amadan
plan: slice 4, chat and screen share
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CzvnuKhLzudvq7jZ7SvVt2
1 file changed,
+482
−0
docs/superpowers/plans/2026-09-10-meet-slice-4-chat.md+482 −0
CI passed — run details
diff --git a/docs/superpowers/plans/2026-09-10-meet-slice-4-chat.md b/docs/superpowers/plans/2026-09-10-meet-slice-4-chat.md| new file mode 100644 |
| index 0000000..d3f57e2 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/2026-09-10-meet-slice-4-chat.md |
| @@ -0,0 +1,482 @@ |
| +# Meet slice 4: chat and screen share — Implementation Plan |
| + |
| +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. |
| + |
| +**Goal:** An admitted participant can send a short text message that every other admitted participant sees at once and nobody else ever sees, and can share a screen that arrives at every peer as a second labelled video tile which goes away the moment sharing stops. |
| + |
| +**Architecture:** The hub gains one fan-out primitive (`Fanout`) for the two untargeted message types: sender must be an admitted participation bound to this session (the same authority as a relay message, §2.5 last row, §15.12), recipients are every other admitted peer, nothing is ringed or stored. `/signal` validates the two payload shapes (`chat {text}` ≤ 2 KB, `share {on}`) and dispatches. The chat panel is estilo's first chat: one self-contained template partial and one script file with a tiny mount API, adopted by `room.html` and driven by `room.js` through a broadcast lane in its existing outbound queue. Screen share is a `getDisplayMedia` track added as its own transceiver on every connection with a `share` message so peers label the tile; stopping stops the transceiver and renegotiates so the receiver's track ends. The gate proves chat reaches the admitted context and not a waiting one, and the share round trip with frames. |
| + |
| +**Tech Stack:** Go 1.25 (rastrillo v0.26.0, chi), hand-written `chat.js` and `room.js`, Playwright 1.62.1 on Chromium, `codex exec` for the independent review. |
| + |
| +**Spec:** `docs/superpowers/specs/2026-09-07-meet-design.md` revision 9: §4.3 (the `chat` and `share` rows and the recipient rule), §4.4 (2 KB, nothing of an accepted message in a log), §5.1 (renegotiation), §5.4 (screen share), §6 (chat), §10 (estilo: the panel is one partial and one script so a second app can adopt it), §12 item 4, §13 (the slice-4 gates: the captured-log test extended to accepted chat; no `chat` while waiting; the share round trip; chat arrives at the admitted context and not a waiting one). |
| + |
| +## Global Constraints |
| + |
| +- `CGO_ENABLED=0` throughout; `make ci` is the gate on every task; `make race` and `make browser` (sandbox OFF: UDP is blocked inside the Claude Code sandbox; the gate takes about seven minutes; `X-Meet-Test-Ice-TTL` values must be multiples of 6 s) on the tasks that name them. |
| +- No schema change. Chat is not stored, not replayed, not ringed; gone with the tab (§6). |
| +- `chat` text is at most 2048 bytes of UTF-8, refused above with 413 (§4.4); the server reads nothing inside `chat` beyond the byte length and rebuilds the envelope with the sender's name; the text never reaches a log line, and neither does anything of an accepted message (§4.4). |
| +- Recipients: every **other** admitted peer in the room (the sender's own panel renders locally on send); a waiting guest receives nothing (§4.3, ruling 9). |
| +- A 404 is never a 403; the `/signal` not-found body is unchanged. |
| +- DOM safety: chat text is rendered with `textContent` only; no `innerHTML`, no linkification (§6); peer names come only from the envelope. |
| +- The chat panel is one partial (`internal/meet/templates/partials/chat.html`) and one script (`internal/meet/static/chat.js`) with no dependency on `room.js` internals: `Chat.mount(root, {send})` returns `{append({from, text, at, self}), setEnabled(bool)}`; a second app can adopt both files unchanged. |
| +- Screen share: one `sendonly` video transceiver per connection carrying the display track; stop calls `transceiver.stop()` and renegotiates so the receiver's track **ends**; the receiver removes the share tile on `ended` or `share {on:false}`, whichever first, and the camera tile continues (§5.4). One sharer at a time is not enforced. |
| +- Copy review is waived this round per suite discussion 5; every new string is catalogued in `docs/superpowers/copy/2026-09-10-slice-2-strings.md` under "## Slice 4". |
| +- Screens work without JavaScript; the room page's scriptless paragraph is unchanged; the chat panel is inside `#room` (hidden without script). |
| +- Commits: `git -c user.name="Paul Campbell" -c user.email="paul@rslw.com" commit`, files by name, never `.claude/`, `node_modules` or `package-lock.json`; trailers `Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>` and `Claude-Session: https://claude.ai/code/session_01CzvnuKhLzudvq7jZ7SvVt2`. |
| + |
| +--- |
| + |
| +## File structure |
| + |
| +- `internal/meet/hub/fanout.go` (+ `fanout_test.go`) — `Fanout`. |
| +- `internal/meet/signal.go` — the `chat`/`share` arms and payload validation; `internal/meettest/signal_test.go` — the accepted-chat log extension; `internal/meettest/chat_test.go` — recipients over HTTP. |
| +- `internal/meet/templates/partials/chat.html`, `internal/meet/static/chat.js`, `internal/meet/static/chat.css` — the panel (estilo's first chat). |
| +- `internal/meet/templates/room.html` — mounts the partial; `internal/meet/static/room.js` — the broadcast lane, chat wiring, screen share; `internal/meet/static/meet.css` — share tile and the share button. |
| +- `test/browser/call.mjs`, `internal/meettest/browser_test.go` — scenarios `chat`, `share`. |
| +- `docs/superpowers/copy/2026-09-10-slice-2-strings.md`, `docs/superpowers/reviews/2026-09-10-slice-4-record.md`, spec §15.15. |
| + |
| +--- |
| + |
| +### Task 1: `hub.Fanout`: an untargeted message from an admitted peer to every other admitted peer |
| + |
| +**Files:** |
| +- Create: `internal/meet/hub/fanout.go`, `internal/meet/hub/fanout_test.go` |
| + |
| +**Interfaces:** |
| +- Consumes: `memberStandingGone(ctx, sqid, session, peer, end bool) (bool, error)` (relay.go), `findLocked`, `roomLocked`/`h.rooms`, `broadcastLocked`, `audience`, `Message`, `ErrUnknownPeer`, `ErrNotAdmitted`, `ErrNotYours`, `ErrNotTargeted` (read `Authorize` in authorize.go for the exact shape of the standing step). |
| +- Produces: |
| + ```go |
| + // Fanout delivers m to every admitted peer in the room except the sender. |
| + // Sender: bound to this session, admitted; a member-kind participation |
| + // re-derives standing first (§15.12) and is ended with lost{standing} |
| + // when it is gone (ErrNotYours). m.Type must be chat or share |
| + // (ErrNotFanout otherwise). The envelope is rebuilt: {Type, From, Name, |
| + // Payload}; no To, Seq or Gen; nothing is ringed. |
| + func (h *Hub) Fanout(ctx context.Context, sqid, session string, from PeerID, m Message) error |
| + var ErrNotFanout = errors.New("hub: not a fan-out type") |
| + ``` |
| + |
| +- [ ] **Step 1: Write the failing tests** |
| + |
| +```go |
| +package hub |
| + |
| +import ( |
| + "context" |
| + "encoding/json" |
| + "errors" |
| + "testing" |
| + "time" |
| +) |
| + |
| +func TestFanoutReachesEveryOtherAdmittedPeerAndNobodyElse(t *testing.T) { |
| + now := time.Date(2026, 9, 10, 9, 0, 0, 0, time.UTC) |
| + h := testHub(&now) |
| + ctx := context.Background() |
| + a, _ := h.Open("r1", "sa", 1, "Ann", KindMember) |
| + h.Join(ctx, "r1", "sa", a.Peer) |
| + b, _ := h.Open("r1", "sb", 2, "Bob", KindMember) |
| + h.Join(ctx, "r1", "sb", b.Peer) |
| + g, _ := h.Open("r1", "sg", 100, "Gus", KindGuest) |
| + h.Join(ctx, "r1", "sg", g.Peer) // waiting |
| + drain(a.Sub) |
| + drain(b.Sub) |
| + drain(g.Sub) |
| + |
| + err := h.Fanout(ctx, "r1", "sa", a.Peer, Message{Type: TypeChat, Payload: json.RawMessage(`{"text":"hi"}`)}) |
| + if err != nil { |
| + t.Fatal(err) |
| + } |
| + got := events(b.Sub) |
| + if len(got) != 1 || got[0].Type != TypeChat || got[0].From != a.Peer || got[0].Name != "Ann" || string(got[0].Payload) != `{"text":"hi"}` || got[0].To != "" || got[0].Seq != 0 || got[0].Gen != 0 { |
| + t.Fatalf("Bob got %+v", got) |
| + } |
| + if n := len(events(a.Sub)); n != 0 { |
| + t.Fatalf("the sender must not receive its own chat, got %d", n) |
| + } |
| + if n := len(events(g.Sub)); n != 0 { |
| + t.Fatalf("a waiting guest must receive nothing, got %d", n) |
| + } |
| + if n := len(peerOf(h, "r1", b.Peer).ring); n != 0 { |
| + t.Fatalf("chat is never ringed, ring has %d", n) |
| + } |
| +} |
| + |
| +func TestFanoutNeedsAnAdmittedSenderBoundToThisSession(t *testing.T) { |
| + now := time.Date(2026, 9, 10, 9, 0, 0, 0, time.UTC) |
| + h := testHub(&now) |
| + ctx := context.Background() |
| + a, _ := h.Open("r1", "sa", 1, "Ann", KindMember) |
| + msg := Message{Type: TypeChat, Payload: json.RawMessage(`{"text":"hi"}`)} |
| + if err := h.Fanout(ctx, "r1", "sa", a.Peer, msg); !errors.Is(err, ErrNotAdmitted) { |
| + t.Fatalf("unjoined: %v", err) |
| + } |
| + h.Join(ctx, "r1", "sa", a.Peer) |
| + if err := h.Fanout(ctx, "r1", "sb", a.Peer, msg); !errors.Is(err, ErrUnknownPeer) { |
| + t.Fatalf("another session: %v", err) |
| + } |
| + if err := h.Fanout(ctx, "r2", "sa", a.Peer, msg); !errors.Is(err, ErrUnknownPeer) { |
| + t.Fatalf("another room: %v", err) |
| + } |
| + g, _ := h.Open("r1", "sg", 100, "Gus", KindGuest) |
| + h.Join(ctx, "r1", "sg", g.Peer) |
| + if err := h.Fanout(ctx, "r1", "sg", g.Peer, msg); !errors.Is(err, ErrNotAdmitted) { |
| + t.Fatalf("waiting guest: %v", err) |
| + } |
| + if err := h.Fanout(ctx, "r1", "sa", a.Peer, Message{Type: TypeOffer}); !errors.Is(err, ErrNotFanout) { |
| + t.Fatalf("a targeted type is not a fan-out: %v", err) |
| + } |
| +} |
| + |
| +func TestFanoutDropsAMemberWhoseStandingIsGoneAndKeepsAnAdmittedGuest(t *testing.T) { |
| + // Copy the fixture from authorize_test.go's standing test (the hub |
| + // whose StandingFor consults a mutable map): revoke Ann's standing, |
| + // Fanout → ErrNotYours, Ann's participation is gone, Bob's stream got |
| + // `gone` naming Ann and no chat. Then an admitted guest past expiry |
| + // (StandingFor !ok for the guest) fans out successfully (ruling 14). |
| +} |
| +``` |
| + |
| +Use the file's existing helpers (`testHub`, `drain`, `events`, and a `peerOf` lookup; if `peerOf` does not exist, read the participation through `h.Find(sqid, session, peer)` under the test's own lock discipline as other hub tests do). |
| + |
| +- [ ] **Step 2: Run to see them fail**: `GOCACHE=/home/paulca/.cache/tmp/claude-1001/gocache CGO_ENABLED=0 go test ./internal/meet/hub/ -run Fanout` — compile error, `Fanout` undefined. |
| + |
| +- [ ] **Step 3: Implement** (`internal/meet/hub/fanout.go`) |
| + |
| +```go |
| +package hub |
| + |
| +import ( |
| + "context" |
| + "errors" |
| +) |
| + |
| +// ErrNotFanout is a Fanout of a type that is targeted or server-raised. |
| +var ErrNotFanout = errors.New("hub: not a fan-out type") |
| + |
| +// Fanout is §4.3's chat and share: an admitted peer to every other |
| +// admitted peer, the envelope rebuilt from the sender's participation |
| +// so from and name can never be forged, nothing ringed or stored (§6). |
| +// The sender's authority is §2.5's last row, exactly as Relay's: a |
| +// member-kind participation re-derives standing first (§15.12) and one |
| +// whose standing is gone is ended here with lost{standing}; a guest |
| +// never consults standing (ruling 14). |
| +func (h *Hub) Fanout(ctx context.Context, sqid, session string, from PeerID, m Message) error { |
| + if m.Type != TypeChat && m.Type != TypeShare { |
| + return ErrNotFanout |
| + } |
| + if gone, err := h.memberStandingGone(ctx, sqid, session, from, true); err != nil { |
| + return err |
| + } else if gone { |
| + return ErrNotYours |
| + } |
| + h.mu.Lock() |
| + defer h.mu.Unlock() |
| + p, ok := h.findLocked(sqid, session, from) |
| + if !ok { |
| + return ErrUnknownPeer |
| + } |
| + if !p.Admitted { |
| + return ErrNotAdmitted |
| + } |
| + r := h.rooms[sqid] |
| + out := Message{Type: m.Type, From: p.Peer, Name: p.Name, Payload: m.Payload} |
| + h.broadcastLocked(r, out, func(q *Participation) bool { return q.Admitted && q.Peer != p.Peer }) |
| + return nil |
| +} |
| +``` |
| + |
| +(Read `memberStandingGone`'s real return contract and `Relay`'s mapping of it before writing the two lines that use it; mirror `Authorize`.) |
| + |
| +- [ ] **Step 4: Run to see them pass; gate**: `make ci` and `CGO_ENABLED=1 go test -race ./internal/meet/hub/`. |
| + |
| +- [ ] **Step 5: Commit** |
| + |
| +```bash |
| +git add internal/meet/hub/fanout.go internal/meet/hub/fanout_test.go |
| +git -c user.name="Paul Campbell" -c user.email="paul@rslw.com" commit -m "hub: Fanout, an untargeted message to every other admitted peer |
| + |
| +Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
| +Claude-Session: https://claude.ai/code/session_01CzvnuKhLzudvq7jZ7SvVt2" |
| +``` |
| + |
| +--- |
| + |
| +### Task 2: `/signal` dispatches `chat` and `share` |
| + |
| +**Files:** |
| +- Modify: `internal/meet/signal.go` (the `case hub.TypeChat, hub.TypeShare` arm and a `validateFanout` helper), `internal/meettest/signal_test.go` (the captured-log test gains an accepted chat and a refused oversize chat), `internal/meettest/sse_test.go` only if a helper is missing |
| +- Create: `internal/meettest/chat_test.go` |
| + |
| +**Interfaces:** |
| +- Consumes: `hub.Fanout`, `hub.ErrNotFanout`, the existing error mapping switch, `refuseSignal`, `client.signal(sqid, peer, body)`, `sseReader.nextOf`, `guestJoinedAndWaiting` (ice_test.go), `newHarnessWithLogger(t, env, logger, members...)`. |
| +- Produces: the wire: `POST /m/{sqid}/signal {"peer", "type":"chat", "payload":{"text":"…"}}` → 200 on acceptance; 413 `{"error":"too-large"}` when the text exceeds 2048 bytes; 400 `{"error":"bad-request"}` for a payload that is not `{text: string}` (chat) or `{on: bool}` (share) or that has other keys; the usual 404s. Downstream event: `event: chat` / `event: share` with `{type, from, name, payload}`. |
| + |
| +- [ ] **Step 1: Write the failing tests** (`internal/meettest/chat_test.go`) |
| + |
| +```go |
| +package meettest |
| + |
| +import ( |
| + "net/http" |
| + "strings" |
| + "testing" |
| + "time" |
| +) |
| + |
| +func TestChatReachesTheOtherAdmittedPeerWithTheSendersNameAndNotTheSender(t *testing.T) { |
| + x, sqid, _ := memberWithMeeting(t) |
| + a := x.browser(t) |
| + a.signIn("paul@example.com") |
| + sa := a.stream("/m/" + sqid + "/stream") |
| + defer sa.close() |
| + pa, _ := sa.hello() |
| + a.signal(sqid, pa, map[string]any{"type": "join"}) |
| + sa.nextOf("roster", 2*time.Second) |
| + b := x.browser(t) |
| + b.signIn("paul@rslw.com") |
| + sb := b.stream("/m/" + sqid + "/stream") |
| + defer sb.close() |
| + pb, _ := sb.hello() |
| + b.signal(sqid, pb, map[string]any{"type": "join"}) |
| + sb.nextOf("roster", 2*time.Second) |
| + sa.nextOf("peer", 2*time.Second) |
| + |
| + res, _ := a.signal(sqid, pa, map[string]any{"type": "chat", "payload": map[string]any{"text": "hello there"}}) |
| + if res.StatusCode != http.StatusOK { |
| + t.Fatalf("chat: %d", res.StatusCode) |
| + } |
| + ev, data, ok := sb.nextOf("chat", 2*time.Second) |
| + if !ok || ev != "chat" { |
| + t.Fatal("Bob did not receive the chat") |
| + } |
| + s := string(data) |
| + if !strings.Contains(s, `"from":"`+pa+`"`) || !strings.Contains(s, `"name":"paul"`) || !strings.Contains(s, `"text":"hello there"`) || strings.Contains(s, `"seq"`) || strings.Contains(s, `"to"`) { |
| + t.Fatalf("envelope %s", s) |
| + } |
| + if ev, _, ok := sa.next(300 * time.Millisecond); ok && ev == "chat" { |
| + t.Fatal("the sender received its own chat") |
| + } |
| +} |
| + |
| +func TestChatNeverReachesAWaitingGuestAndAWaitingGuestCannotSend(t *testing.T) { |
| + x, sqid, _ := memberWithMeeting(t) |
| + a := x.browser(t) |
| + a.signIn("paul@example.com") |
| + sa := a.stream("/m/" + sqid + "/stream") |
| + defer sa.close() |
| + pa, _ := sa.hello() |
| + a.signal(sqid, pa, map[string]any{"type": "join"}) |
| + sa.nextOf("roster", 2*time.Second) |
| + g, gpeer := guestJoinedAndWaiting(t, x, sqid) // its stream is g.s or returned; adapt to the helper's shape |
| + sa.nextOf("knock", 2*time.Second) |
| + |
| + a.signal(sqid, pa, map[string]any{"type": "chat", "payload": map[string]any{"text": "secret"}}) |
| + if ev, data, ok := g.stream.next(500 * time.Millisecond); ok && (ev == "chat" || strings.Contains(string(data), "secret")) { |
| + t.Fatalf("a waiting guest received %s %s", ev, data) |
| + } |
| + res, body := g.signal(sqid, gpeer, map[string]any{"type": "chat", "payload": map[string]any{"text": "let me in"}}) |
| + if res.StatusCode != http.StatusNotFound || !strings.Contains(string(body), `"error":"not-found"`) { |
| + t.Fatalf("a waiting guest's chat must be the usual 404: %d %s", res.StatusCode, body) |
| + } |
| +} |
| + |
| +func TestChatLimitsAndShapes(t *testing.T) { |
| + x, sqid, _ := memberWithMeeting(t) |
| + a := x.browser(t) |
| + a.signIn("paul@example.com") |
| + sa := a.stream("/m/" + sqid + "/stream") |
| + defer sa.close() |
| + pa, _ := sa.hello() |
| + a.signal(sqid, pa, map[string]any{"type": "join"}) |
| + sa.nextOf("roster", 2*time.Second) |
| + cases := []struct { |
| + name string |
| + body map[string]any |
| + status int |
| + }{ |
| + {"2048 bytes ok", map[string]any{"type": "chat", "payload": map[string]any{"text": strings.Repeat("a", 2048)}}, 200}, |
| + {"2049 bytes too large", map[string]any{"type": "chat", "payload": map[string]any{"text": strings.Repeat("a", 2049)}}, 413}, |
| + {"multibyte counted in bytes", map[string]any{"type": "chat", "payload": map[string]any{"text": strings.Repeat("é", 1025)}}, 413}, |
| + {"text not a string", map[string]any{"type": "chat", "payload": map[string]any{"text": 5}}, 400}, |
| + {"extra key", map[string]any{"type": "chat", "payload": map[string]any{"text": "x", "html": "<b>"}}, 400}, |
| + {"empty text", map[string]any{"type": "chat", "payload": map[string]any{"text": ""}}, 400}, |
| + {"share on", map[string]any{"type": "share", "payload": map[string]any{"on": true}}, 200}, |
| + {"share off", map[string]any{"type": "share", "payload": map[string]any{"on": false}}, 200}, |
| + {"share not a bool", map[string]any{"type": "share", "payload": map[string]any{"on": "yes"}}, 400}, |
| + {"chat with a target", map[string]any{"type": "chat", "to": pa, "payload": map[string]any{"text": "x"}}, 400}, |
| + } |
| + for _, c := range cases { |
| + t.Run(c.name, func(t *testing.T) { |
| + res, _ := a.signal(sqid, pa, c.body) |
| + if res.StatusCode != c.status { |
| + t.Fatalf("%s: %d, want %d", c.name, res.StatusCode, c.status) |
| + } |
| + }) |
| + } |
| +} |
| +``` |
| + |
| +Extend `TestSignallingLogsCarryNoContent` (signal_test.go): after the existing rounds, send an accepted chat with a distinctive text (`"xyzzy-plugh-chat"`) and an oversize chat; assert the buffer never contains the text, and that the oversize refusal line carries `outcome=size` (or the file's outcome vocabulary) and no text. Also assert the accepted chat appended nothing to the log. |
| + |
| +- [ ] **Step 2: Run to see them fail** (`go test ./internal/meettest/ -run 'Chat|Logs'`): the chat cases get 400 from the slice-4 stub. |
| + |
| +- [ ] **Step 3: Implement** in `signal.go`: replace the stub arm with |
| + |
| +```go |
| + case hub.TypeChat, hub.TypeShare: |
| + if body.To != "" { |
| + a.refuseSignal(w, sqid, body.Peer, body.Type, http.StatusBadRequest, "shape", map[string]any{"error": "bad-request"}) |
| + return |
| + } |
| + if status, outcome := validateFanout(body.Type, body.Payload); status != 0 { |
| + a.refuseSignal(w, sqid, body.Peer, body.Type, status, outcome, map[string]any{"error": fanoutError(status)}) |
| + return |
| + } |
| + herr = a.hub.Fanout(r.Context(), sqid, session, body.Peer, hub.Message{Type: body.Type, Payload: body.Payload}) |
| +``` |
| + |
| +with |
| + |
| +```go |
| +// maxChatBytes is §4.4's 2 KB, counted in bytes of the text, not |
| +// characters: the limit protects the other peers' streams, which carry |
| +// bytes. |
| +const maxChatBytes = 2048 |
| + |
| +// validateFanout checks the two untargeted payload shapes without |
| +// keeping anything from them: chat is exactly {"text": string} with |
| +// 1..2048 bytes; share is exactly {"on": bool}. Returns a status and |
| +// an outcome word for the refusal log, or 0. |
| +func validateFanout(typ string, raw json.RawMessage) (int, string) { |
| + dec := json.NewDecoder(bytes.NewReader(raw)) |
| + dec.DisallowUnknownFields() |
| + switch typ { |
| + case hub.TypeChat: |
| + var p struct { |
| + Text *string `json:"text"` |
| + } |
| + if err := dec.Decode(&p); err != nil || p.Text == nil || dec.More() { |
| + return http.StatusBadRequest, "shape" |
| + } |
| + if len(*p.Text) == 0 { |
| + return http.StatusBadRequest, "shape" |
| + } |
| + if len(*p.Text) > maxChatBytes { |
| + return http.StatusRequestEntityTooLarge, "size" |
| + } |
| + case hub.TypeShare: |
| + var p struct { |
| + On *bool `json:"on"` |
| + } |
| + if err := dec.Decode(&p); err != nil || p.On == nil || dec.More() { |
| + return http.StatusBadRequest, "shape" |
| + } |
| + } |
| + return 0, "" |
| +} |
| + |
| +func fanoutError(status int) string { |
| + if status == http.StatusRequestEntityTooLarge { |
| + return "too-large" |
| + } |
| + return "bad-request" |
| +} |
| +``` |
| + |
| +Add `hub.ErrNotFanout` to the 400 arm of the error-mapping switch beside `ErrNotTargeted`. Keep `refuseSignal`'s log shape (room, peer, type, outcome only). |
| + |
| +- [ ] **Step 4: Gate**: `make ci`; `CGO_ENABLED=1 go test -race ./internal/...`. |
| + |
| +- [ ] **Step 5: Commit** `signal: chat and share fan out to every other admitted peer` with the trailers; files by name. |
| + |
| +--- |
| + |
| +### Task 3: The chat panel: estilo's first chat, one partial and one script |
| + |
| +**Files:** |
| +- Create: `internal/meet/templates/partials/chat.html`, `internal/meet/static/chat.js`, `internal/meet/static/chat.css` |
| +- Modify: `internal/meet/templates/room.html` (mount the partial inside `#room`, after `#tiles`/`#controls`, before `#queue`; load `chat.css` and `chat.js` from the head block with `defer`), `internal/meet/app.go` or `render.go` only if partials need registering (check how the vendored `ui/*` partials are parsed and follow it), `internal/meettest/room_test.go` (the panel renders, hidden without script, with its `data-*`), `docs/superpowers/copy/2026-09-10-slice-2-strings.md` ("## Slice 4") |
| + |
| +**Interfaces (the primitive's contract, §6 and §10):** |
| +- Partial `{{template "chat-panel" .}}` renders: |
| + ```html |
| + <section id="chat" class="chat" data-chat aria-label="Chat" hidden> |
| + <h2 class="chat-title">Chat</h2> |
| + <ol id="chat-log" class="chat-log" aria-live="polite" aria-relevant="additions"></ol> |
| + <form id="chat-form" class="chat-form"> |
| + <label for="chat-text" class="chat-label">Message</label> |
| + <textarea id="chat-text" name="text" rows="2" maxlength="2048" rst-input required></textarea> |
| + <button type="submit" id="chat-send" rst-btn>Send</button> |
| + <p id="chat-status" class="chat-status" role="status"></p> |
| + </form> |
| + </section> |
| + ``` |
| + (`hidden` because the whole room is script-only; `room.js` un-hides it on admission.) |
| +- `chat.js` defines `window.Chat = { mount(root, opts) }` with `opts.send(text) → Promise<boolean>` (resolves true when the message was accepted; the panel appends the local echo only then) and returns `{ append({from, name, text, at, self}), setEnabled(enabled), clear() }`. `append` creates `<li class="chat-line"><span class="chat-name">name</span> <time datetime=…>HH:MM</time> <span class="chat-text">text</span></li>` with `textContent` only; keeps the log scrolled to the newest line unless the reader has scrolled up; caps the log at 500 lines (drops the oldest). Enter sends, Shift+Enter is a newline. The status line says "Could not send. Try again." on a failed send and "Message is too long." when the textarea holds more than 2048 bytes (count with `TextEncoder`). No `innerHTML`, no linkification, no dependency on `room.js`. |
| +- `chat.css` uses the `--rst-*` tokens the theme defines (see `meet.css` for the ones in use); no colour alone for state. |
| + |
| +- [ ] **Step 1: Write the Go test** in `room_test.go`: the room page contains `id="chat"` with `hidden`, `id="chat-log"`, `id="chat-text"` with `maxlength="2048"`, and loads `/static/chat.js` from the head block with `defer` and `chat.css`; verify it fails before the partial exists. |
| +- [ ] **Step 2: Write the partial, the script and the stylesheet to the contract**; `node --check internal/meet/static/chat.js`. |
| +- [ ] **Step 3: A node test** `test/browser/chat.test.mjs` that lifts `append`'s line builder (or the byte counter) out of `chat.js` by name and proves: text is set with `textContent` (an angle bracket survives as text), the 500-line cap, the byte counter on multibyte input. Wire it into the Makefile's `browser` target beside `negotiation.test.mjs`. |
| +- [ ] **Step 4: Catalogue the strings** ("Chat", "Message", "Send", "Could not send. Try again.", "Message is too long."). |
| +- [ ] **Step 5: Gate** `make ci`; commit `chat: the panel partial and script, estilo's first chat` with the trailers. |
| + |
| +--- |
| + |
| +### Task 4: `room.js`: chat wiring and screen share |
| + |
| +**Files:** |
| +- Modify: `internal/meet/static/room.js`, `internal/meet/static/meet.css`, `internal/meet/templates/room.html` (a Share button in `#controls`: `<button type="button" id="share" rst-btn aria-pressed="false">Share screen<span id="share-state" class="meet-toggle-state" aria-hidden="true">Off</span></button>`), `docs/superpowers/copy/2026-09-10-slice-2-strings.md` |
| + |
| +**Interfaces (the client contract):** |
| +- **Broadcast lane.** `send(to, …)` is per-target with `seq`/`gen`; chat and share are untargeted. Add `broadcast(type, payload) → Promise<boolean>`: one queue keyed by the sentinel `'*'` with the same pump discipline (one POST in flight, the 30 s deadline, 429 with Retry-After, 401/403 → signed-out, 404 → the probe-first recovery, 400/413 never retried) but **no** `to`, `seq` or `gen` in the body; resolves true on 200. `stale`/`gen` logic does not apply to `'*'`. |
| +- **Chat.** On admission (`state.admitted` becomes true), `Chat.mount(document.getElementById('chat'), {send: (text) => broadcast('chat', {text})})`, un-hide `#chat`, `setEnabled(true)`; on `handle('chat', msg)` → `chat.append({from: msg.from, name: msg.name, text: msg.payload.text, at: Date.now(), self: false})`; on the local send's true → `append({… self: true, name: selfName})`. On `terminal`/`leave` → `setEnabled(false)`. A `chat` from a peer not in the roster is still rendered (the name is in the envelope; the hub guaranteed admission). |
| +- **Screen share (§5.4).** `#share` toggles: on → `navigator.mediaDevices.getDisplayMedia({video: true, audio: false})`; store `share = {stream, track}`; for every live `pcs` entry `entry.shareTx = pc.addTransceiver(track, {direction: 'sendonly', streams: [stream]})` (the label is carried by the `share` message, not the stream); perfect negotiation carries the offer; `broadcast('share', {on: true})`; `aria-pressed` and the state span flip. The display track's own `ended` event (the browser's "stop sharing" bar) runs the same stop path. Off → for every entry `entry.shareTx.stop()` (fallback `sender.replaceTrack(null)` + `removeTrack` when `stop` is unsupported), renegotiation follows, `broadcast('share', {on: false})`, stop the display track. New connections created while sharing get the transceiver in `createPC`. |
| +- **Receiving.** In the `track` handler, a second video track from a peer that is not the camera (the camera is the first video track of the peer's first stream; the share arrives with `ev.streams[0].id !== entry.stream.id`, or as a track whose transceiver `mid` is not the camera's — record `entry.cameraMid` from the first video transceiver) becomes `entry.share = {stream, track}` and a second tile keyed `peer + '#share'` labelled "<name>'s screen" (the `share {on:true}` message sets `entry.sharing = true` so the tile can be labelled even if the message precedes the track); on the track's `ended` **or** `share {on:false}`, whichever first, remove the share tile and clear `entry.share`; the camera tile is untouched. Frames on the share tile are counted like the camera's (`watchFrames`) under `frames.get(peer + '#share')`. |
| +- `state()` gains `chat: {sent, received}`, `sharing: bool`, `shares: [peer ids with a share tile]`, and `frames` entries for share tiles. |
| +- Strings: "Share screen", "On"/"Off" state, "<name>'s screen" caption, and a status sentence when `getDisplayMedia` is refused: "Screen sharing was not allowed." |
| + |
| +- [ ] **Step 1: Read §5.1, §5.4, §6, the current `room.js` (send/pump/postSignal ~2003–2193, the track handler ~982, `createPC`, `tile`, `renderTiles`, `state()`), `chat.js`'s API from Task 3, and `task-8-handoffs.md`.** |
| +- [ ] **Step 2: Implement to the contract** in named functions with a header comment naming §5.4 and §6; `node --check`. |
| +- [ ] **Step 3: Node tests** in `negotiation.test.mjs` (or a new `room-share.test.mjs`) for the pure parts liftable by name: the share/camera track classifier, the broadcast lane's body shape (no `to`/`seq`/`gen`), the share tile key. |
| +- [ ] **Step 4: Catalogue the strings; gate** `make ci`, `node --test`, and `make browser` (sandbox off) staying 27/27. |
| +- [ ] **Step 5: Commit** `room.js: chat over the broadcast lane; screen share as its own transceiver`. |
| + |
| +--- |
| + |
| +### Task 5: The browser gate: `chat` and `share` |
| + |
| +**Files:** |
| +- Modify: `test/browser/call.mjs`, `internal/meettest/browser_test.go` |
| + |
| +**Scenarios (§13):** |
| +- `chat`: two members connected; a third context signs in as a guest through the link and knocks (waiting). A types "hello from A" in `#chat-text` and presses Enter: B's `#chat-log` gains a line with A's name and the text within 2 s; A's own log shows the echo; the guest's page has no `#chat` visible and `state().chat.received === 0` after 2 s; a route on `**/signal` sees exactly one chat POST with no `to`/`seq`/`gen`. Then admit the guest and send again: the guest now receives it. Assert no console line carries the text. |
| +- `share`: two members connected (frames both ways); the **higher-id** context clicks `#share` (the fake display source: launch Chromium with `--auto-select-desktop-capture-source=Entire screen` or `--use-fake-device-for-media-stream` covers only cameras, so add `--auto-select-desktop-capture-source` and, if needed, `--auto-accept-this-tab-capture`); within 5 s the lower context's `state().shares` contains the sharer's peer, a second tile labelled "<name>'s screen" exists, `frames.get(peer + '#share') > 0`, and the camera tile's frames keep rising. Then the sharer clicks `#share` again: within 5 s the share tile is gone, `state().shares` is empty, the received track ended (assert through a page-side listener recording `ended`), and the camera frames still rise. Also assert the sharer's `aria-pressed` flips and the state span reads Off. |
| +- Keep the whole gate under ~8 minutes. |
| + |
| +- [ ] **Step 1: Write the scenarios** in the file's shape (per-scenario restart, `until`, `check`, `diagnose`, `state` flattening, the control channel for the guest link). |
| +- [ ] **Step 2: Run `make browser`** with the sandbox off; both pass; record timings. |
| +- [ ] **Step 3: Commit** `browser gate: chat to the admitted context only; the share round trip`. |
| + |
| +--- |
| + |
| +### Task 6: Record and spec note |
| + |
| +**Files:** |
| +- Modify: `docs/superpowers/specs/2026-09-07-meet-design.md` (§15.15: the chat and share wire — `{text}` ≤ 2048 bytes, 413 `too-large`; `{on}`; fan-out excludes the sender; the downstream envelope `{type, from, name, payload}`; the panel's mount API as estilo's adoptable contract; the share transceiver and tile rules) |
| +- Create: `docs/superpowers/reviews/2026-09-10-slice-4-record.md` in the slice 3 record's shape. |
| + |
| +- [ ] **Step 1: Write both; `make ci`; commit `docs: slice 4 record and spec note`.** |
| + |
| +--- |
| + |
| +## Self-review |
| + |
| +**Spec coverage (§12 item 4):** `chat.js` (3), the `chat` and `share` messages with their recipient rules (1, 2), display-media tracks and renegotiation from either side (4). §13 slice-4 gates: the captured-log test extended to accepted chat (2); no `chat` while waiting (2, 5); the share round trip with the received track ending and the camera continuing (5); chat arrives at the admitted context and not at a waiting one (5). §10: the panel is one partial and one script (3). |
| + |
| +**Placeholders:** Tasks 4 and 5 are contract-and-function-list tasks (Opus-tier), as slices 2 and 3 did; Task 1's third test names the fixture to copy. |
| + |
| +**Type consistency:** `hub.Fanout`, `hub.ErrNotFanout` (1) used in 2; `validateFanout` (2); `Chat.mount` → `{append, setEnabled, clear}` (3) used in 4; `broadcast('chat'|'share', payload)` (4); `state().chat/sharing/shares` (4) read by 5. |
| + |
| +**Rulings for the controller:** the fan-out excludes the sender (the panel echoes locally on acceptance); chat above 2048 bytes is 413 `too-large`, not 400; `share` carries only `{on}` (the tile label comes from the sender's name in the envelope); one Share button, no sharer limit. |