dexterm-cli 0.0.0-stage → 0.1.2

package/dist/packages/popup/src/pages/roster.js

@@ -0,0 +1,75 @@
+// dexterm popup — agent roster page (task-1345). Renders the RosterVM: connected agents with tier, last
+// activity, reads/proposals, rate usage, and the audit log, with per-agent pause and kick. Every untrusted
+// string (agent name, client label, audit detail) is rendered with textContent only — never innerHTML. The
+// only messages this page sends are the allow-listed roster.pause / roster.resume / roster.kick events; the
+// page can never arm, sign, change a cap, or touch a wallet (no such control exists and the server drops
+// anything off the allow-list).
+(() => {
+  'use strict';
+  const DT = window.DT; DT.page = 'roster';
+  const $ = (id) => document.getElementById(id);
+  const el = (tag, cls, text) => { const e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = String(text); return e; };
+  const ago = (t) => { if (!t) return '—'; const s = Math.max(0, Math.round((Date.now() - t) / 1000)); return s < 60 ? `${s}s` : s < 3600 ? `${Math.floor(s / 60)}m` : `${Math.floor(s / 3600)}h`; };
+  const TIER_LABEL = { observe: 'observe', annotate: 'annotate', propose: 'propose' };
+
+  let vm = null;
+
+  function render() {
+    if (!vm) return;
+    const sum = $('summary'); sum.textContent = '';
+    const live = vm.agents.length;
+    sum.appendChild(el('span', 'roster-k', `${live} connected`));
+    sum.appendChild(el('span', 'roster-dim', ` · bus ws://127.0.0.1:${Number(vm.busPort) || 0} · untrusted by default`));
+
+    const host = $('agents'); host.textContent = '';
+    if (!vm.agents.length) host.appendChild(el('div', 'roster-dim', 'no agents connected. register one: dexterm agent add <name> --tier observe'));
+    for (const a of vm.agents) {
+      const row = el('div', 'roster-row' + (a.paused ? ' paused' : ''));
+      const head = el('div', 'roster-row-head');
+      head.appendChild(el('span', 'roster-name', a.name));           // textContent — untrusted name is safe
+      head.appendChild(el('span', 'roster-tier tier-' + a.tier, TIER_LABEL[a.tier] || a.tier));
+      if (a.paused) head.appendChild(el('span', 'roster-badge', a.floodPausedUntil ? 'flood-paused' : 'paused'));
+      head.appendChild(el('span', 'roster-dim', ` ${a.sessions} session${a.sessions === 1 ? '' : 's'} · ${a.client || 'unknown'} · active ${ago(a.lastActivity)}`));
+      row.appendChild(head);
+
+      const stats = el('div', 'roster-stats');
+      stats.appendChild(el('span', 'roster-stat', `reads ${a.reads}/${a.readsLimit}·min`));
+      stats.appendChild(el('span', 'roster-stat', `proposals ${a.proposals}/${a.proposalsLimit}·h`));
+      stats.appendChild(el('span', 'roster-stat' + (a.refused ? ' bad' : ''), `refused ${a.refused}`));
+      if (a.topics && a.topics.length) stats.appendChild(el('span', 'roster-stat', `subs: ${a.topics.join(',')}`));
+      row.appendChild(stats);
+
+      const ctl = el('div', 'roster-ctl');
+      const pause = el('button', 'roster-btn', a.paused ? 'resume' : 'pause'); pause.type = 'button';
+      pause.addEventListener('click', () => DT.send({ type: 'event', name: a.paused ? 'roster.resume' : 'roster.pause', payload: { agent: a.name } }));
+      const kick = el('button', 'roster-btn danger', 'kick'); kick.type = 'button';
+      kick.addEventListener('click', () => DT.send({ type: 'event', name: 'roster.kick', payload: { agent: a.name } }));
+      ctl.appendChild(pause); ctl.appendChild(kick);
+      row.appendChild(ctl);
+      host.appendChild(row);
+    }
+
+    const audit = $('audit'); audit.textContent = '';
+    for (const r of (vm.audit || []).slice(0, 80)) {
+      const line = el('div', 'roster-audit-row' + (r.ok ? '' : ' bad'));
+      line.appendChild(el('span', 'roster-audit-t', ago(r.t)));
+      line.appendChild(el('span', 'roster-audit-agent', r.agent));
+      line.appendChild(el('span', 'roster-audit-kind', r.kind));
+      line.appendChild(el('span', 'roster-audit-tool', r.tool));
+      line.appendChild(el('span', 'roster-audit-detail', r.detail));  // textContent — firewalled upstream, safe here
+      audit.appendChild(line);
+    }
+    DT.status(`${live} agent${live === 1 ? '' : 's'}`, live ? 'up' : 'muted');
+  }
+
+  DT.onHello(() => { DT.mountRain('rain'); const r = DT.rain(); if (r) { r.setActivity(0.25); r.setMood('rain'); } });
+  DT.onData((payload) => { vm = payload; render(); });
+  DT.onUpdate(() => { /* roster is pushed as full `data` frames; nothing incremental */ });
+  DT.wireChrome();
+  // A slow rAF loop keeps the rain alive and refreshes relative times once a second; the roster content
+  // itself only changes when a new `data` frame arrives.
+  let lastTick = 0;
+  DT.rainEvery = 2; DT.fpsCap = 30;
+  DT.loop((now) => { if (now - lastTick > 1000) { lastTick = now; if (vm) render(); } });
+  DT.connect();
+})();

package/dist/packages/popup/src/pages/token.html

@@ -0,0 +1,20 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="dexterm-ws" content="__WS_TOKEN__">
+<meta name="dexterm-popup" content="__POPUP_ID__">
+<meta name="dexterm-port" content="__PORT__">
+<title>dexterm · token</title>
+<style nonce="__NONCE__">/*__CSS__*/</style>
+</head>
+<body>
+<div id="hud" class="hud">
+  <div id="drag" class="drag"><span class="mark">✦</span><span id="title" class="title">dexterm · TOKEN</span><span id="status" class="status">connecting…</span><button id="close" class="close" type="button" aria-label="close">✕</button></div>
+  <div class="stage"><canvas id="rain"></canvas><div class="body"><div id="rows" class="rows"></div></div></div>
+  <div id="foot" class="foot"><span>token detail</span><span>esc  close</span><span id="fps" class="fps">— fps</span></div>
+</div>
+<script nonce="__NONCE__">/*__COMMON_JS__*/</script>
+<script nonce="__NONCE__">/*__JS__*/</script>
+</body>
+</html>

package/dist/packages/popup/src/pages/token.js

@@ -0,0 +1,112 @@
+// dexterm popup — TOKEN DETAIL HUD (key/value table over full-panel rain; task-1290).
+// Inlined after common.js under a CSP nonce. No remote content, no innerHTML: every untrusted string
+// (symbol, name, mint, risk/flag text) is rendered with textContent only. Data is a TokenDetailVM over the WS.
+(() => {
+  'use strict';
+  const DT = window.DT; DT.page = 'token';
+  const $ = (id) => document.getElementById(id);
+  const titleEl = $('title'), rowsEl = $('rows');
+  const rain = DT.mountRain('rain');
+  let vm = null;
+
+  function fmtPrice(p) {
+    if (p == null) return '—';
+    if (p >= 1) return '$' + p.toFixed(3);
+    if (p >= 0.0001) return '$' + p.toFixed(6);
+    return '$' + p.toExponential(2);
+  }
+  // task-1325 fix: TokenView.chg is already in percent (DexScreener priceChange), not a fraction.
+  function fmtPct(x) { return x == null ? '—' : (x >= 0 ? '+' : '') + x.toFixed(Math.abs(x) >= 1000 ? 0 : 1) + '%'; }
+  function fmtUsd(x) {
+    if (x == null) return '—';
+    const a = Math.abs(x);
+    if (a >= 1e9) return '$' + (x / 1e9).toFixed(2) + 'B';
+    if (a >= 1e6) return '$' + (x / 1e6).toFixed(2) + 'M';
+    if (a >= 1e3) return '$' + (x / 1e3).toFixed(1) + 'K';
+    return '$' + x.toFixed(0);
+  }
+  const fmtNum = (x) => x == null ? '—' : x.toLocaleString('en-US');
+  const fmtPctRaw = (x) => x == null ? '—' : x.toFixed(1) + '%';
+
+  function resize() { if (rain) rain.resize(window.innerWidth, window.innerHeight); }
+  window.addEventListener('resize', resize);
+
+  // ---- row builders: every value is textContent only.
+  function clear(el) { while (el.firstChild) el.removeChild(el.firstChild); }
+  function addRow(label, value, cls) {
+    const row = document.createElement('div'); row.className = 'row';
+    const k = document.createElement('div'); k.className = 'k'; k.textContent = label;
+    const v = document.createElement('div'); v.className = 'v' + (cls ? ' ' + cls : ''); v.textContent = value == null ? '—' : String(value);
+    row.appendChild(k); row.appendChild(v); rowsEl.appendChild(row);
+  }
+  const chgCls = (x) => x == null ? 'muted' : x >= 0 ? 'up' : 'down';
+  const yesNoCls = (b) => b === true ? 'warn' : b === false ? 'up' : 'muted';
+  const yesNo = (b) => b == null ? '—' : b ? 'yes' : 'no';
+
+  function render() {
+    clear(rowsEl);
+    if (!vm) { addRow('', 'waiting for data…', 'muted'); return; }
+    const chg = vm.chg || {};
+    addRow('token', `${vm.symbol ? '$' + String(vm.symbol).replace(/^\$/, '') : '?'}  ${vm.name || ''}`.trim());
+    if (vm.launchpad) addRow('launchpad', vm.launchpad, 'muted');
+    if (vm.mint) addRow('mint', DT.shortAddr(vm.mint, 6), 'muted');
+    if (vm.mint) addRow('', vm.mint, 'muted');
+    addRow('price', fmtPrice(vm.price));
+    addRow('24h', fmtPct(chg.h24), chgCls(chg.h24));
+    addRow('6h', fmtPct(chg.h6), chgCls(chg.h6));
+    addRow('1h', fmtPct(chg.h1), chgCls(chg.h1));
+    addRow('5m', fmtPct(chg.m5), chgCls(chg.m5));
+    addRow('mcap', fmtUsd(vm.mcap));
+    addRow('fdv', fmtUsd(vm.fdv));
+    addRow('liq', fmtUsd(vm.liq));
+    addRow('vol 24h', fmtUsd(vm.vol24));
+    addRow('holders', fmtNum(vm.holders));
+    if (vm.holdersSample) addRow('', vm.holdersSample, 'muted');
+    addRow('top 10', fmtPctRaw(vm.top10), vm.top10 != null && vm.top10 >= 40 ? 'warn' : null);
+    addRow('dev', fmtPctRaw(vm.dev), vm.dev != null && vm.dev >= 10 ? 'warn' : null);
+    addRow('lp locked', fmtPctRaw(vm.lpLocked), vm.lpLocked != null && vm.lpLocked < 50 ? 'warn' : 'up');
+    addRow('mint auth', yesNo(vm.mintAuth), yesNoCls(vm.mintAuth));
+    addRow('freeze auth', yesNo(vm.freezeAuth), yesNoCls(vm.freezeAuth));
+    // task-1359: snipers / bundled from the wallet-intel scan (a reason instead of a number when not measured)
+    if (vm.intel) {
+      const lv = (l) => l === 'bad' ? 'down' : l === 'warn' ? 'warn' : l === 'ok' ? 'up' : 'muted';
+      addRow('snipers', vm.intel.snipers, lv(vm.intel.snipersLevel));
+      addRow('bundled', vm.intel.bundle, lv(vm.intel.bundleLevel));
+    }
+    addRow('rug score', vm.rugScore == null ? '—' : String(vm.rugScore), vm.rugScore != null && vm.rugScore >= 50 ? 'warn' : vm.rugScore != null ? 'up' : 'muted');
+    if (Array.isArray(vm.risks) && vm.risks.length) {
+      for (const r of vm.risks) {
+        const lvl = r && r.level ? String(r.level) : '';
+        const cls = /high|danger|crit/i.test(lvl) ? 'down' : /med|warn/i.test(lvl) ? 'warn' : 'muted';
+        addRow('risk', `${r && r.name ? r.name : ''}${lvl ? '  (' + lvl + ')' : ''}`.trim(), cls);
+      }
+    }
+    if (Array.isArray(vm.flags) && vm.flags.length) {
+      for (const f of vm.flags) addRow('flag', String(f), 'muted');
+    }
+    if (vm.updatedAt) addRow('updated', new Date(vm.updatedAt).toISOString().slice(11, 19), 'muted');
+  }
+
+  function setData(a) {
+    vm = a;
+    const sym = String(vm.symbol || '?').replace(/^\$/, '');
+    titleEl.textContent = `dexterm · $${sym} · TOKEN`;
+    document.title = `dexterm · ${sym}`;
+    const dir = (vm.chg && (vm.chg.h24 ?? vm.chg.h1)) || 0;
+    if (rain) {
+      rain.setMood(dir > 0.01 ? 'rainPump' : dir < -0.01 ? 'rainDump' : 'rain');
+      rain.setActivity(Math.min(1, 0.4 + Math.abs(dir)));
+      rain.setSources([sym, String(vm.mint || '').slice(0, 6)]);
+    }
+    DT.status(vm.price != null ? fmtPrice(vm.price) : 'no price', dir >= 0 ? 'up' : 'down');
+    render();
+  }
+
+  DT.onData(setData);
+  DT.onTheme(render);
+  DT.wireChrome();
+  resize();
+  render();
+  DT.connect();
+  DT.loop(() => {});
+})();

package/dist/packages/popup/src/pages/widget-sdk.js

@@ -0,0 +1,224 @@
+// dexterm popup — PACK WIDGET SDK (task-1358 Tier 5, r2, r3, r4). Inlined by the popup server into a pack's widget page,
+// ahead of the pack's own markup, and allow-listed in the page's CSP by its sha256 (a widget page carries no nonce;
+// every inline block, this one included, runs by hash). It is the FIRST script of the frame document and it does two
+// things: it seals the DOM (r4), then it defines ONE frozen global, `window.dexterm`:
+//
+//   dexterm.on(topic, fn)      fn(payload) on every push of a topic the widget declared (rows · token · narrative ·
+//                              positions · alerts · theme); the current value is replayed to a late listener
+//   dexterm.off(topic, fn)
+//   dexterm.theme              the terminal's theme tokens (also set as CSS variables: --bg --panel --border
+//                              --borderFocus --text --muted --dim --accent --up --down --warn --ai --pump --dbc)
+//   dexterm.topics             the topics this widget subscribed to (from its widget.json)
+//   dexterm.key                '<pack>/<widget>[/<id>]'
+//   dexterm.close()            ask the terminal to close this window (Esc does the same)
+//   dexterm.log(text)          a line in the terminal's popup log (sanitised there, 200 chars)
+//
+// That is the whole API. (r3) The page is the document inside the host's wrapper iframe: it has NO network of its own
+// (connect-src 'none' — no socket, no fetch, nothing), an opaque origin (sandbox without allow-same-origin: no cookies,
+// no storage, no reach into the wrapper) and may only be shown inside the host's own origin. View models arrive from the
+// wrapper by postMessage (accepted only from the parent window AND the host origin named in <head>); the only messages
+// this page can send are ready / log / close, and only to that origin. No imports or remote scripts (script-src is the
+// hash list and nothing else), no eval, no inline handlers, no remote images or fonts, no runtime script injection
+// (Trusted Types), no popups, forms or downloads (sandbox), and no navigating away: the wrapper's frame-src names the one
+// document this frame may show, the engine refuses any other, and the wrapper then closes the widget.
+//
+// (r4) THE DOM SEAL. One thing no CSP directive covers: a `<link rel=preconnect|dns-prefetch>` built at run time makes
+// WebKit resolve a name and open a bare TCP connection to a host:port the page chose (nothing is fetched, so no
+// directive applies; Trusted Types do not see it; the install-time audit cannot, the element does not exist yet). The
+// page cannot obtain a second realm (nested frames are created but sealed off from it by the sandbox; every HTML-parsing
+// sink is a Trusted Types sink), so this script — first to run, hash-listed — replaces the DOM's insertion methods on
+// the prototypes with non-configurable, non-writable guards that refuse any node whose subtree holds a LOADER element
+// (link · meta · base · iframe · frame · frameset · object · embed · applet · portal · fencedframe · script), makes the
+// HTML-string sinks throw outright (innerHTML / outerHTML setters, insertAdjacentHTML, document.write, setHTML,
+// setHTMLUnsafe, createContextualFragment, DOMParser) so the rule holds on an engine without Trusted Types too, and
+// removes WebRTC (the other connection CSP has no directive for). The natives live only in this closure: a pack script
+// runs after it and cannot get them back. (r5, after the fourth verifier) The STATIC parsers (`Document.parseHTMLUnsafe`,
+// `Document.parseHTML`) and `document.execCommand` throw too; `adoptNode` / `importNode` and the element-taking setters
+// (`table.caption` / `tHead` / `tFoot`, `document.body`, `select.add`, `options.add`) refuse a loader subtree at the door —
+// the system WKWebView on macOS 14/15 (Safari < 26) has NO Trusted Types, so this seal must be complete on its own; a
+// MutationObserver removes any loader element that ever appears and tells the wrapper, which closes the widget (after the
+// fact: a belt, not the control), and `ready` reports whether Trusted Types exist. (r6, after the fifth verifier) A click
+// on a link that targets ANOTHER window (`<a target=_blank>`) makes WebKit open a bare TCP connection to the link's
+// host:port even though the sandbox refuses the popup — an `<a>` is not a loader, so the seal never saw it. Now a
+// capture-phase listener on `window`, registered before any pack script exists (it runs first and nothing can remove
+// it), cancels every click / auxclick / submit whose path holds a link with a target other than `_self`, a `download`
+// or `ping`, or a form; `attachShadow` is forced open so a closed shadow root cannot hide such a link from the guard's
+// composedPath; the belt treats a `<meta>` as a breach only when it carries `http-equiv`. Render untrusted strings
+// (symbols, names, alert text) with textContent. Nothing in a view model names a key, a signer, a cap, a mandate or the gate.
+(() => {
+  'use strict';
+  let sealBreach = null, sealNote = null; // set once the SDK can talk to the wrapper
+  // ------------------------------------------------------------------ the DOM seal (r4, r5)
+  (() => {
+    const LOADERS = new Set(['link', 'meta', 'base', 'iframe', 'frame', 'frameset', 'object', 'embed', 'applet', 'portal', 'fencedframe', 'script']);
+    const SEL = [...LOADERS].join(',');
+    const N = Node.prototype, E = Element.prototype, D = Document.prototype, F = DocumentFragment.prototype, CD = CharacterData.prototype, DT = DocumentType.prototype;
+    const desc = (o, k) => Object.getOwnPropertyDescriptor(o, k);
+    const nodeType = desc(N, 'nodeType').get, localName = desc(E, 'localName').get;
+    const qsaE = E.querySelectorAll, qsaF = F.querySelectorAll, hasAttribute = E.hasAttribute, getAttribute = E.getAttribute;
+    const apply = Reflect.apply;
+    const refuse = (what) => { throw new DOMException(`dexterm widget: ${what} is sealed (loaders, nested documents and HTML-string sinks are refused in a pack page; see WIDGETS.md)`, 'NotAllowedError'); };
+    // the loader element (local name) a node carries, or null; a non-node is left to the native to reject
+    const findIn = (n, set, sel) => {
+      if (!n || typeof n !== 'object') return null;
+      let t; try { t = apply(nodeType, n, []); } catch { return null; }
+      if (t === 1) { const ln = apply(localName, n, []); if (set.has(ln)) return ln; const hit = apply(qsaE, n, [sel]); return hit.length ? apply(localName, hit[0], []) : null; }
+      if (t === 11) { const hit = apply(qsaF, n, [sel]); return hit.length ? apply(localName, hit[0], []) : null; }
+      return null;
+    };
+    const loaderIn = (n) => findIn(n, LOADERS, SEL);
+    // the kill switch watches the parser too, and the pack's own (hashed) <script> elements arrive through the parser: a
+    // runtime <script> has no hash (CSP refuses it) and the insertion guards refuse it anyway, so the watch excludes script
+    // (r6) a plain <meta> the parser reaches after this script (a page without </head>, or one in <body>) is harmless — the
+    // audit refuses <meta http-equiv> and so does the watch; any other meta is not a breach
+    const WATCHED = new Set([...LOADERS].filter((x) => x !== 'script' && x !== 'meta')), WATCH_SEL = [...WATCHED, 'meta[http-equiv]'].join(',');
+    const breachIn = (n) => {
+      const w = findIn(n, WATCHED, WATCH_SEL); if (w) return w;
+      try { if (apply(nodeType, n, []) === 1 && apply(localName, n, []) === 'meta' && apply(hasAttribute, n, ['http-equiv'])) return 'meta'; } catch { /* not an element */ }
+      return null;
+    };
+    const lock = (proto, name, value) => Object.defineProperty(proto, name, { value, writable: false, configurable: false, enumerable: true });
+    // which argument(s) a method inserts: 0 = the first, 1 = the second, -1 = all of them
+    const guard = (proto, name, which) => {
+      const d = desc(proto, name); if (!d || typeof d.value !== 'function') return;
+      const native = d.value;
+      lock(proto, name, function (...args) {
+        if (which === -1) { for (const a of args) { const w = loaderIn(a); if (w) refuse(`inserting <${w}>`); } }
+        else { const w = loaderIn(args[which]); if (w) refuse(`inserting <${w}>`); }
+        return apply(native, this, args);
+      });
+    };
+    guard(N, 'appendChild', 0); guard(N, 'insertBefore', 0); guard(N, 'replaceChild', 0);
+    for (const p of [E, D, F]) { guard(p, 'append', -1); guard(p, 'prepend', -1); guard(p, 'replaceChildren', -1); guard(p, 'moveBefore', 0); }
+    for (const p of [E, CD, DT]) { guard(p, 'before', -1); guard(p, 'after', -1); guard(p, 'replaceWith', -1); }
+    guard(E, 'insertAdjacentElement', 1);
+    if (typeof Range !== 'undefined') { guard(Range.prototype, 'insertNode', 0); guard(Range.prototype, 'surroundContents', 0); }
+    // HTML-string sinks: refused outright (Trusted Types refuse them too where the engine has them; this holds everywhere)
+    const sinkMethod = (proto, name) => { if (proto && desc(proto, name)) lock(proto, name, function () { refuse(`${name}()`); }); };
+    const sinkSetter = (proto, name) => { const d = proto && desc(proto, name); if (d && d.set) Object.defineProperty(proto, name, { get: d.get, set() { refuse(`the ${name} setter`); }, configurable: false, enumerable: d.enumerable }); };
+    sinkSetter(E, 'innerHTML'); sinkSetter(E, 'outerHTML'); sinkSetter(typeof ShadowRoot !== 'undefined' ? ShadowRoot.prototype : null, 'innerHTML');
+    sinkMethod(E, 'insertAdjacentHTML'); sinkMethod(E, 'setHTML'); sinkMethod(E, 'setHTMLUnsafe');
+    if (typeof ShadowRoot !== 'undefined') { sinkMethod(ShadowRoot.prototype, 'setHTML'); sinkMethod(ShadowRoot.prototype, 'setHTMLUnsafe'); }
+    sinkMethod(D, 'write'); sinkMethod(D, 'writeln'); sinkMethod(D, 'open');
+    if (typeof Range !== 'undefined') sinkMethod(Range.prototype, 'createContextualFragment');
+    if (typeof DOMParser !== 'undefined') sinkMethod(DOMParser.prototype, 'parseFromString');
+    if (typeof XSLTProcessor !== 'undefined') { sinkMethod(XSLTProcessor.prototype, 'transformToFragment'); sinkMethod(XSLTProcessor.prototype, 'transformToDocument'); }
+    // r5: the STATIC parsers (not on any prototype) and the editor command that parses HTML into the document
+    for (const name of ['parseHTMLUnsafe', 'parseHTML']) { if (typeof Document[name] === 'function') lock(Document, name, function () { refuse(`Document.${name}()`); }); }
+    sinkMethod(D, 'execCommand');
+    // r5: a node from ANOTHER document (a parsed one, an XML one) enters this one by adoptNode / importNode, by an insertion
+    // method (guarded above) or by an element-taking setter: refuse a loader subtree at every door
+    guard(D, 'adoptNode', 0); guard(D, 'importNode', 0);
+    const guardSetter = (proto, name) => {
+      const d = proto && desc(proto, name); if (!d || !d.set) return;
+      const set = d.set;
+      Object.defineProperty(proto, name, { get: d.get, set(v) { const w = loaderIn(v); if (w) refuse(`setting ${name} to a subtree with <${w}>`); return apply(set, this, [v]); }, configurable: false, enumerable: d.enumerable });
+    };
+    if (typeof HTMLTableElement !== 'undefined') for (const k of ['caption', 'tHead', 'tFoot']) guardSetter(HTMLTableElement.prototype, k);
+    guardSetter(D, 'body');
+    if (typeof HTMLSelectElement !== 'undefined') guard(HTMLSelectElement.prototype, 'add', 0);
+    if (typeof HTMLOptionsCollection !== 'undefined') guard(HTMLOptionsCollection.prototype, 'add', 0);
+    // r5: the last line — if a loader element ever becomes part of the document anyway (a parsing path this list does not
+    // name on some engine, or a parser/audit disagreement in the markup itself), it is removed at once and the wrapper
+    // closes the widget. After the fact (the engine may already have acted on it), so a belt, not the control.
+    const removeChild = N.removeChild;
+    const mo = new MutationObserver((recs) => {
+      for (const r of recs) for (const n of r.addedNodes) {
+        const w = breachIn(n);
+        if (w) { try { const p = n.parentNode; if (p) apply(removeChild, p, [n]); } catch { /* already gone */ } if (sealBreach) sealBreach(w); }
+      }
+    });
+    mo.observe(document, { childList: true, subtree: true });
+    // r6: ACTIVATIONS. A click on a link that targets another window makes WebKit open a bare TCP connection to the link's
+    // host:port before the sandbox refuses the popup. This listener sits on `window` in the capture phase, registered
+    // before any pack script exists: it runs first and nothing can remove it (no reference). It cancels a click /
+    // auxclick whose composed path holds a link (`a` / `area`, HTML or SVG) with a target other than `_self` / empty, or a
+    // `download` / `ping` attribute, and every form submit (the sandbox refuses forms anyway). A link to our own origin
+    // with no target navigates the frame, which the wrapper's frame-src governs (r3).
+    const composedPath = Event.prototype.composedPath, preventDefault = Event.prototype.preventDefault, stopImmediate = Event.prototype.stopImmediatePropagation;
+    let noted = 0;
+    const cancel = (e, why) => { apply(preventDefault, e, []); apply(stopImmediate, e, []); if (sealNote && noted < 5) { noted++; sealNote(why); } };
+    const activation = (e) => {
+      let path; try { path = apply(composedPath, e, []); } catch { path = []; }
+      for (const n of path) {
+        let t; try { t = apply(nodeType, n, []); } catch { continue; }
+        if (t !== 1) continue;
+        const ln = apply(localName, n, []);
+        if (ln === 'a' || ln === 'area') {
+          const target = (apply(hasAttribute, n, ['target']) ? String(apply(getAttribute, n, ['target']) || '') : '').trim().toLowerCase();
+          if ((target && target !== '_self') || apply(hasAttribute, n, ['download']) || apply(hasAttribute, n, ['ping'])) { cancel(e, `refused a ${e.type} on a link that targets another window (${target || 'download/ping'})`); return; }
+        }
+        if (ln === 'form') { cancel(e, `refused a form ${e.type}`); return; }
+      }
+    };
+    for (const type of ['click', 'auxclick', 'submit']) window.addEventListener(type, activation, { capture: true });
+    // a closed shadow root would hide its links from composedPath: every shadow root a pack page makes is open
+    { const d = desc(E, 'attachShadow'); if (d && typeof d.value === 'function') { const native = d.value; lock(E, 'attachShadow', function (init, ...rest) { const i = init && typeof init === 'object' ? { ...init, mode: 'open' } : init; return apply(native, this, [i, ...rest]); }); } }
+    // WebRTC: a connection with no CSP directive; a pack page has no use for it
+    for (const name of ['RTCPeerConnection', 'webkitRTCPeerConnection', 'mozRTCPeerConnection', 'RTCIceTransport', 'RTCDtlsTransport', 'RTCSctpTransport']) {
+      if (name in window) lock(window, name, function () { refuse(`${name}`); });
+    }
+    Object.defineProperty(window, 'dextermSealed', { value: true, writable: false, configurable: false, enumerable: true });
+  })();
+
+  // ------------------------------------------------------------------ the SDK
+  const meta = (n) => (document.querySelector(`meta[name="${n}"]`) || {}).content || '';
+  const KEY = meta('dexterm-widget'), TOPICS = Object.freeze(meta('dexterm-topics').split(',').filter(Boolean)), HOST = meta('dexterm-host');
+  // the wrapper is the parent window; a page opened any other way has nobody to talk to and stays inert
+  const host = window.parent !== window && /^http:\/\/127\.0\.0\.1:\d+$/.test(HOST) ? window.parent : null;
+  const listeners = new Map();
+  const last = new Map();
+  let theme = {};
+  const CSS_TOKENS = ['bg', 'panel', 'panelAlt', 'border', 'borderFocus', 'text', 'muted', 'dim', 'accent', 'up', 'down', 'warn', 'ai', 'pump', 'dbc', 'glow'];
+  function send(o) { if (host) { try { host.postMessage(o, HOST); } catch { /* wrapper gone */ } } }
+  function applyTheme(t) {
+    theme = Object.freeze({ ...theme, ...(t || {}) });
+    const r = document.documentElement.style;
+    for (const k of CSS_TOKENS) if (typeof theme[k] === 'string') r.setProperty(`--${k}`, theme[k]);
+    fire('theme', theme);
+  }
+  function fire(topic, payload) {
+    last.set(topic, payload);
+    const fns = listeners.get(topic);
+    if (!fns) return;
+    for (const fn of [...fns]) { try { fn(payload); } catch (err) { send({ type: 'log', msg: `widget ${KEY} ${topic} handler: ${err && err.message}` }); } }
+  }
+  function requestClose() { send({ type: 'close' }); }
+  sealBreach = (what) => send({ type: 'breach', what: String(what).slice(0, 24) });
+  sealNote = (why) => send({ type: 'log', msg: `widget ${KEY}: ${why}`.slice(0, 200) });
+  window.addEventListener('message', (e) => {
+    if (!host || e.source !== host || e.origin !== HOST) return;
+    const m = e.data;
+    if (!m || typeof m !== 'object' || typeof m.type !== 'string') return;
+    switch (m.type) {
+      case 'hello': if (m.theme) applyTheme(m.theme); break;
+      case 'theme': applyTheme(m.tokens || {}); break;
+      case 'data': if (typeof m.topic === 'string' && TOPICS.includes(m.topic)) fire(m.topic, m.payload); break;
+      case 'ping': send({ type: 'pong' }); break; // r6: the wrapper checks the document is still ours after a frame `load`
+      case 'close': document.documentElement.dataset.dexterm = 'closed'; break; // the host closes the window itself
+      default: break;
+    }
+  });
+  const api = Object.freeze({
+    on(topic, fn) {
+      if (typeof fn !== 'function' || typeof topic !== 'string') return api;
+      if (!listeners.has(topic)) listeners.set(topic, new Set());
+      listeners.get(topic).add(fn);
+      if (last.has(topic)) { try { fn(last.get(topic)); } catch (err) { send({ type: 'log', msg: `widget ${KEY} ${topic} handler: ${err && err.message}` }); } }
+      return api;
+    },
+    off(topic, fn) { const s = listeners.get(topic); if (s) s.delete(fn); return api; },
+    get theme() { return theme; },
+    get topics() { return TOPICS; },
+    get key() { return KEY; },
+    close: requestClose,
+    log(text) { send({ type: 'log', msg: String(text).slice(0, 200) }); },
+  });
+  Object.defineProperty(window, 'dexterm', { value: api, writable: false, configurable: false, enumerable: true });
+  window.addEventListener('keydown', (e) => { if (e.key === 'Escape') requestClose(); });
+  window.addEventListener('error', (e) => send({ type: 'log', msg: `widget ${KEY} error: ${e.message}`.slice(0, 200) }));
+  // the pack's own scripts run after this one; `ready` goes out once the document has parsed, so their listeners exist
+  // before the wrapper replays the current view models
+  const ready = () => send({ type: 'ready', page: `widget:${KEY}`.slice(0, 24), tt: typeof trustedTypes !== 'undefined' });
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ready); else ready();
+})();

package/dist/packages/popup/src/pages/widget.css

@@ -0,0 +1,5 @@
+/* dexterm popup — pack WIDGET wrapper (task-1358 r3). The pack page lives in the sandboxed iframe; this page is ours. */
+.widget { position: absolute; inset: 0; width: 100%; height: 100%; border: 0; display: block; background: transparent; }
+.blocked { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; padding: 20px; text-align: center;
+  color: var(--down); background: var(--bg); font-size: 12px; z-index: 2; }
+.blocked[hidden] { display: none; }

package/dist/packages/popup/src/pages/widget.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="dexterm-ws" content="__WS_TOKEN__">
+<meta name="dexterm-popup" content="__POPUP_ID__">
+<meta name="dexterm-port" content="__PORT__">
+<meta name="dexterm-widget" content="__WIDGET_KEY__">
+<meta name="dexterm-frame" content="__FRAME_URL__">
+<title>dexterm · widget</title>
+<style nonce="__NONCE__">/*__CSS__*/</style>
+</head>
+<body>
+<div id="hud" class="hud">
+  <div id="drag" class="drag"><span class="mark">✦</span><span id="title" class="title">__WIDGET_TITLE__</span><span id="status" class="status">connecting…</span><button id="close" class="close" type="button" aria-label="close">✕</button></div>
+  <div class="stage"><iframe id="widget" class="widget" sandbox="allow-scripts" referrerpolicy="no-referrer" title="pack widget" src="__FRAME_URL__"></iframe><div id="blocked" class="blocked" hidden></div></div>
+</div>
+<script nonce="__NONCE__">/*__COMMON_JS__*/</script>
+<script nonce="__NONCE__">/*__JS__*/</script>
+</body>
+</html>

package/dist/packages/popup/src/pages/widget.js

@@ -0,0 +1,85 @@
+// dexterm popup — pack WIDGET wrapper page (task-1358 r3). OUR document (nonce CSP like every built-in page): it owns
+// the WebSocket, the drag strip, the close button and Escape, and holds the pack page in `<iframe sandbox="allow-scripts">`
+// whose only permitted document is the host's widget-frame route (the page CSP's `frame-src`). The pack page has no
+// network of its own: everything it sees comes through here by postMessage, and the only things it can say back are
+// ready / log / close.
+//
+// Why a frame: a document may always navigate ITSELF, and `sandbox` only stops it navigating others — so a pack page
+// served top-level could carry data to a remote URL in the address bar (the r2 verifier's finding, browser fallback).
+// A nested browsing context's navigations are governed by the PARENT's `frame-src`, whoever initiates them: the engine
+// refuses a remote URL before any request leaves, and this page hears the violation and closes the widget.
+(() => {
+  'use strict';
+  const meta = (n) => document.querySelector(`meta[name="${n}"]`)?.content || '';
+  const KEY = meta('dexterm-widget');
+  DT.page = `widget:${KEY}`.slice(0, 24);
+  const frame = document.getElementById('widget'), blockedEl = document.getElementById('blocked');
+  let child = null, loads = 0, dead = false, frameReady = false;
+  const last = new Map(); // the latest payload per topic, replayed once the frame says ready (pushes may arrive first)
+
+  // targetOrigin must be '*' for an opaque-origin (sandboxed) frame; the only document that can be in there is ours
+  // (frame-src), and the frame is dropped the moment anything else is seen.
+  const post = (m) => { if (!dead && child && frameReady) { try { child.postMessage(m, '*'); } catch { /* frame gone */ } } };
+  const kill = (why) => {
+    if (dead) return;
+    dead = true; child = null; frameReady = false;
+    try { frame.removeAttribute('src'); frame.remove(); } catch { /* already gone */ }
+    blockedEl.textContent = `widget blocked: ${why}`; blockedEl.hidden = false;
+    DT.status('blocked', 'down');
+    DT.send({ type: 'log', msg: `widget ${KEY} blocked: ${why}`.slice(0, 200) });
+    DT.requestClose();
+  };
+
+  // r6: a second `load` is NOT proof of a navigation — WebKit fires it for a same-document fragment navigation too (an
+  // in-page `<a href="#section">`), which used to close honest widgets. So on a second load the wrapper asks the document
+  // to identify itself: our SDK answers a `ping` with `pong` at once; an error document committed after a refused
+  // navigation (frame-src), a spent-token 404 or about:blank cannot — then the widget is closed. Pushes pause meanwhile.
+  let pingTimer = null;
+  const liveness = () => {
+    frameReady = false; child = frame.contentWindow;
+    if (pingTimer) clearTimeout(pingTimer);
+    try { child && child.postMessage({ type: 'ping' }, '*'); } catch { /* no window */ }
+    pingTimer = setTimeout(() => { pingTimer = null; if (!dead) kill('the page tried to leave its frame (the navigation was refused)'); }, 400);
+  };
+  frame.addEventListener('load', () => {
+    loads++;
+    if (loads > 1) { liveness(); return; }
+    child = frame.contentWindow;
+  });
+  // frame-src violations are reported to the EMBEDDING document's policy: this page hears a pack page's attempt to go elsewhere
+  document.addEventListener('securitypolicyviolation', (e) => {
+    const d = String(e.effectiveDirective || e.violatedDirective || '');
+    if (d.startsWith('frame-src') || d.startsWith('child-src')) kill(`tried to navigate to ${String(e.blockedURI || '?').slice(0, 80)} (refused by frame-src)`);
+  });
+  window.addEventListener('message', (e) => {
+    // identity is the window object; the sandboxed frame's origin is the literal 'null'
+    if (dead || !child || e.source !== child) return;
+    const m = e.data;
+    if (!m || typeof m !== 'object' || typeof m.type !== 'string') return;
+    switch (m.type) {
+      case 'ready':
+        frameReady = true;
+        // r5: the frame says whether this WebView has Trusted Types; without them the SDK's seal is the only HTML-sink guard
+        if (m.tt === false) { DT.status('live · no Trusted Types', 'warn'); DT.send({ type: 'log', msg: `widget ${KEY}: this WebView has no Trusted Types — the SDK seal is the HTML-sink guard`.slice(0, 200) }); }
+        else DT.status('live', 'up');
+        post({ type: 'hello', theme: DT.theme });
+        for (const [topic, payload] of last) post({ type: 'data', topic, payload });
+        break;
+      case 'pong': // r6: the document is still ours after a second load (a fragment navigation) — keep feeding it
+        if (pingTimer) { clearTimeout(pingTimer); pingTimer = null; }
+        frameReady = true; break;
+      case 'log': DT.send({ type: 'log', msg: String(m.msg).slice(0, 200) }); break;
+      case 'close': DT.requestClose(); break;
+      // r5: the seal's kill switch saw a loader element appear in the page — it was removed; close the widget
+      case 'breach': kill(`a <${String(m.what).replace(/[^a-z0-9-]/gi, '').slice(0, 24)}> element appeared in the page (removed; the seal reported it)`); break;
+      default: break; // anything else a page invents is ignored here and never reaches the socket
+    }
+  });
+
+  DT.onTheme((t) => post({ type: 'theme', tokens: t }));
+  DT.onData((payload, topic) => { if (typeof topic !== 'string') return; last.set(topic, payload); post({ type: 'data', topic, payload }); });
+  DT.onClose(() => { post({ type: 'close' }); });
+  DT.wireChrome();
+  DT.loop(() => {});
+  DT.connect();
+})();

package/dist/packages/popup/src/protocol.js

@@ -0,0 +1,31 @@
+// dexterm popup protocol v1 (task-1290). Types only; the runtime lives in server.ts (TUI side),
+// src/pages/*.js (popup side) and shell/wry (window side). Three layers, three channels:
+//
+//   TUI  ──stdin JSON lines──▶  SHELL (window process: wry)  ──stdout JSON lines──▶  TUI
+//   TUI  ◀──── WebSocket (loopback, ticket → one-time token) ────▶  POPUP PAGE (served by the TUI's server)
+//
+// Invariants (security model, carried over from the spike doc §5):
+//   * popups never receive keys, signer state, mandates or trade capability; they receive VIEW MODELS and theme tokens;
+//   * popups can only send UI events from `PopupToTui`; anything else is dropped and reported as `popup.dropped`;
+//   * the popup URL carries a single-use 30 s ticket and travels TUI → shell over stdin (never argv, never a log);
+//   * every untrusted string in a view model is rendered via textContent / fillText, never markup; CSP blocks the rest.
+//
+// This file ports and narrows research/popup-host/popup-protocol.ts to the three in-app popups.
+// ------------------------------------------------------------------ pack widgets (task-1358 Tier 5)
+/**
+ * The topics a pack widget may subscribe to. Each is a PUBLIC view model the terminal already shows: nothing in
+ * them names a key, a signer, a cap, a mandate or the gate, and a widget can only receive — the only messages a
+ * widget page may send are the generic ready/perf/log + close/focus/drag events every popup has.
+ */
+export const WIDGET_TOPICS = ['rows', 'token', 'narrative', 'positions', 'alerts', 'theme'];
+/** Hard cap on a widget page (the pack layer caps files at 512 KB; the server refuses anything larger at ticket time). */
+export const WIDGET_HTML_MAX = 512_000;
+// ------------------------------------------------------------------ chart v2 (task-1325): TradingView Lightweight Charts page
+/** The six chart timeframes, same order and keys (1–6) as the terminal. 1s is deliberately absent (see README). */
+export const CHART_INTERVALS = ['1m', '5m', '15m', '1h', '4h', '1d'];
+/** Indicator / overlay ids the chart page may toggle. Anything else is dropped by the server. */
+export const CHART_INDICATORS = ['ema9', 'ema21', 'vwap', 'volma', 'volume', 'tape'];
+export const CHART_STYLES = ['candles', 'line', 'area'];
+/** Price-scale mode: auto (normal, autoscaled), logarithmic, percent (from the first visible bar). */
+export const CHART_SCALES = ['auto', 'log', 'percent'];
+export const PROTOCOL_VERSION = 'dexterm-popup/1';