{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[00be3a29] invite system\n\nSide A — unified diff (full patch):\ndiff --git a/bb.edn b/bb.edn\nindex 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644\n--- a/bb.edn\n+++ b/bb.edn\n@@ -47,14 +47,16 @@\n \"RUST_LOG\" \"info\"})})))}\n \n test\n- {:doc \"Full test suite: integration + auth + grants\"\n+ {:doc \"Full test suite: integration + auth + grants + invites\"\n :requires ([test.integration :as integration]\n [test.auth :as auth]\n- [test.grants :as grants])\n+ [test.grants :as grants]\n+ [test.invites :as invites])\n :task (do\n (integration/integration)\n (auth/auth-test)\n- (grants/grants-test))}\n+ (grants/grants-test)\n+ (invites/invites-test))}\n \n perf\n {:doc \"Performance test: concurrent HTTP requests to detect blocking I/O\"\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -105,6 +105,23 @@ enum ScopedCmd {\n #[arg(long)]\n json: bool,\n },\n+\n+ /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.\n+ InviteLink {\n+ /// Comma-separated: view, post, vote, add_item, manage\n+ #[arg(long = \"caps\", value_delimiter = ',')]\n+ caps: Vec,\n+ #[arg(long, default_value_t = 1)]\n+ uses: usize,\n+ #[arg(long)]\n+ json: bool,\n+ },\n+\n+ /// List principals granted access in this room (requires View or Manage)\n+ Audit {\n+ #[arg(long)]\n+ json: bool,\n+ },\n }\n \n #[derive(Subcommand, Debug)]\n@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {\n .duration_since(std::time::UNIX_EPOCH)\n .unwrap_or_default()\n .as_millis() as i64;\n- if resp.total > resp.posts.len() {\n- let end = resp.offset + resp.posts.len();\n- eprintln!(\"# showing {}-{} of {} posts (--offset N --limit N to paginate)\", resp.offset, end.saturating_sub(1), resp.total);\n+ if resp.total > resp.items.len() {\n+ let end = resp.offset + resp.items.len();\n+ eprintln!(\n+ \"# showing {}-{} of {} rows (--offset N --limit N to paginate)\",\n+ resp.offset,\n+ end.saturating_sub(1),\n+ resp.total\n+ );\n }\n- for (i, post) in resp.posts.iter().enumerate() {\n- let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);\n- let body = &post.body.trim();\n- println!(\"\", post.index, timeago);\n- println!(\"{}\", body);\n- println!(\"\");\n- if i + 1 < resp.posts.len() {\n+ for (i, item) in resp.items.iter().enumerate() {\n+ match item {\n+ ThreadItem::Post {\n+ index,\n+ ts,\n+ body,\n+ ..\n+ } => {\n+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+ let body = body.trim();\n+ println!(\"\", index, timeago);\n+ println!(\"{}\", body);\n+ println!(\"\");\n+ }\n+ ThreadItem::System { ts, text } => {\n+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+ println!(\"{}\", timeago, text.trim());\n+ }\n+ }\n+ if i + 1 < resp.items.len() {\n println!();\n println!();\n }\n@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n }\n }\n },\n+ ScopedCmd::InviteLink { caps, uses, json } => {\n+ let caps: Vec = caps\n+ .into_iter()\n+ .flat_map(|s| {\n+ s.split(',')\n+ .map(|p| p.trim().to_lowercase())\n+ .filter(|p| !p.is_empty())\n+ .collect::>()\n+ })\n+ .collect();\n+ if caps.is_empty() {\n+ return Err(anyhow!(\"--caps is required (e.g. --caps view,post,vote)\"));\n+ }\n+ let bearer = effective_bearer().ok_or_else(|| {\n+ anyhow!(\n+ \"no bearer token: run `slugsocial identity start --rig --model ` \\\n+ then `slugsocial identity poll `, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+ )\n+ })?;\n+ let batch = send_rpc(\n+ &client,\n+ base,\n+ Some(&bearer),\n+ vec![RpcCommand::RoomMintInvite {\n+ room: room.to_string(),\n+ capabilities: caps,\n+ max_uses: uses,\n+ }],\n+ )\n+ .await?;\n+ match rpc_line_ok(&batch.results[0])? {\n+ RpcResult::RoomInviteMinted {\n+ invite_url,\n+ expires_at_ms,\n+ max_uses,\n+ } => {\n+ if json {\n+ println!(\n+ \"{}\",\n+ serde_json::to_string_pretty(&serde_json::json!({\n+ \"invite_url\": invite_url,\n+ \"expires_at_ms\": expires_at_ms,\n+ \"max_uses\": max_uses,\n+ }))?\n+ );\n+ } else {\n+ println!(\"{invite_url}\");\n+ println!(\"(Expires in 24 hours. Max uses: {max_uses})\");\n+ }\n+ }\n+ _ => return Err(anyhow!(\"unexpected RPC result\")),\n+ }\n+ }\n+ ScopedCmd::Audit { json } => {\n+ let bearer = effective_bearer().ok_or_else(|| {\n+ anyhow!(\n+ \"no bearer token: run `slugsocial identity start --rig --model ` \\\n+ then `slugsocial identity poll `, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+ )\n+ })?;\n+ let batch = send_rpc(\n+ &client,\n+ base,\n+ Some(&bearer),\n+ vec![RpcCommand::RoomAudit {\n+ room: room.to_string(),\n+ }],\n+ )\n+ .await?;\n+ match rpc_line_ok(&batch.results[0])? {\n+ RpcResult::RoomAudit(resp) => {\n+ if json {\n+ println!(\"{}\", serde_json::to_string_pretty(&resp)?);\n+ } else {\n+ println!(\"room {}\", resp.room);\n+ if resp.grants.is_empty() {\n+ println!(\"(no grants recorded)\");\n+ } else {\n+ let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);\n+ for g in &resp.grants {\n+ let caps = g.capabilities.join(\", \");\n+ println!(\"{: return Err(anyhow!(\"unexpected RPC result\")),\n+ }\n+ }\n ScopedCmd::Check { file, json } => {\n let mut text = String::new();\n match file {\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -12,12 +12,61 @@ use tokio::sync::RwLock;\n \n use crate::{\n api::helpers::{api_error, now_ms, sha256_hex},\n- events::{Event, TokenIssued, UserRegistered},\n+ events::{Event, GrantAdded, TokenIssued, UserRegistered},\n identity::{parse_agent, parse_username},\n html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n state::{AppState, PendingSession},\n };\n \n+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n+const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n+\n+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {\n+ let now = now_ms();\n+ let ga = {\n+ let mut invites = state.invites.write().await;\n+ let Some(inv) = invites.get_mut(invite_token) else {\n+ return Err(\"invite not found\".into());\n+ };\n+ if now > inv.expires_at_ms {\n+ invites.remove(invite_token);\n+ return Err(\"invite expired\".into());\n+ }\n+ if inv.current_uses >= inv.max_uses {\n+ return Err(\"invite exhausted\".into());\n+ }\n+ inv.current_uses += 1;\n+ Event::GrantAdded(GrantAdded {\n+ ts: now,\n+ room_id: inv.room_id.clone(),\n+ username: grantee_username.to_string(),\n+ capabilities: inv.capabilities.clone(),\n+ granted_by: inv.inviter.clone(),\n+ })\n+ };\n+\n+ match state.event_log.append(&ga).await {\n+ Ok(()) => {\n+ let mut reduced = state.reduced.write().await;\n+ reduced.apply_event(ga);\n+ let mut invites = state.invites.write().await;\n+ if let Some(inv) = invites.get(invite_token) {\n+ if inv.current_uses >= inv.max_uses {\n+ invites.remove(invite_token);\n+ }\n+ }\n+ Ok(())\n+ }\n+ Err(e) => {\n+ let mut invites = state.invites.write().await;\n+ if let Some(inv) = invites.get_mut(invite_token) {\n+ inv.current_uses = inv.current_uses.saturating_sub(1);\n+ }\n+ Err(format!(\"{e}\"))\n+ }\n+ }\n+}\n+\n fn pending_sessions(state: &AppState) -> Arc>> {\n state.pending_sessions.clone()\n }\n@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {\n pub session: String,\n }\n \n+pub async fn get_join_invite(Path(token): Path, State(state): State) -> impl IntoResponse {\n+ let token = token.trim().to_string();\n+ if token.is_empty() {\n+ return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+ }\n+ let now = now_ms();\n+ let valid = {\n+ let invites = state.invites.read().await;\n+ match invites.get(&token) {\n+ None => false,\n+ Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,\n+ }\n+ };\n+ if !valid {\n+ return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+ }\n+\n+ let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n+ let s = PendingSession {\n+ agent: INVITE_BROWSER_AGENT.to_string(),\n+ created_ts: now_ms(),\n+ provider: None,\n+ provider_id: None,\n+ redeem_invite: Some(token),\n+ complete: None,\n+ };\n+ state.pending_sessions.write().await.insert(session.clone(), s);\n+\n+ let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+ Redirect::temporary(&format!(\n+ \"{public_url}/auth/login?session={}\",\n+ urlencoding::encode(&session)\n+ ))\n+ .into_response()\n+}\n+\n pub async fn get_auth_login(Query(q): Query, State(state): State) -> impl IntoResponse {\n // Redirect to Google auth endpoint.\n let sessions = pending_sessions(&state);\n@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n s.provider = Some(\"google\".to_string());\n s.provider_id = Some(sub.clone());\n if let Some(username) = existing {\n+ let invite_tok = s.redeem_invite.clone();\n let (bearer, token_event) = issue_token_for_user(&username);\n // append token event\n let ev = Event::TokenIssued(token_event);\n@@ -215,6 +301,11 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n let mut reduced = reduced_arc.write().await;\n reduced.apply_event(ev);\n }\n+ if let Some(tok) = invite_tok {\n+ if let Err(e) = apply_invite_redemption(&state, &tok, &username).await {\n+ tracing::warn!(error = %e, \"invite redemption skipped after oauth\");\n+ }\n+ }\n s.complete = Some((username, bearer));\n return Redirect::temporary(&format!(\"{public_url}/auth/complete\")).into_response();\n }\n@@ -310,6 +401,16 @@ pub async fn post_choose_username(\n reduced.apply_event(ti_ev.clone());\n }\n \n+ // Redeem invite (if any) before marking the session complete.\n+ if let Some(tok) = {\n+ let sessions_read = sessions.read().await;\n+ sessions_read.get(&form.session).and_then(|s| s.redeem_invite.clone())\n+ } {\n+ if let Err(e) = apply_invite_redemption(&state, &tok, &canon_user).await {\n+ tracing::warn!(error = %e, \"invite redemption skipped after registration\");\n+ }\n+ }\n+\n // Mark complete for polling.\n {\n let mut sessions_write = sessions.write().await;\n@@ -339,6 +440,7 @@ pub async fn post_pending_session(\n created_ts: now_ms(),\n provider: None,\n provider_id: None,\n+ redeem_invite: None,\n complete: None,\n };\n let sessions = pending_sessions(&state);\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex a1ea432932cdca0e42dc7377f0a25075fd5644c0..cb031aecebad1107dfa2898a98fb6084b28ba6e9 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -4,6 +4,7 @@ mod rpc;\n mod validate;\n \n pub use auth::{\n+ get_join_invite,\n get_pending_session,\n get_whoami,\n post_pending_session,\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex 11a76ed7a02aae588edadb7a87a43660f5669d9e..f6bbc3df71909a2da7403cd46fe4ea6ca130c692 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -13,12 +13,14 @@ use slug_types::*;\n use crate::{\n canonical_path::{canonicalize_item, canonicalize_tag},\n dsl,\n- events::{AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility},\n+ events::{\n+ AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility,\n+ },\n identity::{parse_agent, parse_username},\n path_types::CanonicalItemUrl,\n ranking::{connected_components_from_voted_pairs, ranked_items_subset},\n reducer::{scope_from_room_wire, ReducerState, ScopeId},\n- state::AppState,\n+ state::{AppState, InviteState},\n };\n \n use super::auth::verify_bearer_principal;\n@@ -142,6 +144,27 @@ fn gen_short_id() -> String {\n (0..7).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect()\n }\n \n+fn gen_invite_token() -> String {\n+ use rand::Rng;\n+ const ALPHABET: &[u8] = b\"0123456789abcdefghijklmnopqrstuvwxyz\";\n+ let mut rng = rand::thread_rng();\n+ let tail: String = (0..16).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect();\n+ format!(\"inv_{tail}\")\n+}\n+\n+const INVITE_TTL_MS: i64 = 86_400_000;\n+\n+fn capability_wire(c: ThreadCapability) -> String {\n+ match c {\n+ ThreadCapability::View => \"view\",\n+ ThreadCapability::Post => \"post\",\n+ ThreadCapability::Vote => \"vote\",\n+ ThreadCapability::AddItem => \"add_item\",\n+ ThreadCapability::Manage => \"manage\",\n+ }\n+ .to_string()\n+}\n+\n fn build_rank_response_for_content(\n content: &crate::reducer::ContentState,\n parent: Option<&str>,\n@@ -512,7 +535,7 @@ fn rpc_forum_thread_detail(\n None => Err((\"post not found\".into(), None)),\n Some((idx, ing)) => Ok(ThreadDetailResponse {\n thread: format!(\"#{}\", tag),\n- posts: vec![PostRow {\n+ items: vec![ThreadItem::Post {\n id: ing.id.clone(),\n index: idx,\n ts: ing.ts,\n@@ -543,7 +566,7 @@ fn rpc_forum_thread_detail(\n \n let total = filtered.len();\n const MAX_BODY: usize = 2000;\n- let posts: Vec = filtered\n+ let items: Vec = filtered\n .into_iter()\n .skip(offset)\n .take(limit)\n@@ -553,7 +576,7 @@ fn rpc_forum_thread_detail(\n } else {\n (ing.raw.clone(), false)\n };\n- PostRow {\n+ ThreadItem::Post {\n id: ing.id.clone(),\n index: idx,\n ts: ing.ts,\n@@ -566,7 +589,7 @@ fn rpc_forum_thread_detail(\n \n Ok(ThreadDetailResponse {\n thread: format!(\"#{}\", tag),\n- posts,\n+ items,\n total,\n offset,\n })\n@@ -1007,7 +1030,7 @@ pub async fn handle_rpc_batch(\n RpcCommand::RoomGrant {\n room,\n username,\n- capability,\n+ capabilities,\n } => {\n let principal = {\n let reduced = state.reduced.read().await;\n@@ -1022,6 +1045,8 @@ pub async fn handle_rpc_batch(\n };\n if !can_manage {\n line_err(\"requires Manage capability\", None)\n+ } else if capabilities.is_empty() {\n+ line_err(\"capabilities must not be empty\", None)\n } else {\n match parse_username(&username) {\n Err(msg) => line_err(\"invalid username\", Some(msg)),\n@@ -1033,14 +1058,18 @@ pub async fn handle_rpc_batch(\n if !user_exists {\n line_err(format!(\"user @{target} not found\"), None)\n } else {\n- match parse_capability(&capability) {\n+ let caps: Result, String> = capabilities\n+ .iter()\n+ .map(|c| parse_capability(c.trim()))\n+ .collect();\n+ match caps {\n Err(msg) => line_err(msg, None),\n- Ok(cap) => {\n+ Ok(caps) => {\n let ga_ev = Event::GrantAdded(GrantAdded {\n ts: now_ms(),\n room_id: room,\n username: target,\n- capabilities: vec![cap],\n+ capabilities: caps,\n granted_by: principal,\n });\n if let Err(e) = state.event_log.append(&ga_ev).await {\n@@ -1059,6 +1088,114 @@ pub async fn handle_rpc_batch(\n }\n }\n }\n+ RpcCommand::RoomMintInvite {\n+ room,\n+ capabilities,\n+ max_uses,\n+ } => {\n+ let principal = {\n+ let reduced = state.reduced.read().await;\n+ verify_bearer_principal(&headers, &*reduced)\n+ };\n+ match principal {\n+ Err((_, m)) => line_err(m, None),\n+ Ok(principal) => {\n+ let can_manage = {\n+ let reduced = state.reduced.read().await;\n+ reduced.user_has_cap(&room, &principal, ThreadCapability::Manage)\n+ };\n+ if !can_manage {\n+ line_err(\"requires Manage capability\", None)\n+ } else if capabilities.is_empty() {\n+ line_err(\"capabilities must not be empty\", None)\n+ } else {\n+ match capabilities\n+ .iter()\n+ .map(|c| parse_capability(c.trim()))\n+ .collect::, String>>()\n+ {\n+ Err(msg) => line_err(msg, None),\n+ Ok(caps) => {\n+ let max_uses = max_uses.max(1).min(100_000);\n+ let now = now_ms();\n+ let expires_at_ms = now + INVITE_TTL_MS;\n+ let token = loop {\n+ let t = gen_invite_token();\n+ let taken = {\n+ let invites = state.invites.read().await;\n+ invites.contains_key(&t)\n+ };\n+ if !taken {\n+ break t;\n+ }\n+ };\n+ let inv = InviteState {\n+ room_id: room.clone(),\n+ capabilities: caps,\n+ expires_at_ms,\n+ max_uses,\n+ current_uses: 0,\n+ inviter: principal,\n+ };\n+ state.invites.write().await.insert(token.clone(), inv);\n+ let public_url = std::env::var(\"SLUG_PUBLIC_URL\")\n+ .unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+ let invite_url = format!(\"{public_url}/join/{token}\");\n+ line_ok(RpcResult::RoomInviteMinted {\n+ invite_url,\n+ expires_at_ms: Some(expires_at_ms),\n+ max_uses,\n+ })\n+ }\n+ }\n+ }\n+ }\n+ }\n+ }\n+ RpcCommand::RoomAudit { room } => {\n+ let principal = {\n+ let reduced = state.reduced.read().await;\n+ verify_bearer_principal(&headers, &*reduced)\n+ };\n+ match principal {\n+ Err((_, m)) => line_err(m, None),\n+ Ok(principal) => {\n+ let reduced = state.reduced.read().await;\n+ if !reduced.rooms.contains_key(&room) {\n+ line_err(\"unknown room\", None)\n+ } else {\n+ let can_audit = reduced.user_has_cap(&room, &principal, ThreadCapability::View)\n+ || reduced.user_has_cap(&room, &principal, ThreadCapability::Manage);\n+ if !can_audit {\n+ line_err(\"requires View or Manage capability\", None)\n+ } else {\n+ let grants: Vec = reduced\n+ .grants\n+ .get(&room)\n+ .map(|m| {\n+ let mut v: Vec = m\n+ .iter()\n+ .map(|(username, caps)| {\n+ let mut c: Vec =\n+ caps.iter().copied().map(capability_wire).collect();\n+ c.sort();\n+ RoomAuditEntry {\n+ username: username.clone(),\n+ capabilities: c,\n+ }\n+ })\n+ .collect();\n+ v.sort_by(|a, b| a.username.cmp(&b.username));\n+ v\n+ })\n+ .unwrap_or_default();\n+ line_ok(RpcResult::RoomAudit(RoomAuditResponse { room, grants }))\n+ }\n+ }\n+ }\n+ }\n+ }\n+ RpcCommand::RoomRevoke { .. } => line_err(\"RoomRevoke is not implemented yet\", None),\n RpcCommand::GetGlobalRank {\n room,\n limit,\ndiff --git a/server/src/events.rs b/server/src/events.rs\nindex 125005d89ade7b22c9b6d997f0ed81781df5e7ec..9e60f2c218f5c871a93e855e415dd984e3a017c5 100644\n--- a/server/src/events.rs\n+++ b/server/src/events.rs\n@@ -26,6 +26,8 @@ pub enum Event {\n RoomCreated(RoomCreated),\n GrantAdded(GrantAdded),\n GrantRevoked(GrantRevoked),\n+ InviteMinted(InviteMinted),\n+ InviteRedeemed(InviteRedeemed),\n /// Ingest of a DSL+prose body. Identity and routing live in event metadata.\n Ingest(Ingest),\n }\n@@ -82,6 +84,25 @@ pub struct GrantRevoked {\n pub revoked_by: String,\n }\n \n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteMinted {\n+ pub ts: i64,\n+ pub token: String,\n+ pub room_id: String,\n+ pub capabilities: Vec,\n+ pub inviter: String,\n+ pub max_uses: u32,\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ pub expires_ts_ms: Option,\n+}\n+\n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteRedeemed {\n+ pub ts: i64,\n+ pub token: String,\n+ pub username: String,\n+}\n+\n #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n pub struct Ingest {\n /// Unix timestamp in milliseconds.\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex d00b56d909e1fabd1d122d054dd02785e13e0bd8..bf2f73d4d0f26a357961e88c52c3b4f72626af81 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -27,6 +27,7 @@ pub fn create_app(state: AppState) -> Router {\n Router::new()\n .route(\"/healthz\", axum::routing::get(|| async { \"ok\" }))\n .route(\"/static/:filename\", axum::routing::get(crate::html::serve_theme_css))\n+ .route(\"/join/:token\", axum::routing::get(api::get_join_invite))\n .route(\"/auth/login\", axum::routing::get(api::get_auth_login))\n .route(\"/auth/callback\", axum::routing::get(api::get_auth_callback))\n .route(\"/auth/complete\", axum::routing::get(api::get_auth_complete))\ndiff --git a/server/src/reducer.rs b/server/src/reducer.rs\nindex 118cb19f4df4a083df2878ca7a1424f3d63de851..5190d0a7ee3d545a786a68fef483322aafdce7f9 100644\n--- a/server/src/reducer.rs\n+++ b/server/src/reducer.rs\n@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet, VecDeque};\n use serde::{Deserialize, Serialize};\n \n use crate::canonical_path::canonicalize_tag;\n-use crate::events::{Event, Ingest, ThreadCapability};\n+use crate::events::{Event, Ingest, ThreadCapability, ThreadVisibility};\n use crate::path_types::CanonicalItemUrl;\n \n #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]\n@@ -156,6 +156,41 @@ pub struct RoomState {\n pub visibility: crate::events::ThreadVisibility,\n }\n \n+/// Durable invite link state (from [`crate::events::InviteMinted`] / [`crate::events::InviteRedeemed`]).\n+#[derive(Debug, Clone)]\n+pub struct ActiveInviteState {\n+ pub room_id: String,\n+ pub capabilities: HashSet,\n+ pub inviter: String,\n+ pub uses_remaining: u32,\n+ pub expires_ts_ms: Option,\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum RoomTimelineKind {\n+ RoomCreated {\n+ owner: String,\n+ slug: String,\n+ visibility: ThreadVisibility,\n+ },\n+ GrantAdded {\n+ username: String,\n+ granted_by: String,\n+ capabilities: Vec,\n+ },\n+ GrantRevoked {\n+ username: String,\n+ revoked_by: String,\n+ capabilities: Vec,\n+ },\n+}\n+\n+#[derive(Clone, Debug)]\n+pub struct RoomTimelineEntry {\n+ pub ts: i64,\n+ pub kind: RoomTimelineKind,\n+}\n+\n #[derive(Debug, Clone)]\n pub struct ForumThreadState {\n pub last_activity_ts: i64,\n@@ -210,6 +245,10 @@ pub struct ReducerState {\n pub ingests_ordered: Vec,\n /// room_id → username → capabilities\n pub grants: HashMap>>,\n+ /// room_id → chronological room admin lines (for thread UI).\n+ pub room_timeline: HashMap>,\n+ /// Invite token → active invite (absent when fully consumed or never minted).\n+ pub invites: HashMap,\n }\n \n impl ReducerState {\n@@ -225,6 +264,20 @@ impl ReducerState {\n .unwrap_or(false)\n }\n \n+ /// Invite link is present, not expired, and has uses left.\n+ pub fn invite_token_active(&self, token: &str, now_ms: i64) -> Option<&ActiveInviteState> {\n+ let inv = self.invites.get(token)?;\n+ if inv.uses_remaining == 0 {\n+ return None;\n+ }\n+ if let Some(exp) = inv.expires_ts_ms {\n+ if now_ms > exp {\n+ return None;\n+ }\n+ }\n+ Some(inv)\n+ }\n+\n pub fn content_for_scope_mut(&mut self, scope: ScopeId) -> &mut ContentState {\n self.content.entry(scope).or_default()\n }\n@@ -356,6 +409,17 @@ impl ReducerState {\n visibility: rc.visibility,\n },\n );\n+ self.room_timeline\n+ .entry(rc.room_id.clone())\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: rc.ts,\n+ kind: RoomTimelineKind::RoomCreated {\n+ owner: rc.owner.clone(),\n+ slug: rc.slug.clone(),\n+ visibility: rc.visibility,\n+ },\n+ });\n }\n Event::Ingest(mut ing) => {\n ing.thread_tag = canonicalize_tag(&ing.thread_tag);\n@@ -525,18 +589,31 @@ impl ReducerState {\n nav!(self.actor_last_post_ts, keypath(ing.principal.clone()), setval(ing.ts));\n }\n Event::GrantAdded(ga) => {\n+ let room_id = ga.room_id.clone();\n let caps = self.grants\n .entry(ga.room_id)\n .or_default()\n- .entry(ga.username)\n+ .entry(ga.username.clone())\n .or_default();\n- for cap in ga.capabilities {\n+ for cap in ga.capabilities.iter().copied() {\n caps.insert(cap);\n }\n+ self.room_timeline\n+ .entry(room_id)\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: ga.ts,\n+ kind: RoomTimelineKind::GrantAdded {\n+ username: ga.username.clone(),\n+ granted_by: ga.granted_by.clone(),\n+ capabilities: ga.capabilities.clone(),\n+ },\n+ });\n }\n Event::GrantRevoked(gr) => {\n+ let room_id = gr.room_id.clone();\n if let Some(room_grants) = self.grants.get_mut(&gr.room_id) {\n- let username = gr.username;\n+ let username = gr.username.clone();\n if let Some(caps) = room_grants.get_mut(&username) {\n for cap in &gr.capabilities {\n caps.remove(cap);\n@@ -549,6 +626,37 @@ impl ReducerState {\n self.grants.remove(&gr.room_id);\n }\n }\n+ self.room_timeline\n+ .entry(room_id)\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: gr.ts,\n+ kind: RoomTimelineKind::GrantRevoked {\n+ username: gr.username.clone(),\n+ revoked_by: gr.revoked_by.clone(),\n+ capabilities: gr.capabilities.clone(),\n+ },\n+ });\n+ }\n+ Event::InviteMinted(im) => {\n+ self.invites.insert(\n+ im.token.clone(),\n+ ActiveInviteState {\n+ room_id: im.room_id.clone(),\n+ capabilities: im.capabilities.iter().copied().collect(),\n+ inviter: im.inviter.clone(),\n+ uses_remaining: im.max_uses,\n+ expires_ts_ms: im.expires_ts_ms,\n+ },\n+ );\n+ }\n+ Event::InviteRedeemed(ir) => {\n+ if let Some(inv) = self.invites.get_mut(&ir.token) {\n+ inv.uses_remaining = inv.uses_remaining.saturating_sub(1);\n+ if inv.uses_remaining == 0 {\n+ self.invites.remove(&ir.token);\n+ }\n+ }\n }\n }\n }\n@@ -570,6 +678,8 @@ impl Default for ReducerState {\n actor_last_post_ts: HashMap::new(),\n ingests_ordered: Vec::new(),\n grants: HashMap::new(),\n+ room_timeline: HashMap::new(),\n+ invites: HashMap::new(),\n }\n }\n }\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex b1ff2330903780cbe0cdf35964cb166eb2423d7d..628fd5921b34ba53ac0ca6b6fd33957ca09129b9 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -1,8 +1,20 @@\n+use std::collections::HashMap;\n use std::sync::Arc;\n \n use tokio::sync::{broadcast, RwLock};\n \n-use crate::{event_log::EventLog, reducer::ReducerState};\n+use crate::{event_log::EventLog, events::ThreadCapability, reducer::ReducerState};\n+\n+/// Ephemeral invite link (24h TTL, in-memory only; not written to the event log).\n+#[derive(Debug, Clone)]\n+pub struct InviteState {\n+ pub room_id: String,\n+ pub capabilities: Vec,\n+ pub expires_at_ms: i64,\n+ pub max_uses: usize,\n+ pub current_uses: usize,\n+ pub inviter: String,\n+}\n \n #[derive(Debug, Clone)]\n pub struct PendingSession {\n@@ -10,6 +22,8 @@ pub struct PendingSession {\n pub created_ts: i64,\n pub provider: Option,\n pub provider_id: Option,\n+ /// When set, successful OAuth completion redeems this invite token and appends [`crate::events::GrantAdded`].\n+ pub redeem_invite: Option,\n pub complete: Option<(String /*username*/, String /*bearer*/ )>,\n }\n \n@@ -42,7 +56,9 @@ pub struct AppState {\n pub cfg: Arc,\n pub event_log: Arc,\n pub reduced: Arc>,\n- pub pending_sessions: Arc>>,\n+ pub pending_sessions: Arc>>,\n+ /// Ephemeral invite tokens (`inv_…`) until expiry or exhaustion.\n+ pub invites: Arc>>,\n /// Broadcast channel for SSE live-streaming. Capacity = 64 events.\n pub stream_tx: broadcast::Sender,\n /// Broadcast channel for web SSE HTML fragments (poem pattern). Capacity = 64.\n@@ -58,7 +74,8 @@ impl AppState {\n cfg: Arc::new(cfg),\n event_log: Arc::new(event_log),\n reduced: Arc::new(RwLock::new(ReducerState::default())),\n- pending_sessions: Arc::new(RwLock::new(std::collections::HashMap::new())),\n+ pending_sessions: Arc::new(RwLock::new(HashMap::new())),\n+ invites: Arc::new(RwLock::new(HashMap::new())),\n stream_tx,\n html_tx,\n }\ndiff --git a/server/src/timeline.rs b/server/src/timeline.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..251158943ab36d3015268e35f6bdd01c3f42ab3b\n--- /dev/null\n+++ b/server/src/timeline.rs\n@@ -0,0 +1,153 @@\n+//! Room admin lines merged into forum thread views.\n+\n+use crate::{\n+ canonical_path::canonicalize_tag,\n+ reducer::{ReducerState, RoomTimelineEntry, RoomTimelineKind},\n+};\n+\n+fn cap_label(c: crate::events::ThreadCapability) -> &'static str {\n+ use crate::events::ThreadCapability::*;\n+ match c {\n+ View => \"view\",\n+ Post => \"post\",\n+ Vote => \"vote\",\n+ AddItem => \"add_item\",\n+ Manage => \"manage\",\n+ }\n+}\n+\n+fn caps_list(caps: &[crate::events::ThreadCapability]) -> String {\n+ let mut v: Vec<_> = caps.iter().map(|c| cap_label(*c)).collect();\n+ v.sort();\n+ v.join(\", \")\n+}\n+\n+/// Human-readable system line for the thread feed.\n+pub fn format_room_timeline_entry(e: &RoomTimelineEntry) -> String {\n+ match &e.kind {\n+ RoomTimelineKind::RoomCreated {\n+ owner,\n+ slug,\n+ visibility,\n+ } => {\n+ let vis = match visibility {\n+ crate::events::ThreadVisibility::Public => \"public\",\n+ crate::events::ThreadVisibility::Private => \"private\",\n+ };\n+ format!(\"@{owner} created room #{slug} ({vis})\")\n+ }\n+ RoomTimelineKind::GrantAdded {\n+ username,\n+ granted_by,\n+ capabilities,\n+ } => {\n+ format!(\n+ \"@{granted_by} granted @{} {}\",\n+ username,\n+ caps_list(capabilities)\n+ )\n+ }\n+ RoomTimelineKind::GrantRevoked {\n+ username,\n+ revoked_by,\n+ capabilities,\n+ } => {\n+ format!(\n+ \"@{revoked_by} revoked @{} {}\",\n+ username,\n+ caps_list(capabilities)\n+ )\n+ }\n+ }\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum MergedThreadRow {\n+ System { ts: i64, text: String },\n+ Post {\n+ index: usize,\n+ id: String,\n+ ts: i64,\n+ principal: String,\n+ raw: String,\n+ },\n+}\n+\n+/// Merge room admin lines with thread ingests for one room + tag. Oldest first.\n+/// `actor_prefix` filters posts only (system lines always included).\n+pub fn merge_thread_rows(\n+ reduced: &ReducerState,\n+ room_wire: &str,\n+ thread_tag: &str,\n+ since: Option,\n+ before: Option,\n+ actor_prefix: &str,\n+) -> Vec {\n+ let scope = crate::reducer::scope_from_room_wire(room_wire);\n+ let tag = canonicalize_tag(thread_tag);\n+ let key = (scope.clone(), tag.clone());\n+\n+ let mut rows: Vec = Vec::new();\n+\n+ if let Some(entries) = reduced.room_timeline.get(room_wire.trim()) {\n+ for e in entries {\n+ if since.map_or(true, |s| e.ts >= s) && before.map_or(true, |b| e.ts < b) {\n+ rows.push(MergedThreadRow::System {\n+ ts: e.ts,\n+ text: format_room_timeline_entry(e),\n+ });\n+ }\n+ }\n+ }\n+\n+ let all_ids: Vec = reduced\n+ .ingests_by_scope_thread\n+ .get(&key)\n+ .map(|q| q.iter().rev().cloned().collect())\n+ .unwrap_or_default();\n+\n+ for (idx, id) in all_ids.into_iter().enumerate() {\n+ let Some(ing) = reduced.ingests_by_id.get(&id) else {\n+ continue;\n+ };\n+ if since.map_or(true, |s| ing.ts >= s) && before.map_or(true, |b| ing.ts < b) {\n+ if !actor_prefix.is_empty()\n+ && !ing\n+ .principal\n+ .to_lowercase()\n+ .starts_with(actor_prefix)\n+ {\n+ continue;\n+ }\n+ rows.push(MergedThreadRow::Post {\n+ index: idx,\n+ id: ing.id.clone(),\n+ ts: ing.ts,\n+ principal: ing.principal.clone(),\n+ raw: ing.raw.clone(),\n+ });\n+ }\n+ }\n+\n+ rows.sort_by(|a, b| {\n+ let ta = match a {\n+ MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+ };\n+ let tb = match b {\n+ MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+ };\n+ ta.cmp(&tb)\n+ });\n+ rows\n+}\n+\n+/// Public forum thread (`room_wire == \"public\"`): same merge (timeline usually empty).\n+pub fn merge_public_thread_rows(\n+ reduced: &ReducerState,\n+ thread_tag: &str,\n+ since: Option,\n+ before: Option,\n+ actor_prefix: &str,\n+) -> Vec {\n+ merge_thread_rows(reduced, \"public\", thread_tag, since, before, actor_prefix)\n+}\ndiff --git a/test/grants.bb b/test/grants.bb\nindex 10ef0f08ce1c3945e5f1634314e6aebcf6810cd2..4ded5ce92576cdea653cce0ba8a751be4374731a 100644\n--- a/test/grants.bb\n+++ b/test/grants.bb\n@@ -105,7 +105,7 @@\n ;; Alice grants bob View only.\n (println \"\\nalice grants bob View only…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"view\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"view\"]}}])))\n \"grant View RPC ok\")\n \n (println \"\\nbob (View only) tries to post prose…\")\n@@ -117,7 +117,7 @@\n ;; Alice grants bob Post.\n (println \"\\nalice grants bob Post…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"post\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"post\"]}}])))\n \"grant Post RPC ok\")\n \n (println \"\\nbob (View + Post) posts prose…\")\n@@ -143,7 +143,7 @@\n ;; Alice grants bob Vote.\n (println \"\\nalice grants bob Vote…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"vote\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"vote\"]}}])))\n \"grant Vote RPC ok\")\n \n (println \"\\nbob (View + Post + Vote) votes…\")\ndiff --git a/test/invites.bb b/test/invites.bb\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f72b1e630a6856174cdef11eb977e2f81b16e551\n--- /dev/null\n+++ b/test/invites.bb\n@@ -0,0 +1,150 @@\n+(ns test.invites\n+ \"Ephemeral invite links: mint via RPC, GET /join → pending session + OAuth, redemption → GrantAdded,\n+ RoomAudit, post succeeds, second GET /join returns 404 when max_uses exhausted.\"\n+ (:require [babashka.fs :as fs]\n+ [cheshire.core :as json]\n+ [clojure.string :as str]\n+ [test.common :as common]\n+ [test.oauth :as oauth]))\n+\n+(def ^:private counts (atom {:pass 0 :fail 0}))\n+\n+(defn- assert! [pred msg]\n+ (common/test-assert! counts pred msg))\n+\n+(defn- bearer [token] {\"Authorization\" (str \"Bearer \" token)})\n+\n+(defn- rpc-batch! [base-url token cmds]\n+ (let [resp (oauth/http-post-json (str base-url \"/api/v0/rpc\") cmds :headers (bearer token))]\n+ {:status (:status resp)\n+ :parsed (json/parse-string (:body resp) false)}))\n+\n+(defn- rpc-line-ok? [parsed]\n+ (true? (get-in parsed [\"results\" 0 \"ok\"])))\n+\n+(defn- session-from-login-location [loc]\n+ (when loc\n+ (let [qpart (if (str/includes? loc \"?\")\n+ (-> loc (str/split #\"\\?\" 2) second)\n+ \"\")\n+ qpart (if (str/includes? qpart \"#\")\n+ (-> qpart (str/split #\"#\" 2) first)\n+ qpart)\n+ m (oauth/parse-query qpart)]\n+ (some-> (get m :session) str))))\n+\n+(defn- invite-token-from-url [invite-url]\n+ (second (re-find #\"/join/(inv_[^/?#]+)\" (str invite-url))))\n+\n+(defn- register-user! [base-url session-agent username]\n+ (oauth/complete-registration! base-url\n+ :agent session-agent\n+ :username username\n+ :assert! (fn [pred msg] (assert! pred msg))))\n+\n+(defn- ingest! [base-url token room thread delegate text]\n+ (rpc-batch! base-url token\n+ [{\"Post\" {\"room\" room\n+ \"thread_tag\" thread\n+ \"delegate\" delegate\n+ \"text\" text\n+ \"return_rank_diff\" false}}]))\n+\n+(defn invites-test [& _args]\n+ (println \"\\n━━━ ephemeral invite + audit integration check ━━━\\n\")\n+ (reset! counts {:pass 0 :fail 0})\n+\n+ (println \"building server binary…\")\n+ (common/letlocals\n+ (bind build (common/run-cargo-build-release! [\"slugsocial-server\"]))\n+ (assert! (zero? (:exit build)) \"cargo build succeeds\")\n+ (bind server-bin \"target/release/slugsocial-server\")\n+\n+ (bind tmp-dir (str (fs/create-temp-dir {:prefix \"slug-invites-\"})))\n+ (bind slug-port (common/pick-port))\n+ (bind google-port (common/pick-port))\n+ (bind base-url (str \"http://127.0.0.1:\" slug-port))\n+ (bind google-url (str \"http://127.0.0.1:\" google-port))\n+\n+ (bind !server (atom nil))\n+ (bind !google (atom nil))\n+\n+ (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))\n+ (try\n+ (println (str \"starting mock google on :\" google-port))\n+ (reset! !google (oauth/start-mock-google google-port\n+ :google-users [\"google-user-alice\" \"google-user-bob\"]))\n+\n+ (println (str \"starting server on :\" slug-port))\n+ (reset! !server (common/start-server server-bin server-env))\n+ (assert! (common/wait-for-server base-url 10000) \"server responds to /healthz\")\n+\n+ (println \"\\nregistering alice…\")\n+ (let [alice-token (register-user! base-url\n+ \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n+ \"alice\")\n+\n+ _ (println \"\\nalice creates private room…\")\n+ create (rpc-batch! base-url alice-token\n+ [{\"RoomCreate\" {\"slug\" \"invite-demo\" \"visibility\" \"private\"}}])\n+ _ (assert! (= 200 (:status create)) \"room create HTTP 200\")\n+ _ (assert! (rpc-line-ok? (:parsed create)) \"room create RPC ok\")\n+ room-id (get-in (:parsed create) [\"results\" 0 \"result\" \"RoomCreated\" \"room_id\"])\n+ _ (assert! (some? room-id) \"room_id present\")\n+\n+ _ (println \"\\nalice mints invite (view,post,vote uses=1)…\")\n+ mint (rpc-batch! base-url alice-token\n+ [{\"RoomMintInvite\" {\"room\" room-id\n+ \"capabilities\" [\"view\" \"post\" \"vote\"]\n+ \"max_uses\" 1}}])\n+ _ (assert! (= 200 (:status mint)) \"mint HTTP 200\")\n+ _ (assert! (rpc-line-ok? (:parsed mint)) \"mint RPC ok\")\n+ invite-url (get-in (:parsed mint) [\"results\" 0 \"result\" \"RoomInviteMinted\" \"invite_url\"])\n+ inv-tok (invite-token-from-url invite-url)\n+ _ (assert! (some? inv-tok) \"invite token parsed from URL\")\n+\n+ _ (println \"\\nGET /join/:token (expect redirect + session)…\")\n+ join-resp (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+ _ (assert! (contains? #{302 307} (:status join-resp))\n+ (str \"join returns redirect (got status \" (:status join-resp) \")\"))\n+ sess (session-from-login-location (:location join-resp))\n+ _ (assert! (and (some? sess) (str/starts-with? sess \"p_\")) \"Location carries session=p_…\")\n+\n+ _ (println \"\\nbob completes OAuth via invite session…\")\n+ bob-token (oauth/complete-pending-session! base-url sess \"bob\"\n+ :assert! (fn [pred msg] (assert! pred msg)))\n+\n+ _ (println \"\\nalice runs RoomAudit…\")\n+ audit (rpc-batch! base-url alice-token [{\"RoomAudit\" {\"room\" room-id}}])\n+ _ (assert! (rpc-line-ok? (:parsed audit)) \"audit RPC ok\")\n+ grants (get-in (:parsed audit) [\"results\" 0 \"result\" \"RoomAudit\" \"grants\"])\n+ bob-entry (first (filter #(= \"bob\" (get % \"username\")) grants))\n+ _ (assert! (some? bob-entry) \"audit lists bob\")\n+ bob-caps (set (get bob-entry \"capabilities\"))\n+ _ (assert! (= bob-caps #{\"view\" \"post\" \"vote\"}) \"bob has view, post, vote\")\n+\n+ _ (println \"\\nbob posts prose to private room…\")\n+ _ (assert! (rpc-line-ok? (:parsed (ingest! base-url bob-token room-id \"main\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"Hello via invite link.\")))\n+ \"bob post succeeds\")\n+\n+ _ (println \"\\nsecond GET /join (invite exhausted → 404)…\")\n+ join2 (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+ _ (assert! (= 404 (:status join2)) \"exhausted invite returns 404\")]\n+\n+ (println \"\\ninvite lifecycle OK.\"))\n+\n+ (finally\n+ (when-some [s @!server] (common/kill-server s))\n+ (when-some [g @!google] ((:stop-fn g)))\n+ (fs/delete-tree tmp-dir)))\n+\n+ (bind {pass :pass fail :fail} @counts)\n+ (if (zero? fail)\n+ (println (str \"\\n\" common/ansi-green \"━━━ \" pass \" invite checks passed ━━━\" common/ansi-reset \"\\n\"))\n+ (do (println (str \"\\n\" common/ansi-red \"━━━ \" fail \" invite checks FAILED ━━━\" common/ansi-reset \"\\n\"))\n+ (System/exit 1)))))\n+\n+(when (= *file* (System/getProperty \"babashka.file\"))\n+ (invites-test))\ndiff --git a/test/oauth.bb b/test/oauth.bb\nindex b69459acd17c23c023170d8dd93fe45bb49c8d88..efb3f3e66346ffde81bf9622d75c3a6ec89f8db2 100644\n--- a/test/oauth.bb\n+++ b/test/oauth.bb\n@@ -21,6 +21,21 @@\n resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn http-get-no-redirect\n+ \"GET without following redirects; returns `:location` from the first `Location` header when present.\"\n+ [url & {:keys [headers]}]\n+ (let [client (-> (java.net.http.HttpClient/newBuilder)\n+ (.followRedirects java.net.http.HttpClient$Redirect/NEVER)\n+ (.connectTimeout connect-timeout)\n+ (.build))\n+ b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n+ (doseq [[k v] (or headers {})]\n+ (.header b k v))\n+ (let [req (-> b (.timeout request-timeout) (.GET) (.build))\n+ resp (.send client req (java.net.http.HttpResponse$BodyHandlers/ofString))\n+ loc (first (get (.map (.headers resp)) \"location\"))]\n+ {:status (.statusCode resp) :body (.body resp) :location loc})))\n+\n (defn http-post-json [url data & {:keys [headers]}]\n (let [body (json/generate-string data)\n b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n@@ -50,6 +65,35 @@\n resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn complete-pending-session!\n+ \"Finish OAuth for an existing pending session id (e.g. created by `GET /join/inv_…`). Returns bearer token.\"\n+ [base-url session-id username & {:keys [assert!]}]\n+ (let [check! (fn [pred msg resp]\n+ (if assert!\n+ (assert! pred msg)\n+ (when-not pred\n+ (throw (ex-info msg {:resp resp})))))]\n+ (let [enc (java.net.URLEncoder/encode session-id \"UTF-8\")\n+ login-url (str base-url \"/auth/login?session=\" enc)\n+ login-get (http-get login-url)]\n+ (check! (= 200 (:status login-get))\n+ (str \"oauth redirect chain for session \" session-id)\n+ login-get)\n+ (let [choose (http-post-form (str base-url \"/auth/choose-username\")\n+ {:session session-id :username username})]\n+ (check! (= 200 (:status choose))\n+ (str \"choose-username for \" username \" returns 200\")\n+ choose)\n+ (let [poll (http-get (str base-url \"/api/v0/pending-session/\" session-id))]\n+ (check! (= 200 (:status poll))\n+ (str \"pending-session poll returns 200\")\n+ poll)\n+ (let [poll-json (json/parse-string (:body poll) true)]\n+ (check! (:complete poll-json)\n+ (str \"pending session complete for \" username)\n+ poll)\n+ (:token poll-json)))))))\n+\n (defn parse-query [s]\n (into {}\n (for [part (str/split (or s \"\") #\"&\")\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex a715fe5639f4a3a7bfedcc706b5fb312b98c9ac5..98c66a00fd27803ef6f75b5ac478ff2eb762d771 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -123,13 +123,32 @@ pub struct PathDetailResponse {\n #[derive(Debug, Serialize, Deserialize)]\n pub struct ThreadDetailResponse {\n pub thread: String,\n- pub posts: Vec,\n- /// Total posts in this thread.\n+ /// Chronological page: prose posts and room system lines, oldest first within the window.\n+ pub items: Vec,\n+ /// Total rows (posts + system lines) in this thread after filters.\n pub total: usize,\n- /// Chronological offset of the first post in this page.\n+ /// Offset into the merged chronological list.\n pub offset: usize,\n }\n \n+/// One row in a thread timeline: a normal post or a room system line.\n+#[derive(Debug, Serialize, Deserialize)]\n+#[serde(tag = \"kind\", rename_all = \"snake_case\")]\n+pub enum ThreadItem {\n+ Post {\n+ id: String,\n+ index: usize,\n+ ts: i64,\n+ actor: String,\n+ body: String,\n+ truncated: bool,\n+ },\n+ System {\n+ ts: i64,\n+ text: String,\n+ },\n+}\n+\n /// One post in a thread. Full body, no snippet.\n #[derive(Debug, Serialize, Deserialize)]\n pub struct PostRow {\n@@ -224,6 +243,23 @@ pub struct FeedPost {\n // RPC batch API (`POST /api/v0/rpc`)\n // ---------------------------------------------------------------------------\n \n+fn default_invite_max_uses() -> usize {\n+ 1\n+}\n+\n+/// One principal's capabilities in a private room (from [`RpcCommand::RoomAudit`]).\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditEntry {\n+ pub username: String,\n+ pub capabilities: Vec,\n+}\n+\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditResponse {\n+ pub room: String,\n+ pub grants: Vec,\n+}\n+\n #[derive(Debug, Serialize, Deserialize)]\n #[serde(transparent)]\n pub struct RpcBatch(pub Vec);\n@@ -287,10 +323,27 @@ pub enum RpcCommand {\n visibility: Option,\n },\n RoomGrant {\n+ room: String,\n+ username: String,\n+ /// Capability names: `view`, `post`, `vote`, `add_item`, `manage`.\n+ capabilities: Vec,\n+ },\n+ RoomRevoke {\n room: String,\n username: String,\n capability: String,\n },\n+ /// Mint a shareable invite link (24h TTL, stored in memory only until redeemed or expiry).\n+ RoomMintInvite {\n+ room: String,\n+ capabilities: Vec,\n+ #[serde(default = \"default_invite_max_uses\")]\n+ max_uses: usize,\n+ },\n+ /// List principals granted access in a room (requires View or Manage).\n+ RoomAudit {\n+ room: String,\n+ },\n GetGlobalRank {\n room: String,\n #[serde(default)]\n@@ -361,6 +414,13 @@ pub enum RpcResult {\n RoomCreated {\n room_id: String,\n },\n+ RoomInviteMinted {\n+ invite_url: String,\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ expires_at_ms: Option,\n+ max_uses: usize,\n+ },\n+ RoomAudit(RoomAuditResponse),\n GrantOk {},\n GlobalRank(GlobalRankResponse),\n Pair(PairResponse),\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[08565bea] Tokenize prose refs for garden URL links (#147)\n\n* Tokenize prose refs for garden URL links\n\nCo-authored-by: tommy \n\n* Stop prose URLs at line boundaries\n\nCo-authored-by: tommy \n\n* Require braced DSL item bodies\n\nCo-authored-by: tommy \n\n---------\n\nCo-authored-by: Cursor Agent \n\nSide B — unified diff (full patch):\ndiff --git a/server/src/dsl.rs b/server/src/dsl.rs\nindex 4203c2f59dd8825d7a91513c4023f3ccd37f1efc..b3c785674560a0b42a7f4c3aa13d80cd350f485b 100644\n--- a/server/src/dsl.rs\n+++ b/server/src/dsl.rs\n@@ -1,7 +1,5 @@\n use std::collections::HashMap;\n \n-use rand::Rng;\n-\n /// Parsed DSL document.\n #[derive(Debug, Clone, PartialEq, Eq)]\n pub struct Document {\n@@ -39,31 +37,57 @@ pub enum DslError {\n /// Matches the legacy Python parser behavior:\n /// - Supports toggle markers (open == close), e.g. ```...```\n /// - Supports nested markers (open != close), e.g. { ... { ... } ... }\n+#[derive(Debug, Clone, Copy, PartialEq, Eq)]\n+pub enum BlockKind {\n+ CodeFence,\n+ DoubleBrace,\n+ Brace,\n+}\n+\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+struct MaskedBlock {\n+ kind: BlockKind,\n+}\n+\n #[derive(Debug, Default, Clone)]\n pub struct BlockMasker {\n pub replacements: HashMap,\n+ blocks: HashMap,\n+ next_id: u32,\n }\n \n impl BlockMasker {\n pub fn new() -> Self {\n Self {\n replacements: HashMap::new(),\n+ blocks: HashMap::new(),\n+ next_id: 0,\n }\n }\n \n- fn new_token(&mut self) -> String {\n- let mut rng = rand::thread_rng();\n- let n: u32 = rng.gen();\n- let token = format!(\"__BLOCK_{:08x}__\", n);\n- // Extremely unlikely collision; if it happens, regenerate.\n- if self.replacements.contains_key(&token) {\n- return self.new_token();\n+ fn new_token(&mut self, haystack: &str) -> String {\n+ loop {\n+ let token = format!(\"__BLOCK_{:08x}__\", self.next_id);\n+ self.next_id = self.next_id.wrapping_add(1);\n+ if !self.replacements.contains_key(&token) && !haystack.contains(&token) {\n+ return token;\n+ }\n }\n- token\n }\n \n /// Replace outermost balanced blocks with tokens.\n pub fn mask(&mut self, text: &str, open_marker: &str, close_marker: &str) -> String {\n+ self.mask_kind(text, open_marker, close_marker, BlockKind::Brace)\n+ }\n+\n+ /// Replace outermost balanced blocks with typed deterministic tokens.\n+ pub fn mask_kind(\n+ &mut self,\n+ text: &str,\n+ open_marker: &str,\n+ close_marker: &str,\n+ kind: BlockKind,\n+ ) -> String {\n if text.is_empty() {\n return text.to_string();\n }\n@@ -97,9 +121,10 @@ impl BlockMasker {\n // Found end of outermost block\n let s = start_idx.max(0) as usize;\n let original_block = &text[s..i];\n- let token = self.new_token();\n+ let token = self.new_token(text);\n self.replacements\n .insert(token.clone(), original_block.to_string());\n+ self.blocks.insert(token.clone(), MaskedBlock { kind });\n result_parts.push(token);\n current_idx = i;\n }\n@@ -176,13 +201,22 @@ impl BlockMasker {\n }\n token.to_string()\n }\n+\n+ pub fn block_kind(&self, token: &str) -> Option {\n+ self.blocks.get(token).map(|b| b.kind)\n+ }\n }\n \n fn mask_all(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {\n // Mask hierarchy: Code -> Double Brace -> Single Brace.\n- let t = masker.mask(text, \"```\", \"```\");\n- let t = masker.mask(&t, \"{{\", \"}}\");\n- let t = masker.mask(&t, \"{\", \"}\");\n+ let t = masker.mask_kind(text, \"```\", \"```\", BlockKind::CodeFence);\n+ let t = masker.mask_kind(&t, \"{{\", \"}}\", BlockKind::DoubleBrace);\n+ let t = masker.mask_kind(&t, \"{\", \"}\", BlockKind::Brace);\n+ (masker, t)\n+}\n+\n+fn mask_code_fences(mut masker: BlockMasker, text: &str) -> (BlockMasker, String) {\n+ let t = masker.mask_kind(text, \"```\", \"```\", BlockKind::CodeFence);\n (masker, t)\n }\n \n@@ -253,7 +287,34 @@ fn skip_ws(s: &str, mut i: usize) -> usize {\n i\n }\n \n-fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n+#[derive(Debug, Clone, PartialEq, Eq)]\n+pub enum ProseToken {\n+ Text(String),\n+ ItemRef(String),\n+}\n+\n+fn trim_prose_item_ref_end(s: &str, mut end: usize) -> usize {\n+ while end > 0 {\n+ let Some((idx, c)) = s[..end].char_indices().next_back() else {\n+ break;\n+ };\n+ if matches!(\n+ c,\n+ '.' | ',' | ';' | ':' | '!' | '?' | ')' | ']' | '}' | '\"' | '\\''\n+ ) {\n+ end = idx;\n+ } else {\n+ break;\n+ }\n+ }\n+ end\n+}\n+\n+fn parse_item_name_at_with_mode(\n+ s: &str,\n+ i: usize,\n+ trim_trailing_punctuation: bool,\n+) -> Option<(String, usize)> {\n let bytes = s.as_bytes();\n if i >= bytes.len() {\n return None;\n@@ -263,6 +324,9 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n if s[i..].starts_with(\"https://\") || s[i..].starts_with(\"http://\") {\n let mut j = i;\n while j < bytes.len() {\n+ if trim_trailing_punctuation && bytes[j] == b'\\n' {\n+ break;\n+ }\n if bytes[j..].starts_with(b\"__BLOCK_\") || is_ws_byte(bytes[j]) {\n break;\n }\n@@ -271,6 +335,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n if j <= i {\n return None;\n }\n+ if trim_trailing_punctuation {\n+ j = trim_prose_item_ref_end(s, j);\n+ if j <= i {\n+ return None;\n+ }\n+ }\n return Some((s[i..j].to_string(), j));\n }\n \n@@ -296,6 +366,12 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n if j <= i + 2 {\n return None;\n }\n+ if trim_trailing_punctuation {\n+ j = trim_prose_item_ref_end(s, j);\n+ if j <= i + 2 {\n+ return None;\n+ }\n+ }\n let raw = &s[i..j];\n if !is_item_name(raw) {\n return None;\n@@ -336,6 +412,46 @@ fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n Some((format!(\"~/{}\", name), j))\n }\n \n+fn parse_item_name_at(s: &str, i: usize) -> Option<(String, usize)> {\n+ parse_item_name_at_with_mode(s, i, false)\n+}\n+\n+pub fn parse_prose_item_ref_at(s: &str, i: usize) -> Option<(String, usize)> {\n+ parse_item_name_at_with_mode(s, i, true)\n+}\n+\n+pub fn tokenize_prose_item_refs(text: &str) -> Vec {\n+ if text.is_empty() {\n+ return Vec::new();\n+ }\n+ let (masker, masked) = mask_code_fences(BlockMasker::new(), text);\n+ let mut tokens = Vec::new();\n+ let mut text_start = 0usize;\n+ let mut i = 0usize;\n+\n+ while i < masked.len() {\n+ if let Some((raw, end)) = parse_prose_item_ref_at(&masked, i) {\n+ if text_start < i {\n+ tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..i])));\n+ }\n+ tokens.push(ProseToken::ItemRef(masker.unmask(&raw)));\n+ i = end;\n+ text_start = i;\n+ continue;\n+ }\n+\n+ let Some((_, c)) = masked[i..].char_indices().next() else {\n+ break;\n+ };\n+ i += c.len_utf8();\n+ }\n+\n+ if text_start < masked.len() {\n+ tokens.push(ProseToken::Text(masker.unmask(&masked[text_start..])));\n+ }\n+ tokens\n+}\n+\n fn parse_block_token_at(s: &str, i: usize) -> Option<(String, usize)> {\n let bytes = s.as_bytes();\n if i >= bytes.len() {\n@@ -401,6 +517,12 @@ fn parse_block_prefixed_statement(\n tail: &str,\n masker: &BlockMasker,\n ) -> Result {\n+ if masker.block_kind(block_token) == Some(BlockKind::CodeFence) {\n+ return Err(DslError::Parse(\n+ \"vote explanations must use `{ ... }`; code fences belong inside body blocks\"\n+ .to_string(),\n+ ));\n+ }\n // vote: block item_ref comparison item_ref\n let s = tail.trim_start();\n if s.is_empty() {\n@@ -462,6 +584,11 @@ fn parse_item_definition_statement(stripped: &str, masker: &BlockMasker) -> Resu\n }\n \n if let Some((tok, end)) = parse_block_token_at(stripped, i) {\n+ if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {\n+ return Err(DslError::Parse(\n+ \"item bodies must use `{ ... }`; code fences belong inside body blocks\".to_string(),\n+ ));\n+ }\n let body = masker.extract_body(&tok);\n let tail = stripped[end..].trim();\n if !tail.is_empty() {\n@@ -572,6 +699,10 @@ pub fn parse_full(text: &str) -> Result {\n \n if let Some((tok, end)) = parse_block_token_at(stripped, 0) {\n if stripped[end..].trim().is_empty() {\n+ if masker.block_kind(&tok) == Some(BlockKind::CodeFence) {\n+ prose_buffer.push(line);\n+ continue;\n+ }\n pending_block = Some(tok);\n continue;\n }\n@@ -619,6 +750,70 @@ mod tests {\n assert_eq!(roundtrip, input);\n }\n \n+ #[test]\n+ fn blockmasker_tokens_are_deterministic_and_typed() {\n+ let input = \"x ```code``` y {body}\";\n+ let (masker, masked) = mask_all(BlockMasker::new(), input);\n+ assert!(masked.contains(\"__BLOCK_00000000__\"));\n+ assert!(masked.contains(\"__BLOCK_00000001__\"));\n+ assert_eq!(\n+ masker.block_kind(\"__BLOCK_00000000__\"),\n+ Some(BlockKind::CodeFence)\n+ );\n+ assert_eq!(\n+ masker.block_kind(\"__BLOCK_00000001__\"),\n+ Some(BlockKind::Brace)\n+ );\n+ assert_eq!(masker.unmask(&masked), input);\n+ }\n+\n+ #[test]\n+ fn prose_tokenizer_finds_tilde_dash_and_raw_url_refs() {\n+ let tokens =\n+ tokenize_prose_item_refs(\"see ~/a/b then -/example.com/x and https://Example.com/A/B.\");\n+ assert_eq!(\n+ tokens,\n+ vec![\n+ ProseToken::Text(\"see \".to_string()),\n+ ProseToken::ItemRef(\"~/a/b\".to_string()),\n+ ProseToken::Text(\" then \".to_string()),\n+ ProseToken::ItemRef(\"-/example.com/x\".to_string()),\n+ ProseToken::Text(\" and \".to_string()),\n+ ProseToken::ItemRef(\"https://Example.com/A/B\".to_string()),\n+ ProseToken::Text(\".\".to_string()),\n+ ]\n+ );\n+ }\n+\n+ #[test]\n+ fn prose_tokenizer_stops_raw_urls_at_newlines() {\n+ let tokens = tokenize_prose_item_refs(\"https://example.com/a/b.\\n-/example.com/a/b\");\n+ assert_eq!(\n+ tokens,\n+ vec![\n+ ProseToken::ItemRef(\"https://example.com/a/b\".to_string()),\n+ ProseToken::Text(\".\\n\".to_string()),\n+ ProseToken::ItemRef(\"-/example.com/a/b\".to_string()),\n+ ]\n+ );\n+ }\n+\n+ #[test]\n+ fn prose_tokenizer_does_not_linkify_inside_code_fences() {\n+ let tokens = tokenize_prose_item_refs(\n+ \"before ```json\\n{\\\"url\\\":\\\"https://example.com\\\"}\\n``` after ~/x\",\n+ );\n+ assert_eq!(\n+ tokens,\n+ vec![\n+ ProseToken::Text(\n+ \"before ```json\\n{\\\"url\\\":\\\"https://example.com\\\"}\\n``` after \".to_string()\n+ ),\n+ ProseToken::ItemRef(\"~/x\".to_string()),\n+ ]\n+ );\n+ }\n+\n #[test]\n fn parse_item_with_body_strips_outer_braces() {\n let input = \"~/rust { Systems language }\";\n@@ -633,8 +828,8 @@ mod tests {\n }\n \n #[test]\n- fn parse_item_with_fenced_json_body_preserves_braces() {\n- let input = \"~/item/in/url ```json\\n{\\\"test\\\": true}\\n```\";\n+ fn parse_item_with_braced_fenced_json_body_preserves_braces() {\n+ let input = \"~/item/in/url {\\n```json\\n{\\\"test\\\": true}\\n```\\n}\";\n let doc = parse_full(input).unwrap();\n assert_eq!(\n doc.statements,\n@@ -645,6 +840,51 @@ mod tests {\n );\n }\n \n+ #[test]\n+ fn parse_rejects_singleton_fenced_json_item_body() {\n+ let input = \"~/item/in/url ```json\\n{\\\"test\\\": true}\\n```\";\n+ let err = parse_full(input).unwrap_err().to_string();\n+ assert!(\n+ err.contains(\"item bodies must use\"),\n+ \"unexpected error: {err}\"\n+ );\n+ }\n+\n+ #[test]\n+ fn parse_keeps_standalone_code_fence_as_prose() {\n+ let input = \"```json\\n{\\\"test\\\": true}\\n```\";\n+ let doc = parse_full(input).unwrap();\n+ assert_eq!(\n+ doc.statements,\n+ vec![Stmt::Prose {\n+ text: input.to_string(),\n+ }]\n+ );\n+ }\n+\n+ #[test]\n+ fn parse_rejects_code_fence_vote_explanation() {\n+ let input = \"```json\\n{\\\"why\\\": true}\\n```\\n~/a 2:1 ~/b\";\n+ let err = parse_full(input).unwrap_err().to_string();\n+ assert!(\n+ err.contains(\"vote explanations must start\"),\n+ \"unexpected error: {err}\"\n+ );\n+ }\n+\n+ #[test]\n+ fn parse_raw_url_item_with_braced_fenced_json_body() {\n+ let input = \"https://example.com/itembody/slug {\\n```json\\n{\\\"test\\\": true}\\n```\\n}\";\n+ let doc = parse_full(input).unwrap();\n+ assert_eq!(\n+ doc.statements,\n+ vec![Stmt::Item {\n+ title: \"https://example.com/itembody/slug\".to_string(),\n+ body: Some(\"```json\\n{\\\"test\\\": true}\\n```\".to_string()),\n+ }]\n+ );\n+ }\n+\n #[test]\n fn parse_vote_ratio_and_symbols() {\n let d1 = parse_full(\"{because}\\n~/a 3:1 ~/b\").unwrap();\ndiff --git a/server/src/external_resolver.rs b/server/src/external_resolver.rs\nindex 8481f1fbff1c4265da182a225f539f97d6829002..04bc3de32b6df1aefe197d942db67de2cbdbde4f 100644\n--- a/server/src/external_resolver.rs\n+++ b/server/src/external_resolver.rs\n@@ -256,7 +256,7 @@ fn children_to_dsl(children: &[ResolvedChild]) -> String {\n .filter(|s| !s.trim().is_empty())\n .unwrap_or(child.title.as_str());\n if body.trim_start().starts_with(\"```\") {\n- out.push_str(&format!(\"{} {}\\n\\n\", child.url, body.trim()));\n+ out.push_str(&format!(\"{} {{\\n{}\\n}}\\n\\n\", child.url, body.trim()));\n } else {\n out.push_str(&format!(\n \"{} {{\\n{}\\n}}\\n\\n\",\n@@ -378,7 +378,8 @@ mod tests {\n title: \"#1 title\".into(),\n body: Some(\"```json\\n{\\\"test\\\": true}\\n```\".into()),\n }]);\n- assert!(dsl.contains(\"https://github.com/o/r/issues/1 ```json\"));\n+ assert!(dsl.contains(\"https://github.com/o/r/issues/1 {\\n```json\"));\n assert!(dsl.contains(\"{\\\"test\\\": true}\"));\n+ assert!(dsl.contains(\"```\\n}\\n\"));\n }\n }\ndiff --git a/server/src/html/breadcrumb_path.rs b/server/src/html/breadcrumb_path.rs\nindex 3e949ce2cb70de3f024f46af773a93f3f8852260..e48612d7d3c4df52c161499a11865d4caca607aa 100644\n--- a/server/src/html/breadcrumb_path.rs\n+++ b/server/src/html/breadcrumb_path.rs\n@@ -88,16 +88,12 @@ impl ExternalOntologyPath {\n .filter(|x| !x.is_empty())\n .map(|x| x.to_string())\n .collect();\n- let segments = if segments == [\".\"] {\n- vec![]\n- } else {\n- segments\n- };\n+ let segments = if segments == [\".\"] { vec![] } else { segments };\n Self { item, segments }\n }\n \n pub(super) fn is_root(&self) -> bool {\n- self.segments.len() <= 1\n+ self.segments.is_empty()\n }\n \n pub(super) fn segments(&self) -> &[String] {\n@@ -108,3 +104,28 @@ impl ExternalOntologyPath {\n self.item.as_str()\n }\n }\n+\n+#[cfg(test)]\n+mod tests {\n+ use super::*;\n+\n+ #[test]\n+ fn external_root_and_host_paths_are_distinct() {\n+ let root = ExternalOntologyPath::from_input(\"\");\n+ assert!(root.is_root());\n+ assert!(root.segments().is_empty());\n+\n+ let host = ExternalOntologyPath::from_input(\"example.com\");\n+ assert!(!host.is_root());\n+ assert_eq!(host.segments(), &[\"example.com\".to_string()]);\n+ }\n+\n+ #[test]\n+ fn external_path_keeps_each_url_segment_for_breadcrumbs() {\n+ let path = ExternalOntologyPath::from_input(\"https://example.com/a/b\");\n+ assert_eq!(\n+ path.segments(),\n+ &[\"example.com\".to_string(), \"a\".to_string(), \"b\".to_string()]\n+ );\n+ }\n+}\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 8876a1a00a16ee3bf7a371f7a5ca27b5862b62cc..d5877eeb3632ed5d770f23a04cb4d1881209bc74 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -20,27 +20,30 @@ mod search;\n pub mod ui_action;\n use breadcrumb_path::{ExternalOntologyPath, OntologyPath};\n \n-pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};\n+pub use auth::{\n+ auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment,\n+ choose_username_page,\n+};\n pub use editor::{editor_check, editor_page};\n pub use forum::{\n home, room_page, room_thread_post_view, room_thread_view, thread_feed_html,\n thread_feed_html_for_room, thread_feed_region_markup, thread_post_view, thread_view, ThreadNav,\n };\n \n+pub use forum::user_profile_page;\n pub(crate) use forum::{\n fragment_new_thread_slot, login_to_post_hint_markup, room_members_section_markup,\n thread_ui_collapse_redacted_post, thread_ui_expand_post_full, thread_ui_expand_redacted_post,\n user_can_post_room, user_can_view_room,\n };\n+pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};\n pub use garden::{\n external_garden_index, external_ontology_path, garden_index, ontology_path,\n- room_external_garden_index, room_external_ontology_path, room_garden_index,\n- room_ontology_path, room_vote_compare_page, vote_compare_page,\n+ room_external_garden_index, room_external_ontology_path, room_garden_index, room_ontology_path,\n+ room_vote_compare_page, vote_compare_page,\n };\n-pub(crate) use garden::{encode_pin_cookie_value, vote_compare_post_success_js, GARDEN_PIN_COOKIE};\n pub use routing::RouteContext;\n pub use search::{search_page, search_results_fragment};\n-pub use forum::user_profile_page;\n pub use ui_action::{parse_html_ui_from_form, HtmlUiAction, HtmlUiParseError, UI_RPC_FIELD};\n \n /// Public profile URL path for a stored username (no `@`).\n@@ -107,8 +110,8 @@ pub struct ThemeForm {\n pub async fn post_theme(Form(form): Form) -> impl IntoResponse {\n let theme = normalize_theme(&form.theme);\n let next = sanitize_theme_next(form.next.as_deref());\n- let loc = HeaderValue::try_from(next.as_str())\n- .unwrap_or_else(|_| HeaderValue::from_static(\"/\"));\n+ let loc =\n+ HeaderValue::try_from(next.as_str()).unwrap_or_else(|_| HeaderValue::from_static(\"/\"));\n Response::builder()\n .status(StatusCode::SEE_OTHER)\n .header(header::LOCATION, loc)\n@@ -179,7 +182,9 @@ pub(crate) struct JsQueryBuilder {\n \n impl JsBuilder {\n pub(crate) fn new() -> Self {\n- Self { snippets: Vec::new() }\n+ Self {\n+ snippets: Vec::new(),\n+ }\n }\n \n pub(crate) fn morph_selector(self, selector: &str, markup: Markup) -> Self {\n@@ -195,7 +200,12 @@ impl JsBuilder {\n self.qs(selector).morph_inner(markup)\n }\n \n- pub(crate) fn morph_expr(mut self, expr: &str, markup: Markup, morph_style: Option<&str>) -> Self {\n+ pub(crate) fn morph_expr(\n+ mut self,\n+ expr: &str,\n+ markup: Markup,\n+ morph_style: Option<&str>,\n+ ) -> Self {\n let html = js_string_literal(&markup.into_string());\n let opts = morph_style\n .map(|style| format!(\", {{morphStyle: {}}}\", js_string_literal(style)))\n@@ -217,7 +227,11 @@ impl JsBuilder {\n self.qs(&format!(\"#{id}\"))\n }\n \n- pub(crate) fn if_current_path_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {\n+ pub(crate) fn if_current_path_matches(\n+ mut self,\n+ path: &str,\n+ f: impl FnOnce(JsBuilder) -> JsBuilder,\n+ ) -> Self {\n let inner = f(JsBuilder::new()).build();\n self.snippets.push(format!(\n \"var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0) {{ {inner} }}\",\n@@ -226,7 +240,11 @@ impl JsBuilder {\n self\n }\n \n- pub(crate) fn if_current_path_not_matches(mut self, path: &str, f: impl FnOnce(JsBuilder) -> JsBuilder) -> Self {\n+ pub(crate) fn if_current_path_not_matches(\n+ mut self,\n+ path: &str,\n+ f: impl FnOnce(JsBuilder) -> JsBuilder,\n+ ) -> Self {\n let inner = f(JsBuilder::new()).build();\n self.snippets.push(format!(\n \"var __slugHere = window.location.pathname + window.location.search; var __slugPath = {path}; if (!(__slugHere === __slugPath || __slugHere.indexOf(__slugPath + '?') === 0)) {{ {inner} }}\",\n@@ -301,7 +319,17 @@ pub(super) fn layout(\n garden_room_wire: Option<&str>,\n garden_path_prefix: Option<&str>,\n ) -> Markup {\n- layout_embed_controls(title, view, body, views, theme, theme_next, garden_room_wire, garden_path_prefix, true)\n+ layout_embed_controls(\n+ title,\n+ view,\n+ body,\n+ views,\n+ theme,\n+ theme_next,\n+ garden_room_wire,\n+ garden_path_prefix,\n+ true,\n+ )\n }\n \n /// Minimal document shell: no bottom controls, no garden HUD data attributes (`data-garden-room` /\n@@ -315,15 +343,7 @@ pub(super) fn layout_full_bleed_chromeless(\n theme_next: &str,\n ) -> Markup {\n layout_embed_controls(\n- title,\n- view,\n- body,\n- views,\n- theme,\n- theme_next,\n- None,\n- None,\n- false,\n+ title, view, body, views, theme, theme_next, None, None, false,\n )\n }\n \n@@ -545,7 +565,58 @@ fn item_body_title_snippet(body: &str) -> Option {\n Some(format!(\"{truncated}{ellipsis}\"))\n }\n \n-/// Replace ~/path slugs in raw text with clickable links.\n+fn garden_href_for_item_ref(\n+ raw_ref: &str,\n+ garden_prefix: &str,\n+) -> Option<(crate::path_types::ItemId, String)> {\n+ let key = slug_types::canonicalize_item(raw_ref);\n+ let id = crate::path_types::ItemId::parse(&key)?;\n+ let href = if let Some(tail) = id.tilde_tail() {\n+ if tail.is_empty() {\n+ garden_prefix.trim_end_matches('/').to_string()\n+ } else {\n+ format!(\"{}/{}\", garden_prefix.trim_end_matches('/'), tail)\n+ }\n+ } else if id.as_str().starts_with(\"https://\") || id.as_str().starts_with(\"http://\") {\n+ let display = id.display_path();\n+ let rest = display.strip_prefix(\"-/\").unwrap_or(display.as_str());\n+ let ext_prefix = format!(\"{}-\", garden_prefix.trim_end_matches('~'));\n+ format!(\"{}/{}\", ext_prefix, rest)\n+ } else {\n+ return None;\n+ };\n+ Some((id, href))\n+}\n+\n+fn push_item_ref_anchor(\n+ out: &mut String,\n+ raw_ref: &str,\n+ garden_prefix: &str,\n+ item_bodies: Option<&HashMap>,\n+) -> bool {\n+ let Some((id, href)) = garden_href_for_item_ref(raw_ref, garden_prefix) else {\n+ return false;\n+ };\n+ out.push_str(r#\"');\n+ out.push_str(&escape_html(raw_ref));\n+ out.push_str(\"\");\n+ true\n+}\n+\n+/// Replace item refs in raw prose with clickable garden links.\n ///\n /// When `item_bodies` is set, matching ontology items get a `title` attribute with a truncated\n /// body preview for native browser tooltips (forum posts, item pages).\n@@ -554,53 +625,16 @@ pub(super) fn linkify_slugs_with_prefix(\n garden_prefix: &str,\n item_bodies: Option<&HashMap>,\n ) -> String {\n- let escaped = escape_html(raw);\n- let mut out = String::with_capacity(escaped.len() + 64);\n- let mut i = 0;\n- let s = escaped.as_str();\n- while i < s.len() {\n- let rest = &s[i..];\n- if let Some(after_tilde) = rest.strip_prefix(\"~/\") {\n- let path_len = after_tilde\n- .chars()\n- .take_while(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-' || *c == '/')\n- .map(|c| c.len_utf8())\n- .sum::();\n- if path_len > 0 {\n- let path = &after_tilde[..path_len];\n- out.push_str(r#\" out.push_str(&escape_html(&text)),\n+ crate::dsl::ProseToken::ItemRef(raw_ref) => {\n+ if !push_item_ref_anchor(&mut out, &raw_ref, garden_prefix, item_bodies) {\n+ out.push_str(&escape_html(&raw_ref));\n }\n- out.push('>');\n- out.push_str(\"~/\");\n- out.push_str(path);\n- out.push_str(\"\");\n- i += 2 + path_len;\n- continue;\n }\n }\n- if let Some((j, c)) = rest.char_indices().next() {\n- out.push(c);\n- i += j + c.len_utf8();\n- } else {\n- break;\n- }\n }\n out\n }\n@@ -638,7 +672,13 @@ fn spotify_embed_src(url: &str) -> Option {\n if !(host == \"open.spotify.com\" || host == \"www.open.spotify.com\") {\n return None;\n }\n- let path = tail.split('#').next().unwrap_or(tail).split('?').next().unwrap_or(tail);\n+ let path = tail\n+ .split('#')\n+ .next()\n+ .unwrap_or(tail)\n+ .split('?')\n+ .next()\n+ .unwrap_or(tail);\n let mut segs: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();\n if segs.first().is_some_and(|s| s.starts_with(\"intl-\")) {\n segs.remove(0);\n@@ -670,8 +710,16 @@ fn youtube_embed_src(url: &str) -> Option {\n let host = host.to_lowercase();\n \n let video_id = if host == \"youtu.be\" || host == \"www.youtu.be\" {\n- clean_media_id(tail.split(['?', '#']).next().unwrap_or(tail).trim_matches('/'))\n- } else if matches!(host.as_str(), \"youtube.com\" | \"www.youtube.com\" | \"m.youtube.com\" | \"music.youtube.com\") {\n+ clean_media_id(\n+ tail.split(['?', '#'])\n+ .next()\n+ .unwrap_or(tail)\n+ .trim_matches('/'),\n+ )\n+ } else if matches!(\n+ host.as_str(),\n+ \"youtube.com\" | \"www.youtube.com\" | \"m.youtube.com\" | \"music.youtube.com\"\n+ ) {\n let path = format!(\"/{}\", tail.split('#').next().unwrap_or(tail));\n if path.starts_with(\"/watch\") {\n clean_media_id(&query_param(url, \"v\")?)\n@@ -745,10 +793,7 @@ pub(super) fn render_linkified_with_embeds_in_scope(\n /// CLI strings are embedded in a single-quoted JS literal; they must never need escaping.\n fn assert_cli_panel_cmd_js_single_quote_safe(s: &str) {\n assert!(\n- !s.contains('\\\\')\n- && !s.contains('\\'')\n- && !s.contains('\\n')\n- && !s.contains('\\r'),\n+ !s.contains('\\\\') && !s.contains('\\'') && !s.contains('\\n') && !s.contains('\\r'),\n \"cli_panel cmd must not contain `\\\\`, `'`, or newlines (got {s:?})\"\n );\n }\n@@ -805,15 +850,40 @@ mod linkify_title_tests {\n let mut bodies = HashMap::new();\n let key = ItemId::parse(&slug_types::canonicalize_item(\"~/foo/bar\")).unwrap();\n bodies.insert(key, \"Hello world\\nline\".to_string());\n- let html = linkify_slugs_with_prefix(\n- \"see ~/foo/bar ok\",\n- \"/r/x/~\",\n- Some(&bodies),\n- );\n+ let html = linkify_slugs_with_prefix(\"see ~/foo/bar ok\", \"/r/x/~\", Some(&bodies));\n assert!(html.contains(\"title=\\\"Hello world line\\\"\"));\n assert!(html.contains(\"href=\\\"/r/x/~/foo/bar\\\"\"));\n }\n \n+ #[test]\n+ fn raw_url_links_to_public_external_garden_page() {\n+ let html = linkify_slugs_with_prefix(\"see https://example.com/z.\", \"/~\", None);\n+ assert!(html\n+ .contains(r#\"https://example.com/z.\"#));\n+ }\n+\n+ #[test]\n+ fn dash_ref_links_to_room_external_garden_page_with_title() {\n+ let mut bodies = HashMap::new();\n+ let key = ItemId::parse(&slug_types::canonicalize_item(\"-/example.com/z\")).unwrap();\n+ bodies.insert(key, \"External body\\npreview\".to_string());\n+ let html =\n+ linkify_slugs_with_prefix(\"see -/example.com/z\", \"/r/9ab12cdroom/~\", Some(&bodies));\n+ assert!(html.contains(r#\"href=\"/r/9ab12cdroom/-/example.com/z\"\"#));\n+ assert!(html.contains(r#\"title=\"External body preview\"\"#));\n+ }\n+\n+ #[test]\n+ fn code_fence_urls_are_not_linkified() {\n+ let html = linkify_slugs_with_prefix(\n+ \"```json\\n{\\\"url\\\":\\\"https://example.com/z\\\"}\\n```\\nthen https://example.com/a\",\n+ \"/~\",\n+ None,\n+ );\n+ assert!(!html.contains(r#\"href=\"/-/example.com/z\"\"#));\n+ assert!(html.contains(r#\"href=\"/-/example.com/a\"\"#));\n+ }\n+\n #[test]\n fn no_title_when_body_missing_or_empty() {\n let html = linkify_slugs_with_prefix(\"x ~/a/b y\", \"/~\", Some(&HashMap::new()));\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}