@hienlh/ppm 0.18.11 → 0.18.12

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.18.12] - 2026-09-05
+
+### Fixed
+- **npm package no longer includes local investigation scripts** — the 0.18.11 tarball shipped a `.spike/` scratch folder by mistake; it is now excluded.
+
 ## [0.18.11] - 2026-09-05
 
 ### Added

package/README.md

@@ -42,7 +42,7 @@ curl -fsSL https://ppm.sh/install | sh
 irm https://ppm.sh/install.ps1 | iex
 ```
 
-Downloads the latest binary, adds to PATH, and shows next steps. To upgrade, run the same command again.
+Downloads the latest binary, adds to PATH, and shows next steps. To upgrade, run the same command again (or `ppm upgrade`).
 
 ### Via Bun
 
@@ -66,30 +66,60 @@ After setup, open the URL shown in terminal and enter your access password.
 
 ## What You Get
 
-- **AI Chat** — Claude AI with tool execution, file attachments, streaming, session history, slash commands
-- **Terminal** — Full PTY terminal (xterm.js), multiple sessions per project
-- **File Explorer** — Browse, edit, create, delete files with Monaco editor
-- **Git** — Status, diff, commit, push/pull, branching, merge, rebase, commit graph
-- **Database** — SQLite + PostgreSQL viewer with query editor, data grid, cell editing
-- **Notifications** — Telegram bot integration
-- **Remote Access** — Cloudflare tunnel for public URL sharing (always enabled)
-- **PPM Cloud** *(optional)* — Permanent private link to each machine, phone dashboard to see and open them, remote restart. Stores only your email, machine names and their tunnel URLs — never your code or chats. PPM works fully without it.
-- **Command Palette** — Fuzzy search for commands, files, tables (Shift+Shift or F1)
-- **PWA** — Installable as a progressive web app
-- **Mobile-First** — Responsive UI with bottom sheets and touch optimization
+### AI
+
+- **AI Chat** — tool execution, file attachments, streaming, session history, search, branching, drafts. Chat output is durable: leave the tab, come back, the turn is still there.
+- **Multiple AI providers** — Claude Agent SDK built in; [OpenAI Codex](https://github.com/openai/codex) and Cursor CLI register themselves when their binaries are installed. Pick provider, model, reasoning effort and permission mode per session.
+- **Slash commands, skills, subagents** — the skills, commands and plugin items in your `~/.claude` directory are discovered and runnable from chat.
+- **Agent teams** — a live panel of who is working, the step they are on, elapsed time and model; open any teammate to replay its whole work session.
+- **Group chat** — a multi-agent group conversation where several agents answer in turns.
+- **MCP servers** — add, edit and import MCP servers (auto-imports from `~/.claude.json`).
+- **Scheduled agents** — cron jobs inside PPM that wake a session to work unattended, with turn/timeout budgets and a summary notification.
+- **Multi-account** — store several Claude/Codex accounts, rotate on cooldown, track usage.
+- **API proxy** — expose your accounts as an Anthropic-compatible (and OpenAI-compatible) endpoint under `/proxy/v1/*`, guarded by its own auth key, with request logging.
+
+### Workspace
+
+- **Terminal** — full PTY terminal (xterm.js), multiple sessions per project, plus a dock terminal you can open on any folder. Send a code block from chat into a terminal, and terminal output back into chat.
+- **Editor** — Monaco with syntax highlighting, plus viewers for images, PDF, CSV and video (unsupported video formats are transcoded on the fly).
+- **Project explorer** — browse, edit, create, delete, upload (per-file progress, collision prompts) and drag-and-drop files across registered projects.
+- **OS File Explorer** — a floating, resizable, multi-instance window that browses the whole machine: drives, known folders and the pinned folders of your OS; List/Icons/Column views; Cut/Copy/Paste, Rename, Trash, Properties; drag between windows. Full-screen sheet on mobile.
+- **Git** — status, diff, stage, commit, push/pull, branches, merge, rebase, stash, worktrees, an interactive commit graph, and an inline conflict-resolution editor.
+- **Database** — SQLite + PostgreSQL viewer with query editor, data grid, cell editing, and a query audit log. External `.db`/`.sqlite` files open in the same viewer.
+- **System Monitor** — a task manager for the whole machine: CPU per core, RAM, disk, network and NVIDIA GPU charts, plus every process grouped by app with live usage. End a process or a whole app; PPM's own and OS-critical processes are refused.
+- **Floating windows** — Explorer and System Monitor open as windows, and any tab can be popped out into one without reloading its state. Chrome/Edge can send a window into always-on-top picture-in-picture.
+- **Extensions** — VSCode-compatible npm extensions run in isolated Bun workers, contributing tree views, webviews, quick picks and status bar items. See the [extension guide](docs/extension-development-guide.md).
+
+### Access & integrations
+
+- **Remote access** — a Cloudflare tunnel gives your machine a public URL (always enabled). Port forwarding opens a tunnel for any localhost dev server.
+- **PPM Cloud** *(optional)* — permanent private link to each machine, phone dashboard to see and open them, remote restart. Stores only your email, machine names and their tunnel URLs — never your code or chats. PPM works fully without it.
+- **Telegram bot (PPMBot)** — a coordinator chat that delegates project tasks to agents, keeps its own memory, and reports back.
+- **Jira** — per-project credentials plus watchers that poll JQL searches and notify you on new results.
+- **Notifications** — cloud push and Telegram when a turn finishes, needs approval, or asks a question.
+
+### The app itself
+
+- **Command palette** — fuzzy search for commands, files, tables (Shift+Shift or F1).
+- **Themes** — built-in themes plus import of VSCode themes by URL or `.vsix`.
+- **Stays up** — a supervisor keeps the server alive, checks for new versions, and self-replaces on a one-click upgrade. `ppm autostart` registers it at login.
+- **PWA** — installable as a progressive web app.
+- **Mobile-first** — responsive UI with bottom sheets, long-press menus and touch optimization.
 
 ## CLI
 
 ```bash
 # Server
 ppm start                  # Start (background daemon, port 3210, tunnel auto-enabled)
-ppm start -f               # Foreground mode (for debugging)
 ppm start -p 4000          # Custom port
-ppm stop                   # Stop daemon
-ppm restart                # Restart
-ppm status                 # Show status
+ppm stop                   # Stop the server (supervisor stays alive)
+ppm down                   # Full shutdown (supervisor + server + tunnel)
+ppm restart                # Restart, keeping the tunnel alive
+ppm status                 # Show status (--json for machine-readable)
 ppm open                   # Open in browser
 ppm logs -f                # Tail logs
+ppm upgrade                # Install updates (--check to only look)
+ppm autostart enable       # Start PPM at login (also: disable, status)
 
 # Projects
 ppm projects list
@@ -103,18 +133,42 @@ ppm git commit -m "message"
 ppm git push
 
 # Database
-ppm db connections         # List DB connections
+ppm db list                            # Configured connections
+ppm db tables my-db
 ppm db query my-db "SELECT * FROM users LIMIT 10"
+ppm db run my-db ./migration.sql
+
+# Chat
+ppm chat list
+ppm chat create
+ppm chat send <session-id> "message"
+ppm chat resume <session-id>
+
+# Scheduled agents
+ppm schedule add
+ppm schedule list
+ppm schedule run-now <id>
+ppm schedule runs <id>
+
+# Extensions & skills
+ppm ext list
+ppm ext install <name>
+ppm ext dev /path/to/extension
+ppm skills list
+ppm skills search <query>
+
+# Integrations
+ppm cloud login            # PPM Cloud (also: status, devices, alias, logout)
+ppm bot status             # Telegram coordinator (delegate, tasks, memory, ...)
+ppm jira config set <project>
 
 # Config
 ppm config get port
 ppm config set port 4000
 
-# Chat (CLI mode)
-ppm chat
-
 # Other
 ppm init                   # Re-run setup wizard
+ppm export skill           # Export the PPM skill for Claude Code
 ppm report                 # File bug report on GitHub
 ```
 
@@ -136,7 +190,7 @@ The `-y` flag skips all prompts and applies these defaults:
 - Port: `3210`
 - Scan directory: `$HOME`
 - Auth: enabled, password auto-generated (printed at end of `init` output)
-- AI model: `claude-opus-4-8`
+- AI model: `claude-opus-5`
 
 Override any default with flags:
 
@@ -162,9 +216,10 @@ Then in Claude Code: `/ppm list my projects` → Claude invokes `ppm projects li
 
 ## Requirements
 
-- **Bun** v1.3.6+ ([install](https://bun.sh))
+- **Bun** v1.3.6+ ([install](https://bun.sh)) — not needed for the binary install, which bundles its own runtime
 - **Git** v2.0+ (for git features)
 - **Claude Code** authenticated (`claude` CLI logged in) — for AI chat
+- *Optional:* `@openai/codex` or `cursor-agent` on PATH to enable those providers
 
 ## Development
 
@@ -192,12 +247,15 @@ For architecture details, API reference, and contribution guidelines, see the [d
 | [Code Standards](docs/code-standards.md) | Conventions and patterns |
 | [Deployment Guide](docs/deployment-guide.md) | Installation, config, troubleshooting |
 | [Design Guidelines](docs/design-guidelines.md) | UI framework, colors, components |
+| [Extension Development](docs/extension-development-guide.md) | Building PPM extensions |
 | [Project Roadmap](docs/project-roadmap.md) | Status and plans |
+| [Changelog](CHANGELOG.md) | Release-by-release changes |
 
 ## Known Gotchas
 
 - **SDK .env poisoning**: Projects with `ANTHROPIC_API_KEY` in `.env` can break SDK tool execution. PPM neutralizes these vars automatically.
-- **Windows**: SDK uses CLI fallback (`claude -p`) due to Bun pipe buffering issues. Ensure `claude` is in PATH.
+- **Claude CLI discovery**: PPM looks for the `claude` CLI on PATH, in the usual install locations, and in the `cli/` folder shipped beside the binary. If none is found, point at it with `PPM_CLAUDE_CLI=/path/to/claude`.
+- **Project Claude settings**: a project's `.claude/settings.local.json` can restrict tools even under bypass permissions; PPM overrides it with empty settings so chat tools keep working.
 
 ---
 

package/assets/skills/ppm/SKILL.md

@@ -71,4 +71,4 @@ This skill covers the `ppm` CLI, its HTTP API, and its config DB. It does **not*
 - Third-party extensions (inspect via `ppm ext list`).
 - The Claude Agent SDK internals (separate skill).
 
-<!-- Generated for PPM v0.18.11 at build time. Re-run `ppm export skill --install` to refresh. -->
+<!-- Generated for PPM v0.18.12 at build time. Re-run `ppm export skill --install` to refresh. -->

package/assets/skills/ppm/references/http-api.md

@@ -309,4 +309,4 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `ws://<host>/ws/terminal` — PTY terminal multiplexer
 - `ws://<host>/ws/extensions` — extension host channel
 
-<!-- Generated from src/server/routes/ for PPM v0.18.11 -->
+<!-- Generated from src/server/routes/ for PPM v0.18.12 -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.18.11",
+  "version": "0.18.12",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "SEE LICENSE IN LICENSE",

package/.spike/cdp-client.ts

@@ -1,116 +0,0 @@
-// Minimal Chrome DevTools Protocol client over the browser WebSocket endpoint.
-// Spike helper only (untracked). Flattened sessions: one WS, per-target sessionId.
-
-export interface CdpTarget {
-  targetId: string;
-  type: string;
-  title: string;
-  url: string;
-  attached: boolean;
-}
-
-type Pending = { resolve: (v: any) => void; reject: (e: Error) => void; method: string };
-
-export class CdpClient {
-  private ws!: WebSocket;
-  private nextId = 1;
-  private pending = new Map<number, Pending>();
-  private listeners: Array<(msg: any) => void> = [];
-
-  static async connect(port: number): Promise<CdpClient> {
-    const res = await fetch(`http://127.0.0.1:${port}/json/version`);
-    const info = (await res.json()) as { webSocketDebuggerUrl: string };
-    const client = new CdpClient();
-    await client.open(info.webSocketDebuggerUrl);
-    return client;
-  }
-
-  private open(url: string): Promise<void> {
-    return new Promise((resolve, reject) => {
-      this.ws = new WebSocket(url);
-      this.ws.onopen = () => resolve();
-      this.ws.onerror = (e) => reject(new Error(`ws error ${String(e)}`));
-      this.ws.onmessage = (ev) => {
-        const msg = JSON.parse(String(ev.data));
-        if (msg.id && this.pending.has(msg.id)) {
-          const p = this.pending.get(msg.id)!;
-          this.pending.delete(msg.id);
-          if (msg.error) p.reject(new Error(`${p.method}: ${msg.error.message} ${msg.error.data ?? ""}`));
-          else p.resolve(msg.result);
-        } else {
-          for (const l of this.listeners) l(msg);
-        }
-      };
-    });
-  }
-
-  onEvent(fn: (msg: any) => void) {
-    this.listeners.push(fn);
-  }
-
-  send(method: string, params: Record<string, unknown> = {}, sessionId?: string): Promise<any> {
-    const id = this.nextId++;
-    const payload: Record<string, unknown> = { id, method, params };
-    if (sessionId) payload.sessionId = sessionId;
-    return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject, method });
-      this.ws.send(JSON.stringify(payload));
-    });
-  }
-
-  async targets(): Promise<CdpTarget[]> {
-    const r = await this.send("Target.getTargets");
-    return r.targetInfos as CdpTarget[];
-  }
-
-  async attach(targetId: string): Promise<string> {
-    const r = await this.send("Target.attachToTarget", { targetId, flatten: true });
-    return r.sessionId as string;
-  }
-
-  /** Runtime.evaluate with awaitPromise + returnByValue; throws on JS exception. */
-  async eval<T = unknown>(sessionId: string, expression: string): Promise<T> {
-    const r = await this.send(
-      "Runtime.evaluate",
-      { expression, awaitPromise: true, returnByValue: true, userGesture: false },
-      sessionId,
-    );
-    if (r.exceptionDetails) {
-      const d = r.exceptionDetails;
-      throw new Error(`JS exception: ${d.exception?.description ?? d.text}`);
-    }
-    return r.result?.value as T;
-  }
-
-  async click(sessionId: string, x: number, y: number) {
-    const base = { x, y, button: "left", clickCount: 1 };
-    await this.send("Input.dispatchMouseEvent", { type: "mouseMoved", x, y }, sessionId);
-    await this.send("Input.dispatchMouseEvent", { ...base, type: "mousePressed" }, sessionId);
-    await this.send("Input.dispatchMouseEvent", { ...base, type: "mouseReleased" }, sessionId);
-  }
-
-  /** Type printable text as trusted key events (one keyDown/keyUp per char). */
-  async typeText(sessionId: string, text: string) {
-    for (const ch of text) {
-      await this.send("Input.dispatchKeyEvent", { type: "keyDown", text: ch, key: ch, unmodifiedText: ch }, sessionId);
-      await this.send("Input.dispatchKeyEvent", { type: "keyUp", key: ch }, sessionId);
-    }
-  }
-
-  async pressKey(sessionId: string, key: string, code: string, vk: number, text?: string, modifiers = 0) {
-    const common = { key, code, windowsVirtualKeyCode: vk, nativeVirtualKeyCode: vk, modifiers };
-    await this.send("Input.dispatchKeyEvent", { type: text ? "keyDown" : "rawKeyDown", ...common, ...(text ? { text, unmodifiedText: text } : {}) }, sessionId);
-    await this.send("Input.dispatchKeyEvent", { type: "keyUp", ...common }, sessionId);
-  }
-
-  async screenshot(sessionId: string, path: string) {
-    const r = await this.send("Page.captureScreenshot", { format: "png" }, sessionId);
-    await Bun.write(path, Buffer.from(r.data, "base64"));
-  }
-
-  close() {
-    this.ws.close();
-  }
-}
-
-export const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));

package/.spike/cleanup-ppm-workspace.mjs

@@ -1,44 +0,0 @@
-// One-off: remove the duplicate `terminal:1@panel-*` tabs an earlier smoke run left in the
-// real `ppm` project workspace. Prints before/after; makes no other change.
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { Database } from "bun:sqlite";
-
-const API = "http://127.0.0.1:8099";
-const db = new Database(join(homedir(), ".ppm", "ppm.dev.db"), { readonly: true });
-const TOKEN = JSON.parse(db.query("SELECT value FROM config WHERE key='auth'").get().value).token;
-db.close();
-
-const H = { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json" };
-const res = await fetch(`${API}/api/project/ppm/workspace`, { headers: H });
-const json = await res.json();
-if (!json.ok || !json.data) {
-  console.log("no server workspace for ppm:", JSON.stringify(json).slice(0, 300));
-  process.exit(0);
-}
-const layout = json.data.layout;
-const dump = (l) =>
-  JSON.stringify(Object.fromEntries(Object.entries(l.panels).map(([k, v]) => [k, v.tabs.map((t) => t.id)])));
-console.log("before:", dump(layout));
-
-const BAD = /^terminal:1@panel-/;
-let removed = 0;
-for (const panel of Object.values(layout.panels)) {
-  const keep = panel.tabs.filter((t) => !BAD.test(t.id));
-  removed += panel.tabs.length - keep.length;
-  const ids = new Set(keep.map((t) => t.id));
-  panel.tabs = keep;
-  panel.tabHistory = (panel.tabHistory ?? []).filter((id) => ids.has(id));
-  if (panel.activeTabId && !ids.has(panel.activeTabId)) {
-    panel.activeTabId = panel.tabHistory.at(-1) ?? keep.at(-1)?.id ?? null;
-  }
-}
-console.log("after: ", dump(layout), `removed=${removed}`);
-if (removed === 0) process.exit(0);
-
-const put = await fetch(`${API}/api/project/ppm/workspace`, {
-  method: "PUT",
-  headers: H,
-  body: JSON.stringify({ layout }),
-});
-console.log("PUT:", put.status, JSON.stringify(await put.json()).slice(0, 200));

package/.spike/group-protected-probe.ts

@@ -1,21 +0,0 @@
-// How many groups would the whole-app kill button be enabled for, per the live snapshot?
-import { Database } from "bun:sqlite";
-import { homedir } from "node:os";
-import { resolve } from "node:path";
-import { isGroupProtected } from "../src/web/components/system/build-kill-request.ts";
-
-const db = new Database(resolve(homedir(), ".ppm", "ppm.dev.db"), { readonly: true });
-const row = db.query("SELECT value FROM config WHERE key = 'auth'").get() as { value: string } | null;
-const token = row ? JSON.parse(row.value)?.token : undefined;
-const res = await fetch("http://localhost:8081/api/system/resources?processes=1", { headers: token ? { Authorization: `Bearer ${token}` } : {} });
-const snap = (await res.json()).data;
-const byPid = new Map(snap.processes.map((p: any) => [p.pid, p]));
-let enabled = 0, disabled = 0;
-const protectedNames = new Map<string, number>();
-for (const g of snap.groups) {
-  const members = g.pids.map((pid: number) => byPid.get(pid)).filter(Boolean);
-  if (isGroupProtected(members)) { disabled++; for (const m of members) if (m.protected) protectedNames.set(m.name, (protectedNames.get(m.name) ?? 0) + 1); }
-  else enabled++;
-}
-console.log({ groups: snap.groups.length, enabled, disabled, processes: snap.processes.length, protectedProcs: snap.processes.filter((p: any) => p.protected).length });
-console.log("protected names in disabled groups:", [...protectedNames].slice(0, 12));

package/.spike/pip-eval.ts

@@ -1,17 +0,0 @@
-// Ad-hoc: evaluate a JS expression in the spike Chrome's app page. Usage: bun pip-eval.ts "<expr>" [--shot path]
-import { CdpClient } from "./cdp-client";
-const expr = process.argv[2] ?? "location.href";
-const shotIdx = process.argv.indexOf("--shot");
-const cdp = await CdpClient.connect(9333);
-const targets = await cdp.targets();
-const page = targets.find((t) => t.type === "page" && t.url.startsWith("http://localhost:5173"));
-if (!page) throw new Error("no page: " + JSON.stringify(targets));
-const sid = await cdp.attach(page.targetId);
-try {
-  const v = await cdp.eval(sid, expr);
-  console.log(typeof v === "string" ? v : JSON.stringify(v, null, 2));
-} catch (e) {
-  console.error(String(e));
-}
-if (shotIdx > 0) await cdp.screenshot(sid, process.argv[shotIdx + 1]!);
-cdp.close();

package/.spike/pip-page-helpers.js

@@ -1,119 +0,0 @@
-// Injected into the PPM page via Runtime.evaluate. Defines window.__spike helpers.
-// Spike helper only (untracked). Plain JS, no bundling.
-(() => {
-  const S = (window.__spike = window.__spike || { log: [], results: {} });
-  S.note = (m) => { S.log.push(`${new Date().toISOString().slice(11, 23)} ${m}`); console.log("[spike]", m); };
-
-  // ---- React fiber walk: find xterm Terminal instance owned by a tab wrapper ----
-  S.fiberOf = (el) => {
-    const k = Object.keys(el).find((k) => k.startsWith("__reactFiber$"));
-    return k ? el[k] : null;
-  };
-  S.findTerminal = (wrapper) => {
-    const container = wrapper.querySelector(".xterm")?.parentElement;
-    if (!container) return null;
-    let f = S.fiberOf(container);
-    for (let depth = 0; f && depth < 40; depth++, f = f.return) {
-      let hook = f.memoizedState;
-      for (let i = 0; hook && i < 200; i++, hook = hook.next) {
-        const cur = hook.memoizedState && hook.memoizedState.current;
-        if (cur && typeof cur.getSelection === "function" && cur.buffer && typeof cur.rows === "number") return cur;
-      }
-    }
-    return null;
-  };
-  S.termText = (term, lastN = 60) => {
-    const buf = term.buffer.active;
-    const out = [];
-    for (let i = Math.max(0, buf.length - lastN); i < buf.length; i++) out.push(buf.getLine(i)?.translateToString(true) ?? "");
-    return out.join("\n");
-  };
-
-  // ---- Monaco editor instance owned by a wrapper ----
-  S.findEditor = (wrapper) => {
-    const m = window.monaco;
-    if (!m) return null;
-    return m.editor.getEditors().find((e) => wrapper.contains(e.getDomNode())) ?? null;
-  };
-
-  // ---- Style copy into PiP document ----
-  S.copyStyles = (pipDoc) => {
-    const stats = { inlineSheets: 0, clonedLinks: 0, failed: 0, rules: 0 };
-    for (const sheet of document.styleSheets) {
-      try {
-        const rules = [...sheet.cssRules];
-        const style = pipDoc.createElement("style");
-        style.textContent = rules.map((r) => r.cssText).join("\n");
-        pipDoc.head.append(style);
-        stats.inlineSheets++; stats.rules += rules.length;
-      } catch (e) {
-        if (sheet.href) {
-          const link = pipDoc.createElement("link");
-          link.rel = "stylesheet"; link.href = sheet.href;
-          pipDoc.head.append(link); stats.clonedLinks++;
-        } else stats.failed++;
-      }
-    }
-    // Theme lives on <html class="dark|light" style="--token: ...">
-    pipDoc.documentElement.className = document.documentElement.className;
-    pipDoc.documentElement.style.cssText = document.documentElement.style.cssText;
-    pipDoc.body.className = document.body.className;
-    pipDoc.body.style.cssText = "margin:0;width:100vw;height:100vh;overflow:hidden;position:relative;";
-    return stats;
-  };
-
-  // ---- Move / return ----
-  S.moveToPip = (pip, wrapper) => {
-    const slot = wrapper.parentElement;
-    S.origin = { slot, next: wrapper.nextSibling, display: wrapper.style.display, cssText: wrapper.style.cssText };
-    pip.document.body.append(wrapper); // adopts node into pip document
-    wrapper.style.position = "relative"; wrapper.style.inset = ""; wrapper.style.width = "100%"; wrapper.style.height = "100%";
-    return { adopted: wrapper.ownerDocument === pip.document, slotTag: slot.tagName, slotHasWrapper: slot.contains(wrapper) };
-  };
-  // Spike-only: stop ReparentingTab's layout effect (slot.appendChild(wrapper) on every render) from pulling the wrapper back.
-  S.pinToPip = (wrapper) => {
-    const slot = S.origin.slot; S.pinned = wrapper; S.pullbackAttempts = 0;
-    if (!slot.__spikePatched) {
-      const orig = slot.appendChild.bind(slot);
-      slot.appendChild = (n) => { if (n === S.pinned) { S.pullbackAttempts++; return n; } return orig(n); };
-      slot.__spikePatched = true;
-    }
-  };
-  S.unpin = () => { S.pinned = null; };
-  S.moveBack = (wrapper) => {
-    const { slot, cssText } = S.origin;
-    S.unpin();
-    slot.append(wrapper);
-    wrapper.style.cssText = cssText;
-    return { back: wrapper.ownerDocument === document && wrapper.parentElement === slot };
-  };
-
-  // ---- Trusted-gesture button: onclick runs the async fn, stores result ----
-  S.installButton = (id, fn) => {
-    document.getElementById(id)?.remove();
-    const b = document.createElement("button");
-    b.id = id; b.textContent = id;
-    b.style.cssText = "position:fixed;left:8px;bottom:8px;z-index:2147483647;padding:8px 12px;background:#e11;color:#fff;font:14px sans-serif;";
-    b.onclick = async () => {
-      S.results[id] = { phase: "running" };
-      try { S.results[id] = { phase: "done", value: await fn() }; }
-      catch (e) { S.results[id] = { phase: "error", error: String(e && e.stack || e) }; S.note(`button ${id} error: ${e}`); }
-    };
-    document.body.append(b);
-    const r = b.getBoundingClientRect();
-    return { x: r.x + r.width / 2, y: r.y + r.height / 2 };
-  };
-
-  // ---- Event probes (native listeners in main doc + pip doc + on wrapper) ----
-  S.installClickProbes = (pip, wrapper) => {
-    S.probe = { mainDocClick: 0, pipDocClick: 0, wrapperClick: 0, reactRootClick: 0 };
-    document.addEventListener("click", () => S.probe.mainDocClick++, true);
-    pip.document.addEventListener("click", () => S.probe.pipDocClick++, true);
-    wrapper.addEventListener("click", () => S.probe.wrapperClick++, true);
-    document.getElementById("root")?.addEventListener("click", () => S.probe.reactRootClick++, true);
-  };
-
-  S.toastText = () => [...document.querySelectorAll("[data-sonner-toast]")].map((t) => t.textContent).join(" | ");
-  S.note("helpers installed");
-  return "ok";
-})();

package/.spike/pip-results-editor-glue.json

@@ -1,105 +0,0 @@
-{
-  "mainState": {
-    "layout": [
-      1395,
-      814
-    ],
-    "slot": [
-      1033,
-      655
-    ],
-    "editContextOpt": true,
-    "nativeEditContextEl": true,
-    "editContextApi": true,
-    "minimapEnabled": false
-  },
-  "layoutFixInMain": [
-    1033,
-    627
-  ],
-  "move": {
-    "phase": "done",
-    "value": {
-      "pipSize": [
-        1395,
-        842
-      ],
-      "layoutBeforeExplicit": [
-        1033,
-        627
-      ],
-      "layoutAfterExplicit": [
-        1395,
-        814
-      ],
-      "wrapper": [
-        1395,
-        842
-      ]
-    }
-  },
-  "pipFocusTarget": {
-    "focused": "native-edit-context",
-    "hasEditContext": true
-  },
-  "typingEditContext": {
-    "line2": "EC export const spikeLine1 = \"one\";",
-    "pass": true
-  },
-  "insertTextEditContext": {
-    "line2": "EC IT export const spikeLine1 = \"one\";",
-    "pass": true
-  },
-  "switchToTextarea": {
-    "editContextOpt": false,
-    "textarea": true,
-    "nec": false
-  },
-  "typingTextarea": {
-    "line2": "TA EC IT export const spikeLine1 = \"one\";",
-    "pass": true
-  },
-  "suggestWidget": {
-    "inWrapper": true,
-    "visible": true,
-    "inMainDoc": false,
-    "items": 12
-  },
-  "resizeGlue": {
-    "pipResizes": 2,
-    "layout": [
-      684,
-      408
-    ],
-    "pip": [
-      684,
-      408
-    ]
-  },
-  "back": {
-    "back": true,
-    "layoutStaleAfterReturn": [
-      684,
-      408
-    ],
-    "layoutAfterExplicit": [
-      1033,
-      627
-    ],
-    "slot": [
-      1033,
-      655
-    ]
-  },
-  "undoAfterReturn": {
-    "steps": [
-      "TA EC IT export const spikeLine1 = \"one\"; || L8=",
-      "TAEC IT export const spikeLine1 = \"one\"; || L8=",
-      "EC ITexport const spikeLine1 = \"one\"; || L8=",
-      "ECexport const spikeLine1 = \"one\"; || L8=",
-      "export const spikeLine1 = \"one\"; || L8=",
-      "export const spikeLine1 = \"one\"; || L8="
-    ],
-    "line2Restored": true
-  }
-}