@zq-silk/yui 2.12.0 → 2.15.0

package/dist/web/assets/client/views/permissions.js

@@ -0,0 +1,129 @@
+export const PERMISSIONS_SCRIPT = String.raw `
+import { h } from "/assets/js/lib/dom.js";
+import { requestJson } from "/assets/js/lib/api.js";
+
+export function mountPermissions(root, t) {
+  let meta, generation = 0, timer;
+  let mode = "commands", role = "", category = "", q = "", cursor = "0", previous = [];
+  const label = r => r.name ? t("permissions.configured") + ": " + r.name : t("permissions.role." + r.id);
+  let status, results, prev, next, search, roleSelect, categorySelect;
+  function reset() { cursor = "0"; previous = []; load(); }
+  function controls() {
+    const modeSelect = h("select", { onchange: () => {
+      mode = modeSelect.value; roleSelect.disabled = categorySelect.disabled = mode !== "commands"; reset();
+    } }, ["commands", "capabilities"].map(id => h("option", { value: id }, t("permissions." + id))));
+    modeSelect.value = mode;
+    search = h("input", { type: "search", value: q, maxlength: 200, oninput: () => {
+      q = search.value; clearTimeout(timer);
+      // Invalidate any older result immediately, even during debounce.
+      generation++; prev.disabled = next.disabled = true;
+      timer = setTimeout(reset, 180);
+    } });
+    roleSelect = h("select", { onchange: () => { role = roleSelect.value; reset(); } },
+      h("option", { value: "" }, t("permissions.allRoles")),
+      meta.roles.map(r => h("option", { value: r.id }, label(r))));
+    roleSelect.value = role;
+    categorySelect = h("select", { onchange: () => { category = categorySelect.value; reset(); } },
+      h("option", { value: "" }, t("permissions.allCategories")),
+      meta.categories.map(c => h("option", { value: c }, c)));
+    categorySelect.value = category;
+    roleSelect.disabled = categorySelect.disabled = mode !== "commands";
+    status = h("p", { role: "status", "aria-live": "polite" });
+    results = h("div.permissions-results");
+    prev = h("button.btn", { type: "button", disabled: true, onclick: () => { cursor = previous.pop(); load(); } }, t("permissions.previous"));
+    next = h("button.btn", { type: "button", disabled: true }, t("permissions.next"));
+    const field = (key, input) => h("label.field", null, h("span", null, t("permissions." + key)), input);
+    root.replaceChildren(
+      h("div.card.settings-card.settings-stack", null,
+        h("p", null, t("permissions.notice")),
+        h("div.settings-grid", null, field("view", modeSelect), field("search", search),
+          field("role", roleSelect), field("category", categorySelect))),
+      status, results, h("div.settings-actions", null, prev, next),
+      h("details.settings-card", null, h("summary", null, t("permissions.legend")),
+        h("p", null, t("permissions.states")),
+        h("p", null, t("permissions.boundaries")),
+        h("p", null, t("permissions.sources") + ": " + meta.sources.join(" · "))));
+  }
+  function detailContent(data) {
+    return h("div.settings-stack", null,
+      h("p", null, t("permissions.unevaluated")),
+      h("p", null, t("permissions.boundaries")),
+      data.roles.map(r => h("div", null,
+        h("h3", null, label(meta.roles.find(item => item.id === r.role))),
+        h("p", null, t("permissions.reason." + (r.visible ? "visible" : "hidden"))),
+        h("p", null, t("permissions.boundary." + r.audience)),
+        r.usage.length ? h("pre", null, r.usage.join("\n")) : null)),
+      h("small", null, t("permissions.sources") + ": " + data.source));
+  }
+  function commandTable(page, version) {
+    const shown = role ? meta.roles.filter(r => r.id === role) : meta.roles.filter(r => !r.name);
+    const body = h("tbody");
+    page.items.forEach((item, index) => {
+      const detail = h("td", { colSpan: shown.length + 1 });
+      const detailRow = h("tr", { hidden: true, id: "permission-detail-" + version + "-" + index }, detail);
+      let loaded = false;
+      const button = h("button.permissions-command", { type: "button", "aria-expanded": "false",
+        "aria-controls": detailRow.id, onclick: async () => {
+          detailRow.hidden = !detailRow.hidden;
+          button.setAttribute("aria-expanded", String(!detailRow.hidden));
+          if (detailRow.hidden || loaded) return;
+          loaded = true; detail.textContent = t("permissions.loading");
+          try {
+            const params = new URLSearchParams({ id: item.id, ...(role ? { role } : {}) });
+            const data = await requestJson("/api/permissions/command?" + params);
+            if (version !== generation) return;
+            detail.replaceChildren(detailContent(data));
+          } catch (error) { loaded = false; detail.textContent = error.message; }
+        } }, item.id);
+      body.append(h("tr", null, h("th", { scope: "row" }, button, h("small", null, item.summary)),
+        item.roles.map(r => h("td", null, h("span", { class: r.visible ? "permissions-visible" : "permissions-hidden" },
+          t("permissions." + (r.visible ? "visible" : "hidden")))))), detailRow);
+    });
+    return h("div.permissions-scroll", { tabIndex: 0, role: "region", "aria-label": t("permissions.commands") },
+      h("table.permissions-table", null,
+        h("caption", null, t("permissions.tableHint")),
+        h("thead", null, h("tr", null, h("th", { scope: "col" }, t("permissions.command")),
+          shown.map(r => h("th", { scope: "col" }, label(r))))), body));
+  }
+  async function load() {
+    clearTimeout(timer);
+    const version = ++generation;
+    status.textContent = t("permissions.loading");
+    results.replaceChildren(); prev.disabled = next.disabled = true;
+    const params = new URLSearchParams({ q, cursor, ...(mode === "commands" ? { role, category } : {}) });
+    try {
+      const page = await requestJson("/api/permissions/" + mode + "?" + params);
+      if (version !== generation) return;
+      status.textContent = page.items.length ? (Number(cursor) + 1) + "–" + (Number(cursor) + page.items.length) + " / " + page.total : t("permissions.empty");
+      if (mode === "commands") results.append(commandTable(page, version));
+      else results.append(h("p", null, t("permissions.capabilityNotice")), ...page.items.map(item =>
+        h("details.settings-card", null, h("summary", null, item.name),
+          h("p", null, item.summary), h("p", null, t("permissions.unevaluated")),
+          h("p", null, t("permissions.effect") + ": " + item.effect),
+          h("p", null, t("permissions.requiredPermissions") + ": " + (item.requiredPermissions.join(", ") || "—")),
+          h("p", null, t("permissions.requiredInputs") + ": " + (item.requiredInputs.join(", ") || "—")),
+          h("p", null, t("permissions.inputs") + ": " + (item.inputs.join(", ") || "—")),
+          h("small", null, t("permissions.sources") + ": " + page.source + " → " + item.source))));
+      prev.disabled = previous.length === 0;
+      next.disabled = page.nextCursor === null;
+      next.onclick = () => { previous.push(cursor); cursor = page.nextCursor; load(); };
+    } catch (error) {
+      if (version !== generation) return;
+      status.textContent = error.message;
+      results.append(h("button.btn", { type: "button", onclick: load }, t("permissions.retry")));
+    }
+  }
+  async function init() {
+    root.replaceChildren(h("p", { role: "status" }, t("permissions.loading")));
+    try {
+      meta = await requestJson("/api/permissions");
+      controls(); load();
+    } catch (error) {
+      root.replaceChildren(h("p", { role: "status" }, error.message),
+        h("button.btn", { type: "button", onclick: init }, t("permissions.retry")));
+    }
+  }
+  init();
+  return { translate() { if (meta) { controls(); load(); } } };
+}
+`;

package/dist/web/assets/shared/icons.js

@@ -32,6 +32,7 @@ export const ICON_PATHS = Object.freeze({
     dots: ["M5 12h.01", "M12 12h.01", "M19 12h.01"],
     inbox: ["M4 13l2.5-8h11L20 13", "M4 13v6h16v-6", "M4 13h5l1 2h4l1-2h5"],
     user: ["M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8z", "M4 20a8 8 0 0 1 16 0"],
+    eyeOff: ["M3 3l18 18", "M10.6 5.1A10 10 0 0 1 12 5c6.4 0 10 7 10 7a17 17 0 0 1-3 3.9", "M6.6 6.6C3.9 8.3 2 12 2 12s3.6 7 10 7a9.6 9.6 0 0 0 5.4-1.6", "M9.9 9.9a3 3 0 0 0 4.2 4.2"],
     eye: ["M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7S2 12 2 12z", "M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6z"],
     plus: ["M12 5v14", "M5 12h14"],
     play: ["M8 5v14l11-7z"],

package/dist/web/assets/shared/manageNav.js

@@ -8,6 +8,7 @@ export const MANAGE_SECTIONS = Object.freeze({
         { page: "settings", section: "preferences", key: "settings.section.preferences", label: "Preferences" },
         { page: "settings", section: "skills", key: "settings.section.skills", label: "Skills" },
         { page: "settings", section: "jobs", key: "settings.section.jobs", label: "Jobs & schedules" },
+        { page: "settings", section: "permissions", key: "settings.section.permissions", label: "Command permissions" },
         { page: "settings", section: "server", key: "settings.section.server", label: "Agents & server" },
         { page: "models", section: "connection", key: "models.section.connection", label: "Model connection" }
     ]

package/dist/web/assets/shell/login.js

@@ -0,0 +1,56 @@
+import { DEFAULT_DARK_THEME } from "../shared/themes.js";
+import { iconSvg } from "../shared/icons.js";
+// The only document served without a session. It carries no page token and
+// no Task data; the client module posts the password as same-origin JSON and
+// the server answers with a session cookie. CSP form-action 'none' means the
+// form can never submit natively (so a password cannot end up in a URL).
+const SHEETS = ["fonts", "tokens", "base", "ui/controls", "ui/forms", "views/login"];
+export const LOGIN_HTML = `<!doctype html>
+<html lang="en" data-theme="${DEFAULT_DARK_THEME.id}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="color-scheme" content="dark light">
+  <script src="/assets/theme.js"></script>
+  <link rel="icon" href="data:,">
+  <title>Sign in · Yui</title>
+  <link rel="preload" href="/assets/fonts/inter-500.woff2" as="font" type="font/woff2" crossorigin>
+  <link rel="preload" href="/assets/fonts/inter-600.woff2" as="font" type="font/woff2" crossorigin>
+${SHEETS.map(name => `  <link rel="stylesheet" href="/assets/css/${name}.css">`).join("\n")}
+</head>
+<body class="login-body">
+  <main class="login-shell">
+    <div class="login-top">
+      <label class="login-locale"><span class="sr-only" data-i18n="settings.language">Language</span><select id="locale-select"><option value="en">English</option><option value="zh-CN">简体中文</option></select></label>
+    </div>
+    <section class="login-card" aria-labelledby="login-title">
+      <div class="login-brand">
+        <span class="brand-mark" aria-hidden="true">結</span>
+        <span class="brand-name">Yui</span>
+      </div>
+      <header class="login-heading">
+        <h1 id="login-title" data-i18n="login.heading">Sign in to Yui</h1>
+        <p id="login-subtitle" class="login-sub" data-i18n="login.subtitle">Enter the Web access password from this listener's private credential file.</p>
+      </header>
+      <p id="login-notice" class="login-notice" role="status" hidden></p>
+      <form id="login-form" class="login-form" method="post" novalidate aria-describedby="login-subtitle">
+        <input class="sr-only" type="text" name="username" value="yui" autocomplete="username" tabindex="-1" aria-hidden="true" readonly>
+        <div class="login-field">
+          <label class="login-label" for="login-password" data-i18n="login.password">Password</label>
+          <div class="login-password">
+            <input id="login-password" name="password" type="password" autocomplete="current-password" required maxlength="256" spellcheck="false" autocapitalize="off" autocorrect="off" aria-describedby="login-error" aria-invalid="false" autofocus>
+            <button id="login-reveal" class="icon-btn login-reveal" type="button" aria-controls="login-password" aria-pressed="false" aria-label="Show password" data-i18n-aria-label="login.show" title="Show password" data-i18n-title="login.show">${iconSvg("eye", "icon icon-show")}${iconSvg("eyeOff", "icon icon-hide")}</button>
+          </div>
+          <p id="login-error" class="login-error" role="alert" hidden></p>
+        </div>
+        <button id="login-submit" class="btn btn-primary login-submit" type="submit" disabled>
+          <span class="login-spinner" aria-hidden="true"></span><span id="login-submit-label" data-i18n="login.submit">Sign in</span>
+        </button>
+      </form>
+      <p id="login-transport" class="login-transport" hidden>${iconSvg("alert")}<span data-i18n="login.httpWarning">This connection uses plain HTTP and is not encrypted. Sign in only on a trusted network.</span></p>
+      <noscript><p class="login-error" data-i18n="login.noscript">JavaScript is required to sign in.</p></noscript>
+    </section>
+  </main>
+  <script type="module" src="/assets/js/app/login.js"></script>
+</body>
+</html>`;

package/dist/web/assets/shell/settingsContent.js

@@ -30,4 +30,8 @@ export const SETTINGS_MAIN = `
         <label class="field settings-search"><span data-i18n="settings.search">Find a setting</span><input id="settings-search" type="search" autocomplete="off"></label>
         <p id="settings-status" role="status"></p>
         <div id="settings-groups" class="settings-stack"></div>
+      </section>
+      <section class="manage-section" data-section="permissions" aria-labelledby="settings-permissions-title" hidden>
+        ${manageHead("settings-permissions-title", "settings.section.permissions", "Command permissions", "permissions.intro", "Read-only discovery templates, not authorization for a specific call. No rules or Grants are changed.")}
+        <section id="permission-browser" class="settings-stack"></section>
       </section>`;

package/dist/web/assets/styles/index.js

@@ -19,6 +19,7 @@ import { MANAGE_STYLES } from "./views/manage.js";
 import { SETTINGS_STYLES } from "./views/settings.js";
 import { MODELS_STYLES } from "./views/models.js";
 import { JOBS_STYLES } from "./views/jobs.js";
+import { LOGIN_STYLES } from "./views/login.js";
 // The stylesheet registry, in cascade order: foundations (fonts, tokens,
 // element defaults), the workspace frame, shared UI primitives, then one
 // sheet per view, rendered prose, and breakpoints last so they override
@@ -44,6 +45,7 @@ export const STYLESHEETS = Object.freeze([
     { name: "views/settings", body: SETTINGS_STYLES },
     { name: "views/models", body: MODELS_STYLES },
     { name: "views/jobs", body: JOBS_STYLES },
+    { name: "views/login", body: LOGIN_STYLES },
     { name: "markdown", body: MARKDOWN_STYLES },
     { name: "layout/responsive", body: RESPONSIVE_STYLES }
 ]);

package/dist/web/assets/styles/views/login.js

@@ -0,0 +1,42 @@
+/*
+ * LOGIN VIEW — the standalone sign-in document: one centred card on the
+ * canvas with the workbench brand, a password field (with reveal toggle),
+ * inline error/notice states and the plain-HTTP reminder. Colour comes only
+ * from theme tokens; the card collapses to the full width on narrow screens.
+ */
+export const LOGIN_STYLES = `
+.login-body{height:auto;min-height:100vh;min-height:100dvh;overflow:auto}
+.login-shell{position:relative;display:grid;place-items:center;min-height:100vh;min-height:100dvh;padding:72px 16px 48px;background:radial-gradient(120% 70% at 50% -10%,var(--accent-soft),transparent 60%),var(--canvas)}
+.login-top{position:absolute;top:16px;right:16px}
+.login-locale select{height:30px;width:auto;max-width:132px;padding:0 26px 0 9px;line-height:28px;font-size:var(--fs-xs);background-color:var(--surface)}
+.login-card{display:grid;gap:20px;width:min(400px,100%);padding:32px 28px 28px;border:1px solid var(--line-2);border-radius:var(--r-lg);background:var(--surface);box-shadow:var(--shadow-2)}
+.login-brand{display:flex;align-items:center;gap:10px}
+.login-brand .brand-mark{display:grid;place-items:center;width:32px;height:32px;flex:none;border-radius:9px;background:var(--accent);color:var(--accent-ink);font-size:17px;font-weight:700;line-height:1}
+.login-brand .brand-name{font-size:var(--fs-lg);font-weight:650;letter-spacing:-.02em}
+.login-heading{display:grid;gap:6px}
+.login-heading h1{font-size:var(--fs-2xl)}
+.login-sub{color:var(--ink-3);font-size:var(--fs-sm);overflow-wrap:anywhere}
+.login-notice{margin:0;padding:10px 12px;border:1px solid var(--line-2);border-left:3px solid var(--tone,var(--info));border-radius:var(--r-sm);background:var(--tone-soft,var(--info-soft));color:var(--ink);font-size:var(--fs-sm)}
+.login-form{display:grid;gap:16px}
+.login-field{display:grid;gap:6px;min-width:0}
+.login-label{color:var(--ink-2);font-size:var(--fs-xs);font-weight:500}
+.login-password{position:relative}
+.login-password input{height:40px;padding-right:44px}
+.login-password input[aria-invalid="true"]{border-color:var(--bad)}
+.login-password input[aria-invalid="true"]:focus{box-shadow:0 0 0 3px var(--bad-soft)}
+.login-reveal{position:absolute;top:4px;right:4px}
+.login-reveal .icon-hide,.login-reveal[aria-pressed="true"] .icon-show{display:none}
+.login-reveal[aria-pressed="true"] .icon-hide{display:block}
+.login-error{margin:0;color:var(--bad);font-size:var(--fs-sm);overflow-wrap:anywhere}
+.login-submit{width:100%;height:40px;font-size:var(--fs-md)}
+.login-spinner{display:none;width:14px;height:14px;flex:none;border:2px solid currentColor;border-right-color:transparent;border-radius:50%;animation:login-spin .8s linear infinite}
+.login-form[aria-busy="true"] .login-spinner{display:inline-block}
+@keyframes login-spin{to{transform:rotate(360deg)}}
+.login-transport{display:flex;align-items:flex-start;gap:8px;margin:0;padding-top:16px;border-top:1px solid var(--line);color:var(--ink-3);font-size:var(--fs-xs)}
+.login-transport .icon{width:14px;height:14px;margin-top:2px;color:var(--warn)}
+@media(max-width:480px){
+  .login-shell{place-items:start center;padding:64px 12px 32px}
+  .login-card{padding:24px 20px;border-radius:var(--r-md)}
+  .login-heading h1{font-size:var(--fs-xl)}
+}
+`;

package/dist/web/assets/styles/views/settings.js

@@ -33,6 +33,19 @@ export const SETTINGS_STYLES = `
 .settings-search input{width:100%;max-width:520px}
 #settings-status:empty,#browser-receipt:empty{display:none}
 .mono-line{overflow-wrap:anywhere}
+.permissions-results{display:grid;gap:12px;min-width:0}
+.permissions-scroll{overflow:auto;border:1px solid var(--line);border-radius:var(--r-lg);background:var(--surface)}
+.permissions-table{border-collapse:collapse;width:100%;font-size:var(--fs-xs)}
+.permissions-table caption{text-align:left;padding:14px;color:var(--ink-2)}
+.permissions-table th,.permissions-table td{text-align:left;vertical-align:top;padding:12px;border-bottom:1px solid var(--line)}
+.permissions-table thead th{background:var(--surface-2);min-width:100px;font-weight:600}
+.permissions-table th[scope=row]{min-width:240px;max-width:360px;font-weight:400}
+.permissions-table small{display:block;color:var(--ink-3);margin-top:6px;overflow-wrap:anywhere}
+.permissions-command{font-family:var(--font-mono);color:var(--accent);background:none;border:0;padding:4px 0;cursor:pointer;text-align:left;overflow-wrap:anywhere}
+.permissions-command:hover{text-decoration:underline}
+.permissions-table pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:var(--fs-xs);max-width:700px}
+.permissions-visible{color:var(--ink);white-space:nowrap}
+.permissions-hidden{color:var(--ink-3);white-space:nowrap}
 @media(max-width:${BREAKPOINTS.small}px){
   .settings-grid{grid-template-columns:minmax(0,1fr)}
   .settings-card{padding:14px}

package/dist/web/webAccess.js

@@ -1,8 +1,35 @@
-import { createHash, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { closeSync, constants, fstatSync, openSync, readFileSync } from "node:fs";
 import { isIP } from "node:net";
 import { networkInterfaces } from "node:os";
 import { isAbsolute } from "node:path";
+export const DEFAULT_WEB_SESSION_POLICY = Object.freeze({
+    idleMs: 8 * 60 * 60 * 1000,
+    absoluteMs: 24 * 60 * 60 * 1000,
+    maxSessions: 32,
+    failureWindowMs: 60 * 1000,
+    maxFailures: 5,
+    now: () => Date.now()
+});
+/** A post-login destination must stay a same-origin document path. Anything
+ * else (absolute/protocol-relative URLs, backslashes, API/auth/asset paths)
+ * falls back to the workbench root. */
+export function safeReturnPath(candidate) {
+    if (typeof candidate !== "string" || candidate.length > 2048 || !candidate.startsWith("/")
+        || candidate.startsWith("//") || /[\\\u0000-\u001f\u007f]/u.test(candidate))
+        return "/";
+    try {
+        const url = new URL(candidate, "http://return.invalid");
+        if (url.origin !== "http://return.invalid")
+            return "/";
+        if (/^\/(?:login|auth|api|assets|preview)(?:\/|$)/u.test(url.pathname))
+            return "/";
+        return url.pathname + url.search;
+    }
+    catch {
+        return "/";
+    }
+}
 export function isLoopbackAddress(host) {
     return host === "localhost" || host === "::1" || /^127\./.test(host) && isIP(host) === 4;
 }
@@ -39,7 +66,7 @@ function passwordDigest(path) {
         const password = readFileSync(fd, "utf8").replace(/\r?\n$/, "");
         if (!/^[\x21-\x7e]{32,128}$/.test(password))
             throw new Error("invalid password");
-        return createHash("sha256").update(`Basic ${Buffer.from(`yui:${password}`).toString("base64")}`).digest();
+        return createHash("sha256").update(password).digest();
     }
     catch {
         // Never include file contents, OS error text or a submitted credential.
@@ -50,7 +77,7 @@ function passwordDigest(path) {
             closeSync(fd);
     }
 }
-export function createWebAccess(options, interfaces = networkInterfaces()) {
+export function createWebAccess(options, interfaces = networkInterfaces(), policy = DEFAULT_WEB_SESSION_POLICY) {
     validateWebAccessOptions(options);
     const lan = !isLoopbackAddress(options.host);
     const digest = options.authFile === undefined ? undefined : passwordDigest(options.authFile);
@@ -65,6 +92,41 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
     const allowed = new Set(!lan || wildcard ? [...addresses, "127.0.0.1", "::1", "localhost"] : addresses);
     const urlHost = (host) => isIP(host) === 6 ? `[${host}]` : host;
     const urls = addresses.map(host => `http://${urlHost(host)}:${options.port}`);
+    // Cookies are scoped by host, not port: include the port so two listeners on
+    // one machine cannot overwrite each other's session.
+    const cookieName = `yui_session_${options.port}`;
+    // Keyed by a hash of the opaque cookie value; the raw value is never stored.
+    const sessions = new Map();
+    const failures = new Map();
+    const sessionKey = (request) => {
+        const header = request.headers.cookie;
+        if (typeof header !== "string" || header.length > 8192)
+            return undefined;
+        for (const part of header.split(";")) {
+            const index = part.indexOf("=");
+            if (index > 0 && part.slice(0, index).trim() === cookieName) {
+                const value = part.slice(index + 1).trim();
+                return /^[A-Za-z0-9_-]{43}$/.test(value) ? createHash("sha256").update(value).digest("hex") : undefined;
+            }
+        }
+        return undefined;
+    };
+    const live = (key, touch) => {
+        if (key === undefined)
+            return false;
+        const session = sessions.get(key);
+        if (!session)
+            return false;
+        const now = policy.now();
+        if (now - session.seen >= policy.idleMs || now - session.created >= policy.absoluteMs) {
+            sessions.delete(key);
+            return false;
+        }
+        if (touch)
+            session.seen = now;
+        return true;
+    };
+    const cookie = (value, maxAgeSeconds) => `${cookieName}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAgeSeconds}`;
     const warnings = lan ? [
         "HTTP is not encrypted. Use only a trusted network; credentials and data are visible to network observers.",
         ...(wildcard ? ["Wildcard binding listens on all matching interfaces, including public ones. Yui does not open firewall ports or tunnels."] : []),
@@ -72,7 +134,8 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
     ] : [];
     return {
         lan,
-        authentication: digest ? "basic" : "local",
+        authentication: digest ? "password" : "local",
+        passwordRequired: digest !== undefined,
         urls,
         warnings,
         acceptsHost(request) {
@@ -98,12 +161,69 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
             return request.headers["sec-fetch-site"] !== "cross-site"
                 && (origin === undefined ? !requireOrigin : origin === `http://${request.headers.host}`);
         },
+        /** Every protected request/handshake checks the listener's session table. */
         authenticated(request) {
+            return !digest || live(sessionKey(request), true);
+        },
+        /** True when the request carries this listener's cookie name, valid or not. */
+        presentedSession(request) {
+            return typeof request.headers.cookie === "string"
+                && request.headers.cookie.split(";").some(part => part.trim().startsWith(`${cookieName}=`));
+        },
+        /** Opaque identity for binding long-lived connections; not a credential. */
+        sessionOf(request) {
+            const key = sessionKey(request);
+            return live(key, false) ? key : undefined;
+        },
+        sessionActive(key) { return !digest || live(key, false); },
+        login(request, password) {
             if (!digest)
-                return true;
-            const authorization = request.headers.authorization;
-            return typeof authorization === "string" && authorization.length <= 512
-                && timingSafeEqual(createHash("sha256").update(authorization).digest(), digest);
-        }
+                return { ok: false, reason: "unconfigured" };
+            const now = policy.now();
+            const address = request.socket.remoteAddress ?? "unknown";
+            const recent = (failures.get(address) ?? []).filter(at => now - at < policy.failureWindowMs);
+            if (recent.length >= policy.maxFailures) {
+                failures.set(address, recent);
+                return { ok: false, reason: "throttled",
+                    retryAfterSeconds: Math.max(1, Math.ceil((recent[0] + policy.failureWindowMs - now) / 1000)) };
+            }
+            const valid = typeof password === "string" && password.length <= 256
+                && timingSafeEqual(createHash("sha256").update(password).digest(), digest);
+            if (!valid) {
+                recent.push(now);
+                failures.delete(address);
+                failures.set(address, recent);
+                // Bound memory: forget the oldest addresses first.
+                while (failures.size > 1024)
+                    failures.delete(failures.keys().next().value);
+                return { ok: false, reason: "invalid" };
+            }
+            failures.delete(address);
+            for (const [key, session] of sessions) {
+                if (now - session.seen >= policy.idleMs || now - session.created >= policy.absoluteMs)
+                    sessions.delete(key);
+            }
+            while (sessions.size >= policy.maxSessions) {
+                let oldest;
+                let seen = Infinity;
+                for (const [key, session] of sessions)
+                    if (session.seen < seen) {
+                        seen = session.seen;
+                        oldest = key;
+                    }
+                sessions.delete(oldest);
+            }
+            const value = randomBytes(32).toString("base64url");
+            sessions.set(createHash("sha256").update(value).digest("hex"), { created: now, seen: now });
+            return { ok: true, cookie: cookie(value, Math.floor(policy.absoluteMs / 1000)) };
+        },
+        /** Revokes the presented session (if any) and returns a clearing cookie. */
+        logout(request) {
+            const key = sessionKey(request);
+            if (key !== undefined)
+                sessions.delete(key);
+            return cookie("", 0);
+        },
+        clearCookie() { return cookie("", 0); }
     };
 }

package/dist/web/webPermissions.js

@@ -0,0 +1,97 @@
+import { ROOT_COMMAND } from "../cli/commandCatalog.js";
+import { discoveryCommandTree } from "../cli/commandDiscovery.js";
+import { BUILTIN_CAPABILITIES } from "../kernel/builtinCapabilities.js";
+const templates = [
+    { id: "public", audience: "public" },
+    { id: "operator", audience: "operator" },
+    { id: "global", audience: "global" },
+    { id: "leader", audience: "leader" },
+    { id: "worker", audience: "assignment" },
+    { id: "reviewer", audience: "assignment" },
+    { id: "unbound", audience: "unbound" }
+];
+function executableNodes(node) {
+    return [...(node.kind !== "group" && node.discovery?.surface !== "runtime" ? [node] : []),
+        ...node.children.flatMap(executableNodes)];
+}
+const commands = executableNodes(ROOT_COMMAND);
+// The same pure projection as CLI help/completion. No fake Session, caller
+// environment, authority issuance, registry invocation or domain assessment.
+const projections = new Map(templates.map(role => [role.audience,
+    new Map(executableNodes(discoveryCommandTree({}, role.audience)).map(node => [node.path.join(" "), node]))]));
+const pageSize = 30;
+function searchText(value = "") {
+    if (value.length > 200)
+        throw new Error("Search is limited to 200 characters.");
+    return value.trim().toLowerCase();
+}
+function page(items, cursor = "0") {
+    if (!/^(0|[1-9]\d*)$/.test(cursor) || !Number.isSafeInteger(Number(cursor)))
+        throw new Error("Invalid cursor.");
+    const start = Number(cursor);
+    return { items: items.slice(start, start + pageSize), total: items.length,
+        nextCursor: start + pageSize < items.length ? String(start + pageSize) : null };
+}
+/** Read-only metadata projection for the authenticated local Web user.
+ * Only configured GlobalRole names cross the Store boundary. Task contents,
+ * bindings, profiles, Sessions, Grants and plugin descriptors are not read.
+ * These templates deliberately have no AccessAssessment field. */
+export function createWebPermissions(store) {
+    const roles = () => [...templates, ...store.listGlobalRoles()
+            .filter(role => role.name !== "operator").map(role => ({
+            id: `global:${role.name}`, name: role.name, audience: "global"
+        }))];
+    const selected = (id) => {
+        if (!id)
+            return templates;
+        const role = roles().find(role => role.id === id);
+        if (!role)
+            throw new Error("Unknown role template.");
+        return [role];
+    };
+    const cells = (id, selectedRoles) => selectedRoles.map(role => {
+        const projected = projections.get(role.audience).get(id);
+        return { role: role.id, visible: !!projected };
+    });
+    return {
+        index() {
+            return { roles: roles(), categories: [...new Set(commands.map(node => node.path[1]))].sort(),
+                sources: ["cli/commandCatalog.ts", "cli/commandDiscovery.ts", "kernel/builtinCapabilities.ts", "docs/authorization.md"],
+                evaluation: "not-performed" };
+        },
+        commands(query = {}) {
+            const q = searchText(query.q);
+            const selectedRoles = selected(query.role);
+            return { ...page(commands.filter(node => (!query.category || node.path[1] === query.category)
+                    && `${node.path.join(" ")} ${node.summary}`.toLowerCase().includes(q))
+                    .map(node => ({ id: node.path.join(" "), summary: node.summary, category: node.path[1],
+                    roles: cells(node.path.join(" "), selectedRoles) })), query.cursor),
+                evaluation: "not-performed" };
+        },
+        command(id, role) {
+            const node = commands.find(node => node.path.join(" ") === id);
+            if (!node)
+                throw new Error("Unknown command template.");
+            return { id, summary: node.summary, evaluation: "not-performed",
+                source: "cli/commandCatalog.ts → cli/commandDiscovery.ts",
+                roles: selected(role).map(role => {
+                    const projected = projections.get(role.audience).get(id);
+                    return { role: role.id, audience: role.audience, visible: !!projected,
+                        // Use the projected usage/options, including option audience gates.
+                        usage: projected?.usage ?? [], options: projected?.options ?? [] };
+                }) };
+        },
+        capabilities(query = {}) {
+            const q = searchText(query.q);
+            return { ...page(BUILTIN_CAPABILITIES
+                    .filter(entry => `${entry.name} ${entry.summary} ${entry.requiredPermissions.join(" ")}`.toLowerCase().includes(q))
+                    .map(entry => ({
+                    name: entry.name, summary: entry.summary, effect: entry.effect, source: entry.source,
+                    requiredPermissions: entry.requiredPermissions,
+                    requiredInputs: entry.inputSchema.required ?? [],
+                    inputs: Object.keys(entry.inputSchema.properties ?? {})
+                })), query.cursor), evaluation: "not-performed",
+                source: "kernel/builtinCapabilities.ts (registry built-in descriptors)" };
+        }
+    };
+}