@elu-labs/elu 0.0.0-stage → 0.1.0

package/lib/sandbox.mjs

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { findBin, refuse, mkdir, noSymlinks } from './util.mjs';
+import { assertNoCodexProjectConfig } from './policy.mjs';
+import { agentEnv, runProcess } from './process.mjs';
+import os from 'node:os';
+import net from 'node:net';
+import { spawnSync } from 'node:child_process';
+
+// Whether Claude Code's shell sandbox can start on this machine. On Linux it is bubblewrap: it
+// needs bwrap and socat on PATH, and bwrap must be allowed to make its namespaces, which
+// Ubuntu 24.04 stops until an AppArmor profile for it is loaded (docs/permissions.md, Linux).
+// 'missing': a tool is not installed. 'blocked': both are, and bwrap cannot start. 'ok'
+// otherwise, and on every other system, where nothing is started. bwrap is really started,
+// once, around a command that does nothing, so ask once per app start and keep the answer.
+export function shellSandbox({ platform = process.platform, env = process.env } = {}) {
+  if (platform !== 'linux') return 'ok';
+  const bwrap = findBin('bwrap', env);
+  if (!bwrap || !findBin('socat', env)) return 'missing';
+  const started = spawnSync(bwrap, ['--unshare-net', '--ro-bind', '/', '/', '/bin/sh', '-c', ':'], { env, stdio: 'ignore', timeout: 5000 });
+  return started.status === 0 ? 'ok' : 'blocked';
+}
+// What the Permissions picker says about it: nothing where the sandbox works.
+export function shellSandboxLine(state = shellSandbox()) {
+  if (state === 'missing') return ['No OS sandbox here: commands ask you (Ask) or are reviewed (Approve for me).'];
+  if (state === 'blocked') return ['The OS sandbox cannot start here, so commands ask you (Ask) or are reviewed (Approve for me). See https://github.com/ELU-Labs/elu/blob/main/docs/permissions.md#linux'];
+  return [];
+}
+
+// The helper is the one program started outside the sandbox, so only the owner's own
+// environment names it. A project's settings file comes with the repository and never does.
+export function findSandboxHelper(config={},env=process.env){
+  const configured=env.ELU_CODE_SANDBOX_HELPER;
+  if(configured){
+    if(!path.isAbsolute(configured))refuse('The sandbox helper path must be absolute.');
+    try{fs.accessSync(configured,fs.constants.X_OK);if(fs.statSync(configured).isFile())return fs.realpathSync(configured);}catch{}
+    refuse('The configured sandbox helper is missing or not executable.');
+  }
+  const bin=findBin('codex',env);if(!bin)refuse('Install the Codex sandbox helper, or set ELU_CODE_SANDBOX_HELPER to its absolute path.');return bin;
+}
+export async function probeSandbox(config={}){
+  const helper=findSandboxHelper(config);
+  const root=fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(),'elu-code-sandbox-proof-')));
+  const cwd=path.join(root,'worktree');mkdir(cwd);const home=path.join(root,'home');mkdir(home);
+  mkdir(path.join(home,'.codex'));mkdir(path.join(home,'.config'));
+  const outside=path.join(root,'outside');const server=net.createServer(socket=>socket.end('probe'));
+  await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve));
+  const script=`const fs=require('fs'),net=require('net');fs.writeFileSync('allowed','yes');let writeDenied=false;try{fs.writeFileSync(${JSON.stringify(outside)},'bad')}catch{writeDenied=true}const socket=net.connect(${server.address().port},'127.0.0.1');const done=(networkDenied)=>{socket.destroy();console.log(JSON.stringify({writeDenied,networkDenied}));};socket.once('error',()=>done(true));socket.once('connect',()=>done(false));socket.setTimeout(1500,()=>done(false));`;
+  try{
+    const run=await sandboxRun({cwd,helper,program:process.execPath,args:['-e',script,'elu-code-sandbox-probe'],logFile:path.join(root,'probe.log'),timeoutSeconds:10,env:{HOME:home,CODEX_HOME:path.join(home,'.codex'),XDG_CONFIG_HOME:path.join(home,'.config')}});
+    let proof;try{proof=JSON.parse(fs.readFileSync(path.join(root,'probe.log'),'utf8').trim());}catch{}
+    if(run.code!==0||run.timedOut||typeof proof?.writeDenied!=='boolean'||!proof?.networkDenied||fs.existsSync(outside))refuse('The sandbox helper failed its file-write or network test. Nothing was started.',{exitCode:run.code,proof:proof??null,diagnostic:fs.readFileSync(run.stderrFile,'utf8').slice(-1500)});
+    return {available:true,working:true,writeDenied:proof.writeDenied,outsideWriteContained:true,networkDenied:true,requiresSignIn:false};
+  }finally{await new Promise(resolve=>server.close(resolve));fs.rmSync(root,{recursive:true,force:true});}
+}
+
+// This uses the vendor's sandbox helper. It never supplies a sandbox implementation.
+// network: 'off' (every other check) or 'on' (checks of a Full access session).
+export function sandboxArgs({ cwd, protectedPaths = [], writablePaths = ['.'], scratch, program, args = [], readPaths = [], deniedPaths=[], helper=findBin('codex'), network = 'off' }) {
+  if (!['off', 'on'].includes(network)) refuse('Network is off or on.');
+  const name = `elu_code_${crypto.randomBytes(8).toString('hex')}`;
+  const filesystem = { ':minimal': 'read', [cwd]: 'read' };
+  for (const folder of ['/tmp','/private/tmp','/var/tmp','/private/var/tmp']) filesystem[folder]='deny';
+  for (const file of writablePaths) filesystem[path.resolve(cwd, file)] = 'write';
+  for (const file of protectedPaths) filesystem[path.resolve(cwd, file)] = 'read';
+  if(fs.existsSync(path.join(cwd,'.git')))filesystem[path.join(cwd, '.git')] = 'deny';
+  for (const file of readPaths) filesystem[file] = 'read';
+  for (const file of ['.env', '.env.*', '**/.env', '**/.env.*', '**/.npmrc', '**/auth.json', '**/credentials.json', '**/*.pem']) filesystem[path.join(cwd, file)] = 'deny';
+  if (scratch) filesystem[scratch] = 'write';
+  const runtime = path.dirname(fs.realpathSync(process.execPath));
+  filesystem[runtime] = 'read';
+  const executable = path.isAbsolute(program) ? program : findBin(program);
+  if (!executable) refuse(`Check program is not installed: ${program}`);
+  for(const file of [executable,helper].filter(Boolean)){
+    let executableRoot = path.dirname(fs.realpathSync(file));
+    const modulePart = executableRoot.indexOf(`${path.sep}node_modules${path.sep}`);
+    if (modulePart >= 0) {
+      const prefix = executableRoot.slice(0, modulePart + '/node_modules/'.length);
+      const pieces = executableRoot.slice(prefix.length).split(path.sep);
+      executableRoot = path.join(prefix, ...pieces.slice(0, pieces[0].startsWith('@') ? 2 : 1));
+    }
+    filesystem[executableRoot] = 'read';
+  }
+  for(const file of deniedPaths)filesystem[file]='deny';
+  const entries = Object.entries(filesystem).map(([key, access]) => `${JSON.stringify(key)}=${JSON.stringify(access)}`).join(',');
+  const profile = `{filesystem={${entries}},network={enabled=${network === 'on'}}}`;
+  return ['sandbox', '-P', name, '-c', `permissions.${name}=${profile}`, '-c', 'features.hooks=false', '-c', 'shell_environment_policy.inherit="all"', '-c', 'shell_environment_policy.set.OPENSSL_CONF="/dev/null"', '--', program, ...args];
+}
+export async function sandboxRun({ cwd, protectedPaths, writablePaths, scratch, program, args, logFile, processFile, timeoutSeconds = 120, env: extraEnv = {}, readPaths, helper, config, signal, network = 'off' }) {
+  const bin = helper??findSandboxHelper(config);
+  assertNoCodexProjectConfig(cwd);
+  const ownedScratch=!scratch;
+  scratch ??= path.join(cwd,'.elu-code','tmp',crypto.randomUUID());
+  noSymlinks(scratch); mkdir(scratch);
+  const helperHome=path.join(scratch,'codex-home');mkdir(helperHome);
+  const temporary=path.join(scratch,'tmp');mkdir(temporary);
+  const globalConfig = path.join(scratch ?? cwd, 'global.npmrc');
+  const env = { ...agentEnv(), ...extraEnv, CODEX_HOME:helperHome, OPENSSL_CONF: '/dev/null', npm_config_userconfig: '/dev/null', npm_config_globalconfig: globalConfig, npm_config_script_shell: '/bin/sh', npm_config_update_notifier: 'false', npm_config_audit: 'false', npm_config_fund: 'false', TMPDIR:temporary, npm_config_cache: path.join(scratch, 'npm-cache') };
+  try { return await runProcess({ bin, args: sandboxArgs({ cwd, protectedPaths, writablePaths, scratch, program, args, readPaths, helper:bin, network }), cwd, env, logFile, processFile, timeoutSeconds, signal }); }
+  finally { if(ownedScratch)fs.rmSync(scratch,{recursive:true,force:true}); }
+}

package/lib/schedules.mjs

@@ -0,0 +1,270 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { atomic, cleanPath, mkdir, noSymlinks, readJson, refuse } from './util.mjs';
+import { isInstalled, BY_HAND } from './install.mjs';
+import { waitLock } from './state.mjs';
+import { personalDirectory } from './usage.mjs';
+import { enqueue, startConductor } from './conductor.mjs';
+import { pendingRequests } from './workspace.mjs';
+import { MODES, checkMode } from './modes.mjs';
+import { checkModel } from './models.mjs';
+import { unitArgument, unitEnvironment } from './unit-file.mjs';
+
+// Schedules send a message to a project's lead at set times. Each run is a queued
+// request, like a message typed in Tasks, so it ends at "ready" and nothing is pushed.
+// A login item checks every minute, so runs happen while the computer is awake even
+// with ELU Code closed. Times are the computer's local time.
+
+const FULL_DAYS = ['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'];
+const DAY_NAMES = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+const MIN_EVERY = 15, MAX_EVERY = 7 * 24 * 60;
+export const WHEN_HELP = 'Examples:  daily 9:00   weekdays 9am   mon,thu 14:30   every 2h   tomorrow 15:00   2026-12-01 9:00';
+
+const file = () => path.join(personalDirectory(), 'schedules.json');
+const pad = value => String(value).padStart(2, '0');
+export const clockText = (hour, minute) => `${hour}:${pad(minute)}`;
+
+function parseTime(word) {
+  const match = /^(\d{1,2})(?::(\d{2}))?(am|pm)?$/.exec(word ?? '');
+  if (!match) return null;
+  let hour = Number(match[1]); const minute = match[2] ? Number(match[2]) : 0, half = match[3];
+  if (minute > 59) return null;
+  if (half) { if (hour < 1 || hour > 12) return null; hour = hour % 12 + (half === 'pm' ? 12 : 0); }
+  else if (hour > 23) return null;
+  return { hour, minute };
+}
+function parseDays(word) {
+  const days = new Set();
+  for (const part of word.split(',').filter(Boolean)) {
+    const range = part.split('-');
+    const index = name => name.length >= 3 ? FULL_DAYS.findIndex(day => day.startsWith(name)) : -1;
+    if (range.length === 2) {
+      const from = index(range[0]), to = index(range[1]); if (from < 0 || to < 0) return null;
+      for (let day = from; ; day = (day + 1) % 7) { days.add(day); if (day === to) break; }
+    } else { const day = index(part); if (day < 0) return null; days.add(day); }
+  }
+  return days.size ? [...days].sort((a, b) => a - b) : null;
+}
+function duration(count, unit) {
+  const value = Number(count);
+  if (/^(m|min|mins|minute|minutes)$/.test(unit)) return value;
+  if (/^(h|hr|hrs|hour|hours)$/.test(unit)) return value * 60;
+  if (/^(d|day|days)$/.test(unit)) return value * 24 * 60;
+  return null;
+}
+// Reads "daily 9:00", "weekdays 9am", "mon,thu 14:30", "every 2h", "in 30m",
+// "tomorrow 15:00" or "2026-12-01 9:00". "now" or nothing means not scheduled.
+export function parseWhen(text, now = new Date()) {
+  const value = String(text ?? '').trim().toLowerCase().replace(/\s+(am|pm)\b/g, '$1').replace(/\b(at|on)\b/g, ' ').replace(/,\s+/g, ',').replace(/\s+/g, ' ').trim();
+  if (!value || value === 'now') return null;
+  const fail = () => refuse(`Could not read "${String(text).trim()}" as a time. ${WHEN_HELP}`);
+  if (value === 'hourly') return describe({ kind: 'every', minutes: 60 });
+  let match = /^every (\d+) ?([a-z]+)$/.exec(value);
+  if (match) {
+    const minutes = duration(match[1], match[2]); if (minutes === null) fail();
+    if (minutes < MIN_EVERY || minutes > MAX_EVERY) refuse(`Choose every 15m to every 7d.`);
+    return describe({ kind: 'every', minutes });
+  }
+  match = /^in (\d+) ?([a-z]+)$/.exec(value);
+  if (match) {
+    const minutes = duration(match[1], match[2]); if (minutes === null || minutes < 1) fail();
+    return describe({ kind: 'once', at: new Date(now.getTime() + minutes * 60000).toISOString() });
+  }
+  const words = value.replace(/^(every|each) /, '').split(' ');
+  const time = parseTime(words.at(-1)), head = words.slice(0, -1).join(' ');
+  if (!time) { if (words.length === 1 && (parseDays(words[0]) || ['daily', 'day', 'weekdays', 'weekday', 'weekends', 'today', 'tomorrow'].includes(words[0]))) refuse(`Add a time, for example ${words[0]} 9:00.`); fail(); }
+  if (!head || ['daily', 'day', 'everyday'].includes(head)) return describe({ kind: 'days', days: [0, 1, 2, 3, 4, 5, 6], ...time });
+  if (['weekdays', 'weekday'].includes(head)) return describe({ kind: 'days', days: [1, 2, 3, 4, 5], ...time });
+  if (['weekends', 'weekend'].includes(head)) return describe({ kind: 'days', days: [0, 6], ...time });
+  const once = date => {
+    if (date <= now) refuse('That time has passed. Choose a later one.');
+    return describe({ kind: 'once', at: date.toISOString() });
+  };
+  if (head === 'today' || head === 'tomorrow') return once(new Date(now.getFullYear(), now.getMonth(), now.getDate() + (head === 'tomorrow' ? 1 : 0), time.hour, time.minute));
+  match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(head);
+  if (match) {
+    const date = new Date(Number(match[1]), Number(match[2]) - 1, Number(match[3]), time.hour, time.minute);
+    if (date.getMonth() !== Number(match[2]) - 1) fail();
+    return once(date);
+  }
+  const days = parseDays(head.replace(/ /g, ',')); if (!days) fail();
+  return describe({ kind: 'days', days, ...time });
+}
+function describe(spec) {
+  let label;
+  if (spec.kind === 'every') label = spec.minutes % 1440 === 0 ? `every ${spec.minutes / 1440}d` : spec.minutes % 60 === 0 ? `every ${spec.minutes / 60}h` : `every ${spec.minutes}m`;
+  else if (spec.kind === 'once') label = `once ${dateText(new Date(spec.at))}`;
+  else {
+    const key = spec.days.join(), at = clockText(spec.hour, spec.minute);
+    label = key === '0,1,2,3,4,5,6' ? `daily ${at}` : key === '1,2,3,4,5' ? `weekdays ${at}` : key === '0,6' ? `weekends ${at}` : `every ${spec.days.map(day => DAY_NAMES[day]).join(', ')} ${at}`;
+  }
+  return { ...spec, label };
+}
+export function dateText(date) { return `${DAY_NAMES[date.getDay()]} ${MONTHS[date.getMonth()]} ${date.getDate()} ${clockText(date.getHours(), date.getMinutes())}`; }
+// The first run strictly after `after`, or null when a one-time run has passed.
+export function nextRun(spec, after = new Date()) {
+  if (spec.kind === 'every') return new Date(after.getTime() + spec.minutes * 60000);
+  if (spec.kind === 'once') { const at = new Date(spec.at); return at > after ? at : null; }
+  for (let offset = 0; offset <= 8; offset++) {
+    const date = new Date(after.getFullYear(), after.getMonth(), after.getDate() + offset, spec.hour, spec.minute);
+    if (date > after && spec.days.includes(date.getDay())) return date;
+  }
+  return null;
+}
+// "in 25m", "in 3h", "Tue 9:00": short enough for the Tasks clock column where possible.
+export function untilText(value, now = Date.now()) {
+  const at = Date.parse(value); if (!Number.isFinite(at)) return '-';
+  const minutes = Math.max(0, Math.round((at - now) / 60000));
+  if (minutes < 60) return `in ${minutes}m`;
+  if (minutes < 24 * 60) return `in ${Math.round(minutes / 60)}h`;
+  return `in ${Math.round(minutes / 1440)}d`;
+}
+
+function validWhen(spec) {
+  if (spec?.kind === 'every') return Number.isInteger(spec.minutes) && spec.minutes >= MIN_EVERY && spec.minutes <= MAX_EVERY;
+  if (spec?.kind === 'once') return Number.isFinite(Date.parse(spec.at));
+  return spec?.kind === 'days' && Array.isArray(spec.days) && spec.days.length && spec.days.every(day => Number.isInteger(day) && day >= 0 && day <= 6) && Number.isInteger(spec.hour) && spec.hour >= 0 && spec.hour <= 23 && Number.isInteger(spec.minute) && spec.minute >= 0 && spec.minute <= 59;
+}
+function readAll() {
+  const target = file(); noSymlinks(target);
+  if (!fs.existsSync(target)) return [];
+  const value = readJson(target);
+  if (!Array.isArray(value?.schedules)) refuse('The schedule file could not be read.');
+  return value.schedules.filter(row => typeof row?.id === 'string' && typeof row.root === 'string' && typeof row.goal === 'string' && validWhen(row.when));
+}
+let cache = { stamp: null, rows: [] };
+// Read on every Tasks redraw, so a file that has not changed is not parsed again.
+export function listSchedules() {
+  let stamp = null; try { const stat = fs.statSync(file()); stamp = `${stat.mtimeMs}:${stat.size}`; } catch { return []; }
+  if (stamp !== cache.stamp) { try { cache = { stamp, rows: readAll() }; } catch { cache = { stamp, rows: [] }; } }
+  return cache.rows;
+}
+function change(edit) {
+  mkdir(personalDirectory());
+  const release = waitLock({ state: personalDirectory() }, 'schedules', 200);
+  try { const rows = readAll(), result = edit(rows); atomic(file(), { version: 1, schedules: rows }); return result; }
+  finally { release(); }
+}
+// permissions: the mode each run gets, ask or auto; a schedule never runs with Full access.
+// model: the model each run starts on, { vendor, model }; without one, the project's default at that time.
+export function saveSchedule({ root, project, goal, when, permissions, model }, now = new Date()) {
+  if (typeof goal !== 'string' || !goal.trim() || goal.length > 16000) refuse('Enter a task of 1 to 16000 characters.');
+  if (!validWhen(when)) refuse(`Choose when it runs. ${WHEN_HELP}`);
+  const mode = permissions === undefined || permissions === null ? null : checkMode(permissions, { allowFull: false });
+  const next = nextRun(when, now); if (!next) refuse('That time has passed. Choose a later one.');
+  const row = { id: `schedule-${crypto.randomUUID().slice(0, 8)}`, root, project: project ?? path.basename(root), goal, when: describe(when), enabled: true, createdAt: now.toISOString(), nextRunAt: next.toISOString(), lastRunAt: null, lastRequestId: null, lastTaskId: null, runs: 0, note: null, permissions: mode, ...(model ? { model: checkModel(model) } : {}) };
+  return change(rows => { if (rows.length >= 50) refuse('Keep at most 50 schedules.'); rows.push(row); return row; });
+}
+export function removeSchedule(id) {
+  return change(rows => { const index = rows.findIndex(row => row.id === id); if (index < 0) refuse('That schedule no longer exists.'); rows.splice(index, 1); return rows.length; });
+}
+export function pauseSchedule(id, paused, now = new Date()) {
+  return change(rows => {
+    const row = rows.find(value => value.id === id); if (!row) refuse('That schedule no longer exists.');
+    if (!paused) { const next = nextRun(row.when, now); if (!next) refuse('That one-time run has passed. Delete it and schedule a new one.'); row.nextRunAt = next.toISOString(); }
+    row.enabled = !paused; row.note = null; return row;
+  });
+}
+// The run's task number, once the conductor has started it. Requests are deleted two
+// minutes after they finish, so the schedule keeps the number itself.
+function settle(row) {
+  if (!row.lastRequestId || row.lastTaskId) return;
+  try { const request = pendingRequests(row.root).find(value => value.id === row.lastRequestId); if (request?.taskId) row.lastTaskId = String(request.taskId); } catch { /* Read next time. */ }
+}
+function fire(row, at) {
+  if (!fs.existsSync(row.root)) { row.note = 'The project folder is missing.'; return false; }
+  let pending = null; try { pending = pendingRequests(row.root).find(value => value.scheduleId === row.id && value.state !== 'done'); } catch { /* Treated as none. */ }
+  if (pending) { row.note = `Skipped ${dateText(at)}: the last run is ${pending.state}.`; return false; }
+  const request = enqueue(row.root, row.goal, { priority: 1, scheduleId: row.id, ...(MODES.includes(row.permissions) && row.permissions !== 'full' ? { permissions: row.permissions } : {}), ...(row.model ? { model: row.model } : {}) });
+  Object.assign(row, { lastRequestId: request.id, lastTaskId: null, lastRunAt: at.toISOString(), runs: row.runs + 1, note: null });
+  return true;
+}
+// Queues every schedule that is due. A computer that slept through several runs gets
+// one, then the next time is counted from now.
+export function runDue(now = new Date(), { start = startConductor } = {}) {
+  if (!fs.existsSync(file())) return 0;
+  const fired = change(rows => {
+    let count = 0;
+    for (const row of rows) {
+      settle(row);
+      if (!row.enabled || !(Date.parse(row.nextRunAt) <= now.getTime())) continue;
+      try { if (fire(row, now)) count++; } catch (error) { row.note = error.message; }
+      const next = nextRun(row.when, now);
+      if (row.when.kind === 'once' || !next) Object.assign(row, { enabled: false, nextRunAt: null }); else row.nextRunAt = next.toISOString();
+    }
+    return count;
+  });
+  if (fired) start();
+  return fired;
+}
+export function runScheduleNow(id, now = new Date(), { start = startConductor } = {}) {
+  const ok = change(rows => { const row = rows.find(value => value.id === id); if (!row) refuse('That schedule no longer exists.'); settle(row); if (!fire(row, now)) refuse(row.note); return true; });
+  if (ok) start();
+  return ok;
+}
+
+// Login item: runs `elu schedule tick` every minute. run(bin, args) loads it;
+// tests pass their own, and the real one refuses inside the test runner.
+const LABEL = 'dev.elu-code.scheduler';
+const xml = value => String(value).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+const runDefault = (bin, args, { allowFailure = false } = {}) => {
+  const result = spawnSync(bin, args, { encoding: 'utf8', timeout: 15000 });
+  if (result.status !== 0 && !allowFailure) refuse(`${bin} could not load the scheduler: ${(result.stderr || result.error?.message || '').trim().slice(0, 200)}`);
+};
+// Session folders (such as a terminal's own shims under the temp folder) vanish later.
+function keptPath(value = '') {
+  const temp = [os.tmpdir(), fs.realpathSync.native?.(os.tmpdir()) ?? os.tmpdir()];
+  return cleanPath(value).split(path.delimiter).filter(entry => entry && path.isAbsolute(entry) && !temp.some(root => entry.startsWith(root))).join(path.delimiter);
+}
+export function schedulerFiles({ platform = process.platform, home = os.homedir(), env = process.env } = {}) {
+  if (platform === 'darwin') return [path.join(home, 'Library', 'LaunchAgents', `${LABEL}.plist`)];
+  if (platform === 'linux') { const dir = path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), 'systemd', 'user'); return [path.join(dir, 'elu-code-scheduler.service'), path.join(dir, 'elu-code-scheduler.timer')]; }
+  return [];
+}
+const guard = run => { if (run === runDefault && process.env.NODE_TEST_CONTEXT) refuse('Tests must not install login items.'); };
+export function installScheduler({ platform = process.platform, home = os.homedir(), env = process.env, run = runDefault, lasting = isInstalled({ env, home }) } = {}) {
+  guard(run);
+  const files = schedulerFiles({ platform, home, env });
+  if (!files.length) return { installed: false, reason: 'Schedules run only while ELU Code is open on this system.' };
+  // A login item names this copy's files, so it is written only by the installed command. A
+  // copy a package runner fetched (npx and the like) sits in a cache that gets cleared.
+  if (!lasting) return { installed: false, reason: `Schedules run only while ELU Code is open until it is installed: ${BY_HAND}` };
+  const args = [process.execPath, fileURLToPath(new URL('../bin/elu-code.mjs', import.meta.url)), 'schedule', 'tick'];
+  const keep = Object.fromEntries([['PATH', keptPath(env.PATH)], ...['HOME', 'XDG_CONFIG_HOME', 'LANG', 'USER', 'LOGNAME', 'SHELL'].map(name => [name, env[name]])].filter(([, value]) => value));
+  let contents;
+  if (platform === 'darwin') {
+    const log = path.join(personalDirectory(), 'scheduler.log');
+    contents = [`<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${LABEL}</string>\n  <key>ProgramArguments</key><array>${args.map(arg => `<string>${xml(arg)}</string>`).join('')}</array>\n  <key>StartInterval</key><integer>60</integer>\n  <key>RunAtLoad</key><true/>\n  <key>ProcessType</key><string>Background</string>\n  <key>EnvironmentVariables</key><dict>${Object.entries(keep).map(([key, value]) => `<key>${xml(key)}</key><string>${xml(value)}</string>`).join('')}</dict>\n  <key>StandardOutPath</key><string>${xml(log)}</string>\n  <key>StandardErrorPath</key><string>${xml(log)}</string>\n</dict>\n</plist>\n`];
+  } else {
+    contents = [`[Unit]\nDescription=ELU Code schedules\n\n[Service]\nType=oneshot\nExecStart=${args.map(unitArgument).join(' ')}\n${Object.entries(keep).map(([key, value]) => unitEnvironment(key, value)).join('\n')}\n`,
+      `[Unit]\nDescription=Check ELU Code schedules every minute\n\n[Timer]\nOnCalendar=*-*-* *:*:00\nAccuracySec=10s\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n`];
+  }
+  const same = files.every((target, index) => { try { noSymlinks(target); return fs.readFileSync(target, 'utf8') === contents[index]; } catch { return false; } });
+  if (same) return { installed: true, changed: false, files };
+  for (const [index, target] of files.entries()) { mkdir(path.dirname(target)); atomic(target, contents[index]); }
+  if (platform === 'darwin') {
+    const domain = `gui/${process.getuid()}`;
+    run('launchctl', ['bootout', domain, files[0]], { allowFailure: true });
+    run('launchctl', ['bootstrap', domain, files[0]]);
+  } else {
+    run('systemctl', ['--user', 'daemon-reload']);
+    run('systemctl', ['--user', 'enable', '--now', 'elu-code-scheduler.timer']);
+  }
+  return { installed: true, changed: true, files };
+}
+export function uninstallScheduler({ platform = process.platform, home = os.homedir(), env = process.env, run = runDefault } = {}) {
+  guard(run);
+  const files = schedulerFiles({ platform, home, env }).filter(target => { noSymlinks(target); return fs.existsSync(target); });
+  if (!files.length) return { removed: false };
+  try {
+    if (platform === 'darwin') run('launchctl', ['bootout', `gui/${process.getuid()}`, files[0]], { allowFailure: true });
+    else run('systemctl', ['--user', 'disable', '--now', 'elu-code-scheduler.timer'], { allowFailure: true });
+  } catch { /* It may not be loaded; the files still go. */ }
+  for (const target of files) fs.rmSync(target, { force: true });
+  return { removed: true, files };
+}

package/lib/selection.mjs

@@ -0,0 +1,202 @@
+import { spawn } from 'node:child_process';
+
+// Drag to select and copy, the way a terminal does, kept inside the pane you started in.
+// A double click takes a word, a triple click the row. The copy happens when you let go.
+
+const INVERSE = 8 << 18;
+const ESCAPES = /\x1b\[[\d;]*m/g;
+
+// The cells from a to b in reading order, clamped to the pane: [y, from, to] per row.
+export function spans(rect, a, b) {
+  let [start, end] = a.y < b.y || a.y === b.y && a.x <= b.x ? [a, b] : [b, a];
+  if (start.y < rect.y0) start = { x: rect.x0, y: rect.y0 };
+  if (end.y > rect.y1) end = { x: rect.x1, y: rect.y1 };
+  const rows = [];
+  for (let y = Math.max(start.y, rect.y0); y <= Math.min(end.y, rect.y1); y++) {
+    const from = Math.max(rect.x0, y === start.y ? start.x : rect.x0), to = Math.min(rect.x1, y === end.y ? end.x : rect.x1);
+    if (from <= to) rows.push([y, from, to]);
+  }
+  return rows;
+}
+// The text in those cells. joinAt(y) says how row y joins the one above: '\n', or '' / ' ' at a soft wrap.
+// clean(row) takes out what is drawn beside the text and is not part of it, such as a message's bar.
+export function spanText(lines, rows, joinAt = () => '\n', clean = row => row) {
+  let text = '';
+  rows.forEach(([y, from, to], index) => {
+    const cells = lines[y] ?? [];
+    let row = '';
+    for (let x = from; x <= to && x < cells.length; x++) if (cells[x][1] !== '\x03') row += cells[x][1];
+    text += (index ? joinAt(y) : '') + clean(row).replace(/\s+$/, '');
+  });
+  return text;
+}
+// The word around x in a row of cells, as [from, to].
+export function wordSpan(cells, x, x0, x1) {
+  const solid = at => at >= x0 && at <= x1 && cells[at] && /\S/.test(cells[at][1]) && cells[at][1] !== '\x03' || cells[at]?.[1] === '\x03';
+  if (!solid(x)) return null;
+  let from = x, to = x;
+  while (solid(from - 1)) from--;
+  while (solid(to + 1)) to++;
+  return [from, to];
+}
+
+// The clipboard: pbcopy on macOS, else the terminal's OSC 52. Tests pass their own.
+export function systemClipboard({ write, platform = process.platform } = {}) {
+  const osc = text => write?.(`\x1b]52;c;${Buffer.from(text).toString('base64')}\x07`);
+  return text => {
+    if (platform !== 'darwin') return osc(text);
+    try { const child = spawn('pbcopy', [], { stdio: ['pipe', 'ignore', 'ignore'] }); child.on('error', () => osc(text)); child.stdin.on('error', () => {}); child.stdin.end(text); }
+    catch { osc(text); }
+  };
+}
+
+// The pane a cell belongs to: the deepest element there, or the nearest scrolling or bordered
+// one around it. A scrollbar column is not text.
+function paneAt(screen, x, y) {
+  let found = null;
+  const walk = el => {
+    for (const child of el.children ?? []) {
+      if (child.detached || child.hidden || !child.visible) continue;
+      const pos = child.lpos;
+      if (pos && x >= pos.xi && x < pos.xl && y >= pos.yi && y < pos.yl) found = child;
+      walk(child);
+    }
+  };
+  walk(screen);
+  let pane = found;
+  while (pane && pane !== screen && !pane.selectText && !pane.scrollable && !pane.border) pane = pane.parent;
+  if (!pane || pane === screen || !pane.lpos) return { el: null, rect: { x0: 0, y0: 0, x1: screen.width - 1, y1: screen.height - 1 } };
+  const pos = pane.lpos;
+  return { el: pane, rect: { x0: pos.xi + pane.ileft, y0: pos.yi + pane.itop, x1: pos.xl - 1 - pane.iright - (pane.scrollbar ? 1 : 0), y1: pos.yl - 1 - pane.ibottom } };
+}
+// Rows wrapped by blessed join without a newline; a space dropped at the wrap comes back.
+function joiner(el) {
+  const lines = el?._clines, pos = el?.lpos;
+  if (!lines?.rtof || !pos) return () => '\n';
+  return y => {
+    const row = y - pos.yi - el.itop + (el.childBase || 0);
+    if (row <= 0 || lines.rtof[row] === undefined || lines.rtof[row] !== lines.rtof[row - 1]) return '\n';
+    return /\s$/.test(String(lines[row - 1] ?? '').replace(ESCAPES, '')) ? ' ' : '';
+  };
+}
+
+// The report's button code without the protocol offset: SGR sends it as is; X10, UTF-8 and
+// urxvt add 32. Bit 32 of the code means the mouse moved with a button held (a drag).
+export function buttonCode(data) {
+  if (!data?.raw) return 0;
+  return data.type === 'sgr' ? data.raw[0] : data.raw[0] - 32;
+}
+
+// One mouse report in a form blessed reads: SGR, urxvt, or X10 with three coordinates (in the
+// UTF-8 form a coordinate past 95 is two bytes). Matched on the bytes as latin1 text.
+const REPORT = /\x1b\[<(\d+);\d+;\d+([mM])|\x1b\[(\d+);\d+;\d+M|\x1b\[M((?:[\xc2-\xdf][\x80-\xbf]|[\x00-\xff]){3})/g;
+// The start of a report that the end of a read cut off. No key begins this way.
+const CUT = /\x1b\[<[\d;]*$|\x1b\[M(?:[\xc2-\xdf][\x80-\xbf]|[\x00-\xff]){0,2}$/;
+
+// Splits each read of input into the parts blessed can take one at a time: every mouse report
+// on its own, and the keys between them. blessed reads one report from the start of a read
+// and drops the rest, so a release that arrived with the last drag report was lost, and the
+// drag never ended. Of a run of motion reports only the last is passed on. A report cut by
+// the end of a read waits for the rest of it.
+export function reportSplitter() {
+  let held = Buffer.alloc(0);
+  return chunk => {
+    const fresh = typeof chunk === 'string' ? Buffer.from(chunk) : chunk, data = held.length ? Buffer.concat([held, fresh]) : fresh;
+    held = Buffer.alloc(0);
+    const text = data.toString('latin1'), parts = [];
+    let at = 0, last = null;
+    const keys = to => { if (to > at) { parts.push(data.subarray(at, to)); last = null; } };
+    for (const found of text.matchAll(REPORT)) {
+      keys(found.index);
+      // The button code with the motion bit: SGR and urxvt as sent, X10 less its offset of 32.
+      const code = found[1] !== undefined ? Number(found[1]) : found[3] !== undefined ? Number(found[3]) - 32 : found[4].charCodeAt(0) - 32;
+      const motion = Boolean(code & 32) && found[2] !== 'm' ? code : null;
+      const part = data.subarray(found.index, found.index + found[0].length);
+      if (motion !== null && motion === last) parts[parts.length - 1] = part; else parts.push(part);
+      last = motion; at = found.index + found[0].length;
+    }
+    const cut = text.slice(at).search(CUT);
+    if (cut >= 0) { keys(at + cut); held = Buffer.from(data.subarray(at + cut)); } else keys(text.length);
+    return parts;
+  };
+}
+// Passes every read of the screen's input through reportSplitter, to all that listen to it:
+// blessed's mouse and key readers, and the paste reader. Call it once they are attached.
+export function attachReports(screen) {
+  const input = screen.program.input, readers = input.listeners('data');
+  if (!readers.length) return;
+  const split = reportSplitter(), each = chunk => { for (const part of split(chunk)) for (const reader of readers) reader.call(input, part); };
+  for (const reader of readers) input.removeListener('data', reader);
+  input.on('data', each);
+  const destroy = screen.destroy.bind(screen);
+  screen.destroy = function() { input.removeListener('data', each); return destroy(); };
+}
+
+export function attachSelection(screen, { copy, onCopy, clean } = {}) {
+  // blessed asks xterm-like terminals for UTF-8 reports; SGR has no column limit, so ask for it too.
+  // The mode joins the ones blessed resets on exit.
+  if (screen.program.mouseEnabled) screen.program.setMouse({ sgrMouse: true }, true);
+  let pane = null, anchor = null, head = null, dragging = false, moved = false, shown = [], last = { at: 0, x: -1, y: -1, count: 0 };
+  const selected = () => pane && anchor && head ? spans(pane.rect, anchor, head) : [];
+  // Just before each frame is drawn the selected cells are inverted; once it is out they go
+  // back, so the buffer always holds the real text. Elements have all rendered by then.
+  const invert = () => { for (const [y, from, to] of shown) { const cells = screen.lines[y]; if (!cells) continue; for (let x = from; x <= to && x < cells.length; x++) cells[x][0] ^= INVERSE; cells.dirty = true; } };
+  const draw = screen.draw.bind(screen);
+  screen.draw = function(start, end) { shown = selected(); invert(); return draw(start, end); };
+  screen.on('render', () => { invert(); for (const [y] of shown) if (screen.lines[y]) screen.lines[y].dirty = false; });
+  const clear = () => {
+    if (!anchor) return;
+    for (const [y] of shown) if (screen.lines[y]) screen.lines[y].dirty = true;
+    pane = anchor = head = null; shown = []; screen.render();
+  };
+  // The pane and the first and last selected cells, or null.
+  const range = () => {
+    const rows = selected(); if (!rows.length) return null;
+    const first = rows[0], end = rows.at(-1);
+    return { el: pane.el, from: { x: first[1], y: first[0] }, to: { x: end[2], y: end[0] } };
+  };
+  // The cells as they are on the terminal. Setting a pane's content blanks its cells until
+  // the next frame, and the app sets content on a timer without drawing when nothing
+  // changed. Drawing first makes the cells hold the text again.
+  const cells = () => { screen.render(); return screen.lines; };
+  const text = () => {
+    const rows = selected(); if (!rows.length) return '';
+    if (pane.el?.selectText) { const { from, to } = range(); return pane.el.selectText(from, to); }
+    return spanText(cells(), rows, joiner(pane.el), clean);
+  };
+  const finish = () => { const value = text(); if (value) { copy?.(value); onCopy?.(value); } };
+  screen.program.prependListener('mouse', data => {
+    const motion = data.action === 'mousemove' || data.action === 'mousedown' && Boolean(buttonCode(data) & 32);
+    if (data.action === 'wheelup' || data.action === 'wheeldown') { clear(); return; }
+    if (motion) {
+      if (!dragging) return;
+      if (data.button !== 'left' && data.action === 'mousemove') { dragging = false; if (moved) finish(); return; }
+      data.action = 'mousedrag';
+      if (head && head.x === data.x && head.y === data.y) return;
+      head = { x: data.x, y: data.y }; moved = true; screen.render(); return;
+    }
+    if (data.action === 'mousedown') {
+      if (data.button !== 'left') return;
+      const now = Date.now(), again = now - last.at < 500 && last.x === data.x && last.y === data.y;
+      last = { at: now, x: data.x, y: data.y, count: again ? last.count + 1 : 1 };
+      clear();
+      pane = paneAt(screen, data.x, data.y); dragging = true; moved = false;
+      if (last.count === 2) {
+        const span = wordSpan(cells()[data.y] ?? [], data.x, pane.rect.x0, pane.rect.x1);
+        if (span) { anchor = { x: span[0], y: data.y }; head = { x: span[1], y: data.y }; dragging = false; screen.render(); finish(); return; }
+      }
+      if (last.count >= 3) { anchor = { x: pane.rect.x0, y: data.y }; head = { x: pane.rect.x1, y: data.y }; dragging = false; screen.render(); finish(); return; }
+      anchor = { x: data.x, y: data.y }; head = null; return;
+    }
+    if (data.action === 'mouseup' && dragging) {
+      dragging = false;
+      if (!moved) { anchor = null; return; }
+      // A drag is not a click: the element under the release does nothing.
+      data.action = 'mouseselect'; screen.mouseDown = null; finish();
+    }
+  });
+  // Any key ends the highlight, but for Ctrl-C: the app copies the highlight on it.
+  screen.program.on('keypress', (ch, key) => { if (key?.full !== 'C-c') clear(); });
+  screen.on('resize', () => clear());
+  return { clear, text, range, get active() { return Boolean(anchor && head); } };
+}