app/worker/src/webApp.ts

+ deleteRepoRow,

+ getAgentByEmail,

+ getAgentByUsername,

+ listRepoRolesForAgent,

+ searchAgents,

+ syncRepoRoleCache,

+ updateRepoOwner,

+import { ensureMeta, readRepoMeta, readRepoRoles, repoAtLeast, repoRoleFor, writeRepoRoles, writeRepoMeta, type RbacRole } from "./repoMeta.js";

+import { LICENSES, LICENSE_ORDER } from "./licenses.js";

+import { isRef, type EmbeddedRung } from "../../engine/ladderNotes.js";

+.card-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:.6rem}

+.card-head h2{margin:0}

+.icon-btn{width:1.8rem;height:1.8rem;padding:0;border-radius:999px;font-size:1.1rem;line-height:1;display:inline-flex;align-items:center;justify-content:center}

+dialog.modal{border:none;border-radius:12px;padding:0;background:var(--surface);color:var(--fg);border:1px solid var(--border);max-width:460px;width:92vw}

+dialog.modal::backdrop{background:rgba(10,6,20,.65)}

+dialog.modal .modal-body{padding:1.25rem 1.4rem}

+dialog.modal h3{margin:0 0 1rem;font-size:.85rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}

+dialog.modal .modal-actions{display:flex;justify-content:flex-end;gap:.5rem;margin-top:1.1rem}

+.ac-wrap{position:relative}

+.ac-list{position:absolute;top:100%;left:0;right:0;background:var(--panel);border:1px solid var(--border);border-radius:8px;margin-top:.25rem;max-height:220px;overflow-y:auto;z-index:30}

+.ac-item{padding:.5rem .7rem;cursor:pointer;font-size:.88rem}

+.ac-item:hover,.ac-item.active{background:var(--surface)}

+.tab-bar{display:flex;gap:.25rem;border-bottom:1px solid var(--border);margin-bottom:1rem;flex-wrap:wrap}

+.tab-btn{background:none;border:none;color:var(--muted);font-weight:600;padding:.5rem .9rem;border-bottom:2px solid transparent;border-radius:0;cursor:pointer}

+.tab-btn.active{color:var(--pink);border-bottom-color:var(--pink)}

+.tab-btn:hover{color:var(--fg);background:none}

+select.role-select{appearance:none;-webkit-appearance:none;background:transparent;border:1px solid var(--border);color:var(--fg);padding:.2rem .5rem;border-radius:6px;font-size:.85rem}

+select.role-select:disabled{opacity:1;color:var(--fg);border-color:transparent;background:rgba(180,163,214,.08)}

+.split{display:flex;justify-content:space-between;gap:1.5rem;flex-wrap:wrap}

+.split>div{flex:1 1 16rem;min-width:0}

+.align-right{text-align:right}

+.align-right pre{text-align:left}

+.danger-zone{border-color:rgba(255,68,102,.4)}

+function card(heading: string, innerHtml: string, opts: { addModal?: string; extraClass?: string } = {}): string {

+ const addBtn = opts.addModal ? `<button type="button" class="icon-btn" onclick="document.getElementById('${opts.addModal}').showModal()" aria-label="Add" title="Add">+</button>` : "";

+ return `<section class="card${opts.extraClass ? ` ${opts.extraClass}` : ""}"><div class="card-head"><h2>${esc(heading)}</h2>${addBtn}</div>${innerHtml}</section>`;

+const LANE_STATUS_BADGE_VARIANT: Record<string, string> = { proposed: "yellow", open: "yellow", claimed: "blue", active: "cyan", merged: "green", closed: "muted", vetoed: "red", stopped: "red" };

+/** A text input that autocompletes against /api/agents/search as you type, so you never have to remember or paste a raw agent id -- used anywhere a form asks for a principal (grant-role, add-token, transfer-ownership). Submits the agent's `id` (what every principal field expects) once a suggestion is clicked; typing a raw id and not picking a suggestion still works, same as before. */

+function agentAutocompleteField(name: string, placeholder: string, idSuffix: string): string {

+ const boxId = `ac-box-${idSuffix}`;

+ return `<div class="ac-wrap">

+ <input name="${name}" placeholder="${esc(placeholder)}" required autocomplete="off" data-autocomplete="${boxId}" data-ac-url="/api/agents/search">

+ <div id="${boxId}" class="ac-list" hidden></div>

+ </div>`;

+}

+// Generic, reused across every page: `data-tabs` containers get click-

+// to-switch tab panels, `data-autocomplete` inputs get a debounced

+// agent search dropdown. No framework -- every page here is server-

+// rendered and form-POST-driven already, so this stays a handful of

+// plain DOM calls rather than a client-side rendering layer.

+const WEB_JS = `

+function zzInitTabs(container) {

+ var btns = container.querySelectorAll('.tab-btn');

+ btns.forEach(function (btn) {

+ btn.addEventListener('click', function () {

+ btns.forEach(function (b) { b.classList.remove('active'); });

+ btn.classList.add('active');

+ container.querySelectorAll('.tab-panel').forEach(function (p) { p.hidden = true; });

+ document.getElementById(btn.dataset.target).hidden = false;

+ });

+ });

+}

+document.querySelectorAll('[data-tabs]').forEach(zzInitTabs);

+function zzAutocomplete(inputEl, listEl, url) {

+ var t;

+ inputEl.addEventListener('input', function () {

+ clearTimeout(t);

+ var q = inputEl.value.trim();

+ if (!q) { listEl.hidden = true; listEl.innerHTML = ''; return; }

+ t = setTimeout(function () {

+ fetch(url + '?q=' + encodeURIComponent(q)).then(function (r) { return r.ok ? r.json() : { agents: [] }; }).then(function (data) {

+ listEl.innerHTML = '';

+ (data.agents || []).forEach(function (a) {

+ var item = document.createElement('div');

+ item.className = 'ac-item';

+ item.textContent = a.display_name + ' (' + a.username + ')';

+ item.onclick = function () { inputEl.value = a.id; listEl.hidden = true; };

+ listEl.appendChild(item);

+ });

+ listEl.hidden = (data.agents || []).length === 0;

+ });

+ }, 200);

+ });

+ inputEl.addEventListener('blur', function () { setTimeout(function () { listEl.hidden = true; }, 150); });

+}

+document.querySelectorAll('[data-autocomplete]').forEach(function (el) {

+ zzAutocomplete(el, document.getElementById(el.dataset.autocomplete), el.dataset.acUrl);

+});

+`;

+ ? `<a href="/explore">Explore</a><a href="/${esc(agent.username)}">${esc(agent.display_name)}</a><a href="/logout">Log out</a>`

+<script>${WEB_JS}</script>

+ // A second OAuth provider with the SAME verified email links to

+ // the agent that already owns that email instead of minting a

+ // disconnected duplicate -- confirmed live as a real bug: logging

+ // in with Google, then later with Cloudflare, produced two

+ // separate Agents sharing no history (different provider_subject,

+ // so findAgentIdentity above correctly found nothing -- the gap

+ // was never checking for an existing Agent by email before

+ // falling through to createAgent).

+ const byEmail = identity.email ? await getAgentByEmail(env.DB, identity.email) : null;

+ if (byEmail) {

+ agent = byEmail;

+ await refreshAgentProfile(env.DB, agent.id, identity.displayName, identity.email);

+ } else {

+ agent = await createAgent(env.DB, identity.displayName, identity.email, null);

+ }

+ <p><a href="/${esc(agent.username)}">Continue to your profile &rarr;</a></p>

+ return redirect(`/${agent.username}`, { cookies: [sessionCookieHeader(session.id, 60 * 60 * 24 * 30)] });

+/** The repo URL's owner segment, and the segment at /<username> for this Agent's own profile page. Frozen at creation (accountsDb.ts's createAgent) rather than recomputed live from display_name -- see migration 0003's header for why that matters. */

+ return agent.username;

+async function doCreateRepo(env: WebEnv, owner: Agent, name: string, description: string | null, licenseKey: string | null): Promise<RepoRow> {

+ const license = licenseKey ? LICENSES[licenseKey] : null;

+ const files = [{ path: "README.md", content: `# ${name}\n\n${description ?? ""}\n` }];

+ if (license) files.push({ path: "LICENSE", content: license.text(owner.display_name, new Date().getFullYear()) });

+ await createInitialCommit(created.remote, token, files, { name: owner.display_name, email: owner.email ?? `${owner.id}@zz.local` });

+ const row = await upsertRepo(env.DB, { slug, artifactsName, description, ownerId: owner.id });

+ await syncRepoRoleCache(env.DB, row.id, [{ principal: owner.id, role: "owner", granted_by: "system", at: row.created_at }]);

+ return row;

+ await syncRepoRoleCache(env.DB, repo.id, nextGrants);

+async function doSetVisibility(env: WebEnv, actor: Agent, repoSlug: string, visibility: "public" | "private"): Promise<void> {

+ const repo = await getRepoBySlug(env.DB, repoSlug);

+ if (!repo) throw new ApiError(404, "no such repo");

+ using artifactsRepo = await env.ARTIFACTS.get(repo.artifacts_name);

+ const token = await artifactsRepo.createToken("write", 3600);

+ const info = await artifactsRepo.info();

+ const [meta, roles] = await Promise.all([readRepoMeta(info.remote, token), readRepoRoles(info.remote, token)]);

+ if (!meta) throw new ApiError(404, "repo has no metadata yet");

+ if (!repoAtLeast(repoRoleFor(roles, actor.id), "owner")) throw new ApiError(403, `${actor.id} is not an Owner of ${repoSlug}`);

+ await writeRepoMeta(info.remote, token, { ...meta, policy: { ...meta.policy, visibility } });

+}

+/** Ownership transfer keeps the repo's URL (slug) unchanged -- the slug is frozen at creation time off the ORIGINAL owner's username, same as a GitHub repo's path staying put after a transfer within the same org would. The new owner gets an explicit "owner" grant in roles.json; the previous owner's own grant is left as-is (not stripped), so transferring doesn't silently revoke their access -- they can demote themselves separately via the roles list if that's what they want. */

+async function doTransferOwnership(env: WebEnv, actor: Agent, repoSlug: string, newOwnerId: string): Promise<void> {

+ const repo = await getRepoBySlug(env.DB, repoSlug);

+ if (!repo) throw new ApiError(404, "no such repo");

+ const newOwner = await getAgent(env.DB, newOwnerId);

+ if (!newOwner) throw new ApiError(404, "no such agent");

+ using artifactsRepo = await env.ARTIFACTS.get(repo.artifacts_name);

+ const token = await artifactsRepo.createToken("write", 3600);

+ const info = await artifactsRepo.info();

+ const [meta, roles] = await Promise.all([readRepoMeta(info.remote, token), readRepoRoles(info.remote, token)]);

+ if (!meta) throw new ApiError(404, "repo has no metadata yet");

+ if (!repoAtLeast(repoRoleFor(roles, actor.id), "owner")) throw new ApiError(403, `${actor.id} is not an Owner of ${repoSlug}`);

+ await writeRepoMeta(info.remote, token, { ...meta, owner_id: newOwner.id });

+ const nextGrants = (roles?.grants ?? []).filter((g) => g.principal !== newOwner.id);

+ nextGrants.push({ principal: newOwner.id, role: "owner", granted_by: actor.id, at: new Date().toISOString() });

+ await writeRepoRoles(info.remote, token, { grants: nextGrants });

+ await syncRepoRoleCache(env.DB, repo.id, nextGrants);

+ await updateRepoOwner(env.DB, repo.id, newOwner.id);

+}

+async function doDeleteRepo(env: WebEnv, actor: Agent, repoSlug: string): Promise<void> {

+ const repo = await getRepoBySlug(env.DB, repoSlug);

+ if (!repo) throw new ApiError(404, "no such repo");

+ using artifactsRepo = await env.ARTIFACTS.get(repo.artifacts_name);

+ const token = await artifactsRepo.createToken("read", 120);

+ const info = await artifactsRepo.info();

+ const roles = await readRepoRoles(info.remote, token);

+ if (!repoAtLeast(repoRoleFor(roles, actor.id), "owner")) throw new ApiError(403, `${actor.id} is not an Owner of ${repoSlug}`);

+ await env.ARTIFACTS.delete(repo.artifacts_name);

+ await deleteRepoRow(env.DB, repo.id);

+}

+ coordinators: string[];

+function doStub(env: WebEnv, artifactsName: string) {

+ return stub;

+}

+/** The root ("_repo") Lane's full history -- every ASK/ANSWER posted via doPostAsk or the engine's own protocol. Null if the repo has no root Lane yet (never had an Ask posted to it). */

+async function getRootLane(env: WebEnv, artifactsName: string): Promise<LaneSnapshot | null> {

+ const stub = doStub(env, artifactsName);

+/** Every Lane in the repo, for the "Lanes" tab -- the full flattened cross-lane protocol feed (the "Protocol" tab) is derived from these same objects' `.history`, not a second fetch. */

+async function getAllLanes(env: WebEnv, artifactsName: string): Promise<LaneSnapshot[]> {

+ const stub = doStub(env, artifactsName);

+ await stub.configure(artifactsName);

+ return (await stub.callTool("lane_list", { repo: artifactsName })) as LaneSnapshot[];

+}

+interface ProtocolEvent {

+ laneId: string;

+ entry: LaneHistoryEntry;

+}

+function flattenProtocol(lanes: LaneSnapshot[]): ProtocolEvent[] {

+ const events = lanes.flatMap((lane) => lane.history.map((entry) => ({ laneId: lane.id, entry })));

+ return events.sort((a, b) => (a.entry.at < b.entry.at ? 1 : -1));

+}

+// Ladder tab: the repo's full Ladder tree, read via repeated

+// ladder_read calls (the same shape engine/ladderRender.ts's

+// collectLadder resolves locally, just driven through callTool since

+// this runs in the Worker, not against a local clone). Only "ask"-

+// thread children come back as bare {ref} stubs needing a follow-up

+// call -- repo-wide/anchor kinds are already embedded inline. Capped

+// so a pathological ask-thread depth can't turn one page load into

+// hundreds of DO round-trips.

+interface LadderNode {

+ path: string;

+ kind: string;

+ summary: string;

+ children: LadderNode[];

+}

+const LADDER_TAB_NODE_CAP = 300;

+async function getLadderTree(env: WebEnv, artifactsName: string): Promise<LadderNode | null> {

+ const stub = doStub(env, artifactsName);

+ await stub.configure(artifactsName);

+ let remaining = LADDER_TAB_NODE_CAP;

+ async function resolve(rung: EmbeddedRung): Promise<LadderNode> {

+ remaining -= 1;

+ const children: LadderNode[] = [];

+ for (const child of rung.children) {

+ if (remaining <= 0) break;

+ if (isRef(child)) {

+ const anchor = (await stub.callTool("ladder_read", { repo: artifactsName, path: child.ref })) as EmbeddedRung | null;

+ children.push(anchor ? await resolve(anchor) : { path: child.ref, kind: "ask", summary: "[missing]", children: [] });

+ } else {

+ children.push(await resolve(child));

+ }

+ }

+ return { path: rung.path, kind: rung.kind, summary: rung.summary, children };

+ }

+ const root = (await stub.callTool("ladder_read", { repo: artifactsName, path: "_repo" })) as EmbeddedRung | null;

+ return root ? resolve(root) : null;

+}

+function renderLadderNode(node: LadderNode, depth = 0): string {

+ const indent = "&nbsp;&nbsp;".repeat(depth);

+ const self = `<li class="row">${indent}<span class="badge badge-pink">${esc(node.kind)}</span> <span class="mono">${esc(node.path)}</span> <span class="muted">${esc(node.summary)}</span></li>`;

+ return [self, ...node.children.map((c) => renderLadderNode(c, depth + 1))].join("");

+}

+// --- Agent profile: /<username> is BOTH the public view (anyone) and

+// the private, editable view (when you're logged in as that agent) --

+// no separate /profile route. See migration 0003's header for why

+// `username` is a frozen, stored column rather than recomputed.

+interface RepoWithRole extends RepoRow {

+ role: string;

+}

+async function handleAgentPage(username: string, request: Request, env: WebEnv): Promise<Response> {

+ const pageAgent = await getAgentByUsername(env.DB, username);

+ if (!pageAgent) return new Response("no such agent", { status: 404 });

+ if (me && me.id === pageAgent.id) return renderOwnProfile(me, env);

+ return renderPublicProfile(pageAgent, request, env);

+}

+async function renderPublicProfile(agent: Agent, request: Request, env: WebEnv): Promise<Response> {

+ const owned = await listReposOwnedBy(env.DB, agent.id);

+ const visible: RepoRow[] = [];

+ for (const r of owned) {

+ const ctx = await getRepoAccessContext(r.slug, env);

+ if (ctx && (await canReadRepo(request, env, ctx.meta, ctx.roles))) visible.push(r);

+ }

+ return layout(

+ agent.display_name,

+ await resolveRequestAgent(request, env),

+ `<p class="hint">@${esc(agent.username)}</p>

+ ${card(

+ "Repos",

+ `<ul class="list">${visible.map((r) => `<li><a href="/${esc(r.slug)}" class="mono" style="color:var(--pink)">${esc(r.slug)}</a>${r.description ? `<div class="muted">${esc(r.description)}</div>` : ""}</li>`).join("") || '<li class="empty">No public repos.</li>'}</ul>`,

+ )}`,

+ );

+}

+async function renderOwnProfile(me: Agent, env: WebEnv): Promise<Response> {

+ const tokenLists = await Promise.all(allSelf.map((a) => listTokensForAgent(env.DB, a.id)));

+ // One flat, unified list across you and every agent you manage --

+ // no more "your tokens" vs "managed agents' tokens" as two separate

+ // sub-UIs (per direct instruction: token management should not

+ // distinguish you from the agents you manage).

+ const tokenRows = allSelf

+ .flatMap((a, i) => tokenLists[i].filter((t) => !t.revoked_at).map((t) => ({ agent: a, token: t })))

+ .map(

+ ({ agent, token }) =>

+ `<li class="row"><b>${esc(agent.display_name)}</b> <span class="mono">${esc(token.id)}</span> <span class="muted">${token.last_used_at ? `last used ${esc(token.last_used_at)}` : "never used"}</span>

+ <form method="post" action="/profile/tokens/${token.id}/revoke" class="inline"><button type="submit" class="danger">Revoke</button></form></li>`,

+ )

+ const [ownedRepos, sharedRepos] = await Promise.all([listReposOwnedBy(env.DB, me.id), listRepoRolesForAgent(env.DB, me.id)]);

+ const repoRows: { repo: RepoRow; role: string }[] = [...ownedRepos.map((r) => ({ repo: r, role: "owner" })), ...sharedRepos.map((r) => ({ repo: r as RepoWithRole, role: (r as RepoWithRole).role }))];

+ `${me.display_name} (you)`,

+ `<p class="hint">@${esc(me.username)} ${me.email ? `&lt;${esc(me.email)}&gt;` : ""}</p>

+ "Credentials",

+ `<p class="hint">You, and every agent you manage, share one token list -- not "yours" vs "theirs" in any authority sense, just one place to issue, rotate, or revoke whatever can authenticate as any of them.</p>

+ <ul class="list">${tokenRows || '<li class="empty">No active tokens.</li>'}</ul>`,

+ { addModal: "modal-add-token" },

+ "Repos",

+ `<ul class="list">${

+ repoRows

+ .map(({ repo, role }) => `<li class="row"><a href="/${esc(repo.slug)}" class="mono" style="color:var(--pink)">${esc(repo.slug)}</a>${roleBadge(role)}</li>`)

+ .join("") || '<li class="empty">None yet.</li>'

+ }</ul>`,

+ { addModal: "modal-create-repo" },

+ )}

+ <dialog id="modal-add-token" class="modal"><div class="modal-body">

+ <h3>Add a token</h3>

+ <form method="post" action="/profile/tokens" class="stack">

+ <p class="hint" style="margin:0">Pick an agent you manage, or type a new name to create one (and mint its first token in the same step).</p>

+ ${agentAutocompleteField("agent", "agent name or existing agent", "add-token")}

+ <div class="modal-actions">

+ <form method="dialog" class="inline"><button type="submit" class="secondary">Cancel</button></form>

+ <button type="submit">Add</button>

+ </div>

+ </form>

+ </div></dialog>

+ <dialog id="modal-create-repo" class="modal"><div class="modal-body">

+ <h3>Create a repo</h3>

+ <form method="post" action="/profile/repos" class="stack">

+ <input name="name" placeholder="repo-name" required pattern="[A-Za-z0-9._-]+">

+ <input name="description" placeholder="description">

+ <select name="license">

+ <option value="">No license</option>

+ ${LICENSE_ORDER.map((k) => `<option value="${esc(k)}">${esc(LICENSES[k].name)}</option>`).join("")}

+ </select>

+ <div class="modal-actions">

+ <form method="dialog" class="inline"><button type="submit" class="secondary">Cancel</button></form>

+ <button type="submit">Create</button>

+ </div>

+ </form>

+ </div></dialog>`,

+/** A single value covers both the earlier two actions (mint a token for an existing agent, or create a brand-new managed agent and mint its first token) -- matches the unified "+" modal: an id of an agent you already manage mints; anything else creates. */

+async function handleTokenAddForm(request: Request, env: WebEnv): Promise<Response> {

+ const value = String(form.get("agent") ?? "").trim();

+ const existing = value.startsWith("agent-") ? await getAgent(env.DB, value) : null;

+ const { agent, token } = existing ? await doMintToken(env, me, existing.id) : await doCreateAgent(env, me, value);

+ "New token",

+ <p><a href="/${esc(me.username)}">&larr; Back to profile</a></p>

+ return redirect(`/${me.username}`);

+async function handleRbacGrantForm(repoSlug: string, request: Request, env: WebEnv): Promise<Response> {

+ await doRbacGrant(env, me, repoSlug, String(form.get("principal") ?? ""), String(form.get("role") ?? "reader") as RbacRole);

+ return redirect(`/${repoSlug}/settings`);

+ const repo = await doCreateRepo(env, me, String(form.get("name") ?? "").trim(), String(form.get("description") ?? "").trim() || null, String(form.get("license") ?? "").trim() || null);

+ return redirect(`/${me.username}`);

+async function handleVisibilityForm(repoSlug: string, request: Request, env: WebEnv): Promise<Response> {

+ const me = await resolveRequestAgent(request, env);

+ if (!me) return redirect("/login");

+ const form = await request.formData();

+ try {

+ await doSetVisibility(env, me, repoSlug, String(form.get("visibility") ?? "public") as "public" | "private");

+ } catch (err) {

+ if (err instanceof ApiError) return new Response(err.message, { status: err.status });

+ throw err;

+ }

+ return redirect(`/${repoSlug}/settings`);

+}

+async function handleTransferForm(repoSlug: string, request: Request, env: WebEnv): Promise<Response> {

+ const me = await resolveRequestAgent(request, env);

+ if (!me) return redirect("/login");

+ const form = await request.formData();

+ try {

+ await doTransferOwnership(env, me, repoSlug, String(form.get("new_owner") ?? "").trim());

+ } catch (err) {

+ if (err instanceof ApiError) return new Response(err.message, { status: err.status });

+ throw err;

+ }

+ return redirect(`/${repoSlug}/settings`);

+}

+async function handleDeleteRepoForm(repoSlug: string, request: Request, env: WebEnv): Promise<Response> {

+ const me = await resolveRequestAgent(request, env);

+ if (!me) return redirect("/login");

+ try {

+ await doDeleteRepo(env, me, repoSlug);

+ } catch (err) {

+ if (err instanceof ApiError) return new Response(err.message, { status: err.status });

+ throw err;

+ }

+ return redirect(`/${me.username}`);

+}

+/** Autocomplete backing for any "which agent" field (add-token, grant-role, transfer-ownership) -- searches every Agent known to zz, not just ones the caller created. The server-side authority check for what you're actually trying to DO with the chosen agent (mint a token, grant a role) still applies at the real action endpoint; this just helps you find the right id. */

+async function handleApiSearchAgents(request: Request, env: WebEnv): Promise<Response> {

+ return withApi(async () => {

+ await requireApiAgent(request, env);

+ const q = new URL(request.url).searchParams.get("q")?.trim() ?? "";

+ if (!q) return json({ agents: [] });

+ return json({ agents: await searchAgents(env.DB, q, 10) });

+ });

+}

+ const body = (await request.json()) as { name?: string; description?: string; owner_id?: string; license?: string };

+ const repo = await doCreateRepo(env, owner, (body.name ?? "").trim(), body.description?.trim() || null, body.license ?? null);

+ const commits = await repo.log({ ref: info.defaultBranch, limit: 30 });

+ const isOwner = !!me && repoAtLeast(repoRoleFor(roles, me.id), "owner");

+ const [lanes, ladder] = await Promise.all([getAllLanes(env, repoRow.artifacts_name), getLadderTree(env, repoRow.artifacts_name)]);

+ const rootLane = lanes.find((l) => l.id === "_repo") ?? null;

+ const asksHtml = (rootLane?.history ?? [])

+ const lanesHtml = lanes

+ .map((l) => `<li class="row"><span class="mono">${esc(l.id)}</span> <span class="badge badge-${LANE_STATUS_BADGE_VARIANT[l.status] ?? "muted"}">${esc(l.status)}</span> <span class="muted">coord: ${esc(l.coordinators?.join(", ") ?? "")}</span></li>`)

+ .join("");

+ const protocolHtml = flattenProtocol(lanes)

+ .slice(0, 100)

+ .map(({ laneId, entry: e }) => {

+ const badge = e.type === "ASK" ? "badge-yellow" : e.type === "ANSWER" ? "badge-green" : "badge-cyan";

+ const rest = e.type === "ASK" ? `${esc(e.kind ?? "?")} from ${esc(e.from ?? "?")}` : e.type === "ANSWER" ? `${esc(e.action ?? "?")} by ${esc(e.from ?? "?")} on ${esc(e.ask ?? "?")}` : esc(JSON.stringify(e.payload ?? {}));

+ return `<li class="row"><span class="badge ${badge}">${esc(e.type)}</span> <span class="muted">${esc(laneId)}</span> ${rest} <span class="muted">${esc(e.at)}</span></li>`;

+ })

+ .join("");

+ const activityHtml = commits

+ .map((c) => `<li class="row"><span class="mono">${esc(c.hash.slice(0, 8))}</span> ${esc(c.message.split("\n")[0])} <span class="muted">${esc(c.author.name)} ${esc(new Date(c.authoredAt * 1000).toISOString())}</span></li>`)

+ .join("");

+ const fileTabs = [

+ readme ? { id: "readme", label: "README", html: `<pre>${esc(readme)}</pre>` } : null,

+ { id: "ladder", label: "Ladder", html: `<ul class="list">${ladder ? renderLadderNode(ladder) : '<li class="empty">No Ladder content yet.</li>'}</ul>` },

+ { id: "files", label: "Files", html: `<ul class="list">${fileListHtml || '<li class="empty">Empty repo.</li>'}</ul>` },

+ ].filter((t): t is { id: string; label: string; html: string } => t !== null);

+ const activityTabs = [

+ { id: "activity", label: "Activity", html: `<ul class="list">${activityHtml || '<li class="empty">No commits yet.</li>'}</ul>` },

+ { id: "asks", label: "Asks", html: `<ul class="list">${asksHtml || '<li class="empty">No Asks posted yet.</li>'}</ul>` },

+ { id: "lanes", label: "Lanes", html: `<ul class="list">${lanesHtml || '<li class="empty">No Lanes yet.</li>'}</ul>` },

+ { id: "protocol", label: "Protocol", html: `<ul class="list">${protocolHtml || '<li class="empty">No protocol activity yet.</li>'}</ul>` },

+ ];

+ const tabGroup = (groupId: string, tabs: { id: string; label: string; html: string }[]): string => `

+ <div class="card" data-tabs>

+ <div class="tab-bar">${tabs.map((t, i) => `<button type="button" class="tab-btn${i === 0 ? " active" : ""}" data-target="${groupId}-${t.id}">${esc(t.label)}</button>`).join("")}</div>

+ ${tabs.map((t, i) => `<div id="${groupId}-${t.id}" class="tab-panel"${i === 0 ? "" : " hidden"}>${t.html}</div>`).join("")}

+ </div>`;

+ <div class="split">

+ <div>

+ <div class="row" style="margin-bottom:.5rem"><span class="badge badge-${visibility === "private" ? "red" : "muted"}">${esc(visibility)}</span>${rolesHtml}</div>

+ <p>${esc(meta?.description ?? repoRow.description ?? "")}</p>

+ <div class="row">

+ <a href="${origin}/${esc(slug)}/archive.zip"><button class="secondary">Download .zip</button></a>

+ ${isOwner ? `<a href="/${esc(slug)}/settings"><button class="secondary">Settings</button></a>` : ""}

+ </div>

+ </div>

+ <div class="align-right">

+ <pre>git clone ${esc(origin)}/${esc(slug)}</pre>

+ <p class="hint">To push: issue yourself (or a managed agent) a token on <a href="${me ? `/${esc(me.username)}` : "/login"}">your profile</a> (needs at least Maintainer). <code>zz repo clone ${esc(slug)}</code> does this automatically when logged in via the CLI.</p>

+ </div>

+ ${tabGroup("files", fileTabs)}

+ ${tabGroup("act", activityTabs)}`,

+ );

+}

+async function handleRepoSettings(slug: string, request: Request, env: WebEnv): Promise<Response> {

+ const me = await resolveRequestAgent(request, env);

+ if (!me) return redirect("/login");

+ const ctx = await getRepoAccessContext(slug, env);

+ if (!ctx) return new Response("no such repo", { status: 404 });

+ const { meta, roles } = ctx;

+ if (!repoAtLeast(repoRoleFor(roles, me.id), "owner")) return new Response("Owners only", { status: 403 });

+ const roleRows = (roles?.grants ?? [])

+ .map(

+ (g) => `<li class="row">

+ <span class="mono">${esc(g.principal)}</span>

+ <form method="post" action="/${esc(slug)}/settings/roles" class="row inline">

+ <input type="hidden" name="principal" value="${esc(g.principal)}">

+ <select name="role" class="role-select" disabled>

+ ${(["owner", "maintainer", "contributor", "reader"] as const).map((r) => `<option value="${r}"${r === g.role ? " selected" : ""}>${r}</option>`).join("")}

+ </select>

+ <button type="button" class="secondary" onclick="this.previousElementSibling.disabled=false;this.nextElementSibling.hidden=false;this.hidden=true">Edit</button>

+ <button type="submit" class="secondary" hidden>Save</button>

+ </form>

+ </li>`,

+ )

+ .join("");

+ const visibility = meta?.policy.visibility ?? "public";

+ return layout(

+ `${slug} settings`,

+ me,

+ `${card(

+ "Roles",

+ `<ul class="list">${roleRows || '<li class="empty">No grants yet.</li>'}</ul>`,

+ { addModal: "modal-add-role" },

+ )}

+ "Visibility",

+ `<p class="hint">Public repos are readable by anyone; private repos need an explicit role grant above to even view.</p>

+ <form method="post" action="/${esc(slug)}/settings/visibility" class="row">

+ <select name="visibility"><option value="public"${visibility === "public" ? " selected" : ""}>public</option><option value="private"${visibility === "private" ? " selected" : ""}>private</option></select>

+ <button type="submit" class="secondary">Save</button>

+ </form>`,

+ ${card(

+ "Danger zone",

+ `<div class="stack">

+ <form method="post" action="/${esc(slug)}/settings/transfer" class="field-row">

+ ${agentAutocompleteField("new_owner", "new owner (agent name or id)", "transfer")}

+ <button type="submit" class="danger">Transfer ownership</button>

+ </form>

+ <form method="post" action="/${esc(slug)}/settings/delete" onsubmit="return confirm('Permanently delete ${esc(slug).replace(/'/g, "\\'")}? This cannot be undone.')">

+ <button type="submit" class="danger">Delete repo</button>

+ </form>

+ </div>`,

+ { extraClass: "danger-zone" },

+ )}

+ <dialog id="modal-add-role" class="modal"><div class="modal-body">

+ <h3>Add a role</h3>

+ <form method="post" action="/${esc(slug)}/settings/roles" class="stack">

+ ${agentAutocompleteField("principal", "agent name or id", "add-role")}

+ <select name="role"><option>owner</option><option>maintainer</option><option selected>contributor</option><option>reader</option></select>

+ <div class="modal-actions">

+ <form method="dialog" class="inline"><button type="submit" class="secondary">Cancel</button></form>

+ <button type="submit">Grant</button>

+ </div>

+ </form>

+ </div></dialog>`,

+ // /profile is kept only as a convenience redirect to your own

+ // /<username> page -- see that handler's header for why there's no

+ // separate profile route anymore (one route, public or editable

+ // depending on who's looking).

+ if (path === "/profile" && request.method === "GET") {

+ const me = await resolveRequestAgent(request, env);

+ return me ? redirect(`/${me.username}`) : redirect("/login");

+ }

+ if (path === "/profile/tokens" && request.method === "POST") return handleTokenAddForm(request, env);

+ if (path === "/api/agents/search" && request.method === "GET") return handleApiSearchAgents(request, env);

+ const m = path.match(/^\/([^/]+)\/([^/]+)\/settings$/);

+ if (m && request.method === "GET") return handleRepoSettings(`${m[1]}/${m[2]}`, request, env);

+ }

+ {

+ const m = path.match(/^\/([^/]+)\/([^/]+)\/settings\/roles$/);

+ if (m && request.method === "POST") return handleRbacGrantForm(`${m[1]}/${m[2]}`, request, env);

+ }

+ {

+ const m = path.match(/^\/([^/]+)\/([^/]+)\/settings\/visibility$/);

+ if (m && request.method === "POST") return handleVisibilityForm(`${m[1]}/${m[2]}`, request, env);

+ }

+ {

+ const m = path.match(/^\/([^/]+)\/([^/]+)\/settings\/transfer$/);

+ if (m && request.method === "POST") return handleTransferForm(`${m[1]}/${m[2]}`, request, env);

+ }

+ {

+ const m = path.match(/^\/([^/]+)\/([^/]+)\/settings\/delete$/);

+ if (m && request.method === "POST") return handleDeleteRepoForm(`${m[1]}/${m[2]}`, request, env);

+ }

+ {

+ {

+ const m = path.match(/^\/([^/]+)$/);

+ if (m && request.method === "GET") return handleAgentPage(m[1], request, env);

+ }