ava-engine 0.3.0 → 0.4.0

package/public/setup.js

@@ -4,8 +4,15 @@
 (() => {
   const $ = (id) => document.getElementById(id);
   const TOKEN = new URLSearchParams(location.hash.slice(1)).get("token") || "";
-  const ORDER = ["ai", "voice", "speech", "access", "review"];
-  const S = { step: "ai", state: null, keyOk: false, elevenOk: false, selectedPacks: new Set(), pollTimer: null };
+  const ORDER = ["welcome", "ai", "voice", "speech", "access", "review"];
+  const STEPS = ORDER.slice(1); // the numbered steps in the rail
+  const ICON = {
+    kokoro: '<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M5 19c0-8 5-13 14-14-1 9-6 14-14 14Z"/><path d="M5 19 13 11"/></svg>',
+    elevenlabs: '<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M4 10v4M8 7v10M12 4v16M16 8v8M20 11v2"/></svg>',
+    browser: '<svg viewBox="0 0 24 24" aria-hidden="true"><rect x="3" y="4.5" width="18" height="14" rx="2.5"/><path d="M3 9h18M6.5 6.8h.01M9 6.8h.01"/></svg>',
+    pack: '<svg viewBox="0 0 24 24" aria-hidden="true"><rect x="9" y="3" width="6" height="11" rx="3"/><path d="M5.5 11.5a6.5 6.5 0 0 0 13 0M12 18v3"/></svg>',
+  };
+  const S = { step: "welcome", state: null, keyOk: false, elevenOk: false, selectedPacks: new Set(), pollTimer: null };
 
   async function api(path, body) {
     const r = await fetch(`/api/setup/${path}`, {
@@ -25,7 +32,8 @@
   function show(step) {
     S.step = step;
     document.querySelectorAll(".step").forEach((s) => { s.hidden = s.dataset.step !== step; });
-    const idx = ORDER.indexOf(step);
+    const idx = STEPS.indexOf(step) === -1 ? (step === "launching" ? STEPS.length : -1) : STEPS.indexOf(step);
+    $("progressBar").style.width = `${step === "welcome" ? 4 : step === "launching" ? 100 : ((idx + 1) / (STEPS.length + 1)) * 100}%`;
     document.querySelectorAll("#steps li").forEach((li, i) => {
       li.classList.toggle("current", i === idx);
       li.classList.toggle("done", idx > i || step === "launching");
@@ -104,7 +112,7 @@
     $("voiceCards").innerHTML = "";
     for (const [id, info] of Object.entries(v)) {
       const label = document.createElement("label"); label.className = "card";
-      label.innerHTML = `<input type="radio" name="voice"><span class="card-body"><b></b><span></span></span>`;
+      label.innerHTML = `<input type="radio" name="voice"><span class="card-icon">${ICON[id] || ICON.browser}</span><span class="card-body"><b></b><span></span></span>`;
       const input = label.querySelector("input"); input.value = id; input.checked = id === cur;
       label.querySelector("b").textContent = info.label;
       label.querySelector(".card-body span").textContent = id === "kokoro" && S.state.kokoro.installed ? "Free, runs on this computer. Installed." : info.hint[0].toUpperCase() + info.hint.slice(1) + ".";
@@ -127,7 +135,7 @@
     for (const [id, p] of Object.entries(S.state.packs)) {
       const installed = S.state.installedPacks.includes(id);
       const label = document.createElement("label"); label.className = "card";
-      label.innerHTML = `<input type="checkbox"><span class="card-body"><b></b><span></span></span>`;
+      label.innerHTML = `<input type="checkbox"><span class="card-icon">${ICON.pack}</span><span class="card-body"><b></b><span></span></span>`;
       const input = label.querySelector("input"); input.value = id;
       input.checked = installed || S.selectedPacks.has(id); input.disabled = installed;
       label.querySelector("b").textContent = `${p.label} · ${p.size}`;
@@ -208,7 +216,7 @@
       ["Voice", S.state.voices[a.voice].label],
       ["Speech recognition", packs.length ? packs.join(", ") : "Chrome's built-in recognition"],
       ["Access", a.audience === "me" ? "This computer only" : "Password protected"],
-      ["Address", `http://localhost:${a.port}/app`],
+      ["Dashboard", `http://localhost:${a.port}/dashboard`],
     ];
     if (a.audience === "others" && a.password !== "keep") rows.splice(4, 0, ["Password", a.password]);
     const dl = $("summary"); dl.innerHTML = "";
@@ -279,7 +287,7 @@
     $("regen").addEventListener("click", async () => { $("password").value = (await api("password")).password; });
     $("copyPass").addEventListener("click", async () => { try { await navigator.clipboard.writeText($("password").value); $("copyPass").textContent = "Copied"; setTimeout(() => { $("copyPass").textContent = "Copy"; }, 1400); } catch {} });
     $("launch").addEventListener("click", launch);
-    show("ai");
+    show("welcome");
     pollJobs();
   }
   // A fresh setup link opened in this same tab only changes the #token, which

package/public/style.css

@@ -838,3 +838,20 @@ body { height: 100dvh; }
   .rep-foot { justify-content: flex-end; }
   .rep-foot .ghostbtn { white-space: nowrap; }
 }
+
+/* ── lobby extras: dashboard link (operators) and the journey preview (share links) ── */
+.ob-section[hidden], .ob-dashlink[hidden] { display: none; }
+.ob-dashlink { align-self: flex-start; display: inline-flex; align-items: center; gap: 5px; margin-bottom: 8px; padding: 5px 12px 5px 8px; border-radius: 99px; border: 1px solid var(--edge); background: var(--control); color: var(--ink2); font-size: 13px; font-weight: 500; text-decoration: none; transition: border-color .15s, color .15s; }
+.ob-dashlink:hover { color: var(--ink); border-color: #C6C6D0; }
+.ob-journey { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 10px; counter-reset: j; }
+.ob-journey li { counter-increment: j; display: flex; align-items: center; gap: 12px; font-size: 14.5px; }
+.ob-journey li::before { content: counter(j); width: 26px; height: 26px; flex: none; display: grid; place-items: center; border-radius: 50%; font: 500 12px var(--mono); color: var(--amber); background: var(--brandtint); border: 1px solid var(--brandline); }
+.ob-journey + .ob-divider { margin-top: 4px; }
+
+/* ── share-link (customer) mode: the call without operator controls ── */
+.customer #obAgent, .customer #obVoiceField, .customer #obSttField, .customer .ob-dashlink,
+.customer #consolebtn, .customer #modelchip, .customer #agentlog, .customer .rep-right, .customer .rep-replay { display: none !important; }
+.customer .ob-gear { grid-template-columns: 1fr; }
+.customer .rep-left { flex: 1; }
+.wf-nosteps .wf-head, .wf-nosteps .wf-steps { display: none; }
+.ob-unavailable .ob-section, .ob-unavailable .ob-divider, .ob-unavailable .ob-actions, .ob-unavailable .ob-priv { display: none !important; }

package/server.mjs

@@ -13,9 +13,12 @@ import { synth, TTS_ENABLED, providers, defaultProvider, warmKokoro, kokoroStrea
 import { transcribe, STT_ENABLED } from "./lib/stt.mjs";
 import { createAsrSession, asrAvailable, warmAsr, availableEngines, defaultEngine, ENGINE_LABELS } from "./lib/asr.mjs";
 import { platformsView, platformById, CUSTOM_PLAYBOOKS } from "./lib/platforms.mjs";
-import { AUTH_ENABLED, isAuthorized, challengeHeaders, authCookieHeader, clientIp, sameOrigin, limiter } from "./lib/guard.mjs";
+import { AUTH_ENABLED, isAuthorized, currentUser, signIn, logoutCookie, authCookieHeader, clientIp, sameOrigin, limiter } from "./lib/guard.mjs";
+import { hasUsers } from "./lib/team.mjs";
 import { emitEvent, WEBHOOKS_ENABLED } from "./lib/webhooks.mjs";
 import { DAILY_BUDGET_USD, dailyCapReached, spentToday } from "./lib/spend.mjs";
+import { getLink, linkBlocked, countLinkCall, publicLinkView, linkCookieHeader, linksFromRequest } from "./lib/links.mjs";
+import { createAdmin } from "./lib/admin.mjs";
 import { WebSocketServer } from "ws";
 
 // A stray rejection is logged, not fatal. An uncaught exception leaves the process
@@ -26,25 +29,33 @@ process.on("uncaughtException", (e) => { console.error("[uncaught exception]", e
 const __dir = dirname(fileURLToPath(import.meta.url));
 const PUBLIC = join(__dir, "public");
 const PORT = Number(process.env.PORT) || 5190;
+// HOST=127.0.0.1 keeps Ava private to this computer (the CLI's "just me" setup).
+const HOST = process.env.HOST || undefined;
+const LOCAL_ONLY = HOST === "127.0.0.1" || HOST === "localhost" || HOST === "::1";
 
 // Spend limits. Each session is capped in model spend; each client IP in request rate.
-const SESSION_BUDGET_USD = Number(process.env.SESSION_BUDGET_USD) || 2;
+const sessionBudget = () => Number(process.env.SESSION_BUDGET_USD) || 2; // live: editable in Settings
 const MAX_USER_TEXT = 2000;
 const MAX_FRAME_BYTES = 2 * 1024 * 1024; // a downscaled JPEG screen frame is ~100-300 KB
 const FRAME_RE = /^data:image\/(jpeg|png|webp);base64,[A-Za-z0-9+/=]+$/;
 const rate = {
-  session: limiter("session", Number(process.env.RATE_SESSIONS_PER_MIN) || 10, 60_000), // new calls per IP per minute
-  api: limiter("api", Number(process.env.RATE_API_PER_MIN) || 240, 60_000),            // all other /api calls per IP per minute
+  session: limiter("session", () => Number(process.env.RATE_SESSIONS_PER_MIN) || 10, 60_000), // new calls per IP per minute
+  api: limiter("api", () => Number(process.env.RATE_API_PER_MIN) || 240, 60_000),            // all other /api calls per IP per minute
   authFail: limiter("authFail", 20, 10 * 60_000),                                         // wrong passwords per IP per 10 minutes
 };
 
 // A wrong password counts against the client; past the limit, stop checking.
 // (A first visit with no credentials at all is just the login prompt, not a guess.)
-const triedPassword = (req) => !!req.headers.authorization || /ava_auth=/.test(String(req.headers.cookie || ""));
+const triedPassword = (req) => !!req.headers.authorization || /ava_session=/.test(String(req.headers.cookie || ""));
 function lockedOut(req) { return triedPassword(req) && rate.authFail.blocked(clientIp(req)); }
-function denyAuth(req, res) {
+// Pages go to the sign-in page (and come back after); API calls get a 401.
+function denyAuth(req, res, url) {
   if (triedPassword(req)) rate.authFail(clientIp(req));
-  return send(res, 401, "authentication required", challengeHeaders());
+  if ((req.method === "GET" || req.method === "HEAD") && !url.pathname.startsWith("/api/")) {
+    res.writeHead(302, { Location: `/login?next=${encodeURIComponent(url.pathname + url.search)}`, "Cache-Control": "no-store" });
+    return res.end();
+  }
+  return send(res, 401, { error: "Sign in first." });
 }
 const LOCKED = "too many failed logins — try again in 10 minutes";
 const asrPerIp = new Map(); // ip → open /asr sockets
@@ -132,9 +143,27 @@ const CAP_MSG = "Ava has reached today's usage limit — try again tomorrow";
 /** Why a session can't spend more (its own budget, or the daily cap across all sessions), or null. */
 function spendLimit(sess) {
   if (!MOCK && dailyCapReached()) return CAP_MSG;
-  if (sess.score.ours.cost >= SESSION_BUDGET_USD) return "this session reached its spend limit — start a new call";
+  if (sess.score.ours.cost >= sessionBudget()) return "this session reached its spend limit — start a new call";
   return null;
 }
+const admin = createAdmin({
+  send, readBody, LOCAL_ONLY, HOST, PORT, sessionBudget,
+  origin: (req) => `${secureReq(req) || req.headers["x-forwarded-proto"] === "https" ? "https" : "http"}://${safeHost(req) || `localhost:${PORT}`}`,
+  voice: () => ({ enabled: TTS_ENABLED, default: defaultProvider(), providers: providers() }),
+  speech: () => ({ offline: asrAvailable(), engines: availableEngines(), default: defaultEngine(), cloud: STT_ENABLED }),
+});
+
+/** Serve one HTML page from public/ with its CSP (and the login cookie, if any). */
+async function servePage(req, res, file, headers = {}) {
+  try {
+    const full = join(PUBLIC, file), html = await readFile(full), st = await stat(full);
+    return send(res, 200, html, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": cspFor(html, `${full}|${st.mtimeMs}`, safeHost(req)), ...authCookieHeader(req), ...headers });
+  } catch { return send(res, 404, "not found"); }
+}
+// Only same-site paths after signing in (never another host).
+const safeNext = (n) => (typeof n === "string" && /^\/(?!\/)[\w\-./?#=&%~]*$/.test(n) && !n.startsWith("/login") ? n : "/dashboard");
+const secureReq = (req) => process.env.TRUST_PROXY === "1" || !!req.socket.encrypted;
+
 const untilMidnightUtc = () => String(Math.ceil((new Date().setUTCHours(24, 0, 0, 0) - Date.now()) / 1000));
 
 async function serveStatic(req, res, pathname) {
@@ -181,10 +210,28 @@ async function serveStatic(req, res, pathname) {
 // Pages that open a call (and everything they talk to) sit behind ACCESS_PASSWORD
 // when it's set. The landing page and its assets stay public.
 function needsAuth(pathname) {
-  return pathname.startsWith("/api/") && pathname !== "/api/health"
+  return pathname.startsWith("/api/") && pathname !== "/api/health" && !pathname.startsWith("/api/link/") // a link's id is its own key
+      && pathname !== "/api/auth/login" && pathname !== "/api/auth/mode"
     || pathname === "/app" || pathname === "/app/" || pathname === "/index.html"
-    || pathname === "/specialist" || pathname === "/specialist.html";
+    || pathname === "/specialist" || pathname === "/specialist.html"
+    || pathname === "/dashboard" || pathname === "/dashboard.html";
+}
+
+// Share-link visitors (see lib/links.mjs) may use only what a customer's call needs.
+const CUSTOMER_API = new Set(["/api/session", "/api/turn", "/api/observe", "/api/nudge", "/api/end", "/api/summary", "/api/truncate", "/api/stt", "/api/tts", "/api/handoff", "/api/bridge"]);
+/** Is this caller allowed to drive that session? Operators: any. Link visitors: calls from their own link. */
+function canUse(req, sess) {
+  return !!sess && (req.ava.operator || (!!sess.link && req.ava.links.some((l) => l.id === sess.link.id)));
 }
+function sessionFor(req, id) { const s = getSession(id); return canUse(req, s) ? s : undefined; }
+// "This computer": a loopback socket, addressed as localhost, not relayed by a proxy
+// or tunnel (cloudflared and friends also connect from 127.0.0.1).
+const isLoopback = (req) => /^(127\.|::1$|::ffff:127\.)/.test(req.socket.remoteAddress || "")
+  && /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i.test(String(req.headers.host || ""))
+  && !["x-forwarded-for", "forwarded", "cf-connecting-ip", "fly-client-ip", "x-real-ip"].some((h) => req.headers[h]);
+// The dashboard changes how Ava runs. Without a password it's only for this computer.
+const dashboardAllowed = (req) => req.ava.operator && (AUTH_ENABLED || LOCAL_ONLY || isLoopback(req) || !!req.ava.user?.apiKey); // an API key is a sign-in
+const DASHBOARD_LOCKED = "The dashboard is only available on this computer until you set a password. Run `npx ava-engine setup` and choose “My team or customers”.";
 
 // Aborts when the client goes away before we've answered (not after a normal finish).
 function clientGone(res) {
@@ -199,10 +246,12 @@ async function handle(req, res) {
   for (const [k, v] of Object.entries(SECURITY_HEADERS)) res.setHeader(k, v);
   let url;
   try { url = new URL(req.url, "http://x"); } catch { return send(res, 400, "bad request"); }
+  const user = currentUser(req), operator = !!user;
+  req.ava = { operator, user, links: operator ? [] : linksFromRequest(req) };
   if (needsAuth(url.pathname)) {
     // Locked-out clients get no answer about any password, right or wrong.
     if (lockedOut(req)) return send(res, 429, LOCKED, { "Retry-After": "600" });
-    if (!isAuthorized(req)) return denyAuth(req, res);
+    if (!operator && !(req.ava.links.length && CUSTOMER_API.has(url.pathname))) return denyAuth(req, res, url);
   }
   if (url.pathname.startsWith("/api/") && url.pathname !== "/api/health" && !rate.api(clientIp(req))) {
     return send(res, 429, { error: "too many requests — slow down" }, { "Retry-After": "30" });
@@ -227,7 +276,7 @@ async function handle(req, res) {
     // End-of-call recap for the session report.
     if (req.method === "POST" && url.pathname === "/api/summary") {
       const { sessionId } = await readBody(req);
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       try { return send(res, 200, await sessionSummary(sess)); }
       catch (e) { return upstreamFail(res, e, "summary"); }
@@ -236,7 +285,7 @@ async function handle(req, res) {
     // The user barged in — rewrite Ava's last reply to what was actually heard.
     if (req.method === "POST" && url.pathname === "/api/truncate") {
       const { sessionId, heard = "" } = await readBody(req);
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       return send(res, 200, truncateAssistant(sess, String(heard).slice(0, 2000)));
     }
@@ -298,20 +347,31 @@ async function handle(req, res) {
       if (!hasCapacity()) return send(res, 503, { error: "Ava is at capacity right now — try again in a few minutes" }, { "Retry-After": "60" });
       if (!MOCK && dailyCapReached()) return send(res, 503, { error: CAP_MSG }, { "Retry-After": untilMidnightUtc() });
       const body = await readBody(req);
-      const mode = body.mode === "onboarding" ? "onboarding" : "flexible";
-      const platform = typeof body.platformId === "string" ? platformById(body.platformId) : null; // knowledge in any mode
-      const s = newSession({ mode, platform });
+      // A share link fixes the product and mode; link visitors can't pick their own.
+      let link = null;
+      if (body.link != null) {
+        link = getLink(String(body.link));
+        const why = linkBlocked(link);
+        if (why) return send(res, 410, { error: why });
+        if (!operator && !req.ava.links.some((l) => l.id === link.id)) return send(res, 403, { error: "Open this call from its link." });
+      } else if (!operator) return send(res, 403, { error: "Open this call from its link." });
+      const mode = link ? link.mode : body.mode === "onboarding" ? "onboarding" : "flexible";
+      const platformId = link ? link.product : typeof body.platformId === "string" ? body.platformId : null;
+      const platform = platformId ? platformById(platformId) : null; // knowledge in any mode
+      if (link && link.product && !platform) return send(res, 410, { error: "This link's product isn't available any more. Ask whoever sent it for a new one." });
+      const s = newSession({ mode, platform, link });
       if (!s) return send(res, 503, { error: "Ava is at capacity right now — try again in a few minutes" }, { "Retry-After": "60" });
-      emitEvent("session.started", { sessionId: s.id, mode, platform: platform ? { id: platform.id, name: platform.name } : null });
+      if (link) countLinkCall(link);
+      emitEvent("session.started", { sessionId: s.id, mode, platform: platform ? { id: platform.id, name: platform.name } : null, link: link ? { id: link.id, name: link.name } : null });
       // pre-warm the talker route so the greeting isn't a cold start
       if (!MOCK) chat({ model: MODELS.talker, role: "talker", provider: PROVIDER.talker, messages: [{ role: "user", content: "hi" }], maxTokens: 1 }).catch(() => {});
-      return send(res, 200, { sessionId: s.id, mock: MOCK, models: MODELS, mode, platform: platform ? { id: platform.id, name: platform.name, url: platform.url } : null });
+      return send(res, 200, { sessionId: s.id, mock: MOCK, models: MODELS, mode, platform: platform ? { id: platform.id, name: platform.name, url: platform.url } : null, link: link ? publicLinkView(link, platform).options : null });
     }
 
     if (req.method === "POST" && url.pathname === "/api/turn") {
       const body = await readBody(req);
       const { sessionId, frameHash = null, greet = false, voice = false, changed = false, screenActive = false } = body;
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       const limit = spendLimit(sess);
       if (limit) return send(res, 402, { error: limit });
@@ -333,7 +393,7 @@ async function handle(req, res) {
 
     if (req.method === "POST" && url.pathname === "/api/observe") {
       const { sessionId, frame: rawFrame, frameHash = null, stopped = false, changed = false } = await readBody(req);
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       if (stopped) return send(res, 200, screenOff(sess)); // user stopped sharing → mark state stale now
       if (spendLimit(sess)) return send(res, 402, { error: spendLimit(sess) });
@@ -343,31 +403,72 @@ async function handle(req, res) {
       catch (e) { return upstreamFail(res, e, "screen read"); }
     }
 
-    // Specialist console page (opened at /specialist?key=<specialist key>).
-    if (req.method === "GET" && url.pathname === "/specialist") {
-      try {
-        const full = join(PUBLIC, "specialist.html"), html = await readFile(full), st = await stat(full);
-        return send(res, 200, html, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": cspFor(html, `${full}|${st.mtimeMs}`, safeHost(req)), ...authCookieHeader(req) });
-      }
-      catch { return send(res, 404, "not found"); }
+    // ── Signing in ──
+    if ((req.method === "GET" || req.method === "HEAD") && url.pathname === "/login") {
+      if (operator && AUTH_ENABLED) { res.writeHead(302, { Location: safeNext(url.searchParams.get("next")) }); return res.end(); }
+      return servePage(req, res, "login.html");
     }
+    if (req.method === "GET" && url.pathname === "/api/auth/mode") return send(res, 200, { accounts: hasUsers(), password: !!process.env.ACCESS_PASSWORD, required: AUTH_ENABLED });
+    if (req.method === "POST" && url.pathname === "/api/auth/login") {
+      if (lockedOut(req) || rate.authFail.blocked(clientIp(req))) return send(res, 429, { error: LOCKED }, { "Retry-After": "600" });
+      const body = await readBody(req);
+      const r = signIn({ email: typeof body.email === "string" ? body.email.trim() : "", password: body.password }, req);
+      if (!r) { rate.authFail(clientIp(req)); return send(res, 401, { error: hasUsers() ? "That email and password don't match." : "That password isn't right." }); }
+      return send(res, 200, { ok: true, user: r.user, next: safeNext(body.next) }, { "Set-Cookie": r.setCookie });
+    }
+    if (req.method === "POST" && url.pathname === "/api/auth/logout") return send(res, 200, { ok: true }, { "Set-Cookie": logoutCookie(req) });
+    if (req.method === "GET" && url.pathname === "/api/auth/me") return send(res, 200, { user, accounts: hasUsers(), required: AUTH_ENABLED });
+
+    // ── Dashboard (operator only) ──
+    if ((req.method === "GET" || req.method === "HEAD") && (url.pathname === "/dashboard" || url.pathname === "/dashboard.html")) {
+      if (!dashboardAllowed(req)) return send(res, 403, DASHBOARD_LOCKED);
+      return servePage(req, res, "dashboard.html");
+    }
+    if (req.method === "GET" && url.pathname === "/dashboard/openrouter-callback") return await admin.finishOpenRouter(req, res, url);
+    if (url.pathname.startsWith("/api/admin/")) {
+      if (!dashboardAllowed(req)) return send(res, 403, { error: DASHBOARD_LOCKED });
+      if (req.method !== "GET" && !sameOrigin(req)) return send(res, 403, { error: "cross-site request refused" });
+      return await admin(req, res, url, req.ava.user);
+    }
+
+    // ── Share links: /c/<id> opens a customer call set up by the link ──
+    const linkPage = url.pathname.match(/^\/c\/([A-Za-z0-9_-]{22})\/?$/);
+    if (linkPage && (req.method === "GET" || req.method === "HEAD")) {
+      const l = getLink(linkPage[1]);
+      const live = l && l.enabled && !(l.expiresAt && Date.parse(l.expiresAt) <= Date.now());
+      return servePage(req, res, "index.html", live ? { "Set-Cookie": linkCookieHeader(l.id, secureReq(req)) } : {});
+    }
+    const linkApi = url.pathname.match(/^\/api\/link\/([A-Za-z0-9_-]{1,64})$/);
+    if (linkApi && req.method === "GET") {
+      const l = getLink(linkApi[1]);
+      const why = linkBlocked(l);
+      if (!l) return send(res, 404, { error: why });
+      const p = l.product ? platformById(l.product) : null;
+      if (l.product && !p) return send(res, 410, { error: "This link's product isn't available any more. Ask whoever sent it for a new one." });
+      return send(res, why ? 410 : 200, { ...publicLinkView(l, p), ...(why ? { error: why } : {}) });
+    }
+
+    // Specialist console page (opened at /specialist?key=<specialist key>).
+    if (req.method === "GET" && url.pathname === "/specialist") return servePage(req, res, "specialist.html");
 
     // Live bridge between the user's call and a human specialist. The user is
     // identified by sessionId; the specialist only ever holds the specialist key
     // minted when the user asked for a person (revoked when the handoff ends).
     if (req.method === "GET" && url.pathname === "/api/bridge") {
       const key = url.searchParams.get("key");
-      const sess = key ? getSessionBySpecialistKey(key) : getSession(url.searchParams.get("sessionId"));
+      if (key && !operator) return send(res, 401, { error: "specialists sign in with the team password" });
+      const sess = key ? getSessionBySpecialistKey(key) : sessionFor(req, url.searchParams.get("sessionId"));
       if (!sess) return send(res, 404, { error: "unknown session" });
       return send(res, 200, bridgePoll(sess, Number(url.searchParams.get("since")) || 0));
     }
     if (req.method === "POST" && url.pathname === "/api/bridge") {
       const { sessionId, key, action = "say", text = "" } = await readBody(req);
       if (action === "usersay") {
-        const sess = getSession(sessionId);
+        const sess = sessionFor(req, sessionId);
         if (!sess) return send(res, 404, { error: "unknown session" });
         return send(res, 200, userSayToBridge(sess, String(text).slice(0, MAX_USER_TEXT)));
       }
+      if (!operator) return send(res, 401, { error: "specialists sign in with the team password" });
       const sess = getSessionBySpecialistKey(key);
       if (!sess) return send(res, 404, { error: "unknown or expired link" });
       if (action === "join") { const r = specialistJoin(sess); return r ? send(res, 200, r) : send(res, 409, { error: "no handoff requested" }); }
@@ -385,16 +486,17 @@ async function handle(req, res) {
     // Human handoff — request a real person, poll the connect state.
     if (req.method === "POST" && url.pathname === "/api/handoff") {
       const { sessionId, action = "request" } = await readBody(req);
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       if (action === "cancel") return send(res, 200, cancelHandoff(sess));
+      if (sess.link && getLink(sess.link.id)?.handoff === false) return send(res, 403, { error: "Talking to a person isn't available on this link." });
       if (action === "status") return send(res, 200, handoffStatus(sess));
       return send(res, 200, requestHandoff(sess));
     }
 
     if (req.method === "POST" && url.pathname === "/api/nudge") {
       const { sessionId } = await readBody(req);
-      const sess = getSession(sessionId);
+      const sess = sessionFor(req, sessionId);
       if (!sess) return send(res, 404, { error: "unknown session" });
       if (spendLimit(sess)) return send(res, 402, { error: spendLimit(sess) });
       try { return send(res, 200, await proactiveNudge(sess)); }
@@ -402,7 +504,7 @@ async function handle(req, res) {
     }
 
     if (req.method === "GET" && url.pathname === "/api/scoreboard") {
-      const sess = getSession(url.searchParams.get("sessionId"));
+      const sess = sessionFor(req, url.searchParams.get("sessionId"));
       if (!sess) return send(res, 404, { error: "unknown session" });
       return send(res, 200, { ours: scoreView(sess.score.ours) });
     }
@@ -435,7 +537,9 @@ server.on("upgrade", (req, socket, head) => {
   const reject = (code, msg) => { try { socket.write(`HTTP/1.1 ${code} ${msg}\r\nConnection: close\r\n\r\n`); } catch {} socket.destroy(); };
   if (!sameOrigin(req)) return reject(403, "Forbidden");
   if (lockedOut(req)) return reject(429, "Too Many Requests");
-  if (!isAuthorized(req)) { if (triedPassword(req)) rate.authFail(clientIp(req)); return reject(401, "Unauthorized"); }
+  const operator = isAuthorized(req), links = operator ? [] : linksFromRequest(req);
+  if (!operator && !links.length) { if (triedPassword(req)) rate.authFail(clientIp(req)); return reject(401, "Unauthorized"); }
+  req.ava = { operator, user: currentUser(req), links };
   if (path === "/asr") {
     const ip = clientIp(req);
     if (asrOpen >= MAX_ASR_TOTAL || (asrPerIp.get(ip) || 0) >= MAX_ASR_PER_IP) return reject(503, "Service Unavailable");
@@ -449,7 +553,8 @@ rtcWss.on("connection", (ws, req) => {
   const role = u.searchParams.get("role") === "specialist" ? "specialist" : "user";
   const other = role === "user" ? "specialist" : "user";
   // The user proves the call with its session id, the specialist with the handoff key.
-  const sess = role === "specialist" ? getSessionBySpecialistKey(u.searchParams.get("key")) : getSession(u.searchParams.get("session"));
+  // Specialists are the operator's team; a share-link visitor can only be the customer.
+  const sess = role === "specialist" ? (req.ava.operator ? getSessionBySpecialistKey(u.searchParams.get("key")) : null) : sessionFor(req, u.searchParams.get("session"));
   if (!sess) { try { ws.close(4404, "unknown session"); } catch {} return; }
   const session = sess.id;
   let room = rtcRooms.get(session);
@@ -491,9 +596,6 @@ wss.on("connection", (ws, req) => {
   ws.on("error", () => {});
 });
 
-// HOST=127.0.0.1 keeps Ava private to this computer (the CLI's "just me" setup).
-const HOST = process.env.HOST || undefined;
-const LOCAL_ONLY = HOST === "127.0.0.1" || HOST === "localhost" || HOST === "::1";
 
 server.on("error", (e) => {
   if (e.code === "EADDRINUSE") console.error(`\n  ✗ Port ${PORT} is already in use. Stop whatever is using it, or pick another port (PORT=5191, or \`ava-engine start --port 5191\`).\n`);
@@ -504,7 +606,8 @@ server.on("error", (e) => {
 
 server.listen(PORT, HOST, () => {
   console.log(`\n  Ava — screen-aware voice agent`);
-  console.log(`  → http://localhost:${PORT}/app`);
+  console.log(`  → dashboard  http://localhost:${PORT}/dashboard`);
+  console.log(`  → test call  http://localhost:${PORT}/app`);
   console.log(`  mode: ${MOCK ? "MOCK (no OPENROUTER_API_KEY set — synthetic replies)" : "LIVE (OpenRouter)"}`);
   if (!MOCK) console.log(`  models: talker=${MODELS.talker}  perception=${MODELS.perception}  planner=${MODELS.planner}  intent=${MODELS.intent}`);
   if (!MOCK) console.log(DAILY_BUDGET_USD ? `  daily cap: $${DAILY_BUDGET_USD} (spent today: $${spentToday().toFixed(2)})` : "  daily cap: none (set DAILY_BUDGET_USD to limit spend across all calls)");
@@ -512,7 +615,7 @@ server.listen(PORT, HOST, () => {
   if (WEBHOOKS_ENABLED) console.log("  webhooks: on");
   if (LOCAL_ONLY) console.log("  access: this computer only");
   else if (!AUTH_ENABLED) console.log("  access: OPEN — anyone who can reach this server can spend your API credit. Set ACCESS_PASSWORD before exposing it.");
-  else console.log("  access: password protected");
+  else console.log(hasUsers() ? "  access: team accounts (sign in at /login)" : "  access: password protected");
   console.log("");
   warmKokoro(); // preload the offline voice so the first reply is fast
   warmAsr();    // preload the offline ear so the first utterance is fast