@bysir/herdr-web 0.5.2 → 0.5.4

package/README.md

@@ -82,7 +82,7 @@ The ⚙ at the right end of the top bar is the **settings panel**; its "Devices"
 
 The old never-expiring `~/.herdr-web/token` is demoted to **bootstrap only**: an old bookmark exchanges it for a device credential on first open and scrubs the token out of the URL, after which you should `rm ~/.herdr-web/token`. Details and reasoning in [SECURITY.md](docs/dev/SECURITY.md) (Chinese).
 
-Once connected it **types `herdr` for you**. To type something else, or nothing: `HERDR_WEB_ONCONNECT` (set it to an empty string to stay in the shell). Adding a path segment to the URL (`/work`) gives you **a different herdr session** — see [First run](#first-run). The old "run herdr" button in the top bar is gone: with autotyping it earns its place less than once a day, and the soft key bar ships a preset for it if you want one.
+Once connected it **types `herdr` for you**. To type something else, or nothing: `HERDR_WEB_ONCONNECT` (set it to an empty string to stay in the shell). Adding a path segment to the URL (`/work`) gives you **a different herdr session** — see [First run](#first-run). The old "run herdr" button in the top bar is gone: with autotyping it earns its place less than once a day, and the shortcut bar ships a preset for it if you want one.
 
 **The admin page is at `http://127.0.0.1:<port+1>/`** (also in the startup banner): certificate status, one-click issue/renew, generated DNS `.env` snippets, pairing codes, device kicking. It is **bound to loopback and does not exist on the public internet**, so it needs no login — anything that can reach it already has your shell. Why not "an authenticated page on the main server": authentication is a control that can fail, unreachability is a property; and the admin page must not depend on the very certificate it exists to fix (a broken certificate would lock you out of the page that repairs it).
 
@@ -141,22 +141,22 @@ whole paragraph to one of herdr's panes.
 | **Pull back** | Grabs what is already in the remote input line into the textarea for editing (useful when the remote side has been Tab-completing) |
 | **Auto pull** | Every 500ms by default. Switching panes swaps in the new pane's content; **never overwrites a local draft**, it just says so in the status line |
 | **Two-way** | Local edits get pushed back into the remote input line (without Enter). Off by default — see the caveats below |
-| **Image** | Upload an image; the path is inserted **at the cursor**. On a phone it offers camera / library; on a desktop just `⌘V` a screenshot into the box, or drop a file. You do not need the outbox open for this — bind `act:img` on the soft key bar, or paste anywhere on the page |
+| **Image** | Upload an image; the path is inserted **at the cursor**. On a phone it offers camera / library; on a desktop just `⌘V` a screenshot into the box, or drop a file. You do not need the outbox open for this — bind `act:img` on the shortcut bar, or paste anywhere on the page |
 | `↑` | With an empty box, recalls the last thing you posted (30 kept locally) |
 | `Esc` | **Forwarded to the terminal.** Esc means nothing inside a plain textarea, while the agent needs it constantly (overlays like `/usage` close with it); focus does not move, so you can press it repeatedly |
 
-Uploading does not need the outbox open: bind `act:img` on the soft key bar, or **paste anywhere on
+Uploading does not need the outbox open: bind `act:img` on the shortcut bar, or **paste anywhere on
 the page** (an image in the clipboard is uploaded directly). Where the path lands depends on whether
 the outbox is open — appended to your draft, or typed straight into the terminal.
 
 → Why a separate box at all, how images actually work, the two-way caveats, measured polling
 latency: [OUTBOX.md](docs/dev/OUTBOX.md)
 
-### Soft key bar
+### Shortcut bar
 
 Phones have no Ctrl key, and herdr's `ctrl+b` prefix depends on one. The keys live **on the server**
 (`~/.herdr-web/softkeys.json`), so phone / tablet / desktop share one set of definitions, edited in
-Settings → Soft keys.
+Settings → Shortcut keys.
 
 - The "Keys" field takes a **key spec**; space-separated entries fire in sequence — `ctrl+b c` is the
   prefix plus c, one tap.
@@ -176,7 +176,7 @@ which key and where it stopped making sense — rather than shipped as a key tha
 
 ### Pane list · notices
 
-The ▦ in the top bar (or `act:panes` on the soft key bar; on a phone you can also tap herdr's own
+The ▦ in the top bar (or `act:panes` on the shortcut bar; on a phone you can also tap herdr's own
 `switch`) opens a list of panes, one per row — **tap one and you are there, zoomed full screen**.
 You can filter (tab / title / path / pane id) and show only panes running an agent. The list
 refreshes itself every 4 seconds.
@@ -210,6 +210,36 @@ allowlist would not stop them and would only get in the way daily. If you want o
 → The short-lived link route and the four hard rules on it (never `text/html`, why SVG is safe to
 render): [SECURITY.md](docs/dev/SECURITY.md)
 
+### Reading a diff
+
+`git diff` is close to unreadable in a phone terminal: long lines are either cut off or scroll
+sideways, a wall of red against a wall of green does not show you *which word* changed, and paging
+means driving a pager with arrow keys. The "改动" button in the top bar (or `act:diff`) opens a
+separate layer:
+
+- **a file list first**: what changed, `+n −m` per file, which parts are already `git add`ed;
+- tapping one opens a patch that **wraps long lines** (on by default; the button in its header
+  toggles it, and the choice is remembered in this layout profile), with **word-level highlighting**
+  on lines that pair up — only the part that actually changed gets the darker background;
+- **every file of the change is one continuous stream**: keep scrolling past a and you are in b, no
+  going back to the list. The header tracks where you are (`3 / 19 · filename`), and tapping the band
+  between two files folds one away. Files you have not reached yet hold their place and are fetched
+  as you approach them, one at a time — no fanning out a dozen `git diff`s on the machine your agents
+  are working on;
+- three views: **working tree vs the last commit** (including new files) / **staged** / **the last
+  commit itself**;
+- you never pick the repository: it is discovered from every pane's cwd, deduplicated by repo root,
+  with the focused pane first;
+- the top-bar button carries a **green dot** when there are changes **you have not looked at yet** —
+  not merely "there are changes", which is permanently true in a repo an agent is working in. Opening
+  the panel counts as looking; the dot comes back when the agent touches something again. It follows
+  the "panel dot" switch in settings — turned off, it does not even poll.
+
+**Read-only.** No add / commit / checkout here, and none planned — anything that changes the
+repository belongs in the terminal, where you have all of git and can see its output. The boundary
+is the same one as file browsing (`HERDR_WEB_FILES=0` turns this off too, and `HERDR_WEB_FILE_ROOTS`
+still jails the repo root); if this machine has no `git`, the button is not drawn.
+
 ### Phones and tablets
 
 When a program has mouse reporting on (herdr does), touch gestures are taken over entirely:
@@ -222,9 +252,9 @@ When a program has mouse reporting on (herdr does), touch gestures are taken ove
 
 **There is no double tap.** It used to be the "show / hide the system keyboard" gesture, and it is gone — one gesture was costing the feel of every other tap. To tell "this is a tap" from "this is the first half of a double tap", every tap has to sit out the double-tap window (320ms) before it can be sent, so clicking panes and clicking things inside Claude all lag a beat; and without the wait, that first tap **leaks into the program in the pane** — Claude Code has its own clickable UI (expanding a block, **picking an option**), and a leaked tap picks the option for you. Paying "every click is imprecise and might answer for you" for one keyboard shortcut is not worth it.
 
-The keyboard now comes from **buttons** only: the ⌨ soft key (`act:kbd` — the first key in the factory set, and the soft key bar is on by default on phones) and the "system keyboard" button in the top bar (drag it on under Settings → Top bar). A button press means you want the keyboard — nothing to guess, and no delay.
+The keyboard now comes from **buttons** only: the ⌨ shortcut key (`act:kbd` — the first key in the factory set, and the shortcut bar is on by default on phones) and the "system keyboard" button in the top bar (drag it on under Settings → Top bar). A button press means you want the keyboard — nothing to guess, and no delay.
 
-**The outbox and the soft key bar are one dock**: drag either side edge to change its width (when an
+**The outbox and the shortcut bar are one dock**: drag either side edge to change its width (when an
 IME covers half the screen, shrink the whole dock into what is left), and the three handles on the
 top edge of the key area set the height and the boundaries; double-tap any handle to reset. A phone
 in portrait (< 440px) switches to another tier: no handles, full width, one horizontally-scrolling
@@ -240,7 +270,7 @@ details of the dock and the top bar: [MOBILE.md](docs/dev/MOBILE.md)
 
 The ⚙ at the right end of the top bar, in four pages: **Terminal** (font size / light-dark, kitty
 protocol / Option as Meta / copy on select / synchronized output, herdr's switch opening our pane
-list, the badge on the panel icon), **Top bar**, **Soft keys**, **Devices**. Above the tabs there is
+list, the badge on the panel icon), **Top bar**, **Shortcut keys**, **Devices**. Above the tabs there is
 one more row: which layout profile this device uses. The three overlays (pane list / files /
 settings) are mutually exclusive.
 
@@ -297,6 +327,7 @@ Changes take effect on restart — configuration is read once at startup. To con
 | `HERDR_WEB_ONCONNECT_MS` | `250` | How long to wait before typing that line. The wait starts **after the shell's first output** — an rc file touching `stty`, or a completion plugin initialising, **silently swallows** characters typed too early. If the auto-typed line does not land, raise it |
 | `HERDR_WEB_DIR` | `~/.herdr-web` | Data directory, in two layers: configuration and files (`softkeys.json` / `tls/` / `uploads/`) at the root, **internal data** (device credentials, passkey public keys) under `data/` — those two are not meant to be hand-edited, and tampering is reported in the terminal. **Keep the path short**: a unix socket (`ctl.sock`) is opened inside it, and beyond ~100 bytes it cannot bind, which breaks the subcommands |
 | `HERDR_WEB_FILES` | on | `=0` turns file browsing off: `/api/files/*` and `/_f/` all 404, and the 📁 in the top bar is not drawn (an entry point that opens onto a wall of 404s is worse than no entry point) |
+| `HERDR_WEB_GIT` | on | `=0` turns the diff panel off: `/api/git/*` all 404 and the top-bar button is not drawn. **It also sits under `HERDR_WEB_FILES`** — a diff *is* file content, so being able to read diffs while file browsing is off would make that switch a lie. Same when this machine has no `git` |
 | `HERDR_WEB_FILE_ROOTS` | empty | Comma-separated directories. Set, this is **a real allowlist** (a jail) and only those trees are visible. **Empty means no boundary** — the reasoning is in [File browsing](#file-browsing). `~` is expanded; non-absolute entries are discarded (relative to what? keeping them only makes the prefix check pass somewhere surprising) |
 
 ### Outbox / talking to herdr

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bysir/herdr-web",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "浏览器里的 herdr 终端 + 语音投稿。一个 Go 二进制，前端嵌在里面。",
   "license": "MIT",
   "homepage": "https://github.com/zbysir/herdr-web#readme",
@@ -29,9 +29,9 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@bysir/herdr-web-darwin-arm64": "0.5.2",
-    "@bysir/herdr-web-darwin-x64": "0.5.2",
-    "@bysir/herdr-web-linux-arm64": "0.5.2",
-    "@bysir/herdr-web-linux-x64": "0.5.2"
+    "@bysir/herdr-web-darwin-arm64": "0.5.4",
+    "@bysir/herdr-web-darwin-x64": "0.5.4",
+    "@bysir/herdr-web-linux-arm64": "0.5.4",
+    "@bysir/herdr-web-linux-x64": "0.5.4"
   }
 }