Repository navigation
id(web): explicit host view and actionable program-install state #3378
Description
Follow-up to #2144.
Viewing model
Guest join remains the way a guest enters a world. Add an explicit, authenticated host/owner view as a convenience for the node operator; do not make all visitors hosts by default and do not mint, consume, or expose a guest capability just to show the host its own world. Start read-only: render the authoritative program view and records without adding the host as a guest participant. Keep host authorization out of URLs and preserve the existing guest-capability flow.
Current evidence
pkgs/id/web/src/world.ts:288-314,606connects only when a guest capability is present and sends ajoinframe.pkgs/id/src/world_session/mod.rs:1058-1067routes a join through capability validation.- Program installation already exists:
id world install(pkgs/id/src/cli.rs:1434-1454), is documented inpkgs/id/examples/roc-counter/README.md:33-43, and the web page has Wasm and Roc install controls (pkgs/id/src/web/templates.rs:806-823). Those controls currently sit under the misleading “Host: create a guest invite” disclosure.
Scope
Add the explicit host-view path and make the existing install path discoverable from the host view/empty-program state. This is the world-host control surface, not a program-as-website feature.
Acceptance
- An explicitly authenticated host can view the current authoritative program surface and records without joining as a guest or consuming a guest capability.
- Missing or invalid host authorization cannot enter host view; the existing guest view still requires a valid guest capability and remains unchanged.
- The host is not counted as a guest participant, and the initial host view is read-only.
- A world without an installed program shows an actionable empty state; Wasm/Roc install controls live under a clearly named, separate “Install or update program” host section and remain functional.
- Tests cover host authorization, guest-flow preservation, and the no-program/install UI state.
Out of scope
Listener/binding redesign (#2145), program-as-website routing and authentication model (#2146), dynamic publish/unpublish (#2147), and guest role/capability changes.
Activity
developing-today commentedon Nov 1, 2026
CODE-1279
dezren39 commentedon Nov 2, 2026
agent-note:v1
task: 5190 (small_fix, OpenChamber scheduled lane)
state: picked-up
checked_at: 2026-11-02T00:46:06Z
feat(id): add authenticated read-only world host view (#3378)
147 remaining items
developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done — triaged: already implemented, closing with evidence
origin/main=848faa256eae, 2026-11-03T18:10Z). The fix landed via task 5190 / PR feat(id): authenticated read-only world host view (#3378) #4104 (merged 2026-11-02T15:41Z, merge commit0dfe5f1977b36fa98c55ae7bb05a7cf679492b03, confirmed an ancestor of current main); the issue simply was never closed. The 2026-11-03 coverage pass verdict of "still live" was a false positive — it joined on issue-open state only.GET /api/world/host-view(pkgs/id/src/web/world_ws.rs:72,118) is a plain HTTP read; authorization is thex-world-admin-tokenheader checked withhub.admin_ok(token)— never in a URL, nojoinframe, no guest capability consumed.401 UNAUTHORIZED(missing header and failedadmin_okboth); the guest capability flow inpkgs/id/web/src/world.tsis unchanged.world.tsblocks chat/game input whilehostModeis set (button labelled "View as host (read-only)").world.ts:465renders "No program is installed. Use Install or update program below."; the Wasm/Roc controls now sit in their own top-level "Install or update program" section (pkgs/id/src/web/templates.rs:815), separate from "Host controls" / the guest-invite area, with install handlers intact.host_view_requires_admin_and_does_not_register_a_guest(world_ws.rs:697, passed 1/1 during task 5190), template assertion for the install section (templates.rs:1101), and web test "host view uses the admin header, shows an empty-program action, and blocks guest input" (world-rejoin.test.ts:172; suite 3/3 passed on PR feat(id): authenticated read-only world host view (#3378) #4104). Both Codex P2 findings on PR feat(id): authenticated read-only world host view (#3378) #4104 were fixed in its final head and replied to on-thread during task 5190.