fix(web): the console switcher carries no token and sits beside the chip (#815 review)

[eaitbrahim]

Follow-up to #815 (merged, not yet released), from its review. Refs #814.

What was wrong in #815

1. Session tokens reached the page. live_peers returned url_for(record), which is http://host:port/?token=…, for every running console, and /api/config carried the list into <option value>. So the paper console's page held the live console's session token, and its own. That breaks security.py ("HttpOnly and must never be written into the page"). On a tunnelled deployment it would also have shipped every local token to the remote viewer.
2. The dropdown was always empty. el(tag, className, text) has no children form, so el("select", …, ...options) set the select's text to "[object HTMLOptionElement]" and dropped every option.
3. A console with no record could name the wrong console. A console started from a terminal writes no record. It then got a select with no current entry, and once item 2 was fixed the browser would pre-select the first option, which is another console's name.
4. Each console's mode was frozen at start-up. It went stale after a config edit, contradicting _auto_trade_mode's rule of re-reading the config on every request.
5. It turned the session chip into a dropdown, which [web] Session identity: profile · mode · equity-state switcher chip and a no-CTA paper banner #704 explicitly forbids. It only got past test_neither_the_chip_nor_the_banner_builds_anything_clickable because select isn't on that test's token list.

The fix

• No token on the wire. payload.profile_switcher sends {switchable, choices: [{label, href}], display}. Each href is a token-free /switch/<port> on the current console.
• GET /switch/<port>. This goes through normal admission, then a locality check, then reads the peer's record at click time. It answers 303 to the peer's own ?token= hand-off, which is the route keel open already uses. No page script can read a redirect's Location header.
  • Refusals: no session gives 403; a remote deployment or non-loopback peer gives 403; an unknown, dead or malformed port gives 404; this console's own port redirects to /.
• One locality rule. security.local_deployment is split out of gated_action_permitted, so the switcher offer and the switch route can't disagree about what "local" means.
• Service worker. sw.js now sends /switch/ navigations to the network. Otherwise the cached shell would answer them and switching would silently do nothing.
• A separate control. #console-switcher sits beside the chip. It's a select with a disabled "switch console…" placeholder, listing the other consoles.
  • sessionChip is byte-identical to its pre-feat(web): in-app profile switcher dropdown for multi-daemon navigation (#814) #815 code and passes [web] Session identity: profile · mode · equity-state switcher chip and a no-CTA paper banner #704's rule unchanged.
  • The new control has its own rule: navigation only, with no button, link, form, input or handler of its own.
  • The deployment card gains a read-only "running consoles" row.
• Smaller fixes.
  • This console is listed from its own arguments, never from a record.
  • Labels carry no mode, and records no longer store one.
  • serve now calls api._profile_name instead of an inline copy of it.

Verification

• tests/web/test_profile_switcher.py is rewritten (23 tests). The old version asserted the token was present in the URL.
• Six mutants were each killed: spreading children into el, dropping the locality check, removing the service-worker guard, listing this console as a choice, offering switching on a remote deployment, and an extra payload field.
• Full suite: 6711 passed, 3 skipped. ruff check, ruff format --check and mypy are clean.
• Manual check in Chromium. I ran two detached consoles in a throwaway KEEL_HOME (keel-live and keel-paper) with the service worker controlling the page.
  • The chip shows the profile as plain text, and the switcher lists the other console.
  • Switching paper → live → paper works both ways: each lands authenticated (/api/config 200) with no token left in the URL.
  • /api/config contains no token=.
• Known limit: a console started after the page loaded appears on the next reload. Following a stale entry returns a 404 that asks you to reload.

Note: main currently has a JS syntax error from #810 (a duplicate const note in render.js), so every console built from main is blank. It's fixed separately. For the manual check above I applied that rename locally; it is not in this PR.

🤖 Generated with Claude Code