toolroll 0.9.103 → 0.9.105

package/dist/server/http.js

@@ -23,17 +23,8 @@ import { matchRoute } from "./route-table.js";
 import {} from "../folder-look.js";
 import {} from "../project-identity.js";
 import {} from "../learning-look.js";
-// A note is at most NOTE_BYTE_CAP (16,000) UTF-8 bytes, which URL encoding
-// can triple: room for one whole, before canonical text validation.
 export const BODY_CAP = 64 * 1024;
-/** How long a stop waits for subagents and the lead's follow pass before closing anyway. */
 export const SHUTDOWN_WAIT_MS = 5_000;
-// ---- path plumbing ---------------------------------------------------------
-/**
- * Match `/t/<id>` (suffix "") or `/t/<id>/<verb>` — the id percent-decoded
- * exactly once, refused when it does not decode, is oversized, or carries
- * control characters. Legacy CLI-created ids are free-form; the URL is not.
- */
 export function matchTaskPath(pathname, suffixPattern) {
     const match = new RegExp(`^/t/([^/]+)${suffixPattern === "" ? "$" : suffixPattern}`).exec(pathname);
     if (match === null)
@@ -55,7 +46,6 @@ export function taskHref(taskId) {
 export function runHref(runId) {
     return `/r/${Math.trunc(runId)}`;
 }
-// ---- rendering -------------------------------------------------------------
 export const SAFETY = {
     "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
     "X-Content-Type-Options": "nosniff",
@@ -63,12 +53,8 @@ export const SAFETY = {
     "Cache-Control": "no-store",
 };
 export function respond(response, status, type, body) {
-    // A route that set its OWN policy (the service worker's default-src
-    // 'none') or its own caching (the pre-auth assets) keeps it —
-    // writeHead's headers would otherwise win.
     const own = response.getHeader("content-security-policy");
     const cache = response.getHeader("cache-control");
-    // The first-account form's page sends `same-origin` so its own post names this console (signup-gate.ts).
     const referrer = response.getHeader("referrer-policy");
     response.writeHead(status, {
         ...SAFETY,
@@ -79,33 +65,17 @@ export function respond(response, status, type, body) {
     });
     response.end(isHtml(body) ? htmlString(body) : body);
 }
-/**
- * A page response. With a nonce, this response's CSP admits exactly the one
- * inline script the shell stamped with the same value — generated per
- * response, never shared, never 'unsafe-inline' (Codex board review,
- * finding 9). Everything else keeps the constant script-free policy.
- */
 export function page(response, status, document, nonce, fetches) {
     if (nonce === undefined)
         return respond(response, status, "text/html; charset=utf-8", document);
     response.writeHead(status, {
         ...SAFETY,
         "Content-Security-Policy": `default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; script-src 'nonce-${nonce}'; ` +
-            // connect-src only when the page's script actually fetches (a region
-            // poller, the full chrome beat, or the minimal sensitive-page beat).
             `${fetches === true ? "connect-src 'self'; " : ""}form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
         "Content-Type": "text/html; charset=utf-8",
     });
     response.end(htmlString(document));
 }
-/**
- * An outside sign-in comes back only to the browser that started it: the
- * start leaves the visit's state in this cookie (Lax, so it rides the
- * service's redirect back; the session cookie is Strict and doesn't), and a
- * return whose state isn't the one this browser holds is refused. So nobody
- * can start a sign-in and have someone else finish it into their project.
- */
-/** A moment's page on the way to or back from another site's sign-in: no stylesheet may load there, so the palette rides inline. */
 export const HANDOFF_STYLE = html `<style>body{font:15px/1.5 "Geist",system-ui,sans-serif;margin:2rem;background:#efefef;color:#171717}a{color:#171717;text-decoration-color:#8f8f8f;text-underline-offset:3px}@media(prefers-color-scheme:dark){body{background:#0b0b0b;color:#ededed}a{color:#ededed;text-decoration-color:#ff6fb5}}</style>`;
 export const SIGN_IN_COOKIE = "so-sign-in";
 export function startedHere(request, state) {
@@ -113,36 +83,26 @@ export function startedHere(request, state) {
     return held !== undefined && held.length === state.length && timingSafeEqual(Buffer.from(held), Buffer.from(state));
 }
 export const signInSpent = (path) => `${SIGN_IN_COOKIE}=; Path=${path}; Max-Age=0; HttpOnly; SameSite=Lax`;
-/**
- * Off to another site's sign-in (Google, a service's one-click connection):
- * a page that moves on by itself. Not a redirect: every page's form-action
- * 'self' also covers where a form's answer redirects, so a browser stops a
- * form that is answered with another site's address.
- */
 export function goOutside(response, to, words, bind) {
     response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
         "set-cookie": `${SIGN_IN_COOKIE}=${bind.state}; Path=${bind.path}; Max-Age=900; HttpOnly; SameSite=Lax${bind.secure ? "; Secure" : ""}`,
         "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" });
     response.end(htmlString(html `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${to}"><title>Toolroll</title>${HANDOFF_STYLE}<p>${words} <a href="${to}">Continue</a></p>`));
 }
-/** A form's answer: back to `page` (which may carry its own query) saying `said` or `problem` words, then an anchor. */
 export function sayTo(response, page, anchor = "") {
     const join = page.includes("?") ? "&" : "?";
     return (key, words, at = anchor) => redirect(response, `${page}${join}${key}=${encodeURIComponent(words)}${at}`);
 }
 export function redirect(response, to) {
-    // Set as a header (not only in writeHead) so the answer can be read back after: a refused act's redirect names it.
     response.setHeader("Location", to);
     response.writeHead(303, { ...SAFETY });
     response.end();
 }
 export const taskChatHref = (taskId) => `/chat?task=${encodeURIComponent(taskId)}`;
-/** A project's own lead thread (v77). */
 export const projectChatHref = (repo) => `/chat?project=${encodeURIComponent(repo)}`;
 export function safeReturn(raw) {
     if (raw === null || raw === undefined)
         return "/";
-    // A backslash is a slash to a browser's URL parser (`/\evil` → `//evil`), so it is refused too (v3 review, finding 10).
     if (!raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\") || /[\r\n\t\u0000-\u001f]/.test(raw) || raw.length > 512)
         return "/";
     try {
@@ -155,18 +115,6 @@ export function safeReturn(raw) {
     }
     return raw;
 }
-/**
- * The destination a sign-in returns to (a phone's deep link to an exact
- * task or result): `safeReturn`, then narrower still — never the sign-in,
- * sign-up, join or sign-out roads themselves (a loop, or a token in a
- * path), never an encoded second scheme or host once the browser decodes
- * it, never a query key that could carry a secret, and never a region
- * fetch (`?fragment=`), which is a piece of a page and not a place to
- * land. Only the app's own pages qualify: the task lens, the chat, the
- * work and board views, and the fixed control destinations a phone
- * button can name. Nothing here is a second redirect framework: one
- * same-site path, or "/".
- */
 export const LOGIN_RETURN_PAGES = /^\/(oauth\/authorize|t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|tasks|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
 export function loginReturn(raw) {
     const safe = safeReturn(raw);
@@ -199,17 +147,13 @@ export function loginReturn(raw) {
     const query = parsed.searchParams.toString();
     return `${parsed.pathname}${query === "" ? "" : `?${query}`}`;
 }
-/** A request path fit for a log: the one-time sign-in link's code is left out. */
 export function redactedPath(path) {
     return path.startsWith(SIGN_IN_LINK_PATH) ? `${SIGN_IN_LINK_PATH}…` : path;
 }
-/** The sign-in page that comes back to `path` afterwards, or plain /login when the path is not one to come back to. */
 export function loginHref(path) {
     const back = loginReturn(path);
     return back === "/" ? "/login" : `/login?return=${encodeURIComponent(back)}`;
 }
-/** Chat actions may return only to the unified chat or one task-focused
- * lens. Other same-site paths are valid elsewhere, but not for chat forms. */
 export function safeChatReturn(raw) {
     const safe = safeReturn(raw);
     try {
@@ -234,14 +178,8 @@ export function chatReturnWithSaid(back, said) {
     return `${back}${back.includes("?") ? "&" : "?"}said=${encodeURIComponent(said)}`;
 }
 export const chatReturnWithLatest = (back) => `${back}#latest`;
-/** The one result page's address: the task and its run, never a project path
- * (the page finds the result's project itself and keeps the person's own). */
 export const reviewHref = (taskId, runId = null) => `/review?result=${encodeURIComponent(taskId)}${runId === null ? "" : `&run=${runId}`}`;
-/** The chat's result detail (package 3): the same panel the run page
- * and the cockpit render, opened beside the conversation when the screen
- * has room and as a dedicated view with Back to chat when it does not. */
 export const chatResultHref = (taskId, runId, tab = "summary") => sharedResultHref(taskId, runId, tab);
-// ---- request plumbing ------------------------------------------------------
 export async function form(request, cap = BODY_CAP) {
     const chunks = [];
     let size = 0;
@@ -253,19 +191,10 @@ export async function form(request, cap = BODY_CAP) {
     }
     return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
 }
-/** A refused chat setting (POST /chat/config): back on the lead's settings it is a ?problem=, which the page's section
- * shows in place with the edits kept; elsewhere it stays the chat's said line. */
 export function chatRefusal(back, words) {
     return back === "/settings/lead" ? `/settings/lead?problem=${encodeURIComponent(words)}` : chatReturnWithSaid(back, words);
 }
-/** The longest page a refusal's "Set a password" link carries on to. */
 export const PASSWORD_SET_NEXT_MAX = 512;
-/**
- * Where /password/set continues once the first password is set (easy-start C4): a page of this console a browser can
- * open, as path and query only — one leading slash, never two, no backslash, no scheme or host (also once decoded),
- * no control characters, at most PASSWORD_SET_NEXT_MAX characters, never the sign-in, sign-out, sign-up, join or
- * password roads, never a region fetch, query keys that could carry a secret dropped. Anything else is home ("/").
- */
 export function passwordSetNext(raw) {
     if (typeof raw !== "string" || raw === "" || raw.length > PASSWORD_SET_NEXT_MAX)
         return "/";
@@ -298,12 +227,6 @@ export function passwordSetNext(raw) {
     const next = `${parsed.pathname}${query === "" ? "" : `?${query}`}`;
     return next.length > PASSWORD_SET_NEXT_MAX ? "/" : next;
 }
-/**
- * The page a refused request was on, for its "Set a password" link: a page read is itself; a refused form is its own
- * address when a browser can open it (a settings page posting to itself), else the nearest page above it
- * (`/t/x/complete` → `/t/x`, `/flows/example` → `/flows`), since
- * the console sends no Referer to name the page the form was on. Checked by passwordSetNext; else home.
- */
 export function refusalNext(method, url) {
     if (method === "GET" || method === "HEAD")
         return passwordSetNext(url.pathname + url.search);
@@ -315,11 +238,6 @@ export function refusalNext(method, url) {
     }
     return "/";
 }
-/**
- * Whether an act asked for its answer in place (live-pages-and-home.md B2.3): `x-toolroll-act: in-place` turns the
- * answer into a small JSON outcome (`{ outcome, words }`) instead of a page or a redirect. It chooses only the answer's
- * shape: a handler reads it after every proof and authorisation decision is made, and no decision ever reads it.
- */
 export function answersInPlace(request) {
     return request?.headers["x-toolroll-act"] === "in-place";
 }

package/dist/server/in-place.js

@@ -1,12 +1,3 @@
-/**
- * Which pages may change in place, and which may be read ahead (docs/plans/live-pages-and-home.md A1.1, A1.4).
- *
- * Both are explicit allowlists of route-table ids (route-table.ts): nothing is eligible by default, so a new route
- * loads as its own document until it is added here on purpose. The welcome and first-run pages, the terminal, sign-in,
- * the release sheet and every page not named below are never eligible. A page on the in-place list is still a document
- * load when it is sensitive (a password field) or carries a page script (serve.ts sendScreen decides `inPlace`).
- */
-/** The Settings pages (route-table.ts): the overview, its groups and each section page. Not the Slack manifest file. */
 const SETTINGS_PAGES = [
     "settings.page",
     ...["general", "agents", "alerts", "projects", "access", "system"].map(one => `settings.group-${one}`),
@@ -14,18 +5,12 @@ const SETTINGS_PAGES = [
         "pull-requests", "checks", "backups", "data", "sign-in", "lead", "teams", "discord", "slack",
         "skills", "flows", "knowledge", "learning", "spend", "passwordless"].map(one => `settings.${one}`),
 ];
-/** Home, the Tasks list, a task page, Projects, Agents (the list), Search and the Settings pages. */
 export const IN_PLACE_ROUTES = new Set(["home", "tasks", "task.page", "projects.page", "agents", "search", ...SETTINGS_PAGES]);
-/** What may be read ahead with `x-toolroll-read: prefetch`: Home, the Tasks list, Projects, Agents (the list, never an
- * opened agent), Search, a task page. Everything else answers 204. */
 export const PREFETCH_ROUTES = new Set(["home", "tasks", "projects.page", "agents", "search", "task.page"]);
-/** The Agents view's Live grid shares the `agents` row (`/agents?view=live`); it only watches, and is never in place. */
 const liveGrid = (id, url) => id === "agents" && url.searchParams.get("view") === "live";
 export function inPlaceRoute(id, url) {
     return id !== undefined && IN_PLACE_ROUTES.has(id) && !liveGrid(id, url);
 }
-/** An opened agent shares the `agents` row too (`/agents?run=`): opening one marks it seen or watched, which is an
- * act, so its page is never read ahead (the browser never shows it before the person's own read). */
 const openedAgent = (id, url) => id === "agents" && url.searchParams.has("run");
 export function prefetchRoute(id, url) {
     return id !== undefined && PREFETCH_ROUTES.has(id) && !liveGrid(id, url) && !openedAgent(id, url);

package/dist/server/kit-standalone.js

@@ -1,22 +1,3 @@
-/**
- * The kit's behaviour for a server page the workspace bundle doesn't place (src/design/KIT.md): a chromed page
- * answered without the React workspace (a bearer or link session, or a build without browser assets). It is the
- * same behaviour src/browser/kit/behavior.ts gives kit markup inside the workspace, kept small and dependency-free so
- * it can ride the page's one nonce'd script (serve.ts sendScreen):
- *
- * - the composer grows from its rows to its max rows and then scrolls, and keeps "has text" and a gated send in step;
- * - a gated send does nothing while the box is empty;
- * - an idea (`data-k-draft`) adds its words to its composer in place;
- * - the composer's project chip and + open a small menu;
- * - overlays (`data-k-open`, `data-k-close`): the page behind inert, Tab kept inside, Escape, Close and the scrim close
- *   it, focus returns to the trigger; a popover or menu becomes a bottom sheet on a phone;
- * - a button switch (`button.k-switch[role=switch][data-k-switch]`) flips and says its new state;
- * - the phone keyboard: html.kb-open and --kb from the visual viewport.
- *
- * It reads no field but a composer's own text, posts nothing and fetches nothing: every control still works as plain
- * HTML without it. It never rides a sensitive page (one that asks for a password or shows a secret), where the page
- * carries no chrome additions.
- */
 export const KIT_STANDALONE_SCRIPT = `(function(){
 if(window.__kitStandalone)return;window.__kitStandalone=1;var d=document;
 var PHONE="(max-width: 760px)";var FOCUSABLE='a[href], button:not([disabled]), input:not([disabled]):not([type="hidden"]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
@@ -66,5 +47,4 @@ if(window.visualViewport){window.visualViewport.addEventListener("resize",kb);wi
 var root=d.documentElement;root.classList.add("k-js");d.addEventListener("keydown",function(e){if(e.key==="Tab"||e.key==="F6")root.classList.add("k-kbd");},true);d.addEventListener("pointerdown",function(){root.classList.remove("k-kbd");},true);
 if(d.readyState==="loading")d.addEventListener("DOMContentLoaded",syncAll);else syncAll();
 })();`;
-/** Whether a page's markup has kit pieces the standalone behaviour wires (a composer, an overlay, a button switch, an idea). */
 export const KIT_BEHAVIOR_MARKUP = /class="k-composer[ "]|data-k-open=|data-k-switch=|data-k-draft=/;