From 12c2ae1d17c458f177f7c713ee3a6374720ad586 Mon Sep 17 00:00:00 2001
From: claude <no-reply@agents.claude.kvmx.ru>
Date: Thu, 6 Aug 2026 01:29:08 +0400
Subject: [PATCH] mavweb: the last two pages leave Go (V-409)

CLAUDE.md says every page is its own embedded .html file next to main.go,
and that no page markup lives in Go. Two pages were still Go string
constants: passkeyPageHTML in webauthn.go and modelsHTML in models.go. They
are now passkey.html and models.html, embedded.

The identifiers keep their names, so passkey_prf_test.go still reads
passkeyPageHTML and still asserts on the same bytes.

Both templates now build through parsePage, and Page and handleModels render
through renderPage. handleEcosystem did too and now does the same.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 cmd/mavweb/ecosystem.go |  5 +--
 cmd/mavweb/models.go    | 46 +++-----------------------
 cmd/mavweb/models.html  | 35 ++++++++++++++++++++
 cmd/mavweb/passkey.html | 58 +++++++++++++++++++++++++++++++++
 cmd/mavweb/webauthn.go  | 72 ++++++-----------------------------------
 5 files changed, 108 insertions(+), 108 deletions(-)
 create mode 100644 cmd/mavweb/models.html
 create mode 100644 cmd/mavweb/passkey.html

diff --git a/cmd/mavweb/ecosystem.go b/cmd/mavweb/ecosystem.go
index 77a329c..1bb1439 100644
--- a/cmd/mavweb/ecosystem.go
+++ b/cmd/mavweb/ecosystem.go
@@ -117,8 +117,5 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 		d.Calls.Rows = rows
 	}
 
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := ecosystemTmpl.Execute(w, d); err != nil {
-		log.Printf("ecosystem render: %v", err)
-	}
+	renderPage(w, ecosystemTmpl, d)
 }
diff --git a/cmd/mavweb/models.go b/cmd/mavweb/models.go
index ded6af1..2b38bcd 100644
--- a/cmd/mavweb/models.go
+++ b/cmd/mavweb/models.go
@@ -2,8 +2,8 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"errors"
-	"html/template"
 	"log"
 	"net/http"
 	"strconv"
@@ -31,43 +31,10 @@ type modelController interface {
 	SwapModel(ctx context.Context, req ipc.SwapModelReq) (ipc.SwapModelResp, error)
 }
 
-var modelsTmpl = template.Must(template.New("models").Funcs(shellFuncs()).Parse(shellHTML + modelsHTML))
+//go:embed models.html
+var modelsHTML string
 
-const modelsHTML = `{{template "shellTop" "models"}}
-<h1>Resident model</h1>
-<p class=hint>swapping requires step-up — <a href=/auth/passkey>assert a passkey</a> first. The old model is unloaded before the new one is loaded (one model fits the iGPU at a time), so turns during the load are refused and fall back to the classifier.</p>
-<p class=hint>a swap is not remembered. Nothing writes it down, so the next restart of the daemon — including the one <code>mavupdate</code> does — comes back on <code>phraser.model_path</code> from the config. Make it stick by editing that.</p>
-{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
-{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
-{{if .Off}}
-<section class=card>
-<h2 class=card-title>swap not configured</h2>
-<p class=hint>this core has no <code>phraser.swap_models</code> allowlist, so there is nothing to swap to. Add the gguf paths you allow to <code>deploy/mavend.json</code> and restart once.</p>
-</section>
-{{else}}
-<section class=card>
-<h2 class=card-title>loaded now</h2>
-<div class=scroll><table>
-<tr><th>model</th><td><code>{{.Status.Model}}</code></td></tr>
-<tr><th>file</th><td><code>{{.Status.ModelPath}}</code></td></tr>
-<tr><th>server</th><td><code>{{.Status.BaseURL}}</code></td></tr>
-<tr><th>n_ctx</th><td>{{.Status.NCtx}}</td></tr>
-<tr><th>n_gpu_layers</th><td>{{.Status.NGpuLayers}}</td></tr>
-</table></div>
-<p class=hint>the model name is what llama-server reports for itself, not what the config says it should be.</p>
-</section>
-<section class=card>
-<h2 class=card-title>allowed models <span class=badge>{{len .Status.Swappable}}</span></h2>
-{{if .Status.Swappable}}<div class=scroll><table><tr><th>file</th><th></th></tr>
-{{range .Status.Swappable}}<tr><td><code>{{.}}</code></td>
-<td><form method=post action=/models class=inline-form>
-<input type=hidden name=model_path value="{{.}}">
-<button class=btn>load this one</button></form></td></tr>{{end}}
-</table></div>
-{{else}}<div class=empty><div>no models allowlisted</div></div>{{end}}
-</section>
-{{end}}
-{{template "shellBottom"}}`
+var modelsTmpl = parsePage("models", modelsHTML, nil)
 
 type modelsPage struct {
 	Msg    string
@@ -154,8 +121,5 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		}
 	}
 	page.Status = st
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := modelsTmpl.Execute(w, page); err != nil {
-		log.Printf("models render: %v", err)
-	}
+	renderPage(w, modelsTmpl, page)
 }
diff --git a/cmd/mavweb/models.html b/cmd/mavweb/models.html
new file mode 100644
index 0000000..0990b54
--- /dev/null
+++ b/cmd/mavweb/models.html
@@ -0,0 +1,35 @@
+{{template "shellTop" "models"}}
+<h1>Resident model</h1>
+<p class=hint>swapping requires step-up — <a href=/auth/passkey>assert a passkey</a> first. The old model is unloaded before the new one is loaded (one model fits the iGPU at a time), so turns during the load are refused and fall back to the classifier.</p>
+<p class=hint>a swap is not remembered. Nothing writes it down, so the next restart of the daemon — including the one <code>mavupdate</code> does — comes back on <code>phraser.model_path</code> from the config. Make it stick by editing that.</p>
+{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
+{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
+{{if .Off}}
+<section class=card>
+<h2 class=card-title>swap not configured</h2>
+<p class=hint>this core has no <code>phraser.swap_models</code> allowlist, so there is nothing to swap to. Add the gguf paths you allow to <code>deploy/mavend.json</code> and restart once.</p>
+</section>
+{{else}}
+<section class=card>
+<h2 class=card-title>loaded now</h2>
+<div class=scroll><table>
+<tr><th>model</th><td><code>{{.Status.Model}}</code></td></tr>
+<tr><th>file</th><td><code>{{.Status.ModelPath}}</code></td></tr>
+<tr><th>server</th><td><code>{{.Status.BaseURL}}</code></td></tr>
+<tr><th>n_ctx</th><td>{{.Status.NCtx}}</td></tr>
+<tr><th>n_gpu_layers</th><td>{{.Status.NGpuLayers}}</td></tr>
+</table></div>
+<p class=hint>the model name is what llama-server reports for itself, not what the config says it should be.</p>
+</section>
+<section class=card>
+<h2 class=card-title>allowed models <span class=badge>{{len .Status.Swappable}}</span></h2>
+{{if .Status.Swappable}}<div class=scroll><table><tr><th>file</th><th></th></tr>
+{{range .Status.Swappable}}<tr><td><code>{{.}}</code></td>
+<td><form method=post action=/models class=inline-form>
+<input type=hidden name=model_path value="{{.}}">
+<button class=btn>load this one</button></form></td></tr>{{end}}
+</table></div>
+{{else}}<div class=empty><div>no models allowlisted</div></div>{{end}}
+</section>
+{{end}}
+{{template "shellBottom"}}
diff --git a/cmd/mavweb/passkey.html b/cmd/mavweb/passkey.html
new file mode 100644
index 0000000..6ea67e0
--- /dev/null
+++ b/cmd/mavweb/passkey.html
@@ -0,0 +1,58 @@
+{{template "shellTop" "passkey"}}
+<h1>Passkey</h1>
+<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
+<div class=flex gap-2>
+<button class=btn onclick=enroll()>enroll passkey</button>
+<button class=btn onclick=assert()>assert (step-up)</button>
+<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
+<a href=/tools><button class=btn-primary>→ tools</button></a>
+</div>
+<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
+<div id=msg></div>
+{{template "shellBottom"}}
+<script>
+const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
+const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
+const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
+async function enroll(){try{
+ const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
+ options.challenge=ub64(options.challenge);
+ options.user.id=ub64(options.user.id);
+ const c=await navigator.credentials.create({publicKey:options});
+ const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
+  body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
+   clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
+ if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
+ // The wrapped key can only be written from an assertion: PRF results are
+ // not produced at create() time on most authenticators. Enrolment reports
+ // whether PRF is available at all so he is not told cold-start works when
+ // it cannot.
+ const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
+ const prfOK=!!(ext.prf&&ext.prf.enabled);
+ say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
+  'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
+}catch(e){say('enroll error: '+e,false);}}
+async function assert(explicit){try{
+ const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
+ options.challenge=ub64(options.challenge);
+ const c=await navigator.credentials.get({publicKey:options});
+ // The PRF result is the cold-start secret. It never touches localStorage
+ // and is posted once, over the same request as the assertion.
+ const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
+ const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
+ const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
+  body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
+   clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
+   signature:b64u(c.response.signature)}}})});
+ if(!r.ok){say('assert failed: '+await r.text(),false);return;}
+ if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
+ say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
+  'stepped up ✓ — enable tools now',true);
+}catch(e){say('assert error: '+e,false);}}
+// Rewriting the wrapped key is a separate gesture, never a side effect of a
+// step-up. Only this button sets explicit, and only explicit lets the daemon
+// replace a blob that already exists.
+async function rewrapKey(){
+ if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
+ await assert(true);}
+</script>
diff --git a/cmd/mavweb/webauthn.go b/cmd/mavweb/webauthn.go
index 3312c7f..f1ef4a7 100644
--- a/cmd/mavweb/webauthn.go
+++ b/cmd/mavweb/webauthn.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -76,72 +77,17 @@ func newPasskeyHandle(cfg webauthn.Config, core ipc.CoreAPI, storePath string, s
 // on: assert here (bumps the daemon session to L3 for the assertion TTL), then
 // enable a tool on /tools within that window.
 func (h *PasskeyHandle) Page(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	passkeyTmpl.Execute(w, nil)
+	renderPage(w, passkeyTmpl, nil)
 }
 
-var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
+// passkeyPageHTML — the enrolment page's own markup, wrapped by passkeyTmpl
+// with shellTop/shellBottom. It was a Go string constant, which is the one
+// place page markup still lived in Go.
+//
+//go:embed passkey.html
+var passkeyPageHTML string
 
-// passkeyPageHTML — rendered via passkeyTmpl, which wraps it with
-// shellTop/shellBottom.
-const passkeyPageHTML = `{{template "shellTop" "passkey"}}
-<h1>Passkey</h1>
-<p class=hint>Enroll a passkey once, then assert it to unlock destructive actions (tool enable) for a few minutes.</p>
-<div class=flex gap-2>
-<button class=btn onclick=enroll()>enroll passkey</button>
-<button class=btn onclick=assert()>assert (step-up)</button>
-<button class=btn onclick=rewrapKey()>rewrite cold-start key</button>
-<a href=/tools><button class=btn-primary>→ tools</button></a>
-</div>
-<p class=hint>Rewriting the cold-start key points it at the passkey you assert next. Every other enrolled passkey stops being able to unlock a cold-booted daemon.</p>
-<div id=msg></div>
-{{template "shellBottom"}}
-<script>
-const b64u=b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');
-const ub64=s=>{s=s.replace(/-/g,'+').replace(/_/g,'/');const b=atob(s),a=new Uint8Array(b.length);for(let i=0;i<b.length;i++)a[i]=b.charCodeAt(i);return a;};
-const say=(t,ok)=>{const m=document.getElementById('msg');m.textContent=t;m.className=ok?'msg msg-ok':'msg msg-err';};
-async function enroll(){try{
- const {challenge,options}=await (await fetch('/auth/webauthn/register/begin')).json();
- options.challenge=ub64(options.challenge);
- options.user.id=ub64(options.user.id);
- const c=await navigator.credentials.create({publicKey:options});
- const r=await fetch('/auth/webauthn/register/finish',{method:'POST',headers:{'content-type':'application/json'},
-  body:JSON.stringify({challenge,credential:{id:c.id,type:c.type,response:{
-   clientDataJSON:b64u(c.response.clientDataJSON),attestationObject:b64u(c.response.attestationObject)}}})});
- if(!r.ok){say('enroll failed: '+await r.text(),false);return;}
- // The wrapped key can only be written from an assertion: PRF results are
- // not produced at create() time on most authenticators. Enrolment reports
- // whether PRF is available at all so he is not told cold-start works when
- // it cannot.
- const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
- const prfOK=!!(ext.prf&&ext.prf.enabled);
- say(prfOK?'enrolled ✓ — now assert once to write the cold-start key':
-  'enrolled ✓ — but this authenticator has no PRF: cold-start unlock unavailable',true);
-}catch(e){say('enroll error: '+e,false);}}
-async function assert(explicit){try{
- const {challenge,options}=await (await fetch('/auth/webauthn/assert/begin')).json();
- options.challenge=ub64(options.challenge);
- const c=await navigator.credentials.get({publicKey:options});
- // The PRF result is the cold-start secret. It never touches localStorage
- // and is posted once, over the same request as the assertion.
- const ext=c.getClientExtensionResults?c.getClientExtensionResults():{};
- const prf=ext.prf&&ext.prf.results&&ext.prf.results.first?b64u(ext.prf.results.first):'';
- const r=await fetch('/auth/webauthn/assert/finish',{method:'POST',headers:{'content-type':'application/json'},
-  body:JSON.stringify({challenge,prf,explicit:!!explicit,credential:{id:c.id,type:c.type,response:{
-   clientDataJSON:b64u(c.response.clientDataJSON),authenticatorData:b64u(c.response.authenticatorData),
-   signature:b64u(c.response.signature)}}})});
- if(!r.ok){say('assert failed: '+await r.text(),false);return;}
- if(!prf){say('stepped up ✓ — no PRF from this authenticator, so cold-start unlock stayed unavailable',true);return;}
- say(explicit?'stepped up ✓ — cold-start key now points at this passkey':
-  'stepped up ✓ — enable tools now',true);
-}catch(e){say('assert error: '+e,false);}}
-// Rewriting the wrapped key is a separate gesture, never a side effect of a
-// step-up. Only this button sets explicit, and only explicit lets the daemon
-// replace a blob that already exists.
-async function rewrapKey(){
- if(!confirm('Rewrite the cold-start key under the passkey you are about to assert? Every other enrolled passkey stops being able to unlock a cold-booted daemon.'))return;
- await assert(true);}
-</script>`
+var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
 
 func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.CreationOptions([]byte("maven-user"), "maven user")