toolroll 0.9.54 → 0.9.55

package/dist/server/runtime.d.ts

@@ -32,7 +32,13 @@ import { createTeamRuntime } from '../team-runtime.js';
 import { type ToolsView } from "../tools-ui.js";
 import { type ReviewFacts } from "../workspace-ui.js";
 import { WorktreePool } from "../worktree.js";
-import { PersistentSessions, taskBody, type ChatEnablement, type Chrome, type LiveTurn, type PlanContractView, type PlanRevisionLedgerView, type ProjectPeek, type ReplacedThread, type ResultDetail, type RevisionDocView, type RevisionView, type RouteView, type Screen, type ServeOptions, type Session, type SsoIntent, type TaskChatFocus, type Who } from "./shared.js";
+import { type Chrome, type Screen } from "./chrome.js";
+import { type ServeOptions } from "./http.js";
+import { type ChatEnablement, type LiveTurn, type ReplacedThread, type TaskChatFocus } from "./render-chat.js";
+import { type ProjectPeek } from "./render-pages.js";
+import { type ResultDetail } from "./render-results.js";
+import { taskBody, type PlanContractView, type PlanRevisionLedgerView, type RevisionDocView, type RevisionView, type RouteView } from "./render-tasks.js";
+import { PersistentSessions, type Session, type SsoIntent, type Who } from "./session.js";
 export interface ServerRuntime {
     codingActorAllowed: (actor: {
         name: string;
@@ -42,7 +48,7 @@ export interface ServerRuntime {
     codingProjectAllowed: (repo: string) => boolean;
     store: Store;
     sendScreen: (response: ServerResponse, status: number, s: Screen) => void;
-    chromeFor: (project: string | null, active: Chrome["active"], listPane?: string, scope?: Chrome["scope"]) => Chrome;
+    chromeFor: (project: string | null, active: Chrome["active"], listPane?: import("../html.js").Html, scope?: Chrome["scope"]) => Chrome;
     visible: (repo: string | null) => boolean;
     managedRepos: () => string[];
     codingProblem: string | undefined;
@@ -107,7 +113,8 @@ export interface ServerRuntime {
     }) => VerifiedApprover | null;
     chatScopeOf: (focusTask: TaskChatFocus | null, chatProject: string | null) => MateThreadScope;
     liveTurns: Map<number, LiveTurn>;
-    chatStreams: Set<ServerResponse<IncomingMessage>>;
+    /** A lead reply started on a thread: pages with that conversation open follow it (server/live.ts). */
+    liveTurnStarted: (thread: number) => void;
     mateConversationRows: (who: Who & {
         via: "cookie";
     }, principal: VerifiedApprover, focusTask: TaskChatFocus | null, now: Date, chatProject?: string | null) => {
@@ -255,18 +262,19 @@ export interface ServerRuntime {
     } | null;
     CHAT_CANDIDATE_TTL_MS: number;
     CHAT_CANDIDATES_PER_APPROVER: 9;
-    peekSay: (message: string, final?: boolean) => string;
+    peekSay: (message: string, final?: boolean) => import("../html.js").Html;
     peekCache: Map<string, {
-        fragment: string;
+        fragment: import("../html.js").Html;
+        bytes: number;
         at: number;
     }>;
     PEEK_CACHE_TTL_MS: 10000;
     peekCacheBytes: number;
-    peekInFlight: Map<string, Promise<string>>;
+    peekInFlight: Map<string, Promise<import("../html.js").Html>>;
     PEEK_GLOBAL_INFLIGHT: 4;
     peekBySession: Map<string, number>;
     PEEK_SESSION_INFLIGHT: 2;
-    peekName: (path: string) => string;
+    peekName: (path: string) => import("../html.js").Html;
     PEEK_FRAGMENT_BYTES: number;
     peekEvict: () => void;
     allowedHost: (host: string | undefined) => boolean;

package/dist/server/runtime.js

@@ -22,4 +22,10 @@ import { createTeamRuntime } from '../team-runtime.js';
 import {} from "../tools-ui.js";
 import {} from "../workspace-ui.js";
 import { WorktreePool } from "../worktree.js";
-import { PersistentSessions, taskBody } from "./shared.js";
+import {} from "./chrome.js";
+import {} from "./http.js";
+import {} from "./render-chat.js";
+import {} from "./render-pages.js";
+import {} from "./render-results.js";
+import { taskBody } from "./render-tasks.js";
+import { PersistentSessions } from "./session.js";

package/dist/server/session.d.ts

@@ -0,0 +1,138 @@
+/** Browser sessions and the signed-in caller of a request. */
+import { type ChatDraft } from "../converse.js";
+import { type Principal } from "../operate-remote.js";
+import { type Store } from "../store.js";
+import { type Server } from "node:http";
+/** A user agent, reduced to safe display words — never echoed raw. */
+export declare function oneLineUa(raw: string | string[] | undefined): string;
+export declare const SESSION_COOKIE = "standing-orders_session";
+/** Stands in for "no project" in a ceiling: no folder resolves to it, so it admits nothing. */
+export declare const NO_PROJECT = "/\0no-project";
+/** Where `up`'s one-time sign-in link points, and how long it works. */
+export declare const SIGN_IN_LINK_PATH = "/login/once/";
+export declare const SIGN_IN_LINK_MS: number;
+/** A cookie idles out after half a day and dies outright after a week. */
+export declare const SESSION_IDLE_MS: number;
+export declare const SESSION_ABSOLUTE_MS: number;
+/** An approval nonce is a rendered form, not a standing right — it ages out fast. */
+export declare const NONCE_TTL_MS: number;
+export declare const NONCE_CAP = 500;
+/** Read-only fragment polls that must never refresh session activity (arc 1). */
+export declare const NO_TOUCH_FRAGMENTS: ReadonlySet<string>;
+export type Session = {
+    name: string;
+    csrf: string;
+    /** v29: the account's standing at login — the central gate reads it;
+     * the revocation cascade kills the session outright. */
+    role: "approver" | "viewer";
+    /** The approver generation at login: credential rotation kills the cookie. */
+    generation: number;
+    createdAt: number;
+    lastSeen: number;
+    /** The open project — a VIEW FILTER chosen inside the ceiling, never authorization. */
+    project: string | null;
+    /** Bumped on every open: stale tabs carry the revision they were rendered under. */
+    projectRevision: number;
+    /** v100: signed in with the identity provider, and when it last checked them (a step-up within 10 minutes needs no password). */
+    sso?: {
+        at: number;
+    };
+    /** v101: the browser and address it signed in from, for the person to recognise it. */
+    agent?: string | null;
+    address?: string | null;
+    /** Onboarding preview records (arc: repo onboarding, finding 14) —
+     * session-held, swept at mint, at most 3, consumed exactly once. */
+    onboard?: Map<string, {
+        nameWithOwner: string;
+        rootIndex: number;
+        target: string;
+        diskUsageKib: number | null;
+        large: boolean;
+        mintedAt: number;
+    }>;
+    /** When this session last READ the board — the anchor for "since you
+     * last looked". Full page loads move it; fragment polls never do. */
+    sawBoardAt: number | null;
+    /** Fleet chat (v13): drafts and the last reply live HERE and nowhere
+     * durable — restart or logout loses them by design (v2 finding 12). */
+    chat?: SessionChat;
+    /** Editor links (arc 6): the SESSION's half of the activation — "this
+     * browser runs on the machine that holds the worktrees" is a statement
+     * only the person at the browser can make. Dies with the session. */
+    editorLinks?: boolean;
+};
+export type ChatCandidate = {
+    key: string;
+    draft: ChatDraft;
+    /** Resolved server-side at parse time from the opaque repoId. */
+    repoPath: string;
+    provider: string;
+    approver: string;
+    /** Digest of the frozen explicit repo list at turn time — filing
+     * re-proves it (v2 new finding 5). */
+    ceilingDigest: string;
+    createdAt: number;
+    state: "pending" | "filing";
+};
+export type SessionChat = {
+    candidates: Map<string, ChatCandidate>;
+    lastTurn: {
+        id: number;
+        reply: string | null;
+        staticError: string | null;
+        proposalsDiscarded: boolean;
+    } | null;
+};
+/** One rendered approval form: who saw which digest of which task, once. */
+export type ApprovalNonce = {
+    name: string;
+    taskId: string;
+    digest: string;
+    expiresAt: number;
+};
+export type Who = {
+    name: string;
+    via: "cookie";
+    session: Session;
+    role: "approver" | "viewer";
+} | {
+    name: string;
+    via: "bearer";
+    role: "approver" | "viewer"; /** v101: the API token it came with. */
+    token?: string;
+    /** The complete proved API-token authority, retained across body reads. */ principal?: Principal;
+    generation: number;
+};
+/** The browser session of a caller its route admits only through a browser sign-in (the row's callers or role). */
+export declare function browserCaller(who: Who): Extract<Who, {
+    via: "cookie";
+}>;
+/**
+ * v101: browser sessions in memory and in the database (by a hash of the
+ * cookie, never the cookie), so a restart signs no one out and a person can
+ * see and end their sessions. The in-memory map is the working set; a cookie
+ * it hasn't seen is looked up by its hash.
+ */
+export declare class PersistentSessions extends Map<string, Session> {
+    private readonly db;
+    private readonly ids;
+    private readonly savedAt;
+    constructor(db: Store);
+    static hash(id: string): string;
+    set(id: string, session: Session): this;
+    delete(id: string): boolean;
+    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    persist(session: Session, seen?: boolean): void;
+    /** A cookie from before a restart, if its session is still kept. */
+    load(id: string): Session | null;
+    /** End one session by its kept hash (from the Sessions page). */
+    endByHash(idHash: string): void;
+    hashOf(session: Session): string | null;
+}
+/** The console's server, and the one-time sign-in link `up` opens: a path on this server, or null for no such approver.
+ * closeCoding starts the coding shutdown on its own, ahead of the rest of a stop; close() awaits the same promise. */
+export type DecisionServer = Server & {
+    mintSignInLink(account: string): string | null;
+    closeCoding(): Promise<void>;
+};
+export type SsoIntent = "sign-in" | "reauth" | "link";

package/dist/server/session.js

@@ -0,0 +1,94 @@
+/** Browser sessions and the signed-in caller of a request. */
+import {} from "../converse.js";
+import {} from "../operate-remote.js";
+import {} from "../store.js";
+import { createHash } from "node:crypto";
+import {} from "node:http";
+/** A user agent, reduced to safe display words — never echoed raw. */
+export function oneLineUa(raw) {
+    const text = Array.isArray(raw) ? (raw[0] ?? "") : (raw ?? "");
+    if (/iphone|ipad/i.test(text))
+        return "an iPhone or iPad";
+    if (/android/i.test(text))
+        return "an Android device";
+    if (/mac os/i.test(text))
+        return "a Mac";
+    if (/windows/i.test(text))
+        return "a Windows machine";
+    return "a device";
+}
+export const SESSION_COOKIE = "standing-orders_session";
+/** Stands in for "no project" in a ceiling: no folder resolves to it, so it admits nothing. */
+export const NO_PROJECT = "/\0no-project";
+/** Where `up`'s one-time sign-in link points, and how long it works. */
+export const SIGN_IN_LINK_PATH = "/login/once/";
+export const SIGN_IN_LINK_MS = 10 * 60_000;
+/** A cookie idles out after half a day and dies outright after a week. */
+export const SESSION_IDLE_MS = 12 * 60 * 60_000;
+export const SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60_000;
+/** An approval nonce is a rendered form, not a standing right — it ages out fast. */
+export const NONCE_TTL_MS = 15 * 60_000;
+export const NONCE_CAP = 500;
+/** Read-only fragment polls that must never refresh session activity (arc 1). */
+export const NO_TOUCH_FRAGMENTS = new Set(["1", "facts", "peek", "rail", "transcript"]);
+/** The browser session of a caller its route admits only through a browser sign-in (the row's callers or role). */
+export function browserCaller(who) {
+    if (who.via !== "cookie")
+        throw new Error("A browser-only route reached its handler without a browser session.");
+    return who;
+}
+/**
+ * v101: browser sessions in memory and in the database (by a hash of the
+ * cookie, never the cookie), so a restart signs no one out and a person can
+ * see and end their sessions. The in-memory map is the working set; a cookie
+ * it hasn't seen is looked up by its hash.
+ */
+export class PersistentSessions extends Map {
+    db;
+    ids = new WeakMap();
+    savedAt = new WeakMap();
+    constructor(db) {
+        super();
+        this.db = db;
+    }
+    static hash(id) { return createHash("sha256").update(id, "utf8").digest("hex"); }
+    set(id, session) {
+        super.set(id, session);
+        this.ids.set(session, id);
+        this.persist(session);
+        return this;
+    }
+    delete(id) {
+        this.db.dropWebSession(PersistentSessions.hash(id));
+        return super.delete(id);
+    }
+    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    persist(session, seen = false) {
+        const id = this.ids.get(session);
+        if (id === undefined || (seen && Date.now() - (this.savedAt.get(session) ?? 0) < 60_000))
+            return;
+        this.savedAt.set(session, Date.now());
+        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
+            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
+    }
+    /** A cookie from before a restart, if its session is still kept. */
+    load(id) {
+        const row = this.db.webSession(PersistentSessions.hash(id));
+        if (row === null)
+            return null;
+        const session = { name: row.account, csrf: row.csrf, role: row.role, generation: row.generation, createdAt: row.createdAt, lastSeen: row.lastSeen, sawBoardAt: null,
+            project: row.project, projectRevision: row.projectRevision, agent: row.agent, address: row.address, ...(row.ssoAt === null ? {} : { sso: { at: row.ssoAt } }) };
+        super.set(id, session);
+        this.ids.set(session, id);
+        this.savedAt.set(session, Date.now());
+        return session;
+    }
+    /** End one session by its kept hash (from the Sessions page). */
+    endByHash(idHash) {
+        for (const id of [...this.keys()])
+            if (PersistentSessions.hash(id) === idHash)
+                super.delete(id);
+        this.db.dropWebSession(idHash);
+    }
+    hashOf(session) { const id = this.ids.get(session); return id === undefined ? null : PersistentSessions.hash(id); }
+}

package/dist/server/settings.d.ts

@@ -1,11 +1,7 @@
-import type { HandlerContext } from './handler-context.js';
-import type { Registration } from './handler-registry.js';
 import type { ServerRuntime } from './runtime.js';
 import { type RoleView } from "../models-ui.js";
 export declare function createSettingsHandlers(runtime: ServerRuntime): {
-    registrations: Registration[];
-    get: (ctx: HandlerContext) => Promise<void>;
-    post: (ctx: HandlerContext) => Promise<void>;
+    registrations: import("./handler-registry.js").Registration[];
     modelsView: (canManage: boolean, csrf: string, now: Date, said: string | null, problem: string | null) => {
         runtimes: import("../model-catalog.js").RuntimeState[];
         watch: import("../model-catalog.js").WatchState;