@withbuddi/buddi 0.1.0-pre.28 → 0.1.0-pre.30

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -41,6 +41,7 @@
  * No `Access-Control-*` header is ever emitted, and `OPTIONS` is refused: a
  * page on another origin gets no preflight and no permission.
  */
+import { runningAgentRuns } from '@buddi/runtime';
 import { agentMuteRoute, focusRoute, listNotificationsRoute, markSeenRoute, notificationSettingsRoute, presenceRoute, testChannelRoute } from './notifications.js';
 import { catalogSkillLookup, discardProposalFromWeb, keepAllProposalsFromWeb, keepProposalFromWeb, readProposals, registryChangeLookup } from './proposals.js';
 import { latestDigest, readDigestSchedule, setDigestSchedule } from '../agents/learning-digest.js';
@@ -60,18 +61,20 @@ import { mlxhBaseUrl, probeMlxh } from '../mlxh.js';
 import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimOpeningTurn, createFirstAgent, probeOllama, readOnboarding, rebindBrain, updateFirstAgent, withFirstRunFacts, readFirstAgentPersona } from './onboarding.js';
 import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
-import { PAGE_ROUTE, sendPageFile, actOnPage, listPageDescriptors, runPageQuery, } from './pages.js';
+import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
 import { listSecrets, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
-import { getAction, idleRolloverMs, inRecovery, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding } from '@buddi/core';
+import { getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
+import { actOnAlerts, askPrompt, findingsForAsk, muteAlert } from './alerts.js';
 import { connectionsOf } from '@buddi/tool-mcp';
 import { CONNECTIONS_CALLBACK_PATH, connectionsRoute } from './connections.js';
 import { browserHost } from '../browser-host.js';
 import { hostService } from '@buddi/tool-host';
-import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, setOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
+import { listToolPermissions, revokeToolPermission, getArtifact, readArtifactBytes, artifactBytesExist, discardUnreferencedUpload, listLibrary, getLibraryEntry, decodeCursor, filterKey, textPreviewable, readArtifactPrefix, FILE_FAMILIES, LIBRARY_PAGE_MAX, getOwnerProfile, saveOwnerProfile, isKnownTimezone, listGroups, getGroup, createGroup, updateGroup, archiveGroup, deleteGroup, restoreGroup, clearGroupHistory, groupHistorySize, GROUP_UNDO_MS, GroupRefusal, createGroupConversation, listGroupConversations, latestGroupConversation, openGroupRequest, conversationGroup } from '@buddi/core';
 import { beginOnboarding, completeOnboarding, markStepDone, setOnboardingDetails, skipOnboarding, readWebSetting, writeWebSetting } from '@buddi/core';
 import { listMemory, setPreference, forgetPreference, updateNote, forgetNote } from '@buddi/tool-memory';
+import { purgeGroups, stopGroupWork } from './group-lifecycle.js';
 import { engineChangeFromBody, readAgentEngines, readDefaultAgent, readEngineOptions, setAgentEngineFromWeb, setDefaultAgentFromWeb, } from './agents.js';
 import { writeDefaultAgentRecord } from '../agents/default-agent.js';
 import { ownerEditableInput, updateAgentFromOwner, PlatformRefusal } from '../agents/platform.js';
@@ -86,12 +89,12 @@ import { ATTACHMENTS_UNAVAILABLE, CHAT_CONVERSATIONS_LIMIT, CHAT_UNAVAILABLE, WE
 import { readAgentAttention, streamAttention } from './attention.js';
 import { PreviewApp, PreviewTickets, parsePreviewApiPath } from './preview.js';
 import { allowedOrigins, isLoopback, webAssetsDir, webUrl } from './config.js';
-import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
+import { TAILSCALE_SETTING_KEY, daemonWhois, isLoginRefusal, isUnansweredRefusal, plausibleLogin, proxiedThroughTailscale, sameLogin, tailscaleIdentity, tailscaleRefusalReason, tailscaleSelf, toTailscaleSetting, } from './tailscale.js';
 import { retryHref, sendSignedOut, wantsSignedOutPage } from './signed-out.js';
 import { extensionEndpoint } from './extension.js';
 import { REMOTE_HAND_SOCKET_PATH, RemoteHandEndpoint } from './remote-hand.js';
 import { csrfCookieName, CSRF_HEADER, sessionCookieName, requestPort, BodyTooLargeError, first, cookieHeader, parseCookies, parseUrl, readJsonBody, remoteKey, requestOrigin, requestScope, sendEmpty, sendJson, sendText, } from './http.js';
-import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readMissions, readOverview, setGlanceHidden, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
+import { boundedLimit, readAgents, readApprovals, readConversation, readConversations, readEventKinds, readEvents, readJobs, readJobFailures, readMissions, readOverview, setGlanceHidden, readOffers, readReminders, readSentinels, toApprovalView, } from './read.js';
 import { RateLimiter, SessionStore, } from './sessions.js';
 import { supervisorCall } from './service.js';
 import { backupJobRoute, createBackupRoute, discardUpload, listBackups, passphraseRoute, receiveUpload, restoreRoute, scheduleRoute, verifyBackupRoute, } from './backups.js';
@@ -99,16 +102,24 @@ import { acceptAgentRoute, approveRoute, listPlugins, pluginJobRoute, receivePlu
 import { marketAssetRoute, marketRoute } from './market.js';
 import { pluginFoldersRoute } from './folders.js';
 import { tipsRoute } from '../tips/route.js';
+import { createWidgets, widgetsRoute } from './widgets.js';
+import { createRequirements } from '../plugins/requires.js';
+import { placesList, placesRoute } from './places.js';
+import { OWNER_DATE_FORMATS, OWNER_TIME_FORMATS } from '@buddi/core';
 import { readFacts, webSettingsStore } from '../tips/facts.js';
 import { dismissAgentOffer, isPendingAccept, raiseAgentOffers, readAgentOffers, readTeammates } from './agent-offers.js';
 import { currentVersion, upgradeJobRoute, upgradeRoute, versionCheckRoute, versionRoute, } from './version.js';
 import { leaveRecoveryMode, readRecoveryView } from './recovery.js';
 import { readRail, setRailPageHidden } from './rail.js';
 import { BUILD_MISSING, serveAsset, serveShellAtRoot } from './static.js';
-import { StreamBudget, resumeCursor, streamConversation } from './stream.js';
+import { StreamBudget, frame, resumeCursor, streamConversation } from './stream.js';
 import { ensureWebToken, verifyTicket } from './token.js';
 import { MAX_UPLOAD_BYTES, readUpload } from './upload.js';
-import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
+import { LOCKED_BODY, LockUnavailable, allowedWhileLocked, clientOf, createLock } from './lock.js';
+import { matchApiRoute, TOKEN_REFUSALS } from './api-routes.js';
+import { apiTokensRoute, bearerOf, verifyApiToken } from './api-tokens.js';
+import { LockImageRefusal, MAX_LOCK_IMAGE_BYTES, normaliseLockImage } from './lock-image.js';
+import { cancelJobFromWeb, cancelReminderFromWeb, decideApprovalFromWeb, retryJobFromWeb, retryJobsFromWeb, dismissJobsFromWeb, undismissJobsFromWeb, setMissionEnabledFromWeb, setPausedFromWeb, setScheduleFromWeb, dismissOfferFromWeb, dismissOffersFromWeb, takeOfferFromWeb, } from './write.js';
 /** How often approvals past their expiry are swept, and waiting delegations told. */
 export const EXPIRY_SWEEP_MS = 60_000;
 /**
@@ -127,6 +138,16 @@ const WEB_CHATS = new WeakMap();
  * it down, and a caller that built a bare `createWebApp` is unaffected.
  */
 const PREVIEW_APPS = new WeakMap();
+/**
+ * What a dashboard says to its open pages just before it closes: one
+ * `closing` frame on every live stream, naming the restart or stop the page
+ * itself asked for when it was one (`for`), so a page another device or the
+ * CLI restarted under draws "Restarting buddi" rather than errors, and
+ * reloads once the next process answers `/_buddi/ready` with a new `boot`.
+ */
+const CLOSING_SAYS = new WeakMap();
+/** How long a closing frame may take to reach the pages before the sockets go. */
+const CLOSING_FLUSH_MS = 250;
 /** The chat surface this server is running, if any. */
 /** The most of a text file a preview shows; the download has the whole. */
 const PREVIEW_TEXT_BYTES = 100_000;
@@ -232,9 +253,16 @@ export function createWebApp(deps) {
             const session = await sessions.resolve(parseCookies(req.headers.cookie)[sessionCookieName(cookiePort(req))], scope, now);
             if (!session)
                 return null;
+            // A locked dashboard drives nothing (docs/dashboard.md, "Lock screen").
+            if (await lock.locked(session))
+                return null;
             if (session.via === 'tailscale') {
-                const confirmed = await identityOf(req, now);
+                let refusal;
+                const confirmed = await identityOf(req, now, (reason) => { refusal = reason; });
                 if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
+                    // "Could not ask" is not an answer: no socket now, but the session stays.
+                    if (!confirmed && isUnansweredRefusal(refusal))
+                        return null;
                     await sessions.destroy(session.id).catch(() => { });
                     return null;
                 }
@@ -273,6 +301,72 @@ export function createWebApp(deps) {
             return [own, preview].filter((port) => typeof port === 'number');
         },
     });
+    // Plugin readiness and requirements: serve's, or this server's own.
+    const requirements = deps.requirements ??
+        createRequirements({ registry: deps.registry, ctx: deps.ctx, env: deps.env ?? process.env, pool: deps.pool, now: deps.now, log });
+    // Home's widgets: one cache per server (web/widgets.ts).
+    const widgets = createWidgets({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
+    /*
+     * The lock screen (web/lock.ts): which sessions are locked, the PIN, the
+     * gate below. A session that locks has its streams closed and its remote
+     * hand let go on the spot, and every half minute the sessions holding a
+     * stream are asked again, so one left idle past the delay is locked and cut
+     * off even if its page never says a word.
+     */
+    const lock = createLock({ pool: deps.pool, sessions, now: deps.now, get timezone() { return deps.timezone; }, widgets, log });
+    const openStreams = new Map();
+    /*
+     * This process's boot: answered by `/_buddi/ready`, so a page that watches a
+     * restart can tell the process that went from the one that came back.
+     * Random, and nothing else: it says which run this is, not when or where.
+     */
+    const boot = randomUUID();
+    /** Set when a page asked the supervisor to restart or stop this process: what the closing frame says. */
+    let goingAway;
+    /*
+     * The session a live API token acts through: minted on its first request,
+     * kept in memory only, one per token (and scope), so a stream budget or a
+     * sign-in in progress keyed by session id holds across its requests.
+     */
+    const tokenSessions = new Map();
+    const tokenSession = (holder, scope, now) => {
+        const key = `${holder.id}:${scope}`;
+        const held = tokenSessions.get(key);
+        if (held && held.expiresAt.getTime() > now.getTime()) {
+            held.expiresAt = new Date(now.getTime() + held.ttlMs);
+            return held;
+        }
+        for (const [k, s] of tokenSessions)
+            if (s.expiresAt.getTime() <= now.getTime())
+                tokenSessions.delete(k);
+        const session = sessions.create(scope, now, { via: 'token', client: 'api' }, { persist: false });
+        tokenSessions.set(key, session);
+        return session;
+    };
+    const holdStream = (session, res) => {
+        let entry = openStreams.get(session.id);
+        if (!entry)
+            openStreams.set(session.id, (entry = { session, responses: new Set() }));
+        entry.responses.add(res);
+        return () => {
+            const held = openStreams.get(session.id);
+            if (!held)
+                return;
+            held.responses.delete(res);
+            if (held.responses.size === 0)
+                openStreams.delete(session.id);
+        };
+    };
+    lock.onLocked((session) => {
+        hand.revoke((lease) => lease === session.id);
+        for (const res of openStreams.get(session.id)?.responses ?? [])
+            res.end();
+    });
+    const idleSweep = setInterval(() => {
+        for (const { session } of openStreams.values())
+            void lock.locked(session).catch(() => { });
+    }, 30_000);
+    idleSweep.unref();
     const writeDeps = {
         pool: deps.pool,
         registry: deps.registry,
@@ -297,7 +391,7 @@ export function createWebApp(deps) {
             registry: deps.registry,
             ctx: deps.ctx,
             now: deps.now,
-            timezone: deps.timezone,
+            get timezone() { return deps.timezone; },
             log,
             ...deps.chat,
         })
@@ -389,7 +483,6 @@ export function createWebApp(deps) {
     const identityOf = (req, now, onRefusal) => tailscaleIdentity(req, {
         setting: readTailscaleSetting,
         whois,
-        mayAskDaemon: () => !limiter.blocked(remoteKey(req), now),
         log,
         now: () => now,
         onRefusal,
@@ -406,6 +499,51 @@ export function createWebApp(deps) {
             cookieHeader(csrfCookieName(cookiePort(req)), session.csrf, { httpOnly: false, maxAgeSeconds, secure: session.scope === 'remote' && !!deps.config.publicOrigin }),
         ];
     };
+    /**
+     * The same pair, expired: what a response carries when the browser presented
+     * a session that is gone, so it stops presenting it. A forgotten tab or a
+     * polling page then sends no credential at all, which counts as nothing.
+     */
+    const expiredCookies = (req) => {
+        const secure = requestScope(req) === 'remote' && !!deps.config.publicOrigin;
+        return [
+            cookieHeader(sessionCookieName(cookiePort(req)), '', { httpOnly: true, maxAgeSeconds: 0, secure }),
+            cookieHeader(csrfCookieName(cookiePort(req)), '', { httpOnly: false, maxAgeSeconds: 0, secure }),
+        ];
+    };
+    /**
+     * What the signed-out page should offer this request: how it arrived,
+     * whether Tailscale can sign it in, and whether a lockout is running.
+     */
+    const signedOutFor = async (req, pathname, search, now, refusal) => {
+        const proxied = proxiedThroughTailscale(req);
+        let publicHost;
+        try {
+            publicHost = deps.config.publicOrigin ? new URL(deps.config.publicOrigin).hostname : undefined;
+        }
+        catch {
+            publicHost = undefined;
+        }
+        let host;
+        try {
+            host = req.headers.host ? new URL(`http://${req.headers.host}`).hostname : undefined;
+        }
+        catch {
+            host = undefined;
+        }
+        const scope = requestScope(req);
+        const arrived = proxied || (publicHost !== undefined && host === publicHost) ? 'tailnet' : scope === 'local' ? 'local' : 'remote';
+        const setting = arrived === 'tailnet' ? await readTailscaleSetting() : null;
+        const lockedForMs = limiter.retryAfterMs(remoteKey(req), now);
+        return {
+            retry: retryHref(pathname, search),
+            arrived,
+            tailscaleSignIn: !!setting?.enabled && !isLoginRefusal(refusal),
+            ...(isLoginRefusal(refusal) ? { tailscaleRefusal: tailscaleRefusalReason(refusal) } : {}),
+            ...(isUnansweredRefusal(refusal) ? { tailscaleUnanswered: true } : {}),
+            ...(lockedForMs > 0 ? { lockedForMs } : {}),
+        };
+    };
     /**
      * The port this request's cookies are named after (http.ts says why they
      * carry one): the port the browser sees, from the request's Host, so the
@@ -434,6 +572,13 @@ export function createWebApp(deps) {
     // have to unpack.
     const server = createServer((req, res) => {
         handle(req, res).catch((err) => {
+            // The lock could not say whether this request may pass: refused, never let in (web/lock.ts).
+            if (err instanceof LockUnavailable) {
+                log('web: the lock screen\'s state could not be read; refusing until it can');
+                if (!res.headersSent)
+                    return sendEmpty(res, 503, { 'Retry-After': '5' });
+                return res.end();
+            }
             // A defect is a 500 with nothing in it. The sentence goes to the log,
             // where only the owner can read it.
             log(`web: ${req.method} ${req.url} failed: ${err instanceof Error ? err.stack : String(err)}`);
@@ -446,11 +591,36 @@ export function createWebApp(deps) {
     if (chat)
         WEB_CHATS.set(server, chat);
     PREVIEW_APPS.set(server, previews);
+    CLOSING_SAYS.set(server, async () => {
+        const said = frame('closing', goingAway === undefined ? {} : { for: goingAway });
+        const flushed = [];
+        for (const { responses } of openStreams.values()) {
+            for (const res of responses) {
+                if (res.writableEnded || res.destroyed)
+                    continue;
+                // Ended, not just written: an ended response is flushed before its
+                // socket goes, where a frame still queued would be dropped with it.
+                flushed.push(new Promise((resolve) => {
+                    try {
+                        res.end(said, () => resolve());
+                    }
+                    catch {
+                        resolve();
+                    }
+                }));
+            }
+        }
+        if (flushed.length === 0)
+            return;
+        let timer;
+        await Promise.race([Promise.all(flushed), new Promise((resolve) => { timer = setTimeout(resolve, CLOSING_FLUSH_MS); })]);
+        clearTimeout(timer);
+    });
     // "Your browser": the only path this server ever upgrades. Attached here
     // rather than in `startWebServer` so every caller, tests included, has it.
     extension.attach(server);
     extension.attachPath(REMOTE_HAND_SOCKET_PATH, (req, socket, head) => hand.upgrade(req, socket, head));
-    server.once('close', () => { extension.shutdown(); hand.shutdown(); });
+    server.once('close', () => { extension.shutdown(); hand.shutdown(); clearInterval(idleSweep); });
     return server;
     async function handle(req, res) {
         const now = deps.now();
@@ -462,11 +632,13 @@ export function createWebApp(deps) {
             return sendEmpty(res, 405);
         // A port answering 401 is not evidence that this installation is ready.
         // Domain-separated challenge proof never sends the install secret to that port.
-        if (method === 'GET' && url.pathname === '/_buddi/ready' && deps.env?.BUDDI_WEB_REQUIRE_AUTH === '1') {
+        // Answered on every binding: `buddi mcp` asks it before it presents a
+        // ticket, so a port held by some other buddi never sees one.
+        if (method === 'GET' && url.pathname === '/_buddi/ready') {
             const challenge = url.searchParams.get('challenge') ?? '';
             if (!/^[a-f0-9]{64}$/.test(challenge))
                 return sendEmpty(res, 400);
-            return sendJson(res, 200, { proof: createHmac('sha256', deps.token).update(`buddi-ready-v1:${challenge}`).digest('hex') });
+            return sendJson(res, 200, { proof: createHmac('sha256', deps.token).update(`buddi-ready-v1:${challenge}`).digest('hex'), boot }, { 'Cache-Control': 'no-store' });
         }
         // A remote socket or proxy metadata can only earn remote access. It
         // decides how long a session minted now lives, and it must keep matching
@@ -505,7 +677,9 @@ export function createWebApp(deps) {
                 return sendText(res, 401, 'This sign-in link is no longer valid: a link lasts five minutes.\nRun `buddi` again for a fresh one.\n');
             }
             limiter.reset(key);
-            const session = sessions.create(scope, now);
+            // A ticket takes the installation's token, so it is the one way in that
+            // opens a session unlocked: what `buddi dashboard --unlock` hands out.
+            const session = sessions.create(scope, now, { via: scope === 'local' ? 'local' : 'ticket', client: clientOf(req.headers['x-buddi-client']) });
             const clean = new URL(url.toString());
             clean.searchParams.delete(TICKET_PARAM);
             return sendEmpty(res, 302, {
@@ -513,6 +687,43 @@ export function createWebApp(deps) {
                 'Set-Cookie': sessionCookies(req, session),
             });
         }
+        /*
+         * An owner API token (docs/api.md, "Authentication"): `Authorization:
+         * Bearer buddi_…` on an /api request, from a script or another program.
+         *
+         * It is a credential presented, so a wrong or revoked one counts as a
+         * failed sign-in for this address exactly as a stale cookie does. A live
+         * one is the owner with no cookie and therefore no CSRF to check, and is
+         * answered only on a route the table lets a token call: never one that
+         * decides an approval, changes a grant, installs code, opens access or
+         * touches a secret. The lock screen does not cover it.
+         */
+        const bearer = url.pathname === '/api' || url.pathname.startsWith('/api/') ? bearerOf(req.headers.authorization) : undefined;
+        if (bearer !== undefined) {
+            if (limiter.blocked(key, now)) {
+                return sendEmpty(res, 429, { 'Retry-After': String(Math.max(1, Math.ceil(limiter.retryAfterMs(key, now) / 1000))) });
+            }
+            let holder;
+            try {
+                holder = await verifyApiToken(deps.pool, bearer, now);
+            }
+            catch (err) {
+                log(`web: checking an API token failed: ${err instanceof Error ? err.message : String(err)}`);
+                return sendEmpty(res, 503, { 'Retry-After': '5' });
+            }
+            if (!holder) {
+                limiter.failCredential(key, bearer, now);
+                return sendEmpty(res, 401, { 'WWW-Authenticate': 'Bearer realm="buddi"' });
+            }
+            const path = url.pathname.replace(/\/+$/, '') || '/api';
+            const route = matchApiRoute(method, path);
+            if (!route)
+                return method === 'GET' || method === 'HEAD' ? sendJson(res, 404, { error: 'no such endpoint' }) : sendEmpty(res, 405);
+            if (route.token) {
+                return sendJson(res, 403, { error: `An API token cannot call ${route.method} ${route.path}. ${TOKEN_REFUSALS[route.token]} Do it on the dashboard.` });
+            }
+            return api(req, res, url, method, now, tokenSession(holder, scope, now));
+        }
         const cookies = parseCookies(req.headers.cookie);
         const presentedSession = cookies[sessionCookieName(cookiePort(req))];
         let session = await sessions.resolve(presentedSession, scope, now);
@@ -523,18 +734,29 @@ export function createWebApp(deps) {
          */
         let refusal;
         const noteRefusal = (reason) => { refusal = reason; };
+        /*
+         * Set when the browser presented a session that is gone: the refusal then
+         * expires its cookies, so it stops presenting them (and stops counting).
+         */
+        let forgetCookies = false;
         /*
          * The answer to a refused request: the signed-out page for a person
-         * opening a page, the empty 401 for everything else (docs/web.md).
+         * opening a page, the empty status for everything else (docs/web.md).
+         * 401 is "signed out", 429 "too many tries from here", 503 "Tailscale
+         * could not be asked; the session is still good, try again".
          */
-        const refuse = () => {
+        const refuse = async (status = 401) => {
+            const headers = forgetCookies ? { 'Set-Cookie': expiredCookies(req) } : {};
+            if (status === 429)
+                headers['Retry-After'] = String(Math.max(1, Math.ceil(limiter.retryAfterMs(key, now) / 1000)));
+            if (status === 503)
+                headers['Retry-After'] = '5';
             if (!wantsSignedOutPage(req, method, url.pathname))
-                return sendEmpty(res, 401);
-            return sendSignedOut(res, {
-                retry: retryHref(url.pathname, url.search),
-                ...(isLoginRefusal(refusal) ? { tailscaleRefusal: tailscaleRefusalReason(refusal) } : {}),
-            });
+                return sendEmpty(res, status, headers);
+            return sendSignedOut(res, await signedOutFor(req, url.pathname, url.search, now, refusal), headers, status);
         };
+        /* A Tailscale session this request ended: not a guess, so never a failed sign-in. */
+        let revoked = false;
         /*
          * A Tailscale session is re-confirmed on every single request.
          *
@@ -550,14 +772,23 @@ export function createWebApp(deps) {
         if (session?.via === 'tailscale') {
             const confirmed = await identityOf(req, now, noteRefusal);
             if (!confirmed || !sameLogin(confirmed.login, session.tailscaleLogin)) {
-                const revoked = session.id;
+                /*
+                 * The daemon could not be asked (busy, starting, timed out). That is
+                 * not an answer about anyone, so the session is not ended for it —
+                 * a restart's first burst of requests used to end every tailnet
+                 * session this way — and nothing is counted. This request waits.
+                 */
+                if (!confirmed && isUnansweredRefusal(refusal))
+                    return refuse(503);
+                const ended = session.id;
                 // A hand this session was holding does not outlive the session.
-                hand.revoke((lease) => lease === revoked);
-                await sessions.destroy(revoked);
-                if (limiter.blocked(key, now))
-                    return sendEmpty(res, 429);
-                limiter.failCredential(key, presentedSession ?? '', now);
-                return refuse();
+                hand.revoke((lease) => lease === ended);
+                await sessions.destroy(ended);
+                session = undefined;
+                revoked = true;
+                forgetCookies = true;
+                // The identity on this very request may still earn a new session below.
+                refusal = undefined;
             }
         }
         /*
@@ -571,7 +802,14 @@ export function createWebApp(deps) {
         if (!session && openAccess && scope === 'local') {
             // Not stored: the next request mints another for free, so there is
             // nothing to keep across a restart and no row per cookie-less poll.
-            session = sessions.create(scope, now, undefined, { persist: false });
+            // While a PIN is set a browser's new session starts locked: clearing the
+            // cookie or opening a private window is not a way past the lock screen.
+            //
+            // Always a browser's session: `x-buddi-client` is a header anybody can
+            // send, so here it earns nothing. Only a ticket from the installation
+            // token (the exchange above) names a client the lock does not cover.
+            const locked = await lock.startLocked('browser');
+            session = sessions.create(scope, now, { via: 'local', client: 'browser' }, { persist: false, ...(locked ? { locked } : {}) });
             res.setHeader('Set-Cookie', sessionCookies(req, session));
         }
         /*
@@ -589,12 +827,13 @@ export function createWebApp(deps) {
             const identity = await identityOf(req, now, noteRefusal);
             if (identity) {
                 limiter.reset(key);
+                const locked = await lock.startLocked('browser');
                 session = sessions.create('remote', now, {
                     via: 'tailscale',
                     tailscaleLogin: identity.login,
                     tailscaleAddress: identity.address,
                     tailscaleName: identity.name,
-                });
+                }, locked ? { locked } : {});
                 res.setHeader('Set-Cookie', sessionCookies(req, session));
             }
         }
@@ -610,8 +849,11 @@ export function createWebApp(deps) {
             // able to lock the owner out of every way in.
             if (!presentedSession)
                 return refuse();
+            forgetCookies = true;
+            if (revoked)
+                return refuse();
             if (limiter.blocked(key, now))
-                return sendEmpty(res, 429);
+                return refuse(429);
             limiter.failCredential(key, presentedSession, now);
             return refuse();
         }
@@ -641,6 +883,14 @@ export function createWebApp(deps) {
                 return sendEmpty(res, 403);
         }
         if (url.pathname === '/api' || url.pathname.startsWith('/api/')) {
+            /*
+             * The lock screen's gate, after the session and its CSRF: a locked
+             * session gets 423 for everything but what the lock screen itself
+             * draws and the two ways off it (web/lock.ts).
+             */
+            const path = url.pathname.replace(/\/+$/, '') || '/api';
+            if (!allowedWhileLocked(method, path) && (await lock.locked(session)))
+                return sendJson(res, 423, LOCKED_BODY);
             return api(req, res, url, method, now, session);
         }
         if (mutating)
@@ -690,6 +940,7 @@ export function createWebApp(deps) {
             log,
             pool: deps.pool,
             registry: deps.registry,
+            requirements,
             ...(deps.plugins ? { engine: deps.plugins } : {}),
         });
         /** Is a mailbox connected? The email plugin's own read, the one Home's offer asks. */
@@ -764,6 +1015,24 @@ export function createWebApp(deps) {
                     now: deps.now,
                     agents: () => deps.catalog.list(),
                     plugins: () => deps.registry.manifests().map((m) => m.name),
+                    needsSetup: async () => {
+                        const out = [];
+                        for (const manifest of deps.registry.manifests()) {
+                            if (manifest.setup === undefined)
+                                continue;
+                            const ready = await requirements.readiness.of(manifest.name);
+                            if (!ready || ready.ready)
+                                continue;
+                            const page = ready.page === undefined ? undefined : deps.registry.pages().find((p) => p.plugin === manifest.name && p.id === ready.page);
+                            const route = page === undefined
+                                ? undefined
+                                : page.place === 'settings'
+                                    ? `#/settings/p.${manifest.name}${page.id === manifest.name ? '' : `.${page.id}`}`
+                                    : `#/p/${encodeURIComponent(manifest.name)}/${encodeURIComponent(page.id)}`;
+                            out.push({ plugin: manifest.name, ...(ready.note ? { note: ready.note } : {}), ...(route ? { route } : {}) });
+                        }
+                        return out;
+                    },
                     mailboxSet: async () => {
                         const answer = await runPageQuery(pagesDeps(), 'email', 'triage_offer', new URLSearchParams()).catch(() => null);
                         return answer?.status === 200 && answer.body?.data?.wanted === true;
@@ -772,6 +1041,74 @@ export function createWebApp(deps) {
             }, { method, path, body, preview: url.searchParams.get('preview') });
             return sendJson(res, answer.status, answer.body);
         }
+        // The lock screen: its state and data, Lock now, Unlock, the PIN, its settings and picture (web/lock.ts).
+        if (path === '/api/lock' || path.startsWith('/api/lock/')) {
+            let body = {};
+            const upload = method === 'POST' && path === '/api/lock/background';
+            if ((method === 'POST' || method === 'PUT') && !upload) {
+                try {
+                    body = await readJsonBody(req);
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await lock.route({
+                method,
+                path,
+                body,
+                session,
+                query: url.searchParams,
+                ...(upload ? {
+                    upload: async () => {
+                        const file = await readUpload(req, MAX_LOCK_IMAGE_BYTES);
+                        if (!file.ok)
+                            return { ok: false, status: file.status, error: file.status === 413 ? 'A picture can be at most 10 MB.' : file.error };
+                        try {
+                            return { ok: true, image: normaliseLockImage(file.file.bytes, file.file.mime) };
+                        }
+                        catch (err) {
+                            if (err instanceof LockImageRefusal)
+                                return { ok: false, status: err.status, error: err.message };
+                            throw err;
+                        }
+                    },
+                } : {}),
+            });
+            if (answer === null)
+                return sendJson(res, 404, { error: 'no such endpoint' });
+            if ('image' in answer) {
+                const etag = `"${answer.image.sha256}"`;
+                res.setHeader('ETag', etag);
+                res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+                if (req.headers['if-none-match'] === etag)
+                    return sendEmpty(res, 304);
+                res.setHeader('Content-Type', 'image/jpeg');
+                res.setHeader('Content-Length', String(answer.image.jpeg.length));
+                res.statusCode = 200;
+                res.end(method === 'HEAD' ? undefined : answer.image.jpeg);
+                return;
+            }
+            if (answer.status === 204)
+                return sendEmpty(res, 204);
+            return sendJson(res, answer.status, answer.body);
+        }
+        // Home's widgets: the gallery, the owner's layout, each placed one's body (web/widgets.ts).
+        if (path === '/api/widgets' || path.startsWith('/api/widgets/')) {
+            let body = {};
+            if (method === 'PUT' || (method === 'POST' && path === '/api/widgets/preview')) {
+                try {
+                    body = await readJsonBody(req);
+                }
+                catch {
+                    return sendJson(res, 400, { error: 'request body must be JSON' });
+                }
+            }
+            const answer = await widgetsRoute(widgets, { method, path, body, query: url.searchParams });
+            return sendJson(res, answer.status, answer.body);
+        }
         // Settings → Connections: every method, one module (web/connections.ts).
         if (path === '/api/connections' || path.startsWith('/api/connections/')) {
             let body = {};
@@ -952,10 +1289,14 @@ export function createWebApp(deps) {
                     res.end(method === 'HEAD' ? undefined : bytes);
                     return;
                 }
-                case '/api/session':
+                case '/api/session': {
+                    // How the owner reads times and dates: every page formats with it.
+                    const formats = await getOwnerProfile(deps.pool).catch(() => null);
                     return sendJson(res, 200, {
                         csrf: session.csrf,
                         timezone: deps.timezone,
+                        timeFormat: formats?.timeFormat ?? null,
+                        dateFormat: formats?.dateFormat ?? null,
                         host: deps.config.host,
                         port: deps.config.port,
                         // Where buddi runs: a page opened from another machine is still
@@ -979,6 +1320,7 @@ export function createWebApp(deps) {
                         // the old one" without a second route.
                         version: await currentVersion(deps.env ?? process.env),
                     });
+                }
                 /*
                  * The Tailscale panel's whole payload: what is stored, whether a
                  * daemon is here to ask, who this machine is signed in as (so the
@@ -1010,7 +1352,9 @@ export function createWebApp(deps) {
                             timezone: deps.timezone,
                             now,
                         })),
-                        running: chat?.runningCount ?? 0,
+                        // Every surface's runs (Telegram, the queue, the terminal), not only
+                        // this dashboard's; a chat send still being set up counts too.
+                        running: Math.max(runningAgentRuns(), chat?.runningCount ?? 0),
                     });
                 case '/api/events':
                     return sendJson(res, 200, await readEvents(deps.pool, {
@@ -1035,8 +1379,16 @@ export function createWebApp(deps) {
                         kind: q.get('kind') ?? undefined,
                         limit: boundedLimit(q.get('limit')),
                         offset: Math.max(0, Math.min(Number(q.get('offset') ?? 0) || 0, 100_000)),
+                        failed: q.get('failed') === 'open' || q.get('failed') === 'dismissed' ? q.get('failed') : undefined,
+                        hideDismissed: q.get('dismissed') === '0',
                     }));
                 }
+                // Failed jobs grouped by what broke them: the ones still asking, and
+                // the dismissed ones (by the owner, or quiet after 14 days) apart.
+                case '/api/jobs/failures': {
+                    const names = new Map(deps.catalog.list().map((a) => [a.id, a.name]));
+                    return sendJson(res, 200, await readJobFailures(deps.pool, now, (id) => names.get(id) ?? null));
+                }
                 case '/api/approvals': {
                     const approvals = await readApprovals(deps.pool, now, boundedLimit(q.get('limit'), 50));
                     return sendJson(res, 200, { pending: approvals.pending.map(a => ({ ...a, ...permissionScopes(a.tool) })),
@@ -1068,7 +1420,7 @@ export function createWebApp(deps) {
                         reminders: await readReminders(deps.pool, boundedLimit(q.get('limit'))),
                     });
                 case '/api/sentinels':
-                    return sendJson(res, 200, await readSentinels(deps.pool, deps.registry, boundedLimit(q.get('limit'), 50)));
+                    return sendJson(res, 200, await readSentinels(deps.pool, deps.registry, deps.now()));
                 case '/api/chat/agents':
                     return sendJson(res, 200, readChatAgents(deps.catalog, await avatarVersions(deps.pool)));
                 // Which agents are waiting on the owner. One small query, and the only
@@ -1113,6 +1465,8 @@ export function createWebApp(deps) {
                         default: readDefaultAgent(deps.catalog),
                     });
                 case '/api/groups':
+                    // The list is read every few seconds, so it is also where a delete whose minute has passed is made final.
+                    await purgeGroups(deps.pool, deps.now(), log);
                     return sendJson(res, 200, { groups: (await listGroups(deps.pool)).map(groupView) });
                 /*
                  * The supervisor, when there is one. A developer checkout has no
@@ -1237,7 +1591,7 @@ export function createWebApp(deps) {
                     return sendJson(res, 200, await telegramDevices(telegramDeps()));
                 case '/api/owner': {
                     const profile = await getOwnerProfile(deps.pool);
-                    return sendJson(res, 200, { ...profile, detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+                    return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
                 }
                 case '/api/memory': {
                     try {
@@ -1249,6 +1603,9 @@ export function createWebApp(deps) {
                         return sendJson(res, 503, { error: `Memory is unavailable: ${err instanceof Error ? err.message : String(err)}` });
                     }
                 }
+                // Settings → API tokens. A token is refused these by the table: it cannot list or make its kind.
+                case '/api/api-tokens':
+                    return reply(res, await apiTokensRoute(deps.pool, { method, path, body: null, now }));
                 case '/api/provider-accounts':
                     if (!deps.providerAccounts)
                         return sendJson(res, 503, { error: 'Provider accounts are unavailable in this process.' });
@@ -1420,7 +1777,13 @@ export function createWebApp(deps) {
                     return sendJson(res, 404, { error: 'no such group' });
                 const latest = await latestGroupConversation(deps.pool, group.id);
                 const open = latest ? await openGroupRequest(deps.pool, latest) : null;
-                return sendJson(res, 200, { ...groupView(group), latestConversationId: latest, openRequest: open ? { id: open.id, state: open.state, awaitingAgentId: open.awaitingAgentId, budgetReserved: open.budgetReserved, budgetTotal: open.budgetTotal } : null });
+                return sendJson(res, 200, {
+                    ...groupView(group),
+                    latestConversationId: latest,
+                    openRequest: open ? { id: open.id, state: open.state, awaitingAgentId: open.awaitingAgentId, budgetReserved: open.budgetReserved, budgetTotal: open.budgetTotal } : null,
+                    // What Clear history and Delete would take, for the sentence that asks first.
+                    history: await groupHistorySize(deps.pool, group.id),
+                });
             }
             const chatConversations = /^\/api\/chat\/([^/]+)\/conversations$/.exec(path);
             if (chatConversations) {
@@ -1449,6 +1812,7 @@ export function createWebApp(deps) {
                 const release = streams.take(session.id);
                 if (release === null)
                     return sendEmpty(res, 429);
+                const let_go = holdStream(session, res);
                 try {
                     await streamAttention(req, res, {
                         pool: deps.pool,
@@ -1457,6 +1821,7 @@ export function createWebApp(deps) {
                     });
                 }
                 finally {
+                    let_go();
                     release();
                 }
                 return;
@@ -1472,6 +1837,7 @@ export function createWebApp(deps) {
                 const release = streams.take(session.id);
                 if (release === null)
                     return sendEmpty(res, 429);
+                const let_go = holdStream(session, res);
                 try {
                     await streamConversation(req, res, {
                         pool: deps.pool,
@@ -1482,6 +1848,7 @@ export function createWebApp(deps) {
                     });
                 }
                 finally {
+                    let_go();
                     release();
                 }
                 return;
@@ -1545,6 +1912,12 @@ export function createWebApp(deps) {
                 const forgotten = await extension.unpair();
                 return sendJson(res, forgotten.status, forgotten.body);
             }
+            // Revoke an API token: the next request carrying it is a 401.
+            const tokenGone = /^\/api\/api-tokens\/([0-9a-f-]{36})$/i.exec(path);
+            if (tokenGone) {
+                const revoked = await apiTokensRoute(deps.pool, { method, path, body: null, now });
+                return revoked.status === 204 ? sendEmpty(res, 204) : sendJson(res, revoked.status, revoked.body);
+            }
             // A phone the owner no longer wants talking to their agents. Same as
             // `buddi telegram unpair <id>`, and as immediate.
             const phoneGone = /^\/api\/telegram\/devices\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(path);
@@ -1560,14 +1933,21 @@ export function createWebApp(deps) {
                 }
             }
             /*
-             * A group the owner is done with leaves the rail and takes no new
-             * requests — and keeps everything that was said in it. Archived, never
-             * deleted: the transcript is the record of work that was done, and no
-             * amount of tidying the roster is worth destroying it.
+             * Delete a group: it leaves every list now, with whatever it was doing
+             * stopped, and is removed for good — its history and what the room
+             * remembered, never its agents — once GROUP_UNDO_MS has passed without
+             * a restore. The answer says until when Undo works.
              */
             const groupGone = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(path);
             if (groupGone) {
-                return (await archiveGroup(deps.pool, groupGone[1], deps.now())) ? sendEmpty(res, 204) : sendEmpty(res, 404);
+                const at = deps.now();
+                if (!(await getGroup(deps.pool, groupGone[1])))
+                    return sendJson(res, 404, { error: 'no such group' });
+                await stopGroupWork(deps.pool, chat, groupGone[1], at, deps.ctx.ownerId);
+                if (!(await deleteGroup(deps.pool, groupGone[1], at)))
+                    return sendJson(res, 404, { error: 'no such group' });
+                await purgeGroups(deps.pool, at, log);
+                return sendJson(res, 200, { undoUntil: new Date(at.getTime() + GROUP_UNDO_MS).toISOString() });
             }
             /*
              * The owner read the note a rollover carried into this conversation and
@@ -1900,6 +2280,8 @@ export function createWebApp(deps) {
         }
         if (path === '/api/presence')
             return reply(res, await presenceRoute(deps.pool, body, deps.now()));
+        if (path === '/api/api-tokens')
+            return reply(res, await apiTokensRoute(deps.pool, { method, path, body, now }));
         if (path === '/api/notifications/test')
             return reply(res, await testChannelRoute(body, deps.now()));
         if (path === '/api/notifications/agent-mute')
@@ -1937,14 +2319,64 @@ export function createWebApp(deps) {
                 return sendJson(res, 400, { error: 'Expected agentId and conversationId.' });
             return sendJson(res, 200, { stopped: host.stop(deps.ctx.ownerId, body.agentId, body.conversationId) });
         }
+        /*
+         * Alerts (alerts.ts): the owner's verbs on what the watchers found. Snooze
+         * one ("Not now" for a week with `days`, "Not needed" without), several at
+         * once (Clear all, and its Undo), silence a subject or a kind, run what a
+         * finding declared, or ask the agent that answers for it.
+         */
         const alert = /^\/api\/alerts\/([^/]+)\/snooze$/.exec(path);
         if (alert) {
             if (typeof body.snoozed !== 'boolean')
                 return sendJson(res, 400, { error: '`snoozed` must be true or false' });
-            const finding = await snoozeFinding(deps.pool, decodeURIComponent(alert[1]), body.snoozed, deps.now());
+            const days = typeof body.days === 'number' && Number.isFinite(body.days) && body.days > 0 && body.days <= 90 ? body.days : null;
+            const until = body.snoozed && days !== null ? new Date(deps.now().getTime() + days * 86_400_000) : null;
+            const finding = await snoozeFinding(deps.pool, decodeURIComponent(alert[1]), body.snoozed, deps.now(), until);
             if (!finding)
                 return sendJson(res, 404, { error: 'No open alert has that key.' });
-            return sendJson(res, 200, { key: finding.key, snoozedAt: finding.snoozedAt ? finding.snoozedAt.toISOString() : null });
+            return sendJson(res, 200, {
+                key: finding.key,
+                snoozedAt: finding.snoozedAt ? finding.snoozedAt.toISOString() : null,
+                snoozedUntil: finding.snoozedUntil ? finding.snoozedUntil.toISOString() : null,
+            });
+        }
+        if (path === '/api/alerts/snooze') {
+            const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === 'string').slice(0, 500) : null;
+            if (keys === null || typeof body.snoozed !== 'boolean')
+                return sendJson(res, 400, { error: 'Send `{ keys: string[], snoozed: boolean, days? }`.' });
+            const days = typeof body.days === 'number' && Number.isFinite(body.days) && body.days > 0 && body.days <= 90 ? body.days : null;
+            const until = body.snoozed && days !== null ? new Date(deps.now().getTime() + days * 86_400_000) : null;
+            return sendJson(res, 200, { keys: await snoozeFindings(deps.pool, keys, body.snoozed, deps.now(), until) });
+        }
+        if (path === '/api/alerts/mute')
+            return reply(res, await muteAlert(deps.pool, body, deps.now()));
+        const unmute = /^\/api\/alerts\/mutes\/([^/]+)\/remove$/.exec(path);
+        if (unmute) {
+            const removed = await unmuteFindings(deps.pool, decodeURIComponent(unmute[1]));
+            return removed ? sendJson(res, 200, { removed: true }) : sendJson(res, 404, { error: 'Nothing is silenced under that id.' });
+        }
+        if (path === '/api/alerts/act') {
+            if (actRateLimited(session.id, deps.now().getTime()))
+                return sendJson(res, 429, { error: 'Too many writes from this page. Wait a moment and try again.' });
+            return reply(res, await actOnAlerts({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now }, body, session));
+        }
+        if (path === '/api/alerts/ask') {
+            const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === 'string') : [];
+            const findings = await findingsForAsk(deps.pool, keys);
+            if (findings.length === 0)
+                return sendJson(res, 404, { error: 'No alert has those keys.' });
+            if (!chat)
+                return sendJson(res, 503, { error: 'Chat is not running in this process.' });
+            // The agent that answers for them, else whoever runs the wake mission.
+            const wake = (await listMissions(deps.pool)).find((m) => m.id === 'sentinel-wake');
+            const agentId = findings.find((f) => f.agentId !== null && deps.catalog.get(f.agentId) !== undefined)?.agentId ?? wake?.agentId ?? null;
+            if (agentId === null)
+                return sendJson(res, 409, { error: 'No agent answers for this alert yet.' });
+            const { label, prompt } = askPrompt(findings);
+            const sent = await chat.send({ agentId, text: prompt, offer: { id: `alert:${findings[0].key}`.slice(0, 200), label, brief: true } });
+            if (!sent.ok)
+                return sendJson(res, sent.status, { error: sent.error });
+            return sendJson(res, 200, { agentId, conversationId: sent.conversationId, runId: sent.runId });
         }
         /*
          * A watcher, switched off or back on. Off means it does not run: it raises
@@ -2200,8 +2632,10 @@ export function createWebApp(deps) {
             }
             const outcome = await leaveRecoveryMode({ pool: deps.pool, env: deps.env ?? process.env, log }, deps.ctx.ownerId, { dropPending: body.dropPending !== false, keepGrants: keep }, now);
             if (socket) {
+                goingAway = 'restart';
                 res.once('finish', () => {
                     void supervisorCall(socket, '/restart', 'POST').catch((err) => {
+                        goingAway = undefined;
                         log(`web: supervisor restart after leaving recovery failed: ${err instanceof Error ? err.message : String(err)}`);
                     });
                 });
@@ -2241,8 +2675,10 @@ export function createWebApp(deps) {
                     return sendJson(res, 503, { error: 'The supervisor is not answering on its control socket. Run buddi in a terminal.' });
                 }
             }
+            goingAway = action === 'stop' ? 'stop' : 'restart';
             res.once('finish', () => {
                 void supervisorCall(socket, `/${action}`, 'POST').catch((err) => {
+                    goingAway = undefined;
                     log(`web: supervisor ${action} failed: ${err instanceof Error ? err.message : String(err)}`);
                 });
             });
@@ -2301,6 +2737,21 @@ export function createWebApp(deps) {
         if (groupArchive) {
             return (await archiveGroup(deps.pool, groupArchive[1], deps.now())) ? sendEmpty(res, 204) : sendEmpty(res, 404);
         }
+        // Undo a delete, while the minute lasts. Too late: 410, and the page says so.
+        const groupRestore = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/restore$/i.exec(path);
+        if (groupRestore) {
+            const back = await restoreGroup(deps.pool, groupRestore[1], deps.now());
+            return back ? sendJson(res, 200, groupView(back)) : sendJson(res, 410, { error: 'Too late to undo: that group is gone for good.' });
+        }
+        // Clear the history, keep the group: its conversations go, its members and memory stay.
+        const groupClear = /^\/api\/groups\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/clear$/i.exec(path);
+        if (groupClear) {
+            const group = await getGroup(deps.pool, groupClear[1]);
+            if (!group)
+                return sendJson(res, 404, { error: 'no such group' });
+            await stopGroupWork(deps.pool, chat, group.id, deps.now(), deps.ctx.ownerId);
+            return sendJson(res, 200, { conversations: await clearGroupHistory(deps.pool, group.id) });
+        }
         /*
          * First run, from the dashboard.
          *
@@ -2532,14 +2983,37 @@ export function createWebApp(deps) {
                     return sendJson(res, 400, { error: `\`${key}\` must be a string or null` });
                 patch[key] = given;
             }
+            // How times and dates read: a known word, or null for Auto.
+            if (body.timeFormat !== undefined) {
+                if (body.timeFormat !== null && !OWNER_TIME_FORMATS.includes(body.timeFormat))
+                    return sendJson(res, 400, { error: '`timeFormat` is 12h, 24h or null (Auto).' });
+                patch.timeFormat = body.timeFormat;
+            }
+            if (body.dateFormat !== undefined) {
+                if (body.dateFormat !== null && !OWNER_DATE_FORMATS.includes(body.dateFormat))
+                    return sendJson(res, 400, { error: '`dateFormat` is short, long, iso or null (Auto).' });
+                patch.dateFormat = body.dateFormat;
+            }
             if (patch.timezone && !isKnownTimezone(patch.timezone))
                 return sendJson(res, 400, { error: `"${patch.timezone}" is not a timezone this host knows.` });
             if (patch.preferredName && patch.preferredName.length > 80)
                 return sendJson(res, 400, { error: 'The name is too long (80 characters at most).' });
             if (patch.about && patch.about.length > 1000)
                 return sendJson(res, 400, { error: 'Keep the line about you under 1,000 characters.' });
-            const profile = await setOwnerProfile(deps.pool, patch);
-            return sendJson(res, 200, { ...profile, detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+            // The zone applies at once; schedules kept in the old one move with it.
+            const { profile, zoneChange } = await saveOwnerProfile(deps.pool, patch, deps.env ?? process.env);
+            if (zoneChange)
+                log(`owner: timezone ${zoneChange.from} → ${zoneChange.to}${zoneChange.missions.length > 0 ? `; moved ${zoneChange.missions.join(', ')}` : ''}`);
+            return sendJson(res, 200, { ...profile, places: await placesList(deps.pool), detectedTimezone: Intl.DateTimeFormat().resolvedOptions().timeZone, zones: knownTimezones() });
+        }
+        /* The owner's places beside the timezone: find one, save one, remove one (web/places.ts). */
+        if (path.startsWith('/api/owner/places')) {
+            const answered = await placesRoute({ pool: deps.pool, log, ...(deps.placesHttp ? { http: deps.placesHttp } : {}) }, path, body);
+            if (answered) {
+                // Plugins that read the places answer their setup again now.
+                requirements.readiness.forget();
+                return sendJson(res, answered.status, answered.body);
+            }
         }
         /* Memory, the owner's side: correct a preference, retire one, edit or forget a note. */
         if (path === '/api/memory/preferences') {
@@ -2645,6 +3119,14 @@ export function createWebApp(deps) {
                 return sendJson(res, 400, { error: change });
             return finish(res, setAgentEngineFromWeb({ catalog: deps.catalog, env: deps.env ?? process.env }, decodeURIComponent(engine[1]), change));
         }
+        // Failed jobs in bulk — by ids, by cause group, or every one still asking.
+        // Dismiss keeps them on record and out of the footer's count.
+        if (path === '/api/jobs/dismiss')
+            return finish(res, await dismissJobsFromWeb(writeDeps, body));
+        if (path === '/api/jobs/undismiss')
+            return finish(res, await undismissJobsFromWeb(writeDeps, body));
+        if (path === '/api/jobs/retry')
+            return finish(res, await retryJobsFromWeb(writeDeps, body));
         const job = /^\/api\/jobs\/([^/]+)\/(retry|cancel)$/.exec(path);
         if (job) {
             const jobId = decodeURIComponent(job[1]);
@@ -2863,7 +3345,8 @@ export function createWebApp(deps) {
  */
 export async function startWebServer(deps) {
     const token = deps.token ?? (await ensureWebToken()).token;
-    const server = createWebApp({ ...deps, token });
+    // The zone stays a getter through the spread: Settings → Profile can change it.
+    const server = createWebApp({ ...deps, token, get timezone() { return deps.timezone; } });
     await new Promise((resolve, reject) => {
         server.once('error', reject);
         server.listen(deps.config.port, deps.config.host, () => {
@@ -2907,6 +3390,8 @@ export async function startWebServer(deps) {
         close: async () => {
             if (expirySweep)
                 clearInterval(expirySweep);
+            // Said before anything closes, while the streams can still carry it.
+            await CLOSING_SAYS.get(server)?.();
             // Both listeners, both awaited. A preview socket still open is a port
             // still held, and the next thing to want it — the next test, the
             // gateway coming back up — finds it taken.