The keeper can bring back a seat a browser lost: a new token on the ledger, the old one refused and any phrase it minted voided, and a link that carries it in the fragment, minted by waving-hands-reseat.sh through a /keeper door Caddy does not proxy; the join page keeps a linked seat only once the server takes it and never over a seat that still opens, a watcher at a duel in play is told both ways back, the hall asks before forgetting a duel in play, and the server's rooms have tests of their own

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

server/src/index.ts

@@ -23,7 +23,11 @@
 //   GET  /api/tally                 what the ledgers add up to, for the hall
 //   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //
-// Caddy serves the static site and proxies /api and /ws here.
+// Caddy serves the static site and proxies /api and /ws here. The keeper's
+// door answers only on the host itself (deploy/waving-hands-reseat.sh):
+//
+//   GET  /keeper/rooms/:id          who sits at the table, and when each wizard last moved or spoke
+//   POST /keeper/rooms/:id/reseat   {seat}             a new token for a player locked out, as a link to send them
 
 import * as Sentry from '@sentry/node';
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
@@ -195,9 +199,24 @@ function readBody(req: IncomingMessage): Promise<Record<string, unknown>> {
 	});
 }
 
+/** The keeper's door. Caddy proxies only /api and /ws, so it is reached from the host alone; a request Caddy forwarded is turned away besides. */
+async function handleKeeper(req: IncomingMessage, res: ServerResponse, parts: string[]): Promise<void> {
+	if (req.headers['x-forwarded-for'] || parts[1] !== 'rooms') throw new RoomError('Not here.', 404);
+	const room = rooms.get(parts[2] ?? '');
+	if (parts.length === 3 && req.method === 'GET') return send(res, 200, { roomId: room.id, started: !!room.state, seats: rooms.seatsForKeeper(room) });
+	if (parts[3] === 'reseat' && parts.length === 4 && req.method === 'POST') {
+		const body = await readBody(req);
+		const { seat, token } = rooms.reseat(room, body.seat);
+		// The token rides the fragment, which the browser keeps to itself: it reaches neither Caddy's log nor this server.
+		return send(res, 200, { name: seat.name, link: `${PUBLIC_URL}/join/${room.id}#seat=${seat.id}.${token}` });
+	}
+	throw new RoomError('Not here.', 404);
+}
+
 async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
 	const url = new URL(req.url ?? '/', 'http://localhost');
 	const parts = url.pathname.split('/').filter(Boolean);
+	if (parts[0] === 'keeper') return handleKeeper(req, res, parts);
 	if (parts[0] === 'api' && parts[1] === 'reports') return handleReports(req, res, parts);
 	if (parts[0] === 'api' && parts[1] === 'tally' && parts.length === 2 && req.method === 'GET') return send(res, 200, tallies.get());
 	if (parts[0] === 'api' && parts[1] === 'transfer' && parts.length === 2 && req.method === 'POST') {

server/src/rooms.test.ts

@@ -0,0 +1,49 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Rooms } from './rooms';
+import { Store } from './store';
+
+let dir: string;
+beforeEach(() => {
+	dir = mkdtempSync(join(tmpdir(), 'rooms-'));
+});
+afterEach(() => {
+	rmSync(dir, { recursive: true, force: true });
+});
+
+/** A table of three with Ann, who opened it, and Bo seated, the duel begun. */
+function table() {
+	const rooms = new Rooms(new Store(dir));
+	const host = rooms.create('Ann', 3);
+	const guest = rooms.join(host.room, 'Bo');
+	rooms.begin(host.room, host.token);
+	return { rooms, room: host.room, ann: host.token, bo: guest.token };
+}
+
+describe('rooms', () => {
+	it("gives a seat a new token at the keeper's word: the old one opens nothing, and a restart keeps the change", () => {
+		const { rooms, room, bo } = table();
+		const phrase = rooms.transfer(room, bo).phrase;
+		const { seat, token } = rooms.reseat(room, 'B');
+		expect(seat.name).toBe('Bo');
+		expect(rooms.seatOf(room, token).id).toBe('B');
+		expect(() => rooms.seatOf(room, bo)).toThrow(/opens no seat/);
+		// A phrase minted with the old token carries nothing now.
+		expect(() => rooms.claim(phrase)).toThrow(/unknown or has expired/);
+		const reopened = new Rooms(new Store(dir)).get(room.id);
+		expect(rooms.seatOf(reopened, token).id).toBe('B');
+		expect(() => rooms.seatOf(reopened, bo)).toThrow(/opens no seat/);
+	});
+
+	it('re-seats only a wizard, and says when each last acted', () => {
+		const { rooms, room, ann } = table();
+		expect(() => rooms.reseat(room, 'Z')).toThrow(/No wizard sits/);
+		rooms.submit(room, ann, { left: 'P', right: '-', casts: [] }, 0);
+		const seats = rooms.seatsForKeeper(room);
+		expect(seats.map((s) => [s.id, s.name])).toEqual([['A', 'Ann'], ['B', 'Bo']]);
+		expect(seats[0].lastActed).toBeGreaterThan(0);
+		expect(seats[1].lastActed).toBeNull();
+	});
+});

server/src/rooms.ts

@@ -307,6 +307,30 @@ export class Rooms {
 		return { seat, token };
 	}
 
+	/**
+	 * The keeper gives a wizard's seat a new token, for a player whose browser lost the old one. Whether the one
+	 * asking holds the seat is the keeper's judgment; this carries it out. The old token opens nothing after.
+	 */
+	reseat(room: Room, seatId: unknown): { seat: Seat; token: string } {
+		const seat = room.seats.find((s) => s.id === seatId && !s.bot);
+		if (!seat) throw new RoomError('No wizard sits in that seat.', 404);
+		const token = newId(18);
+		this.commit(room, { t: 'reseat', at: Date.now(), id: seat.id, tokenHash: hashToken(token) });
+		// A phrase minted with the old token would carry a seat that no longer answers to it.
+		for (const [phrase, t] of this.transfers) if (t.roomId === room.id && t.seatId === seat.id) this.transfers.delete(phrase);
+		return { seat, token };
+	}
+
+	/** The table as the keeper sees it before re-seating: who sits where, and when each wizard last moved or spoke. */
+	seatsForKeeper(room: Room): { id: WizardId; name: string; bot: boolean; lastActed: number | null }[] {
+		const last = new Map<WizardId, number>();
+		for (const line of this.store.read(room.id)) {
+			if (line.t === 'input' || line.t === 'chat') last.set(line.id, line.at);
+			else if (line.t === 'turn') for (const id of Object.keys(line.inputs)) last.set(id, line.at);
+		}
+		return room.seats.map((s) => ({ id: s.id, name: s.name, bot: s.bot, lastActed: s.bot ? null : (last.get(s.id) ?? null) }));
+	}
+
 	/** The host sends a bot away before the duel begins. People leave by not coming back. */
 	unseat(room: Room, token: string | undefined, seatId: unknown): void {
 		const host = this.seatOf(room, token);
@@ -437,6 +461,11 @@ function apply(room: Room, line: LedgerLine): void {
 		case 'seat':
 			room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash ?? (line.token ? hashToken(line.token) : ''), bot: line.bot });
 			break;
+		case 'reseat': {
+			const seat = room.seats.find((s) => s.id === line.id);
+			if (seat) seat.tokenHash = line.tokenHash;
+			break;
+		}
 		case 'input':
 			room.pending[line.id] = line.input;
 			break;

server/src/store.ts

@@ -11,6 +11,8 @@ export type LedgerLine =
 	| { t: 'room'; id: string; seats: number; createdAt: number; rematchOf?: string; expected?: string[] }
 	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. Ledgers written before hashing carry `token` and are read once more. */
 	| { t: 'seat'; id: WizardId; name: string; tokenHash?: string; token?: string; bot: boolean }
+	/** The keeper gave a wizard's seat a new token, for a player whose browser lost the old one; the old one opens nothing after. */
+	| { t: 'reseat'; at: number; id: WizardId; tokenHash: string }
 	/** One seat's move for the turn in progress, so a restart keeps it. The turn line that follows carries every input again. */
 	| { t: 'input'; at: number; id: WizardId; input: TurnInput }
 	/** A bot sent away by the host before the duel began; its seat id is free again. */