@augurworks/augur 0.15.1 → 0.15.3

package/scripts/read.mjs

@@ -4,8 +4,7 @@
 // refuses edits there. `augur close` inside it removes it. See docs/drafts-that-land.md §7.
 import path from "node:path";
 import { target } from "./lib/store.mjs";
-import { markPathFor } from "./lib/marks.mjs";
-import { unitClient, doRead, readDirFor } from "./lib/draft.mjs";
+import { unitClient, doRead, readDirFor, unitPathFor } from "./lib/draft.mjs";
 import { normUnit } from "../src/unit-core.mjs";
 
 const log = (m) => console.error(`\x1b[35m[read]\x1b[0m ${m}`);
@@ -15,7 +14,7 @@ const opt = (n) => { const i = argv.indexOf(n); return i > -1 ? argv[i + 1] : nu
 const positional = argv.filter((a, i) => !a.startsWith("--") && !(i > 0 && argv[i - 1].startsWith("--")));
 const raw = positional[0];
 if (!raw) die("name a prototype: `augur read <opportunity>/<prototype>`.");
-const unit = normUnit(markPathFor(raw) || raw);
+const unit = normUnit(unitPathFor(raw) || raw);
 if (!unit) die(`"${raw}" is not a prototype path.`);
 let origin, token;
 try { ({ origin, token } = target({ needToken: true })); } catch (e) { die(e.message); }

package/scripts/status.mjs

@@ -16,7 +16,6 @@ import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { resolveOrigin, resolveToken, apiClient, buildStamp, ENGINE_ROOT } from "./lib/store.mjs";
-import { fetchMarks, markLine } from "./lib/marks.mjs";
 import { registryList, unitClient, draftsReport } from "./lib/draft.mjs";
 
 const args = process.argv.slice(2);
@@ -123,28 +122,11 @@ console.log("");
 console.log(`  ${C.dim}engine chrome    ${eng.sha ? eng.sha.slice(0, 12) : "—"}` +
   `${eng.version ? ` (v${eng.version})` : ""}${eng.publishedAt ? `  ·  shipped ${eng.publishedAt}` : ""}${C.off}`);
 
-// ── who is working where, right now ─────────────────────────────────────────
-//
-// `F-presence-marks`. The three numbers above answer "is what I have what is live"; they
-// cannot answer "is somebody else in here", and that is the question that decides whether
-// the next hour of work is going to be merged or forked.
-//
-// NEEDS A TOKEN and does not ask for one. `status` has always been the command that runs
-// with nothing configured — the build stamp is public — so a missing credential quietly
-// costs the marks section and nothing else. It affects the exit code in no way: marks
-// refuse nothing, and a mark is not a problem.
-const markToken = resolveToken(origin);
-if (markToken) {
-  const marks = await fetchMarks(apiClient(origin, markToken));
-  if (marks.length) {
-    console.log("");
-    console.log(`  ${C.dim}being worked on right now${C.off}`);
-    for (const m of marks) console.log(`  ${C.dim}  ${markLine(m)}${C.off}`);
-  }
-} else {
-  // The one thing a fresh agent needs to know and has no other way to learn: this machine
-  // holds no token, and the way to get one is pairing, not a password. Same words as the
-  // instance's own /llms.txt. Costs nothing here — status never needed the token.
+// ── not paired? say how, once ───────────────────────────────────────────────
+// The one thing a fresh agent needs to know and has no other way to learn: this machine
+// holds no token, and the way to get one is pairing, not a password. Same words as the
+// instance's own /llms.txt. Costs nothing here — status never needed the token.
+if (!resolveToken(origin)) {
   console.log("");
   console.log(`  ${C.dim}not paired with ${origin}. Publishing from here needs a token; get one without a password:${C.off}`);
   console.log(`  ${C.dim}  augur connect --origin ${origin}   (the owner approves a code in a signed-in browser)${C.off}`);

package/seed/README.md

@@ -59,7 +59,7 @@ Three things are substituted on the way in:
 
 | What | Where | Substituted with |
 | --- | --- | --- |
-| The connect command | `CONNECT_COMMAND` in `start-here/prototypes/connect-your-terminal/index.html` | `npx augur connect --origin https://<label><suffix>`, the workspace's real address, filled the moment the page is published |
+| The connect command | `CONNECT_COMMAND` in `start-here/prototypes/connect-your-terminal/index.html` | `npx @augurworks/augur connect --origin https://<label><suffix>`, the workspace's real address, filled the moment the page is published |
 | Comment timestamps | `at` in `threads.json` | the provisioning time, so day-one threads do not read as months old |
 | File timestamps | `editedAt` on every file in the manifest | the same provisioning time, all of them |
 

package/seed/start-here/prototypes/connect-your-terminal/index.html

@@ -91,7 +91,7 @@
         <h2 class="s-h2">Run this where your agent runs</h2>
         <p class="s-prose">In the folder you want this workspace to live in, run:</p>
         <div class="s-cmd">
-          <code class="s-cmd__text" id="cmd-connect">npx augur connect your-workspace</code>
+          <code class="s-cmd__text" id="cmd-connect">npx @augurworks/augur connect your-workspace</code>
           <button type="button" class="s-cmd__btn" data-s-copy="#cmd-connect">Copy</button>
         </div>
         <p class="s-prose" style="margin-top: var(--starter-s4)">A browser tab opens and asks you to
@@ -105,7 +105,7 @@
           <div>
             <p class="ask__why">Paste this into your agent instead of running the command yourself.</p>
             <div class="s-cmd s-cmd--paste">
-              <code class="s-cmd__text s-cmd__text--plain" id="ask-agent">Run `npx augur connect your-workspace` in this folder. It will open a browser tab for me to approve — tell me when it is waiting, and tell me exactly what it prints when it finishes.</code>
+              <code class="s-cmd__text s-cmd__text--plain" id="ask-agent">Run `npx @augurworks/augur connect your-workspace` in this folder. It will open a browser tab for me to approve — tell me when it is waiting, and tell me exactly what it prints when it finishes.</code>
               <button type="button" class="s-cmd__btn" data-s-copy="#ask-agent">Copy</button>
             </div>
           </div>
@@ -311,7 +311,7 @@
               <p class="s-prose">Last one. Ask the agent to connect, in plain language — it runs the
                 command for you:</p>
               <div class="s-cmd s-cmd--paste">
-                <code class="s-cmd__text s-cmd__text--plain" id="ask-5-do">Run `npx augur connect your-workspace` in this folder. It will open a browser tab for me to approve — tell me when it is waiting, and tell me exactly what it prints when it finishes.</code>
+                <code class="s-cmd__text s-cmd__text--plain" id="ask-5-do">Run `npx @augurworks/augur connect your-workspace` in this folder. It will open a browser tab for me to approve — tell me when it is waiting, and tell me exactly what it prints when it finishes.</code>
                 <button type="button" class="s-cmd__btn" data-s-copy="#ask-5-do">Copy</button>
               </div>
               <p class="s-prose">Approve the tab that opens. The terminal now has a key of its own, so
@@ -369,7 +369,7 @@
     var host = location.hostname || "";
     var label = host.split(".")[0];
     var named = host.indexOf(".") > 0 && label && label !== "localhost" && !/^\d+$/.test(label);
-    return named ? "npx augur connect --origin https://" + host : "npx augur connect your-workspace";
+    return named ? "npx @augurworks/augur connect --origin https://" + host : "npx @augurworks/augur connect your-workspace";
   }
 
   var cmd = connectCommand();
@@ -377,7 +377,7 @@
   if (cmdEl) cmdEl.textContent = cmd;
   ["ask-agent", "ask-5-do"].forEach(function (id) {
     var el = document.getElementById(id);
-    if (el) el.textContent = el.textContent.replace(/npx augur connect [\w-]+/, cmd);
+    if (el) el.textContent = el.textContent.replace(/npx @augurworks/augur connect [\w-]+/, cmd);
   });
 
   /* ── Which path you are on ────────────────────────────────────────────────

package/src/_worker.js

@@ -5453,46 +5453,6 @@ async function publishApi(tctx, request, url, env) {
   const [spaceId, op, arg] = url.pathname.slice("/__publish/".length).split("/");
   if (!spaceId || !op || !/^[a-z0-9_][a-z0-9-]*$/.test(spaceId)) return jsonResponse({ error: "bad-path" }, 400);
 
-  // ── working marks (`F-presence-marks`) ─────────────────────────────────────
-  //
-  // AHEAD OF THE BUNDLE-STORE GUARD, deliberately: a mark is not published content and
-  // holds nothing the store knows about, so an instance serving from ASSETS — `augur dev`,
-  // `npm run offline`, a raw engine build — is exactly where two agents most need to stay
-  // out of each other's way, and 501 there would be an accident of where the check sits.
-  //
-  // ANY VALID PUBLISH TOKEN, whatever its scope. A mark names a path, not a space, and a
-  // space-scoped token holder is precisely the person whose work-start is worth announcing.
-  // The capability gate still applies, so a restricted credential (the control plane's
-  // purge token) reaches this no more than it reaches anything else.
-  if (spaceId === "_marks") {
-    const a = await publishAuthDetailed(tctx, request, env, spaceId, true);
-    if (!a.entry) return jsonResponse(publishRefusalBody(a.refusal), 403);
-    if (capabilityRefusal(a.entry, spaceId, op)) {
-      return jsonResponse({ error: "forbidden", reason: "capability-not-granted" }, 403);
-    }
-    // WHO, from the credential and never from the body. `augur login` labels a token with
-    // the holder's address; a token an admin minted by hand carries whatever they typed,
-    // which hashes to a stable id that resolves to no roster face — honest, and better
-    // than letting the caller name itself.
-    const who = { personId: personId(a.entry.label || "") };
-    if (op === "list" && request.method === "GET") {
-      return jsonResponse({ ...(await readMarks(tctx, env)), ttlMs: MARK_TTL_MS, maxTtlMs: MARK_TTL_MAX_MS });
-    }
-    let body = null;
-    if (request.method === "POST") {
-      try { body = await request.json(); } catch (e) { return jsonResponse({ error: "bad-json" }, 400); }
-    }
-    if (op === "set" && request.method === "POST") {
-      const out = await writeMark(tctx, env, who, { path: body && body.path, ttl: body && body.ttl });
-      return out.error ? jsonResponse(out, out.error === "bad-input" ? 400 : 503) : jsonResponse(out);
-    }
-    if (op === "clear" && request.method === "POST") {
-      const out = await clearMark(tctx, env, who, { path: body && body.path });
-      return out.error ? jsonResponse(out, out.error === "bad-input" ? 400 : 503) : jsonResponse(out);
-    }
-    return jsonResponse({ error: "unknown-op" }, 400);
-  }
-
   if (!env.BUNDLES) return jsonResponse({ error: "bundle-store-not-configured" }, 501);
   // This workspace's view of the store. `blobs/` is content-addressed and shared, so the
   // three `blobs/…` operations below deliberately keep using the binding directly — the
@@ -5975,7 +5935,7 @@ async function publishApi(tctx, request, url, env) {
         clientProtocol,
         minProtocol: tctx.MIN_CLIENT_PROTOCOL,
         protocol: PUBLISH_PROTOCOL,
-        upgrade: "npx augur@latest",
+        upgrade: "npx @augurworks/augur@latest",
       }, 426);
     }
     // Prune any publicPrefixes entry THIS manifest declares without backing it with
@@ -7949,16 +7909,6 @@ const OVERLAY_KV_KEYS = Object.freeze({
   boards: Object.freeze({ doc: "board", layout: "keyed", workspaceScoped: true }),
   // Canvas image METADATA — the bytes are in R2. See assetApi.
   assets: Object.freeze({ doc: "basset-meta", layout: "keyed" }),
-  // WORKING MARKS — "something is editing here right now". One row per path, and the row
-  // is only meaningful until its own TTL runs out. See the marks section below.
-  //
-  // `map` RATHER THAN `keyed`, and the trade is worth naming because it looks backwards.
-  // Keyed would give one KV document per path, so two marks written in the same window
-  // could not lose each other. It would also turn every READ into a kv.list plus a get per
-  // row — and marks are read by a gallery page as well as by the CLI, which puts a listing
-  // in front of ordinary page loads on a store whose daily get budget has been exhausted
-  // before. One document is one get. What it costs is stated on `writeMark`.
-  marks: Object.freeze({ doc: "marks", layout: "map" }),
   // WHICH UNITS HAVE OPEN DRAFTS — a hint the gallery reads so it can ask the right unit
   // objects and no others (`draftsIndexApi`). One row per unit, `{n, at}`, written from
   // the object's own presence answer after open, land and discard. NEVER THE TRUTH: the
@@ -9149,7 +9099,7 @@ function doorFacts(tctx, url, env) {
     origin: url.origin,
     engine: tctx.INSTANCE_ENGINE_VERSION ? { version: tctx.INSTANCE_ENGINE_VERSION } : {},
     pairing: { enabled: pairing, start: "/__publish/_pair/start", approve: "/__connect" },
-    connect: pairing ? `npx augur connect --origin ${url.origin}` : null,
+    connect: pairing ? `npx @augurworks/augur connect --origin ${url.origin}` : null,
     docs: DOOR_DOCS,
     // Where drafts are served, a prototype is changed by opening it, not by shipping a
     // tree — and the door is where a cold agent learns which of the two this instance is.
@@ -9169,11 +9119,9 @@ function doorText(f) {
       + `  ${f.connect}\n\n`
       + `It prints a link and a code. The owner of this workspace opens the link in a\n`
       + `browser they are already signed in to and enters the code. The token lands on\n`
-      + `that machine, and \`augur publish\` / \`augur ship\` use it from then on. With no\n`
-      + `source tree yet, \`npx augur clone --space ${f.workspace}\` then fetches one (it reads\n`
+      + `that machine, and every verb below uses it from then on. With no\n`
+      + `source tree yet, \`npx @augurworks/augur clone --space ${f.workspace}\` then fetches one (it reads\n`
       + `the origin from the pairing).\n\n`
-      + `Not on npm yet? The engine clone sits next to every workspace that publishes:\n\n`
-      + `  node <engine>/scripts/cli.mjs connect --origin ${f.origin}\n\n`
     : `Device pairing is switched off on this workspace. Ask an admin for an invite;\n`
       + `once you have signed in, \`augur login\` (email and password, meant for CI)\n`
       + `trades that for a publish token.\n\n`;
@@ -10335,235 +10283,6 @@ async function nameApi(tctx, request, url, env) {
   return jsonResponse({ error: "method-not-allowed" }, 405);
 }
 
-// ---- Working marks (KV-backed, single key) ----------------------------------
-//
-// `F-presence-marks`. Nothing anywhere said what was already being worked on. Two
-// collaborators' tools — usually two agents, on two machines, told to improve "the
-// checkout flow" — would each open the same folder, each edit it, and find out at publish
-// time, where the answer is a fork and a conflict file nobody asked for.
-//
-// ⚠️ THIS IS DELIBERATELY NOT A LOCK, and every line below is written so it cannot become
-// one. A mark REFUSES NOTHING. It is not consulted by the gate, by the publish handler, by
-// the commit CAS or by anything else that could say no. It is a note left where the next
-// reader will look, and the whole protocol is: write one before you start, read them
-// before you start. Enforcement when coordination fails is the composed publish's job
-// (`src/publish-compose.mjs`), which is the only place in this engine allowed to refuse a
-// write over a collision — and it does it on evidence, after the fact, never on a claim.
-//
-// THE PROTOCOL IS AGENT-FIRST. The badge a person sees on a gallery card is the byproduct,
-// not the point: as an agent's edit shrinks toward seconds, a mark is FELT almost never and
-// READ always. So the write side is the CLI (`augur mark`, over a publish token, see the
-// `_marks` branch in publishApi) and the browser side is read-only — a person editing in a
-// tab is not running a work-start step and inventing one for them would be a lie about who
-// wrote what.
-//
-// ⚠️ A MARK EXPIRES BY ITSELF AND IS NEVER TRUSTED TO BE CLEARED. The thing that leaves a
-// mark is a process that can be killed — Ctrl-C, an OOM, a laptop lid — and a claim that
-// outlives the claimant is worse than no claim at all, because the next reader believes it.
-// So EXPIRY IS A READ-TIME FILTER (`liveMarks`), not a cleanup job: the moment `startedAt +
-// ttl` is in the past the mark is gone from every answer, whether or not anything ever runs
-// again. `sweepExpired` below only reclaims the BYTES, opportunistically, and correctness
-// never depends on it having run.
-
-/** How long a mark is good for when the caller does not say. */
-const MARK_TTL_MS = 10 * 60_000;
-/**
- * The longest a caller may ask for. An agent that wants four hours is describing a lock,
- * and the answer to a lock is a shorter mark re-written as the work continues.
- */
-const MARK_TTL_MAX_MS = 60 * 60_000;
-/** The shortest, so a `--ttl 0` cannot write a mark that is already dead. */
-const MARK_TTL_MIN_MS = 5_000;
-/**
- * How many lapsed rows one write may reclaim. Bounded low because on the KV backing each
- * row delete is a whole-document read and put, so the sweep can cost more than the litter
- * it collects; an unbounded one would turn a work-start step into a hundred writes on a
- * workspace nobody has marked in a month. Nothing depends on it running at all.
- */
-const MARK_SWEEP_MAX = 4;
-/** Belt and braces: a workspace cannot be filled with marks by a loop. */
-const MARK_MAX_ROWS = 200;
-
-/**
- * One spelling of a path, so two tools that mean the same folder agree.
- *
- * Leading and trailing slash, always: a mark names a UNIT — the prototype folder a URL
- * names and a person edits — and `unitOfPath` in src/publish-units.mjs decides containment
- * by prefix, which only works when a folder ends in a slash. `/a/b` and `/a/bc/` would
- * otherwise overlap.
- */
-function normalizeMarkPath(p) {
-  const s = clamp(p, 300);
-  if (!s) return "";
-  const trimmed = s.trim().replace(/^\.\//, "").replace(/\/{2,}/g, "/");
-  if (!trimmed || trimmed === "/") return "/";
-  return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}/`;
-}
-
-/**
- * Do these two paths describe overlapping work? Containment in either direction — a mark
- * on `/checkout/` covers `/checkout/step-two/`, and a mark on `/checkout/step-two/` is
- * worth showing to somebody about to take `/checkout/`.
- */
-function markPathsOverlap(a, b) {
-  const x = normalizeMarkPath(a), y = normalizeMarkPath(b);
-  if (!x || !y) return false;
-  return x === y || x.startsWith(y) || y.startsWith(x);
-}
-
-/** The instant a mark stops meaning anything. Pure, and the only definition of expiry. */
-function markExpiresAt(m) {
-  const started = Date.parse((m && m.startedAt) || "");
-  if (!Number.isFinite(started)) return 0;
-  const ttl = Number.isFinite(+(m && m.ttl)) ? +m.ttl : MARK_TTL_MS;
-  return started + Math.min(Math.max(ttl, MARK_TTL_MIN_MS), MARK_TTL_MAX_MS);
-}
-
-/**
- * The live marks in a stored map, newest first. THE expiry rule — every reader goes
- * through here, so a lapsed mark cannot be reported by one surface and hidden by another.
- */
-function liveMarks(map, now = Date.now()) {
-  return Object.entries(map || {})
-    .map(([path, m]) => (m && typeof m === "object" ? { ...m, path: m.path || path } : null))
-    .filter((m) => m && markExpiresAt(m) > now)
-    .sort((a, b) => Date.parse(b.startedAt || 0) - Date.parse(a.startedAt || 0));
-}
-
-/**
- * What a mark looks like on the wire: the stored row plus two things a reader would
- * otherwise have to compute, and one it could not — the display name behind the id.
- *
- * The NAME IS RESOLVED, NEVER STORED. `personId` is the same one-way hash a comment
- * carries, so a mark holds no address; the roster turns it back into a face at read time,
- * which also means a rename shows through and an ex-member resolves to nobody.
- */
-function decorateMark(m, users, now = Date.now()) {
-  const u = (users || []).find((x) => x && personId(x.email) === m.personId);
-  return {
-    path: m.path,
-    personId: m.personId || null,
-    startedAt: m.startedAt,
-    ttl: markExpiresAt(m) - Date.parse(m.startedAt),
-    by: u ? u.name || nameFromEmail(u.email) : null,
-    initials: u ? u.initials || initialsFor(u.name || u.email) : null,
-    color: u ? u.color || null : null,
-    expiresIn: Math.max(0, markExpiresAt(m) - now),
-  };
-}
-
-/** Read the live marks for a workspace, decorated. `null` store answers with nothing. */
-async function readMarks(tctx, env) {
-  const store = overlayFor(env, tctx);
-  if (!store) return { marks: [], warning: "no-kv-binding" };
-  const map = await store.read("marks");
-  const now = Date.now();
-  return { marks: liveMarks(map, now).map((m) => decorateMark(m, tctx.USERS, now)), now };
-}
-
-/**
- * Reclaim the bytes of rows that lapsed. NOT the expiry mechanism — `liveMarks` already
- * stopped reporting these, and this runs only so a one-way author id does not sit in the
- * store for months after it stopped meaning anything. Per-key deletes, never a whole-family
- * `replace`: a replace computed from a read taken moments ago would drop a mark another
- * agent wrote in between, and on the workspace object it would delete rows it never read.
- *
- * It swallows its own failures on purpose. Reclaiming bytes may never be the reason a
- * work-start step reports a failure, because the mark it was announcing is already written.
- */
-async function sweepExpired(store, map, now, keep) {
-  let swept = 0;
-  for (const [path, m] of Object.entries(map || {})) {
-    if (swept >= MARK_SWEEP_MAX) break;
-    if (path === keep) continue;
-    if (markExpiresAt(m) > now) continue;
-    try { await store.set("marks", "", path, null); swept++; } catch (e) { break; }
-  }
-  return swept;
-}
-
-/**
- * Write one mark. `who` is resolved by the caller from a credential — a session or a
- * publish token — and NEVER from the request body, exactly like a comment's authorship.
- *
- * ⚠️ ON THE KV BACKING TWO MARKS WRITTEN IN THE SAME WINDOW CAN LOSE EACH OTHER, and that
- * is a known cost rather than an oversight. A `map` family is one document: `set` reads it,
- * changes one key and puts it back, so a mark written between the read and the put is
- * overwritten — and KV reads converge globally rather than instantly, which makes the
- * window as wide as the convergence, not as wide as the round trip. The overlay's own
- * header says the same thing about statuses, names and pins; the workspace object closes
- * it for all of them at once by making each key a row.
- *
- * WHY IT IS SURVIVABLE HERE AND WOULD NOT BE IN A LOCK. A lost mark costs the next reader
- * a hint. It cannot cost anybody work, because nothing anywhere asks a mark for permission:
- * the loser of the race is still editing, still publishing, and still protected by the
- * composed publish, which settles a real collision on evidence. A lock that lost a write
- * would hand two writers the same exclusive claim, which is why this is not one.
- */
-async function writeMark(tctx, env, who, { path, ttl }) {
-  const store = overlayFor(env, tctx);
-  if (!store) return { error: "no-kv-binding" };
-  const p = normalizeMarkPath(path);
-  if (!p) return { error: "bad-input" };
-  const ms = Number.isFinite(+ttl) && +ttl > 0
-    ? Math.min(Math.max(+ttl, MARK_TTL_MIN_MS), MARK_TTL_MAX_MS)
-    : MARK_TTL_MS;
-  const now = Date.now();
-  const before = await store.read("marks");
-  // The only refusal on this route, and it is a runaway-loop guard rather than a policy:
-  // this many things being worked on at once in one workspace is a script, not a team.
-  const live = liveMarks(before, now);
-  if (live.length >= MARK_MAX_ROWS && !live.some((m) => m.path === p)) {
-    return { error: "too-many-marks" };
-  }
-  // ⚠️ THE ROW CARRIES NO ADDRESS — not in the value and not in the `owner` column. A mark
-  // is read by more things than a comment thread is (a gallery page stamps a badge from
-  // it), and `personId` is exactly enough to put a face on it.
-  const mark = { path: p, personId: who.personId, startedAt: new Date(now).toISOString(), ttl: ms };
-  await store.set("marks", "", p, mark, null);
-  const swept = await sweepExpired(store, before, now, p);
-  // The answer is COMPUTED from what was just written, never re-read. A second read costs
-  // a round trip to say what this function already knows, and on KV it can come back
-  // STALER than the write it was meant to confirm — a work-start step that printed "your
-  // mark is not there" right after writing it would teach people to distrust the tool.
-  const marks = [mark, ...live.filter((m) => m.path !== p)];
-  return {
-    mark: decorateMark(mark, tctx.USERS, now),
-    marks: marks.map((m) => decorateMark(m, tctx.USERS, now)),
-    swept,
-  };
-}
-
-/**
- * Release a mark early. A COURTESY, never the guarantee — the TTL is the guarantee, and a
- * tool that is killed never reaches this. Only the mark's own author may clear it: taking
- * somebody else's mark down would turn the note into something worth fighting over.
- */
-async function clearMark(tctx, env, who, { path }) {
-  const store = overlayFor(env, tctx);
-  if (!store) return { error: "no-kv-binding" };
-  const p = normalizeMarkPath(path);
-  if (!p) return { error: "bad-input" };
-  const map = await store.read("marks");
-  const cur = (map || {})[p];
-  const now = Date.now();
-  if (!cur || markExpiresAt(cur) <= now) return { cleared: false, reason: "no-mark" };
-  if (cur.personId !== who.personId) return { cleared: false, reason: "not-yours" };
-  await store.set("marks", "", p, null);
-  const marks = liveMarks(map, now).filter((m) => m.path !== p);
-  return { cleared: true, marks: marks.map((m) => decorateMark(m, tctx.USERS, now)) };
-}
-
-/**
- * The browser's read. GET only, on purpose — see the header: the badge is the byproduct of
- * an agent protocol, and a tab is not a work-start step.
- */
-async function marksApi(tctx, request, url, env) {
-  if (request.method !== "GET") return jsonResponse({ error: "method-not-allowed" }, 405);
-  const out = await readMarks(tctx, env);
-  return jsonResponse({ ...out, ttlMs: MARK_TTL_MS });
-}
-
 // ---- Prototype deletion (repo-write via dispatch webhook) -------------------
 // "Delete forever" on a prototype card. The worker holds NO repo credentials —
 // it forwards the request to a per-instance webhook (a GitHub repository_dispatch
@@ -12413,13 +12132,6 @@ async function handleRequest(request, env, ctx, url, trace) {
       if (!authed) return jsonResponse({ error: "unauthorized" }, 401);
       return pinsApi(tctx, request, url, env, me);
     }
-    // Working marks — READ ONLY here. Who is working where is workspace-internal, so it
-    // asks for a session like the gallery around it; the WRITE side is a publish token and
-    // lives under /__publish/_marks, because a work-start step is something a tool runs.
-    if (url.pathname === "/__marks") {
-      if (!authed) return jsonResponse({ error: "unauthorized" }, 401);
-      return marksApi(tctx, request, url, env);
-    }
     if (url.pathname === "/__name") {
       if (!authed) return jsonResponse({ error: "unauthorized" }, 401);
       const denied = viewerWriteRefusal(request, url, me, "name", tctx.SPACES);
@@ -12625,9 +12337,6 @@ export const __testables = Object.freeze({
   nextPublishVersion, overlayFor, overlayKvKey, statusApi, nameApi, pinsApi,
   currencyApi, currencyRows, freshness, whenWords, parseSince, unitKey, unitProvenance,
   STALE_AFTER_DAYS, STATUS_LABELS, VALID_STATUS,
-  marksApi, readMarks, writeMark, clearMark, liveMarks, markExpiresAt, decorateMark,
-  normalizeMarkPath, markPathsOverlap, sweepExpired,
-  MARK_TTL_MS, MARK_TTL_MAX_MS, MARK_TTL_MIN_MS, MARK_SWEEP_MAX, MARK_MAX_ROWS,
   exportState, importState,
   quotaBump, quotaMinute, quotaDay, workspaceStatus, touchWorkspaceActivity,
   deleteWorkspace, purgeDue, blobGc, clearFamilies, NEVER_CLEARED,

package/src/seed-pack.mjs

@@ -44,7 +44,7 @@
 //
 // ONE SUBSTITUTION. connect-your-terminal ships with an empty `CONNECT_COMMAND` slot and
 // derives a command from the URL it is served on. Provisioning fills the slot with the
-// workspace's REAL command — `npx augur connect --origin https://<label><suffix>` — so the
+// workspace's REAL command — `npx @augurworks/augur connect --origin https://<label><suffix>` — so the
 // page is exact rather than merely not wrong. The filled page hashes differently, so it is
 // the one blob that is per-workspace rather than shared; everything else dedups.
 
@@ -60,7 +60,7 @@ export const SEED_CONNECT_SLOT = 'var CONNECT_COMMAND = "";';
 /** The one-line command a person runs to pair a terminal with their workspace. */
 export function connectCommandFor(origin) {
   const o = String(origin || "").replace(/\/+$/, "");
-  return o ? `npx augur connect --origin ${o}` : "";
+  return o ? `npx @augurworks/augur connect --origin ${o}` : "";
 }
 
 /**

package/src/state-inventory.mjs

@@ -123,10 +123,6 @@ export const STATE_INVENTORY = Object.freeze([
     id: "board:", store: "kv", kind: "prefix", to: "workspace",
     why: "A canvas board document, spelled `board:<path>` or `board:<workspace>:<path>` where the deployment serves its own rooms (src/board-key.mjs). Same table. NOTE this is a MIRROR: while the realtime worker is separate, the authoritative copy is that worker's own BoardRoom storage, and a DO's storage belongs to the script that created it — so a board carried by an export is carried as of the last mirror write, which lags the room and can lag it by a great deal more than the write cadence alone. What travels the whole board is `scripts/board-snapshot.mjs`, which reads the room over a WebSocket join and seeds the new one; run it per board AFTER a move, and take its lag report rather than a clock as the sign that a board is quiet enough to have been copied correctly.",
   },
-  {
-    id: "marks", store: "kv", kind: "key", to: "drop",
-    why: "Working marks: one row per path saying something is editing there right now, holding the path, the one-way author id and the time, and good only until its own TTL runs out (ten minutes by default, an hour at the most). Transient by construction — a mark is not a promise to anybody, it grants nothing and refuses nothing, and the next work-start recreates it. DROPPED rather than carried, for the same reason `health:report` is: a mark restored onto a new home would say somebody is working somewhere at a moment that has passed, and a false claim is worse than a missing one. Nothing is lost: the marks a copy would have carried are all expired by the time anybody reads the copy.",
-  },
   {
     id: "drafts", store: "kv", kind: "key", to: "drop",
     why: "The open-drafts hint: one row per unit saying how many drafts its object reports open, written after open, land and discard so the gallery knows which unit objects to ask (`draftsIndexApi` in src/_worker.js) and asks no others. Transient by construction and recreated by the next open, land or discard on that unit; never the truth — every read re-checks the object and drops a row it contradicts. DROPPED on a copy because the unit objects it points at do not travel (see `/__unit/`), so a carried row would name drafts the destination cannot serve; the first open on the new home writes a true one.",

package/agents/working-marks.md

@@ -1,86 +0,0 @@
-# Working marks — say what you are about to touch, read what everyone else is
-
-Nothing in a workspace used to say what was already being worked on. Two people's
-agents, on two machines, both told to improve "the checkout flow", would each open
-the same folder, each edit it, and find out at publish time — where the answer is a
-fork, a conflict file and an afternoon nobody planned.
-
-A **mark** is a note on a path saying *something is editing here right now*. It
-carries the path, a one-way id for who left it, when it started, and how long it is
-good for. That is all it is.
-
-Where the workspace serves drafts, a draft IS the mark: `augur open` tells you who else
-has the prototype open and shows you on their chips, with nothing to leave and nothing to
-expire — see [drafts.md](./drafts.md). Marks stay for workspaces without drafts.
-
-## ⚠️ It is not a lock, and you must not treat it as one
-
-A mark **grants nothing and refuses nothing**. A marked path can still be opened,
-edited, published and shipped by anybody, including you. Nothing in the engine asks
-a mark for permission — not the gate, not the publish handler, not the commit.
-`augur mark` exits 0 whatever it finds.
-
-So do not write a script that blocks on a mark, retries until one clears, or treats
-one as a failure. When coordination genuinely fails, the composed publish settles it
-on evidence after the fact (see [publishing.md](./publishing.md)) — that is the part
-that is allowed to refuse, and it is the only part.
-
-## The protocol, in one line
-
-**Read the marks before you start. Leave one when you do.**
-
-```
-augur mark                              what is being worked on right now
-augur mark <path> [--ttl <seconds>]     leave a mark on it, then start
-augur mark <path> --clear               take yours down early
-augur mark … --json                     the same answer, for a tool to read
-```
-
-A path is a URL path (`/checkout/flow/`). The repo folder is accepted and
-translated, so `checkout/prototypes/flow` — the folder you were just editing —
-marks the URL it publishes to. The line printed back is always the instance's own
-spelling; do not assume yours won.
-
-Marking a path that somebody else already marked **still works**, and prints their
-mark next to yours. That is the whole design: you now know, and you choose. Pick a
-different path, wait it out, or carry on knowing you will be merging.
-
-## It expires by itself
-
-A mark is good for ten minutes by default and an hour at the most. The instance
-stops reporting it the moment that passes, whether or not anything ever clears it.
-
-That is the point rather than a detail. The thing leaving marks is a process that
-can be killed — an interrupt, an out-of-memory, a closed laptop — and a claim that
-outlives the claimant is worse than no claim at all, because the next reader
-believes it. **`--clear` is a courtesy, never the guarantee.** There is no cleanup
-job to run and none to forget.
-
-If the work is genuinely still going when the mark lapses, mark it again. An agent
-that wants a four-hour mark is describing a lock, and the answer to a lock is a
-short mark re-written as the work continues.
-
-## Where marks show up without being asked for
-
-- `augur status` prints what is being worked on, under the live-vs-clone table.
-- `augur clone` and `augur pull` print the marks on the paths they are about to
-  write, before the first byte lands — and write anyway, with the same exit code
-  as always.
-- A gallery card carries a small badge (*"… is working on this"*) while a mark on
-  that exact URL is live, and drops it when the mark lapses.
-
-The badge is the **byproduct**, not the point. As an agent's edit shrinks toward
-seconds, a mark is felt almost never and read always — which is why the write side
-is the CLI and the browser side only ever reads.
-
-## What is stored
-
-`{path, personId, startedAt, ttl}` — and `personId` is the same one-way fingerprint
-a comment carries, so a mark holds **no address**. The display name beside it is
-resolved from the roster at read time, never stored, so a rename shows through and
-somebody who has left resolves to "Someone".
-
-Marks are workspace state, not published content: they are covered by
-`augur export --full`, and a restore deliberately drops them (see
-`src/state-inventory.mjs`) rather than reinstating a claim about a moment that has
-passed.