Add a reviewed `theme` plugin kind (interfaceVersion 1, export `theme`, switch
"list"). A module returns data only: a displayName and a flat map of colour
custom properties for light, dim and dark. checkTheme validates names and
#rrggbb colours strictly and checks each text/background pair for contrast; a
bad module is refused and logged, never served.
The ten shipped palettes become the first ten modules under
packages/plugins/theme/<name>/. Modules are found by directory scan
(loader.discoverModules, loader.loadInstalled), not by a list in the Console.
loadModule and createLoader are unchanged.
The organization file takes `appearance: { theme, mode }`, validated in
packages/business/src/appearance.mjs; a missing appearance is valid.
GET /api/themes (themes-http.mjs) serves the installed, valid themes.
Browser: the Settings picker lists /api/themes. Precedence is a per-organization
browser override, then the organization's saved theme, then the built-in default
(Harbor, dark). Clearing the override restores the organization's choice. An
uninstalled or invalid saved theme renders the default with a visible warning
and keeps the saved value. A legacy global browser preference is not copied to
every organization. The organization is named in text, so colour is never the
only cue. A plain load writes no appearance record. The default look is
unchanged: computed styles match the base commit element for element.
A failed bus start now carries the host's own refusal line, read from host.log; repository paths in messages are shown relative and URLs are kept. Setup cards keep the chosen mode, remote and risk box across a re-render, and a client-side refusal is shown on the card.
Form and live JSON preview over one document, field errors with their
JSON path, the save receipt, and setup cards that name the CLI verb each
step equals. serve.mjs mounts org-admin.mjs with the existing origin and
CSRF fencing.
org-admin.mjs serves the S6 routes over the C2 organization service:
template, validation with JSON paths, create, edit with if-revision, and
guided setup steps that read their receipt back before acting and never
reinitialize. Receipts reach the browser with host paths relative to the
data and config directories.
Read-only: finds a thread's launch and end records in the organization launch log and checks each run's session.json, bundle manifest digests and turn stderr files.
Starts the fixture provider's loopback endpoint for a named dev instance and records it under the data root. Refuses the default instance, a configured proxy, provider credentials in the environment, a non-loopback bind and a second fixture. fixtureLauncherOptions hands the endpoint to the launcher as its session proxy context.
S15 review fixes on top of a584c08ad.
- Breadcrumb: from 700px the project name stops at 40% and a long current
label ellipsizes after it, so a long Conversation title no longer pushes
the page wider than the window. Under 700px the current label is hidden
and the project name shrinks as before.
- Details keeps its size beside a long Conversation title instead of
squeezing to a vertical label (also present on 7c664fac9).
- The active tab is brought fully into the strip after counts load, after
a refresh repaint and when a tab receives keyboard focus.
- Long speaker names wrap between words at narrow zoom; the time stays
whole.
Tests: three new S15 browser tests, red on a584c08ad sources and green
here. S10-S15 each alone 3 times green; webui 952/0/0.
A Tab outside the transcript while a stale matching scroll was still being
classified deleted the settling pin, which cancelled the classification.
Tab moves no transcript, so no later scroll event decided it, follow stayed
on and the next growth pulled the reader to the tail.
The classification now has its own mark. Reader input drops only the pin
provenance that a repaint reads; the two-frame check still runs.
Room and Conversation 700x700 cases: bf6e92232 fails 2/2 in 3 of 3 runs
(5017 to 5267, 5135 to 5385); this commit passes 4/4 in 3 of 3.
In the short desktop Room layout the section title sat in the first grid column, so Room details ended mid-row. The title now spans the row and the members line sits right-aligned before the button, capped so long names ellipsize.
The chip's percentage max-width resolved against a content-sized picker
column, so even a single short name was cut off. Cap chips at 16em and
test a one-member Room for whole chip names.
fit-content() is not valid inside minmax(), so the browser dropped the
composer column rule and the field fell into a narrow implicit column.
Use fit-content(50%) for the picker and test the field's share of the row.
Review fixes for S13: the closed-room notice and library line sit above the
messages, the members summary keeps one line (full names in Room details),
the recipient picker is bounded with truncated chips, and the icon-only Room
details button keeps a 44px target. Adds long-member and closed-room tests at
1440x700 and 700x541.
At 100% zoom in windows 541-760px tall the Room page was 60px taller than
the window and the Send to room button started cut off (S10's 160px log
minimum). A short-window Room grid moves the members line beside the
section title and puts the composer on one row; under 650px the header
compacts. Keyed on the CSS viewport only, so 2x displays get the same
layout; page-flow layouts are unchanged.
An upward reader scroll that left the newest message's end at the
viewport bottom still read as at tail, so new content pulled the reader
down past the composer pin. The message-end tail position now counts
only on a downward scroll. A channel-disabled Conversation pins the
newest message instead of a composer that cannot send. S11 and S12
visibility checks require the whole newest message whenever it fits
above the composer.
In page flow (200% zoom, short or narrow windows) the transcript now
follows with the composer's bottom at the viewport bottom and the newest
message above it. Absent or disabled composers keep the S11 pin. Narrow
Room composers stack in one column. S11's visibility check accepts the
newest message's end when it is taller than half the viewport.
In page flow (200% zoom), the S11 follow logic re-pinned the document on
any scroll without wheel, touch, pointer or scroll-key input, so Tab,
Shift+Tab, focus(), find-style reveals and dialog return focus were pulled
back to the tail with focus thousands of pixels off screen.
Re-pin only a downward scroll with no reader input while following (scroll
anchoring as content grows). Count Tab as reader input, expire the reader
flag after two frames, and resume following when a transcript is opened.
S10 review P1: the max-height:700px page-flow rule moved the composer
off screen on 1440x700 and 1366x650 windows at 100%. Page flow now
applies only at max-height:540px (200% tab zoom on desktop screens) or
below 320px wide. S10 review P2: the moved Room details control keeps
its 44px target.
At 200% zoom on a 390px viewport the compact conversation row held a decision status on one line, so Needs your input pushed the page 12px sideways. The status now takes its own line under the icon and text and wraps. The Overview column margin and split were scoped to Overview, so Requirements keeps its base geometry. Tests cover a real decision status and the Requirements position.
jason.woltje