@dreb/coding-agent 2.35.0 → 2.36.1

package/docs/dashboard.md

@@ -18,6 +18,10 @@ dreb dashboard [--port 5343]
 
 # or directly
 dreb-dashboard [--port 5343]
+
+# remote over Tailscale with HTTPS (PWA + notifications on mobile)
+dreb dashboard --remote --allow you@example.com \
+  --https --cert /path/cert.pem --key /path/key.pem
 ```
 
 If `@dreb/dashboard` is not installed, `dreb dashboard` fails loudly with
@@ -94,10 +98,108 @@ When the agent is idle, send is a plain prompt.
 
 ## Notifications
 
-The settings tab exposes a browser-local permission toggle for needs-attention
-notifications. When permission is granted, a hidden dashboard tab sends a
-browser notification when a session newly needs input; all browsers still get a
-`◆` tab-title badge fallback.
+Needs-attention notifications are delivered through a **service worker**
+(`registration.showNotification()`), not the page-context `Notification`
+constructor — the constructor was removed from Android Chrome (throws
+`Illegal constructor`) and is absent from iOS Safari entirely. The service
+worker handles `notificationclick`: it focuses an open dashboard client and
+navigates to the session that needs attention, or opens one. All browsers still
+get a `◆` tab-title badge fallback when the tab is hidden.
+
+The settings tab exposes a browser-local permission toggle. Gating is unchanged:
+notifications fire only when permission is granted **and** the tab is hidden.
+
+**iOS:** notifications exist only in the **installed PWA** (Add to Home Screen,
+iOS 16.4+) — a plain Safari tab has no Notification API regardless of HTTPS.
+The settings copy explains the install prerequisite when it detects an
+un-installed iOS Safari session. (Note: iOS 17.4+ in the EU dropped standalone
+PWA support — installed PWAs open as Safari tabs and push is unavailable there.)
+
+## Installable PWA + secure context
+
+The dashboard ships a web app manifest (`display: standalone`, theme/background
+colors, icon set), an apple-touch-icon, and service worker registration, so it
+is **installable to the home screen** on Android Chrome and iOS Safari 16.4+ —
+no URL bar, app-like presence, and (on iOS) the only context where
+notifications work.
+
+Service workers and the Notifications API require a **secure context**: HTTPS,
+or `localhost`/`127.0.0.1`. Local mode (`http://127.0.0.1:<port>`) already
+qualifies — install and notifications work with no TLS setup. **Remote mode
+over the tailnet is plain HTTP**, which is not a secure context, so the service
+worker will not register and notifications are unavailable until you enable
+HTTPS. See [Native TLS](#native-tls-remote-https) below.
+
+## Native TLS (remote HTTPS)
+
+For PWA install + notifications from a phone over the tailnet, the dashboard
+terminates TLS itself using certificate files from
+[`tailscale cert`](https://tailscale.com/docs/how-to/set-up-https-certificates)
+(no reverse proxy, **no auth-model change**):
+
+```bash
+dreb dashboard --remote --allow you@example.com \
+  --https --cert /etc/dreb/cert.pem --key /etc/dreb/key.pem
+```
+
+Because the dashboard terminates TLS directly, `req.socket.remoteAddress` is
+still the phone's real tailnet IP — Tailscale identity resolution, the
+allowlist, and pairing all keep working exactly as in plain-HTTP remote mode.
+There is no header trust, no proxy, no weakening of the auth model.
+
+### One-time cert setup with `tailscale cert`
+
+```bash
+# Enable HTTPS certificates in the Tailscale admin console (DNS → HTTPS) first.
+sudo tailscale cert \
+  --cert-file=/etc/dreb/cert.pem \
+  --key-file=/etc/dreb/key.pem \
+  hostname.tailXXXX.ts.net
+sudo chown dreb:dreb /etc/dreb/cert.pem /etc/dreb/key.pem
+sudo chmod 644 /etc/dreb/cert.pem && sudo chmod 600 /etc/dreb/key.pem
+```
+
+Renewal is **manual** — `tailscale cert` certs are Let's Encrypt, 90-day
+lifetime. The dashboard hot-reloads the cert files on change
+(`setSecureContext`), so a renewal that rewrites the files is picked up with
+zero downtime. A daily systemd timer with `--min-validity=720h` (only renews
+when within 30 days of expiry) is the recommended cadence:
+
+```ini
+# /etc/systemd/system/dreb-cert.service
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/tailscale cert --cert-file=/etc/dreb/cert.pem \
+  --key-file=/etc/dreb/key.pem --min-validity=720h hostname.tailXXXX.ts.net
+ExecStartPost=/bin/chown dreb:dreb /etc/dreb/cert.pem /etc/dreb/key.pem
+
+# /etc/systemd/system/dreb-cert.timer
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=3600
+[Install]
+WantedBy=timers.target
+```
+
+Then open `https://hostname.tailXXXX.ts.net:<port>` on the phone.
+
+> **Hostname note (important):** the `tailscale cert` certificate is issued
+> for your machine's tailnet name (`hostname.tailXXXX.ts.net`) **only** — not
+> `127.0.0.1`, not a raw tailnet IP. When `--https` is enabled the server
+> speaks TLS on every address it binds, so on the host itself:
+>
+> - `https://hostname.tailXXXX.ts.net:<port>` — works, cert validates (resolves
+>   to your tailnet IP). But it's a *remote* request: you go through the full
+>   Tailscale allowlist + pairing flow, not instant loopback local mode.
+> - `https://127.0.0.1:<port>` — the server answers, but the browser rejects
+>   the cert (no `127.0.0.1` SAN) with a scary warning.
+> - `http://127.0.0.1:<port>` — **dead**: the server only speaks TLS now.
+>
+> If you want the host dashboard tab to stay instant (loopback local mode, no
+> pairing, no warning), run a **second** dashboard process without `--https` on
+> a different port for local-only use, and keep the TLS-enabled one for remote.
+> `--https` is primarily for the `--remote` path; pure-local setups don't need
+> it (`127.0.0.1` is already a secure context).
 
 ## Subagent observability
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@dreb/coding-agent",
-	"version": "2.35.0",
+	"version": "2.36.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"type": "module",
 	"drebConfig": {

package/skills/mach6-implement/SKILL.md

@@ -18,7 +18,7 @@ This skill has two modes:
 2. **No `#N` in comment bodies** — Use "finding 3", "item 3" etc. instead.
 3. **Safe git** — Never use `git add -A` or `git add .`. Stage files by name. Never stage secrets.
 4. **Task tracking** — Use the `tasks_update` tool to show progress.
-5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 ## Step 1: Parse input
 

package/skills/mach6-issue/SKILL.md

@@ -16,7 +16,7 @@ argument-hint: "[issue-number | description]"
 4. **Safe git** — Never use `git add -A` or `git add .`. Stage files by name. Never stage secrets (.env, credentials, tokens, keys).
 5. **Task tracking** — Use the `tasks_update` tool to show progress through multi-step commands.
 6. **Project conventions** — Check for CLAUDE.md, AGENTS.md, .dreb/CONTEXT.md, and CONTRIBUTING.md before planning or implementing.
-7. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+7. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 ## Determine Mode
 
@@ -76,7 +76,8 @@ Present to the user:
 Post as an issue comment:
 
 ```bash
-cat > /tmp/gh-comment.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <!-- mach6-assessment -->
 ## Issue Assessment
 
@@ -85,7 +86,7 @@ cat > /tmp/gh-comment.md << 'MACH6_EOF'
 ---
 *Automated assessment by mach6*
 MACH6_EOF
-gh issue comment <number> --body-file /tmp/gh-comment.md
+gh issue comment <number> --body-file "$GH_BODY"
 ```
 
 Update task: post → completed.
@@ -127,10 +128,11 @@ Present the draft to the user for approval.
 ### Step 3: Create the issue
 
 ```bash
-cat > /tmp/gh-body.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-body.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <body>
 MACH6_EOF
-gh issue create --title "<title>" --body-file /tmp/gh-body.md [--label "<labels>"]
+gh issue create --title "<title>" --body-file "$GH_BODY" [--label "<labels>"]
 ```
 
 Report the issue number and URL. Suggest next step: `/skill:mach6-plan <number>`

package/skills/mach6-plan/SKILL.md

@@ -18,7 +18,7 @@ This command is strictly for **planning**. Do NOT implement any code changes —
 4. **Safe git** — Never use `git add -A` or `git add .`. Stage files by name. Never stage secrets.
 5. **Task tracking** — Use the `tasks_update` tool to show progress through multi-step commands.
 6. **Project conventions** — Check for CLAUDE.md, AGENTS.md, .dreb/CONTEXT.md, and CONTRIBUTING.md before planning.
-7. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+7. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 ## Step 1: Set up task tracking
 
@@ -98,14 +98,15 @@ git commit --allow-empty -m "chore: open PR for issue <N>"
 git push -u origin feature/issue-<N>-<slug>
 
 # Open draft PR
-cat > /tmp/gh-body.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-body.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 Closes #<N>
 
 <brief description>
 
 Implementation plan posted as a comment below.
 MACH6_EOF
-gh pr create --draft --title "<title>" --body-file /tmp/gh-body.md
+gh pr create --draft --title "<title>" --body-file "$GH_BODY"
 ```
 
 Update task: branch → completed, post → in_progress.
@@ -113,7 +114,8 @@ Update task: branch → completed, post → in_progress.
 ## Step 7: Post plan to PR
 
 ```bash
-cat > /tmp/gh-comment.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <!-- mach6-plan -->
 ## Implementation Plan
 
@@ -122,7 +124,7 @@ cat > /tmp/gh-comment.md << 'MACH6_EOF'
 ---
 *Plan created by mach6*
 MACH6_EOF
-gh pr comment <pr-number> --body-file /tmp/gh-comment.md
+gh pr comment <pr-number> --body-file "$GH_BODY"
 ```
 
 Update task: post → completed.

package/skills/mach6-publish/SKILL.md

@@ -14,7 +14,7 @@ argument-hint: "<pr-number>"
 2. **No `#N` in comment bodies** — Use "finding 3", "item 3" etc. instead.
 3. **Safe git** — Never use `git add -A` or `git add .`. Stage files by name. Never stage secrets.
 4. **Task tracking** — Use the `tasks_update` tool to show progress.
-5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 ## Step 1: Set up task tracking
 
@@ -181,10 +181,11 @@ git push --tags
 
 3. Present draft to user for approval, then create:
    ```bash
-   cat > /tmp/gh-release-notes.md << 'MACH6_EOF'
+   GH_NOTES="$(mktemp /tmp/gh-release-notes.XXXXXX.md)"
+   cat > "$GH_NOTES" << 'MACH6_EOF'
    <release-notes>
    MACH6_EOF
-   gh release create v<version> --title "v<version>" --notes-file /tmp/gh-release-notes.md
+   gh release create v<version> --title "v<version>" --notes-file "$GH_NOTES"
    ```
 
 Update task: release → completed.

package/skills/mach6-push/SKILL.md

@@ -15,7 +15,7 @@ argument-hint: "[commit message]"
 3. **No `#N` in comment bodies** — Use "finding 3", "item 3", "stage 2" etc. instead.
 4. **Safe git** — Never use `git add -A` or `git add .`. Stage files by name. Never stage secrets (.env, credentials, tokens, keys).
 5. **Task tracking** — Use the `tasks_update` tool to show progress.
-6. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+6. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 ## Step 1: Set up task tracking
 
@@ -81,7 +81,8 @@ If session context points to an issue but a PR also exists on the current branch
 
 Post a progress comment:
 ```bash
-cat > /tmp/gh-comment.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <!-- mach6-progress -->
 ## Progress Update
 
@@ -92,7 +93,7 @@ cat > /tmp/gh-comment.md << 'MACH6_EOF'
 ---
 *Progress tracked by mach6*
 MACH6_EOF
-gh pr comment <number> --body-file /tmp/gh-comment.md
+gh pr comment <number> --body-file "$GH_BODY"
 ```
 
 Update task: comment → completed.

package/skills/mach6-review/SKILL.md

@@ -14,7 +14,7 @@ argument-hint: "<pr-number> [code|errors|tests|completeness|simplify]"
 2. **HTML markers** — Use `<!-- mach6-review -->` and `<!-- mach6-assessment -->` as the first line of comment bodies.
 3. **No `#N` in comment bodies** — Use "finding 3", "item 3", "stage 2" etc. instead.
 4. **Task tracking** — Use the `tasks_update` tool to show progress.
-5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks.
+5. **Non-interactive `gh`** — Set `GH_PAGER=cat` and `GH_EDITOR=cat` before all `gh` commands to prevent interactive prompts from hanging the agent. Use `--body-file` instead of inline `--body` for all `gh pr comment`, `gh pr create`, and `gh issue create` calls to avoid shell interpretation of backticks. Write each body to a **unique per-invocation temp file** via `mktemp` (e.g. `GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"`) — never a fixed path like `/tmp/gh-comment.md`, which concurrent mach6 sessions on the same machine would clobber, cross-posting one session's body to another's PR/issue.
 
 **Important: Do NOT fix any issues in this session. Fixes happen via `/skill:mach6-implement`.**
 
@@ -96,7 +96,8 @@ Update task: review → completed, post-review → in_progress.
 Compile all findings from all agents into a single structured comment:
 
 ```bash
-cat > /tmp/gh-comment.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <!-- mach6-review -->
 ## Code Review
 
@@ -117,7 +118,7 @@ cat > /tmp/gh-comment.md << 'MACH6_EOF'
 ---
 *Reviewed by mach6*
 MACH6_EOF
-gh pr comment <pr-number> --body-file /tmp/gh-comment.md
+gh pr comment <pr-number> --body-file "$GH_BODY"
 ```
 
 Save the review comment URL:
@@ -156,7 +157,8 @@ Update task: assess → completed, post-assess → in_progress.
 ## Step 7: Post assessment
 
 ```bash
-cat > /tmp/gh-comment.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-comment.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <!-- mach6-assessment -->
 ## Review Assessment
 
@@ -175,7 +177,7 @@ cat > /tmp/gh-comment.md << 'MACH6_EOF'
 ---
 *Assessment by mach6*
 MACH6_EOF
-gh pr comment <pr-number> --body-file /tmp/gh-comment.md
+gh pr comment <pr-number> --body-file "$GH_BODY"
 ```
 
 Update task: post-assess → completed, summary → in_progress.
@@ -189,10 +191,11 @@ Present to the user:
 
 If any findings were classified as **deferred**, ask the user if they want to create issues for them:
 ```bash
-cat > /tmp/gh-body.md << 'MACH6_EOF'
+GH_BODY="$(mktemp /tmp/gh-body.XXXXXX.md)"
+cat > "$GH_BODY" << 'MACH6_EOF'
 <body referencing PR and finding>
 MACH6_EOF
-gh issue create --title "<title>" --body-file /tmp/gh-body.md
+gh issue create --title "<title>" --body-file "$GH_BODY"
 ```
 
 Update task: summary → completed.