toolroll 0.9.54 → 0.9.55

package/dist/request-budget-ui.js

@@ -1,5 +1,5 @@
+import { html, postForm } from "./html.js";
 import { effectiveLimits, limitOverrides, PER_DAY_MAX, PER_MINUTE_MAX, REQUEST_BUDGET_DEFAULTS } from "./request-budget.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 const n = (value) => value.toLocaleString("en-US");
 export const REQUEST_LIMITS_CSS = `.credentials .limits{display:grid;gap:14px}.credentials .limits form{display:grid;gap:10px}.credentials .limits label{display:grid;gap:6px}` +
     `.credentials .limits input,.credentials .limits select{box-sizing:border-box;width:100%;min-width:0}.credentials .limits .pair{display:grid;grid-template-columns:1fr 1fr;gap:10px}.credentials .limits .actions{display:flex;flex-wrap:wrap;gap:8px}` +
@@ -10,22 +10,22 @@ export function tokenLimitWords(db, token) {
     return `${n(limits.perMinute)} requests a minute · ${n(limits.perDay)} a day`;
 }
 /** The operator's disclosure: everyone's tokens, or one token. Blank fields use the default shown. */
-export function requestLimitsHtml(db, tokens, csrf, now) {
+export function requestLimitsHtml(db, tokens, now) {
     const overrides = limitOverrides(db);
     const everyone = overrides.get("*") ?? { readPerMinute: null, actPerMinute: null, perDay: null };
-    const field = (name, label, value, placeholder, max) => `<label>${label}<input type="number" name="${name}" min="1" max="${max}" step="1" inputmode="numeric" value="${value === null ? "" : value}" placeholder="${placeholder}"></label>`;
-    const password = `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`;
-    const buttons = `<div class="actions"><button name="action" value="save">Save limits</button><button class="secondary" name="action" value="clear">Use defaults</button></div>`;
+    const field = (name, label, value, placeholder, max) => html `<label>${label}<input type="number" name="${name}" min="1" max="${max}" step="1" inputmode="numeric" value="${value === null ? "" : value}" placeholder="${placeholder}"></label>`;
+    const password = html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`;
+    const buttons = html `<div class="actions"><button name="action" value="save">Save limits</button><button class="secondary" name="action" value="clear">Use defaults</button></div>`;
     const live = tokens.filter(one => one.revokedAt === null && Date.parse(one.expiresAt) > now);
-    const installation = `<form method="post" action="/settings/request-limits"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="target" value="*">` +
-        `<h3>Everyone's tokens</h3><div class="pair">${field("read-per-minute", "Read tokens, a minute", everyone.readPerMinute, String(REQUEST_BUDGET_DEFAULTS.read), PER_MINUTE_MAX)}` +
-        `${field("act-per-minute", "Act tokens, a minute", everyone.actPerMinute, String(REQUEST_BUDGET_DEFAULTS.act), PER_MINUTE_MAX)}</div>` +
-        `${field("per-day", "Each token, a day", everyone.perDay, String(REQUEST_BUDGET_DEFAULTS.day), PER_DAY_MAX)}${password}${buttons}</form>`;
-    const one = live.length === 0 ? "" : `<form method="post" action="/settings/request-limits"><input type="hidden" name="csrf" value="${e(csrf)}">` +
-        `<h3>One token</h3><label>Token<select name="target">${live.map(row => {
-            const set = overrides.get(row.id);
-            return `<option value="${e(row.id)}">${e(row.name)} (${e(row.account)}, ${row.access === "act" ? "act" : "read"})${set === undefined ? "" : " · own limits"}</option>`;
-        }).join("")}</select></label>` +
-        `<div class="pair">${field("per-minute", "A minute", null, "Everyone's", PER_MINUTE_MAX)}${field("per-day", "A day", null, "Everyone's", PER_DAY_MAX)}</div>${password}${buttons}</form>`;
-    return `<details class="card"><summary>Request limits</summary><div class="limits">${installation}${one}</div></details>`;
+    const installation = postForm("/settings/request-limits", html `\
+<h3>Everyone's tokens</h3><div class="pair">${field("read-per-minute", "Read tokens, a minute", everyone.readPerMinute, String(REQUEST_BUDGET_DEFAULTS.read), PER_MINUTE_MAX)}\
+${field("act-per-minute", "Act tokens, a minute", everyone.actPerMinute, String(REQUEST_BUDGET_DEFAULTS.act), PER_MINUTE_MAX)}</div>\
+${field("per-day", "Each token, a day", everyone.perDay, String(REQUEST_BUDGET_DEFAULTS.day), PER_DAY_MAX)}${password}${buttons}`, { hidden: { target: "*" } });
+    const one = live.length === 0 ? "" : postForm("/settings/request-limits", html `\
+<h3>One token</h3><label>Token<select name="target">${live.map(row => {
+        const set = overrides.get(row.id);
+        return html `<option value="${row.id}">${row.name} (${row.account}, ${row.access === "act" ? "act" : "read"})${set === undefined ? "" : " · own limits"}</option>`;
+    })}</select></label>\
+<div class="pair">${field("per-minute", "A minute", null, "Everyone's", PER_MINUTE_MAX)}${field("per-day", "A day", null, "Everyone's", PER_DAY_MAX)}</div>${password}${buttons}`);
+    return html `<details class="card"><summary>Request limits</summary><div class="limits">${installation}${one}</div></details>`;
 }

package/dist/result-review.d.ts

@@ -5,7 +5,7 @@
  * Nothing here reads a database or renders a full page. The server
  * assembles the same verified records it already reads (handoff, proof,
  * diff, matrix, publication, report) into `SharedResultFacts`; every
- * surface prints those facts through `resultFactsAttributes`, so a test —
+ * surface prints those facts through `resultFactsAttributeMap` (as html attributes), so a test —
  * or a person — can check that chat, run detail, and review agree on the
  * run, its head, its checks, its caveats, and its publication.
  *
@@ -141,8 +141,7 @@ export type SharedResultFacts = {
 /** The shared facts as the panel's data attributes, unescaped (the rebuilt
  * result page sets them through React). */
 export declare function resultFactsAttributeMap(facts: SharedResultFacts): Record<string, string>;
-export declare function resultFactsAttributes(facts: SharedResultFacts): string;
-/** The shared fact names, in the order `resultFactsAttributes` writes them. */
+/** The shared fact names, in the order `resultFactsAttributeMap` lists them. */
 export declare const RESULT_FACT_KEYS: readonly ["run", "head", "base", "head-source", "checks", "caveats", "evidence", "publication"];
 /** Parse the shared facts back — the test-side and proof-side reader.
  * Only the shared keys are read; a panel's own presentation attributes

package/dist/result-review.js

@@ -5,7 +5,7 @@
  * Nothing here reads a database or renders a full page. The server
  * assembles the same verified records it already reads (handoff, proof,
  * diff, matrix, publication, report) into `SharedResultFacts`; every
- * surface prints those facts through `resultFactsAttributes`, so a test —
+ * surface prints those facts through `resultFactsAttributeMap` (as html attributes), so a test —
  * or a person — can check that chat, run detail, and review agree on the
  * run, its head, its checks, its caveats, and its publication.
  *
@@ -126,10 +126,7 @@ export function resultFactsAttributeMap(facts) {
         "data-result-publication": facts.publicationState,
     };
 }
-export function resultFactsAttributes(facts) {
-    return Object.entries(resultFactsAttributeMap(facts)).map(([name, value]) => ` ${name}="${escapeAttribute(value)}"`).join("");
-}
-/** The shared fact names, in the order `resultFactsAttributes` writes them. */
+/** The shared fact names, in the order `resultFactsAttributeMap` lists them. */
 export const RESULT_FACT_KEYS = ["run", "head", "base", "head-source", "checks", "caveats", "evidence", "publication"];
 /** Parse the shared facts back — the test-side and proof-side reader.
  * Only the shared keys are read; a panel's own presentation attributes
@@ -426,9 +423,6 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
     }
   }
 })();`;
-function escapeAttribute(text) {
-    return text.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
 function unescapeAttribute(text) {
-    return text.replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+    return text.replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 }

package/dist/retention-ui.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Settings → Retention (v105): how long each kind of data is kept, and what
+ * the next daily sweep would remove. An instance operator's page; changes
+ * take a step-up.
+ */
+import { type Html } from "./html.js";
 import { type RetentionCount, type RetentionKind, type RetentionPeriods } from "./retention.js";
 export declare const RETENTION_CSS: string;
 /** `chosen`: the kinds someone chose a period for; the rest keep their default. */
@@ -11,4 +17,4 @@ export type RetentionView = {
 export declare function retentionHtml(view: RetentionView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;

package/dist/retention-ui.js

@@ -3,9 +3,9 @@
  * the next daily sweep would remove. An instance operator's page; changes
  * take a step-up.
  */
+import { html, postForm } from "./html.js";
 import { bytesWords } from "./storage.js";
 import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
     `.retention form{display:grid;gap:0}.retention .kind{display:grid;grid-template-columns:minmax(0,1fr) 11rem;gap:4px 16px;align-items:center;padding:12px 0;border-bottom:1px solid var(--border)}` +
     `.retention .kind .name{font-weight:500;font-size:.875rem}.retention .kind .meta{grid-column:1;margin:0}.retention .kind select{grid-column:2;grid-row:1/span 2;width:100%;min-height:44px}` +
@@ -23,17 +23,13 @@ function nextWords(view) {
     return `The next daily sweep removes ${listWords(due.map(countWords))} (about ${bytesWords(bytes)}).`;
 }
 export function retentionHtml(view, notice) {
-    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const rows = RETENTION_KINDS.map(({ kind, label, detail }) => {
         const current = view.periods[kind];
         const chosen = view.chosen.includes(kind);
-        const options = periodChoices(kind, current).map(days => `<option value="${days === null ? "forever" : days}"${days === current ? " selected" : ""}>${e(periodLabel(kind, days, chosen || days !== current))}</option>`).join("");
-        return `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${e(label)}</label><p class="meta">${e(detail)}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
-    }).join("");
-    const last = view.lastSweep === null ? "" : ` Last sweep ${e(view.lastSweep.slice(0, 10))}.`;
-    return `<article class="retention">${note}<p class="retention-next" data-retention-next>${e(nextWords(view))}${last}</p>` +
-        `<form method="post" action="/settings/retention"><input type="hidden" name="csrf" value="${e(view.csrf)}">${rows}` +
-        `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
-        `<button type="submit">Save</button></form>` +
-        `<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
+        const options = periodChoices(kind, current).map(days => html `<option value="${days === null ? "forever" : days}"${days === current ? html ` selected` : ""}>${periodLabel(kind, days, chosen || days !== current)}</option>`);
+        return html `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${label}</label><p class="meta">${detail}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
+    });
+    const last = view.lastSweep === null ? "" : ` Last sweep ${view.lastSweep.slice(0, 10)}.`;
+    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
 }

package/dist/serve.d.ts

@@ -1,3 +1,12 @@
-import { type DecisionServer, type ServeOptions } from "./server/shared.js";
+import { type ServeOptions } from "./server/http.js";
+import { type DecisionServer } from "./server/session.js";
 export declare function createDecisionServer(options: ServeOptions): DecisionServer;
-export { decisionAnswerScript, diffFileAnchor, earlierVersionsWords, editorFileHref, inboxFingerprints, needActionOf, orderChangedFiles, PAGE_CSS, parseInboxTab, pinnedTheme, plainConclusionOf, queueScript, rankReviewQueue, redactedPath, reviewFilePriority, reviewPriorityOf, revisionLineageWords, runFactsFragment, SENSITIVE_INPUT, settingsGroups, settingsTiles, SHUTDOWN_WAIT_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_COMPOSER_MODES, withinSignedTouches, wrongHostPage, type DecisionServer, type InboxTab, type ReviewFileRow, type ReviewPriority, type ReviewQueueFacts, type RouteView, type ServeOptions, type TaskComposerMode } from "./server/shared.js";
+export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
+export { redactedPath, SHUTDOWN_WAIT_MS, type ServeOptions } from "./server/http.js";
+export { TASK_COMPOSER_MODES, type TaskComposerMode } from "./server/render-chat.js";
+export { inboxFingerprints, parseInboxTab, queueScript, type InboxTab } from "./server/render-pages.js";
+export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches, type ReviewFileRow, type ReviewPriority, type ReviewQueueFacts } from "./server/render-results.js";
+export { settingsGroups, settingsTiles } from "./server/render-settings.js";
+export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords, type RouteView } from "./server/render-tasks.js";
+export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, type DecisionServer } from "./server/session.js";

package/dist/serve.js

@@ -1,3 +1,4 @@
+import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
 import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
@@ -111,11 +112,18 @@ import { isAlive as runnerAlive } from "./runner.js";
 import { freshIdentitySignIn } from "./scope.js";
 import { instrumentRequest } from "./server-telemetry.js";
 import { createChatHandlers } from './server/chat.js';
+import { createLiveHandlers } from './server/live.js';
 import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
-import { BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
+import { requestContext } from "./server/request-context.js";
+import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
+import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
+import { decisionsFor, LEAD_BY_DEFAULT_FACT, mateBrowserMessages, mateChatVersion, teamProposalCardParts } from "./server/render-chat.js";
+import {} from "./server/render-pages.js";
+import { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
@@ -421,9 +429,8 @@ export function createDecisionServer(options) {
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));
-    const teamStreams = new Set();
     /** Open chat streams (live replies), ended when the server closes. */
-    const chatStreams = new Set();
+    let liveTurnStarted = () => { };
     /** Google sign-ins in progress (v89): each consent visit's state, for 10 minutes. */
     const googleVisits = new Map();
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
@@ -625,12 +632,13 @@ export function createDecisionServer(options) {
         }
         if (edgeRoute === null && isEdgeAddress(url.pathname))
             return refuseEdge(request, response, url.pathname, wrongMethodEdge);
-        if (edgeRoute !== null && edgeRoute.domain !== 'people')
+        // Live rooms share the browser identity/context below; their adapter carries token limits into each room.
+        if (edgeRoute !== null && edgeRoute.domain !== 'people' && edgeRoute.domain !== 'live')
             return dispatchEdge(edgeRoute, { url, who: null, request, response, method });
         // Passive polls authenticate without extending the browser session.
         const fragmentName = url.searchParams.get("fragment");
         const workspaceRead = method === "GET" && url.searchParams.get('format') === 'workspace';
-        const touch = !(method === "GET" && (workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
+        const touch = !(method === "GET" && (edgeRoute?.domain === 'live' || workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
         const refuseBudget = (admitted) => {
             if (admitted.ok)
                 return false;
@@ -644,7 +652,7 @@ export function createDecisionServer(options) {
         if (refuseBudget(admitPasswordSource(request)))
             return;
         const refusedToken = {};
-        const who = identify(request, touch, false, refusedToken);
+        const who = identify(request, touch, edgeRoute?.domain === 'live', refusedToken);
         if (refusedToken.principal !== undefined) {
             if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
                 return;
@@ -685,8 +693,9 @@ export function createDecisionServer(options) {
         // An empty password stands for a fresh identity-provider sign-in, for this person only (v100).
         if (method === "GET" || method === "POST")
             return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
-                const taskTextForm = url.pathname === "/tasks/add" || /^\/t\/[^/]+\/scope$/.test(url.pathname);
-                const body = method === "POST" ? await form(request, url.pathname === "/settings/skills/import" ? 2 * 1024 * 1024 : url.pathname === "/flows/import" ? 1024 * 1024 : taskTextForm ? TASK_FORM_BODY_CAP : BODY_CAP) : null;
+                if (edgeRoute?.domain === 'live')
+                    return dispatchEdge(edgeRoute, { url, who, request, response, method });
+                const body = method === "POST" ? await form(request, (matchedRoute?.stage === "console" ? matchedRoute.bodyCap : undefined) ?? BODY_CAP) : null;
                 const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
                 const execute = async () => {
                     // THE ROUTE TABLE (server/route-table.ts): nothing reaches a handler unless a row declares this method and
@@ -717,7 +726,7 @@ export function createDecisionServer(options) {
                         // Authorize every read before considering a conditional response.
                         // Task/result opening and receipt reconciliation always re-read work.
                         const facts = requestContext.getStore();
-                        if (facts?.workspaceRead && who.via === 'cookie' && url.pathname === '/chat' &&
+                        if (facts?.workspaceRead && who.via === 'cookie' && route.id === 'chat.page' &&
                             !url.searchParams.has('task') && !url.searchParams.has('result') && !url.searchParams.has('request')) {
                             const key = createHash('sha256').update(JSON.stringify([workspaceIncarnation, who.name,
                                 who.session.generation, who.session.csrf, who.session.project, who.session.projectRevision,
@@ -819,7 +828,7 @@ export function createDecisionServer(options) {
         // A project link is a read context, not a session-changing operation.
         // Prove it against both admission and the known project catalog before
         // collection queries; unknown/foreign paths reveal no work.
-        if ((url.pathname === '/work' || url.pathname === '/system') && url.searchParams.has('project')) {
+        if ((route.id === 'work' || route.id === 'system') && url.searchParams.has('project')) {
             const wanted = url.searchParams.get('project') ?? '';
             if (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
                 ![...managedRepos(), ...store.listProjects().map(one => one.path)].includes(wanted)) {
@@ -836,7 +845,7 @@ export function createDecisionServer(options) {
         // viewing a result never changes the session's selected project, and
         // the page's project switch keeps showing the person's own choice.
         const chosenProject = project;
-        if (url.pathname === "/review" && url.searchParams.has("result")) {
+        if (route.id === "review" && url.searchParams.has("result")) {
             const wanted = url.searchParams.get("result") ?? "";
             const ref = wanted.length > 0 && wanted.length <= 64 && !hasForbiddenControls(wanted) ? store.lookupRef(wanted) : null;
             const namedProject = url.searchParams.get("project");
@@ -867,8 +876,8 @@ export function createDecisionServer(options) {
         // and the all-projects board carry their own read context.
         const needsProject = who.via === "cookie" && project === null && !unscopedMode &&
             route.needsProject &&
-            !(url.pathname === "/review" && url.searchParams.has("result")) &&
-            !(url.pathname === "/board" && url.searchParams.get("scope") === "all");
+            !(route.id === "review" && url.searchParams.has("result")) &&
+            !(route.id === "board" && url.searchParams.get("scope") === "all");
         if (needsProject)
             return redirect(response, `/projects?return=${encodeURIComponent(safeReturn(url.pathname + url.search))}`);
         return dispatchConsole(route, { url, who, request, response, route, now, project, chosenProject, posted: new URLSearchParams() });
@@ -1039,7 +1048,7 @@ export function createDecisionServer(options) {
         const rows = mateConversationRows(who, principal, focusTask, now, chatProject);
         return {
             sessionId: session.id, user: session.approver, version: mateChatVersion({ ...rows, focusTask }),
-            messages: mateBrowserMessages(rows, who.session.csrf, back, { task: focusTask?.id ?? null, project: chatProject }),
+            messages: mateBrowserMessages(rows, back, { task: focusTask?.id ?? null, project: chatProject }),
             pendingTurnId: rows.pending?.id ?? null, requestId: randomBytes(16).toString("hex"), maxChars: MATE_MESSAGE_MAX_CHARS,
             taskId: focusTask?.id ?? null, resultRunId, project: focusTask === null ? chatProject : null,
         };
@@ -1187,9 +1196,7 @@ export function createDecisionServer(options) {
         }
         const saturated = open.length > 200;
         const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/flows", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
-        const json = JSON.stringify(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries)
-            .replace(/</g, "\\u003c");
-        return `<script type="application/json" id="palette-index">${json}</script>`;
+        return jsonScript(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries, { id: "palette-index" });
     }
     /**
      * The palette cache (arc 4, finding 6), and its honest contract: a
@@ -1232,13 +1239,13 @@ export function createDecisionServer(options) {
         }
         const teamEntry = requestContext.getStore()?.returnTo;
         if (teamEntry?.startsWith('/chat') && !s.workspace?.team && !teamEntry.includes('task=') && !teamEntry.includes('proposal=') && demoLeadHere() === null) {
-            s.body = '<p class="team-entry"><a href="/chat?team=1">Open team chat</a></p>' + s.body;
+            s.body = html `<p class="team-entry"><a href="/chat?team=1">Open team chat</a></p>${s.body}`;
             if (s.workspace?.conversation)
-                s.workspace.controlsHtml = '<p><a href="/chat?team=1">Open team chat</a></p>' + (s.workspace.controlsHtml ?? '');
+                s.workspace.controlsHtml = html `<p><a href="/chat?team=1">Open team chat</a></p>${s.workspace.controlsHtml}`;
         }
         const sensitive = s.forceSensitive === true ||
-            SENSITIVE_INPUT.test(s.body) ||
-            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(s.chrome.listPane));
+            SENSITIVE_INPUT.test(htmlString(s.body)) ||
+            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(htmlString(s.chrome.listPane)));
         const requestFacts = requestContext.getStore();
         if (requestFacts?.browser && s.chrome && !s.forceSensitive && (requestFacts.workspaceRead || browserAssetsAvailable())) {
             const path = new URL(requestFacts.returnTo, 'http://standing-orders.local');
@@ -1248,7 +1255,7 @@ export function createDecisionServer(options) {
             path.searchParams.set('format', 'workspace');
             // The legacy list pane (every task or build as links) duplicates the
             // Crew panel and Tasks page; inside the workspace the page stands alone.
-            const pageHtml = s.body;
+            const pageHtml = htmlString(s.body);
             const extras = s.workspace ?? {};
             const notices = [...(extras.notices ?? [])];
             if (s.chrome.modeBanner)
@@ -1315,9 +1322,9 @@ export function createDecisionServer(options) {
                     ? { request, received: store.mateRequestReceipt(conversation.sessionId, request) !== null } : null,
                 projects: browserProjectsOf(s.chrome.projects ?? []), ...crew,
                 conversation, ...(extras.team ? { team: extras.team } : {}), focus: extras.focus ?? null, result: extras.result ?? null,
-                catchUpHtml: extras.catchUpHtml ?? '', controlsHtml: extras.controlsHtml ?? '', notices, view: extras.view ?? null,
+                catchUpHtml: extras.catchUpHtml === undefined ? '' : htmlString(extras.catchUpHtml), controlsHtml: extras.controlsHtml === undefined ? '' : htmlString(extras.controlsHtml), notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
-                pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml,
+                pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml === null ? null : htmlString(extras.pageHtml),
                 navigation: [...browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel), { label: 'Workspace tools', href: '/menu', active: path.pathname === '/menu' }],
                 chats,
                 ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: Math.max(5, Math.floor(s.refreshSeconds)) }),
@@ -1355,9 +1362,9 @@ export function createDecisionServer(options) {
         const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
-            ? `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
+            ? html `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
             : s.body;
-        const html = shell(s.title, body, {
+        const document = shell(s.title, body, {
             ...(s.chrome === undefined ? {} : { chrome: s.chrome }),
             ...(sensitive ? { sensitive: true } : {}),
             ...(s.chrome !== undefined ? { sidebarToggle: true } : {}),
@@ -1367,7 +1374,7 @@ export function createDecisionServer(options) {
         // Pages that ship the chrome layer keep connect-src (v28 granted it for
         // the since-removed watched-session beat), beside pages whose own
         // functional script polls.
-        return page(response, status, html, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
+        return page(response, status, document, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
     /** The needs-you count every surface wears, read from this request's own
      * Work counts (one query per request, never a cached earlier one), so a
@@ -1513,41 +1520,30 @@ export function createDecisionServer(options) {
             if (peekCache.size <= PEEK_CACHE_ENTRIES && peekCacheBytes <= PEEK_CACHE_BYTES)
                 break;
             peekCache.delete(key);
-            peekCacheBytes -= Buffer.byteLength(entry.fragment);
+            peekCacheBytes -= entry.bytes;
         }
     };
     /** One typed sentence inside the region — plain words, no raw errors.
      * `final` marks conditions that cannot heal for this run (finished,
      * superseded, wrong machine): the region poller reads the marker and
      * stops, instead of refetching a dead build every beat forever. */
-    const peekSay = (message, final = false) => `<p class="meta"${final ? " data-region-stop" : ""}>${escape(message)}</p>`;
+    const peekSay = (message, final = false) => html `<p class="meta"${final ? html ` data-region-stop` : ""}>${message}</p>`;
     /** The sanitize pipeline (finding 30/35): normalize → mask → escape. */
     const peekName = (path) => {
         const normalized = path.replace(/[\u0000-\u001f\u007f]/g, "");
         const masked = scanForSecrets(normalized).length > 0 ? "[redacted: a credential-shaped name]" : normalized;
-        return escape(masked);
+        return textHtml(masked);
     };
     async function handlePost(route, url, who, request, response, posted) {
-        const early = () => dispatchConsole(route, { url, who, request, response, route, now: clock(), project: projectOf(who, request) ?? null, chosenProject: projectOf(who, request) ?? null, posted });
+        // Every POST passes the shared mutation guard. Caller, scope, project (including a limited account's posted repo)
+        // and role were admitted by the route table.
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message);
-        if (["chat.demo", "provider.resume", "settings.updates-dismiss", "settings.updates-checks", "code.act"].includes(route.id))
-            return early();
-        if (restricted()) {
-            const repos = readForm(posted, CONSOLE_FORMS.projectCeiling).getAll("repo");
-            if (repos.length > 1 || repos.some(repo => repo.trim() !== "" && !visible(repo.trim())))
-                return refuse(response, who, 403, "That project is outside your access.", "/projects");
-        }
-        // THE CENTRAL VIEWER GATE (modes chain, D2/E2): consequential POSTs
-        // require ACTIVE approver standing — cookie and bearer alike — with
-        // an EXACT allowlist of session-local acts, never a prefix. /login,
-        // /logout and /join answer before this handler.
-        if (who.role === "viewer") {
-            if (route.viewer !== true) {
-                return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");
-            }
-        }
+        // Standing can change after a token was minted: a viewer's act stays refused, cookie and bearer alike, except
+        // the row's session-local acts.
+        if (who.role === "viewer" && !route.viewer)
+            return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");
         const now = clock();
         // Any accepted mutation may change what the inbox owes; the badge
         // re-counts within five seconds either way, this just makes it exact.
@@ -1588,14 +1584,9 @@ export function createDecisionServer(options) {
             requestBudget.flush();
         }
         catch { /* saved again on the close event when it can be */ }
-        for (const stream of teamStreams)
-            stream.end();
-        teamStreams.clear();
-        for (const stream of chatStreams)
-            stream.end();
-        chatStreams.clear();
         flowRooms.close();
         taskRooms.close();
+        liveHandlers.close();
         detachReads();
         liveFollower.close();
         void Promise.all([closeCoding(), bounded(team.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())]).then(() => closeServer(callback)).catch(error => {
@@ -1657,7 +1648,7 @@ export function createDecisionServer(options) {
         get matePrincipal() { return matePrincipal; },
         get chatScopeOf() { return chatScopeOf; },
         get liveTurns() { return liveTurns; },
-        get chatStreams() { return chatStreams; },
+        get liveTurnStarted() { return liveTurnStarted; },
         get mateConversationRows() { return mateConversationRows; },
         get demoLeadHere() { return demoLeadHere; },
         get teamBrowserReply() { return teamBrowserReply; },
@@ -1763,7 +1754,6 @@ export function createDecisionServer(options) {
         get allowedHost() { return allowedHost; },
         get team() { return team; },
         get teamBrowserReply() { return teamBrowserReply; },
-        get teamStreams() { return teamStreams; },
         get requestBudget() { return requestBudget; },
         get options() { return options; },
         get coding() { return coding; },
@@ -1781,13 +1771,26 @@ export function createDecisionServer(options) {
         get teamsSourceBudget() { return teamsSourceBudget; },
         get teamsTenantBudget() { return teamsTenantBudget; },
     };
+    const liveHandlers = createLiveHandlers(handlerRuntime, { bus: liveBus, workspaceRevision, chatProjectOf: chatHandlers.chatProjectOf });
+    liveTurnStarted = liveHandlers.turnStarted;
     const remoteHandlers = createRemoteHandlers(remoteRuntime);
     const registry = createHandlerRegistry([
         ...tasksHandlers.registrations, ...flowsHandlers.registrations, ...chatHandlers.registrations,
         ...settingsHandlers.registrations, ...peopleHandlers.registrations, ...pagesHandlers.registrations,
-        ...remoteHandlers.registrations,
+        ...remoteHandlers.registrations, ...liveHandlers.registrations,
     ]);
-    function dispatchConsole(route, ctx) { return registry.console(route, ctx); }
+    /** The row's role, after admission and before its one handler. */
+    function dispatchConsole(route, ctx) {
+        const { who, response } = ctx;
+        const held = route.role === "any" || ((!route.roleBrowser || who.via === "cookie") &&
+            (route.role === "approver" ? who.role === "approver" : store.isInstanceOperator(who.name)));
+        if (!held) {
+            ctx.request.resume();
+            const refusal = route.roleRefusal;
+            return Promise.resolve("message" in refusal ? refuse(response, who, 403, refusal.message, refusal.back) : respond(response, refusal.status, refusal.type, refusal.body));
+        }
+        return registry.console(route, ctx);
+    }
     async function dispatchEdge(route, ctx) {
         if (route.callers.length === 1 && route.callers[0] === 'cookie' && ctx.request.headers.authorization !== undefined) {
             return respond(ctx.response, 403, 'text/plain; charset=utf-8', 'This address needs a browser sign-in.');
@@ -1801,4 +1804,12 @@ export function createDecisionServer(options) {
     }
     return Object.assign(server, { mintSignInLink, closeCoding });
 }
-export { decisionAnswerScript, diffFileAnchor, earlierVersionsWords, editorFileHref, inboxFingerprints, needActionOf, orderChangedFiles, PAGE_CSS, parseInboxTab, pinnedTheme, plainConclusionOf, queueScript, rankReviewQueue, redactedPath, reviewFilePriority, reviewPriorityOf, revisionLineageWords, runFactsFragment, SENSITIVE_INPUT, settingsGroups, settingsTiles, SHUTDOWN_WAIT_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_COMPOSER_MODES, withinSignedTouches, wrongHostPage } from "./server/shared.js";
+export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
+export { redactedPath, SHUTDOWN_WAIT_MS } from "./server/http.js";
+export { TASK_COMPOSER_MODES } from "./server/render-chat.js";
+export { inboxFingerprints, parseInboxTab, queueScript } from "./server/render-pages.js";
+export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches } from "./server/render-results.js";
+export { settingsGroups, settingsTiles } from "./server/render-settings.js";
+export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
+export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";

package/dist/server/chat.d.ts

@@ -1,17 +1,14 @@
-import type { Registration } from './handler-registry.js';
 import { type BrowserFirstRun, type BrowserHome, type BrowserPhoneCard } from '../browser-workspace.js';
 import { type DemoResultView } from "../demo-chat.js";
 import type { DemoExchange } from "../demo.js";
 import { type FirstTaskSuggestion } from "../first-run.js";
 import type { MateProgress } from "../mate-progress.js";
 import type { DirectChatProviderId } from "../store.js";
-import type { HandlerContext } from './handler-context.js';
 import type { ServerRuntime } from './runtime.js';
-import { type ChatEnablement, type Session, type Who } from "./shared.js";
+import { type ChatEnablement } from "./render-chat.js";
+import { type Session, type Who } from "./session.js";
 export declare function createChatHandlers(runtime: ServerRuntime): {
-    registrations: Registration[];
-    get: (ctx: HandlerContext) => Promise<void>;
-    post: (ctx: HandlerContext) => Promise<void>;
+    registrations: import("./handler-registry.js").Registration[];
     chatFirstRun: (now: Date, project: string | null) => BrowserFirstRun | undefined;
     phoneCard: (who: Who & {
         via: "cookie";