@gaia-ai/addon-gaia-ui 0.11.2 → 0.11.3

package/dist/src/Entity/conductor/Data/process.js

@@ -1,5 +1,17 @@
 import { spawn as nodeSpawn } from 'node:child_process';
-import { signalVerifiedProcess } from '@gaia-ai/core';
+import { machineContextPath, readMachineContext, signalVerifiedProcess, } from '@gaia-ai/core';
+/**
+ * This machine's host_key, from the same MachineContext the CLI reads.
+ *
+ * Exported so the Conductors screens (GAIA-450 B10) can key their view-only
+ * marking and their `actions()` gate on IDENTITY — this row's `host_key`
+ * against this machine's own — rather than on `isLocal`'s filesystem check,
+ * which two machines whose checkouts share a path can both satisfy.
+ */
+export async function defaultThisHostKey() {
+    const ctx = await readMachineContext(machineContextPath());
+    return ctx.machine_id ?? '';
+}
 /**
  * Start and stop a conductor from the cockpit.
  *
@@ -15,8 +27,27 @@ import { signalVerifiedProcess } from '@gaia-ai/core';
 export function createConductorProcessHost(deps = {}) {
     const spawn = deps.spawn ?? defaultSpawn;
     const signal = deps.signal ?? signalVerifiedProcess;
+    const thisHostKey = deps.thisHostKey ?? defaultThisHostKey;
     return {
-        async start({ workspaceRoot, conductorName }) {
+        thisHostKey,
+        async start({ workspaceRoot, conductorName, hostKey }) {
+            // GAIA-450 review B5: the only gate this used to have was `isLocal` — a
+            // filesystem check on `workspaceRoot`, which answers "does this path
+            // exist on THIS disk", not "is this THIS machine's conductor". Two
+            // machines whose checkouts share a path (the ordinary case for one
+            // operator with several) make that a false positive: pressing `s` on a
+            // ROW naming another machine's conductor silently started this
+            // machine's OWN one instead, composed from `workspaceRoot` alone with no
+            // identity at all. `stop` never had this hole — it already runs through
+            // `signalVerifiedProcess`'s `host_key` check downstream — so `start`
+            // gets the same verification here, the one place both actions now share.
+            const expected = await thisHostKey();
+            if (!hostKey || hostKey !== expected) {
+                return {
+                    ok: false,
+                    message: `conductor's host_key (${hostKey ?? '(none)'}) is not this machine's (${expected}) — refusing to start a conductor on another host`,
+                };
+            }
             try {
                 // Awaited, so "starting …" is claimed only once the fork has really
                 // happened — and so an `'error'` event becomes a reported failure
@@ -49,8 +80,13 @@ export function createConductorProcessHost(deps = {}) {
                 };
             }
         },
-        async stop({ pid, workspaceRoot }) {
-            const outcome = signal({ pid, workspaceRoot, signal: 'SIGTERM' });
+        async stop({ pid, hostKey }) {
+            const outcome = signal({
+                pid,
+                hostKey,
+                thisHostKey: await thisHostKey(),
+                signal: 'SIGTERM',
+            });
             return outcome.ok
                 ? {
                     ok: true,

package/dist/src/Entity/conductor/Screen/conductors.d.ts

@@ -31,6 +31,14 @@ export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
     private selectedIndex;
     private logFor;
     private readonly busyIds;
+    /**
+     * GAIA-450 review B6 — every `act()` outcome (success, refusal, thrown
+     * failure) lands here so the footer states it instead of staying silent.
+     * Cleared on selection change so a stale outcome does not linger under a
+     * different row; falls back to {@link viewOnlyNotice} so a row this screen
+     * cannot act on is marked BEFORE a key is pressed, not only after.
+     */
+    private status;
     topTab(): {
         readonly level: "root";
         readonly tab: "conductors";
@@ -42,11 +50,46 @@ export declare class ConductorsScreen extends AsyncScreen<ConductorsData> {
     protected renderReady(data: ConductorsData, context: ScreenContext): VNode;
     protected didLoad(data: ConductorsData): void;
     protected chrome(_context: ScreenContext): FullScreenChrome;
+    /**
+     * GAIA-450 review B9 — `s`/`x` are advertised only when the SELECTED row can
+     * actually be acted on: `mine` is the identity gate (B10), not `isLocal`'s
+     * filesystem check, so a foreign conductor whose workspace happens to exist
+     * on this disk (GAIA-281 Finding 2) is correctly excluded too.
+     *
+     * GAIA-450 review B12 — `Enter :log` joins the same gate. A row that is not
+     * ours has no readable log on this machine (see {@link logFor}), so
+     * advertising the key made a promise the footer could not keep.
+     */
     protected actions(): import("../../../Component/footer-actions/index.js").ActionItem[];
+    /**
+     * GAIA-450 review B6/B10 — a row this screen cannot act on states so,
+     * before any key is pressed: `!mine` is the identity gate `act()` uses too.
+     * The row's own MARKS cell already carries `elsewhere`; this is the
+     * footer's copy of the same fact for the row currently selected.
+     */
+    private viewOnlyNotice;
+    protected notice(): string | undefined;
     select(index: number, context: ScreenContext): boolean;
+    /**
+     * GAIA-450 review B12 — gated here, not in `handleInput`: the kernel's own
+     * fallback (`tui-kernel.ts` — an unhandled `enter` calls `active()?.activate?.()`
+     * unconditionally) and a mouse click on the selected row
+     * (`Kernel/regions.ts`'s `rows.activate(index)`) both reach this method
+     * directly, bypassing `handleInput` entirely. Refusing here is therefore the
+     * one place that actually withholds the log on a row that is not ours,
+     * whichever path invoked it.
+     */
     activate(index: number, context: ScreenContext): boolean;
     handleInput(input: string, context: ScreenContext): boolean;
     reset(): void;
+    /**
+     * GAIA-450 review B6 — every outcome is now stated in the footer: the two
+     * refusals this screen can decide on its own (foreign row, already-online),
+     * the `{ok, message}` `host.start()`/`host.stop()` returns (previously
+     * discarded at the call site — the host-mismatch refusal `start` gained in
+     * the prior rework was composed only to be dropped here), and a thrown
+     * failure.
+     */
     private act;
 }
 export {};

package/dist/src/Entity/conductor/Screen/conductors.js

@@ -1,4 +1,5 @@
 import { existsSync } from 'node:fs';
+import { configHomeOf } from '@gaia-ai/core';
 import { actionItem } from '../../../Component/footer-actions/index.js';
 import { columnNode, textNode } from '../../../lib/vnode.js';
 import { AsyncScreen } from '../../../Screen/async-screen.js';
@@ -12,18 +13,30 @@ import { createConductorProcessHost } from '../Data/process.js';
  * A conductor on another machine has a workspace this machine cannot read, so
  * the block states that instead of showing an empty tail — the same rule the
  * row's `elsewhere` mark states for its actions.
+ *
+ * GAIA-450 review B12: keyed on `mine`, not `isLocal`. `isLocal` is a
+ * filesystem existence check on `workspace_root`, so a FOREIGN conductor that
+ * happens to share this machine's directory layout (GAIA-281 Finding 2 — two
+ * `gaia_conductor` records naming one checkout under different machines) still
+ * has `isLocal === true`. Keying the log on it tailed THIS machine's own
+ * `log.txt` under the foreign conductor's heading, while the footer
+ * simultaneously read "view-only". `mine` is the identity gate `actions()` and
+ * `act()` already use; the log now agrees with them.
  */
-const logFor = (row) => row.isLocal
-    ? {
-        heading: `log — ${row.workspaceRoot}/log.txt`,
-        lines: tailConductorLog(`${row.workspaceRoot}/log.txt`, {
-            maxLines: 40,
-        }).lines,
-    }
-    : {
-        heading: `log — ${row.label} runs on another machine; no log here`,
-        lines: [],
-    };
+const logFor = (row) => {
+    // GAIA-450 D4: workspace_root is the checkout root; the log lives under its
+    // own .gaia dir, not directly at the root.
+    const logPath = `${configHomeOf(row.workspaceRoot)}/log.txt`;
+    return row.mine
+        ? {
+            heading: `log — ${logPath}`,
+            lines: tailConductorLog(logPath, { maxLines: 40 }).lines,
+        }
+        : {
+            heading: `log — ${row.label} runs on another machine; no log here`,
+            lines: [],
+        };
+};
 /**
  * Conductors list — a normal {@link AsyncScreen}.
  *
@@ -42,6 +55,14 @@ export class ConductorsScreen extends AsyncScreen {
     selectedIndex = 0;
     logFor = null;
     busyIds = new Set();
+    /**
+     * GAIA-450 review B6 — every `act()` outcome (success, refusal, thrown
+     * failure) lands here so the footer states it instead of staying silent.
+     * Cleared on selection change so a stale outcome does not linger under a
+     * different row; falls back to {@link viewOnlyNotice} so a row this screen
+     * cannot act on is marked BEFORE a key is pressed, not only after.
+     */
+    status = '';
     topTab() {
         return { level: 'root', tab: 'conductors' };
     }
@@ -55,13 +76,19 @@ export class ConductorsScreen extends AsyncScreen {
         if (!context.services)
             throw new Error('Conductors requires services');
         const client = context.services.client;
-        const [projectNames, rows] = await Promise.all([
+        const host = context.services.conductorProcess ?? createConductorProcessHost();
+        // GAIA-450 B10: `mine` needs THIS machine's own host_key resolved before a
+        // row can be projected, so it is read alongside the project-name lookup
+        // rather than after — the same seam `start`/`stop` already verify against.
+        const [projectNames, thisHostKey] = await Promise.all([
             listProjectNames(client),
-            listConductorRows(client, {
-                now: context.nowSeconds?.() ?? Math.floor(Date.now() / 1000),
-                exists: existsSync,
-            }),
+            host.thisHostKey(),
         ]);
+        const rows = await listConductorRows(client, {
+            now: context.nowSeconds?.() ?? Math.floor(Date.now() / 1000),
+            exists: existsSync,
+            thisHostKey,
+        });
         return { rows, projectNames };
     }
     renderLoading() {
@@ -95,24 +122,64 @@ export class ConductorsScreen extends AsyncScreen {
             meta: `${rows.length} conductor(s)`,
         };
     }
+    /**
+     * GAIA-450 review B9 — `s`/`x` are advertised only when the SELECTED row can
+     * actually be acted on: `mine` is the identity gate (B10), not `isLocal`'s
+     * filesystem check, so a foreign conductor whose workspace happens to exist
+     * on this disk (GAIA-281 Finding 2) is correctly excluded too.
+     *
+     * GAIA-450 review B12 — `Enter :log` joins the same gate. A row that is not
+     * ours has no readable log on this machine (see {@link logFor}), so
+     * advertising the key made a promise the footer could not keep.
+     */
     actions() {
+        const canAct = this.rows[this.selectedIndex]?.mine ?? false;
         return [
-            actionItem('conductors-start', 's', 'start'),
-            actionItem('conductors-stop', 'x', 'stop'),
-            actionItem('conductors-enter', 'Enter', 'log'),
+            ...(canAct
+                ? [
+                    actionItem('conductors-start', 's', 'start'),
+                    actionItem('conductors-stop', 'x', 'stop'),
+                    actionItem('conductors-enter', 'Enter', 'log'),
+                ]
+                : []),
             actionItem('conductors-tab', 'Tab', 'tabs'),
         ];
     }
+    /**
+     * GAIA-450 review B6/B10 — a row this screen cannot act on states so,
+     * before any key is pressed: `!mine` is the identity gate `act()` uses too.
+     * The row's own MARKS cell already carries `elsewhere`; this is the
+     * footer's copy of the same fact for the row currently selected.
+     */
+    viewOnlyNotice() {
+        const row = this.rows[this.selectedIndex];
+        return row && !row.mine
+            ? `${row.label} runs on another machine — view-only`
+            : undefined;
+    }
+    notice() {
+        return this.status || this.viewOnlyNotice();
+    }
     select(index, context) {
         if (index < 0 || index >= this.rows.length)
             return false;
         this.selectedIndex = index;
+        this.status = '';
         context.requestDraw();
         return true;
     }
+    /**
+     * GAIA-450 review B12 — gated here, not in `handleInput`: the kernel's own
+     * fallback (`tui-kernel.ts` — an unhandled `enter` calls `active()?.activate?.()`
+     * unconditionally) and a mouse click on the selected row
+     * (`Kernel/regions.ts`'s `rows.activate(index)`) both reach this method
+     * directly, bypassing `handleInput` entirely. Refusing here is therefore the
+     * one place that actually withholds the log on a row that is not ours,
+     * whichever path invoked it.
+     */
     activate(index, context) {
         const row = this.rows[index];
-        if (!row)
+        if (!row?.mine)
             return false;
         this.logFor = this.logFor === row.id ? null : row.id;
         context.requestDraw();
@@ -137,35 +204,49 @@ export class ConductorsScreen extends AsyncScreen {
         this.selectedIndex = 0;
         this.logFor = null;
         this.busyIds.clear();
+        this.status = '';
         super.reset();
     }
+    /**
+     * GAIA-450 review B6 — every outcome is now stated in the footer: the two
+     * refusals this screen can decide on its own (foreign row, already-online),
+     * the `{ok, message}` `host.start()`/`host.stop()` returns (previously
+     * discarded at the call site — the host-mismatch refusal `start` gained in
+     * the prior rework was composed only to be dropped here), and a thrown
+     * failure.
+     */
     async act(action, context) {
         const row = this.rows[this.selectedIndex];
         if (!row || this.busyIds.has(row.id))
             return;
-        if (!row.isLocal)
+        if (!row.mine) {
+            this.status = `${row.label} runs on another machine — view-only`;
+            context.requestDraw();
             return;
-        if (action === 'start' && row.derivedStatus === 'running')
+        }
+        if (action === 'start' && row.derivedStatus === 'online') {
+            this.status = `${row.label} is already online`;
+            context.requestDraw();
             return;
+        }
         this.busyIds.add(row.id);
         context.requestDraw();
         const host = context.services?.conductorProcess ?? createConductorProcessHost();
         try {
-            if (action === 'start') {
-                await host.start({
+            const result = action === 'start'
+                ? await host.start({
                     workspaceRoot: row.workspaceRoot,
                     conductorName: row.conductorName,
-                });
-            }
-            else {
-                await host.stop({
+                    hostKey: row.hostKey,
+                })
+                : await host.stop({
                     pid: row.lastPid,
-                    workspaceRoot: row.workspaceRoot,
+                    hostKey: row.hostKey,
                 });
-            }
+            this.status = result.message;
         }
-        catch {
-            // Outcome lives in the reloaded row state, not a footer notice.
+        catch (err) {
+            this.status = `${action} failed: ${err instanceof Error ? err.message : String(err)}`;
         }
         finally {
             this.busyIds.delete(row.id);

package/dist/src/Entity/conductor/Screen/project-conductors.d.ts

@@ -0,0 +1,87 @@
+import type { VNode } from '@opentui/core';
+import { AsyncScreen } from '../../../Screen/async-screen.js';
+import type { FullScreenChrome } from '../../../Screen/full-screen.js';
+import type { ScreenContext } from '../../../Screen/screen.js';
+import { type ConductorRow } from '../Data/conductors.js';
+/**
+ * The project-scoped Conductors tab (GAIA-450 D13) — the conductors bound to
+ * THIS project, beside Tickets, Ticket-Agents and Runs. Same interaction as
+ * the root-level Conductors screen (start/stop keys, the log toggle, through
+ * the same {@link createConductorProcessHost}) over the same row shape, minus
+ * the PROJECT column every row would otherwise repeat.
+ *
+ * Refresh is the shared mechanism (GAIA-376 `ui-refresh` file + `R`), not a
+ * screen-private timer, matching every other list on this level.
+ */
+export declare class ProjectConductorsScreen extends AsyncScreen<readonly ConductorRow[]> {
+    static readonly route: {
+        id: string;
+        path: string;
+        parent: string;
+        tab: {
+            id: string;
+            label: string;
+            scope: string;
+            order: number;
+        };
+    };
+    readonly id: string;
+    readonly frameId = "project-conductors";
+    private selectedIndex;
+    private logFor;
+    private readonly busyIds;
+    /**
+     * GAIA-450 review B6 — every `act()` outcome (success, refusal, thrown
+     * failure) lands here so the footer states it instead of staying silent.
+     * Cleared on selection change so a stale outcome does not linger under a
+     * different row; falls back to {@link viewOnlyNotice} so a row this screen
+     * cannot act on is marked BEFORE a key is pressed, not only after.
+     */
+    private status;
+    topTab(): {
+        readonly level: "project";
+        readonly tab: "conductors";
+    };
+    reload(context: ScreenContext): void;
+    get rows(): readonly ConductorRow[];
+    protected load(context: ScreenContext): Promise<readonly ConductorRow[]>;
+    protected renderLoading(): string[];
+    protected renderReady(rows: readonly ConductorRow[], context: ScreenContext): VNode;
+    protected didLoad(rows: readonly ConductorRow[]): void;
+    protected chrome(context: ScreenContext): FullScreenChrome;
+    /**
+     * GAIA-450 review B9 — `s`/`x` are advertised only when the SELECTED row can
+     * actually be acted on: `mine` is the identity gate (B10), not `isLocal`'s
+     * filesystem check.
+     *
+     * GAIA-450 review B12 — `Enter :log` joins the same gate; see the root
+     * screen's copy of this comment.
+     */
+    protected actions(): import("../../../Component/footer-actions/index.js").ActionItem[];
+    /**
+     * GAIA-450 review B6/B10 — a row this screen cannot act on states so,
+     * before any key is pressed: `!mine` is the identity gate `act()` uses too.
+     * The row's own MARKS cell already carries `elsewhere`; this is the
+     * footer's copy of the same fact for the row currently selected.
+     */
+    private viewOnlyNotice;
+    protected notice(): string | undefined;
+    select(index: number, context: ScreenContext): boolean;
+    /**
+     * GAIA-450 review B12 — gated here, not in `handleInput`; see the root
+     * screen's copy of this comment for why (the kernel's unhandled-`enter`
+     * fallback and a mouse click both call this directly).
+     */
+    activate(index: number, context: ScreenContext): boolean;
+    handleInput(input: string, context: ScreenContext): boolean;
+    reset(): void;
+    /**
+     * GAIA-450 review B6 — every outcome is now stated in the footer: the two
+     * refusals this screen can decide on its own (foreign row, already-online),
+     * the `{ok, message}` `host.start()`/`host.stop()` returns (previously
+     * discarded at the call site — the host-mismatch refusal `start` gained in
+     * the prior rework was composed only to be dropped here), and a thrown
+     * failure.
+     */
+    private act;
+}

package/dist/src/Entity/conductor/Screen/project-conductors.js

@@ -0,0 +1,245 @@
+import { existsSync } from 'node:fs';
+import { configHomeOf } from '@gaia-ai/core';
+import { actionItem } from '../../../Component/footer-actions/index.js';
+import { columnNode, textNode } from '../../../lib/vnode.js';
+import { AsyncScreen } from '../../../Screen/async-screen.js';
+import { listRowIds, listTableTree } from '../../collection.js';
+import { listConductorRows, PROJECT_CONDUCTOR_TABLE, } from '../Data/conductors.js';
+import { tailConductorLog } from '../Data/log-tail.js';
+import { createConductorProcessHost } from '../Data/process.js';
+/**
+ * The open row's log block: where it is, and its tail.
+ *
+ * Identical to the root Conductors screen's own — see its comment for why a
+ * non-local row shows a stated reason rather than an empty tail. Not shared
+ * as an import: a two-line function duplicated once is cheaper than a shared
+ * module two screens would otherwise have to agree on evolving together.
+ *
+ * GAIA-450 review B12: keyed on `mine`, not `isLocal` — see the root screen's
+ * copy of this comment for the GAIA-281 Finding 2 shape this closes.
+ */
+const logFor = (row) => {
+    const logPath = `${configHomeOf(row.workspaceRoot)}/log.txt`;
+    return row.mine
+        ? {
+            heading: `log — ${logPath}`,
+            lines: tailConductorLog(logPath, { maxLines: 40 }).lines,
+        }
+        : {
+            heading: `log — ${row.label} runs on another machine; no log here`,
+            lines: [],
+        };
+};
+/**
+ * The project-scoped Conductors tab (GAIA-450 D13) — the conductors bound to
+ * THIS project, beside Tickets, Ticket-Agents and Runs. Same interaction as
+ * the root-level Conductors screen (start/stop keys, the log toggle, through
+ * the same {@link createConductorProcessHost}) over the same row shape, minus
+ * the PROJECT column every row would otherwise repeat.
+ *
+ * Refresh is the shared mechanism (GAIA-376 `ui-refresh` file + `R`), not a
+ * screen-private timer, matching every other list on this level.
+ */
+export class ProjectConductorsScreen extends AsyncScreen {
+    static route = {
+        id: 'project.conductors',
+        path: '/projects/:projectId/conductors',
+        parent: 'project.dashboard',
+        tab: { id: 'conductors', label: 'Conductors', scope: 'project', order: 50 },
+    };
+    id = ProjectConductorsScreen.route.id;
+    frameId = 'project-conductors';
+    selectedIndex = 0;
+    logFor = null;
+    busyIds = new Set();
+    /**
+     * GAIA-450 review B6 — every `act()` outcome (success, refusal, thrown
+     * failure) lands here so the footer states it instead of staying silent.
+     * Cleared on selection change so a stale outcome does not linger under a
+     * different row; falls back to {@link viewOnlyNotice} so a row this screen
+     * cannot act on is marked BEFORE a key is pressed, not only after.
+     */
+    status = '';
+    topTab() {
+        return { level: 'project', tab: 'conductors' };
+    }
+    reload(context) {
+        this.retry(context);
+    }
+    get rows() {
+        return this.readyValue ?? [];
+    }
+    async load(context) {
+        if (!context.services || !context.project) {
+            throw new Error('Project conductors requires project context');
+        }
+        const host = context.services.conductorProcess ?? createConductorProcessHost();
+        // GAIA-450 B10: `mine` needs THIS machine's own host_key, the same seam
+        // `start`/`stop` already verify against.
+        const thisHostKey = await host.thisHostKey();
+        return listConductorRows(context.services.client, {
+            now: context.nowSeconds?.() ?? Math.floor(Date.now() / 1000),
+            exists: existsSync,
+            thisHostKey,
+        }, context.project.id);
+    }
+    renderLoading() {
+        return ['Loading conductors…'];
+    }
+    renderReady(rows, context) {
+        const open = rows.find((row) => row.id === this.logFor);
+        const log = open ? logFor(open) : undefined;
+        return columnNode('project-conductor-list', listTableTree(PROJECT_CONDUCTOR_TABLE, rows, {
+            nowSeconds: context.nowSeconds?.() ?? Math.floor(Date.now() / 1000),
+            busyIds: this.busyIds,
+            projectNames: new Map(),
+        }, { selectedIndex: this.selectedIndex }), ...(log
+            ? [
+                textNode({ id: 'project-conductor-log-gap', content: '' }),
+                textNode({
+                    id: 'project-conductor-log-heading',
+                    content: log.heading,
+                }),
+                ...log.lines.map((line, index) => textNode({ id: `project-conductor-log-${index}`, content: line })),
+            ]
+            : []));
+    }
+    didLoad(rows) {
+        this.selectedIndex = Math.min(this.selectedIndex, Math.max(0, rows.length - 1));
+    }
+    chrome(context) {
+        const rows = this.rows;
+        return {
+            selectable: rows.length,
+            selectedIndex: this.selectedIndex,
+            rowIds: listRowIds(PROJECT_CONDUCTOR_TABLE, rows),
+            title: `${context.project?.name ?? context.project?.slug ?? ''} · conductors`,
+            meta: `${rows.length} conductor(s)`,
+        };
+    }
+    /**
+     * GAIA-450 review B9 — `s`/`x` are advertised only when the SELECTED row can
+     * actually be acted on: `mine` is the identity gate (B10), not `isLocal`'s
+     * filesystem check.
+     *
+     * GAIA-450 review B12 — `Enter :log` joins the same gate; see the root
+     * screen's copy of this comment.
+     */
+    actions() {
+        const canAct = this.rows[this.selectedIndex]?.mine ?? false;
+        return [
+            ...(canAct
+                ? [
+                    actionItem('project-conductors-start', 's', 'start'),
+                    actionItem('project-conductors-stop', 'x', 'stop'),
+                    actionItem('project-conductors-enter', 'Enter', 'log'),
+                ]
+                : []),
+            actionItem('project-conductors-tab', 'Tab', 'tabs'),
+        ];
+    }
+    /**
+     * GAIA-450 review B6/B10 — a row this screen cannot act on states so,
+     * before any key is pressed: `!mine` is the identity gate `act()` uses too.
+     * The row's own MARKS cell already carries `elsewhere`; this is the
+     * footer's copy of the same fact for the row currently selected.
+     */
+    viewOnlyNotice() {
+        const row = this.rows[this.selectedIndex];
+        return row && !row.mine
+            ? `${row.label} runs on another machine — view-only`
+            : undefined;
+    }
+    notice() {
+        return this.status || this.viewOnlyNotice();
+    }
+    select(index, context) {
+        if (index < 0 || index >= this.rows.length)
+            return false;
+        this.selectedIndex = index;
+        this.status = '';
+        context.requestDraw();
+        return true;
+    }
+    /**
+     * GAIA-450 review B12 — gated here, not in `handleInput`; see the root
+     * screen's copy of this comment for why (the kernel's unhandled-`enter`
+     * fallback and a mouse click both call this directly).
+     */
+    activate(index, context) {
+        const row = this.rows[index];
+        if (!row?.mine)
+            return false;
+        this.logFor = this.logFor === row.id ? null : row.id;
+        context.requestDraw();
+        return true;
+    }
+    handleInput(input, context) {
+        if (super.handleInput(input, context))
+            return true;
+        if (input === 's' || input === 'x') {
+            void this.act(input === 's' ? 'start' : 'stop', context);
+            return true;
+        }
+        if (input === 'enter')
+            return this.activate(this.selectedIndex, context);
+        if (input === 'j' || input === 'down')
+            return this.select(Math.min(this.selectedIndex + 1, this.rows.length - 1), context);
+        if (input === 'k' || input === 'up')
+            return this.select(Math.max(this.selectedIndex - 1, 0), context);
+        return false;
+    }
+    reset() {
+        this.selectedIndex = 0;
+        this.logFor = null;
+        this.busyIds.clear();
+        this.status = '';
+        super.reset();
+    }
+    /**
+     * GAIA-450 review B6 — every outcome is now stated in the footer: the two
+     * refusals this screen can decide on its own (foreign row, already-online),
+     * the `{ok, message}` `host.start()`/`host.stop()` returns (previously
+     * discarded at the call site — the host-mismatch refusal `start` gained in
+     * the prior rework was composed only to be dropped here), and a thrown
+     * failure.
+     */
+    async act(action, context) {
+        const row = this.rows[this.selectedIndex];
+        if (!row || this.busyIds.has(row.id))
+            return;
+        if (!row.mine) {
+            this.status = `${row.label} runs on another machine — view-only`;
+            context.requestDraw();
+            return;
+        }
+        if (action === 'start' && row.derivedStatus === 'online') {
+            this.status = `${row.label} is already online`;
+            context.requestDraw();
+            return;
+        }
+        this.busyIds.add(row.id);
+        context.requestDraw();
+        const host = context.services?.conductorProcess ?? createConductorProcessHost();
+        try {
+            const result = action === 'start'
+                ? await host.start({
+                    workspaceRoot: row.workspaceRoot,
+                    conductorName: row.conductorName,
+                    hostKey: row.hostKey,
+                })
+                : await host.stop({
+                    pid: row.lastPid,
+                    hostKey: row.hostKey,
+                });
+            this.status = result.message;
+        }
+        catch (err) {
+            this.status = `${action} failed: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        finally {
+            this.busyIds.delete(row.id);
+            this.retry(context);
+        }
+    }
+}