bazaar-compute-node 0.2.1rc8__tar.gz → 0.2.1rc10__tar.gz

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazaar-compute-node
-Version: 0.2.1rc8
+Version: 0.2.1rc10
 Summary: Runtime-agnostic computer node daemon for agents and channels.
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc8"
+version = "0.2.1rc10"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc8"
+version = "0.2.1rc10"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/contrib/sqlite/migrations/registry.py

@@ -14,6 +14,7 @@ from .v03_roles_oidc import ROLES_OIDC_MIGRATION
 from .v04_login_order import LOGIN_ORDER_MIGRATION
 from .v05_provider_description import PROVIDER_DESCRIPTION_MIGRATION
 from .v06_provider_default_role import PROVIDER_DEFAULT_ROLE_MIGRATION
+from .v07_oidc_session_settings import OIDC_SESSION_SETTINGS_MIGRATION
 
 
 class MigrationError(RuntimeError):
@@ -38,6 +39,7 @@ MIGRATIONS = _migration_ledger(
     LOGIN_ORDER_MIGRATION,
     PROVIDER_DESCRIPTION_MIGRATION,
     PROVIDER_DEFAULT_ROLE_MIGRATION,
+    OIDC_SESSION_SETTINGS_MIGRATION,
 )
 
 

bazaar_compute_node-0.2.1rc10/src/bazaar_compute_server/contrib/sqlite/migrations/v07_oidc_session_settings.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from .model import Migration
+
+OIDC_SESSION_SETTINGS_MIGRATION = Migration(
+    version=7,
+    name="oidc_session_settings",
+    statements=(
+        "ALTER TABLE oidc_providers ADD COLUMN session_minutes INTEGER NOT NULL DEFAULT 10",
+        "DROP TABLE oidc_transactions",
+    ),
+)

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/contrib/sqlite/storage.py

@@ -25,7 +25,6 @@ from ...storage import (
     Enrolment,
     IStorage,
     OIDCProvider,
-    OIDCTransaction,
     Role,
     RoleShare,
     StoredEvent,
@@ -300,10 +299,10 @@ class SqliteStorage(IStorage):
     async def save_oidc_provider(self, provider: OIDCProvider) -> None:
         async def save(db: aiosqlite.Connection) -> None:
             await db.execute(
-                "INSERT INTO oidc_providers(id,name,logo_url,issuer,client_id,client_secret,redirect_uri,created_at_ms,updated_at_ms,description,default_role_id)"
-                " VALUES (?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET"
+                "INSERT INTO oidc_providers(id,name,logo_url,issuer,client_id,client_secret,redirect_uri,created_at_ms,updated_at_ms,description,default_role_id,session_minutes)"
+                " VALUES (?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET"
                 " name=excluded.name,logo_url=excluded.logo_url,issuer=excluded.issuer,client_id=excluded.client_id,"
-                " client_secret=excluded.client_secret,redirect_uri=excluded.redirect_uri,updated_at_ms=excluded.updated_at_ms,description=excluded.description,default_role_id=excluded.default_role_id",
+                " client_secret=excluded.client_secret,redirect_uri=excluded.redirect_uri,updated_at_ms=excluded.updated_at_ms,description=excluded.description,default_role_id=excluded.default_role_id,session_minutes=excluded.session_minutes",
                 (
                     provider.id,
                     provider.name,
@@ -316,6 +315,7 @@ class SqliteStorage(IStorage):
                     provider.updated_at_ms,
                     provider.description,
                     provider.default_role_id,
+                    provider.session_minutes,
                 ),
             )
             await db.execute(
@@ -376,41 +376,6 @@ class SqliteStorage(IStorage):
 
         return await self._write(resolve)
 
-    async def save_oidc_transaction(self, transaction: OIDCTransaction) -> None:
-        async def save(db: aiosqlite.Connection) -> None:
-            await db.execute(
-                "DELETE FROM oidc_transactions WHERE expires_at_ms <= ?", (now_ms(),)
-            )
-            await db.execute(
-                "INSERT INTO oidc_transactions(state,provider_id,browser_hash,nonce,code_verifier,redirect_uri,expires_at_ms,issuer,subject) VALUES (?,?,?,?,?,?,?,?,?)",
-                (
-                    transaction.state,
-                    transaction.provider_id,
-                    transaction.browser_hash,
-                    transaction.nonce,
-                    transaction.code_verifier,
-                    transaction.redirect_uri,
-                    transaction.expires_at_ms,
-                    transaction.issuer,
-                    transaction.subject,
-                ),
-            )
-
-        await self._write(save)
-
-    async def consume_oidc_transaction(
-        self, state: str, browser_hash: str, provider_id: str
-    ) -> OIDCTransaction | None:
-        async def consume(db: aiosqlite.Connection) -> OIDCTransaction | None:
-            async with db.execute(
-                "DELETE FROM oidc_transactions WHERE state=? AND browser_hash=? AND provider_id=? AND expires_at_ms>? RETURNING *",
-                (state, browser_hash, provider_id, now_ms()),
-            ) as rows:
-                row = await rows.fetchone()
-            return None if row is None else OIDCTransaction(**dict(row))
-
-        return await self._write(consume)
-
     async def list_role_shares(self, kind: str, target_id: str) -> list[RoleShare]:
         async with (
             self._reader() as db,

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/gate.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from urllib.parse import urlencode, urlsplit
+
 from starlette.requests import Request
 from starlette.responses import RedirectResponse, Response
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
@@ -106,6 +108,23 @@ def _to_login(request: Request) -> Response:
     destination = (
         "/login/oidc/resume" if request.cookies.get(reauth.COOKIE) else LOGIN_PATH
     )
+    if request.cookies.get(reauth.COOKIE):
+        # Partial requests name the page in the browser, not the fragment endpoint.
+        if request.headers.get("HX-Request") == "true":
+            current = request.headers.get("HX-Current-URL", "")
+        elif request.method in ("GET", "HEAD"):
+            current = str(request.url)
+        else:
+            current = request.headers.get("Referer", "")
+        try:
+            current = urlsplit(current)
+            origin = urlsplit(str(request.url))
+            if (current.scheme, current.netloc) == (origin.scheme, origin.netloc):
+                destination += "?" + urlencode(
+                    {"return_to": current._replace(scheme="", netloc="").geturl()}
+                )
+        except ValueError:
+            pass
     # htmx cannot follow a redirect into the shell; it is told to go there whole
     if request.headers.get("HX-Request") == "true":
         return Response(status_code=401, headers={"HX-Redirect": destination})

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/pages/oidc.py

@@ -38,6 +38,7 @@ class ProviderForm(BaseModel):
         str, StringConstraints(strip_whitespace=True, max_length=200)
     ] = ""
     default_role_id: str = ""
+    session_minutes: int = Field(default=10, ge=1)
 
     clear_logo: bool = False
     issuer: HttpUrl
@@ -127,6 +128,7 @@ class OIDCPages:
                 "name": selected.name if selected else "",
                 "description": selected.description if selected else "",
                 "default_role_id": (selected.default_role_id or "") if selected else "",
+                "session_minutes": str(selected.session_minutes if selected else 10),
                 "logo_url": selected.logo_url if selected else "",
                 "issuer": selected.issuer if selected else "",
                 "client_id": selected.client_id if selected else "",
@@ -179,6 +181,7 @@ class OIDCPages:
                 "redirect_uri",
             )
         }
+        values["session_minutes"] = str(form.get("session_minutes", "10"))
         values["logo_url"] = selected.logo_url if selected else ""
         logo = form.get("logo")
         logo_url = values["logo_url"]
@@ -241,6 +244,7 @@ class OIDCPages:
             now_ms(),
             description=parsed.description,
             default_role_id=parsed.default_role_id or None,
+            session_minutes=parsed.session_minutes,
         )
         await self._storage.save_oidc_provider(provider)
         await self.refs.load([provider.id])

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/pages/oidc_login.py

@@ -1,30 +1,60 @@
-"""OIDC protocol calls with single-use, browser-bound transactions in BCS storage."""
+"""OIDC protocol calls with short-lived, single-use in-memory login state."""
 
 from __future__ import annotations
 
+from collections import OrderedDict
 from hashlib import sha256
+from pathlib import PurePosixPath
 from secrets import token_urlsafe
 
 from authlib.integrations.base_client import OAuthError
 from authlib.integrations.starlette_client import StarletteOAuth2App
 from httpx2 import HTTPError
 from joserfc.errors import JoseError
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, Field, ValidationError, field_validator
 from starlette.requests import Request
 from starlette.responses import RedirectResponse, Response
+from yarl import URL
 
 from .. import reauth
 from ..clock import now_ms
 from ..gate import set_session
 from ..rendering import Renderer
 from ..sessions import Sessions
-from ..storage import IStorage, OIDCProvider, OIDCTransaction
+from ..storage import IStorage, OIDCProvider
 from .login import HOME
 
 LIFETIME = 600
+MAX_TRANSACTIONS = 1024
 COOKIE = "bcs_oidc"
 
 
+class Destination(BaseModel):
+    return_to: str = Field(default=HOME, max_length=8192)
+
+    @field_validator("return_to")
+    @classmethod
+    def local_path(cls, value: str) -> str:
+        url = URL(value)
+        path = PurePosixPath(url.raw_path)
+        if url.scheme or url.authority or path.root != "/":
+            raise ValueError("return_to must be a local absolute path")
+        return str(
+            url.with_path(str(path), encoded=True, keep_query=True, keep_fragment=True)
+        )
+
+
+class Transaction(Destination):
+    expires_at_ms: int
+    browser_hash: str
+    provider_id: str
+    nonce: str
+    code_verifier: str
+    redirect_uri: str
+    issuer: str
+    subject: str
+
+
 class Callback(BaseModel):
     state: str = Field(min_length=1, max_length=256)
     code: str = Field(default="", max_length=8192)
@@ -39,8 +69,8 @@ class Identity(BaseModel):
 
 
 def client(provider: OIDCProvider) -> StarletteOAuth2App:
-    # BCS stores/consumes state itself; these Authlib protocol methods do not
-    # use the framework session adapter or expose protocol data in cookies.
+    # BCS keeps login state in memory rather than the framework session adapter.
+    # Authlib handles the protocol and token checks.
     return StarletteOAuth2App(
         framework=None,
         client_id=provider.client_id,
@@ -62,6 +92,7 @@ class OIDCLoginPages:
         self._storage = storage
         self._render = renderer
         self._sessions = sessions
+        self._transactions: OrderedDict[str, Transaction] = OrderedDict()
 
     async def failure(self, request: Request, reason: str) -> Response:
         response = self._render.standalone(
@@ -106,6 +137,10 @@ class OIDCLoginPages:
     async def _start(
         self, request: Request, provider: OIDCProvider, hint: reauth.Hint | None = None
     ) -> Response:
+        try:
+            destination = Destination.model_validate(dict(request.query_params))
+        except ValidationError:
+            destination = Destination()
         state, nonce, verifier, browser = (token_urlsafe(32) for _ in range(4))
         oauth = client(provider)
         try:
@@ -121,19 +156,24 @@ class OIDCLoginPages:
             )
         except HTTPError, OAuthError, ValueError, KeyError, RuntimeError:
             return await self.failure(request, "oidc.unavailable")
-        await self._storage.save_oidc_transaction(
-            OIDCTransaction(
-                state,
-                provider.id,
-                sha256(browser.encode()).hexdigest(),
-                nonce,
-                verifier,
-                provider.redirect_uri,
-                now_ms() + LIFETIME * 1000,
-                hint.issuer if hint else "",
-                hint.subject if hint else "",
-            )
+        self._transactions[state] = Transaction(
+            expires_at_ms=now_ms() + LIFETIME * 1000,
+            browser_hash=sha256(browser.encode()).hexdigest(),
+            provider_id=provider.id,
+            nonce=nonce,
+            code_verifier=verifier,
+            redirect_uri=provider.redirect_uri,
+            issuer=hint.issuer if hint else "",
+            subject=hint.subject if hint else "",
+            return_to=destination.return_to,
         )
+        # Each entry is read only when consumed, so the oldest pending entry
+        # is also the least recently used one.
+        while self._transactions and (
+            len(self._transactions) > MAX_TRANSACTIONS
+            or next(iter(self._transactions.values())).expires_at_ms <= now_ms()
+        ):
+            self._transactions.popitem(last=False)
         response = RedirectResponse(authorization["url"], status_code=302)
         response.delete_cookie(reauth.COOKIE, path="/")
         response.set_cookie(
@@ -154,13 +194,16 @@ class OIDCLoginPages:
             values = Callback.model_validate(dict(request.query_params))
         except ValidationError:
             return await self.failure(request, "oidc.expired")
-        transaction = await self._storage.consume_oidc_transaction(
-            values.state,
-            sha256(request.cookies.get(COOKIE, "").encode()).hexdigest(),
-            request.path_params["provider_id"],
-        )
-        if transaction is None:
+        transaction = self._transactions.get(values.state)
+        if (
+            transaction is None
+            or transaction.expires_at_ms <= now_ms()
+            or transaction.browser_hash
+            != sha256(request.cookies.get(COOKIE, "").encode()).hexdigest()
+            or request.path_params["provider_id"] != transaction.provider_id
+        ):
             return await self.failure(request, "oidc.expired")
+        self._transactions.pop(values.state)
         if values.error or not values.code:
             return await self.failure(request, "oidc.failed")
         provider = await self._storage.get_oidc_provider(transaction.provider_id)
@@ -203,12 +246,12 @@ class OIDCLoginPages:
             )
         except ValueError:
             return await self.failure(request, "oidc.default_required")
-        response = RedirectResponse(HOME, status_code=302)
+        response = RedirectResponse(transaction.return_to, status_code=302)
         set_session(
             response,
-            self._sessions.issue(account),
+            self._sessions.issue(account, max_age=provider.session_minutes * 60),
             request=request,
-            max_age=self._sessions.max_age,
+            max_age=provider.session_minutes * 60,
         )
         response.delete_cookie(COOKIE, path="/login/oidc")
         hint = reauth.Hint(

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/locales/en.toml

@@ -438,3 +438,8 @@
 "error.403.text" = "Your account does not have permission to access this page. Choose an available module from the navigation."
 
 "computers.overview" = "Overview"
+
+"oidc.session_minutes" = "Session duration (minutes)"
+"oidc.session_minutes_hint" = "Defaults to 10 minutes. Changes apply on the next sign-in or automatic sign-in renewal."
+
+"history.jump_bottom" = "Jump to latest"

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/locales/zh-CN.toml

@@ -438,3 +438,8 @@
 "error.403.text" = "你的账号没有访问此页面的权限，请通过导航进入可访问的模块。"
 
 "computers.overview" = "概览"
+
+"oidc.session_minutes" = "会话有效期（分钟）"
+"oidc.session_minutes_hint" = "默认 10 分钟。修改后从下一次登录或自动恢复登录起生效。"
+
+"history.jump_bottom" = "跳到底部"

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/static/agent-form.js

@@ -19,7 +19,7 @@ document.addEventListener('alpine:init', () => {
       this.step = Number(this.form.dataset.at || 0);
       for (const family of ['channel', 'runtime']) {
         this.cards[family] = this.cards[family].map(card => ({
-          app_id: '', region: 'feishu', bot_id: '', websocket_url: '',
+          app_id: '', region: 'feishu', bot_id: '', websocket_url: '', version: '',
           model: '', effort: '', sandbox_mode: 'workspace-write', network_access: true,
           models: [{value: card.model || '', label: card.model || labels.modelDefault, efforts: []}],
           efforts: card.effort ? [card.effort] : [], modelState: 'idle', modelError: '',
@@ -69,7 +69,8 @@ document.addEventListener('alpine:init', () => {
     reveal() {
       if (!this.active) return;
       for (const family of ['channel', 'runtime']) {
-        if (this.form.querySelector(`[data-blank="${family}"]`).checkVisibility()) this.loadKinds(family);
+        const blank = this.form.querySelector(`[data-blank="${family}"]`);
+        if (blank.checkVisibility() || (family === 'runtime' && this.cards.runtime.length && (!this.wizard || this.step >= 2))) this.loadKinds(family);
       }
     },
     kindStarted(event) {
@@ -84,6 +85,10 @@ document.addEventListener('alpine:init', () => {
       if (!blank) return;
       this.kindRequests.delete(blank.dataset.blank);
       this.kinds[blank.dataset.blank] = ctx.status === 'swapped' && !blank.querySelector('.err') ? 'ready' : 'error';
+      if (blank.dataset.blank === 'runtime' && this.kinds.runtime === 'ready') {
+        const versions = new Map([...blank.querySelectorAll('[data-add]')].map(option => [option.dataset.add, option.dataset.version]));
+        for (const card of this.cards.runtime) card.version = versions.get(`runtime-${card.kind}`) || '';
+      }
     },
     async loadKinds(family, retry = false) {
       if (!this.active || this.kinds[family] === 'loading' || (!retry && this.kinds[family] !== 'idle')) return;

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/static/app.css

@@ -83,6 +83,7 @@ a { color: inherit; text-decoration: none; }
 
 /* the chat: a run of one speaker's messages under their name, oldest at
    the top, the newest end kept in view; no bubbles, no colour per speaker */
+#chat { position: relative; }
 .chat { flex: 1; overflow-y: auto; padding: 12px 16px; }
 .turn { display: flex; gap: 10px; margin: 10px 0; }
 /* where a day starts, in the chat and the activity log alike: its date
@@ -206,7 +207,7 @@ a { color: inherit; text-decoration: none; }
 /* the card is fixed, shown while the pointer is on the agent's avatar and
    kept by the pointer (the avatar moves it); never clipped by the scrolling
    list it belongs to */
-.agent .card, .turn.own .card { display: none; position: fixed; width: 300px; background: var(--float); border: 1px solid var(--line); border-radius: 8px; box-shadow: 0 8px 24px rgba(16,24,40,.12); padding: 12px 14px; z-index: 3; font-size: .92em; pointer-events: none; }
+.agent .card, .turn.own .card { display: none; position: fixed; width: 300px; background: var(--float); border: 1px solid var(--line); border-radius: 8px; padding: 12px 14px; z-index: 3; font-size: .92em; pointer-events: none; }
 .agent:has(> .in > .av:hover) .card, .turn.own:has(> .av:hover) .card { display: block; }
 .card .h { display: flex; align-items: center; gap: 8px; font-weight: 600; margin-bottom: 8px; }
 .card .h .dot { margin-left: auto; }
@@ -249,6 +250,8 @@ a { color: inherit; text-decoration: none; }
 .btn.icon { width: 28px; height: 28px; padding: 0; justify-content: center; margin-left: auto; color: var(--muted); }
 .btn.icon:hover { color: var(--fg); background: var(--chip); }
 .btn.icon .i { margin: 0; }
+.btn.chat-jump { position: absolute; right: 18px; bottom: 18px; width: 36px; height: 36px; border: 0; background: transparent; color: var(--fg); z-index: 2; }
+.btn.chat-jump .i svg { width: 22px; height: 22px; }
 .btn.icon .i svg { width: 16px; height: 16px; }
 .field { display: flex; align-items: center; gap: 10px; margin: 8px 0; }
 .field label { width: 64px; color: var(--muted); }
@@ -256,7 +259,7 @@ a { color: inherit; text-decoration: none; }
 /* a text box grows with what is typed, from three lines, and has no grip */
 .field textarea { resize: none; field-sizing: content; min-height: 3lh; }
 /* forms are short: a card no wider than it needs */
-.dialog { border: 1px solid var(--edge); border-radius: 8px; padding: 14px 16px; margin: 12px 0; background: var(--panel); max-width: 420px; box-shadow: 0 10px 30px rgba(16, 24, 40, .14); }
+.dialog { border: 1px solid var(--edge); border-radius: 8px; padding: 14px 16px; margin: 12px 0; background: var(--panel); max-width: 420px; }
 .dialog h3 { margin: 0 0 8px; font-size: 1em; }
 /* a command to copy: wraps rather than scrolls, with the copy button in its corner */
 /* two commands, one per kind of machine: flat tabs, the open one in the
@@ -324,7 +327,7 @@ a { color: inherit; text-decoration: none; }
 @supports (appearance: base-select) {
   .select select, .select select::picker(select) { appearance: base-select; }
   .select select::picker-icon { display: none; }
-  .select select::picker(select) { margin-top: 4px; padding: 4px; border: 1px solid var(--line); border-radius: 8px; background: var(--float); color: var(--fg); box-shadow: 0 8px 24px rgba(16,24,40,.12); }
+  .select select::picker(select) { margin-top: 4px; padding: 4px; border: 1px solid var(--line); border-radius: 8px; background: var(--float); color: var(--fg); }
   .select option { padding: 6px 9px; border-radius: 4px; }
   .select option:hover, .select option:focus-visible { background: var(--hi); outline: none; }
   .select option:checked { color: var(--accent); font-weight: 500; }
@@ -374,7 +377,7 @@ a { color: inherit; text-decoration: none; }
 /* the chat's title wears the conversation's face, which opens its card */
 .hd .face { padding: 0; border: 1px solid var(--line); cursor: pointer; }
 #chat { position: relative; }
-.drawer { position: absolute; top: 0; right: 0; bottom: 0; width: 320px; display: flex; flex-direction: column; background: var(--float); border-left: 1px solid var(--line); box-shadow: -6px 0 18px rgba(16, 24, 40, .06); z-index: 4; }
+.drawer { position: absolute; top: 0; right: 0; bottom: 0; width: 320px; display: flex; flex-direction: column; background: var(--float); border-left: 1px solid var(--line); z-index: 4; }
 .drawer[hidden] { display: none; }
 .drawer .hd .btn.icon { margin-left: auto; }
 .drawer .who { display: flex; gap: 12px; align-items: center; padding: 14px; border-bottom: 1px solid var(--line); }
@@ -427,12 +430,12 @@ a { color: inherit; text-decoration: none; }
 
 /* a form in steps: a sheet over the page, the steps across its top as dots
    on a line, the one open scrolling under them, the buttons at its foot */
-.veil .sheet { width: 520px; max-height: 88vh; display: flex; flex-direction: column; overflow: hidden; border: 1px solid var(--edge); border-radius: 10px; background: var(--canvas); box-shadow: 0 10px 30px rgba(16, 24, 40, .14); }
+.veil .sheet { width: 520px; max-height: 88vh; display: flex; flex-direction: column; overflow: hidden; border: 1px solid var(--edge); border-radius: 10px; background: var(--canvas); }
 .sheet h3 { margin: 0; padding: 16px 18px 10px; font-size: 1em; }
 .sheet .steps { flex: 1; overflow-y: auto; padding: 14px 18px 4px; min-height: 340px; }
 .sheet .steps > [hidden] { display: none; }
 .sheet .hint { margin: 0 0 12px; color: var(--muted); font-size: .9em; }
-.sheet .dialog { max-width: none; margin: 0 0 12px; box-shadow: none; }
+.sheet .dialog { max-width: none; margin: 0 0 12px; }
 .sheet .foot { display: flex; gap: 8px; padding: 12px 18px 16px; border-top: 1px solid var(--line); }
 .sheet .foot .grow { flex: 1; }
 .sheet .foot [hidden] { display: none; }
@@ -478,8 +481,8 @@ a { color: inherit; text-decoration: none; }
 .field [data-again] { margin-left: 0; }
 .field .wait[hidden], .field [data-again][hidden] { display: none; }
 /* a logo beside words sits on their middle, not their baseline */
-.part .title .ch, .part .title .rt, .blank .kinds .ch, .blank .kinds .rt { display: inline-flex; }
-.part .title .ch .i svg, .part .title .rt .i svg, .blank .kinds .ch .i svg, .blank .kinds .rt .i svg { vertical-align: 0; }
+.part .title .kind-logo, .part .title .ch, .part .title .rt, .blank .kinds .ch, .blank .kinds .rt { display: inline-flex; }
+.part .title .ch .i svg, .part .title .rt .i svg, .blank .kinds .ch .i svg, .blank .kinds .rt .i svg { display: block; }
 .field[hidden] { display: none; }
 .part > .field:first-child, .part > input[type=hidden] + .title + .field { margin-top: 0; }
 .part > .field:last-child { margin-bottom: 0; }
@@ -510,7 +513,7 @@ a { color: inherit; text-decoration: none; }
 .switch.text .tab { width: auto; gap: 6px; padding: 0 12px; font: inherit; }
 .profile .body { flex: 1; }
 .profile .body > .dialog, .profile .config { max-width: 480px; }
-.profile .config .dialog, .profile .body > .dialog.part { max-width: none; margin: 0 0 12px; box-shadow: none; }
+.profile .config .dialog, .profile .body > .dialog.part { max-width: none; margin: 0 0 12px; }
 .profile .config .section, .profile .body > .section { margin: 18px 0 8px; }
 .profile .config > .section:first-child, .profile .body > .section:first-child { margin-top: 0; }
 /* the heading names the card: the card need not say it again */
@@ -539,7 +542,7 @@ a { color: inherit; text-decoration: none; }
 .profile .file .name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .profile .file .size, .profile .file .when { color: var(--muted); font-size: .88em; font-variant-numeric: tabular-nums; }
 .profile .health { max-width: 480px; }
-.profile .health .dialog { max-width: none; margin: 0 0 12px; box-shadow: none; }
+.profile .health .dialog { max-width: none; margin: 0 0 12px; }
 .profile .health .section { margin: 18px 0 8px; }
 .profile .health .title { display: flex; align-items: center; gap: 6px; font-weight: 600; margin-bottom: 6px; }
 .profile .health .field .v { display: inline-flex; align-items: baseline; gap: 6px; min-width: 0; overflow-wrap: anywhere; }
@@ -771,7 +774,7 @@ a:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outlin
 .role-tag .i svg { width: 14px; height: 14px; }
 .role-picker-toggle { flex: 1; justify-content: flex-end; gap: 12px; min-width: 24px; min-height: 24px; }
 .role-picker-toggle > span:first-child { margin-right: auto; }
-.role-options { position: absolute; z-index: 10; left: 0; right: 0; top: calc(100% + 6px); padding: 8px; border: 1px solid var(--edge); border-radius: var(--r-sm); background: var(--panel); box-shadow: 0 8px 24px rgba(0,0,0,.12); }
+.role-options { position: absolute; z-index: 10; left: 0; right: 0; top: calc(100% + 6px); padding: 8px; border: 1px solid var(--edge); border-radius: var(--r-sm); background: var(--panel); }
 .role-options > input { width: 100%; }
 .role-options-list { max-height: 220px; overflow-y: auto; margin-top: 6px; }
 .role-options .check { width: auto; padding: 8px; border-radius: var(--r-sm); color: var(--fg); }

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/static/components.js

@@ -238,6 +238,7 @@ document.addEventListener('alpine:init', () => {
   }));
   Alpine.data('history', () => ({
     element: null,
+    atBottom: true,
     pending: new Map(),
     active: true,
     init() {
@@ -245,6 +246,9 @@ document.addEventListener('alpine:init', () => {
       this.$nextTick(() => { if (this.active) this.element.scrollTop = this.element.scrollHeight; });
     },
     destroy() { this.active = false; this.pending.clear(); },
+    updateBottom() {
+      this.atBottom = this.element.scrollHeight - this.element.scrollTop - this.element.clientHeight < 2;
+    },
     before(event) {
       const {ctx} = event.detail;
       if (!this.element.contains(ctx.sourceElement)) return;
@@ -262,6 +266,7 @@ document.addEventListener('alpine:init', () => {
         if (!this.active) return;
         if (position.earlier) this.element.scrollTop = position.top + this.element.scrollHeight - position.height;
         else if (position.bottom) this.element.scrollTop = this.element.scrollHeight;
+        this.updateBottom();
       });
     },
   }));

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/static/poll.js

@@ -52,6 +52,7 @@ document.addEventListener('alpine:init', () => {
       const response = await fetch('/poll', {
         method: 'POST', credentials: 'same-origin', signal: controller.signal,
         headers: {'Content-Type': 'application/json', 'HX-Request': 'true',
+          'HX-Current-URL': location.href,
           'X-Build': document.body.dataset.build,
           'X-Timezone': Intl.DateTimeFormat().resolvedOptions().timeZone},
         body: JSON.stringify({subscriptions: items.map(({id, scope, seen}) => ({id, scope, seen}))}),

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/templates/agent_form.html

@@ -63,8 +63,8 @@
 
 {% macro card_head(family) -%}
 <div class="title">
-  {% for kind in ("telegram", "lark", "wecom") if family == "channel" %}<span x-show="card.kind === '{{ kind }}'">{{ logo(family, kind) }}</span>{% endfor %}
-  {% for kind in ("codex", "claudecode") if family == "runtime" %}<span x-show="card.kind === '{{ kind }}'">{{ logo(family, kind) }}</span>{% endfor %}
+  {% for kind in ("telegram", "lark", "wecom") if family == "channel" %}<span class="kind-logo" x-show="card.kind === '{{ kind }}'">{{ logo(family, kind) }}</span>{% endfor %}
+  {% for kind in ("codex", "claudecode") if family == "runtime" %}<span class="kind-logo" x-show="card.kind === '{{ kind }}'">{{ logo(family, kind) }}</span>{% endfor %}
   <span x-text="labels.{{ family }}[card.kind] || card.kind"></span><span class="ver" x-show="card.version" x-text="card.version"></span>
   <button class="btn icon" type="button" title="{{ t.text('agents.remove_card') }}" aria-label="{{ t.text('agents.remove_card') }}" data-remove @click="removeCard('{{ family }}', card)">{{ c.icon('trash-2') }}</button>
 </div>
@@ -111,7 +111,7 @@
 {% if listed.answer != 'listed' %}
 <p class="err">{{ t.text('agents.' ~ listed.answer, {'code': listed.code}) }}</p><button class="btn sm" type="button" @click="loadKinds('{{ family }}', true)">{{ c.icon('rotate-cw') }} {{ t.text('agents.retry') }}</button>
 {% else %}
-{% for item in listed.kinds %}<button type="button" data-add="{{ family }}-{{ item.kind }}" @click='addCard({{ family|tojson }}, {{ item.kind|tojson }}, {{ (item.version if family == "runtime" else "")|tojson }})'{% if family == 'runtime' and not item.available %} disabled title="{{ t.text('agents.not_found') }}"{% endif %}>{{ logo(family, item.kind) }}{{ kind_name(family, item.kind) }}{% if family == 'runtime' %}{% if item.available %}{% if item.version %}<span class="ver">{{ item.version }}</span>{% endif %}{% else %}<span class="miss">{{ c.icon('triangle-alert') }}</span>{% endif %}{% endif %}</button>{% endfor %}
+{% for item in listed.kinds %}<button type="button" data-add="{{ family }}-{{ item.kind }}"{% if family == "runtime" %} data-version="{{ item.version or '' }}"{% endif %} @click='addCard({{ family|tojson }}, {{ item.kind|tojson }}, {{ (item.version if family == "runtime" else "")|tojson }})'{% if family == 'runtime' and not item.available %} disabled title="{{ t.text('agents.not_found') }}"{% endif %}>{{ logo(family, item.kind) }}{{ kind_name(family, item.kind) }}{% if family == 'runtime' %}{% if item.available %}{% if item.version %}<span class="ver">{{ item.version }}</span>{% endif %}{% else %}<span class="miss">{{ c.icon('triangle-alert') }}</span>{% endif %}{% endif %}</button>{% endfor %}
 {% endif %}
 {%- endmacro %}
 

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/templates/history.html

@@ -1,6 +1,6 @@
 {% import "components.html" as c with context %}
 {% set url = c.messages_url(history.agent, history.contact) %}
-<div class="chat" id="history" x-data="history" @htmx:before:request.window="before($event)" @htmx:after:swap.window="after($event)" @htmx:finally:request.window="pending.delete($event.detail.ctx)">
+<div class="chat" id="history" x-data="history" @scroll.passive="updateBottom()" @resize.window="updateBottom()" @htmx:before:request.window="before($event)" @htmx:after:swap.window="after($event)" @htmx:finally:request.window="pending.delete($event.detail.ctx)">
   {% if history.answer == "offline" %}
   {{ c.empty(t.text("contacts.offline")) }}
   {% elif history.answer != "listed" %}
@@ -10,4 +10,5 @@
   {% if not history.turns %}{{ c.empty(t.text("history.empty"), "message-square-text") }}{% endif %}
   {% endif %}
   {% include "history_end.html" %}
+  <button class="btn icon chat-jump" type="button" x-show="!atBottom" x-cloak @click="element.scrollTop = element.scrollHeight" title="{{ t.text('history.jump_bottom') }}" aria-label="{{ t.text('history.jump_bottom') }}">{{ c.icon("chevrons-down") }}</button>
 </div>

bazaar_compute_node-0.2.1rc10/src/bazaar_compute_server/resources/templates/icons/chevrons-down.svg

@@ -0,0 +1 @@
+<!-- @license lucide-static v1.46.0 - ISC --><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m7 6 5 5 5-5" /><path d="m7 13 5 5 5-5" /></svg>

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/resources/templates/settings_oidc.html

@@ -49,6 +49,7 @@
         </div>
       </div>
       <div class="field"><label for="oidc-default-role">{{ t.text("oidc.default_role") }}</label><span class="select"><select id="oidc-default-role" name="default_role_id"><option value=""{% if not values.default_role_id %} selected{% endif %}>{{ t.text("oidc.global_role") }} · {{ default.name }}</option>{% for role in roles %}<option value="{{ role.id }}"{% if values.default_role_id == role.id %} selected{% endif %}>{{ role.name }}</option>{% endfor %}</select>{{ c.icon("chevron-down") }}</span><small>{{ t.text("oidc.default_role_hint") }}</small></div>
+      <div class="field"><label for="oidc-session-minutes">{{ t.text("oidc.session_minutes") }}</label><input id="oidc-session-minutes" name="session_minutes" type="number" min="1" step="1" value="{{ values.session_minutes }}" required><small>{{ t.text("oidc.session_minutes_hint") }}</small></div>
       <p>{{ t.text("oidc.callback_hint") }}</p>
       <div class="field"><label for="oidc-secret">{{ t.text("oidc.client_secret") }}</label><input id="oidc-secret" name="client_secret" type="password" value="" autocomplete="new-password"{% if not selected %} required{% endif %}></div>{% if selected %}<p>{{ t.text("oidc.secret_set") }}</p>{% endif %}
       <button class="btn p" type="submit">{{ t.text("manage.save") }}</button>

{bazaar_compute_node-0.2.1rc8 → bazaar_compute_node-0.2.1rc10}/src/bazaar_compute_server/sessions.py

@@ -39,8 +39,10 @@ class Sessions:
         self.max_age = max_age
         self.key = b""
 
-    def issue(self, account: Account) -> str:
-        body = f"{account.id}:{now_ms()}:{account.session_version}"
+    def issue(self, account: Account, *, max_age: int | None = None) -> str:
+        issued = now_ms()
+        expires = issued + (self.max_age if max_age is None else max_age) * 1000
+        body = f"{account.id}:{issued}:{account.session_version}:{expires}"
         return f"{body}:{self._sign(body)}"
 
     def read(self, cookie: str | None) -> Claim | None:
@@ -52,13 +54,14 @@ class Sessions:
         if not body or not hmac.compare_digest(self._sign(body), signature):
             return None
         parts = body.split(":")
-        if len(parts) != 3:
+        if len(parts) != 4:
             return None
-        account_id, issued, mark = parts
+        account_id, issued, mark, expires = parts
         if (
             not mark.isdigit()
             or not issued.isdigit()
-            or now_ms() - int(issued) >= self.max_age * 1000
+            or not expires.isdigit()
+            or now_ms() >= int(expires)
         ):
             return None
         return Claim(