toolroll 0.9.54 → 0.9.56

package/dist/serve.js

@@ -1,3 +1,4 @@
+import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
 import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
@@ -86,7 +87,7 @@ import { firstRunSteps, signInCommandFor } from "./first-run.js";
 import { installMethod } from "./install-method.js";
 import { createIntegrationMonitor } from "./integrations.js";
 import { logEvent } from "./log.js";
-import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import {} from "./model-catalog.js";
 import { modeTermsFromJson } from "./modes.js";
 import { envValue } from "./names.js";
@@ -111,11 +112,18 @@ import { isAlive as runnerAlive } from "./runner.js";
 import { freshIdentitySignIn } from "./scope.js";
 import { instrumentRequest } from "./server-telemetry.js";
 import { createChatHandlers } from './server/chat.js';
+import { createLiveHandlers } from './server/live.js';
 import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
-import { BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
+import { requestContext } from "./server/request-context.js";
+import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
+import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
+import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, teamProposalCardParts } from "./server/render-chat.js";
+import {} from "./server/render-pages.js";
+import { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
@@ -421,9 +429,8 @@ export function createDecisionServer(options) {
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));
-    const teamStreams = new Set();
     /** Open chat streams (live replies), ended when the server closes. */
-    const chatStreams = new Set();
+    let liveTurnStarted = () => { };
     /** Google sign-ins in progress (v89): each consent visit's state, for 10 minutes. */
     const googleVisits = new Map();
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
@@ -446,7 +453,7 @@ export function createDecisionServer(options) {
         if (!snapshot?.selected || !snapshot.proposals)
             return reply;
         return { ...reply, snapshot: { ...snapshot, proposals: snapshot.proposals.map(summary => {
-                    const proposal = store.getMateProposal(summary.id);
+                    const proposal = store.getLeadProposal(summary.id);
                     if (!proposal || proposal.thread !== snapshot.selected.threadId)
                         return summary;
                     const decision = proposal.kind === 'answer' && typeof proposal.payload['decision'] === 'number' ? store.getDecision(proposal.payload['decision']) : null;
@@ -625,12 +632,13 @@ export function createDecisionServer(options) {
         }
         if (edgeRoute === null && isEdgeAddress(url.pathname))
             return refuseEdge(request, response, url.pathname, wrongMethodEdge);
-        if (edgeRoute !== null && edgeRoute.domain !== 'people')
+        // Live rooms share the browser identity/context below; their adapter carries token limits into each room.
+        if (edgeRoute !== null && edgeRoute.domain !== 'people' && edgeRoute.domain !== 'live')
             return dispatchEdge(edgeRoute, { url, who: null, request, response, method });
         // Passive polls authenticate without extending the browser session.
         const fragmentName = url.searchParams.get("fragment");
         const workspaceRead = method === "GET" && url.searchParams.get('format') === 'workspace';
-        const touch = !(method === "GET" && (workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
+        const touch = !(method === "GET" && (edgeRoute?.domain === 'live' || workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
         const refuseBudget = (admitted) => {
             if (admitted.ok)
                 return false;
@@ -644,7 +652,7 @@ export function createDecisionServer(options) {
         if (refuseBudget(admitPasswordSource(request)))
             return;
         const refusedToken = {};
-        const who = identify(request, touch, false, refusedToken);
+        const who = identify(request, touch, edgeRoute?.domain === 'live', refusedToken);
         if (refusedToken.principal !== undefined) {
             if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
                 return;
@@ -685,8 +693,9 @@ export function createDecisionServer(options) {
         // An empty password stands for a fresh identity-provider sign-in, for this person only (v100).
         if (method === "GET" || method === "POST")
             return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
-                const taskTextForm = url.pathname === "/tasks/add" || /^\/t\/[^/]+\/scope$/.test(url.pathname);
-                const body = method === "POST" ? await form(request, url.pathname === "/settings/skills/import" ? 2 * 1024 * 1024 : url.pathname === "/flows/import" ? 1024 * 1024 : taskTextForm ? TASK_FORM_BODY_CAP : BODY_CAP) : null;
+                if (edgeRoute?.domain === 'live')
+                    return dispatchEdge(edgeRoute, { url, who, request, response, method });
+                const body = method === "POST" ? await form(request, (matchedRoute?.stage === "console" ? matchedRoute.bodyCap : undefined) ?? BODY_CAP) : null;
                 const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
                 const execute = async () => {
                     // THE ROUTE TABLE (server/route-table.ts): nothing reaches a handler unless a row declares this method and
@@ -717,7 +726,7 @@ export function createDecisionServer(options) {
                         // Authorize every read before considering a conditional response.
                         // Task/result opening and receipt reconciliation always re-read work.
                         const facts = requestContext.getStore();
-                        if (facts?.workspaceRead && who.via === 'cookie' && url.pathname === '/chat' &&
+                        if (facts?.workspaceRead && who.via === 'cookie' && route.id === 'chat.page' &&
                             !url.searchParams.has('task') && !url.searchParams.has('result') && !url.searchParams.has('request')) {
                             const key = createHash('sha256').update(JSON.stringify([workspaceIncarnation, who.name,
                                 who.session.generation, who.session.csrf, who.session.project, who.session.projectRevision,
@@ -771,10 +780,10 @@ export function createDecisionServer(options) {
         }
         const shared = /^\/chat\/(?:action\/([0-9]{1,15})|proposal\/([0-9]{1,15})\/(?:confirm|dismiss))$/.exec(url.pathname);
         if (shared) {
-            const proposal = store.getMateProposal(Number(shared[1] ?? shared[2]));
+            const proposal = store.getLeadProposal(Number(shared[1] ?? shared[2]));
             const action = proposal?.kind === 'action' ? sharedActionPayload(proposal.payload) : null;
             const room = proposal ? store.handle.prepare('SELECT id FROM team_conversation WHERE thread=?').get(proposal.thread) : null;
-            let admitted = proposal && store.getMateThread(proposal.thread)?.approver === who.name;
+            let admitted = proposal && store.getLeadThread(proposal.thread)?.approver === who.name;
             if (room && who.via === 'cookie') {
                 try {
                     team.domain.access({ name: who.name, generation: who.session.generation }, String(room['id']), 'contributor');
@@ -819,7 +828,7 @@ export function createDecisionServer(options) {
         // A project link is a read context, not a session-changing operation.
         // Prove it against both admission and the known project catalog before
         // collection queries; unknown/foreign paths reveal no work.
-        if ((url.pathname === '/work' || url.pathname === '/system') && url.searchParams.has('project')) {
+        if ((route.id === 'work' || route.id === 'system') && url.searchParams.has('project')) {
             const wanted = url.searchParams.get('project') ?? '';
             if (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
                 ![...managedRepos(), ...store.listProjects().map(one => one.path)].includes(wanted)) {
@@ -836,7 +845,7 @@ export function createDecisionServer(options) {
         // viewing a result never changes the session's selected project, and
         // the page's project switch keeps showing the person's own choice.
         const chosenProject = project;
-        if (url.pathname === "/review" && url.searchParams.has("result")) {
+        if (route.id === "review" && url.searchParams.has("result")) {
             const wanted = url.searchParams.get("result") ?? "";
             const ref = wanted.length > 0 && wanted.length <= 64 && !hasForbiddenControls(wanted) ? store.lookupRef(wanted) : null;
             const namedProject = url.searchParams.get("project");
@@ -867,8 +876,8 @@ export function createDecisionServer(options) {
         // and the all-projects board carry their own read context.
         const needsProject = who.via === "cookie" && project === null && !unscopedMode &&
             route.needsProject &&
-            !(url.pathname === "/review" && url.searchParams.has("result")) &&
-            !(url.pathname === "/board" && url.searchParams.get("scope") === "all");
+            !(route.id === "review" && url.searchParams.has("result")) &&
+            !(route.id === "board" && url.searchParams.get("scope") === "all");
         if (needsProject)
             return redirect(response, `/projects?return=${encodeURIComponent(safeReturn(url.pathname + url.search))}`);
         return dispatchConsole(route, { url, who, request, response, route, now, project, chosenProject, posted: new URLSearchParams() });
@@ -972,36 +981,36 @@ export function createDecisionServer(options) {
     // ---- fleet chat (v13) ----------------------------------------------------
     const chatFetcher = options.chatFetcher ?? fetch;
     const chatEnv = options.chatEnv ?? process.env;
-    /** The mate's last non-answer per BROWSER session (keyed by its csrf —
+    /** The lead's last non-answer per BROWSER session (keyed by its csrf —
      * never by name, so two browsers on one account do not read each other's
      * notes), bound to the mate turn it came from so a note from a session
      * that has since ended never shows; bounded; read once. */
-    const mateSaid = new Map();
+    const leadSaid = new Map();
     /** The unified conversation's rows for one reader (package 2): the SAME
      * rows the page renders and the status poll's fragments re-render, so a
      * live update can never show a card the page would not. A task lens
-     * keeps only that task's coordinator cards; the mate's own thread is one
+     * keeps only that task's coordinator cards; the lead's own thread is one
      * thread regardless of lens. */
-    function mateConversationRows(who, principal, focusTask, now, chatProject = null) {
+    function leadConversationRows(who, principal, focusTask, now, chatProject = null) {
         const allCoordinatorRows = store.listCoordinatorProposals({ repos: managedRepos(), states: ["pending", "confirmed", "refused"], limit: 30 });
         const coordinatorProposals = focusTask !== null ? allCoordinatorRows.filter(one => focusTask.family.versions.some(version => version.id === one.payload["task"]))
             : chatProject !== null ? allCoordinatorRows.filter(one => one.repo === chatProject) : allCoordinatorRows;
-        const opened = store.openMateThread(who.name, principal.ceilingDigest, now, chatScopeOf(focusTask, chatProject));
-        const proposals = store.listMateProposals(opened.thread.id);
+        const opened = store.openLeadThread(who.name, principal.ceilingDigest, now, chatScopeOf(focusTask, chatProject));
+        const proposals = store.listLeadProposals(opened.thread.id);
         // One reply runs at a time per person; this thread shows it only when
         // the reply is its own.
-        const live = store.liveMateTurnFor(who.name);
-        const messages = store.listMateMessages(opened.thread.id, 40);
+        const live = store.liveLeadTurnFor(who.name);
+        const messages = store.listLeadMessages(opened.thread.id, 40);
         // The lead's question with buttons, while its reply is the last word in the thread.
         const last = messages.at(-1);
-        const ask = last?.role === "assistant" && last.turn !== null && store.getMateTurn(last.turn)?.approver === who.name ? store.mateAskOpen(last.turn, now) : null;
+        const ask = last?.role === "assistant" && last.turn !== null && store.getLeadTurn(last.turn)?.approver === who.name ? store.leadAskOpen(last.turn, now) : null;
         // Answered questions stay readable above the answer; only their buttons go.
-        const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.mateAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
+        const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.leadAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
         // The thread a ceiling change replaced (ruling 9): read after the open, display only.
         const replaced = store.replacedLeadThread(opened.thread);
-        const previousProposals = replaced === null ? [] : store.listMateProposals(replaced.id);
+        const previousProposals = replaced === null ? [] : store.listLeadProposals(replaced.id);
         return {
-            previous: replaced === null ? null : { messages: store.listMateMessages(replaced.id, 40), proposals: previousProposals, decisions: decisionsFor(store, previousProposals) },
+            previous: replaced === null ? null : { messages: store.listLeadMessages(replaced.id, 40), proposals: previousProposals, decisions: decisionsFor(store, previousProposals) },
             messages,
             ask,
             asks,
@@ -1009,7 +1018,7 @@ export function createDecisionServer(options) {
             decisions: decisionsFor(store, [...proposals, ...coordinatorProposals]),
             coordinatorProposals,
             pending: live !== null && live.thread === opened.thread.id ? live : null,
-            recent: store.recentMateTurns(who.name, 5),
+            recent: store.recentLeadTurns(who.name, 5),
         };
     }
     /** The thread a chat surface speaks in (v77): the task's own thread, the
@@ -1026,21 +1035,21 @@ export function createDecisionServer(options) {
         if (who.via !== "cookie" || who.role !== "approver" || (focusTask === null && chatProject === null))
             return null;
         const enabled = chatEnablement();
-        const principal = enabled.ok ? matePrincipal(who) : null;
+        const principal = enabled.ok ? leadPrincipal(who) : null;
         if (!enabled.ok || principal === null)
             return null;
-        let session = store.activeMateSession(who.name);
+        let session = store.activeLeadSession(who.name);
         if ((session === null || session.ceilingDigest !== principal.ceilingDigest) && enabled.billing === "subscription" && !requestContext.getStore()?.workspaceRead) {
-            startMateConversation(who, principal, enabled, 0, false, now);
-            session = store.activeMateSession(who.name);
+            startLeadConversation(who, principal, enabled, 0, false, now);
+            session = store.activeLeadSession(who.name);
         }
         if (session === null || session.ceilingDigest !== principal.ceilingDigest || session.approverGeneration !== principal.generation)
             return null;
-        const rows = mateConversationRows(who, principal, focusTask, now, chatProject);
+        const rows = leadConversationRows(who, principal, focusTask, now, chatProject);
         return {
-            sessionId: session.id, user: session.approver, version: mateChatVersion({ ...rows, focusTask }),
-            messages: mateBrowserMessages(rows, who.session.csrf, back, { task: focusTask?.id ?? null, project: chatProject }),
-            pendingTurnId: rows.pending?.id ?? null, requestId: randomBytes(16).toString("hex"), maxChars: MATE_MESSAGE_MAX_CHARS,
+            sessionId: session.id, user: session.approver, version: leadChatVersion({ ...rows, focusTask }),
+            messages: leadBrowserMessages(rows, back, { task: focusTask?.id ?? null, project: chatProject }),
+            pendingTurnId: rows.pending?.id ?? null, requestId: randomBytes(16).toString("hex"), maxChars: LEAD_MESSAGE_MAX_CHARS,
             taskId: focusTask?.id ?? null, resultRunId, project: focusTask === null ? chatProject : null,
         };
     }
@@ -1049,17 +1058,17 @@ export function createDecisionServer(options) {
     /** Start the person's lead conversation: the session every later turn
      * debits (a membership spends nothing; direct API gets a per-conversation
      * ceiling) and its thread. Starting ends any older session. */
-    function startMateConversation(who, principal, enabled, ceilingUsd, follow, now) {
+    function startLeadConversation(who, principal, enabled, ceilingUsd, follow, now) {
         const ceilingMicrousd = enabled.billing === "subscription" ? 0 : Math.round(ceilingUsd * 1_000_000);
         const termsDigest = createHash("sha256").update(`${ceilingMicrousd}\n${principal.ceilingDigest}`).digest("hex");
-        const sessionId = store.mintMateSession({ approver: who.name, approverGeneration: principal.generation, credentialKey: enabled.credentialKey, ceilingMicrousd, ceilingDigest: principal.ceilingDigest, termsDigest }, now);
-        const thread = store.openMateThread(who.name, principal.ceilingDigest, now).thread;
+        const sessionId = store.mintLeadSession({ approver: who.name, approverGeneration: principal.generation, credentialKey: enabled.credentialKey, ceilingMicrousd, ceilingDigest: principal.ceilingDigest, termsDigest }, now);
+        const thread = store.openLeadThread(who.name, principal.ceilingDigest, now).thread;
         if (follow)
-            configureLeadFollow(store, principal, store.getMateSession(sessionId), thread, true, now);
-        mateSaid.delete(who.session.csrf);
+            configureLeadFollow(store, principal, store.getLeadSession(sessionId), thread, true, now);
+        leadSaid.delete(who.session.csrf);
         return sessionId;
     }
-    function matePrincipal(who) {
+    function leadPrincipal(who) {
         const verified = verifyApproverStanding(store, who.name, who.session.generation, managedRepos());
         return verified.ok ? verified.who : null;
     }
@@ -1187,9 +1196,7 @@ export function createDecisionServer(options) {
         }
         const saturated = open.length > 200;
         const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/flows", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
-        const json = JSON.stringify(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries)
-            .replace(/</g, "\\u003c");
-        return `<script type="application/json" id="palette-index">${json}</script>`;
+        return jsonScript(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries, { id: "palette-index" });
     }
     /**
      * The palette cache (arc 4, finding 6), and its honest contract: a
@@ -1230,15 +1237,10 @@ export function createDecisionServer(options) {
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
-        const teamEntry = requestContext.getStore()?.returnTo;
-        if (teamEntry?.startsWith('/chat') && !s.workspace?.team && !teamEntry.includes('task=') && !teamEntry.includes('proposal=') && demoLeadHere() === null) {
-            s.body = '<p class="team-entry"><a href="/chat?team=1">Open team chat</a></p>' + s.body;
-            if (s.workspace?.conversation)
-                s.workspace.controlsHtml = '<p><a href="/chat?team=1">Open team chat</a></p>' + (s.workspace.controlsHtml ?? '');
-        }
+        // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = s.forceSensitive === true ||
-            SENSITIVE_INPUT.test(s.body) ||
-            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(s.chrome.listPane));
+            SENSITIVE_INPUT.test(htmlString(s.body)) ||
+            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(htmlString(s.chrome.listPane)));
         const requestFacts = requestContext.getStore();
         if (requestFacts?.browser && s.chrome && !s.forceSensitive && (requestFacts.workspaceRead || browserAssetsAvailable())) {
             const path = new URL(requestFacts.returnTo, 'http://standing-orders.local');
@@ -1248,7 +1250,7 @@ export function createDecisionServer(options) {
             path.searchParams.set('format', 'workspace');
             // The legacy list pane (every task or build as links) duplicates the
             // Crew panel and Tasks page; inside the workspace the page stands alone.
-            const pageHtml = s.body;
+            const pageHtml = htmlString(s.body);
             const extras = s.workspace ?? {};
             const notices = [...(extras.notices ?? [])];
             if (s.chrome.modeBanner)
@@ -1289,7 +1291,7 @@ export function createDecisionServer(options) {
             try {
                 const actor = requestFacts.actor ?? '';
                 if (actor !== '') {
-                    chats = store.listMateThreads(actor, 16).flatMap((thread) => {
+                    chats = store.listLeadThreads(actor, 16).flatMap((thread) => {
                         if (thread.scope.kind === 'project') {
                             const repo = thread.scope.key;
                             return visible(repo) && managedRepos().includes(repo) ? [{ kind: 'project', title: projectName(repo), href: projectChatHref(repo), at: thread.lastMessageAt }] : [];
@@ -1312,12 +1314,12 @@ export function createDecisionServer(options) {
                 ...(requestFacts.actor ? { leadName: leadNameOf(store, requestFacts.actor) } : {}),
                 refreshUrl: path.pathname + path.search,
                 receipt: conversation !== null && request && REQUEST_TOKEN.test(request)
-                    ? { request, received: store.mateRequestReceipt(conversation.sessionId, request) !== null } : null,
+                    ? { request, received: store.leadRequestReceipt(conversation.sessionId, request) !== null } : null,
                 projects: browserProjectsOf(s.chrome.projects ?? []), ...crew,
                 conversation, ...(extras.team ? { team: extras.team } : {}), focus: extras.focus ?? null, result: extras.result ?? null,
-                catchUpHtml: extras.catchUpHtml ?? '', controlsHtml: extras.controlsHtml ?? '', notices, view: extras.view ?? null,
+                catchUpHtml: extras.catchUpHtml === undefined ? '' : htmlString(extras.catchUpHtml), controlsHtml: extras.controlsHtml === undefined ? '' : htmlString(extras.controlsHtml), notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
-                pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml,
+                pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml === null ? null : htmlString(extras.pageHtml),
                 navigation: [...browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel), { label: 'Workspace tools', href: '/menu', active: path.pathname === '/menu' }],
                 chats,
                 ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: Math.max(5, Math.floor(s.refreshSeconds)) }),
@@ -1355,9 +1357,9 @@ export function createDecisionServer(options) {
         const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
-            ? `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
+            ? html `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
             : s.body;
-        const html = shell(s.title, body, {
+        const document = shell(s.title, body, {
             ...(s.chrome === undefined ? {} : { chrome: s.chrome }),
             ...(sensitive ? { sensitive: true } : {}),
             ...(s.chrome !== undefined ? { sidebarToggle: true } : {}),
@@ -1367,7 +1369,7 @@ export function createDecisionServer(options) {
         // Pages that ship the chrome layer keep connect-src (v28 granted it for
         // the since-removed watched-session beat), beside pages whose own
         // functional script polls.
-        return page(response, status, html, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
+        return page(response, status, document, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
     /** The needs-you count every surface wears, read from this request's own
      * Work counts (one query per request, never a cached earlier one), so a
@@ -1513,41 +1515,30 @@ export function createDecisionServer(options) {
             if (peekCache.size <= PEEK_CACHE_ENTRIES && peekCacheBytes <= PEEK_CACHE_BYTES)
                 break;
             peekCache.delete(key);
-            peekCacheBytes -= Buffer.byteLength(entry.fragment);
+            peekCacheBytes -= entry.bytes;
         }
     };
     /** One typed sentence inside the region — plain words, no raw errors.
      * `final` marks conditions that cannot heal for this run (finished,
      * superseded, wrong machine): the region poller reads the marker and
      * stops, instead of refetching a dead build every beat forever. */
-    const peekSay = (message, final = false) => `<p class="meta"${final ? " data-region-stop" : ""}>${escape(message)}</p>`;
+    const peekSay = (message, final = false) => html `<p class="meta"${final ? html ` data-region-stop` : ""}>${message}</p>`;
     /** The sanitize pipeline (finding 30/35): normalize → mask → escape. */
     const peekName = (path) => {
         const normalized = path.replace(/[\u0000-\u001f\u007f]/g, "");
         const masked = scanForSecrets(normalized).length > 0 ? "[redacted: a credential-shaped name]" : normalized;
-        return escape(masked);
+        return textHtml(masked);
     };
     async function handlePost(route, url, who, request, response, posted) {
-        const early = () => dispatchConsole(route, { url, who, request, response, route, now: clock(), project: projectOf(who, request) ?? null, chosenProject: projectOf(who, request) ?? null, posted });
+        // Every POST passes the shared mutation guard. Caller, scope, project (including a limited account's posted repo)
+        // and role were admitted by the route table.
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message);
-        if (["chat.demo", "provider.resume", "settings.updates-dismiss", "settings.updates-checks", "code.act"].includes(route.id))
-            return early();
-        if (restricted()) {
-            const repos = readForm(posted, CONSOLE_FORMS.projectCeiling).getAll("repo");
-            if (repos.length > 1 || repos.some(repo => repo.trim() !== "" && !visible(repo.trim())))
-                return refuse(response, who, 403, "That project is outside your access.", "/projects");
-        }
-        // THE CENTRAL VIEWER GATE (modes chain, D2/E2): consequential POSTs
-        // require ACTIVE approver standing — cookie and bearer alike — with
-        // an EXACT allowlist of session-local acts, never a prefix. /login,
-        // /logout and /join answer before this handler.
-        if (who.role === "viewer") {
-            if (route.viewer !== true) {
-                return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");
-            }
-        }
+        // Standing can change after a token was minted: a viewer's act stays refused, cookie and bearer alike, except
+        // the row's session-local acts.
+        if (who.role === "viewer" && !route.viewer)
+            return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");
         const now = clock();
         // Any accepted mutation may change what the inbox owes; the badge
         // re-counts within five seconds either way, this just makes it exact.
@@ -1568,7 +1559,7 @@ export function createDecisionServer(options) {
         });
     });
     // Keep native process custody until shutdown has verified agent/tool exit.
-    // Coding custody does not depend on teammates or the lead's follow pass, so
+    // Coding custody does not depend on subagents or the lead's follow pass, so
     // it closes at once and never waits behind a model turn: a stop must release
     // the owner record well inside the service's exit window (Oct 2: deploys
     // over 0.9.11 found it still held by a killed process).
@@ -1588,14 +1579,9 @@ export function createDecisionServer(options) {
             requestBudget.flush();
         }
         catch { /* saved again on the close event when it can be */ }
-        for (const stream of teamStreams)
-            stream.end();
-        teamStreams.clear();
-        for (const stream of chatStreams)
-            stream.end();
-        chatStreams.clear();
         flowRooms.close();
         taskRooms.close();
+        liveHandlers.close();
         detachReads();
         liveFollower.close();
         void Promise.all([closeCoding(), bounded(team.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())]).then(() => closeServer(callback)).catch(error => {
@@ -1654,18 +1640,18 @@ export function createDecisionServer(options) {
         get flowRooms() { return flowRooms; },
         get providerHome() { return providerHome; },
         get toolHome() { return toolHome; },
-        get matePrincipal() { return matePrincipal; },
+        get leadPrincipal() { return leadPrincipal; },
         get chatScopeOf() { return chatScopeOf; },
         get liveTurns() { return liveTurns; },
-        get chatStreams() { return chatStreams; },
-        get mateConversationRows() { return mateConversationRows; },
+        get liveTurnStarted() { return liveTurnStarted; },
+        get leadConversationRows() { return leadConversationRows; },
         get demoLeadHere() { return demoLeadHere; },
         get teamBrowserReply() { return teamBrowserReply; },
         get team() { return team; },
         get teamChatProvider() { return teamChatProvider; },
         get pullRequestTargetOf() { return pullRequestTargetOf; },
         get chatEnablement() { return chatEnablement; },
-        get startMateConversation() { return startMateConversation; },
+        get startLeadConversation() { return startLeadConversation; },
         get projectFamilyPeek() { return projectFamilyPeek; },
         get needsYouBadge() { return needsYouBadge; },
         get liveRefreshSeconds() { return liveRefreshSeconds; },
@@ -1698,7 +1684,7 @@ export function createDecisionServer(options) {
         get deletedRepos() { return deletedRepos; },
         get lookupSession() { return lookupSession; },
         get authorizeMutation() { return authorizeMutation; },
-        get mateSaid() { return mateSaid; },
+        get leadSaid() { return leadSaid; },
         get armTaskResume() { return armTaskResume; },
         get chatFetcher() { return chatFetcher; },
         get chatCeilingDigest() { return chatCeilingDigest; },
@@ -1763,7 +1749,6 @@ export function createDecisionServer(options) {
         get allowedHost() { return allowedHost; },
         get team() { return team; },
         get teamBrowserReply() { return teamBrowserReply; },
-        get teamStreams() { return teamStreams; },
         get requestBudget() { return requestBudget; },
         get options() { return options; },
         get coding() { return coding; },
@@ -1781,13 +1766,26 @@ export function createDecisionServer(options) {
         get teamsSourceBudget() { return teamsSourceBudget; },
         get teamsTenantBudget() { return teamsTenantBudget; },
     };
+    const liveHandlers = createLiveHandlers(handlerRuntime, { bus: liveBus, workspaceRevision, chatProjectOf: chatHandlers.chatProjectOf });
+    liveTurnStarted = liveHandlers.turnStarted;
     const remoteHandlers = createRemoteHandlers(remoteRuntime);
     const registry = createHandlerRegistry([
         ...tasksHandlers.registrations, ...flowsHandlers.registrations, ...chatHandlers.registrations,
         ...settingsHandlers.registrations, ...peopleHandlers.registrations, ...pagesHandlers.registrations,
-        ...remoteHandlers.registrations,
+        ...remoteHandlers.registrations, ...liveHandlers.registrations,
     ]);
-    function dispatchConsole(route, ctx) { return registry.console(route, ctx); }
+    /** The row's role, after admission and before its one handler. */
+    function dispatchConsole(route, ctx) {
+        const { who, response } = ctx;
+        const held = route.role === "any" || ((!route.roleBrowser || who.via === "cookie") &&
+            (route.role === "approver" ? who.role === "approver" : store.isInstanceOperator(who.name)));
+        if (!held) {
+            ctx.request.resume();
+            const refusal = route.roleRefusal;
+            return Promise.resolve("message" in refusal ? refuse(response, who, 403, refusal.message, refusal.back) : respond(response, refusal.status, refusal.type, refusal.body));
+        }
+        return registry.console(route, ctx);
+    }
     async function dispatchEdge(route, ctx) {
         if (route.callers.length === 1 && route.callers[0] === 'cookie' && ctx.request.headers.authorization !== undefined) {
             return respond(ctx.response, 403, 'text/plain; charset=utf-8', 'This address needs a browser sign-in.');
@@ -1801,4 +1799,12 @@ export function createDecisionServer(options) {
     }
     return Object.assign(server, { mintSignInLink, closeCoding });
 }
-export { decisionAnswerScript, diffFileAnchor, earlierVersionsWords, editorFileHref, inboxFingerprints, needActionOf, orderChangedFiles, PAGE_CSS, parseInboxTab, pinnedTheme, plainConclusionOf, queueScript, rankReviewQueue, redactedPath, reviewFilePriority, reviewPriorityOf, revisionLineageWords, runFactsFragment, SENSITIVE_INPUT, settingsGroups, settingsTiles, SHUTDOWN_WAIT_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_COMPOSER_MODES, withinSignedTouches, wrongHostPage } from "./server/shared.js";
+export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
+export { redactedPath, SHUTDOWN_WAIT_MS } from "./server/http.js";
+export { TASK_COMPOSER_MODES } from "./server/render-chat.js";
+export { inboxFingerprints, parseInboxTab, queueScript } from "./server/render-pages.js";
+export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches } from "./server/render-results.js";
+export { settingsGroups, settingsTiles } from "./server/render-settings.js";
+export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
+export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";

package/dist/server/chat.d.ts

@@ -1,26 +1,23 @@
-import type { Registration } from './handler-registry.js';
 import { type BrowserFirstRun, type BrowserHome, type BrowserPhoneCard } from '../browser-workspace.js';
 import { type DemoResultView } from "../demo-chat.js";
 import type { DemoExchange } from "../demo.js";
 import { type FirstTaskSuggestion } from "../first-run.js";
-import type { MateProgress } from "../mate-progress.js";
+import type { LeadProgress } from "../lead-progress.js";
 import type { DirectChatProviderId } from "../store.js";
-import type { HandlerContext } from './handler-context.js';
 import type { ServerRuntime } from './runtime.js';
-import { type ChatEnablement, type Session, type Who } from "./shared.js";
+import { type ChatEnablement } from "./render-chat.js";
+import { type Session, type Who } from "./session.js";
 export declare function createChatHandlers(runtime: ServerRuntime): {
-    registrations: Registration[];
-    get: (ctx: HandlerContext) => Promise<void>;
-    post: (ctx: HandlerContext) => Promise<void>;
+    registrations: import("./handler-registry.js").Registration[];
     chatFirstRun: (now: Date, project: string | null) => BrowserFirstRun | undefined;
     phoneCard: (who: Who & {
         via: "cookie";
     }, now: Date) => BrowserPhoneCard | undefined;
     chatProjectOf: (values: string[]) => string | null | undefined;
-    beginLiveTurn: (thread: number) => (event: MateProgress) => void;
+    beginLiveTurn: (thread: number) => (event: LeadProgress) => void;
     endLiveTurn: (thread: number, ok: boolean) => void;
-    noteMate: (csrf: string, turn: number | null, message: string) => void;
-    takeMateNote: (csrf: string, liveSession: number | null) => string | null;
+    noteLead: (csrf: string, turn: number | null, message: string) => void;
+    takeLeadNote: (csrf: string, liveSession: number | null) => string | null;
     demoResultView: (exchange: DemoExchange) => DemoResultView | null;
     storeChatKey: (provider: DirectChatProviderId, key: string) => {
         ok: true;