Rebuild the run page around one client, with live status per URL

The run page now says what a run is and how many cells can start at each
revision (18 and 31 today, not 49 at every revision), then leads with the
config picker, whose block covers the starter set only. Below it come the
one URL per revision for scenarios that need no sign-in, the cells that
need a URL of their own, and the auth cells, metadata-default first and
the rest folded by group. Every URL carries a live line: its state as a
glyph and a word, the time of the last request and the client's name,
judged by buildReport() from the stored log so every process agrees with
the report. It refreshes with the report's 10-second script, paused while
the tab is hidden. The page ends with how many cells were reached and how
many need a look.

Every client's full block, copy all, the mcpServers map of every cell and
the run's matrix move to a bulk page at /s/<run-id>/bulk.

Author: pcarleton

src/hosted/README.md

@@ -68,8 +68,9 @@ name (`auth/metadata-var2/tenant1` → scenario `auth/metadata-var2`, suffix
 Before the matrix it says, in plain sentences: what this is (a server that
 tests a client you point at it by hand; a cell is one scenario at one
 revision with its own MCP URL); how to test a client in five minutes (a new
-run at `/s`, the run page's composite URLs and per-client config blocks,
-the cell steps, the report and its frozen, Markdown and plain-text copies);
+run at `/s`, the run page's composite URLs, `auth/metadata-default` and
+client picker, the cell steps, the report and its frozen, Markdown and
+plain-text copies);
 what the score means (the frozen requirement set's scored cells per
 revision, "X of the M scored cells you can run here pass · N are scored for
 the revision", one line per state, and that a
@@ -82,8 +83,41 @@ issue tracker are. Every page ends with the server's build (short commit,
 run report stores it as `server` (`build`, `deployedAt`), so a frozen copy
 names the build that froze it. The Val Town deploy stamps the staged
 `src/hosted/build-stamp.ts`; the local `hosted` command reads the checkout's
-commit from git; anything else reads "unknown". The run page's two sections it names carry anchors,
-`#composites` and `#client-config`.
+commit from git; anything else reads "unknown". The run page's sections carry anchors:
+`#client-config`, `#composites`, `#own-url`, `#auth` and `#results`.
+
+**The run page** (`/s/<run-id>`; `/s/<run-id>/<rev>` for one revision) is
+written for the author of one client setting it up. It says what a run is
+and how many cells can start at each revision ("At 2025-11-25, 18 cells can
+start here, and at 2026-07-28, 31 can."), then:
+
+1. **Pick your client**: a picker (`src/hosted/config-picker.ts`) whose
+   default is "Just the URL", with VS Code, Codex, Goose, Copilot CLI and
+   `mcpServers` JSON behind it. The choice is kept in the browser's
+   localStorage (`c9e-client`), read and written inside try/catch, so a
+   blocked store leaves the URL. Its block covers the starter set only: the
+   ready-made composites and `auth/metadata-default` at each revision.
+2. One URL per revision for the scenarios that need no sign-in (the
+   ready-made composite), with the scenarios behind it folded.
+3. The cells that need a URL of their own (no composite can carry them), each
+   with the reason.
+4. The auth cells: `auth/metadata-default` at each revision, then the rest
+   folded by group (metadata discovery, scopes, registration and token
+   endpoint authentication, issuer checks, other auth).
+5. How many cells the client has reached and how many need a look, with
+   "Open the results".
+
+Every URL has a live line: `✓ reached`, `✗ fails`, `■ stopped`, `◔ waiting`,
+`◑ in progress`, `◐ stopped short` or `○ not reached yet`, with the time of
+the last request and the client's name. A cell the client reached reads
+"reached" until it fails or stops; only the report says pass. A composite's
+line is its worst child's, with how many of its scenarios were reached. The
+lines are judged exactly as the report judges the cell
+(`src/hosted/run-status.ts` over `buildReport()`), from the stored log when
+there is a store, and the page refreshes them with the report's 10-second
+script, paused while the tab is hidden. The bulk page (`/s/<run-id>/bulk`)
+has every client's full block with "copy all", the `mcpServers` map of every
+cell, and the run's matrix with each cell's steps, links and copy buttons.
 
 **How long results last.** The landing page states these from the values
 the deployment runs with, not from the defaults, so it cannot disagree with
@@ -173,10 +207,10 @@ each with its own copy button and a line on adding it to a file that already
 has servers. Names are `c9e-<revision>-<scenario>` with
 anything but letters, digits, `*`and`-`made`-`
 (`c9e-2025-11-25-auth-metadata-default`); the run page's ready-made
-composites are `c9e-<revision>-composite`. The run page gives each client a
+composites are `c9e-<revision>-composite`. The run page's picker gives the
 starter block (the ready-made composites and `auth/metadata-default`per
-revision) and, folded, the full one, which covers every startable cell of the
-run once: the composites, each cell no composite carries (such as`request-metadata`and`http-invalid-tool-headers`), and every auth cell, switched off where
+revision); the bulk page gives each client the full one, which covers every
+startable cell of the run once: the composites, each cell no composite carries (such as`request-metadata`and`http-invalid-tool-headers`), and every auth cell, switched off where
 the format can say so (`enabled: false`for Goose,`enabled = false` for
 Codex), since each auth cell starts a sign-in when the client connects
 (`src/hosted/client-config.ts`). An `auth/\*`cell, which has no generic-client steps, shows plain ones for a hand-driven

src/hosted/client-config.test.ts

@@ -9,7 +9,7 @@ import {
 } from './client-config';
 import { DEFAULT_COMPOSITES, parseComposite } from './composite';
 import { createHostedApp, type RunConfig } from './server';
-import { runClientEntries } from './html';
+import { runClientEntries } from './run-page';
 import { MCP_PATH } from './matrix';
 
 const entries: ServerEntry[] = [

src/hosted/composite.test.ts

@@ -380,7 +380,9 @@ describe('composite cells on the hosted server', () => {
     const html = await (
       await fetch(`${base}/s/comp5`, { headers: { accept: 'text/html' } })
     ).text();
-    expect(html).toContain('One URL for several scenarios');
+    expect(html).toContain(
+      'Add one URL per revision for the scenarios that need no sign-in'
+    );
     expect(html).toContain(
       `${base}/s/comp5/${STATELESS}/tools_call+http-standard-headers+http-custom-headers+json-schema-ref-no-deref+sep-2322-client-request-state/mcp`
     );

src/hosted/html.test.ts

@@ -19,6 +19,8 @@ import { scoreText } from './markdown';
 import { cellId, DEFAULT_CELL_TTL_MS } from './session';
 import { describeStep } from '../steps';
 import { CLIENTS } from './client-config';
+import { renderBulkPage, renderRunPage } from './run-page';
+import type { RunLive } from './run-status';
 import { identityCheck, identityOf } from './identity';
 import { hostedScenarios } from './catalog';
 
@@ -69,6 +71,14 @@ function configFor(runId: string, scope: Partial<RunConfig> = {}): RunConfig {
 /** A single process without a store, at the default idle TTL. */
 const IN_MEMORY = { idleMs: DEFAULT_CELL_TTL_MS };
 
+/** A run nothing has reached yet, for the run page. */
+const NO_LIVE: RunLive = {
+  cells: new Map(),
+  reached: 0,
+  needsLook: 0,
+  now: 0
+};
+
 /** The page's text with tags dropped and whitespace folded. */
 const text = (html: string) =>
   html
@@ -99,23 +109,21 @@ describe('landing page for a newcomer', () => {
 
   it('gives the five-minute path: new run, composite, per-client config, steps, results', () => {
     expect(html).toContain('<a href="/s">Start a new run</a>');
-    expect(said).toContain('One URL for several scenarios');
-    expect(said).toContain('Each auth scenario needs a URL of its own.');
+    expect(said).toContain('one URL per revision');
+    expect(said).toContain('Each auth scenario needs a URL of its own');
     expect(said).toContain(
-      'VS Code, Codex, Goose and any client that reads mcpServers JSON'
+      'VS Code, Codex, Goose, Copilot CLI and any client that reads mcpServers JSON'
     );
     expect(said).toContain('/results/<run-id>');
     expect(said).toContain('Freeze a copy to link to');
     expect(said).toContain('Markdown or plain text');
-    // The section names match the run page's headings, which carry anchors.
-    const run = renderConfig('http://x', matrix, configFor('run0'));
-    expect(run).toContain(
-      '<h2 id=composites>One URL for several scenarios</h2>'
-    );
-    expect(run).toContain('<h2 id=client-config>Paste into your client</h2>');
-    expect(said).toContain('Paste into your client');
+    // The section it names matches the run page's heading, with an anchor,
+    // and the picker offers every client the landing page names.
+    const run = renderRunPage('http://x', matrix, configFor('run0'), NO_LIVE);
+    expect(run).toContain('<h2 id=client-config>Pick your client</h2>');
+    expect(said).toContain('Pick your client');
     for (const client of CLIENTS)
-      expect(run).toContain(`<b>${client.label}</b>`);
+      expect(run).toContain(`>${client.label}</option>`);
   });
 
   it('explains the score from the matrix and every state in one line', () => {
@@ -237,9 +245,9 @@ describe('hosted HTML', () => {
     expect(html).toContain('excluded &lt;here&gt;');
   });
 
-  it('run page links every startable cell and embeds the config for the copy buttons', () => {
+  it('bulk page links every startable cell and embeds the config for the copy buttons', () => {
     const config = configFor('run1');
-    const html = renderConfig('http://x', matrix, config);
+    const html = renderBulkPage('http://x', matrix, config);
     expect(html).toContain('<a href="/s/run1/2026-07-28/tools_call">open</a>');
     expect(html).toContain(
       '<a href="/results/run1/2026-07-28/tools_call">results</a>'
@@ -256,14 +264,12 @@ describe('hosted HTML', () => {
 
   it('run page and landing count startable cells per revision, not "at every revision"', () => {
     const config = configFor('run6');
-    const per = matrix.revisions
-      .map(
-        (r) => `${config.cells.filter((c) => c.revision === r).length} at ${r}`
-      )
-      .join(', ');
-    const html = renderConfig('http://x', matrix, config);
-    expect(html).toContain(
-      `<p>${config.cells.length} startable cells (${per}).`
+    const [older, newer] = matrix.revisions.map(
+      (r) => config.cells.filter((c) => c.revision === r).length
+    );
+    const html = renderRunPage('http://x', matrix, config, NO_LIVE);
+    expect(text(html)).toContain(
+      `At ${matrix.revisions[0]}, ${older} cells can start here, and at ${matrix.revisions[1]}, ${newer} can.`
     );
     expect(html).not.toContain('at every revision');
 
@@ -275,27 +281,25 @@ describe('hosted HTML', () => {
       `${cells.length} startable cells (${landingPer}) here.`
     );
 
-    const column = renderConfig(
+    const column = renderRunPage(
       'http://x',
       matrix,
-      configFor('run7', { revision: '2026-07-28' })
-    );
-    expect(column).toMatch(
-      /<p>\d+ startable cells? at revision <code>2026-07-28<\/code>\./
+      configFor('run7', { revision: '2026-07-28' }),
+      NO_LIVE
     );
+    expect(text(column)).toMatch(/At 2026-07-28, \d+ cells? can start here\./);
   });
 
-  it('column page filters to one revision', () => {
-    const html = renderConfig(
+  it('column page lists one revision', () => {
+    const html = renderRunPage(
       'http://x',
       matrix,
-      configFor('run2', { revision: '2025-11-25' })
-    );
-    expect(html).toContain(
-      '<th><a href="/s/run2/2025-11-25">2025-11-25</a></th>'
+      configFor('run2', { revision: '2025-11-25' }),
+      NO_LIVE
     );
-    expect(html).not.toContain('2026-07-28</a></th>');
-    expect(html).toContain('href="/s/run2/2025-11-25/initialize"');
+    expect(html).toContain('/s/run2/2025-11-25/initialize+tools_call/mcp');
+    expect(html).toContain('href="/s/run2/2025-11-25/elicitation-sep1034');
+    expect(html).not.toContain('/2026-07-28/');
   });
 
   it('cell page shows the endpoint, env and steps with a copy button', () => {
@@ -370,12 +374,16 @@ describe('hosted HTML', () => {
   });
 
   it('offers the bare MCP URL to copy on every cell, cell page and composite', () => {
-    const run = renderConfig('http://x', matrix, configFor('run6'));
-    expect(run).toContain(
+    const bulk = renderBulkPage('http://x', matrix, configFor('run6'));
+    expect(bulk).toContain(
       '<button class=copy data-copy-text="http://x/s/run6/2026-07-28/tools_call/mcp">copy URL</button>'
     );
+    const run = renderRunPage('http://x', matrix, configFor('run6'), NO_LIVE);
     expect(run).toMatch(
-      /data-copy-text="http:\/\/x\/s\/run6\/2026-07-28\/tools_call\+[^"]*\/mcp">copy URL/
+      /data-copy-text="http:\/\/x\/s\/run6\/2026-07-28\/tools_call\+[^"]*\/mcp" title="[^"]*">copy URL/
+    );
+    expect(run).toContain(
+      'data-copy-text="http://x/s/run6/2026-07-28/request-metadata/mcp"'
     );
     const cell = renderConfig(
       'http://x',
@@ -439,7 +447,7 @@ describe('hosted HTML', () => {
     );
   });
 
-  it('offers one block per client on the run page: the ready-made composites and every auth cell', () => {
+  it('offers one block per client: the starter on the run page, every cell on the bulk page', () => {
     const withAuth = buildMatrix({ auxOrigins: { as: 'http://as' } });
     const cells = withAuth
       .cells()
@@ -455,25 +463,36 @@ describe('hosted HTML', () => {
           MCP_CONFORMANCE_PROTOCOL_VERSION: c.revision
         }
       }));
-    const run = renderConfig('http://x', withAuth, {
+    const config: RunConfig = {
       runId: 'run9',
       resultsUrl: 'http://x/results/run9',
       mcpServers: {},
       cells
-    });
-    // Per client a starter block and the full one; the full one is longer.
-    const blocksWith = (marker: string) =>
-      [...run.matchAll(/data-copy-text="([^"]*)"/g)]
+    };
+    const run = renderRunPage('http://x', withAuth, config, NO_LIVE);
+    const bulk = renderBulkPage('http://x', withAuth, config);
+    const blockWith = (page: string, marker: string) => {
+      const found = [...page.matchAll(/data-copy-text="([^"]*)"/g)]
         .map((m) => m[1])
-        .filter((t) => t.includes(marker))
-        .sort((a, b) => a.length - b.length);
-    const [gooseStarter, goose] = blocksWith('type: streamable_http');
-    const [codexStarter, codex] = blocksWith('[mcp_servers.');
+        .filter((t) => t.includes(marker));
+      expect(found, marker).toHaveLength(1);
+      return found[0];
+    };
+    const [gooseStarter, codexStarter] = [
+      blockWith(run, 'type: streamable_http'),
+      blockWith(run, '[mcp_servers.')
+    ];
+    const [goose, codex] = [
+      blockWith(bulk, 'type: streamable_http'),
+      blockWith(bulk, '[mcp_servers.')
+    ];
     // Pasted under the file's own `extensions:` key: no key of its own.
     expect(goose).not.toMatch(/^extensions:/m);
-    expect(run).toContain(
-      'Paste under extensions: in ~/.config/goose/config.yaml.'
-    );
+    for (const page of [run, bulk]) {
+      expect(page).toContain(
+        'Paste under extensions: in ~/.config/goose/config.yaml.'
+      );
+    }
     // Auth cells arrive switched off, the composites on.
     expect(goose).toContain(
       '  c9e-2026-07-28-auth-resource-mismatch:\n    enabled: false'
@@ -491,7 +510,8 @@ describe('hosted HTML', () => {
       expect(starter).not.toContain('enabled = false');
     }
     // Copilot CLI has its own block (its entries need `tools`).
-    expect(run).toContain('<b>Copilot CLI</b>');
+    expect(bulk).toContain('<b>Copilot CLI</b>');
+    expect(run).toContain('<option value="copilot">Copilot CLI</option>');
     const auth = cells.filter((c) => c.scenario.startsWith('auth/'));
     expect(auth.length).toBeGreaterThan(10);
     for (const name of [
@@ -504,6 +524,7 @@ describe('hosted HTML', () => {
     // Only those: a cell a composite covers is not listed again.
     expect(goose).not.toContain('c9e-2026-07-28-tools_call:');
     expect(run).toContain('data-copy-text="{\n  &quot;servers&quot;');
+    expect(bulk).toContain('data-copy-text="{\n  &quot;servers&quot;');
   });
 
   it('renders the markdown in scenario descriptions instead of showing it raw', () => {
@@ -563,9 +584,18 @@ describe('hosted HTML', () => {
 
   it('escapes request-derived values', () => {
     const evil = '"><img src=x onerror=alert(1)>';
-    const html = renderConfig('http://x', matrix, configFor(evil));
-    expect(html).not.toContain('<img');
-    expect(html).toContain('&quot;&gt;&lt;img');
+    for (const html of [
+      renderRunPage('http://x', matrix, configFor(evil), NO_LIVE),
+      renderBulkPage('http://x', matrix, configFor(evil)),
+      renderConfig(
+        'http://x',
+        matrix,
+        configFor(evil, { revision: '2026-07-28', scenario: 'tools_call' })
+      )
+    ]) {
+      expect(html).not.toContain('<img');
+      expect(html).toContain('&quot;&gt;&lt;img');
+    }
     expect(
       renderMatrixTable(matrix, { origin: 'http://x', runId: evil })
     ).not.toContain('<img');