@bensandee/tooling 0.72.1 → 0.72.3

package/README.md

@@ -475,10 +475,10 @@ env:
 
 Debug output is prefixed with `[debug]` and includes exec results (exit codes, stdout/stderr), compose configuration details, container health statuses, and retry attempts.
 
-## The agent daemon's web control panel
+## The agent's web control panel
 
-`agent:daemon --ui` serves an opt-in board that renders the `agent/<stage>[-<status>]` label state
-machine, shows the daemon's own live state, and lets you drive the transitions you would otherwise
+`agent:start --ui` serves an opt-in board that renders the `agent/<stage>[-<status>]` label state
+machine, shows the agent's own live state, and lets you drive the transitions you would otherwise
 apply by hand with `bst issue:set-labels` -- plus read a branch's plan and reply on its pull request
 without leaving the page. It is off by default.
 
@@ -487,13 +487,13 @@ The problem it solves is that a parked terminal is silent: `agent/plan-ready`,
 has stopped and is waiting on a person, and nothing announces them. The board's lanes are ordered by
 what needs you, not by pipeline position.
 
-It also closes a real gap: **the board can kill a wedged run on a headless daemon.** The interactive
+It also closes a real gap: **the board can kill a wedged run on a headless agent.** The interactive
 `k` keypress needs a TTY, so under systemd there was previously no way to stop a stuck container
 short of a hand-run `docker kill`.
 
 ```bash
 # Loopback, port 4600, token minted at startup and logged once.
-bst agent:daemon --ui
+bst agent:start --ui
 ```
 
 The startup log carries one clickable line -- open it and the token is exchanged for a session
@@ -511,7 +511,7 @@ terminator, so nothing is listening on your LAN at all and no phone is asked to
 certificate:
 
 ```bash
-bst agent:daemon --ui \
+bst agent:start --ui \
   --ui-public-url https://box.tail1234.ts.net \
   --ui-behind-tls
 
@@ -525,7 +525,7 @@ tailscale serve --bg 4600
   `Host: box.tail1234.ts.net`, not `127.0.0.1:4600`, so without it **every** proxied request is
   rejected with a bare `403`. It is also what makes the startup line print the URL you can actually
   open.
-- `--ui-behind-tls` marks the session cookie `Secure`. It has to be explicit: the daemon serves plain
+- `--ui-behind-tls` marks the session cookie `Secure`. It has to be explicit: the agent serves plain
   HTTP and cannot see that something in front terminated TLS, and `X-Forwarded-Proto` is
   attacker-supplied unless a trusted proxy is guaranteed -- which nothing here can guarantee.
 
@@ -541,14 +541,14 @@ There is exactly one credential to be careful with, and its lifetime is the part
 
 |           | Board token                                                       | Session cookie it mints |
 | --------- | ----------------------------------------------------------------- | ----------------------- |
-| Lifetime  | the daemon **process** -- a service, so weeks                     | 12 hours                |
+| Lifetime  | the agent **process** -- a service, so weeks                     | 12 hours                |
 | Scope     | label transitions + comments + kill, every repo the bot can write | the board, nothing else |
 | Holders   | one, shared                                                       | one browser             |
 | Persisted | never                                                             | never                   |
 
-The board token gates reaching the board at all, and everything it grants happens under the daemon's
+The board token gates reaching the board at all, and everything it grants happens under the agent's
 bot token. It is "short-lived" only relative to a config file; against the process it gates it is
-long-lived, and rotating it means restarting the daemon -- at which point a phone bookmark goes dead
+long-lived, and rotating it means restarting the agent -- at which point a phone bookmark goes dead
 and you return to the log for a fresh link. That is the accepted cost of never persisting it.
 
 Session cookies are `HttpOnly`, `SameSite=Strict`, and expire after 12 hours. Every request is
@@ -556,7 +556,7 @@ checked against a Host-header allowlist **and** an `Origin` check; neither repla
 because an `Origin` check alone does not defeat DNS rebinding.
 
 There is no second forge credential. **Everything the board writes -- labels and comments alike --
-is written under the daemon's own bot token**, so there is no operator PAT to mint and no account to
+is written under the agent's own bot token**, so there is no operator PAT to mint and no account to
 connect. What that costs is authorship, and the next section is about why paying it is safe.
 
 ### Reading a plan, and replying to one
@@ -574,12 +574,12 @@ can push to it, and the board will not render it.
 to every later run rather than windowed). Posting takes the same two-step confirm as kill, because
 the forge has no comment-edit API and nothing you post can be retracted from here.
 
-The comment is **authored by the daemon's bot account**, with a plain-prose suffix saying so:
+The comment is **authored by the agent's bot account**, with a plain-prose suffix saying so:
 
 ```
 Looks right, but rebase on main first.
 
--- posted from the agent daemon control panel
+-- posted from the agent control panel
 ```
 
 That is safe because the boundary the agent uses to tell its own words from yours is **marker-based,
@@ -596,7 +596,7 @@ that lies to the next run.
 agent operation on it -- the same window the next run will actually read, computed from the same two
 functions, so the badge cannot promise the run something different. It appears on **pull request rows
 only**; an issue's comments are replayed to every run whole, so "new since the last run" has no
-meaning there and a number would be a lie. The counts are fetched in the daemon's poll cycle and
+meaning there and a number would be a lie. The counts are fetched in the agent's poll cycle and
 memoized, so a row nothing has touched costs nothing and `GET /` still makes no forge call.
 
 ### What it costs, and what it does not
@@ -604,7 +604,7 @@ memoized, so a row nothing has touched costs nothing and `GET /` still makes no
 Reads are cheap, not free: the publishers write a snapshot into memory and `GET /` is a synchronous
 render off it, so **a board page load makes no forge call of its own**. What it does do is record
 that someone is watching, which arms a refresher that drains queued actions and re-searches the
-forge every few seconds until nobody is. That traffic is bounded by one refresher per daemon rather
+forge every few seconds until nobody is. That traffic is bounded by one refresher per agent rather
 than by how many tabs are open, and it stops an idle window after the last reader's last request --
 a window derived from the poll interval, never shorter than two minutes. Closing the tab does not
 cut that short: the stream ends at once, but presence also counts that reader's last request, and
@@ -620,7 +620,7 @@ does not block. Making those git calls async is out of scope, so the board is us
 occasionally waits out one clone.
 
 An action is **queued, not applied**, when the page comes back. The board never writes a label
-itself; the daemon drains queued actions -- at the top of its next claim cycle, and on the board
+itself; the agent drains queued actions -- at the top of its next claim cycle, and on the board
 refresher's own timer while a viewer is present -- which keeps it the only writer of agent labels in
 the process. A row says `queued` in either state, because the refresher applies it within a tick or
 two whatever the claim cycle is doing. Each action is re-checked against live labels when it is
@@ -682,6 +682,6 @@ A service with a published port but no compose-level `healthcheck:` automaticall
 
 This matters because compose publishes a port in the _host's_ network namespace, not the caller's. On a normal developer machine those are the same thing, so probing `localhost:<hostPort>` directly works fine -- but on a CI runner that shares the host's docker daemon over a mounted socket (the standard Forgejo/GitHub Actions runner shape), the job container's `localhost` is its own netns, and the published port is unreachable from it. Probing from inside the target's own namespace works in every topology, including that one.
 
-The probe image (`curlimages/curl`) is pinned by digest, and a `docker run` exit code of `125` (Docker's convention for "the daemon failed to start the container at all" -- missing image, pull denied, daemon unreachable) fails the check immediately instead of waiting out the full timeout.
+The probe image (`curlimages/curl`) is pinned by digest, and a `docker run` exit code of `125` (Docker's convention for "the agent failed to start the container at all" -- missing image, pull denied, agent unreachable) fails the check immediately instead of waiting out the full timeout.
 
 **This only applies to auto-derived checks.** A health check you configure yourself via `.tooling.json`'s `dockerCheck.healthChecks` is still probed with a direct `fetch()` from wherever `bst docker:check` runs -- an arbitrary user-supplied URL isn't necessarily compose-related at all, so making it reachable from the caller remains your responsibility.