@ashlr/hub 3.5.1 → 3.8.0

package/CHANGELOG.md

@@ -339,6 +339,171 @@ superseded, not a setup procedure. Use [runtime activation authority](docs/RUNTI
 and the [current architecture boundary](docs/ARCHITECTURE.md#legacy-fleet-activation-boundary).
 Neither the historical record nor a successful test activates a resident fleet.
 
+## [3.8.0] — 2026-09-23 UTC — local-only actually prevents spend
+
+Two gates that make a promise the UI was already making. Both landed after the
+3.7.0 tag, so 3.7.0 shipped with local-only leaking in two places.
+
+### The Verse chat gate
+
+The Local-only panel said *"Nothing can spend money while this is on"* and
+*"cloud engines are unreachable"*. That was **false for Verse chat sessions**:
+`session-engine.ts` spawned the seat CLI with raw `child_process.spawn` and
+imported nothing from `policy/`, so an interactive Claude, Codex or Grok turn
+still ran and still spent.
+
+The daemon path was gated at seven chokepoints, and a structural test enumerated
+them — which is exactly why this survived. The test listed every chokepoint
+except this one, so the gap looked audited. Verse is now chokepoint 13, with a
+test asserting the gate sits inside `startTurn` *before* the `spawn(`.
+
+### Locality is not the same claim as spend
+
+`local-only.ts` answered one question — local or cloud — that was used to decide
+two: where inference runs, and whether something can bill you. Its purpose is the
+second. For every subject except CLI agents the answers coincide. For `ashlrcode`
+they did not: it is a local **process** whose inference is cloud by default, and
+`sandboxed-engine.ts` hands every cli-agent spawn `CLAUDE_CODE_OAUTH_TOKEN` /
+`ANTHROPIC_AUTH_TOKEN` plus the config dirs where subscription auth lives.
+
+Measured before the change: `enginePermitted('ashlrcode')`, `binPermitted('ac')`
+and `binPermitted('aw')` all **permitted** under local-only, and
+`estCostUsd('ashlrcode', 1M, 1M)` was **$18**.
+
+`Meteredness = 'free' | 'metered' | 'unknown'` now sits beside `EngineLocality`,
+which is unchanged — local-fleet membership, pool tiering and local-context
+injection all legitimately want "runs on this machine". **Local-only refuses
+anything not provably free, including `unknown`**: a spend policy cannot treat
+"I can't tell" as safe, which is how this survived. `estCostUsd` keys on
+meteredness, never locality, and does not report $0 for a metered agent — zero
+would be worse than wrong, because a wrong number invites scrutiny and a zero
+ends it.
+
+`ashlrcode` is `metered` by decision: its repo has not moved in three months and
+Qwen3.8 now drives the local lane, so refusing it under local-only costs nothing.
+`aw` is `unknown` rather than `metered` — its cloud fallback is opt-in, but that
+opt-in lives in aw's own config which the hub never reads, and asserting
+otherwise would be the same error mirrored.
+
+Three assertions in `local-only-policy.test.ts` had been **defending the bug** as
+expected behaviour. They were green on master.
+
+### Known residual
+
+`forceLocalOnly` — the autonomy director's cost-*pressure* switch — is a
+different mechanism from `cfg.foundry.localOnly` and still allows `ashlrcode`.
+Closing it is a decision about what the director should do when it is trying to
+save money rather than forbid spending it. See `docs/LOCALITY-VS-SPEND.md`.
+
+## [3.7.0] — 2026-09-23 UTC — The console you can actually navigate, and a fleet that can be bounded
+
+### Verse
+
+- **The rail expands** (⌘\), with labels and ⌘-digits. Hover used to show the
+  *native browser tooltip* — unstyled, mouse-only, clipping against the sidebar.
+  There is now a real portalled Tooltip primitive, and adopting it fixed a live
+  accessibility defect: `aria-describedby` sat on a wrapper rather than the
+  focusable child, so nothing was ever announced. A **disabled** trigger emits no
+  pointer events, so its tooltip could never open — precisely the tooltip that
+  matters, since it explains why the control is disabled.
+- **The header earns its height.** It held one toggle floating at the right edge
+  with nothing anchoring the left, because the sidebar toggle only rendered while
+  the sidebar was collapsed.
+- **Display size** — Default / Large / Extra large, scaling type *and* spacing as
+  a multiplier rather than a second table of literals, because density and scale
+  have identical CSS specificity and two literal tables would let file order
+  decide what "Compact + Large" means. Rail width and strip height are pinned so
+  the traffic-light clearance cannot regress.
+- **Pane resizing** that survives a real drag: widths are a desired/effective
+  pair, so a wide sidebar narrows on a small window and springs back. It also
+  turned out the resize handle was eating 4px of the macOS window drag strip.
+- **Saved projects and a native folder picker**, and the MCP section is mounted.
+
+### Autonomy
+
+- **A bounded run window** — until paused, at a wall-clock time, or after N
+  iterations. The window is an absolute instant, never a countdown, so a host
+  suspended at 01:00 and opened at 09:00 finds its 07:00 window expired.
+- **The post-merge halt.** The pre-merge gate was already strict; *nothing re-ran
+  the suite after a merge*, so a regression merged at 01:00 compounded all night.
+  A dirty working tree halts too, as **unprovable** rather than *regressed* — a
+  run that measured uncommitted edits has proven nothing. Ignored files are not
+  dirt, or it would halt every night.
+
+### Corrections
+
+- A test guard was red, and a red guard protects nothing. The Anthropic shim is a
+  request normaliser, not a transport — its one `/chat/completions` is in a doc
+  comment recording a measurement.
+- `VerseApp.test.tsx` had been passing by luck of file ordering; the first test to
+  mount the shell paid ChatSection's cold transform cost inside its own 1000ms
+  assertion window.
+
+## [3.6.0] — 2026-09-23 UTC — Open any project, from a real picker
+
+Verse could already drive any folder on the machine — the API accepted an
+unenrolled path and both Grok and local seats ran in it. What it could not do was
+let you *choose* one. The only way in was typing an absolute path into a text
+box, and a folder you typed vanished from the list until a chat existed on it.
+This release is the door.
+
+### Any folder, from a native chooser
+
+- **A real macOS directory picker.** "Choose folder…" opens `NSOpenPanel`
+  through the Tauri dialog plugin. Detection is a call-time feature probe of the
+  injected shell global, not a build flag, because the same bundle is served
+  inside the desktop app and as a plain web UI — in a browser the button is
+  absent and the absolute-path input remains, which is never removed.
+- **Saved projects the console can actually create.** `createVerseWorkspace`,
+  `updateVerseWorkspace`, `deleteVerseWorkspace`, `setVerseRootPriority` and
+  `setVerseFocusSection` all existed with **zero callers**, so
+  `~/.ashlr/verse/workspaces.json` could only be written by hand. There is now a
+  Projects section in the sidebar: save, rename, add and remove folders, reorder
+  (the first folder is the primary — its directory is the chat's working
+  directory), and forget behind a two-step confirm that states existing chats
+  are untouched.
+- **Interactive and autonomous stay separate registries.** Saving a folder to
+  work in never enrols it for unattended work. A saved project can be *offered*
+  to the autonomous lane, but only by ticking that box.
+- **The Grok caveat travels with a saved project.** Grok takes no extra roots,
+  so a multi-root project picked with a Grok seat now says its extra folders are
+  unreachable. That case previously had no warning at all.
+
+### The MCP section exists again
+
+`McpSection.tsx` was complete — query layer, tested contract, complete server
+side — and unreachable: absent from `VERSE_SECTIONS`, no `'mcp'` member on
+`VerseSectionId`, and outside the glob that mounts sections. It is now ⌘6.
+⌘1–⌘5 keep their meanings.
+
+It also discloses a footgun nothing named before: Codex and Grok inherit MCP
+from their native profile config, so a turn on an unenrolled folder can reach an
+`ashlr__*` write tool and be refused by the enrollment gate — the turn fails on
+policy, not on the model. Claude and local seats are unaffected, because the
+adapter passes an empty `--mcp-config` under `--strict-mcp-config`.
+
+### One capability was widened, deliberately
+
+`dialog:allow-open` is granted to the remote Verse origin in
+`capabilities/verse-remote.json`, whose note said not to widen the list. It is
+the narrowest dialog permission: it shows a chooser the user must confirm and
+returns a path, reads no file contents, and no `fs:*` permission is granted
+anywhere in the app. `allow-save`, `allow-message`, `allow-ask` and
+`allow-confirm` stay ungranted so page code cannot forge a native prompt.
+
+It had to go in that file rather than `main.json`: the Verse window loads a
+remote origin, and a Tauri 2 capability without a `remote` block never reaches
+one — the grant would have looked correct in review and failed silently at
+runtime.
+
+### Verified in the built app, not only in tests
+
+The picker was driven end to end in a real build: the button renders inside the
+shell, `NSOpenPanel` opens, the chosen path lands in the field, "Start chat"
+enables, "Save as a project" persists and appears in the sidebar, and forget
+removes it. Separately, `POST /api/verse/workspaces` was confirmed against a
+live server to create a record on disk and list it back.
+
 ## [3.5.1] — 2026-09-23 UTC — The dependency backlog, landed rather than deferred
 
 Four dependency PRs had been sitting open. None was a version bump; each needed

package/README.md

@@ -7,6 +7,9 @@
 **[verse.ashlr.ai](https://verse.ashlr.ai)** — Ashlr Verse, the operator console: every account you own
 behind one surface, plus a local model that keeps working after the quota runs out.
 
+
+![Ashlr Verse — the operator console: an expandable section rail, a project sidebar, and every connected account with its live usage windows](docs/images/verse-console.png)
+
 [![npm](https://img.shields.io/npm/v/@ashlr/hub.svg?logo=npm&label=%40ashlr%2Fhub&color=cb3837)](https://www.npmjs.com/package/@ashlr/hub)
 [![npm downloads](https://img.shields.io/npm/dm/@ashlr/hub.svg?color=cb3837)](https://www.npmjs.com/package/@ashlr/hub)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)

package/dist/build-identity.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "3.5.1",
-  "revision": "5bbb2454b7238f8db83acc7b7b8b9635bd89d2da",
+  "packageVersion": "3.8.0",
+  "revision": "a3a44cbbc5599bdb369c3cba1d7fcd53a45fa854",
   "dirty": false,
   "provenance": "git"
 }

package/dist/cli/activation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `ashlr activation` — operator authority for the autonomous fleet (M470).
+ *
+ * The daemon, goal/simple conductors, and resident-service install are all
+ * held shut by hard-coded denials until an operator EXPLICITLY grants
+ * authority here. Doing nothing keeps today's exact behavior: everything
+ * denied. This command group is how an operator opts in, on their own
+ * terms, with a real signed/expiring/revocable authorization trail.
+ *
+ * Subcommands:
+ *   activation init [--label <text>] [--force] [--yes] [--json]
+ *       Generate an Ed25519 keypair on this machine (private key never
+ *       leaves it) and register the public half as a trust root. Grants
+ *       NOTHING by itself — run `activation grant` next.
+ *   activation status [--json]
+ *       Trust roots, pending one-shot permit, standing grants, and what is
+ *       currently authorized, right now, and why.
+ *   activation grant <scope...> [--ttl <duration>] [--yes] [--json]
+ *       Mint a scoped, signed, expiring authorization. `once`/`resident`
+ *       mint a single-use permit for `ashlr daemon start`, good for a fixed
+ *       2-minute window; any of `residentStanding`/`conductor`/`automerge`/
+ *       `repair`/`deploy`/`install`/`proposalOnly` mint a standing grant
+ *       checked on every use until it expires (30d cap) or is revoked.
+ *       `residentStanding` is what lets a resident daemon started by
+ *       launchd/systemd/Task Scheduler after a reboot authorize itself with
+ *       no operator present — grant it once, ahead of time, alongside
+ *       whichever of `automerge`/`repair`/`deploy` the resident loop should
+ *       also carry for its whole run.
+ *   activation revoke --root <keyId> | --grant <grantId> [--yes] [--json]
+ *       Immediately invalidate a trust root or a standing grant.
+ *
+ * Every subcommand supports --help. Mutating subcommands (init/grant/revoke)
+ * refuse to run unattended in a non-TTY session without --yes — the same
+ * confirm-gate convention as `ashlr inbox approve`.
+ */
+/**
+ * `ashlr activation [init|status|grant|revoke] [flags]`
+ *
+ * Returns a process exit code (0 = success, non-zero = error/usage).
+ */
+export declare function cmdActivation(args: string[]): Promise<number>;