instar 1.3.1350 → 1.3.1352

package/dashboard/index.html

@@ -1055,6 +1055,14 @@
     .pair-word { display: flex; align-items: center; gap: 4px; font-size: 12px; color: var(--text-dim); }
     .pair-word input { flex: 1; min-width: 0; padding: 6px; font-family: ui-monospace, monospace; font-size: 15px; }
     .pair-meta { font-size: 11px; color: var(--text-dim); margin-top: 8px; }
+    .pair-waiting { border-color: #1f6feb; }
+    #pairNotice:empty { display: none; }
+    .pair-pin { width: 160px; padding: 8px; font-size: 16px; }
+    .pair-nav-badge { margin-left: 8px; padding: 1px 8px; border-radius: 10px; background: #1f6feb; color: #fff; font-size: 12px; font-weight: 600; }
+    /* On a phone the header has no room left: the badge floats on the menu button's corner and takes no width. */
+    @media (max-width: 640px) { .pair-nav-badge-word { display: none; } #navToggle { position: relative; } .pair-nav-badge { position: absolute; top: -7px; right: -7px; margin: 0; padding: 1px 6px; } }
+    .pair-alarm { border-color: #f85149; background: rgba(248, 81, 73, 0.08); }
+    .pair-invite-text { width: 100%; box-sizing: border-box; font-family: ui-monospace, monospace; font-size: 13px; padding: 8px; }
     @media (max-width: 640px) {
       .pair-own-words { columns: 2; }
       .pair-words { grid-template-columns: repeat(2, minmax(0, 1fr)); }
@@ -3023,6 +3031,10 @@
   </div>
 
   <!-- Main app -->
+  <div id="dashVersionBar" style="display:none;position:fixed;top:0;left:0;right:0;z-index:10000;gap:10px;align-items:center;justify-content:center;padding:8px 12px;background:#1f6feb;color:#fff;font-size:14px">
+    The agent was updated to <span data-new-version></span>. Reload to get the new dashboard.
+    <button onclick="location.reload()" style="padding:4px 12px">Reload</button>
+  </div>
   <div class="app" id="app" style="display:none">
     <header class="header">
       <div class="header-left">
@@ -4173,6 +4185,30 @@
         Threadline is your agent's secure channel to other AI agents. The Telegram bridge mirrors those conversations into per-thread Telegram topics so you can watch every exchange. Quiet by default — flip the master switch below to opt in.
       </div>
 
+      <!-- Pair with another agent — by invite (docs/specs/a2a-pairing-invite-link.md §8). First on the
+           tab: decisions waiting for the operator sit at the top of this card. -->
+      <div id="pairCard" class="mnd-card" style="border:1px solid var(--border);border-radius:8px;padding:16px">
+        <strong>Pair with another agent</strong>
+        <div class="mnd-hint">Pairing proves another agent is really who it says it is, before it can be sent anything secret.</div>
+        <div id="pairNotice" class="mnd-notice"></div>
+        <div id="pairPinRow" class="pair-row" style="display:none"><label for="pairPin" class="pair-step-title" style="margin:0">Your PIN, to approve (asked once):</label><input type="password" id="pairPin" class="mnd-pin pair-pin" inputmode="numeric" autocomplete="off" /></div>
+        <div id="pairPending"></div>
+        <div class="pair-step">
+          <div class="pair-step-title">Invite an agent</div>
+          <div class="pair-row"><label for="pairFor" class="mnd-dim">Who is it for?</label><select id="pairFor"><option value="">Someone new</option></select></div>
+          <div class="pair-row"><select id="pairTtl"><option value="60">Valid for 1 hour</option><option value="1440">Valid for 24 hours</option></select>
+          <button class="mnd-btn mnd-btn-primary" data-make-invite>Make an invite</button></div>
+          <div id="pairInviteOut"></div>
+          <div id="pairOpen"></div>
+        </div>
+        <div class="pair-step">
+          <div class="pair-step-title">Got an invite? Paste it here</div>
+          <textarea id="pairInviteIn" class="pair-invite-text" rows="3" placeholder="Paste the whole message you were sent" autocomplete="off" spellcheck="false"></textarea>
+          <div class="pair-row"><button class="mnd-btn mnd-btn-primary" data-inspect-invite>Check it</button></div>
+        </div>
+        <div id="pairList"></div>
+      </div>
+
       <!-- Bridge settings card -->
       <div id="tlBridgeCard" style="border:1px solid var(--border);border-radius:8px;padding:16px;display:flex;flex-direction:column;gap:14px">
         <div style="font-weight:600">Telegram bridge settings</div>
@@ -4202,7 +4238,7 @@
           </span>
         </label>
 
-        <div style="display:grid;grid-template-columns:1fr 1fr;gap:14px">
+        <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px">
           <div>
             <div style="font-weight:600;font-size:13px;margin-bottom:6px">Allow-list</div>
             <div style="font-size:11px;color:var(--text-dim);margin-bottom:6px">Always auto-create topics for these remote agents (overrides "auto-create off").</div>
@@ -4226,21 +4262,10 @@
         <div id="tlBridgeError" style="color:var(--err, #c44);font-size:12px;display:none"></div>
       </div>
 
-      <!-- Verified pairing — the 12-word check (docs/specs/secure-a2a-verified-pairing.md §3.6) -->
-      <div id="pairCard" class="mnd-card" style="border:1px solid var(--border);border-radius:8px;padding:16px">
-        <div style="display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap">
-          <strong>Verified pairing</strong>
-          <button onclick="startPairingPanel()" class="mnd-btn mnd-btn-quiet" style="padding:6px 12px">Refresh</button>
-        </div>
-        <div class="mnd-hint">Confirm another agent is really who it says it is: compare 12 words with its operator before it can be sent credentials.</div>
-        <div id="pairNotice" class="mnd-notice"></div>
-        <div id="pairList"></div>
-      </div>
-
       <!-- Conversation observability — threads list + message stream + search -->
       <div style="border:1px solid var(--border);border-radius:8px;padding:0;display:flex;flex-direction:column;min-height:480px">
         <!-- Toolbar -->
-        <div style="display:flex;gap:8px;align-items:center;padding:12px 16px;border-bottom:1px solid var(--border)">
+        <div style="display:flex;flex-wrap:wrap;gap:8px;align-items:center;padding:12px 16px;border-bottom:1px solid var(--border)">
           <div style="font-weight:600">Conversations</div>
           <div style="flex:1"></div>
           <input type="search" id="tlObsSearchInput" placeholder="search messages…" style="padding:6px 8px;font-size:12px;width:220px" oninput="tlObsSearchDebounced(this.value)" />
@@ -4430,6 +4455,7 @@
             startWaPolling();
             startVitalSigns();
             startPoolSessionsPolling();
+            if (typeof startPairingPanel === 'function') startPairingPanel();
             loadTopicProfileOptions();
           } else {
             showAuthError('Incorrect PIN');
@@ -4457,6 +4483,7 @@
             startWaPolling();
             startVitalSigns();
             startPoolSessionsPolling();
+            if (typeof startPairingPanel === 'function') startPairingPanel();
             loadTopicProfileOptions();
           }
         })
@@ -8008,6 +8035,18 @@
         const resp = await fetch('/health', { headers: { 'Authorization': 'Bearer ' + token } });
         if (!resp.ok) return;
         const h = await resp.json();
+        // a2a-pairing-invite-link §8.4: an updated server means this page may be stale. Offer a
+        // reload instead of silently showing an old dashboard.
+        if (h.version) {
+          if (!window.__dashServerVersion) window.__dashServerVersion = h.version;
+          else if (h.version !== window.__dashServerVersion) {
+            const bar = document.getElementById('dashVersionBar');
+            if (bar && bar.style.display === 'none') {
+              bar.querySelector('[data-new-version]').textContent = h.version;
+              bar.style.display = 'flex';
+            }
+          }
+        }
 
         // Server status
         const serverDot = document.getElementById('vitalServerDot');
@@ -10443,8 +10482,9 @@
       } catch { host.innerHTML = '<div style="opacity:.7">Throughput data is temporarily unavailable.</div>'; }
     }
 
-    // ── Verified pairing panel (Threadline tab; secure-a2a-verified-pairing §3.6) ──
-    // Lazy-loaded like Mandates. The PIN typed here is sent once per action, never stored.
+    // ── Pairing by invite (Threadline tab; a2a-pairing-invite-link §8) ──
+    // Started at login (not only on the tab) so the tab can show waiting decisions.
+    // The PIN is held in the module's memory after one accepted use; never stored.
     let __pairController = null;
     let __pairModule = null;
     async function startPairingPanel() {
@@ -10453,7 +10493,13 @@
         catch (e) { console.error('[pairing] module load failed', e); return; }
       }
       if (!__pairController) {
-        const els = { list: document.getElementById('pairList'), notice: document.getElementById('pairNotice') };
+        const $ = (id) => document.getElementById(id);
+        const els = {
+          root: $('pairCard'), notice: $('pairNotice'), pending: $('pairPending'), open: $('pairOpen'), list: $('pairList'),
+          pin: $('pairPin'), pinRow: $('pairPinRow'), ttl: $('pairTtl'), forPeer: $('pairFor'), inviteOut: $('pairInviteOut'), inviteIn: $('pairInviteIn'),
+          tabButton: document.querySelector('.tab[data-tab="threadline"]'),
+          navToggle: $('navToggle'),
+        };
         const fetchImpl = (url, opts = {}) => fetch(url, {
           ...opts,
           headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },

package/dashboard/pairing.js

@@ -1,86 +1,116 @@
 /**
- * pairing.js — the Verified Pairing panel on the dashboard's Threadline tab
- * (docs/specs/secure-a2a-verified-pairing.md §3.6, Mobile-Complete operator action).
+ * pairing.js — "Pair with another agent" on the dashboard's Threadline tab
+ * (docs/specs/a2a-pairing-invite-link.md §8; replaces the 12-word panel of
+ * secure-a2a-verified-pairing §3.6, which Justin rejected on 2026-10-13).
  *
- * The operator's surface for the 12-word check: list pairings; for a pending one,
- * enter the dashboard PIN to see THIS side's 12 words, then type the 12 words the
- * OTHER side shows and confirm (the server compares all 12 in order; any difference
- * is a denial). A denied pairing can be cleared with the PIN. The PIN is typed at
- * action time, sent once, and never stored (no localStorage, no module state).
+ * What the operator does: make an invite and send it however they like; or paste one
+ * they were sent and approve it; and, when someone accepts their invite, Finish (or say
+ * "Not them"). Nobody reads, compares or types words.
+ *
+ * The rules from Justin's test (spec §8):
+ *  1. Nothing the operator is looking at or typing into is re-rendered by a timer. Only the
+ *     list sections (waiting decisions, open invites, paired agents) refresh, and only when
+ *     their content actually changed; none of them holds an input.
+ *  2. The PIN is asked once per page: after one accepted use it is held in this module's
+ *     memory (never storage) until the page is reloaded. A refused PIN is forgotten.
+ *  3. Decisions waiting for the operator come first, with a count on the Threadline tab AND on
+ *     the header menu button (the tabs sit behind it, so a count only on the tab is invisible).
  *
  * Same shape as mandates.js: pure renderers + createController({ doc, els, fetchImpl }).
  */
 
-const REFRESH_MS = 30_000;
-const WORD_COUNT = 12;
+const POLL_MS = 10_000;
 
 function esc(s) {
   return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 }
 
 const STATE_LABEL = {
-  'pending-verification': 'Waiting for you to compare the words',
-  'mutual-verified': 'Verified',
-  'identity-verified': 'Verified on another of my machines',
-  'verification-failed': 'Words did not match — blocked',
+  'mutual-verified': 'Paired',
+  'identity-verified': 'Paired (on another of my machines)',
+  'invite-accepted': 'Waiting for the other side to finish',
+  'pending-verification': 'Started with the old word check. Pair by invite instead.',
+  'verification-failed': 'Blocked (the old word check did not match)',
+};
+
+const claimed = (agent, owner) =>
+  `the agent that calls itself <strong>${esc(agent || 'unknown')}</strong>${owner ? `, which says it belongs to <strong>${esc(owner)}</strong>` : ''}`;
+
+const cap = (h) => h.charAt(0).toUpperCase() + h.slice(1);
+
+const timeLeft = (exp, now = Date.now()) => {
+  const ms = Date.parse(exp) - now;
+  if (!(ms > 0)) return 'expired';
+  const min = Math.round(ms / 60_000);
+  return min >= 90 ? `${Math.round(min / 60)} h left` : `${Math.max(1, min)} min left`;
 };
 
-/** One pairing card. Primary action first; the fingerprint is support metadata. */
+/** Invites waiting for this operator's Finish: used, with an acceptor, undecided, not leaked. */
+export function finishPrompts(invites) {
+  return (invites || []).filter((i) => i.state === 'used' && i.acceptor && !i.decision && !i.secondAccept);
+}
+
+/** Leak alarms from the last 24 h. */
+export function alarms(invites, now = Date.now()) {
+  return (invites || []).filter((i) => i.secondAccept && now - Date.parse(i.secondAccept.at) < 24 * 60 * 60_000);
+}
+
+/** How many decisions wait for the operator (the tab badge). */
+export function pendingCount(data) {
+  return finishPrompts(data?.invites).length + (data?.pendingAccepts || []).length;
+}
+
+export function renderPending(data, now = Date.now()) {
+  const parts = [];
+  for (const a of alarms(data?.invites, now)) {
+    parts.push(`<div class="pair-card pair-alarm" data-alarm="${esc(a.iid)}">
+      <div><strong>Warning: your invite got out.</strong> Two agents used it, so I paused the first one: it cannot receive anything secret.
+      The second calls itself <strong>${esc(a.secondAccept.agent || 'unknown')}</strong>. Make a new invite and send it privately.</div></div>`);
+  }
+  for (const p of data?.pendingAccepts || []) {
+    parts.push(`<div class="pair-card pair-waiting" data-pending-accept="${esc(p.iid)}">
+      <div>Pair with ${claimed(p.claimedAgent, p.claimedOwner)}? Only approve if you know who sent you this invite.</div>
+      <div class="pair-meta">Check code (optional, to read to them): ${esc(p.checkCode)} · ${esc(timeLeft(p.exp, now))}</div>
+      <div class="pair-row"><button class="mnd-btn mnd-btn-primary" data-approve="${esc(p.iid)}">Approve</button>
+      <button class="mnd-btn mnd-btn-quiet" data-decline="${esc(p.iid)}">Decline</button></div></div>`);
+  }
+  for (const i of finishPrompts(data?.invites)) {
+    parts.push(`<div class="pair-card pair-waiting" data-finish-prompt="${esc(i.iid)}">
+      <div>${cap(claimed(i.acceptor.agent, i.acceptor.owner))} accepted your invite. Finish only if that is who you sent it to.</div>
+      <div class="pair-row"><button class="mnd-btn mnd-btn-primary" data-finish="${esc(i.iid)}">Finish</button>
+      <button class="mnd-btn mnd-btn-quiet mnd-btn-danger" data-not-them="${esc(i.iid)}">Not them</button></div></div>`);
+  }
+  return parts.join('');
+}
+
+export function renderOpenInvites(invites, now = Date.now()) {
+  const open = (invites || []).filter((i) => i.state === 'open' && Date.parse(i.exp) > now);
+  if (open.length === 0) return '';
+  return '<div class="pair-step-title">Invites not used yet</div>' + open.map((i) => `<div class="pair-row" data-open-invite="${esc(i.iid)}">
+    <span>Invite ${esc(i.iid.slice(0, 6))} · ${esc(timeLeft(i.exp, now))}</span>
+    <button class="mnd-btn mnd-btn-quiet" data-revoke="${esc(i.iid)}">Cancel it</button></div>`).join('');
+}
+
+/** One paired (or pairing) agent. No actions: invites replace the 12-word flow. */
 export function renderPairing(p) {
   const fp = esc(p.peerFp);
-  const name = esc(p.peerName || 'Unknown agent');
-  const state = p.state;
-  const label = esc(STATE_LABEL[state] || state || 'Unknown');
-  let actions = '';
-  if (state === 'pending-verification') {
-    const inputs = Array.from({ length: WORD_COUNT }, (_, i) =>
-      `<label class="pair-word"><span>${i + 1}</span><input type="text" autocomplete="off" autocapitalize="off" spellcheck="false" data-their-word="${fp}" data-idx="${i}" aria-label="Their word ${i + 1}" /></label>`).join('');
-    actions = `
-      <div class="pair-step">
-        <div class="pair-step-title">1. See the words on this side</div>
-        <div class="pair-row"><input type="password" class="mnd-pin" data-show-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
-        <button class="mnd-btn mnd-btn-primary" data-show-words="${fp}">Show my words</button></div>
-        <ol class="pair-own-words" data-own-words="${fp}"></ol>
-      </div>
-      <div class="pair-step">
-        <div class="pair-step-title">2. Type the 12 words the OTHER agent's operator sees</div>
-        <div class="pair-words">${inputs}</div>
-        <div class="pair-row"><input type="password" class="mnd-pin" data-confirm-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
-        <button class="mnd-btn mnd-btn-primary" data-confirm="${fp}">Confirm they match</button></div>
-        <div class="mnd-hint">Compare over a call or in person, not through the agents. Any wrong word blocks this pairing.</div>
-        <button class="mnd-btn mnd-btn-quiet mnd-btn-danger" data-deny="${fp}">They don't match</button>
-      </div>`;
-  } else if (state === 'verification-failed') {
-    actions = `
-      <div class="pair-step">
-        <div class="mnd-hint">Clear this only once you know why the words were different.</div>
-        <div class="pair-row"><input type="password" class="mnd-pin" data-clear-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
-        <button class="mnd-btn mnd-btn-quiet" data-clear="${fp}">Clear and start again</button></div>
-      </div>`;
-  }
+  const label = esc(STATE_LABEL[p.state] || p.state || 'Unknown');
   return `<div class="pair-card" data-pairing="${fp}">
-    <div class="pair-head"><strong>${name}</strong> <span class="pair-state pair-state-${esc(state)}">${label}</span></div>
-    ${actions}
+    <div class="pair-head"><strong>${esc(p.peerName || 'Unknown agent')}</strong> <span class="pair-state pair-state-${esc(p.state)}">${label}</span></div>
     <div class="pair-meta">Agent ${fp.slice(0, 12)}…</div>
   </div>`;
 }
 
 export function renderPairings(list) {
-  if (!Array.isArray(list) || list.length === 0) {
-    return '<div class="mnd-hint">No pairings yet. An agent starts one with <code>threadline_pair</code> start.</div>';
-  }
-  return list.map(renderPairing).join('');
+  if (!Array.isArray(list) || list.length === 0) return '<div class="mnd-hint">No paired agents yet.</div>';
+  return '<div class="pair-step-title">Agents</div>' + list.map(renderPairing).join('');
 }
 
-/** Words typed into the 12 inputs for one pairing, in order. */
-export function collectTypedWords(root, fp) {
-  const inputs = Array.from(root.querySelectorAll(`[data-their-word="${fp}"]`));
-  inputs.sort((a, b) => Number(a.dataset.idx) - Number(b.dataset.idx));
-  return inputs.map((i) => String(i.value || '').trim().toLowerCase());
-}
-
-export function createController({ doc, els, fetchImpl }) {
+export function createController({ doc, els, fetchImpl, now = () => Date.now() }) {
   let timer = null;
+  let heldPin = '';           // §8.2: asked once per page, memory only
+  let data = { invites: [], pendingAccepts: [], pairings: [] };
+  const lastHtml = new Map();  // section → last rendered HTML (§8.1: re-render only on change)
 
   async function fetchJson(url, opts) {
     const res = await fetchImpl(url, opts);
@@ -88,6 +118,7 @@ export function createController({ doc, els, fetchImpl }) {
     try { body = await res.json(); } catch { body = null; }
     return { status: res.status, body };
   }
+  const post = (url, payload, method = 'POST') => fetchJson(url, { method, headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload ?? {}) });
 
   function note(msg, kind) {
     if (!els.notice) return;
@@ -95,70 +126,158 @@ export function createController({ doc, els, fetchImpl }) {
     els.notice.className = kind === 'error' ? 'mnd-notice mnd-notice-err' : kind === 'success' ? 'mnd-notice mnd-notice-ok' : 'mnd-notice';
   }
 
-  // A timed refresh must not wipe words or a PIN the operator is typing.
-  function operatorIsTyping() {
-    const inputs = els.list ? Array.from(els.list.querySelectorAll('input')) : [];
-    return inputs.some((i) => i.value);
+  function setSection(el, key, html) {
+    if (!el || lastHtml.get(key) === html) return;
+    lastHtml.set(key, html);
+    el.innerHTML = html;
   }
 
-  async function load(opts = {}) {
-    if (opts.timed && operatorIsTyping()) return;
+  // The PIN field sits right above the decisions and shows only while one waits and no PIN is
+  // held: a person meets it before the button that needs it, and never otherwise.
+  function showPinRow() {
+    if (els.pinRow) els.pinRow.style.display = !heldPin && pendingCount(data) > 0 ? '' : 'none';
+  }
+
+  function render() {
+    setSection(els.pending, 'pending', renderPending(data, now()));
+    setSection(els.open, 'open', renderOpenInvites(data.invites, now()));
+    setSection(els.list, 'list', renderPairings(data.pairings));
+    const n = pendingCount(data);
+    if (els.tabButton) {
+      const base = els.tabButton.dataset.baseLabel || (els.tabButton.dataset.baseLabel = els.tabButton.textContent);
+      els.tabButton.textContent = n > 0 ? `${base} (${n})` : base;
+    }
+    // The tabs sit behind the header menu button, so the count must also show THERE or nobody
+    // sees it (found walking the flow as a person, 2026-10-14).
+    if (els.navToggle) {
+      let badge = els.navToggle.querySelector('[data-pair-badge]');
+      if (!badge && n > 0) {
+        badge = doc.createElement('span');
+        badge.setAttribute('data-pair-badge', '');
+        badge.className = 'pair-nav-badge';
+        els.navToggle.appendChild(badge);
+      }
+      if (badge) {
+        // On a phone only the number shows (the word would push the header past the screen).
+        badge.innerHTML = n > 0 ? `${n}<span class="pair-nav-badge-word"> waiting</span>` : '';
+        badge.setAttribute('aria-label', n > 0 ? `${n} pairing decision${n === 1 ? '' : 's'} waiting` : '');
+        badge.style.display = n > 0 ? '' : 'none';
+      }
+    }
+    showPinRow();
+  }
+
+  async function load() {
     try {
-      const { status, body } = await fetchJson('/threadline/pairing');
-      if (status === 503) { els.list.innerHTML = '<div class="mnd-hint">Verified pairing is turned off on this agent.</div>'; return; }
-      if (status !== 200) { note(`Could not load pairings: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
-      els.list.innerHTML = renderPairings(body?.pairings ?? []);
+      const [inv, pr] = await Promise.all([fetchJson('/threadline/pairing/invites'), fetchJson('/threadline/pairing')]);
+      if (inv.status === 503 || pr.status === 503) {
+        const off = /not enabled/.test(String(inv.body?.error ?? pr.body?.error ?? ''));
+        setSection(els.list, 'list', off
+          ? '<div class="mnd-hint">Pairing is turned off on this agent.</div>'
+          : '<div class="mnd-hint">Pairing runs on the machine that holds this agent\'s Threadline identity. Open the dashboard on that machine.</div>');
+        return;
+      }
+      if (inv.status !== 200) { note(`Could not load invites: ${inv.body?.error ?? `HTTP ${inv.status}`}`, 'error'); return; }
+      data = { invites: inv.body?.invites ?? [], pendingAccepts: inv.body?.pendingAccepts ?? [], pairings: pr.status === 200 ? (pr.body?.pairings ?? []) : data.pairings };
+      renderForChoices(inv.body?.knownPeers ?? []);
+      render();
     } catch (e) {
       note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
     }
   }
 
-  async function post(url, payload) {
-    return fetchJson(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+  /** The PIN for one action: the held one, or the field's (asked once). */
+  function pinForAction() {
+    if (heldPin) return heldPin;
+    const v = els.pin ? String(els.pin.value || '') : '';
+    return v;
+  }
+  /** After a PIN-gated call: keep an accepted PIN, forget a refused one. */
+  function settlePin(pin, status) {
+    if (status === 403 || status === 429) { heldPin = ''; if (els.pin) els.pin.value = ''; showPinRow(); return; }
+    if (status < 500 && status !== 401) { heldPin = pin; if (els.pin) els.pin.value = ''; showPinRow(); }
+  }
+
+  async function pinned(url, okMsg) {
+    const pin = pinForAction();
+    if (!pin) { note('Enter your PIN first (you will only be asked once).', 'error'); if (els.pin) els.pin.focus?.(); return; }
+    const { status, body } = await post(url, { pin });
+    settlePin(pin, status);
+    if (status === 403) { note('That PIN was not accepted.', 'error'); return; }
+    if (status !== 200) { note(`That didn't work: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+    note(okMsg, 'success');
+    await load();
+  }
+
+  // "Who is it for?": a known agent binds the invite to it (spec §4.1: the default whenever the
+  // inviter starts from a peer it already knows). Rebuilt only when the list changes, and the
+  // operator's current choice is kept.
+  function renderForChoices(peers) {
+    if (!els.forPeer) return;
+    const key = JSON.stringify(peers.map((p) => [p.fp, p.name]));
+    if (lastHtml.get('for') === key) return;
+    const keep = els.forPeer.value;
+    lastHtml.set('for', key);
+    const opt = (fpValue, label) => { const o = doc.createElement('option'); o.value = fpValue; o.textContent = label; return o; };
+    els.forPeer.replaceChildren(opt('', 'Someone new'), ...peers.map((p) => opt(p.fp, `${p.name || 'Unknown agent'} (${p.fp.slice(0, 6)}…)`)));
+    if (peers.some((p) => p.fp === keep)) els.forPeer.value = keep;
+  }
+
+  async function makeInvite() {
+    const ttlMinutes = els.ttl ? Number(els.ttl.value) || 60 : 60;
+    const bindFp = els.forPeer ? String(els.forPeer.value || '') : '';
+    const { status, body } = await post('/threadline/pairing/invites', bindFp ? { ttlMinutes, bindFp } : { ttlMinutes });
+    if (status !== 200 || !body?.message) { note(`Could not make an invite: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+    // Shown until the operator closes it; no timer touches this box.
+    els.inviteOut.innerHTML = `<div class="pair-step-title">Send this to the other person, privately, in any app. It works once.</div>
+      <textarea class="pair-invite-text" readonly rows="4" data-invite-text>${esc(body.message)}</textarea>
+      <div class="pair-row"><button class="mnd-btn mnd-btn-primary" data-copy-invite>Copy</button>
+      <button class="mnd-btn mnd-btn-quiet" data-close-invite>Done</button></div>
+      <div class="mnd-hint">Expires in ${esc(timeLeft(body.exp, now()))}. When they accept, you will see it at the top of this card.</div>`;
+    await load();
+  }
+
+  async function copyInvite() {
+    const ta = els.inviteOut.querySelector('[data-invite-text]');
+    if (!ta) return;
+    try {
+      await doc.defaultView.navigator.clipboard.writeText(ta.value);
+      note('Copied. Paste it to the other person.', 'success');
+    } catch {
+      ta.select?.();
+      note('Select the text and copy it yourself (your browser blocked copying).', 'info');
+    }
+  }
+
+  async function inspect() {
+    const text = els.inviteIn ? String(els.inviteIn.value || '') : '';
+    if (!text.includes('tlinv1:')) { note('Paste the whole invite you were sent.', 'error'); return; }
+    const { status, body } = await post('/threadline/pairing/invites/inspect', { invite: text });
+    if (status !== 200) { note(`I can't use that invite: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+    els.inviteIn.value = ''; // the secret leaves the page; the decision now waits at the top
+    note('Got it. Approve or decline it at the top of this card.', 'info');
+    await load();
   }
 
   async function onClick(ev) {
     const t = ev.target;
     if (!t || !t.dataset) return;
-    const root = els.list;
-    const take = (attr, fp) => { const el = root.querySelector(`[${attr}="${fp}"]`); const v = el ? el.value : ''; if (el) el.value = ''; return v; };
+    const d = t.dataset;
     try {
-      if (t.dataset.showWords) {
-        const fp = t.dataset.showWords;
-        const pin = take('data-show-pin', fp);
-        if (!pin) { note('Enter your PIN to see the words.', 'error'); return; }
-        const res = await fetchImpl(`/threadline/pairing/${fp}`, { headers: { 'X-Dashboard-Pin': pin } });
-        const body = await res.json().catch(() => null);
-        const words = body?.pairing?.sasWords;
-        if (!Array.isArray(words)) { note(res.status === 200 ? 'The PIN was not accepted, or this pairing is no longer waiting.' : `Refused: ${body?.error ?? `HTTP ${res.status}`}`, 'error'); return; }
-        const ol = root.querySelector(`[data-own-words="${fp}"]`);
-        if (ol) ol.innerHTML = words.map((w) => `<li>${esc(w)}</li>`).join('');
-        note('These are the words on this side. Read them to the other operator and type theirs below.', 'info');
-      } else if (t.dataset.confirm) {
-        const fp = t.dataset.confirm;
-        const words = collectTypedWords(root, fp);
-        const pin = take('data-confirm-pin', fp);
-        if (words.some((w) => !w)) { note(`Type all ${WORD_COUNT} of the other side's words first.`, 'error'); return; }
-        if (!pin) { note('Enter your PIN to confirm.', 'error'); return; }
-        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { words, pin });
-        if (status !== 200) { note(`Not confirmed — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
-        note(body?.state === 'mutual-verified' ? 'Verified. Every word matched.' : 'The words did not match. This pairing is now blocked.', body?.state === 'mutual-verified' ? 'success' : 'error');
-        await load();
-      } else if (t.dataset.deny) {
-        const fp = t.dataset.deny;
-        const pin = take('data-confirm-pin', fp);
-        if (!pin) { note('Enter your PIN (in the field above) to record that the words did not match.', 'error'); return; }
-        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { match: false, pin });
-        if (status !== 200) { note(`Not recorded — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
-        note('Recorded: the words did not match. This pairing is blocked.', 'success');
+      if (d.makeInvite !== undefined) await makeInvite();
+      else if (d.copyInvite !== undefined) await copyInvite();
+      else if (d.closeInvite !== undefined) els.inviteOut.innerHTML = '';
+      else if (d.inspectInvite !== undefined) await inspect();
+      else if (d.approve) await pinned(`/threadline/pairing/invites/${d.approve}/approve`, 'Approved. Waiting for the other side to finish.');
+      else if (d.finish) await pinned(`/threadline/pairing/invites/${d.finish}/finish`, 'Finished. You are paired.');
+      else if (d.notThem) await pinned(`/threadline/pairing/invites/${d.notThem}/not-them`, 'Not paired. That invite is used up.');
+      else if (d.decline) {
+        const { status, body } = await post(`/threadline/pairing/invites/${d.decline}/decline`, {});
+        note(status === 200 ? 'Declined. Nothing was paired.' : `That didn't work: ${body?.error ?? `HTTP ${status}`}`, status === 200 ? 'success' : 'error');
         await load();
-      } else if (t.dataset.clear) {
-        const fp = t.dataset.clear;
-        const pin = take('data-clear-pin', fp);
-        if (!pin) { note('Enter your PIN to clear this pairing.', 'error'); return; }
-        const { status, body } = await post(`/threadline/pairing/${fp}/start`, { clearFailed: true, pin });
-        if (status !== 200) { note(`Not cleared — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
-        note('Cleared. Compare the words again.', 'success');
+      } else if (d.revoke) {
+        const { status, body } = await post(`/threadline/pairing/invites/${d.revoke}`, {}, 'DELETE');
+        note(status === 200 ? 'Cancelled. That invite no longer works.' : `That didn't work: ${body?.error ?? `HTTP ${status}`}`, status === 200 ? 'success' : 'error');
         await load();
       }
     } catch (e) {
@@ -168,12 +287,13 @@ export function createController({ doc, els, fetchImpl }) {
 
   return {
     start() {
-      if (els.list && !els.list.__pairWired) { els.list.addEventListener('click', onClick); els.list.__pairWired = true; }
+      if (els.root && !els.root.__pairWired) { els.root.addEventListener('click', onClick); els.root.__pairWired = true; }
       load();
-      if (!timer) timer = setInterval(() => load({ timed: true }), REFRESH_MS);
+      if (!timer) timer = setInterval(load, POLL_MS);
     },
     stop() { if (timer) { clearInterval(timer); timer = null; } },
     load,
     onClick,
+    hasPin: () => Boolean(heldPin),
   };
 }

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAwGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiJ7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AA8gBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAg3BN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+iyBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAwGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiJ7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AA8gBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAg3BN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAmjyBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}