nook: add /agents, /changelog and /faq

Three organic surfaces, each answering an objection at the moment it
bites. /agents lists all twelve agents with each hook's exact event
surface (mirrors AgentSpec.all + hook/setup.go + the plugins) and what
a card can do — allow/deny or observe. /changelog renders the appcast
HTML the Sparkle updater already publishes, so release notes have one
source of truth. /faq answers privacy (scoped honestly: no prompt or
code content leaves the device), the notch question, battery,
permissions, the macOS 14 floor and offline use — no refund question,
per decision: the trial is the answer. Nav gains the three links.

Tests: appcast parser suite (5 tests) covers CDATA, escaped HTML,
Version-prefix titles and garbage input.

Issues: FRE-12, FRE-13, FRE-14

src/routes/api/the-nook/_appcast.ts

@@ -0,0 +1,114 @@
+import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
+import { env } from "~/env/server";
+
+/**
+ * Appcast reading for The Nook, shared by the download resolver and the
+ * /changelog page. The same route-module tree-shake rule applies as in
+ * `_download.ts`: helpers live in an underscore-prefixed module because
+ * route files may only export HTTP handlers.
+ */
+
+const APPCAST_KEY = "api/TheNook/appcast.xml";
+
+/** Kept in step with the appcast route's own 5-minute cache. */
+const TTL_MS = 5 * 60 * 1000;
+
+export interface AppcastRelease {
+  /** Human version, e.g. "1.2.0" — from sparkle:shortVersionString. */
+  version: string;
+  /** Build number from sparkle:version, when present. */
+  build: string | null;
+  /** Release date as published (already human-formatted in the appcast). */
+  date: string | null;
+  /** HTML release notes exactly as the Sparkle updater receives them. */
+  notesHtml: string;
+}
+
+function extract(tag: string, xml: string): string | null {
+  const match = xml.match(
+    new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, "i")
+  );
+  return match?.[1]?.trim() ?? null;
+}
+
+function decodeCdata(value: string): string {
+  const cdata = value.match(/^<!\[CDATA\[([\s\S]*)\]\]>$/);
+  const inner = (cdata ? cdata[1] : value).trim();
+  if (cdata) return inner;
+  // Non-CDATA text is XML-escaped; descriptions arrive as escaped HTML.
+  return inner
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, "&");
+}
+
+/** Strips the conventional "Version " prefix from an appcast item title. */
+function versionFromTitle(title: string): string {
+  return title.replace(/^version\s+/i, "");
+}
+
+/**
+ * Parses a Sparkle appcast into release entries, newest first (the appcast's
+ * own order). Empty or unparseable input yields an empty list — the page
+ * renders its empty state rather than an error.
+ */
+export function parseAppcastItems(xml: string): AppcastRelease[] {
+  const releases: AppcastRelease[] = [];
+  for (const match of xml.matchAll(/<item\b[^>]*>([\s\S]*?)<\/item>/gi)) {
+    const item = match[1];
+    if (!item) continue;
+    const short = decodeCdata(extract("sparkle:shortVersionString", item) ?? "");
+    const title = versionFromTitle(decodeCdata(extract("title", item) ?? ""));
+    const version = short || title;
+    if (!version) continue;
+    releases.push({
+      version,
+      build: decodeCdata(extract("sparkle:version", item) ?? "") || null,
+      date: decodeCdata(extract("pubDate", item) ?? "") || null,
+      notesHtml: decodeCdata(extract("description", item) ?? "")
+    });
+  }
+  return releases;
+}
+
+let cached: { xml: string; at: number } | null = null;
+
+/** Drops the cached appcast so the next read hits S3 again. */
+export function invalidateAppcastCache(): void {
+  cached = null;
+}
+
+/** Reads (and briefly caches) the raw appcast XML from the download bucket. */
+export async function fetchAppcastXml(): Promise<string | null> {
+  if (cached && Date.now() - cached.at < TTL_MS) {
+    return cached.xml;
+  }
+
+  const client = new S3Client({
+    region: env.AWS_REGION,
+    credentials: {
+      accessKeyId: env.MY_AWS_ACCESS_KEY,
+      secretAccessKey: env.MY_AWS_SECRET_KEY
+    }
+  });
+
+  const response = await client.send(
+    new GetObjectCommand({
+      Bucket: env.VITE_DOWNLOAD_BUCKET_STRING,
+      Key: APPCAST_KEY
+    })
+  );
+  if (!response.Body) return null;
+
+  const xml = await response.Body.transformToString();
+  cached = { xml, at: Date.now() };
+  return xml;
+}
+
+/** The releases behind /changelog, or an empty list when the appcast is unreadable. */
+export async function fetchAppcastReleases(): Promise<AppcastRelease[]> {
+  const xml = await fetchAppcastXml();
+  return xml ? parseAppcastItems(xml) : [];
+}

src/routes/api/the-nook/appcast.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "bun:test";
+import { parseAppcastItems } from "./_appcast";
+
+// The /changelog page renders exactly what the Sparkle updater receives, so
+// the parser's contract is the appcast's contract: newest-first items, a
+// shortVersionString title with the raw <title> as fallback, CDATA and
+// plain-encoded descriptions both accepted, garbage in → empty list out.
+
+const item = (over: Record<string, string>) => `
+  <item>
+    <title>Version ${over.title ?? "1.0.0"}</title>
+    ${over.short ? `<sparkle:shortVersionString>${over.short}</sparkle:shortVersionString>` : ""}
+    ${over.build ? `<sparkle:version>${over.build}</sparkle:version>` : ""}
+    ${over.date ? `<pubDate>${over.date}</pubDate>` : ""}
+    ${over.desc ?? `<description><![CDATA[<ul><li>Fixes</li></ul>]]></description>`}
+    <enclosure url="https://example.com/Nook-1.0.0.dmg" type="application/x-apple-diskimage"/>
+  </item>`;
+
+describe("parseAppcastItems", () => {
+  it("parses newest-first items with version, build, date and CDATA notes", () => {
+    const xml = `<rss><channel>
+      ${item({ title: "1.2.0", short: "1.2.0", build: "42", date: "Sat, 03 Oct 2026 12:00:00 +0000" })}
+      ${item({ title: "1.1.0", short: "1.1.0", build: "41", date: "Fri, 02 Oct 2026 12:00:00 +0000" })}
+    </channel></rss>`;
+
+    const releases = parseAppcastItems(xml);
+    expect(releases.length).toBe(2);
+    expect(releases[0].version).toBe("1.2.0");
+    expect(releases[0].build).toBe("42");
+    expect(releases[0].date).toContain("03 Oct 2026");
+    expect(releases[0].notesHtml).toBe("<ul><li>Fixes</li></ul>");
+    expect(releases[1].version).toBe("1.1.0");
+  });
+
+  it("falls back to the plain title when shortVersionString is absent", () => {
+    const xml = `<rss><channel>${item({ title: "1.0.0" })}</channel></rss>`;
+    const releases = parseAppcastItems(xml);
+    expect(releases[0].version).toBe("1.0.0");
+    expect(releases[0].build).toBeNull();
+  });
+
+  it("accepts non-CDATA escaped-HTML descriptions", () => {
+    const xml = `<rss><channel>
+      ${item({ desc: "<description>&lt;p&gt;Hello&lt;/p&gt;</description>" })}
+    </channel></rss>`;
+    expect(parseAppcastItems(xml)[0].notesHtml).toBe("<p>Hello</p>");
+  });
+
+  it("returns [] for empty, non-XML, or item-less input", () => {
+    expect(parseAppcastItems("")).toEqual([]);
+    expect(parseAppcastItems("<html>not an appcast</html>")).toEqual([]);
+    expect(parseAppcastItems("<rss><channel></channel></rss>")).toEqual([]);
+  });
+
+  it("skips items with no version signal at all", () => {
+    const xml = `<rss><channel>
+      <item><description><![CDATA[<p>orphan</p>]]></description></item>
+      ${item({ title: "1.0.0" })}
+    </channel></rss>`;
+    const releases = parseAppcastItems(xml);
+    expect(releases.length).toBe(1);
+    expect(releases[0].version).toBe("1.0.0");
+  });
+});