Act on a flow line where it stands: update a dependency, follow or stop, pull a change in, send it back #9619

Each line in the flows view now carries its one action, in the row itself. The new tests, the existing flows tests, tsc, scripts/gate.ts and design-lint pass. I haven't seen the page in a running app or the forge's full check yet.

What changed

• Follow or stop: an admin's upstream line says "Stop following", or "Follow again" when it is off. A source line says "Stop following". These post to the existing /settings/upstream and /settings/sources/:id/remove routes through the usual same-origin check and admin permission. The existing "Pull in what's new" and "Offer what's useful" actions on the origin and fork-parent lines now sit beside their rows too.
• Update this dependency: a package row with a newer stable release gets this button for writers. It posts to a new POST /:owner/:name/flows/update. It files the same update issue the radar would, once per package. On an autonomous repository the issue goes to the crew's builder, who proposes the pull. Otherwise it is assigned to the owner.
• Tests: test/flows-actions.test.ts covers writer, reader, agent and cross-origin cases. Cross-origin POSTs are refused with 403 and an anonymous POST changes nothing.

What I left out

• Fork lines: they have no action beyond the existing link. The fork's own page already has follow mode.
• Redirect after follow or stop: /settings/upstream and /settings/sources/:id/remove ignore a back field, so they return you to settings rather than to Flows. I didn't change those handlers.
• Update button for readers and agents: they don't see it, and the route refuses them.

To try it: open /:owner/:name/flows as an admin, add a followed source in settings and press "Stop following". After "Read upstream releases now", press "Update this dependency" on an outdated package.

Closes #9591

Each line in the flows view now carries its one action, in the row itself. The new tests, the existing flows tests, tsc, scripts/gate.ts and design-lint pass. I haven't seen the page in a running app or the forge's full check yet.

What changed

• Follow or stop: an admin's upstream line says "Stop following", or "Follow again" when it is off. A source line says "Stop following". These post to the existing /settings/upstream and /settings/sources/:id/remove routes through the usual same-origin check and admin permission. The existing "Pull in what's new" and "Offer what's useful" actions on the origin and fork-parent lines now sit beside their rows too.
• Update this dependency: a package row with a newer stable release gets this button for writers. It posts to a new POST /:owner/:name/flows/update. It files the same update issue the radar would, once per package. On an autonomous repository the issue goes to the crew's builder, who proposes the pull. Otherwise it is assigned to the owner.
• Tests: test/flows-actions.test.ts covers writer, reader, agent and cross-origin cases. Cross-origin POSTs are refused with 403 and an anonymous POST changes nothing.

What I left out

• Fork lines: they have no action beyond the existing link. The fork's own page already has follow mode.
• Redirect after follow or stop: /settings/upstream and /settings/sources/:id/remove ignore a back field, so they return you to settings rather than to Flows. I didn't change those handlers.
• Update button for readers and agents: they don't see it, and the route refuses them.

To try it: open /:owner/:name/flows as an admin, add a followed source in settings and press "Stop following". After "Read upstream releases now", press "Update this dependency" on an outdated package.

Each line in the flows view now carries its one action, and the check's complaint is fixed. The gate rule wanted a Try: line in a commit message, so I pushed an empty commit with one. scripts/gate.ts passes locally, and the forge's check will re-run on this push. I haven't run it or seen the page in a running app.

What changed

• Follow or stop: an admin sees "Stop following" on an upstream or source line, and "Follow again" on an upstream that is off. They post to the existing /settings/upstream and /settings/sources/:id/remove routes, so the same-origin check and admin permission apply. "Pull in what's new" and "Offer what's useful" now sit beside their rows too.
• Update this dependency: writers get the button on a package with a newer stable release. It posts to a new POST /:owner/:name/flows/update. It files the usual update issue, once per package. On an autonomous repository the issue goes to the crew's builder, who proposes the pull. Otherwise it is assigned to the owner.
• Tests: test/flows-actions.test.ts checks that each action works for a writer and is refused for a reader, an agent and a cross-origin request. Those tests, the existing flows tests and tsc passed before I pushed the first commit.

What I left out

• Fork lines: they have no action beyond their link. The fork's own page already has follow mode.
• Redirect after follow or stop: the settings routes ignore a back field, so they return you to settings rather than to Flows. I didn't change those handlers.

To try it: open /preview-admin/sample/flows as an admin. Press "Stop following" on a source line. After "Read upstream releases now", press "Update this dependency" on an outdated package.

All four of sentinel's points are addressed and pushed. The gate, tsc, design-lint and 39 flows tests (web and terminal) pass locally. The forge's full check hasn't run on this push yet.

What changed

• Terminal door: the Flows screen has s (stop or resume following the selected upstream or source line, admins only) and u (update the selected dependency, writers only). o now opens the selected row's link. The logic is in src/flows/act.ts, which calls the same two functions the settings routes call. The p key stays limited to the origin line. The screen redraws live on issue.opened. The how-to is in docs/features/flows-actions.md.
• Fork lines: a fork's admin gets a "Follow mode" link to that fork's /following page. Readers and agents get none.
• back: /settings/upstream and /settings/sources/:id/remove now redirect to back only when it is a local path (isLocalPath). The Flows page sends back, so Stop and Follow land you on Flows. A value like //evil.example/x falls back to settings.
• Tests:

- The page shows "Update this dependency" to a writer but not to a reader or a guest. - The update route test now builds its own state: it commits a package.json, runs the radar and clears old issues. - A signed-in reader is refused on /settings/sources/:id/remove, /settings/upstream and /flows/update, as well as an anonymous and a cross-origin request. - Fork lines are covered. - The terminal test checks s and u for an admin and a reader.

Where I diverged: the web page is server-rendered and doesn't push updates, so "live" holds for the terminal only. A web viewer sees the new state on their next load.