instar 0.28.64 → 0.28.66

package/dashboard/index.html

@@ -2410,6 +2410,7 @@
           <button class="tab active" data-tab="sessions" onclick="switchTab('sessions')">Sessions <span class="tab-count" id="tabSessionCount">0</span></button>
           <button class="tab" data-tab="files" onclick="switchTab('files')">Files</button>
           <button class="tab" data-tab="dropzone" onclick="switchTab('dropzone')">Send Content</button>
+          <button class="tab" data-tab="secrets" onclick="switchTab('secrets')">Secrets <span class="tab-count" id="tabSecretCount">0</span></button>
           <button class="tab" data-tab="jobs" onclick="switchTab('jobs')">Jobs <span class="tab-count" id="tabJobCount">0</span></button>
           <button class="tab" data-tab="features" onclick="switchTab('features')">Features</button>
           <button class="tab" data-tab="systems" onclick="switchTab('systems')">Health</button>
@@ -2810,6 +2811,24 @@
     </div>
 
     <!-- Commitments Tab (Open Promises) -->
+    <div id="secretsPanel" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
+        <h2 style="margin:0">Secrets</h2>
+        <div style="display:flex;gap:8px">
+          <button onclick="createTestSecretRequest()" style="padding:6px 12px" title="Create a short-lived test Secret Drop request">Create test request</button>
+          <button onclick="loadSecrets()" style="padding:6px 12px">Refresh</button>
+        </div>
+      </div>
+      <div style="font-size:12px;color:var(--text-dim);line-height:1.4">
+        Secret Drop — one-time-use links for users to submit credentials safely (never through chat).
+        Links expire automatically and are destroyed after submission.
+      </div>
+      <div id="secretsEmpty" style="padding:40px;text-align:center;color:var(--text-dim);display:none">
+        No pending secret requests.
+      </div>
+      <div id="secretsList" style="display:flex;flex-direction:column;gap:12px"></div>
+    </div>
+
     <div id="commitmentsPanel" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:center">
         <h2 style="margin:0">Commitments</h2>
@@ -3873,6 +3892,18 @@
         display: ['flex'],
         onActivate: () => { if (typeof loadCommitments === 'function') loadCommitments(); },
       },
+      {
+        id: 'secrets',
+        panels: ['secretsPanel'],
+        display: ['flex'],
+        onActivate: () => {
+          if (typeof loadSecrets === 'function') loadSecrets();
+          if (typeof startSecretsTicker === 'function') startSecretsTicker();
+        },
+        onDeactivate: () => {
+          if (typeof stopSecretsTicker === 'function') stopSecretsTicker();
+        },
+      },
     ];
 
     function switchTab(tabName) {
@@ -6048,6 +6079,200 @@
       }
     }
 
+    // ── Secrets Tab ──────────────────────────────────────────────
+    let secretsTickerTimer = null;
+    let secretsLastPending = [];
+
+    function formatCountdown(ms) {
+      if (ms <= 0) return 'expired';
+      const totalSec = Math.floor(ms / 1000);
+      const m = Math.floor(totalSec / 60);
+      const s = totalSec % 60;
+      if (m > 0) return `${m}m ${s}s`;
+      return `${s}s`;
+    }
+
+    function renderSecretsCountdowns() {
+      const now = Date.now();
+      for (const p of secretsLastPending) {
+        const el = document.getElementById(`secretCountdown-${p.token}`);
+        if (!el) continue;
+        const remaining = p.expiresAt - now;
+        el.textContent = formatCountdown(remaining);
+        if (remaining <= 0) {
+          el.style.color = '#c66';
+        }
+      }
+    }
+
+    function startSecretsTicker() {
+      stopSecretsTicker();
+      secretsTickerTimer = setInterval(renderSecretsCountdowns, 1000);
+    }
+
+    function stopSecretsTicker() {
+      if (secretsTickerTimer) {
+        clearInterval(secretsTickerTimer);
+        secretsTickerTimer = null;
+      }
+    }
+
+    async function loadSecrets() {
+      const list = document.getElementById('secretsList');
+      const empty = document.getElementById('secretsEmpty');
+      const countBadge = document.getElementById('tabSecretCount');
+      while (list.firstChild) list.removeChild(list.firstChild);
+      empty.style.display = 'none';
+
+      let res = null;
+      try {
+        res = await apiFetch('/secrets/pending');
+      } catch { /* fall through */ }
+
+      const pending = (res && Array.isArray(res.pending)) ? res.pending : [];
+      secretsLastPending = pending;
+
+      // Badge shows non-expired count.
+      const now = Date.now();
+      const liveCount = pending.filter(p => p.expiresAt > now).length;
+      if (countBadge) countBadge.textContent = String(liveCount);
+
+      if (pending.length === 0) {
+        empty.style.display = 'block';
+        empty.textContent = 'No pending secret requests.';
+        return;
+      }
+
+      const fmtTs = (ms) => {
+        if (!ms) return '—';
+        try { return new Date(ms).toLocaleString(); } catch { return String(ms); }
+      };
+
+      for (const p of pending) {
+        const card = document.createElement('div');
+        card.style.cssText = 'padding:14px;border:1px solid var(--border);border-radius:6px;background:var(--bg-dim);display:flex;flex-direction:column;gap:8px';
+
+        const header = document.createElement('div');
+        header.style.cssText = 'display:flex;justify-content:space-between;gap:12px;align-items:flex-start';
+        const label = document.createElement('div');
+        label.style.cssText = 'flex:1;font-weight:600;line-height:1.3';
+        label.textContent = p.label || '(no label)';
+        header.appendChild(label);
+
+        const badge = document.createElement('span');
+        const expired = !!p.expired;
+        badge.textContent = expired ? 'expired' : 'pending';
+        badge.style.cssText = `font-size:11px;padding:3px 8px;border-radius:4px;background:${expired ? '#c66' : '#4a9a4a'};color:#fff;white-space:nowrap`;
+        header.appendChild(badge);
+        card.appendChild(header);
+
+        const meta = document.createElement('div');
+        meta.style.cssText = 'display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:6px;font-size:12px;color:var(--text-dim)';
+
+        const rows = [
+          ['token', (p.token || '').slice(0, 12) + '…'],
+          ['topic', p.topicId != null ? String(p.topicId) : '—'],
+          ['created', fmtTs(p.createdAt)],
+          ['expires', fmtTs(p.expiresAt)],
+        ];
+        for (const [k, v] of rows) {
+          const cell = document.createElement('div');
+          const kEl = document.createElement('span');
+          kEl.textContent = `${k}: `;
+          kEl.style.opacity = '0.7';
+          const vEl = document.createElement('span');
+          vEl.textContent = v;
+          vEl.style.color = 'var(--text)';
+          cell.appendChild(kEl);
+          cell.appendChild(vEl);
+          meta.appendChild(cell);
+        }
+
+        const countdownCell = document.createElement('div');
+        const cLabel = document.createElement('span');
+        cLabel.textContent = 'expires in: ';
+        cLabel.style.opacity = '0.7';
+        const cVal = document.createElement('span');
+        cVal.id = `secretCountdown-${p.token}`;
+        cVal.style.color = 'var(--text)';
+        cVal.style.fontVariantNumeric = 'tabular-nums';
+        cVal.textContent = formatCountdown(p.expiresAt - now);
+        countdownCell.appendChild(cLabel);
+        countdownCell.appendChild(cVal);
+        meta.appendChild(countdownCell);
+
+        card.appendChild(meta);
+
+        // Links and actions.
+        const actions = document.createElement('div');
+        actions.style.cssText = 'display:flex;gap:8px;align-items:center;flex-wrap:wrap';
+
+        const url = p.tunnelUrl || p.localUrl;
+        if (url) {
+          const openBtn = document.createElement('a');
+          openBtn.textContent = 'Open drop link';
+          openBtn.href = url;
+          openBtn.target = '_blank';
+          openBtn.rel = 'noopener noreferrer';
+          openBtn.style.cssText = 'padding:6px 10px;border:1px solid var(--border);border-radius:4px;text-decoration:none;color:var(--text);cursor:pointer';
+          actions.appendChild(openBtn);
+
+          const copyBtn = document.createElement('button');
+          copyBtn.textContent = 'Copy link';
+          copyBtn.style.cssText = 'padding:6px 10px;cursor:pointer';
+          copyBtn.addEventListener('click', async () => {
+            try {
+              await navigator.clipboard.writeText(url);
+              copyBtn.textContent = 'Copied';
+              setTimeout(() => { copyBtn.textContent = 'Copy link'; }, 1200);
+            } catch {
+              copyBtn.textContent = 'Copy failed';
+            }
+          });
+          actions.appendChild(copyBtn);
+        }
+
+        const cancelBtn = document.createElement('button');
+        cancelBtn.textContent = 'Cancel';
+        cancelBtn.style.cssText = 'padding:6px 10px;cursor:pointer';
+        cancelBtn.addEventListener('click', async () => {
+          cancelBtn.disabled = true;
+          try {
+            await apiFetch(`/secrets/pending/${encodeURIComponent(p.token)}`, { method: 'DELETE' });
+            await loadSecrets();
+          } catch (err) {
+            cancelBtn.disabled = false;
+            alert('Cancel failed: ' + (err && err.message ? err.message : String(err)));
+          }
+        });
+        actions.appendChild(cancelBtn);
+
+        card.appendChild(actions);
+        list.appendChild(card);
+      }
+    }
+
+    async function createTestSecretRequest() {
+      try {
+        const res = await apiFetch('/secrets/request', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            label: 'Dashboard test request',
+            description: 'Created from the Secrets tab for verification. Safe to cancel.',
+            ttlMs: 5 * 60 * 1000,
+          }),
+        });
+        await loadSecrets();
+        const url = (res && (res.tunnelUrl || res.localUrl)) || '';
+        if (url) {
+          try { await navigator.clipboard.writeText(url); } catch { /* ignore */ }
+        }
+      } catch (err) {
+        alert('Test request failed: ' + (err && err.message ? err.message : String(err)));
+      }
+    }
+
     // ── Integrated-Being Tab (v1) ────────────────────────────────
     let integratedBeingPollTimer = null;
 

package/dist/commands/init.js

@@ -3549,14 +3549,12 @@ done
     // Real safety is in PreToolUse hooks (dangerous-command-guard, external-communication-guard).
     fs.writeFileSync(path.join(hooksDir, 'auto-approve-permissions.js'), getAutoApprovePermissionsScript(), { mode: 0o755 });
     // Build stop hook — structural enforcement for /build pipeline.
-    // Installed from template; only needs to exist when /build is active (registered dynamically).
-    const buildModDir = path.dirname(new URL(import.meta.url).pathname);
-    const buildStopHookSrc = path.join(buildModDir, '..', '..', 'src', 'templates', 'hooks', 'build-stop-hook.sh');
-    const buildStopHookDst = path.join(hooksDir, 'build-stop-hook.sh');
-    if (fs.existsSync(buildStopHookSrc) && !fs.existsSync(buildStopHookDst)) {
-        fs.copyFileSync(buildStopHookSrc, buildStopHookDst);
-        fs.chmodSync(buildStopHookDst, 0o755);
-    }
+    // Shares the PostUpdateMigrator content so init and upgrade produce the same
+    // file. Previously read from src/templates/hooks/build-stop-hook.sh, which
+    // meant agents initialized before this block was added never received the
+    // hook, yet settings.json references it — silent "No such file" on every
+    // Stop event until they ran an upgrade.
+    fs.writeFileSync(path.join(hooksDir, 'build-stop-hook.sh'), migrator.getHookContent('build-stop-hook'), { mode: 0o755 });
 }
 function getHookEventReporterScript() {
     return `#!/usr/bin/env node