feat(webui): read-only Queue, Business and Settings views (#1543, row 54)

The Console gains three read-only views. Queue lists every row from
rows() in packages/queue (lead decision 83: the same lock-free read as
`queue list`, writing nothing), run in a child with a timeout and an
output cap; a row page shows the full row. Business shows names, an
allowlist of vars, arbiters, authority per action and credential
metadata (service, account, role, date, never a value, file or
variable). Settings shows RELEASE, the board origin and the notifier
binding. Every route is GET only, and every string in a body or
refusal passes a redactor: the config directory and dataRoot become
<config> and <dataRoot>, other absolute, ~/ and file:// paths <path>,
and 17 to 20 digit runs <id>. A queue-read that fails to start sends a
fixed message, never node's stderr.

Four fixes to HEAD behaviour, each with a test: the bus view's refresh
timer is cleared at render, a same-page refresh keeps focus on the H1,
#conv-pick is emptied when a conversation opens, and error() returns
focus to <main> only when something had focus. Filbert's T8 tests the
failed first read.

Dewey built it in two rounds. Round 1 (dba2429e) got changes from
Filbert (27185: After rendered [object Object], ~/ and :/ paths leaked)
and Darkwing (27186: Arbiters always none, queue-read import failure
leaked a file:// path and stack). Round 2 (afb2ae0e) was approved by
Filbert (27190) and Darkwing (27191, correction 27192). Sage's gate on
d64f434f plus the candidate: 13 package node suites 0 failed (queue
149, webui 39), every scripts/test-*.sh 0 failed (task 98/0 with
Docker, 26/0 without; release 14/0), build-tokens --check current.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/webui/src/serve.mjs

@@ -3,6 +3,7 @@ import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { isIP } from 'node:net';
 import { BusReadError, busStatus, subjectOk } from './bus.mjs';
+import { ReadError, readStatus } from './reads.mjs';
 
 export const DEFAULT_BOARD = 'http://127.0.0.1:7331';
 export function isLoopback(host) {
@@ -62,7 +63,16 @@ async function busRead(res, bus, verb, search) {
     return json(res, busStatus(code), { error: code, message: err instanceof BusReadError ? err.message : code });
   }
 }
-export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null } = {}) {
+// Row 54 (#1543): GET only. `reads` is consoleReads() from reads.mjs; its
+// bodies and messages arrive redacted. No route here writes or calls out.
+const QUEUE_ID = /^[1-9]\d{0,5}$/;
+async function consoleRead(res, read) {
+  try { return json(res, 200, await read()); } catch (err) {
+    const code = err instanceof ReadError ? err.code : 'invalid-response';
+    return json(res, readStatus(code), { error: code, message: err instanceof ReadError ? err.message : code });
+  }
+}
+export async function startServer({ host = '127.0.0.1', port = 7330, board = DEFAULT_BOARD, timeout = 20000, bus = null, reads = null } = {}) {
   if (!isLoopback(host)) throw new Error('refusing to bind to non-loopback host');
   if (host === 'localhost') host = '127.0.0.1';
   const upstream = boardURL(board);
@@ -106,6 +116,17 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
       if (req.method !== 'GET') return json(res, 405, { error: 'method not allowed' });
       return busRead(res, bus, verb, search);
     }
+    if (path === '/api/queue' || path.startsWith('/api/queue/') || path === '/api/business' || path === '/api/settings') {
+      if (req.method !== 'GET') return json(res, 405, { error: 'method not allowed' });
+      const a = server.address(), address = `http://${a.family === 'IPv6' ? `[${a.address}]` : a.address}:${a.port}/`;
+      if (path === '/api/settings') return consoleRead(res, async () => ({ ...(reads ? await reads.settings() : { release: null, business: null, notifier: { refused: 'not-configured', message: 'the Console has no reads configured' } }), board: upstream, address }));
+      if (!reads) return json(res, 503, { error: 'not-configured', message: 'the Console has no reads configured' });
+      if (path === '/api/business') return consoleRead(res, () => reads.business());
+      if (path === '/api/queue') return consoleRead(res, () => reads.queue());
+      const id = path.slice('/api/queue/'.length);
+      if (!QUEUE_ID.test(id)) return json(res, 400, { error: 'invalid-request', message: 'a queue row id is a positive integer' });
+      return consoleRead(res, () => reads.row(Number(id)));
+    }
     if (req.method !== 'GET' && req.method !== 'HEAD') return json(res, 405, { error: 'method not allowed' });
     if (path === '/api/config') return json(res, 200, { board: upstream });
     if (path === '/healthz') return json(res, 200, { ok: true });