Radar: Live, channels, threads and the log for the owner, signed in by a CLI-signed link; ledger writes survive a cancelled caller (#10) 39f5c913f617

// Radar's one script (spec §17.3): when the event stream says something

// changed, fetch this page again and replace <main>. Pages work without it.

(function () {

  var main = document.querySelector("main[data-live]");

  if (!main || !window.EventSource) return;

  var timer = null;

  function refresh() {

    fetch(location.href, { credentials: "same-origin" }).then(function (r) { return r.ok ? r.text() : null; }).then(function (html) {

      if (!html) return;

      var next = new DOMParser().parseFromString(html, "text/html").querySelector("main");

      var active = document.activeElement;

      if (next && !(active && (active.tagName === "TEXTAREA" || active.tagName === "INPUT") && active.value)) main.innerHTML = next.innerHTML;

    });

  }

  var es = new EventSource("/radar/events");

  es.onmessage = function () { clearTimeout(timer); timer = setTimeout(refresh, 300); };

})();

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 32" width="48" height="32" aria-hidden="true">

  <!-- Spectra's mark: one line of light into a prism, out as a band of colour. -->

  <line x1="1" y1="17" x2="17" y2="15" stroke="#f0f6fc" stroke-width="2" stroke-linecap="round" stroke-opacity="0.9"/>

  <path d="M15 27 L24 4 L33 27 Z" fill="none" stroke="#8b949e" stroke-width="2" stroke-linejoin="round"/>

  <g stroke-width="2.2" stroke-linecap="round">

    <line x1="27" y1="13" x2="47" y2="5" stroke="#f85149"/>

    <line x1="27.5" y1="15" x2="47" y2="10" stroke="#ff9e2c"/>

    <line x1="28" y1="17" x2="47" y2="15" stroke="#e3b341"/>

    <line x1="28.5" y1="19" x2="47" y2="20" stroke="#3fb950"/>

    <line x1="29" y1="21" x2="47" y2="25" stroke="#4493f8"/>

    <line x1="29.5" y1="23" x2="47" y2="30" stroke="#a371f7"/>

  </g>

</svg>

/* Radar's look: OxygenHub's (Primer colours, system fonts, rounded boxes,

   underline navigation, sentence case), light or dark with the system. */

:root {

  --bg:#ffffff; --soft:#f6f8fa; --ink:#1f2328; --mute:#59636e; --line:#d1d9e0; --dim:#818b98;

  --acc:#0969da; --ok:#1a7f37; --bad:#d1242f; --warn:#9a6700; --busy:#8250df;

  --header:#f6f8fa; --btn:#f6f8fa; --btn-line:#d1d9e0; --primary:#1f883d; --primary-ink:#ffffff; --banner:#fff8c5;

  --font:-apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif;

  --mono:ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace;

  color-scheme: light;

}

@media (prefers-color-scheme: dark) {

  :root {

    --bg:#0d1117; --soft:#151b23; --ink:#f0f6fc; --mute:#9198a1; --line:#3d444d; --dim:#656c76;

    --acc:#4493f8; --ok:#3fb950; --bad:#f85149; --warn:#d29922; --busy:#a371f7;

    --header:#010409; --btn:#212830; --btn-line:#3d444d; --primary:#238636; --banner:#3b2e00;

    color-scheme: dark;

  }

}

* { box-sizing: border-box; }

body { margin: 0; background: var(--bg); color: var(--ink); font: 14px/1.5 var(--font); }

a { color: var(--acc); text-decoration: none; }

a:hover { text-decoration: underline; }

code, pre, .mono { font-family: var(--mono); font-size: 12px; }

header { display: flex; align-items: center; gap: 12px; padding: 12px 24px; background: var(--header); border-bottom: 1px solid var(--line); }

.brand { display: flex; align-items: center; gap: 8px; color: var(--ink); font-weight: 600; font-size: 16px; }

.brand svg { height: 28px; width: auto; }

header .grow { flex: 1; }

header .who { color: var(--mute); }

nav.band { display: flex; gap: 4px; padding: 0 24px; border-bottom: 1px solid var(--line); background: var(--header); }

nav.band a { padding: 8px 12px; color: var(--ink); border-bottom: 2px solid transparent; }

nav.band a.now { border-bottom-color: #fd8c73; font-weight: 600; }

nav.band a:hover { text-decoration: none; background: var(--soft); border-radius: 6px 6px 0 0; }

.banner { background: var(--banner); border-bottom: 1px solid var(--line); padding: 6px 24px; color: var(--ink); font-size: 13px; }

main { max-width: 1180px; margin: 0 auto; padding: 24px; }

h1 { font-size: 20px; font-weight: 600; margin: 0 0 16px; }

h2 { font-size: 16px; font-weight: 600; margin: 24px 0 8px; }

.box { border: 1px solid var(--line); border-radius: 6px; background: var(--bg); }

.box > .row { padding: 8px 16px; border-top: 1px solid var(--line); }

.box > .row:first-child { border-top: 0; }

.box > .head { padding: 8px 16px; background: var(--soft); border-bottom: 1px solid var(--line); border-radius: 6px 6px 0 0; font-weight: 600; }

.cards { display: grid; grid-template-columns: repeat(auto-fill, minmax(320px, 1fr)); gap: 12px; }

.card { border: 1px solid var(--line); border-radius: 6px; padding: 12px 16px; }

.card .name { font-weight: 600; font-size: 15px; }

.mute { color: var(--mute); }

.dim { color: var(--dim); }

.pill { display: inline-block; padding: 0 8px; border-radius: 2em; border: 1px solid var(--line); font-size: 12px; line-height: 20px; color: var(--mute); }

.p-online { color: var(--ok); border-color: var(--ok); }

.p-busy { color: var(--busy); border-color: var(--busy); }

.p-blocked, .p-paused { color: var(--warn); border-color: var(--warn); }

.ok { color: var(--ok); }

.bad { color: var(--bad); }

.msg { display: flex; flex-direction: column; gap: 2px; }

.msg .meta { color: var(--mute); font-size: 12px; }

.msg .body p { margin: 4px 0; }

.msg .body pre { background: var(--soft); padding: 8px; border-radius: 6px; overflow-x: auto; }

.redacted { color: var(--dim); font-style: italic; }

form.compose { display: flex; flex-direction: column; gap: 8px; margin-top: 16px; }

textarea { width: 100%; min-height: 80px; padding: 8px 12px; border: 1px solid var(--line); border-radius: 6px; background: var(--bg); color: var(--ink); font: inherit; }

button { padding: 5px 16px; border: 1px solid var(--btn-line); border-radius: 6px; background: var(--btn); color: var(--ink); font: inherit; font-weight: 500; cursor: pointer; }

button.primary { background: var(--primary); border-color: rgba(31,35,40,.15); color: var(--primary-ink); align-self: flex-start; }

details > summary { cursor: pointer; list-style: none; }

details[open] > summary { margin-bottom: 6px; }

pre.payload { background: var(--soft); padding: 8px 12px; border-radius: 6px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; }

table.facts td { padding: 2px 12px 2px 0; vertical-align: top; }

table.facts td:first-child { color: var(--mute); white-space: nowrap; }

form.inline { display: inline; }

.filters { display: flex; gap: 8px; margin-bottom: 12px; flex-wrap: wrap; }

.filters a { padding: 2px 10px; border: 1px solid var(--line); border-radius: 2em; color: var(--ink); font-size: 12px; }

.filters a.now { background: var(--acc); border-color: var(--acc); color: #fff; }

footer { max-width: 1180px; margin: 24px auto; padding: 0 24px; color: var(--dim); font-size: 12px; }

//! Radar's sign-in (spec §8.3): the owner's CLI signs a request for a

//! one-time link (`POST /radar/link`, valid 60 s); opening it starts a

//! browser session whose events carry that signed request as their proof

//! (level 2). The passkey (level 3) is 0.2. Sessions live in memory: a

//! restart signs the browser out.

use rand::RngCore;

use std::collections::HashMap;

use std::sync::Mutex;

/// How long a sign-in link is good for, and a session.

pub const LINK_MS: u64 = 60_000;

pub const SESSION_MS: u64 = 12 * 3_600_000;

/// What a session holds: the owner's key and the proof that opened it.

#[derive(Clone, Debug)]

pub struct Session {

    pub key: [u8; 32],

    pub proof: Vec<u8>,

    pub csrf: String,

    pub expires_ms: u64,

}

#[derive(Debug, Default)]

pub struct Sessions {

    codes: Mutex<HashMap<String, (Session, u64)>>,

    live: Mutex<HashMap<String, Session>>,

}

fn random_hex() -> String {

    let mut b = [0u8; 32];

    rand::rngs::OsRng.fill_bytes(&mut b);

    hex::encode(b)

}

impl Sessions {

    /// A one-time code for the owner, from their signed request.

    pub fn link(&self, key: [u8; 32], proof: Vec<u8>, now: u64) -> String {

        let code = random_hex();

        let s = Session { key, proof, csrf: random_hex(), expires_ms: now + SESSION_MS };

        let mut codes = self.codes.lock().unwrap();

        codes.retain(|_, (_, until)| *until > now);

        codes.insert(code.clone(), (s, now + LINK_MS));

        code

    }

    /// Spend a code: the session id, once, within a minute of the link.

    pub fn open(&self, code: &str, now: u64) -> Option<String> {

        let (s, until) = self.codes.lock().unwrap().remove(code)?;

        if until < now {

            return None;

        }

        let id = random_hex();

        let mut live = self.live.lock().unwrap();

        live.retain(|_, s| s.expires_ms > now);

        live.insert(id.clone(), s);

        Some(id)

    }

    pub fn get(&self, id: &str, now: u64) -> Option<Session> {

        self.live.lock().unwrap().get(id).filter(|s| s.expires_ms > now).cloned()

    }

    pub fn close(&self, id: &str) {

        self.live.lock().unwrap().remove(id);

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_link_opens_one_session_once_and_only_while_fresh() {

        let s = Sessions::default();

        let code = s.link([1; 32], vec![9], 1_000);

        let id = s.open(&code, 2_000).expect("fresh");

        assert!(s.open(&code, 2_000).is_none(), "spent");

        assert_eq!(s.get(&id, 3_000).unwrap().key, [1; 32]);

        assert!(s.get(&id, 1_000 + SESSION_MS + 1).is_none(), "expired");

        let stale = s.link([1; 32], vec![9], 1_000);

        assert!(s.open(&stale, 1_000 + LINK_MS + 1).is_none());

        s.close(&id);

        assert!(s.get(&id, 3_000).is_none());

    }

}

<!doctype html>

<html lang="en">

<head>

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1">

<title>{% block title %}{% endblock %} · Spectra</title>

<link rel="stylesheet" href="/radar/style.css">

<link rel="icon" href="/radar/spectra.svg" type="image/svg+xml">

<script src="/radar/radar.js" defer></script>

{% block head %}{% endblock %}

</head>

<body>

<header>

  <a class="brand" href="/">{{ shell.mark|safe }}Spectra</a>

  <span class="grow"></span>

  <span class="who">{{ shell.owner }}</span>

</header>

<nav class="band" aria-label="Radar">

  <a href="/"{% if shell.page == "live" %} class="now"{% endif %}>Live</a>

  <a href="/channels"{% if shell.page == "channels" %} class="now"{% endif %}>Channels</a>

  <a href="/log"{% if shell.page == "log" %} class="now"{% endif %}>Log</a>

</nav>

<div class="banner">Signed in from the command line (level 2). Answering agents' requests and changing rules will need your passkey, which arrives in 0.2.</div>

<main id="main" data-live>

{% block content %}{% endblock %}

</main>

<footer>Spectra {{ shell.version }} · ledger head #{{ shell.head }}</footer>

</body>

</html>

{% extends "base.html" %}

{% block title %}{{ display }}{% endblock %}

{% block content %}

<h1>{{ display }} {% if let Some(t) = thread %}<span class="mute">· thread</span>{% endif %}</h1>

{% if let Some(p) = purpose %}<p class="mute">{{ p }}</p>{% endif %}

<div class="box">

{% if messages.is_empty() %}<div class="row mute">No messages yet.</div>{% endif %}

{% for m in messages %}

  <div class="row msg" id="m{{ m.id }}">

    <div class="meta"><strong>{{ m.author }}</strong> · {{ m.at }} · <code>{{ m.kind }}</code>{% if m.replies > 0 %} · <a href="/c/{{ name }}/t/{{ m.id }}">{{ m.replies }} repl{% if m.replies == 1 %}y{% else %}ies{% endif %}</a>{% else %}{% if thread.is_none() %} · <a href="/c/{{ name }}/t/{{ m.id }}">reply</a>{% endif %}{% endif %} <span class="dim mono">{{ m.id }}</span></div>

    {% if m.redacted %}<div class="redacted">{{ m.body_html|safe }}</div>{% else %}<div class="body">{{ m.body_html|safe }}</div>{% endif %}

  </div>

{% endfor %}

</div>

{% if can_post %}

<form class="compose" method="post" action="{{ action }}">

  <input type="hidden" name="_csrf" value="{{ csrf }}">

  {% if let Some(t) = thread %}<input type="hidden" name="reply_to" value="{{ t }}">{% endif %}

  <textarea name="body" placeholder="Write as {{ shell.owner }}. Markdown; @name mentions." required></textarea>

  <button class="primary" type="submit">{% if thread.is_some() %}Reply{% else %}Post{% endif %}</button>

</form>

{% endif %}

{% endblock %}

{% extends "base.html" %}

{% block title %}Channels{% endblock %}

{% block content %}

<h1>Channels</h1>

<div class="box">

{% for c in channels %}

  <div class="row"><a href="/c/{{ c.name }}"><strong>{{ c.display }}</strong></a> <span class="pill">{{ c.kind }}</span> <span class="mute">{{ c.purpose }}</span> <span class="dim">· {{ c.count }} message(s){% if !c.last.is_empty() %}, last {{ c.last }}{% endif %}</span></div>

{% endfor %}

</div>

{% endblock %}

{% extends "base.html" %}

{% block title %}Live{% endblock %}

{% block head %}<noscript><meta http-equiv="refresh" content="30"></noscript>{% endblock %}

{% block content %}

<h1>Live</h1>

{% if agents.is_empty() %}

<p class="mute">No agents yet. Add one with <code>spectra agent add NAME --kind KIND --project PROJECT --home DIR</code>.</p>

{% else %}

<div class="cards">

{% for a in agents %}

  <div class="card">

    <div class="name">{{ a.name }} <span class="pill p-{{ a.presence }}">{{ a.presence }}</span></div>

    <div class="mute">{{ a.owner }}'s agent · {{ a.kind }} · #{{ a.project }}</div>

    {% if let Some(s) = a.status %}<div>“{{ s }}”</div>{% endif %}

    {% if let Some(t) = a.last_tool %}<div class="dim">last call: <code>{{ t }}</code> {{ a.last_at }}</div>{% endif %}

  </div>

{% endfor %}

</div>

{% endif %}

<h2>Your inbox</h2>

<p class="mute">{{ unread }} unread mention(s) and direct message(s). <a href="/channels">Channels</a></p>

<h2>Recent events</h2>

<div class="box">

{% for e in events %}

  <div class="row"><a class="mono" href="/log?around={{ e.seq }}">#{{ e.seq }}</a> <span class="dim">{{ e.at }}</span> <code>{{ e.kind }}</code> {{ e.actor }}{% if let Some(s) = e.subject %} <span class="dim">{{ s }}</span>{% endif %}</div>

{% endfor %}

</div>

{% endblock %}

{% extends "base.html" %}

{% block title %}Log{% endblock %}

{% block content %}

<h1>Log</h1>

<table class="facts">

  <tr><td>head</td><td class="mono">#{{ shell.head }} {{ head_hash }}</td></tr>

  <tr><td>verified</td><td>{{ verified }}

    <form class="inline" method="post" action="/log/verify"><input type="hidden" name="_csrf" value="{{ csrf }}"> <button type="submit">Verify now</button></form></td></tr>

</table>

<div class="filters">

  <a href="/log"{% if kind.is_empty() %} class="now"{% endif %}>All</a>

{% for k in kinds %}

  <a href="/log?kind={{ k }}"{% if kind.as_str() == k.as_str() %} class="now"{% endif %}>{{ k }}</a>

{% endfor %}

</div>

<div class="box">

{% for e in events %}

  <div class="row"><details><summary><span class="mono">#{{ e.seq }}</span> <span class="dim">{{ e.at }}</span> <code>{{ e.kind }}</code> {{ e.actor }}{% if let Some(s) = e.subject %} <span class="dim">{{ s }}</span>{% endif %} <span class="pill">{{ e.method }} · level {{ e.assurance }}</span></summary>

    <table class="facts">

      <tr><td>hash</td><td class="mono">{{ e.hash }}</td></tr>

      <tr><td>prev</td><td class="mono">{{ e.prev }}</td></tr>

      <tr><td>key</td><td class="mono">{{ e.key }}</td></tr>

      <tr><td>proof</td><td>{{ e.proof }}</td></tr>

      <tr><td>id</td><td class="mono">{{ e.id }}</td></tr>

    </table>

    <pre class="payload">{{ e.payload }}</pre>

  </details></div>

{% endfor %}

</div>

{% if let Some(b) = older %}<p><a href="/log?before={{ b }}{% if !kind.is_empty() %}&amp;kind={{ kind }}{% endif %}">Older events</a></p>{% endif %}

{% endblock %}

<!doctype html>

<html lang="en">

<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Sign in · Spectra</title><link rel="stylesheet" href="/radar/style.css"></head>

<body>

<header><a class="brand" href="/">{{ mark|safe }}Spectra</a></header>

<main>

<h1>Sign in to Radar</h1>

<p>{{ message }}</p>

<p>Run <code>spectra open</code> on this machine: it signs a one-time link with your key and opens it here.</p>

</main>

</body>

</html>

//! `spectra open`: sign in to Radar (spec §8.3). The owner's CLI signs a

//! request for a one-time link with the owner's key; the link, valid for a

//! minute, opens a level-2 browser session.

use super::identity::{owner_home, recorded_owner};

use super::{ui, Ctx};

use anyhow::{bail, Context, Result};

use spectra_core::ledger::Ledger;

use spectra_mcp::client::Client;

use std::path::PathBuf;

pub async fn open(ctx: &Ctx, owner_home_flag: Option<PathBuf>, launch: bool) -> Result<i32> {

    let socket = ctx.socket();

    if !Client::alive(&socket).await {

        bail!("Spectra is not serving {} (spectra serve)", ctx.data.display());

    }

    let home = owner_home(ctx, owner_home_flag);

    let ledger = Ledger::open_read_only(&ctx.db()?).await?;

    let owner = recorded_owner(&ledger, &home).await?;

    let r = Client::new(&socket, Some(owner)).send("POST", "/radar/link", &[], Vec::new()).await?;

    if r.status != 200 {

        bail!("the daemon refused the sign-in: {}", String::from_utf8_lossy(&r.body));

    }

    let url = r.json()?.get("url").and_then(|u| u.as_str()).map(String::from).context("no link in the answer")?;

    println!("{} {}", ui::done("Signed"), ui::subject("a one-time link to Radar, good for a minute"));

    println!("  {}", ui::id(&url));

    if launch

        && std::process::Command::new("xdg-open")

            .arg(&url)

            .stdout(std::process::Stdio::null())

            .stderr(std::process::Stdio::null())

            .spawn()

            .is_ok()

    {

        println!("  {} {}", ui::note(), ui::dim("opened in your browser"));

    }

    Ok(0)

}

//! Radar end to end (spec §17, §8.3, §21.2): the owner signs in with a

//! one-time link their CLI signed, every page renders and none shows

//! without the session, a post needs the session's CSRF token and our own

//! origin and is recorded as a verified session event.

mod common;

use common::{add_agent, hermetic, run, setup, text, Serving};

use serde_json::json;

use spectra_mcp::client::Client;

fn link(d: &std::path::Path) -> String {

    let o = hermetic(d).args(["open", "--no-browser"]).output().unwrap();

    let t = text(&o);

    let url = t.split_whitespace().find(|w| w.starts_with("http://")).unwrap_or_else(|| panic!("no link in {t}")).to_string();

    url.split_once("7350")

        .or_else(|| url.split_once(":0"))

        .map(|(_, p)| p.to_string())

        .unwrap_or_else(|| format!("/{}", url.splitn(4, '/').nth(3).unwrap()))

}

#[tokio::test]

async fn the_owner_signs_in_reads_every_page_and_posts() {

    let dir = setup();

    let d = dir.path();

    let agent = add_agent(d, "claude-oxygen", &[]);

    let srv = Serving::start(d);

    let a = Client::new(&srv.socket, Some(agent));

    let say = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "say", "arguments": { "body": "@andy **ready** for review", "channel": "humans" } } });

    assert_eq!(a.mcp("2025-11-25", &say).await.unwrap().status, 200);

    let web = Client::new(&srv.socket, None);

    for path in ["/", "/channels", "/c/general", "/log"] {

        let r = web.send("GET", path, &[], vec![]).await.unwrap();

        assert_eq!(r.status, 401, "{path} without a session");

        assert!(String::from_utf8_lossy(&r.body).contains("spectra open"));

    }

    let path = link(d);

    let r = web.send("GET", &path, &[], vec![]).await.unwrap();

    assert_eq!(r.status, 303, "{}", String::from_utf8_lossy(&r.body));

    let cookie = r.header("set-cookie").unwrap().split(';').next().unwrap().to_string();

    assert!(r.header("set-cookie").unwrap().contains("HttpOnly"));

    assert_eq!(web.send("GET", &path, &[], vec![]).await.unwrap().status, 401, "a link works once");

    let get = |p: &'static str| {

        let (web, cookie) = (&web, cookie.clone());

        async move {

            let r = web.send("GET", p, &[("cookie", cookie)], vec![]).await.unwrap();

            assert_eq!(r.status, 200, "{p}: {}", String::from_utf8_lossy(&r.body));

            assert!(r.header("content-security-policy").unwrap().contains("default-src 'self'"));

            String::from_utf8_lossy(&r.body).to_string()

        }

    };

    let live = get("/").await;

    assert!(live.contains("claude-oxygen") && live.contains("Andy McCall's agent"), "escaped by askama: {live}");

    assert!(live.contains("1 unread"));

    assert!(get("/channels").await.contains("#humans"));

    let humans = get("/c/humans").await;

    assert!(humans.contains("<strong>ready</strong>"), "Markdown rendered: {humans}");

    let log = get("/log").await;

    assert!(log.contains("message.posted") && log.contains("signature · level 2"));

    let csrf = humans.split("name=\"_csrf\" value=\"").nth(1).unwrap().split('"').next().unwrap().to_string();

    let form = |csrf: &str| format!("_csrf={csrf}&body=Looks+good%2C+%40claude-oxygen").into_bytes();

    let h = |origin: &str| {

        vec![("cookie", cookie.clone()), ("content-type", "application/x-www-form-urlencoded".to_string()), ("origin", origin.to_string())]

    };

    assert_eq!(web.send("POST", "/c/humans", &h("http://evil.example"), form(&csrf)).await.unwrap().status, 403);

    // Without an Origin header (not a browser) the CSRF token alone guards

    // the form; a browser's Origin must also be the daemon's own address.

    let no_origin = vec![("cookie", cookie.clone()), ("content-type", "application/x-www-form-urlencoded".to_string())];

    assert_eq!(web.send("POST", "/c/humans", &no_origin, form("stale")).await.unwrap().status, 403);

    assert_eq!(web.send("POST", "/c/humans", &no_origin, form(&csrf)).await.unwrap().status, 303);

    assert!(get("/c/humans").await.contains("Looks good"));

    assert_eq!(web.send("POST", "/log/verify", &no_origin, format!("_csrf={csrf}").into_bytes()).await.unwrap().status, 303);

    assert!(get("/log").await.contains("clean at"));

    srv.stop();

    let v: serde_json::Value = serde_json::from_slice(&run(d, &["admin", "verify", "--json"]).stdout).unwrap();

    assert!(v["findings"].as_array().unwrap().is_empty(), "the session post verifies: {v}");

    let pool = sqlx::SqlitePool::connect(&format!("sqlite://{}", d.join("data/spectra.db").display())).await.unwrap();

    let m: (String, i64) = sqlx::query_as("SELECT actor, auth_method FROM events WHERE kind = 'message.posted' ORDER BY seq DESC LIMIT 1")

        .fetch_one(&pool)

        .await

        .unwrap();

    assert_eq!(m, ("human".to_string(), 4), "recorded as the owner, through a session");

}

- **Fixed: a client hanging up mid-request could stop the ledger saving anything.** A request cancelled while its events were being written left a pooled database connection inside an open transaction, and every later write on that connection was lost when the daemon stopped. Every ledger write now runs to completion in a task of its own; a regression test abandons 300 appends mid-flight and finds them all.

- **Added: Radar, the owner's window (#10).** `spectra open` (or `spectra serve --open`) signs a one-time link with the owner's key; the browser session it opens shows Live (each agent with its owner, presence, status and last call; the inbox; recent events), Channels, a channel or thread with a compose box, and the Log, with each event's hash, proof and level and a Verify now button. Pages refresh from an event stream that carries ids, never data, and work without JavaScript; posts need the session's CSRF token and Spectra's own origin and are recorded as the owner's, with the signed link as proof.

name = "ammonia"

version = "4.2.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "1f45dfa685e1ec33b1bf1a3b93b8047cbdbef41b6040deebbe6bea7720a45574"

dependencies = [

 "cssparser",

 "html5ever",

 "maplit",

 "url",

]

[[package]]

[[package]]

name = "askama"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "f75363874b771be265f4ffe307ca705ef6f3baa19011c149da8674a87f1b75c4"

dependencies = [

 "askama_derive",

 "itoa",

 "percent-encoding",

 "serde",

 "serde_json",

]

name = "askama_derive"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "129397200fe83088e8a68407a8e2b1f826cf0086b21ccdb866a722c8bcd3a94f"

dependencies = [

 "askama_parser",

 "basic-toml",

 "memchr",

 "proc-macro2",

 "quote",

 "rustc-hash",

 "serde",

 "serde_derive",

 "syn 2.0.119",

]

[[package]]

name = "askama_parser"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "d6ab5630b3d5eaf232620167977f95eb51f3432fc76852328774afbd242d4358"

dependencies = [

 "memchr",

 "serde",

 "serde_derive",

 "winnow",

]

[[package]]

name = "basic-toml"

version = "0.1.10"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ba62675e8242a4c4e806d12f11d136e626e6c8361d6b829310732241652a178a"

dependencies = [

 "serde",

]

[[package]]

name = "cssparser"

version = "0.38.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "11119743ad110e8c1bdccd930d7f5c30c99e5fc76a7b63ec9807e84eef0c5f59"

dependencies = [

 "dtoa-short",

 "itoa",

 "smallvec",

]

[[package]]

[[package]]

name = "dtoa"

version = "1.0.11"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"

name = "dtoa-short"

version = "0.3.5"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"

dependencies = [

 "dtoa",

]

[[package]]

]

[[package]]

name = "html5ever"

version = "0.40.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "456a1a377e608e555d22ddab27ac0114bc7a7b4199078108e34c2aeae6c9b130"

dependencies = [

 "log",

 "markup5ever",

 "memchr",

[[package]]

name = "maplit"

version = "1.0.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"

name = "markup5ever"

version = "0.40.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0ab3dc68ac4a0f5719e560136778c1ee716e296030d75dbd4484e37e39e3a842"

dependencies = [

 "log",

 "tendril",

 "web_atoms",

]

[[package]]

[[package]]

name = "new_debug_unreachable"

version = "1.0.6"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

[[package]]

name = "phf"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"

dependencies = [

 "phf_shared",

 "serde",

]

[[package]]

name = "phf_codegen"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "41b585a510fb76fdebead6897982ef2a03a21d8e6cbcca904999742a4afc6ffe"

dependencies = [

 "phf_generator",

 "phf_shared",

]

[[package]]

name = "phf_generator"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"

dependencies = [

 "fastrand",

 "phf_shared",

]

name = "phf_shared"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"

dependencies = [

 "siphasher",

]

[[package]]

name = "precomputed-hash"

version = "0.1.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"

[[package]]

name = "pulldown-cmark"

version = "0.13.6"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3db2be46835f013dd3f4fa7f5f7402c537787b54ebb6fe2b94bbdd7e2669bb7b"

dependencies = [

 "bitflags",

 "memchr",

 "pulldown-cmark-escape",

 "unicase",

]

[[package]]

name = "pulldown-cmark-escape"

version = "0.11.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"

[[package]]

 "ammonia",

 "anyhow",

 "askama",

 "axum",

 "futures",

 "hex",

 "oxy-core",

 "pulldown-cmark",

 "rand 0.8.8",

 "serde",

 "serde_json",

 "spectra-mcp",

 "sqlx",

 "tokio",

 "tokio-stream",

 "tracing",

name = "rustc-hash"

version = "2.1.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"

[[package]]

name = "siphasher"

version = "1.0.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"

[[package]]

[[package]]

name = "string_cache"

version = "0.11.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ffa8a5dbe8b3f0bbe29d4c3225daafaeead63afdc1b65fc4c01a1384166038e6"

dependencies = [

 "new_debug_unreachable",

 "parking_lot",

 "phf_shared",

 "precomputed-hash",

]

[[package]]

name = "string_cache_codegen"

version = "0.11.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "928dcdf75e47626b3617a976ec205d9f057584c371c1f23b782129268d0e6edc"

dependencies = [

 "phf_generator",

 "phf_shared",

 "proc-macro2",

 "quote",

]

name = "tendril"

version = "0.5.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"

dependencies = [

 "new_debug_unreachable",

]

[[package]]

name = "unicase"

version = "2.10.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"

[[package]]

]

[[package]]

name = "web_atoms"

version = "0.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7572660c8890448ba236b7376f27e389c6a7e1c70195622faced601f855c0ada"

dependencies = [

 "phf",

 "phf_codegen",

 "string_cache",

 "string_cache_codegen",

spectra-mcp.workspace = true

oxy-core.workspace = true

anyhow.workspace = true

axum.workspace = true

askama.workspace = true

serde.workspace = true

serde_json.workspace = true

tokio.workspace = true

futures.workspace = true

tokio-stream.workspace = true

sqlx.workspace = true

rand.workspace = true

hex.workspace = true

tracing.workspace = true

pulldown-cmark.workspace = true

ammonia.workspace = true

//! Radar (spec §17): the human's pages, rendered with askama, refreshed

//! from the event stream, working without JavaScript. Linked by `spectra`

//! and, later, mounted by SpectraHub.

//!

//! The owner signs in with a one-time link their CLI signed (`spectra

//! open`); everything they do here is recorded with that signed request as

//! its proof (spec §8.3). Every unsafe request carries the session's CSRF

//! token and a same-origin `Origin`.

pub mod session;

use askama::Template;

use axum::body::Bytes;

use axum::extract::connect_info::ConnectInfo;

use axum::extract::{Form, Path, Query, State};

use axum::http::{header, HeaderMap, HeaderValue, StatusCode};

use axum::response::sse::{Event as SseEvent, KeepAlive, Sse};

use axum::response::{Html, IntoResponse, Redirect, Response};

use axum::routing::{get, post};

use axum::Router;

use futures::StreamExt;

use serde::Deserialize;

use session::{Session, Sessions};

use spectra_core::conversation::{self as conv, Author, Post, Signer};

use spectra_core::event::{Auth, Method};

use spectra_core::ids::{format_time, now_ms};

use spectra_core::principals::{Principal, Principals};

use spectra_mcp::http::{AppState, PeerInfo};

use std::sync::Arc;

use std::time::Duration;

const MARK: &str = include_str!("../assets/spectra.svg");

const STYLE: &str = include_str!("../assets/style.css");

const SCRIPT: &str = include_str!("../assets/radar.js");

const COOKIE: &str = "spectra_session";

#[derive(Clone)]

pub struct RadarState {

    pub app: AppState,

    pub sessions: Arc<Sessions>,

}

/// Radar's routes.

pub fn router(app: AppState) -> Router {

    let state = RadarState { app, sessions: Arc::new(Sessions::default()) };

    Router::new()

        .route("/", get(live))

        .route("/channels", get(channels))

        .route("/c/{name}", get(channel).post(post_channel))

        .route("/c/{name}/t/{id}", get(thread).post(post_thread))

        .route("/log", get(log))

        .route("/log/verify", post(verify))

        .route("/radar/link", post(link))

        .route("/signin", get(signin))

        .route("/signout", post(signout))

        .route("/radar/events", get(events))

        .route("/radar/style.css", get(|| async { asset("text/css; charset=utf-8", STYLE) }))

        .route("/radar/radar.js", get(|| async { asset("text/javascript; charset=utf-8", SCRIPT) }))

        .route("/radar/spectra.svg", get(|| async { asset("image/svg+xml", MARK) }))

        .layer(axum::middleware::map_response(security_headers))

        .with_state(state)

}

fn asset(kind: &'static str, body: &'static str) -> Response {

    ([(header::CONTENT_TYPE, kind), (header::CACHE_CONTROL, "max-age=300")], body).into_response()

}

/// CSP and friends on every response (spec §21.2).

async fn security_headers(mut r: Response) -> Response {

    let h = r.headers_mut();

    h.insert("content-security-policy", HeaderValue::from_static("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; form-action 'self'; base-uri 'none'"));

    h.insert("x-content-type-options", HeaderValue::from_static("nosniff"));

    // `same-origin`: a form post still carries our Origin (no-referrer makes it `null`).

    h.insert("referrer-policy", HeaderValue::from_static("same-origin"));

    h.insert("x-frame-options", HeaderValue::from_static("DENY"));

    r

}

/// What every page's frame shows.

pub struct Shell {

    pub page: &'static str,

    pub owner: String,

    pub head: u64,

    pub version: &'static str,

    pub mark: &'static str,

}

/// The signed-in owner, or the page that says how to sign in.

struct Owner {

    session: Session,

    principal: Principal,

    shell: Shell,

}

impl Owner {

    fn author(&self) -> Author<'static> {

        Author {

            principal: self.principal.clone(),

            signer: Signer::Request(Auth {

                key: Some(self.session.key),

                method: Method::Session,

                assurance: 2,

                proof: Some(self.session.proof.clone()),

            }),

        }

    }

}

fn cookie(headers: &HeaderMap) -> Option<String> {

    let c = headers.get(header::COOKIE)?.to_str().ok()?;

    c.split(';').map(str::trim).find_map(|kv| kv.strip_prefix(&format!("{COOKIE}=")).map(String::from))

}

async fn owner(st: &RadarState, headers: &HeaderMap, page: &'static str) -> Result<Owner, Response> {

    let now = now_ms();

    let session = cookie(headers)

        .and_then(|id| st.sessions.get(&id, now))

        .ok_or_else(|| signin_page("Radar shows Spectra to its owner only.", StatusCode::UNAUTHORIZED))?;

    let d = &st.app.daemon;

    let principal = d

        .principals

        .read()

        .await

        .principal(&oxy_core_key(session.key), now)

        .map_err(|why| signin_page(&format!("This session no longer belongs to the owner: {why}."), StatusCode::UNAUTHORIZED))?;

    if !matches!(principal, Principal::Owner { .. }) {

        return Err(signin_page("Radar shows Spectra to its owner only.", StatusCode::FORBIDDEN));

    }

    let shell = Shell { page, owner: principal.display(), head: d.ledger.head().await.0, version: env!("CARGO_PKG_VERSION"), mark: MARK };

    Ok(Owner { session, principal, shell })

}

fn oxy_core_key(k: [u8; 32]) -> oxy_core::hash::KeyId {

    oxy_core::hash::ObjectRef(k)

}

#[derive(Template)]

#[template(path = "signin.html")]

struct SigninPage<'a> {

    mark: &'static str,

    message: &'a str,

}

fn signin_page(message: &str, status: StatusCode) -> Response {

    (status, render(&SigninPage { mark: MARK, message })).into_response()

}

fn render<T: Template>(t: &T) -> Response {

    match t.render() {

        Ok(html) => Html(html).into_response(),

        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("could not render the page: {e}")).into_response(),

    }

}

/// Unsafe requests: the session's CSRF token and our own origin.

/// The refusal, if the form may not go through.

fn check_form(st: &RadarState, o: &Owner, headers: &HeaderMap, csrf: &str) -> Option<Response> {

    if !spectra_mcp::http::origin_ok(headers, &st.app.origins) {

        return Some((StatusCode::FORBIDDEN, "this origin may not change Spectra").into_response());

    }

    if csrf != o.session.csrf {

        return Some((StatusCode::FORBIDDEN, "the form is stale: reload the page").into_response());

    }

    None

}

/// Markdown, sanitised: what a message's body becomes on a page.

fn markdown(body: &str) -> String {

    let mut html = String::new();

    pulldown_cmark::html::push_html(

        &mut html,

        pulldown_cmark::Parser::new_ext(body, pulldown_cmark::Options::ENABLE_STRIKETHROUGH | pulldown_cmark::Options::ENABLE_TABLES),

    );

    ammonia::clean(&html)

}

// ---- Live ----

struct AgentCard {

    name: String,

    owner: String,

    kind: String,

    project: String,

    presence: String,

    status: Option<String>,

    last_tool: Option<String>,

    last_at: String,

}

struct EventRow {

    seq: i64,

    at: String,

    kind: String,

    actor: String,

    subject: Option<String>,

}

#[derive(Template)]

#[template(path = "live.html")]

struct LivePage {

    shell: Shell,

    agents: Vec<AgentCard>,

    unread: i64,

    events: Vec<EventRow>,

}

async fn live(State(st): State<RadarState>, headers: HeaderMap) -> Response {

    let o = match owner(&st, &headers, "live").await {

        Ok(o) => o,

        Err(r) => return r,

    };

    let d = &st.app.daemon;

    let pool = d.ledger.pool();

    let rows: Vec<(String, String, String, String, Option<String>)> =

        sqlx::query_as("SELECT a.name, a.owner_name, a.kind, a.project, p.status_text FROM agents a LEFT JOIN presence p ON p.agent = a.name WHERE a.disabled_ms IS NULL ORDER BY a.name")

            .fetch_all(pool)

            .await

            .unwrap_or_default();

    let mut agents = Vec::new();

    {

        let now = now_ms();

        for (name, owner, kind, project, status) in rows {

            let last: Option<(String, i64)> =

                sqlx::query_as("SELECT tool, at_ms FROM tool_calls WHERE agent = ? ORDER BY seq DESC LIMIT 1")

                    .bind(&name)

                    .fetch_optional(pool)

                    .await

                    .ok()

                    .flatten();

            let presence = d.presence.lock().await.state(&name, now).to_string();

            agents.push(AgentCard {

                name,

                owner,

                kind,

                project,

                presence,

                status,

                last_tool: last.as_ref().map(|(t, _)| t.clone()),

                last_at: last.map(|(_, at)| format_time(at as u64)).unwrap_or_default(),

            });

        }

    }

    let unread = conv::unread(&d.ledger, "human").await.unwrap_or(0);

    let events = recent(&st, None, None, 50)

        .await

        .into_iter()

        .map(|e| EventRow { seq: e.seq, at: e.at, kind: e.kind, actor: e.actor, subject: e.subject })

        .collect();

    render(&LivePage { shell: o.shell, agents, unread, events })

}

// ---- Channels ----

struct ChannelRow {

    name: String,

    display: String,

    kind: String,

    purpose: String,

    count: i64,

    last: String,

}

/// A channel with its message count and last message time.

type ChannelCount = (String, String, String, Option<String>, i64, Option<i64>);

#[derive(Template)]

#[template(path = "channels.html")]

struct ChannelsPage {

    shell: Shell,

    channels: Vec<ChannelRow>,

}

async fn channels(State(st): State<RadarState>, headers: HeaderMap) -> Response {

    let o = match owner(&st, &headers, "channels").await {

        Ok(o) => o,

        Err(r) => return r,

    };

    let rows: Vec<ChannelCount> = sqlx::query_as(

        "SELECT c.id, c.name, c.kind, c.purpose, (SELECT COUNT(*) FROM messages m WHERE m.channel = c.id), (SELECT MAX(at_ms) FROM messages m WHERE m.channel = c.id) \

         FROM channels c ORDER BY c.kind = 'direct', c.kind = 'system', c.name",

    )

    .fetch_all(st.app.daemon.ledger.pool())

    .await

    .unwrap_or_default();

    let channels = rows

        .into_iter()

        .map(|(_, name, kind, purpose, count, last)| ChannelRow {

            display: match name.strip_prefix("dm:") {

                Some(p) => format!("@{p}"),

                None => format!("#{name}"),

            },

            name,

            kind,

            purpose: purpose.unwrap_or_default(),

            count,

            last: last.map(|t| format_time(t as u64)).unwrap_or_default(),

        })

        .collect();

    render(&ChannelsPage { shell: o.shell, channels })

}

// ---- A channel and a thread ----

struct MessageRow {

    id: String,

    author: String,

    at: String,

    kind: String,

    replies: i64,

    redacted: bool,

    body_html: String,

}

#[derive(Template)]

#[template(path = "channel.html")]

struct ChannelPage {

    shell: Shell,

    name: String,

    display: String,

    purpose: Option<String>,

    thread: Option<String>,

    messages: Vec<MessageRow>,

    can_post: bool,

    action: String,

    csrf: String,

}

async fn show(st: &RadarState, o: Owner, name: &str, thread: Option<&str>) -> Response {

    let d = &st.app.daemon;

    let (ch, msgs) = match conv::read(&d.ledger, &o.principal, if thread.is_some() { None } else { Some(name) }, thread, None, 200).await {

        Ok(r) => r,

        Err(e) => return (StatusCode::NOT_FOUND, format!("{e:#}")).into_response(),

    };

    let mut messages = Vec::new();

    for m in msgs {

        messages.push(MessageRow {

            author: spectra_core::conversation::display_name(&d.ledger, &m.author).await,

            at: format_time(m.at_ms as u64),

            redacted: m.redacted.is_some(),

            body_html: if m.redacted.is_some() { ammonia::clean_text(&m.body) } else { markdown(&m.body) },

            id: m.id,

            kind: m.kind,

            replies: m.replies,

        });

    }

    let can_post = conv::can_post(&o.principal, &ch).is_ok();

    let action = match thread {

        Some(t) => format!("/c/{}/t/{t}", ch.name),

        None => format!("/c/{}", ch.name),

    };

    let csrf = o.session.csrf.clone();

    render(&ChannelPage {

        shell: o.shell,

        name: ch.name.clone(),

        display: ch.display(),

        purpose: ch.purpose.clone(),

        thread: thread.map(String::from),

        messages,

        can_post,

        action,

        csrf,

    })

}

async fn channel(State(st): State<RadarState>, headers: HeaderMap, Path(name): Path<String>) -> Response {

    match owner(&st, &headers, "channels").await {

        Ok(o) => show(&st, o, &name, None).await,

        Err(r) => r,

    }

}

async fn thread(State(st): State<RadarState>, headers: HeaderMap, Path((name, id)): Path<(String, String)>) -> Response {

    match owner(&st, &headers, "channels").await {

        Ok(o) => show(&st, o, &name, Some(&id)).await,

        Err(r) => r,

    }

}

#[derive(Deserialize)]

struct PostForm {

    _csrf: String,

    body: String,

    reply_to: Option<String>,

}

async fn post_to(st: &RadarState, headers: &HeaderMap, name: &str, form: PostForm, back: String) -> Response {

    let o = match owner(st, headers, "channels").await {

        Ok(o) => o,

        Err(r) => return r,

    };

    if let Some(r) = check_form(st, &o, headers, &form._csrf) {

        return r;

    }

    let post = Post {

        channel: if form.reply_to.is_some() { None } else { Some(name.to_string()) },

        body: form.body,

        reply_to: form.reply_to,

        ..Default::default()

    };

    match conv::post(&st.app.daemon.ledger, &o.author(), post, now_ms()).await {

        Ok(_) => Redirect::to(&back).into_response(),

        Err(e) => (StatusCode::BAD_REQUEST, format!("{e:#}")).into_response(),

    }

}

async fn post_channel(State(st): State<RadarState>, headers: HeaderMap, Path(name): Path<String>, Form(form): Form<PostForm>) -> Response {

    let back = format!("/c/{name}");

    post_to(&st, &headers, &name, form, back).await

}

async fn post_thread(

    State(st): State<RadarState>,

    headers: HeaderMap,

    Path((name, id)): Path<(String, String)>,

    Form(mut form): Form<PostForm>,

) -> Response {

    form.reply_to = Some(id.clone());