upload: 100MB cap — 4k masters run 30-60MB and belong in the library

Co-authored-by: Hanzo AI <ai@hanzo.ai>

.dockerignore

@@ -23,9 +23,10 @@ venv/
 .ruff_cache/
 tests/
 tests-unit/
-scripts/*
-# ...except the pack installer, which the image build invokes.
-!scripts/install_custom_nodes.sh
+# scripts/ ships WHOLE: the image build runs scripts/install_custom_nodes.sh and
+# the studio pod runs scripts/library_manifest.py as the build-manifest sidecar
+# (indexes every org's output/ into library.json). Excluding it silently no-ops
+# the sidecar's `[ -f ]` guard, so nothing gets indexed — keep the tree intact.
 notebooks/
 *.swp
 .env

Dockerfile

@@ -1,3 +1,12 @@
+# ── studio-chat SPA (web/) ── the /v1/agent chat UI served at /studio. Built here
+# so the image is self-contained; the small Vite bundle lands at /app/web/dist.
+FROM node:20-slim AS web
+WORKDIR /web
+COPY web/package.json web/package-lock.json* ./
+RUN npm ci 2>/dev/null || npm install
+COPY web/ ./
+RUN npm run build
+
 FROM python:3.11-slim AS base
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -25,6 +34,9 @@ RUN chmod +x /tmp/branding/apply-branding.sh && /tmp/branding/apply-branding.sh
 # Copy application code
 COPY . .
 
+# The studio-chat SPA built above → served at /studio by middleware/studio_home.py.
+COPY --from=web /web/dist ./web/dist
+
 # Vendor the Hanzo Studio custom-node packs (segmentation, controlnet, ipadapter,
 # upscaling, video, utils) at their pinned commits and install their deps with the
 # torch/numpy/transformers stack locked. See custom_nodes/hanzo-packs.txt.

branding/hanzo-identity.js

@@ -110,6 +110,12 @@
     }
 
     rows.push(el("div", { class: "hzid-sep" }));
+    // Exit the advanced node editor back to the content-forward Studio Home.
+    // Without this there is NO way out of Advanced mode (the node editor is the
+    // full-screen ComfyUI SPA) — the user gets stuck.
+    rows.push(el("a", { class: "hzid-item hzid-link", href: "/studio" }, [
+      el("span", { class: "hzid-tick", text: "←" }), el("span", { text: "Exit to Studio Home" }),
+    ]));
     rows.push(el("a", { class: "hzid-item hzid-link", href: s.console_url || "https://console.hanzo.ai", target: "_blank", rel: "noopener" }, [
       el("span", { class: "hzid-tick", text: "↗" }), el("span", { text: "Console" }),
     ]));
@@ -151,6 +157,17 @@
   // ------------------------------------------------------------- boot
   function mount() {
     if (document.getElementById("hanzo-identity")) return;
+    // Always-visible "Exit to Studio" button so Advanced mode is never a trap.
+    // Fixed top-left, above the node editor; independent of the user menu.
+    if (!document.getElementById("hanzo-exit-advanced")) {
+      var exit = el("a", {
+        id: "hanzo-exit-advanced", href: "/studio", title: "Exit Advanced — back to Studio Home",
+        style: "position:fixed;top:10px;left:12px;z-index:100000;display:flex;align-items:center;gap:6px;" +
+               "background:rgba(20,20,24,.92);color:#ececf1;border:1px solid #33333c;border-radius:8px;" +
+               "padding:6px 11px;font:600 12px/1 Inter,system-ui,sans-serif;text-decoration:none;cursor:pointer;backdrop-filter:blur(8px)"
+      }, [el("span", { text: "←" }), el("span", { text: "Studio" })]);
+      document.body.appendChild(exit);
+    }
     var root = el("div", { id: "hanzo-identity", class: "hanzo-identity" });
     document.body.appendChild(root);
     getSession().then(function (s) {

branding/patch_identity.py

@@ -21,7 +21,7 @@ import sys
 STATIC_DIR = sys.argv[1]
 BRANDING_DIR = sys.argv[2]
 
-BUNDLE_VERSION = "3"
+BUNDLE_VERSION = "4"
 JS = "hanzo-identity.js"
 CSS = "hanzo-identity.css"
 LINK_TAG = f'<link rel="stylesheet" href="{CSS}?v={BUNDLE_VERSION}"/>'

folder_paths.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+import re
 import time
 import mimetypes
 import logging
@@ -94,6 +95,19 @@ def get_org_id() -> str | None:
     return _org_id
 
 
+_ORG_ID_RE = re.compile(r"^[a-zA-Z0-9._-]+$")
+
+
+def _safe_org_id(oid: str) -> str:
+    """The single choke point where an org value becomes a filesystem path — so it
+    is also the one place to reject traversal. An org id must be a plain slug; `.`,
+    `..`, `/`, `\\`, or any other character is refused so a malformed/hostile claim
+    can never escape the orgs/ tree (defense-in-depth; org id is IAM-derived today)."""
+    if oid in (".", "..") or not _ORG_ID_RE.match(oid):
+        raise ValueError(f"invalid org_id for path scoping: {oid!r}")
+    return oid
+
+
 def get_org_base_path(org_id: str | None = None) -> str:
     """
     Get the org-scoped base path. If multi-tenant is enabled and org_id is set,
@@ -101,7 +115,7 @@ def get_org_base_path(org_id: str | None = None) -> str:
     """
     oid = org_id or _org_id
     if _multi_tenant and oid:
-        org_path = os.path.join(base_path, "orgs", oid)
+        org_path = os.path.join(base_path, "orgs", _safe_org_id(oid))
         os.makedirs(org_path, exist_ok=True)
         return org_path
     return base_path

middleware/gpu_dispatch.py

@@ -76,11 +76,36 @@ def _bearer(request) -> str:
     return f"Bearer {tok}" if tok else ""
 
 
-def _has_online_gpu(tok: str) -> bool:
-    """True if the caller's org has an online GPU machine in the cloud fleet."""
+# Identity keys a fleet machine might carry, most human-friendly first. We READ
+# whatever the gpu-jobs lane publishes (home-lab labels like spark/dbc/evo land in
+# `name`/`hostname`); we never invent a parallel registry.
+_NODE_KEYS = ("name", "hostname", "label", "node", "worker_id", "machine_id", "id", "gpu_model")
+
+
+def _node_label(m: dict) -> str:
+    for k in _NODE_KEYS:
+        v = m.get(k)
+        if isinstance(v, str) and v.strip():
+            return v.strip()
+    return "gpu"
+
+
+def _fleet_machines(tok: str) -> list:
+    """The caller-org's machines from the cloud fleet. The token scopes the fleet to
+    the caller's org, so this is inherently tenant-isolated."""
     req = urllib.request.Request(f"{CLOUD}/v1/machines", headers={"Authorization": tok})
     d = json.loads(urllib.request.urlopen(req, timeout=10).read())
-    return any(m.get("status") == "online" and m.get("gpu") for m in d.get("machines", []))
+    ms = d.get("machines", [])
+    return ms if isinstance(ms, list) else []
+
+
+def _online_gpu_nodes(tok: str) -> list:
+    return [m for m in _fleet_machines(tok) if m.get("status") == "online" and m.get("gpu")]
+
+
+def _has_online_gpu(tok: str) -> bool:
+    """True if the caller's org has an online GPU machine in the cloud fleet."""
+    return bool(_online_gpu_nodes(tok))
 
 
 def dispatch_if_worker(request, org_id: str, prompt_id: str, prompt: dict) -> bool:
@@ -89,14 +114,25 @@ def dispatch_if_worker(request, org_id: str, prompt_id: str, prompt: dict) -> bo
     Never raises — any failure falls back to local."""
     try:
         tok = _bearer(request)
-        if not tok or not _has_online_gpu(tok):
+        online = _online_gpu_nodes(tok) if tok else []
+        if not online:
             return False
+        # Which node runs it: the single online GPU is definitive; with several the
+        # claimer is decided at pick-up time, so record the ambiguous "gpu".
+        node = _node_label(online[0]) if len(online) == 1 else "gpu"
         body = json.dumps({
             "activityId": prompt_id,
             "runId": prompt_id,
             "activityType": {"name": "studio.render"},
             "taskQueue": JOBS_NS,
-            "heartbeatTimeout": "600s",
+            # 1200s: a heavy Qwen edit on a cold GB10 (model reload + full 30-step
+            # sample) can exceed 600s; the worker heartbeats each step, so this is
+            # the ceiling for a genuinely long single render, not idle slack.
+            "heartbeatTimeout": "1200s",
+            # Liveness is the heartbeat above; this cap only bounds a live-but-stuck
+            # render. Unset, the tasks default (~1h) reaped real renders mid-run and
+            # the queue re-ran them for hours.
+            "startToCloseTimeout": "14400s",
             "input": {
                 "prompt": prompt,
                 "org": org_id,
@@ -113,6 +149,49 @@ def dispatch_if_worker(request, org_id: str, prompt_id: str, prompt: dict) -> bo
             headers={"Authorization": tok, "Content-Type": "application/json"},
         )
         urllib.request.urlopen(req, timeout=15).read()
+        _track_dispatched(org_id, prompt_id, prompt, node=node)
         return True
     except Exception:
         return False
+
+
+def _track_dispatched(org_id: str, prompt_id: str, prompt: dict, node: str = "gpu") -> None:
+    """Record a BYO-GPU render dispatched to gpu-jobs so the studio UI can SHOW it
+    in the queue. BYO-GPU jobs render on the worker (gpu-jobs), not the pod's local
+    /queue — so without this the user's fix/compose 'never appears in the queue'.
+    A tiny per-org JSON the /v1/render-queue endpoint reads; entries drop off when
+    their output lands in the library or they age out. Never raises."""
+    try:
+        import time
+        import folder_paths
+        # human title from the SaveImage prefix; refs from LoadImage for a thumbnail
+        full_prefix, refs = "render", []
+        for n in prompt.values():
+            if not isinstance(n, dict):
+                continue
+            ct = n.get("class_type", "")
+            if ct == "SaveImage":
+                full_prefix = n.get("inputs", {}).get("filename_prefix") or "render"
+            elif "LoadImage" in ct:
+                im = n.get("inputs", {}).get("image")
+                if im:
+                    refs.append(im)
+        out_dir = folder_paths.get_org_output_directory(org_id)
+        os.makedirs(out_dir, exist_ok=True)
+        jf = os.path.join(out_dir, "render_jobs.json")
+        try:
+            jobs = json.loads(open(jf).read())
+        except Exception:
+            jobs = []
+        jobs = [j for j in jobs if j.get("id") != prompt_id][-40:]  # dedupe + cap
+        # store the FULL output prefix (e.g. "fixes/model01_..._00001_") so the queue
+        # endpoint can check for the ACTUAL output file, not a fuzzy base match that
+        # collides with the source image and makes the job vanish after 30s.
+        jobs.append({"id": prompt_id, "prefix": full_prefix.split("/")[-1],
+                     "outPrefix": full_prefix, "refs": refs[:1], "node": node,
+                     "ts": int(time.time()), "status": "rendering"})
+        tmp = jf + ".tmp"
+        open(tmp, "w").write(json.dumps(jobs))
+        os.replace(tmp, jf)
+    except Exception:
+        pass

middleware/mcp.py

@@ -0,0 +1,187 @@
+"""MCP-over-HTTP for Hanzo Studio — the studio render pipeline as a Model Context
+Protocol server so the cloud chat `create` capability can drive it.
+
+POST /v1/mcp speaks JSON-RPC 2.0 (the MCP wire format) and exposes the SAME render
+dispatch the /v1/library/{fix,compose} routes use — ``studio_home.dispatch_fix`` /
+``studio_home.dispatch_compose`` — as MCP tools. So a fix/compose an LLM issues
+behaves identically to one the Studio UI issues: one dispatch path, no second
+pipeline. Auth and org ride the existing IAM middleware exactly like every other
+/v1/* route (org = ``studio_home._org_of(request)``); nothing is registered here
+that the global auth layer does not already gate.
+
+Methods (JSON-RPC 2.0 envelope: {jsonrpc,id,result|error}):
+    initialize   -> {protocolVersion, serverInfo, capabilities:{tools:{}}}
+    tools/list   -> the fix / compose / ask tools + JSON schemas
+    tools/call   -> dispatch fix|compose|ask and return MCP tool-result content
+                    (the render prompt_id / output_prefix). A DispatchError
+                    becomes an isError tool-result, never a 500. An unknown
+                    METHOD is a JSON-RPC method-not-found error.
+
+── Registration: the ONE recipe ──────────────────────────────────────────────
+An operator/admin registers THIS studio MCP server per-org, once, through the
+cloud tool registry — the studio public URL with the /v1/mcp path:
+
+    POST https://api.hanzo.ai/v1/tools/servers
+    { "name": "studio",
+      "url":  "https://studio.hanzo.ai/v1/mcp",
+      "org":  "<org>" }
+
+Cloud then calls tools/list here and exposes the returned tools to /v1/chat's
+`create` capability as SourceMCP tools. There is no per-tool wiring in cloud: the
+tool set is whatever tools/list returns, so adding a studio tool is a one-line
+change to _TOOLS here — it flows to chat with no cloud deploy.
+"""
+from __future__ import annotations
+
+import json
+
+from aiohttp import web
+
+from middleware import studio_home
+from studio_version import __version__
+
+# The MCP revision this server implements. Reported in `initialize`.
+_PROTOCOL_VERSION = "2025-06-18"
+
+# JSON-RPC 2.0 error codes (only the ones we emit).
+_PARSE_ERROR = -32700
+_INVALID_REQUEST = -32600
+_METHOD_NOT_FOUND = -32601
+
+# The studio render tools. `inputSchema` is the JSON Schema cloud advertises to
+# the model; the dispatch functions validate again (instruction length, asset
+# existence), so the schema is a hint, not the trust boundary.
+_TOOLS = [
+    {
+        "name": "fix",
+        "description": (
+            "Edit one library asset with an instruction (Qwen image-edit). "
+            "Returns the render prompt_id and output_prefix."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "path": {"type": "string", "description": "library-relative path of the asset to edit"},
+                "instruction": {"type": "string", "description": "the edit to apply (3-500 chars)"},
+            },
+            "required": ["path", "instruction"],
+        },
+    },
+    {
+        "name": "compose",
+        "description": (
+            "Combine 2-5 library assets into a new output per an instruction. "
+            "Returns the render prompt_id and output_prefix."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "paths": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "minItems": 2,
+                    "maxItems": 5,
+                    "description": "2-5 library-relative asset paths to combine",
+                },
+                "instruction": {"type": "string", "description": "how to combine them (3-500 chars)"},
+            },
+            "required": ["paths", "instruction"],
+        },
+    },
+    {
+        "name": "ask",
+        "description": (
+            "Clarifier no-op: echo a question back to the user when the request is "
+            "ambiguous. Produces no render."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "question": {"type": "string", "description": "the clarifying question to ask"},
+            },
+            "required": ["question"],
+        },
+    },
+]
+
+
+def _result(id_, result: dict) -> dict:
+    return {"jsonrpc": "2.0", "id": id_, "result": result}
+
+
+def _error(id_, code: int, message: str) -> dict:
+    return {"jsonrpc": "2.0", "id": id_, "error": {"code": code, "message": message}}
+
+
+def _content(payload: dict, is_error: bool = False) -> dict:
+    """An MCP tool result: text content parts + optional isError flag. The text is
+    the JSON dispatch payload (prompt_id / output_prefix) or the error message."""
+    r = {"content": [{"type": "text", "text": json.dumps(payload)}]}
+    if is_error:
+        r["isError"] = True
+    return r
+
+
+async def _call_tool(request: web.Request, server, name: str, arguments: dict):
+    """Dispatch one tool call to the shared render path. Returns the MCP
+    tool-result, or None for an unknown tool name (caller maps that to isError)."""
+    org = studio_home._org_of(request)
+    if name == "fix":
+        out = await studio_home.dispatch_fix(
+            request, server, org, arguments.get("path", ""), arguments.get("instruction", ""))
+        return _content(out)
+    if name == "compose":
+        out = await studio_home.dispatch_compose(
+            request, server, org, arguments.get("paths") or [], arguments.get("instruction", ""))
+        return _content(out)
+    if name == "ask":
+        return _content({"ok": True, "question": str(arguments.get("question", "")).strip()})
+    return None
+
+
+async def _handle(request: web.Request, server, msg) -> dict | None:
+    """Process one JSON-RPC 2.0 message. Returns the response envelope, or None
+    for a notification (a message with no ``id`` — no response is sent)."""
+    if not isinstance(msg, dict) or msg.get("jsonrpc") != "2.0":
+        return _error(None, _INVALID_REQUEST, "invalid JSON-RPC 2.0 request")
+    is_notification = "id" not in msg
+    id_ = msg.get("id")
+    method = msg.get("method")
+    params = msg.get("params") or {}
+
+    if method == "initialize":
+        result = {
+            "protocolVersion": _PROTOCOL_VERSION,
+            "serverInfo": {"name": "hanzo-studio", "version": __version__},
+            "capabilities": {"tools": {"listChanged": False}},
+        }
+    elif method == "tools/list":
+        result = {"tools": _TOOLS}
+    elif method == "tools/call":
+        name = params.get("name")
+        arguments = params.get("arguments") or {}
+        try:
+            result = await _call_tool(request, server, name, arguments)
+        except studio_home.DispatchError as e:
+            result = _content({"error": str(e)}, is_error=True)
+        if result is None:
+            result = _content({"error": f"unknown tool: {name}"}, is_error=True)
+    else:
+        return None if is_notification else _error(id_, _METHOD_NOT_FOUND, f"unknown method: {method}")
+
+    return None if is_notification else _result(id_, result)
+
+
+def add_mcp_routes(routes: web.RouteTableDef, server) -> None:
+    """Register POST /v1/mcp — the studio MCP-over-HTTP endpoint."""
+
+    @routes.post("/v1/mcp")
+    async def mcp_endpoint(request: web.Request):
+        try:
+            msg = await request.json()
+        except Exception:
+            return web.json_response(_error(None, _PARSE_ERROR, "invalid JSON"), status=400)
+        resp = await _handle(request, server, msg)
+        if resp is None:  # notification: acknowledge with no body
+            return web.Response(status=202)
+        return web.json_response(resp)

middleware/shell.css

@@ -0,0 +1,63 @@
+/* Hanzo Studio shell — the ONE shared chrome, loaded by BOTH the Studio home
+ * (middleware/studio_home.html) and the Editor (injected into the engine's
+ * index.html by server.get_root). Self-contained dark palette + `hz` id/class
+ * prefix so it never collides with the editor's own theme. */
+#hzbar{position:fixed;bottom:18px;right:18px;z-index:2147483000;display:flex;align-items:center;gap:8px;
+  flex-wrap:wrap;justify-content:flex-end;max-width:calc(100vw - 36px);
+  font:400 14px/1.4 Inter,system-ui,-apple-system,sans-serif}
+#hzbar button,#hzbar a{font:inherit}
+.hz-pill{display:inline-flex;align-items:center;gap:7px;background:#131317;color:#ececf1;border:1px solid #232329;
+  border-radius:999px;padding:7px 13px;cursor:pointer;text-decoration:none;white-space:nowrap}
+.hz-pill:hover{border-color:#3a3a48}
+.hz-pill .hz-dot{width:8px;height:8px;border-radius:50%;background:#555;flex:0 0 auto}
+.hz-pill.on .hz-dot{background:#3ddc84}
+.hz-pill.hz-chat{background:#f4f4f6;color:#111;border-color:#f4f4f6;font-weight:600}
+.hz-topup{color:#6aa5ff;text-decoration:none;font-size:.82em;border-left:1px solid #232329;padding-left:7px}
+.hz-topup:hover{text-decoration:underline}
+/* right-docked chat sidebar (both views) */
+#hzchat{position:fixed;top:0;right:0;height:100vh;width:380px;max-width:94vw;background:#0e0e12;color:#ececf1;
+  border-left:1px solid #232329;z-index:2147483001;display:flex;flex-direction:column;
+  transform:translateX(100%);transition:transform .22s ease;box-shadow:-14px 0 44px #0007}
+#hzchat.on{transform:translateX(0)}
+#hzchat .hz-h{display:flex;align-items:center;gap:9px;padding:13px 15px;border-bottom:1px solid #232329;flex-wrap:wrap}
+#hzchat .hz-h .hz-av{width:26px;height:26px;border-radius:50%;background:#26262e;display:flex;align-items:center;
+  justify-content:center;font-size:.72rem;font-weight:600;flex:0 0 auto}
+#hzchat .hz-h .hz-who{font-size:.82rem;min-width:0}
+#hzchat .hz-h .hz-who b{display:block;font-size:.86rem;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+#hzchat .hz-h .hz-who span{color:#8a8a95;font-size:.72rem}
+#hzchat .hz-h .hz-x{margin-left:auto;cursor:pointer;color:#8a8a95;font-size:1.3rem;line-height:1;background:none;border:none}
+#hzmsgs{flex:1;overflow:auto;padding:14px;display:flex;flex-direction:column;gap:10px}
+.hz-m{max-width:88%;padding:9px 12px;border-radius:12px;font-size:.86rem;line-height:1.45;white-space:pre-wrap;word-break:break-word}
+.hz-m.u{align-self:flex-end;background:#f4f4f6;color:#111;border-bottom-right-radius:3px}
+.hz-m.a{align-self:flex-start;background:#1a1a20;border:1px solid #232329;border-bottom-left-radius:3px}
+.hz-m.sys{align-self:center;color:#8a8a95;font-size:.78rem;background:none}
+#hzform{display:flex;gap:8px;padding:12px;border-top:1px solid #232329}
+#hzform input{flex:1;background:#0a0a0d;border:1px solid #232329;border-radius:9px;color:#ececf1;padding:9px 11px;font:inherit;font-size:.85rem;outline:none}
+#hzform button{background:#f4f4f6;color:#111;border:none;border-radius:9px;padding:0 14px;font-weight:600;cursor:pointer}
+/* GPUs panel (both views) */
+#hzgpus{position:fixed;bottom:64px;right:18px;z-index:2147483001;width:320px;max-width:92vw;background:#131317;
+  color:#ececf1;border:1px solid #232329;border-radius:12px;padding:12px 14px;display:none;box-shadow:0 18px 50px #0009}
+#hzgpus.on{display:block}
+#hzgpus h4{font-size:.82rem;font-weight:600;margin:0 0 8px;display:flex;align-items:center;gap:7px}
+.hz-node{display:flex;align-items:flex-start;gap:9px;padding:7px 0;border-top:1px solid #1e1e24;font-size:.8rem}
+.hz-node:first-of-type{border-top:none}
+.hz-node .hz-dot{width:8px;height:8px;border-radius:50%;background:#555;margin-top:5px;flex:0 0 auto}
+.hz-node.on .hz-dot{background:#3ddc84}
+.hz-node .hz-nn{flex:1;min-width:0}
+.hz-node .hz-nn b{font-weight:500}
+.hz-node .hz-nsub{color:#8a8a95;font-size:.72rem;margin-top:2px}
+/* Tablet: a touch narrower sidebar; the pill bar + panels already fit. */
+@media (max-width:900px){#hzchat{width:340px}}
+/* Phone: chat becomes a full-width bottom sheet (same pattern the old chatpanel
+   used); the pill bar wraps upward from the bottom-right so the toggle, wallet
+   and GPUs badge all stay reachable; the GPUs panel spans the width. */
+@media (max-width:600px){
+  #hzbar{bottom:14px;right:14px;gap:7px}
+  .hz-pill{padding:7px 11px}
+  .hz-pill .hz-lbl{display:none}   /* icon-only Chat/GPUs → one line, clears content */
+  #hzchat{top:auto;bottom:0;width:100vw;max-width:100vw;height:85vh;
+    border-left:none;border-top:1px solid #232329;border-radius:16px 16px 0 0;
+    transform:translateY(100%);box-shadow:0 -14px 44px #0007}
+  #hzchat.on{transform:translateY(0)}
+  #hzgpus{left:12px;right:12px;width:auto;bottom:66px}
+}

middleware/shell.js

@@ -0,0 +1,201 @@
+/* Hanzo Studio shell — the ONE shared chrome for BOTH views.
+ *
+ *   Studio home (/studio)      includes this via <script src="/studio/shell.js">
+ *   Editor (/ ?advanced=1)     gets the same tag injected into the engine's
+ *                              index.html by server.get_root
+ *
+ * It renders (identically in both views): a Studio/Editor toggle, a wallet chip,
+ * a GPUs badge + panel, and a dockable right chat SIDEBAR backed by the ONE chat
+ * path (POST /v1/copilot/chat). Same-origin cookies carry the IAM session, so org
+ * + login are inherited — no auth is rebuilt here. In the editor it also honours
+ * ?load=<worklog id> / ?template=<name> to open a graph, and offers Save as
+ * template. Guarded end to end: any failure logs and no-ops, never throws. */
+(function () {
+  "use strict";
+  if (window.__hzShell) return;
+  window.__hzShell = 1;
+
+  var STUDIO = location.pathname === "/studio" || location.pathname === "/studio/";
+  var $ = function (id) { return document.getElementById(id); };
+  var el = function (tag, attrs, html) {
+    var e = document.createElement(tag);
+    if (attrs) for (var k in attrs) e.setAttribute(k, attrs[k]);
+    if (html != null) e.innerHTML = html;
+    return e;
+  };
+  var esc = function (s) { return String(s == null ? "" : s).replace(/[<>&]/g, function (c) { return { "<": "&lt;", ">": "&gt;", "&": "&amp;" }[c]; }); };
+  async function getJSON(url, opt) {
+    var r = await fetch(url, Object.assign({ credentials: "same-origin" }, opt || {}));
+    var j = {}; try { j = await r.json(); } catch (_) {}
+    return { ok: r.ok, status: r.status, body: j };
+  }
+
+  // ── chrome: bottom-right pill cluster + docked chat sidebar + GPUs panel ──────
+  var bar = el("div", { id: "hzbar" });
+  var toggle = el("a", { class: "hz-pill", href: STUDIO ? "/?advanced=1" : "/studio",
+    title: STUDIO ? "Open the node editor" : "Back to Studio" }, STUDIO ? "⇄ Editor" : "⇄ Studio");
+  var tmplBtn = STUDIO ? null : el("button", { class: "hz-pill", title: "Save the current graph as a reusable template" }, "★ Template");
+  var wallet = el("a", { class: "hz-pill", id: "hzwallet", href: "https://pay.hanzo.ai", target: "_blank", rel: "noopener",
+    title: "Wallet — top up at pay.hanzo.ai" }, "wallet …");
+  var gpus = el("button", { class: "hz-pill", id: "hzgpubtn", title: "GPUs" }, '<span class="hz-dot"></span><span class="hz-lbl">GPUs</span>');
+  var chatBtn = el("button", { class: "hz-pill hz-chat", title: "Chat" }, '💬<span class="hz-lbl"> Chat</span>');
+  bar.appendChild(toggle);
+  if (tmplBtn) bar.appendChild(tmplBtn);
+  bar.appendChild(wallet); bar.appendChild(gpus); bar.appendChild(chatBtn);
+
+  var gpuPanel = el("div", { id: "hzgpus" }, '<h4>GPUs</h4><div id="hznodes"></div>');
+  var chat = el("aside", { id: "hzchat" });
+  chat.innerHTML =
+    '<div class="hz-h"><span class="hz-av" id="hzav">·</span>' +
+    '<span class="hz-who"><b id="hzuser">…</b><span id="hzorg"></span></span>' +
+    '<button class="hz-x" id="hzclose" title="Close">×</button></div>' +
+    '<div id="hzmsgs"></div>' +
+    '<form id="hzform"><input id="hzin" placeholder="Ask the copilot…" autocomplete="off"><button type="submit">Send</button></form>';
+
+  function mount() {
+    document.body.appendChild(bar);
+    document.body.appendChild(gpuPanel);
+    document.body.appendChild(chat);
+    wire();
+    loadSession(); loadWallet(); loadGpus();
+    if (!STUDIO) editorBoot();
+  }
+
+  // ── chat: the ONE path — POST /v1/copilot/chat; ops applied via the editor's
+  // existing applier when present (no second chat mechanism) ────────────────────
+  var HISTORY = [];
+  function addMsg(role, text) {
+    var m = el("div", { class: "hz-m " + role }, esc(text));
+    $("hzmsgs").appendChild(m); $("hzmsgs").scrollTop = $("hzmsgs").scrollHeight;
+    return m;
+  }
+  async function graphContext() {
+    var app = window.app;
+    if (!app || typeof app.graphToPrompt !== "function") return {};
+    try {
+      var p = await app.graphToPrompt();
+      var ctx = { graph_json: p.output || {} };
+      try { ctx.catalog = { types: Object.keys((window.LiteGraph && window.LiteGraph.registered_node_types) || {}) }; } catch (_) {}
+      return ctx;
+    } catch (_) { return {}; }
+  }
+  async function send(text) {
+    HISTORY.push({ role: "user", content: text });
+    addMsg("u", text);
+    var pending = addMsg("sys", "…");
+    var payload = Object.assign({ messages: HISTORY.slice(-20) }, await graphContext());
+    var r = await getJSON("/v1/copilot/chat", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });
+    pending.remove();
+    var reply = (r.body && r.body.reply) || (r.body && r.body.error) || (r.ok ? "" : "chat failed (" + r.status + ")");
+    if (reply) { HISTORY.push({ role: "assistant", content: reply }); addMsg("a", reply); }
+    var ops = (r.body && r.body.ops) || [];
+    if (ops.length && window.HanzoCopilot && typeof window.HanzoCopilot.applyOps === "function") {
+      try { window.HanzoCopilot.applyOps(ops); } catch (e) { addMsg("sys", "couldn't apply changes: " + e.message); }
+    } else if (ops.length && STUDIO) {
+      addMsg("sys", "Open the Editor to apply " + ops.length + " graph change" + (ops.length > 1 ? "s" : "") + ".");
+    }
+  }
+
+  function wire() {
+    chatBtn.onclick = function () { chat.classList.toggle("on"); if (chat.classList.contains("on")) $("hzin").focus(); };
+    $("hzclose").onclick = function () { chat.classList.remove("on"); };
+    $("hzform").onsubmit = function (e) {
+      e.preventDefault();
+      var v = $("hzin").value.trim(); if (!v) return;
+      $("hzin").value = ""; send(v).catch(function (err) { addMsg("sys", "error: " + err.message); });
+    };
+    gpus.onclick = function () { gpuPanel.classList.toggle("on"); if (gpuPanel.classList.contains("on")) loadGpus(); };
+    if (tmplBtn) tmplBtn.onclick = saveTemplate;
+  }
+
+  // ── session · wallet · GPUs ───────────────────────────────────────────────────
+  async function loadSession() {
+    var r = await getJSON("/v1/session"); var s = r.body || {};
+    var nm = (s.user || s.email || "You").trim();
+    $("hzav").textContent = (nm[0] || "·").toUpperCase();
+    $("hzuser").textContent = nm;
+    $("hzorg").textContent = s.org ? ("org · " + s.org) : "";
+  }
+  function money(n, cur) {
+    if (n == null || isNaN(n)) return "—";
+    var sym = (cur || "").toLowerCase() === "usd" ? "$" : "";
+    return sym + Number(n).toFixed(2) + (sym ? "" : " " + (cur || "").toUpperCase());
+  }
+  async function loadWallet() {
+    var r = await getJSON("/v1/wallet"); var w = r.body || {};
+    wallet.innerHTML = esc(money(w.balance, w.currency)) + '<span class="hz-topup">Top up ↗</span>';
+    wallet.title = "Wallet" + (w.org ? " · " + w.org : "") + " — top up at pay.hanzo.ai";
+  }
+  async function loadGpus() {
+    var nres = await getJSON("/v1/nodes"); var qres = await getJSON("/v1/queue/status");
+    var nodes = (nres.body && nres.body.nodes) || [];
+    var pod = (nres.body && nres.body.pod) || null;
+    if (pod) nodes = nodes.concat([pod]);
+    var items = (qres.body && qres.body.items) || {};
+    var byNode = {};
+    Object.keys(items).forEach(function (id) {
+      var it = items[id]; var k = it.node || "gpu";
+      (byNode[k] = byNode[k] || { running: null, depth: 0 });
+      byNode[k].depth++;
+      if (it.status === "running") byNode[k].running = it.prompt || it.kind || "a render";
+    });
+    var online = nodes.filter(function (n) { return n.online; }).length;
+    gpus.innerHTML = '<span class="hz-dot"></span><span class="hz-lbl">GPUs </span>' + online + "/" + nodes.length;
+    gpus.classList.toggle("on", online > 0);
+    $("hznodes").innerHTML = nodes.length ? nodes.map(function (n) {
+      var s = byNode[n.name] || { running: null, depth: 0 };
+      var sub = (n.online ? "online" : "offline") +
+        (s.running ? " · running: " + esc(String(s.running).slice(0, 40)) : (n.online ? " · idle" : "")) +
+        " · queue " + s.depth;
+      return '<div class="hz-node ' + (n.online ? "on" : "") + '"><span class="hz-dot"></span>' +
+        '<div class="hz-nn"><b>' + esc(n.name) + '</b><div class="hz-nsub">' + sub + "</div></div></div>";
+    }).join("") : '<div class="hz-nsub">No GPU nodes connected. Run <b>hanzo gpu connect</b> on a box to add one.</div>';
+  }
+
+  // ── editor-only: open a graph (?load / ?template), Save as template ────────────
+  function waitForApp(ms) {
+    return new Promise(function (resolve, reject) {
+      var t0 = Date.now();
+      (function poll() {
+        if (window.app && typeof window.app.loadGraphData === "function") return resolve(window.app);
+        if (Date.now() - t0 > ms) return reject(new Error("editor not ready"));
+        setTimeout(poll, 150);
+      })();
+    });
+  }
+  function editorLoad(g) {
+    var app = window.app; if (!app || !g) return false;
+    if (g.workflow && typeof app.loadGraphData === "function") { app.loadGraphData(g.workflow); return true; }
+    if (g.output && typeof app.loadApiJson === "function") { app.loadApiJson(g.output, "hanzo"); return true; }
+    if ((g.nodes || g.last_node_id != null) && typeof app.loadGraphData === "function") { app.loadGraphData(g); return true; }
+    if (typeof app.loadApiJson === "function") { app.loadApiJson(g, "hanzo"); return true; }
+    if (typeof app.loadGraphData === "function") { app.loadGraphData(g); return true; }
+    return false;
+  }
+  async function editorBoot() {
+    var q = new URLSearchParams(location.search);
+    var load = q.get("load"), template = q.get("template");
+    if (!load && !template) return;
+    try {
+      await waitForApp(30000);
+      var url = load ? "/v1/workflow?id=" + encodeURIComponent(load) : "/v1/templates/" + encodeURIComponent(template);
+      var r = await getJSON(url);
+      if (!r.ok) { addMsg("sys", "couldn't open: " + ((r.body && r.body.error) || r.status)); return; }
+      editorLoad(r.body.graph || r.body);
+    } catch (e) { console.warn("[hz shell]", e); }
+  }
+  async function saveTemplate() {
+    var app = window.app;
+    if (!app || typeof app.graphToPrompt !== "function") { alert("Open a workflow in the editor first."); return; }
+    var name = prompt("Save this graph as a template named:");
+    if (!name || !name.trim()) return;
+    var g;
+    try { g = await app.graphToPrompt(); } catch (e) { alert("Couldn't read the graph: " + e.message); return; }
+    var r = await getJSON("/v1/templates", { method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name: name.trim(), graph: { workflow: g.workflow, output: g.output } }) });
+    alert(r.ok ? '★ Saved template "' + (r.body.name || name.trim()) + '"' : "Save failed: " + ((r.body && r.body.error) || r.status));
+  }
+
+  if (document.body) mount();
+  else document.addEventListener("DOMContentLoaded", mount);
+})();

middleware/studio_home.html

@@ -0,0 +1,879 @@
+<!doctype html>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Hanzo Studio</title>
+<link rel="stylesheet" href="/studio/shell.css">
+<script src="/studio/shell.js" defer></script>
+<style>
+:root{--bg:#0a0a0b;--panel:#131317;--panel2:#17171c;--line:#232329;--txt:#ececf1;--dim:#8a8a95;
+--brand:#f4f4f6;--ok:#3ddc84;--warn:#ffb648;--pub:#6aa5ff;font-size:15px}
+*{box-sizing:border-box;margin:0}
+body{background:var(--bg);color:var(--txt);font:400 1rem/1.5 Inter,system-ui,-apple-system,sans-serif}
+.serif{font-family:"Iowan Old Style","Palatino Linotype",Georgia,serif}
+a{color:inherit}
+header{display:flex;align-items:center;gap:12px;padding:14px 26px;border-bottom:1px solid var(--line);
+position:fixed;top:0;left:0;right:0;background:rgba(10,10,11,.82);backdrop-filter:blur(14px);z-index:30;
+transition:transform .28s ease,opacity .28s ease}
+/* immersive: header hides; a top hover-zone or mouse-near-top reveals it */
+body.immersive header{transform:translateY(-100%);opacity:0;border-bottom-color:transparent}
+body.immersive header.reveal{transform:translateY(0);opacity:1}
+#tophover{position:fixed;top:0;left:0;right:0;height:24px;z-index:29}
+header .logo{width:26px;height:26px;border-radius:7px;display:block;flex:0 0 auto}
+header h1{font-size:1.02rem;font-weight:600;letter-spacing:.2px}
+header .beta{font-size:.62rem;color:var(--dim);border:1px solid var(--line);border-radius:5px;padding:1px 5px;text-transform:uppercase;letter-spacing:.08em}
+header .sp{flex:1}
+header .lnk{color:var(--dim);font-size:.85rem;text-decoration:none}
+header .user{display:flex;align-items:center;gap:8px;border:1px solid var(--line);border-radius:99px;padding:3px 11px 3px 4px;cursor:pointer}
+#acctmenu{position:fixed;top:52px;right:12px;background:#0e0e12;border:1px solid var(--line);border-radius:12px;padding:6px;display:none;z-index:60;min-width:210px;box-shadow:0 16px 44px #000a}
+#acctmenu.on{display:block}
+#acctmenu .hd{padding:8px 12px;color:var(--dim);font-size:.78rem;border-bottom:1px solid var(--line);margin-bottom:4px}
+#acctmenu .mi{display:flex;align-items:center;gap:8px;padding:10px 12px;border-radius:8px;cursor:pointer;font-size:.88rem;color:var(--txt);text-decoration:none}
+#acctmenu .mi:hover{background:#ffffff10}
+header .user .av{width:24px;height:24px;border-radius:50%;background:#26262e;display:flex;align-items:center;justify-content:center;font-size:.72rem;font-weight:600}
+header .user .nm{font-size:.82rem;color:var(--dim)}
+.btn{border:1px solid var(--line);background:var(--panel);color:var(--txt);border-radius:8px;padding:7px 13px;font-size:.85rem;cursor:pointer}
+.btn:hover{border-color:var(--dim)} .btn.brand{background:var(--brand);border-color:var(--brand);color:#111;font-weight:600}
+main{max-width:1120px;margin:0 auto;padding:12px 24px 80px}
+body{padding-top:56px}  /* clear the fixed header */
+body.immersive{padding-top:0}
+/* persistent live-queue bar — always visible so you can see what's generating */
+#livebar{position:sticky;top:56px;z-index:19;max-width:1120px;margin:0 auto 8px;display:flex;align-items:center;gap:14px;
+  background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:9px 15px;font-size:.84rem}
+#livebar .lb-run{color:var(--ok);display:flex;align-items:center;gap:7px}
+#livebar .lb-run .spin{width:9px;height:9px;border-radius:50%;background:var(--ok);animation:pulse 1.1s infinite}
+@keyframes pulse{0%,100%{opacity:.35}50%{opacity:1}}
+#livebar .lb-q{color:var(--dim)} #livebar .lb-eta{color:var(--warn)} #livebar .sp{flex:1}
+#livebar a.lb-more{color:var(--dim);text-decoration:none;font-size:.8rem;border:1px solid var(--line);border-radius:7px;padding:3px 10px;cursor:pointer}
+#livebar.idle{opacity:.72}
+.hero{text-align:center;font-size:3rem;font-weight:500;margin:56px 0 26px;letter-spacing:-.01em}
+/* prompt box */
+.prompt{background:var(--panel);border:1px solid var(--line);border-radius:16px;padding:16px 16px 12px;max-width:820px;margin:0 auto}
+.prompt textarea{width:100%;background:none;border:none;color:var(--txt);font:inherit;font-size:1.02rem;resize:none;outline:none;min-height:26px;max-height:180px}
+.prompt textarea::placeholder{color:var(--dim)}
+.pctl{display:flex;align-items:center;gap:8px;margin-top:12px}
+.pchip{display:flex;flex-direction:column;line-height:1.1;border:1px solid var(--line);border-radius:9px;padding:5px 11px;background:var(--panel2);cursor:pointer;font-size:.8rem}
+.pchip .k{color:var(--dim);font-size:.64rem;text-transform:uppercase;letter-spacing:.05em}
+.pchip .v{color:var(--txt);font-weight:500}
+.pico{border:1px solid var(--line);border-radius:9px;padding:8px 10px;background:var(--panel2);cursor:pointer;color:var(--dim);font-size:.9rem}
+.psend{margin-left:auto;width:38px;height:38px;border-radius:10px;border:none;background:var(--brand);color:#111;font-size:1.1rem;cursor:pointer}
+/* templates */
+.sec-l{color:var(--dim);font-size:.82rem;margin:40px 0 12px}
+.tgrid{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:12px}
+.tcard{background:var(--panel);border:1px solid var(--line);border-radius:12px;overflow:hidden;cursor:pointer;transition:.12s}
+.tcard:hover{border-color:#3a3a48;transform:translateY(-2px)}
+.tcard .ic{aspect-ratio:16/10;display:flex;align-items:center;justify-content:center;color:var(--dim);font-size:1.7rem;background:var(--panel2)}
+.tcard .tl{padding:9px 11px;font-size:.83rem;font-weight:500}
+.tcard .td{padding:0 11px 10px;font-size:.7rem;color:var(--dim)}
+/* tabs */
+.tabs{display:flex;gap:6px;align-items:center;margin:44px 0 16px;border-bottom:1px solid var(--line);padding-bottom:0}
+.tabs button{background:none;border:none;color:var(--dim);font-size:.9rem;padding:8px 12px;cursor:pointer;border-radius:8px 8px 0 0;border-bottom:2px solid transparent}
+.tabs button.on{color:var(--txt);border-bottom-color:var(--brand)}
+.tabs .sp{flex:1}
+.search{background:var(--panel);border:1px solid var(--line);border-radius:9px;padding:6px 12px;color:var(--txt);font:inherit;font-size:.85rem;width:220px}
+.chips{display:flex;gap:8px;flex-wrap:wrap;margin:4px 0 18px}
+.chip{border:1px solid var(--line);border-radius:99px;padding:4px 12px;font-size:.8rem;color:var(--dim);cursor:pointer}
+.chip.on{color:#111;background:var(--brand);border-color:var(--brand);font-weight:600}
+.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(215px,1fr));gap:15px}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:13px;overflow:hidden;display:flex;flex-direction:column}
+.card .im{aspect-ratio:2/3;background:#0f0f12 center/cover no-repeat;cursor:zoom-in}
+.card .doc{aspect-ratio:2/3;display:flex;align-items:center;justify-content:center;color:var(--dim);font-size:.8rem;text-align:center;padding:12px}
+.card .meta{padding:10px 12px;display:flex;flex-direction:column;gap:7px}
+.card .t{font-size:.82rem;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+.card .sub{font-size:.7rem;color:var(--dim);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+.row{display:flex;gap:6px;align-items:center;flex-wrap:wrap}
+.st{font-size:.66rem;font-weight:600;border-radius:99px;padding:2px 8px;text-transform:uppercase;letter-spacing:.4px}
+.st.draft{background:#2a2a31;color:var(--dim)}.st.approved{background:rgba(61,220,132,.15);color:var(--ok)}
+.st.queued{background:rgba(255,182,72,.15);color:var(--warn)}.st.published{background:rgba(106,165,255,.18);color:var(--pub)}
+.mini{border:1px solid var(--line);background:none;color:var(--dim);border-radius:7px;padding:4px 9px;font-size:.72rem;cursor:pointer}
+.mini:hover{color:var(--txt);border-color:var(--dim)} .mini.hot{color:#111;background:var(--brand);border-color:var(--brand);font-weight:600}
+.empty{color:var(--dim);padding:44px;text-align:center}
+#toast{position:fixed;bottom:22px;left:50%;transform:translateX(-50%);background:#1c1c22;border:1px solid var(--line);border-radius:10px;padding:10px 18px;font-size:.85rem;opacity:0;transition:.25s;pointer-events:none;z-index:50}
+#toast.show{opacity:1}
+#zoom{position:fixed;inset:0;background:rgba(0,0,0,.9);display:none;align-items:center;justify-content:center;z-index:40;cursor:zoom-out}
+#zoom img{max-width:94vw;max-height:94vh;border-radius:8px}
+dialog{background:var(--panel);color:var(--txt);border:1px solid var(--line);border-radius:14px;padding:22px;max-width:460px;width:92vw}
+dialog::backdrop{background:rgba(0,0,0,.6)} dialog textarea{width:100%;background:#0f0f12;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:10px;font:inherit;font-size:.9rem;min-height:90px;margin:12px 0}
+#bulkbar{position:fixed;bottom:20px;left:50%;transform:translateX(-50%);background:#1a1a24;border:1px solid #34344a;border-radius:12px;padding:9px 14px;display:none;gap:9px;align-items:center;z-index:45;box-shadow:0 10px 32px #000a}
+#bulkbar.on{display:flex} #bulkn{font-size:.82rem;color:#cfcfe0;margin-right:4px}
+.card.sel-mode{cursor:pointer} .card.picked{outline:2px solid var(--brand);outline-offset:-2px}
+/* cleaner grid: tools hidden until hover */
+.card .tools{max-height:0;overflow:hidden;opacity:0;transition:.15s}
+.card:hover .tools{max-height:60px;opacity:1;margin-top:2px}
+.card .meta{gap:5px}
+.card .pick{position:absolute;top:8px;left:9px;width:20px;height:20px;border-radius:5px;border:1.5px solid #fff;background:rgba(0,0,0,.5);display:none;align-items:center;justify-content:center;font-size:.8rem;color:#111;z-index:3}
+.card{position:relative} .sel-mode .pick{display:flex} .picked .pick{background:var(--brand)}
+/* YouTube-style queue + history */
+.qcol{margin-bottom:26px} .qh{font-size:.9rem;font-weight:600;margin-bottom:10px;color:var(--txt);display:flex;align-items:center;gap:8px}
+.qlist{display:flex;flex-direction:column;gap:8px}
+.qrow{display:flex;align-items:center;gap:13px;background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:9px 13px}
+.qrow:hover{border-color:#333340}
+.qrow .qthumb{width:60px;height:80px;border-radius:7px;background:#0f0f12 center/cover;flex:0 0 auto;font-size:1.1rem}
+.qrow .qtitle{flex:1;min-width:0;font-size:.88rem;font-weight:500}
+.qrow .qdesc{font-size:.76rem;color:#b3b3bd;margin-top:3px;line-height:1.35;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden}
+.qrow .qsub{font-size:.72rem;color:var(--dim);margin-top:4px}
+.stars{display:inline-flex;gap:1px;cursor:pointer} .stars span{font-size:1rem;color:#3a3a44;transition:.1s} .stars span.on{color:#ffcf4a}
+.notebox{width:100%;background:#0f0f12;color:var(--txt);border:1px solid var(--line);border-radius:7px;padding:6px 9px;font:inherit;font-size:.76rem;margin-top:6px;min-height:34px;resize:vertical}
+.fav{cursor:pointer;font-size:1rem;color:#3a3a44} .fav.on{color:#ffcf4a}
+dialog .drop{border:1.5px dashed var(--line);border-radius:9px;padding:14px;text-align:center;color:var(--dim);font-size:.82rem;margin:8px 0;cursor:pointer}
+.drop.drag{border-color:var(--brand);color:var(--txt)}
+.prompt.drag{outline:2px dashed var(--brand);outline-offset:2px}
+.dlgerr{display:none;color:#ff8f8f;background:rgba(192,57,43,.12);border:1px solid rgba(192,57,43,.4);border-radius:8px;padding:8px 11px;font-size:.8rem;margin:8px 0 0;white-space:pre-wrap}
+.ctxlabel{font-size:.66rem;text-transform:uppercase;letter-spacing:.05em;color:var(--dim);margin:14px 0 6px}
+.wst{font-size:.66rem;font-weight:600;border-radius:99px;padding:1px 7px}
+.wst.queued{color:var(--warn)}.wst.running{color:var(--ok)}.wst.done{color:var(--pub)}.wst.failed{color:#ff8f8f}.wst.cancelled{color:var(--dim)}
+.wmeta{font-size:.72rem;color:var(--dim);margin-top:3px;display:flex;gap:8px;flex-wrap:wrap;align-items:center}
+.wnode{border:1px solid var(--line);border-radius:6px;padding:0 6px;color:var(--txt)}
+.qhead{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:0 0 14px;font-size:.8rem;color:var(--dim)}
+.nodebadge{display:inline-flex;align-items:center;gap:6px;border:1px solid var(--line);border-radius:99px;padding:3px 11px;background:var(--panel)}
+.nodebadge .dot{width:7px;height:7px;border-radius:50%;background:#555}
+.nodebadge.on .dot{background:var(--ok)} .nodebadge.off{opacity:.6}
+.qhead .mstat{margin-left:auto;color:var(--dim)}
+#ctxdlg{max-width:560px}
+.card .addref{position:absolute;top:8px;right:9px;width:26px;height:26px;border-radius:50%;border:none;background:rgba(0,0,0,.6);color:#fff;font-size:1rem;cursor:pointer;z-index:4;line-height:1}
+.card .addref:hover{background:var(--brand);color:#111} .card .addref.on{background:var(--brand);color:#111}
+.card .delx{position:absolute;top:8px;left:9px;width:26px;height:26px;border-radius:50%;border:none;background:rgba(0,0,0,.6);color:#fff;font-size:.85rem;cursor:pointer;z-index:4;line-height:1;opacity:.8}
+.card .delx:hover{background:#c0392b;color:#fff;opacity:1}
+#reftray{position:fixed;bottom:20px;left:50%;transform:translateX(-50%);background:#1a1a24;border:1px solid #34344a;border-radius:12px;padding:10px 14px;display:none;gap:11px;align-items:center;z-index:44;box-shadow:0 10px 32px #000a}
+#reftray.on{display:flex} #reftray .rt{width:38px;height:56px;object-fit:cover;border-radius:5px;border:1px solid var(--line)}
+/* ── Immersive full-viewport stage (editorial hero) ────────────────────────── */
+#stage{position:relative;width:100vw;height:100vh;overflow:hidden;background:#000;display:none;user-select:none}
+body.immersive #stage{display:block}
+#stage .slide{position:absolute;inset:0;background:#000 center/cover no-repeat;opacity:0;transition:opacity .6s ease}
+#stage .slide.on{opacity:1}
+#stage .cap{position:absolute;left:48px;bottom:56px;z-index:6;max-width:60vw;text-shadow:0 2px 20px rgba(0,0,0,.6)}
+#stage .cap .k{font-size:.72rem;letter-spacing:.18em;text-transform:uppercase;color:rgba(255,255,255,.75)}
+#stage .cap .t{font-size:2.2rem;font-weight:500;color:#fff;margin-top:6px;font-family:"Iowan Old Style",Georgia,serif}
+#stage .cap .tools{display:flex;gap:8px;margin-top:14px;opacity:0;transition:.2s} #stage:hover .cap .tools{opacity:1}
+#stage .nav{position:absolute;top:0;bottom:0;width:16vw;z-index:5;cursor:pointer;display:flex;align-items:center;color:rgba(255,255,255,.0);font-size:2rem;transition:.2s}
+#stage .nav:hover{color:rgba(255,255,255,.9)} #stage .nav.prev{left:0;justify-content:flex-start;padding-left:28px} #stage .nav.next{right:0;justify-content:flex-end;padding-right:28px}
+#stage .dots{position:absolute;bottom:26px;left:50%;transform:translateX(-50%);display:flex;gap:7px;z-index:6}
+#stage .dots span{width:6px;height:6px;border-radius:50%;background:rgba(255,255,255,.35);cursor:pointer} #stage .dots span.on{background:#fff;width:20px;border-radius:4px}
+#stage .exit{position:absolute;top:18px;right:22px;z-index:7;color:#fff;background:rgba(0,0,0,.4);border:1px solid rgba(255,255,255,.25);border-radius:8px;padding:6px 12px;font-size:.8rem;cursor:pointer;opacity:0;transition:.2s} #stage:hover .exit{opacity:1}
+.viewbtn{border:1px solid var(--line);background:var(--panel);color:var(--txt);border-radius:8px;padding:7px 13px;font-size:.85rem;cursor:pointer}
+/* The Studio/Editor toggle, wallet, GPUs and chat sidebar are the shared shell
+   (/studio/shell.css + shell.js), loaded in both views. */
+/* ── Responsive: tablet ≤900px, phone ≤600px ─────────────────────────────── */
+@media (max-width:900px){
+  main{padding:12px 16px 90px}
+  .hero{font-size:2.1rem;margin:34px 0 20px}
+  .grid{grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:11px}
+  .tgrid{grid-template-columns:repeat(auto-fill,minmax(120px,1fr))}
+  #livebar{margin-left:16px;margin-right:16px}
+}
+@media (max-width:600px){
+  header{padding:11px 14px;gap:9px}
+  header h1{font-size:.95rem} header .beta{display:none} header .lnk{display:none}
+  header .user .nm{display:none}  /* avatar only on phone */
+  .hero{font-size:1.6rem;margin:22px 0 16px}
+  .prompt{padding:12px 12px 10px;border-radius:13px}
+  .prompt textarea{font-size:.95rem}
+  .pctl{flex-wrap:wrap;gap:6px} .psend{margin-left:0}
+  .grid{grid-template-columns:repeat(auto-fill,minmax(46vw,1fr));gap:9px}
+  .tgrid{grid-template-columns:repeat(auto-fill,minmax(44vw,1fr))}
+  .sec-l{margin:26px 0 10px}
+  .tabs{overflow-x:auto;white-space:nowrap;-webkit-overflow-scrolling:touch}
+  .tabs button{padding:8px 10px;font-size:.84rem}
+  .search{width:120px} .tabs .sp{display:none}
+  #livebar{flex-wrap:wrap;font-size:.78rem}
+  #bulkbar,#reftray{left:8px;right:8px;transform:none;flex-wrap:wrap;justify-content:center}
+  .card .delx,.card .addref{width:30px;height:30px}  /* bigger tap targets */
+}
+/* touch: no hover-reveal — always show card tools on touch devices */
+@media (hover:none){
+  .card .tools{max-height:none;opacity:1;margin-top:2px}
+}
+</style>
+<header>
+  <svg class="logo" viewBox="0 0 520 520" xmlns="http://www.w3.org/2000/svg"><rect width="520" height="520" rx="120" fill="#111"/><g transform="translate(100,100) scale(4.78)" fill="#fff"><path d="M22.21 67V44.6369H0V67H22.21Z"/><path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z"/><path d="M22.21 0H0V22.3184H22.21V0Z"/><path d="M66.7198 0H44.5098V22.3184H66.7198V0Z"/><path d="M66.7198 67V44.6369H44.5098V67H66.7198Z"/></g></svg>
+  <h1>Hanzo Studio</h1><span class="beta">Beta</span><span class="sp"></span>
+  <button class="btn" onclick="load()">Refresh</button>
+  <div class="user" id="user" title="Account"><span class="av" id="av">·</span><span class="nm" id="org">…</span></div>
+</header>
+<div id="acctmenu"><div class="hd" id="acctwho">Account</div><a class="mi" href="https://hanzo.id" target="_blank" rel="noopener">Manage account ↗</a><a class="mi" href="/logout">Sign out</a></div>
+<div id="tophover"></div>
+<div id="livebar" class="idle">
+  <span id="lbstatus" class="lb-q">Checking queue…</span>
+  <span class="sp"></span>
+  <a class="lb-more" onclick="tab('runs');document.getElementById('runs').scrollIntoView({behavior:'smooth'})">Queue &amp; History →</a>
+</div>
+<main>
+  <h2 class="hero serif">What should we create?</h2>
+  <div class="prompt">
+    <textarea id="pin" rows="1" placeholder="Describe what you want to create…"></textarea>
+    <div class="pctl">
+      <span class="pico" title="Attach a photo" onclick="attachPick()">+</span>
+      <input id="attachfile" type="file" accept="image/*" multiple hidden>
+      <span class="pchip" onclick="pickPreset()"><span class="k">Design system</span><span class="v" id="ds">None</span></span>
+      <span class="pchip" onclick="tab('templates')"><span class="k">Template</span><span class="v" id="tmpl">None</span></span>
+      <span class="pico" title="Code">&lt;/&gt;</span>
+      <span class="pchip" style="margin-left:auto"><span class="k">Model</span><span class="v">Opus 4.8</span></span>
+      <button class="psend" onclick="create()" title="Create">↑</button>
+    </div>
+  </div>
+
+  <div class="sec-l">Use a template</div>
+  <div class="tgrid" id="tcards"></div>
+
+  <div class="tabs">
+    <button class="on" data-tab="assets" onclick="tab('assets')">Assets</button>
+    <button data-tab="templates" onclick="tab('templates')">Templates</button>
+    <button data-tab="pipelines" onclick="tab('pipelines')">Workflows</button>
+    <button data-tab="runs" onclick="tab('runs')">Queue &amp; History</button>
+    <span class="sp"></span>
+    <button class="btn" id="selbtn" onclick="toggleSel()" style="padding:6px 12px">Select</button>
+    <input class="search" id="q" placeholder="Search…" oninput="render()">
+  </div>
+  <section id="assets"><div class="chips" id="filters"></div><div class="grid" id="agrid"></div></section>
+  <div id="bulkbar"><span id="bulkn">0 selected</span>
+    <button class="mini hot" onclick="openCompose()" title="Combine selected assets into a new one">✦ Compose new</button>
+    <button class="mini" onclick="bulk('approved')">Approve</button>
+    <button class="mini" onclick="bulk('published')">Publish</button>
+    <button class="mini" onclick="bulkFork()">Fork / redo</button>
+    <button class="mini" onclick="bulk('deleted')">Delete</button>
+    <button class="mini" onclick="clearSel()">Cancel</button>
+  </div>
+  <section id="templates" hidden>
+    <div class="sec-l">Your templates</div>
+    <div class="tgrid" id="orgtmpl"></div>
+    <div class="sec-l">Start from a kind</div>
+    <div class="grid" id="tgall"></div>
+  </section>
+  <section id="pipelines" hidden><div class="grid" id="wfgrid"></div></section>
+  <section id="runs" hidden>
+    <div id="qhead" class="qhead"></div>
+    <div class="qcol"><h3 class="qh">🗂 Your work
+      <input class="search" id="wlq" placeholder="Search prompts…" oninput="worklog()" style="margin-left:10px"></h3>
+      <div class="qlist" id="wllist"></div></div>
+    <div class="qcol"><h3 class="qh">▶ Now running <span id="qrunN" class="cnt">0</span></h3><div class="qlist" id="qrun"></div></div>
+    <div class="qcol"><h3 class="qh">⏳ Up next <span id="qpendN" class="cnt">0</span> <button class="mini" onclick="clearQueue()" style="margin-left:8px">Clear all</button></h3><div class="qlist" id="qpend"></div></div>
+    <div class="qcol"><h3 class="qh">✓ History — rate &amp; note for better future generations</h3><div class="grid" id="rgrid"></div></div>
+  </section>
+</main>
+<div id="reftray">
+  <div style="font-size:.72rem;color:var(--dim);text-transform:uppercase;letter-spacing:.05em">Next generation</div>
+  <div id="refthumbs" style="display:flex;gap:6px;align-items:center"></div>
+  <input id="refprompt" placeholder="Describe what to make from these…" style="background:#0f0f12;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:7px 11px;font:inherit;font-size:.82rem;width:280px">
+  <button class="mini hot" onclick="genFromTray()">✦ Generate</button>
+  <button class="mini" onclick="clearTray()">Clear</button>
+</div>
+<div id="toast"></div>
+<div id="zoom" onclick="this.style.display='none'"><img id="zoomimg"></div>
+<dialog id="fixdlg">
+  <h3 id="fixtitle" style="font-size:1rem">Fix with chat</h3>
+  <p id="fixdesc" style="color:var(--dim);font-size:.83rem;margin-top:6px">Describe the change — a new render is queued from this image. Add reference photos (drag in, or pick from your history) to guide it.</p>
+  <div class="row" id="fixrefs" style="margin:12px 0 0;flex-wrap:wrap"></div>
+  <div class="drop" id="fixdrop">Drag images here, or <b>click to upload</b> references</div>
+  <input id="fixfile" type="file" accept="image/*" multiple hidden>
+  <textarea id="fixtext" placeholder="e.g. make the straps thicker, smooth the skin"></textarea>
+  <div id="gpuwarn" style="display:none;color:var(--warn);font-size:.78rem;margin:-4px 0 8px"></div>
+  <div id="fixerr" class="dlgerr"></div>
+  <div class="row" style="justify-content:space-between">
+    <button class="mini" id="fixhistbtn" onclick="toggleFixHistory()">+ From history</button>
+    <div class="row"><button class="mini" onclick="fixdlg.close()">Cancel</button><button class="mini hot" onclick="sendFix()">Queue fix</button></div>
+  </div>
+  <div id="fixhist" style="display:none;max-height:210px;overflow:auto;margin-top:10px;border-top:1px solid var(--line);padding-top:10px"></div>
+</dialog>
+<dialog id="tmpldlg">
+  <h3 style="font-size:1rem">★ Save as template</h3>
+  <p style="color:var(--dim);font-size:.83rem;margin-top:6px">Turn this favorited generation into a reusable template — its workflow becomes a one-click KIND you can run again with new inputs.</p>
+  <label style="display:block;font-size:.72rem;color:var(--dim);margin:12px 0 4px;text-transform:uppercase;letter-spacing:.04em">Template name</label>
+  <input id="tmplname" style="width:100%;background:#0f0f12;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:9px 11px;font:inherit" placeholder="e.g. Karma ghost mannequin — white studio">
+  <label style="display:block;font-size:.72rem;color:var(--dim);margin:12px 0 4px;text-transform:uppercase;letter-spacing:.04em">What it makes</label>
+  <input id="tmpldesc" style="width:100%;background:#0f0f12;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:9px 11px;font:inherit" placeholder="e.g. Product on invisible form, real fabric">
+  <div id="tmplsteps" style="color:var(--dim);font-size:.78rem;margin-top:12px;line-height:1.6"></div>
+  <div class="row" style="justify-content:flex-end;margin-top:8px"><button class="mini" onclick="tmpldlg.close()">Cancel</button><button class="mini hot" onclick="saveTemplate()">Save template</button></div>
+</dialog>
+<dialog id="ctxdlg">
+  <div class="row"><h3 id="ctxtitle" style="font-size:1rem;flex:1">Work item</h3><button class="mini" onclick="ctxdlg.close()">Close</button></div>
+  <div id="ctxbody" style="margin-top:6px"></div>
+  <div class="row" style="justify-content:flex-end;margin-top:14px;gap:6px">
+    <button class="mini" id="ctxcancel" onclick="cancelCtx()" style="display:none">✕ Cancel job</button>
+    <button class="mini" id="ctxedit" onclick="editCtx()" style="display:none">✎ Edit</button>
+    <button class="mini" id="ctxeditor" onclick="editorCtx()" title="Load this graph into the node editor" style="display:none">⇄ Open in Editor</button>
+    <button class="mini" id="ctxreuse" onclick="reuseCtx()" title="Open Fix primed with this prompt + references">↻ Reuse context</button>
+    <button class="mini hot" id="ctxfix" onclick="fixCtx()">Fix this version</button>
+  </div>
+</dialog>
+<dialog id="compdlg">
+  <h3 style="font-size:1rem">✦ Compose new from <span id="compn">0</span> assets</h3>
+  <p style="color:var(--dim);font-size:.83rem;margin-top:6px">Explain HOW to use the selected assets — e.g. "put the garment from the first onto the model in the second, keep the second's lighting."</p>
+  <div class="row" id="compthumbs" style="margin:10px 0 0;flex-wrap:wrap"></div>
+  <textarea id="comptext" placeholder="e.g. combine these — garment from #1 on the model + pose from #2, studio white background"></textarea>
+  <div id="gpuwarn2" style="display:none;color:var(--warn);font-size:.78rem;margin:-4px 0 8px"></div>
+  <div class="row" style="justify-content:flex-end"><button class="mini" onclick="compdlg.close()">Cancel</button><button class="mini hot" onclick="sendCompose()">Generate</button></div>
+</dialog>
+<script>
+// ── Template / KIND catalog — everything Studio supports ─────────────────────
+const TEMPLATES=[
+ // ── Fashion / commerce (the proven karma workflows, systematized) ──
+ {k:'cad_ghost', t:'CAD → Ghost mannequin', d:'Real fabric, invisible form', ic:'👕', wf:'cad_ghost', grp:'Fashion'},
+ {k:'outfit',    t:'Outfit switcher',       d:'Swap clothes, keep model+light', ic:'🔁', wf:'outfit', grp:'Fashion'},
+ {k:'product',   t:'Product photography',   d:'Ecom front·side·back',        ic:'🛍', wf:'product', grp:'Fashion'},
+ {k:'lifestyle', t:'Lifestyle photography', d:'Same model/3D, in scene',     ic:'🌅', wf:'lifestyle', grp:'Fashion'},
+ {k:'cad_mockup',t:'CAD → mockup',          d:'Fashion / packaging',         ic:'✳️', wf:'cad_mockup', grp:'Fashion'},
+ {k:'cad_3d',    t:'CAD → 3D + drape',      d:'Multi-view → 3D, fabric drape',ic:'🧊', wf:'cad_3d', grp:'Fashion'},
+ // ── Media ──
+ {k:'video',     t:'Video',           d:'Wan · LTX · Hunyuan',        ic:'🎬', wf:'video', grp:'Media'},
+ {k:'music',     t:'Music',           d:'ACE-Step · song',            ic:'🎵', wf:'music', grp:'Media'},
+ {k:'voice',     t:'Voice',           d:'Narration · TTS',            ic:'🎙', wf:'voice', grp:'Media'},
+ // ── Marketing ──
+ {k:'social',    t:'Social / Ad',     d:'Posts · ads · campaigns',    ic:'📣', wf:'social', grp:'Marketing'},
+ {k:'email',     t:'Marketing email', d:'HTML / MJML',                ic:'✉️', wf:'email', grp:'Marketing'},
+ {k:'deck',      t:'Deck',            d:'Sales · investor',           ic:'📊', wf:'deck', grp:'Marketing'},
+ // ── Documents ──
+ {k:'doc',       t:'Document',        d:'Word · guide',               ic:'📄', wf:'doc', grp:'Documents'},
+ {k:'sheet',     t:'Spreadsheet',     d:'xlsx · data',                ic:'🧮', wf:'sheet', grp:'Documents'},
+ {k:'paper',     t:'Paper (LaTeX)',   d:'Academic · PDF',             ic:'📐', wf:'paper', grp:'Documents'},
+ // ── Web ──
+ {k:'site',      t:'Website / App',   d:'From hanzo.app templates',   ic:'🖥', wf:'site', grp:'Web'},
+];
+let DATA={assets:[],workflows:[]},FILTER='all';
+const $=id=>document.getElementById(id);
+const toast=m=>{const t=$('toast');t.textContent=m;t.classList.add('show');setTimeout(()=>t.classList.remove('show'),3000)};
+const imgURL=a=>`/v1/library/file?path=${encodeURIComponent(a.path)}`;
+const thumbURL=a=>`/v1/library/file?thumb=1&path=${encodeURIComponent(a.path)}`;
+function tcard(x){return `<div class="tcard" onclick="pickTemplate('${x.k}','${x.t.replace(/'/g,"")}')"><div class="ic">${x.ic}</div><div class="tl">${x.t}</div><div class="td">${x.d}</div></div>`;}
+function tab(name){document.querySelectorAll('.tabs button').forEach(b=>b.classList.toggle('on',b.dataset.tab===name));
+  for(const s of ['assets','templates','pipelines','runs'])$(s).hidden=s!==name;
+  if(name==='runs')runs(); if(name==='pipelines')pipes(); if(name==='templates')loadOrgTemplates();}
+// ── Org templates: saved graphs, Open in Editor + Render (the ONE dispatch path) ──
+async function loadOrgTemplates(){
+  let d={templates:[]}; try{d=await (await fetch('/v1/templates')).json();}catch(_){}
+  const ts=d.templates||[];
+  $('orgtmpl').innerHTML=ts.length?ts.map(t=>{const nm=(t.name||t.slug).replace(/</g,'&lt;'),ne=(t.name||t.slug).replace(/'/g,"\\'");
+    return `<div class="tcard"><div class="ic">★</div><div class="tl">${nm}</div>
+      <div class="td">${t.ts?new Date(t.ts*1000).toLocaleDateString():''}</div>
+      <div class="row" style="padding:0 11px 11px;gap:6px">
+        <a class="mini" href="/?advanced=1&template=${encodeURIComponent(t.slug)}">Open in Editor</a>
+        ${t.renderable?`<button class="mini hot" onclick="renderTemplate('${t.slug}','${ne}')">Render</button>`:''}
+      </div></div>`;}).join(''):'<div class="empty" style="grid-column:1/-1;padding:20px">No templates yet. In the Editor, build a graph and click ★ Template to save one.</div>';
+}
+async function renderTemplate(slug,name){
+  toast('Queueing '+name+'…');
+  const r=await fetch('/v1/templates/render',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:slug})});
+  const j=await r.json().catch(()=>({}));
+  toast(r.ok?'Render queued → see Queue & History':'Failed: '+(errMsg(j)||('error '+r.status)));
+}
+function editorCtx(){ if(CTX&&CTX.id)location.href='/?advanced=1&load='+encodeURIComponent(CTX.id); }
+function pickTemplate(k,t){$('tmpl').textContent=t; tab('assets'); $('pin').focus(); toast('Template: '+t);}
+function pickPreset(){toast('Design systems / presets — coming in the preset library');}
+function create(){const p=$('pin').value.trim(); const t=$('tmpl').textContent;
+  if(!p&&t==='None'){toast('Describe what to create, or pick a template');return;}
+  toast('Creation flow wires copilot → exec/tasks (HIP-0506 phase 1)');
+  // real path once phase 1 lands: POST /v1/studio/create {prompt,template,design_system}
+}
+async function load(){
+  const r=await fetch('/v1/library'); DATA=await r.json(); $('org').textContent=DATA.org||'';
+  $('tcards').innerHTML=TEMPLATES.slice(0,7).map(tcard).join('');
+  // Templates tab: grouped by category
+  const grps=[...new Set(TEMPLATES.map(t=>t.grp))];
+  $('tgall').innerHTML=grps.map(g=>`<div style="grid-column:1/-1;color:var(--dim);font-size:.8rem;margin:8px 0 2px">${g}</div>`+
+    TEMPLATES.filter(t=>t.grp===g).map(tcard).join('')).join('');
+  const groups=[...new Set(DATA.assets.map(a=>a.design).filter(Boolean))].sort();
+  const delN=DATA.assets.filter(a=>a.status==='deleted').length;
+  const chips=['all','marketing',...groups];
+  $('filters').innerHTML=chips.map(g=>`<span class="chip ${g===FILTER?'on':''}" onclick="FILTER='${g}';render()">${g}</span>`).join('')
+    +`<span class="chip ${FILTER==='deleted'?'on':''}" onclick="FILTER='deleted';render()" style="margin-left:auto">🗑 Deleted${delN?' ('+delN+')':''}</span>`;
+  render();
+}
+let SELMODE=false; const SEL=new Set();
+function toggleSel(){SELMODE=!SELMODE;$('selbtn').classList.toggle('brand',SELMODE);if(!SELMODE)SEL.clear();updateBulk();render();}
+function clearSel(){SEL.clear();SELMODE=false;$('selbtn').classList.remove('brand');updateBulk();render();}
+function updateBulk(){$('bulkbar').classList.toggle('on',SELMODE&&SEL.size>0);$('bulkn').textContent=SEL.size+' selected';}
+function pick(ev,path){ev.stopPropagation();if(SEL.has(path))SEL.delete(path);else SEL.add(path);updateBulk();render();}
+function render(){
+  const q=($('q').value||'').toLowerCase();
+  const showDel=FILTER==='deleted';
+  let rows=DATA.assets.filter(a=>{
+    if(showDel)return a.status==='deleted';
+    if(a.status==='deleted')return false;               // hide trashed from normal views
+    return FILTER==='all'?true:FILTER==='marketing'?(a.path||'').startsWith('marketing/'):a.design===FILTER;
+  });
+  if(q)rows=rows.filter(a=>(a.path||'').toLowerCase().includes(q));
+  $('agrid').innerHTML=rows.map(a=>{
+    const i=DATA.assets.indexOf(a);
+    const img=/\.(png|jpe?g|webp)$/i.test(a.path||'');
+    const prov=a.prov&&a.prov.workflow?` · ${a.prov.workflow}`:'';
+    const picked=SEL.has(a.path);
+    const cardClick=SELMODE?`onclick="pick(event,'${a.path.replace(/'/g,"\\'")}')"`:'';
+    const inTray=trayHasLib(a.path);
+    const pe=a.path.replace(/'/g,"\\'");
+    return `<div class="card ${SELMODE?'sel-mode':''} ${picked?'picked':''}" ${cardClick}>
+      <div class="pick">${picked?'✓':''}</div>
+      ${img&&!SELMODE?`<button class="addref ${inTray?'on':''}" title="Add to next generation" onclick="event.stopPropagation();addRef('${pe}')">${inTray?'✓':'+'}</button>`:''}
+      ${img&&!SELMODE&&!showDel?`<button class="delx" title="Move to Deleted (recoverable)" onclick="event.stopPropagation();quickDel('${pe}')">🗑</button>`:''}
+      ${img?`<div class="im" style="background-image:url('${thumbURL(a)}')" ${SELMODE?'':`onclick="zoom('${imgURL(a)}')"`}></div>`
+           :`<div class="doc">${(a.path||'').split('/').pop()}</div>`}
+      <div class="meta">
+        <span class="t">${(a.path||'').split('/').pop()}</span>
+        <span class="sub">${a.design||a.kind||''}${prov}</span>
+        <div class="row"><span class="st ${a.status}">${a.status}</span></div>
+        ${SELMODE?'':`<div class="row tools">
+          ${showDel?`<button class="mini" onclick="setSt(${i},'draft')">Recover</button>`:`
+          ${a.status!=='approved'?`<button class="mini" onclick="setSt(${i},'approved')">Approve</button>`:''}
+          ${a.status!=='published'?`<button class="mini" onclick="setSt(${i},'published')">Publish</button>`:''}
+          ${img?`<button class="mini" onclick="rerun(${i})">Re-run</button><button class="mini" onclick="openLineage('${pe}')" title="Show this image's versions (what it came from + later fixes)">Versions</button><button class="mini hot" onclick="openFix(${i})">Fix</button>`:''}
+          <button class="mini" onclick="setSt(${i},'deleted')" title="Move to Deleted (recoverable)">🗑</button>`}
+        </div>`}
+      </div></div>`;}).join('')||`<div class="empty">${showDel?'Deleted is empty.':'No assets in this view yet.'}</div>`;
+}
+async function bulk(status){
+  if(!SEL.size)return;
+  if(status==='deleted'&&!confirm('Move '+SEL.size+' asset(s) to Deleted? (recoverable)'))return;
+  const paths=[...SEL];
+  for(const p of paths){await fetch('/v1/library/status',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,status})});
+    const a=DATA.assets.find(x=>x.path===p);if(a)a.status=status;}
+  toast(paths.length+' → '+status); clearSel();
+}
+async function bulkFork(){ if(!SEL.size)return; toast('Fork/redo '+SEL.size+' — re-running each with a fresh seed');
+  for(const p of [...SEL]){await fetch('/v1/library/rerun',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p})});}
+  clearSel(); }
+// ── Shared image-upload lane (ONE implementation) ────────────────────────────
+// Every "add a photo" surface (composer "+", Fix dialog, drag/drop, paste) funnels
+// through here → POST /upload/image, which lands the file in the caller's org input
+// dir (multi-tenant) and returns its name. Errors are RETURNED, never swallowed, so
+// every caller can SHOW them (no-silent-swallow rule).
+function errMsg(j){ if(!j)return ''; const e=j.error; return (e&&(e.message||e))||j.message||''; }
+async function uploadImage(file){
+  if(!file||!file.type||!file.type.startsWith('image/'))return {error:'not an image file'};
+  const fd=new FormData(); fd.append('image',file,file.name||'upload.png');
+  try{
+    const r=await fetch('/upload/image',{method:'POST',body:fd});
+    let j={}; try{j=await r.json();}catch(_){}
+    if(!r.ok)return {error:errMsg(j)||('upload failed ('+r.status+')')};
+    if(!j.name)return {error:'upload failed (no name returned)'};
+    return {name:j.name};
+  }catch(e){ return {error:'upload failed ('+((e&&e.message)||e)+')'}; }
+}
+async function uploadMany(files,onName,onErr){ for(const f of [...files]){ const r=await uploadImage(f); if(r.name)onName(r.name); else onErr(r.error); } }
+function wireDrop(el,onFiles){
+  ['dragenter','dragover'].forEach(ev=>el.addEventListener(ev,e=>{e.preventDefault();el.classList.add('drag');}));
+  ['dragleave','dragend'].forEach(ev=>el.addEventListener(ev,e=>{e.preventDefault();el.classList.remove('drag');}));
+  el.addEventListener('drop',e=>{e.preventDefault();el.classList.remove('drag');if(e.dataTransfer&&e.dataTransfer.files&&e.dataTransfer.files.length)onFiles(e.dataTransfer.files);});
+}
+function wirePaste(el,onFiles){ el.addEventListener('paste',e=>{const items=(e.clipboardData&&e.clipboardData.items)||[]; const fs=[...items].filter(i=>i.kind==='file').map(i=>i.getAsFile()).filter(Boolean); if(fs.length){e.preventDefault();onFiles(fs);}}); }
+const inputThumb=name=>`/v1/library/file?input=1&path=${encodeURIComponent(name)}`;
+// ── Reference tray: "+" on any photo / composer attach → next generation ──────
+// Holds mixed refs: {kind:'lib', ref:<library path>} and {kind:'up', ref:<input name>}.
+let TRAY=[];
+const trayHasLib=path=>TRAY.some(r=>r.kind==='lib'&&r.ref===path);
+function addRef(path){ const i=TRAY.findIndex(r=>r.kind==='lib'&&r.ref===path); if(i>=0)TRAY.splice(i,1); else{ if(TRAY.length>=5){toast('Up to 5 references');return;} TRAY.push({kind:'lib',ref:path,thumb:thumbURL({path})}); } drawTray(); render(); }
+function addTrayUpload(name){ if(TRAY.length>=5){toast('Up to 5 references');return;} TRAY.push({kind:'up',ref:name,thumb:inputThumb(name)}); drawTray(); }
+function removeTrayRef(i){ TRAY.splice(i,1); drawTray(); render(); }
+function clearTray(){ TRAY=[]; drawTray(); render(); }
+function drawTray(){
+  $('reftray').classList.toggle('on',TRAY.length>0);
+  $('refthumbs').innerHTML=TRAY.map((r,i)=>`<span style="position:relative;display:inline-block">
+    <img class="rt" src="${r.thumb}" title="${r.ref}">
+    <button onclick="removeTrayRef(${i})" title="Remove" style="position:absolute;top:-6px;right:-6px;width:16px;height:16px;border-radius:50%;border:none;background:#c0392b;color:#fff;font-size:.62rem;line-height:1;cursor:pointer">×</button></span>`).join('');
+}
+function attachPick(){ $('attachfile').click(); }
+async function attachFiles(files){ await uploadMany(files, addTrayUpload, err=>toast('Upload failed: '+err)); }
+async function genFromTray(){
+  const t=$('refprompt').value.trim();
+  if(!TRAY.length){toast('Add photos with + first');return;}
+  if(t.length<3){toast('Describe what to make');return;}
+  if(!(await gpuOnline()))toast('⚠ No GPU online — queues until a BYO-GPU connects');
+  const libs=TRAY.filter(r=>r.kind==='lib').map(r=>r.ref), ups=TRAY.filter(r=>r.kind==='up').map(r=>r.ref);
+  let r;
+  if(libs.length+ups.length===1){                          // single ref → edit (library or uploaded base)
+    r=await fetch('/v1/library/fix',{method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify(libs.length?{path:libs[0],instruction:t}:{upload:ups[0],instruction:t})});
+  }else{                                                    // 2-5 refs → compose
+    r=await fetch('/v1/library/compose',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({paths:libs,uploads:ups,instruction:t})});
+  }
+  const j=await r.json().catch(()=>({}));
+  if(r.ok){ toast('Queued → see Queue & History'); $('refprompt').value=''; clearTray(); }
+  else toast('Failed: '+(errMsg(j)||('error '+r.status)));
+}
+// ── GPU status: fix/compose need an ONLINE GPU worker (Qwen models live there) ──
+let GPU_ONLINE=null, GPU_TS=0;
+async function gpuOnline(){
+  // Check the FLEET (same source dispatch uses), not /v1/engines — a `hanzo gpu
+  // connect` box registers with the fleet, so /v1/engines missed it and the UI
+  // wrongly said "connect a GPU". Cache 15s so we don't hammer it.
+  if(GPU_ONLINE!==null && Date.now()-GPU_TS<15000)return GPU_ONLINE;
+  try{const s=await (await fetch('/v1/gpu-status')).json(); GPU_ONLINE=!!s.online;}
+  catch(_){GPU_ONLINE=false;}
+  GPU_TS=Date.now(); return GPU_ONLINE;
+}
+async function openCompose(){
+  if(SEL.size<2){toast('Select 2+ assets to compose');return;}
+  const paths=[...SEL]; $('compn').textContent=paths.length;
+  $('compthumbs').innerHTML=paths.map((p,i)=>`<div style="text-align:center"><img src="/v1/library/file?thumb=1&path=${encodeURIComponent(p)}" style="width:64px;height:96px;object-fit:cover;border-radius:6px;border:1px solid var(--line)"><div style="font-size:.62rem;color:var(--dim)">#${i+1}</div></div>`).join('');
+  $('comptext').value='';
+  $('gpuwarn2').style.display=(await gpuOnline())?'none':'block';
+  $('gpuwarn2').textContent='⚠ No GPU worker online — this queues but renders only when a BYO-GPU (e.g. spark) is connected.';
+  $('compdlg').showModal();
+}
+async function sendCompose(){
+  const t=$('comptext').value.trim(); if(t.length<3){toast('Describe how to combine them');return;}
+  const paths=[...SEL]; toast('Composing from '+paths.length+' assets…');
+  const r=await fetch('/v1/library/compose',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({paths,instruction:t})});
+  const j=await r.json().catch(()=>({}));
+  if(r.ok){ $('compdlg').close(); toast(`Compose queued (${j.refs} refs) → see Queue & History`); clearSel(); }
+  else{ $('gpuwarn2').style.display='block'; $('gpuwarn2').textContent='Couldn’t queue: '+(errMsg(j)||('error '+r.status)); }
+}
+function pipes(){ $('wfgrid').innerHTML=(DATA.workflows||[]).map(w=>`<div class="card"><div class="doc">⚙︎ ${w}</div><div class="meta"><div class="row"><a class="mini" href="/?advanced=1&workflow=${encodeURIComponent(w)}">Edit</a><a class="mini hot" href="/?advanced=1&workflow=${encodeURIComponent(w)}&run=1">Run</a></div></div></div>`).join('')||'<div class="empty">No saved workflows for this org yet.</div>'; }
+// ── YouTube-style Queue & History ───────────────────────────────────────────
+let RATINGS={};
+const vURL=im=>`/view?filename=${encodeURIComponent(im.filename)}&subfolder=${encodeURIComponent(im.subfolder||'')}&type=${im.type||'output'}`;
+const promptTitle=v=>{ // pull the SaveImage prefix / positive text from the run's graph
+  const g=(v.prompt&&v.prompt[2])||{};
+  for(const n of Object.values(g)){if(n&&n.class_type==='SaveImage')return (n.inputs.filename_prefix||'render').split('/').pop();}
+  return 'render';
+};
+// ── Work log: the org's dispatched renders with real status + full context ────
+let WL=[], CTX=null;
+// live queue status (positions/ETAs/node) computed SERVER-SIDE; QLOCAL seeds the
+// client-side elapsed tick between polls. NODES = the org's GPU nodes for badges.
+let QST={items:{},medians:{},lanes:{},now:0}, QLOCAL=Date.now(), NODES=[];
+const WSTATUS={queued:['⏳','queued'],running:['●','running'],done:['✓','done'],failed:['⚠','failed'],cancelled:['✕','cancelled']};
+const fmtDur=s=>{ s=Math.max(0,Math.round(s)); if(s<60)return s+'s'; const m=Math.floor(s/60),r=s%60; if(s<3600)return m+'m'+(r?(' '+r+'s'):''); return Math.floor(s/3600)+'h '+Math.floor((s%3600)/60)+'m'; };
+const fmtEta=s=>{ s=Math.max(0,Math.round(s)); return s<60?('~'+s+'s est'):('~'+Math.round(s/60)+' min est'); };
+function wlThumb(it){ if(it.output)return thumbURL({path:it.output});
+  if(it.refs&&it.refs[0])return inputThumb(it.refs[0]);
+  if(it.parents&&it.parents[0])return thumbURL({path:it.parents[0]}); return ''; }
+function qmetaHTML(it,e){
+  if(!e)return '';
+  const node=`<span class="wnode">⚙ ${(e.node||it.node||'gpu')}</span>`;
+  if(e.status==='running'){
+    const el=(e.elapsed_seconds||0)+(Date.now()-QLOCAL)/1000;
+    return `<div class="wmeta">${node} · #${e.position}/${e.of} · running <span id="el-${it.id}">${fmtDur(el)}</span>${e.eta_seconds!=null?(' · ~'+fmtDur(e.eta_seconds)+' left'):''}</div>`;
+  }
+  return `<div class="wmeta">${node} · #${e.position}/${e.of} in line · ${fmtEta(e.eta_seconds||0)}</div>`;
+}
+function wlRow(it){
+  const e=QST.items[it.id];                    // live status wins over the stored one
+  const status=(e&&e.status)||it.status;
+  const [ic,lbl]=WSTATUS[status]||['·',status||''];
+  const th=wlThumb(it), when=it.ts?new Date(it.ts*1000).toLocaleString():'';
+  const active=status==='queued'||status==='running';
+  return `<div class="qrow" style="cursor:pointer" onclick="openContext('${it.id}')">
+    <div class="qthumb" style="${th?`background-image:url('${th}');background-size:cover;background-position:center`:'display:flex;align-items:center;justify-content:center;color:var(--dim)'}">${th?'':'🗂'}</div>
+    <div class="qtitle">${it.kind} · <span class="wst ${status}">${ic} ${lbl}</span>
+      <div class="qdesc">${(it.prompt||'(no prompt)').replace(/</g,'&lt;')}</div>
+      ${active&&e?qmetaHTML(it,e):`<div class="qsub">${when}${it.node?(' · ⚙ '+it.node):''}${it.error?` · <span style="color:#ff8f8f">${it.error.replace(/</g,'&lt;')}</span>`:''}</div>`}</div>
+    ${active?`<button class="mini" onclick="event.stopPropagation();openAmend('${it.id}')" title="Amend prompt/refs (re-queues)">Edit</button><button class="mini" onclick="event.stopPropagation();cancelJob('${it.id}')">Cancel</button>`:''}
+    <button class="mini" onclick="event.stopPropagation();openContext('${it.id}')">Open</button></div>`;
+}
+// server does the position/ETA math over the org's OWN jobs; the client only renders.
+async function loadQueueStatus(){ let d; try{d=await (await fetch('/v1/queue/status')).json();}catch(_){d=null;} if(d){QST=d;QLOCAL=Date.now();} }
+async function loadNodes(){ try{const d=await (await fetch('/v1/nodes')).json(); NODES=d.nodes||[];}catch(_){NODES=[];} renderQhead(); }
+function renderQhead(){
+  if(!$('qhead'))return;
+  const badges=(NODES||[]).map(n=>`<span class="nodebadge ${n.online?'on':'off'}"><span class="dot"></span>${n.name}${n.online?'':' · offline'}</span>`).join('')
+    +`<span class="nodebadge on"><span class="dot"></span>studio pod</span>`;
+  const m=QST.medians||{}, ks=Object.keys(m);
+  const ms=ks.length?('median '+ks.map(k=>k+' ~'+fmtDur(m[k])).join(' · ')):'';
+  $('qhead').innerHTML=badges+(ms?`<span class="mstat">${ms}</span>`:'');
+}
+async function refreshQueue(){
+  const before=Object.keys(QST.items||{});
+  await loadQueueStatus(); await worklog(); renderQhead();
+  let fin=0; before.forEach(id=>{ if(!QST.items[id]){ const w=WL.find(x=>x.id===id); if(w&&w.status==='done')fin++; } });
+  if(fin>0)toast('✓ '+fin+' render'+(fin>1?'s':'')+' finished — in your library');
+}
+async function worklog(){
+  const q=($('wlq')&&$('wlq').value||'').trim();
+  let d={items:[]}; try{d=await (await fetch('/v1/worklog'+(q?('?q='+encodeURIComponent(q)):''))).json();}catch(_){}
+  WL=d.items||[];
+  $('wllist').innerHTML=WL.map(wlRow).join('')||'<div class="qsub" style="padding:6px 2px">No work yet — your renders will appear here with full context.</div>';
+}
+function pv(url,label,click){ return `<div style="text-align:center">
+  <img src="${url}" ${click?`onclick="${click}" style="cursor:pointer;`:'style="'}width:60px;height:88px;object-fit:cover;border-radius:6px;border:1px solid var(--line)">
+  <div style="font-size:.58rem;color:var(--dim);margin-top:2px">${label}</div></div>`; }
+function ctxHTML(it,lin){
+  const parents=(it.parents||[]).map(p=>pv(thumbURL({path:p}),'from',`openLibItem('${p.replace(/'/g,"\\'")}')`)).join('');
+  const refs=(it.refs||[]).map(n=>pv(inputThumb(n),(it.uploads||[]).includes(n)?'upload':'ref')).join('');
+  const result=it.output?pv(thumbURL({path:it.output}),'result',`openLibItem('${it.output.replace(/'/g,"\\'")}')`):'';
+  const params=it.params&&Object.keys(it.params).length?Object.entries(it.params).map(([k,v])=>k+':'+v).join(' · '):'';
+  const trail=(it.events||[]).map(e=>`${e.s}${e.ts?(' '+new Date(e.ts*1000).toLocaleTimeString()):''}${e.note?(' — '+e.note.replace(/</g,'&lt;')):''}`).join('  →  ');
+  const chain=[...lin.ancestors.map(a=>[a,a.kind||'ancestor']),...(it.output?[[{path:it.output},'● this']]:[]),...lin.descendants.map(d=>[d,d.kind||'later'])];
+  const chainHTML=chain.length>1?`<div class="ctxlabel">Versions</div><div style="display:flex;gap:8px;overflow-x:auto;padding-bottom:4px">${chain.map(([n,role])=>pv(thumbURL({path:n.path}),role,role==='● this'?'':`openLibItem('${(n.path||'').replace(/'/g,"\\'")}')`)).join('')}</div>`:'';
+  return `${it.prompt?`<div class="ctxlabel">Prompt</div><div style="font-size:.86rem;background:#0f0f12;border:1px solid var(--line);border-radius:8px;padding:9px 11px">${it.prompt.replace(/</g,'&lt;')}</div>`:''}
+   ${(parents||refs||result)?`<div class="ctxlabel">References &amp; result</div><div class="row" style="flex-wrap:wrap">${parents}${refs}${result}</div>`:''}
+   <div class="ctxlabel">Workflow</div><div style="font-size:.82rem;color:var(--dim)">${it.kind} · ${it.status||''}${it.lane&&it.lane!=='local'?(' · '+it.lane):''}${params?(' · '+params):''}</div>
+   ${trail?`<div class="ctxlabel">Process</div><div style="font-size:.78rem;color:var(--dim)">${trail}</div>`:''}
+   ${it.error?`<div class="dlgerr" style="display:block">${it.error.replace(/</g,'&lt;')}</div>`:''}${chainHTML}`;
+}
+async function lineageFor(path){ if(!path)return {ancestors:[],descendants:[],node:''}; try{return await (await fetch('/v1/worklog/lineage?path='+encodeURIComponent(path))).json();}catch(_){return {ancestors:[],descendants:[],node:path};} }
+async function openContext(id){
+  const it=WL.find(x=>x.id===id); if(!it)return; CTX=it;
+  $('ctxtitle').textContent=it.kind+' — '+(it.status||'');
+  $('ctxbody').innerHTML=ctxHTML(it, await lineageFor(it.output));
+  const hasBase=!!(it.output||(it.parents&&it.parents[0]));
+  const live=it.status==='queued'||it.status==='running';
+  $('ctxreuse').style.display=hasBase?'':'none';
+  $('ctxfix').style.display=hasBase?'':'none';
+  $('ctxcancel').style.display=live?'':'none';
+  $('ctxedit').style.display=live?'':'none';
+  $('ctxeditor').style.display=(it.output&&it.id&&!String(it.id).startsWith('failed-'))?'':'none';
+  $('ctxdlg').showModal();
+}
+function cancelCtx(){ if(!CTX)return; ctxdlg.close(); cancelJob(CTX.id); }
+function editCtx(){ if(!CTX)return; ctxdlg.close(); openAmend(CTX.id); }
+async function openLineage(path){
+  CTX={output:path,parents:[],refs:[],uploads:[],prompt:'',kind:'asset',status:''};
+  $('ctxtitle').textContent='Versions'; $('ctxbody').innerHTML=ctxHTML(CTX, await lineageFor(path));
+  $('ctxreuse').style.display='none'; $('ctxfix').style.display=''; $('ctxeditor').style.display='none'; $('ctxdlg').showModal();
+}
+function openLibItem(path){ ctxdlg.close(); zoom(imgURL({path})); }
+async function primeFix(base,prompt,libRefs,upRefs){
+  await openFixPath(base,prompt);
+  (libRefs||[]).filter(p=>p&&p!==base).forEach(p=>{ if(FIXREFS.length<MAXFIXREFS)FIXREFS.push({kind:'lib',ref:p,thumb:thumbURL({path:p})}); });
+  (upRefs||[]).forEach(n=>{ if(FIXREFS.length<MAXFIXREFS)FIXREFS.push({kind:'up',ref:n,thumb:inputThumb(n)}); });
+  drawFixRefs();
+}
+function reuseCtx(){ if(!CTX)return; const base=CTX.output||(CTX.parents&&CTX.parents[0]); if(!base){toast('No base image to reuse');return;} ctxdlg.close(); primeFix(base,CTX.prompt||'',CTX.parents||[],CTX.uploads||[]); }
+function fixCtx(){ if(!CTX)return; const base=CTX.output||(CTX.parents&&CTX.parents[0]); if(!base){toast('No result to fix yet');return;} ctxdlg.close(); openFixPath(base,''); }
+async function runs(){
+  refreshQueue(); loadNodes();
+  RATINGS=await (await fetch('/v1/library/ratings')).json().catch(()=>({}));
+  // live queue
+  let q={queue_running:[],queue_pending:[]}; try{q=await (await fetch('/queue')).json();}catch(_){}
+  const qr=q.queue_running||[], qp=q.queue_pending||[];
+  $('qrunN').textContent=qr.length; $('qpendN').textContent=qp.length;
+  // YouTube-style up-next row: reference thumbnail + title + brief description.
+  const qitem=(it,running,pos)=>{
+    const id=it[1], g=it[2]||{};
+    const nodes=Object.values(g);
+    const title=(nodes.find(n=>n.class_type==='SaveImage')?.inputs?.filename_prefix||id+'').split('/').pop();
+    // reference image(s) attached to this job (fix/compose sources live in input dir)
+    const refs=nodes.filter(n=>n.class_type==='LoadImage').map(n=>n.inputs?.image).filter(Boolean);
+    const thumb=refs.length?`/v1/library/file?thumb=1&input=1&path=${encodeURIComponent(refs[0])}`:'';
+    // brief description = the positive prompt / instruction
+    let desc='';
+    for(const n of nodes){ if(n.class_type&&n.class_type.indexOf('TextEncode')>=0){ const t=n.inputs?.prompt||n.inputs?.text||''; if(t&&!/blurry|deformed|watermark|ghosting/i.test(t.slice(0,40))){desc=t;break;} } }
+    desc=(desc||'').replace(/\.\s*(Photorealistic|Combine|keep the same).*$/i,'').trim().slice(0,140);
+    const eta=running?'rendering now':(pos!=null?`~${(pos+1)*ETA_MIN} min · #${pos+1} in line`:'queued');
+    return `<div class="qrow">
+      <div class="qthumb" style="${thumb?`background-image:url('${thumb}');background-size:cover;background-position:center`:'display:flex;align-items:center;justify-content:center;color:var(--dim)'}">${thumb?'':(running?'▶':'⏳')}</div>
+      <div class="qtitle">${title}<div class="qdesc">${desc||'(no description)'}</div><div class="qsub">${running?'<span style=color:var(--ok)>● </span>':''}${eta}${refs.length>1?` · ${refs.length} refs`:''}</div></div>
+      ${running?'':`<button class="mini" onclick="cancelJob('${id}')">Remove</button>`}</div>`;};
+  // BYO-GPU renders (fix/compose on a connected GPU) — rendered on the worker,
+  // shown here so a dispatched fix is visible (was invisible before).
+  let gjobs=[]; try{gjobs=(await (await fetch('/v1/render-queue')).json()).jobs||[];}catch(_){}
+  const gjRow=j=>`<div class="qrow">
+    <div class="qthumb" style="${j.refs&&j.refs[0]?`background-image:url('/v1/library/file?thumb=1&input=1&path=${encodeURIComponent(j.refs[0])}');background-size:cover;background-position:center`:'display:flex;align-items:center;justify-content:center;color:var(--ok)'}">${j.refs&&j.refs[0]?'':'▶'}</div>
+    <div class="qtitle">${j.prefix||'render'}<div class="qsub"><span style=color:var(--ok)>● </span>rendering on ${j.node||'your GPU'} · ${Math.max(0,Math.round((j.age||0)/60))}m elapsed${QST.items[j.id]&&QST.items[j.id].eta_seconds!=null?(' · ~'+fmtDur(QST.items[j.id].eta_seconds)+' left'):''}</div></div>
+    ${j.id?`<button class="mini" onclick="cancelJob('${j.id}')">Cancel</button>`:''}</div>`;
+  const gjHtml=gjobs.map(gjRow).join('');
+  $('qrun').innerHTML=gjHtml + qr.map(it=>qitem(it,true,null)).join('') || '<div class="qsub" style="padding:6px 2px">Idle — nothing rendering.</div>';
+  $('qpend').innerHTML=qp.map((it,i)=>qitem(it,false,i)).join('')||'<div class="qsub" style="padding:6px 2px">Nothing queued.</div>';
+  // history
+  const h=await (await fetch('/history?max_items=40')).json();
+  const items=Object.entries(h).reverse().map(([id,v])=>{const ims=[];for(const o of Object.values(v.outputs||{}))for(const im of (o.images||[]))if(im.type==='output')ims.push(im);
+    return {id,ok:(v.status||{}).status_str||'?',im:ims[0],title:promptTitle(v)};});
+  $('rgrid').innerHTML=items.map(r=>{
+    const rt=RATINGS[r.id]||{}; const st=rt.stars||0;
+    const stars=[1,2,3,4,5].map(n=>`<span class="${n<=st?'on':''}" onclick="rate('${r.id}',${n})">★</span>`).join('');
+    return `<div class="card">
+      ${r.im?`<div class="im" style="background-image:url('${vURL(r.im)}')" onclick="zoom('${vURL(r.im)}')"></div>`:`<div class="doc">no output</div>`}
+      <div class="meta">
+        <span class="t">${r.title}</span>
+        <div class="row" style="justify-content:space-between">
+          <span class="stars">${stars}</span>
+          <span class="fav ${rt.favorite?'on':''}" onclick="toggleFav('${r.id}','${r.title}')" title="Favorite → save as template">★fav</span>
+        </div>
+        <textarea class="notebox" placeholder="Notes for the AI to improve next time…" onblur="rateNote('${r.id}',this.value)">${(rt.notes||'').replace(/</g,'&lt;')}</textarea>
+      </div></div>`;}).join('')||'<div class="empty">No runs yet.</div>';
+}
+async function clearQueue(){if(!confirm('Clear all queued jobs?'))return;await fetch('/queue',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({clear:true})});toast('Queue cleared');runs();}
+async function rate(key,stars){await fetch('/v1/library/rate',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({key,stars})});RATINGS[key]={...(RATINGS[key]||{}),stars};runs();}
+async function rateNote(key,notes){await fetch('/v1/library/rate',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({key,notes})});toast('Note saved — the AI will use it next time');}
+let FAVKEY=null,FAVTITLE=null;
+async function toggleFav(key,title){const cur=RATINGS[key]||{};const nv=!cur.favorite;
+  await fetch('/v1/library/rate',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({key,favorite:nv})});
+  RATINGS[key]={...cur,favorite:nv};
+  if(nv){FAVKEY=key;FAVTITLE=title;$('tmplname').value=title;$('tmpldesc').value='';
+    $('tmplsteps').innerHTML='This favorited run has an embedded workflow. Saving turns it into a reusable KIND:<br>1 · name it &amp; describe what it makes<br>2 · it appears under Templates for your org<br>3 · run it anytime with new inputs';
+    $('tmpldlg').showModal();}
+  else runs();
+}
+async function saveTemplate(){const nm=$('tmplname').value.trim();if(!nm){toast('Name the template');return;}
+  // Real save: the favorited run's graph is embedded in its output (fetched via
+  // /v1/workflow by the run's id) → POST /v1/templates, the ONE template store the
+  // Editor's ★ Template also writes to.
+  let g=null; try{const wr=await fetch('/v1/workflow?id='+encodeURIComponent(FAVKEY)); if(wr.ok)g=(await wr.json()).graph;}catch(_){}
+  if(!g){$('tmpldlg').close();toast('No graph on this run — open it in the Editor and use ★ Template');return;}
+  const r=await fetch('/v1/templates',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:nm,graph:g})});
+  const j=await r.json().catch(()=>({}));
+  $('tmpldlg').close();toast(r.ok?('★ Saved "'+nm+'" — see Templates'):('Failed: '+(errMsg(j)||('error '+r.status))));
+  if(r.ok&&!$('templates').hidden)loadOrgTemplates();
+}
+async function setSt(i,status){const a=DATA.assets[i];const r=await fetch('/v1/library/status',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:a.path,status})});if(r.ok){a.status=status;render();toast(`${a.path.split('/').pop()} → ${status}`);}else toast('Failed');}
+// Optimistic trash: mark deleted locally + re-render immediately (feels instant),
+// then persist. On failure, revert. This is the always-visible 🗑 on each card.
+async function quickDel(path){
+  const a=DATA.assets.find(x=>x.path===path); if(!a)return;
+  const prev=a.status; a.status='deleted'; render(); toast('Moved to Deleted');
+  try{const r=await fetch('/v1/library/status',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path,status:'deleted'})});
+    if(!r.ok)throw 0;}catch(_){a.status=prev;render();toast('Delete failed — restored');}
+}
+async function rerun(i){const a=DATA.assets[i];toast('Queueing re-run…');const r=await fetch('/v1/library/rerun',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:a.path})});const j=await r.json();toast(r.ok?`Re-run queued — see Runs`:'Failed');}
+// ── Fix surface: base image + up to 4 references (history picks + drag/drop
+// uploads). No references → the single-image edit (/v1/library/fix); any
+// reference → the multi-input compose (/v1/library/compose) — same proven Qwen
+// graph, base image first. 5-ref cap = base + 4. ─────────────────────────────
+let FIXPATH=null;          // the base image (library asset path)
+let FIXREFS=[];            // [{kind:'lib'|'up', ref, thumb}] added references
+let FIXMODE='fix';         // 'fix' (new render) | 'amend' (swap a queued job)
+let AMENDID=null;          // the queued prompt_id when FIXMODE==='amend'
+let ORIGREFS=[];           // amend: the job's current refs (input-dir names), locked base
+let MAXFIXREFS=4;          // added-ref cap = 5 − base count (set per open)
+function drawFixRefs(){
+  let base;
+  if(FIXMODE==='amend'){
+    base=(ORIGREFS||[]).map(n=>`<div style="text-align:center"><img src="${inputThumb(n)}" style="width:56px;height:84px;object-fit:cover;border-radius:6px;border:2px solid var(--brand)"><div style="font-size:.6rem;color:var(--dim);margin-top:3px">current</div></div>`).join('')
+      ||`<div style="font-size:.72rem;color:var(--dim)">Amending queued job</div>`;
+  }else{
+    base=`<div style="text-align:center"><img src="${thumbURL({path:FIXPATH})}" style="width:56px;height:84px;object-fit:cover;border-radius:6px;border:2px solid var(--brand)"><div style="font-size:.6rem;color:var(--dim);margin-top:3px">base</div></div>`;
+  }
+  const refs=FIXREFS.map((r,i)=>`<div style="position:relative;text-align:center">
+    <img src="${r.thumb}" style="width:56px;height:84px;object-fit:cover;border-radius:6px;border:1px solid var(--line)">
+    <button onclick="removeFixRef(${i})" title="Remove" style="position:absolute;top:-6px;right:-6px;width:18px;height:18px;border-radius:50%;border:none;background:#c0392b;color:#fff;font-size:.72rem;line-height:1;cursor:pointer">×</button>
+    <div style="font-size:.6rem;color:var(--dim);margin-top:3px">${r.kind==='up'?'upload':'ref'}</div></div>`).join('');
+  $('fixrefs').innerHTML=base+refs;
+}
+function removeFixRef(i){FIXREFS.splice(i,1);drawFixRefs();if($('fixhist').style.display!=='none')renderFixHist();}
+function toggleFixHistory(){const h=$('fixhist');const show=h.style.display==='none';h.style.display=show?'block':'none';if(show)renderFixHist();}
+function renderFixHist(){
+  const imgs=DATA.assets.filter(a=>/\.(png|jpe?g|webp)$/i.test(a.path||'')&&a.status!=='deleted'&&a.path!==FIXPATH);
+  $('fixhist').innerHTML=`<div style="font-size:.72rem;color:var(--dim);margin-bottom:8px">Tap a past generation to add it as a reference (max ${MAXFIXREFS}).</div>`
+    +`<div class="grid" style="grid-template-columns:repeat(auto-fill,minmax(70px,1fr));gap:8px">`
+    +imgs.map(a=>{const on=FIXREFS.some(r=>r.kind==='lib'&&r.ref===a.path);
+      return `<img src="${thumbURL(a)}" onclick="addFixHistory('${a.path.replace(/'/g,"\\'")}')" title="${a.path}" style="width:100%;aspect-ratio:2/3;object-fit:cover;border-radius:6px;cursor:pointer;border:2px solid ${on?'var(--brand)':'transparent'}">`;
+    }).join('')+`</div>`;
+}
+function addFixHistory(path){
+  const at=FIXREFS.findIndex(r=>r.kind==='lib'&&r.ref===path);
+  if(at>=0){FIXREFS.splice(at,1);}
+  else{ if(FIXREFS.length>=MAXFIXREFS){toast('Up to '+MAXFIXREFS+' references');return;} FIXREFS.push({kind:'lib',ref:path,thumb:thumbURL({path})}); }
+  drawFixRefs(); renderFixHist();
+}
+function showFixErr(m){ const e=$('fixerr'); e.textContent=m||''; e.style.display=m?'block':'none'; }
+async function uploadFixFiles(files){
+  for(const f of [...files]){
+    if(FIXREFS.length>=MAXFIXREFS){toast('Up to '+MAXFIXREFS+' references');break;}
+    const r=await uploadImage(f);
+    if(r.name){FIXREFS.push({kind:'up',ref:r.name,thumb:inputThumb(r.name)}); drawFixRefs(); showFixErr('');}
+    else showFixErr('Upload failed: '+r.error);
+  }
+}
+async function openFixPath(path,prompt){FIXMODE='fix';AMENDID=null;ORIGREFS=[];MAXFIXREFS=4;
+  FIXPATH=path;FIXREFS=[];$('fixtext').value=prompt||'';showFixErr('');
+  $('fixtitle').textContent='Fix with chat';
+  $('fixdesc').textContent='Describe the change — a new render is queued from this image. Add reference photos (drag in, or pick from your history) to guide it.';
+  $('fixhist').style.display='none'; drawFixRefs();
+  $('gpuwarn').style.display=(await gpuOnline())?'none':'block';
+  $('gpuwarn').textContent='⚠ No GPU worker online — this queues but renders only when a BYO-GPU (e.g. spark) is connected.';
+  $('fixdlg').showModal();}
+async function openFix(i){ return openFixPath(DATA.assets[i].path,''); }
+async function openAmend(id){
+  const it=WL.find(x=>x.id===id); if(!it){toast('Job not found');return;}
+  FIXMODE='amend';AMENDID=id;FIXPATH=null;ORIGREFS=it.refs||[];FIXREFS=[];MAXFIXREFS=Math.max(0,5-ORIGREFS.length);
+  $('fixtext').value=it.prompt||'';showFixErr('');
+  $('fixtitle').textContent='Edit queued job';
+  $('fixdesc').textContent='Change the prompt and/or add references. Saving cancels the queued job and re-queues it with the amendment — it re-enters the queue, so its position resets.';
+  $('fixhist').style.display='none'; drawFixRefs();
+  $('gpuwarn').style.display='none';
+  $('fixdlg').showModal();
+}
+async function sendFix(){const t=$('fixtext').value.trim();if(t.length<3){showFixErr('Describe the change (3+ characters).');return;}
+  showFixErr(''); toast(FIXMODE==='amend'?'Amending…':'Queueing fix…');
+  const paths=FIXREFS.filter(x=>x.kind==='lib').map(x=>x.ref);
+  const uploads=FIXREFS.filter(x=>x.kind==='up').map(x=>x.ref);
+  let r;
+  if(FIXMODE==='amend'){ // atomic swap: cancel the queued job + re-dispatch amended
+    r=await fetch('/v1/queue/amend',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({prompt_id:AMENDID,instruction:t,paths,uploads})});
+  }else if(!FIXREFS.length){ // single base image → the proven edit path
+    r=await fetch('/v1/library/fix',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({path:FIXPATH,instruction:t})});
+  }else{               // base + references → multi-reference compose
+    r=await fetch('/v1/library/compose',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({paths:[FIXPATH,...paths],instruction:t,uploads})});
+  }
+  const j=await r.json().catch(()=>({}));
+  if(r.ok){ $('fixdlg').close(); toast(FIXMODE==='amend'?'Amended — re-queued (position reset)':'Fix queued → see Queue & History'); if(typeof runs==='function')runs(); }
+  else showFixErr('Couldn’t '+(FIXMODE==='amend'?'amend':'queue')+': '+(errMsg(j)||('error '+r.status)));   // stay open so the reason is visible
+}
+async function cancelJob(id){
+  if(!confirm('Cancel this job?'))return;
+  const r=await fetch('/v1/queue/cancel',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({prompt_id:id})});
+  const j=await r.json().catch(()=>({}));
+  if(r.ok)toast('Cancelled'+(j.canceled==='gpu'?' — if it was already rendering on your GPU it may still finish':''));
+  else toast('Cancel failed: '+(errMsg(j)||('error '+r.status)));
+  if(typeof runs==='function')runs();
+}
+// One shared drag/drop/paste + click-to-upload wiring, applied to every add-photo
+// surface: the Fix dialog dropzone AND the composer prompt box + "+" button.
+(function(){
+  const fdrop=$('fixdrop'),ffile=$('fixfile');
+  fdrop.addEventListener('click',()=>ffile.click());
+  ffile.addEventListener('change',e=>{uploadFixFiles(e.target.files);e.target.value='';});
+  wireDrop($('fixdlg'),uploadFixFiles); wirePaste($('fixdlg'),uploadFixFiles);
+  const af=$('attachfile');
+  af.addEventListener('change',e=>{attachFiles(e.target.files);e.target.value='';});
+  const uc=$('user'); if(uc){uc.addEventListener('click',e=>{e.stopPropagation();$('acctwho').textContent=($('org').textContent||'').trim()||'Account';$('acctmenu').classList.toggle('on');});
+    document.addEventListener('click',e=>{const m=$('acctmenu');if(m&&m.classList.contains('on')&&!m.contains(e.target))m.classList.remove('on');});}
+  const box=document.querySelector('.prompt'); if(box){ wireDrop(box,attachFiles); wirePaste(box,attachFiles); }
+})();
+function zoom(u){$('zoomimg').src=u;$('zoom').style.display='flex';}
+const ta=$('pin'); ta.addEventListener('input',()=>{ta.style.height='auto';ta.style.height=Math.min(ta.scrollHeight,180)+'px';});
+async function loadSession(){
+  let s={}; try{ s=await (await fetch('/v1/session')).json(); }catch(e){ return; }
+  const nm=(s.user||s.email||'').trim(); $('av').textContent=(nm[0]||'·').toUpperCase(); if(s.org)$('org').textContent=s.org;
+  $('user').onclick=()=>{ const ex=$('omenu'); if(ex){ex.remove();return;}
+    const orgs=(s.orgs&&s.orgs.length?s.orgs:[s.org]).filter(Boolean);
+    const m=document.createElement('div'); m.id='omenu';
+    m.style.cssText='position:fixed;top:54px;right:24px;background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:6px;min-width:190px;z-index:30;box-shadow:0 12px 34px #000b';
+    m.innerHTML=orgs.map(o=>`<div class="omi" data-o="${o}" style="padding:8px 11px;border-radius:8px;cursor:pointer;font-size:.85rem;color:${o===s.org?'var(--txt)':'var(--dim)'}">${o===s.org?'● ':'○ '}${o}</div>`).join('')
+      +`<div style="height:1px;background:var(--line);margin:5px 4px"></div>`+(s.console_url?`<a href="${s.console_url}" style="display:block;padding:8px 11px;color:var(--dim);text-decoration:none;font-size:.85rem">Console ↗</a>`:'')+`<a href="/logout" style="display:block;padding:8px 11px;color:var(--dim);text-decoration:none;font-size:.85rem">Sign out</a>`;
+    document.body.appendChild(m);
+    m.querySelectorAll('.omi').forEach(el=>el.onclick=async()=>{try{await fetch('/v1/session/org',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({org:el.dataset.o})});}catch(e){} location.reload();});
+    setTimeout(()=>document.addEventListener('click',function h(e){if(!m.contains(e.target)&&!$('user').contains(e.target)){m.remove();document.removeEventListener('click',h);}}),0);
+  };
+}
+// ── persistent live-queue bar: always shows what's generating + ETA ──────────
+const ETA_MIN=9; // ~min per render on a warm BYO-GPU
+async function updateLivebar(){
+  // Two queues: the pod's local /queue (in-pod renders) AND the org's BYO-GPU
+  // renders on gpu-jobs (fix/compose/rerun dispatched to a connected GPU). The
+  // latter is why a queued fix "never showed" — it renders on the worker, not
+  // the pod. Merge both.
+  let q={queue_running:[],queue_pending:[]}; try{q=await (await fetch('/queue')).json();}catch(_){}
+  let rq={jobs:[]}; try{rq=await (await fetch('/v1/render-queue')).json();}catch(_){}
+  const run=q.queue_running||[], pend=q.queue_pending||[];
+  const gpuJobs=rq.jobs||[];
+  const lb=$('livebar'), st=$('lbstatus');
+  const name=it=>{try{return (Object.values(it[2]).find(n=>n.class_type==='SaveImage')?.inputs?.filename_prefix||'render').split('/').pop();}catch(_){return 'render';}};
+  if(gpuJobs.length){
+    lb.classList.remove('idle');
+    const first=gpuJobs[0], more=gpuJobs.length-1;
+    st.innerHTML=`<span class="lb-run"><span class="spin"></span>Generating on your GPU: <b>${first.prefix||'render'}</b></span>`
+      + (more>0?` <span class="lb-q">· ${more} more</span>`:'')
+      + ` <span class="lb-eta">· ~${ETA_MIN} min each</span>`;
+  } else if(run.length){
+    lb.classList.remove('idle');
+    const q1=pend.length;
+    st.innerHTML=`<span class="lb-run"><span class="spin"></span>Generating: <b>${name(run[0])}</b></span>`
+      + (q1?` <span class="lb-q">· ${q1} queued</span>`:'')
+      + ` <span class="lb-eta">· ~${ETA_MIN}${q1?`–${(q1+1)*ETA_MIN}`:''} min</span>`;
+  } else if(pend.length){
+    lb.classList.remove('idle');
+    st.innerHTML=`<span class="lb-q">⏳ ${pend.length} queued · ~${pend.length*ETA_MIN} min · waiting for a GPU</span>`;
+  } else {
+    lb.classList.add('idle');
+    const gpu=await gpuOnline();
+    st.innerHTML=`<span class="lb-q">Idle — nothing generating.</span>${gpu?'':' <span class="lb-eta">· connect a GPU to generate</span>'}`;
+  }
+}
+// header auto-hide (immersive) — reveal on top-hover / mouse near top
+document.getElementById('tophover').addEventListener('mouseenter',()=>document.querySelector('header').classList.add('reveal'));
+document.addEventListener('mousemove',e=>{if(e.clientY<8)document.querySelector('header').classList.add('reveal');else if(e.clientY>90&&document.body.classList.contains('immersive'))document.querySelector('header').classList.remove('reveal');});
+load(); loadSession(); updateLivebar(); setInterval(updateLivebar, 5000);
+// Queue transparency: refresh positions/ETAs while the queue view is open (sane
+// cadence, no hammering); node badges less often; tick the running item's elapsed.
+setInterval(()=>{ if(!$('runs').hidden)refreshQueue(); }, 6000);
+setInterval(()=>{ if(!$('runs').hidden)loadNodes(); }, 20000);
+setInterval(()=>{ for(const id in (QST.items||{})){ const e=QST.items[id]; if(e.status==='running'){ const el=$('el-'+id); if(el)el.textContent=fmtDur((e.elapsed_seconds||0)+(Date.now()-QLOCAL)/1000); } } }, 1000);
+</script>

middleware/worklog.py

@@ -0,0 +1,283 @@
+"""Per-org work log — the ONE record of every render this org dispatched.
+
+The single dispatch funnel (``studio_home.dispatch_fix`` / ``dispatch_compose`` /
+``rerun``) writes one row here at dispatch time, so the studio surface can show:
+
+  * the queue/history with REAL status — queued · running · done · failed ·
+    cancelled — including gpu-lane jobs the local /queue can't see (that was the
+    'nothing showed as queued' report) and dispatches that failed before queuing;
+  * the full context that produced each item — prompt, reference images/uploads,
+    the workflow family (fix / compose / …), params, and the process trail;
+  * parent → child lineage: each derived asset records the library asset(s) it was
+    derived from, so any item's versions (ancestors + later fixes) form a chain.
+
+Storage is one JSON array per org at ``orgs/<org>/output/worklog.json`` — the same
+per-org metadata pattern as ``library.json`` / ``render_jobs.json`` / ``ratings.json``
+(atomic tmp+replace). No new database. No backfill: history starts when this ships;
+items generated earlier have no recorded row (and derived items no recorded parent).
+
+Tenant isolation: every function takes an already-resolved ``org`` (the caller's
+IAM org, resolved server-side by ``studio_home._org_of``). A row lives only in its
+org's file, so one org can never read or mutate another's log.
+"""
+from __future__ import annotations
+
+import json
+import time
+import uuid
+from pathlib import Path
+
+import folder_paths
+
+# Cap the file so a busy org can't grow it without bound; oldest rows drop off.
+_CAP = 1000
+_TERMINAL = ("done", "failed", "cancelled")
+
+
+def _dir(org: str) -> Path:
+    return Path(folder_paths.get_org_output_directory(org))
+
+
+def _path(org: str) -> Path:
+    return _dir(org) / "worklog.json"
+
+
+def load(org: str) -> list[dict]:
+    try:
+        rows = json.loads(_path(org).read_text())
+        return rows if isinstance(rows, list) else []
+    except Exception:
+        return []
+
+
+def _save(org: str, rows: list[dict]) -> None:
+    d = _dir(org)
+    d.mkdir(parents=True, exist_ok=True)
+    p = _path(org)
+    tmp = p.with_name(p.name + ".tmp")
+    tmp.write_text(json.dumps(rows[-_CAP:]))
+    tmp.replace(p)
+
+
+def record(org: str, *, kind: str, prompt: str, refs: list, uploads: list,
+           parents: list, output_prefix: str, params: dict | None = None,
+           pid: str | None = None, lane: str | None = None, node: str | None = None,
+           status: str = "queued", error: str | None = None) -> dict:
+    """Append one dispatch row. ``pid`` is the /prompt id on success (used to match
+    live queue/history); a failed dispatch has no id, so a synthetic one is minted
+    and the row is marked failed with the reason so it STILL shows (never silent)."""
+    now = int(time.time())
+    row: dict = {
+        "id": pid or f"failed-{uuid.uuid4().hex[:12]}",
+        "ts": now,
+        "kind": kind,
+        "prompt": (prompt or "")[:800],
+        "refs": [str(x) for x in (refs or [])][:8],
+        "uploads": [str(x) for x in (uploads or [])][:8],
+        "parents": [str(x) for x in (parents or [])][:8],
+        "output_prefix": output_prefix or "",
+        "params": params or {},
+        "lane": lane or ("failed" if status == "failed" else "local"),
+        "node": node or ("studio pod" if (lane in (None, "local")) else "gpu"),
+        "status": status,
+        "updatedAt": now,
+        "events": [{"s": "queued", "ts": now}],
+    }
+    if error:
+        row["error"] = str(error)[:400]
+        row["events"].append({"s": "failed", "ts": now, "note": row["error"]})
+    rows = load(org)
+    rows.append(row)
+    _save(org, rows)
+    return row
+
+
+def set_status(org: str, pid: str, status: str, note: str | None = None) -> bool:
+    """Advance a row's status by prompt_id (running/done/failed/cancelled). Returns
+    True if a row was updated. Idempotent-safe; terminal rows are left untouched."""
+    if not pid:
+        return False
+    rows = load(org)
+    hit = False
+    now = int(time.time())
+    for r in rows:
+        if r.get("id") == pid and r.get("status") not in _TERMINAL:
+            r["status"] = status
+            r["updatedAt"] = now
+            r.setdefault("events", []).append(
+                {"s": status, "ts": now, **({"note": note} if note else {})})
+            hit = True
+    if hit:
+        _save(org, rows)
+    return hit
+
+
+def mark_started(org: str, pid: str, at: int) -> bool:
+    """Stamp when a job first begins rendering (first seen at the head of its lane).
+    Idempotent: only the first observation sets started_at. Feeds duration = finished
+    − started, the basis of the ETA median."""
+    if not pid:
+        return False
+    rows = load(org)
+    hit = False
+    for r in rows:
+        if r.get("id") == pid and not r.get("started_at") and r.get("status") not in _TERMINAL:
+            r["started_at"] = int(at)
+            r["status"] = "running"
+            r["updatedAt"] = int(time.time())
+            r.setdefault("events", []).append({"s": "running", "ts": int(at)})
+            hit = True
+    if hit:
+        _save(org, rows)
+    return hit
+
+
+def mark_finished(org: str, pid: str, at: int) -> bool:
+    """Stamp real completion (the output file's mtime) and close the row as done."""
+    if not pid:
+        return False
+    rows = load(org)
+    hit = False
+    for r in rows:
+        if r.get("id") == pid and r.get("status") not in _TERMINAL:
+            r["finished_at"] = int(at)
+            r["status"] = "done"
+            r["updatedAt"] = int(time.time())
+            r.setdefault("events", []).append({"s": "done", "ts": int(at)})
+            hit = True
+    if hit:
+        _save(org, rows)
+    return hit
+
+
+def _duration(r: dict) -> float | None:
+    """Measured render seconds for a completed row: finished − started when both
+    exist (true render time), else finished − queued (turnaround, an upper bound)."""
+    fin = r.get("finished_at")
+    if fin is None:
+        return None
+    start = r.get("started_at")
+    if start is None:
+        start = r.get("ts")
+    if start is None:
+        return None
+    return float(fin - start) if fin > start else None
+
+
+def median_durations(rows: list[dict]) -> dict:
+    """Rolling median render seconds per kind (fix/compose/rerun) over completed
+    rows — the ETA basis. Pure. Only kinds with a measured sample appear."""
+    buckets: dict[str, list[float]] = {}
+    for r in rows:
+        d = _duration(r)
+        if d and d > 0:
+            buckets.setdefault(r.get("kind", ""), []).append(d)
+    out: dict[str, int] = {}
+    for k, v in buckets.items():
+        v.sort()
+        n = len(v)
+        out[k] = int(v[n // 2] if n % 2 else (v[n // 2 - 1] + v[n // 2]) / 2)
+    return out
+
+
+def estimate_lanes(active: list[dict], medians: dict, now: int,
+                   default_median: int = 180) -> tuple[dict, dict]:
+    """Pure position + ETA math, per lane. ``active`` items are
+    ``{id, kind, lane, ts, status, started_at?}``. Within a lane the running item
+    (head) is position 1; each queued item's wait ≈ jobs-ahead × their medians +
+    the running item's remaining time (median − elapsed). ETA to done = wait +
+    its own median. Returns (per-id info, per-lane count). No client math over
+    another tenant's data — the caller passes only THIS org's active jobs."""
+    lanes: dict[str, list[dict]] = {}
+    for j in active:
+        lanes.setdefault(j.get("lane") or "local", []).append(j)
+    info: dict[str, dict] = {}
+    counts: dict[str, int] = {}
+    for lane, jobs in lanes.items():
+        jobs.sort(key=lambda j: (0 if j.get("status") == "running" else 1, j.get("ts", 0)))
+        counts[lane] = len(jobs)
+        cum = 0.0  # seconds until the START of the current item
+        for idx, j in enumerate(jobs):
+            m = medians.get(j.get("kind", ""), default_median)
+            row = {"lane": lane, "position": idx + 1, "of": len(jobs),
+                   "node": j.get("node") or ("studio pod" if lane == "local" else "gpu")}
+            if idx == 0 and j.get("status") == "running":
+                started = j.get("started_at") or j.get("ts") or now
+                elapsed = max(0, now - started)
+                remaining = max(0.0, m - elapsed)
+                row.update(elapsed_seconds=int(elapsed), wait_seconds=0,
+                           remaining_seconds=int(remaining), eta_seconds=int(remaining))
+                cum = remaining
+            else:
+                row.update(elapsed_seconds=0, wait_seconds=int(cum),
+                           remaining_seconds=None, eta_seconds=int(cum + m))
+                cum += m
+            info[j["id"]] = row
+    return info, counts
+
+
+def build_lineage(rows: list[dict], target: str) -> dict:
+    """Pure: given work-log rows (each with ``parents`` = source library paths and
+    ``output`` = the landed library path, resolved by the caller) and a target
+    library asset path, return its version chain:
+
+        {"ancestors": [older … immediate parent], "node": <target>,
+         "descendants": [later derivations, chronological]}
+
+    Each entry is ``{path, prompt, kind, ts}``. Ancestors walk the first-parent edge
+    up from the row that PRODUCED the target; descendants are rows that name the
+    target among their parents (and, transitively, their outputs). Cycles and
+    missing rows terminate the walk — never loops."""
+    by_output: dict[str, dict] = {}
+    for r in rows:
+        out = r.get("output")
+        if out and out not in by_output:
+            by_output[out] = r
+
+    def entry(path: str, r: dict | None) -> dict:
+        return {
+            "path": path,
+            "prompt": (r or {}).get("prompt", ""),
+            "kind": (r or {}).get("kind", ""),
+            "ts": (r or {}).get("ts", 0),
+        }
+
+    # Ancestors: from the row that produced `target`, follow its first parent up.
+    ancestors: list[dict] = []
+    seen = {target}
+    cur = target
+    while True:
+        producer = by_output.get(cur)
+        if not producer:
+            break
+        parents = producer.get("parents") or []
+        if not parents:
+            break
+        parent = parents[0]
+        if parent in seen:
+            break
+        seen.add(parent)
+        ancestors.append(entry(parent, by_output.get(parent)))
+        cur = parent
+    ancestors.reverse()  # oldest first
+
+    # Descendants: rows that derive FROM target, then rows deriving from those, …
+    descendants: list[dict] = []
+    frontier = [target]
+    seen_out = {target}
+    while frontier:
+        nxt: list[str] = []
+        kids = [r for r in rows if any(p in frontier for p in (r.get("parents") or []))]
+        kids.sort(key=lambda r: r.get("ts", 0))
+        for r in kids:
+            out = r.get("output")
+            key = out or r.get("id")
+            if key in seen_out:
+                continue
+            seen_out.add(key)
+            descendants.append(entry(out or "", r))
+            if out:
+                nxt.append(out)
+        frontier = nxt
+
+    return {"ancestors": ancestors, "node": target, "descendants": descendants}

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hanzo-studio"
-version = "0.15.1"
+version = "0.17.3"
 readme = "README.md"
 license = { file = "LICENSE" }
 requires-python = ">=3.10"

scripts/library_manifest.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""karma_manifest.py — regenerate the ONE canonical asset-library index.
+"""library_manifest.py — regenerate the ONE canonical asset-library index.
 
 The Karma content pipeline has a single source of truth: a `library.json`
-manifest that sits at the root of the karma org's studio-output subtree and
+manifest that sits at the root of an org's studio-output subtree (any tenant; pass --root) and
 indexes every asset Antje has rendered. The storefront (karma.style) and the
 socials/blog queue both read THIS file — there is no second index.
 
@@ -93,6 +93,11 @@ def scan(root: str) -> list[str]:
     found: list[str] = []
     for base, _dirs, files in os.walk(root):
         for f in files:
+            if f.startswith("."):
+                # Dotfiles are never assets: `._foo.png` AppleDouble forks ride
+                # along with mac transfers, carry an image extension, and are
+                # resource-fork bytes that render 0x0 in the library.
+                continue
             ext = os.path.splitext(f)[1].lower()
             full = os.path.join(base, f)
             rel = os.path.relpath(full, root)
@@ -159,7 +164,7 @@ def build(root: str) -> dict:
     return {
         "_meta": {
             "note": "Canonical Karma asset library. ONE index the storefront + "
-                    "socials queue read. Regenerated by karma_manifest.py; edit "
+                    "socials queue read. Regenerated by library_manifest.py; edit "
                     "status/caption/tags with karma-queue.py (they are preserved).",
             "prefix": "orgs/karma/output",
             "generatedAt": iso(time.time()),
@@ -183,7 +188,7 @@ def write_atomic(root: str, doc: dict) -> str:
 
 def run_once(root: str, quiet: bool = False, strict: bool = True) -> dict | None:
     if not os.path.isdir(root):
-        msg = f"karma_manifest: root does not exist yet: {root}"
+        msg = f"library_manifest: root does not exist yet: {root}"
         if strict:
             sys.exit(msg)
         if not quiet:
@@ -193,7 +198,7 @@ def run_once(root: str, quiet: bool = False, strict: bool = True) -> dict | None
     path = write_atomic(root, doc)
     if not quiet:
         m = doc["_meta"]
-        print(f"karma_manifest: {m['count']} assets -> {path}  {m['byStatus']}")
+        print(f"library_manifest: {m['count']} assets -> {path}  {m['byStatus']}")
     return doc
 
 
@@ -210,12 +215,12 @@ def main() -> None:
         run_once(args.root)
         return
 
-    print(f"karma_manifest: watching {args.root} every {args.interval}s", flush=True)
+    print(f"library_manifest: watching {args.root} every {args.interval}s", flush=True)
     while True:
         try:
             run_once(args.root, quiet=True, strict=False)
         except Exception as e:  # a bad cycle must never kill the sidecar
-            print(f"karma_manifest: cycle error: {e}", file=sys.stderr, flush=True)
+            print(f"library_manifest: cycle error: {e}", file=sys.stderr, flush=True)
         time.sleep(args.interval)
 
 

server.py

@@ -64,6 +64,41 @@ def _remove_sensitive_from_queue(queue: list) -> list:
     return [item[:5] for item in queue]
 
 
+# ── Multi-tenant scoping for the inherited core endpoints (HIP-0506 security) ──
+# /history and /queue are process-global in upstream ComfyUI. In a multi-tenant
+# deployment that is cross-tenant disclosure (one org reads another's prompts,
+# graphs, seeds) and a cross-tenant DoS (one org's "clear queue" wipes another's).
+# Every item carries its owner in extra_data["org_id"] (bound at enqueue). These
+# filter each list/dict to the caller's org. `org is None` means auth is OFF
+# (single-tenant/local dev) → return everything unchanged (no behavior change).
+def _item_org(item) -> str | None:
+    """org_id from a queue-item tuple (index 3 = extra_data)."""
+    try:
+        return item[3].get("org_id") if len(item) > 3 and isinstance(item[3], dict) else None
+    except Exception:
+        return None
+
+
+def _scope_queue_to_org(items: list, org: str | None) -> list:
+    if not org:
+        return items
+    return [it for it in items if _item_org(it) == org]
+
+
+def _scope_history_to_org(hist: dict, org: str | None) -> dict:
+    if not org:
+        return hist
+    out = {}
+    for k, entry in (hist or {}).items():
+        try:
+            ed = entry.get("prompt", [None, None, None, {}])[3]
+            if isinstance(ed, dict) and ed.get("org_id") == org:
+                out[k] = entry
+        except Exception:
+            continue  # malformed/legacy entry with no org → excluded (fail-closed)
+    return out
+
+
 async def send_socket_catch_exception(function, message):
     try:
         await function(message)
@@ -229,7 +264,8 @@ class PromptServer():
         self.client_session:Optional[aiohttp.ClientSession] = None
         self.number = 0
 
-        middlewares = [cache_control, deprecation_warning]
+        from middleware.studio_home import home_redirect
+        middlewares = [cache_control, deprecation_warning, home_redirect]
 
         self._iam_auth = None
         if args.enable_iam_auth:
@@ -399,11 +435,11 @@ class PromptServer():
                             },
                         )
 
-            response = web.FileResponse(os.path.join(self.web_root, "index.html"))
-            response.headers['Cache-Control'] = 'no-cache'
-            response.headers["Pragma"] = "no-cache"
-            response.headers["Expires"] = "0"
-            return response
+            # Serve the editor SPA with the shared Studio shell injected (the ONE
+            # chrome — Studio/Editor toggle, wallet, GPUs, chat sidebar — that the
+            # Studio home also includes). No-cache, same as before.
+            from middleware.studio_home import editor_index
+            return editor_index(self.web_root)
 
         @routes.get("/embeddings")
         def get_embeddings(request):
@@ -968,19 +1004,24 @@ class PromptServer():
             else:
                 offset = -1
 
-            return web.json_response(self.prompt_queue.get_history(max_items=max_items, offset=offset))
+            hist = self.prompt_queue.get_history(max_items=max_items, offset=offset)
+            hist = _scope_history_to_org(hist, self._caller_org(request))
+            return web.json_response(hist)
 
         @routes.get("/history/{prompt_id}")
         async def get_history_prompt_id(request):
             prompt_id = request.match_info.get("prompt_id", None)
-            return web.json_response(self.prompt_queue.get_history(prompt_id=prompt_id))
+            hist = self.prompt_queue.get_history(prompt_id=prompt_id)
+            hist = _scope_history_to_org(hist, self._caller_org(request))
+            return web.json_response(hist)
 
         @routes.get("/queue")
         async def get_queue(request):
+            org = self._caller_org(request)
             queue_info = {}
             current_queue = self.prompt_queue.get_current_queue_volatile()
-            queue_info['queue_running'] = _remove_sensitive_from_queue(current_queue[0])
-            queue_info['queue_pending'] = _remove_sensitive_from_queue(current_queue[1])
+            queue_info['queue_running'] = _scope_queue_to_org(_remove_sensitive_from_queue(current_queue[0]), org)
+            queue_info['queue_pending'] = _scope_queue_to_org(_remove_sensitive_from_queue(current_queue[1]), org)
             return web.json_response(queue_info)
 
         @routes.post("/prompt")
@@ -1105,13 +1146,20 @@ class PromptServer():
         @routes.post("/queue")
         async def post_queue(request):
             json_data =  await request.json()
+            org = self._caller_org(request)  # None = auth off → upstream behavior
             if "clear" in json_data:
                 if json_data["clear"]:
-                    self.prompt_queue.wipe_queue()
+                    if org is None:
+                        self.prompt_queue.wipe_queue()
+                    else:
+                        # SCOPED clear: only THIS org's pending items, never others'.
+                        self.prompt_queue.delete_queue_item(lambda a: _item_org(a) == org)
             if "delete" in json_data:
                 to_delete = json_data['delete']
                 for id_to_delete in to_delete:
-                    delete_func = lambda a: a[1] == id_to_delete
+                    # Only delete an item the caller owns (org must match when auth on).
+                    delete_func = (lambda a, i=id_to_delete: a[1] == i) if org is None \
+                        else (lambda a, i=id_to_delete: a[1] == i and _item_org(a) == org)
                     self.prompt_queue.delete_queue_item(delete_func)
 
             return web.Response(status=200)
@@ -1123,16 +1171,19 @@ class PromptServer():
             except json.JSONDecodeError:
                 json_data = {}
 
+            org = self._caller_org(request)  # None = auth off → upstream behavior
             # Check if a specific prompt_id was provided for targeted interruption
             prompt_id = json_data.get('prompt_id')
             if prompt_id:
                 currently_running, _ = self.prompt_queue.get_current_queue()
 
-                # Check if the prompt_id matches any currently running prompt
+                # Check if the prompt_id matches any currently running prompt — and
+                # (multi-tenant) that it belongs to the caller's org, so one tenant
+                # cannot interrupt another tenant's render.
                 should_interrupt = False
                 for item in currently_running:
                     # item structure: (number, prompt_id, prompt, extra_data, outputs_to_execute)
-                    if item[1] == prompt_id:
+                    if item[1] == prompt_id and (org is None or _item_org(item) == org):
                         logging.info(f"Interrupting prompt {prompt_id}")
                         should_interrupt = True
                         break
@@ -1140,11 +1191,18 @@ class PromptServer():
                 if should_interrupt:
                     nodes.interrupt_processing()
                 else:
-                    logging.info(f"Prompt {prompt_id} is not currently running, skipping interrupt")
-            else:
-                # No prompt_id provided, do a global interrupt
+                    logging.info(f"Prompt {prompt_id} is not currently running / not owned by caller, skipping interrupt")
+            elif org is None:
+                # No prompt_id + auth off → upstream global interrupt.
                 logging.info("Global interrupt (no prompt_id specified)")
                 nodes.interrupt_processing()
+            else:
+                # Multi-tenant: a global interrupt would kill another tenant's render.
+                # Only interrupt if the running job belongs to the caller's org.
+                currently_running, _ = self.prompt_queue.get_current_queue()
+                if any(_item_org(item) == org for item in currently_running):
+                    logging.info(f"Interrupting current render for org {org}")
+                    nodes.interrupt_processing()
 
             return web.Response(status=200)
 
@@ -1321,6 +1379,16 @@ class PromptServer():
             return iam_user.get("org_id", "default")
         return os.environ.get("STUDIO_ORG_ID", "default")
 
+    def _caller_org(self, request) -> str | None:
+        """The verified caller org to SCOPE cross-tenant reads by — or None when
+        multi-tenant auth is OFF (single-tenant/local dev) so /history + /queue
+        behave exactly as upstream. Only returns a value when there is a real IAM
+        user, so scoping never hides another tenant's data by accident."""
+        iam_user = request.get("iam_user")
+        if iam_user and iam_user.get("org_id"):
+            return iam_user.get("org_id")
+        return None
+
     async def setup(self):
         timeout = aiohttp.ClientTimeout(total=None) # no timeout
         self.client_session = aiohttp.ClientSession(timeout=timeout)
@@ -1348,6 +1416,10 @@ class PromptServer():
         add_copilot_routes(self.routes, self)
         from middleware.session import add_session_routes
         add_session_routes(self.routes, self)
+        from middleware.studio_home import add_studio_home_routes
+        add_studio_home_routes(self.routes, self)
+        from middleware.mcp import add_mcp_routes
+        add_mcp_routes(self.routes, self)
         self.app.add_subapp('/internal', self.internal_routes.get_app())
 
         # Prefix every route with /api for easier matching for delegation.

studio_version.py

@@ -1,3 +1,3 @@
 # This file is automatically generated by the build process when version is
 # updated in pyproject.toml.
-__version__ = "0.14.1"
+__version__ = "0.17.3"

studio_watchdog.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Studio watchdog: keep :8188 alive through the overnight karma render run.
+# Emits a line ONLY on a restart event (so it's a signal, not a firehose).
+# Detects: process gone, port unresponsive, or output-log silent >12min while a
+# render is supposedly in flight (the 6h-hang failure mode from the QC log).
+set -u
+STUDIO=/home/z/work/hanzo/studio
+LOG=$STUDIO/studio-local.log
+launch() {
+  cd "$STUDIO"
+  # Free the port first: a stale/duplicate main.py holding :8188 makes the new
+  # one crash on bind (EADDRINUSE). Kill any existing listener, wait for release.
+  pkill -f 'main.py --listen' 2>/dev/null || true
+  for _ in $(seq 1 15); do
+    ss -ltn 2>/dev/null | grep -q ':8188 ' || break
+    sleep 1
+  done
+  HF_HOME=/home/z/.cache/huggingface \
+  PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True \
+  STUDIO_PERSIST_QUEUE=1 \
+  nohup .venv/bin/python main.py --listen 0.0.0.0 --port 8188 --normalvram \
+    --disable-auto-launch --output-directory "$STUDIO/output" >> "$LOG" 2>&1 &
+  sleep 1
+  local pid
+  pid=$(pgrep -f 'main.py --listen' | head -1)
+  [ -n "$pid" ] && sudo -n sh -c "echo -700 > /proc/$pid/oom_score_adj" 2>/dev/null || true
+  echo "$pid"
+}
+while true; do
+  code=$(curl -s -m 5 http://127.0.0.1:8188/system_stats -o /dev/null -w "%{http_code}" 2>/dev/null || echo 000)
+  if [ "$code" != "200" ]; then
+    # give it one grace re-check (could be mid-render, momentarily busy)
+    sleep 8
+    code=$(curl -s -m 5 http://127.0.0.1:8188/system_stats -o /dev/null -w "%{http_code}" 2>/dev/null || echo 000)
+    if [ "$code" != "200" ]; then
+      pid=$(launch)
+      # wait for it to answer
+      for i in $(seq 1 45); do
+        c=$(curl -s -m 4 http://127.0.0.1:8188/system_stats -o /dev/null -w "%{http_code}" 2>/dev/null || echo 000)
+        [ "$c" = "200" ] && break
+        sleep 4
+      done
+      echo "STUDIO_RESTARTED pid=$pid health=$c"
+    fi
+  fi
+  sleep 45
+done

tests-unit/middleware_test/gpu_dispatch_test.py

@@ -0,0 +1,33 @@
+"""Unit tests for BYO-GPU dispatch node identity (middleware/gpu_dispatch.py)."""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from middleware import gpu_dispatch as g
+
+
+def test_node_label_prefers_human_name():
+    assert g._node_label({"name": "spark", "hostname": "h", "gpu": True}) == "spark"
+    assert g._node_label({"hostname": "dbc-01", "gpu": True}) == "dbc-01"
+    assert g._node_label({"worker_id": "gpu-acme-123"}) == "gpu-acme-123"
+    assert g._node_label({"gpu_model": "RTX 4090"}) == "RTX 4090"
+    assert g._node_label({}) == "gpu"                      # never blank
+
+
+def test_online_gpu_nodes_filters_offline_and_non_gpu(monkeypatch):
+    monkeypatch.setattr(g, "_fleet_machines", lambda tok: [
+        {"name": "spark", "status": "online", "gpu": True},
+        {"name": "idle", "status": "offline", "gpu": True},
+        {"name": "cpu-box", "status": "online", "gpu": False},
+    ])
+    assert [m["name"] for m in g._online_gpu_nodes("tok")] == ["spark"]
+    assert g._has_online_gpu("tok") is True
+
+
+def test_no_online_gpu_when_all_offline(monkeypatch):
+    monkeypatch.setattr(g, "_fleet_machines", lambda tok: [
+        {"name": "spark", "status": "offline", "gpu": True},
+    ])
+    assert g._online_gpu_nodes("tok") == []
+    assert g._has_online_gpu("tok") is False

tests-unit/middleware_test/mcp_test.py

@@ -0,0 +1,204 @@
+"""Tests for the /v1/mcp MCP-over-HTTP endpoint: initialize, tools/list, the
+tools/call dispatch, DispatchError -> isError result, and unknown-method error.
+
+Mirrors session_test.py: a real aiohttp app with a middleware that injects the
+IAM user the auth layer would have set, so org resolution and the JSON-RPC
+envelopes are the real thing. The render dispatch (studio_home.dispatch_fix /
+dispatch_compose) is monkeypatched, so no GPU / self-POST is needed.
+"""
+import asyncio
+import json
+
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from middleware import mcp
+from middleware import studio_home
+
+ORG_USER = {"sub": "hanzo/antje", "org_id": "hanzo", "orgs": ["hanzo"]}
+
+
+def _app(iam_user=ORG_USER):
+    app = web.Application()
+
+    @web.middleware
+    async def inject(request, handler):
+        if iam_user is not None:
+            request["iam_user"] = iam_user
+        return await handler(request)
+
+    app.middlewares.append(inject)
+    routes = web.RouteTableDef()
+    mcp.add_mcp_routes(routes, None)
+    app.add_routes(routes)
+    return app
+
+
+def _rpc(client, method, params=None, id_=1):
+    payload = {"jsonrpc": "2.0", "id": id_, "method": method}
+    if params is not None:
+        payload["params"] = params
+    return client.post("/v1/mcp", json=payload)
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+# --- initialize ----------------------------------------------------------
+
+def test_initialize_reports_server_and_tools_capability():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "initialize")
+            assert r.status == 200
+            return await r.json()
+    body = _run(go())
+    assert body["jsonrpc"] == "2.0"
+    assert body["id"] == 1
+    assert body["result"]["serverInfo"]["name"] == "hanzo-studio"
+    assert body["result"]["protocolVersion"]
+    assert "tools" in body["result"]["capabilities"]
+
+
+# --- tools/list ----------------------------------------------------------
+
+def test_tools_list_returns_the_three_render_tools():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/list")
+            return await r.json()
+    body = _run(go())
+    tools = body["result"]["tools"]
+    assert {t["name"] for t in tools} == {"fix", "compose", "ask"}
+    for t in tools:
+        assert t["inputSchema"]["type"] == "object"
+    compose = next(t for t in tools if t["name"] == "compose")
+    assert compose["inputSchema"]["properties"]["paths"]["minItems"] == 2
+    assert compose["inputSchema"]["properties"]["paths"]["maxItems"] == 5
+
+
+# --- tools/call ----------------------------------------------------------
+
+def test_tools_call_fix_dispatches(monkeypatch):
+    seen = {}
+
+    async def fake_fix(request, server, org, path, instruction):
+        seen.update(org=org, path=path, instruction=instruction)
+        return {"ok": True, "prompt_id": "p1", "output_prefix": "fixes/x"}
+
+    monkeypatch.setattr(studio_home, "dispatch_fix", fake_fix)
+
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/call", {
+                "name": "fix",
+                "arguments": {"path": "a/b.png", "instruction": "make it red"},
+            })
+            assert r.status == 200
+            return await r.json()
+    body = _run(go())
+    assert seen == {"org": "hanzo", "path": "a/b.png", "instruction": "make it red"}
+    result = body["result"]
+    assert result.get("isError") is not True
+    payload = json.loads(result["content"][0]["text"])
+    assert payload["prompt_id"] == "p1"
+    assert payload["output_prefix"] == "fixes/x"
+
+
+def test_tools_call_compose_dispatches(monkeypatch):
+    seen = {}
+
+    async def fake_compose(request, server, org, paths, instruction):
+        seen.update(org=org, paths=paths, instruction=instruction)
+        return {"ok": True, "prompt_id": "p2", "output_prefix": "composes/y", "refs": len(paths)}
+
+    monkeypatch.setattr(studio_home, "dispatch_compose", fake_compose)
+
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/call", {
+                "name": "compose",
+                "arguments": {"paths": ["a.png", "b.png"], "instruction": "merge them"},
+            })
+            return await r.json()
+    body = _run(go())
+    assert seen["paths"] == ["a.png", "b.png"]
+    payload = json.loads(body["result"]["content"][0]["text"])
+    assert payload["prompt_id"] == "p2"
+    assert payload["refs"] == 2
+
+
+def test_tools_call_ask_echoes_question():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/call", {
+                "name": "ask", "arguments": {"question": "which asset?"},
+            })
+            return await r.json()
+    body = _run(go())
+    payload = json.loads(body["result"]["content"][0]["text"])
+    assert payload["question"] == "which asset?"
+    assert body["result"].get("isError") is not True
+
+
+def test_dispatch_error_becomes_iserror_result(monkeypatch):
+    async def bad_fix(request, server, org, path, instruction):
+        raise studio_home.DispatchError("unknown asset: nope.png")
+
+    monkeypatch.setattr(studio_home, "dispatch_fix", bad_fix)
+
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/call", {
+                "name": "fix", "arguments": {"path": "nope.png", "instruction": "x"},
+            })
+            assert r.status == 200          # never a 500
+            return await r.json()
+    body = _run(go())
+    assert "error" not in body              # not a JSON-RPC error
+    assert body["result"]["isError"] is True
+    assert "unknown asset" in body["result"]["content"][0]["text"]
+
+
+def test_unknown_tool_is_iserror_result():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/call", {"name": "frobnicate", "arguments": {}})
+            return await r.json()
+    body = _run(go())
+    assert body["result"]["isError"] is True
+
+
+# --- protocol edges ------------------------------------------------------
+
+def test_unknown_method_is_jsonrpc_error():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await _rpc(c, "tools/frobnicate")
+            assert r.status == 200
+            return await r.json()
+    body = _run(go())
+    assert "result" not in body
+    assert body["error"]["code"] == -32601
+    assert body["id"] == 1
+
+
+def test_notification_gets_no_body():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await c.post("/v1/mcp", json={"jsonrpc": "2.0", "method": "notifications/initialized"})
+            return r.status, await r.text()
+    status, text = _run(go())
+    assert status == 202
+    assert text == ""
+
+
+def test_bad_json_is_parse_error():
+    async def go():
+        async with TestClient(TestServer(_app())) as c:
+            r = await c.post("/v1/mcp", data="not json", headers={"Content-Type": "application/json"})
+            return r.status, await r.json()
+    status, body = _run(go())
+    assert status == 400
+    assert body["error"]["code"] == -32700

tests-unit/middleware_test/worklog_test.py

@@ -0,0 +1,162 @@
+"""Unit tests for the per-org work log (middleware/worklog.py)."""
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from middleware import worklog
+
+
+@pytest.fixture
+def orgdirs(tmp_path, monkeypatch):
+    """Map each org to its own output dir, exactly as folder_paths does per-org, so
+    the tests exercise real cross-tenant isolation (one file per org)."""
+    def out_dir(org=None):
+        d = tmp_path / "orgs" / (org or "default") / "output"
+        d.mkdir(parents=True, exist_ok=True)
+        return str(d)
+    monkeypatch.setattr(worklog.folder_paths, "get_org_output_directory", out_dir)
+    return out_dir
+
+
+def test_record_and_load_roundtrip(orgdirs):
+    row = worklog.record("acme", kind="fix", prompt="brighten", refs=["r.png"],
+                         uploads=[], parents=["a.png"], output_prefix="fixes/a",
+                         pid="pid-1", lane="gpu")
+    assert row["id"] == "pid-1" and row["status"] == "queued" and row["lane"] == "gpu"
+    rows = worklog.load("acme")
+    assert len(rows) == 1 and rows[0]["parents"] == ["a.png"] and rows[0]["kind"] == "fix"
+
+
+def test_failed_dispatch_still_recorded_with_reason(orgdirs):
+    row = worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[],
+                         parents=["a.png"], output_prefix="fixes/a",
+                         status="failed", error="no GPU worker online for this org")
+    assert row["status"] == "failed" and row["id"].startswith("failed-")
+    assert "no GPU worker" in row["error"]
+    assert any(e["s"] == "failed" for e in row["events"])   # visible, not swallowed
+
+
+def test_set_status_advances_but_respects_terminal(orgdirs):
+    worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                   output_prefix="fixes/a", pid="p1")
+    assert worklog.set_status("acme", "p1", "running")
+    assert worklog.load("acme")[0]["status"] == "running"
+    assert worklog.set_status("acme", "p1", "cancelled")
+    # a terminal row is frozen — a late 'done' can't resurrect a cancelled job
+    assert not worklog.set_status("acme", "p1", "done")
+    assert worklog.load("acme")[0]["status"] == "cancelled"
+
+
+def test_cross_tenant_isolation(orgdirs):
+    worklog.record("acme", kind="fix", prompt="secret acme prompt", refs=[], uploads=[],
+                   parents=["a.png"], output_prefix="fixes/a", pid="p1")
+    # a different org's log is a different file — zero leakage either direction
+    assert worklog.load("acme") and worklog.load("globex") == []
+    worklog.record("globex", kind="fix", prompt="globex prompt", refs=[], uploads=[],
+                   parents=["b.png"], output_prefix="fixes/b", pid="p2")
+    assert [r["prompt"] for r in worklog.load("acme")] == ["secret acme prompt"]
+    assert [r["prompt"] for r in worklog.load("globex")] == ["globex prompt"]
+
+
+def test_cap_keeps_newest(orgdirs, monkeypatch):
+    monkeypatch.setattr(worklog, "_CAP", 5)
+    for i in range(12):
+        worklog.record("acme", kind="fix", prompt=f"p{i}", refs=[], uploads=[],
+                       parents=[], output_prefix=f"fixes/{i}", pid=f"p{i}")
+    rows = worklog.load("acme")
+    assert len(rows) == 5 and [r["prompt"] for r in rows] == [f"p{i}" for i in range(7, 12)]
+
+
+def test_build_lineage_chain():
+    # a.png --fix--> b.png --fix--> c.png ; and a.png --fix--> d.png (a sibling branch)
+    rows = [
+        {"kind": "fix", "prompt": "step1", "ts": 1, "parents": ["a.png"], "output": "b.png"},
+        {"kind": "fix", "prompt": "step2", "ts": 2, "parents": ["b.png"], "output": "c.png"},
+        {"kind": "fix", "prompt": "branch", "ts": 3, "parents": ["a.png"], "output": "d.png"},
+    ]
+    lin = worklog.build_lineage(rows, "c.png")
+    assert [a["path"] for a in lin["ancestors"]] == ["a.png", "b.png"]   # oldest first
+    assert lin["node"] == "c.png"
+    assert lin["descendants"] == []
+    # from the root, descendants include both branches, chronological
+    lin2 = worklog.build_lineage(rows, "a.png")
+    assert [d["path"] for d in lin2["descendants"]] == ["b.png", "d.png", "c.png"]
+    assert lin2["ancestors"] == []
+
+
+def test_record_stores_node(orgdirs):
+    r = worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                       output_prefix="f", pid="p1", lane="gpu", node="spark")
+    assert r["node"] == "spark"
+    r2 = worklog.record("acme", kind="fix", prompt="y", refs=[], uploads=[], parents=[],
+                        output_prefix="g", pid="p2", lane="local")
+    assert r2["node"] == "studio pod"   # local jobs run on the pod
+
+
+def test_mark_started_finished_and_median(orgdirs):
+    worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                   output_prefix="fixes/x", pid="p1")
+    assert worklog.mark_started("acme", "p1", 1000)
+    r = worklog.load("acme")[0]
+    assert r["started_at"] == 1000 and r["status"] == "running"
+    assert not worklog.mark_started("acme", "p1", 2000)          # idempotent: keeps first
+    assert worklog.load("acme")[0]["started_at"] == 1000
+    assert worklog.mark_finished("acme", "p1", 1050)
+    r = worklog.load("acme")[0]
+    assert r["finished_at"] == 1050 and r["status"] == "done"
+    assert worklog.median_durations(worklog.load("acme"))["fix"] == 50   # 1050-1000
+
+
+def test_median_durations_per_kind():
+    rows = [
+        {"kind": "fix", "ts": 100, "started_at": 100, "finished_at": 110},     # 10
+        {"kind": "fix", "ts": 200, "started_at": 200, "finished_at": 220},     # 20
+        {"kind": "fix", "ts": 300, "started_at": 300, "finished_at": 360},     # 60 → median 20
+        {"kind": "compose", "ts": 0, "started_at": 0, "finished_at": 100},     # 100
+        {"kind": "fix", "ts": 400},                                            # unfinished → ignored
+    ]
+    m = worklog.median_durations(rows)
+    assert m == {"fix": 20, "compose": 100}
+    # no started_at → duration falls back to finished − queued(ts)
+    assert worklog.median_durations([{"kind": "rerun", "ts": 0, "finished_at": 30}]) == {"rerun": 30}
+
+
+def test_estimate_lanes_positions_and_eta():
+    now = 1000
+    active = [
+        {"id": "a", "kind": "fix", "lane": "gpu", "ts": 100, "status": "running", "started_at": now - 60, "node": "spark"},
+        {"id": "b", "kind": "fix", "lane": "gpu", "ts": 200, "status": "queued", "node": "spark"},
+        {"id": "c", "kind": "compose", "lane": "gpu", "ts": 300, "status": "queued", "node": "spark"},
+        {"id": "d", "kind": "fix", "lane": "local", "ts": 150, "status": "queued", "node": "studio pod"},
+    ]
+    medians = {"fix": 120, "compose": 300}
+    est, counts = worklog.estimate_lanes(active, medians, now)
+    assert counts == {"gpu": 3, "local": 1}
+    # running: elapsed 60 of median 120 → 60 remaining
+    assert est["a"]["position"] == 1 and est["a"]["of"] == 3
+    assert est["a"]["elapsed_seconds"] == 60 and est["a"]["remaining_seconds"] == 60 and est["a"]["eta_seconds"] == 60
+    assert est["a"]["node"] == "spark"
+    # queued #2: wait = running remaining(60); eta = 60 + own fix median(120)
+    assert est["b"]["position"] == 2 and est["b"]["wait_seconds"] == 60 and est["b"]["eta_seconds"] == 180
+    # queued #3: wait = 60 + b's fix(120) = 180; eta = 180 + compose(300)
+    assert est["c"]["position"] == 3 and est["c"]["wait_seconds"] == 180 and est["c"]["eta_seconds"] == 480
+    # separate lane, single queued item, nothing running → starts ~now
+    assert est["d"]["position"] == 1 and est["d"]["of"] == 1 and est["d"]["wait_seconds"] == 0 and est["d"]["eta_seconds"] == 120
+
+
+def test_estimate_lanes_default_median_for_unknown_kind():
+    est, _ = worklog.estimate_lanes(
+        [{"id": "x", "kind": "video", "lane": "gpu", "ts": 1, "status": "queued"}], {}, 0, default_median=200)
+    assert est["x"]["eta_seconds"] == 200
+
+
+def test_build_lineage_terminates_on_cycle():
+    rows = [
+        {"kind": "fix", "prompt": "x", "ts": 1, "parents": ["y.png"], "output": "x.png"},
+        {"kind": "fix", "prompt": "y", "ts": 2, "parents": ["x.png"], "output": "y.png"},
+    ]
+    lin = worklog.build_lineage(rows, "x.png")   # must not loop forever
+    assert lin["node"] == "x.png"

tests-unit/studio_home_test/test_studio_home.py

@@ -0,0 +1,590 @@
+"""Unit tests for the Studio Home surface (middleware/studio_home.py)."""
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from middleware import studio_home as sh
+
+
+def test_reseed_randomizes_every_sampler_seed():
+    graph = {
+        "a": {"class_type": "KSampler", "inputs": {"seed": 7, "steps": 30}},
+        "b": {"class_type": "KSamplerAdvanced", "inputs": {"noise_seed": 7}},
+        "c": {"class_type": "SaveImage", "inputs": {"filename_prefix": "x"}},
+    }
+    out = sh._reseed(json.loads(json.dumps(graph)))
+    assert out["a"]["inputs"]["steps"] == 30
+    # 2**31 space: a collision with the old seed twice over is not a thing.
+    assert (out["a"]["inputs"]["seed"], out["b"]["inputs"]["noise_seed"]) != (7, 7)
+
+
+def test_fix_graph_keeps_recipe_invariants():
+    g = sh._fix_graph("ref.png", "make the straps thicker", "fixes/test")
+    ks = g["13"]["inputs"]
+    assert ks["cfg"] == 4.0 and ks["steps"] == 30            # proven floor, not the weak 3.0
+    assert g["12"]["class_type"] == "CFGNorm"
+    assert g["8"]["inputs"]["reference_latents_method"] == "index_timestep_zero"
+    assert g["6"]["inputs"]["image1"] == ["2", 0]            # scaled ref, never raw
+    assert "straps thicker" in g["6"]["inputs"]["prompt"]
+    assert g["15"]["inputs"]["filename_prefix"] == "fixes/test"
+
+
+def test_safe_asset_blocks_traversal(tmp_path):
+    root = tmp_path / "out"
+    (root / "designs").mkdir(parents=True)
+    (root / "designs" / "a.png").write_bytes(b"x")
+    (tmp_path / "secret.txt").write_text("no")
+    assert sh._safe_asset(root, "designs/a.png") is not None
+    assert sh._safe_asset(root, "../secret.txt") is None
+    assert sh._safe_asset(root, "designs/missing.png") is None
+
+
+def test_status_vocab_matches_library_lifecycle():
+    assert sh._STATUSES == ("draft", "approved", "queued", "published", "deleted")
+
+
+def test_resolve_uploads_keeps_only_safe_existing_images(tmp_path, monkeypatch):
+    in_dir = tmp_path / "orgs" / "acme" / "input"
+    in_dir.mkdir(parents=True)
+    (in_dir / "ref.png").write_bytes(b"\x89PNG")
+    (in_dir / "shot.jpg").write_bytes(b"jpg")
+    (tmp_path / "secret.txt").write_text("no")
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", lambda org=None: str(in_dir))
+    out = sh._resolve_uploads("acme", [
+        "ref.png",                 # kept
+        "sub/dir/shot.jpg",        # basename kept (upload names are flat)
+        "ref.png",                 # de-duped
+        "../secret.txt",           # traversal + non-image -> dropped
+        "missing.png",             # absent -> dropped
+        "notes.txt",               # non-image -> dropped
+        42,                        # non-string -> dropped
+    ])
+    assert out == ["ref.png", "shot.jpg"]
+
+
+@pytest.mark.asyncio
+async def test_compose_accepts_uploaded_references(tmp_path, monkeypatch):
+    """A base library asset + one uploaded image is a valid 2-reference compose:
+    the upload is named directly (already in the input dir), the library asset is
+    staged, and both reach the graph — no lower bound violation."""
+    org = "acme"
+    root = tmp_path / "orgs" / org / "output"
+    root.mkdir(parents=True)
+    (root / "library.json").write_text(json.dumps({"assets": [{"path": "a.png"}]}))
+    (root / "a.png").write_bytes(b"\x89PNG-base")
+    in_dir = tmp_path / "orgs" / org / "input"
+    in_dir.mkdir(parents=True)
+    (in_dir / "up_0001_.png").write_bytes(b"\x89PNG-up")
+
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", lambda o=None: str(in_dir))
+    monkeypatch.setattr(sh.folder_paths, "get_org_output_directory", lambda o=None: str(root))
+    monkeypatch.setattr(sh.folder_paths, "get_output_directory", lambda: str(tmp_path))
+
+    captured = {}
+    async def fake_queue(request, server, graph):
+        captured["graph"] = graph
+        return "pid-1"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+
+    out = await sh.dispatch_compose(None, None, org, ["a.png"], "merge them", uploads=["up_0001_.png"])
+    assert out["ok"] and out["refs"] == 2
+    load_names = [n["inputs"]["image"] for n in captured["graph"].values()
+                 if n["class_type"] == "LoadImage"]
+    assert "up_0001_.png" in load_names            # upload referenced by its own name
+    assert any(n.startswith("compose_src_") for n in load_names)  # library asset staged
+
+
+class _FakeQueue:
+    def __init__(self, running=None, pending=None):
+        self.running = running or []
+        self.pending = pending or []
+        self.deleted = []
+
+    def get_current_queue_volatile(self):
+        return (self.running, self.pending)
+
+    def delete_queue_item(self, fn):
+        before = len(self.pending)
+        self.pending = [it for it in self.pending if not fn(it)]
+        self.deleted.append(before - len(self.pending))
+
+
+class _FakeServer:
+    port = 1
+
+    def __init__(self, **kw):
+        self.prompt_queue = _FakeQueue(**kw)
+
+
+def _orgaware(tmp_path, monkeypatch):
+    def outd(o=None):
+        d = tmp_path / "orgs" / (o or "default") / "output"
+        d.mkdir(parents=True, exist_ok=True)
+        return str(d)
+    def ind(o=None):
+        d = tmp_path / "orgs" / (o or "default") / "input"
+        d.mkdir(parents=True, exist_ok=True)
+        return str(d)
+    monkeypatch.setattr(sh.folder_paths, "get_org_output_directory", outd)
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", ind)
+    monkeypatch.setattr(sh.folder_paths, "get_output_directory", lambda: str(tmp_path))
+    return outd, ind
+
+
+def test_cancel_marks_cancelled_and_removes_gpu_row_org_scoped(tmp_path, monkeypatch):
+    outd, _ = _orgaware(tmp_path, monkeypatch)
+    (Path(outd("acme")) / "library.json").write_text('{"assets":[]}')
+    sh.worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/x", pid="p1", lane="gpu")
+    (Path(outd("acme")) / "render_jobs.json").write_text(json.dumps([{"id": "p1", "prefix": "x"}]))
+    srv = _FakeServer()
+    assert sh._owns_job(srv, "acme", "p1")
+    assert not sh._owns_job(srv, "globex", "p1")            # cross-tenant: not owned
+    assert sh._cancel_job(srv, "acme", "p1") == "gpu"
+    assert sh.worklog.load("acme")[0]["status"] == "cancelled"
+    assert json.loads((Path(outd("acme")) / "render_jobs.json").read_text()) == []
+
+
+def test_cancel_deletes_local_pending_only_when_org_matches(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    mine = (1, "p1", {}, {"org_id": "acme"}, [])
+    theirs = (2, "p2", {}, {"org_id": "globex"}, [])
+    srv = _FakeServer(pending=[mine, theirs])
+    sh.worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/x", pid="p1")
+    assert sh._cancel_job(srv, "acme", "p1") == "local"
+    assert [it[1] for it in srv.prompt_queue.pending] == ["p2"]   # only mine deleted
+
+
+@pytest.mark.asyncio
+async def test_amend_atomic_swap_keeps_original_refs_and_adds_new(tmp_path, monkeypatch):
+    outd, ind = _orgaware(tmp_path, monkeypatch)
+    (Path(outd("acme")) / "library.json").write_text('{"assets":[]}')
+    (Path(ind("acme")) / "fix_src_1.png").write_bytes(b"\x89PNG")   # original ref, still present
+    (Path(ind("acme")) / "drop_9.png").write_bytes(b"\x89PNG")      # new upload
+    sh.worklog.record("acme", kind="fix", prompt="brighten", refs=["fix_src_1.png"],
+                      uploads=[], parents=["a.png"], output_prefix="fixes/a", pid="p1", lane="local")
+    captured = {}
+    async def fake_queue(request, server, graph):
+        captured["graph"] = graph
+        return "p2"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+    out = await sh.dispatch_amend(None, _FakeServer(), "acme", "p1", "brighten a lot more",
+                                  paths=[], uploads=["drop_9.png"])
+    assert out["amended_from"] == "p1" and out["prompt_id"] == "p2" and out["refs"] == 2
+    rows = {r["id"]: r for r in sh.worklog.load("acme")}
+    assert rows["p1"]["status"] == "cancelled"                      # original swapped out
+    assert rows["p2"]["status"] == "queued" and rows["p2"]["prompt"] == "brighten a lot more"
+    loads = [n["inputs"]["image"] for n in captured["graph"].values() if n.get("class_type") == "LoadImage"]
+    assert "fix_src_1.png" in loads and "drop_9.png" in loads       # original kept + new added
+
+
+@pytest.mark.asyncio
+async def test_amend_unknown_job_is_not_owned(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    with pytest.raises(sh.NotOwned):
+        await sh.dispatch_amend(None, _FakeServer(), "acme", "ghost", "change it")
+
+
+@pytest.mark.asyncio
+async def test_amend_terminal_job_rejected(tmp_path, monkeypatch):
+    outd, _ = _orgaware(tmp_path, monkeypatch)
+    sh.worklog.record("acme", kind="fix", prompt="x", refs=["r.png"], uploads=[], parents=[],
+                      output_prefix="fixes/x", pid="p1")
+    sh.worklog.set_status("acme", "p1", "done")
+    with pytest.raises(sh.DispatchError):
+        await sh.dispatch_amend(None, _FakeServer(), "acme", "p1", "too late")
+
+
+def test_prompt_error_message_extracts_real_reason():
+    # model-less pod: /prompt returns a validation error — the user must SEE it.
+    body = {"error": {"type": "prompt_outputs_failed_validation",
+                      "message": "Prompt outputs failed validation",
+                      "details": "UNETLoader: unet_name 'qwen-image-edit-2511.safetensors' not in []"}}
+    msg = sh._prompt_error_message(body)
+    assert "Prompt outputs failed validation" in msg and "not in []" in msg
+    assert sh._prompt_error_message({}) and "silent" not in sh._prompt_error_message({}).lower()
+    assert sh._prompt_error_message({"error": "no GPU worker"}) == "no GPU worker"
+
+
+@pytest.mark.asyncio
+async def test_text_only_fix_dispatches_single_image(tmp_path, monkeypatch):
+    """REGRESSION LOCK: click Fix, type text, no references → the single-image
+    /v1/library/fix path (base library asset staged, proven Qwen edit graph)."""
+    org = "acme"
+    root = tmp_path / "orgs" / org / "output"
+    root.mkdir(parents=True)
+    (root / "library.json").write_text(json.dumps({"assets": [{"path": "a.png"}]}))
+    (root / "a.png").write_bytes(b"\x89PNG")
+    in_dir = tmp_path / "orgs" / org / "input"
+    in_dir.mkdir(parents=True)
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", lambda o=None: str(in_dir))
+    monkeypatch.setattr(sh.folder_paths, "get_org_output_directory", lambda o=None: str(root))
+    monkeypatch.setattr(sh.folder_paths, "get_output_directory", lambda: str(tmp_path))
+    captured = {}
+    async def fake_queue(request, server, graph):
+        captured["graph"] = graph
+        return "pid-fix"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+    out = await sh.dispatch_fix(None, None, org, "a.png", "make the straps thicker")
+    assert out["ok"] and out["prompt_id"] == "pid-fix"
+    g = captured["graph"]
+    assert g["1"]["class_type"] == "LoadImage" and g["1"]["inputs"]["image"].startswith("fix_src_")
+    assert g["15"]["class_type"] == "SaveImage" and "straps thicker" in g["6"]["inputs"]["prompt"]
+
+
+@pytest.mark.asyncio
+async def test_fix_accepts_uploaded_base_image(tmp_path, monkeypatch):
+    """A freshly uploaded photo can be the fix base (upload=) without landing it in
+    the library first — the '+ add a photo' single-ref path."""
+    org = "acme"
+    in_dir = tmp_path / "orgs" / org / "input"
+    in_dir.mkdir(parents=True)
+    (in_dir / "shot_1.png").write_bytes(b"\x89PNG-up")
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", lambda o=None: str(in_dir))
+    captured = {}
+    async def fake_queue(request, server, graph):
+        captured["graph"] = graph
+        return "pid-up"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+    out = await sh.dispatch_fix(None, None, org, "", "brighten it", upload="shot_1.png")
+    assert out["ok"] and captured["graph"]["1"]["inputs"]["image"] == "shot_1.png"
+    with pytest.raises(sh.DispatchError):
+        await sh.dispatch_fix(None, None, org, "", "brighten it", upload="../etc/passwd")
+
+
+@pytest.mark.asyncio
+async def test_queue_prompt_surfaces_downstream_error(tmp_path, monkeypatch):
+    """A non-200 from the self-POST /prompt (model-less pod) becomes a DispatchError
+    carrying the REAL reason — never a raw 502 the dialog swallows into 'Failed:'."""
+    from aiohttp import web
+    from aiohttp.test_utils import TestClient, TestServer
+
+    class Srv:
+        port = None
+    srv = Srv()
+    routes = web.RouteTableDef()
+
+    @routes.post("/prompt")
+    async def prompt(request):
+        return web.json_response({"error": {"message": "Prompt outputs failed validation",
+                                            "details": "UNETLoader: unet_name '…' not in []"}}, status=400)
+
+    async def edit(request):
+        graph = (await request.json())["graph"]
+        try:
+            pid = await sh._queue_prompt(request, srv, graph)
+            return web.json_response({"prompt_id": pid})
+        except sh.DispatchError as e:
+            return web.json_response({"error": str(e)}, status=400)
+    routes.post("/edit")(edit)
+
+    app = web.Application()
+    app.add_routes(routes)
+    ts = TestServer(app)
+    await ts.start_server()
+    srv.port = ts.port
+    client = TestClient(ts)
+    await client.start_server()
+    r = await client.post("/edit", json={"graph": {"1": {"class_type": "SaveImage", "inputs": {}}}})
+    body = await r.json()
+    assert r.status == 400 and "error" in body
+    assert "failed validation" in body["error"] and "not in []" in body["error"]  # real reason, shown
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_compose_rejects_single_reference(tmp_path, monkeypatch):
+    org = "acme"
+    root = tmp_path / "orgs" / org / "output"
+    root.mkdir(parents=True)
+    (root / "library.json").write_text(json.dumps({"assets": [{"path": "a.png"}]}))
+    (root / "a.png").write_bytes(b"\x89PNG")
+    in_dir = tmp_path / "orgs" / org / "input"
+    in_dir.mkdir(parents=True)
+    monkeypatch.setattr(sh.folder_paths, "get_org_input_directory", lambda o=None: str(in_dir))
+    monkeypatch.setattr(sh.folder_paths, "get_org_output_directory", lambda o=None: str(root))
+    monkeypatch.setattr(sh.folder_paths, "get_output_directory", lambda: str(tmp_path))
+    with pytest.raises(sh.DispatchError):
+        await sh.dispatch_compose(None, None, org, ["a.png"], "just one", uploads=[])
+
+
+@pytest.mark.asyncio
+async def test_home_redirect_only_hits_root_html(monkeypatch):
+    from aiohttp import web
+    from aiohttp.test_utils import make_mocked_request
+
+    monkeypatch.setenv("STUDIO_HOME_DEFAULT", "1")
+
+    async def handler(_):
+        return web.Response(text="spa")
+
+    # root + html accept -> redirect to /studio
+    req = make_mocked_request("GET", "/", headers={"Accept": "text/html"})
+    with pytest.raises(web.HTTPFound) as e:
+        await sh.home_redirect(req, handler)
+    assert e.value.location == "/studio"
+
+    # advanced escape hatch and non-root paths pass through untouched
+    for path, accept in [("/?advanced=1", "text/html"), ("/assets/x.js", "*/*"), ("/", "application/json")]:
+        req = make_mocked_request("GET", path, headers={"Accept": accept})
+        resp = await sh.home_redirect(req, handler)
+        assert resp.text == "spa"
+
+    # env off (local dev / worker pods): root is untouched
+    monkeypatch.delenv("STUDIO_HOME_DEFAULT")
+    req = make_mocked_request("GET", "/", headers={"Accept": "text/html"})
+    resp = await sh.home_redirect(req, handler)
+    assert resp.text == "spa"
+
+
+# ── Shared shell: editor index injection + templates + workflow + wallet ─────────
+async def _client(server, org_middleware=True):
+    """A real aiohttp app with the studio-home routes and a fake-auth middleware that
+    stamps request['iam_user'] from an X-Org header — so route tests exercise the
+    SAME server-side org scoping (_org_of) production uses."""
+    from aiohttp import web
+    from aiohttp.test_utils import TestClient, TestServer
+
+    @web.middleware
+    async def fake_auth(request, handler):
+        o = request.headers.get("X-Org")
+        if o:
+            request["iam_user"] = {"org_id": o, "orgs": [o]}
+        return await handler(request)
+
+    app = web.Application(middlewares=[fake_auth] if org_middleware else [])
+    routes = web.RouteTableDef()
+    sh.add_studio_home_routes(routes, server)
+    app.add_routes(routes)
+    ts = TestServer(app)
+    await ts.start_server()
+    client = TestClient(ts)
+    await client.start_server()
+    return client
+
+
+def test_editor_index_injects_shell_once(tmp_path):
+    root = tmp_path / "web"
+    root.mkdir()
+    (root / "index.html").write_text("<html><head></head><body><div id=app></div></body></html>")
+    resp = sh.editor_index(str(root))
+    assert resp.headers["Cache-Control"] == "no-cache"
+    assert '<link rel="stylesheet" href="/studio/shell.css"></head>' in resp.text
+    assert '<script src="/studio/shell.js" defer></script></body>' in resp.text
+    # idempotent: an index that already carries the shell is served unchanged
+    (root / "index.html").write_text(resp.text)
+    again = sh.editor_index(str(root))
+    assert again.text.count("/studio/shell.js") == 1
+
+
+def test_template_api_prompt_shapes():
+    api = {"9": {"class_type": "KSampler", "inputs": {}}, "15": {"class_type": "SaveImage", "inputs": {}}}
+    assert sh._template_api_prompt({"output": api, "workflow": {"nodes": []}}) == api   # editor save
+    assert sh._template_api_prompt(api) == api                                          # bare API prompt
+    assert sh._template_api_prompt({"nodes": [{"id": 1}], "last_node_id": 1}) is None   # UI-only, not runnable
+    assert sh._template_api_prompt({}) is None and sh._template_api_prompt("x") is None
+    assert sh._template_slug("Karma — Ghost Mannequin!") == "karma-ghost-mannequin"
+
+
+@pytest.mark.asyncio
+async def test_templates_crud_and_tenant_isolation(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    client = await _client(_FakeServer())
+    graph = {"output": {"15": {"class_type": "SaveImage", "inputs": {"filename_prefix": "t/x"}}}}
+    r = await client.post("/v1/templates", json={"name": "Ghost Mannequin", "graph": graph}, headers={"X-Org": "acme"})
+    assert r.status == 200 and (await r.json())["slug"] == "ghost-mannequin"
+    # acme sees it (renderable — the graph carries an API prompt), fetches it by slug
+    r = await client.get("/v1/templates", headers={"X-Org": "acme"})
+    body = await r.json()
+    assert body["org"] == "acme" and len(body["templates"]) == 1
+    assert body["templates"][0]["name"] == "Ghost Mannequin" and body["templates"][0]["renderable"] is True
+    r = await client.get("/v1/templates/ghost-mannequin", headers={"X-Org": "acme"})
+    assert (await r.json())["graph"] == graph
+    # tenant isolation: globex's list is empty and it can't read acme's template
+    assert (await (await client.get("/v1/templates", headers={"X-Org": "globex"})).json())["templates"] == []
+    assert (await client.get("/v1/templates/ghost-mannequin", headers={"X-Org": "globex"})).status == 404
+    # validation
+    assert (await client.post("/v1/templates", json={"name": "", "graph": graph}, headers={"X-Org": "acme"})).status == 400
+    assert (await client.post("/v1/templates", json={"name": "x", "graph": {}}, headers={"X-Org": "acme"})).status == 400
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_template_render_dispatches_and_rejects_ui_only(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    async def fake_queue(request, server, graph):
+        return "pid-tmpl"
+    monkeypatch.setattr(sh, "_queue_prompt", fake_queue)
+    client = await _client(_FakeServer())
+    runnable = {"output": {"9": {"class_type": "KSampler", "inputs": {"seed": 1}},
+                           "15": {"class_type": "SaveImage", "inputs": {"filename_prefix": "t/run"}}}}
+    await client.post("/v1/templates", json={"name": "Run Me", "graph": runnable}, headers={"X-Org": "acme"})
+    r = await client.post("/v1/templates/render", json={"name": "run-me"}, headers={"X-Org": "acme"})
+    assert r.status == 200 and (await r.json())["prompt_id"] == "pid-tmpl"
+    assert sh.worklog.load("acme")[-1]["kind"] == "template"     # went through the ONE funnel
+    # UI-only graph can't run headless -> 422 with a reason, not a silent dispatch
+    await client.post("/v1/templates", json={"name": "UI Only", "graph": {"nodes": [], "last_node_id": 0}}, headers={"X-Org": "acme"})
+    assert (await client.post("/v1/templates/render", json={"name": "ui-only"}, headers={"X-Org": "acme"})).status == 422
+    # cross-tenant render: globex has no such template -> 404
+    assert (await client.post("/v1/templates/render", json={"name": "run-me"}, headers={"X-Org": "globex"})).status == 404
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_workflow_reads_embedded_graph_tenant_scoped(tmp_path, monkeypatch):
+    from PIL import Image
+    from PIL.PngImagePlugin import PngInfo
+    _orgaware(tmp_path, monkeypatch)
+    root = Path(sh.folder_paths.get_org_output_directory("acme"))
+    (root / "library.json").write_text('{"assets":[]}')
+    (root / "fixes").mkdir(parents=True, exist_ok=True)
+    info = PngInfo()
+    ui = {"nodes": [{"id": 1, "type": "SaveImage"}], "last_node_id": 1}
+    info.add_text("workflow", json.dumps(ui))
+    info.add_text("prompt", json.dumps({"1": {"class_type": "SaveImage", "inputs": {"filename_prefix": "fixes/x"}}}))
+    Image.new("RGB", (4, 4)).save(root / "fixes" / "x_00001_.png", "PNG", pnginfo=info)
+    sh.worklog.record("acme", kind="fix", prompt="x", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/x", pid="p1")
+    sh.worklog.record("acme", kind="fix", prompt="pending", refs=[], uploads=[], parents=[],
+                      output_prefix="fixes/nope", pid="p2")
+    client = await _client(_FakeServer())
+    r = await client.get("/v1/workflow?id=p1", headers={"X-Org": "acme"})
+    body = await r.json()
+    assert r.status == 200 and body["format"] == "ui" and body["graph"] == ui   # UI graph preferred
+    # not landed yet -> 404 (no graph to open)
+    assert (await client.get("/v1/workflow?id=p2", headers={"X-Org": "acme"})).status == 404
+    # cross-tenant id is never confirmed -> 404
+    assert (await client.get("/v1/workflow?id=p1", headers={"X-Org": "globex"})).status == 404
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_wallet_proxies_and_scopes_org(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    async def fake_balance(tok):
+        assert tok == "Bearer tkn"
+        return {"availableCents": 2500, "currency": "usd", "pendingCents": 0}
+    monkeypatch.setattr(sh, "_finance_balance", fake_balance)
+    client = await _client(_FakeServer())
+    r = await client.get("/v1/wallet", headers={"X-Org": "acme", "Authorization": "Bearer tkn"})
+    body = await r.json()
+    assert body == {"org": "acme", "balance": 25.0, "currency": "usd"}
+    # signed-out (no bearer): display-only null balance, never a fabricated number
+    r = await client.get("/v1/wallet", headers={"X-Org": "acme"})
+    assert await r.json() == {"org": "acme", "balance": None, "currency": None}
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_library_upload_roundtrip_dedup_and_tenant_isolation(tmp_path, monkeypatch):
+    import aiohttp
+    _orgaware(tmp_path, monkeypatch)
+    # library.json so _library_root resolves for the GET round-trip
+    (Path(sh.folder_paths.get_org_output_directory("acme")) / "library.json").write_text('{"assets":[]}')
+    (Path(sh.folder_paths.get_org_output_directory("globex")) / "library.json").write_text('{"assets":[]}')
+    client = await _client(_FakeServer())
+    png = b"\x89PNG\r\n\x1a\n" + b"acme-bytes"
+    # multipart upload as acme -> renders/r1.png
+    form = aiohttp.FormData()
+    form.add_field("image", png, filename="r1.png", content_type="image/png")
+    r = await client.post("/v1/library/upload", data=form, headers={"X-Org": "acme"})
+    body = await r.json()
+    assert r.status == 200 and body["ok"] and body["path"] == "renders/r1.png" and not body.get("existed")
+    # round-trip through the org-scoped file server
+    g = await client.get("/v1/library/file?path=renders/r1.png", headers={"X-Org": "acme"})
+    assert g.status == 200 and (await g.read()) == png
+    # dedup: identical name+size -> existed, no rewrite
+    form2 = aiohttp.FormData()
+    form2.add_field("image", png, filename="r1.png", content_type="image/png")
+    r2 = await client.post("/v1/library/upload", data=form2, headers={"X-Org": "acme"})
+    assert (await r2.json()) == {"ok": True, "existed": True, "path": "renders/r1.png"}
+    # tenant isolation: org B never sees org A's file; its own upload is a separate tree
+    assert (await client.get("/v1/library/file?path=renders/r1.png", headers={"X-Org": "globex"})).status == 404
+    rg = await client.post("/v1/library/upload?name=r1.png", data=b"\x89PNG\r\n\x1a\nglobex",
+                           headers={"X-Org": "globex", "Content-Type": "application/octet-stream"})
+    assert (await rg.json())["path"] == "renders/r1.png"
+    # org A's bytes are untouched by org B's same-named upload
+    assert (await (await client.get("/v1/library/file?path=renders/r1.png", headers={"X-Org": "acme"})).read()) == png
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_library_upload_rejects_traversal_bad_name_and_oversize(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    client = await _client(_FakeServer())
+    hdr = {"X-Org": "acme", "Content-Type": "application/octet-stream"}
+    # subpath traversal -> 400
+    assert (await client.post("/v1/library/upload?name=x.png&subpath=../secret", data=b"\x89PNGx", headers=hdr)).status == 400
+    # non-image name -> 400
+    assert (await client.post("/v1/library/upload?name=notes.txt", data=b"hi", headers=hdr)).status == 400
+    # a traversal-y NAME is neutralized to its basename, lands safely under renders/
+    r = await client.post("/v1/library/upload?name=../../evil.png", data=b"\x89PNG\r\n\x1a\nevil", headers=hdr)
+    assert (await r.json())["path"] == "renders/evil.png"
+    assert (Path(sh.folder_paths.get_org_output_directory("acme")) / "renders" / "evil.png").is_file()
+    # size cap -> 413
+    monkeypatch.setattr(sh, "_MAX_UPLOAD", 8)
+    assert (await client.post("/v1/library/upload?name=big.png", data=b"0123456789", headers=hdr)).status == 413
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_library_upload_indexes_into_assets_and_worklog(tmp_path, monkeypatch):
+    import aiohttp
+    _orgaware(tmp_path, monkeypatch)
+    client = await _client(_FakeServer())
+    png = b"\x89PNG\r\n\x1a\n" + b"render-bytes"
+    form = aiohttp.FormData()
+    form.add_field("image", png, filename="shot.png", content_type="image/png")
+    r = await client.post("/v1/library/upload?node=spark&design=karma&kind=render",
+                          data=form, headers={"X-Org": "acme"})
+    assert (await r.json())["path"] == "renders/shot.png"
+    # instantly findable in Assets (library.json entry, draft)
+    lib = await (await client.get("/v1/library", headers={"X-Org": "acme"})).json()
+    a = next(x for x in lib["assets"] if x["path"] == "renders/shot.png")
+    assert a["status"] == "draft" and a["kind"] == "render" and a["design"] == "karma" and a["tags"] == []
+    # instantly findable in Queue & History with its source node + resolved output
+    wl = await (await client.get("/v1/worklog", headers={"X-Org": "acme"})).json()
+    it = next(x for x in wl["items"] if x["output_prefix"] == "renders/shot.png")
+    assert it["kind"] == "render" and it["node"] == "spark" and it["status"] == "done"
+    assert it["output"] == "renders/shot.png" and it["lane"] == "gpu"
+    # tenant isolation: org B sees neither the asset nor the row
+    lib2 = await (await client.get("/v1/library", headers={"X-Org": "globex"})).json()
+    assert all(x["path"] != "renders/shot.png" for x in lib2.get("assets", []))
+    assert (await (await client.get("/v1/worklog", headers={"X-Org": "globex"})).json())["items"] == []
+    # dedup: re-upload identical bytes adds no second asset or row
+    form2 = aiohttp.FormData()
+    form2.add_field("image", png, filename="shot.png", content_type="image/png")
+    r2 = await client.post("/v1/library/upload?node=spark", data=form2, headers={"X-Org": "acme"})
+    assert (await r2.json()).get("existed") is True
+    lib3 = await (await client.get("/v1/library", headers={"X-Org": "acme"})).json()
+    assert sum(1 for x in lib3["assets"] if x["path"] == "renders/shot.png") == 1
+    wl3 = await (await client.get("/v1/worklog", headers={"X-Org": "acme"})).json()
+    assert sum(1 for x in wl3["items"] if x["output_prefix"] == "renders/shot.png") == 1
+    await client.close()
+
+
+@pytest.mark.asyncio
+async def test_worklog_search_matches_paths_and_refs_not_just_prompt(tmp_path, monkeypatch):
+    _orgaware(tmp_path, monkeypatch)
+    (Path(sh.folder_paths.get_org_output_directory("acme")) / "library.json").write_text('{"assets":[]}')
+    # an ingested render: empty prompt, findable only by its filename / ref
+    sh.worklog.record("acme", kind="render", prompt="", refs=["srcphoto.png"], uploads=[],
+                      parents=[], output_prefix="renders/model_shot.png", pid="r1", status="done")
+    sh.worklog.record("acme", kind="fix", prompt="brighten the sky", refs=[], uploads=[],
+                      parents=[], output_prefix="fixes/x", pid="r2")
+    client = await _client(_FakeServer())
+
+    async def ids(q):
+        r = await client.get("/v1/worklog?q=" + q, headers={"X-Org": "acme"})
+        return [it["id"] for it in (await r.json())["items"]]
+
+    assert await ids("model_shot") == ["r1"]   # by output filename, empty prompt
+    assert await ids("srcphoto") == ["r1"]      # by reference
+    assert await ids("brighten") == ["r2"]      # prompt search still works
+    assert await ids("nomatch") == []
+    await client.close()

web/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+dist/
+*.tsbuildinfo

web/README.md

@@ -0,0 +1,32 @@
+# Studio web — the Hanzo Studio product frontend
+
+Our unique studio frontend: a specialized **chat app** on the shared Hanzo stack.
+You say what to create; the cloud `/v1/chat` orchestrator drives studio's render
+tools and the outputs land in the library. This is the default surface at
+`studio.hanzo.ai/studio`.
+
+- **Stack**: Vite + React + TS. `@hanzo/*` packages are npm-published, so a clean
+  `npm install` — no workspace linking.
+- **Chat**: `POST api.hanzo.ai/v1/chat {capability, messages}` → `{reply, actions, ops}`
+  — the cloud `clients/chat` orchestrator, called **directly** (no studio proxy). The
+  `hanzo_token` cookie is `.hanzo.ai`-scoped, so `credentials:'include'` carries it
+  cross-origin and the handler bills the caller org. (Gateway CORS must allow the
+  `studio.hanzo.ai` origin with credentials.)
+- **Engine**: the studio pod serves `/v1/session`, `/v1/library`, `/v1/render-queue`,
+  `/v1/gpu-status` same-origin (same cookie) — no token handling in the browser.
+
+```bash
+npm install
+npm run build      # -> dist/  (served at /studio; base = /studio/)
+npm run dev        # local, set VITE_STUDIO_API=https://studio.hanzo.ai
+```
+
+The ComfyUI-derived node editor ("Advanced mode") is a **separate** repo —
+`hanzoai/studio-ui` (formerly `studio-frontend`) — not this app.
+
+## Status / next
+- Increment 1 (done): chat wired to `/v1/chat` create + live library/queue/gpu strip.
+- Increment 2: swap the transcript/composer for `@hanzo/chat` `<Chat>` on `@hanzo/gui`
+  (GuiProvider + SessionProvider, copying console2's `Provider.tsx` spine).
+- Wiring: Dockerfile multi-stage to build `dist/` and serve it at `/studio` in
+  place of `middleware/studio_home.html`. (No proxy — chat hits api.hanzo.ai direct.)

web/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+    <title>Hanzo Studio</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

web/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@hanzo/studio-chat",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Studio as a specialized chat app — @hanzo/ai + @hanzo/gui talking to the cloud /v1/chat orchestrator, served at studio.hanzo.ai/studio.",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.12",
+    "@types/react-dom": "^18.3.1",
+    "@vitejs/plugin-react": "^4.3.4",
+    "typescript": "^5.6.3",
+    "vite": "^6.0.7"
+  }
+}

web/src/App.tsx

@@ -0,0 +1,115 @@
+import { useEffect, useRef, useState } from 'react'
+import {
+  chat, getSession, getLibrary, getRenderQueue, gpuOnline, thumbURL,
+  type ChatMessage, type Session, type Asset, type RenderJob,
+} from './api'
+
+// Studio-chat: the specialized chat surface. You say what to create; the cloud
+// /v1/agent "create" preset drives studio's render tools (fix/compose) and the
+// outputs land in the library strip. Increment 1 uses a minimal own-UI; the next
+// increment swaps the transcript/composer for @hanzo/chat's <Chat> on @hanzo/gui.
+
+export function App() {
+  const [session, setSession] = useState<Session>({})
+  const [messages, setMessages] = useState<ChatMessage[]>([])
+  const [conversationId, setConversationId] = useState<string>()
+  const [input, setInput] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [assets, setAssets] = useState<Asset[]>([])
+  const [jobs, setJobs] = useState<RenderJob[]>([])
+  const [gpu, setGpu] = useState(false)
+  const scroller = useRef<HTMLDivElement>(null)
+
+  useEffect(() => { getSession().then(setSession) }, [])
+
+  // Poll the library + in-flight queue so dispatched renders appear as they land.
+  useEffect(() => {
+    let alive = true
+    const tick = async () => {
+      if (!alive) return
+      const [lib, q, on] = await Promise.all([getLibrary(), getRenderQueue(), gpuOnline()])
+      if (!alive) return
+      setAssets(lib.assets.filter(a => a.status !== 'deleted').slice(0, 24))
+      setJobs(q.jobs); setGpu(on)
+    }
+    tick()
+    const t = setInterval(tick, 5000)
+    return () => { alive = false; clearInterval(t) }
+  }, [])
+
+  useEffect(() => { scroller.current?.scrollTo(0, scroller.current.scrollHeight) }, [messages, busy])
+
+  async function send() {
+    const text = input.trim()
+    if (!text || busy) return
+    const next = [...messages, { role: 'user' as const, content: text }]
+    setMessages(next); setInput(''); setBusy(true)
+    try {
+      const r = await chat(next, conversationId)
+      setConversationId(r.conversationId)
+      const note = r.actions.length
+        ? `\n\n${r.actions.map(a => a.error ? `⚠︎ ${a.name}: ${a.error}` : `▸ ${a.name} dispatched`).join('\n')}`
+        : ''
+      setMessages([...next, { role: 'assistant', content: (r.reply || '…') + note }])
+    } catch (e) {
+      setMessages([...next, { role: 'assistant', content: `Couldn't reach the studio chat (${(e as Error).message}).` }])
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <div className="app">
+      <header className="top">
+        <div className="brand">Hanzo <b>Studio</b></div>
+        <div className="spacer" />
+        <div className={`gpu ${gpu ? 'on' : 'off'}`}>{gpu ? 'GPU online' : 'no GPU'}</div>
+        <div className="who">{session.authenticated ? (session.org || session.user || 'signed in') : 'sign in'}</div>
+      </header>
+
+      <main className="body">
+        <section className="chat">
+          <div className="scroll" ref={scroller}>
+            {messages.length === 0 && (
+              <div className="hero">
+                <h1>What should we create?</h1>
+                <p>Describe an edit or a new shot — “make the Valentina back crotchless”,
+                  “put design 13 on model 01”. I’ll run it on your GPU and it lands below.</p>
+              </div>
+            )}
+            {messages.map((m, i) => (
+              <div key={i} className={`msg ${m.role}`}><div className="bubble">{m.content}</div></div>
+            ))}
+            {busy && <div className="msg assistant"><div className="bubble dim">working…</div></div>}
+          </div>
+          <div className="composer">
+            <textarea
+              value={input} placeholder="Describe what to create or change…"
+              onChange={e => setInput(e.target.value)}
+              onKeyDown={e => { if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); send() } }}
+            />
+            <button onClick={send} disabled={busy || !input.trim()}>Send</button>
+          </div>
+        </section>
+
+        <aside className={`rail${assets.length || jobs.length ? ' active' : ''}`}>
+          {jobs.length > 0 && (
+            <div className="queue">
+              <div className="rail-h">Rendering ({jobs.length})</div>
+              {jobs.map(jb => <div key={jb.id} className="job">{jb.prefix || jb.id.slice(0, 8)}</div>)}
+            </div>
+          )}
+          <div className="rail-h">Library</div>
+          <div className="grid">
+            {assets.map(a => (
+              <a key={a.path} className="cell" href={thumbURL(a.path)} target="_blank" rel="noreferrer">
+                <img loading="lazy" src={thumbURL(a.path)} alt="" />
+              </a>
+            ))}
+            {assets.length === 0 && <div className="empty">Renders appear here.</div>}
+          </div>
+        </aside>
+      </main>
+    </div>
+  )
+}

web/src/api.ts

@@ -0,0 +1,67 @@
+// The studio-chat data layer. Two backends, no proxy layer between them:
+//   - the agent orchestrator: POST api.hanzo.ai/v1/agent  (github.com/hanzoai/agent,
+//     mounted in the cloud binary) — called DIRECTLY, no studio pass-through. The
+//     hanzo_token cookie is scoped to .hanzo.ai so credentials:'include' carries it
+//     cross-origin, and the round replays it into the per-org-billed completion.
+//     (Gateway CORS must allow the studio.hanzo.ai origin with credentials.)
+//   - the studio engine API: /v1/session, /v1/library, /v1/render-queue, … —
+//     same-origin on studio.hanzo.ai (same cookie).
+// No token handling in the browser: the cookie is the credential for both.
+// VITE_STUDIO_API / VITE_AGENT_API override the bases for local dev.
+
+const BASE = (import.meta.env.VITE_STUDIO_API ?? '').replace(/\/$/, '')
+// Default: same-origin through the studio's /v1/agent bridge — the host-only
+// session cookie authorizes it and the middleware forwards the bearer, so no
+// parent-domain cookie and no gateway CORS dependency. VITE_AGENT_API points
+// straight at the gateway for direct mode.
+const AGENT_API = (import.meta.env.VITE_AGENT_API ?? '').replace(/\/$/, '')
+
+async function j<T>(url: string, init?: RequestInit): Promise<T> {
+  const r = await fetch(url, { credentials: 'include', ...init })
+  if (!r.ok) {
+    // Surface the server's own message — a 402 says "add credits at
+    // pay.hanzo.ai", which beats a bare status code.
+    let msg = `${url} -> ${r.status}`
+    try {
+      const b = await r.json()
+      const m = b?.error?.message ?? b?.error ?? b?.message
+      if (typeof m === 'string' && m) msg = m
+    } catch { /* keep the status line */ }
+    throw new Error(msg)
+  }
+  return r.json() as Promise<T>
+}
+
+export type Role = 'user' | 'assistant'
+export interface ChatMessage { role: Role; content: string }
+export interface Action { name: string; args?: Record<string, unknown>; result?: unknown; error?: string }
+export interface Op { name: string; args?: Record<string, unknown> }
+export interface ChatReply { reply: string; actions: Action[]; ops: Op[]; conversationId: string }
+
+// One turn of a preset: the model edits/combines library assets; `actions` are the
+// renders it dispatched (each result carries a prompt_id). Pass the prior reply's
+// conversationId to continue a thread — the orchestrator persists per-org history.
+export function chat(messages: ChatMessage[], conversationId?: string, preset = 'create'): Promise<ChatReply> {
+  return j<ChatReply>(`${AGENT_API}/v1/agent`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ preset, messages, conversationId }),
+  })
+}
+
+export interface Session {
+  user?: string; email?: string; org?: string; orgs?: string[]
+  authenticated?: boolean; iam_url?: string
+}
+export const getSession = () => j<Session>(`${BASE}/v1/session`).catch(() => ({ authenticated: false } as Session))
+
+export interface Asset { path: string; status?: string; mtime?: number; view?: unknown }
+export const getLibrary = () => j<{ org: string; assets: Asset[] }>(`${BASE}/v1/library`).catch(() => ({ org: '', assets: [] }))
+
+export interface RenderJob { id: string; prefix?: string; refs?: string[]; ts?: number; age?: number; status?: string }
+export const getRenderQueue = () => j<{ jobs: RenderJob[] }>(`${BASE}/v1/render-queue`).catch(() => ({ jobs: [] }))
+export const gpuOnline = () => j<{ online: boolean }>(`${BASE}/v1/gpu-status`).then(r => r.online).catch(() => false)
+
+// Thumbnail URL for a library asset (the studio pod serves a downsized JPEG).
+export const thumbURL = (path: string) => `${BASE}/v1/library/file?thumb=1&path=${encodeURIComponent(path)}`
+export const fileURL = (path: string) => `${BASE}/v1/library/file?path=${encodeURIComponent(path)}`

web/src/main.tsx

@@ -0,0 +1,10 @@
+import React from 'react'
+import { createRoot } from 'react-dom/client'
+import { App } from './App'
+import './styles.css'
+
+createRoot(document.getElementById('root')!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+)

web/src/styles.css

@@ -0,0 +1,54 @@
+:root {
+  --bg: #0d0d0f; --panel: #151517; --line: #26262b; --text: #f4f4f6;
+  --dim: #9a9aa2; --accent: #f4f4f6; --accent-ink: #0d0d0f;
+}
+@media (prefers-color-scheme: light) {
+  :root { --bg: #fafafa; --panel: #fff; --line: #e6e6ea; --text: #16161a; --dim: #6b6b73; --accent: #16161a; --accent-ink: #fff; }
+}
+* { box-sizing: border-box; }
+html, body, #root { height: 100%; margin: 0; }
+body { background: var(--bg); color: var(--text); font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
+
+.app { display: flex; flex-direction: column; height: 100%; }
+.top { display: flex; align-items: center; gap: 12px; padding: 12px 18px; border-bottom: 1px solid var(--line); }
+.brand { font-weight: 500; letter-spacing: .2px; } .brand b { font-weight: 700; }
+.spacer { flex: 1; }
+.gpu { font-size: 12px; padding: 3px 8px; border-radius: 999px; border: 1px solid var(--line); color: var(--dim); }
+.gpu.on { color: var(--text); } .gpu.on::before { content: "● "; color: #35c26b; }
+.who { font-size: 13px; color: var(--dim); }
+
+.body { flex: 1; display: grid; grid-template-columns: 1fr 320px; min-height: 0; }
+.chat { display: flex; flex-direction: column; min-height: 0; border-right: 1px solid var(--line); }
+.scroll { flex: 1; overflow-y: auto; padding: 22px; }
+.hero { max-width: 560px; margin: 8vh auto 0; text-align: center; }
+.hero h1 { font-size: 30px; font-weight: 600; margin: 0 0 10px; }
+.hero p { color: var(--dim); }
+.msg { display: flex; margin: 10px 0; } .msg.user { justify-content: flex-end; }
+.bubble { max-width: 74%; padding: 10px 14px; border-radius: 14px; white-space: pre-wrap; border: 1px solid var(--line); background: var(--panel); }
+.msg.user .bubble { background: var(--accent); color: var(--accent-ink); border-color: transparent; }
+.bubble.dim { color: var(--dim); }
+
+.composer { display: flex; gap: 10px; padding: 14px; border-top: 1px solid var(--line); }
+.composer textarea { flex: 1; resize: none; height: 44px; padding: 11px 14px; border-radius: 12px; border: 1px solid var(--line); background: var(--panel); color: var(--text); font: inherit; }
+.composer button { padding: 0 18px; border-radius: 12px; border: 0; background: var(--accent); color: var(--accent-ink); font-weight: 600; cursor: pointer; }
+.composer button:disabled { opacity: .5; cursor: default; }
+
+.rail { overflow-y: auto; padding: 16px; }
+.rail-h { font-size: 12px; text-transform: uppercase; letter-spacing: .6px; color: var(--dim); margin: 14px 0 8px; }
+.queue .job { font-size: 12px; padding: 6px 8px; border: 1px solid var(--line); border-radius: 8px; margin-bottom: 6px; color: var(--dim); }
+.grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 6px; }
+.cell { aspect-ratio: 3 / 4; overflow: hidden; border-radius: 8px; border: 1px solid var(--line); background: var(--panel); }
+.cell img { width: 100%; height: 100%; object-fit: cover; display: block; }
+.empty { color: var(--dim); font-size: 13px; }
+
+@media (max-width: 820px) {
+  /* Chat fills; the library drops UNDER it as a compact strip so renders stay
+     reachable on a phone. Empty (no jobs, no assets) it hides entirely — the
+     `active` class is set only when there is something to show — so the empty
+     chat state stays clean. */
+  .body { grid-template-columns: 1fr; grid-template-rows: minmax(0, 1fr) auto; }
+  .chat { border-right: 0; }
+  .rail { display: none; }
+  .rail.active { display: block; border-top: 1px solid var(--line); max-height: 42vh; overflow-y: auto; }
+  .rail.active .grid { grid-template-columns: repeat(auto-fill, minmax(84px, 1fr)); }
+}

web/src/vite-env.d.ts

@@ -0,0 +1 @@
+/// <reference types="vite/client" />

web/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src"]
+}

web/vite.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// Served same-origin by the studio Python pod at /studio, so the app is based at
+// /studio/ and every /v1/* fetch rides the same-origin hanzo_token cookie (no CORS).
+export default defineConfig({
+  base: '/studio/',
+  plugins: [react()],
+  build: { outDir: 'dist', sourcemap: false },
+})