@zq-silk/yui 2.14.0 → 2.16.0

package/dist/config/configCatalog.js

@@ -8,7 +8,7 @@ export const CONFIG_DOMAINS = ["system", "runtime", "workflow", "resources", "to
 export const CONFIG_DEFINITIONS = Object.freeze([
     { key: "default-agent", domain: "system", property: "defaultAgent", label: "Default Agent", summary: "Configured Agent used when a Task or Role does not select one explicitly.", takesEffect: "Future Role and Task defaults; existing bindings are unchanged." },
     { key: "default-workspace", domain: "system", property: "defaultWorkspace", label: "Default workspace", summary: "Absolute workspace root outside YUI_HOME used when no workspace is selected.", takesEffect: "Future workspace selection; existing Roles and worktrees are unchanged." },
-    { key: "time-zone", domain: "system", property: "timeZone", label: "Time zone", summary: "IANA timezone for human-facing timestamps (default: Asia/Shanghai).", takesEffect: "The next human-readable timestamp rendering; durable JSON remains UTC." },
+    { key: "time-zone", domain: "system", property: "timeZone", label: "Time zone", summary: "IANA timezone for human-facing timestamps and new default Project sync plans (default: Asia/Shanghai).", takesEffect: "The next human-readable timestamp rendering and newly installed Project sync plans; existing Schedule rules stay unchanged and durable timestamps remain UTC." },
     { key: "reconciliation-interval-seconds", domain: "runtime", property: "reconciliationIntervalSeconds", label: "Reconciliation interval", summary: "Recovery reconciliation interval, 5-300 seconds (default: 120).", takesEffect: "The running Controller is refreshed after the value is saved." },
     { key: "controller-task-concurrency", domain: "runtime", property: "controllerTaskConcurrency", label: "Controller Task concurrency", summary: "Maximum Tasks reconciled concurrently, 1-32 (default: 4).", takesEffect: "After the Controller restarts." },
     { key: "runtime-health", domain: "runtime", property: "runtimeHealth", label: "Runtime health thresholds", summary: "Quiet, checkpoint-overdue, and read-only diagnostic thresholds in seconds; values must be strictly increasing (defaults: 300/900/1800).", takesEffect: "CLI and Web projections immediately; scheduler diagnostics after the Controller restarts." },

package/dist/controlPlaneCli.js

@@ -689,7 +689,7 @@ export async function main() {
             const describe = (status) => status
                 ? `Web listener: ${status.state}\n`
                     + (status.alreadyRunning ? "Existing listener reused; credentials were not reloaded.\n" : "")
-                    + (status.authentication === "basic" ? "Browser authentication: username yui; use the password from your private credential file.\n" : "")
+                    + (status.authentication === "password" ? "Browser sign-in: open the URL and enter the password from your private credential file on the Yui sign-in page.\n" : "")
                     + (status.urls ?? []).map(url => `Yui web control room: ${url}\n`).join("")
                     + (status.warnings ?? []).map(warning => `Warning: ${warning}\n`).join("")
                 : "Web is not running. Start it explicitly; Controller recovery does not restore listeners.\n";

package/dist/job/projectSync.js

@@ -7,9 +7,9 @@ import { requireRefreshProject, projectRefreshTargetDigest } from "../repository
 import { createJobDefinition, reviseJobDefinition, validateJobDefinition } from "./jobDefinition.js";
 import { nextScheduleDue, validateScheduleRule } from "../schedule/schedule.js";
 import { scheduleServiceBinding } from "./scheduleService.js";
+import { resolveTimeZone } from "../config/timeZone.js";
 const scope = { kind: "global" };
 const unavailable = "Project sync unavailable: ";
-export const PROJECT_SYNC_INTERVAL_MS = 6 * 60 * 60_000;
 /** Called under the maintenance lock immediately before Git, not a timer probe. */
 export function requireProjectSyncCheckout(store, job) {
     requireProjectSyncTarget(store, job);
@@ -86,8 +86,8 @@ export function reconcileProjectSync(store, now, onError = () => { }) {
                     reason = unavailable + (error instanceof Error ? error.message : String(error));
                 }
                 if (!plan) {
-                    const rule = { kind: "interval", anchor: new Date(now.getTime() + PROJECT_SYNC_INTERVAL_MS).toISOString(),
-                        everyMs: PROJECT_SYNC_INTERVAL_MS };
+                    const rule = { kind: "cron", expression: "0 */6 * * *",
+                        timezone: resolveTimeZone(tx.getConfig().timeZone) };
                     const grantId = randomUUID();
                     plan = { schemaVersion: 1, id, scope, jobId: id, target: { kind: "existing-job" }, rule,
                         builtin: { projectId, enabled: true }, revision: 1, generation: 1,

package/dist/storage/sqliteSchema.js

@@ -10,6 +10,7 @@ import { GLOBAL_SESSION_TABLE_SQL, SESSION_HISTORY_UPGRADE_SQL } from "./session
 import { migrateJobDefinitions } from "./upgrade/jobDefinitionMigration.js";
 import { migrateJobBusinessResults } from "./upgrade/jobBusinessResultMigration.js";
 import { migrateScheduleDispatch } from "./upgrade/scheduleDispatchMigration.js";
+import { migrateProjectSyncClock } from "./upgrade/projectSyncClockMigration.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION, STORAGE_FORMAT, isMinorStorageUpgrade, isStorageVersion, storageVersionParts } from "./storageVersions.js";
 export { BASELINE_SCHEMA_SQL };
 export const SQLITE_SCHEMA_TABLES = [...BASELINE_SCHEMA_TABLES, "job_definitions", "global_job_runs", "schedules", "agent_job_runs"];
@@ -233,6 +234,15 @@ const MINOR_UPGRADES = Object.freeze([{
         // Existing records and immutable artifacts remain byte-for-byte unchanged.
         // Declares Agent definitions/Runs and optional Job ownership of a non-Task Role.
         sql: AGENT_JOB_SCHEMA_SQL
+    }, {
+        fromVersion: "1.20",
+        toVersion: "1.21",
+        name: "project-sync-clock",
+        introducedIn: "next",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        sql: "",
+        dataMigration: "project-sync-clock"
     }]);
 export function storageMinorUpgradePlan(from) {
     if (from === CURRENT_STORAGE_VERSION)
@@ -363,6 +373,8 @@ export function applySqliteMinorUpgrades(db, home, createdRoots = []) {
                 migrateJobBusinessResults(db);
             if (step.dataMigration === "schedule-dispatch")
                 migrateScheduleDispatch(db);
+            if (step.dataMigration === "project-sync-clock")
+                migrateProjectSyncClock(db);
             const { major, minor } = storageVersionParts(step.toVersion);
             db.prepare("UPDATE storage_schema SET major=?,minor=?,checksum=? WHERE id=1")
                 .run(major, minor, step.targetChecksum);

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.20";
+export const CURRENT_STORAGE_VERSION = "1.21";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/dist/storage/upgrade/projectSyncClockMigration.js

@@ -0,0 +1,30 @@
+import { resolveTimeZone } from "../../config/timeZone.js";
+import { nextScheduleDue, validateSchedule } from "../../schedule/schedule.js";
+/** 1.20 had no rule-edit provenance. Only revision 1 proves no user mutation.
+ * Higher revisions may be dispatch, recovery OR an equal-valued user edit;
+ * preserve them instead of guessing from interval values or generation.
+ */
+export function migrateProjectSyncClock(db) {
+    const now = new Date();
+    const rows = db.prepare("SELECT rowid,scope_key,schedule_id,payload FROM schedules").all();
+    for (const row of rows) {
+        const old = JSON.parse(row.payload);
+        if (!old.builtin || old.revision !== 1)
+            continue;
+        validateSchedule(old);
+        // Confirm the declared install shape, in addition to the mutation evidence.
+        if (old.generation !== 1 || old.rule.kind !== "interval" || old.rule.everyMs !== 21_600_000
+            || Date.parse(old.rule.anchor) !== Date.parse(old.createdAt) + 21_600_000)
+            continue;
+        const config = db.prepare("SELECT payload FROM config WHERE id=1").get();
+        const rule = { kind: "cron", expression: "0 */6 * * *",
+            timezone: resolveTimeZone(config ? JSON.parse(config.payload).timeZone : undefined) };
+        const after = new Date(Math.max(now.getTime(), Date.parse(old.processedThrough ?? "") || 0));
+        const next = validateSchedule({ ...old, rule, revision: old.revision + 1, generation: old.generation + 1,
+            processedThrough: after.toISOString(), nextDue: nextScheduleDue(rule, after), updatedAt: now.toISOString() });
+        db.prepare("INSERT INTO storage_migration_archive(migration_version,family,record_key,payload) VALUES(?,?,?,?)")
+            .run(21, "schedules", `${row.scope_key}/${row.schedule_id}`, row.payload);
+        db.prepare("UPDATE schedules SET payload=?,next_due=? WHERE rowid=?")
+            .run(JSON.stringify(next), next.nextDue, row.rowid);
+    }
+}

package/dist/web/assets/assetManifest.js

@@ -8,6 +8,7 @@ import { APP_SCRIPT, CLIENT_MODULES } from "./client/index.js";
 import { THEME_BOOTSTRAP_SCRIPT } from "./client/lib/theme.js";
 import { FONT_WOFF2_BASE64 } from "./fontData.js";
 import { DASHBOARD_HTML } from "./shell/index.js";
+import { LOGIN_HTML } from "./shell/login.js";
 import { STYLESHEETS } from "./styles/index.js";
 const require = createRequire(import.meta.url);
 const CSS = "text/css; charset=utf-8";
@@ -22,7 +23,28 @@ export const WEB_ASSETS = Object.freeze({
     "/assets/vendor/addon-fit.mjs": vendorAsset("@xterm/addon-fit/lib/addon-fit.mjs", JS),
     "/assets/vendor/xterm.css": vendorAsset("@xterm/xterm/css/xterm.css", CSS)
 });
-export { DASHBOARD_HTML };
+export { DASHBOARD_HTML, LOGIN_HTML };
+// The sign-in document's static closure (its stylesheets, fonts, theme script
+// and module import graph). Only these assets are served without a session;
+// every other asset, like every document and API, requires sign-in.
+const LOGIN_ASSETS = (() => {
+    const found = new Set();
+    const visit = (body) => {
+        for (const [path] of body.matchAll(/\/assets\/[\w./-]+/g)) {
+            const asset = WEB_ASSETS[path];
+            if (!asset || found.has(path))
+                continue;
+            found.add(path);
+            if (asset.encoding !== "base64")
+                visit(asset.body);
+        }
+    };
+    visit(LOGIN_HTML);
+    return found;
+})();
+export function isLoginAsset(pathname) {
+    return LOGIN_ASSETS.has(pathname);
+}
 // One content revision covers the complete import graph: changing a dependency
 // invalidates its importers too. Only these static assets may be cached.
 export const WEB_ASSET_VERSION = createHash("sha256")

package/dist/web/assets/client/app/catalog.js

@@ -51,8 +51,21 @@ async function refresh(deps, progress, options) {
     const query = catalogQuery(state);
     const dashboard = await deps.api.dashboard(query);
     if (request !== progress.request) return;
-    applyDashboard(state, dashboard, query);
-    showDashboard(deps, progress, previousInputs);
+    // An unchanged quiet poll leaves the list and overview alone: rebuilding
+    // them every few seconds would interrupt scrolling and animations. They
+    // still redraw once a minute so relative times stay true.
+    const signature = query + "|" + JSON.stringify(dashboard);
+    const now = Date.now();
+    if (quiet && signature === progress.signature && now - progress.drawnAt < 60000) {
+      state.generatedAt = new Date().toISOString();
+      el.sync.dataset.state = "ok";
+      el.lastSync.textContent = formatClock(state.generatedAt, deps.locale());
+    } else {
+      progress.signature = signature;
+      progress.drawnAt = now;
+      applyDashboard(state, dashboard, query);
+      showDashboard(deps, progress, previousInputs);
+    }
     // A selected Task may live on another page or outside current filters;
     // only its own read can establish that it no longer exists.
     if (state.selected) {
@@ -98,18 +111,10 @@ function renderSidebar(deps, progress) {
     reset(deps, progress);
   });
   el.catalogCount.textContent = fill(t("catalog.count"), { shown: state.tasks.length, total: state.catalogTotal });
-  let source = el.filters.querySelector("select");
-  if (!source) {
-    source = h("select", { "aria-label": t("jobs.taskCategory") });
-    source.addEventListener("change", function () {
-      state.source = source.value; state.attentionFilter = null; state.query = ""; el.search.value = "";
-      syncUrl(state, false); reset(deps, progress);
-    });
-    el.filters.append(source);
-  }
-  source.replaceChildren(...["ordinary", "job", "all"].map(value =>
-    h("option", { value }, t("jobs.category." + value))));
-  source.value = state.query.trim() || state.attentionFilter ? "all" : state.source || "ordinary";
+  renderSource(el.source, state, t, function (value) {
+    state.source = value; state.attentionFilter = null; state.query = ""; el.search.value = "";
+    syncUrl(state, false); reset(deps, progress);
+  });
   el.catalogReset.hidden = !state.catalogCursor;
   el.catalogNext.hidden = !state.nextCursor && !state.catalogCursor;
   el.catalogAttentionReset.hidden = !state.attentionFilter;
@@ -117,6 +122,27 @@ function renderSidebar(deps, progress) {
   el.lastSync.textContent = state.generatedAt ? formatClock(state.generatedAt, deps.locale()) : "—";
 }
 
+// Task category: search and attention are cross-category, so they show "all";
+// picking a category clears them, as the server filter then applies again.
+function renderSource(container, state, t, onPick) {
+  const current = state.query.trim() || state.attentionFilter ? "all" : state.source || "ordinary";
+  // Bound once; the handler reads the live state, not this render's snapshot.
+  if (!container.childElementCount) {
+    ["ordinary", "job", "all"].forEach(function (value) {
+      container.append(h("button.seg-btn", { type: "button", role: "radio", dataset: { source: value },
+        onclick: function () {
+          if (value !== (state.source || "ordinary") || state.query.trim() || state.attentionFilter) onPick(value);
+        } }));
+    });
+  }
+  container.querySelectorAll("[data-source]").forEach(function (button) {
+    const value = button.dataset.source;
+    button.textContent = t("jobs.categoryShort." + value);
+    button.title = t("jobs.category." + value);
+    button.setAttribute("aria-checked", String(value === current));
+  });
+}
+
 // Redraw the list in place, keeping its scroll position.
 function renderTaskList(deps) {
   const scroll = deps.el.tasks.scrollTop;

package/dist/web/assets/client/app/login.js

@@ -0,0 +1,156 @@
+export const LOGIN_SCRIPT = String.raw `
+// Sign-in page controller. Posts the password once per submission as
+// same-origin JSON; the server sets an HttpOnly session cookie and returns a
+// validated same-origin destination. The password is never written to the
+// URL, storage or console, and the field is cleared after a rejection.
+import { createI18n } from "/assets/js/lib/i18n.js";
+
+const form = document.querySelector("#login-form");
+const password = document.querySelector("#login-password");
+const reveal = document.querySelector("#login-reveal");
+const submit = document.querySelector("#login-submit");
+const submitLabel = document.querySelector("#login-submit-label");
+const errorBox = document.querySelector("#login-error");
+const notice = document.querySelector("#login-notice");
+const transport = document.querySelector("#login-transport");
+
+const i18n = createI18n(document.querySelector("#locale-select"));
+const t = i18n.t;
+const params = new URLSearchParams(window.location.search);
+const next = params.get("next") || "/";
+const reason = params.get("reason");
+let busy = false;
+let lockedUntil = 0;
+let lockTimer = null;
+let currentError = null;
+
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "[::1]" || /^127\./.test(host);
+}
+
+function showError(key, values) {
+  currentError = { key: key, values: values || {} };
+  let text = t(key);
+  Object.keys(currentError.values).forEach(function (name) { text = text.split("{" + name + "}").join(String(currentError.values[name])); });
+  errorBox.textContent = text;
+  errorBox.hidden = false;
+  password.setAttribute("aria-invalid", key === "login.error.network" || key === "login.error.origin" ? "false" : "true");
+}
+
+function clearError() {
+  currentError = null;
+  errorBox.hidden = true;
+  errorBox.textContent = "";
+  password.setAttribute("aria-invalid", "false");
+}
+
+function setBusy(value) {
+  busy = value;
+  form.setAttribute("aria-busy", value ? "true" : "false");
+  password.readOnly = value;
+  updateSubmit();
+}
+
+function updateSubmit() {
+  const locked = Date.now() < lockedUntil;
+  submit.disabled = busy || locked;
+  submitLabel.textContent = t(busy ? "login.submitting" : "login.submit");
+}
+
+function renderStatic() {
+  document.title = t("login.title");
+  if (reason === "expired" || reason === "signed-out") {
+    notice.className = "login-notice " + (reason === "expired" ? "tone-warn" : "tone-ok");
+    notice.textContent = t(reason === "expired" ? "login.notice.expired" : "login.notice.signedOut");
+    notice.hidden = false;
+  }
+  const revealed = reveal.getAttribute("aria-pressed") === "true";
+  reveal.setAttribute("aria-label", t(revealed ? "login.hide" : "login.show"));
+  reveal.title = t(revealed ? "login.hide" : "login.show");
+  if (currentError) showError(currentError.key, currentError.values);
+  updateSubmit();
+}
+
+function lockFor(seconds) {
+  lockedUntil = Date.now() + seconds * 1000;
+  window.clearInterval(lockTimer);
+  const tick = function () {
+    const remaining = Math.ceil((lockedUntil - Date.now()) / 1000);
+    if (remaining <= 0) {
+      window.clearInterval(lockTimer);
+      lockTimer = null;
+      clearError();
+      updateSubmit();
+      return;
+    }
+    showError("login.error.throttled", { seconds: remaining });
+    updateSubmit();
+  };
+  tick();
+  lockTimer = window.setInterval(tick, 1000);
+}
+
+reveal.addEventListener("click", function () {
+  const revealed = reveal.getAttribute("aria-pressed") !== "true";
+  reveal.setAttribute("aria-pressed", revealed ? "true" : "false");
+  password.type = revealed ? "text" : "password";
+  renderStatic();
+  password.focus();
+});
+
+password.addEventListener("input", function () {
+  if (currentError && currentError.key !== "login.error.throttled") clearError();
+});
+
+form.addEventListener("submit", async function (event) {
+  event.preventDefault();
+  if (busy || Date.now() < lockedUntil) return;
+  if (!password.value) {
+    showError("login.error.empty");
+    password.focus();
+    return;
+  }
+  clearError();
+  setBusy(true);
+  let response;
+  let body = null;
+  try {
+    response = await fetch("/auth/login", {
+      method: "POST", credentials: "same-origin", cache: "no-store",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ password: password.value, next: next })
+    });
+    try { body = await response.json(); } catch {}
+  } catch {
+    setBusy(false);
+    showError("login.error.network");
+    password.focus();
+    return;
+  }
+  if (response.ok && body && typeof body.location === "string" && body.location.startsWith("/") && !body.location.startsWith("//")) {
+    // Keep the busy state while the browser navigates to the destination.
+    window.location.replace(body.location + window.location.hash);
+    return;
+  }
+  setBusy(false);
+  if (response.status === 429) {
+    lockFor(Math.max(1, Number(body && body.retryAfterSeconds) || Number(response.headers.get("retry-after")) || 30));
+  } else if (response.status === 401) {
+    password.value = "";
+    showError("login.error.invalid");
+  } else if (response.status === 403) {
+    showError("login.error.origin");
+  } else if (response.status === 404 && body && body.code === "password-not-configured") {
+    window.location.replace("/");
+    return;
+  } else {
+    showError("login.error.network");
+  }
+  password.focus();
+});
+
+i18n.subscribe(renderStatic);
+transport.hidden = window.location.protocol !== "http:" || isLoopbackHost(window.location.hostname);
+renderStatic();
+password.focus();
+`;

package/dist/web/assets/client/app/main.js

@@ -17,7 +17,7 @@ export const APP_SCRIPT = String.raw `
 //   refresh  catalog.refresh → sidebar, then the overview (nothing selected)
 //            or selection.reload → taskView.render
 //   select   sidebar row / overview row / URL → selection.selectTask
-//   leave    back button or Escape → selection.clearSelection
+//   leave    rail Workbench or Escape → selection.clearSelection
 //   write    Task page or discussion afterWrite → quiet catalog refresh
 //   URL      load and back/forward → catalog.applyFilters + selection.followUrl
 import { createI18n } from "/assets/js/lib/i18n.js";
@@ -31,7 +31,9 @@ import { bindGlobalInput } from "/assets/js/views/globalInput.js";
 import { bindCreateTask } from "/assets/js/views/createTask.js";
 import { bindBodySearch } from "/assets/js/views/bodySearch.js";
 import { readQuery } from "/assets/js/layout/router.js";
+import { rememberPlace, linkPlaces } from "/assets/js/lib/prefs.js";
 import { createWorkspace } from "/assets/js/layout/workspace.js";
+import { createSidebarNav } from "/assets/js/layout/sidebarNav.js";
 import { bindShortcuts } from "/assets/js/layout/shortcuts.js";
 import { createTaskView } from "/assets/js/app/taskView.js";
 import { createSelection } from "/assets/js/app/selection.js";
@@ -39,12 +41,14 @@ import { createCatalog } from "/assets/js/app/catalog.js";
 
 const $ = function (selector) { return document.querySelector(selector); };
 const el = {
-  sidebar: $(".sidebar"), sidebarDivider: $("#sidebar-divider"), center: $("#center"), detail: $("#detail"),
-  search: $("#search"), filters: $("#status-filters"), attention: $("#attention-bar"), tasks: $("#task-list"),
+  sidebar: $(".sidebar"), rail: $(".app-rail"), railWorkbench: $("#rail-workbench"),
+  sidebarScrim: $("#sidebar-scrim"), sidebarCollapse: $("#sidebar-collapse"), sidebarDivider: $("#sidebar-divider"), center: $("#center"), detail: $("#detail"),
+  search: $("#search"), source: $("#catalog-source"), filters: $("#status-filters"), attention: $("#attention-bar"), tasks: $("#task-list"),
   catalogNext: $("#catalog-next"), catalogReset: $("#catalog-reset"), catalogCount: $("#catalog-count"),
   catalogAttentionReset: $("#catalog-attention-reset"),
   refresh: $("#refresh"), sync: $("#sync-state"), lastSync: $("#last-sync"), toast: $("#toast"),
-  operator: $("#operator-terminal"), settingsOpen: $("#settings-open"), settings: $("#settings-dialog"),
+  dockTarget: $("#dock-target"), dockTargetLabel: $("#dock-target-label"), dockTargetIcon: $("#dock-target-icon"),
+  dockTargetOptions: $("#dock-target-options"), globalInputOpen: $("#global-input-open"), settings: $("#settings-dialog"),
   locale: $("#locale-select"), themeOptions: $("#theme-options"),
   dock: $("#dock"), divider: $("#dock-divider"), dockSwap: $("#dock-swap"), dockClose: $("#dock-close"),
   dockTabDiscussion: $("#dock-tab-discussion"), dockTabSession: $("#dock-tab-session"),
@@ -52,7 +56,7 @@ const el = {
   dockTabPreview: $("#dock-tab-preview"), preview: $("#dock-preview"),
   discussion: $("#dock-discussion"), session: $("#dock-session"),
   terminalHost: $("#terminal-host"), terminalEmpty: $("#terminal-empty"), terminalState: $("#terminal-state"),
-  sessionTargets: $("#session-targets"), terminalCli: $("#terminal-cli")
+  sessionTargets: $("#session-targets"), settingsOpen: $("#settings-open"), terminalCli: $("#terminal-cli")
 };
 
 // View state. Each group has exactly one writer.
@@ -86,13 +90,18 @@ let taskView = null;
 let selection = null;
 let catalog = null;
 const workspace = createWorkspace({
-  el: el, state: state, terminal: terminal, conversation: conversation, preview: preview,
+  el: el, state: state, t: t, terminal: terminal, conversation: conversation, preview: preview,
   sessionOpened: function () { taskView.updateSessionTargets(); }
 });
+const sidebarNav = createSidebarNav({
+  el: { sidebar: el.sidebar, rail: el.rail, scrim: el.sidebarScrim, collapse: el.sidebarCollapse },
+  relayout: function () { workspace.updateLayout(); }
+});
 taskView = createTaskView({
   el: el, state: state, t: t, locale: locale, api: api, toast: toast, terminal: terminal, workspace: workspace,
   selectTask: function (taskId) { return selection.selectTask(taskId); },
   clearSelection: function () { selection.clearSelection(); },
+  revealSidebar: function () { sidebarNav.reveal(); },
   pickAttention: function (kind) { catalog.pickAttention(kind); },
   readPageSessions: function () { return catalog.readPageSessions(); },
   refreshCatalog: function () { return catalog.refresh({ quiet: true }); }
@@ -114,10 +123,24 @@ bindBodySearch({ t: t, api: api, selectTask: selection.selectTask,
   currentTask: function () { return state.selected; },
   captureDraftTarget: conversation.captureDraftTarget, insertReference: conversation.insertReference });
 bindShortcuts({
-  el: el, state: state, globalInput: globalInput, workspace: workspace,
+  el: el, state: state, globalInput: globalInput, workspace: workspace, sidebarNav: sidebarNav,
   selection: selection, catalog: catalog, taskView: taskView
 });
-el.settingsOpen.addEventListener("click", function () { window.location.assign("/settings"); });
+// Workbench <-> Models/Settings: each side remembers where the user was, so a
+// round trip returns to the same filters, Task and management section.
+function rememberWorkbench() { rememberPlace("workbench", window.location.pathname + window.location.search); }
+el.rail.querySelectorAll("a[data-nav-area]").forEach(function (link) { link.addEventListener("click", rememberWorkbench); });
+// The rail's Workbench entry on the workbench itself returns to the overview.
+el.railWorkbench.addEventListener("click", function (event) {
+  if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
+  event.preventDefault();
+  sidebarNav.closeDrawer();
+  selection.clearSelection();
+});
+window.addEventListener("pagehide", rememberWorkbench);
+function linkAll() { linkPlaces(el.rail); linkPlaces(el.sidebar); }
+window.addEventListener("pageshow", linkAll);
+linkAll();
 
 // The URL names the catalog filters and the selected Task (with its section).
 function applyStateFromUrl() {
@@ -140,9 +163,10 @@ i18n.subscribe(function () {
 
 workspace.updateLayout();
 taskView.showOverview();
+// The panel starts closed: name its owner without polling until it opens.
 conversation.open({ scope: "global", roleName: "operator" });
+conversation.close();
 applyStateFromUrl();
-workspace.restoreDefaultMode();
 catalog.refresh();
 window.setInterval(function () { catalog.refresh({ quiet: true }); }, 5000);
 `;

package/dist/web/assets/client/app/manage.js

@@ -2,5 +2,23 @@ export const MANAGE_SCRIPT = String.raw `
 import "/assets/js/app/settings.js";
 import "/assets/js/app/models.js";
 import { startManagement } from "/assets/js/layout/manageShell.js";
+import { createSidebarNav } from "/assets/js/layout/sidebarNav.js";
+import { isEditing } from "/assets/js/lib/dom.js";
+
+// The section list behaves like the workbench task list: collapsible beside
+// the content, a drawer (with the global rail) on narrow screens.
+const sidebarNav = createSidebarNav({
+  el: { sidebar: document.querySelector(".manage-rail"), rail: document.querySelector(".app-rail"), scrim: document.querySelector("#sidebar-scrim"),
+    collapse: document.querySelector("#sidebar-collapse") },
+  relayout: function () {}
+});
+document.querySelectorAll("[data-sidebar-toggle]").forEach(function (button) {
+  button.addEventListener("click", sidebarNav.reveal);
+});
+document.addEventListener("keydown", function (event) {
+  if (document.querySelector("dialog[open]") || event.metaKey || event.ctrlKey || event.altKey) return;
+  if (event.key === "Escape" && sidebarNav.drawerOpen()) { sidebarNav.closeDrawer(); return; }
+  if (event.key === "[" && !isEditing(document.activeElement)) sidebarNav.toggle();
+});
 startManagement();
 `;

package/dist/web/assets/client/app/selection.js

@@ -74,6 +74,7 @@ function clearSelection(deps) {
   syncUrl(deps.state, !urlTaskId());
   deps.workspace.updateLayout();
   deps.taskView.showOverview();
+  deps.taskView.revealPage();
   deps.renderTaskList();
   deps.taskView.updateSessionTargets();
 }
@@ -96,9 +97,11 @@ function followUrl(deps, params) {
     return;
   }
   if (state.selected && !canLeave(deps)) { syncUrl(state, true); return; }
+  const leaving = !!state.selected;
   dropSelection(deps);
   deps.workspace.updateLayout();
   deps.taskView.showOverview();
+  if (leaving) deps.taskView.revealPage();
 }
 
 async function load(deps, taskId, navigate) {
@@ -120,7 +123,7 @@ async function load(deps, taskId, navigate) {
   state.detail = detail;
   state.detailKey = fingerprint(core);
   deps.taskView.render(navigate);
-  if (navigate) deps.taskView.applySection(readQuery().get("section"));
+  if (navigate) { deps.taskView.applySection(readQuery().get("section")); deps.taskView.revealPage(); }
   observe(deps, taskId, detail);
 }
 

package/dist/web/assets/client/app/taskView.js

@@ -14,6 +14,7 @@ import { updateObservation } from "/assets/js/views/task/observation.js";
 import { renderDiscussion, discussionHasUnsent } from "/assets/js/views/dock/discussion.js";
 import { sameTarget } from "/assets/js/views/dock/terminal.js";
 import { setSectionParam } from "/assets/js/layout/router.js";
+import { enter } from "/assets/js/lib/motion.js";
 
 // Only the observed identity participates: observation timestamps advance on
 // every poll and would otherwise re-render continuously.
@@ -29,7 +30,7 @@ function runtimeSignature(detail) {
 }
 
 // deps: { el, state, t, locale, api, toast, terminal, workspace,
-//         selectTask, clearSelection, pickAttention, readPageSessions, refreshCatalog }
+//         selectTask, clearSelection, revealSidebar, pickAttention, readPageSessions, refreshCatalog }
 //   el         #detail, #center and the dock discussion
 //   state      reads selected, detail, detailKey and the catalog fields the
 //              overview shows; writes activeTab
@@ -37,7 +38,8 @@ function runtimeSignature(detail) {
 //   terminal   the dock's native Session (views/dock/terminal)
 //   workspace  layout/workspace: dock toggles and opening Sessions
 //   selectTask(taskId)  an overview row was chosen (app/selection)
-//   clearSelection()    the Task page's back button (app/selection)
+//   clearSelection()    the Task page's "Tasks" crumb (app/selection)
+//   revealSidebar()     the page header's task-list switch (layout/sidebarNav)
 //   pickAttention(kind), readPageSessions()  overview actions (app/catalog)
 //   refreshCatalog()    quiet catalog refresh after a write; resolves when done
 export function createTaskView(deps) {
@@ -59,7 +61,10 @@ export function createTaskView(deps) {
     showOverview: function () { showOverview(deps); },
     updateSessionTargets: function () { updateSessionTargets(deps); },
     switchTab: function (tab, options) { switchTab(deps, tab, options); },
-    applySection: function (section) { applySection(deps, section); }
+    applySection: function (section) { applySection(deps, section); },
+    // The page content after an explicit navigation (a Task opened, back to
+    // the overview) rises in; polling redraws never call this.
+    revealPage: function () { reveal(deps.el.detail.querySelector(":scope > .page")); }
   };
   return view.controller;
 }
@@ -143,9 +148,15 @@ function detailContext(view) {
   const api = deps.api;
   return {
     activeTab: deps.state.activeTab,
-    onTab: view.controller.switchTab,
+    onTab: function (tab, options) {
+      const changed = tab !== deps.state.activeTab;
+      switchTab(deps, tab, options);
+      if (changed) reveal(deps.el.detail.querySelector(".tab-panel:not([hidden])"));
+    },
     onBack: deps.clearSelection,
+    revealSidebar: deps.revealSidebar,
     showDock: deps.workspace.toggleDock,
+    toggleOperator: deps.workspace.toggleOperator,
     openConversation: function (materials) {
       deps.workspace.openConversation({ scope: "task", taskId: deps.state.selected, roleName: "leader" }, materials);
     },
@@ -253,8 +264,14 @@ function showOverview(deps) {
     select: deps.selectTask,
     filterAttention: deps.pickAttention,
     readSessions: deps.readPageSessions,
-    openOperator: deps.workspace.openOperator
+    toggleOperator: deps.workspace.toggleOperator,
+    revealSidebar: deps.revealSidebar
   });
+  deps.workspace.syncDockButtons();
+}
+
+function reveal(element) {
+  if (element && typeof enter === "function") enter(element, "rise");
 }
 
 function switchTab(deps, tab, options) {