toolroll 0.9.53 → 0.9.55

package/dist/server/guards.d.ts

@@ -6,7 +6,7 @@ import { authenticateApprover as checkApproverPassword } from "../scope.js";
 import { SourceBudget } from "../sign-in-guard.js";
 import { type Run, type Store } from "../store.js";
 import type { RouteDeclaration } from './route-table.js';
-import { PersistentSessions, type Session, type Who } from "./shared.js";
+import { PersistentSessions, type Session, type Who } from "./session.js";
 /** Shared browser, credential and project guards. Runtime access is lazy to preserve server initialization order. */
 export interface GuardsRuntime {
     store: Store;

package/dist/server/guards.js

@@ -9,7 +9,10 @@ import { canonicalProject, rowVisible } from "../project.js";
 import { authenticateAccount, authenticateApprover as checkApproverPassword } from "../scope.js";
 import { SourceBudget } from "../sign-in-guard.js";
 import {} from "../store.js";
-import { matchTaskPath, PersistentSessions, refuse, requestContext, SESSION_ABSOLUTE_MS, SESSION_COOKIE, SESSION_IDLE_MS } from "./shared.js";
+import { requestContext } from "./request-context.js";
+import { refuse } from "./chrome.js";
+import { matchTaskPath } from "./http.js";
+import { PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_COOKIE, SESSION_IDLE_MS } from "./session.js";
 export function createSharedGuards(runtime) {
     // v99: wrong passwords. One address guessing across names runs out of tries here; each name
     // locks on its own (sign-in-guard.ts), and every lock, whatever road it came by, is kept.
@@ -163,7 +166,7 @@ export function createSharedGuards(runtime) {
         const path = url.pathname;
         const project = resolveRouteProject(source, url, who, request, body);
         if (restricted() && body !== null) {
-            const repos = body.getAll("repo");
+            const repos = readForm(body, CONSOLE_FORMS.projectCeiling).getAll("repo");
             if (repos.length > 1 || repos.some(repo => repo.trim() !== "" && !visible(repo.trim()))) {
                 refuse(response, who, 403, "That project is outside your access.", "/projects");
                 return false;

package/dist/server/handler-context.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { RouteDeclaration } from './route-table.js';
-import type { Who } from './shared.js';
+import { type Who } from "./session.js";
 export interface HandlerContext {
     url: URL;
     who: Who;

package/dist/server/handler-context.js

@@ -1 +1 @@
-export {};
+import {} from "./session.js";

package/dist/server/handler-registry.d.ts

@@ -1,19 +1,21 @@
 import type { EdgeContext, HandlerContext } from './handler-context.js';
-import { type Domain, type RouteDeclaration, type RouteMethod } from './route-table.js';
+import { type Domain, type RouteDeclaration } from './route-table.js';
+export type ConsoleHandler = (ctx: HandlerContext) => Promise<void>;
+export type EdgeHandler = (ctx: EdgeContext) => Promise<void>;
 export type Registration = {
     id: string;
     domain: Domain;
     stage: 'console';
-    method: RouteMethod;
-    handle: (ctx: HandlerContext) => Promise<void>;
+    handle: ConsoleHandler;
 } | {
     id: string;
     domain: Domain;
     stage: 'edge';
-    method: RouteMethod;
-    handle: (ctx: EdgeContext) => Promise<void>;
+    handle: EdgeHandler;
 };
-/** Registrations are independent of policy. Missing, extra or incompatible entries fail at startup. */
+/** One domain's handlers by route id: one function per row. */
+export declare function handlersOf(domain: Domain, console: Readonly<Record<string, ConsoleHandler>>, edge?: Readonly<Record<string, EdgeHandler>>): Registration[];
+/** Registrations are independent of policy. Missing, extra, incompatible or shared handlers fail at startup. */
 export declare function assertHandlerRegistry(registrations: readonly Registration[], routes?: readonly RouteDeclaration[]): void;
 export declare function createHandlerRegistry(registrations: readonly Registration[]): {
     console(route: RouteDeclaration, ctx: HandlerContext): Promise<void>;

package/dist/server/handler-registry.js

@@ -1,14 +1,26 @@
 import { ROUTES } from './route-table.js';
-/** Registrations are independent of policy. Missing, extra or incompatible entries fail at startup. */
+/** One domain's handlers by route id: one function per row. */
+export function handlersOf(domain, console, edge = {}) {
+    return [
+        ...Object.entries(console).map(([id, handle]) => ({ id, domain, stage: 'console', handle })),
+        ...Object.entries(edge).map(([id, handle]) => ({ id, domain, stage: 'edge', handle })),
+    ];
+}
+/** Registrations are independent of policy. Missing, extra, incompatible or shared handlers fail at startup. */
 export function assertHandlerRegistry(registrations, routes = ROUTES) {
     const seen = new Set();
+    const callbacks = new Map();
     for (const handler of registrations) {
         if (seen.has(handler.id))
             throw new Error(`Duplicate handler: ${handler.id}`);
         seen.add(handler.id);
         const route = routes.find(row => row.id === handler.id);
-        if (!route || route.domain !== handler.domain || route.method !== handler.method || route.stage !== handler.stage)
+        if (!route || route.domain !== handler.domain || route.stage !== handler.stage)
             throw new Error(`Handler has no compatible route: ${handler.id}`);
+        const other = callbacks.get(handler.handle);
+        if (other !== undefined)
+            throw new Error(`Handler shared by ${other} and ${handler.id}`);
+        callbacks.set(handler.handle, handler.id);
     }
     for (const route of routes)
         if (!seen.has(route.id))

package/dist/server/http.d.ts

@@ -0,0 +1,274 @@
+/** HTTP answers every console route shares: server options, body limits, safe responses, redirects and return paths. */
+import { type Html } from "../html.js";
+import { type CliHttpOptions, type RunOperateAs } from "../cli-http.js";
+import { type CodingWorkspace } from "../coding-workspace.js";
+import { type run as execRun } from "../exec.js";
+import { type MailSender } from "../flow-actions.js";
+import { type FetchLike } from "../flow-share.js";
+import { type TriggerIo } from "../flow-triggers.js";
+import { type InstallMethod } from "../install-method.js";
+import { type IntegrationIo } from "../integrations.js";
+import { type VersionRunner } from "../model-catalog.js";
+import { type cloneGithubRepo, type listGithubRepos, type previewGithubRepo } from "../onboard.js";
+import { type PublishExec } from "../publish.js";
+import { type ResultTab } from "../result-review.js";
+import { type Store } from "../store.js";
+import { type SubscriptionMateRunner } from "../subscription-chat.js";
+import { type launchRuntimeUpdate } from "../toolroll-update.js";
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export type ServeOptions = {
+    /** Tests: runs a person's command for the HTTP MCP gateway instead of operate.ts's. */
+    runOperateAs?: import("../mcp-person.js").RunOperateAs;
+    /** `toolroll demo`: the scripted lead that answers Chat instead of a model. */
+    demoLead?: import("../demo.js").DemoLead;
+    /** Tests: the bin whose real path says how Toolroll was installed (Settings → Updates' command). */
+    installBin?: string;
+    /** Native coding workspace injection for isolated integration tests. */
+    codingWorkspace?: CodingWorkspace;
+    /** Read-only worker connections for heavy reads (read-executor.ts); 0 reads in-process. Default: off under tests. */
+    readWorkers?: number;
+    store: Store;
+    evidenceRoot: string;
+    clock?: () => Date;
+    /**
+     * The console's canonical https origin, when TLS terminates in front
+     * (arc 3 finding 2/16): EXACTLY an origin — no path, query, credentials.
+     * The one trust anchor for secure-context features: it joins the allowed
+     * hosts, its origin authorizes POSTs, cookies turn Secure, and the
+     * install/push cards light up. X-Forwarded-* is consulted only from a
+     * loopback peer, the same-host proxy (public-access.ts).
+     */
+    publicUrl?: string;
+    /** Tests: the shared command boundary `POST /api/cli` runs (default: operate.ts's runOperateAs). */
+    cliRunner?: RunOperateAs;
+    /** Tests: remote command metadata until the shared contract declares it. */
+    cliModeOf?: CliHttpOptions['modeOf'];
+    /** Tests: the clock request budgets for API tokens count by (request-budget.ts). */
+    requestBudgetClock?: () => number;
+    /** Where repos.json lives — every enrollment locks exactly this file. */
+    registryPath?: string;
+    /** This console fronts an `up` process: onboarding copy says how to watch. */
+    upConsole?: boolean;
+    /**
+     * The lead on by default (onboarding): with no lead set up, the agent CLI
+     * signed in on this computer runs it, once. `up` and `serve` turn this on;
+     * tests opt in.
+     */
+    leadByDefault?: boolean;
+    /** Test seam: the operating system the sign-in command is written for. */
+    platform?: NodeJS.Platform;
+    /** Extra Host values this server answers as (a Tailscale name, a LAN ip:port). */
+    allowedHosts?: readonly string[];
+    /**
+     * This computer's names on its tailnet (onboarding): read at start and every
+     * few minutes; the console answers to each on its own port without an
+     * --allow-host, and the phone card names the address. Absent = none.
+     */
+    tailnetNames?: () => Promise<readonly string[]>;
+    /**
+     * The first-account road (setup review): while NO approver exists, the
+     * login page offers "create the first account", gated by this code —
+     * printed once by the process that started the server, never stored.
+     * Five wrong codes close the road until the server restarts. The moment
+     * an approver exists, the page is the ordinary sign-in.
+     */
+    setupCode?: string;
+    /**
+     * Where the Telegram bot token lives when set from here. Present = the
+     * settings card renders; absent = no settings surface at all.
+     */
+    telegramTokenFile?: string;
+    /** Where messaging config files live (beside the database) — enables the
+     * primary-messenger selector on the settings screen. */
+    configDir?: string;
+    /** Test seam for the Slack setup handshake. */
+    slackFetcher?: typeof fetch;
+    /** Settings → Updates seams: the latest release, how this Toolroll was
+     * installed, its version, and how the updater job starts. Tests and
+     * screenshots inject these; production reads the registry and launchd. */
+    updates?: {
+        latest?: () => Promise<{
+            version: string;
+        }>;
+        method?: InstallMethod;
+        current?: string;
+        dist?: string;
+        launch?: typeof launchRuntimeUpdate;
+    };
+    discordFetcher?: typeof fetch;
+    /** Injected by tests: Microsoft sign-in, key metadata and Teams conversation calls. */
+    teamsFetcher?: typeof fetch;
+    /** Injected by tests: how "Check now" reaches GitHub (gh) and Linear (fetch). */
+    flowTriggerIo?: Partial<TriggerIo>;
+    /**
+     * The repo this console serves. Scopes run evidence to that repo's tasks
+     * (and unplaced ones) and turns on the gaps and capabilities views —
+     * without it those pages say so instead of guessing.
+     */
+    repo?: string;
+    /**
+     * The full authorization ceiling (v2 review, finding 1): `repos` this
+     * server may show and operate on, plus `projectRoots` under which any git
+     * repository qualifies. `repo` above is sugar for one entry in `repos`.
+     * No configuration at all is the legacy unscoped mode — everything
+     * visible, and stated as such where the code decides.
+     */
+    repos?: readonly string[];
+    projectRoots?: readonly string[];
+    /** Repositories the co-located `up` process has proved and is watching.
+     * Kept as a callback so projects added after startup appear immediately
+     * without turning the durable registry itself into an authorization source. */
+    currentRepos?: () => readonly string[];
+    /** Injected by tests: the fetch direct-API chat turns use, and where chat
+     * keys are read from (defaults to process.env). */
+    chatFetcher?: typeof fetch;
+    /** Subscription-backed mate transport; injected in tests so no real
+     * Codex or Claude membership turn is consumed. */
+    subscriptionChatRunner?: SubscriptionMateRunner;
+    /** Tests: stands in for `codex mcp list --json` in the project (the Tools page's "Found on this computer"). */
+    codexToolList?: (cwd: string) => Promise<string | null>;
+    /** Tests: the home whose ~/.toolroll (or older ~/.standing-orders) tool-secrets and ~/.claude.json the Tools page uses. */
+    toolHome?: string;
+    /** v87: sends Send email steps' mail and the settings test (tests inject one). */
+    mailSender?: MailSender;
+    /** Injected by tests: how Flows → Import fetches a flow file's address. */
+    flowFetch?: FetchLike;
+    /** v89: Google's token endpoint (tests inject a scripted one). */
+    googleFetch?: typeof fetch;
+    /** Tests: every request a one-click connection makes (discovery, registration, tokens). */
+    connectFetch?: typeof fetch;
+    /** Tests: every request sign-in with the identity provider makes (discovery, keys, tokens). */
+    ssoFetch?: typeof fetch;
+    chatEnv?: Record<string, string | undefined>;
+    /**
+     * The live peek's locality ASSERTION (live-peek v3 §3): the administrator
+     * who starts serve names the runner this machine owns. This is documented
+     * as an assertion, not machine-bound credential enforcement — the product
+     * has none anywhere. Absent = the peek is off, and says so.
+     */
+    desktopIdentity?: string;
+    /** Trusted native admission callback; enrollment rows alone never supply this authority. */
+    additionalProjectRepos?: () => readonly string[];
+    /** The co-located `up`'s exact admitted repositories, read on every request: its startup projects plus those
+     * added since (`repos add`, the lead, the console) and minus those removed. When given it replaces `repos` as
+     * the exact part of the ceiling, so an addition or removal shows without a restart. */
+    admittedRepos?: () => readonly string[];
+    connectionProbe?: typeof execRun;
+    connectionHome?: string;
+    /** Test seam for Chat's first tasks: the `gh` and `git grep` reads. */
+    firstTaskRunner?: typeof execRun;
+    /** Test seam for Settings → Integrations: how its checks reach services (fetch, gh, mail servers). */
+    integrationIo?: Partial<IntegrationIo>;
+    modelCatalogFetcher?: typeof fetch;
+    /** Test seams for Settings → Models: CLI version probes and the PATH they search. */
+    modelRunner?: VersionRunner;
+    modelPath?: string;
+    localRunner?: string;
+    /** The checkout pool root the peek confines itself to (realpath-proved). */
+    poolRoot?: string;
+    /**
+     * Editor deep links (arc 6): a DEPLOYMENT capability, not an activation.
+     * vscode:// links open on the BROWSER's machine, so links render only
+     * when three statements align: the operator started serve with
+     * --editor vscode AND --runner (this machine owns the worktrees), the
+     * run belongs to that runner, and THIS session turned links on for
+     * this device. "vscode" is the only value; the scheme is never data.
+     */
+    editorLinks?: "vscode";
+    /** Injected by tests: the onboarding ceremony's gh-facing halves — the
+     * ceremony's gating, nonce, and enrollment logic is what the HTTP tests
+     * prove; gh itself is proved by onboard.test.ts. */
+    ghPreview?: typeof previewGithubRepo;
+    ghClone?: typeof cloneGithubRepo;
+    ghList?: typeof listGithubRepos;
+    /** Injected by tests: the git and gh calls pull-request setup and Merge make. */
+    publishExec?: PublishExec;
+};
+export declare const BODY_CAP: number;
+/** How long a stop waits for teammates and the lead's follow pass before closing anyway. */
+export declare const SHUTDOWN_WAIT_MS = 5000;
+/**
+ * Match `/t/<id>` (suffix "") or `/t/<id>/<verb>` — the id percent-decoded
+ * exactly once, refused when it does not decode, is oversized, or carries
+ * control characters. Legacy CLI-created ids are free-form; the URL is not.
+ */
+export declare function matchTaskPath(pathname: string, suffixPattern: string): {
+    taskId: string;
+    verb: string;
+} | null;
+export declare function taskHref(taskId: string): string;
+export declare const SAFETY: {
+    readonly "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
+    readonly "X-Content-Type-Options": "nosniff";
+    readonly "Referrer-Policy": "no-referrer";
+    readonly "Cache-Control": "no-store";
+};
+/** A text/html answer carries markup (Html); every other type, its own text. */
+export type ResponseBody<T extends string> = T extends `text/html${string}` ? Html : string;
+export declare function respond<T extends string>(response: ServerResponse, status: number, type: T, body: ResponseBody<T>): void;
+/**
+ * A page response. With a nonce, this response's CSP admits exactly the one
+ * inline script the shell stamped with the same value — generated per
+ * response, never shared, never 'unsafe-inline' (Codex board review,
+ * finding 9). Everything else keeps the constant script-free policy.
+ */
+export declare function page(response: ServerResponse, status: number, document: Html, nonce?: string, fetches?: boolean): void;
+/**
+ * An outside sign-in comes back only to the browser that started it: the
+ * start leaves the visit's state in this cookie (Lax, so it rides the
+ * service's redirect back; the session cookie is Strict and doesn't), and a
+ * return whose state isn't the one this browser holds is refused. So nobody
+ * can start a sign-in and have someone else finish it into their project.
+ */
+/** A moment's page on the way to or back from another site's sign-in: no stylesheet may load there, so the palette rides inline. */
+export declare const HANDOFF_STYLE: Html;
+export declare const SIGN_IN_COOKIE = "so-sign-in";
+export declare function startedHere(request: IncomingMessage, state: string): boolean;
+export declare const signInSpent: (path: string) => string;
+/**
+ * Off to another site's sign-in (Google, a service's one-click connection):
+ * a page that moves on by itself. Not a redirect: every page's form-action
+ * 'self' also covers where a form's answer redirects, so a browser stops a
+ * form that is answered with another site's address.
+ */
+export declare function goOutside(response: ServerResponse, to: string, words: string, bind: {
+    state: string;
+    path: string;
+    secure: boolean;
+}): void;
+export declare function redirect(response: ServerResponse, to: string): void;
+export declare const taskChatHref: (taskId: string) => string;
+/** A project's own lead thread (v77). */
+export declare const projectChatHref: (repo: string) => string;
+export declare function safeReturn(raw: string | null | undefined): string;
+/**
+ * The destination a sign-in returns to (a phone's deep link to an exact
+ * task or result): `safeReturn`, then narrower still — never the sign-in,
+ * sign-up, join or sign-out roads themselves (a loop, or a token in a
+ * path), never an encoded second scheme or host once the browser decodes
+ * it, never a query key that could carry a secret, and never a region
+ * fetch (`?fragment=`), which is a piece of a page and not a place to
+ * land. Only the app's own pages qualify: the task lens, the chat, the
+ * work and board views, and the fixed control destinations a phone
+ * button can name. Nothing here is a second redirect framework: one
+ * same-site path, or "/".
+ */
+export declare const LOGIN_RETURN_PAGES: RegExp;
+export declare function loginReturn(raw: string | null | undefined): string;
+/** A request path fit for a log: the one-time sign-in link's code is left out. */
+export declare function redactedPath(path: string): string;
+/** The sign-in page that comes back to `path` afterwards, or plain /login when the path is not one to come back to. */
+export declare function loginHref(path: string): string;
+/** Chat actions may return only to the unified chat or one task-focused
+ * lens. Other same-site paths are valid elsewhere, but not for chat forms. */
+export declare function safeChatReturn(raw: string | null | undefined): string;
+export declare function chatReturnWithSaid(back: string, said: string): string;
+export declare const chatReturnWithLatest: (back: string) => string;
+/** The one result page's address: the task and its run, never a project path
+ * (the page finds the result's project itself and keeps the person's own). */
+export declare const reviewHref: (taskId: string, runId?: number | null) => string;
+/** The chat's result detail (package 3): the same panel the run page
+ * and the cockpit render, opened beside the conversation when the screen
+ * has room and as a dedicated view with Back to chat when it does not. */
+export declare const chatResultHref: (taskId: string, runId: number, tab?: ResultTab) => string;
+export declare function form(request: IncomingMessage, cap?: number): Promise<URLSearchParams>;

package/dist/server/http.js

@@ -0,0 +1,239 @@
+/** HTTP answers every console route shares: server options, body limits, safe responses, redirects and return paths. */
+import { html, htmlString, isHtml } from "../html.js";
+import { chatResultHref as sharedResultHref } from "../chat-controls.js";
+import {} from "../cli-http.js";
+import {} from "../coding-workspace.js";
+import { hasForbiddenControls } from "../decision.js";
+import {} from "../exec.js";
+import {} from "../flow-actions.js";
+import {} from "../flow-share.js";
+import {} from "../flow-triggers.js";
+import {} from "../install-method.js";
+import {} from "../integrations.js";
+import {} from "../model-catalog.js";
+import {} from "../onboard.js";
+import {} from "../publish.js";
+import {} from "../result-review.js";
+import {} from "../store.js";
+import {} from "../subscription-chat.js";
+import {} from "../toolroll-update.js";
+import { timingSafeEqual } from "node:crypto";
+import {} from "node:http";
+import { SIGN_IN_LINK_PATH } from "./session.js";
+// A note is at most NOTE_BYTE_CAP (16,000) UTF-8 bytes, which URL encoding
+// can triple: room for one whole, before canonical text validation.
+export const BODY_CAP = 64 * 1024;
+/** How long a stop waits for teammates and the lead's follow pass before closing anyway. */
+export const SHUTDOWN_WAIT_MS = 5_000;
+// ---- path plumbing ---------------------------------------------------------
+/**
+ * Match `/t/<id>` (suffix "") or `/t/<id>/<verb>` — the id percent-decoded
+ * exactly once, refused when it does not decode, is oversized, or carries
+ * control characters. Legacy CLI-created ids are free-form; the URL is not.
+ */
+export function matchTaskPath(pathname, suffixPattern) {
+    const match = new RegExp(`^/t/([^/]+)${suffixPattern === "" ? "$" : suffixPattern}`).exec(pathname);
+    if (match === null)
+        return null;
+    let taskId;
+    try {
+        taskId = decodeURIComponent(match[1]);
+    }
+    catch {
+        return null;
+    }
+    if (taskId.length === 0 || taskId.length > 64 || hasForbiddenControls(taskId))
+        return null;
+    return { taskId, verb: match[2] ?? "" };
+}
+export function taskHref(taskId) {
+    return `/t/${encodeURIComponent(taskId)}`;
+}
+// ---- rendering -------------------------------------------------------------
+export const SAFETY = {
+    "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+};
+export function respond(response, status, type, body) {
+    // A route that set its OWN policy (the service worker's default-src
+    // 'none') or its own caching (the pre-auth assets) keeps it —
+    // writeHead's headers would otherwise win.
+    const own = response.getHeader("content-security-policy");
+    const cache = response.getHeader("cache-control");
+    response.writeHead(status, {
+        ...SAFETY,
+        ...(own === undefined ? {} : { "content-security-policy": own }),
+        ...(cache === undefined ? {} : { "Cache-Control": cache }),
+        "Content-Type": type,
+    });
+    response.end(isHtml(body) ? htmlString(body) : body);
+}
+/**
+ * A page response. With a nonce, this response's CSP admits exactly the one
+ * inline script the shell stamped with the same value — generated per
+ * response, never shared, never 'unsafe-inline' (Codex board review,
+ * finding 9). Everything else keeps the constant script-free policy.
+ */
+export function page(response, status, document, nonce, fetches) {
+    if (nonce === undefined)
+        return respond(response, status, "text/html; charset=utf-8", document);
+    response.writeHead(status, {
+        ...SAFETY,
+        "Content-Security-Policy": `default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; script-src 'nonce-${nonce}'; ` +
+            // connect-src only when the page's script actually fetches (a region
+            // poller, the full chrome beat, or the minimal sensitive-page beat).
+            `${fetches === true ? "connect-src 'self'; " : ""}form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
+        "Content-Type": "text/html; charset=utf-8",
+    });
+    response.end(htmlString(document));
+}
+/**
+ * An outside sign-in comes back only to the browser that started it: the
+ * start leaves the visit's state in this cookie (Lax, so it rides the
+ * service's redirect back; the session cookie is Strict and doesn't), and a
+ * return whose state isn't the one this browser holds is refused. So nobody
+ * can start a sign-in and have someone else finish it into their project.
+ */
+/** A moment's page on the way to or back from another site's sign-in: no stylesheet may load there, so the palette rides inline. */
+export const HANDOFF_STYLE = html `<style>body{font:15px/1.5 "Geist",system-ui,sans-serif;margin:2rem;background:#efefef;color:#171717}a{color:#171717;text-decoration-color:#8f8f8f;text-underline-offset:3px}@media(prefers-color-scheme:dark){body{background:#0b0b0b;color:#ededed}a{color:#ededed;text-decoration-color:#ff6fb5}}</style>`;
+export const SIGN_IN_COOKIE = "so-sign-in";
+export function startedHere(request, state) {
+    const held = new RegExp(`(?:^|;\\s*)${SIGN_IN_COOKIE}=([A-Za-z0-9_-]{16,128})`).exec(request.headers.cookie ?? "")?.[1];
+    return held !== undefined && held.length === state.length && timingSafeEqual(Buffer.from(held), Buffer.from(state));
+}
+export const signInSpent = (path) => `${SIGN_IN_COOKIE}=; Path=${path}; Max-Age=0; HttpOnly; SameSite=Lax`;
+/**
+ * Off to another site's sign-in (Google, a service's one-click connection):
+ * a page that moves on by itself. Not a redirect: every page's form-action
+ * 'self' also covers where a form's answer redirects, so a browser stops a
+ * form that is answered with another site's address.
+ */
+export function goOutside(response, to, words, bind) {
+    response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
+        "set-cookie": `${SIGN_IN_COOKIE}=${bind.state}; Path=${bind.path}; Max-Age=900; HttpOnly; SameSite=Lax${bind.secure ? "; Secure" : ""}`,
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" });
+    response.end(htmlString(html `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${to}"><title>Toolroll</title>${HANDOFF_STYLE}<p>${words} <a href="${to}">Continue</a></p>`));
+}
+export function redirect(response, to) {
+    response.writeHead(303, { ...SAFETY, Location: to });
+    response.end();
+}
+export const taskChatHref = (taskId) => `/chat?task=${encodeURIComponent(taskId)}`;
+/** A project's own lead thread (v77). */
+export const projectChatHref = (repo) => `/chat?project=${encodeURIComponent(repo)}`;
+export function safeReturn(raw) {
+    if (raw === null || raw === undefined)
+        return "/";
+    // A backslash is a slash to a browser's URL parser (`/\evil` → `//evil`), so it is refused too (v3 review, finding 10).
+    if (!raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\") || /[\r\n\t\u0000-\u001f]/.test(raw) || raw.length > 512)
+        return "/";
+    try {
+        const path = decodeURIComponent(new URL(raw, "http://standing-orders.local").pathname);
+        if (path.startsWith("//") || path.includes("\\") || /[\u0000-\u001f\u007f]/.test(path))
+            return "/";
+    }
+    catch {
+        return "/";
+    }
+    return raw;
+}
+/**
+ * The destination a sign-in returns to (a phone's deep link to an exact
+ * task or result): `safeReturn`, then narrower still — never the sign-in,
+ * sign-up, join or sign-out roads themselves (a loop, or a token in a
+ * path), never an encoded second scheme or host once the browser decodes
+ * it, never a query key that could carry a secret, and never a region
+ * fetch (`?fragment=`), which is a piece of a page and not a place to
+ * land. Only the app's own pages qualify: the task lens, the chat, the
+ * work and board views, and the fixed control destinations a phone
+ * button can name. Nothing here is a second redirect framework: one
+ * same-site path, or "/".
+ */
+export const LOGIN_RETURN_PAGES = /^\/(oauth\/authorize|t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
+export function loginReturn(raw) {
+    const safe = safeReturn(raw);
+    if (safe === "/")
+        return "/";
+    let parsed;
+    try {
+        parsed = new URL(safe, "http://standing-orders.local");
+    }
+    catch {
+        return "/";
+    }
+    if (parsed.origin !== "http://standing-orders.local" || parsed.username !== "" || parsed.password !== "")
+        return "/";
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(parsed.pathname);
+    }
+    catch {
+        return "/";
+    }
+    if (/^\/\/|\\|[\r\n\t\u0000-\u001f]/.test(decodedPath) || /^\/(login|logout|signup|join)(\/|$)/.test(decodedPath))
+        return "/";
+    if (!LOGIN_RETURN_PAGES.test(decodedPath) || parsed.searchParams.has("fragment"))
+        return "/";
+    for (const key of [...parsed.searchParams.keys()]) {
+        if (/token|password|secret|csrf|code|key|auth/i.test(key))
+            parsed.searchParams.delete(key);
+    }
+    const query = parsed.searchParams.toString();
+    return `${parsed.pathname}${query === "" ? "" : `?${query}`}`;
+}
+/** A request path fit for a log: the one-time sign-in link's code is left out. */
+export function redactedPath(path) {
+    return path.startsWith(SIGN_IN_LINK_PATH) ? `${SIGN_IN_LINK_PATH}…` : path;
+}
+/** The sign-in page that comes back to `path` afterwards, or plain /login when the path is not one to come back to. */
+export function loginHref(path) {
+    const back = loginReturn(path);
+    return back === "/" ? "/login" : `/login?return=${encodeURIComponent(back)}`;
+}
+/** Chat actions may return only to the unified chat or one task-focused
+ * lens. Other same-site paths are valid elsewhere, but not for chat forms. */
+export function safeChatReturn(raw) {
+    const safe = safeReturn(raw);
+    try {
+        const parsed = new URL(safe, "http://standing-orders.local");
+        if (parsed.pathname !== "/chat")
+            return "/chat";
+        const conversation = parsed.searchParams.get('conversation');
+        if (conversation && /^[a-f0-9-]{36}$/.test(conversation))
+            return `/chat?conversation=${encodeURIComponent(conversation)}`;
+        if (parsed.searchParams.get('private') === '1')
+            return '/chat?private=1';
+        const task = parsed.searchParams.get("task");
+        return task !== null && task.length > 0 && task.length <= 64 && !hasForbiddenControls(task)
+            ? taskChatHref(task)
+            : "/chat";
+    }
+    catch {
+        return "/chat";
+    }
+}
+export function chatReturnWithSaid(back, said) {
+    return `${back}${back.includes("?") ? "&" : "?"}said=${encodeURIComponent(said)}`;
+}
+export const chatReturnWithLatest = (back) => `${back}#latest`;
+/** The one result page's address: the task and its run, never a project path
+ * (the page finds the result's project itself and keeps the person's own). */
+export const reviewHref = (taskId, runId = null) => `/review?result=${encodeURIComponent(taskId)}${runId === null ? "" : `&run=${runId}`}`;
+/** The chat's result detail (package 3): the same panel the run page
+ * and the cockpit render, opened beside the conversation when the screen
+ * has room and as a dedicated view with Back to chat when it does not. */
+export const chatResultHref = (taskId, runId, tab = "summary") => sharedResultHref(taskId, runId, tab);
+// ---- request plumbing ------------------------------------------------------
+export async function form(request, cap = BODY_CAP) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > cap)
+            throw new Error("body too large");
+        chunks.push(chunk);
+    }
+    return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}

package/dist/server/live.d.ts

@@ -0,0 +1,34 @@
+import { type LiveBus } from "../live-bus.js";
+import type { WorkspaceRevision } from "../workspace-revision.js";
+import type { ServerRuntime } from "./runtime.js";
+/** A page asks for a few rooms at once: its workspace, what it shows, its conversation. */
+export declare const LIVE_ROOMS_PER_PAGE = 5;
+export type LiveRoom = {
+    kind: "workspace";
+} | {
+    kind: "task";
+    task: string;
+} | {
+    kind: "flow";
+    flow: number;
+    card: number | null;
+    editing: boolean;
+} | {
+    kind: "chat";
+    task: string | null;
+    project: string | null;
+} | {
+    kind: "team";
+    conversation: string | null;
+};
+/** A room's name, read strictly: anything else is not a room. */
+export declare function parseLiveRoom(name: string): LiveRoom | null;
+export declare function createLiveHandlers(runtime: ServerRuntime, live: {
+    bus: LiveBus;
+    workspaceRevision: WorkspaceRevision;
+    chatProjectOf: (projects: string[]) => string | null | undefined;
+}): {
+    registrations: import("./handler-registry.js").Registration[];
+    turnStarted: (thread: number) => void;
+    close(): void;
+};