agent-nuvira 3.5.7 → 3.5.10

package/dist/web-dashboard/server.js

@@ -31,7 +31,7 @@ import { classifyEntries, } from '../learning/cost-classification.js';
 import { acceptanceSummary, collectLabelledTurns, serializeLabelledTurns, parseCorpusText, detectCorpusFormat, mergeImportedLabels, } from '../learning/acceptance-model.js';
 import { readDecisions, recallDecisions, reviseDecision } from '../learning/decision-log.js';
 import { degradedCallsFromTraces } from '../learning/reasoning-trace.js';
-import { withStrictModel } from '../inference/route-resolver.js';
+import { strictPinPolicy, withStrictModel } from '../inference/route-resolver.js';
 import { readRecallHits } from '../context/session-recall.js';
 import { getRouterPromotion } from '../learning/router-promotion.js';
 import { AUTH_CLEAR_THRESHOLD } from '../learning/key-hygiene.js';
@@ -57,6 +57,7 @@ import { FRESH_DAYS, FRESHNESS_COPY, REACHABILITY_COPY, classifyFreshness, class
 import { VERIFY_BACKLOG_DEFAULT_PER_RUN, VERIFY_BACKLOG_MAX_PER_RUN, getVerifyBacklogState, startVerifyBacklogRun, } from '../learning/model-verify-job.js';
 import { setToolsetEnabled } from '../tools/toolsets.js';
 import { ArtifactStore } from '../tools/artifact-store.js';
+import { motionRenderFile, motionRenders } from './motion-data.js';
 import { setSkillEnabled } from '../learning/hub-skill-catalog.js';
 // I11 — dashboard channel send-test: the same registry/adapters `nuvira gateway
 // send` uses, so a Channels-tab test message behaves identically to the CLI.
@@ -156,6 +157,43 @@ function artifactFileMime(file, recorded) {
     };
     return byExt[ext] ?? 'application/octet-stream';
 }
+/**
+ * Stream a media file, with byte-range support.
+ *
+ * A `<video>` that cannot seek cannot be reviewed: the player asks for ranges
+ * the moment the user drags the scrubber. Shared by the artifact endpoint and
+ * the motion endpoint so a second media route cannot quietly lose that — the
+ * same reason the artifact route says it never takes a path from the query.
+ */
+function streamMedia(req, res, filePath, type) {
+    const size = statSync(filePath).size;
+    const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range ?? '');
+    if (range) {
+        const start = range[1] ? Number(range[1]) : 0;
+        const end = range[2] ? Math.min(Number(range[2]), size - 1) : size - 1;
+        if (start >= size || end < start) {
+            res.writeHead(416, { 'Content-Range': `bytes */${size}` });
+            res.end();
+            return;
+        }
+        res.writeHead(206, {
+            'Content-Type': type,
+            'Content-Length': String(end - start + 1),
+            'Content-Range': `bytes ${start}-${end}/${size}`,
+            'Accept-Ranges': 'bytes',
+            'Cache-Control': 'no-store',
+        });
+        createReadStream(filePath, { start, end }).pipe(res);
+        return;
+    }
+    res.writeHead(200, {
+        'Content-Type': type,
+        'Content-Length': String(size),
+        'Accept-Ranges': 'bytes',
+        'Cache-Control': 'no-store',
+    });
+    createReadStream(filePath).pipe(res);
+}
 function loadAlwaysWatchQuotaFlag() {
     try {
         const configPath = resolveBuffConfigPath();
@@ -3377,6 +3415,25 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // ── Motion — the renders this workspace has made. Discoverability, not
+    // rendering: the page plays back what a chat turn (or `nuvira motion render`)
+    // produced, because an artifact nobody can find is an artifact nobody has.
+    if (pathname === '/api/motion') {
+        writeJson(res, 200, motionRenders());
+        return;
+    }
+    // The bytes for ONE render. The id is resolved through OUR OWN manifest store
+    // (`motionRenderFile`), never a path from the query string, so this endpoint
+    // cannot be asked for an arbitrary file.
+    if (pathname === '/api/motion-file') {
+        const file = motionRenderFile(url.searchParams.get('id') ?? '');
+        if (!file) {
+            writeJson(res, 404, { ok: false, error: 'No such motion render.' });
+            return;
+        }
+        streamMedia(req, res, file.path, file.mime);
+        return;
+    }
     // ── An artifact's BYTES — how the Artifacts tab shows a rendered video rather
     // than a filename. The path is looked up in OUR OWN artifact store by (session,
     // artifact id) and is never taken from the query string, so a caller cannot ask
@@ -3391,36 +3448,7 @@ function handleRequest(req, res) {
             writeJson(res, 404, { ok: false, error: 'No such artifact file.' });
             return;
         }
-        const size = statSync(artifact.path).size;
-        const type = artifactFileMime(artifact.path, artifact.mime);
-        // Range support, because a <video> that cannot seek cannot be reviewed: a
-        // player asks for byte ranges the moment the user drags the scrubber.
-        const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range ?? '');
-        if (range) {
-            const start = range[1] ? Number(range[1]) : 0;
-            const end = range[2] ? Math.min(Number(range[2]), size - 1) : size - 1;
-            if (start >= size || end < start) {
-                res.writeHead(416, { 'Content-Range': `bytes */${size}` });
-                res.end();
-                return;
-            }
-            res.writeHead(206, {
-                'Content-Type': type,
-                'Content-Length': String(end - start + 1),
-                'Content-Range': `bytes ${start}-${end}/${size}`,
-                'Accept-Ranges': 'bytes',
-                'Cache-Control': 'no-store',
-            });
-            createReadStream(artifact.path, { start, end }).pipe(res);
-            return;
-        }
-        res.writeHead(200, {
-            'Content-Type': type,
-            'Content-Length': String(size),
-            'Accept-Ranges': 'bytes',
-            'Cache-Control': 'no-store',
-        });
-        createReadStream(artifact.path).pipe(res);
+        streamMedia(req, res, artifact.path, artifactFileMime(artifact.path, artifact.mime));
         return;
     }
     if (pathname === '/api/benchmarks') {
@@ -7654,7 +7682,24 @@ function handleRequest(req, res) {
             // only" switch). Scoped to the turn with AsyncLocalStorage rather than a
             // process env write, because two sessions can run concurrently and a
             // global mutation would leak one user's pin into the other's turn.
-            const strict = body?.strict === true;
+            //
+            // READ AS A TRI-STATE (2026-10-16) — same three cases, same reasoning, as
+            // `worktree`/`resume` below. `true` holds the pin; `false` is this turn's
+            // EXPLICIT permission to substitute; ABSENT defers to the pin's own policy,
+            // where a request that NAMED a provider+model HOLDS (the pair `pinOf`
+            // records) and an Auto turn has no pair to hold.
+            //
+            // Collapsing absent into `false` — the previous `body?.strict === true` —
+            // was wrong on both sides. A pinned API request that never mentioned the
+            // flag was substituted by default, i.e. a pin read as a preference, which
+            // is the contract `strictPinPolicy` exists to end. And because the scope
+            // set here OUTRANKS the environment inside `withStrictModel`, a dashboard
+            // deployment running with `NUVIRA_STRICT_MODEL=1` was silently un-strict
+            // for every chat turn that left the flag out — the operator's own switch,
+            // quietly ignored.
+            const strict = typeof body?.strict === 'boolean'
+                ? body.strict
+                : strictPinPolicy(typeof provider === 'string' && typeof model === 'string');
             // WS5 (#27) — per-turn isolation and resume, from the GUI.
             //
             // Read as a strict TRI-state, because the three cases are genuinely
@@ -7908,7 +7953,12 @@ function handleRequest(req, res) {
                             `your pinned ${requested} is ${pinnedClass} class, and this turn ran on ${served} (${servedClass} class).`;
                 }
                 else if (substituted) {
-                    routingNotice = `Auto routing took over: this turn ran on ${served} because your pinned ${requested} was not available. To work with ${requested} only, enable strict model mode.`;
+                    // Reachable now only when the turn EXPLICITLY allowed a substitute
+                    // (`strict: false`, the chat's lock switched off) or the deployment set
+                    // `NUVIRA_STRICT_MODEL=0`, because a named pair holds by default. So the
+                    // instruction names the two controls that actually release it, instead
+                    // of telling the user to enable something that is already the default.
+                    routingNotice = `Auto routing took over: this turn ran on ${served} because your pinned ${requested} was not available. To work with ${requested} only, hold the pin: turn the chat's lock back on, or set NUVIRA_STRICT_MODEL=1.`;
                 }
                 else if (result.generationFailed === true) {
                     // The turn ran on the pair the user pinned and stopped there. Saying