cool-workflow 0.2.5 → 0.2.6

package/scripts/verify-release-verdict.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+"use strict";
+// verify-release-verdict.js — the one true "find a signed, committed release
+// verdict for this commit" check. Both CI workflows call it:
+//   .github/workflows/release-gate.yml   (cwd = repo root)
+//   .github/workflows/npm-publish.yml    (cwd = plugins/cool-workflow)
+// Before this file, each workflow kept its own ~35-line bash copy of this
+// same loop, and the two copies could drift apart. Now the logic lives here
+// only, and each workflow step is one line.
+//
+// One more win: a GitHub Actions `run:` step prints its FULL script text to
+// the log before it runs. With the old inline bash, the "::error::" lines of
+// the fail branch were printed on EVERY run — even a fully green one — and
+// GitHub's log UI marked them red, which made a good release look bad. With
+// a one-line `run:`, the "::error::" text only ever gets printed when this
+// script truly fails.
+//
+// WHY the check is shaped this way (was: near-same comments in both YAMLs):
+// The tag commit itself bumps version/changelog; the reviewed sha is its
+// parent. So a verdict for HEAD or HEAD~1 is accepted. But a validly-signed
+// verdict for the PARENT alone does not prove HEAD is the same mechanical
+// bump release-flow.js's cut() would have made on top of the approved
+// parent — it could be an attacker's own commit smuggling in changes on top
+// of an old, truly-approved parent, replaying that parent's already-public
+// verdict + signature (public git objects; no secret is needed to copy
+// them). So when the match is at HEAD~1, HEAD must ALSO reproduce exactly
+// as the deterministic bump (verify-bump-reproduction.js).
+//
+// The pubkey is read from origin/main, NOT from the checked-out tree. The
+// checked-out tree IS the commit under test — an attacker's tag could just
+// delete .cw-release/verdict-signing.pub and fall back to a no-signature
+// check. origin/main is a ref the tag being judged cannot rewrite. Until a
+// pubkey is committed there, this stays a first-line-only text check
+// (opt-in, backward compatible — see scripts/verdict-keygen.js).
+//
+// cwd does not matter: everything is anchored on
+// `git rev-parse --show-toplevel`, and the two helper scripts are loaded
+// from this script's own directory (never from the repo under test).
+//
+// Usage: verify-release-verdict.js [--context "<one sentence for the fail message>"]
+// Exit 0: a valid verdict was found. Exit 1: none found — the two
+// "::error::" lines are printed here and nowhere else.
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+// Where THIS SCRIPT lives — the helper scripts are siblings of the installed
+// script, never files of the (possibly throwaway) repo being checked. Same
+// rule as in verify-bump-reproduction.js.
+const VERIFY_SIG = path.join(__dirname, "verify-verdict-signature.js");
+const VERIFY_BUMP = path.join(__dirname, "verify-bump-reproduction.js");
+
+function git(args) {
+  const r = spawnSync("git", args, { encoding: "utf8" });
+  return r.status === 0 ? r.stdout.trim() : "";
+}
+
+function main() {
+  let context = "The release flow was bypassed.";
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--context" && argv[i + 1]) context = argv[++i];
+  }
+
+  const REPO_ROOT = git(["rev-parse", "--show-toplevel"]);
+  if (!REPO_ROOT) {
+    process.stderr.write("verify-release-verdict: not inside a git repo\n");
+    return 1;
+  }
+
+  const SHA = git(["-C", REPO_ROOT, "rev-parse", "HEAD^{commit}"]);
+  if (!SHA) {
+    process.stderr.write("verify-release-verdict: could not resolve HEAD\n");
+    return 1;
+  }
+  const PARENT = git(["-C", REPO_ROOT, "rev-parse", "HEAD~1"]) || "none";
+
+  let PUBKEY = "";
+  const pk = spawnSync("git", ["-C", REPO_ROOT, "show", "origin/main:.cw-release/verdict-signing.pub"], {
+    encoding: "utf8",
+  });
+  if (pk.status === 0 && pk.stdout.trim() !== "") {
+    PUBKEY = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "cw-verdict-pub-")), "verdict-signing.pub");
+    fs.writeFileSync(PUBKEY, pk.stdout);
+  }
+
+  for (const C of [SHA, PARENT]) {
+    if (C === "none") continue;
+    const VERDICT_REL = `.cw-release/review-${C}.verdict`;
+    const VERDICT = path.join(REPO_ROOT, VERDICT_REL);
+    if (!fs.existsSync(VERDICT)) continue;
+    // The first line must say EXACTLY "APPROVED <this candidate's sha>". A
+    // starts-with check is not enough: the signature binds the BYTES, never
+    // the file NAME, so a real signed verdict for some other sha could be
+    // parked under this candidate's filename and still verify.
+    const FIRST_LINE = fs.readFileSync(VERDICT, "utf8").split("\n", 1)[0];
+    if (FIRST_LINE !== `APPROVED ${C}`) continue;
+
+    if (PUBKEY) {
+      const SIG_REL = `${VERDICT_REL}.sig`;
+      const SIG = path.join(REPO_ROOT, SIG_REL);
+      const sigOk =
+        fs.existsSync(SIG) &&
+        spawnSync(process.execPath, [VERIFY_SIG, VERDICT, SIG, PUBKEY], { stdio: "inherit" }).status === 0;
+      if (sigOk) {
+        if (C !== SHA) {
+          const bump = spawnSync(process.execPath, [VERIFY_BUMP, C, SHA, VERDICT_REL, SIG_REL], {
+            cwd: REPO_ROOT,
+            stdio: "inherit",
+          });
+          if (bump.status !== 0) {
+            console.log(
+              `verdict for ${C} has a valid signature but HEAD does not reproduce as its deterministic bump — trying the other candidate`
+            );
+            continue;
+          }
+        }
+        console.log(`verdict found + signature verified for ${C}`);
+        return 0;
+      }
+      console.log(`verdict for ${C} has no valid signature — trying the other candidate`);
+      continue;
+    }
+    console.log(`verdict found for ${C} (no verdict-signing.pub committed yet — signature not required)`);
+    return 0;
+  }
+
+  console.log(
+    `::error::No committed APPROVED verdict for this tag (with a valid signature, if .cw-release/verdict-signing.pub is committed). ${context}`
+  );
+  console.log(
+    "::error::Expected: .cw-release/review-<sha>.verdict with first line 'APPROVED <sha>' — auto-created by release-flow.js --cut"
+  );
+  return 1;
+}
+
+process.exit(main());

package/ui/workbench/app.css

@@ -63,24 +63,26 @@ input[type="search"] {
 }
 .freshness { font-size: 12px; color: var(--muted); margin-bottom: 8px; }
 .run-list { list-style: none; margin: 0; padding: 0; }
-.run-list li,
-.run-list button {
+.run-list > li { margin-bottom: 6px; }
+.run-list > li:not(.run-entry),
+.run-list .run-entry > button {
   padding: 8px; border: 1px solid var(--line); border-radius: 6px;
-  margin-bottom: 6px; cursor: pointer; background: var(--panel);
+  cursor: pointer; background: var(--panel);
 }
 /* Only the run-row <button> needs a plain-element reset: a <button> has
    its own default display/width/font/color, a plain <li> (used only for
    the error and empty-state rows) does not and must keep its own color
    (.err red, .muted gray) — see app.js. */
-.run-list button {
+.run-list .run-entry > button {
   display: block; width: 100%; text-align: left; font: inherit; color: inherit;
 }
-.run-list li:hover, .run-list button:hover { border-color: var(--accent); }
-.run-list li.active, .run-list button.active { border-color: var(--accent); background: var(--panel-2); }
+.run-list > li:not(.run-entry):hover, .run-list .run-entry > button:hover { border-color: var(--accent); }
+.run-list .run-entry > button.active { border-color: var(--accent); background: var(--panel-2); }
 /* Run rows are now real <button> elements (for Tab/Enter/Space); make the
    keyboard focus ring visible — there is no :focus-visible rule for this
    element otherwise. */
-.run-list button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.run-list button:focus-visible,
+.tabs button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
 .run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; display: flex; align-items: center; gap: 6px; }
 .run-list .meta { color: var(--muted); font-size: 12px; margin-top: 2px; }
 .status-dot {
@@ -126,6 +128,12 @@ pre.json {
   color: var(--ink); white-space: pre; max-height: 460px;
 }
 .panel-card .absent-note { padding: 10px 12px; color: var(--absent); font-size: 12px; }
+.what-matters { padding: 10px 12px; border-top: 1px solid var(--line); background: var(--panel-2); }
+.what-matters-title { margin: 0 0 8px; font-size: 12px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); }
+.action-fact { display: grid; grid-template-columns: minmax(100px, 140px) 1fr; gap: 10px; margin-top: 6px; }
+.action-fact:first-of-type { margin-top: 0; }
+.action-label { color: var(--muted); font-size: 12px; }
+.action-items { margin: 0; padding-left: 18px; font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; white-space: pre-wrap; overflow-wrap: anywhere; }
 .kv { display: flex; gap: 16px; flex-wrap: wrap; padding: 8px 12px; font-size: 12px; color: var(--muted); }
 .kv b { color: var(--ink); font-weight: 600; }
 .err { color: var(--bad); }

package/ui/workbench/app.js

@@ -15,12 +15,24 @@ const PANEL_GROUPS = [
   { key: "collaboration", label: "Review & collaboration", panels: ["review", "comments"] }
 ];
 
+const NAV = globalThis.CWWorkbenchNavigation;
+if (!NAV) throw new Error("Workbench navigation helper is not available");
+const INSPECTION = globalThis.CWWorkbenchInspection;
+if (!INSPECTION) throw new Error("Workbench inspection helper is not available");
+
 // `indexSeq` is a request sequence number: the debounced filter input can
 // start a second /api/index fetch while an older one is still in flight, and
 // only the NEWEST request may render (an old slow response must not
 // overwrite a new fast one). `viewFetchedAt` is when the active run's view
 // was fetched, shown as "as of HH:MM:SS" in the detail header.
-const state = { activeRunId: null, activeTab: "graph", indexSeq: 0, viewFetchedAt: null };
+const state = {
+  activeRunId: null,
+  activeTab: NAV.DEFAULT_TAB,
+  currentView: null,
+  detailSeq: 0,
+  indexSeq: 0,
+  viewFetchedAt: null
+};
 
 // The host's auth token, read ONCE at startup from the page URL. When
 // CW_WORKBENCH_TOKEN is set on the host, every /api/* request must carry it;
@@ -28,6 +40,16 @@ const state = { activeRunId: null, activeTab: "graph", indexSeq: 0, viewFetchedA
 // and can explain what to do instead of rendering broken.
 const TOKEN = new URLSearchParams(location.search).get("token") || "";
 
+function routeUrl(runId, tab) {
+  return `${location.pathname}${location.search}${NAV.formatFragment(runId, tab)}`;
+}
+
+function writeRoute(runId, tab, mode = "push") {
+  const fragment = NAV.formatFragment(runId, tab);
+  if (location.hash === fragment && mode === "push") return;
+  history[mode === "replace" ? "replaceState" : "pushState"](null, "", routeUrl(runId, tab));
+}
+
 // Build a request URL with URLSearchParams so the token composes with any
 // other query params (e.g. the index filter's ?text=).
 function apiUrl(pathname, params = {}) {
@@ -83,14 +105,14 @@ async function loadIndex() {
   // A loading placeholder, not a bare wipe: the same pattern the detail
   // pane uses, so the sidebar never flashes empty while the fetch runs.
   list.innerHTML = "";
-  list.appendChild(el("li", { class: "muted", text: "loading runs…" }));
+  list.appendChild(el("li", { class: "muted", text: "loading runs…", role: "status" }));
   let view;
   try {
     view = await getJson(apiUrl("/api/index", { text: filter }));
   } catch (error) {
     if (seq !== state.indexSeq) return;
     list.innerHTML = "";
-    list.appendChild(el("li", { class: "err", text: `failed to load index: ${error.message}` }));
+    list.appendChild(el("li", { class: "err", text: `failed to load index: ${error.message}`, role: "alert" }));
     // Clear the stale "registry valid · scope …" line — leaving the last
     // successful freshness next to a load error is itself a stale badge on
     // the one panel whose whole point is freshness.
@@ -144,7 +166,7 @@ async function loadIndex() {
       })
     ]);
     btn.addEventListener("click", () => selectRun(record.runId));
-    list.appendChild(btn);
+    list.appendChild(el("li", { class: "run-entry" }, [btn]));
   }
 }
 
@@ -155,33 +177,40 @@ async function loadIndex() {
 function markActiveRow(runId) {
   const list = document.getElementById("run-list");
   for (const btn of list.querySelectorAll("button[data-runid]")) {
-    btn.classList.toggle("active", btn.getAttribute("data-runid") === runId);
+    const active = btn.getAttribute("data-runid") === runId;
+    btn.classList.toggle("active", active);
+    if (active) btn.setAttribute("aria-current", "true");
+    else btn.removeAttribute("aria-current");
   }
 }
 
-function selectRun(runId) {
+function selectRun(runId, options = {}) {
   state.activeRunId = runId;
+  if (!state.currentView || state.currentView.runId !== runId) state.currentView = null;
   markActiveRow(runId);
+  if (options.history !== false) writeRoute(runId, state.activeTab);
   return loadRunDetail(runId);
 }
 
 async function loadRunDetail(runId) {
+  const seq = ++state.detailSeq;
   const detail = document.getElementById("run-panel");
   detail.innerHTML = "";
-  detail.appendChild(el("p", { class: "muted", text: `loading ${runId}…` }));
+  detail.appendChild(el("p", { class: "muted", text: `loading ${runId}…`, role: "status" }));
   let view;
   try {
     view = await getJson(apiUrl(`/api/run/${encodeURIComponent(runId)}`));
   } catch (error) {
-    if (state.activeRunId !== runId) return;
+    if (state.activeRunId !== runId || seq !== state.detailSeq) return;
     detail.innerHTML = "";
-    detail.appendChild(el("p", { class: "err", text: `failed to load run: ${error.message}` }));
+    detail.appendChild(el("p", { class: "err", text: `failed to load run: ${error.message}`, role: "alert" }));
     return;
   }
   // The user may have clicked another run while this fetch was in flight;
   // a stale response must not overwrite the newer selection's render.
-  if (state.activeRunId !== runId) return;
+  if (state.activeRunId !== runId || seq !== state.detailSeq) return;
   state.viewFetchedAt = new Date();
+  state.currentView = view;
   renderRun(view);
 }
 
@@ -198,7 +227,13 @@ function formatClock(date) {
   return date ? date.toTimeString().slice(0, 8) : "";
 }
 
-function renderRun(view) {
+function selectTab(tab, options = {}) {
+  state.activeTab = NAV.TAB_KEYS.includes(tab) ? tab : NAV.DEFAULT_TAB;
+  if (options.history !== false && state.activeRunId) writeRoute(state.activeRunId, state.activeTab);
+  if (state.currentView) renderRun(state.currentView, { focusTab: options.focus === true });
+}
+
+function renderRun(view, options = {}) {
   const detail = document.getElementById("run-panel");
   detail.innerHTML = "";
   const header = el("div", { class: "kv" }, [
@@ -223,14 +258,22 @@ function renderRun(view) {
   for (const group of PANEL_GROUPS) {
     const active = state.activeTab === group.key;
     const btn = el("button", {
+      id: `workbench-tab-${group.key}`,
       class: `tab ${active ? "active" : ""}`,
       text: group.label,
       role: "tab",
-      "aria-selected": active ? "true" : "false"
+      "aria-controls": `workbench-panel-${group.key}`,
+      "aria-selected": active ? "true" : "false",
+      tabindex: active ? "0" : "-1"
+    });
+    btn.addEventListener("click", (event) => {
+      selectTab(group.key, { focus: event.detail === 0 });
     });
-    btn.addEventListener("click", () => {
-      state.activeTab = group.key;
-      renderRun(view);
+    btn.addEventListener("keydown", (event) => {
+      const next = NAV.moveTab(state.activeTab, event.key);
+      if (next === state.activeTab && !["Home", "End", "ArrowLeft", "ArrowRight"].includes(event.key)) return;
+      event.preventDefault();
+      selectTab(next, { focus: true });
     });
     tabs.appendChild(btn);
   }
@@ -238,6 +281,11 @@ function renderRun(view) {
 
   const group = PANEL_GROUPS.find((g) => g.key === state.activeTab) || PANEL_GROUPS[0];
   const panels = (view.panels && view.panels[group.key]) || {};
+  const tabPanel = el("section", {
+    id: `workbench-panel-${group.key}`,
+    role: "tabpanel",
+    "aria-labelledby": `workbench-tab-${group.key}`
+  });
   // Some groups declare two panel names that map to the same capability on
   // the server (e.g. graph's compact/criticalPath both come from
   // summary.show), so they carry byte-identical payloads. Render such a pair
@@ -252,8 +300,10 @@ function renderRun(view) {
     else rendered.push({ names: [name], panel });
   }
   for (const entry of rendered) {
-    detail.appendChild(renderPanel(entry.names.join(" / "), entry.panel));
+    tabPanel.appendChild(renderPanel(entry.names.join(" / "), entry.panel));
   }
+  detail.appendChild(tabPanel);
+  if (options.focusTab) document.getElementById(`workbench-tab-${group.key}`).focus();
 }
 
 function renderPanel(name, panel) {
@@ -265,6 +315,8 @@ function renderPanel(name, panel) {
   card.appendChild(head);
   card.appendChild(el("div", { class: "kv" }, [el("span", { class: "src", text: panel.cli }), el("span", { class: "src", text: panel.mcp })]));
   if (panel.status === "present") {
+    const actionSummary = renderActionSummary(panel.data);
+    if (actionSummary) card.appendChild(actionSummary);
     card.appendChild(renderStructured(panel.data) || el("pre", { class: "json", text: JSON.stringify(panel.data, null, 2) }));
   } else {
     card.appendChild(el("div", { class: "absent-note", text: `absent — ${panel.error || "source unreadable"}` }));
@@ -272,6 +324,23 @@ function renderPanel(name, panel) {
   return card;
 }
 
+function renderActionSummary(data) {
+  const facts = INSPECTION.actionFacts(data);
+  if (facts.length === 0) return null;
+  const summary = el("section", { class: "what-matters", "aria-label": "What matters" }, [
+    el("h3", { class: "what-matters-title", text: "What matters" })
+  ]);
+  for (const fact of facts) {
+    summary.appendChild(
+      el("div", { class: `action-fact ${fact.key}` }, [
+        el("div", { class: "action-label", text: fact.label }),
+        el("ul", { class: "action-items" }, fact.items.map((item) => el("li", { text: item })))
+      ])
+    );
+  }
+  return summary;
+}
+
 // Purely presentational shape-detection: recognizes the two payload shapes
 // that recur across several capabilities (a nodes/edges graph, and one or
 // more TrustAuditEvent[] arrays) and tables them instead of dumping raw
@@ -396,8 +465,40 @@ function renderEventGroups(data, confirmedEventKeys) {
   return wrap;
 }
 
+function showIndexOnly() {
+  ++state.detailSeq;
+  state.currentView = null;
+  const detail = document.getElementById("run-panel");
+  detail.innerHTML = "";
+  detail.appendChild(
+    el("p", {
+      class: "empty",
+      text: "Select a run to inspect its graph, blackboard, worker logs, candidate compare, and audit timeline."
+    })
+  );
+}
+
+function applyLocationRoute() {
+  const route = NAV.parseFragment(location.hash);
+  state.activeRunId = route.runId;
+  state.activeTab = route.tab;
+  if (route.replace) writeRoute(route.runId, route.tab, "replace");
+  markActiveRow(route.runId);
+  if (!route.runId) {
+    showIndexOnly();
+    return;
+  }
+  if (state.currentView && state.currentView.runId === route.runId) {
+    renderRun(state.currentView);
+    return;
+  }
+  state.currentView = null;
+  loadRunDetail(route.runId);
+}
+
 document.getElementById("refresh").addEventListener("click", refreshAll);
 document.getElementById("filter").addEventListener("input", debounce(loadIndex, 200));
+window.addEventListener("popstate", applyLocationRoute);
 
 function debounce(fn, ms) {
   let timer;
@@ -408,3 +509,4 @@ function debounce(fn, ms) {
 }
 
 loadIndex();
+applyLocationRoute();

package/ui/workbench/index.html

@@ -27,6 +27,8 @@
         <p class="empty">Select a run to inspect its graph, blackboard, worker logs, candidate compare, and audit timeline.</p>
       </section>
     </main>
+    <script src="/ui/navigation.js"></script>
+    <script src="/ui/inspection.js"></script>
     <script src="/ui/app.js"></script>
   </body>
 </html>

package/ui/workbench/inspection.js

@@ -0,0 +1,51 @@
+"use strict";
+// Pure action-first projection. It copies a small set of facts from one
+// capability payload for display; it makes no new state, rank, or action.
+
+(function expose(root, factory) {
+  const inspection = factory();
+  if (typeof module === "object" && module.exports) module.exports = inspection;
+  if (root) root.CWWorkbenchInspection = inspection;
+})(typeof globalThis === "object" ? globalThis : this, function buildInspection() {
+  function compactValue(value) {
+    if (typeof value === "string") return value;
+    const encoded = JSON.stringify(value);
+    return typeof encoded === "string" ? encoded : null;
+  }
+
+  function arrayFact(data, key, label, emptyMeansNone) {
+    if (!Array.isArray(data[key])) return null;
+    const items = data[key].map(compactValue).filter((item) => item !== null);
+    if (items.length === 0 && emptyMeansNone) items.push("none");
+    return items.length > 0 ? { key, label, items } : null;
+  }
+
+  function actionFacts(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return [];
+    const facts = [];
+    const integrity = data.integrity;
+    if (integrity && typeof integrity === "object" && !Array.isArray(integrity)) {
+      const items = [];
+      if (typeof integrity.verified === "boolean") items.push(`verified: ${integrity.verified}`);
+      if (typeof integrity.eventCount === "number" && Number.isFinite(integrity.eventCount)) items.push(`event count: ${integrity.eventCount}`);
+      if (typeof integrity.corruptLines === "number" && Number.isFinite(integrity.corruptLines)) items.push(`corrupt lines: ${integrity.corruptLines}`);
+      if (items.length > 0) facts.push({ key: "integrity", label: "integrity", items });
+    }
+
+    const problems = arrayFact(data, "problems", "problems", true);
+    if (problems) facts.push(problems);
+    const missing = arrayFact(data, "missingEvidence", "missing evidence", true);
+    if (missing) facts.push(missing);
+
+    if (typeof data.nextAction === "string" && data.nextAction.length > 0) {
+      facts.push({ key: "nextAction", label: "next action", items: [data.nextAction] });
+    }
+    if (Array.isArray(data.nextActions)) {
+      const items = data.nextActions.filter((item) => typeof item === "string" && item.length > 0);
+      if (items.length > 0) facts.push({ key: "nextActions", label: "next actions", items });
+    }
+    return facts;
+  }
+
+  return { actionFacts };
+});

package/ui/workbench/navigation.js

@@ -0,0 +1,44 @@
+"use strict";
+// Pure Workbench navigation policy. The browser page and Node unit test both
+// use this file; it holds no run data and does no file or network work.
+
+(function expose(root, factory) {
+  const navigation = factory();
+  if (typeof module === "object" && module.exports) module.exports = navigation;
+  if (root) root.CWWorkbenchNavigation = navigation;
+})(typeof globalThis === "object" ? globalThis : this, function buildNavigation() {
+  const TAB_KEYS = ["graph", "blackboard", "worker", "candidate", "audit", "metrics", "collaboration"];
+  const DEFAULT_TAB = TAB_KEYS[0];
+
+  function knownTab(value) {
+    return TAB_KEYS.includes(value) ? value : DEFAULT_TAB;
+  }
+
+  function parseFragment(fragment) {
+    const source = typeof fragment === "string" && fragment.startsWith("#") ? fragment.slice(1) : fragment || "";
+    const params = new URLSearchParams(source);
+    const run = params.get("run");
+    const requestedTab = params.get("tab");
+    return {
+      runId: run ? run : null,
+      tab: knownTab(requestedTab),
+      replace: requestedTab !== null && !TAB_KEYS.includes(requestedTab),
+    };
+  }
+
+  function formatFragment(runId, tab) {
+    if (!runId) return "";
+    return `#run=${encodeURIComponent(runId)}&tab=${encodeURIComponent(knownTab(tab))}`;
+  }
+
+  function moveTab(current, key) {
+    const index = Math.max(0, TAB_KEYS.indexOf(knownTab(current)));
+    if (key === "Home") return TAB_KEYS[0];
+    if (key === "End") return TAB_KEYS[TAB_KEYS.length - 1];
+    if (key === "ArrowLeft") return TAB_KEYS[(index - 1 + TAB_KEYS.length) % TAB_KEYS.length];
+    if (key === "ArrowRight") return TAB_KEYS[(index + 1) % TAB_KEYS.length];
+    return TAB_KEYS[index];
+  }
+
+  return { DEFAULT_TAB, TAB_KEYS, formatFragment, moveTab, parseFragment };
+});