castle-web-cli 0.4.172 → 0.4.174

package/dist/agent-prompts.d.ts

@@ -75,7 +75,11 @@ export declare function renderPlanDigest(plan: RouterPlanOpts, tasks: PromptTask
 export declare function planOpenQuestionLines(fileText: string): string[];
 export declare function renderTaskPlanSlice(fileText: string, item: string | undefined, finishedWork?: PlanFinishedWork[]): string;
 export declare const NO_DECK_DOCS = "This deck has no CLAUDE.md / AGENTS.md quick reference. There is no documentation to read -- do not search for one (CLAUDE.md, README, **/*.md, etc.).";
-export declare function buildRouterPrompt(opts: {
+export interface RouterPromptParts {
+    system: string;
+    user: string;
+}
+export interface RouterPromptOpts {
     deckLabel: string;
     quickReference?: string;
     deckTree?: string;
@@ -85,7 +89,9 @@ export declare function buildRouterPrompt(opts: {
     plan?: RouterPlanOpts;
     playtest?: boolean;
     instruction: string;
-}): string;
+}
+export declare function buildRouterPromptParts(opts: RouterPromptOpts): RouterPromptParts;
+export declare function buildRouterPrompt(opts: RouterPromptOpts): string;
 export declare function userTurnInstruction(opts: {
     messages: string[];
     interruptedDraft?: string;

package/dist/agent-prompts.js

@@ -820,7 +820,7 @@ function renderTasks(tasks, showItems) {
 // not included" and burns its first turns hunting for CLAUDE.md. Exported so
 // the platform block (platformDoc.ts) can keep the sentence after itself.
 export const NO_DECK_DOCS = "This deck has no CLAUDE.md / AGENTS.md quick reference. There is no documentation to read -- do not search for one (CLAUDE.md, README, **/*.md, etc.).";
-export function buildRouterPrompt(opts) {
+export function buildRouterPromptParts(opts) {
     // Making the ABSENCE explicit, not just omitting the section, matters: a
     // router on a bare/greenfield deck otherwise has no way to tell "no docs
     // exist" from "the docs section just wasn't included in this prompt", and
@@ -842,17 +842,19 @@ export function buildRouterPrompt(opts) {
     const plan = opts.plan
         ? `\n\n== plan ==\n${renderPlanDigest(opts.plan, opts.tasks)}`
         : "";
-    // Section order is stable-to-volatile for prompt caching: rules + deck
-    // identity never change within a serve, the transcript is append-only, and
-    // the churning state (file tree, task board, instruction) rides at the tail
-    // so a task creating a file doesn't invalidate the cached transcript prefix.
-    return `${routerRules(opts.plan !== undefined, opts.playtest === true)}
+    // Two parts, split for prompt caching. `system` holds what is the same from
+    // one turn to the next within a serve -- the rules, the deck identity, the
+    // file tree and (smith) the deck source -- and each backend sends it as
+    // system text, which is the prefix the provider caches turn after turn. A
+    // file edit invalidates it; a chat turn does not. `user` holds what changes
+    // every turn: the transcript, the plan, the board and this instruction.
+    return {
+        system: `${routerRules(opts.plan !== undefined, opts.playtest === true)}
 
 == deck ==
-${opts.deckLabel}${quickReference}
-
-== conversation so far ==
-${renderTranscript(opts.messages)}${deckFiles}${deckSource}${plan}
+${opts.deckLabel}${quickReference}${deckFiles}${deckSource}`,
+        user: `== conversation so far ==
+${renderTranscript(opts.messages)}${plan}
 
 == background tasks ==
 ${renderTasks(opts.tasks, opts.plan !== undefined)}
@@ -860,7 +862,13 @@ ${renderTasks(opts.tasks, opts.plan !== undefined)}
 == now ==
 ${opts.instruction}
 
-Reply now, as "you" in the conversation. Plain reply text only -- no role prefix.`;
+Reply now, as "you" in the conversation. Plain reply text only -- no role prefix.`,
+    };
+}
+// The router prompt as one string, system part first. What the goldens pin.
+export function buildRouterPrompt(opts) {
+    const parts = buildRouterPromptParts(opts);
+    return `${parts.system}\n\n${parts.user}`;
 }
 export function userTurnInstruction(opts) {
     const parts = [];

package/dist/agent.js

@@ -27,7 +27,7 @@ import { WebSocketServer } from 'ws';
 import { rawDataToString } from './rawData.js';
 import { atomicWriteFileSync } from './atomicFile.js';
 import { AGENT_ATTACHMENT_PREFIX, AGENT_PLAYTEST_PREFIX, PLAN_FILE } from './localPaths.js';
-import { applyPlanOps, buildRouterPrompt, buildTaskPrompt, parsePlanOps, planOpenQuestionLines, truncateToBytes, userTurnInstruction, CLAUDE_TASK_SYSTEM_REMINDER, } from './agent-prompts.js';
+import { applyPlanOps, buildRouterPromptParts, buildTaskPrompt, parsePlanOps, planOpenQuestionLines, truncateToBytes, userTurnInstruction, CLAUDE_TASK_SYSTEM_REMINDER, } from './agent-prompts.js';
 import { readCastleJson } from './castleJson.js';
 import { checkOpenrouterKey, checkOpenrouterModel, openrouterCatalogEntry, primeOpenrouterCatalog, } from './openrouter-catalog.js';
 import { classifyProviderError, failureCopy, setReaderTimeZone, } from './agent-failures.js';
@@ -501,6 +501,17 @@ function claudeSettingsArg(auth) {
         ...(auth?.mode === 'user-key' ? { apiKeyHelper: anthropicKeyHelperCommand() } : {}),
     });
 }
+// The claude CLI puts every CLAUDE.md it finds, and a git-status note, into the
+// first user message of each process, ahead of the prompt. A router turn is a
+// new process, so that text (the kit guide: ~23k tokens on a kit deck) is sent
+// uncached on every call of every turn. The router already carries the deck's
+// quick reference and file tree in its cached system part, and can read a
+// guide on demand; tasks keep the CLI's own loading. Measured on a 30k-token
+// router prompt: a second turn goes from 40k tokens written to 4.6k.
+const ROUTER_CLAUDE_ENV = {
+    CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1',
+    CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS: '1',
+};
 function buildAgentInvocation(backend, role, prompt, claudeModel, 
 // Already resolved for this role by the caller (router turns pass
 // settings.routerOpenrouterModel, task spawns settings.tasksOpenrouterModel).
@@ -512,7 +523,14 @@ metering,
 // The task this spawn belongs to, so its playtest frames land under
 // tasks/<id>/playtest/ and count against that task's call budget. Absent for
 // router turns, which get no playtest tool at all.
-taskId) {
+taskId, 
+// The stable part of a router prompt. claude takes it as appended system
+// text, which its own cache breakpoints cover; cursor has no such flag and
+// gets it ahead of the prompt.
+systemPrompt) {
+    const systemText = [systemPrompt, role === 'task' ? CLAUDE_TASK_SYSTEM_REMINDER : undefined]
+        .filter((text) => Boolean(text))
+        .join('\n\n');
     if (backend === 'claude') {
         const viaOpenrouter = claudeModel === 'openrouter';
         const orAuth = viaOpenrouter ? resolveOpenrouterAuth() : null;
@@ -547,15 +565,18 @@ taskId) {
                 claudeSettingsArg(anAuth),
                 '--strict-mcp-config',
                 ...(role === 'task' ? [mcpConfigArg(metering.deckDir, taskId)] : []),
-                ...(role === 'task' ? ['--append-system-prompt', CLAUDE_TASK_SYSTEM_REMINDER] : []),
+                ...(systemText ? ['--append-system-prompt', systemText] : []),
                 prompt,
             ],
-            env: withCustomHeaders(viaOpenrouter ? envForOpenrouterSpawn(orAuth) : envForClaudeSpawn(anAuth), meteringHeaders({
-                deckDir: metering.deckDir,
-                sessionId: metering.sessionId,
-                route: viaOpenrouter ? 'openrouter' : 'anthropic',
-                direct,
-            })),
+            env: {
+                ...withCustomHeaders(viaOpenrouter ? envForOpenrouterSpawn(orAuth) : envForClaudeSpawn(anAuth), meteringHeaders({
+                    deckDir: metering.deckDir,
+                    sessionId: metering.sessionId,
+                    route: viaOpenrouter ? 'openrouter' : 'anthropic',
+                    direct,
+                })),
+                ...(role === 'router' ? ROUTER_CLAUDE_ENV : {}),
+            },
         };
     }
     return {
@@ -569,7 +590,7 @@ taskId) {
             '--model',
             CURSOR_MODEL,
             ...(role === 'router' ? ['--mode', 'ask'] : ['--force']),
-            prompt,
+            systemPrompt ? `${systemPrompt}\n\n${prompt}` : prompt,
         ],
         env: envForAgentSpawn(backend),
     };
@@ -1852,6 +1873,7 @@ async function runAgentSmith(opts) {
             // "" (auto) becomes undefined so no provider.order is sent.
             providerTier: opts.openrouterTuning?.providerTier || undefined,
             prompt: opts.prompt,
+            system: opts.system,
             systemReminder: opts.systemReminder,
             attachments: opts.attachments,
             timeoutMs: opts.timeoutMs,
@@ -2169,6 +2191,7 @@ async function runAgentTurn(opts) {
             }),
             model: opts.openrouterModel,
             prompt: opts.prompt,
+            system: opts.systemPrompt,
             // Mirrors claude's --append-system-prompt for tasks (the native loop
             // appends it to its own system framing).
             systemReminder: opts.role === 'task' ? CLAUDE_TASK_SYSTEM_REMINDER : undefined,
@@ -2185,7 +2208,7 @@ async function runAgentTurn(opts) {
             onSpawn: opts.onSpawn,
         }));
     }
-    const invocation = buildAgentInvocation(opts.backend, opts.role, opts.prompt, opts.claudeModel, opts.openrouterModel, { sessionId, deckDir: opts.cwd }, opts.taskId);
+    const invocation = buildAgentInvocation(opts.backend, opts.role, opts.prompt, opts.claudeModel, opts.openrouterModel, { sessionId, deckDir: opts.cwd }, opts.taskId, opts.systemPrompt);
     const startedMs = Date.now();
     const run = runAgentCli({
         cwd: opts.cwd,
@@ -3273,7 +3296,7 @@ function routerTurnPrompt(ctx, instruction, selfMessageId, plan) {
     // ROUTER_DECK_CONTENTS_BUDGET's comment (the router prompt is already the
     // largest one this serve builds).
     const isSmith = ctx.backend() === 'smith';
-    return buildRouterPrompt({
+    return buildRouterPromptParts({
         deckLabel: ctx.deckLabel,
         quickReference: quickReferenceFor(ctx.deckDir, ctx.quickReference, ctx.backend()),
         deckTree: buildDeckTree(ctx.deckDir, isSmith
@@ -3409,7 +3432,8 @@ function runRouterTurnIn(ctx, instruction, attachments = []) {
     void runAgentTurn({
         backend,
         role: 'router',
-        prompt,
+        prompt: prompt.user,
+        systemPrompt: prompt.system,
         claudeModel: ctx.claudeModel(),
         openrouterModel: ctx.openrouterModel(),
         openrouterTuning: ctx.openrouterTuning(),

package/dist/assetCompression.d.ts

@@ -0,0 +1,3 @@
+import type { Connect } from 'vite';
+/** Compress assets, never the token-bearing shell bootstrap or control API. */
+export declare function createAssetCompression(): Connect.NextHandleFunction;

package/dist/assetCompression.js

@@ -0,0 +1,30 @@
+import compression from 'compression';
+/** Compress assets, never the token-bearing shell bootstrap or control API. */
+export function createAssetCompression() {
+    // compression supports plain Node HTTP/Connect; its DefinitelyTyped signature
+    // unnecessarily requires Express request/response extensions.
+    return compression({
+        threshold: 1024,
+        filter(req, res) {
+            const requestPath = (req.url || '/').split('?')[0];
+            if ((req.method !== 'GET' && req.method !== 'HEAD') ||
+                requestPath === '/' ||
+                (requestPath.startsWith('/__castle/') &&
+                    !requestPath.startsWith('/__castle/ide/assets/')) ||
+                req.headers.range ||
+                res.hasHeader('Content-Range')) {
+                return false;
+            }
+            // Conditional responses must retain the representation's Vary header,
+            // but must never start a compressor or acquire a body.
+            if (res.statusCode === 304) {
+                if (res.getHeader('Vary') !== '*')
+                    res.appendHeader('Vary', 'Accept-Encoding');
+                return false;
+            }
+            return (res.statusCode === 200 &&
+                !String(res.getHeader('Content-Type')).startsWith('text/event-stream') &&
+                compression.filter(req, res));
+        },
+    });
+}

package/dist/castleJson.d.ts

@@ -1,4 +1,4 @@
-export declare const STARTER_STYLE_FILES: string[];
+export declare const STARTER_THEME_FILES: string[];
 export declare const IMPORTS_DIR = "imports";
 export interface DeckImport {
     deckId?: string;

package/dist/castleJson.js

@@ -5,7 +5,7 @@ import picomatch from 'picomatch';
 // module with no imports of its own, because both the import machinery and the
 // fork overlay need it and importing it from either of those would close a
 // cycle.
-// Root-level style files a kit ships as a deck's starting point, seeded into a
+// Root-level theme files a kit ships as a deck's starting point, seeded into a
 // deck at scaffold (init.ts `writeStarterTheme`) and when an import newly brings
 // them (imports.ts `seedKitTheme`).
 //
@@ -18,7 +18,7 @@ import picomatch from 'picomatch';
 // `theme.style` names the deck's font, `fonts.generated.js` is what carries that
 // face's bytes into the bundle, and a deck given the first without the second
 // renders in the fallback while claiming otherwise.
-export const STARTER_STYLE_FILES = ['theme.style', 'fonts.generated.js'];
+export const STARTER_THEME_FILES = ['theme.style', 'fonts.generated.js'];
 export const IMPORTS_DIR = 'imports';
 export const DEFAULT_STARTER_SCENE = 'scenes/main.scene';
 export const DEFAULT_SERVER_TICK_RATE = 20;

package/dist/imports.js

@@ -6,7 +6,7 @@ import { runTar } from './save-deck.js';
 import { normalizeDeckPackageJson } from './normalize.js';
 import { getKitsDir } from './localPaths.js';
 import { writePlatformDocs } from './platformDoc.js';
-import { ensureVisibleGlob, IMPORTS_DIR, STARTER_STYLE_FILES, readCastleJson as tryReadCastleJson, readCastleJsonOrThrow as readCastleJson, } from './castleJson.js';
+import { ensureVisibleGlob, IMPORTS_DIR, STARTER_THEME_FILES, readCastleJson as tryReadCastleJson, readCastleJsonOrThrow as readCastleJson, } from './castleJson.js';
 // Adding another deck as a dependency (`castle-web add-import`; removing one is a
 // later command). Deliberately NOT `get-deck`: that one
 // replaces THIS deck's own source from the server (and carries guards for the
@@ -614,7 +614,7 @@ function seedKitTheme(deckDir, alias, log) {
     if (typeof main !== 'string' || !main.trim())
         return;
     const seeded = [];
-    for (const name of STARTER_STYLE_FILES) {
+    for (const name of STARTER_THEME_FILES) {
         const src = path.join(importDir, name);
         const dest = path.join(deckDir, name);
         if (!fs.existsSync(src) || fs.existsSync(dest))

package/dist/init.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { CLAUDE_MD_PLATFORM_SECTION } from './platformDoc.js';
 import { installDeps } from './install.js';
-import { deckMainFile, deckStarterScene, STARTER_STYLE_FILES } from './castleJson.js';
+import { deckMainFile, deckStarterScene, STARTER_THEME_FILES } from './castleJson.js';
 import { addImportTo, IMPORTS_DIR, lockImportTree, restoreMissingImports, syncImportDependencies, } from './imports.js';
 import { discardParentSource, fetchParentSource, unpackParentSource, writeRemixIdentity, } from './remix.js';
 import { getCliEntryPath, getKitsDir, getSdkPackagePath, toPosixPath } from './localPaths.js';
@@ -309,7 +309,7 @@ export function writeStarterScene(projectDir, kitDir, alias) {
     fs.mkdirSync(path.join(projectDir, 'scenes'), { recursive: true });
     writeJsonFile(path.join(projectDir, 'scenes', 'main.scene'), rewrite(scene));
 }
-// A kit may ship starter style files (deck-level styling: the color palette,
+// A kit may ship starter theme files (deck-level theme: the color palette,
 // the deck font). Like the starter scene, they are deck content: the engine
 // reads them from the DECK root, and they are the creator's to edit -- so they
 // get seeded once at scaffold time rather than living read-only in the import.
@@ -317,11 +317,11 @@ export function writeStarterScene(projectDir, kitDir, alias) {
 // kit file paths, so no ref rewriting). Exported for the same two scaffold paths
 // as writeStarterScene.
 //
-// The set is STARTER_STYLE_FILES (castleJson.ts), which says why these two
+// The set is STARTER_THEME_FILES (castleJson.ts), which says why these two
 // travel together: a deck given the record without the generated module renders
 // in the fallback while claiming otherwise.
 export function writeStarterTheme(projectDir, kitDir) {
-    for (const name of STARTER_STYLE_FILES) {
+    for (const name of STARTER_THEME_FILES) {
         const src = path.join(kitDir, name);
         const dest = path.join(projectDir, name);
         if (!fs.existsSync(src) || fs.existsSync(dest))

package/dist/native/loop.js

@@ -319,6 +319,8 @@ const ROLE_FRAMING = {
 };
 function buildSystemMessage(opts) {
     const parts = [ROLE_FRAMING[opts.role]];
+    if (opts.system)
+        parts.push(opts.system);
     if (opts.systemReminder)
         parts.push(opts.systemReminder);
     return parts.join("\n\n");
@@ -700,10 +702,17 @@ async function runLoop(opts, toolSchemas, log) {
                 };
             }
             usedAnyTool = true;
+            // The reasoning goes back with the turn it belongs to. Anthropic treats an
+            // assistant turn returned without its thinking as a changed prefix and
+            // recomputes every message after it, so without this no call in the loop
+            // reads the cache (measured: 0 cached tokens per call, 30k written each).
             messages.push({
                 role: "assistant",
                 content: streamResult.message.content || null,
                 tool_calls: toolCalls,
+                ...(streamResult.message.reasoning_details
+                    ? { reasoning_details: streamResult.message.reasoning_details }
+                    : {}),
             });
             const toolResults = await runToolCalls(toolCalls, opts.role, toolCtx, playtestFrames, toolLabels, imageLabels, log, opts.onActivity);
             messages.push(...toolResults);

package/dist/native/openrouter.d.ts

@@ -25,11 +25,13 @@ export interface ORMessage {
     content?: string | null | ORContentPart[];
     tool_calls?: ORToolCall[];
     tool_call_id?: string;
+    reasoning_details?: unknown[];
 }
 export interface ORAssistantMessage {
     role: "assistant";
     content: string;
     tool_calls?: ORToolCall[];
+    reasoning_details?: unknown[];
 }
 export type ORReasoningEffort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 export type ORRoutingMode = "balanced" | "nitro" | "exacto" | "floor";

package/dist/native/openrouter.js

@@ -344,6 +344,7 @@ export async function streamChatCompletion(opts) {
         return { message: null, crashed: false, error: "could not run openrouter: empty response body" };
     }
     let content = "";
+    const reasoningDetails = [];
     // Observed live (2026-07): some providers' MID-stream usage passthrough is
     // junk (constant cache_read=128 / cache_created=0 on every event) while the
     // FINAL usage chunk -- the one OpenRouter emits at/after finish_reason --
@@ -398,6 +399,9 @@ export async function streamChatCompletion(opts) {
             if (typeof delta.reasoning === "string" && delta.reasoning) {
                 opts.onThinking?.(delta.reasoning);
             }
+            if (Array.isArray(delta.reasoning_details)) {
+                reasoningDetails.push(...delta.reasoning_details);
+            }
             const toolCallDeltas = delta.tool_calls;
             if (Array.isArray(toolCallDeltas)) {
                 for (const tc of toolCallDeltas) {
@@ -461,7 +465,12 @@ export async function streamChatCompletion(opts) {
         };
     }
     return {
-        message: { role: "assistant", content, tool_calls: finalizeToolCalls(pendingToolCalls) },
+        message: {
+            role: "assistant",
+            content,
+            tool_calls: finalizeToolCalls(pendingToolCalls),
+            ...(reasoningDetails.length ? { reasoning_details: reasoningDetails } : {}),
+        },
         usage: finalUsage ?? usage,
         reasoningTokens: finalReasoningTokens ?? reasoningTokens,
         crashed: false,

package/dist/native/types.d.ts

@@ -23,6 +23,7 @@ export interface NativeRunOpts {
     routing?: ORRoutingMode;
     providerTier?: string;
     prompt: string;
+    system?: string;
     systemReminder?: string;
     attachments?: string[];
     playtest?: NativePlaytestOpts;

package/dist/serve.js

@@ -19,6 +19,7 @@ import { graphql as castleGraphql } from './api.js';
 import { executeCommand } from './castle-host/host.js';
 import { ServeSecurity } from './serveSecurity.js';
 import { isSameOriginUpgrade } from './wsOrigin.js';
+import { createAssetCompression } from './assetCompression.js';
 import { resolveServerConfig } from './castleJson.js';
 import { startDevSessionServer, } from './devSessionServer.js';
 // The log is a tail, not an archive: append, and once it passes the cap drop
@@ -315,6 +316,7 @@ window.__castleShellOrigin=(function(){
             },
         },
         configureServer(server) {
+            server.middlewares.use(createAssetCompression());
             server.middlewares.use((req, res, next) => {
                 const reqPath = (req.url || '/').split('?')[0];
                 const trustedSurface = req.headers['x-castle-sandbox-surface'];

package/dist/serveSecurity.d.ts

@@ -18,6 +18,7 @@ export declare class ServeSecurity {
     private readonly contentProxyToken;
     private readonly signingKey;
     private readonly serveNonce;
+    private contentGrantExpiresAtSeconds;
     private readonly pathKey;
     private readonly tickets;
     private localContentPorts;
@@ -50,6 +51,7 @@ export declare class ServeSecurity {
         editOrigin: string;
         playOrigin: string;
     };
+    private contentGrantExpiry;
     /**
      * Origin a browser should use for a local content role.
      *

package/dist/serveSecurity.js

@@ -6,6 +6,7 @@ const CROCKFORD = '0123456789abcdefghjkmnpqrstvwxyz';
 const CONTENT_LABEL_RE = /^1([ep])([0-9a-z]{1,4})-([a-z0-9]{14})-([0-9a-z]{1,8})-([0-9a-hjkmnp-tv-z]{13})-([0-9a-hjkmnp-tv-z]{20})$/;
 const MAX_GRANT_SECONDS = 12 * 60 * 60;
 const GRANT_CLOCK_SKEW_SECONDS = 60;
+const MIN_CONTENT_GRANT_REMAINING_SECONDS = 11 * 60 * 60;
 const BROWSER_GRANT_SECONDS = 3 * 60;
 export const MOBILE_HOST_PROTOCOL = '2';
 // A signature covers the request path and nothing else, so every path it can
@@ -79,6 +80,7 @@ export class ServeSecurity {
     contentProxyToken = randomBytes(32).toString('base64url');
     signingKey = process.env.CASTLE_AGENT_TOKEN || randomBytes(32).toString('base64url');
     serveNonce = base32Lower(randomBytes(8));
+    contentGrantExpiresAtSeconds = 0;
     pathKey = randomBytes(32).toString('base64url');
     tickets = new Map();
     localContentPorts;
@@ -284,9 +286,7 @@ window.fetch=function(input,init){
                 : cloud
                     ? 'sandboxes.castlexyz.com'
                     : null;
-        // Leave room for small positive clock skew at the control plane. Ghost still
-        // enforces the hard 12-hour maximum when it resolves the capability.
-        const expiresAtSeconds = Math.floor(Date.now() / 1000) + MAX_GRANT_SECONDS - GRANT_CLOCK_SKEW_SECONDS;
+        const expiresAtSeconds = cloud && contentDomain ? this.contentGrantExpiry() : 0;
         const originFor = (role) => {
             // Safari on macOS 15 asks DNS to resolve `*.localhost`, where it fails.
             // Dedicated loopback ports are still distinct browser origins and need no DNS.
@@ -297,6 +297,20 @@ window.fetch=function(input,init){
         };
         return { editOrigin: originFor('edit'), playOrigin: originFor('play') };
     }
+    contentGrantExpiry() {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const latestExpiry = nowSeconds + MAX_GRANT_SECONDS - GRANT_CLOCK_SKEW_SECONDS;
+        // Expiry is part of the hostname: reuse it so reopening the shell can reuse
+        // the browser's module cache. Until open shells support automatic refresh,
+        // keep at least 11 hours for every new shell (about an hour of cache reuse).
+        // Already-open shells keep their old, still-valid grants until expiry.
+        // Also remint after a backwards clock jump rather than exceed Ghost's cap.
+        if (this.contentGrantExpiresAtSeconds - nowSeconds < MIN_CONTENT_GRANT_REMAINING_SECONDS ||
+            this.contentGrantExpiresAtSeconds > latestExpiry) {
+            this.contentGrantExpiresAtSeconds = latestExpiry;
+        }
+        return this.contentGrantExpiresAtSeconds;
+    }
     /**
      * Origin a browser should use for a local content role.
      *