madarx 2.18.0 → 2.19.0

package/.next/static/sO4ApzzsDEnqk70DEBOS6/_buildManifest.js

@@ -0,0 +1 @@
+self.__BUILD_MANIFEST=function(e,r,t,_){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:144,errorRate:1e-4,numBits:2761,numHashes:14,bitArray:[0,0,r,r,1,r,r,r,r,1,e,e,e,r,e,r,r,e,r,r,r,r,r,e,e,r,r,e,e,e,e,r,r,e,e,e,r,r,e,e,e,e,r,r,r,e,r,e,e,e,r,r,e,r,e,e,r,e,e,e,e,e,e,r,r,e,e,r,e,r,r,e,e,r,r,e,e,e,r,r,r,e,r,e,e,e,r,r,e,e,r,e,e,e,e,r,e,r,r,r,r,e,e,r,r,r,r,r,e,r,e,r,e,r,e,r,e,e,r,e,e,e,e,e,r,e,e,e,e,r,r,e,e,e,e,e,e,r,r,r,e,r,e,r,e,r,e,r,e,r,r,e,e,e,r,r,r,e,e,r,e,e,r,e,r,r,r,r,e,r,r,r,e,e,r,e,e,r,r,r,r,r,e,e,e,r,e,e,r,r,r,e,e,r,r,r,e,e,e,e,r,e,e,r,r,e,r,r,e,e,r,r,e,e,r,r,r,r,e,e,e,e,r,r,e,e,e,e,r,e,e,e,e,r,e,e,e,e,e,e,r,r,r,e,e,r,r,r,r,r,r,r,e,e,r,e,r,r,e,r,r,e,r,r,e,e,e,r,e,e,e,r,e,e,r,e,e,e,r,r,r,r,e,e,r,r,e,e,e,e,r,e,e,e,e,r,e,r,r,r,r,r,r,e,r,e,r,e,e,e,e,e,e,e,r,e,r,r,e,e,r,e,r,r,e,e,e,e,e,e,r,r,r,e,r,r,e,e,r,e,r,r,e,r,r,r,e,e,r,r,e,e,r,r,e,e,r,r,e,r,e,e,e,r,e,r,e,e,r,e,r,r,e,r,r,r,r,r,e,r,e,e,r,r,r,e,r,r,r,r,e,r,r,r,e,e,r,r,e,e,r,r,e,e,e,r,r,r,r,r,e,e,r,e,e,e,e,r,e,e,r,e,r,e,e,r,r,e,e,r,e,r,r,e,e,r,e,e,r,r,r,r,r,e,e,e,e,e,r,r,e,e,e,e,e,r,e,e,e,e,e,r,e,e,r,r,e,e,e,e,e,r,e,e,e,e,e,e,e,e,e,r,r,e,r,e,r,e,r,r,r,e,e,r,r,e,r,r,r,r,r,e,e,e,r,r,r,e,e,r,e,e,r,r,e,r,r,e,e,r,e,r,e,e,e,r,e,r,r,r,e,r,e,r,r,e,e,r,e,e,r,r,e,r,e,e,e,r,r,e,e,r,r,r,r,e,e,e,e,e,r,e,e,r,r,e,r,r,r,e,r,e,e,e,r,e,e,e,e,e,r,e,r,r,r,e,r,r,r,r,e,r,r,r,r,e,r,e,r,r,e,e,r,r,r,r,r,r,e,r,r,r,e,e,e,e,r,e,r,e,e,e,e,e,r,e,e,r,r,e,e,r,r,r,e,r,r,r,e,e,r,r,e,e,e,r,r,e,e,r,e,e,e,r,r,r,e,e,r,r,e,r,r,e,e,r,e,r,r,r,r,r,e,e,e,e,r,r,e,r,r,r,r,r,r,r,r,r,e,r,r,e,e,e,r,r,e,r,e,e,e,e,e,e,e,e,e,e,e,r,r,r,r,r,r,e,e,e,e,r,e,r,r,e,e,e,r,r,r,e,r,e,r,r,e,r,r,r,e,r,e,e,r,e,e,e,e,e,e,e,r,e,r,e,r,e,r,r,r,r,r,r,e,e,r,e,r,e,r,r,e,e,r,r,e,r,e,e,r,e,e,r,r,r,e,r,e,e,e,r,e,r,r,r,e,e,e,r,e,r,e,r,r,r,e,e,e,e,r,e,e,e,r,e,e,r,r,e,e,r,e,e,e,r,r,r,r,r,e,r,e,r,e,r,e,r,r,r,e,e,e,r,e,r,e,r,r,e,r,r,e,e,e,e,r,e,e,e,e,e,e,e,e,r,r,r,r,e,e,e,e,r,e,r,r,e,r,e,e,e,e,r,e,e,e,r,r,r,r,e,r,r,r,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,r,r,r,e,r,e,e,r,r,r,e,e,r,r,r,r,e,e,r,r,r,e,e,r,e,e,e,r,r,r,e,r,r,e,r,e,r,r,r,r,e,r,r,e,e,r,e,r,e,e,e,e,r,e,e,r,e,e,r,r,e,e,e,r,e,e,e,e,e,e,e,r,r,r,r,e,r,r,r,r,e,r,r,e,r,r,r,e,r,e,r,e,e,e,r,r,e,e,r,r,r,r,r,e,r,e,e,e,e,r,e,e,e,r,e,e,r,r,r,e,r,r,r,e,r,r,e,r,r,r,r,r,r,e,r,e,e,e,r,r,e,e,e,r,r,e,e,e,e,e,e,r,e,e,r,r,r,e,e,e,e,e,r,r,e,r,r,r,r,r,e,e,r,e,r,e,r,r,e,r,r,r,r,e,e,e,r,e,e,e,e,r,r,e,e,r,e,e,e,e,r,e,e,r,r,r,e,e,e,r,r,r,r,e,r,r,e,r,e,r,e,r,e,e,r,e,e,r,e,e,r,r,r,r,e,e,e,r,r,r,e,r,r,e,r,r,e,r,e,r,e,e,r,e,r,e,e,r,r,r,e,r,r,r,e,e,e,r,e,r,r,e,r,r,r,r,r,e,r,e,e,e,e,e,e,e,e,e,r,e,e,r,e,r,r,r,e,e,e,r,e,r,r,e,e,e,r,r,r,e,e,r,e,r,e,e,r,r,e,e,r,e,r,e,e,r,e,e,e,e,e,e,e,e,r,r,r,e,r,r,e,r,e,r,r,r,r,r,r,e,r,e,r,r,e,r,e,e,r,e,e,e,e,e,r,r,r,e,r,e,r,e,r,r,r,e,e,e,r,e,e,e,r,r,r,r,r,e,e,e,r,e,e,e,e,r,e,e,r,e,r,r,e,e,e,r,e,e,e,e,r,r,e,r,r,r,r,r,e,e,e,e,e,r,e,e,e,e,r,e,e,r,r,e,r,e,r,e,r,e,e,r,r,r,e,e,r,r,r,e,r,e,e,r,r,r,e,e,e,e,r,r,e,r,e,r,e,r,e,r,e,r,r,r,e,e,r,e,e,e,e,e,r,r,e,r,r,r,e,r,r,e,r,r,r,r,r,e,r,e,r,e,r,r,r,e,r,r,e,r,e,r,e,e,r,e,e,r,e,r,r,r,e,r,r,e,e,e,r,r,e,e,e,e,r,r,r,e,r,e,e,e,e,e,e,e,r,r,r,e,e,e,r,e,e,e,e,r,e,e,e,e,r,e,e,e,r,r,r,r,r,e,e,e,r,r,e,r,r,r,e,e,r,r,r,e,r,r,e,e,e,r,e,e,e,r,r,r,e,e,r,e,e,e,e,e,r,r,r,e,r,e,e,r,r,e,r,e,r,r,r,r,e,r,e,r,r,e,e,e,e,r,r,e,r,r,e,e,e,r,r,r,e,r,e,e,e,e,e,r,r,r,r,e,e,e,e,e,r,r,e,e,e,r,e,r,e,e,e,r,e,e,e,e,r,e,e,e,e,r,r,r,e,r,r,r,r,e,e,e,e,r,e,e,r,e,r,r,r,e,e,r,e,e,e,r,e,e,r,r,r,r,e,r,e,r,e,e,r,e,r,r,e,e,r,e,e,r,r,r,e,r,r,e,e,r,e,r,e,e,e,e,e,r,e,e,e,e,r,r,r,r,e,e,e,e,r,r,e,e,r,r,e,e,r,e,r,e,e,e,r,r,e,e,r,r,e,e,e,e,e,r,r,e,e,e,r,r,r,r,e,e,e,r,r,e,e,r,r,e,e,e,r,r,r,r,r,r,e,e,r,r,r,e,e,r,r,r,e,r,r,r,e,r,r,r,e,r,r,e,e,e,r,r,e,e,e,r,e,e,e,r,r,e,r,e,r,r,r,e,e,r,r,e,r,r,r,e,r,r,e,e,e,r,r,r,r,e,r,r,r,e,e,r,r,r,r,r,e,r,r,e,r,e,e,e,r,e,e,e,r,r,e,r,r,r,e,r,e,r,r,e,r,e,r,r,e,r,e,r,r,e,e,r,e,e,r,e,e,e,e,r,e,r,r,r,r,e,r,e,e,e,e,e,e,r,e,e,r,e,e,r,e,e,e,e,r,r,r,e,e,e,r,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,e,r,r,r,e,e,e,e,r,r,r,r,r,e,r,r,e,e,r,e,e,e,r,e,e,e,r,r,r,e,e,e,e,r,e,e,e,r,r,e,e,e,e,r,r,e,r,r,r,r,e,r,e,e,r,e,e,e,r,e,e,r,e,e,e,e,r,e,r,e,r,r,e,e,e,r,r,e,e,r,r,r,e,e,e,r,e,e,e,e,r,r,e,e,e,e,e,e,e,e,e,r,r,e,r,e,e,e,e,e,e,r,r,r,r,r,r,e,r,e,e,r,e,r,r,e,r,r,e,e,e,r,e,r,e,e,e,r,e,r,r,e,e,e,e,e,r,r,e,r,r,r,e,e,e,r,e,e,r,r,e,e,e,r,e,e,e,e,r,r,r,r,r,e,e,r,e,e,e,r,e,e,r,r,e,e,r,e,r,e,r,r,e,r,r,e,e,e,e,r,e,r,e,r,e,e,r,r,r,e,e,e,e,r,e,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,r,e,r,r,r,r,r,e,e,e,r,e,r,r,r,e,r,r,r,e,e,r,r,e,r,e,e,r,r,r,r,e,r,r,r,e,r,e,r,e,r,r,e,e,e,e,r,e,r,r,r,e,r,e,e,r,r,e,e,r,r,e,e,r,r,e,r,r,e,e,e,e,e,r,r,e,r,r,r,r,e,e,r,r,e,r,r,e,r,e,e,e,e,r,r,r,r,e,e,e,r,r,e,e,r,r,r,e,e,e,e,r,e,e,r,e,r,r,r,r,e,e,e,r,e,e,e,e,e,r,e,e,e,e,e,e,r,e,e,e,r,r,r,e,r,r,r,r,e,e,r,r,e,r,e,e,r,e,e,r,e,e,e,r,r,e,e,r,e,r,r,e,e,e,r,r,r,e,e,r,r,r,e,r,e,e,r,e,r,e,r,e,e,e,e,e,r,e,e,r,e,r,e,e,r,r,r,r,r,e,e,e,r,e,r,r,r,e,r,r,r,e,r,r,e,r,r,e,e,e,r,r,r,e,r,e,e,e,e,e,r,r,r,e,e,r,r,e,r,e,r,r,r,r,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,e,r,e,r,e,e,r,e,e,r,r,r,e,e,e,e,r,r,r,r,r,e,e,r,e,r,r,e,r,r,e,r,r,e,r,r,e,r,r,e,r,e,r,e,e,e,r,r,r,e,r,e,e,r,r,r,e,e,r,e,r,e,e,r,e,r,e,e,r,r,e,r,r,e,e,r,r,r,e,e,r,e,e,e,r,e,e,r,e,e,e,r,r,e,e,e,r,e,r,e,e,r,r,r,e,e,r,e,e,e,r,r,r,e,e,r,r,e,r,e,e,e,r,e,r,e,r,e,e,r,e,r,e,e,r,r,e,e,e,r,r,r,r,r,e,r,e,e,e,e,e,r,r,e,r,r,e,e,r,r,r,r,r,r,e,r,e,e,r,e,e,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,e,r,e,e,r,r,e,e,e,e,e,e,e,e,r,r,e,e,e,r,e,r,e,r,e,r,r,r,e,r,r,r,e,r,r,e,r,e,e,r,r,e,e,r,e,e,r,e,e,r,e,r,r,r,e,e,e,r,e,r,r,r,r,r,e,r,r,e,r,e,e,r,r,r,r,e,r,e,r,r,r,e,r,r,r,r,r,e,e,e,r,r,e,r,e,r,e,r,e,r,r,e,e,r,r,r,r,e,e,e,r,r,e,r,r,r,e,e,e,r,e,r,r,e,r,e,e,r,r,r,r,r,r,r,e,e,e,e,e,e,e,e,e,r,e,e,e,r,r,e,r,e,r,e,r,r,r,r,r,e,r,r,e,r,r,e,e,r,r,e,e,e,e,r,e,e,e,r,e,r,e,e,r,e,e,r,r,e,e,e,r,e,r,e,e,e,e,r,r,r]},__routerFilterDynamic:{numItems:39,errorRate:1e-4,numBits:748,numHashes:14,bitArray:[r,e,r,r,e,e,e,e,r,r,r,e,r,r,e,r,e,r,e,r,e,e,r,e,e,r,e,e,e,e,r,r,e,r,e,r,e,r,e,r,e,e,e,r,r,r,r,r,e,r,r,r,e,e,r,e,e,r,r,r,r,r,e,e,r,r,r,e,e,r,r,e,r,e,e,r,r,e,r,e,e,e,e,e,e,r,e,e,r,r,r,e,e,e,r,e,r,e,r,r,e,r,e,r,e,e,e,r,e,e,e,e,r,r,e,e,r,r,e,r,r,r,r,e,e,r,e,e,e,r,e,e,e,r,r,r,r,r,e,r,r,r,r,e,r,e,e,r,r,e,e,r,e,r,e,r,r,r,r,r,e,r,r,e,r,e,r,r,e,r,r,e,e,e,e,e,r,r,r,e,r,r,e,e,r,r,e,e,e,r,r,e,r,e,e,e,r,r,e,e,r,e,r,r,e,r,e,e,e,e,e,r,r,r,e,r,r,r,e,r,e,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,r,e,e,r,r,r,r,e,e,r,e,r,r,r,e,e,r,r,r,r,e,e,r,r,e,r,r,r,e,e,e,r,r,e,e,r,e,e,e,e,e,e,e,r,r,e,r,e,r,e,e,r,r,r,r,r,r,r,e,r,r,e,r,r,e,r,e,e,r,e,e,e,e,r,r,e,r,e,e,r,r,r,e,e,e,r,e,e,r,r,e,r,e,r,r,r,r,r,r,e,r,e,e,e,r,r,e,r,e,r,r,e,r,e,r,e,e,e,r,e,e,r,r,r,r,r,r,r,r,e,e,e,e,r,r,e,r,e,e,r,r,e,e,r,e,e,r,e,e,e,e,e,e,e,r,r,e,e,e,r,r,e,e,r,r,e,e,r,r,r,r,r,r,r,r,e,e,r,r,r,e,e,r,r,e,e,e,e,r,r,e,r,r,r,r,r,r,e,r,e,r,e,e,e,e,e,e,r,e,r,r,e,r,r,e,e,r,e,e,r,e,e,r,r,r,r,e,r,r,e,r,r,r,e,e,e,e,r,e,e,e,e,r,r,r,r,r,e,e,e,r,e,e,e,e,r,r,e,r,r,r,e,r,r,e,e,r,r,r,e,e,e,r,r,r,e,r,e,r,r,e,r,e,e,e,e,e,r,r,e,r,r,e,r,e,r,e,r,e,r,e,r,r,r,e,r,e,e,r,r,e,e,r,r,e,e,e,e,r,r,r,e,r,r,e,e,e,e,e,e,e,r,e,r,e,e,r,e,r,e,r,r,e,r,e,e,e,e,e,e,r,r,e,e,r,r,e,e,e,e,e,e,r,e,r,e,e,r,r,r,r,e,r,e,e,e,e,r,r,r,r,e,e,e,r,e,r,r,r,r,e,e,r,e,r,r,r,e,r,e,e,r,e,r,r,e,e,e,r,r,r,r,e,r,r,r,e,r,e,e,r,e,e,r,e,r,r,r,e,r,r,e,e,e,r,e,r,e,e,e,e,r,e,e,e,e,e,e,e,e,r,e,e,r,r,r,r,e,r,e,e,e,r,r,e,r,e,e,r,e,e,e,e,r,e,r,e,e,r,e,e,e,e,e,r,e,e,e,r,e,r,r,e,r,e,e,e,e,r,r,r,e,e,r,e,e,r,e,r,e,r,r]},"/_error":["static/chunks/pages/_error-c970d8b55ace1b48.js"],sortedPages:["/_app","/_error"]}}(1,0,1e-4,14),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to Madarx OS. Newest first.
 
 ## Unreleased
 
+## [2.19.0] - 2026-06-06
+
+### Added
+
+- **Chat persistence & live-activity continuity across navigation.** Navigate away from the dashboard during a main-agent turn and come back — the chat now resumes instead of going silent until a manual refresh. Two phases ship together. **Phase 1:** the orchestrator stamps an `active_turn_id` / `active_turn_started_at` on the chat session at turn start and clears it in `finally` (so it self-heals on error/cancel), with a derived `agent_working` flag gated by a TTL (`MADARX_ACTIVE_TURN_TTL_MS`, default 15 min) so a crashed turn reads as idle instead of stuck. On return the UI shows an "Agent still working…" banner and progressively refetches persisted turns — including tool-call steps, which the restore path previously dropped. **Phase 2:** a process-local broadcaster (`lib/orchestrator-broadcast.js`) decouples the running turn from the originating request via a per-session ring buffer (`MADARX_TURN_BUFFER_MAX`, default 1000) retained briefly after completion (`MADARX_TURN_BUFFER_RETENTION_MS`, default 30 s); a new `GET /api/orchestrator/stream/attach?session_id=&from_seq=` replays the buffered tail then tails live, so a returning client resumes token-level output and ends on the same transcript as if it never left. The SSE event handling is extracted into a shared reducer (`app/components/dashboard/apply-stream-event.js`) used by both the live POST stream and the attach reconnect, so behavior stays identical. `chat_turn` events are observation-only (persisted to `activity_log`, never mutate agent/case state) and a per-session attach-subscriber cap (`MADARX_TURN_MAX_SUBSCRIBERS`, default 8) bounds listener growth. Single-process / local-first: on a server restart mid-turn the live buffer is lost, but Phase-1 persistence + the TTL flag are the durable fallback. Spec: `specs/active/chat-persistence-live-continuity.md`. Files: `lib/schema.js`, `lib/db.js`, `lib/runtime.js`, `lib/orchestrator-broadcast.js`, `lib/delegation-contracts.js`, `app/api/orchestrator/stream/route.js`, `app/api/orchestrator/stream/attach/route.js`, `app/components/dashboard/*`. Tests: `tests/chat-continuity.test.js`, `tests/chat-continuity-phase2.test.js`.
+- **Artifact layout & team onboarding.** Improved canvas artifact positioning/ordering (`app/components/dashboard/artifact-board.jsx`, `artifact-order.js`, `use-artifact-layout.js`) with regression coverage in `tests/artifact-layout.test.js`, plus a dedicated team-onboarding flow (`app/onboarding/team/`) and team settings/invite refinements. Adds a cloud-schema export pipeline (`lib/cloud-schema.js`, `scripts/build-cloud-schema.mjs`, `GET /api/cloud/schema`) and a `lib/public-url.js` helper for share/public URL resolution.
+
+### Fixed
+
+- **CLI-install login lockout in supabase mode.** Under `madarx` (separate `~/.madarx` data home, plain `SUPABASE_*` env + vault keys) three gaps stacked into a hard lockout: a correct password sign-in succeeded, then the next page load bounced back to `/login?error=missing_supabase_env`. The middleware auth gate's env fast-path read only `NEXT_PUBLIC_SUPABASE_*`; it now resolves plain `SUPABASE_*` too and defers to the vault-backed `/api/auth/config` (returns null instead of short-circuiting) when a mode is named but creds are absent. Auth-mode drift (stale config-table `local` overriding env) and related resolution gaps closed. New pure, unit-tested `lib/auth-env-fastpath.js::resolveEnvAuthConfig()`. Only reproduced under the CLI install, never under `npm run dev`.
+
 ## [2.18.0] - 2026-06-06
 
 ### Added

package/app/api/auth/config/route.js

@@ -22,6 +22,7 @@ import {
   testSupabaseConnection,
   verifyRecoveryToken,
 } from '@/lib/auth-config.js';
+import { getPublicBaseUrl, setPublicBaseUrl } from '@/lib/public-url.js';
 import { requireSession } from '@/lib/auth.js';
 
 export const runtime = 'nodejs';
@@ -35,6 +36,7 @@ export async function GET() {
     supabaseConfigured: Boolean(url && anonKey),
     supabaseUrl: url || null,
     supabaseAnonKey: anonKey || null,
+    publicBaseUrl: getPublicBaseUrl() || null,
   });
 }
 
@@ -105,9 +107,14 @@ export async function POST(req) {
       anonKey: body.anonKey,
       serviceKey: body.serviceKey,
     });
+    // The public app URL is not a secret; persist it on the same save so invite
+    // and share links resolve to a host teammates can actually reach.
+    if (body.publicBaseUrl !== undefined) {
+      setPublicBaseUrl(body.publicBaseUrl);
+    }
   } catch (err) {
     return Response.json({ ok: false, error: err.message }, { status: 400 });
   }
 
-  return Response.json({ ok: true, authMode: getAuthMode() });
+  return Response.json({ ok: true, authMode: getAuthMode(), publicBaseUrl: getPublicBaseUrl() || null });
 }

package/app/api/cloud/schema/route.js

@@ -0,0 +1,109 @@
+/**
+ * /api/cloud/schema — Supabase shared-layer schema bootstrap surface.
+ *
+ *   GET                         → readiness snapshot for the onboarding wizard:
+ *                                 { configured, ready, present[], missing[],
+ *                                   total, version, projectRef, sqlEditorUrl,
+ *                                   schemaSql, serviceKeyConfigured }
+ *   POST { action: 'verify' }   → re-probe the tables (after a manual apply).
+ *   POST { action: 'apply', accessToken } → one-click apply via the Supabase
+ *                                 Management API using a personal access token.
+ *                                 The token is used once and never persisted.
+ *
+ * Authorization mirrors /api/auth/config: in local mode the app is already open
+ * to the single operator; in supabase mode an owner/admin session is required.
+ * The schema SQL is public DDL (safe to return); no secret is ever returned.
+ */
+
+import { getAuthMode } from '@/lib/auth.js';
+import { requireSession } from '@/lib/auth.js';
+import { getSupabaseAuthConfig, isServiceKeyConfigured } from '@/lib/auth-config.js';
+import {
+  probeCloudSchema,
+  applySchemaViaManagementApi,
+  projectRefFromUrl,
+  sqlEditorUrl,
+  CLOUD_SCHEMA_SQL,
+  SCHEMA_VERSION,
+} from '@/lib/cloud-schema.js';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/** Owner/admin gate; in local mode the single operator is always allowed. */
+async function canManage(req) {
+  if (getAuthMode() === 'local') return true;
+  let session = null;
+  try {
+    session = await requireSession(req);
+  } catch {
+    session = null;
+  }
+  return Boolean(session && ['owner', 'admin'].includes(session.role));
+}
+
+function baseSnapshot() {
+  const { url } = getSupabaseAuthConfig();
+  return {
+    projectRef: projectRefFromUrl(url) || null,
+    sqlEditorUrl: sqlEditorUrl(url) || null,
+    serviceKeyConfigured: isServiceKeyConfigured(),
+    schemaSql: CLOUD_SCHEMA_SQL,
+    version: SCHEMA_VERSION,
+  };
+}
+
+export async function GET(req) {
+  if (!(await canManage(req))) {
+    return Response.json({ ok: false, error: 'forbidden' }, { status: 403 });
+  }
+  const snap = baseSnapshot();
+  let probe = { configured: false };
+  try {
+    probe = await probeCloudSchema();
+  } catch {
+    probe = { configured: false };
+  }
+  return Response.json({ ok: true, ...snap, ...probe });
+}
+
+export async function POST(req) {
+  if (!(await canManage(req))) {
+    return Response.json({ ok: false, error: 'forbidden' }, { status: 403 });
+  }
+  const body = await req.json().catch(() => ({}));
+  const action = body.action || 'verify';
+
+  if (action === 'verify') {
+    let probe = { configured: false };
+    try {
+      probe = await probeCloudSchema();
+    } catch {
+      probe = { configured: false };
+    }
+    return Response.json({ ok: true, ...probe });
+  }
+
+  if (action === 'apply') {
+    const { url } = getSupabaseAuthConfig();
+    const ref = projectRefFromUrl(body.projectRef || url);
+    if (!ref) {
+      return Response.json({ ok: false, error: 'no_project_ref' }, { status: 400 });
+    }
+    const result = await applySchemaViaManagementApi({ ref, pat: body.accessToken });
+    if (!result.ok) {
+      const status = result.error === 'unauthorized_token' ? 422 : 400;
+      return Response.json({ ok: false, error: result.error }, { status });
+    }
+    // Re-probe so the client gets fresh readiness in the same round-trip.
+    let probe = { configured: false };
+    try {
+      probe = await probeCloudSchema();
+    } catch {
+      probe = { configured: false };
+    }
+    return Response.json({ ok: true, applied: true, ...probe });
+  }
+
+  return Response.json({ ok: false, error: 'unknown_action' }, { status: 400 });
+}

package/app/api/orchestrator/stream/attach/route.js

@@ -0,0 +1,101 @@
+import { requireSession } from '@/lib/auth.js';
+import { getActiveTurn, subscribe } from '@/lib/orchestrator-broadcast.js';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+// Phase 2: re-attach to an in-flight orchestrator turn.
+//
+// GET /api/orchestrator/stream/attach?session_id=<id>&from_seq=<n>
+//
+// When a turn is live (or just finished, within the broadcaster's retention
+// window) for the session, this replays the buffered tail after `from_seq`,
+// then streams live frames until the terminal `__end`. When nothing is in
+// flight it returns 204 so the client can stay on its persisted state.
+// SECURITY — session ownership: `requireSession` authenticates the caller but
+// `chat_sessions` has no `user_id` column yet, so we cannot scope the attach to
+// the owner. In `MADARX_AUTH_MODE=local` (single synthetic user) this is moot.
+// In `supabase` multi-user mode an authenticated user could attach to another
+// user's live turn by guessing its session_id. Closing this requires adding
+// `user_id` to `chat_sessions` (set at createChatSession, propagated from the
+// orchestrator's authenticated session) and an ownership assert here — tracked
+// as a follow-up, out of scope for the continuity feature. The broadcaster only
+// holds an in-flight turn for a session that genuinely started one, so this is
+// not a path to historical/persisted data, only the live token tail.
+export async function GET(req) {
+  try {
+    await requireSession(req);
+  } catch (err) {
+    if (err && typeof err === 'object' && err.status) {
+      return Response.json({ error: err.error || 'unauthorized' }, { status: err.status });
+    }
+    throw err;
+  }
+
+  const url = new URL(req.url);
+  const sessionId = url.searchParams.get('session_id');
+  const fromSeq = Number(url.searchParams.get('from_seq')) || 0;
+  if (!sessionId) {
+    return Response.json({ error: 'session_id required' }, { status: 400 });
+  }
+
+  const active = getActiveTurn(sessionId);
+  if (!active) {
+    // Nothing in flight — the client keeps its persisted view.
+    return new Response(null, { status: 204 });
+  }
+
+  const encoder = new TextEncoder();
+  let cleanup = () => {};
+
+  const stream = new ReadableStream({
+    start(ctrl) {
+      let closed = false;
+      function safeEnqueue(chunk) {
+        if (closed) return;
+        try { ctrl.enqueue(encoder.encode(chunk)); }
+        catch { closed = true; }
+      }
+      function send(event, data) {
+        // Serialise exactly as the live stream's emit() does so the shared
+        // client reducer treats replayed and live frames identically.
+        const payload = typeof data === 'string' ? data : JSON.stringify(data);
+        safeEnqueue(`event: ${event}\ndata: ${payload}\n\n`);
+      }
+
+      // Tell the client which turn it attached to.
+      send('attach', { session_id: sessionId, turn_id: active.turnId });
+
+      const unsubscribe = subscribe(sessionId, fromSeq, (frame) => {
+        if (frame.event === '__end') {
+          send('done', { ok: true, resumed: true });
+          cleanup();
+          return;
+        }
+        send(frame.event, frame.data);
+      });
+
+      cleanup = () => {
+        if (closed) return;
+        closed = true;
+        try { unsubscribe(); } catch { /* ignore */ }
+        try { ctrl.close(); } catch { /* ignore */ }
+      };
+
+      req.signal.addEventListener('abort', cleanup);
+
+      // If the turn already finished before we subscribed, the buffered tail
+      // (incl. __end) was replayed synchronously above and cleanup ran.
+    },
+    cancel() { cleanup(); },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    },
+  });
+}

package/app/api/orchestrator/stream/route.js

@@ -11,9 +11,12 @@ import {
   createChatSession,
   appendChatMessage,
   getChatSession,
+  setSessionActiveTurn,
   createArtifact,
   updateArtifact,
 } from '@/lib/runtime.js';
+import { publishLiveEvent } from '@/lib/live-events.js';
+import * as turnBroadcast from '@/lib/orchestrator-broadcast.js';
 import { buildAgentCreatedHtml } from '@/lib/agent-created-card.js';
 import { INTENT_WITHOUT_ACTION_RE } from '@/lib/intent-without-action.js';
 import { looksFabricatedToolTranscript } from '@/lib/fabricated-tool-output.js';
@@ -386,6 +389,19 @@ export async function POST(req) {
     sessionId = created.id;
   }
 
+  // Live-turn id for navigate-away/return continuity. Marks the session as
+  // "agent working" so a returning client can show a resume banner (Phase 1)
+  // and, later, re-attach to the live stream (Phase 2). Cleared in `finally`.
+  const turnId = `turn-${sessionId}-${Date.now()}`;
+  function emitTurnPhase(phase) {
+    try {
+      publishLiveEvent({ type: 'chat_turn', session_id: sessionId, turn_id: turnId, phase });
+    } catch { /* observation-only — never let it break the turn */ }
+  }
+  try { setSessionActiveTurn(sessionId, turnId); } catch { /* best-effort */ }
+  try { turnBroadcast.beginTurn(sessionId, turnId); } catch { /* best-effort */ }
+  emitTurnPhase('started');
+
   // Optional: caller passes the artifact ID from the previous turn so follow-ups can update it.
   const sessionArtifactId = typeof body.session_artifact_id === 'string' ? body.session_artifact_id : null;
 
@@ -484,6 +500,10 @@ export async function POST(req) {
         }
       }
       function emit(event, data) {
+        // Mirror to the turn broadcaster FIRST so a re-attached client (Phase 2)
+        // receives the frame even after this request's stream has closed
+        // (navigate-away leaves the server loop running to completion).
+        try { turnBroadcast.publish(sessionId, turnId, event, data); } catch { /* best-effort */ }
         if (streamState.closed) return;
         const payload = typeof data === 'string' ? data : JSON.stringify(data);
         enqueue(`event: ${event}\ndata: ${payload}\n\n`);
@@ -1109,6 +1129,9 @@ Rules (non-negotiable):
             });
           } catch { /* session deleted mid-stream — keep streaming, drop persistence */ }
 
+          // Each persisted turn is a resume point for a returning client.
+          emitTurnPhase('step');
+
           totalAgentText += textBuffer;
 
           // If no tool calls, we are done
@@ -1198,6 +1221,11 @@ Rules (non-negotiable):
       } catch (err) {
         emit('error', { message: err.message });
       } finally {
+        // Clear the live-turn flag even on error/disconnect so the session
+        // reads idle on return. (cancel() leaves the loop running to here.)
+        try { setSessionActiveTurn(sessionId, null); } catch { /* best-effort */ }
+        try { turnBroadcast.endTurn(sessionId, turnId); } catch { /* best-effort */ }
+        emitTurnPhase('done');
         closeStream();
       }
     },

package/app/api/orgs/[id]/invites/route.js

@@ -112,19 +112,25 @@ export async function POST(req, { params }) {
     // link now works whenever Supabase is configured at all. The token rides in
     // the FRAGMENT (H1); the client prepends window.location.origin.
     let joinPath = null;
+    let joinUrl = null;
     try {
       const { url, anonKey } = getSupabaseAuthConfig();
       if (url && anonKey) {
         const org = getOrgById(orgId);
         const blob = encodeInviteBlob({ url, anonKey, token, org: org?.name || undefined });
         joinPath = `/join#invite=${blob}`;
+        // Prefer an absolute URL on the configured public host so the link works
+        // for a teammate on another machine (not the generator's localhost).
+        const { getPublicBaseUrl } = await import('@/lib/public-url.js');
+        const base = getPublicBaseUrl();
+        if (base) joinUrl = `${base}${joinPath}`;
       }
     } catch {
       // Non-fatal — the bare token still works via "Join with code".
     }
 
     // H1: the raw token is returned ONCE and never persisted in raw form.
-    return Response.json({ kind: 'link', id, token, invite, joinPath }, { status: 201 });
+    return Response.json({ kind: 'link', id, token, invite, joinPath, joinUrl }, { status: 201 });
   } catch (err) {
     if (err.code === 'role_ceiling') {
       return Response.json({ error: 'role_ceiling', message: err.message }, { status: 403 });

package/app/components/dashboard/apply-stream-event.js

@@ -0,0 +1,136 @@
+'use client';
+
+// Shared SSE event reducer for the orchestrator stream.
+//
+// Both the live POST stream (use-stream-command.js) and the Phase-2 attach
+// reconnect (use-stream-command's attach path) funnel every event through this
+// one function so the two paths can never drift. It is intentionally a plain
+// function over a `ctx` bundle of setters + refs — no hooks — so it can run
+// outside React render.
+//
+// ctx shape:
+//   textRef            : { current: string }  — accumulated assistant text
+//   setChat, setLiveText, setAgentPhase, setLiveTool, setLiveSteps,
+//   setUsage, setSessionId, setSessionArtifactId : React setters
+//   sessionIdRef       : { current: string|null }
+//   pendingApprovalsRef: { current: Array<{approval_id,tool_name}> }
+//   bringToFront(id), refresh()
+//   onSession(id)      : optional — called when a `session` event arrives
+//                        (live path persists last-session id here)
+export function applyStreamEvent(eventName, payload, ctx) {
+  const {
+    textRef,
+    setChat,
+    setLiveText,
+    setAgentPhase,
+    setLiveTool,
+    setLiveSteps,
+    setUsage,
+    setSessionId,
+    setSessionArtifactId,
+    sessionIdRef,
+    pendingApprovalsRef,
+    bringToFront,
+    refresh,
+    onSession,
+  } = ctx;
+
+  if (eventName === 'session' && payload.id) {
+    onSession?.(payload.id);
+    if (payload.id !== sessionIdRef.current) setSessionId(payload.id);
+  } else if (eventName === 'cli_stream' && (payload.text || payload.building)) {
+    setAgentPhase(p => p === 'thinking' ? 'responding' : p);
+    setChat(c => {
+      const next = [...c];
+      next[next.length - 1] = { role: 'agent', text: payload.text || '', streaming: true, building: Boolean(payload.building) };
+      return next;
+    });
+  } else if (eventName === 'cli_thinking' && typeof payload.text === 'string') {
+    ctx.setLiveThinking?.(payload.text);
+    setAgentPhase(p => (p === 'responding' || p === 'tool') ? p : 'thinking');
+  } else if (eventName === 'cli_status') {
+    ctx.setLiveStatus?.(payload && payload.phase ? payload : null);
+    if (payload?.phase === 'thinking') {
+      setAgentPhase(p => (p === 'responding' || p === 'tool') ? p : 'thinking');
+    }
+  } else if (eventName === 'text' && payload.delta) {
+    textRef.current += payload.delta;
+    setAgentPhase(p => p === 'thinking' ? 'responding' : p);
+    setLiveText(t => t + payload.delta);
+    setChat(c => {
+      const next = [...c];
+      next[next.length - 1] = { role: 'agent', text: textRef.current };
+      return next;
+    });
+  } else if (eventName === 'tool_start') {
+    setLiveTool(payload.name);
+    setAgentPhase('tool');
+    setLiveSteps(s => [...s, {
+      id: `${payload.name}-${s.length}`,
+      name: payload.name,
+      input: payload.input,
+      status: 'running',
+    }]);
+  } else if (eventName === 'tool_result') {
+    setLiveTool(null);
+    setAgentPhase('synthesis');
+    const isApprovalRequired =
+      payload.output?.status === 'approval_required' &&
+      typeof payload.output?.approval_request_id === 'string';
+    setLiveSteps(s => {
+      const next = [...s];
+      for (let i = next.length - 1; i >= 0; i--) {
+        if (next[i].name === payload.name && next[i].status === 'running') {
+          next[i] = {
+            ...next[i],
+            status: isApprovalRequired
+              ? 'awaiting_approval'
+              : (payload.isError ? 'error' : 'done'),
+            durationMs: typeof payload.durationMs === 'number' ? payload.durationMs : next[i].durationMs,
+            preview: payload.output?.preview || next[i].preview || null,
+            outLines: payload.output?.lines ?? next[i].outLines,
+            approval_id: isApprovalRequired
+              ? payload.output.approval_request_id
+              : next[i].approval_id || null,
+            approval_reason: isApprovalRequired
+              ? (payload.output.reason || null)
+              : null,
+          };
+          break;
+        }
+      }
+      return next;
+    });
+    if ((payload.name === 'create_artifact' || payload.name === 'generate_ui' || payload.name === 'send_to_hermes' || payload.name === 'start_hermes_job') && payload.output?.artifact_id) {
+      bringToFront(payload.output.artifact_id);
+    }
+  } else if (eventName === 'artifacts' && payload.created?.length) {
+    for (const a of payload.created) {
+      if (a.artifact_id) bringToFront(a.artifact_id);
+    }
+    refresh();
+  } else if (eventName === 'agent_created' && payload.agent) {
+    refresh();
+  } else if (eventName === 'session_artifact' && payload.artifact_id) {
+    setSessionArtifactId(payload.artifact_id);
+  } else if (eventName === 'artifact_updated' && payload.artifact_id) {
+    setSessionArtifactId(payload.artifact_id);
+    bringToFront(payload.artifact_id);
+    refresh();
+  } else if (eventName === 'usage') {
+    setUsage(payload);
+  } else if (eventName === 'pending_approvals' && Array.isArray(payload?.approvals)) {
+    for (const a of payload.approvals) {
+      if (a?.approval_id && a?.tool_name) {
+        pendingApprovalsRef.current.push({ approval_id: a.approval_id, tool_name: a.tool_name });
+      }
+    }
+  } else if (eventName === 'error') {
+    textRef.current += `\nError: ${payload.message}`;
+    setChat(c => {
+      const next = [...c];
+      next[next.length - 1] = { role: 'agent', text: textRef.current };
+      return next;
+    });
+  }
+}

package/app/components/dashboard/artifact-board.jsx

@@ -7,7 +7,6 @@ import InactiveIframeShield from './inactive-iframe-shield';
 
 export default function ArtifactBoard({ confirmDeleteId, setConfirmDeleteId, deleteArtifactById, setMoveMenu }) {
   const {
-    artifacts,
     visibleArtifacts,
     frontArtifactId,
     zForArtifact,
@@ -29,8 +28,13 @@ export default function ArtifactBoard({ confirmDeleteId, setConfirmDeleteId, del
 
   return (
     <div ref={setBoardEl} className="canvas-board canvas-board--docked">
-      {visibleArtifacts.map(a => {
-        const stableIdx = artifacts.findIndex(x => x.id === a.id);
+      {visibleArtifacts.map((a, idx) => {
+        // Index INTO the ordered visible list (visibleArtifacts === the layout
+        // hook's orderedVisibleArtifacts()), not a global findIndex across all
+        // spaces/minimized cards. This is the single index source: stableIdx is
+        // always < the space's visible count, so getLayout's default cell is
+        // always defined and never the {16,16} overlap fallback (Bug 1).
+        const stableIdx = idx;
         const L = getLayout(a.id, stableIdx);
         const z = zForArtifact(a);
         const isIframeArtifact = isHtmlArtifact(a.kind);

package/app/components/dashboard/artifact-order.js

@@ -0,0 +1,22 @@
+// Canonical ordering of the artifacts visible on the canvas for a given space.
+//
+// This is the SINGLE source of index assignment for artifact layout. Both the
+// board (first-paint default position) and the layout hook (auto/manual reflow)
+// must derive a card's grid slot from the same ordered list, or the synchronous
+// default disagrees with the async effect and a card flashes at the {16,16}
+// fallback before snapping into place (Bug 1).
+//
+// Filter semantics intentionally mirror `visibleArtifacts` in
+// use-dashboard-state.js exactly: in-space, has content, not minimized. Input
+// order is preserved (stable) so index N always maps to the same card.
+
+export function orderedSpaceArtifacts(artifacts, spaceId, minimizedIds) {
+  if (!Array.isArray(artifacts)) return [];
+  return artifacts.filter(
+    (a) =>
+      a &&
+      a.content &&
+      (a.space_id || 'default') === spaceId &&
+      !minimizedIds?.[a.id]
+  );
+}

package/app/components/dashboard/chat-panel.jsx

@@ -68,6 +68,7 @@ function ChatPanel() {
     openConfig,
     chat,
     mainAgent,
+    agentWorkingRemote,
     setChatHidden,
     setVoiceOpen,
   } = useDashboard();
@@ -409,7 +410,9 @@ function ChatPanel() {
       const cleaned = isAgent && m.streaming ? cleanStreamingPreview(m.text) : m.text;
       const building = isAgent && (m.building || (m.streaming && !cleaned && hasArtifactMarkup(m.text)));
       // Empty agent placeholder — never shown. Live activity below covers it.
-      if (isAgent && !cleaned && !building) return null;
+      // Exception: a restored tool-only turn (no prose) still shows its steps.
+      const hasRestoredTools = isAgent && Array.isArray(m.tools) && m.tools.length > 0;
+      if (isAgent && !cleaned && !building && !hasRestoredTools) return null;
       return (
         <div className={'msg ' + m.role + (m.streaming ? ' msg--streaming' : '') + (building ? ' msg--building' : '')} key={i}>
           {building ? (
@@ -433,6 +436,16 @@ function ChatPanel() {
               ))}
             </div>
           )}
+          {isAgent && Array.isArray(m.tools) && m.tools.length > 0 && (
+            <div className="tool-steps tool-steps--restored">
+              {m.tools.map((step, si) => (
+                <div key={si} className="tool-step tool-step--done">
+                  <span className="tool-step-icon" aria-hidden="true"><CheckIcon /></span>
+                  <code className="tool-step-name">{toolStepDisplayName(step.name)}</code>
+                </div>
+              ))}
+            </div>
+          )}
         </div>
       );
     })}
@@ -491,6 +504,13 @@ function ChatPanel() {
       </div>
     )}
     {busy && liveSteps.length === 0 && !liveStatus && !(liveThinking && liveThinking.trim()) && <div className="typing-indicator"><span /><span /><span /></div>}
+    {!busy && agentWorkingRemote && (
+      <div className="agent-resume-banner" aria-live="polite">
+        <span className="agent-resume-orb" aria-hidden="true" />
+        <span className="agent-resume-label">Agent still working<span className="artifact-building-dots"><i>.</i><i>.</i><i>.</i></span></span>
+        <span className="agent-resume-sub">picking up where you left off</span>
+      </div>
+    )}
   </div>
   </section>
   <div

package/app/components/dashboard/chat-session-view.js

@@ -0,0 +1,26 @@
+// Pure mapping from a persisted chat session (chat_sessions + chat_messages)
+// to the dashboard's in-memory `chat` array shape. No React / network imports
+// so it is unit-testable under raw node ESM.
+
+export function chatStateFromSession(session) {
+  // Keep any user/assistant turn that carried text OR tool calls. Assistant
+  // turns that only ran tools (empty content) are retained so restored history
+  // shows the steps the agent took, not just its final prose.
+  const msgs = (session?.messages || []).filter(m =>
+    (m.role === 'user' || m.role === 'assistant') &&
+    (m.content || (Array.isArray(m.tool_calls) && m.tool_calls.length)));
+  const next = msgs.map(m => {
+    const entry = { role: m.role === 'assistant' ? 'agent' : 'user', text: m.content || '' };
+    if (m.role === 'assistant' && Array.isArray(m.tool_calls) && m.tool_calls.length) {
+      // Restored steps are terminal — they already completed when persisted.
+      entry.tools = m.tool_calls
+        .filter(tc => tc && tc.name)
+        .map(tc => ({ name: tc.name, status: 'done' }));
+    }
+    return entry;
+  });
+  if (!next.length) {
+    next.push({ role: 'agent', text: 'Fresh workspace ready. I am the madarX Main Agent. Tell me what to create first.' });
+  }
+  return next;
+}