launchpad: row 301 (#1808): library-cli and thread-claims bus.mjs fixtures export throwing busBusiness and userCaller stubs (mos-1451 under mos-1272); BUILD.md repaired with run 1 and the ruling; manifest seven paths; unrun

agents/launchpad/work/queue-300/BUILD.md

@@ -1,66 +0,0 @@
-# Row 300 build notes (Launchpad): R6-N1, an HTTP-level test of the user-session option swap (#1807)
-
-Brief: docs/plans/2026-10-23_r6-followup-rows.md § Brief: R6-N1. Reviewer Duckworth, gate owner Sage.
-Base c13c337e1 (refactor, after row 294 landed at d3059c2c3). Branch launchpad/row300.
-
-## Change
-
-Tests only. One new file, packages/webui/tests/user-option-swap.test.mjs. No product change and no
-existing assertion or fixture touched.
-
-- **Gate stubbed open.** The file registers an in-thread load hook (`registerHooks`, as
-  thread-claims.test and library-cli.test do through `--import`) keyed on the one URL
-  `serve.mjs?gate=open`. On that URL alone it prepends `return true;` to `userRoute`'s body, then
-  imports `startServer` from it. Every other import of serve.mjs, and every relative import inside
-  the copy, is the real module. If the gate's signature line is not in serve.mjs exactly once, the
-  hook throws. A renamed gate then fails loudly, instead of quietly testing the closed gate. The
-  test also asserts that the copy's `userRoute` answers true for `POST /api/bus/message`.
-- **Setup.** This is granted-user.test.mjs's setup, cut to what the test needs: the fake OP, the
-  in-process broker for `demo`, createSso with the access hook, and `userOptionsFor` over alice's
-  transport. Every owner option is a stub that records its own name. The owner transport records
-  `['transport', verb, args]`. One list, `owner`, holds both kinds of owner call.
-- **Positive control.** The owner signs in and posts `/api/bus/message`. Exactly
-  `['option', 'send']` must be recorded, so the route reaches `send` and the count works.
-- **The check.** Alice signs in and walks G4's owner routes, copied, plus two chat reads. No answer
-  may say `owner-only`, so the gate really is open. After each route, every owner record must be
-  `['transport', 'plugins', {}]`, the read mos-1394 allowed. The message route must reach the user
-  transport (`message.send`), and every transport opened is alice's.
-
-Why a new file: granted-user.test.mjs's setup imports startServer statically. Passing the gate-open
-copy into it would change that fixture, and a fixture change goes to Mos. The route list and setup
-are copied, with a comment naming their source.
-
-## Mutant
-
-M12: serve.mjs:689 drops `send` from the user-session destructure, so a user session keeps the
-owner's `send`. Killed when "R6-N1" reports not ok. Expected failure: on `POST /api/bus/message`,
-the owner record holds `['option', 'send']`. run1/mutants.py applies it (anchor exactly once), runs
-the new file alone, restores with git checkout and checks the tree is clean.
-
-## Gate
-
-Duckworth approves the manifest. On Sage's CLEAR: run1/gate.sh does npm ci (root and webui), the new
-file whole, the webui suite whole, then M12. Logs go to /mnt/storage/scratch/launchpad-r300/run1,
-outside the tree. Not run yet.
-
-MANIFEST.sha256 lists the one new path.
-
-## Run 1 (sage-3408 CLEAR, 12:05Z)
-
-npm ci root and webui were green. The new file was red on its first run (mos-1272, placed by me):
-`TypeError: Cannot read properties of undefined (reading 'set-cookie')` in signIn. When I cut down
-granted-user.test.mjs's `call`, I dropped `headers: res.headers` from what it resolves, so the
-sign-in found no cookies. The fix puts `headers` back, the same as granted-user.test.mjs:40. No
-assertion changed. The new file then passed alone (1/0). The fix is a new commit, and the manifest
-is re-hashed. The gate resumes at new-file on the new head.
-
-Run 1 resumed (TAG -r2) on db5122920, manifest db8be52ce895603e687985acfae29e53e3e8782ae945c3cded6cca36141bfa3b:
-
-- new file whole: 1 pass, 0 fail.
-- webui suite whole: 375 pass, 0 fail, 0 skipped, 0 cancelled, 58.2 s (limit 600).
-- M12 killed. "R6-N1" reports not ok at :151: `POST /api/bus/message: ["option","send"]`, where
-  `["transport","plugins",{}]` is expected. The restore left the tree clean.
-
-Duckworth N1 (duckworth-0263, non-blocking): the setup passes no `upstream`, so the swap's
-`upstream = null` has no recorder here. The test proves the swap for the options it stubs. It
-proves nothing about `upstream`.

agents/launchpad/work/queue-300/MANIFEST.sha256

@@ -1 +0,0 @@
-03b5d60f68ea2bddd779e1df19519855a5f01cc28ec9ddb26ee7c45fcfe75cf4  packages/webui/tests/user-option-swap.test.mjs

agents/launchpad/work/queue-300/run1/gate.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# Row 300 gate run 1 (brief R6-N1): npm ci (root and packages/webui), the new test file whole, the
-# webui suite whole, then mutant M12. Stops at the first red. FROM=<step> resumes at a step.
-set -u -o pipefail
-WT=/mnt/storage/scratch/launchpad-r300/wt
-OUT=$WT/agents/launchpad/work/queue-300/run1
-LOG=/mnt/storage/scratch/launchpad-r300/run1
-FROM=${FROM:-npm-root}; TAG=${TAG:-}
-mkdir -p $LOG
-export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/gXXXXXX)
-echo "start $(date -u +%H:%M:%SZ) FROM=$FROM TAG=$TAG TMPDIR $TMPDIR head $(git -C $WT rev-parse HEAD)" >> $LOG/summary.txt
-[ -z "$(git -C $WT status --porcelain)" ] || { echo "STOP worktree not clean" | tee -a $LOG/summary.txt; exit 9; }
-on=0
-step() { # name limit dir cmd...
-  local name=$1 limit=$2 dir=$3; shift 3
-  [ $on = 1 ] || [ $name = $FROM ] || return 0; on=1
-  local t0=$(date +%s%N)
-  ( cd $dir && timeout -k 10 $limit "$@" ) > $LOG/$name$TAG.log 2>&1
-  local rc=$?
-  local ms=$(( ($(date +%s%N) - t0) / 1000000 )); local dt=$((ms/1000)).$(printf %03d $((ms%1000)))
-  echo "$name$TAG rc=$rc seconds=$dt limit=$limit $(date -u +%H:%M:%SZ)" | tee -a $LOG/summary.txt
-  [ $rc -eq 0 ] || { echo "STOP at $name$TAG" | tee -a $LOG/summary.txt; exit $rc; }
-}
-step npm-root 900 $WT npm ci --ignore-scripts
-step npm-webui 900 $WT/packages/webui npm ci --ignore-scripts
-step new-file 300 $WT/packages/webui node --test tests/user-option-swap.test.mjs
-step webui 600 $WT/packages/webui node --test tests/
-[ -z "$(git -C $WT status --porcelain)" ] || { echo "STOP worktree dirty after the suite" | tee -a $LOG/summary.txt; git -C $WT status --porcelain >> $LOG/summary.txt; exit 9; }
-echo "SUITES GREEN $(date -u +%H:%M:%SZ)" | tee -a $LOG/summary.txt
-python3 -B $OUT/mutants.py
-rc=$?; echo "MUTANTS rc=$rc $(date -u +%H:%M:%SZ)" | tee -a $LOG/summary.txt; exit $rc

agents/launchpad/work/queue-300/run1/mutants.py

@@ -1,47 +0,0 @@
-#!/usr/bin/env python3
-# Row 300 mutant M12 (BUILD.md "Mutant"): serve.mjs keeps the owner's send for a user session. The
-# edit must match exactly once; the new file runs alone under timeout -k 10 300 with the TAP
-# reporter; git checkout restores and the tree must be clean. Killed = "R6-N1" reports "not ok".
-import json, os, re, subprocess, sys, time
-
-WT = '/mnt/storage/scratch/launchpad-r300/wt'
-LOG = '/mnt/storage/scratch/launchpad-r300/run1'
-SWAP = "({ bus, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));"
-MUTANTS = [
-  ('M12', 'packages/webui/src/serve.mjs', SWAP,
-   "({ bus, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));",
-   ('packages/webui', 'tests/user-option-swap.test.mjs'), 'R6-N1'),
-]
-
-def git(*a):
-  return subprocess.run(['git', '-C', WT, *a], capture_output=True, text=True, check=True).stdout
-
-def main():
-  if git('status', '--porcelain'): raise SystemExit('worktree not clean at start')
-  summary, bad = [], 0
-  for mid, path, old, new, (pkg, test), killer in MUTANTS:
-    p = os.path.join(WT, path)
-    try:
-      s = open(p).read()
-      if s.count(old) != 1: raise SystemExit(f'{mid}: anchor count {s.count(old)} in {path}')
-      open(p, 'w').write(s.replace(old, new))
-      diff = git('diff')
-      t0 = time.time()
-      r = subprocess.run(['timeout', '-k', '10', '300', 'node', '--test', '--test-reporter=tap', test],
-                         cwd=os.path.join(WT, pkg), capture_output=True, text=True)
-      dt = round(time.time() - t0, 1)
-    finally:
-      git('checkout', '--', path)
-      if git('status', '--porcelain'): raise SystemExit('worktree not clean after restore')
-    open(f'{LOG}/{mid}.diff', 'w').write(diff)
-    open(f'{LOG}/{mid}.tap', 'w').write(r.stdout + '\n# stderr\n' + r.stderr)
-    res = {m.group(2): m.group(1) == 'ok' for m in re.finditer(r'^(ok|not ok) \d+ - (.*)$', r.stdout, re.M)}
-    hit = [n for n in res if n.startswith(killer)]
-    killed = r.returncode not in (0, 124, 137) and bool(hit) and all(not res[n] for n in hit)
-    bad += not killed
-    print(f'{mid} rc={r.returncode} seconds={dt} killed={killed} red={[n for n, ok in res.items() if not ok]}', flush=True)
-    summary.append({'mutant': mid, 'rc': r.returncode, 'seconds': dt, 'killed': killed, 'killer': killer})
-  json.dump(summary, open(f'{LOG}/mutants.json', 'w'), indent=1)
-  sys.exit(1 if bad else 0)
-
-main()

agents/launchpad/work/queue-301/BUILD.md

@@ -0,0 +1,67 @@
+# Row 301 build notes (Launchpad): R6-N4, fold user-bus.mjs back into bus.mjs (#1808)
+
+Brief: docs/plans/2026-10-23_r6-followup-rows.md § Brief: R6-N4. Reviewer Duckworth, gate owner Sage.
+Base e551cd846 (refactor after row 303). Branch launchpad/row301.
+
+## Change
+
+- packages/webui/src/bus.mjs: the user transport moves in beside humanCall, after `busReader`:
+  `USER_CLI`, `userCall`, `busBusiness` and `userCaller`, byte for byte from user-bus.mjs (checked
+  with diff), under a three-line header. One import is added, `fileURLToPath` from node:url.
+  `readHostState`, `spawn`, `randomBytes` and `BusReadError` were already in bus.mjs. humanCall and
+  busCaller are untouched.
+- packages/webui/src/user-bus.mjs: deleted.
+- packages/webui/src/cli.mjs: the two imports become one, from './bus.mjs'.
+- packages/webui/src/console-bus.mjs: a comment names bus.mjs instead of user-bus.mjs.
+- packages/webui/tests/granted-user.test.mjs:22-23: the two imports become one, from '../src/bus.mjs'.
+  Only the import path changes. Mos ruled (mos-1449, via sage-3399) that this is covered by "update
+  its imports" and is not an old-test change.
+
+No other reference to user-bus.mjs remains under packages/. tools/agent-watch's "user-bus" means
+something unrelated. The 294 packet's mutants name the old file as history only.
+
+## Re-pin
+
+channel-proof.test.mjs:28 pinned packages/webui/src/bus.mjs at 15e8123f…3313. After the fold the
+file hashes to 39fcb27c82e917ef05e1a7a650d522c9f3c656bf8dbade87b8ddb3661b67ad6c. A pin change is an
+old-test change. Mos approved it under mos-1272 in mos-1449 (via sage-3399), as its own commit, with
+row 301 making its own re-pin window. Mos checked fd4b8c36e read-only: bus.mjs hashes to 39fcb27c,
+its diff removes no lines, user-bus.mjs from `export const USER_CLI` to the end is in it byte for
+byte, and nothing else imports user-bus.mjs. The second commit changes that one value and adds one
+comment line in the row 165/171/194 style.
+
+## Gate
+
+Duckworth approves the manifest. channel-proof.test, the webui suite and the 294 user-transport
+tests (granted-user.test.mjs) run whole and green, on Sage's CLEAR.
+
+MANIFEST.sha256 lists the changed paths. DELETED.txt names the one removed path.
+
+## Run 1 (sage-3408 CLEAR, 12:08Z, head 04a179740)
+
+npm ci root and webui green. channel-proof.test whole 2 pass 0 fail. The webui suite whole went
+374 tests, 372 pass, 2 fail, 0 skipped, so the gate stopped. granted-user.test whole, run after the
+stop to see whether the stop hid another red: 19 pass 0 fail. No file changed.
+
+Both reds were in old tests: library-cli.test.mjs:10 (C2-04) and thread-claims.test.mjs:54 (row278
+Console adapter). Each failed with `SyntaxError: The requested module './bus.mjs' does not provide an
+export named 'busBusiness'` at cli.mjs:5. Each test spawns cli.mjs with a registerHooks load hook
+that replaces /webui/src/bus.mjs with a fixture exporting only BusReadError and busCaller. Before
+the fold, cli.mjs took busBusiness and userCaller from the real user-bus.mjs. Now they come from the
+stubbed bus.mjs, so cli.mjs fails to link. cli.mjs calls them only under --sso (:98, :103), and
+neither test passes --sso. A URL-keyed stub is not an import, so the "nothing else imports
+user-bus.mjs" check and the static reviews missed it. `git grep "webui/src/bus.mjs" --
+'packages/*/tests/*'` finds exactly channel-proof, library-cli and thread-claims.
+
+## Fixture change (mos-1451 under mos-1272, via sage-3418)
+
+Mos approved option A with one change and refused option B, a namespace import in cli.mjs. Each
+of the two busSource template strings (library-cli.test.mjs:17, thread-claims.test.mjs:58) gets
+this appended, and nothing else changes in either file:
+
+    export const busBusiness=()=>{throw Error('busBusiness outside --sso')};export const userCaller=()=>{throw Error('userCaller outside --sso')};
+
+The stubs throw rather than return null, so a test that reaches them outside --sso fails loudly.
+The text has no backtick, `${` or backslash, so the template literal carries it unchanged. The
+manifest goes from five paths to seven. Sage's gate: webui 374/0, channel-proof 2/0,
+granted-user 19/0. Any other red stops the gate and goes to Mos.

agents/launchpad/work/queue-301/DELETED.txt

@@ -0,0 +1 @@
+deleted  packages/webui/src/user-bus.mjs

agents/launchpad/work/queue-301/MANIFEST.sha256

@@ -0,0 +1,7 @@
+db1f05e312b9bee7ece7df7df78047a2965024109a297cb8a24112135a6e5f04  packages/bus/tests/channel-proof.test.mjs
+39fcb27c82e917ef05e1a7a650d522c9f3c656bf8dbade87b8ddb3661b67ad6c  packages/webui/src/bus.mjs
+0862b2b5bf6511d2c5deca1f318eee643edaee489c0ce8c83e57364f2f54a3d8  packages/webui/src/cli.mjs
+653d2087c0796a35c3884b7243d1adf8a78c52950a4924049317063f2d3c0974  packages/webui/src/console-bus.mjs
+34b6d052855369c8f7cf1faf8bab3c59ddf96ccd4c42731bd86a4e61e5e70640  packages/webui/tests/granted-user.test.mjs
+7e782c2b6b46b6b8b6e58cd3d148bf041d49e8fbf2cbbed51080cdb02fc11d89  packages/webui/tests/library-cli.test.mjs
+dd1e62d14a59bb8fe7cd4654dd1de8e518270c36d104ee356e165faee7f95a02  packages/webui/tests/thread-claims.test.mjs

agents/launchpad/work/queue-303/BUILD.md

@@ -0,0 +1,26 @@
+# Row 303 build notes (Launchpad): R9 shows its output when rehearse makes no directory (#1810)
+
+Brief: docs/plans/2026-10-23_r9-guard-row.md (Vikunja 589). Reviewer Duckworth, gate owner Sage.
+Base 80793d824 (refactor after row 294 landed at d3059c2c3). Branch launchpad/row303.
+
+## Change
+
+One added line in packages/cli/tests/stack-release.test.mjs, R9 only, at :2178:
+
+    assert.ok(r.dir!==null, r.out+r.err);
+
+It sits right after R9's exit-code check and right before the `includes` check whose message builds
+`join(r.dir,'placeholders')`. rehearse() (:2040) sets `dir` to null when the output has no
+`rehearsal directory:` line, so the guard fails first and its message carries the rehearsal's
+output and stderr, including the FAIL line that stopped it. This is a test-only change to a
+pre-existing test, approved under mos-1272 and mos-1316 (mos-1422 point 2). It adds an assertion
+and changes none. No other line in R9 or any other test changes. The lines the brief names (:2058,
+:2113, :2126, :2267, :2280) put r.dir in a template, where a null prints as `null` and the message
+still carries r.out, so they get no guard.
+
+MANIFEST.sha256 lists the one changed path, hashed from the commit that adds this file.
+
+## Gate
+
+Duckworth approves the diff. stack-release.test.mjs runs whole and green on Sage's gate, in a gap.
+Not run yet.

agents/launchpad/work/queue-303/MANIFEST.sha256

@@ -0,0 +1 @@
+e936808bb12361acf164b675fe40ead416720dfd48c5d51ea5bfee1e1893cc33  packages/cli/tests/stack-release.test.mjs

packages/bus/tests/channel-proof.test.mjs

@@ -25,7 +25,8 @@ const baselines = {
  // Row 171 (#1668): project-name-is-repo maps to 409; no proof or transport change.
  // Row 194 (#1692, brief item 7, sage-1610 a): organization-tracker-required 400 and
  // organization-tracker-bot-taken 409; no proof or transport change.
- "packages/webui/src/bus.mjs": "15e8123ffdbb6d067e8a516f5823efdb5de3c869963764f27cd14bb9e4ce3313",
+ // Row 301 (#1808, mos-1449): the user transport moved from user-bus.mjs into bus.mjs; humanCall unchanged.
+ "packages/webui/src/bus.mjs": "39fcb27c82e917ef05e1a7a650d522c9f3c656bf8dbade87b8ddb3661b67ad6c",
 };
 const repoFile = path => new URL("../../../" + path, import.meta.url);
 

packages/cli/tests/stack-release.test.mjs

@@ -2175,6 +2175,7 @@ test('R9 mos-0963: a role reference left outside placeholders/, or left on an en
  ownScript(e,'for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);swap(name,r?.credentials)}','for(const [name,r] of Object.entries(b.roles??{})){strip(r?.vars);if(name!=="pm")swap(name,r?.credentials)}');
  const r=await rehearse(e,B,'--backup',e.act,'--port',await freePort(),'--timeout','3');
  assert.equal(r.code,1,r.out+r.err);
+ assert.ok(r.dir!==null, r.out+r.err);
  assert.ok(r.out.includes(`FAIL credential-ref-live: pm gitea is ${tok}, not a file in ${join(r.dir,'placeholders')}\n`),r.out);
  assert.deepEqual(r.names.slice(-3),['FAIL credential-ref-live','PASS backup-unchanged','PASS live-config-unchanged']);
  assert.equal(existsSync(rh(e,'host-args.log')),false);assert.equal(existsSync(rh(e,'console-args.log')),false);

packages/webui/src/bus.mjs

@@ -10,6 +10,7 @@
 
 import { spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 import { HUMAN_CLI } from '../../cli/src/transport.mjs';
 import { readHostState } from '../../cli/src/host.mjs';
 import { views } from '../../bus/src/views.mjs';
@@ -72,6 +73,63 @@ export function busCaller({ dataRoot, socket, business = null, env = process.env
 }
 export const busReader = options => views({ call: busCaller(options) });
 
+// FED R6 (#1800): a granted user's bus transport, R3's user-cli.mjs (#414, design 3.6). Same
+// protocol as humanCall: the request on stdin, JSON on stdout, or a bus error code as the last
+// `^[a-z-]{1,64}$` line of stderr. Row 301 (#1808) moved it here from user-bus.mjs.
+export const USER_CLI = fileURLToPath(new URL('../../bus/src/user-cli.mjs', import.meta.url));
+
+// The Console sets the user nonce itself, so user-cli.mjs doesn't re-exec and the broker sees the
+// Console (`cli.mjs serve`) as its parent (principal.mjs). The human nonce is dropped, so this child
+// can never pass as human-cli, and it only ever runs USER_CLI.
+export function userCall({ socket, business, user, env = process.env, timeoutMs = 30000, maxBytes = 8 * 1024 * 1024 }) {
+  const { MOSAIC_BUS_CLI_NONCE, ...rest } = env;
+  return (verb, args = {}) => new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(process.execPath, [USER_CLI, socket], { env: { ...rest, MOSAIC_BUS_USER_NONCE: randomBytes(32).toString('hex') }, stdio: ['pipe', 'pipe', 'pipe'] });
+    } catch { return reject(new BusReadError('outcome-unknown', 'the bus transport did not start')); }
+    const out = [], err = [];
+    let size = 0, settled = false;
+    const done = (fn, value) => { if (!settled) { settled = true; clearTimeout(timer); fn(value); } };
+    const timer = setTimeout(() => { child.kill('SIGKILL'); done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish in time')); }, timeoutMs);
+    child.stdout.on('data', chunk => {
+      size += chunk.length;
+      if (size > maxBytes) { child.kill('SIGKILL'); return done(reject, new BusReadError('response-too-large')); }
+      out.push(chunk);
+    });
+    child.stderr.on('data', chunk => { if (err.length < 64) err.push(chunk); });
+    child.on('error', () => done(reject, new BusReadError('outcome-unknown', 'the bus transport did not start')));
+    child.on('close', status => {
+      if (status === null) return done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish'));
+      if (status !== 0) {
+        const code = Buffer.concat(err).toString('utf8').trim().split('\n').reverse().find(l => /^[a-z-]{1,64}$/.test(l)) ?? 'invalid-response';
+        return done(reject, new BusReadError(code));
+      }
+      try { done(resolve, JSON.parse(Buffer.concat(out).toString('utf8'))); }
+      catch { done(reject, new BusReadError('invalid-response')); }
+    });
+    child.stdin.on('error', () => {}); // A child that exits early reports through 'close'.
+    child.stdin.end(`${JSON.stringify({ business, user, verb, args })}\n`);
+  });
+}
+
+// The business is the --business flag, or else the live bus host's, read on every call, as busCaller does.
+export function busBusiness({ dataRoot, business = null }) {
+  return () => {
+    if (business) return business;
+    let state;
+    try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
+    if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
+    return state.business;
+  };
+}
+
+// One granted user's caller, for that user's session only.
+export function userCaller({ dataRoot, socket, business = null, user, env = process.env, timeoutMs = 30000 }) {
+  const which = busBusiness({ dataRoot, business });
+  return async (verb, args) => userCall({ socket, business: which(), user, env, timeoutMs })(verb, args);
+}
+
 // A send's error, sorted. The broker writes in one transaction, so any code it
 // returns means nothing was written. A transport that lost the answer, or an
 // answer that can't be read, leaves the outcome open: the message may exist.

packages/webui/src/cli.mjs

@@ -2,8 +2,7 @@
 // MOSAIC_TESTER_SOCKET_V1: private tester ingress, no tester TCP.
 import { createChat } from './chat.mjs';
 import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
-import { busCaller } from './bus.mjs';
-import { busBusiness, userCaller } from './user-bus.mjs';
+import { busCaller, busBusiness, userCaller } from './bus.mjs';
 import { consoleBus, userOptionsFor, agentCaller, TESTER_AGENT_VERBS } from './console-bus.mjs';
 import { consoleAccess } from './access.mjs';
 import { accessContextFor } from '../../cli/src/access.mjs';

packages/webui/src/console-bus.mjs

@@ -1,6 +1,6 @@
 // FED R6 (#1800): the Console's bus-backed options for startServer, built over one transport
 // `call`. cli.mjs builds them once over the human transport. A granted user's session gets the same
-// set over its own user transport (user-bus.mjs userCaller), so no route a user reaches holds a
+// set over its own user transport (bus.mjs userCaller), so no route a user reaches holds a
 // human-transport object, and the broker decides every verb the user sends (design 3.1 D4).
 import { createChat } from './chat.mjs';
 import { views } from '../../bus/src/views.mjs';

packages/webui/src/user-bus.mjs

@@ -1,63 +0,0 @@
-// FED R6 (#1800): a granted user's bus transport, R3's user-cli.mjs (#414, design 3.6). Kept apart
-// from bus.mjs so the human transport's reviewed bytes stay as row 164 froze them
-// (bus/tests/channel-proof.test.mjs). Same protocol as humanCall: the request on stdin, JSON on
-// stdout, or a bus error code as the last `^[a-z-]{1,64}$` line of stderr.
-import { spawn } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-import { readHostState } from '../../cli/src/host.mjs';
-import { BusReadError } from './bus.mjs';
-
-export const USER_CLI = fileURLToPath(new URL('../../bus/src/user-cli.mjs', import.meta.url));
-
-// The Console sets the user nonce itself, so user-cli.mjs doesn't re-exec and the broker sees the
-// Console (`cli.mjs serve`) as its parent (principal.mjs). The human nonce is dropped, so this child
-// can never pass as human-cli, and it only ever runs USER_CLI.
-export function userCall({ socket, business, user, env = process.env, timeoutMs = 30000, maxBytes = 8 * 1024 * 1024 }) {
-  const { MOSAIC_BUS_CLI_NONCE, ...rest } = env;
-  return (verb, args = {}) => new Promise((resolve, reject) => {
-    let child;
-    try {
-      child = spawn(process.execPath, [USER_CLI, socket], { env: { ...rest, MOSAIC_BUS_USER_NONCE: randomBytes(32).toString('hex') }, stdio: ['pipe', 'pipe', 'pipe'] });
-    } catch { return reject(new BusReadError('outcome-unknown', 'the bus transport did not start')); }
-    const out = [], err = [];
-    let size = 0, settled = false;
-    const done = (fn, value) => { if (!settled) { settled = true; clearTimeout(timer); fn(value); } };
-    const timer = setTimeout(() => { child.kill('SIGKILL'); done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish in time')); }, timeoutMs);
-    child.stdout.on('data', chunk => {
-      size += chunk.length;
-      if (size > maxBytes) { child.kill('SIGKILL'); return done(reject, new BusReadError('response-too-large')); }
-      out.push(chunk);
-    });
-    child.stderr.on('data', chunk => { if (err.length < 64) err.push(chunk); });
-    child.on('error', () => done(reject, new BusReadError('outcome-unknown', 'the bus transport did not start')));
-    child.on('close', status => {
-      if (status === null) return done(reject, new BusReadError('outcome-unknown', 'the bus transport did not finish'));
-      if (status !== 0) {
-        const code = Buffer.concat(err).toString('utf8').trim().split('\n').reverse().find(l => /^[a-z-]{1,64}$/.test(l)) ?? 'invalid-response';
-        return done(reject, new BusReadError(code));
-      }
-      try { done(resolve, JSON.parse(Buffer.concat(out).toString('utf8'))); }
-      catch { done(reject, new BusReadError('invalid-response')); }
-    });
-    child.stdin.on('error', () => {}); // A child that exits early reports through 'close'.
-    child.stdin.end(`${JSON.stringify({ business, user, verb, args })}\n`);
-  });
-}
-
-// The business is the --business flag, or else the live bus host's, read on every call, as busCaller does.
-export function busBusiness({ dataRoot, business = null }) {
-  return () => {
-    if (business) return business;
-    let state;
-    try { state = readHostState(dataRoot); } catch { throw new BusReadError('no-bus-host', 'the bus host state file is unreadable'); }
-    if (!state?.live) throw new BusReadError('no-bus-host', 'no bus host is running and no --business was given');
-    return state.business;
-  };
-}
-
-// One granted user's caller, for that user's session only.
-export function userCaller({ dataRoot, socket, business = null, user, env = process.env, timeoutMs = 30000 }) {
-  const which = busBusiness({ dataRoot, business });
-  return async (verb, args) => userCall({ socket, business: which(), user, env, timeoutMs })(verb, args);
-}

packages/webui/tests/granted-user.test.mjs

@@ -19,8 +19,7 @@ import { startServer, userRoute } from '../src/serve.mjs';
 import { createSso, SESSION_COOKIE } from '../src/sso.mjs';
 import { consoleAccess } from '../src/access.mjs';
 import { consoleBus, userOptionsFor } from '../src/console-bus.mjs';
-import { BusReadError } from '../src/bus.mjs';
-import { USER_CLI, userCall } from '../src/user-bus.mjs';
+import { BusReadError, USER_CLI, userCall } from '../src/bus.mjs';
 import { close, fixture } from './fixture.mjs';
 import { browser } from './browser.mjs';
 import { fakeOidc } from './helpers/fake-oidc.mjs';

packages/webui/tests/library-cli.test.mjs

@@ -14,7 +14,7 @@ test('C2-04 CLI: both listener callback pairs dispatch library verbs with their
   // The loader supplies a fixture bus and captures callbacks instead of
   // opening an HTTP listener. Production imports and routes are unchanged.
   const serveSource = "export const DEFAULT_BOARD='http://127.0.0.1:9';export const previewOptions=()=>null;export const proofOptions=()=>null;export async function startServer(o){if(typeof o.libraryFile!=='function'||typeof o.libraryStatus!=='function')throw Error('missing library callbacks');await o.libraryFile({project:'books',path:'Book One/A.md'});await o.libraryStatus({project:'books'});return {address:()=>({port:0}),close:()=>{}};}";
-  const busSource = `import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,args)=>{appendFileSync(${JSON.stringify(log)},JSON.stringify({verb,args,cli:o.cli??${JSON.stringify(HUMAN_CLI)}})+'\\n');return {};};`;
+  const busSource = `import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,args)=>{appendFileSync(${JSON.stringify(log)},JSON.stringify({verb,args,cli:o.cli??${JSON.stringify(HUMAN_CLI)}})+'\\n');return {};};export const busBusiness=()=>{throw Error('busBusiness outside --sso')};export const userCaller=()=>{throw Error('userCaller outside --sso')};`;
   writeFileSync(hook, `import {registerHooks} from 'node:module';
     registerHooks({load(url,context,next){
       if(url.endsWith('/webui/src/serve.mjs'))return {format:'module',shortCircuit:true,source:${JSON.stringify(serveSource)}};

packages/webui/tests/thread-claims.test.mjs

@@ -55,7 +55,7 @@ test('row278 Console adapter calls argument-free thread.claims through the norma
   const root = tmp(t, 'claims-cli-'), f = fixture(root), log = join(root, 'calls.jsonl'), hook = join(root, 'hooks.mjs');
   writeFileSync(log, '');
   const serveSource = `export const DEFAULT_BOARD='http://127.0.0.1:9';export const previewOptions=()=>null;export const proofOptions=()=>null;export async function startServer(o){await o.bus['thread.claims']();return {address:()=>({port:0}),close:()=>{}};}`;
-  const busSource = `import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,...args)=>{appendFileSync(${JSON.stringify(log)},JSON.stringify({verb,args,tester:!!o.cli})+'\\n');return [];};`;
+  const busSource = `import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,...args)=>{appendFileSync(${JSON.stringify(log)},JSON.stringify({verb,args,tester:!!o.cli})+'\\n');return [];};export const busBusiness=()=>{throw Error('busBusiness outside --sso')};export const userCaller=()=>{throw Error('userCaller outside --sso')};`;
   writeFileSync(hook, `import {registerHooks} from 'node:module';registerHooks({load(url,context,next){
     if(url.endsWith('/webui/src/serve.mjs'))return {format:'module',shortCircuit:true,source:${JSON.stringify(serveSource)}};
     if(url.endsWith('/webui/src/bus.mjs'))return {format:'module',shortCircuit:true,source:${JSON.stringify(busSource)}};

packages/webui/tests/user-option-swap.test.mjs

@@ -1,155 +0,0 @@
-// R6-N1 (#1807, row 294 N1): the user-session option swap in serve.mjs, driven through HTTP.
-// granted-user.test.mjs G4 stops every owner route at the userRoute gate, so it never reaches the
-// swap behind it. Here serve.mjs loads with that gate stubbed open (a load hook keyed on one query
-// string; the product file is unchanged), and every owner route a user session might try must reach
-// no owner option. The owner transport may carry only the plugins read mos-1394 allowed.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { request } from 'node:http';
-import { registerHooks } from 'node:module';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Store } from '../../bus/src/store.mjs';
-import { Broker } from '../../bus/src/broker.mjs';
-import { createSso, SESSION_COOKIE } from '../src/sso.mjs';
-import { consoleAccess } from '../src/access.mjs';
-import { userOptionsFor } from '../src/console-bus.mjs';
-import { BusReadError } from '../src/bus.mjs';
-import { close } from './fixture.mjs';
-import { fakeOidc } from './helpers/fake-oidc.mjs';
-
-const SERVE = new URL('../src/serve.mjs', import.meta.url).href, OPEN = `${SERVE}?gate=open`;
-const GATE = 'export function userRoute(path, method) {';
-registerHooks({
-  load(url, context, next) {
-    const r = next(url, context);
-    if (url !== OPEN) return r;
-    const source = String(r.source);
-    // A renamed gate fails here rather than leaving the test on the closed gate.
-    if (source.split(GATE).length !== 2) throw new Error('serve.mjs: the userRoute gate is not there exactly once');
-    return { ...r, source: source.replace(GATE, `${GATE} return true;`) };
-  },
-});
-const { startServer, userRoute } = await import(OPEN);
-
-const HOST = 'console.example.test', ORIGIN = `https://${HOST}`;
-
-function call(port, { method = 'GET', path = '/', headers = {}, body } = {}) {
-  return new Promise((resolve, reject) => {
-    const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
-    const req = request({ host: '127.0.0.1', port, method, path, headers: { host: HOST, ...length, ...headers } }, res => {
-      let text = '';
-      res.on('data', c => (text += c));
-      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: text }));
-    });
-    req.on('error', reject);
-    req.end(body);
-  });
-}
-const setCookies = r => [r.headers['set-cookie'] ?? []].flat();
-const writeHeaders = cookie => ({ cookie, origin: ORIGIN, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' });
-
-// As granted-user.test.mjs setup: the fake OP, a broker for `demo`, createSso with the access hook,
-// counting owner stubs, and consoleBus over alice's transport for her session. Only startServer
-// differs: it is the gate-open copy.
-async function setup(t) {
-  const op = await fakeOidc();
-  t.after(() => op.close());
-  const iss = op.issuer('a');
-  const root = mkdtempSync(join(tmpdir(), 'webui-option-swap-'));
-  const store = new Store(root);
-  t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const doc = { accessVersion: 1, revision: 1, users: [{ id: 'alice', home: 'local', subjects: [{ provider: 'a', sub: 'alice-sub' }] }],
-    grants: [{ id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator' }] };
-  const load = () => doc;
-  const broker = new Broker({
-    store,
-    businesses: {
-      demo: {
-        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: {},
-        roles: {
-          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
-          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
-        },
-        definitions: { 'chief-of-staff': {}, assistant: { messaging: JSON.parse(readFileSync(new URL('../../../roles/assistant.json', import.meta.url), 'utf8')).messaging } },
-      },
-    },
-    access: load,
-  });
-  const owner = [], user = [], opened = [];
-  const userTransport = name => async (verb, args = {}) => {
-    user.push(verb);
-    try { return broker.request(broker.bindUser({ business: 'demo', user: name }), { verb, args }); }
-    catch (e) { throw new BusReadError(e.code ?? 'invalid-response'); }
-  };
-  const ownerCall = async (verb, args) => { owner.push(['transport', verb, args]); return { plugins: { channel: ['webui'] } }; };
-  const userOptions = userOptionsFor({ owner: ownerCall, send: true, transport: name => { opened.push(name); return userTransport(name); } });
-  const lines = [];
-  const config = { publicOrigin: ORIGIN, providers: [{ id: 'a', issuer: iss.issuer, clientId: iss.clientId, clientSecret: { slot: 'a' }, algs: ['RS256'], subjects: [{ sub: 'owner-sub', name: 'jason' }] }] };
-  const sso = await createSso(config, { secrets: new Map([['a', iss.clientSecret]]), fetch: op.fetch, log: l => lines.push(l), users: consoleAccess({ load, business: () => 'demo' }) });
-  t.after(() => sso.close());
-  // Every owner option is a stub that records its own name.
-  const stub = name => async () => { owner.push(['option', name]); return name === 'send' ? { id: 'msg-0001' } : [{ verb: name }]; };
-  const options = {
-    bus: Object.fromEntries(['inbox', 'tasks', 'agents', 'trail', 'decisions', 'names', 'instances', 'routes', 'thread.claims'].map(v => [v, stub(`bus.${v}`)])),
-    send: stub('send'), settingsWrite: stub('settingsWrite'), projectFiles: stub('projectFiles'), projectFile: stub('projectFile'), projectSave: stub('projectSave'),
-    nameWrite: stub('nameWrite'), assistantStop: stub('assistantStop'), instancesWrite: stub('instancesWrite'), routesWrite: stub('routesWrite'), agentWrite: stub('agentWrite'),
-    processing: { read: stub('processing.read'), halt: stub('processing.halt'), resume: stub('processing.resume') },
-    reads: Object.fromEntries(['settings', 'business', 'busStatus', 'queue', 'row'].map(v => [v, stub(`reads.${v}`)])),
-    chat: Object.fromEntries(['projects', 'threads', 'messages', 'send', 'open', 'createProject', 'createThread'].map(v => [v, stub(`chat.${v}`)])),
-  };
-  const web = await startServer({ port: 0, board: 'http://127.0.0.1:9', sso, log: l => lines.push(l), ...options, userOptions });
-  t.after(() => close(web));
-  return { op, iss, owner, user, opened, lines, port: web.address().port };
-}
-
-async function signIn(env, sub) {
-  const start = await call(env.port, { path: '/auth/login' });
-  assert.equal(start.status, 303);
-  const cookie = setCookies(start)[0].split(';')[0];
-  const location = start.headers.location;
-  const g = env.op.grant(env.iss, location, { sub });
-  const q = new URLSearchParams({ code: g.code, state: new URL(location).searchParams.get('state') });
-  const r = await call(env.port, { path: `/auth/callback?${q}`, headers: { cookie } });
-  const session = setCookies(r).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0];
-  assert.ok(session, `${sub}: no session cookie (${r.status})`);
-  return session;
-}
-
-// granted-user.test.mjs G4's owner routes, plus the chat routes a user session reaches anyway.
-const ROUTES = [
-  ['GET', '/api/bus/inbox'], ['GET', '/api/bus/tasks'], ['GET', '/api/bus/names'], ['GET', '/api/bus/thread.claims'],
-  ['POST', '/api/bus/message', { to: 'coder', body: 'hi' }],
-  ['GET', '/api/settings'], ['POST', '/api/settings', { revision: 'x' }],
-  ['POST', '/api/name', { role: 'assistant', name: 'x' }], ['POST', '/api/assistant/stop', {}],
-  ['POST', '/api/instances', { instance: 'x' }], ['POST', '/api/routes', { routes: [] }],
-  ['POST', '/api/agent/launch', { instance: 'x' }], ['GET', '/api/agent/request?id=x'],
-  ['GET', '/api/processing'], ['POST', '/api/processing/halt', {}],
-  ['GET', '/api/project-files?project=p'], ['GET', '/api/project-file?project=p&path=a'], ['POST', '/api/project-file', { project: 'p' }],
-  ['GET', '/api/board'], ['GET', '/api/conversations'], ['POST', '/api/seen', {}], ['POST', '/api/reply', {}],
-  ['GET', '/api/queue'], ['GET', '/api/queue/1'], ['GET', '/api/business'], ['GET', '/api/bus-status'], ['GET', '/api/task-fields'],
-  ['GET', '/api/chat/projects'], ['GET', '/api/chat/instances'],
-  ['GET', '/app.js'], ['GET', '/bus.js'], ['GET', '/agents.js'], ['GET', '/editor.js'], ['GET', '/shared/app.css'], ['GET', '/index.html'],
-];
-const go = (env, session, [method, path, value]) => call(env.port, { method, path, headers: value === undefined ? { cookie: session } : writeHeaders(session), body: value === undefined ? undefined : JSON.stringify(value) });
-
-test('R6-N1 with the userRoute gate open, a user session reaches no owner option over HTTP', async t => {
-  // The stub took: the gate-open copy lets an owner route through.
-  assert.equal(userRoute('/api/bus/message', 'POST'), true);
-  const env = await setup(t);
-  // Positive control: the owner's session reaches the owner's send on this route.
-  const ownerSession = await signIn(env, 'owner-sub');
-  const sent = await go(env, ownerSession, ['POST', '/api/bus/message', { to: 'coder', body: 'hi' }]);
-  assert.deepEqual(env.owner, [['option', 'send']], `the owner's send did not run: ${sent.status} ${sent.body}`);
-  env.owner.length = 0;
-  const session = await signIn(env, 'alice-sub');
-  for (const route of ROUTES) {
-    const r = await go(env, session, route);
-    assert.doesNotMatch(r.body, /owner-only/, `${route[0]} ${route[1]}: the gate is still closed`);
-    // Only the plugins read with {}, as granted-user.test.mjs G9 pins for the chat.
-    for (const entry of env.owner) assert.deepEqual(entry, ['transport', 'plugins', {}], `${route[0]} ${route[1]}: ${JSON.stringify(entry)}`);
-  }
-  assert.ok(env.user.includes('message.send'), 'the message route never reached the user transport');
-  assert.ok(env.opened.length > 0 && env.opened.every(name => name === 'alice'));
-});