gloomberb 0.11.0 → 0.11.2

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="https://gloomberb.com/gloomberb-logo-grayscale.svg" alt="Gloomberb logo" width="76" />
+<img src="https://gloom.sh/gloomberb-logo-grayscale.svg" alt="Gloomberb logo" width="76" />
 
 # Gloomberb
 
@@ -8,7 +8,7 @@
 
 Desktop app for macOS and Windows. Terminal UI for macOS, Linux, and Windows.
 
-<a href="https://gloomberb.com/download/desktop"><strong>Download desktop</strong></a>
+<a href="https://gloom.sh/download/desktop"><strong>Download desktop</strong></a>
 &nbsp;&middot;&nbsp;
 <a href="#install"><strong>Install the TUI</strong></a>
 &nbsp;&middot;&nbsp;
@@ -17,7 +17,7 @@ Desktop app for macOS and Windows. Terminal UI for macOS, Linux, and Windows.
 <br />
 <br />
 
-<img src="https://gloomberb.com/landing-terminal.png" alt="Gloomberb terminal showing portfolio, watchlists, market data, and chart panels." width="720" />
+<img src="https://gloom.sh/landing-terminal.png" alt="Gloomberb terminal showing portfolio, watchlists, market data, and chart panels." width="720" />
 
 </div>
 
@@ -29,8 +29,24 @@ Gloomberb has two ways in:
 |---------|----------|-------------|
 | Desktop app | A polished app window, pop-out panes, OS shortcuts, and built-in updates | Published for macOS and Windows. It also installs a `gloomberb` terminal command for the TUI. |
 | Terminal UI | Fast keyboard workflows inside your terminal, SSH/dev boxes, Linux machines, and script-friendly setups | Runs with `gloomberb` on macOS, Linux, and Windows. |
+| Browser app | The shared DOM interface without an install | Open [term.gloom.sh](https://term.gloom.sh). |
 
-Both share the same command language, plugin system, market data surfaces, portfolios, watchlists, alerts, notes, and AI tools.
+The desktop app and TUI share the full command language and plugin system. The browser app uses the same official DOM renderer and layout with a reviewed browser plugin catalog.
+
+## Browser App
+
+[term.gloom.sh](https://term.gloom.sh) works anonymously with configuration, tickers, layouts, session state, and plugin state stored in the browser. Anonymous sessions receive rate-limited, 15-minute-delayed Gloom Cloud market data and read-only chat. Login remains optional and enables sync and chat posting; Pro accounts receive realtime market data. Cloud REST and WebSocket traffic uses the same-origin `/api` path, which the Worker forwards only to `https://api.gloom.sh`; it is not an arbitrary network proxy.
+
+The browser build intentionally omits brokers and native integrations, filesystem notes, local AI, external plugins, updater/debug tools, application menus, native window controls, pop-out native windows, and native context menus. Modules that still depend on desktop-only or CORS-blocked feeds are also absent for now: RSS/Substack, prediction markets and polls, market halts/heatmap/movers, dividend/ownership/SEC panes, earnings/IPO, and TV. Public shares open under `/s/:id` in a separate slim bundle. Share creation and owner deletion use the signed-in Gloom Cloud session through the same fixed API path; public reads require no account.
+
+Local browser development:
+
+```bash
+bun run web:build
+bunx wrangler dev
+```
+
+Validate the public artifacts with `bun run web:audit` and `bun run cloudflare:dry-run`. `wrangler.jsonc` remains generic for local checks. After verification passes on `main`, GitHub Actions deploys `term.gloom.sh` with `wrangler.production.jsonc`. The private Gloom Cloud API is deployed separately.
 
 ## Install
 
@@ -41,21 +57,21 @@ Install the desktop app and the `gloomberb` terminal command:
 ```bash
 brew install --cask vincelwt/tap/gloomberb
 # or
-curl -fsSL gloomberb.com/install | bash
+curl -fsSL gloom.sh/install | bash
 ```
 
 Both install `Gloomberb.app` and a `gloomberb` command that runs the TUI through the app bundle, so the bundled runtime is stored once.
 
 Prefer a direct download?
 
-- [Download Gloomberb for Mac](https://gloomberb.com/download/desktop)
+- [Download Gloomberb for Mac](https://gloom.sh/download/desktop)
 
 ### Linux
 
 Install the standalone TUI binary:
 
 ```bash
-curl -fsSL gloomberb.com/install | bash
+curl -fsSL gloom.sh/install | bash
 ```
 
 This installs `gloomberb` to `~/.local/bin` by default. A Linux desktop package is not published yet.
@@ -150,10 +166,9 @@ Human-readable output is the default. Automation can opt into structured output
 | `gloomberb portfolio [action]` | Manage manual portfolios |
 | `gloomberb watchlist [action]` | Manage watchlists |
 | `gloomberb notes|alerts [action]` | Manage local notes and alerts |
-| `gloomberb broker|ibkr [action]` | Inspect broker integrations; trading actions require explicit account/profile and `--yes` |
-| `gloomberb ai providers|ask|screen` | Use configured AI providers and screeners |
+| `gloomberb broker|ibkr [action]` | Inspect broker profiles |
+| `gloomberb ai providers|ask` | Use configured AI providers |
 | `gloomberb rss fetch <url>` | Fetch an RSS feed |
-| `gloomberb buildout|congress|substack|x-feed|tweets` | Access cloud and social data sources when an existing session is available |
 | `gloomberb provider status` | Inspect enabled data providers |
 | `gloomberb config|cache|plugin|layout|pane|debug|doctor|version|changelog` | Inspect and manage local app state |
 | `gloomberb fn [...]` | Run a pane-backed report command |
@@ -164,8 +179,6 @@ Human-readable output is the default. Automation can opt into structured output
 | `gloomberb remove <name>` | Remove an installed plugin |
 | `gloomberb update [name]` | Update plugins |
 
-Commands that need a signed-in cloud session may return `auth_required`; sign-in, account management, and chat workflows are still handled in the app UI for now.
-
 ## Plugins
 
 Everything from the portfolio list to broker integrations is a plugin. Plugins can add panes, tabs, columns, command bar commands, CLI commands, status bar widgets, and data providers.
@@ -190,7 +203,7 @@ See [PLUGINS.md](PLUGINS.md) for the plugin API and the shared UI surface availa
 | `Ctrl+Shift+M` | Move focused window (`WIN resize` starts resize mode) |
 | `Ctrl+Shift+D` | Dock or float focused pane |
 | `Ctrl+Shift+L` | Layout actions |
-| `Ctrl+Shift+G` | Gridlock all windows |
+| `Ctrl+Shift+G` | Tidy windows |
 | `Tab` | Switch panes |
 | `j` / `k` | Navigate lists |
 | `h` / `l` | Switch tabs |
@@ -224,6 +237,7 @@ Use `HELP` inside Gloomberb for the live shortcut list. The common command-bar p
 | `CMP <tickers>` | Normalized price comparison |
 | `CORR <tickers>` | Ticker return correlations |
 | `ANR <ticker>` | Analyst targets and ratings |
+| `DIAG <ticker>` | Equity Diagnostic with cited flags and anomalies |
 | `SEC <ticker>` | SEC filings and company disclosures |
 | `OMON <ticker>` | Options monitor |
 | `OVME` | Black-Scholes option calculator with Greeks and implied volatility |
@@ -272,6 +286,7 @@ The toolbar controls preset or exact date ranges, intervals from one minute thro
 | `AUCT` | Treasury auction results: high rate, bid-to-cover, indirect share, and size |
 | `VIX` | VIX 30-day/3-month implied-volatility curve |
 | `CRD` | Credit spreads |
+| `CDS [ticker]` | Single-name corporate CDS activity: most-active issuers, or one issuer's trades |
 | `ERN` | Earnings calendar |
 | `IPO` | Upcoming and recent IPOs |
 | `HALT` | US trading halts with reason and resumption times |
@@ -301,16 +316,24 @@ The toolbar controls preset or exact date ranges, intervals from one minute thro
 | `AW` / `AP <ticker>` | Add a ticker to the active watchlist or portfolio |
 | `RW` / `RP <ticker>` | Remove a ticker from the active watchlist or portfolio |
 | `PS` | Open focused pane settings |
-| `LAY <action>` | Open layout actions |
+| `LAY` | Open the layout browser to switch, publish, or add layouts |
+| `LMA <query>` | Layout and pane arrangement actions |
 | `WIN move\|resize` | Move or resize the focused window |
-| `GL` | Gridlock all visible panes |
+| `GL` | Tidy all windows |
 | `SB` | Toggle the status bar |
 | `VF` | Toggle quote value flashing |
 | `TH <theme>` | Change color theme |
+| `FONT+` / `FONT-` | Increase or decrease desktop font size |
+| `CONN` | Connection health |
+| `POLL` | Prediction-market polls |
+| `ART` | Loaded article lookup |
+| `UPGRADE` | Account upgrade |
 | `CR` | Cycle chart renderer |
 | `LANG <locale>` | Change interface language (`auto`, `en`, `es`, `zh-CN`, `zh-TW`, `ja`, or `ko`) |
 | `PL <plugin>` | Manage plugins |
 
+Published layouts preserve portable pane setup and state, including searches, chart viewport, and drawings. Credentials, accounts, portfolios, and pane fields marked private stay local. Publishing copies a durable `term.gloom.sh/l/...` link for social sharing.
+
 ## Gloom Cloud sign-in
 
 Sign in with email and password, or pick `Log In with QR Code` from the command bar and scan the code with the Gloomberb mobile companion app to sign the terminal in without typing. The onboarding wizard offers the same QR option as the recommended path, with email and password as the alternative.

package/README.zh-CN.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="https://gloomberb.com/gloomberb-logo-grayscale.svg" alt="Gloomberb logo" width="76" />
+<img src="https://gloom.sh/gloomberb-logo-grayscale.svg" alt="Gloomberb logo" width="76" />
 
 # Gloomberb
 
@@ -8,7 +8,7 @@
 
 桌面应用支持 macOS 和 Windows。终端界面（TUI）支持 macOS、Linux 和 Windows。
 
-<a href="https://gloomberb.com/download/desktop"><strong>下载桌面版</strong></a>
+<a href="https://gloom.sh/download/desktop"><strong>下载桌面版</strong></a>
 &nbsp;&middot;&nbsp;
 <a href="#安装">安装 TUI</a>
 &nbsp;&middot;&nbsp;
@@ -17,7 +17,7 @@
 <br />
 <br />
 
-<img src="https://gloomberb.com/landing-terminal.png" alt="Gloomberb 终端界面，显示投资组合、自选列表、市场数据和图表面板。" width="720" />
+<img src="https://gloom.sh/landing-terminal.png" alt="Gloomberb 终端界面，显示投资组合、自选列表、市场数据和图表面板。" width="720" />
 
 </div>
 
@@ -43,21 +43,21 @@ Gloomberb 有两种使用方式：
 ```bash
 brew install --cask vincelwt/tap/gloomberb
 # 或
-curl -fsSL gloomberb.com/install | bash
+curl -fsSL gloom.sh/install | bash
 ```
 
 两种方式都会安装 `Gloomberb.app`，以及一个通过应用内置运行时执行 TUI 的 `gloomberb` 命令，运行时只会存储一份。
 
 想直接下载？
 
-- [下载 Gloomberb（Mac 版）](https://gloomberb.com/download/desktop)
+- [下载 Gloomberb（Mac 版）](https://gloom.sh/download/desktop)
 
 ### Linux
 
 安装独立的 TUI 可执行文件：
 
 ```bash
-curl -fsSL gloomberb.com/install | bash
+curl -fsSL gloom.sh/install | bash
 ```
 
 默认会将 `gloomberb` 安装到 `~/.local/bin`。Linux 桌面安装包暂未发布。
@@ -136,10 +136,9 @@ gloomberb
 | `gloomberb portfolio [action]` | 管理手动投资组合 |
 | `gloomberb watchlist [action]` | 管理自选列表 |
 | `gloomberb notes\|alerts [action]` | 管理本地笔记与提醒 |
-| `gloomberb broker\|ibkr [action]` | 查看券商集成状态；交易操作需要显式指定账户/配置并加 `--yes` |
-| `gloomberb ai providers\|ask\|screen` | 使用已配置的 AI 服务商与选股器 |
+| `gloomberb broker\|ibkr [action]` | 查看券商配置 |
+| `gloomberb ai providers\|ask` | 使用已配置的 AI 服务商 |
 | `gloomberb rss fetch <url>` | 抓取 RSS 订阅源 |
-| `gloomberb buildout\|congress\|substack\|x-feed\|tweets` | 在已有会话可用时访问云端与社交数据源 |
 | `gloomberb provider status` | 查看已启用的数据源 |
 | `gloomberb config\|cache\|plugin\|layout\|pane\|debug\|doctor\|version\|changelog` | 查看和管理本地应用状态 |
 | `gloomberb fn [...]` | 运行基于面板的报告命令 |
@@ -150,8 +149,6 @@ gloomberb
 | `gloomberb remove <name>` | 移除已安装插件 |
 | `gloomberb update [name]` | 更新插件 |
 
-需要已登录云端会话的命令可能返回 `auth_required`；登录、账户管理与聊天相关操作目前仍需在应用界面中完成。
-
 ## 插件
 
 从投资组合列表到券商集成，一切皆为插件。插件可以添加面板、页签、列、命令栏命令、CLI 命令、状态栏组件与数据源。
@@ -260,7 +257,8 @@ gloomberb
 | `AW` / `AP <ticker>` | 将股票添加到活动自选列表或投资组合 |
 | `RW` / `RP <ticker>` | 从活动自选列表或投资组合中移除股票 |
 | `PS` | 打开聚焦面板的设置 |
-| `LAY <action>` | 打开布局操作 |
+| `LAY` | 打开布局浏览器以切换、发布或添加布局 |
+| `LMA <query>` | 布局与面板排列操作 |
 | `WIN move\|resize` | 移动或缩放聚焦窗口 |
 | `GL` | 所有可见面板网格对齐 |
 | `SB` | 切换状态栏 |
@@ -270,6 +268,8 @@ gloomberb
 | `LANG <locale>` | 切换界面语言（`auto`、`en`、`es`、`zh-CN`、`zh-TW`、`ja` 或 `ko`） |
 | `PL <plugin>` | 管理插件 |
 
+发布的布局会保留可移植的面板设置与状态，包括搜索条件、图表视窗和绘图；凭据、账户、投资组合以及标记为私密的字段始终保留在本地。发布后会自动复制一个长期有效的 `term.gloom.sh/l/...` 社交分享链接。
+
 ## 本地化界面
 
 Gloomberb 内置 English、简体中文、繁體中文、日本語和한국어界面支持；英文仍是默认回退语言。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gloomberb",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "packageManager": "bun@1.3.11",
   "description": "Market research and portfolio tracker for the terminal",
   "module": "src/index.tsx",
@@ -19,15 +19,21 @@
     "build": "bun run scripts/build.ts",
     "build:all": "bun run scripts/build.ts --all",
     "desktop:view:build": "bun run scripts/build-electrobun-view.ts",
+    "web:build": "bun run scripts/build-web.ts",
+    "web:audit": "bun run web:build && bun run scripts/audit-web-bundle.ts",
+    "cloudflare:typecheck": "tsc --project tsconfig.cloudflare.json",
+    "cloudflare:dry-run": "bun run web:build && wrangler deploy --dry-run",
     "desktop:dev": "bun run scripts/electrobun-dev.ts",
     "desktop:build": "electrobun build",
     "desktop:release": "electrobun build --env=stable",
     "desktop:release:windows": "electrobun build --env=stable --targets=win-x64",
     "i18n:audit": "bun run scripts/i18n-audit.ts",
-    "typecheck": "bun run typecheck:opentui && bun run typecheck:electrobun-bun && bun run typecheck:electrobun-view && bun run typecheck:scripts",
+    "typecheck": "bun run typecheck:opentui && bun run typecheck:electrobun-bun && bun run typecheck:electrobun-view && bun run typecheck:browser && bun run typecheck:cloudflare && bun run typecheck:scripts",
     "typecheck:opentui": "tsc --project tsconfig.opentui.json",
     "typecheck:electrobun-bun": "tsc --project tsconfig.electrobun-bun.json",
     "typecheck:electrobun-view": "tsc --project tsconfig.electrobun-view.json",
+    "typecheck:browser": "tsc --project tsconfig.browser.json",
+    "typecheck:cloudflare": "tsc --project tsconfig.cloudflare.json",
     "typecheck:scripts": "tsc --project tsconfig.scripts.json",
     "test": "bun test",
     "test:global-upgrade": "bun run scripts/smoke-global-upgrade.ts",
@@ -52,7 +58,8 @@
     "electrobun": "^1.18.1",
     "happy-dom": "^20.11.1",
     "png-to-ico": "^2.1.8",
-    "rcedit": "^4.0.1"
+    "rcedit": "^4.0.1",
+    "wrangler": "^4.0.0"
   },
   "peerDependencies": {
     "typescript": "^5.9.2"

package/src/api-client/auth.ts

@@ -18,6 +18,7 @@ type CloudApiRequest = <T>(path: string, options?: RequestInit) => Promise<T>;
 interface CloudAuthApiOptions {
   getCurrentUser(): AuthUser | null;
   getSessionToken(): string | null;
+  hasSessionCredential(): boolean;
   request: CloudApiRequest;
   requireCapturedSession(message: string): void;
   setCurrentUser(user: AuthUser | null): void;
@@ -29,7 +30,7 @@ export class CloudAuthApi {
   constructor(private readonly options: CloudAuthApiOptions) {}
 
   restoreCachedUser(user: PersistedAuthUser | null): void {
-    if (!this.options.getSessionToken() || !user?.id) {
+    if (!this.options.hasSessionCredential() || !user?.id) {
       this.options.setCurrentUser(null);
       return;
     }
@@ -56,15 +57,6 @@ export class CloudAuthApi {
     });
   }
 
-  async ensureVerifiedSession(): Promise<AuthUser | null> {
-    if (!this.options.getSessionToken()) return null;
-    if (!this.options.getCurrentUser()) {
-      await this.getSession();
-    }
-    const user = this.options.getCurrentUser();
-    return user?.emailVerified ? user : null;
-  }
-
   async signUp(email: string, username: string, name: string, password: string): Promise<AuthUser> {
     const result = await this.options.request<{ user: AuthUser }>("/auth/sign-up/email", {
       method: "POST",
@@ -134,6 +126,18 @@ export class CloudAuthApi {
     }
   }
 
+  /**
+   * Emails a password reset link. The reset itself completes on the gloom.sh
+   * site, so the app only ever sends the email. The server answers the same
+   * way whether or not the address exists.
+   */
+  async requestPasswordReset(email: string): Promise<void> {
+    await this.options.request("/auth/request-password-reset", {
+      method: "POST",
+      body: JSON.stringify({ email }),
+    });
+  }
+
   async sendVerification(): Promise<CloudVerificationResponse> {
     return this.options.request<CloudVerificationResponse>("/cloud/auth/send-verification", {
       method: "POST",

package/src/api-client/data.ts

@@ -2,8 +2,13 @@ import type { TickerFinancials } from "../types/financials";
 import type { InstrumentSearchResult } from "../types/instrument";
 import { normalizeTweetSearchResponse } from "./normalizers";
 import {
+  cloudCdsPath,
   cloudCongressHousePath,
   cloudExchangeRatePath,
+  cloudSec13FPath,
+  cloudSecFilingContentPath,
+  cloudSecFilingDocumentsPath,
+  cloudSecFilingsPath,
   cloudFredSeriesPath,
   cloudHistoryPath,
   cloudMarketSearchPath,
@@ -13,20 +18,26 @@ import {
   cloudStatementsPath,
   cloudTickerTweetsPath,
   cloudTweetSearchPath,
+  type CloudCdsParams,
   type CloudCongressHouseParams,
   type CloudFredSeriesParams,
   type CloudHistoryParams,
   type CloudNewsParams,
+  type CloudSecFilingParams,
+  type CloudSecFilingsParams,
   type CloudTickerTweetsParams,
   type CloudTweetSearchParams,
 } from "./paths";
 import type {
   CloudAnalystResearchPayload,
   CloudShortInterestPayload,
+  CloudCdsResponse,
   CloudCompanyProfile,
   CloudCongressHousePayload,
   CloudCorporateActionsPayload,
   CloudEconEventPayload,
+  CloudEquityDiagnosticMode,
+  CloudEquityDiagnosticResult,
   CloudFredSeriesPayload,
   CloudFundamentals,
   CloudHoldersPayload,
@@ -37,6 +48,9 @@ import type {
   CloudMarketScreenerPayload,
   CloudNewsListResponse,
   CloudNewsPayload,
+  CloudSecContentResponse,
+  CloudSecDocumentsResponse,
+  CloudSecFilingsResponse,
   CloudOptionsChainPayload,
   CloudPricePointPayload,
   CloudQuotePayload,
@@ -163,6 +177,26 @@ export class CloudDataApi {
     return this.request<CloudMarketResponse<{ rate: number }>>(cloudExchangeRatePath(fromCurrency));
   }
 
+  /**
+   * On-demand single-company evidence review. This is a cloud product endpoint,
+   * not a market-data capability, so it is called directly instead of routed
+   * through the asset-data provider.
+   */
+  async getCloudEquityDiagnostic(
+    symbol: string,
+    exchange?: string,
+    mode: CloudEquityDiagnosticMode = "cache-first",
+  ): Promise<CloudEquityDiagnosticResult> {
+    return this.request<CloudEquityDiagnosticResult>("/research/equity-diagnostic", {
+      method: "POST",
+      body: JSON.stringify({
+        symbol: symbol.trim().toUpperCase(),
+        ...(exchange ? { exchange } : {}),
+        mode,
+      }),
+    });
+  }
+
   async getCloudEconomicCalendar(): Promise<CloudEconEventPayload[]> {
     return this.request<CloudEconEventPayload[]>("/cloud/econ/calendar");
   }
@@ -178,10 +212,30 @@ export class CloudDataApi {
     return this.request<CloudYieldPointPayload[]>("/cloud/econ/yield-curve");
   }
 
+  async getCloudCds(params: CloudCdsParams = {}): Promise<CloudCdsResponse> {
+    return this.request<CloudCdsResponse>(cloudCdsPath(params));
+  }
+
   async getCloudCongressHouse(params: CloudCongressHouseParams = {}): Promise<CloudCongressHousePayload> {
     return this.request<CloudCongressHousePayload>(cloudCongressHousePath(params));
   }
 
+  async getCloudSecFilings(params: CloudSecFilingsParams): Promise<CloudSecFilingsResponse> {
+    return this.request<CloudSecFilingsResponse>(cloudSecFilingsPath(params));
+  }
+
+  async getCloudSecFilingDocuments(params: CloudSecFilingParams): Promise<CloudSecDocumentsResponse> {
+    return this.request<CloudSecDocumentsResponse>(cloudSecFilingDocumentsPath(params));
+  }
+
+  async getCloudSecFilingContent(params: CloudSecFilingParams): Promise<CloudSecContentResponse> {
+    return this.request<CloudSecContentResponse>(cloudSecFilingContentPath(params));
+  }
+
+  async getCloudSec13F(path: string, params: Record<string, string | number | undefined> = {}): Promise<unknown> {
+    return this.request<unknown>(cloudSec13FPath(path, params));
+  }
+
   async getCloudNews(params: CloudNewsParams = {}): Promise<CloudNewsListResponse> {
     return this.request<CloudNewsListResponse>(cloudNewsPath(params));
   }

package/src/api-client/index.test.ts

@@ -1,6 +1,9 @@
 import { afterEach, describe, expect, jest, test } from "bun:test";
 import type { AuthUser } from "./index";
 import { apiClient, setCloudApiFetchTransport } from "./index";
+import { publishableMarketplaceLayout } from "../layout-marketplace/payload";
+import { createDefaultConfig } from "../types/config";
+import type { PaneDef } from "../types/plugin";
 
 const originalFetch = globalThis.fetch;
 const originalWebSocket = globalThis.WebSocket;
@@ -104,10 +107,97 @@ afterEach(() => {
   setCloudApiFetchTransport(null);
   apiClient.setSessionToken(null);
   apiClient.setWebSocketToken(null);
+  apiClient.setCookieSessionMode(false);
   jest.useRealTimers();
 });
 
+describe("apiClient layout marketplace", () => {
+  test("lists and publishes validated layouts through authenticated transport", async () => {
+    const config = createDefaultConfig("/tmp/api-layout-marketplace-test");
+    const panes = new Map(config.layout.instances.map((instance) => [instance.paneId, {
+      id: instance.paneId,
+      name: instance.paneId,
+      component: () => null,
+      defaultPosition: "right" as const,
+    } satisfies PaneDef]));
+    const payload = publishableMarketplaceLayout(config.layout, {}, panes);
+    const entry = {
+      id: "0123456789abcdef0123456789abcdef",
+      name: "Research Desk",
+      ...payload,
+      author: { username: "analyst", displayName: "Analyst" },
+      publishedAt: "2026-08-26T00:00:00.000Z",
+    };
+    const calls: Array<{ url: string; method: string; body?: unknown }> = [];
+    apiClient.setSessionToken("marketplace-session");
+    setCloudApiFetchTransport(async (url, init) => {
+      calls.push({
+        url,
+        method: init?.method ?? "GET",
+        ...(typeof init?.body === "string" ? { body: JSON.parse(init.body) } : {}),
+      });
+      const path = new URL(url).pathname;
+      return createResponse(path === `/layouts/${entry.id}` || init?.method === "POST"
+        ? entry
+        : { items: [entry] });
+    });
+
+    await expect(apiClient.listMarketplaceLayouts()).resolves.toEqual([entry]);
+    await expect(apiClient.getMarketplaceLayout(entry.id)).resolves.toEqual(entry);
+    await expect(apiClient.publishMarketplaceLayout(entry.name, payload)).resolves.toEqual(entry);
+
+    expect(calls.map((call) => [new URL(call.url).pathname, call.method])).toEqual([
+      ["/layouts", "GET"],
+      [`/layouts/${entry.id}`, "GET"],
+      ["/layouts", "POST"],
+    ]);
+    expect(calls[2]?.body).toMatchObject({ name: "Research Desk", schemaVersion: 2, paneState: {} });
+  });
+});
+
 describe("apiClient auth cookies", () => {
+  test("accepts a browser-managed api.gloom.sh cookie without exposing its value", async () => {
+    apiClient.setCookieSessionMode(true);
+    setCloudApiFetchTransport(mockFetch(() => createResponse({ user: verifiedUser })));
+
+    await expect(apiClient.signIn("test@example.com", "password")).resolves.toEqual(verifiedUser);
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.isVerified()).toBe(true);
+  });
+
+  test("reports signed-in from the restored user when the cookie hides the raw token", async () => {
+    apiClient.setCookieSessionMode(true);
+    setCloudApiFetchTransport(mockFetch(() => createResponse({ user: verifiedUser })));
+
+    expect(apiClient.isSignedIn()).toBe(false);
+    await apiClient.signIn("test@example.com", "password");
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.isSignedIn()).toBe(true);
+  });
+
+  test("coalesces anonymous browser session checks and remembers the result", async () => {
+    apiClient.setCookieSessionMode(true);
+    let requests = 0;
+    let finishRequest!: () => void;
+    setCloudApiFetchTransport(async () => {
+      requests += 1;
+      await new Promise<void>((resolve) => { finishRequest = resolve; });
+      return createResponse({ user: null });
+    });
+
+    const checks = [
+      apiClient.ensureVerifiedSession(),
+      apiClient.ensureVerifiedSession(),
+      apiClient.ensureVerifiedSession(),
+    ];
+    expect(requests).toBe(1);
+    finishRequest();
+
+    await expect(Promise.all(checks)).resolves.toEqual([null, null, null]);
+    await expect(apiClient.ensureVerifiedSession()).resolves.toBeNull();
+    expect(requests).toBe(1);
+  });
+
   test("captures secure session cookies after login and reuses them on session refresh", async () => {
     const seenCookies: Array<string | null> = [];
 
@@ -1039,3 +1129,37 @@ describe("apiClient cloud news", () => {
     expect(story.id).toBe("story-1");
   });
 });
+
+describe("apiClient equity diagnostic", () => {
+  test("posts the symbol, exchange, and cache mode to the research route", async () => {
+    let seenUrl = "";
+    let seenInit: RequestInit | undefined;
+    globalThis.fetch = mockFetch(async (input: Request | string | URL, init?: RequestInit) => {
+      seenUrl = String(input);
+      seenInit = init;
+      return createResponse({ symbol: "AAPL", status: "complete" });
+    });
+
+    await apiClient.getCloudEquityDiagnostic(" aapl ", "NASDAQ", "refresh");
+
+    expect(new URL(seenUrl).pathname).toBe("/research/equity-diagnostic");
+    expect(seenInit?.method).toBe("POST");
+    expect(JSON.parse(String(seenInit?.body))).toEqual({
+      symbol: "AAPL",
+      exchange: "NASDAQ",
+      mode: "refresh",
+    });
+  });
+
+  test("omits an unknown exchange and defaults to the cached answer", async () => {
+    let seenInit: RequestInit | undefined;
+    globalThis.fetch = mockFetch(async (_input: Request | string | URL, init?: RequestInit) => {
+      seenInit = init;
+      return createResponse({ symbol: "AAPL", status: "complete" });
+    });
+
+    await apiClient.getCloudEquityDiagnostic("AAPL");
+
+    expect(JSON.parse(String(seenInit?.body))).toEqual({ symbol: "AAPL", mode: "cache-first" });
+  });
+});