@zq-silk/yui 2.14.0 → 2.16.0

package/dist/web/webAccess.js

@@ -1,8 +1,35 @@
-import { createHash, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { closeSync, constants, fstatSync, openSync, readFileSync } from "node:fs";
 import { isIP } from "node:net";
 import { networkInterfaces } from "node:os";
 import { isAbsolute } from "node:path";
+export const DEFAULT_WEB_SESSION_POLICY = Object.freeze({
+    idleMs: 8 * 60 * 60 * 1000,
+    absoluteMs: 24 * 60 * 60 * 1000,
+    maxSessions: 32,
+    failureWindowMs: 60 * 1000,
+    maxFailures: 5,
+    now: () => Date.now()
+});
+/** A post-login destination must stay a same-origin document path. Anything
+ * else (absolute/protocol-relative URLs, backslashes, API/auth/asset paths)
+ * falls back to the workbench root. */
+export function safeReturnPath(candidate) {
+    if (typeof candidate !== "string" || candidate.length > 2048 || !candidate.startsWith("/")
+        || candidate.startsWith("//") || /[\\\u0000-\u001f\u007f]/u.test(candidate))
+        return "/";
+    try {
+        const url = new URL(candidate, "http://return.invalid");
+        if (url.origin !== "http://return.invalid")
+            return "/";
+        if (/^\/(?:login|auth|api|assets|preview)(?:\/|$)/u.test(url.pathname))
+            return "/";
+        return url.pathname + url.search;
+    }
+    catch {
+        return "/";
+    }
+}
 export function isLoopbackAddress(host) {
     return host === "localhost" || host === "::1" || /^127\./.test(host) && isIP(host) === 4;
 }
@@ -39,7 +66,7 @@ function passwordDigest(path) {
         const password = readFileSync(fd, "utf8").replace(/\r?\n$/, "");
         if (!/^[\x21-\x7e]{32,128}$/.test(password))
             throw new Error("invalid password");
-        return createHash("sha256").update(`Basic ${Buffer.from(`yui:${password}`).toString("base64")}`).digest();
+        return createHash("sha256").update(password).digest();
     }
     catch {
         // Never include file contents, OS error text or a submitted credential.
@@ -50,7 +77,7 @@ function passwordDigest(path) {
             closeSync(fd);
     }
 }
-export function createWebAccess(options, interfaces = networkInterfaces()) {
+export function createWebAccess(options, interfaces = networkInterfaces(), policy = DEFAULT_WEB_SESSION_POLICY) {
     validateWebAccessOptions(options);
     const lan = !isLoopbackAddress(options.host);
     const digest = options.authFile === undefined ? undefined : passwordDigest(options.authFile);
@@ -65,6 +92,41 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
     const allowed = new Set(!lan || wildcard ? [...addresses, "127.0.0.1", "::1", "localhost"] : addresses);
     const urlHost = (host) => isIP(host) === 6 ? `[${host}]` : host;
     const urls = addresses.map(host => `http://${urlHost(host)}:${options.port}`);
+    // Cookies are scoped by host, not port: include the port so two listeners on
+    // one machine cannot overwrite each other's session.
+    const cookieName = `yui_session_${options.port}`;
+    // Keyed by a hash of the opaque cookie value; the raw value is never stored.
+    const sessions = new Map();
+    const failures = new Map();
+    const sessionKey = (request) => {
+        const header = request.headers.cookie;
+        if (typeof header !== "string" || header.length > 8192)
+            return undefined;
+        for (const part of header.split(";")) {
+            const index = part.indexOf("=");
+            if (index > 0 && part.slice(0, index).trim() === cookieName) {
+                const value = part.slice(index + 1).trim();
+                return /^[A-Za-z0-9_-]{43}$/.test(value) ? createHash("sha256").update(value).digest("hex") : undefined;
+            }
+        }
+        return undefined;
+    };
+    const live = (key, touch) => {
+        if (key === undefined)
+            return false;
+        const session = sessions.get(key);
+        if (!session)
+            return false;
+        const now = policy.now();
+        if (now - session.seen >= policy.idleMs || now - session.created >= policy.absoluteMs) {
+            sessions.delete(key);
+            return false;
+        }
+        if (touch)
+            session.seen = now;
+        return true;
+    };
+    const cookie = (value, maxAgeSeconds) => `${cookieName}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAgeSeconds}`;
     const warnings = lan ? [
         "HTTP is not encrypted. Use only a trusted network; credentials and data are visible to network observers.",
         ...(wildcard ? ["Wildcard binding listens on all matching interfaces, including public ones. Yui does not open firewall ports or tunnels."] : []),
@@ -72,7 +134,8 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
     ] : [];
     return {
         lan,
-        authentication: digest ? "basic" : "local",
+        authentication: digest ? "password" : "local",
+        passwordRequired: digest !== undefined,
         urls,
         warnings,
         acceptsHost(request) {
@@ -98,12 +161,69 @@ export function createWebAccess(options, interfaces = networkInterfaces()) {
             return request.headers["sec-fetch-site"] !== "cross-site"
                 && (origin === undefined ? !requireOrigin : origin === `http://${request.headers.host}`);
         },
+        /** Every protected request/handshake checks the listener's session table. */
         authenticated(request) {
+            return !digest || live(sessionKey(request), true);
+        },
+        /** True when the request carries this listener's cookie name, valid or not. */
+        presentedSession(request) {
+            return typeof request.headers.cookie === "string"
+                && request.headers.cookie.split(";").some(part => part.trim().startsWith(`${cookieName}=`));
+        },
+        /** Opaque identity for binding long-lived connections; not a credential. */
+        sessionOf(request) {
+            const key = sessionKey(request);
+            return live(key, false) ? key : undefined;
+        },
+        sessionActive(key) { return !digest || live(key, false); },
+        login(request, password) {
             if (!digest)
-                return true;
-            const authorization = request.headers.authorization;
-            return typeof authorization === "string" && authorization.length <= 512
-                && timingSafeEqual(createHash("sha256").update(authorization).digest(), digest);
-        }
+                return { ok: false, reason: "unconfigured" };
+            const now = policy.now();
+            const address = request.socket.remoteAddress ?? "unknown";
+            const recent = (failures.get(address) ?? []).filter(at => now - at < policy.failureWindowMs);
+            if (recent.length >= policy.maxFailures) {
+                failures.set(address, recent);
+                return { ok: false, reason: "throttled",
+                    retryAfterSeconds: Math.max(1, Math.ceil((recent[0] + policy.failureWindowMs - now) / 1000)) };
+            }
+            const valid = typeof password === "string" && password.length <= 256
+                && timingSafeEqual(createHash("sha256").update(password).digest(), digest);
+            if (!valid) {
+                recent.push(now);
+                failures.delete(address);
+                failures.set(address, recent);
+                // Bound memory: forget the oldest addresses first.
+                while (failures.size > 1024)
+                    failures.delete(failures.keys().next().value);
+                return { ok: false, reason: "invalid" };
+            }
+            failures.delete(address);
+            for (const [key, session] of sessions) {
+                if (now - session.seen >= policy.idleMs || now - session.created >= policy.absoluteMs)
+                    sessions.delete(key);
+            }
+            while (sessions.size >= policy.maxSessions) {
+                let oldest;
+                let seen = Infinity;
+                for (const [key, session] of sessions)
+                    if (session.seen < seen) {
+                        seen = session.seen;
+                        oldest = key;
+                    }
+                sessions.delete(oldest);
+            }
+            const value = randomBytes(32).toString("base64url");
+            sessions.set(createHash("sha256").update(value).digest("hex"), { created: now, seen: now });
+            return { ok: true, cookie: cookie(value, Math.floor(policy.absoluteMs / 1000)) };
+        },
+        /** Revokes the presented session (if any) and returns a clearing cookie. */
+        logout(request) {
+            const key = sessionKey(request);
+            if (key !== undefined)
+                sessions.delete(key);
+            return cookie("", 0);
+        },
+        clearCookie() { return cookie("", 0); }
     };
 }

package/dist/web/webServer.js

@@ -1,7 +1,7 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
-import { createWebAccess, validateWebAccessOptions } from "./webAccess.js";
+import { createWebAccess, safeReturnPath, validateWebAccessOptions } from "./webAccess.js";
 import { CliError, usageError } from "../errors/cliError.js";
 import { parseTaskCatalogOptions } from "../context/taskCatalog.js";
 import { parseTaskSearchOptions, searchTaskBodies } from "../context/taskSearch.js";
@@ -10,9 +10,11 @@ import { readWebTaskActivity } from "./webTaskActivity.js";
 import { WebRequestRejected } from "./webMutation.js";
 import { MODELS_HTML } from "./assets/shell/models.js";
 import { TASK_SUBMISSION_INTENTS } from "../message/message.js";
-import { DASHBOARD_HTML, findWebAsset, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
+import { DASHBOARD_HTML, findWebAsset, isLoginAsset, LOGIN_HTML, prepareWebDocument, WEB_ASSET_VERSION } from "./assets/assetManifest.js";
 import { buildWebTaskCatalog, buildWebPageSessions, buildWebTaskDetail } from "./webSnapshot.js";
 const MAX_JSON_BODY_BYTES = 16 * 1024;
+const MAX_LOGIN_BODY_BYTES = 4 * 1024;
+const TERMINAL_SESSION_SWEEP_MS = 30 * 1000;
 const MAX_TERMINAL_MESSAGE_BYTES = 64 * 1024;
 const MAX_TERMINAL_BUFFERED_BYTES = 1024 * 1024;
 export function parseWebCommandOptions(args) {
@@ -57,8 +59,19 @@ export function createYuiWebServer(store, dependencies = {}, options = { host: "
         perMessageDeflate: false,
         maxPayload: MAX_TERMINAL_MESSAGE_BYTES
     });
+    // Terminal sockets outlive their handshake: bind each to its browser session
+    // and close it when that session is signed out or expires.
+    const terminalSessions = new WeakMap();
+    const sweepTerminals = () => {
+        for (const socket of webSocketServer.clients) {
+            if (!access.sessionActive(terminalSessions.get(socket)))
+                socket.terminate();
+        }
+    };
+    const sweep = access.passwordRequired ? setInterval(sweepTerminals, TERMINAL_SESSION_SWEEP_MS) : undefined;
+    sweep?.unref();
     const server = createServer((request, response) => {
-        void handleHttpRequest(request, response, store, httpDependencies, token, now, access).catch(() => {
+        void handleHttpRequest(request, response, store, httpDependencies, token, now, access, sweepTerminals).catch(() => {
             if (!response.headersSent)
                 setSecurityHeaders(response);
             if (!response.writableEnded) {
@@ -67,13 +80,15 @@ export function createYuiWebServer(store, dependencies = {}, options = { host: "
         });
     });
     server.on("upgrade", (request, socket, head) => {
-        void handleTerminalUpgrade(request, socket, head, webSocketServer, dependencies.terminal, token, access);
+        void handleTerminalUpgrade(request, socket, head, webSocketServer, dependencies.terminal, token, access, terminalSessions);
     });
     let terminalsClosed = false;
     const closeTerminals = () => {
         if (terminalsClosed)
             return;
         terminalsClosed = true;
+        if (sweep)
+            clearInterval(sweep);
         for (const socket of webSocketServer.clients)
             socket.terminate();
         webSocketServer.close();
@@ -98,7 +113,7 @@ export async function startYuiWebServer(store, options, dependencies = {}) {
     }
     return server;
 }
-async function handleHttpRequest(request, response, store, dependencies, token, now, access) {
+async function handleHttpRequest(request, response, store, dependencies, token, now, access, sweepTerminals) {
     setSecurityHeaders(response);
     const method = request.method ?? "GET";
     const previewAuthenticated = dependencies.previews?.authenticated(request) === true;
@@ -106,19 +121,54 @@ async function handleHttpRequest(request, response, store, dependencies, token,
         sendJson(response, 403, { error: "Invalid Host or Origin.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
-    if (!previewAuthenticated && !access.authenticated(request)) {
-        response.setHeader("www-authenticate", 'Basic realm="Yui Web", charset="UTF-8"');
-        sendJson(response, 401, { error: "Web authentication required. Use username yui and the configured password. To revoke access, stop Web; to rotate the password, replace the credential file and restart Web.", disposition: "not-submitted" }, method === "HEAD");
-        return;
-    }
     let pathname;
+    let search;
     try {
-        pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+        const url = new URL(request.url ?? "/", "http://localhost");
+        pathname = url.pathname;
+        search = url.search;
     }
     catch {
         sendJson(response, 400, { error: "Invalid URL.", disposition: "not-submitted" }, method === "HEAD");
         return;
     }
+    // The sign-in page, its static assets and the session endpoints are the only
+    // routes reachable without a session. They expose no Task data or page token.
+    if (pathname === "/login" || pathname === "/auth/login" || pathname === "/auth/logout") {
+        await handleAuthRoute(request, response, pathname, search, access, sweepTerminals);
+        return;
+    }
+    if ((method === "GET" || method === "HEAD") && isLoginAsset(pathname)) {
+        const assetVersion = new URL(request.url, "http://localhost").searchParams.get("v");
+        const asset = findWebAsset(pathname, assetVersion);
+        if (asset) {
+            sendAsset(response, asset, method === "HEAD", assetVersion === WEB_ASSET_VERSION);
+            return;
+        }
+    }
+    if (!previewAuthenticated && !access.authenticated(request)) {
+        const expired = access.presentedSession(request);
+        if (expired)
+            response.setHeader("set-cookie", access.clearCookie());
+        // Browser navigations go to the sign-in page; data, asset, preview and
+        // write requests get a plain 401. No WWW-Authenticate challenge is sent,
+        // so browsers never show their native credential prompt.
+        if ((method === "GET" || method === "HEAD") && !/^\/(?:api|assets|preview)\//u.test(pathname)) {
+            const next = safeReturnPath(pathname + search);
+            const query = new URLSearchParams({ ...(next === "/" ? {} : { next }), ...(expired ? { reason: "expired" } : {}) }).toString();
+            response.statusCode = 303;
+            response.setHeader("location", `/login${query ? `?${query}` : ""}`);
+            response.setHeader("content-length", 0);
+            response.end();
+            return;
+        }
+        sendJson(response, 401, {
+            error: expired ? "Your Yui Web session has expired. Sign in again." : "Sign in to Yui Web first.",
+            code: "authentication-required",
+            disposition: "not-submitted"
+        }, method === "HEAD");
+        return;
+    }
     // Authentication precedes every document/preview. The page token remains
     // an independent CSRF boundary. A request body cannot
     // select Operator/Leader authority; all API reads use this boundary too.
@@ -774,7 +824,7 @@ async function handleHttpRequest(request, response, store, dependencies, token,
     response.setHeader("allow", "GET, HEAD");
     sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
 }
-async function handleTerminalUpgrade(request, socket, head, webSocketServer, terminalPort, token, access) {
+async function handleTerminalUpgrade(request, socket, head, webSocketServer, terminalPort, token, access, terminalSessions) {
     try {
         const url = new URL(request.url ?? "/", "http://localhost");
         if (!access.acceptsHost(request) || !access.acceptsOrigin(request, true) || !access.authenticated(request)) {
@@ -796,15 +846,26 @@ async function handleTerminalUpgrade(request, socket, head, webSocketServer, ter
             return;
         }
         const terminalRequest = parseTerminalRequest(url.searchParams);
+        const session = access.sessionOf(request);
         webSocketServer.handleUpgrade(request, socket, head, (webSocket) => {
-            void connectTerminal(webSocket, terminalPort, terminalRequest);
+            terminalSessions.set(webSocket, session);
+            void connectTerminal(webSocket, terminalPort, terminalRequest, () => access.sessionActive(session));
         });
     }
     catch {
         rejectUpgrade(socket, 400, "Bad Request");
     }
 }
-async function connectTerminal(webSocket, terminalPort, request) {
+async function connectTerminal(webSocket, terminalPort, request, 
+// The socket's browser session is rechecked at every boundary that would
+// relay data: the periodic sweep only reclaims idle sockets, it is not the
+// authorization for input or output.
+authorized) {
+    const expire = () => {
+        if (webSocket.readyState === WebSocket.OPEN || webSocket.readyState === WebSocket.CONNECTING) {
+            webSocket.close(1008, "Session expired");
+        }
+    };
     let disconnected = false;
     const markDisconnected = () => {
         disconnected = true;
@@ -831,6 +892,11 @@ async function connectTerminal(webSocket, terminalPort, request) {
         connection.close();
         return;
     }
+    if (!authorized()) {
+        connection.close();
+        expire();
+        return;
+    }
     let closed = false;
     let stopData = () => { };
     let stopExit = () => { };
@@ -842,9 +908,20 @@ async function connectTerminal(webSocket, terminalPort, request) {
         stopExit();
         connection.close();
     };
+    const permitted = () => {
+        if (closed)
+            return false;
+        if (authorized())
+            return true;
+        close();
+        expire();
+        return false;
+    };
     webSocket.once("close", close);
     webSocket.once("error", close);
     stopData = connection.onData((data) => {
+        if (!permitted())
+            return;
         if (webSocket.bufferedAmount > MAX_TERMINAL_BUFFERED_BYTES) {
             webSocket.close(1013, "Terminal client is too slow");
             return;
@@ -856,6 +933,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
         return;
     }
     stopExit = connection.onExit((exit) => {
+        if (!permitted())
+            return;
         sendWebSocket(webSocket, { type: "exit", ...exit });
         webSocket.close(1000, "Terminal detached");
         close();
@@ -865,6 +944,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
         return;
     }
     webSocket.on("message", (payload, binary) => {
+        if (!permitted())
+            return;
         if (binary) {
             webSocket.close(1003, "Invalid terminal message");
             return;
@@ -882,6 +963,8 @@ async function connectTerminal(webSocket, terminalPort, request) {
             webSocket.close(1003, "Invalid terminal message");
         }
     });
+    if (!permitted())
+        return;
     sendWebSocket(webSocket, {
         type: "ready",
         readOnly: connection.readOnly,
@@ -1085,6 +1168,79 @@ async function readJsonBody(request, limit = MAX_JSON_BODY_BYTES) {
         throw new Error("Request body must be valid JSON.");
     }
 }
+/** Sign-in page and session endpoints. The page carries no page token; login
+ * and logout require a same-origin JSON POST, so a cross-site form cannot
+ * sign the browser in or out. */
+async function handleAuthRoute(request, response, pathname, search, access, sweepTerminals) {
+    const method = request.method ?? "GET";
+    if (pathname === "/login") {
+        if (method !== "GET" && method !== "HEAD") {
+            response.setHeader("allow", "GET, HEAD");
+            sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
+            return;
+        }
+        if (!access.passwordRequired || access.authenticated(request)) {
+            response.statusCode = 303;
+            response.setHeader("location", safeReturnPath(new URLSearchParams(search).get("next")));
+            response.setHeader("content-length", 0);
+            response.end();
+            return;
+        }
+        if (access.presentedSession(request))
+            response.setHeader("set-cookie", access.clearCookie());
+        sendText(response, 200, "text/html; charset=utf-8", prepareWebDocument(LOGIN_HTML, "/assets/js/app/login.js"), method === "HEAD");
+        return;
+    }
+    if (method !== "POST") {
+        response.setHeader("allow", "POST");
+        sendJson(response, 405, { error: "Method not allowed.", disposition: "not-submitted" }, method === "HEAD");
+        return;
+    }
+    if (!access.acceptsOrigin(request, true)
+        || !/^application\/json(?:;|$)/iu.test(headerValue(request, "content-type") ?? "")) {
+        sendJson(response, 403, { error: "Sign-in requests must be same-origin JSON.", disposition: "not-submitted" }, false);
+        return;
+    }
+    if (pathname === "/auth/logout") {
+        response.setHeader("set-cookie", access.logout(request));
+        sweepTerminals();
+        sendJson(response, 200, { location: access.passwordRequired ? "/login?reason=signed-out" : "/" }, false);
+        return;
+    }
+    let body;
+    try {
+        body = await readJsonBody(request, MAX_LOGIN_BODY_BYTES);
+    }
+    catch {
+        sendJson(response, 400, { error: "Invalid sign-in request.", code: "invalid-request", disposition: "not-submitted" }, false);
+        return;
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)
+        || Object.keys(body).some(key => key !== "password" && key !== "next")
+        || typeof body.password !== "string") {
+        sendJson(response, 400, { error: "Invalid sign-in request.", code: "invalid-request", disposition: "not-submitted" }, false);
+        return;
+    }
+    const { password, next } = body;
+    const result = access.login(request, password);
+    if (result.ok) {
+        response.setHeader("set-cookie", result.cookie);
+        sendJson(response, 200, { location: safeReturnPath(next) }, false);
+    }
+    else if (result.reason === "throttled") {
+        response.setHeader("retry-after", String(result.retryAfterSeconds));
+        sendJson(response, 429, { error: "Too many failed sign-in attempts. Wait and try again.",
+            code: "throttled", retryAfterSeconds: result.retryAfterSeconds, disposition: "not-submitted" }, false);
+    }
+    else if (result.reason === "unconfigured") {
+        sendJson(response, 404, { error: "Password sign-in is not configured for this listener.",
+            code: "password-not-configured", disposition: "not-submitted" }, false);
+    }
+    else {
+        // Never echo the submitted value.
+        sendJson(response, 401, { error: "Incorrect password.", code: "invalid-credential", disposition: "not-submitted" }, false);
+    }
+}
 function setSecurityHeaders(response) {
     response.setHeader("cache-control", "no-store");
     response.setHeader("content-security-policy", "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");

package/docs/release-workflow.md

@@ -51,6 +51,63 @@ merely to avoid a version decision. Package versions remain distinct from protoc
 and persistent-storage contracts: their compatibility checks and required migrations
 are unchanged, and the storage rules below do not authorize a package release.
 
+### 2.16.0 compatibility and migration notes
+
+This minor refreshes the Web workbench (PR #484). One global navigation rail
+(Workbench / Models / Settings) is shared by the workbench and management pages,
+and the task sidebar can be collapsed. Dialogs, menus, presses and column layout
+changes use one motion source; reduced-motion preferences, narrow layouts and
+hidden documents get instant updates. The 「結」 brand glyph is replaced by a
+vector capital-Y mark drawn from the active theme's tokens, and each theme has a
+matching SVG favicon that follows theme switches.
+
+These are presentation changes only. Web APIs, sign-in sessions, `--auth-file`,
+CLI commands and Controller/Host protocols are unchanged. Scripts or browser
+automation that matched the old brand glyph or previous navigation markup must
+use the current page structure. Storage remains **1.21**; there is no migration.
+
+With separate upgrade authorization, use `yui update --version 2.16.0`; the
+updater owns preflight, backup and Controller handover. A running Web listener
+serves the new assets after it is restarted. Release gates reuse exact-commit
+Core CI and the existing fresh-install matrix (Linux x64, macOS x64/arm64,
+Node 20/22/24/26). Publishing does not update the global CLI, migrate a
+production Home, restart its Controller or deploy a production Web listener.
+
+### 2.15.0 compatibility and migration notes
+
+This minor replaces the browser's HTTP Basic prompt with a standalone English/
+Chinese sign-in page, inline errors and safe return to the requested page.
+The credential file format and `--auth-file` stay unchanged, but HTTP Basic
+`Authorization` headers are no longer accepted. Scripts must obtain a session
+through same-origin JSON `POST /auth/login` and retain its cookie; status now
+reports `local`/`password`, not `local`/`basic`. See [Web access](web-access.md).
+
+Sessions are listener-local and in memory, with an 8-hour inactivity limit and
+24-hour absolute limit. There is no sign-out button; the backend logout endpoint
+and session revocation remain. Every terminal relay boundary checks the session.
+Stopping or restarting Web ends all sessions. HTTP remains unencrypted and is
+for trusted networks only; this is not multi-user authentication or public TLS
+hosting.
+
+This release also includes timezone-aligned default Project sync (PR #481):
+new defaults use `0 */6 * * *` with a captured explicit timezone. Storage moves
+from **1.20 to 1.21** through the centralized migration. Only provably unedited
+revision-1 built-in defaults are converted, with original bytes retained;
+higher revisions and customized/disabled plans are preserved. See
+[Project sync](project-sync.md) for explicit schedule updates. Earlier supported
+Homes use the existing contiguous same-major migration chain.
+
+With separate upgrade authorization, use `yui update --version 2.15.0`; the
+updater owns backup, migration and Controller handover. Do not edit storage
+manually or open upgraded Homes with an older binary. Minor numbering is not
+a blanket compatibility promise.
+
+Release gates reuse exact-commit Core CI and install the same checksummed
+runtime archive on Linux x64 and macOS x64/arm64 with Node 20/22/24/26 before
+npm publication. These are isolated deterministic checks, not real-model
+validation. Publishing does not update the global CLI, migrate a production
+Home, restart its Controller or deploy a production Web listener.
+
 ### 2.14.0 compatibility and migration notes
 
 The `v2.13.0` tag is retained as failed release evidence: its publication gates
@@ -827,6 +884,16 @@ The tag-triggered `publish.yml` workflow is the only maintained release smoke.
 It reuses the exact commit that passed core CI and adds only artifact assembly,
 fresh installation, and provenance checks required to publish.
 
+Business contracts and full Jobs/Schedules wiring run once in Core CI on Linux
+Node 24. Release still installs the same checksummed archive on all three
+platforms × Node 20/22/24/26: every install checks CLI/setup/native helpers,
+Doctor/PTY and real SQLite SQL/GC. Node 24 additionally checks real process
+lifecycle on each platform. See the [coverage table](testing/verification-levels.md#ci-and-release).
+Dependency installation does not build the project; each source job builds once
+and verifies native dependencies afterwards. Smoke logs separate phase timings.
+Post-publication registry checks and byte-identical GitHub assets are distinct
+evidence and are not replaced by pre-publication smoke.
+
 That workflow authenticates through npm Trusted Publishing (OIDC), so the
 release identity lives in two places outside the tag: `repository`, `bugs`, and
 `homepage` are copied verbatim from the source `package.json` into the published

package/docs/release-workflow.zh-CN.md

@@ -36,6 +36,48 @@ Agent 选择一个预先声明的计划，设施从持久状态驱动该计划
 不能将不兼容冒称为兼容，也不为回避版本选择新增历史兼容机制。包版本与协议、
 持久存储契约仍然独立：兼容性检查和必要迁移要求不变，下文存储规则不授予发版权限。
 
+### 2.16.0 兼容性及迁移说明
+
+本 minor 更新 Web 工作台（PR #484）：工作台与管理页共用一条全局导航栏
+（工作台 / 模型 / 设置），任务侧栏可折叠。弹窗、菜单、按压与分栏布局变化使用统一动效来源；
+开启减少动态效果、窄屏布局或页面不可见时直接更新。品牌标志由「結」改为矢量大写 Y，
+颜色取自当前主题令牌；每个主题配有对应的 SVG favicon，随主题切换。
+
+以上仅为界面变化。Web API、登录会话、`--auth-file`、CLI 命令以及 Controller/Host 协议均不变。
+依赖旧品牌字形或旧导航结构的脚本、浏览器自动化需改用当前页面结构。存储仍为 **1.21**，无迁移。
+
+另行获得升级授权后，使用 `yui update --version 2.16.0`；更新器负责预检、备份与 Controller 交接。
+正在运行的 Web 监听器需重启后才会提供新资源。发布门禁复用同一提交的 Core CI 与既有全新安装矩阵
+（Linux x64、macOS x64/arm64，Node 20/22/24/26）。发布不会更新全局 CLI、迁移生产 Home、
+重启其 Controller 或部署生产 Web 监听器。
+
+### 2.15.0 兼容性及迁移说明
+
+本 minor 以独立中英文登录页替代浏览器 HTTP Basic 弹窗，支持页内错误提示及安全回跳。
+凭证文件格式和 `--auth-file` 不变，但不再接受 HTTP Basic `Authorization` 请求头。
+脚本须通过同源 JSON `POST /auth/login` 获取会话并保留 Cookie；状态中的认证方式改为
+`local`/`password`，不再是 `local`/`basic`。详见 [Web 访问](web-access.md)。
+
+会话仅保存在当前监听器内存中，闲置上限为 8 小时，绝对上限为 24 小时。
+界面不提供登出按钮，但保留后端注销与会话撤销能力；终端每个数据转发边界均检查会话。
+停止或重启 Web 会结束所有会话。HTTP 仍未加密，只用于可信网络；
+本功能不是多用户认证或公网 TLS 托管。
+
+本版本也包含按时区时钟对齐的默认 Project 同步（PR #481）：
+新默认规则使用 `0 */6 * * *`，保存明确的时区。存储通过集中迁移从 **1.20 升至 1.21**。
+仅转换可证明未编辑过的 revision-1 内置默认规则，并保留原始字节；
+更高修订以及自定义、禁用计划保持不变。显式切换计划的方法见
+[Project 同步](project-sync.zh-CN.md)。更早的受支持 Home 使用既有同 major 连续迁移链。
+
+获得独立升级授权后可执行 `yui update --version 2.15.0`，由 updater 负责备份、
+迁移及 Controller 交接。不要手工修改存储或以旧二进制打开已升级 Home；
+minor 编号不是一般性的向后兼容承诺。
+
+发布门禁复用精确 commit 的 Core CI，并在 Linux x64、macOS x64/arm64 与
+Node 20/22/24/26 的组合上全新安装同一份带校验和的运行时包，全部通过后发布 npm。
+这些是隔离、确定性验证，不是真实模型验证。发布不会更新全局 CLI、迁移生产 Home、
+重启其 Controller 或部署生产 Web 监听器。
+
 ### 2.14.0 兼容性及迁移说明
 
 保留 `v2.13.0` 标签作为失败发布证据：其发布门禁在 npm 发布前失败。
@@ -627,6 +669,13 @@ yui task grant revoke task-15 capability-grant-1
 由 tag 触发的 `publish.yml` 工作流是唯一维护的发布冒烟。它复用那个通过了 core CI 的
 确切 commit，只增加发布所需的产物装配、全新安装和 provenance 检查。
 
+业务契约与完整 Jobs/Schedules 链路仅在 Core CI 的 Linux Node 24 执行一次。
+发布仍在三平台 × Node 20/22/24/26 全部安装同一个已校验 tarball：每组都验证
+CLI/setup/原生 helper、Doctor/PTY 和真实 SQLite SQL/GC；各平台 Node 24 额外验证
+真实进程生命周期。参见[分层覆盖表](testing/verification-levels.zh-CN.md#ci-与发布)。
+依赖安装不再隐含构建，每个源码作业只构建一次，再验证原生依赖；smoke 输出分段耗时。
+发布后的 registry 检查和 GitHub 资产逐字节核验是独立证据，不被发布前 smoke 替代。
+
 该工作流通过 npm Trusted Publishing（OIDC）认证，因此发布身份存在于 tag 之外的两处：
 `repository`、`bugs` 和 `homepage` 由 `assemble-runtime-package.mjs` 从源 `package.json`
 逐字复制进已发布 manifest，而该包的 npm Trusted Publisher 条目点明 GitHub owner、

package/docs/storage-baseline.md

@@ -2,7 +2,13 @@
 
 # Storage baseline 1.0
 
-Current storage is 1.20. The 1.19 → 1.20 transition adds Agent Job configurations,
+Current storage is 1.21. The 1.20 → 1.21 transition converts provably unedited
+built-in Project sync defaults to timezone-explicit clock schedules, archiving
+their original bytes under migration 21. Ambiguous higher revisions and custom
+plans remain unchanged; no Git work or reauthorization occurs. See
+[Project sync](project-sync.md) for the conservative upgrade boundary.
+
+The 1.19 → 1.20 transition adds Agent Job configurations,
 optional Job ownership on Global Roles, and the `agent_job_runs` table for
 exact original-message/native-attempt evidence and explicit business results.
 Existing Role, Session, process Run and artifact identities are unchanged;

package/docs/storage-baseline.zh-CN.md

@@ -2,7 +2,12 @@
 
 # 存储基线 1.0
 
-当前存储为 1.20。1.19 → 1.20 增加 Agent Job 配置、Global Role 的可选 Job
+当前存储为 1.21。1.20 → 1.21 将可证明未经修改的旧内置 Project 同步默认计划
+转换为显式时区的整点计划，在 migration 21 下归档原始字节。更高 revision 的
+来源不明确计划及自定义计划保留，不执行 Git 或重新授权。保守转换边界见
+[Project 同步](project-sync.zh-CN.md)。
+
+1.19 → 1.20 增加 Agent Job 配置、Global Role 的可选 Job
 归属和 `agent_job_runs` 表，保存原始消息、准确原生尝试与显式业务结果。
 保留现有 Role、Session、进程 Run 和固定产物身份；迁移不创建 Agent 或原生会话。