@bastani/atomic 0.9.39-alpha.2 → 0.9.40-alpha.1

package/dist/builtin/workflows/skills/impeccable/reference/onboard.md

@@ -23,7 +23,7 @@ Understand what users need to learn and why:
    - What's the key action we want them to take? (First project? First invite?)
    - How do we know onboarding worked? (Completion rate? Time to value?)
 
-**CRITICAL**: Onboarding should get users to value as quickly as possible, not teach everything possible.
+Onboarding should get users to value as quickly as possible, not teach everything possible.
 
 ## Onboarding Principles
 
@@ -208,9 +208,9 @@ localStorage.setItem('onboarding-completed', 'true');
 localStorage.setItem('feature-tooltip-seen-reports', 'true');
 ```
 
-**IMPORTANT**: Don't show same onboarding twice (annoying). Track completion and respect dismissals.
+Show onboarding once: track completion and respect dismissals.
 
-**NEVER**:
+**Avoid**:
 - Force users through long onboarding before they can use product
 - Patronize users with obvious explanations
 - Show same tooltip repeatedly (respect dismissals)

package/dist/builtin/workflows/skills/impeccable/reference/optimize.md

@@ -17,7 +17,7 @@ Understand current performance and identify problems:
    - How bad is it? (Perceivable? Annoying? Blocking?)
    - Who's affected? (All users? Mobile only? Slow connections?)
 
-**CRITICAL**: Measure before and after. Premature optimization wastes time. Optimize what actually matters.
+Measure before and after. Optimizing without a measurement spends effort on things that do not matter.
 
 ## Optimization Strategy
 
@@ -233,9 +233,9 @@ const observer = new IntersectionObserver((entries) => {
 - Bundle size
 - Request count
 
-**IMPORTANT**: Measure on real devices with real network conditions. Desktop Chrome with fast connection isn't representative.
+Measure on real devices with real network conditions. Desktop Chrome on a fast connection isn't representative.
 
-**NEVER**:
+**Avoid**:
 - Optimize without measuring (premature optimization)
 - Sacrifice accessibility for performance
 - Break functionality while optimizing

package/dist/builtin/workflows/skills/impeccable/reference/overdrive.md

@@ -7,7 +7,7 @@ Start your response with:
 
 Push an interface past conventional limits. This isn't just about visual effects. It's about using the full power of the browser to make any part of an interface feel extraordinary: a table that handles a million rows, a dialog that morphs from its trigger, a form that validates in real-time with streaming feedback, a page transition that feels cinematic.
 
-**EXTRA IMPORTANT FOR THIS COMMAND**: Context determines what "extraordinary" means. A particle system on a creative portfolio is impressive. The same particle system on a settings page is embarrassing. But a settings page with instant optimistic saves and animated state transitions? That's extraordinary too. Understand the project's personality and goals before deciding what's appropriate.
+Context decides what "extraordinary" means. A particle system on a creative portfolio is impressive. The same particle system on a settings page is embarrassing. But a settings page with instant optimistic saves and animated state transitions? That's extraordinary too. Understand the project's personality and goals before deciding what's appropriate.
 
 ### Propose Before Building
 
@@ -19,9 +19,9 @@ This command has the highest potential to misfire. Do NOT jump straight into imp
 
 Skipping this step risks building something embarrassing that needs to be thrown away.
 
-### Iterate with Browser Automation
+### Verify in the Browser
 
-Technically ambitious effects almost never work on the first try. You MUST actively use browser automation tools to preview your work, visually verify the result, and iterate. Do not assume the effect looks right, check it. Expect multiple rounds of refinement. The gap between "technically works" and "looks extraordinary" is closed through visual iteration, not code alone.
+Ambitious effects rarely work on the first try, so verify them in the browser rather than from code: an effect that technically runs can still stutter, ease wrong, or land on the wrong frame. Aim the checks at timing, easing, and smoothness, batch the fixes between looks, and keep refining until the effect is extraordinary.
 
 ---
 

package/dist/builtin/workflows/skills/impeccable/reference/quieter.md

@@ -30,7 +30,7 @@ Analyze what makes the design feel too intense:
 
 If any of these are unclear from the codebase, do not guess. Ask the user directly to clarify what you cannot infer.
 
-**CRITICAL**: "Quieter" doesn't mean boring or generic. It means refined and easier on the eyes. Think luxury, not laziness.
+"Quieter" means refined and easier on the eyes, not generic. Generic quiet looks like gray text on white, one sans at a uniform weight, and a grid of identical cards; restraint still needs a point of view.
 
 ## Plan Refinement
 
@@ -41,7 +41,7 @@ Create a strategy to reduce intensity while maintaining impact:
 - **Simplification approach**: What can be removed entirely?
 - **Sophistication approach**: How can we signal quality through restraint?
 
-**IMPORTANT**: Subtlety requires precision. Quiet without intent collapses to generic.
+Subtlety requires precision. Quiet without intent collapses to generic.
 
 ## Refine the Design
 
@@ -80,7 +80,7 @@ Systematically reduce intensity across these dimensions:
 - **Align to grid**: Bring rogue elements back into systematic alignment
 - **Even out spacing**: Replace extreme spacing variations with consistent rhythm
 
-**NEVER**:
+**Avoid**:
 - Make everything the same size/weight (hierarchy still matters)
 - Remove all color (quiet ≠ grayscale)
 - Eliminate all personality (maintain character through refinement)

package/dist/builtin/workflows/skills/impeccable/reference/typeset.md

@@ -56,6 +56,16 @@ Use the fewest roles and families that make the hierarchy unmistakable. Combine
 
 Do not make type decorative at the expense of comprehension, or introduce a second family without a clear role it alone can perform.
 
+## Line breaks
+
+After Matthew Butterick's *Practical Typography*, paraphrased; where his numbers differ from these, these stand.
+
+- Set `text-wrap: balance` on headings and short centered blocks, and `text-wrap: pretty` on body copy. Both are progressive: a browser that ignores them keeps its default wrap.
+- `pretty` pulls a word down beside a lone last word. It does not fill the last line, and a two-word tail is fine.
+- In a column too narrow for either to help, edit the copy or widen the column.
+- Break a heading by hand only between phrases, and check the break at every width the heading renders at. A hard break that lands mid-line on a phone is worse than the default wrap.
+- An uneven break can carry meaning: a headline that lands on one word for weight, a poster line, a pull quote. Make it deliberate with a hard break or a wrap set on that element, and keep it rare. The detector's `straggler` and `unbalanced-heading` findings are advisory for this reason; say which breaks are intended.
+
 ## Verify
 
 - Primary, secondary, body, and metadata roles are recognizable without reading the copy.

package/dist/builtin/workflows/skills/impeccable/reference/visualize.md

@@ -6,7 +6,7 @@ A probe tests composition, narrative, hierarchy, density, focal moment, signatur
 
 ## Generate three compositional options
 
-The comp round runs inside the build's phase state: `impeccable build-phase start --direction <seed key>` has already run (with `--decision-comp <path>` when the chosen card has a decision comp) and its `comps` phase is open before the first comp is generated; a comp rendered before that sits outside the state, and a session resumed from that point has no phases to follow. `impeccable generate-image` refuses to write under `.impeccable/mocks/` until start has run; a harness-native image tool is bound by the same order.
+The comp round runs inside the build's phase state: `impeccable build-phase start --direction <seed reference>` has already run (with `--decision-comp <path>` when the chosen card has a decision comp) and its `comps` phase is open before the first comp is generated; a comp rendered before that sits outside the state, and a session resumed from that point has no phases to follow. `impeccable generate-image` refuses to write under `.impeccable/mocks/` until start has run; a harness-native image tool is bound by the same order.
 
 Render three distinct high-fidelity north-star comps of the requested surface, saved under `.impeccable/mocks/` so they survive the session. When the chosen card has a decision comp, it is option one: it stays at its path under `.impeccable/mocks/decision/`, where the gate counts it through `--decision-comp`, and is never regenerated; render the other two. Comp at the surface's own viewport: portrait at device size for a native app or mobile-first surface, desktop landscape otherwise; a phone screen comped landscape misstates the composition before anything is built against it. Comps are the build thread's own work, never delegated: the thread that writes the prompts holds the direction's full context and has seen every comp when the build starts. Open every image by its workspace-relative path; sandboxed viewers reject absolute paths, and everything under the project root has a relative one. Base the comps on real content and the surface concepts already developed with the user. On an established world, anchor every comp on the real identity: capture a screenshot of a representative existing page and pass it as a reference image (the harness image tool's input image, or `impeccable generate-image --ref`); the prompt leads with the new surface's structure while the reference carries palette, type, and component character, because DESIGN.md words alone drift where a pixel reference does not. Name what the reference contributes and what it must not: chrome, palette, type, and component character carry over; the reference page's own content does not, and a banner, hero, or card lifted verbatim is the reference leaking, not fidelity. Three is the number: one comp invites rubber-stamping; the spread between three surfaces the composition worth building. The chosen card's decision comp is the first of the three: it already renders this direction at full fidelity under this discipline, so generate two more that vary what the first held fixed, from the direction in words rather than with the first comp as an input image (a reference image anchors the layout, and three comps collapse into one composition). How comps two and three vary from the first is the mode's call, in its COMPS rules. A variant that simplifies the first into a tidier version of itself adds no choice to the round. Send all three to the approval point together. Only a round arriving with no decision comp (a degraded roll, an identity-mode page, a direction pinned without the decision round) renders all three here.
 

package/dist/builtin/workflows/skills/impeccable/scripts/VERSION

@@ -1 +1 @@
-0.1.14
+0.1.16

package/dist/builtin/workflows/skills/impeccable/scripts/impeccable

@@ -130,6 +130,12 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
   [ "$os" = windows ] && asset="$asset.exe"
   url="$base/engine-v$version/$asset"
   tmp="$cache_root/bin/$version/.impeccable.part.$$"
+  # An interrupted download (Ctrl-C, a hook timeout) would otherwise leave the
+  # PID-named staging file behind for good. The handlers must exit explicitly.
+  cleanup() { rm -f "$tmp" "$tmp.sha256" 2>/dev/null || :; }
+  trap 'cleanup; exit 129' HUP
+  trap 'cleanup; exit 130' INT
+  trap 'cleanup; exit 143' TERM
   if ! mkdir -p "$cache_root/bin/$version" 2>/dev/null; then
     echo "impeccable: engine $version is not installed; cannot create cache directory: $cache_root/bin/$version" >&2
     setup_help

package/dist/builtin/workflows/skills/impeccable/scripts/impeccable.cmd

@@ -78,20 +78,37 @@ if exist "%IMPECCABLE_HOME%\bin\%version%\" goto cache_ready
 mkdir "%IMPECCABLE_HOME%\bin\%version%" >nul 2>nul
 if errorlevel 1 goto cache_directory_failed
 :cache_ready
-rem Check the staging file too: an existing directory may be read-only.
+rem Stage the download in a directory only this run owns, as the sh launcher
+rem does with .impeccable.part.$$: concurrent first runs (parallel hooks, two
+rem agents) must never write, hash or move each other's files. mkdir fails
+rem when the name exists, so it claims the name atomically. RANDOM alone is
+rem not enough because cmd seeds it from the clock in whole seconds; the
+rem timestamp and the retry on collision keep same-second runs apart. A cache
+rem directory that refuses every mkdir is reported as unwritable.
+set "attempt=0"
+:claim_staging
+set /a attempt+=1
+if %attempt% GTR 20 goto cache_write_failed
+set "stamp=%TIME: =0%"
+set "stamp=%stamp::=%"
+set "stamp=%stamp:.=%"
+set "stamp=%stamp:,=%"
+set "staging=%IMPECCABLE_HOME%\bin\%version%\.impeccable.part.%stamp%-%RANDOM%%RANDOM%"
+mkdir "%staging%" >nul 2>nul
+if errorlevel 1 goto claim_staging
+set "part=%staging%\impeccable.exe"
+set "sidecar=%staging%\impeccable.sha256"
 rem Redirection failures do not reliably update ERRORLEVEL in cmd.exe;
-rem branch on the command's failure directly. Never treat a directory as a
-rem staging file (later del cleanup would prompt to delete its contents).
-if exist "%cached%.part\" goto cache_write_failed
-(type nul >"%cached%.part") 2>nul || goto cache_write_failed
+rem branch on the command's failure directly.
+(type nul >"%part%") 2>nul || goto staging_write_failed
 set "asset=impeccable-windows-%arch%.exe"
 set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
-curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
 if not errorlevel 1 goto verify
 if not "%arch%"=="arm64" goto download_failed
 set "asset=impeccable-windows-x64.exe"
 set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
-curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
 if errorlevel 1 goto download_failed
 
 :verify
@@ -101,61 +118,67 @@ rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
 rem runs only after verifying against its .sha256 sidecar. A sidecar that
 rem cannot be fetched, or an empty certutil result, refuses the download
 rem instead of running an unverified binary.
-curl.exe -fsSL -o "%cached%.sha256" "%url%.sha256" >nul 2>nul
+curl.exe -fsSL -o "%sidecar%" "%url%.sha256" >nul 2>nul
 if errorlevel 1 goto verify_refuse
 set "expected="
-set /p expected=<"%cached%.sha256"
+set /p expected=<"%sidecar%"
 for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
 call :check_download
 if errorlevel 1 exit /b 127
 set "actual="
 rem Reuse the sidecar staging file after reading expected. Check certutil's
 rem status before parsing: its error text on stdout is not a digest.
-certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
+certutil -hashfile "%part%" SHA256 >"%sidecar%" 2>nul
 if errorlevel 1 goto verify_refuse
 call :check_download
 if errorlevel 1 exit /b 127
-for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
-del "%cached%.sha256" >nul 2>nul
+for /f "usebackq skip=1 delims=" %%h in ("%sidecar%") do if not defined actual set "actual=%%h"
+del "%sidecar%" >nul 2>nul
 if not defined expected goto verify_refuse
 if not defined actual goto verify_refuse
 set "actual=%actual: =%"
 if /I "%actual%"=="%expected%" goto place
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: checksum mismatch downloading %url% 1>&2
 exit /b 127
 
 :verify_refuse
 call :check_download
 if errorlevel 1 exit /b 127
-del "%cached%.part" >nul 2>nul
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
 exit /b 127
 
 :check_download
 set "download_file=%~1"
-if not defined download_file set "download_file=%cached%.part"
+if not defined download_file set "download_file=%part%"
 if not exist "%download_file%" goto download_missing
 for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
 exit /b 0
 
 :download_missing
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
 exit /b 127
 
 :download_empty
 del "%download_file%" >nul 2>nul
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
 exit /b 127
 
+:discard_staging
+rem Removes this run's staging directory and whatever is left in it. Never
+rem touches another run's staging directory or the cached binary.
+if defined staging rd /s /q "%staging%" >nul 2>nul
+exit /b 0
+
 :place
 call :check_download
 if errorlevel 1 exit /b 127
-move /y "%cached%.part" "%cached%" >nul 2>nul
+move /y "%part%" "%cached%" >nul 2>nul
 if errorlevel 1 goto place_failed
+call :discard_staging
 call :check_download "%cached%"
 if errorlevel 1 exit /b 127
 set "run=%cached%"
@@ -164,7 +187,7 @@ goto run
 :place_failed
 call :check_download
 if errorlevel 1 exit /b 127
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: could not cache the verified download: %url% 1>&2
 exit /b 127
 
@@ -193,6 +216,9 @@ exit /b 0
 echo impeccable: engine %version% is not installed; cannot create cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
 goto setup_failed
 
+:staging_write_failed
+call :discard_staging
+
 :cache_write_failed
 echo impeccable: engine %version% is not installed; cannot write to cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
 goto setup_failed
@@ -202,7 +228,7 @@ echo impeccable: cannot download engine %version%; curl.exe is unavailable. 1>&2
 goto setup_failed
 
 :download_failed
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: could not download engine %version% from %url%; check network access and the release URL. 1>&2
 
 :setup_failed
@@ -212,7 +238,6 @@ echo Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCA
 exit /b 127
 
 :fail
-del "%cached%.part" >nul 2>nul
 echo impeccable: no engine binary found (looked in %bin%, %cached%, PATH). 1>&2
 echo Download impeccable-windows-%arch%.exe from https://github.com/pbakaus/impeccable/releases (tag engine-v%version%) and save it as %cached%, or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style 1>&2
 exit /b 127

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser-dom.js

@@ -85,7 +85,10 @@
     }
 
     function id8() {
-      if (crypto?.randomUUID) return crypto.randomUUID().replace(/-/g, '').slice(0, 8);
+      // randomUUID is secure-context only (issue #1055); getRandomValues is not.
+      try {
+        if (typeof crypto?.randomUUID === 'function') return crypto.randomUUID().replace(/-/g, '').slice(0, 8);
+      } catch { /* fall through */ }
       // Insecure-context fallback (plain-http LAN preview): still draw from the
       // CSPRNG. Math.random here was flagged by CodeQL (js/insecure-randomness)
       // because these ids name live-edit sessions.
@@ -200,6 +203,35 @@
       return el;
     }
 
+    // Copy text through a selected textarea and execCommand, for origins where
+    // navigator.clipboard is missing or refused (plain HTTP, issue #1055).
+    // The textarea mounts like any page-level chrome, so while a modal
+    // <dialog> is open it sits in that dialog's top-layer host: on <body> it
+    // would be inert, and inert text cannot be selected or copied.
+    function copyTextViaSelection(text) {
+      let ta = null;
+      const previous = activeElementDeep();
+      try {
+        ta = doc.createElement('textarea');
+        ta.id = prefix + '-clipboard';
+        ta.value = text;
+        ta.setAttribute('readonly', '');
+        ta.setAttribute('aria-hidden', 'true');
+        ta.tabIndex = -1;
+        ta.style.cssText = 'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;';
+        uiAppendToPage(ta);
+        ta.select();
+        return doc.execCommand('copy');
+      } catch {
+        return false;
+      } finally {
+        ta?.remove();
+        if (previous && previous !== activeElementDeep() && typeof previous.focus === 'function') {
+          try { previous.focus({ preventScroll: true }); } catch { /* best effort */ }
+        }
+      }
+    }
+
     function uiAppend(el) {
       const uiRoot = liveUiRoot();
       if (uiRoot === doc.body) return uiAppendToPage(el);
@@ -267,6 +299,7 @@
       liveUiRoot,
       uiAppend,
       uiAppendToPage,
+      copyTextViaSelection,
       topLayerHost,
       watchModalDialogs,
       cloneWithoutChrome,

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser-session.js

@@ -8,6 +8,30 @@
 (function (root) {
   'use strict';
 
+  // crypto.randomUUID() exists only in secure contexts (HTTPS, localhost), so a
+  // dev site on a LAN IP, a Tailscale address, or a custom hostname over plain
+  // HTTP has no randomUUID at all (issue #1055). getRandomValues() is available
+  // in every context, so the fallback still draws from the CSPRNG: the upstream
+  // Math.random last resort is the insecure-randomness class CodeQL flagged in
+  // the id8 helper, and these ids name live-edit sessions.
+  function randomUUID(cryptoImpl) {
+    const c = cryptoImpl === undefined ? root.crypto : cryptoImpl;
+    try {
+      if (c && typeof c.randomUUID === 'function') return c.randomUUID();
+    } catch { /* fall through to getRandomValues */ }
+    const bytes = new Uint8Array(16);
+    (c || crypto).getRandomValues(bytes);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return hex.slice(0, 8) + '-' + hex.slice(8, 12) + '-' + hex.slice(12, 16)
+      + '-' + hex.slice(16, 20) + '-' + hex.slice(20);
+  }
+
+  function randomId8(cryptoImpl) {
+    return randomUUID(cryptoImpl).replace(/-/g, '').slice(0, 8);
+  }
+
   function createLiveBrowserSessionState({ prefix, storage, idFactory }) {
     if (!prefix) throw new Error('prefix required');
     const store = storage || root.localStorage;
@@ -150,5 +174,5 @@
     };
   }
 
-  root.__IMPECCABLE_LIVE_SESSION__ = { createLiveBrowserSessionState };
+  root.__IMPECCABLE_LIVE_SESSION__ = { createLiveBrowserSessionState, randomUUID, randomId8 };
 })(typeof window !== 'undefined' ? window : globalThis);

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser.js

@@ -61,11 +61,19 @@
   const IMPECCABLE_COMMAND = (window.__IMPECCABLE_COMMAND_PREFIX__ || '/') + 'impeccable';
   const PICK_CURSOR_STYLE_ID = PREFIX + '-pick-cursor-style';
   const MANUAL_APPLY_STATE_TTL_MS = 15 * 60 * 1000;
-  const sessionState = window.__IMPECCABLE_LIVE_SESSION__?.createLiveBrowserSessionState({
-    prefix: PREFIX,
-    storage: localStorage,
-    idFactory: () => crypto.randomUUID().replace(/-/g, '').slice(0, 8),
-  });
+  // No idFactory: the session helper's default works on plain-HTTP origins,
+  // where the secure-context-only randomUUID does not exist (issue #1055).
+  let sessionState = null;
+  try {
+    sessionState = window.__IMPECCABLE_LIVE_SESSION__?.createLiveBrowserSessionState({
+      prefix: PREFIX,
+      storage: localStorage,
+    });
+  } catch (err) {
+    console.error('[impeccable] Live mode could not create its session state.', err);
+    window.__IMPECCABLE_LIVE_INIT__ = false; // let a later injection retry
+    return;
+  }
   if (!sessionState) {
     console.error('[impeccable] live-browser-session.js was not loaded. Live mode cannot start safely.');
     window.__IMPECCABLE_LIVE_INIT__ = false;
@@ -293,6 +301,7 @@
     liveUiRoot,
     uiAppend,
     uiAppendToPage,
+    copyTextViaSelection,
     topLayerHost,
     watchModalDialogs,
     cloneWithoutChrome,
@@ -7120,6 +7129,10 @@
   //
 
   function startScrollTracking() {
+    // Idempotent: callers overlap (showBar starts tracking, then the agent
+    // pick path starts it again), and a second loop would never be cancelled
+    // because scrollRaf only remembers the latest one (#1002).
+    stopScrollTracking();
     function tick() {
       if (state === 'CONFIGURING' || state === 'GENERATING' || state === 'CYCLING') {
         if (isInsertGeneratingSession()) ensureInsertPlaceholder();
@@ -13461,12 +13474,24 @@ void main() {
       .replace(/'/g, ''');
   }
 
+  // navigator.clipboard exists only in secure contexts, and writeText can
+  // reject even where it exists (no focus, permission). Fall back
+  // to the DOM helpers' selection copy (execCommand), which plain-HTTP origins
+  // still allow and which stays usable under an open modal dialog.
   function copyToClipboard(text) {
     if (!text) return;
+    const report = (ok) => showToast(ok ? 'Copied: ' + text : 'Could not copy: ' + text);
+    let pending = null;
     try {
-      navigator.clipboard.writeText(text);
-      showToast('Copied: ' + text);
-    } catch { /* ignore */ }
+      if (navigator.clipboard && typeof navigator.clipboard.writeText === 'function') {
+        pending = navigator.clipboard.writeText(text);
+      }
+    } catch { pending = null; }
+    if (pending && typeof pending.then === 'function') {
+      pending.then(() => report(true), () => report(copyTextViaSelection(text)));
+      return;
+    }
+    report(copyTextViaSelection(text));
   }
 
   //

package/dist/builtin/workflows/src/durable/journal/resolution.d.ts

@@ -7,13 +7,13 @@ export interface RunJournalSettings {
     };
     storage?: StorageSettingsSelection;
 }
-export declare function selectRunJournal(options?: {
+export interface RunJournalResolutionOptions {
     journal?: RunJournalOption;
     settings?: RunJournalSettings;
-}): StorageSelection | RunJournal;
-export declare function resolveRunJournal(options?: {
-    journal?: RunJournalOption;
-    settings?: RunJournalSettings;
-}): Promise<RunJournal>;
-export declare function openSelectedRunJournal(selection: StorageSelection | RunJournal): Promise<RunJournal>;
+    /** The agent directory the owning session resolved its storage against; defaults to `getAgentDir()`. */
+    agentDir?: string;
+}
+export declare function selectRunJournal(options?: RunJournalResolutionOptions): StorageSelection | RunJournal;
+export declare function resolveRunJournal(options?: RunJournalResolutionOptions): Promise<RunJournal>;
+export declare function openSelectedRunJournal(selection: StorageSelection | RunJournal, agentDir?: string): Promise<RunJournal>;
 export declare function withRunJournalConfigSource<T>(selection: StorageSelection | RunJournal, open: () => Promise<T>): Promise<T>;