pi-straw-boss 0.58.3 → 0.59.0

package/dist/server/main.mjs

@@ -1923,9 +1923,25 @@ function allyPort(link) {
     async taken(id, identity2) {
       await link()?.holder?.taken(id, identity2);
     },
+    delivered(id, run3) {
+      link()?.holder?.delivered(id, run3);
+    },
+    // A device is taken as gone only while the box can tell who is in the team: the policy file reads (a refused one answers `reply` for everybody, g346-F003) and the holder reads the roster. A team the unattended policy
+    // no longer names has no holder run and never will: nobody is in it, so its controllers are gone (g346-F005b).
+    known(team) {
+      const service = link();
+      if (!service) return false;
+      const { mode, config } = service.policyLook();
+      if (mode === "refused") return false;
+      if (mode === "unattended" && !config.teams.has(team)) return service.holder?.active === true;
+      return service.holder?.rosterKnown(team) ?? false;
+    },
     standing(device, team) {
       const service = link();
-      return service?.holder?.isMember(team, device) ? { level: service.levelOf(device) } : void 0;
+      if (!service) return void 0;
+      const { mode, config } = service.policyLook();
+      if (mode === "unattended" && !config.teams.has(team)) return void 0;
+      return service.holder?.isMember(team, device) ? { level: service.levelOf(device) } : void 0;
     },
     project: (team) => link()?.config().teams.get(team)?.project,
     thread: (device) => link()?.store.readThread(device).slice(-THREAD_ROWS).map((r) => ({ dir: r.dir, at: r.at, kind: r.kind, text: r.text })) ?? []
@@ -8017,7 +8033,12 @@ function createGuiHost(o) {
   let forwardNet;
   return {
     /** The hub and a net reading that binds its dialogs, for the forwarder an unattended device runs. */
-    dialogs: () => ({ hub: theHub(), read: async () => void await (forwardNet ??= netSource({ ...o.tower ? { services: (workspace) => o.tower.view(workspace) } : {}, run: cfg.run, world: cfg.world, sessions, hub: theHub() })).read() }),
+    dialogs: () => ({
+      hub: theHub(),
+      read: async () => void await (forwardNet ??= netSource({ ...o.tower ? { services: (workspace) => o.tower.view(workspace) } : {}, run: cfg.run, world: cfg.world, sessions, hub: theHub() })).read(),
+      /** The pane of a unit by the key the hub gives its dialogs (known after a `read`). */
+      paneOf: (key2) => forwardNet?.lookup(key2)?.pane
+    }),
     /** At the server's start: the GUI on the recorded ports unless it was stopped on purpose (which only the boss's own command undoes). */
     async start() {
       theHub().track();
@@ -8411,6 +8432,14 @@ function decodePlaintext(kind, bytes) {
   }
 }
 
+// src/link/scope.ts
+var EVERYONE = "all";
+function reaches(scope, c, admin) {
+  if (scope === "all") return true;
+  if (admin(c.team, c.device) && (scope.team === void 0 || scope.team === c.team)) return true;
+  return scope.device !== void 0 && scope.device === c.device && (scope.team === void 0 || scope.team === c.team);
+}
+
 // src/link/dialogs-out.ts
 var MAX_OPEN2 = 32;
 var MAX_SEEN = 1024;
@@ -8454,6 +8483,15 @@ var DialogForwarder = class {
     })().finally(() => this.polling = void 0);
     return this.polling = run3;
   }
+  /** Whose unit asked: looked up until it is known, then kept. A lookup that fails leaves it unknown, which is the admins' alone. */
+  async whose(d) {
+    if (!this.d.dispatcher || d.who) return;
+    d.who = await this.d.dispatcher(d.key).catch(() => void 0);
+  }
+  /** What the question's controllers are: every controller when the box cannot tell whose units are whose, else the dispatcher and the admins. */
+  scopeOf(d) {
+    return this.d.dispatcher ? d.who ? { device: d.who.device, ...d.who.team !== void 0 ? { team: d.who.team } : {} } : {} : EVERYONE;
+  }
   async pass() {
     const to = this.d.controllers();
     if (!to.length && !this.open.size) return;
@@ -8465,13 +8503,16 @@ var DialogForwarder = class {
       if (Buffer.byteLength(text5) > LIMITS2.dialog) {
         this.skipped.add(id);
         this.d.log({ event: "dialog-oversize", dialog: id, bytes: Buffer.byteLength(text5) });
-        await this.d.notice?.(`oversize/${id}`, { kind: "dialog-oversize", unit: o.key, text: `A question of ${o.owner} was not forwarded: it is ${Buffer.byteLength(text5)} bytes, over the ${LIMITS2.dialog} the link carries. It waits at the device.` });
+        const unit = { key: o.key };
+        await this.whose(unit);
+        await this.d.notice?.(`oversize/${id}`, { kind: "dialog-oversize", unit: o.key, text: `A question of ${o.owner} was not forwarded: it is ${Buffer.byteLength(text5)} bytes, over the ${LIMITS2.dialog} the link carries. It waits at the device.` }, this.scopeOf(unit));
         continue;
       }
       if (this.open.size >= MAX_OPEN2) continue;
       this.open.set(id, { key: o.key, target: o.target, owner: o.owner, text: text5, sent: /* @__PURE__ */ new Map(), away: /* @__PURE__ */ new Set(), claimed: false, since: this.now(), told: false });
     }
     for (const [id, d] of [...this.open]) {
+      await this.whose(d);
       const state = this.d.hub.outcome(id);
       if (!state.open) {
         this.open.delete(id);
@@ -8483,17 +8524,22 @@ var DialogForwarder = class {
         d.unknownAt = void 0;
         d.sent.clear();
       }
+      const mine = to.filter((c) => reaches(this.scopeOf(d), c, this.d.admin ?? (() => false)));
       for (const k of this.d.controllersKnown?.() === false ? [] : [...d.sent.keys()]) {
-        if (to.some((c) => `${c.team}
+        if (mine.some((c) => `${c.team}
 ${c.device}` === k)) continue;
         d.sent.delete(k);
         await this.send(k, "dialog-close", { dialogId: id, by: "withdrawn" });
       }
       if (!d.told && !d.claimed && to.length && this.now() - d.since >= UNANSWERED_MS) {
-        d.told = true;
-        await this.d.notice?.(`unanswered/${id}`, { kind: "dialog-unanswered", unit: d.key, text: `A question of ${d.owner} has waited ${Math.round((this.now() - d.since) / 6e4)} minutes for an answer.` });
+        const sent = await this.d.notice?.(`unanswered/${id}`, { kind: "dialog-unanswered", unit: d.key, text: `A question of ${d.owner} has waited ${Math.round((this.now() - d.since) / 6e4)} minutes for an answer.` }, this.scopeOf(d));
+        d.told = sent !== false;
       }
-      for (const c of to) {
+      if (!mine.length && !d.unrouted) {
+        d.unrouted = true;
+        this.d.log({ event: "dialog-unrouted", dialog: id, unit: d.key, owner: d.owner });
+      }
+      for (const c of mine) {
         const k = `${c.team}
 ${c.device}`;
         const at = d.sent.get(k), up = this.d.online?.(c.team, c.device) ?? true;
@@ -8532,6 +8578,8 @@ ${device}`);
     const drop = (reason) => this.d.log({ event: "drop", reason, kind: "dialog-answer", from: a.from, dialog: a.dialogId });
     const d = this.open.get(a.dialogId);
     if (!d) return drop("dialog-answer-unknown");
+    await this.whose(d);
+    if (!reaches(this.scopeOf(d), { team: a.team, device: a.from }, this.d.admin ?? (() => false))) return drop("dialog-answer-not-recipient");
     if (d.target.answer.digest !== a.digest) return drop("dialog-answer-digest");
     if (!ANSWER_ID2.test(a.answerId) || this.seen.has(a.answerId)) return drop("dialog-answer-id");
     this.seen.add(a.answerId);
@@ -8597,6 +8645,26 @@ ${dialogId}`;
 };
 var newAnswerId = () => randomBytes12(16).toString("hex");
 
+// src/server/dispatcher.ts
+function dispatcherOf(pane, listed2, allyPanes) {
+  const mine = listed2.find((p) => p.pane_id === pane);
+  if (!mine) return void 0;
+  const ally = allyPanes.find((a) => a.pane === pane);
+  if (ally) return { device: ally.device, ...ally.team ? { team: ally.team } : {} };
+  const device = listed2.find((p) => p.tab_id === mine.tab_id && p.tokens?.sb_opened_by?.startsWith("link:"))?.tokens?.sb_opened_by?.replace(/^(link:)+/, "");
+  return device && /^[a-z2-7]{26}$/.test(device) ? { device } : void 0;
+}
+function dispatcherLookup(d) {
+  let listed2;
+  return async (key2) => {
+    const pane = d.paneOf(key2);
+    if (!pane) return void 0;
+    if (!listed2 || d.now() - listed2.at > 2e3) listed2 = { at: d.now(), panes: d.list().catch(() => void 0) };
+    const panes3 = await listed2.panes;
+    return panes3 ? dispatcherOf(pane, panes3, d.allyPanes()) : void 0;
+  };
+}
+
 // src/server/opentower.ts
 import { realpathSync as realpathSync7 } from "node:fs";
 import { basename as basename8 } from "node:path";
@@ -10708,8 +10776,14 @@ var LinkHolder = class {
       ...message.awaitsReply !== void 0 ? { awaitsReply: message.awaitsReply } : {}
     };
     this.o.store.putInbox(item);
+    this.o.store.log({ event: "tower-in", kind: "tower", team: run3.team, from: header2.from, id: item.id, ...message.awaitsReply !== void 0 ? { ask: message.awaitsReply } : {} });
     this.thread(header2.from, { dir: "in", at: item.received, id: item.id, kind: "tower", ...message.awaitsReply !== void 0 ? { awaitsReply: message.awaitsReply } : {}, text: message.text });
   }
+  /** An ally run took the inbox message `id` into its session: one `link.log` line names the run, the sender, the team and the ask, never the text (docs/specs/2026-11-05-link-shared-box.md, Audit). */
+  delivered(id, run3) {
+    const item = this.o.store.readInbox(id);
+    if (item) this.o.store.log({ event: "tower-run", run: run3, team: item.team, from: item.from, id, ...item.awaitsReply !== void 0 ? { ask: item.awaitsReply } : {} });
+  }
   /** A row of a device's thread, under the lock; a store that cannot write it does not lose the message. */
   thread(device, row2) {
     try {
@@ -10742,6 +10816,7 @@ var LinkHolder = class {
       ...taken ? { reply: { ask: message.inReplyTo, main: taken.main, mainName: taken.mainName, tower: taken.tower } } : {}
     };
     this.o.store.putInbox(item);
+    this.o.store.log({ event: "tower-in", kind: "tower-reply", team: run3.team, from: header2.from, id: item.id, ask: message.inReplyTo });
     this.thread(header2.from, { dir: "in", at: item.received, id: item.id, kind: "tower-reply", inReplyTo: message.inReplyTo, text: message.text });
   }
   /** The election's record no longer names this session: nothing is acted on from here, and every stream ends. */
@@ -10895,7 +10970,7 @@ var LinkHolder = class {
     store.log({ event: "tower-open", project, from });
     const attempt = (async () => {
       try {
-        await openTower2(project, toWorkspace);
+        await openTower2(project, toWorkspace, from);
         store.log({ event: "tower-opened", project });
       } catch (error) {
         store.log({ event: "tower-open-failed", project, error: error.message });
@@ -11078,6 +11153,17 @@ ${target.id}`, { text: req.text, at: this.now() });
     }
     return items.sort((a, b) => a.received - b.received || (a.id < b.id ? -1 : 1));
   }
+  /** Whether this holder can tell who is in `team` right now: it runs, the team runs and has not died, and its roster reads. A device is taken as gone only while this is true (the revocation of a controller's mains). */
+  rosterKnown(team) {
+    const run3 = this.runs.get(team);
+    if (!this.running || !run3 || run3.dead) return false;
+    try {
+      this.loadTeam(team);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   /** Whether `device` is a member of `team` on this computer's roster (a run whose sender left is ended). */
   isMember(team, device) {
     try {
@@ -11187,6 +11273,14 @@ ${target.id}`, { text: req.text, at: this.now() });
   dialogControllers() {
     return this.controllerRead().list;
   }
+  /** Whether `device` is an admin of `team`'s roster now (an admin is told every question and notice of the box). False for a team that is not running or a roster that cannot be read. */
+  isAdmin(team, device) {
+    try {
+      return this.loadTeam(team).state.members.get(device)?.role === "admin";
+    } catch {
+      return false;
+    }
+  }
   /** False while the controller list cannot be trusted to be complete (the holder is not running, or a team's roster could not be read): a caller does not withdraw anything then. */
   controllersKnown() {
     return this.controllerRead().known;
@@ -12288,6 +12382,13 @@ function createLinkService({ kit, stateDir, version, started, pid = process.pid,
       return store;
     },
     attended,
+    /** How the policy file reads now: a refused one means the box cannot tell who may do what (g346-F003). */
+    policyMode: () => policy().mode,
+    /** The policy mode and the effective config from one read of the policy file, so the two cannot disagree. */
+    policyLook() {
+      const p = policy();
+      return { mode: p.mode, config: readEffectiveConfig(p, stateDir, { home, agentDir }) };
+    },
     /** The teams and projects of config.json, read fresh. */
     config,
     /** The level this computer gives a device (the policy file's, else `link.trust`, else `reply`): an ally run is claimed at it. */
@@ -13595,11 +13696,11 @@ ${c.device}`, units = mine.map((u) => ({ ...u, report: cutBytes(this.d.report(u.
       }
     }
   }
-  /** Tells every controller, once per `key`; nothing is remembered when there was nobody to tell, so the next trigger with the same key still goes out. */
-  async notify(key2, notice) {
-    if (this.told.has(key2)) return;
-    const to = this.d.controllers();
-    if (!to.length) return;
+  /** Tells the controllers `scope` covers (the dispatcher and the admins; `EVERYONE` for all), once per `key`; nothing is remembered when there was nobody to tell, so the next trigger with the same key still goes out. Resolves whether anybody was addressed. */
+  async notify(key2, notice, scope) {
+    if (this.told.has(key2)) return false;
+    const to = this.d.controllers().filter((c) => reaches(scope, c, this.d.admin ?? (() => false)));
+    if (!to.length) return false;
     this.told.add(key2);
     while (this.told.size > TOLD_MAX) this.told.delete(this.told.values().next().value);
     this.d.log({ event: "notice", key: key2, kind: notice.kind, unit: notice.unit });
@@ -13610,14 +13711,17 @@ ${c.device}`, units = mine.map((u) => ({ ...u, report: cutBytes(this.d.report(u.
         this.d.log({ event: "notice-post-failed", device: c.device, kind: notice.kind, error: String(error.message).slice(0, 200) });
       }
     }
+    return true;
   }
 };
 function runNotice(s2) {
+  const scope = s2.device !== void 0 ? { device: s2.device, ...s2.team !== void 0 ? { team: s2.team } : {} } : {};
   const who = s2.ally ? "An ally run" : "A run";
-  if (s2.kind === "refused") return { key: `refused/${s2.workspace}/${createHash12("sha256").update(s2.text).digest("hex").slice(0, 16)}`, notice: { kind: "run-refused", unit: allyLabel(s2.label), text: s2.text } };
+  if (s2.kind === "revoked") return { key: `revoked/${s2.main}/${s2.ended ? "ended" : s2.manual ? "manual" : "pending"}`, notice: { kind: s2.ended ? "main-revoked" : "main-revoke-pending", unit: allyLabel(s2.label), text: s2.text }, scope };
+  if (s2.kind === "refused") return { key: `refused/${s2.workspace}/${createHash12("sha256").update(s2.text).digest("hex").slice(0, 16)}`, notice: { kind: "run-refused", unit: allyLabel(s2.label), text: s2.text }, scope };
   const trust = s2.detail?.startsWith("No trust decision");
   const kind = trust ? "trust-unanswered" : s2.outcome === "quit" ? "run-quit" : s2.outcome === "timeout" ? "run-timeout" : "run-crashed";
-  return { key: `run/${s2.run}`, notice: { kind, unit: allyLabel(s2.label), text: `${who} ${s2.outcome === "quit" ? "was quit" : s2.outcome === "timeout" ? "timed out" : "crashed"}${s2.detail ? `: ${s2.detail}` : ""}` } };
+  return { key: `run/${s2.run}`, notice: { kind, unit: allyLabel(s2.label), text: `${who} ${s2.outcome === "quit" ? "was quit" : s2.outcome === "timeout" ? "timed out" : "crashed"}${s2.detail ? `: ${s2.detail}` : ""}` }, scope };
 }
 
 // src/server/towerrunstore.ts
@@ -15461,6 +15565,62 @@ function removeAnswer(slot, workspace, id, now) {
   if (was.some((a) => a.id === id)) write(slot, workspace, ANSWERS, was.filter((a) => a.id !== id));
 }
 
+// src/server/revoke.ts
+var GONE = /No live session is named|is not in this workspace|is not a main agent|was not opened by a tower/;
+function createRevoker(d) {
+  const told = /* @__PURE__ */ new Set();
+  let low = /* @__PURE__ */ new Set();
+  let goneSeen = /* @__PURE__ */ new Map();
+  let running;
+  const pass = async () => {
+    const now = /* @__PURE__ */ new Set(), gone = /* @__PURE__ */ new Map();
+    for (const row2 of d.opened()) {
+      if (row2.level !== void 0 && row2.level !== "dispatch") continue;
+      if (!d.known(row2.team)) continue;
+      const standing = d.standing(row2.device, row2.team);
+      if (standing?.level === "dispatch") continue;
+      now.add(row2.main);
+      if (!low.has(row2.main)) continue;
+      const why = standing ? "the device lost dispatch" : "the device left the team", who = `The main "${row2.name}" opened for ${row2.deviceLabel}`;
+      try {
+        await d.close(row2.workspace, row2.main);
+      } catch (cause) {
+        const reason = cause.message;
+        if (GONE.test(reason)) {
+          const seen = (goneSeen.get(row2.main) ?? 0) + 1;
+          gone.set(row2.main, seen);
+          if (seen < 2) continue;
+          if (await d.paneGone(row2.workspace, row2.pane)) {
+            d.log({ event: "revoke-gone", workspace: row2.workspace, main: row2.main });
+            d.forget(row2.workspace, row2.main);
+            gone.delete(row2.main);
+            continue;
+          }
+        }
+        const manual = /was not opened by a tower/.test(reason), key2 = `${row2.main}/${manual ? "manual" : "pending"}`;
+        d.log({ event: "revoke-waiting", workspace: row2.workspace, main: row2.main, why });
+        if (!told.has(key2)) {
+          const sent = await d.signal({ kind: "revoked", workspace: row2.workspace, label: row2.label, ally: true, device: row2.device, ...row2.team ? { team: row2.team } : {}, main: row2.main, ended: false, ...manual ? { manual: true } : {}, text: manual ? `${who} still runs and cannot be ended by the box (${reason}). Close it by hand.` : `${who} could not be ended yet (${reason}). The box asks again until it quits.` });
+          if (sent !== false) {
+            told.add(key2);
+            while (told.size > 256) told.delete(told.values().next().value);
+          }
+        }
+        continue;
+      }
+      d.log({ event: "revoke-ended", workspace: row2.workspace, main: row2.main, why });
+      d.forget(row2.workspace, row2.main);
+      d.signal({ kind: "revoked", workspace: row2.workspace, label: row2.label, ally: true, device: row2.device, ...row2.team ? { team: row2.team } : {}, main: row2.main, ended: true, text: `${who} was ended: ${why}.` });
+    }
+    low = now;
+    goneSeen = gone;
+  };
+  return {
+    /** One look at every opened main; looks that overlap share the one in flight. A failure is logged and the next sweep tries again. */
+    sweep: () => running ??= pass().catch((cause) => d.log({ event: "revoke-failed", error: cause.message.slice(0, 200) })).finally(() => running = void 0)
+  };
+}
+
 // src/server/runs.ts
 import { randomBytes as randomBytes17 } from "node:crypto";
 import { lstatSync as lstatSync7, realpathSync as realpathSync10 } from "node:fs";
@@ -15991,7 +16151,7 @@ function createRuns2(o) {
       release();
       svc.refusedAt = now();
       noticeOf(svc, { id: "settings", level: "error", kind: "settings", text: `A run could not start: ${cause.message}` });
-      o.signal?.({ kind: "refused", workspace: svc.ref.workspace, label: svc.ref.record().label, ally: true, text: `A run could not start: ${cause.message}` });
+      o.signal?.({ kind: "refused", workspace: svc.ref.workspace, label: svc.ref.record().label, ally: true, text: `A run could not start: ${cause.message}`, device, team: first2.team });
       log.line("run-refused", { workspace: svc.ref.workspace, why: "settings", kind: "ally" });
       return;
     }
@@ -16202,7 +16362,7 @@ function createRuns2(o) {
     a.rec.outcome = outcome;
     a.rec.endedAt = iso2(now());
     if (detail) a.rec.detail = phrase4(detail, 200);
-    if (outcome === "crashed" || outcome === "timeout" || outcome === "quit") o.signal?.({ kind: "ended", run: a.rec.id, workspace: ws, label: svc.ref.record().label, ally: a.rec.kind === "ally", outcome, ...detail ? { detail: phrase4(detail, 200) } : {} });
+    if (outcome === "crashed" || outcome === "timeout" || outcome === "quit") o.signal?.({ kind: "ended", run: a.rec.id, workspace: ws, label: svc.ref.record().label, ally: a.rec.kind === "ally", outcome, ...detail ? { detail: phrase4(detail, 200) } : {}, ...a.rec.kind === "ally" && a.rec.device ? { device: a.rec.device, ...a.rec.team ? { team: a.rec.team } : {} } : {} });
     try {
       writeRun(slot, a.rec);
       pruneRuns(slot, ws);
@@ -16324,7 +16484,7 @@ function createRuns2(o) {
           const orphan = a.rec.hand === true && !a.polled && a.pending === void 0 && a.closing === void 0;
           const outcome = a.pending ?? (a.closing !== void 0 ? "done" : orphan ? "quit" : "crashed");
           if (outcome === "crashed" && diedWithHerdr(a)) continue;
-          await finish(a, outcome, outcome === "crashed" ? "pi exited without tower_done" : orphan ? "the pi left before its first poll" : void 0, a.left === true);
+          await finish(a, outcome, outcome === "crashed" ? "pi exited without tower_done" : orphan ? "the pi left before its first poll" : a.why, a.left === true);
           continue;
         }
         if (a.recovering !== void 0) {
@@ -16353,9 +16513,18 @@ function createRuns2(o) {
         if (!a.token) continue;
         if (a.rec.kind === "ally" && !standingOf(a)) {
           log.line("ally-ended", { workspace: a.rec.workspace, run: a.rec.id, why: "the sender left the roster" });
+          a.why = "the sender left the team";
           terminate(a, "quit");
           continue;
         }
+        const low = a.rec.kind === "ally" && a.rec.level === "dispatch" && o.ally?.known?.(a.rec.team ?? "") !== false && standingOf(a)?.level !== "dispatch";
+        if (low && a.lowSeen) {
+          log.line("ally-ended", { workspace: a.rec.workspace, run: a.rec.id, why: "the sender lost dispatch" });
+          a.why = "the sender lost dispatch";
+          terminate(a, "quit");
+          continue;
+        }
+        a.lowSeen = low;
         if (now() - a.lastPoll > t.lost) {
           log.line("run-lost", { run: a.rec.id });
           terminate(a, "crashed");
@@ -16526,6 +16695,7 @@ function createRuns2(o) {
     a.offered.delete(event.id);
     a.rec.events.push(event.id);
     writeRun(slot, a.rec);
+    if (a.rec.kind === "ally") o.ally?.delivered?.(event.id, a.rec.id);
     if (event.kind === "boss") bossTurn(a);
     return { ok: true };
   }
@@ -16790,7 +16960,7 @@ function createRuns2(o) {
       const a = of(token);
       if (a && !a.ended && a.rec.kind === "ally") {
         const standing = standingOf(a);
-        if (!standing) terminate(a, "quit");
+        if (!standing) a.why ??= "the sender left the team", terminate(a, "quit");
         return { id: a.rec.id, workspace: a.rec.workspace, kind: "ally", ...standing ? { level: standing.level } : { gone: true }, ...a.rec.device ? { device: a.rec.device } : {}, ...a.rec.deviceLabel ? { deviceLabel: a.rec.deviceLabel } : {}, ...a.rec.deviceShort ? { deviceShort: a.rec.deviceShort } : {}, ...a.rec.team ? { team: a.rec.team } : {}, ...a.rec.teamName ? { teamName: a.rec.teamName } : {}, pane: a.rec.pane, asks: itemsOf(a, true).flatMap((i) => i.awaitsReply ? [i.awaitsReply] : []) };
       }
       return a && !a.ended ? { id: a.rec.id, workspace: a.rec.workspace, kind: headRun(a) ? "head" : a.rec.kind, ...a.rec.level ? { level: a.rec.level } : {}, ...a.rec.device ? { device: a.rec.device } : {}, ...a.rec.deviceLabel ? { deviceLabel: a.rec.deviceLabel } : {}, ...a.rec.team ? { team: a.rec.team } : {}, pane: a.rec.pane, asks: itemsOf(a, true).flatMap((i) => i.awaitsReply ? [i.awaitsReply] : []) } : void 0;
@@ -16911,6 +17081,8 @@ function createRuns2(o) {
         parked: readQueue(slot, workspace, true).map((e) => ({ id: e.id, kind: e.kind, ...e.from?.name ?? e.from?.id ? { from: e.from?.name ?? e.from?.id } : {}, first: phrase4(e.text.split("\n").find((l) => l.trim()) ?? "", 120) }))
       };
     },
+    /** The panes of the live ally runs, with the device each serves and its team: the units a controller dispatched (a question asked in one is that controller's). */
+    allyPanes: () => [...services.values()].flatMap((svc) => [...svc.allies.values()].filter((a) => !a.ended && a.rec.pane && a.rec.device).map((a) => ({ pane: a.rec.pane, device: a.rec.device, ...a.rec.team ? { team: a.rec.team } : {} }))),
     /** The waiting events of a workspace for the GUI's queue rows. */
     queue: (workspace) => {
       const s2 = find2(workspace);
@@ -17087,6 +17259,7 @@ var UNKNOWN = "(unknown)";
 var RUN_SEND_CAP_MS = 2e4;
 var RETRY_MS3 = [1e3, 2e3, 5e3, 1e4, 3e4];
 var REPUBLISH_MS = 300;
+var REVOKE_MS = 15e3;
 var REFRESH_MS2 = 4 * 6e4;
 var RECOVER_MS = 6e4;
 var RECOVER_POLL_MS = 2e3;
@@ -17216,10 +17389,14 @@ function createTowers(o) {
     standing: (device, team) => o.ally.standing(device, team),
     project: (team) => o.ally.project(team),
     thread: (device) => o.ally.thread(device),
+    known: (team) => o.ally.known?.(team) ?? true,
     waiting: (identity2) => {
       const ws = workspaceOf(identity2), answers2 = ws ? readAnswers(slot, ws, now()).map((a) => ({ id: `${LOCAL}${a.id}`, device: a.device, label: a.label, short: a.short, team: a.team, teamName: a.teamName, fromWorkspace: "", replyExpected: false, text: a.text, at: a.at, local: a.from, ...a.ask ? { awaitsReply: a.ask } : {} })) : [];
       return [...o.ally.waiting(identity2), ...answers2].sort((a, b) => a.at - b.at);
     },
+    delivered: (id, run4) => {
+      if (!id.startsWith(LOCAL)) o.ally.delivered?.(id, run4);
+    },
     taken: async (id, identity2) => {
       const ws = workspaceOf(identity2);
       if (!id.startsWith(LOCAL)) return o.ally.taken(id, identity2);
@@ -17691,6 +17868,7 @@ function createTowers(o) {
         error("purge", cause.message);
       }
     }, o.refreshMs ?? REFRESH_MS2));
+    timers2.push(setInterval(() => void revoker.sweep(), o.revokeMs ?? REVOKE_MS));
     const poll = o.recoverPollMs ?? RECOVER_POLL_MS;
     timers2.push(setInterval(() => {
       if (now() < recoverUntil + poll) look2();
@@ -17856,6 +18034,25 @@ function createTowers(o) {
     }
     return closed;
   };
+  const revoker = createRevoker({
+    opened: () => o.ally ? [...services.values()].filter((l) => !l.stopped && l.state === "live" && l.control && !isHeadL(l)).flatMap((l) => readRoutes(slot, l.record.workspace, now()).filter((r) => r.kind === "opened").map((r) => ({ workspace: l.record.workspace, label: l.record.label, main: r.to, name: r.name, device: r.device, deviceLabel: r.label, team: r.team, ...r.level ? { level: r.level } : {}, ...r.pane ? { pane: r.pane } : {} }))) : [],
+    known: (team) => o.ally?.known?.(team) ?? true,
+    standing: (device, team) => o.ally?.standing(device, team),
+    close: async (workspace, main) => void await need(workspace).control.closeMain(main),
+    paneGone: async (workspace, pane) => {
+      if (!pane) return false;
+      try {
+        const net = await need(workspace).reach.read();
+        return !net.ps.some((p) => p.pane_id === pane);
+      } catch {
+        return false;
+      }
+    },
+    // Herdr's listing is the second witness that a main is gone; no pane or a failed read confirms nothing
+    forget: (workspace, main) => void forgetClosed(workspace, { main }),
+    signal: (s2) => o.runs?.signal?.(s2),
+    log: ({ event, ...rest }) => log.line(String(event), rest)
+  });
   const answered = answeredAsks(now);
   const runToolFor = async (request) => {
     const who = runs2.runOf(request.token);
@@ -17865,7 +18062,7 @@ function createTowers(o) {
     const peer = who.kind === "ally" && who.device && who.team ? { device: who.device, label: who.deviceLabel ?? who.device.slice(0, 6), short: who.deviceShort ?? who.device.slice(0, 6), team: who.team, teamName: who.teamName ?? who.team.slice(0, 6) } : void 0;
     const route = (to, name3, kind, ask, live, panes3, pane) => {
       try {
-        addRoute(slot, ws, { ...peer, to, name: name3, kind, at: now(), ...ask ? { ask } : {}, ...pane ? { pane } : {} }, now(), live, panes3);
+        addRoute(slot, ws, { ...peer, to, name: name3, kind, at: now(), ...ask ? { ask } : {}, ...pane ? { pane } : {}, ...kind === "opened" && who.level ? { level: who.level } : {} }, now(), live, panes3);
       } catch (cause) {
         error("ally-route", cause.message);
       }
@@ -18627,9 +18824,9 @@ async function runServer(o) {
     ...o.towers,
     // A seam that watches the runs (tests) sees every signal too, and does not take the place of the notice to the controllers.
     runs: { ...o.towers?.runs, signal: (sig) => {
-      const r = runNotice(sig);
-      void reporter?.notify(r.key, r.notice);
+      const r = runNotice(sig), sent = reporter?.notify(r.key, r.notice, r.scope);
       o.towers?.runs?.signal?.(sig);
+      return sent;
     } }
   });
   stops.push(cfg.watch(() => {
@@ -18648,7 +18845,10 @@ async function runServer(o) {
     }
   }), o.herdrPollMs ?? HERDR_POLL_MS));
   const dialogsOut = () => forwarder ??= new DialogForwarder({
-    ...guiHost.dialogs(),
+    hub: guiHost.dialogs().hub,
+    read: guiHost.dialogs().read,
+    dispatcher: dispatcherLookup({ paneOf: (key2) => guiHost.dialogs().paneOf(key2), list: () => panes(cfg.run), allyPanes: () => towers?.runs.allyPanes() ?? [], now }),
+    admin: (team, device) => link?.holder?.isAdmin(team, device) ?? false,
     controllers: () => link?.holder?.dialogControllers() ?? [],
     online: (team, device) => link?.holder?.deviceOnline(team, device) ?? false,
     controllersKnown: () => link?.holder?.controllersKnown() ?? false,
@@ -18658,11 +18858,12 @@ async function runServer(o) {
     },
     log: ({ event, ...rest }) => log.line(String(event), Object.fromEntries(Object.entries(rest).map(([k, v]) => [k, typeof v === "number" || typeof v === "boolean" ? v : phrase6(v, 200)]))),
     now,
-    notice: (key2, notice) => unitsOut().notify(key2, notice)
+    notice: (key2, notice, scope) => unitsOut().notify(key2, notice, scope)
   });
   const unitWorkspaces = /* @__PURE__ */ new Map();
   const unitsOut = () => reporter ??= new UnitReporter({
     controllers: () => link?.holder?.dialogControllers() ?? [],
+    admin: (team, device) => link?.holder?.isAdmin(team, device) ?? false,
     // Per team: the units whose workspace has a pane inside that team's project, when its policy shares status. Labels and monitor commands leave this computer, so they pass the same scrub as a board's.
     units: async (team) => {
       const policy = link?.holder?.policyOf(team), rows = towers?.status() ?? [];
@@ -18714,11 +18915,11 @@ ${unit}`), note = ws ? readNotes(slot, ws).at(-1) : void 0, sent = ws ? link?.ho
         asks: { take: (q) => asks.take(q) },
         served: (identity2) => towers?.allyWaiting(identity2),
         confirmed: (to, dialogId, allow) => towers?.runs.confirmed(dialogId, allow) ?? false,
-        openTower: async (project, toWorkspace) => {
+        openTower: async (project, toWorkspace, from) => {
           try {
             await openTower({ run: cfg.run, towers: () => towers, now, home: o.link?.home ?? homedir12(), agentDir: env.PI_CODING_AGENT_DIR ?? join44(o.link?.home ?? homedir12(), ".pi", "agent") }, project, toWorkspace);
           } catch (error) {
-            void unitsOut().notify(`tower-open/${project}/${Math.floor(now() / 6e5)}`, { kind: "tower-open-failed", unit: allyLabel(project), text: `Could not open a tower for ${project}: ${error.message}` });
+            void unitsOut().notify(`tower-open/${from}/${project}/${Math.floor(now() / 6e5)}`, { kind: "tower-open-failed", unit: allyLabel(project), text: `Could not open a tower for ${project}: ${error.message}` }, { device: from });
             throw error;
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-straw-boss",
-  "version": "0.58.3",
+  "version": "0.59.0",
   "description": "Straw Boss coordination for pi in Herdr: sessions join a tab's net by choice, the first joiner is its main agent, a workspace tower opens on demand with a live monitoring dashboard, and boss_broadcast reaches the rest",
   "type": "module",
   "license": "MIT",

package/prompts/apps-config.md

@@ -4,7 +4,7 @@ The project's managed apps live in `.straw-boss/apps.json` at the git root, or i
 
 ```json
 {"integration": {"skill": "integrate", "maxCars": 4, "maxWaitMin": 60},
- "apps": [{"name": "api", "dir": "apps/api", "match": ["backend", "rest api"], "integration": {"base": "develop"}}]}
+ "apps": [{"name": "api", "dir": "apps/api", "match": ["backend", "rest api"], "integration": {"base": "develop", "stages": ["merge", "deploy", "uat"], "targets": {"test-env": "auto"}}}]}
 ```
 
 | Field | Meaning |
@@ -16,7 +16,7 @@ The project's managed apps live in `.straw-boss/apps.json` at the git root, or i
 | `localFiles` | Gitignored files a new worktree needs, each with `path` relative to `dir`; copy them before launch. A `sensitive: true` file is copied only under the user's authorization, and an entry without `optional: true` that is missing blocks the launch. |
 | `crossAppSkills` | `withApp` and `skill`: an existing skill that handles this app depending on `withApp`; name it in the brief. |
 | `integration` (top level) | The project's merge train defaults: `skill` is the name of the project skill that holds the concrete checks (a name, as `gitWorkflowSkill` is), `maxCars` (default 4) and `maxWaitMin` (default 60) say when a train departs; the skill may override them. |
-| `integration` (per app) | `base` is the integration branch; `skill` overrides the project's. Only an app with this field takes the merge train; an app without it keeps today's flow, and the main merges after its own checks. |
+| `integration` (per app) | `base` is the integration branch; `skill` overrides the project's; `stages` lists, in order, what the integrator carries each train through: `merge` (the default, always first), then optionally `deploy`, then `uat` (only after `deploy`); `targets` maps a deploy target to `auto` (every train deploys there with no per-car authorization: the boss's standing word, so only the boss sets it: a main adds or widens an `auto` entry only with the boss's words for it quoted in the commit message) or `strict` (only cars whose slip `auth` names it; the default for an unlisted target). Only an app with this field takes the merge train; an app without it keeps today's flow, and the main merges after its own checks. |
 
 ## Merge train
 
@@ -31,7 +31,10 @@ The skill is found by the headings below, exactly as written. Straw-boss reads n
 | `## Full gates` | integrator | The heavy checks, which depend on the clock (run at low load), and which failures may be rerun as flakes. |
 | `## Merge` | integrator | How the train enters the base branch. |
 | `## Post-merge` | integrator | What to watch after the merge, how to confirm the release, who closes tickets. |
+| `## Deploy` | integrator | Stage `deploy`: how the train reaches each target, in what order, what a target needs beyond the slip's auth, and how a failed one is rolled back. |
+| `## Deploy verify` | integrator | Stage `deploy`: what shows a target runs the train's own version. |
+| `## UAT` | coordinator, integrator | Stage `uat`: which cars carry checkpoints, where and how the deployed result is captured and by whom, and whether a car the boss comments on is reverted before its fix. |
 | `## Urgent lane` | integrator | Optional: when a car may jump the queue, and whether it may interrupt a running gate. |
 | `## Load` | integrator | Optional: the project's lock name and load thresholds. |
 
-`Light checks`, `Full gates`, and `Merge` are required. If one is missing, the integrator does not depart and calls the tower with `why=blocked`; it never guesses a section.
+`Light checks`, `Full gates`, and `Merge` are required, and so is each heading of a stage an app declares. If one is missing, the integrator does not depart and calls the tower with `why=blocked`; it never guesses a section.

package/prompts/integrator.md

@@ -1,12 +1,12 @@
 # Integrator
 
-You are the integrator of one project: the single main that merges its coordinators' cars into the integration branch of each app with an `integration` field (apps-config.md beside this file). You are a main, not the tower. The project's skill (apps-config `integration.skill`) holds every concrete check: read its headings `Light checks`, `Train assembly`, `Full gates`, `Merge`, `Post-merge`, `Urgent lane`, `Load`; add nothing it does not say. If `Light checks`, `Full gates`, or `Merge` is missing, do not depart: `call_tower` with `why=blocked` and name the config error.
+You are the integrator of one project: the single main that takes its coordinators' cars, for each app with an `integration` field (apps-config.md beside this file), through the stages the app's `stages` list in order: `merge` into its integration branch, then `deploy`, then `uat`. You are a main, not the tower. The project's skill (apps-config `integration.skill`) holds every concrete check: read its headings `Light checks`, `Train assembly`, `Full gates`, `Merge`, `Post-merge`, `Deploy`, `Deploy verify`, `UAT`, `Urgent lane`, `Load`; add nothing it does not say. If `Light checks`, `Full gates`, or `Merge` is missing, or a declared stage lacks its own (`deploy`: `Deploy` and `Deploy verify`; `uat`: `UAT`), do not depart: `call_tower` with `why=blocked` and name the config error.
 
 ## Rules
 
-- You cannot create the boss's authorization: merge nothing whose car lacks a quote of one that covers the integration branch.
-- Only you merge into the integration branch and claim `pre-dev/<code>`. Your own merges and pushes need no `shared` call: the slips' auth covers them.
-- Name: `boss_rename` yourself `integ <project>` (16 characters at most: shorten the project) and never rename again. Keep a ledger at `~/.pi/agent/straw-boss/trains/<project>/<app>.json` (car, tickets, SHAs, stage) and one todo per train.
+- You cannot create the boss's authorization: merge nothing whose car lacks a quote of one that covers the integration branch. A deploy target is `auto` or `strict` by the app's `integration.targets` (unlisted: `strict`): an `auto` target takes every train, the config being the boss's standing word; a `strict` one only cars whose `auth` names it.
+- Only you merge into the integration branch and claim `pre-dev/<code>`. Your own merges, pushes, and merge-triggered deploys need no `shared` call: the slips' auth covers them. A deploy you start yourself still calls `shared` naming the target, so the tower can see a clash.
+- Name: `boss_rename` yourself `integ <project>` (16 characters at most: shorten the project) and never rename again. Keep a ledger at `~/.pi/agent/straw-boss/trains/<project>/<app>.json` (car, tickets, SHAs, stage, deployed versions per target, UAT verdicts) and one todo per train.
 
 ## Receiving a car
 
@@ -16,19 +16,28 @@ A car slip is one block, and one missing field returns it:
 car: <app> | tickets: <ids> | branch: <name> | head: <sha40> | tested-on: <base sha>
 review: P0=0 P1=0 (<report path>) | light: pass (<commands and result per Light checks>)
 migrations: <names or none> (applied to a DB: no|<which>) | lane: normal|urgent (<ground for urgent>)
+deploy: <targets or none> | uat: <checkpoints path or none>
 auth: "<the boss's words>" | coordinator: <session id>
 ```
 
-Check: `head` is still the branch tip, `auth` covers the integration branch, `review` has a report path, and no migration is applied to a DB (the rebase tool cannot regenerate it): else return the car to its coordinator. Answer the coordinator with the train number and departure conditions.
+Check: `head` is still the branch tip, `auth` covers the integration branch and every `strict` target in `deploy`, `review` has a report path, a `uat` file lists per checkpoint its flow, state, steps, and expected result and comes with a target (`deploy` or an `auto` one), and no migration is applied to a DB (the rebase tool cannot regenerate it): else return the car to its coordinator. Answer the coordinator with the train number and departure conditions.
 
 ## Departure and assembly
 
 - Depart when the train reaches `maxCars` (default 4), or its oldest car has waited `maxWaitMin` (default 60), or every coordinator awaited has arrived; the skill's `Load` allows it (if omitted: wait while the 1-minute load exceeds the core count); and the integration branch's pipeline is not red.
 - Assemble on a local `train/<code>` from the latest base, in a worktree at `~/.herdr/worktrees/<repo>/train-<code>`: `merge --no-ff` each car in arrival order. Resolve plain conflicts and log them; a semantic conflict goes back to the later car. Run `Train assembly`.
-- A fresh-context `reviewer` reviews `train/<code>` against the base for interactions between cars, conflict resolutions, and migration order. P0 or P1 of one car goes back to it; of assembly, you fix it. Then run `Full gates` once per train. Green: `Merge`. Push `pre-dev/<code>` only after green: a dropped car is a local rebuild and nothing is force pushed.
+- A fresh-context `reviewer` reviews `train/<code>` against the base for interactions between cars, conflict resolutions, and migration order. P0 or P1 of one car goes back to it; of assembly, you fix it. Then run `Full gates` once per train. Green: `Merge`, then `Post-merge`. Push `pre-dev/<code>` only after green: a dropped car is a local rebuild and nothing is force pushed.
 - Red: the skill's `Full gates` says how to find the guilty car. Drop it, rebuild from the rest. Whenever the head changes (a dropped car, or a post-push `git revert -m1` of a car's merge commit), the new head goes through `Train assembly` again, the reviewer rechecks it (delta brief), then `Full gates`; after a revert, the same before `Merge`. Tell that coordinator: car, failing tests, log path, `train` SHA; it hands over a new SHA. If its session is gone, `call_tower` with `why=blocked`.
-- `urgent` is only the boss's explicit "first" or a P0 production fix; it still gets review and gates.
+- `urgent` is only the boss's explicit "first" or a fix of a P0 defect in a live deploy target; it still gets review and gates.
 
-## After the merge
+## Deploy
 
-Run `Post-merge`; tell each coordinator by intercom "landed in <version>, your commit is <sha>"; it closes its ticket (you, only if its session is gone). When the queue and your post-merge work are empty, `call_tower` with `why=milestone`, reply false, saying idle; the tower closes you.
+Stage `deploy`, after `Post-merge`: run `Deploy` for each `auto` target and each target the slips name, in the order the skill gives. A `strict` target takes the train only when every car in it has `auth` naming it (a deploy ships every car); else skip it and ask the boss with your question tool whether to deploy it or hold those cars; a held car is not landed; held before `Merge`, it leaves the train as a dropped car does. Where merging deploys a `strict` target, ask before `Merge`. One train at a time per target: a later train waits for the earlier one's `Deploy verify`, and where merging deploys a target (the skill says), the next train's `Merge` waits for it too. First do what the skill adds per target, then run `Deploy verify` per target: done is the target running the train's own version, as the skill shows it; a green job, an accepted request, or a finished monitor is not done. A failed target follows the skill's `Deploy` (rollback, retry); its car goes back as a red one does.
+
+## UAT
+
+Stage `uat`, after `Deploy verify`: run `UAT` for the cars with a `uat` file, on the deployed result. One page per train, one `review` block: an item per checkpoint, `label` `<ticket>: <flow>, <state>`, `body` its steps and expected result. Open it with `show_doc` (`view: "page"`) once ready; a blank box means accepted. A later train may deploy meanwhile; captures are the record. A comment returns its car: send its coordinator comments, captures, version; `UAT` says whether to revert first; a revert on the base goes as its own train through review, `Full gates`, `Merge`, and `Deploy`. The fix comes back as a new car whose commented checkpoints are captured again, or all of its checkpoints after a revert.
+
+## After the train
+
+When a car has no stage left, tell its coordinator by intercom "landed in <version>, your commit is <sha>", adding "accepted in UAT" for a `uat` car; it closes its ticket (you, only if its session is gone). When the queue is empty, no stage runs, and no UAT page waits, `call_tower` with `why=milestone`, reply false, saying idle; the tower closes you.