@centralu/darwin-arm64 0.1.0-beta.11 → 0.1.0-beta.12

package/Centralu.app/Contents/Info.plist

@@ -17,9 +17,9 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.1.0-beta.11</string>
+	<string>0.1.0-beta.12</string>
 	<key>CFBundleVersion</key>
-	<string>0.1.0-beta.11</string>
+	<string>0.1.0-beta.12</string>
 	<key>CSResourcesFileMapped</key>
 	<true/>
 	<key>LSApplicationCategoryType</key>

package/Centralu.app/Contents/Resources/content/content-manifest.json

@@ -0,0 +1,500 @@
+{
+  "format": 1,
+  "appVersion": "0.1.0-beta.12",
+  "platform": "darwin-arm64",
+  "minShellVersion": 1,
+  "files": [
+    {
+      "path": "centralu-keeper",
+      "size": 972320,
+      "sha256": "c9b5f59d162946da37b241d9ee0434d5de8f911be0fb5b74a45933077c0621f4",
+      "executable": true
+    },
+    {
+      "path": "host/app-template/AGENTS.md",
+      "size": 10383,
+      "sha256": "6154e3069ff095bb7035a6768e3366cec7e84ff2a0ba2fc8ed67c0581dbaba8b",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/CLAUDE.md",
+      "size": 11,
+      "sha256": "336cc4fbf19beaada7ccf9986414fa91851a8d7a07dfb3ccbe800a69eed0ab49",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/centralu.app.json",
+      "size": 238,
+      "sha256": "0f1cc0b23deb7383a877cde61d0817d42533a66ad69b4b525defbc7375c032ef",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/gitattributes",
+      "size": 142,
+      "sha256": "62e1bf7df96b6862c1a1b8c66f8e39cb31aad0489670c75475b1258245cec2aa",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/runtime/THIRD_PARTY_LICENSES.txt",
+      "size": 52571,
+      "sha256": "ac551b077c3ec25d6ebe457bbf3b2c174eb8b7d8c85ffd1b52fce546d58fcb62",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/runtime/centralu-app-runtime.mjs",
+      "size": 642710,
+      "sha256": "97b0839f01c5ed170f6921df3884e1ce6c30d9b0eb6871b4d289594e94c82564",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/runtime/centralu-app-runtime.mjs.map",
+      "size": 743679,
+      "sha256": "0fc05f9dbd6b192ff74b42e9aadef3c6eaaf9f2f994ecb650e606deba3251cb1",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/runtime/mcp-app.js",
+      "size": 473677,
+      "sha256": "cb5ad8ccdaec624bdf27b3ac585e58d29dc60590d078b9667f6f4947765d5918",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/server.mjs",
+      "size": 2604,
+      "sha256": "60697fa47a26f7851ae496666fa9ee1158e6b5ec6df2eccecfe64fd6144b9038",
+      "executable": false
+    },
+    {
+      "path": "host/app-template/ui/index.html",
+      "size": 6726,
+      "sha256": "47f63220770c85d9f9ec1ab641ce417c0d28c189211d2300070c6447dcb62860",
+      "executable": false
+    },
+    {
+      "path": "host/bundle-info.json",
+      "size": 162,
+      "sha256": "d6af4c5778a131116e0e4fa1e4236c559c7e2270cfd3d937e0a4da79412a7a8a",
+      "executable": false
+    },
+    {
+      "path": "host/codex-orchestrator-bridge.mjs",
+      "size": 134065,
+      "sha256": "d1f0b72e4aec9fe5629fca66b5d7bce75428785f671e263d82d10662484bfa90",
+      "executable": true
+    },
+    {
+      "path": "host/main.mjs",
+      "size": 5212801,
+      "sha256": "d27d3edf42fd32e4cb9cf6ecaf6ef8b4f85d5d27f3f563e84111c07cce2b1348",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/build/Release/better_sqlite3.node",
+      "size": 1980736,
+      "sha256": "98e0e8acd01c632fe5615243e1296af0372826f8783b18fc31c506f73c47459c",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/binding.js",
+      "size": 2123,
+      "sha256": "4fe0f892facc02af7db0a1770150565d2e944e7da3c6493116d8e2a01a0f9b19",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/darwin-arm64.js",
+      "size": 166,
+      "sha256": "830ec2bbc0d402f8be13e93d5549c7a9030a2d5eed40f527e4b4aee9f962ec3b",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/darwin-x64.js",
+      "size": 164,
+      "sha256": "2d7671f3e5d0f19e78eb88d6cd2547ec7554acd3844942fa5a8fff61fd8f9c93",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/database.js",
+      "size": 4729,
+      "sha256": "539315c97591561394d2a0f257632305c3af1e32915a123aa8cc9032056d8ae2",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/index.js",
+      "size": 149,
+      "sha256": "0d56e190de8623278641b613433e89c4af2e5c90092c9c6e425f873d7fbc7ccf",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/linux-arm64.js",
+      "size": 165,
+      "sha256": "e2ff6a1e844f0f95794ebe50cea071f235bd57182ac04985819b86498541797c",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/linux-x64.js",
+      "size": 163,
+      "sha256": "96f9bbd76ab65da4f98a4833eb512746db6a99a2728db20feae2d70db0c2e273",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/linuxmusl-arm64.js",
+      "size": 190,
+      "sha256": "2edb0f14e62d3efa76c8089e58207895abb46642d1e988755a5eef5059605de9",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/linuxmusl-x64.js",
+      "size": 188,
+      "sha256": "d28b85927738844f589601e78e241d501c30231e9b9890f8f3605fca6d238f3d",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/aggregate.js",
+      "size": 1932,
+      "sha256": "e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/backup.js",
+      "size": 2380,
+      "sha256": "ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/explain.js",
+      "size": 292,
+      "sha256": "0bd8cc80ccc7338f1d93058beea0cde924d4e7e652da9f51267e7c0757361be7",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/function.js",
+      "size": 1396,
+      "sha256": "f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/inspect.js",
+      "size": 174,
+      "sha256": "4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/pragma.js",
+      "size": 543,
+      "sha256": "d399bf1dbc85ef8a51f946c5a9505f2c37d0b1bed3f68863b1bf202d53d6524e",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/serialize.js",
+      "size": 625,
+      "sha256": "7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/table.js",
+      "size": 7243,
+      "sha256": "2356885ca1ef37d20f2daeed2b82b9dd6e61481e851194174a16d32efa3ae2f0",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/transaction.js",
+      "size": 2855,
+      "sha256": "40b71d6113f328f96cec8f6f888ffddd98b5926d38fb1e2746939c7daba93e2e",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/methods/wrappers.js",
+      "size": 1152,
+      "sha256": "b289d339ff56b19ab40d109050080e1c844f2a5d01e62d8cb37a0152b0479a47",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/sqlite-error.js",
+      "size": 512,
+      "sha256": "903c140bb3d9d4f6256124889f5a820a491299907885d5b9d5ff2c4eaa268a06",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/util.js",
+      "size": 331,
+      "sha256": "92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/win32-arm64.js",
+      "size": 165,
+      "sha256": "00c1d5355a4e47e485e0ea8408a28423a18204d6d7ea5c57e599ebe64a1aa309",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/lib/win32-x64.js",
+      "size": 163,
+      "sha256": "c25867a2e904a367743498377e6e156a653bd10bcc5f9be7cbdf8a28359012ef",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/package.json",
+      "size": 1838,
+      "sha256": "6c9ea355190dfce3646ad4d2a31c9506de36d884a6461b3655a2a0c4ba3d1695",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/better-sqlite3/prebuilds/darwin-arm64.node",
+      "size": 1980736,
+      "sha256": "98e0e8acd01c632fe5615243e1296af0372826f8783b18fc31c506f73c47459c",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/conpty_console_list_agent.js",
+      "size": 721,
+      "sha256": "0d010879bb6680a0253d44363183d53e631f42972594eb6dcb1fb842c8c85e52",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/conpty_console_list_agent.js.map",
+      "size": 475,
+      "sha256": "e880507e8ebfcaf0fac8ffcb011a3bb3853847767c77bae744ad94ad096977c5",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/eventEmitter2.js",
+      "size": 1600,
+      "sha256": "f1c14613aa90c10def4ca7238329270871997eb26f919f7074dc25533e3e75dd",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/eventEmitter2.js.map",
+      "size": 1155,
+      "sha256": "2300f735c0a048d5b56a2821362f33cc9a811746b8a5b9552854f91a51f52810",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/eventEmitter2.test.js",
+      "size": 1266,
+      "sha256": "9cd06569c14d4cd180031ed4df914b817e75ceb104ac10ef65cae6815f46c568",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/eventEmitter2.test.js.map",
+      "size": 1396,
+      "sha256": "8d3742445dfccf223be42de83015447fbdbcc858a325c061302904f301f503cf",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/index.js",
+      "size": 2008,
+      "sha256": "c1b82c92c4c63aaa8e8441fc5a291c4727cd3f3550666d2fec7250e0f6d4b173",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/index.js.map",
+      "size": 987,
+      "sha256": "829a1a1f145a27eaaf5a636afdedf3ce9746bce25fd489ae04b5721d16f70acc",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/interfaces.js",
+      "size": 233,
+      "sha256": "56e4173f09aad26173f9d4c79800fda0b808c34424f987ef8d671cc931119a0a",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/interfaces.js.map",
+      "size": 124,
+      "sha256": "8ad6939566c34a59f5b7e49307050b73102acce29eed11c12e02fc3d765cc276",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/shared/conout.js",
+      "size": 348,
+      "sha256": "6ae3b0532616da11aa2a11b4506bb89b0d40be005a9ea9fb369fb59eefdbda47",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/shared/conout.js.map",
+      "size": 204,
+      "sha256": "03aeb1e2efe8dc06f069c98bdd30122b2df278f2ac0fbb0a39c91e73801a8eda",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/terminal.js",
+      "size": 7454,
+      "sha256": "5ed5cd66a766afba4a04093284e999f8516d41936501839055800b10eca5d304",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/terminal.js.map",
+      "size": 5845,
+      "sha256": "c9e670bcd71467bd461f9ed969e1e712471f2cd94287543601b7df11ce8c472a",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/terminal.test.js",
+      "size": 6250,
+      "sha256": "6f6ae435c9c6e93d8146fa7a79fe155ec3291880aa4de68fbad7ed8891e4f87b",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/terminal.test.js.map",
+      "size": 4151,
+      "sha256": "b22c83d59bafc013e5ac5016efb262cff8cbe782b79b064d3ce0f12ce55b41c1",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/testUtils.test.js",
+      "size": 807,
+      "sha256": "eb13d8ffc04ef385604b37170bafa9914736d5c5be8bca857c9f32958f6fe7ec",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/testUtils.test.js.map",
+      "size": 622,
+      "sha256": "ac8686314d11e1d90b32f5eb7e753bcd4a184ab4441ff12ea2c586a3b58785e6",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/types.js",
+      "size": 228,
+      "sha256": "408bf8287717b6322cc380ea66caf1b5e366dcf697707ae2f3cc454e08f3b151",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/types.js.map",
+      "size": 114,
+      "sha256": "980a71159075a8183a9a7981ac504e6c277785c33a1fc17eb6908d4abbb128da",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/unixTerminal.js",
+      "size": 13372,
+      "sha256": "a62e3a60c3bc1b0e7261f58284856df748dcee6761a2bc7a5a5ba98b22660473",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/unixTerminal.js.map",
+      "size": 9657,
+      "sha256": "fdc9afe47387e19f74b843cd620c7516895c5c99eba1c1a6aea636f41f9dda2b",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/unixTerminal.test.js",
+      "size": 19310,
+      "sha256": "608d6c9bcfa07873440ed813b499d347e3e79dace1cc58ea3bd61b53356f0937",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/unixTerminal.test.js.map",
+      "size": 11425,
+      "sha256": "44fb7f386894ab2cf5b557ec5cf74ec5417bb75faae608f0f667c365955c5e85",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/utils.js",
+      "size": 1548,
+      "sha256": "f75ad341c13fbf1a9a6605d7ee42dff5bbc5d43b7b381e413fb97eb1b8300beb",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/utils.js.map",
+      "size": 1142,
+      "sha256": "e699109e178ec671819a99db007389b5b39c3ac31d148ddcb47d9aca250327da",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsConoutConnection.js",
+      "size": 6119,
+      "sha256": "1440f70908fb1f55911ac8e936a1230f68a9c00c03096fcef6788eac6aad9d62",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsConoutConnection.js.map",
+      "size": 1660,
+      "sha256": "621dd488e7f33a2f2084cdb3d3df6560209105730d54ae3414fbbc3ba34c07c6",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsPtyAgent.js",
+      "size": 12388,
+      "sha256": "8636d16b38266112204061a22b135734177c242837982fd3a4055be726efa64a",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsPtyAgent.js.map",
+      "size": 9105,
+      "sha256": "351a491b18e6ada481d318a93be7cc80af63f183e9c66f247f193e8bd4627106",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsPtyAgent.test.js",
+      "size": 4147,
+      "sha256": "4c83dd76ec446031876dc81869e4c204715f72c0ba7ba3389e10b390b6d08da1",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsPtyAgent.test.js.map",
+      "size": 2951,
+      "sha256": "1fbfffca813225c86f4a42b3e467a6b3c1a19885db5748d01e8b06d7df82ad94",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsTerminal.js",
+      "size": 7852,
+      "sha256": "c3a65716f53fed0135a8a633373d5f9c2ab092544d651f27ef0a67096dd3bcd9",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsTerminal.js.map",
+      "size": 5021,
+      "sha256": "ad8425423f7cb4b7c405e7275e02c628e2c9df21287413a7cfce1ffcbb997be8",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsTerminal.test.js",
+      "size": 10760,
+      "sha256": "325567d8d6b461df3d3b7990a51bac09f662733988df653de7ee9113880e67a3",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/windowsTerminal.test.js.map",
+      "size": 8847,
+      "sha256": "2a3a29c938a8af86827bd1af33a34da1039f36559e68575ae734a07975a956d3",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/worker/conoutSocketWorker.js",
+      "size": 848,
+      "sha256": "3e4bac095ac3870c3248a7302f5d10217de625f30c32b7000fe48a34788e47ac",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/lib/worker/conoutSocketWorker.js.map",
+      "size": 635,
+      "sha256": "b90f0ea24f182b1be7875070eafc360f91c9d9d5c997815453a117db52fd4250",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/package.json",
+      "size": 1615,
+      "sha256": "f8b6a14f7022c14f1cd5d109486f5dacd32bffb63a9a63e38eced37dacb47439",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/prebuilds/darwin-arm64/pty.node",
+      "size": 85496,
+      "sha256": "e6457d66f45af3facd02920a5b212164e80fe0bb758afe6e6eab1eceeba3fc9a",
+      "executable": false
+    },
+    {
+      "path": "host/node_modules/node-pty/prebuilds/darwin-arm64/spawn-helper",
+      "size": 50480,
+      "sha256": "21c589109bca43e287df884f3c34ab888033a83927ea7d273949ac5030583f26",
+      "executable": true
+    },
+    {
+      "path": "host/schema.sql",
+      "size": 4302,
+      "sha256": "bf73d90f00b9502f4bd100ed0ed8f843fce96cbcd2dba862d9446bf5ac087db8",
+      "executable": false
+    }
+  ]
+}

package/Centralu.app/Contents/Resources/content/content-manifest.json.sig

@@ -0,0 +1,7 @@
+{
+  "format": 1,
+  "algorithm": "ed25519",
+  "keyId": "b2ee887bfe3ff5f5",
+  "signature": "i6aRW8Bvrvj2kYb/fMI3yHVi2GWFvRQa2h00Fk4XFXR+P247wcQD9IK9KPcKph9vzSpwst55YjXCP72loxguAg==",
+  "comment": "release key \"current\" in packaging/shell/keys.json"
+}

package/Centralu.app/Contents/Resources/content/host/app-template/AGENTS.md

@@ -0,0 +1,140 @@
+# {{APP_NAME}} — a Centralu app
+
+This folder is one app. Centralu runs `server.mjs` as an MCP server; people use it through its
+screen (`ui/index.html`) and agents call the same tools as functions. Same tools, one code path.
+
+## Files
+
+- `centralu.app.json` — the manifest. `id` is `{{APP_ID}}` and must stay equal to this folder's
+  name. `home` is the tool Centralu calls to open the screen. Optionally,
+  `"view": { "span": { "cols": 2, "rows": 1 } }` recommends how many grid cells the app's panel takes
+  on Centralu's grid (each side 1 to 4; a session panel is 1 × 1). It is only a default: the person's
+  own choice, from the panel's top bar or in Settings, comes first, and the window may give the panel
+  less. The screen must still work at whatever size it gets.
+- `server.mjs` — the MCP server. Change it.
+- `ui/index.html` — the screen. Change it. It is read on every open, so edits show without a restart.
+- `runtime/` — **generated by Centralu. Never edit, format, move, or read it in full.** It is replaced
+  when Centralu updates. Everything you need is imported from `./runtime/centralu-app-runtime.mjs`:
+  `McpServer`, `serveStdio`, `z` (zod), `centralu`, `inputRequired`, `acceptedContent`.
+
+## Rules
+
+1. **No installs.** No `npm install`, no `package.json`, no imports other than Node built-ins
+   (`node:*`) and the runtime. The app must start with `node server.mjs` alone.
+2. **Tool names** use letters, digits, `_` or `-`. **Never `__`** (two underscores separate names
+   in agent sessions; Centralu drops such tools).
+3. **Register tools with `centralu.tool(server, name, config, handler)`** (same arguments as
+   `server.registerTool`). The handler then knows which call it is serving, which
+   `centralu.agent()` needs.
+4. **Annotate every tool**: `annotations: { readOnlyHint: true }` if it only reads,
+   `readOnlyHint: false` if it changes anything. Read-only tools run without asking the person;
+   the others follow the session's approval setting. The same hint decides refreshes: every call to
+   a tool that is not `readOnlyHint: true` tells this app's open screens to read again (rule 8). A
+   read tool left unannotated costs a refresh cycle each time it is called, and screens that re-read
+   with it keep refreshing each other.
+5. **Visibility**: by default a tool is visible to agents and to the screen. A tool only the screen
+   should call gets `_meta: { ui: { visibility: ['app'] } }`; one only agents should call gets
+   `['model']`.
+6. **A tool with a screen** gets `_meta: { ui: { resourceUri: 'ui://{{APP_ID}}/…' } }`, and the
+   resource is registered with `centralu.uiResource(server, name, uri, new URL('./ui/…', import.meta.url))`.
+   The `home` tool must have one and must be visible to the screen.
+7. **State lives in the server, never in the screen.** Keep it in memory and save it in the data
+   folder with `await centralu.readJson(file, fallback)` / `await centralu.writeJson(file, value)`
+   (or any file under `centralu.dataDir`). **Never write files into this folder** — a project app's
+   folder is committed to git and shared with the team. The screen may not use browser storage
+   (it runs in an isolated frame).
+8. **The screen re-reads, it does not remember.** When anyone calls one of this app's tools that
+   is not `readOnlyHint: true`, Centralu sends open screens `centralu/notifications/changed` (the
+   screen that made the call does not get it: it already has the answer); the template's screen
+   then calls `show` again. Keep that handler, and keep `show` read-only.
+9. **stdout is the MCP channel.** `console.log` is redirected to stderr for you; never write to
+   `process.stdout` yourself. stderr is shown to the person when the app fails.
+10. **Asking the agent**: inside a tool handler, `await centralu.agent('prompt', { schema, tool })`
+    asks the agent of the person using Centralu. Each call runs in a new session under this app
+    (the person can read it), with the `safe` approval setting, and returns the agent's final
+    answer: text, or with `schema` (a JSON Schema whose top level is an object) JSON of that shape,
+    checked by Centralu. Under `safe` the agent reads without asking, but every file write and
+    command waits for the person to approve it in that session, so ask the agent for an answer and
+    do the writing in your own tool code. Declare `"uses": { "agent": true }` in the manifest for the person's
+    default agent, or a list such as `["codex"]` to pick one with `tool`. The prompt reaches the
+    agent marked as written by this app, not by the person, so say plainly what you need. A run
+    takes seconds to minutes; the helper keeps the call alive while it waits. An app runs one agent
+    at a time and at most 5 a minute: put a batch of work into one prompt instead of a loop.
+11. **Calling another app**: inside a tool handler, `await centralu.callApp('other-app', 'tool', args)`
+    calls a tool of another app and returns its answer (JSON if the tool returns structured
+    content, else text). Declare the app in `"uses": { "apps": ["other-app"] }`. Only tools open to
+    agents (visibility `model`) can be called. A project app reaches apps of its own project first,
+    then apps in the person's user folder; an app in the user folder reaches only user-folder apps.
+    A chain of apps calling apps stops at 3 calls deep, and an app tool already in the chain cannot
+    be called again from inside it.
+12. **Reading Centralu's data**: inside a tool handler, `await centralu.host('sessions.list')` or
+    `await centralu.host('git.status')` returns JSON. These two names are the whole list; declare
+    each one you use in `"uses": { "host": [...] }`. `sessions.list` gives this project's sessions
+    (the names shown in the sidebar and their states, never the conversations); `git.status` gives this project's branch and changed
+    files (project apps only).
+
+All three throw an error that says what Centralu answered. The first time the app uses each of them (an
+agent tool, another app, a host name), Centralu asks the person once — on the session's approval card
+when an agent's call started it, on this app's screen when the screen did — and remembers the answer
+until the manifest's `uses` changes. The call waits while the person decides (up to 5 minutes). A
+refusal comes back as that error: show it plainly instead of retrying.
+
+## Dragging an item out of the screen
+
+An item the person may want to hand to a session (a card, a row, a record) should be draggable and
+carry two standard types, set in its `dragstart` handler:
+
+```js
+node.draggable = true
+node.addEventListener('dragstart', (e) => {
+  e.dataTransfer.setData('text/uri-list', item.url)          // the item's address
+  e.dataTransfer.setData('text/plain', `#${item.id} ${item.title}`) // one line naming it
+  e.dataTransfer.effectAllowed = 'copyMove'
+})
+```
+
+Dropped on a session, it goes into the message at the caret as a Markdown link,
+`[#12 Fix login](https://…)`; with no address, the text goes in as it is. Nothing else is needed:
+the browser does not hand a drag from the screen's frame to Centralu, so Centralu carries it out
+itself. Keep your own types next to these two for drags inside the screen (a card moved between
+columns), and keep the title to one line. If the session cannot use this app's tools (another
+project's session, an untrusted project), the link still goes in and Centralu tells the person why.
+
+## The screen's look
+
+Centralu sends the person's theme to the screen (light or dark, their colours), and sends it again
+when they switch. The template's `ui/index.html` already uses it; keep these when you change it:
+
+- **The `applyTheme` function** in the page script. It puts the theme on `<html>`: `color-scheme`
+  from `theme`, the MCP Apps style variables (`--color-text-primary`, `--color-background-secondary`,
+  `--font-sans`, `--font-text-md-size`, `--border-radius-md`, …) and Centralu's own
+  (`--centralu-signal`, `--centralu-scrollbar-*`). It reads `app.getHostContext()`, because a change
+  notification carries only what changed.
+- **Style with those variables only** — colours, and type and shape too (`--font-text-md-size`,
+  `--font-text-md-line-height`, `--font-sans`, `--font-weight-semibold`, `--border-radius-md`,
+  `--border-width-regular`, …) — instead of fixed values. Give each its fallback once, in the
+  `:root` block at the top of the stylesheet (Centralu's dark values, for the moment before the theme
+  arrives), and use those names everywhere below. Then the screen follows light and dark, the
+  person's font, line height and text size, and sits on Centralu's background (keep
+  `background: transparent` on the page). Spacing has no variable; keep it literal. The roles: `primary` / `secondary` / `tertiary` for
+  text and surfaces in falling order; `--color-text-danger` for errors; `--color-text-warning` (the
+  same as `--centralu-signal`) only for what waits on the person — it is Centralu's signal colour,
+  the strongest thing on screen.
+- **Narrow first.** The screen is often a grid panel about 360–480px wide, or the inline view under
+  a tool card. Make it work at that width first: no fixed width over about 320px, rows that wrap
+  (`flex-wrap`), and below about 520px side-by-side parts stacked into one column (a media query in
+  this page measures the panel). Keep what waits on the person first. Check it at 360px.
+- **The "Centralu's scrollbar" block** in the stylesheet. It draws scrollbars the way Centralu
+  does, from the theme. Do not add `scrollbar-color` or `scrollbar-width` outside its `@supports`
+  guard: in Chromium they switch the styled scrollbar off.
+
+## Checking your work
+
+- Call Centralu's **`check`** tool after changes. It validates the manifest, starts the app, lists
+  its tools for real, reads every screen the tools point to, and reports problems (tool names,
+  visibility, missing annotations, a `home` without a screen) with the app's stderr.
+- Centralu restarts the app once at the end of your turn if this folder changed; calls in progress
+  finish first. Agents in other sessions see changed tools from their next turn (Claude) or next
+  thread (Codex).
+- Errors in `server.mjs` are printed with file and line. A failure inside `runtime/` is almost always
+  a wrong argument from `server.mjs` — look at the first frame outside `runtime/`.

package/Centralu.app/Contents/Resources/content/host/app-template/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md