From ef949e6a17cb2e28fdb407e1df59ed1a55f6d4da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?=
 =?UTF-8?q?=D0=B8=D0=BD?= <i@atroshin.ru>
Date: Wed, 30 Sep 2026 00:02:52 +0300
Subject: [PATCH] fix: cached GETs bypass the card lock; compact install step
 lines (v3.6.47)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The install modal's progress bar froze around 70% and jumped to 100% at
the end: not a math bug - the UI's other polls (/api/stk-status,
/api/poll-status, /api/proactive-log, /api/menu, ...) were card-locked in
do_GET even though they only read cached state, queued behind the install
and exhausted the browser's 6-connections-per-host budget, starving
/api/status.  _CARD_FREE_GET lists every card-free GET (status, version,
stk-status, poll-status, proactive-log, menu, events, terminal-profile,
pli-*, commands, net-state, mcc-mnc, scp81/bip status|script|log);
/api/cardinfo and /api/esim/* stay locked (they touch the card).

tests/test_fetch_routes.py holds _CARD_LOCK and asserts the cached
endpoints still answer - verified to time out on the pre-fix list.

The install modal is wider (max-w-3xl) and successful step lines are
compact: '✅ Step 3: LOAD (1/240) - 6101 · 274 B / 3 SMS' (no verbose SW
name, B instead of bytes, the SMS count only when >1); failed steps keep
the full detail and the hint.

sw cache simple-v320; tests: 533 Python / 684 Node.
---
 frontend/index.html           | 43 ++++++++++++++++++-----------
 frontend/sw.js                |  2 +-
 frontend/tests/html.test.js   |  6 ++++
 frontend/tests/ram.test.js    | 10 ++++---
 pyproject.toml                |  2 +-
 pysim_simple_server/server.py | 36 +++++++++++++++++-------
 tests/test_fetch_routes.py    | 52 ++++++++++++++++++++++++++++++++++-
 7 files changed, 118 insertions(+), 33 deletions(-)

diff --git a/frontend/index.html b/frontend/index.html
index b612a88..d90048f 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -1725,7 +1725,7 @@
 	</div>
 
 	<div id="ram-op-modal" class="fixed inset-0 bg-black/50 z-50 flex items-center justify-center hidden">
-		<div class="bg-white dark:bg-slate-800 rounded-lg p-4 max-w-lg w-full max-h-[85vh] flex flex-col">
+		<div class="bg-white dark:bg-slate-800 rounded-lg p-4 max-w-3xl w-full max-h-[85vh] flex flex-col">
 			<div class="flex justify-between items-center mb-2 gap-3">
 				<span id="ram-op-title" class="font-bold text-sm flex-1"></span>
 				<button id="ram-op-close" onclick="ramOpModalClose()" disabled class="px-3 py-1 text-xs rounded-full bg-gray-200 dark:bg-slate-700 text-gray-700 dark:text-slate-300 hover:bg-gray-300 dark:hover:bg-slate-600 disabled:opacity-40 disabled:cursor-not-allowed" data-l10n="Close">Close</button>
@@ -1746,7 +1746,7 @@
 // ===== Version =====
 // Single source of truth for the PWA version: shown in the header and used
 // by the server version check in pysimConnect().
-const SIMPLE_VERSION = '3.6.46';
+const SIMPLE_VERSION = '3.6.47';
 document.getElementById('app-version').textContent = 'v' + SIMPLE_VERSION;
 
 // ===== Tab switching =====
@@ -9432,20 +9432,31 @@ function ramStepLine(s, idx, comps, blockSize) {
 	const ok = !s.por_error && (s.por_status === 'por_ok' || s.por_status === 'no_por');
 	let line = (ok ? '\u2705' : '\u274c') + ' ' + t('Step') + ' ' + (idx + 1) + ': ' +
 		s.name + ' \u2014 ';
-	if (s.por_status === 'por_ok') line += t('PoR ok');
-	else if (s.por_status === 'no_por') line += t('no PoR');
-	else if (s.por_status && s.por_status.indexOf('por_error') === 0) {
-		const legacy = s.por_status.replace(/^por_error_?/, '');
-		line += t('PoR error') + (legacy ? ' ' + legacy : '');
-	} else if (s.por_status) line += t('PoR error') + ' ' + s.por_status;
-	else line += t('PoR unknown');
-	if (s.por_sw) {
-		const name = lookupSw(s.por_sw.substr(0, 2), s.por_sw.substr(2, 2), 'gp');
-		line += ' \u00b7 ' + t('remote SW') + ' ' + s.por_sw + (name ? ' (' + name + ')' : '');
-	}
-	if (s.sw && s.sw !== '9000') line += ' \u00b7 ' + t('transport SW') + ' ' + s.sw;
-	if (s.bytes && s.segments) {
-		line += ' \u00b7 ' + s.bytes + ' ' + t('bytes') + ' / ' + s.segments + ' SMS';
+	if (ok) {
+		// successful step: the verdict symbol carries the meaning - keep the
+		// remote status word (without its verbose name), the size and the SMS
+		// count only when the packet was concatenated
+		if (s.por_sw) line += s.por_sw;
+		else if (s.por_status === 'no_por') line += t('no PoR');
+		else line += t('OK');
+		if (s.bytes) line += ' \u00b7 ' + s.bytes + ' B';
+		if (s.segments > 1) line += ' / ' + s.segments + ' SMS';
+	} else {
+		if (s.por_status === 'por_ok') line += t('PoR ok');
+		else if (s.por_status === 'no_por') line += t('no PoR');
+		else if (s.por_status && s.por_status.indexOf('por_error') === 0) {
+			const legacy = s.por_status.replace(/^por_error_?/, '');
+			line += t('PoR error') + (legacy ? ' ' + legacy : '');
+		} else if (s.por_status) line += t('PoR error') + ' ' + s.por_status;
+		else line += t('PoR unknown');
+		if (s.por_sw) {
+			const name = lookupSw(s.por_sw.substr(0, 2), s.por_sw.substr(2, 2), 'gp');
+			line += ' \u00b7 ' + t('remote SW') + ' ' + s.por_sw + (name ? ' (' + name + ')' : '');
+		}
+		if (s.sw && s.sw !== '9000') line += ' \u00b7 ' + t('transport SW') + ' ' + s.sw;
+		if (s.bytes && s.segments) {
+			line += ' \u00b7 ' + s.bytes + ' ' + t('bytes') + ' / ' + s.segments + ' SMS';
+		}
 	}
 	const sc = ramStepComponents(s.name, comps, blockSize);
 	if (sc) {
diff --git a/frontend/sw.js b/frontend/sw.js
index b274058..516a1fe 100644
--- a/frontend/sw.js
+++ b/frontend/sw.js
@@ -1,4 +1,4 @@
-const CACHE = 'simple-v319';
+const CACHE = 'simple-v320';
 const URLS = [
   'index.html',
   'help.html',
diff --git a/frontend/tests/html.test.js b/frontend/tests/html.test.js
index 5d1ee68..8c22435 100644
--- a/frontend/tests/html.test.js
+++ b/frontend/tests/html.test.js
@@ -486,3 +486,9 @@ test('the RAM form shows Card preset and Operation in one row', () => {
     const row = /<div class="mb-3 flex gap-2 items-end">\s*<div class="flex-1">\s*<label[^>]*data-l10n="Card preset"[\s\S]*?id="ram-card-sel"[\s\S]*?data-l10n="Operation"[\s\S]*?id="ram-op"[\s\S]*?data-l10n="Execute"/.exec(html);
     assert.ok(row, 'Card preset + Operation + Execute must share one row');
 });
+
+test('the RAM operation modal is wide enough for the step lines', () => {
+    const m = /<div id="ram-op-modal"[\s\S]*?<div class="([^"]*max-w-[^"]*)"/.exec(html);
+    assert.ok(m, 'RAM op modal not found');
+    assert.ok(m[1].includes('max-w-3xl'), 'the modal was widened to fit the step lines: ' + m[1]);
+});
diff --git a/frontend/tests/ram.test.js b/frontend/tests/ram.test.js
index f9b2155..912b110 100644
--- a/frontend/tests/ram.test.js
+++ b/frontend/tests/ram.test.js
@@ -374,12 +374,14 @@ test('ramGetStatusApdu builds the compact chain, never the expanded form', () =>
 test('ramStepLine shows the PoR verdict and the remote status word', () => {
 	globalThis.t = s => s;
 	globalThis.lookupSw = (a, b) => (a + b === '6700' ? 'Wrong length in Lc' : '');
+	// successful steps are compact: verdict symbol, remote SW (no name),
+	// size; the SMS count only for concatenated packets
 	const okLine = ramStepLine({ name: 'INSTALL [for load]', por_status: 'por_ok',
 		por_sw: '9000', sw: '9000', bytes: 50, segments: 1 }, 0);
-	assert.ok(okLine.startsWith('\u2705'), okLine);
-	assert.ok(okLine.includes('PoR ok'), okLine);
-	assert.ok(okLine.includes('remote SW 9000'), okLine);
-	assert.ok(okLine.includes('50 bytes / 1 SMS'), okLine);
+	assert.strictEqual(okLine, '\u2705 Step 1: INSTALL [for load] \u2014 9000 \u00b7 50 B');
+	const multi = ramStepLine({ name: 'LOAD (1/64)', por_status: 'por_ok',
+		por_sw: '6101', bytes: 274, segments: 3 }, 1);
+	assert.strictEqual(multi, '\u2705 Step 2: LOAD (1/64) \u2014 6101 \u00b7 274 B / 3 SMS');
 	const badLine = ramStepLine({ name: 'LOAD (1/9)', por_status: 'por_ok', por_sw: '6700',
 		por_error: 'remote SW 6700', sw: '9000', bytes: 274, segments: 3 }, 1);
 	assert.ok(badLine.startsWith('\u274c'), badLine);
diff --git a/pyproject.toml b/pyproject.toml
index e0a3591..08edf1c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pysim-simple-server"
-version = "3.6.46"
+version = "3.6.47"
 description = "HTTP REST server wrapping pysim for the SIMple PWA"
 requires-python = ">=3.8"
 # pysim is a git-only dependency installed explicitly by setup.bat/setup.sh.
diff --git a/pysim_simple_server/server.py b/pysim_simple_server/server.py
index 20b664e..d7646cb 100644
--- a/pysim_simple_server/server.py
+++ b/pysim_simple_server/server.py
@@ -31,7 +31,7 @@ from osmocom.tlv import BER_TLV_IE
 from osmocom.utils import rpad
 
 
-VERSION = '3.6.46'
+VERSION = '3.6.47'
 
 MAX_ENVELOPE_SEGMENTS = 5  # max SMS segments for outgoing C-APDU in ENVELOPE
 
@@ -4864,6 +4864,20 @@ _TEST_BLOCKED_PATHS = frozenset([
     '/api/scp81/gen-install', '/api/scp81/log-clear',
     '/api/bip/control', '/api/bip/log-clear',
 ])
+# GET endpoints that only read cached state (or the static file tree): served
+# without _CARD_LOCK so they stay answerable while a long card operation runs
+# (see do_GET).  Card-touching GETs are deliberately absent: /api/cardinfo
+# (runs cardinfo on the card) and /api/esim/* (ES10 selection + STORE DATA).
+_CARD_FREE_GET = frozenset([
+    '/api/status', '/api/test/status', '/api/version',
+    '/api/stk-status', '/api/poll-status', '/api/proactive-log',
+    '/api/menu', '/api/events', '/api/terminal-profile',
+    '/api/pli-qualifiers', '/api/pli-dict', '/api/commands',
+    '/api/net-state', '/api/mcc-mnc',
+    '/api/scp81/status', '/api/bip/status', '/api/scp81/script',
+    '/api/scp81/log', '/api/bip/log',
+])
+
 _TEST_COMMAND_TYPES = {name.upper(): code for code, name in PROACTIVE_TYPE_NAMES.items()}
 
 
@@ -5424,15 +5438,17 @@ class PysimHandler(BaseHTTPRequestHandler):
             self._send_json({'error': 'test script running - card commands are '
                                       'blocked until it finishes'}, 409)
             return
-        # /api/status and /api/test/status are pure cached state (no card I/O);
-        # keeping them out of the lock lets the UI report 'initializing' while a
-        # long equip (or a test script step) holds the card lock.  Result-shaping
-        # masks everything card-derived when the session is not connected.
-        # Static PWA files are card-free too: they must stay answerable while a
-        # long card operation holds the lock (the server is threaded, so this
-        # bypass is what actually serves the modal's progress poll and page
-        # assets during a RAM install).
-        if self.path in ('/api/status', '/api/test/status') or not self.path.startswith('/api/'):
+        # Pure cached state (no card I/O) is served without the lock: the UI
+        # must be able to report 'initializing' while a long equip (or a test
+        # script step) holds the card lock.  The list is deliberately wide:
+        # with a long RAM install the UI polls several of these every few
+        # seconds, and if they queued behind the install they would eat the
+        # browser's per-host connection budget - starving /api/status (the
+        # modal's progress bar froze around 70% and jumped to 100% at the end,
+        # live 2026-09-29).  Static PWA files are card-free too.  Card-touching
+        # GETs (cardinfo, esim/*) stay locked below.
+        path = self.path.split('?', 1)[0]
+        if path in _CARD_FREE_GET or not path.startswith('/api/'):
             self._do_GET()
             return
         # Serialize all card access: the background STATUS poll runs in its own
diff --git a/tests/test_fetch_routes.py b/tests/test_fetch_routes.py
index 6fcc9d9..817c809 100644
--- a/tests/test_fetch_routes.py
+++ b/tests/test_fetch_routes.py
@@ -18,7 +18,7 @@ import urllib.error
 import urllib.request
 
 from pysim_simple_server.__main__ import _build_http_server
-from pysim_simple_server.server import PysimHandler
+from pysim_simple_server.server import PysimHandler, _CARD_FREE_GET, _CARD_LOCK
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
 
@@ -109,3 +109,53 @@ class TestScriptHttpTests(unittest.TestCase):
 
 if __name__ == '__main__':
     unittest.main()
+
+
+class CardFreeGetTests(unittest.TestCase):
+    """Cached GETs must answer while the card lock is held.
+
+    During a long RAM install the UI polls several cached endpoints every few
+    seconds; while they queued behind the install they ate the browser's
+    per-host connection budget and starved /api/status - the modal's progress
+    bar froze around 70% and jumped to 100% at the end (live 2026-09-29).
+    """
+
+    def setUp(self):
+        self.server = _build_http_server('127.0.0.1', 0, PysimHandler)
+        self.server.log_requests = False
+        self.server.app = None
+        self.server.sl = None
+        self.server.scc = None
+        self.server.stk_pending = None
+        self.server.menu_active = False
+        self.server.sim_menu = None
+        self.server.event_list = None
+        self.server.terminal_profile = None
+        self.server.cli_terminal_profile = None
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.port = self.server.server_address[1]
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+
+    def _get(self, path, timeout=2):
+        return urllib.request.urlopen(
+            'http://127.0.0.1:%d%s' % (self.port, path), timeout=timeout)
+
+    def test_cached_endpoints_answer_while_the_card_lock_is_held(self):
+        with _CARD_LOCK:
+            for path in ('/api/status', '/api/stk-status', '/api/poll-status',
+                         '/api/proactive-log', '/api/menu', '/api/events'):
+                with self.subTest(path=path):
+                    with self._get(path) as res:
+                        self.assertEqual(res.status, 200)
+
+    def test_card_touching_gets_stay_locked(self):
+        # cardinfo runs a card command; the ES10 endpoints select/STORE DATA
+        for path in ('/api/cardinfo', '/api/esim/chip', '/api/esim/profiles'):
+            self.assertNotIn(path, _CARD_FREE_GET)
+
+
+if __name__ == '__main__':
+    unittest.main()