bebfc0a · c695b39 · 96b4746 · bf421c3 · 02b57cf · cec8dc0
@@ -83,3 +83,17 @@
Absorb was built by Ben (benjivers). The review of #9441 found:
- **Speed:** the Features list reads git for every app on every request (#9543).
This section is ready for the owner to share with Ben.
## The menu entry is the admin's, not the deploy's
The name and page in the menu are the ones the admin saw when absorbing. If the production
`forge.json` later declares others, the menu keeps serving the absorbed ones and Settings ›
Features shows "declaration changed: review" with the new values; an admin accepts them
(`POST /settings/features/:slug/accept` with the reviewed `name` and `page`; refused with a re-review flash when the app declares something else by now; event `app.feature_declared`). Feature entries sit under
their own "Features from apps" heading, and a name equal to a built-in menu label is refused.
### Accepting in the terminal
Open the palette and choose "Menu entries to review" (site admins who are people only). It lists the
absorbed apps whose declaration changed; `j`/`k` move, `a` accepts the selected row. The accept posts the
name and page the screen showed, so one that changed since is refused ("review it again"), as on the page.
@@ -24,6 +24,7 @@
import { appsRuntime } from "../apps/runtime.ts";
import { getAppById, getAppBySlug, listApps, type AppRecord } from "../core/apps.ts";
import {
  absorb,
  keepDeclaration,
  featureSettings,
  getAbsorbed,
  listAbsorbed,
@@ -46,7 +47,9 @@
export type FeatureError =
  /** The app is not absorbed: its settings are not the forge's to change. */
  | "not_absorbed"
  /** A value that does not fit its declaration; `message` names it. */
  | "invalid_setting";
  | "invalid_setting"
  /** What the admin reviewed is not what the app declares now: review again. */
  | "declaration_changed";
export interface SettingView {
  readonly key: string;
@@ -69,6 +72,8 @@
export interface FeatureView {
  readonly name: string;
  readonly summary: string | null;
  readonly page: string;
  /** The name and page the app declares now, when they differ from the absorbed ones: waits for an admin. */
  readonly pending: { readonly name: string; readonly page: string } | null;
  readonly absorbed: boolean;
  readonly absorbedBy: string | null;
  readonly absorbedAt: string | null;
@@ -121,9 +126,13 @@
function viewOf(record: AppRecord, repo: Repo, app: App, spec: FeatureSpec | und
  return {
    slug: record.slug,
    repo: `${repo.ownerName}/${repo.name}`,
    name: spec?.name ?? record.slug,
    name: absorbed?.name ?? spec?.name ?? record.slug,
    summary: spec?.summary ?? null,
    page: spec?.page ?? "/",
    page: absorbed?.page ?? spec?.page ?? "/",
    pending:
      absorbed !== undefined && spec !== undefined && (spec.name !== absorbed.name || spec.page !== absorbed.page)
        ? { name: spec.name, page: spec.page }
        : null,
    absorbed: absorbed !== undefined,
    absorbedBy: absorbed?.absorbedBy ?? null,
    absorbedAt: absorbed?.absorbedAt ?? null,
@@ -227,6 +236,38 @@
export async function absorbApp(app: App, actor: User | undefined, slug: string)
  return ok(viewOf(found.record, found.repo, app, declared.value, null));
}
/**
 * Accept the name and page the admin reviewed as the menu's. Refused with
 * `declaration_changed` when the app declares something else by now, so an
 * admin never accepts values they did not see. An admin's act, and an event.
 */
export async function acceptDeclaration(
  app: App,
  actor: User | undefined,
  slug: string,
  reviewed: { readonly name: string; readonly page: string },
): Promise<Result<FeatureView, FeatureError>> {
  const found = readable(app, actor, slug);
  if (found === undefined) return err("not_found");
  if (!siteAdmin(actor)) return err("forbidden");
  const before = getAbsorbed(app.db, found.record.id);
  if (before === undefined) return err("not_absorbed");
  const declared = await declaredFeature(app, found.repo);
  if (!declared.ok || declared.value === undefined) return err("not_a_feature");
  const { name, page } = declared.value;
  if (name !== reviewed.name || page !== reviewed.page) return err("declaration_changed");
  if (name !== before.name || page !== before.page) {
    keepDeclaration(app.db, found.record.id, name, page);
    app.bus.append({
      kind: "app.feature_declared",
      repoId: found.repo.id,
      actorId: actor.id,
      payload: { slug, name, page, was: { name: before.name, page: before.page } },
    });
  }
  return ok(viewOf(found.record, found.repo, app, declared.value, null));
}
/** Put an absorbed app back as an ordinary app. Its settings are kept for the next absorb. */
export async function unabsorbApp(app: App, actor: User | undefined, slug: string): Promise<Result<FeatureView, FeatureError>> {
  const found = readable(app, actor, slug);
@@ -28,6 +28,21 @@
export type SettingType = "bool" | "int" | "string" | "choice" | "days" | "list"
export const SETTING_TYPES: readonly SettingType[] = ["bool", "int", "string", "choice", "days", "list"];
/** The labels the forge's own menus use: a feature may not borrow one. */
const BUILT_IN_MENU_LABELS = [
  "your profile", "repositories", "apps", "notes", "talk", "explore", "packs", "displays", "map", "features",
  "new app", "new repository", "new issue", "new organization", "migrate", "settings", "access tokens", "ssh keys",
  "origins", "boards", "crew", "system memory", "help", "sign out", "log out", "sign in", "admin", "administration",
  "theme", "create", "new forge", "create new", "appearance and help", "features from apps", "keyboard shortcuts",
];
const menuForm = (s: string): string => s.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
/** True when `name` reads as one of the forge's own menu labels. */
export function isBuiltInMenuLabel(name: string): boolean {
  return BUILT_IN_MENU_LABELS.includes(menuForm(name));
}
/** The days a `days` setting can name, in the order they are kept and shown. */
export const DAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] as const;
@@ -79,6 +94,7 @@
export function parseFeature(forgeJson: Raw): Result<FeatureSpec | undefined, st
  const name = block["name"];
  if (typeof name !== "string" || name.trim() === "" || name.length > NAME_MAX)
    return bad(`name is text of 1 to ${NAME_MAX} characters`);
  if (isBuiltInMenuLabel(name)) return bad("name is already a label in the forge's own menu");
  const summary = block["summary"];
  if (summary !== undefined && (typeof summary !== "string" || summary.length > SUMMARY_MAX))
    return bad(`summary is text of at most ${SUMMARY_MAX} characters`);
@@ -8,13 +8,12 @@
import type { Database } from "bun:sqlite";
import { featureEnv, parseFeature } from "./feature.ts";
import { featureSettings, getAbsorbed, refreshAbsorbed } from "../core/features.ts";
import { featureSettings, getAbsorbed } from "../core/features.ts";
export function featureVarsAt(
  db: Database,
  appId: string,
  forgeJson: string | undefined,
      
        sentinelcrew
        6d ago
        
      
      Dead parameter. Remove _o and the production option at the call sites.
    
  o: { production?: boolean } = {},
): Record<string, string> {
  if (forgeJson === undefined || getAbsorbed(db, appId) === undefined) return {};
  let parsed: unknown;
@@ -26,9 +25,8 @@
export function featureVarsAt(
  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
  const spec = parseFeature(parsed as Record<string, unknown>);
  if (!spec.ok || spec.value === undefined) return {};
  // The menu names it as the code production runs names it; a preview's
  // forge.json is a pull's, and does not speak for the forge's menu.
  if (o.production === true) refreshAbsorbed(db, appId, spec.value.name, spec.value.page);
  // The menu keeps the name and page the admin saw at absorb; a changed
  // declaration waits for an admin to accept it (`acceptDeclaration`).
  return featureEnv(spec.value, featureSettings(db, appId));
}
@@ -1695,7 +1695,7 @@
export class AppsRuntime {
    } catch {
      forgeJson = undefined;
    }
    return featureVarsAt(this.app.db, appId, forgeJson, { production: env === "production" });
    return featureVarsAt(this.app.db, appId, forgeJson);
  }
  /**
@@ -36,8 +36,8 @@
export function absorb(db: Database, appId: string, by: string, name: string, pa
  );
}
/** The declaration's name and page as last read, for the nav. */
export function refreshAbsorbed(db: Database, appId: string, name: string, page: string): void {
/** Keep this name and page for the nav: an admin's act (accepting a changed declaration), never a deploy's. */
export function keepDeclaration(db: Database, appId: string, name: string, page: string): void {
  db.query("UPDATE app_feature SET name = ?2, page = ?3 WHERE app_id = ?1").run(appId, name, page);
}
@@ -64,6 +64,10 @@
export function eventVerb(event: ForgeEvent): string {
    const name = payload["name"];
    return `absorbed ${typeof name === "string" ? name : "the app"} as a forge feature`;
  }
  if (kind === "app.feature_declared") {
    const name = payload["name"];
    return `accepted the feature's declared name ${typeof name === "string" ? name : "and page"}`;
  }
  if (kind === "app.unabsorbed") return "put the app back as an ordinary app";
  if (kind === "app.feature_settings") {
    const keys = payload["keys"];
@@ -25,12 +25,13 @@
import type { Router } from "../router.ts";
const WORDS: Record<Exclude<FeatureError, "not_found" | "forbidden" | "invalid_setting">, string> = {
  not_a_feature: "The app's forge.json declares no feature, or declares it wrongly.",
  not_absorbed: "The app is not absorbed.",
  declaration_changed: "The app declares something else than was reviewed.",
};
function refused(error: FeatureError, message?: string): Response {
  if (error === "not_found" || error === "forbidden") return respondAccess(error, 403);
  if (error === "invalid_setting") return json({ error, message: message ?? "A setting does not fit." }, 422);
  return json({ error, message: WORDS[error] }, error === "not_absorbed" ? 409 : 422);
  return json({ error, message: WORDS[error] }, error === "not_absorbed" || error === "declaration_changed" ? 409 : 422);
}
export function featureRoutes(router: Router<Handler>): void {
@@ -31,7 +31,7 @@
import {
  signInAct,
} from "../web/pages/accounts.ts";
import { confirmsList, confirmYes } from "../web/pages/confirms.ts";
import { featurePage, featureSave, featuresPage, featureSwitch } from "../web/pages/features.ts";
import { featureAccept, featurePage, featureSave, featuresPage, featureSwitch } from "../web/pages/features.ts";
import { passkeyAdd, passkeyDelete, passkeyOptions, passkeysPage } from "../web/pages/passkeys.ts";
import { secretDelete, secretSet, secretsPage } from "../web/pages/secrets.ts";
import {
@@ -187,6 +187,7 @@
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
  router.add("POST", "/settings/features/:slug", featureSave);
  router.add("POST", "/settings/features/:slug/absorb", featureSwitch(true));
  router.add("POST", "/settings/features/:slug/unabsorb", featureSwitch(false));
  router.add("POST", "/settings/features/:slug/accept", featureAccept);
  router.add("POST", "/settings/flags", flagsSet);
  router.add("GET", "/settings/usage", (ctx) => usagePage(ctx, knownPatterns));
  router.add("GET", "/settings/spend", spendPage);
@@ -25,6 +25,7 @@
import { entry as displays } from "./displays.ts";
import { entry as domains } from "./domains.ts";
import { entry as edgeOnly } from "./edgeonly.ts";
import { entry as traffic } from "./trafficview.ts";
import { entry as featureReview } from "./features.ts";
import { entry as feed } from "./feed.ts";
import { entry as forgeView } from "./forgeview.ts";
import { entry as front } from "./front.ts";
@@ -111,6 +112,7 @@
export const ENTRIES: readonly PaletteEntry[] = [
  connections,
  domains,
  feed,
  featureReview,
  front,
  owner,
  forges,
@@ -0,0 +1,82 @@
/**
 * Absorbed apps whose declared menu entry changed, in the terminal: the rows
 * Settings › Features marks "declaration changed: review". `a` accepts the
 * selected row's declaration through `acceptDeclaration`, the page's own
 * action, posting what the screen showed, so a declaration that moved since is
 * refused. Offered to a site admin who is a person, as the page is.
 */
import { acceptDeclaration, listFeatures, type FeatureView } from "../../actions/features.ts";
import type { Ctx, Screen } from "../app/app.ts";
import { binding } from "../app/keys.ts";
import { style } from "../term/style.ts";
import { truncate } from "../term/width.ts";
import type { Session } from "../session.ts";
import { fill, len, split } from "../ui/layout.ts";
import { emptyState } from "../ui/widgets.ts";
import { ListState, drawList, type ListRow } from "./common.ts";
import type { PaletteEntry } from "./entries.ts";
export interface FeaturesScreen extends Screen {
  /** The read or accept in flight, for whoever must wait on it. */
  busy(): Promise<void>;
}
const mayReview = (f: Session): boolean => f.user !== undefined && f.user.isAdmin && f.user.kind !== "agent";
export function featuresScreen(f: Session, ctx: Ctx): FeaturesScreen {
  const state = new ListState();
  let rows: FeatureView[] = [];
  let work: Promise<void> = Promise.resolve();
  const reload = (): Promise<void> =>
    listFeatures(f.app, f.user).then((r) => {
      rows = r.ok ? r.value.filter((v) => v.pending !== null) : [];
      state.clamp(rows.length);
      ctx.invalidate();
    });
  work = reload();
  return {
    title: "Menu entries to review",
    keys: [binding(["j", "k"], "move cursor"), binding(["a"], "accept")],
    render(area, s) {
      const c = ctx.theme.c;
      const [head, body] = split(area, "v", [len(1), fill(1)]);
      if (rows.length === 0) {
        emptyState(s, body!, c, { title: "No absorbed app has a declaration to review." });
        return;
      }
      const line = mayReview(f) ? "a accepts the app's declaration as the menu entry" : "only a site admin accepts";
      s.text(head!.x, head!.y, truncate(line, head!.w), style(c.mutedFg, c.bg), head!.x + head!.w);
      const list: ListRow[] = rows.map((r) => ({
        title: `${r.name} (${r.page})`,
        secondary: `${r.repo} declares ${r.pending!.name} (${r.pending!.page})`,
        meta: "",
      }));
      drawList(s, body!, c, state, list);
    },
    key(e) {
      if (state.key(e, rows.length)) return true;
      if (e.ctrl || e.alt || e.key !== "a") return false;
      const row = rows[state.index];
      if (row === undefined || row.pending === null || !mayReview(f)) return false;
      work = acceptDeclaration(f.app, f.user, row.slug, row.pending).then(async (done) => {
        if (done.ok) ctx.toast(`${row.pending!.name} is now the menu's entry`, "success");
        else if (done.error === "declaration_changed") ctx.toast("the app declared something else; review it again", "danger");
        else ctx.toast("that could not be accepted", "danger");
        await reload();
      });
      return true;
    },
    busy: () => work,
  };
}
/** The pending declarations: a site admin's, as the settings page is. */
export const entry: PaletteEntry = {
  id: "feature-review",
  title: "Menu entries to review",
  hint: "absorbed apps whose declared name or page changed: accept them",
  offered: mayReview,
  run: (session, ctx) => ctx.push(featuresScreen(session, ctx)),
};
@@ -271,7 +271,7 @@
function newMenu(ctx: Ctx): Html {
 */
function featureItems(ctx: Ctx, user: User): MenuItem[] {
  const runtime = appsRuntime(ctx.app);
  return absorbedForNav(ctx.app, user).map((f) => {
  const entries = absorbedForNav(ctx.app, user).map((f) => {
    // Without a runtime there is no host to open: the app's own page instead.
    const href =
      runtime === undefined
@@ -279,6 +279,10 @@
function featureItems(ctx: Ctx, user: User): MenuItem[] {
        : `/apps/open?host=${encodeURIComponent(new URL(runtime.urlFor(f.record, "production")).host)}&to=${encodeURIComponent(f.page)}`;
    return { label: f.name, href, icon: "rocket" as const };
  });
  // Under a heading of their own, so an app's chosen name cannot pass for a forge item.
  return entries.length === 0
    ? []
    : [{ separator: true, label: "" }, { label: "Features from apps", heading: true }, ...entries];
}
function userMenu(
@@ -8,6 +8,7 @@
import {
  absorbApp,
  acceptDeclaration,
  changeFeatureSettings,
  getFeature,
  listFeatures,
@@ -47,13 +48,21 @@
function featureRow(f: FeatureView) {
  return row({
    lead: icon("rocket"),
    title: html`${f.name} <span class="muted small mono">${f.repo}</span>
      ${f.absorbed ? badge("absorbed", { tone: "success" }) : null}`,
    meta: f.problem !== null
      ${f.absorbed ? badge("absorbed", { tone: "success" }) : null}
      ${f.pending !== null ? badge("declaration changed: review", { tone: "attn" }) : null}`,
    meta: f.pending !== null
      ? html`Menu: <strong>${f.name}</strong> at <span class="mono">${f.page}</span> → app: <strong>${f.pending.name}</strong> at
          <span class="mono">${f.pending.page}</span>`
      : f.problem !== null
      ? html`<span class="danger">${f.problem}</span>`
      : html`${f.summary ?? ""}${when(f.summary !== null, () => html`<br />`)}${f.settings.length} setting${f.settings.length === 1 ? "" : "s"}${f.absorbed
          ? html` · absorbed by ${f.absorbedBy ?? "someone"}`
          : html` · not absorbed: the app runs as an ordinary app`}`,
    trail: html`<form class="row-fields" method="post" action="${base}/${f.absorbed ? "unabsorb" : "absorb"}">
    trail: html`${when(f.pending !== null, () => html`<form class="row-fields" method="post" action="${base}/accept">
        <input type="hidden" name="name" value="${f.pending?.name ?? ""}" />
        <input type="hidden" name="page" value="${f.pending?.page ?? ""}" />
        ${btn("Accept", { size: "sm", label: `Accept ${f.pending?.name ?? ""} as ${f.name}'s menu entry` })}
      </form>`)}<form class="row-fields" method="post" action="${base}/${f.absorbed ? "unabsorb" : "absorb"}">
      ${when(f.absorbed, () => btn("Settings", { size: "sm", href: base }))}
      ${btn(f.absorbed ? "Un-absorb" : "Absorb", {
        size: "sm",
@@ -235,3 +244,27 @@
export function featureSwitch(absorbing: boolean) {
    );
  };
}
// POST /settings/features/:slug/accept
export async function featureAccept(ctx: Ctx): Promise<Response> {
  const no = requireAdmin(ctx);
  if (no) return no;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const reviewed = { name: String(form.get("name") ?? ""), page: String(form.get("page") ?? "") };
  const done = await acceptDeclaration(ctx.app, ctx.auth.user, ctx.params["slug"] ?? "", reviewed);
  if (!done.ok && done.error === "not_found") return notFoundPage(ctx);
  return flashTo(
    ctx,
    "/settings/features",
    done.ok
      ? { message: `${done.value.name} is now the menu's entry for this app.` }
      : {
          tone: "danger",
          message:
            done.error === "declaration_changed"
              ? "The app declared something else since you looked. Review the new declaration and accept again."
              : "That app is not absorbed, or no longer declares a feature.",
        },
  );
}
@@ -1099,6 +1099,8 @@
export interface MenuItem {
  icon?: IconName;
  current?: boolean;
  separator?: boolean;
  /** A non-interactive group label. */
  heading?: boolean;
  /** Renders as a submit button inside its own POST form. */
  post?: string;
  /** Shown but not usable: the reason, in words, under the label. */
@@ -1139,6 +1141,7 @@
export function menu(o: {
        if (item instanceof Html) return item;
        const i = item;
        if (i.separator) return html`<hr class="menu-sep" />`;
        if (i.heading) return html`<span class="menu-title">${i.label}</span>`;
        if (i.disabled !== undefined) {
          return html`<span class="menu-item" aria-disabled="true" title="${i.disabled}"
            >${i.icon ? icon(i.icon) : null}<span class="grow"
@@ -175,14 +175,11 @@
describe("absorbing a running app", () => {
  }, 60_000);
  test("a preview's forge.json does not rename the forge's menu entry", () => {
    featureVarsAt(forge.app.db, record.id, forgeJson("Not Radar"), {
      production: false,
    });
    featureVarsAt(forge.app.db, record.id, forgeJson("Not Radar"));
    expect(getAbsorbed(forge.app.db, record.id)?.name).toBe("Radar");
    featureVarsAt(forge.app.db, record.id, forgeJson("Radar 2"));
    // A production push does not rename it either: an admin accepts.
    expect(getAbsorbed(forge.app.db, record.id)?.name).toBe("Radar");
    featureVarsAt(forge.app.db, record.id, forgeJson("Radar 2"), {
      production: true,
    });
    expect(getAbsorbed(forge.app.db, record.id)?.name).toBe("Radar 2");
  });
  test("un-absorbed, it restarts told nothing again", async () => {
@@ -15,7 +15,7 @@
import { join } from "node:path";
import { statements } from "./helpers/statements.ts";
import { expectWork } from "./helpers/work.ts";
import { createApp, type App } from "../src/app.ts";
import { absorbApp, absorbedForNav, declaredFeature, changeFeatureSettings, getFeature, unabsorbApp } from "../src/actions/features.ts";
import { absorbApp, acceptDeclaration, absorbedForNav, declaredFeature, changeFeatureSettings, getFeature, unabsorbApp } from "../src/actions/features.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { checkSetting, featureEnv, parseFeature, settingEnvName } from "../src/apps/feature.ts";
import { featureVarsAt } from "../src/apps/feature_env.ts";
@@ -266,6 +266,99 @@
describe("absorbing an app", () => {
    expect(strangers).not.toContain("Radar");
  });
  test("a production push that renames the feature leaves the menu unchanged until an admin accepts", async () => {
    const renamed = JSON.stringify({ app: { run: "x" }, feature: { ...FEATURE, name: "Radar Pro", page: "/pro" } });
    featureVarsAt(app.db, appId, renamed);
    expect(absorbedForNav(app, ada).map((f) => [f.name, f.page])).toEqual([["Radar", "/"]]);
    const c = await commitToBranch(app, cy, repo, { message: "rename", files: [{ path: "forge.json", content: renamed }] });
    if (!c.ok) throw new Error(JSON.stringify(c.error));
    const view = await getFeature(app, ada, "radar");
    expect(view.ok && view.value.pending).toEqual({ name: "Radar Pro", page: "/pro" });
    expect(view.ok && view.value.name).toBe("Radar");
    const list = await (await web(adaCookie, "/settings/features")).text();
    expect(list).toContain("declaration changed: review");
    // The owner is not a site admin; only an admin accepts.
    const refused = await acceptDeclaration(app, cy, "radar", { name: "Radar Pro", page: "/pro" });
    expect(!refused.ok && refused.error).toBe("forbidden");
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
    expect((await web(adaCookie, "/settings/features/radar/accept", new URLSearchParams({ name: "Radar Pro", page: "/pro" }))).status).toBe(303);
    expect(absorbedForNav(app, ada).map((f) => [f.name, f.page])).toEqual([["Radar Pro", "/pro"]]);
    expect(listEvents(app.db, { repoId: repo.id }).filter((e) => e.kind === "app.feature_declared")).toHaveLength(1);
    // Back to the original, accepted the same way.
    await commitToBranch(app, cy, repo, { message: "back", files: [{ path: "forge.json", content: FORGE_JSON }] });
    await acceptDeclaration(app, ada, "radar", { name: "Radar", page: "/" });
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
  });
  test("accepting what the admin reviewed is refused when production declared something else since", async () => {
    const declare = (name: string) =>
      commitToBranch(app, cy, repo, { message: name, files: [{ path: "forge.json", content: JSON.stringify({ app: { run: "x" }, feature: { ...FEATURE, name } }) }] });
    await declare("Reviewed");
    await declare("Sneaky");
    const stale = await acceptDeclaration(app, ada, "radar", { name: "Reviewed", page: FEATURE.page });
    expect(!stale.ok && stale.error).toBe("declaration_changed");
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
    const res = await web(adaCookie, "/settings/features/radar/accept", new URLSearchParams({ name: "Reviewed", page: FEATURE.page }));
    expect(res.status).toBe(303);
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
    const fresh = await acceptDeclaration(app, ada, "radar", { name: "Sneaky", page: FEATURE.page });
    expect(fresh.ok).toBe(true);
    await commitToBranch(app, cy, repo, { message: "back", files: [{ path: "forge.json", content: FORGE_JSON }] });
    await acceptDeclaration(app, ada, "radar", { name: "Radar", page: "/" });
  });
  test("the terminal accepts under the page's rules: admin only, and what the screen showed", async () => {
    const { featuresScreen, entry } = await import("../src/tui/screens/features.ts");
    const { Screen: Surface } = await import("../src/tui/term/screen.ts");
    const { theme } = await import("../src/tui/ui/theme.ts");
    const declare = (name: string) =>
      commitToBranch(app, cy, repo, { message: name, files: [{ path: "forge.json", content: JSON.stringify({ app: { run: "x" }, feature: { ...FEATURE, name } }) }] });
    await declare("Radar TUI");
    const toasts: string[] = [];
    const ctx = { theme: theme("dark"), invalidate() {}, push() {}, pop() {}, copy() {}, toast: (m: string) => toasts.push(m) } as never;
    const open = async (user: typeof ada | typeof cy) => {
      const screen = featuresScreen({ app, db: app.db, user } as never, ctx);
      await screen.busy();
      return screen;
    };
    expect(entry.offered({ app, db: app.db, user: cy } as never)).toBe(false);
    expect(entry.offered({ app, db: app.db, user: ada } as never)).toBe(true);
    const shown = new Surface(110, 20);
    (await open(ada)).render({ x: 0, y: 0, w: 110, h: 20 }, shown);
    expect(shown.toText()).toContain("Radar TUI");
    const denied = await open(cy);
    expect(denied.key!({ key: "a" } as never)).toBe(false);
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
    const screen = await open(ada);
    // The app declares something else after the screen was read.
    await declare("Radar Later");
    expect(screen.key!({ key: "a" } as never)).toBe(true);
    await screen.busy();
    expect(toasts.at(-1)).toContain("review it again");
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar");
    const again = await open(ada);
    expect(again.key!({ key: "a" } as never)).toBe(true);
    await again.busy();
    expect(absorbedForNav(app, ada)[0]!.name).toBe("Radar Later");
    await commitToBranch(app, cy, repo, { message: "back", files: [{ path: "forge.json", content: FORGE_JSON }] });
    await acceptDeclaration(app, ada, "radar", { name: "Radar", page: "/" });
  });
  test("every label in the forge's own menus is one a feature may not take", async () => {
    const { readFileSync } = await import("node:fs");
    const src = readFileSync(new URL("../src/web/layout.ts", import.meta.url), "utf8");
    const labels = [...src.matchAll(/\blabel: "([^"]+)"/g)].map((m) => m[1]!);
    expect(labels.length).toBeGreaterThan(15);
    for (const l of labels) expect({ l, refused: !parseFeature({ feature: { name: l } }).ok }).toEqual({ l, refused: true });
  });
  test("the menu groups feature entries under their own heading, and a built-in label is refused", async () => {
    const home = await (await web(adaCookie, "/settings")).text();
    expect(home).toMatch(/menu-title">Features from apps<\/span>[\s\S]*Radar/);
    for (const name of ["Sign out", "admin", "  SIGN-OUT ", "Ｓettings"]) expect(parseFeature({ feature: { name } }).ok).toBe(false);
    expect(parseFeature({ feature: { name: "Settings" } }).ok).toBe(false);
  });
  test("a value that does not fit changes nothing, and names the setting", async () => {
    const res = await api("PATCH", adaToken, "/radar/settings", { settings: { runDays: ["mon"], runHourUtc: 30 } });
    expect(res.status).toBe(422);
@@ -139,6 +139,7 @@
test("a site-admin person is offered the whole roster", () => {
    ["origins", "Connected origins", "the hosts your mirrors come from"],
    ["domains", "Failure domains", "failure domains and their last drill"],
    ["feed", "Feed", "what happened, ranked; r replies on a post about an issue or pull, l likes"],
    ["feature-review", "Menu entries to review", "absorbed apps whose declared name or page changed: accept them"],
    ["front", "Front page", "the apps a first visitor sees, ranked; an admin pins or hides"],
    ["owner", "Owner's needs", "what needs the owner, snapshots, failure domains"],
    ["forges", "Forges you sent", "each forge sent, claimed or not, and its apps"],
		@@ -83,3 +83,17 @@ Absorb was built by Ben (benjivers). The review of #9441 found:
83	83	- Speed: the Features list reads git for every app on every request (#9543).
84	84
85	85	This section is ready for the owner to share with Ben.
	86
	87	## The menu entry is the admin's, not the deploy's
	88
	89	The name and page in the menu are the ones the admin saw when absorbing. If the production
	90	`forge.json` later declares others, the menu keeps serving the absorbed ones and Settings ›
	91	Features shows "declaration changed: review" with the new values; an admin accepts them
	92	(`POST /settings/features/:slug/accept` with the reviewed `name` and `page`; refused with a re-review flash when the app declares something else by now; event `app.feature_declared`). Feature entries sit under
	93	their own "Features from apps" heading, and a name equal to a built-in menu label is refused.
	94
	95	### Accepting in the terminal
	96
	97	Open the palette and choose "Menu entries to review" (site admins who are people only). It lists the
	98	absorbed apps whose declaration changed; `j`/`k` move, `a` accepts the selected row. The accept posts the
	99	name and page the screen showed, so one that changed since is refused ("review it again"), as on the page.
		@@ -24,6 +24,7 @@ import { appsRuntime } from "../apps/runtime.ts";
24	24	import { getAppById, getAppBySlug, listApps, type AppRecord } from "../core/apps.ts";
25	25	import {
26	26	absorb,
	27	keepDeclaration,
27	28	featureSettings,
28	29	getAbsorbed,
29	30	listAbsorbed,
		@@ -46,7 +47,9 @@ export type FeatureError =
46	47	/** The app is not absorbed: its settings are not the forge's to change. */
47	48	\| "not_absorbed"
48	49	/** A value that does not fit its declaration; `message` names it. */
49		\| "invalid_setting";
	50	\| "invalid_setting"
	51	/** What the admin reviewed is not what the app declares now: review again. */
	52	\| "declaration_changed";
50	53
51	54	export interface SettingView {
52	55	readonly key: string;
		@@ -69,6 +72,8 @@ export interface FeatureView {
69	72	readonly name: string;
70	73	readonly summary: string \| null;
71	74	readonly page: string;
	75	/** The name and page the app declares now, when they differ from the absorbed ones: waits for an admin. */
	76	readonly pending: { readonly name: string; readonly page: string } \| null;
72	77	readonly absorbed: boolean;
73	78	readonly absorbedBy: string \| null;
74	79	readonly absorbedAt: string \| null;
		@@ -121,9 +126,13 @@ function viewOf(record: AppRecord, repo: Repo, app: App, spec: FeatureSpec \| und
121	126	return {
122	127	slug: record.slug,
123	128	repo: `${repo.ownerName}/${repo.name}`,
124		name: spec?.name ?? record.slug,
	129	name: absorbed?.name ?? spec?.name ?? record.slug,
125	130	summary: spec?.summary ?? null,
126		page: spec?.page ?? "/",
	131	page: absorbed?.page ?? spec?.page ?? "/",
	132	pending:
	133	absorbed !== undefined && spec !== undefined && (spec.name !== absorbed.name \|\| spec.page !== absorbed.page)
	134	? { name: spec.name, page: spec.page }
	135	: null,
127	136	absorbed: absorbed !== undefined,
128	137	absorbedBy: absorbed?.absorbedBy ?? null,
129	138	absorbedAt: absorbed?.absorbedAt ?? null,
		@@ -227,6 +236,38 @@ export async function absorbApp(app: App, actor: User \| undefined, slug: string)
227	236	return ok(viewOf(found.record, found.repo, app, declared.value, null));
228	237	}
229	238
	239	/**
	240	* Accept the name and page the admin reviewed as the menu's. Refused with
	241	* `declaration_changed` when the app declares something else by now, so an
	242	* admin never accepts values they did not see. An admin's act, and an event.
	243	*/
	244	export async function acceptDeclaration(
	245	app: App,
	246	actor: User \| undefined,
	247	slug: string,
	248	reviewed: { readonly name: string; readonly page: string },
	249	): Promise<Result<FeatureView, FeatureError>> {
	250	const found = readable(app, actor, slug);
	251	if (found === undefined) return err("not_found");
	252	if (!siteAdmin(actor)) return err("forbidden");
	253	const before = getAbsorbed(app.db, found.record.id);
	254	if (before === undefined) return err("not_absorbed");
	255	const declared = await declaredFeature(app, found.repo);
	256	if (!declared.ok \|\| declared.value === undefined) return err("not_a_feature");
	257	const { name, page } = declared.value;
	258	if (name !== reviewed.name \|\| page !== reviewed.page) return err("declaration_changed");
	259	if (name !== before.name \|\| page !== before.page) {
	260	keepDeclaration(app.db, found.record.id, name, page);
	261	app.bus.append({
	262	kind: "app.feature_declared",
	263	repoId: found.repo.id,
	264	actorId: actor.id,
	265	payload: { slug, name, page, was: { name: before.name, page: before.page } },
	266	});
	267	}
	268	return ok(viewOf(found.record, found.repo, app, declared.value, null));
	269	}
	270
230	271	/** Put an absorbed app back as an ordinary app. Its settings are kept for the next absorb. */
231	272	export async function unabsorbApp(app: App, actor: User \| undefined, slug: string): Promise<Result<FeatureView, FeatureError>> {
232	273	const found = readable(app, actor, slug);
		@@ -28,6 +28,21 @@ export type SettingType = "bool" \| "int" \| "string" \| "choice" \| "days" \| "list"
28	28
29	29	export const SETTING_TYPES: readonly SettingType[] = ["bool", "int", "string", "choice", "days", "list"];
30	30
	31	/** The labels the forge's own menus use: a feature may not borrow one. */
	32	const BUILT_IN_MENU_LABELS = [
	33	"your profile", "repositories", "apps", "notes", "talk", "explore", "packs", "displays", "map", "features",
	34	"new app", "new repository", "new issue", "new organization", "migrate", "settings", "access tokens", "ssh keys",
	35	"origins", "boards", "crew", "system memory", "help", "sign out", "log out", "sign in", "admin", "administration",
	36	"theme", "create", "new forge", "create new", "appearance and help", "features from apps", "keyboard shortcuts",
	37	];
	38
	39	const menuForm = (s: string): string => s.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
	40
	41	/** True when `name` reads as one of the forge's own menu labels. */
	42	export function isBuiltInMenuLabel(name: string): boolean {
	43	return BUILT_IN_MENU_LABELS.includes(menuForm(name));
	44	}
	45
31	46	/** The days a `days` setting can name, in the order they are kept and shown. */
32	47	export const DAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] as const;
33	48
		@@ -79,6 +94,7 @@ export function parseFeature(forgeJson: Raw): Result<FeatureSpec \| undefined, st
79	94	const name = block["name"];
80	95	if (typeof name !== "string" \|\| name.trim() === "" \|\| name.length > NAME_MAX)
81	96	return bad(`name is text of 1 to ${NAME_MAX} characters`);
	97	if (isBuiltInMenuLabel(name)) return bad("name is already a label in the forge's own menu");
82	98	const summary = block["summary"];
83	99	if (summary !== undefined && (typeof summary !== "string" \|\| summary.length > SUMMARY_MAX))
84	100	return bad(`summary is text of at most ${SUMMARY_MAX} characters`);
		@@ -8,13 +8,12 @@
8	8
9	9	import type { Database } from "bun:sqlite";
10	10	import { featureEnv, parseFeature } from "./feature.ts";
11		import { featureSettings, getAbsorbed, refreshAbsorbed } from "../core/features.ts";
	11	import { featureSettings, getAbsorbed } from "../core/features.ts";
12	12
13	13	export function featureVarsAt(
14	14	db: Database,
15	15	appId: string,
16	16	forgeJson: string \| undefined,
		sentinelcrew 6d ago Dead parameter. Remove `_o` and the `production` option at the call sites.
17		o: { production?: boolean } = {},
18	17	): Record<string, string> {
19	18	if (forgeJson === undefined \|\| getAbsorbed(db, appId) === undefined) return {};
20	19	let parsed: unknown;
		@@ -26,9 +25,8 @@ export function featureVarsAt(
26	25	if (typeof parsed !== "object" \|\| parsed === null \|\| Array.isArray(parsed)) return {};
27	26	const spec = parseFeature(parsed as Record<string, unknown>);
28	27	if (!spec.ok \|\| spec.value === undefined) return {};
29		// The menu names it as the code production runs names it; a preview's
30		// forge.json is a pull's, and does not speak for the forge's menu.
31		if (o.production === true) refreshAbsorbed(db, appId, spec.value.name, spec.value.page);
	28	// The menu keeps the name and page the admin saw at absorb; a changed
	29	// declaration waits for an admin to accept it (`acceptDeclaration`).
32	30	return featureEnv(spec.value, featureSettings(db, appId));
33	31	}
34	32
		@@ -1695,7 +1695,7 @@ export class AppsRuntime {
1695	1695	} catch {
1696	1696	forgeJson = undefined;
1697	1697	}
1698		return featureVarsAt(this.app.db, appId, forgeJson, { production: env === "production" });
	1698	return featureVarsAt(this.app.db, appId, forgeJson);
1699	1699	}
1700	1700
1701	1701	/**
		@@ -36,8 +36,8 @@ export function absorb(db: Database, appId: string, by: string, name: string, pa
36	36	);
37	37	}
38	38
39		/** The declaration's name and page as last read, for the nav. */
40		export function refreshAbsorbed(db: Database, appId: string, name: string, page: string): void {
	39	/** Keep this name and page for the nav: an admin's act (accepting a changed declaration), never a deploy's. */
	40	export function keepDeclaration(db: Database, appId: string, name: string, page: string): void {
41	41	db.query("UPDATE app_feature SET name = ?2, page = ?3 WHERE app_id = ?1").run(appId, name, page);
42	42	}
43	43
		@@ -64,6 +64,10 @@ export function eventVerb(event: ForgeEvent): string {
64	64	const name = payload["name"];
65	65	return `absorbed ${typeof name === "string" ? name : "the app"} as a forge feature`;
66	66	}
	67	if (kind === "app.feature_declared") {
	68	const name = payload["name"];
	69	return `accepted the feature's declared name ${typeof name === "string" ? name : "and page"}`;
	70	}
67	71	if (kind === "app.unabsorbed") return "put the app back as an ordinary app";
68	72	if (kind === "app.feature_settings") {
69	73	const keys = payload["keys"];
		@@ -25,12 +25,13 @@ import type { Router } from "../router.ts";
25	25	const WORDS: Record<Exclude<FeatureError, "not_found" \| "forbidden" \| "invalid_setting">, string> = {
26	26	not_a_feature: "The app's forge.json declares no feature, or declares it wrongly.",
27	27	not_absorbed: "The app is not absorbed.",
	28	declaration_changed: "The app declares something else than was reviewed.",
28	29	};
29	30
30	31	function refused(error: FeatureError, message?: string): Response {
31	32	if (error === "not_found" \|\| error === "forbidden") return respondAccess(error, 403);
32	33	if (error === "invalid_setting") return json({ error, message: message ?? "A setting does not fit." }, 422);
33		return json({ error, message: WORDS[error] }, error === "not_absorbed" ? 409 : 422);
	34	return json({ error, message: WORDS[error] }, error === "not_absorbed" \|\| error === "declaration_changed" ? 409 : 422);
34	35	}
35	36
36	37	export function featureRoutes(router: Router<Handler>): void {
		@@ -31,7 +31,7 @@ import {
31	31	signInAct,
32	32	} from "../web/pages/accounts.ts";
33	33	import { confirmsList, confirmYes } from "../web/pages/confirms.ts";
34		import { featurePage, featureSave, featuresPage, featureSwitch } from "../web/pages/features.ts";
	34	import { featureAccept, featurePage, featureSave, featuresPage, featureSwitch } from "../web/pages/features.ts";
35	35	import { passkeyAdd, passkeyDelete, passkeyOptions, passkeysPage } from "../web/pages/passkeys.ts";
36	36	import { secretDelete, secretSet, secretsPage } from "../web/pages/secrets.ts";
37	37	import {
		@@ -187,6 +187,7 @@ export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
187	187	router.add("POST", "/settings/features/:slug", featureSave);
188	188	router.add("POST", "/settings/features/:slug/absorb", featureSwitch(true));
189	189	router.add("POST", "/settings/features/:slug/unabsorb", featureSwitch(false));
	190	router.add("POST", "/settings/features/:slug/accept", featureAccept);
190	191	router.add("POST", "/settings/flags", flagsSet);
191	192	router.add("GET", "/settings/usage", (ctx) => usagePage(ctx, knownPatterns));
192	193	router.add("GET", "/settings/spend", spendPage);
		@@ -25,6 +25,7 @@ import { entry as displays } from "./displays.ts";
25	25	import { entry as domains } from "./domains.ts";
26	26	import { entry as edgeOnly } from "./edgeonly.ts";
27	27	import { entry as traffic } from "./trafficview.ts";
	28	import { entry as featureReview } from "./features.ts";
28	29	import { entry as feed } from "./feed.ts";
29	30	import { entry as forgeView } from "./forgeview.ts";
30	31	import { entry as front } from "./front.ts";
		@@ -111,6 +112,7 @@ export const ENTRIES: readonly PaletteEntry[] = [
111	112	connections,
112	113	domains,
113	114	feed,
	115	featureReview,
114	116	front,
115	117	owner,
116	118	forges,