heyquilt 0.3.90 → 0.3.106

package/src/vault/main.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// quilt-vault's entry point: everything from its own environment (fly.vault.toml).
+//   QUILT_API_URL        quilt-api, whose internal /v1/vault/* routes hold the sealed blobs
+//   QUILT_VAULT_SECRET   the shared secret those routes check (the same value on quilt-api)
+//   VAULT_ROOT_KEY       32 random bytes, base64: seals the per-scope data keys
+//   VAULT_DIGEST_KEY     32 random bytes, base64: the key digests are made with
+//   VAULT_KEY_PROVIDER   env (default) or aws-kms, with VAULT_KMS_KEY_ID, AWS_REGION,
+//                        AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (AWS_SESSION_TOKEN)
+//   VAULT_ALLOWED_ORIGINS  sites that may save from a browser (default https://heyquilt.com)
+import { startVault } from './server.js'
+import { keyRing, keyFrom } from './crypto.js'
+import { providersFromEnv } from './kms.js'
+
+const env = process.env
+try {
+  const vault = await startVault({
+    port: Number(env.PORT || 8080),
+    host: env.HOST || '0.0.0.0',
+    apiUrl: env.QUILT_API_URL || 'https://api.heyquilt.com',
+    vaultSecret: env.QUILT_VAULT_SECRET || '',
+    keys: keyRing(await providersFromEnv(env)),
+    digestKey: keyFrom(env.VAULT_DIGEST_KEY, 'VAULT_DIGEST_KEY'),
+    allowedOrigins: String(env.VAULT_ALLOWED_ORIGINS || 'https://heyquilt.com').split(',').map((s) => s.trim()).filter(Boolean),
+    log: (m) => console.log(m)
+  })
+  console.log(`quilt vault listening on ${vault.url}`)
+  const stop = async () => { await vault.close(); process.exit(0) }
+  process.on('SIGINT', stop)
+  process.on('SIGTERM', stop)
+} catch (err) {
+  console.error(`quilt vault could not start: ${err.message}`)
+  process.exit(1)
+}

package/src/vault/server.js

@@ -0,0 +1,279 @@
+// quilt-vault (docs/superpowers/specs/2026-10-18-secrets.md): the only place a secret's value is
+// ever opened. Two jobs, nothing else:
+//
+// - POST /v1/write: a person's app or browser sends values here with a write ticket from
+//   quilt-api. The vault seals each under its scope's data key and stores the sealed blob
+//   through quilt-api's internal routes. It answers each name's digest, never a value.
+// - /g/<run token>/<NAME>/<path>: the gateway `quilt run` points a process at. quilt-api says
+//   whether the run may use NAME now; the vault opens the value, attaches it to the request in
+//   the secret's format, sends the request to the secret's one host, and streams the answer
+//   back with every copy of the value masked.
+//
+// No route answers a value. Values are never logged.
+import http from 'node:http'
+import https from 'node:https'
+import dns from 'node:dns'
+import net from 'node:net'
+import { Transform } from 'node:stream'
+import zlib from 'node:zlib'
+import { newDataKey, sealValue, openValue, digestOf } from './crypto.js'
+import { applyCredential, maskForms, shortDigest, cleanUpstream, MAX_VALUE_BYTES, STAND_IN } from '../ui/secret-rules.js'
+
+export const MASK = '[hidden by Quilt]'
+const MAX_WRITE_BODY = 2 * 1024 * 1024
+const UPSTREAM_TIMEOUT_MS = 120 * 1000
+// Headers that belong to one connection, never passed on (RFC 9110 §7.6.1), and ones the vault sets itself.
+const HOP = new Set(['connection', 'keep-alive', 'proxy-connection', 'proxy-authorization', 'proxy-authenticate', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'content-length', 'accept-encoding', 'forwarded', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip', 'via'])
+const NAME = /^[A-Z_][A-Z0-9_]{0,63}$/
+const TOKEN = /^qrun_[A-Za-z0-9_-]{20,100}$/
+
+/** Whether an address is inside a private, local or reserved network (the vault never sends there). */
+export function privateAddress (address) {
+  const a = String(address).toLowerCase()
+  if (net.isIPv4(a)) {
+    const [x, y] = a.split('.').map(Number)
+    return x === 0 || x === 10 || x === 127 || (x === 100 && y >= 64 && y <= 127) || (x === 169 && y === 254) || (x === 172 && y >= 16 && y <= 31) || (x === 192 && y === 168) || (x === 192 && y === 0) || (x === 198 && (y === 18 || y === 19)) || x >= 224
+  }
+  if (net.isIPv6(a)) {
+    if (a === '::' || a === '::1') return true
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(a)
+    if (mapped) return privateAddress(mapped[1])
+    return /^(fc|fd|fe8|fe9|fea|feb|ff)/.test(a) || a.startsWith('64:ff9b:') || a.startsWith('2001:db8')
+  }
+  return true
+}
+
+/** A DNS lookup that refuses names pointing inside a network, checked as the connection is made. */
+export function publicLookup (hostname, options, callback) {
+  dns.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err)
+    const list = Array.isArray(addresses) ? addresses : [{ address: addresses, family: options.family || 4 }]
+    if (!list.length || list.some((x) => privateAddress(x.address))) return callback(Object.assign(new Error(`${hostname} points inside a private network`), { code: 'EPRIVATE' }))
+    if (options.all) return callback(null, list)
+    callback(null, list[0].address, list[0].family)
+  })
+}
+
+/** Replaces every form of a value in a stream, including one split across chunks. */
+export function masker (forms, replacement = MASK) {
+  const needles = forms.map((f) => Buffer.from(f)).filter((b) => b.length).sort((a, b) => b.length - a.length)
+  const keep = needles.length ? Math.max(...needles.map((n) => n.length)) - 1 : 0
+  const out = Buffer.from(replacement)
+  let carry = Buffer.alloc(0)
+  const run = (data, end, push) => {
+    const boundary = end ? data.length : Math.max(0, data.length - keep)
+    let pos = 0
+    while (needles.length) {
+      let best = -1; let len = 0
+      for (const n of needles) { const i = data.indexOf(n, pos); if (i !== -1 && (best === -1 || i < best)) { best = i; len = n.length } }
+      if (best === -1 || best >= boundary) break
+      if (best > pos) push(data.subarray(pos, best))
+      push(out)
+      pos = best + len
+    }
+    const cut = Math.max(pos, boundary)
+    if (cut > pos) push(data.subarray(pos, cut))
+    return data.subarray(cut)
+  }
+  return new Transform({
+    transform (chunk, enc, cb) { carry = run(Buffer.concat([carry, chunk]), false, (b) => this.push(b)); cb() },
+    flush (cb) { run(carry, true, (b) => this.push(b)); carry = Buffer.alloc(0); cb() }
+  })
+}
+
+const maskText = (s, forms) => forms.reduce((acc, f) => acc.split(f).join(MASK), String(s))
+
+/**
+ * Starts the vault. `apiUrl` and `vaultSecret` reach quilt-api's internal routes; `keys` is a
+ * key ring (crypto.js keyRing); `digestKey` (32 bytes) makes digests. `allowedOrigins` may write
+ * from a browser (the website). `upstreamProtocol` and `allowLocalUpstreams` are for tests only.
+ */
+export function startVault ({ port = 0, host = '127.0.0.1', apiUrl, vaultSecret, keys, digestKey, fetch: fetchImpl = globalThis.fetch, now = Date.now, log = () => {}, allowedOrigins = [], upstreamProtocol = 'https', allowLocalUpstreams = false, runLimit = 1200 }) {
+  if (!apiUrl || !vaultSecret || !keys || !digestKey) throw new Error('the vault needs QUILT_API_URL, QUILT_VAULT_SECRET, a root key and VAULT_DIGEST_KEY')
+  const api = String(apiUrl).replace(/\/+$/, '')
+  const origins = new Set(allowedOrigins.map((o) => String(o).replace(/\/+$/, '')))
+  const client = upstreamProtocol === 'http' ? http : https
+
+  /** quilt-api's internal routes: { status, body }. */
+  async function internal (path, body) {
+    let res
+    try {
+      res = await fetchImpl(`${api}${path}`, { method: 'POST', headers: { 'content-type': 'application/json', 'x-quilt-vault-secret': vaultSecret }, body: JSON.stringify(body), signal: AbortSignal.timeout(15_000) })
+    } catch (err) { return { status: 502, body: { error: `Quilt did not answer (${err.message})` } } }
+    return { status: res.status, body: await res.json().catch(() => ({})) }
+  }
+
+  const hits = new Map()
+  const limited = (key) => {
+    const t = now()
+    const recent = (hits.get(key) || []).filter((x) => t - x < 60_000)
+    recent.push(t)
+    hits.set(key, recent)
+    if (hits.size > 50_000) hits.delete(hits.keys().next().value)
+    return recent.length > runLimit
+  }
+
+  const cors = (req) => {
+    const o = String(req.headers.origin || '')
+    return origins.has(o) ? { 'access-control-allow-origin': o, vary: 'origin' } : {}
+  }
+  const json = (req, res, status, data) => {
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', ...cors(req) })
+    res.end(JSON.stringify(data))
+  }
+
+  /** The scope's data key, opened: made (and stored) the first time the scope saves a secret. */
+  async function dataKeyFor (scope, given) {
+    let dk = given
+    if (!dk) {
+      const ctx = { scopeType: scope.type, scopeId: scope.id, version: 1 }
+      const fresh = newDataKey()
+      const sealedKey = await keys.wrap(fresh, ctx)
+      const r = await internal('/v1/vault/data-keys', { scopeType: scope.type, scopeId: scope.id, version: 1, sealedKey, provider: keys.primary })
+      if (r.status !== 200) throw Object.assign(new Error(r.body.error || 'could not store the data key'), { status: 502 })
+      dk = r.body.dataKey
+      // Another save made it first: theirs is the one stored, so it is the one used.
+      if (dk.sealedKey === sealedKey) return { version: 1, key: fresh }
+    }
+    return { version: dk.version, key: await keys.unwrap(dk.sealedKey, { scopeType: scope.type, scopeId: scope.id, version: dk.version }) }
+  }
+
+  async function write (req, res) {
+    let body
+    try { body = JSON.parse((await readBody(req, MAX_WRITE_BODY)).toString('utf8')) } catch (err) { return json(req, res, err.status || 400, { error: err.status ? err.message : 'bad json' }) }
+    const values = body && typeof body.values === 'object' && !Array.isArray(body.values) ? body.values : null
+    if (!values || !Object.keys(values).length) return json(req, res, 400, { error: 'send the values to save' })
+    for (const [name, v] of Object.entries(values)) {
+      if (typeof v !== 'string' || !v.length) return json(req, res, 400, { error: `${String(name).slice(0, 64)} has no value` })
+      if (Buffer.byteLength(v) > MAX_VALUE_BYTES) return json(req, res, 413, { error: `${String(name).slice(0, 64)} is longer than ${MAX_VALUE_BYTES / 1024} KB` })
+    }
+    const t = await internal('/v1/vault/tickets/redeem', { ticket: String(body.ticket || '') })
+    if (t.status !== 200) return json(req, res, t.status, { error: t.body.error || 'could not save' })
+    const wanted = new Set(t.body.entries.map((e) => e.name))
+    const names = Object.keys(values)
+    if (names.some((n) => !wanted.has(n)) || names.length !== wanted.size) return json(req, res, 400, { error: 'those are not the names this save was for' })
+    let dk
+    try { dk = await dataKeyFor(t.body.scope, t.body.dataKey) } catch (err) { log(`write: data key: ${err.message}`); return json(req, res, err.status || 500, { error: 'could not open this scope\'s key; try again' }) }
+    const scope = { scopeType: t.body.scope.type, scopeId: t.body.scope.id }
+    const items = names.map((name) => ({ name, sealedValue: sealValue(dk.key, scope, name, values[name]), keyVersion: dk.version, digest: digestOf(digestKey, values[name]) }))
+    const stored = await internal('/v1/vault/secrets', { ticketId: t.body.ticketId, items })
+    if (stored.status !== 200) return json(req, res, stored.status, { error: stored.body.error || 'could not save' })
+    log(`write: ${items.length} secret(s) saved in ${scope.scopeType} ${scope.scopeId}`)
+    return json(req, res, 200, { saved: items.map((i) => ({ name: i.name, digest: shortDigest(i.digest) })) })
+  }
+
+  async function gateway (req, res, token, name, rest) {
+    if (!TOKEN.test(token) || !NAME.test(name)) return json(req, res, 404, { error: 'not a Quilt gateway address' })
+    if (limited(token)) return json(req, res, 429, { error: 'too many requests for this run; slow down' })
+    const r = await internal('/v1/vault/resolve', { token, name })
+    if (r.status !== 200) {
+      req.resume()
+      return json(req, res, r.status, { error: r.body.error || 'not allowed' })
+    }
+    const { secret, dataKey } = r.body
+    let value
+    try {
+      const key = await keys.unwrap(dataKey.sealedKey, { scopeType: secret.scopeType, scopeId: secret.scopeId, version: dataKey.version })
+      value = openValue(key, { scopeType: secret.scopeType, scopeId: secret.scopeId }, secret.name, secret.sealedValue)
+    } catch (err) {
+      log(`gateway: could not open ${secret.name} (${err.message})`)
+      req.resume()
+      return json(req, res, 500, { error: 'the vault could not open this secret; replace it' })
+    }
+    let upstream
+    try { upstream = cleanUpstream(secret.upstream, { allowLocal: allowLocalUpstreams }) } catch { req.resume(); return json(req, res, 502, { error: 'this secret has no host the vault may reach' }) }
+    const cred = applyCredential(secret.format, value)
+    const forms = maskForms(secret.format, value)
+    const incoming = new URL(rest || '/', 'http://x')
+    let path = incoming.pathname
+    if (cred.path !== undefined) path = `/${cred.path.replace(/\/+$/, '')}${path === '/' ? '' : path}`
+    const query = new URLSearchParams(incoming.search)
+    if (cred.query) { query.delete(cred.query[0]); query.append(cred.query[0], cred.query[1]) }
+    const qs = query.toString()
+    const headers = {}
+    for (const [k, v] of Object.entries(req.headers)) {
+      const lower = k.toLowerCase()
+      if (HOP.has(lower) || lower.startsWith('fly-') || lower.startsWith('x-quilt-')) continue
+      // The process's stand-in credential (an SDK sends "Bearer quilt"): never passed on.
+      if (cred.header && lower === cred.header[0]) continue
+      if ((lower === 'authorization' || lower === 'x-api-key') && String(v).replace(/^(Bearer|Basic|Token)\s+/i, '') === STAND_IN) continue
+      headers[lower] = v
+    }
+    if (cred.header) headers[cred.header[0]] = cred.header[1]
+    headers['accept-encoding'] = 'identity' // the mask has to see the answer as text
+    const [hostname, port] = upstream.split(':')
+    const out = client.request({
+      protocol: `${upstreamProtocol}:`,
+      hostname,
+      port: port ? Number(port) : undefined,
+      method: req.method,
+      path: `${path}${qs ? `?${qs}` : ''}`,
+      headers: { ...headers, host: upstream },
+      servername: hostname,
+      lookup: allowLocalUpstreams ? undefined : publicLookup,
+      timeout: UPSTREAM_TIMEOUT_MS
+    })
+    let answered = false
+    out.on('timeout', () => out.destroy(Object.assign(new Error('the service took too long to answer'), { code: 'ETIMEDOUT' })))
+    out.on('error', (err) => {
+      if (answered) return res.destroy()
+      answered = true
+      log(`gateway: ${secret.name} to ${upstream}: ${err.code || err.message}`)
+      json(req, res, 502, { error: err.code === 'EPRIVATE' ? `${upstream} points inside a private network; the vault won't send secrets there` : `${upstream} did not answer (${err.code || 'error'})` })
+    })
+    out.on('response', (up) => {
+      answered = true
+      const h = {}
+      for (const [k, v] of Object.entries(up.headers)) {
+        if (HOP.has(k) || k === 'content-encoding') continue
+        h[k] = Array.isArray(v) ? v.map((x) => maskText(x, forms)) : maskText(v, forms)
+      }
+      res.writeHead(up.statusCode, up.statusMessage, h)
+      // A service that compresses anyway (it was asked not to): opened here, so the mask sees the text.
+      const enc = String(up.headers['content-encoding'] || '').trim().toLowerCase()
+      const open = enc === 'gzip' || enc === 'x-gzip' ? zlib.createGunzip() : enc === 'deflate' ? zlib.createInflate() : enc === 'br' ? zlib.createBrotliDecompress() : null
+      const body = open ? up.pipe(open) : up
+      if (open) open.on('error', () => res.destroy())
+      body.pipe(masker(forms)).pipe(res)
+      up.on('error', () => res.destroy())
+    })
+    req.pipe(out)
+    req.on('error', () => out.destroy())
+  }
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url, 'http://x')
+      if (req.method === 'GET' && url.pathname === '/healthz') return json(req, res, 200, { ok: true })
+      if (url.pathname === '/v1/write') {
+        if (req.method === 'OPTIONS') {
+          res.writeHead(204, { ...cors(req), 'access-control-allow-methods': 'POST', 'access-control-allow-headers': 'content-type', 'access-control-max-age': '600' })
+          return res.end()
+        }
+        if (req.method === 'POST') return await write(req, res)
+      }
+      // /g/<token>/<NAME>[/<path>]: the raw path, so the service gets it exactly as sent.
+      const m = /^\/g\/([^/?#]+)\/([^/?#]+)(\/[^?#]*)?(\?[^#]*)?$/.exec(req.url)
+      if (m) return await gateway(req, res, m[1], m[2], `${m[3] || '/'}${m[4] || ''}`)
+      json(req, res, 404, { error: 'not found' })
+    } catch (err) {
+      log(`vault error: ${err.message}`)
+      if (!res.headersSent) json(req, res, 500, { error: 'internal error' })
+      else res.destroy()
+    }
+  })
+
+  return new Promise((resolve) => server.listen(port, host, () => {
+    const p = server.address().port
+    resolve({ port: p, url: `http://${host}:${p}`, close: () => new Promise((r) => { server.closeAllConnections?.(); server.close(r) }) })
+  }))
+}
+
+function readBody (req, max) {
+  return new Promise((resolve, reject) => {
+    let size = 0; const chunks = []
+    req.on('data', (c) => { size += c.length; if (size > max) { req.destroy(); reject(Object.assign(new Error('too large'), { status: 413 })) } else chunks.push(c) })
+    req.on('end', () => resolve(Buffer.concat(chunks)))
+    req.on('error', reject)
+  })
+}

package/src/vault/sigv4.js

@@ -0,0 +1,38 @@
+// AWS Signature Version 4, for the vault's calls to AWS KMS (kms.js). Small and dependency
+// free: the vault keeps as little code as it can.
+import crypto from 'node:crypto'
+
+const sha256 = (data) => crypto.createHash('sha256').update(data).digest('hex')
+const hmac = (key, data) => crypto.createHmac('sha256', key).update(data).digest()
+// RFC 3986 encoding, as AWS wants it (encodeURIComponent leaves !'()* alone).
+const enc = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)
+
+/** 20150830T123600Z and 20150830 for a time. */
+export function amzDates (at) {
+  const iso = new Date(at).toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '')
+  return { amzDate: iso, dateStamp: iso.slice(0, 8) }
+}
+
+/**
+ * The headers that sign a request: { authorization, 'x-amz-date', 'x-amz-security-token'? }.
+ * `headers` are the ones to sign (host is taken from the URL when absent).
+ */
+export function signAws ({ method, url, headers = {}, body = '', region, service, credentials, now = Date.now }) {
+  const u = new URL(url)
+  const { amzDate, dateStamp } = amzDates(now())
+  const all = { host: u.host, ...Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), String(v)])), 'x-amz-date': amzDate }
+  if (credentials.sessionToken) all['x-amz-security-token'] = credentials.sessionToken
+  const names = Object.keys(all).sort()
+  const canonicalHeaders = names.map((n) => `${n}:${all[n].trim().replace(/\s+/g, ' ')}\n`).join('')
+  const signedHeaders = names.join(';')
+  const path = u.pathname.split('/').map((seg) => enc(decodeURIComponent(seg))).join('/') || '/'
+  const query = [...u.searchParams].map(([k, v]) => [enc(k), enc(v)]).sort(([a, x], [b, y]) => (a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0)).map(([k, v]) => `${k}=${v}`).join('&')
+  const canonical = [method.toUpperCase(), path, query, canonicalHeaders, signedHeaders, sha256(body)].join('\n')
+  const scope = `${dateStamp}/${region}/${service}/aws4_request`
+  const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256(canonical)].join('\n')
+  const key = hmac(hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service), 'aws4_request')
+  const signature = crypto.createHmac('sha256', key).update(toSign).digest('hex')
+  const out = { 'x-amz-date': amzDate, authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}` }
+  if (credentials.sessionToken) out['x-amz-security-token'] = credentials.sessionToken
+  return out
+}

package/src/ui/merges.js

@@ -1,158 +0,0 @@
-// Merges: the buttons for a file changed in two places (the file tree marks them) and
-// the side-by-side view of one.
-import { esc, I, api, toast, loadingNote } from './common.js'
-import { changedLines } from './fileview.js'
-
-const you = (name, me, fallback = 'someone') => !name ? fallback : name === me ? 'you' : esc(name)
-const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1)
-
-/** How the opener's side came about (merges.js VIAS). */
-export function done (m, deleted = false) {
-  if (m.via === 'pull') return deleted ? 'pulled commits that delete this' : 'pulled commits that change this'
-  if (m.via === 'hold') return deleted ? 'deleted this during a git command' : 'changed this during a git command'
-  return deleted ? 'deleted this offline' : 'changed this offline'
-}
-
-/** One plain sentence: who changed what, where; then who holds the file now. */
-function describe (m, me) {
-  const held = m.heldBy && m.heldBy !== me && m.kind !== 'claimed' ? ` ${cap(esc(m.heldBy))} has it claimed now.` : ''
-  return what(m, me) + held
-}
-
-function what (m, me) {
-  const who = cap(you(m.by, me))
-  const other = you(m.others[0], me)
-  const did = done(m)
-  if (m.kind === 'ai') return `${who} ${did} and ${other} changed it in the session. An AI combined the two: have a look.`
-  if (m.kind === 'claimed' && !m.heldBy) return `${who} ${did} while ${you(m.claimedBy, me)} had it claimed. The session's version is in the file.`
-  if (m.kind === 'claimed') return `${who} ${did}, but ${you(m.heldBy, me)} ${m.heldBy === me ? 'have' : 'has'} it claimed. The session's version is in the file.`
-  if (m.oursDeleted) return `${who} ${done(m, true)} and ${other} changed it in the session.`
-  if (m.theirsHash === null) return `${who} ${did}, but it was deleted in the session.`
-  return `${who} ${did} and ${other} changed it in the session${m.reason ? ` (${esc(m.reason)})` : ''}.`
-}
-
-const mineLabel = (m, me) => m.oursDeleted ? 'Delete it' : m.by === me ? 'Keep mine' : `Keep ${esc(m.by)}'s`
-const theirsLabel = (m, me) => m.theirsHash === null ? 'Keep it deleted' : !m.others[0] ? "Keep the session's" : m.others[0] === me ? 'Keep mine' : `Keep ${esc(m.others[0])}'s`
-
-/**
- * The buttons for one record. `full` (the compare view) also offers both
- * versions on rows an AI combined. Viewers see the record but can't act.
- */
-export function mergeActionsHtml (m, me, editors, { full = false, viewer = false } = {}) {
-  const id = esc(m.id)
-  const b = (how, label, cls = 'ghost') => `<button class="btn sm ${cls}" data-merge="${id}" data-how="${how}">${label}</button>`
-  if (m.state === 'done') return `<span class="tag">Settled by ${you(m.resolvedBy, me)}</span>`
-  if (viewer) return '<span class="tag">View only</span>'
-  // Markers are in the file: only "done" and "keep mine" still make sense.
-  if (m.state === 'editing') return `<span class="hint">Markers are in the file</span>${b('mine', mineLabel(m, me))}${b('agent', 'Resolved', 'primary')}`
-  if (m.kind === 'ai') return (full ? b('mine', mineLabel(m, me)) : '') + b('review', 'Looks fine', 'primary')
-  // Settling writes the file, and so would an AI sent to merge it: ask whoever holds it, or keep theirs.
-  if (m.heldBy && m.heldBy !== me) {
-    const ask = m.asked
-      ? `<span class="tag">Asked ${esc(m.heldBy)} for it</span>`
-      : `<button class="btn sm" data-merge="${id}" data-ask="${esc(m.path)}" title="Join the file queue: ${esc(m.heldBy)} hands it to you when done">Ask ${esc(m.heldBy)} for it</button>`
-    return b('theirs', theirsLabel(m, me)) + ask
-  }
-  const hand = m.binary || m.oursDeleted || m.theirsHash === null ? '' : b('hand', 'Edit by hand')
-  const [first, ...rest] = editors
-  const send = first
-    ? `<span class="merge-send"><button class="btn sm" data-merge="${id}" data-send="${esc(first.id)}" ${first.auto ? 'title="Your AI merges it on its own, on this computer, and says how it went in chat"' : ''}>${first.auto ? 'Have your AI merge it' : `Send to ${esc(first.name)}`}</button>${rest.length
-      ? `<select class="input" data-merge-apps="${id}" aria-label="Send to another app"><option value="">Other app…</option>${rest.map((e) => `<option value="${esc(e.id)}">${e.auto ? 'Your AI, on its own' : esc(e.name)}</option>`).join('')}</select>`
-      : ''}</span>`
-    : ''
-  return b('mine', mineLabel(m, me)) + b('theirs', theirsLabel(m, me)) + hand + send
-}
-
-function sentToast (r, name) {
-  if (r.app === 'auto') { toast(`Your AI is on it in ${r.tool || 'your AI tool'}. It says how it went in chat.`); return }
-  toast(r.filled ? `Opened ${name} with the merge prompt filled in: send it.` : r.copied ? `Opened ${name}. The merge prompt is on your clipboard: paste it in.` : `Opened ${name}.`)
-}
-
-const settledToast = { hand: 'Markers are in the file. Remove them and save to finish.', mine: 'Done', theirs: 'Done', review: 'Thanks for checking', agent: 'Done' }
-
-/**
- * Wires the merge buttons inside `el` (the bar, or the compare view). Call once
- * per mount: the listeners are delegated, so redraws need no rebinding.
- * `onCompare(id)` opens the compare view; `editors()` names the apps.
- */
-export function bindMerges (el, { sessionId, onCompare, editors }) {
-  const nameOf = (app) => (editors().find((e) => e.id === app) || {}).name || 'the app'
-  const send = async (id, app) => sentToast(await api('POST', `/api/sessions/${sessionId()}/merges/send`, { id, app }), nameOf(app))
-  el.addEventListener('click', async (e) => {
-    const cmp = e.target.closest('[data-compare]')
-    if (cmp) { onCompare(cmp.dataset.compare); return }
-    const btn = e.target.closest('button[data-merge]')
-    if (!btn) return
-    btn.disabled = true
-    try {
-      if (btn.dataset.send) await send(btn.dataset.merge, btn.dataset.send)
-      else if (btn.dataset.ask) {
-        const file = btn.dataset.ask
-        await api('POST', `/api/sessions/${sessionId()}/request-file`, { path: file, title: `Settle the merge of ${file}`, description: 'I changed this file outside the session while you had it. When you hand it over, I will merge my changes with yours.' })
-        toast(`Asked for ${file}. It comes to you, with their notes, when they hand it over.`)
-      }
-      else {
-        await api('POST', `/api/sessions/${sessionId()}/merges/resolve`, { id: btn.dataset.merge, how: btn.dataset.how })
-        toast(settledToast[btn.dataset.how] || 'Done')
-      }
-    } catch (err) { toast(err.message) }
-    btn.disabled = false // a settled row goes away on the next status
-  })
-  el.addEventListener('change', async (e) => {
-    const sel = e.target.closest('[data-merge-apps]')
-    if (!sel || !sel.value) return
-    const app = sel.value
-    sel.value = ''
-    sel.blur() // lets the bar redraw again
-    try { await send(sel.dataset.mergeApps, app) } catch (err) { toast(err.message) }
-  })
-}
-
-/** One side: its lines, with the ones that differ from the base highlighted. */
-function column (title, text, base, note) {
-  let body
-  if (text == null) body = `<div class="fv-note">${note}</div>`
-  else {
-    const lines = text.split('\n')
-    if (lines.length > 1 && lines[lines.length - 1] === '') lines.pop()
-    const changed = changedLines(base == null ? [] : base.split('\n'), lines)
-    body = `<table class="fv-code"><tbody>${lines.map((l, i) =>
-      `<tr${changed.has(i) ? ' class="mchg"' : ''}><td class="ln">${i + 1}</td><td class="lt">${esc(l) || ' '}</td></tr>`).join('')}</tbody></table>`
-  }
-  return `<div class="merge-col"><div class="merge-col-head">${title}</div><div class="fv-scroll">${body}</div></div>`
-}
-
-/** A short fingerprint of a text (FNV-1a and length), so a redraw check needn't keep or compare whole files. */
-function textSig (t) {
-  if (t == null) return t === undefined ? 'u' : 'n'
-  let h = 0x811c9dc5
-  for (let i = 0; i < t.length; i++) h = Math.imul(h ^ t.charCodeAt(i), 0x01000193)
-  return `${t.length}:${(h >>> 0).toString(36)}`
-}
-
-/**
- * The compare view. `m`: the record without its texts, as status has it.
- * `texts`: { ours, base } from the full record, `undefined` while it loads.
- * `theirs`: the session's text now, `null` when it isn't there, `undefined` while it loads.
- */
-export function renderMergeView (el, { merge: m, texts, theirs, me, editors, viewer = false }) {
-  const showing = el.querySelector(':scope > .merge-view')
-  // Don't redraw under someone picking an app.
-  if (showing && el.contains(document.activeElement) && document.activeElement.tagName === 'SELECT') return
-  const sig = JSON.stringify([m, textSig(texts?.ours), textSig(texts?.base), texts === undefined, textSig(theirs), me, editors.map((e) => e.id), viewer])
-  if (showing && el._mergeSig === sig) return
-  el._mergeSig = sig
-  if (!m) { el.innerHTML = '<div class="main-empty merge-view"><p class="hint">That merge is settled or gone.</p></div>'; return }
-  const ours = texts ? texts.ours : null
-  const base = texts ? texts.base : null
-  const mine = m.by === me ? 'Yours, from offline' : `${esc(m.by)}'s, from offline`
-  const sess = m.kind === 'ai' ? 'In the session now, combined by AI' : `In the session${m.others[0] ? `, from ${you(m.others[0], me)}` : ''}`
-  const oursNote = m.oursDeleted ? 'Deleted offline' : texts === undefined ? loadingNote() : m.local ? `Too big to show here. It's in the merge folder on ${m.by === me ? 'this computer' : `${esc(m.by)}'s computer`}.` : 'Not available'
-  const theirsNote = theirs === undefined ? loadingNote() : m.theirsHash === null ? 'Deleted in the session' : 'Not in the session any more'
-  el.innerHTML = `<div class="fv merge-view">
-    <div class="fv-banner"><span class="fv-path mono">${esc(m.path)}</span><span class="fv-edited">${describe(m, me)}</span><span class="spacer"></span>${mergeActionsHtml(m, me, editors, { full: true, viewer })}</div>
-    ${m.binary
-      ? `<div class="fv-note">${I.file} Binary file: pick a version above.</div>`
-      : `<div class="merge-cols">${column(mine, ours, base, oursNote)}${column(sess, theirs, base, theirsNote)}</div>`}
-  </div>`
-}