@hienlh/ppm 0.23.12 → 0.23.13

package/CHANGELOG.md

@@ -1,5 +1,191 @@
 # Changelog
 
+## [0.23.13] - 2026-10-08
+
+### Added
+
+- **One click installs what Settings used to give you commands for.**
+  - **Settings → Design** installs the suggested design skill, ui-ux-pro-max 2.15.0, for each design provider you use (Claude's `~/.claude/skills`, Codex's `~/.agents/skills`) and names it in your design instructions. The result is the same as running `uipro init --global`, checked file for file, from a download pinned by checksum; a skill folder that is already there is left alone. Its scripts need Python 3, and PPM says so when the machine has none. The commands are still there under "Install it yourself instead".
+  - **Settings → Language Servers** and the editor's missing-server dialog install clangd and the Lua server by downloading the project's own release (pinned by version and SHA-256, and started once to check it runs on this machine), and Solargraph with the machine's Ruby, all into PPM's own folder; Remove deletes them again. Every server in the list now has an Install button wherever the machine can carry it out. Solargraph is not offered on Windows, and says so when a gem needs a C compiler the machine lacks.
+  - **Tailscale on Linux** and **Voice Input on a Mac**: a step that needs your password or Homebrew has a button that types its command into a PPM terminal, where you press Enter. For Tailscale one command installs, starts and lets PPM manage it, so the password is asked once; for Voice it is `brew install whisper.cpp`, and the pane carries on once whisper.cpp is there. Nothing runs until you press Enter.
+
+- **The AI can open files and show you the pages it makes, in PPM tabs.** Turn on **Settings → AI Provider → Let the AI open tabs in PPM** and Claude and Codex get two tools. Each opens a tab on the device you sent the message from: beside the chat on a desktop, or in place of the chat on a phone. PPM serves the page itself, so it works the same over a LAN address, the tunnel and a phone. Turning the setting on also turns off Claude's claude.ai Artifact tool inside PPM. It applies to new chats.
+  - **`open_file`** opens a file the way you would: code in the editor, at a line when the AI points at one, and HTML, Markdown, images, PDF and CSV in their viewers.
+  - **`open_preview`** is for what the AI made: a page, chart, report or mockup. The tab opens and the page loads. The AI then gets the page's script and loading errors, its layout problems, and a screenshot at the size the tab has on your screen, so it can fix what it sees and call again; a tab that is already open reloads in place. Tried with real Claude and Codex: each fixed a page whose chart library 404'd in one round, in 73 s (Claude) and 107 s (Codex) end to end.
+  - **HTML previews may load scripts, styles and fonts from a CDN**: cdn.tailwindcss.com, cdn.jsdelivr.net, unpkg.com, fonts.googleapis.com and fonts.gstatic.com. `fetch`/XHR still reach only the files next to the page.
+  - **Every call is a card in the chat**, such as "Preview · dashboard.html · 2 problems" or "Opened · totals.ts:20". Its **Open** button brings the tab back after you closed it, from the chat's history, or on another device.
+  - If no PPM window is showing the chat, the tool answers at once that nothing was shown and says where the file is, and the AI passes that on.
+
+- **A Logs window in place of Report Bug: read what PPM logged, see what AI made of the errors, and report a bug from the lines that show it.** The Logs button at the bottom of the rail (in the menu on a phone; Logs and Report a Bug in the command palette) opens a window on a desktop and a tab on a phone, with three tabs:
+  - **Logs** reads `ppm.log` and its rotated copies, `cloudflared.log` and the consoles of open PPM tabs as one list, sorted into AI & chat, Shell & tools, Server, Extensions, Files, Automation, Tunnel and Browser, each with its count of errors and warnings. Filter by level, tag, text (plain or a regular expression), chat and time (15 minutes, an hour, since the last restart, today, everything kept). Repeats fold into one line with a count, restarts are marked, and new lines arrive live while the window is open: Follow keeps the newest in view and stops once you select lines, so the list holds still while you pick; Pause holds them back. The list keeps its place when you go to Issues or Report and back. Select lines with click, Shift, Ctrl or a drag (on a phone, long-press one and tap the last) and add them to the current chat, a new chat or the report, or copy them; the lines in view can be saved as a `.log` file. A chat's ⋯ menu has Show logs for this chat.
+  - **Issues** is the last 24 hours of errors and warnings, grouped by cause by Claude Haiku 4.5 on your own Claude account and labelled a likely PPM bug, your setup, upstream or expected, with why and, where it can, a fix. Info lines are never sent, and secrets, home folders, email addresses and chat ids are removed first. Each issue leads to its lines, into a chat, or to a drafted report. Auto sorts new patterns at most every ten minutes and only while something is looking at them; the Logs button shows a red count of likely bugs, which can be switched off.
+  - **Report** turns the chosen lines into a GitHub issue for hienlh/ppm: a title, labels, what happened, steps and what was expected, written by you or drafted by Claude from the lines, each snippet with 5 or 20 lines of context either side if you want them, and your environment. Home folder, email addresses, chat ids and project names can be masked, secrets and quick tunnel addresses always are, and the preview marks every masked spot. Nothing is sent from PPM: Open GitHub issue opens GitHub with the report filled in for you to read and submit (copying the body instead when it is too long for a link), and open issues that look like the same problem are listed beside it.
+  - The login screen's Report Bug opens a GitHub issue holding only the PPM version and browser, since the Logs window needs signing in. `/api/logs/recent`, the log tail it used to read, needs signing in now too.
+
+- **Log levels, and a log that records what PPM did.** Every line in `~/.ppm/ppm.log` now carries one of `DEBUG`, `INFO`, `WARN`, `ERROR` or `FATAL`, and `ppm logs --level warn` shows only that level and above (with `-n` and `-f` too). `INFO` is the default; `ppm config set log_level debug` turns on the detail without a restart, and `PPM_LOG_LEVEL` pins a level for one process.
+  - Every HTTP request is logged once, with method, path, status and time — a change at `INFO`, a read at `DEBUG`, a failure at `ERROR` with the message it returned (and the stack when a handler threw) — and every WebSocket opening and closing. Secrets in query strings and preview tokens in paths are cut out.
+  - Settings changes (the field names, never the values), database creation and migrations, server start-up and shutdown are logged; a database that will not open and a port that will not bind are `FATAL` before the process exits.
+  - Each part of PPM now records what it did: every chat turn's start and end with its outcome (`success`, `aborted`, `error`, …), account token refreshes and accounts taken out of rotation, git writes (commit, push, branch, merge, …), terminals opening and exiting, Remote Desktop and Android sessions, language servers, database pools, SSH tunnels and import/export jobs, extensions (including their own console output), Task Manager kills and signals, and the supervisor's restarts, upgrades, tunnels and PPM Cloud connection — a server that keeps crashing and is given up on is `FATAL`.
+  - A helper process that dies on its own — ffmpeg, the emulator, a language server, the Codex app-server, the WebRTC relay, the extension host — is an `ERROR` with the last of its output, where it used to vanish without a trace. Failures that were caught and dropped are logged, and one that repeats on every poll is logged once and then at `DEBUG`.
+  - The log used to be 81% one streamed SDK event, which rotated everything else out within about nine hours. Per-event chatter is `DEBUG` now, and chat text, tool output and shell commands, some of which used to be written into the log, are not logged at all. Accounts are named by id, never by email.
+  - `/api/logs/recent` (the old bug report's log tail) returns only `INFO` and above, and a Telegram bot token, an ntfy topic and a Remote Desktop stream name are redacted like the other secrets. A bug report also drops a quick tunnel's address, which lets anyone reach the forwarded dev server.
+  - CLI commands write their log lines to stderr, so a command's own output (`--json`, a pipe) stays clean.
+
+- **Settings → Remote Access → Tailscale: PPM at a private address on your tailnet, with an on/off switch.** Turned on, PPM answers at `https://ppm.<your-tailnet>.ts.net` on every device signed in to your tailnet: a Tailscale Service hosted by this machine, with a real certificate and nothing opened to the internet. Tailscale decides most of the setup in its admin console, so the pane walks through it and checks each step itself: install Tailscale, let PPM manage it (Linux), sign in, turn on MagicDNS and HTTPS, tag the machine, and create the service. Each step links to the page that does it and turns green on its own once Tailscale reports the change. Signing in happens in the pane, with the sign-in link and a QR code so a phone can finish it, and a bottom sheet on a phone.
+  - Once on, the pane says whether an admin still has to approve this machine as the service's host, and gives the `autoApprovers` snippet that makes that automatic. When it is live, the address can be copied, opened or shown as a QR code.
+  - The address survives restarts and reboots: Tailscale keeps it, and PPM puts it back at start-up if it went missing. A `svc:ppm` set up by hand before this shows as on.
+  - It never takes over a name that already points somewhere else without asking, turning it off clears it only while it still points at PPM, and turning it on needs PPM's password to be on, since anyone in the tailnet could otherwise open PPM. The name (`ppm`, `ppm-mac`, …) can be changed while it is off.
+
+- **Forward a dev server and open it in a PPM tab, over Tailscale or Cloudflare.** Forward, in the sidebar's Port Forwarding panel, offers Tailscale (`https://<machine>.<tailnet>.ts.net:<port>/`, reachable from your tailnet only, at a URL that stays the same from one forward to the next) or Cloudflare (a public link), and Open in a tab shows the page inside PPM, with its toolbar under the thumb on a phone. Both go through a small hop on the host that makes the request look local to the dev server: Vite 8 listens on `[::1]` only and refuses a Host that is not localhost, so forwarding a Vite server with its defaults used to fail either way. A page that refuses to be framed (Rails and Django do by default) still shows in the tab: the hop lets the address PPM is open at frame it, and every other site is still refused. A Tailscale forward lasts as long as the `tailscale serve` process PPM runs for it, and PPM stops those when it exits, so a restart leaves no dead handler behind (only a `kill -9` of PPM itself can).
+
+- **Every file a chat changed, in one place, like Cursor's review.** A bar above the composer reads "N files changed +X −Y" for the whole session, across all its turns — the chip under each answer still covers that turn only. It opens into the file list (a bottom sheet on a phone), and Review or any file opens a Review tab that goes through the changes block by block, the way Cursor and Zed review an agent's edits: each block sits in place in its file, compared with the state the file was in *before the session first touched it*, and is kept or reverted right there. That is not git: an uncommitted edit from before the session is not counted as the session's, and a file edited in three turns is one set of blocks. The tab follows the chat while it runs and works on its own after a reload.
+  - PPM keeps that "before" itself, under `session-baselines/` in its directory, because nothing else has it: Claude Code's transcript drops a tool's `originalFile` above ~10 KB (kept at 9.8 KB, gone at 13.6 KB), and an Edit's `old_string` is a fragment. Claude's copy is taken by a PreToolUse hook just before the write, in every permission mode, sub-agents included; Codex applies a patch before PPM hears of it, so its "before" is the patch reverse-applied to the file. The first copy wins, a file over 5 MB or binary is listed without a diff, credential paths are never copied, and a session's copies go when it is deleted or after 30 days without a change.
+  - Files a Claude session changed with shell commands are listed too — a `cp`, a `sed -i`, a `printf >>`, a formatter, a `git checkout --` that threw a change away. PPM runs `git status` just before and just after each command in the repositories it can reach (its directory, the ones it `cd`s into or names, and the ones the session has written in), about 6 ms each, and a file whose status or timestamps moved in between is one the command changed. Its "before" is read ahead of the command when git already listed the file, and from HEAD otherwise. An edit committed in the same command is still found. A file git ignores or one outside any repository is not, and the list says so. Codex's shell commands are not followed yet.
+  - A session from before this falls back to git HEAD for the files its transcript names, inside the project only, and says so above its blocks.
+  - **Keep or revert, block by block.** Keep (Y) leaves a change and moves on; Revert (N) writes the block's original lines back to the file on disk at once, byte for byte (line endings and a missing last newline included), and leaves what it put back in place, dimmed. Every answer can be undone from a toast for 5 seconds, and a decided block has Change, which opens it again or undoes its revert later. J and K move between blocks across files; Keep file and Revert file… (confirmed first) answer a whole file, and a binary or very large file is only answered whole; Keep all remaining keeps everything still open. Lines are coloured like the chat's code blocks, with the changed part of each line marked. On a phone the tab shows the file in focus with Previous, Revert, Keep and Next under the thumb and the file list in a sheet; in a narrow split the list folds behind an "N files" button.
+  - **Answers are kept on the server**, so a phone and a desktop agree and a reload loses nothing. An answer applies only to the version on screen: a file the agent changed while you were reading it is left alone and drawn again. A file whose blocks are all kept is marked reviewed and leaves the bar's totals behind one "N reviewed — Show" row, as a checkbox or "Mark all reviewed" in the bar does; the bar shrinks to "All N files reviewed" once nothing is left. If the agent changes a reviewed file again it comes back as "New since review" with only the new blocks open.
+  - **Each block names the turn that wrote it.** A chip on the block ("Turn 2 · 14:03") opens the prompt that asked for the change, with Copy prompt and Show in chat, which brings the chat to the tool call and flashes it; a block two turns wrote names both. PPM records each file's state just before and just after every call that writes it — a file tool, a shell command, a Codex patch — as small deltas beside its "before", and works out which call put each line in the way `git blame` walks commits. A change no call made, such as your own edit or a formatter, names no turn.
+  - **Keep, revert, or revert a whole turn from the chat.** The pill under each answer says how that turn's edits stand ("3 edits to review", "Kept", "2 reverted"), and its tray — a sheet on a phone — keeps or reverts each edit, keeps them all, or opens the Review tab. Revert turn… shows first what it will do: what goes back in which file, a file the turn created removed, and any line a later turn changed again named and left alone ("app.ts line 2 stays as it is — Turn 2 changed it again."). It writes nothing if a file changed since that preview, leaves alone one that changes while it writes, and Undo puts it all back.
+
+- **Add selected code to chat.** Select code in the editor and Monaco's own yellow lightbulb offers Add to current chat and Add to new chat, in the same menu as a language server's quick fixes and refactorings (Ctrl+. opens it too). Selecting does not open anything by itself. The chip carries the file path, the selected line range and the editor's current text, unsaved edits included. When the line has no room for the bulb, Monaco puts it in the glyph margin left of the line numbers, which standalone Monaco turns off; it is now on, two lanes wide, with the bulb centred in it instead of pressed against the editor's edge, and the line-number column reserves three digits instead of five so the code starts where it did (2px further right). A click anywhere on the bulb opens the menu and keeps the selection.
+
+- **Add a terminal selection to chat.** Select text in a terminal and Add to current chat and Add to new chat appear right under it, as the editor offers them for a code selection (and as Cursor shows its Add to Chat). Either one adds the selection as a "Terminal selection" chip without sending anything, and clears the selection. On a phone, select in select mode; the buttons are finger-sized.
+
+- **Fix with AI and Explain with AI on errors and warnings in the editor.** Every error and warning offers both, the way Copilot's Fix and Explain do (Cursor has the first as Fix in Chat): in the lightbulb menu beside the language server's own quick fixes, each marked with a sparkle, and Fix with AI also as a one-click action in the problem's hover, next to Quick Fix. When they are the only fixes on offer, the bulb itself is a sparkle. Either one opens a new chat and sends the request at once: each problem with its line, column, source and code, then the code three lines either side as the editor has it, unsaved edits included. Explain asks for an explanation without changing any files. Hints and infos are not offered. TypeScript and most other languages report errors only while the language server is on (LSP in the editor toolbar); Monaco's own JSON and CSS checks report them either way.
+
+- **Reply to a user or AI chat message.** Select Reply to quote a completed message while keeping your draft and attachments. Quotes reach the AI on normal and mid-turn sends, survive history reloads, and remain readable if their source is unavailable. Reply drafts recover after reload or rejected sends; quote cards jump to a uniquely identified original message.
+
+- **The database sidebar is now a DBGate-style workspace, for SQLite, PostgreSQL, MySQL and MariaDB.** It was a list of connections, a table list and a read-mostly grid. It now follows DBGate's screens, one area at a time:
+  - **Connections**: a connection tab with General, Advanced, SSH Tunnel and SSL pages; Test shows the server version and its databases. A connection can **ask for its password** instead of storing it (Database Log In holds it until Disconnect), be limited to a list of databases, set the isolation level and a query timeout. The sidebar shows CONNECTIONS above TABLES, VIEWS, FUNCTIONS, with folders, status, filters and menus.
+  - **MySQL and MariaDB**: the `mysql2` driver installs from **Settings → Database Drivers** (or `ppm db driver install mysql`) rather than shipping in the binary; SSH tunnels use `ssh2` the same way.
+  - **Data grid**: DBGate's filter row and filter syntax with Set filter, Filter multiple values, Choose value and Lookup dialogs and a Filters panel; sort on several columns; 100 rows at a time with Fetch all; a Columns panel; the Rows / Count / Sum label.
+  - **Editing**: edit cells, add and delete rows, undo and redo, then **Save** shows the script and runs it in one transaction. Deleting a row other rows still point at offers **Delete references CASCADE**.
+  - **Form view (F4), Cell data and References**, including following a foreign key from a cell.
+  - **Copy advanced** in nine formats, **Generate SQL** (INSERT / UPDATE / DELETE) from selected rows, and **Export ▾** of the current view as CSV, TSV, JSON, NDJSON, SQL, XML or XLSX.
+  - **Structure tab**: add, change, rename and drop columns, keys and indexes with a preview of the DDL; new tables. SQLite changes that `ALTER TABLE` cannot express rebuild the table in SQLite's 12 documented steps.
+  - **Import/Export tab**: export several tables at once (one file each, one XLSX workbook with a sheet per table, or a zip) and import CSV, JSON or JSON-lines files into new or existing tables, as jobs you can stop.
+  - **Query tab**: runs a script one statement at a time with a **Messages** tab and a **Result** tab per statement, marks the line that failed, can go on past an error, **Stop** cancels the running statement on PostgreSQL and MySQL / MariaDB, a row limit per tab, EXPLAIN, **Format** (Shift+Alt+F: the script laid out by `sql-formatter` in the engine's own dialect, a MySQL `DELIMITER` block left as typed), a **History** panel read from the query audit log, and Ctrl+S to save the script as a `.sql` file.
+  - **On a phone**: the tree is a drawer, menus open on long-press as bottom sheets, filters and columns are sheets, a tapped row opens as a form, and Run sits in the thumb zone.
+
+- **Source Control, a new Review changes tab and the Git Graph now work as one flow: stage block by block, review, commit.** The three show the same changes, the same staged blocks and the same commit message, and an action in one shows in the others straight away.
+  - **Source Control** lists every changed file in one Changes group — staged, unstaged and new together — each with a checkbox (ticked, partly ticked or empty), a dot per block (green once staged), its +/− and its status letter. The branch row always says where the branch stands and offers the one action it needs: Push ↑n, Pull ↓n, Sync, Publish for a branch with no upstream, or Synced. The commit box adds Commit and push, Amend last commit, Commit with sign-off and Undo last commit (only while that commit is not pushed; its message goes back in the box). A merge, rebase or cherry-pick that stopped part way shows a banner with Abort and Continue, each conflict gets a Resolve that opens the conflict editor, and ticking a file that still has conflict markers asks first. Stashes (apply, pop, drop) and worktrees fold out below. On a phone the rows are 56 px, the checkboxes 48 px, and the commit box sits at the bottom, under the thumb.
+  - **Review changes** goes through what you have not committed block by block, the way the chat's session review goes through an agent's edits: Stage (Y), Discard (N), or Lines… (L) to stage single lines. J and K move between blocks across files, and the commit box is in the tab. A binary, very large or renamed file is one block for the whole file. Clicking a file in Source Control opens it here. On a phone the tab shows one block at a time with Discard and Stage at the bottom, and the file list and the commit box in sheets.
+  - **Git Graph** takes the app's colours, icons and font. A commit opens in an inspector on the right — an overlay below 900 px wide, a bottom sheet on a phone — with Checkout, Branch…, Cherry-pick, its message and its files, each with its own file-type icon. The Uncommitted changes row opens the commit box with a checkbox per file, and Review. The toolbar picks which branches are drawn, searches by message, author or hash, lists stashes and worktrees, and has Fetch, Pull ↓n and Push ↑n. A branch, tag or stash changed outside PPM, in a terminal for example, shows within the 5-second refresh instead of waiting for Refresh.
+  - **One commit message per repository**, kept on the server: what you type in one of the three boxes appears in the others, it survives a reload, and a commit from any of them clears all three.
+  - **A discard can be undone.** Discarding a block or a file shows a toast with Undo, and a discarded block keeps its Undo in the Review tab. git keeps nothing of a discarded change, so PPM keeps a copy for a day, up to 100 per repository, under `git-discards/` in its directory. Undo refuses rather than overwrite anything changed since; a file over 20 MB is not copied, and its discard says it cannot be undone.
+  - **Every view follows a change at once.** A git action made through PPM's git routes — everything in Source Control and the Review tab, and in the Git Graph its commit box, its toolbar and applying, popping or dropping a stash — tells Source Control, the Review tab, the Git Graph, the status bar and the file tree's colours to look again. The Git Graph's commit, branch and tag menus still run git themselves, and are seen at the next poll at the latest. After the Git Graph's Fetch, Pull or Push the status bar used to wait up to 10 seconds for its own poll; it now follows in about 0.6 s. The Git Graph's Fetch goes through PPM for that reason, and fetches every remote with prune.
+
+- **Push notifications to your phone or computer, switched on per device in Settings → Notifications.** It is standard Web Push: Chrome and Android deliver it through Firebase Cloud Messaging, Firefox and Safari through their own services, and PPM signs each push with its own key, so there is no Firebase project to set up. A notification says what happened and on which machine, with the detail worth reading without opening PPM — the end of the answer, the command waiting for approval, the question asked — and tapping it opens that session in the PPM window already open, or in a new one. A session has one notification at a time: a newer one replaces it. Push needs PPM on HTTPS or localhost, and on iPhone and iPad it works only once PPM is added to the Home Screen; the pane says which applies. Every device that receives push is listed with when it last got one, Send a test and Remove.
+
+- **Settings → Notifications decides what is sent and when, for push, Telegram and ntfy alike.** Each kind can be switched off (chat finished, needs approval, AI has a question, scheduled run, Jira). By default a notification waits a minute and goes out only if the chat is still unread by then: opening it on any device, or answering the approval, cancels it. "Right away" sends at once.
+
+- **Connect Telegram in one tap.** Connect Telegram makes a single-use link (with a QR code on a desktop); opening it in Telegram and pressing Start connects that chat — no pairing code to copy, and PPMBot does not have to be on. The pane walks through creating a bot with @BotFather, and a token is checked with Telegram before it is saved, so a mistyped one is refused with Telegram's reason instead of failing silently later. Telegram messages carry the same detail as push and link to the session.
+
+- **PPMBot has a Telegram bot and chats of its own, set up the way Notifications are.** Settings → PPMBot → Telegram now has the same parts as Notifications → Telegram: the bot token with the steps to create a bot in @BotFather (checked with Telegram before it is saved), a switch that turns PPMBot on and says whether it is running, the chats that can use PPMBot with Disconnect, and Connect Telegram with a single-use link and a QR code. There are no pairing codes any more: Connect Telegram is the only way in, as with Notifications, so nothing waits for approval, and a chat that writes to the bot without being connected is told once where to connect it. Notifications and PPMBot used to share one bot and one list of chats, so connecting a chat for alerts also let it command PPMBot, which runs tasks on this machine, and alerts arrived in the middle of PPMBot conversations. Now a chat connected in Notifications gets alerts and nothing else, and a chat connected in PPMBot can use PPMBot and gets no alerts. Controls are 44 px on a phone.
+  - Upgrading leaves nothing behind: every chat that got alerts still does, and a PPMBot that was on keeps answering on the bot it used, with a note in both panes suggesting a bot of its own. A PPMBot that was off starts with no bot. PPMBot's token is stored outside the config object, so nothing that shows config can reveal it.
+
+- **Notifications through ntfy**, on ntfy.sh or a server of your own. Enter the server, a topic (PPM suggests one that is hard to guess) and, for a server that requires sign-in, an access token; PPM checks that the address answers as ntfy and that the server accepts the token before saving, and saving a different server in Settings drops the token saved for the old one instead of sending it to the new one. Every phone or computer subscribed to the topic gets the same text as push, with a tap that opens the session; an approval or a question goes out at ntfy's high priority. ntfy has its own switch, Send a test, a link to the topic and a short guide, including the `upstream-base-url` setting an iPhone needs to get instant alerts from a self-hosted server.
+
+- **The System Monitor's Apps page works on Windows.** It used to say "This host does not list desktop applications". An app is now what Task Manager's Apps group shows — a process owning a visible, titled, top-level window — read over Win32 and named by its executable's own description. The page is sorted by memory, biggest first.
+
+- **The System Monitor's Services page works on Windows.** It used to say the host had no service manager; it now reads the Service Control Manager, with startup type, exit code and pid on the list and this boot's Event Log entries behind each service. One long-lived PowerShell session answers every poll rather than a process per poll.
+
+- **Remote Desktop offers each Windows monitor separately.** Windows listed one display — the whole virtual desktop — so monitors of different sizes streamed as one oversized frame holding area no screen shows. Each monitor is now its own entry to capture and control.
+
+- **An Install ffmpeg button on Remote Desktop's Windows readiness screen.** The checklist used to offer only a `winget` command to type into a terminal. It now runs the install on the host, shows its progress and WinGet's own error, and the re-check picks up the result without restarting PPM.
+
+- **A long chat opens a page at a time.** Opening a chat tab used to parse and render every message since the last compaction, which on a long session is thousands of bubbles and, on the server, minutes of CPU for a transcript in the hundreds of megabytes. History now arrives in windows, and scrolling up asks for the next one.
+
+- **An opt-in server memory monitor, `PPM_MEM_DIAG=1`.** Off unless set. It appends memory use, what grew and a few gauges to `<ppm dir>/mem-diag.log` every 30 seconds, and writes a heap snapshot the first time the heap crosses 1, 2, 4 and 8 GB — for diagnosing a server whose memory climbs.
+
+### Changed
+
+- **PPM's own public link moved from the sidebar's Tunnels panel to Settings → Remote Access, next to Tailscale; forwarding a port stays in the sidebar.** Remote Access has one sub-tab per way to reach PPM itself: Tailscale (the pane as it was) and Public link, which puts the on/off switch first, shows the link with Copy, Open and a QR code, and sets the two kinds of address side by side — a temporary trycloudflare.com one, or your own domain, set up right there. The sidebar panel, now Port Forwarding, opens with one row each for Tailscale and Cloudflare saying where it stands, and Set up (Manage once it is done) opens that service's sub-tab: signing in happens there, never in the panel. Below them it takes a port and a choice of Tailscale (your tailnet only) or Cloudflare (anyone with the link, no sign-in needed), and lists every forward with Open in a tab, Copy and Stop; a tunnel started outside PPM asks before it is stopped, and PPM's own link opens the Public link tab instead of offering Stop. Remote Access and Forward a Port in the command palette open them, on a phone too.
+- **A readonly connection is now enforced by the database itself, on every path — `ppm db query` included.** It used to be protected by a check of the SQL text alone, which let a write hidden in a function call through: `SELECT nextval('s')`, `setval`, any function that writes. PostgreSQL now runs each statement inside `BEGIN READ ONLY`, MySQL / MariaDB inside a READ ONLY transaction on a READ ONLY session, and SQLite opens a readonly handle. A statement that ran before on a readonly connection can now fail.
+- **Dates and times come back as the database prints them.** `ppm db data` and `/api/db/connections/:id/data` used to turn PostgreSQL timestamps into ISO strings in UTC; they now pass the database's own text through, as `psql` shows it. Anything that parsed the old ISO / UTC form needs updating.
+- **`verify-full` (PostgreSQL) and `VERIFY_IDENTITY` (MySQL) now check the certificate's name when the host is an IP address.** Bun did not check the name at all for an IP target, so a certificate that does not list that IP was accepted; it is now refused.
+- The separate PostgreSQL viewer and its CodeMirror SQL editor are gone: every connection, and a `.db` file opened from the file tree, uses the same data and Query tabs. `@codemirror/lang-sql` and `@uiw/react-codemirror` are no longer dependencies.
+- **Clicking a file in Source Control opens it in the Review changes tab instead of a diff.** Open diff in the file's menu still shows the whole file's diff. The list is now the default view; if you had picked the tree, it stays a tree.
+- **The Git Graph's commit details moved from the pane under the graph to an inspector on the right, and the Refs column is gone**: branch and tag labels lead the commit's subject, keep their whole names and take the colour of their line in the graph, the subject being what is cut short. Create worktree, Rebase and Interactive rebase are no longer on the commit menu — rebase is on a branch label's menu, interactive rebase in the command palette, and Add worktree… in the Worktrees menu. Refresh is in the View menu.
+- `POST /git/pull` now takes `{ rebase? }` and pulls from the branch's upstream; it no longer takes a remote or a branch. `POST /git/fetch` takes `prune`.
+- **Telegram alerts are no longer held back while a PPM tab is open.** They used to go out only when no browser was connected, so a tab left open anywhere — even in the background — meant no alert at all. They now follow the delay and unread rule in Settings → Notifications.
+
+### Fixed
+
+- **A container started from a PPM terminal or chat could restart PPM and end every session.** Under systemd, every process PPM started inherited systemd's notify socket, and systemd believed what any of them told it. `podman run` reports its container's monitor as the service's main process, so PPM "ended" when the container did, and a private `dbus-daemon` reports the service as stopping when it exits. Only the supervisor holds the socket now; the server, the edge forwarder, cloudflared and everything they start no longer get it (#38).
+
+- **The running-agents bar listed every named agent twice, and grew over the chat.** An agent given a name was reported once as an Agent card and again as a teammate, so a session that fanned out to eleven agents showed 22 rows covering the whole conversation. Each agent is one row now, and from four agents on the list scrolls inside about three rows under an "N agents running" header that folds it away: open on a desktop, folded on a phone.
+
+- **Save closed a new database connection's form.** It now stays open, as DBGate's does, as that connection's form: a second Save updates the connection instead of adding another one, and Edit on the connection brings that tab forward when it is in the focused panel. Connect still closes it.
+
+- **Account rotation sent most chats to one account.** A chat kept the account it started on for as long as it existed, so chats resumed days later all went back to it: five landed on one account in a single morning while another sat at 3%. A chat now keeps its account only while that account still holds the chat's prompt cache, which is all that staying saves, and is routed like a new chat once the cache has lapsed. Round-robin also started over at the first account after every restart, and skipped an account whenever another one dropped out of the list; it now carries on after the account it handed out last. And moving an idle Claude chat to another account in the usage panel now applies to its next message, as it already did for Codex, instead of waiting until something restarted the chat's process.
+
+- **A tool call made alongside another one lost its result when the turn ended.** The card showed a tick and nothing in it. Each block of a reply is stored as its own message, so two calls made at once sit in two messages with both results after the second, and the history reload that ends every turn put both results under the second call. Each result now stays with the call that made it.
+
+- **A chat that stopped on an error looked like it had simply finished.** A turn that hit Max Turns (500 steps for one message by default) showed its red line only until the chat reloaded its history, which happens on every reload and at the end of a long turn, and the notification still said "Chat completed". A bar above the composer now says why the last turn stopped — "Stopped after 500 steps (Max Turns)", with where the limit is set — and stays through reloads and reconnects until the next message, with a Continue button that picks the work up again. The notification for such a turn reads "Chat stopped" with the reason. The stop is read back from the session trace, because Claude's own transcript ends at the last tool result and has no record of it.
+
+- **A link into Settings did nothing while Settings was already open.** Open General in the Tailscale pane's password notice and Codex accounts & login in AI Provider did nothing at all, and Manage accounts in the chat's usage panel, or the link from a missing database driver, focused an open Settings window or tab but left it on the pane it was showing. It now moves to the pane the link names.
+
+- **A tap on a Telegram or ntfy notification opened PPM at this machine's LAN address** (`http://192.168.x.x:<port>`) whenever no Cloudflare tunnel was running: plain HTTP on an insecure origin, where the browser turns off notifications, the clipboard and the other permissions PPM asks for, and where you had to sign in again. The link now goes to the tunnel, else to PPM's Tailscale address, else to `localhost`.
+
+- **"Open in PPM" on a scheduled run's notification opened the wrong project.** The link was given the project's path where it needs the project's name, so it fell back to whichever project sorted first.
+
+- **A notification's link opened a Codex session as a Claude chat.** Links now name the session's provider, as the app's own chat URLs do.
+
+- **Extensions could read the Telegram bot token** through `workspace:config:get`. It is now withheld like PPM's other secrets.
+
+- **Scrolling up in a long chat failed with "File too large: 542MB exceeds 256MB limit".** A session that had run for five days reached 543MB and 141 compactions, and "Load previous conversation" refused the whole file on every scroll up, although the part each scroll shows is about 3MB. Only that part is parsed now: the file is scanned as bytes, as far as the end of the part, to find where the part starts and ends. The 256MB bound applies to the part parsed rather than the file.
+
+- **A Codex patch that touched several files counted only the first, and a file it created counted +0.** The chip under the answer and the transcript's change list now name every file in the patch, live and in both rollout formats, and a created or deleted file counts its lines: Codex sends those as the file's content, not as a diff.
+
+- **A refused turn said only "Invalid request sent to the API."** The API reports a refusal as an `invalid_request` error, and the chat showed the generic hint for that error. The CLI's own text in the message says what happened and what to do next (rephrase in a new session, or change the model), and it is now the error the chat shows.
+
+- **A diff on a phone was one changed line between screens of hatching.** The inline view hides the original side in a 35px column, and the diff viewer forced word wrap on it there too, so every original line was many rows tall and the visible side was padded to match. It now stays unwrapped in that mode, as Monaco keeps it itself; the Source Control diff tab had the same problem.
+
+- **Closing or switching a diff no longer throws "TextModel got disposed before DiffEditorWidget model got reset".** `@monaco-editor/react` disposes the two models before the diff editor still showing them; the viewer now detaches them first.
+
+- **A terminal could die with "double free or corruption" the first time you typed in it.** Some terminals are mounted but not on screen: the dock's active tab while the dock is hidden, and on a phone every dock terminal, because the dock is always restored collapsed there. Such a terminal was fitted to xterm's smallest size, 2 columns by 1 row, and that size went to the shell. zsh with a themed prompt corrupts its own memory redrawing that narrow. It then aborted on the first keystroke after the terminal was shown, which could be an hour later and at an ordinary size, so the crash pointed nowhere near its cause. Replaying the sequence against zsh with an oh-my-zsh + oh-my-posh config, 20 of 20 shells left at 2x1 died on that keystroke and none of the shells left at 80x24 did. A terminal is now never fitted below 20x2. The server also drops a smaller size, which covers a browser still running an older bundle. In Chrome against a scratch server, a terminal in a hidden dock gave its shell 2x1 before the fix and 80x24 after, then 140x11 once the dock was opened.
+
+- **The language server's quick fixes never appeared for an error.** The code-action request handed the server an empty list of diagnostics, and typescript-language-server finds its fixes from that list, so with LSP on an error had no Change spelling, no Add import, nothing. Measured against the real server, the same request offered no quick fix with the list empty, and Change spelling to 'answer' plus Remove unused declaration with the two diagnostics it had published. The request now carries the diagnostics touching the range, exactly as the server sent them.
+
+- **The lightbulb menu cut off its longest action** ("Move to a new…"). Monaco sizes that menu to its widest row and expects its 4px padding outside that width; Tailwind's global `box-sizing: border-box` put the padding inside, so every menu was 8px too narrow.
+
+- **New File and New Folder from a right-click menu did nothing.** In the project explorer the name box appeared and was gone about 10 ms later, so the toolbar button was the only way to create a file. Radix hands focus back to whatever held it before the menu opened — the right-clicked row — a moment after the menu closes, and does it unconditionally; the box had already taken focus, reads a blur as "done", and done with nothing typed means cancel. Rename escaped only because its box replaces the very row focus would have gone back to. The explorer window lost the same race another way: its name field focused while the menu's focus trap was still up, so it sat there unfocused and whatever was typed next went to the list behind it. A context menu now leaves focus where the chosen item put it (and still returns it to the row when the item moved it nowhere), and the window's field takes focus again once the menu has closed. In Chrome against a scratch server the box survived 0 of 5 attempts before and 5 of 5 after.
+
+- **The video player's seek bar came and went between two opens of the same file.** A video already in the media cache fires its load events before React has put the element in the page, and React drops them, so the player never learned the duration. It now reads that state from the element whenever the source changes.
+
+- **Dragging the video player's seek bar showed no frame until the release, and then the thumb jumped back.** A drag now seeks as it goes and holds a playing video still until the release (a transcoded stream still waits for the release, since each seek there is a new ffmpeg job), and the thumb stays where it was let go. The spinner fades in after 300 ms instead of flashing over every quick seek.
+
+- **On a phone, a long press that opens a menu no longer closes it when the finger lifts.** The menu opens after 400 ms, but the browser still treats a touch shorter than its own long-press delay as a tap: 500 ms by default on a phone, up to 1.5 s with a longer "Touch & hold delay". That tap landed on the menu's backdrop and closed it. This applied to every long-press menu in the app.
+
+- **On a phone, three controls outside the database screens are now 44 px touch targets:** the drawer's close button (which also had no accessible name), the version line at the foot of the drawer, and a toast's close button. Each was 17 to 32 px; the two close buttons look as they did.
+
+- **Pull failed whenever the branch had diverged from its remote.** git 2.33 and later refuse a plain `git pull` then ("Need to specify how to reconcile divergent branches") unless the repository says how to combine the two. PPM now merges, as GitHub Desktop does, when the repository sets none of `pull.rebase`, `pull.ff` or `branch.<name>.rebase`, and leaves it to git when it sets one.
+
+- **Popping or applying a stash from the Git Graph brought staged changes back unstaged.** It now restores the index too; when the staged part no longer fits, the changes come back unstaged and a toast says so.
+
+- **The conflict editor never showed the file.** It measured the space for the editor while its loading spinner was still up, found none, and never measured again.
+
+- **The Git Graph lost your place every 5 seconds.** Its refresh cleared the selected commit and the search results, and Refresh or loading more commits dropped the branch filter.
+
+- **The Git Graph drew `origin/HEAD` as a label of its own, and listed a branch called "origin".** git 2.48 and later create that pointer on every fetch; it is the remote's default branch, not a branch.
+
+- **The file tree's git colours stood still while Source Control was open.**
+
+- **On a phone, a long-press menu's sheet could be scrolled sideways by 4 px.**
+
+- **An extension panel such as the Git Graph came back in the old theme after its tab moved.** Change the theme, then split the panel, drag its tab elsewhere, or cross between the desktop and phone layouts, and the panel reloaded in the theme it had opened with and kept it until the next theme change. A panel is now told the current theme each time it loads; in Chrome the right theme was in place before the panel's first paint.
+
+- **A Claude chat could be resumed as Codex, answer "transcript was not found" and drop the message.** A session row written while marking a chat unread or claiming an account carried no provider, so every reader fell back to the install's default — which on a Codex-default install was the wrong one. The provider is recorded now.
+
+- **A long chat stopped loading its history and kept the server busy parsing.** Each state update asked the tab to refetch, and the refetch cancelled the one already on its way; on a transcript big enough that an answer takes longer than the gap between asks, none ever finished. Measured on an 85 MB transcript, it took 110 seconds a round and 368 requests piled up.
+
+- **Scrolling up in a long chat could drop the page just loaded, and lose an edit's place.** A refetch that answered after an older page had landed replaced the window with its own stale slice.
+
+- **Two Windows Store apps shared one row in the System Monitor**, because every Store app window is framed by one shared host process. End on either row killed both, and each counted the other's CPU and memory. Each app is its own row now, and a process is counted under one app only.
+
+- **A Windows service could be stopped through the API without the guard that protects critical services.** The guard and the no-op shortcuts read the last listing, which is empty until the page has been opened once and stale after any change — so a direct request could stop RPC or Audio, and a stop followed by a start answered "already running" without starting it.
+
 ## [0.23.12] - 2026-10-02
 
 ### Added

package/CLAUDE.md

@@ -60,6 +60,7 @@ Exceptions (intentionally use real `homedir()`):
 - `fs-browse.service.ts`, `git-dirs.service.ts` — file browser starting from real home
 - `ppmbot/` — bot files in real home
 - `slash-discovery/` — discovers skills from real home
+- `design/design-skill-install.service.ts` — installs the suggested design skill where Claude (`$CLAUDE_CONFIG_DIR/skills`, else `~/.claude/skills`) and Codex (`~/.agents/skills`) read user skills
 - `named-tunnel/cloudflared-cert.ts` — `~/.cloudflared` is where `cloudflared` itself writes `cert.pem`, not PPM's directory
 - `fs-credential-path-guard.ts` — refuses `~/.cloudflared` (alongside the PPM dir) on every fs read/write/transfer door
 - `db-backup/db-backup-paths.ts` — snapshots live in `~/.ppm-backups` *outside* the PPM dir on purpose, so they survive a wipe of it (under an isolated `PPM_HOME` they go back inside that temp dir)
@@ -90,11 +91,11 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **A signed-out Codex account fails slowly, and its retry notices are not errors**: a revoked or expired ChatGPT login does not fail `initialize` or `thread/start` — codex opens the turn, then sends `error` notifications with **`willRetry: true`** ("Reconnecting... N/5", ten of them over ~24s) before a final `willRetry: false`. The cause is only in `error.additionalDetails` (`workspace routing discovery unauthorized (401)`), never the headline. Mapping every `error` to a fatal event made the proxy give up at the first reconnect, and a retrying client then kept a dozen app-servers starting at once until the server stopped answering its health check. `codex-event-mapper.ts` turns retry notices into `status_update`; `codex-auth-failure.ts` recognises the 401 on the first one; `codex-account-auth-state.ts` benches the account (hard exclusion, unlike a quota park) so the turn rotates or fails in milliseconds; and `proxy-agent-turn.ts` caps concurrent proxy turns with a 429. Selection also has to ignore the usage figure for such an account: the usage endpoint keeps serving its last good reading, which made a dead account look emptier than a working one.
 - **Nested subagents are never streamed**: the SDK stamps `parent_tool_use_id` only on agents the session itself spawned. An agent that spawns another agent (a reviewer running `Skill code-review`, a planner calling researchers) produces **zero** stream events for that grandchild, so the Agent card would freeze on the forking step for minutes. Its transcript still lands in `<session>/subagents/agent-<id>.jsonl`, with a meta carrying only `parentAgentId` (raw id, no `agent-` prefix) and no `toolUseId`. `src/services/nested-subagent-spy.ts` tails those during the turn and `subagent-transcript-merger.ts` folds them in flat, time-ordered, on reload — both via `groupSubagentsByCard`, which walks the `parentAgentId` chain to the root card.
 - **A codex subagent is a session file of its own**: codex writes every spawned agent as a full rollout in the same `$CODEX_HOME/sessions` tree, with the same `cwd` as the conversation that spawned it — so a cwd filter alone lists each spawn as a top-level session that opens mid-stream, because a subagent's task is handed over as encrypted scaffolding and never appears as a `UserMessage` in its own transcript. `session_meta.parent_thread_id` is what tells the two apart. The parent names each spawn twice (`SubAgentActivity` `started`/`completed`) under **different item ids** but one `agent_thread_id`, which is why `codex-subagent-thread.ts` keys the card on the thread; `codex-history.ts` then reads the child rollout and hangs it under that Agent card.
-- **Agent teams are implicit and mostly not in `~/.claude/teams/`**: there is no `TeamCreate` tool any more. A team appears as `~/.claude/teams/<sessionId>/inboxes/*.json` with **no `config.json`**, so anything that requires a config sees no team at all. The inboxes only hold what was sent *to* each handle — in practice just the lead's task assignments — so they can neither say who is working nor show a teammate's replies. Both live in the agent transcripts under `~/.claude/projects/<slug>/<sessionId>/subagents/`: `agent-<id>.meta.json` maps the teammate `name` to its transcript, a transcript being appended to means that teammate is running, and its replies are `SendMessage` tool calls inside it. See `src/services/team-member-activity/`. A single teammate transcript reaches several MB, so the member window follows one by byte offset (`?sinceBytes=` on the transcript route, `member-transcript-tail.ts`) instead of re-reading it — an idle poll then costs nothing.
+- **Agent teams are implicit and mostly not in `~/.claude/teams/`**: there is no `TeamCreate` tool any more. A team appears as `~/.claude/teams/<sessionId>/inboxes/*.json` with **no `config.json`**, so anything that requires a config sees no team at all. The inboxes only hold what was sent *to* each handle — in practice just the lead's task assignments — so they can neither say who is working nor show a teammate's replies. Both live in the agent transcripts under `~/.claude/projects/<slug>/<sessionId>/subagents/`: `agent-<id>.meta.json` maps the teammate `name` to its transcript, a transcript being appended to means that teammate is running, and its replies are `SendMessage` tool calls inside it. See `src/services/team-member-activity/`. A single teammate transcript reaches several MB, so the member window follows one by byte offset (`?sinceBytes=` on the transcript route, `member-transcript-tail.ts`) instead of re-reading it — an idle poll then costs nothing. A named agent's meta carries the spawning call's `toolUseId` as well as its `name`, so it is an Agent card *and* a teammate: indexing by card and by name lists it twice, which is how the running-agents bar showed every agent of a fan-out session two times. `agent-transcript-activity.ts` lists a teammate only when no card covers its transcript.
 
 - **An extension panel only gets a tab if a browser tab asked for it**: `use-extension-ws.ts` creates a tab for `webview:create` only when `locallyDispatchedViews` holds a matching entry, i.e. when *this* client dispatched the command. A panel the extension opens on its own initiative exists server-side with no tab to show it. To open one panel from another, call `window.openTab("extension", …, { viewType })` instead — `extension-webview.tsx` then sees a tab with no panel and dispatches the command itself, which *is* a local dispatch. The recovery dispatch forwards only the project path, so any other argument has to be stashed for the target panel to pick up (`packages/ext-git-graph/src/panel-nav.ts`). The command id and the viewType must also be identical: both are turned into a tab slug by stripping a trailing `.view`, and a mismatch silently yields no tab.
 - **Extensions may only spawn `git`, `node`, `bun`, `npx`, `sqlite3`** (`ALLOWED_SPAWN_COMMANDS` in `extension-rpc-handlers.ts`) and the call *throws* for anything else. Reaching for `test`, `cat` or any other coreutil looks fine in review and fails only at runtime — where a surrounding `catch` can turn it into silently missing data rather than an error. `env` is merged over `process.env` (so `PATH` survives) except for `BLOCKED_ENV_KEYS`; `GIT_SEQUENCE_EDITOR` and `GIT_EDITOR` are not blocked, which is what makes a non-interactive `git rebase -i` possible.
-- **A webview inherits nothing from the app, including which theme is on**: the iframe is `sandbox="allow-scripts"` with its own document, so none of the CSS vars `apply-theme.ts` writes to `<html>` reach it and there is no `.dark` class to read. The only question the panel can ask by itself is `prefers-color-scheme` — the *OS* setting — which is why every extension panel rendered dark inside a light app on a dark desktop. `webview-theme.ts` stamps `data-ppm-theme` on the panel's own `<html>` and appends the app's tokens as a `:root[data-ppm-theme]` block, and the panels' dark rules are written as `:root[data-ppm-theme="dark"]` plus `@media (prefers-color-scheme: dark) { :root:not([data-ppm-theme="light"]) }` — a bare `:root` inside that media query is the bug, because it cannot lose to an explicit light. Three things are load-bearing: the injected block is *appended last* and ties on specificity, so a panel rule more specific than one attribute silently wins over the app's colours; the seed goes into `srcDoc` (later changes are `postMessage`d, because rewriting `srcDoc` reloads the panel and a graph would refetch every commit); and `--surface-hover` is derived from `--text` rather than injected, because some app themes give `--panel` and `--panel-2` the same value and a hover mapped from either would be invisible in exactly those themes.
+- **A webview inherits nothing from the app, including which theme is on**: the iframe is `sandbox="allow-scripts"` with its own document, so none of the CSS vars `apply-theme.ts` writes to `<html>` reach it and there is no `.dark` class to read. The only question the panel can ask by itself is `prefers-color-scheme` — the *OS* setting — which is why every extension panel rendered dark inside a light app on a dark desktop. `webview-theme.ts` stamps `data-ppm-theme` on the panel's own `<html>` and appends the app's tokens as a `:root[data-ppm-theme]` block, and the panels' dark rules are written as `:root[data-ppm-theme="dark"]` plus `@media (prefers-color-scheme: dark) { :root:not([data-ppm-theme="light"]) }` — a bare `:root` inside that media query is the bug, because it cannot lose to an explicit light. Three things are load-bearing: the injected block is *appended last* and ties on specificity, so a panel rule more specific than one attribute silently wins over the app's colours; the seed goes into `srcDoc` (later changes are `postMessage`d, because rewriting `srcDoc` reloads the panel and a graph would refetch every commit — and the theme is posted again on every iframe `load`, because the tab pool moves a tab with `appendChild` and a moved iframe reloads from that same `srcDoc`, whose seed is the theme of the moment the HTML arrived); and `--surface-hover` is derived from `--text` rather than injected, because some app themes give `--panel` and `--panel-2` the same value and a hover mapped from either would be invisible in exactly those themes.
 - **A webview panel has no `prompt`/`confirm`/`alert`**: `extension-webview.tsx` mounts the iframe with `sandbox="allow-scripts"` and nothing else, and a sandboxed `prompt()` returns `null` silently — no exception, no console warning. Any answer a panel needs has to be collected by markup it renders itself (`confirmHtml` in `reflog-view.ts`). The same string is a TypeScript template literal, so a backtick anywhere inside it — a `` `code span` `` in a comment is the usual one — ends the literal early and reports as a syntax error at some unrelated token far below.
 - **A Monaco model in PPM is not named after its file**: the editor mounts `<Editor value=... />` with no `path`, so Monaco names models `inmemory://model/N`. A language server has never heard of that, and the `file:` URIs it answers with match no model — so an unrewritten request makes the server answer about a document it was never given, and an unrewritten response makes Monaco treat the open file as a different one (go-to-definition inside the current file tries to *open* it, and diagnostics attach to nothing and never appear). `src/server/ws/lsp.ts` rewrites both directions, including URIs used as object *keys* in a workspace edit's `changes`.
 - **Standalone Monaco's F12 into another file hijacks the current editor**: its default editor service, once a model exists for the target, swaps that model into the editor you are in. The tab keeps its old title and its old dirty state while showing another file's contents. `lsp-navigation.ts` replaces the binding and opens a real tab instead. Peek and find-references are left on Monaco's bindings — they render in place and never navigate — but they need a model to exist for the target, which is what the shadow models in `lsp-shadow-models.ts` are for; there is no public way to give standalone Monaco a model *resolver*, so providers create the models before returning locations.
@@ -102,11 +103,12 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **`typescript-language-server` needs TypeScript 5.x**: the 7.x line is the native port and ships no `tsserver.js`, so the server exits at `initialize` with "provides no tsserver". It reads like a broken install rather than the wrong major version, so the registry's install hint pins `typescript@5`.
 - **A compiled PPM reaches none of its own `node_modules`, and is not bun**: `bundledServerEntry` resolves the TypeScript server it ships through `createRequire(import.meta.url)`, which in a compiled binary is `file:///$bunfs/root/…` — so resolution falls back to the process's **cwd**, and the systemd unit's cwd is `~/.ppm`. Measured: started from inside the checkout it answers the real path, started anywhere else `null`, i.e. "TypeScript is not installed" on every release binary and on the unit, for a server the repository does depend on. The second half is the same trap as `<ppm> x @openai/codex app-server`: `process.execPath` is bun only from source, so spawning `[process.execPath, entry]` runs *PPM's CLI* with a script path. Anything that runs a JS entry has to go through `resolveBunPath()` (`bunRuntime()` in `lsp-manager.ts`), and `installLanguageServer` needs it too — which is why a host with no bun at all is reported as not-installed rather than started and left to fail at spawn.
 - **`bun add` in a directory with no `package.json` installs into the parent**: it does not create a manifest where it was asked to. Measured — in `<dir>/sub` with a manifest at `<dir>`, the package landed in `<dir>/node_modules` and `sub` stayed empty. Anything installing into a PPM-owned directory (`lsp-install.ts`, `extension-installer.ts`) must write that directory's own `package.json` first, or the packages appear somewhere above the PPM dir and every later lookup answers "not installed".
-- **A `~/.cargo/bin` proxy exists whether or not the component does, and `Bun.which` cannot see a `PATH` you just set**: `~/.cargo/bin/rust-analyzer` is a symlink to rustup, present on any rustup install — measured on a host where `rustup which rust-analyzer` answered `unknown binary`, the symlink was right there. Found on `PATH` it reports an installed server that prints that error and exits at spawn, i.e. a *broken* server instead of the missing one the Install button is offered for, so `lsp-manager.ts` asks `rustupServerPath` **before** `Bun.which` and takes rustup's 3 ms answer as both the lookup and the installed-check. The same call is the reason a test cannot fake a missing toolchain: `Bun.which` reads the `PATH` the **process started with** and ignores every later write to `process.env.PATH` (so does `Bun.spawn`'s own resolution) — only the explicit `Bun.which(cmd, { PATH })` option is live, which is what `installToolPath` passes.
+- **A `~/.cargo/bin` proxy exists whether or not the component does, and `Bun.which` cannot see a `PATH` you just set**: `~/.cargo/bin/rust-analyzer` is a symlink to rustup, present on any rustup install — measured on a host where `rustup which rust-analyzer` answered `unknown binary`, the symlink was right there. Found on `PATH` it reports an installed server that prints that error and exits at spawn, i.e. a *broken* server instead of the missing one the Install button is offered for, so `lsp-manager.ts` asks `rustupServerPath` **before** `Bun.which` and takes rustup's 3 ms answer as both the lookup and the installed-check. The same call is the reason a test cannot fake a missing toolchain: `Bun.which` reads the `PATH` the **process started with** and ignores every later write to `process.env.PATH` (so does `Bun.spawn`'s own resolution) — only the explicit `Bun.which(cmd, { PATH })` option is live, which is what `installToolPath` passes. A child gets the same snapshot: `Bun.spawn` without `env:` passes the environment the process *started* with, so a variable written to `process.env` afterwards (a `beforeEach` setting one, say) never reaches it, under `bun test` too. Pass `env: process.env` or an argument; `tests/fixtures/fake-tailscale.ts` takes its state file as an argument for that reason.
 - **Standalone Monaco can never turn semantic highlighting on from a theme**: `StandaloneTheme` hardcodes `semanticHighlighting = false` and never reads it from the `defineTheme` data (`IStandaloneThemeData` has no such field), while the `semanticHighlighting.enabled` option defaults to `'configuredByTheme'` — so tokens are fetched, decoded, and change nothing. The only switch is the editor option set to `true` (`code-editor.tsx`). Colours then resolve through the *same* rule trie as TextMate scopes: `getTokenStyleMetadata` joins the type and its modifiers with dots (`variable.readonly.local`) and `ThemeTrieElement.match` falls back segment by segment, so a type with no rule lands on the theme's default foreground — i.e. plain text where the regex tokenizer had colour. `src/web/theme/semantic-token-rules.ts` is that table, and it must cover names outside the specification: `typescript-language-server` sends **`member`** for methods, one of the most common tokens in a TS file.
 - **Monaco's bundled TypeScript service is off entirely, and `setDiagnosticsOptions` is not what does it**: that call silences the validator but leaves all **thirteen** providers in `modeConfigurationDefault` registered, so every `.ts` file had two completion lists and two hovers — the second from a worker that sees one file with no `tsconfig.json` and no `node_modules`. It also cost a *visible* stall: answering a hover at all means fetching `ts.worker.bundle.js` (**13 MB**, the whole TypeScript compiler), and Monaco's hover widget merges every provider and shows "Loading…" until the last one replies — so the real server's answer rendered in milliseconds and then sat behind a spinner. `setModeConfiguration` is the call that unregisters them (`monaco-builtin-typescript.ts`, asserted against Monaco's own default list so an upgrade adding a provider fails a test). Consequence, accepted: a buffer the LSP cannot serve — untitled, external, inline — falls back to word-based suggestions only.
 - **A button in a Monaco hover is a `command:` link in *trusted* markdown, and trust is all-or-nothing unless you narrow it**: a hover can only contain markdown, so the blame hover's actions are `[label](command:id?args)` links reaching ids registered with `monaco.editor.registerCommand`. The renderer *strips* those links unless the `IMarkdownString` is trusted — and `isTrusted: true` allows **every** command on the page's global registry. That hover embeds a commit message, so anyone who can land a commit could write `[click](command:...)` in one and have it render as a working button. Both defences are needed and both are in `blame-hover.ts`: `isTrusted: { enabledCommands: [...] }` (an array is honoured by `toAllowCommandsOption`), and escaping the message so it cannot form a link at all. `supportHtml` stays **off** — the avatar is `![](data:image/svg+xml,...)`, which renders inline at its intrinsic size, so no HTML has to be allowed for it. Escape `<` and `>` too: with `supportHtml` off the renderer does not leave an unknown tag alone, it drops the tag and keeps the text, so a message mentioning a literal `<script>alert(1)</script>` displayed as `alert(1)` — the message silently rewritten in the one view meant to show it verbatim.
 - **Hovering injected text does reach the decoration under it, and Monaco has no `diff` language**: an `after` injected-text annotation sits past the line's last column, and `ContentHoverComputer._getLineDecorations` relaxes its column check by one character *only* for `showIfCollapsed` decorations — which is what makes the blame hover work at all, and why that flag is load-bearing rather than cosmetic. `editor.action.showHover` opens the same hover from the cursor, which is the touch path (gated on `hover: none`, not on a width breakpoint; the mouse target's `injectedText` would identify the tap exactly but is not in Monaco's public typings, so the handler goes by column). Separately: Monaco's 91 basic languages include no `diff` — VS Code's comes from a bundled extension — so a fenced diff block runs the tokenizer and comes back entirely `mtk1`, the theme's default foreground. `monaco-diff-language.ts` registers one and `theme/diff-token-rules.ts` colours it; a Monarch rule whose token name has no theme rule is the same silent no-op as an unmapped semantic token, and a test pairs the two so neither can be added without the other.
+- **Monaco hit-tests the gutter by x, and sizes its glyph margin in lanes**: standalone Monaco ships `glyphMargin` off (`editor.api2.js`), and the code-action lightbulb Monaco puts there when its line has no room is then drawn nowhere. Turned on, the margin is one line height per glyph *lane* in use, so the bulb fills a single 19px lane flush against the editor's edge. Moving it right with CSS looks correct and is a bug: `_hitTestMargin` tells glyph margin from line numbers by the x coordinate alone, so a bulb drawn over the line-number column still opens its menu and the same mousedown selects that whole line, replacing the selection the menu was opened for (measured: `[1,7 -> 2,8]` became `[1,1 -> 2,1]`). `monaco-lightbulb-gutter.ts` widens the margin instead, with two empty glyph-margin widgets. Three traps, all silent. Monaco draws one glyph per (line, lane), highest zIndex first and widgets winning ties, so at zIndex 0 the left widget hid the bulb on line 1. A `persistLane` *decoration* would hold the lanes as well, but any glyph decoration on the bulb's line makes the lightbulb give up the gutter and draw itself over the text. And the width follows the line that uses the most lanes, so both are held on the same line — one lane held on its own widens nothing. Separately, Tailwind's preflight `* { box-sizing: border-box }` makes Monaco's `.action-widget` 8px narrower than the row it measured, which cut the longest code action off with an ellipsis.
 - **The service worker's precache can silently undo any download saving, and both compressions are needed**: `injectManifest` defaults to precaching *everything* in the build output, so the first visit fetched 488 files / 33.3 MB — including the 12.7 MB TypeScript worker that `monaco-builtin-typescript.ts` had just made unnecessary to ever load. A saving measured in the network tab of a warm page is not a saving; measure `precache N entries (X KiB)` in the build output too. `globPatterns` now lists only the boot shell (9 entries / 1.08 MB) with everything else on a runtime `CacheFirst`. Separately, `scripts/precompress-web.ts` writes **both** `.br` and `.gz` siblings and `static-encoding.ts` picks one: brotli alone is not enough, because browsers advertise `br` only on a **secure origin** and PPM is routinely reached over plain HTTP on a LAN. And Monaco is staged locally by `scripts/copy-monaco.ts` with `loader.config({ paths: { vs: "/assets/monaco/vs" } })` — the default is jsdelivr, which means no editor offline and a third party told which files are opened. `vite build` empties `dist/web`, so `copy-monaco` and `precompress-web` must run *after* `build:web` (running `build:web` alone leaves an installed PPM with no Monaco at all).
 - **`FileSink.write()` consumes the whole chunk and returns a number that is not how much of it went in**: the careful-looking `while (off < buf.length) { off += await sink.write(buf.subarray(off)) }` is therefore a loop that re-sends the tail. Measured against `cat`, one 4,924,800-byte frame produced eleven `write()` calls each answering **475072** while everything had already been buffered, and the child received **28,043,840 bytes — 5.7x the frame**. Downstream the damage is silent and total: ffmpeg's rawvideo input is offset for good, so the *first* picture decodes perfectly and every one after it is drawn rolled, with no error from ffmpeg, from the sink, or from the encoder wrapper. One `write()` then `await flush()` is the whole correct form (`writeFrameToSink` in `android-video.ts`). Two things generalise. A frame **counter** cannot see this — every counter in the pipeline reported the right number while 5.7x the bytes left the process — so the test has to measure the bytes a real child receives (`tests/unit/android/android-video-frame-write.test.ts`), and it needs a chunk big enough that the sink buffers in pieces or the bug does not reproduce at all. And a capture that decodes correctly proves nothing if it holds one access unit: the first frame is always right.
 - **A lazy chunk boundary is one static import away from not existing, and it is invisible**: `code-editor.tsx` reaches the language service only through `lazy(() => import("./editor-language-service"))`, which is what keeps the LSP client out of the editor's chunk and — the part that actually costs something — keeps the code that asks the host for a server unreachable until the setting is on. One `import { anything } from "@/hooks/use-lsp"` anywhere on that static path merges the chunk back in and nothing about the UI looks different, so `tests/unit/web/editor-lsp-lazy-boundary.test.ts` enumerates the offenders instead. Importing even a *constant* from the lazy module counts; `import type` does not. Related: `lspEnabled` and `mobileWordWrap` are written with `persistDevicePref` (localStorage only) rather than `persistUiPref`, because the server round-trip that makes prefs survive an origin change also means the last device to write wins everywhere — and a desktop must not start an 854 MB server process for a phone.
@@ -149,6 +151,8 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 
 - **An ANSI palette's neutral ends sit on top of the background, and the fix is not in the palette**: two of the sixteen slots are *defined* to be extremes, so a light theme's `white`/`brightWhite` and a dark theme's `black` land on the background — 1.03–1.18:1 across PPM's six built-in themes, i.e. invisible rather than merely dim. It is not a theoretical slot either: oh-my-posh writes its second prompt line in plain **SGR 37**, correct on the dark terminal it was designed for, and that line was absent on every light theme. Recolouring the slot cannot fix it, because the same `white` is also the text *on* a coloured powerline segment where white is right — only a per-cell decision can tell the two uses apart. `minimumContrastRatio` is xterm's, it defaults to **1 (do nothing)**, and VS Code ships 4.5; it adjusts the foreground against each cell's real background, so segments render byte-identically and only text on the bare background moves. Set it as a *terminal* option, not via a renderer: the WebGL addon is skipped on touch devices, which is where this was reported from. Two traps when measuring a prompt: parse `38;5;`/`37`/`97` as well as `38;2;` truecolor, or plain-ANSI runs read as "no colour set" and the real culprit is invisible to the tooling too — and a `%{`…`%}`-quoted zsh prompt has to have those markers stripped before it is written to a terminal, since the shell normally eats them. `tests/unit/web/terminal-contrast.test.ts` pins the hazard and the mitigation together.
 
+- **xterm stays silent about a selection it already reported, even after clearing it**: `onSelectionChange` fires from `_fireEventIfSelectionChanged`, which compares against the last selection it *reported* — and `clearSelection()` fires the event without resetting that record. xterm itself clears on resize, on a buffer switch and whenever the user types with something selected, so selecting the same text again afterwards reports nothing, and anything driven by the event alone (the terminal's Add to chat bar) silently does not appear. Found by an e2e that selected the same rows twice; `terminal-selection-chat.tsx` also reads the selection on the mouseup that ends a press in the terminal. Related: `getSelectionPosition()` is typed as 1-based and returns 0-based columns and buffer rows, end column exclusive.
+
 - **An overlay on a vendored glyph assumes that glyph is empty, and an icon set migration silently breaks that**: the streaming chat tab draws three bouncing dots absolutely positioned over its 16px bubble icon, which was correct against lucide's hollow `MessageSquare`. Fluent's `chat` is the same bubble with **two message lines drawn inside it**, so after the migration the dots landed on the upper line in the same `currentColor` and the three fused into one lumpy bar — a static-looking smudge at the size a tab renders, reported as a broken animation rather than a wrong glyph, because the dots really were still bouncing. The fix is `chat-empty` (exported as `MessageCircle`), whose two subpaths are byte-identical to `chat`'s first two: same outline, nothing in it. Two things generalise. A glyph's *subpath count* is the cheap test for "does this draw anything inside itself" — `tests/unit/web/tab-streaming-indicator.test.ts` asserts the host glyph contributes exactly the outer edge and its hole, so a MAP edit or a regeneration cannot put a lined glyph back under the dots; and freezing a CSS animation with `animation-play-state: paused` plus a *negative* `animation-delay` renders any phase of its cycle, which is how a bounce this small is compared before and after at all. Note also that `isStreaming` is safe to branch an icon on only because both call sites read `sessionId` exclusively for `type === "chat"`.
 
 - **A Monarch `/$/` rule never runs, so a line-oriented grammar may not use states at all**: Monarch's per-line loop ends the moment the position reaches the end of the line, which means the idiomatic-looking `[/$/, { token: "", next: "@popall" }]` is dead code — the state entered mid-line is *never* left, and it carries into every following line. The `dotenv` grammar (`src/web/lib/monaco-dotenv-language.ts`, since Monaco ships no `.env` language and neither does VS Code) first used a `@value` state entered on `=`; from the first assignment on, the whole file tokenized as a value, so `#KEY=off` came back `string` — the one case the language existed for, still broken while every line *looked* coloured. Everything has to happen in `root`, the way Monaco's own `ini` does, and the test forbids a `next:` outright. Two consequences of statelessness worth knowing: a quoted value must be matched **whole** (`/"(?:[^"\\]|\\.)*"/`), which is the only way a `#` inside it is not read as a comment — at the cost of not colouring an interpolation inside quotes; and an unterminated quote falls through to the bare-value rule instead of swallowing the rest of the file. Separately, this grammar needs **no** `*-token-rules.ts` beside `diff-token-rules.ts`: its token names are Monaco's own (`comment`, `key`, `string`, `variable`, `keyword`, `delimiter`) and `monaco-adapter.ts` defines every PPM theme with `inherit: true`, so the colours arrive from the `vs`/`vs-dark` base and cannot drift from the app's themes — the test reads that pairing out of Monaco's own theme table rather than trusting it. Last trap, when verifying any of this in a browser: a standalone Monaco has **one global theme**, so two editors cannot show two themes at once (the second `create` silently retints the first), and sampling colours right after `setTheme` reads the *old* `mtk` class indices against the new palette — `string` measured as `#FF0000`. One editor, one reload per theme. Do not be misled by a `dotenv-*.js` chunk in the build output: that is shiki's TextMate grammar for a fenced `dotenv` block in markdown (`@shikijs/langs`, reached from `markdown-code-block.tsx`), a separate pipeline Monaco cannot read — there is no TextMate bridge in the editor, which is why a Monarch grammar had to be written even though the repository already ships a dotenv grammar.
@@ -188,6 +192,8 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **Design exports are octet-stream Blobs, and the view tabs are real links**: a `blob:` URL has PPM's origin, and a browser that ignores `download` (iOS Safari) would open an HTML one and run the design beside the token in `localStorage`. Print and "Open in new tab" are `<a target=_blank rel="noopener noreferrer">` to tokens minted when the menu opens, because a `noopener` `window.open` cannot report a blocked popup. `allow-modals` is reachable only through a print-purpose token; the CDN hosts the design CSP allows (jsdelivr, unpkg) run any npm or GitHub code, which is accepted.
 - **`tabSessionId()` is the only way to ask a tab for its session**: design tabs hold chat sessions too, so `type === "chat" && metadata.sessionId` makes a design session look unopened, and reopening it starts a plain chat outside design mode (`src/web/lib/tab-session-id.ts`).
 - **Hono's global `cors()` overwrites the `Access-Control-Allow-Origin` a route sets**: headers set before the handler are copied over the handler's response, so `design-preview.ts` re-asserts `null` in a middleware after `next()`, and its unit test mounts `cors()` like the real server. The same re-wrap (`new Response(res.body, res)`) makes Bun lose a `BunFile.slice()` body: behind `cors()` a `rangeFileResponse` 206 for `bytes=2-5` sends `Content-Length: 8` and bytes 2 to EOF. That one is still open; route unit tests mount without `cors()`, which is why none caught it.
+- **A gem installed into PPM's own folder cannot find itself, and a release zip needs a tool Bun does not have**: `gem install --install-dir <dir>` writes a binstub that asks RubyGems for its gem, and `<dir>` is on no gem path — measured, it exits with `Gem::GemNotFoundException` unless spawned with `GEM_PATH` naming `<dir>` (`installedServerEnv`, threaded `resolveCommand` → `LspSession.start`). Solargraph's dependencies (prism, rbs, jaro_winkler) compile C, so a host with no compiler fails with "Failed to build gem native extension" and a message that ends on a log path; `lsp-install.ts` says what is missing instead and deletes the half-install gem leaves "for inspection" (a first install only — a working one being updated keeps its folder). For downloads: `Bun.Archive` answers "Unrecognized archive format" for a zip and GNU tar cannot read one either, so a zip off Windows needs `unzip` or `bsdtar` on PATH (Windows' own `tar.exe` is bsdtar), and a host with neither has no button.
+- **The dev bundle's terminal connects straight to `:8081`, whatever server the page came from**: `use-terminal.ts` bypasses Vite's WebSocket proxy in dev, so under the html-preview harness (random API port) every terminal sits on "Reconnecting…" — and if a dev PPM is up on 8081, an e2e's terminal opens a shell *in that instance* and types into it. Check `ss -ltn` for 8081 first; to test a live terminal, put the scratch API on 8081 itself. React's `StrictMode` also double-mounts it in dev, so each terminal spawns two shells and a handed-over command is typed into both, showing twice in one xterm — dev only; a production build mounts once.
 - **A leading BOM makes parse5 drop the locations of `<html>`, `<head>` and `<body>`**: it is read as body text, so those explicit start tags lose `sourceCodeLocation`. Strip it first and address everything in the BOM-less text (`decodeDesignText`); parse5 offsets are UTF-16 code units of exactly the string parsed, as `String#slice` counts them, and `startTag.attrs` is keyed by the lowercased source name.
 - **The pre-migration database snapshot is skipped whenever `CURRENT_SCHEMA_VERSION` lags the migrations**: `backupBeforeMigrations` returns early for a database already at that version, and the constant sat at 47 while migrations reached 49, so a database at 47 ran 48 and 49 with no snapshot. Bump it with every migration; `db-session-design-slug.test.ts` asserts a migrated database ends at it.
 - **A PreToolUse hook verdict needs `hookSpecificOutput.hookEventName: "PreToolUse"`**: the bundled CLI reads `permissionDecision` only when the event name matches ("Hook returned incorrect event name" otherwise), so without it a Deny the user clicked did not block the tool. `preToolUseDecision()` in `claude-agent-sdk-query-options.ts` builds every verdict.
@@ -201,8 +207,30 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **WebCodecs is secure-context only, so Remote Desktop and the Android viewer cannot show a picture on a plain-HTTP LAN address** — which is how a phone or tablet normally reaches PPM. Measured in one browser at one moment: `VideoDecoder` is `undefined` on `http://192.168.98.96:3210` and present on `http://127.0.0.1:3210`, while `RTCPeerConnection` exists on both. Nothing warns; the viewer just reports "this browser has no WebCodecs" about a browser that is fine, which is why `missingDecoderReason()` branches on `window.isSecureContext` instead. The way out is WebRTC, and in Bun that means a **downloaded binary**: there is no WebRTC stack in the runtime, GStreamer's `webrtcbin` **segfaults PyGObject** on GStreamer 1.28.7 + Python 3.14 (`gst_webrtc_session_description_copy` → `gst_sdp_message_copy` → `g_strdup` on a malformed emails array — it dies just *reading* the offer, and rebuilding the description from SDP text does not help) *and* would put GStreamer + PyGObject on every Windows and macOS host, and `@roamhq/wrtc` only accepts raw i420, i.e. it would discard the hardware H.264 encode and re-encode in software. `mediamtx-*.ts` is the answer: MediaMTX repackages the H.264 ffmpeg already produced (verified — 1920x1080 Main@4.0 in, `video/H264` at the same size out) for 0.6% of a core and 55 MB RSS. Four traps in wiring it. Its **shipped `mediamtx.yml` must never be used**: it listens on every interface with RTMP/HLS/SRT/MoQ/API/metrics/pprof on, and MoQ writes `auto.crt`/`auto.key` beside itself on first start — PPM generates its own config and every switch is spelled out, because MediaMTX *rejects unknown keys* (`json: unknown field`), so a renamed key fails loudly instead of silently leaving a listener open. The **ICE/UDP port cannot be loopback** — WebRTC media is peer-to-peer, so confining it breaks every remote viewer while the page still connects; what protects it is the per-session ICE ufrag/password, which is why a test asserts the port is *not* loopback. `filesrc` **cannot read a FIFO** (it probes for seekability and closes it, so ffmpeg takes EPIPE) — open the FIFO yourself and hand over `fdsrc fd=N`. And the relay answers **404 until the publisher's first packet**, which a quality change re-creates by respawning ffmpeg, so the browser's WHEP handshake must retry rather than fail. Peer-to-peer also means a viewer on the **Cloudflare tunnel** has no route for the media at all: the handshake is proxied over HTTPS and succeeds, then nothing arrives, and Chromium takes **15 s** (measured, no candidate reachable) to call the connection `failed`. So `use-webrtc-canvas-video.ts` gives ICE `CONNECT_DEADLINE_MS` and the connection hook reconnects asking for the WebSocket stream, remembered for the tab in `sessionStorage` — but only where WebCodecs exists: behind the tunnel's HTTPS it does in any browser that ships it, on a plain-HTTP LAN origin it never does, and there the WebRTC error stands. Last: `startCapture` keeps `stdout: "pipe"` in both modes even though nothing reads it when publishing — making it conditional widens Bun's spawn type so `proc.stdout` is possibly-undefined everywhere below, the same family as the `ReturnType<typeof Bun.spawn>` trap above.
 - **`Bun.spawn({ stdin: other.stdout })` is not a pipe between two children**: Bun reads every byte into PPM and writes it back out with a pump of its own (measured: piping 200 MB raised the Bun process's own `rchar` and `wchar` by 200 MB each). Two failures follow, both silent until the reader dies. Under a burst, that pump rejects with `EPIPE`s nothing can catch — 2–3 per remux death with keyframe-sized writes, and `handleFatalError` in `src/server/index.ts` exits the server at 3 in a minute. And a reader that stalls before dying leaves the writer running for good, because Bun is still reading it: gst-launch kept encoding with no `onExit` and the viewer sat on a frozen picture. `remote-desktop-capture-wayland.ts` therefore pumps gst into the remux itself (one awaited `write()` + `flush()` per chunk, the same shape as the `FileSink` entry above) and watches **both** processes, the first to die taking the other down. `wayland-capture-supervision.test.ts` drives it with shell stand-ins; under `bun test` an unhandled rejection is a failed test, which is what makes the burst case assertable at all.
 
+- **The error that ends a turn is in no transcript, so anything rebuilt from history drops it**: a Max Turns stop reaches the browser as an `error` event and a `done` with `resultSubtype: "error_max_turns"`, and Claude's JSONL ends at the turn's last tool result. A reload rebuilds the chat from that transcript, and so does the end of any turn long enough to overflow the 10,000-event reconnect buffer (thinking deltas fill it), where `replayTruncatedRef` refetches history at idle — so the one red line saying why the session stopped vanished, and the notification said "Chat completed". `turn-stop-reader.ts` reads how the last top-level turn ended back from the session trace (a cancel, a newer message or a turn still running means no stop; rows with `parentToolUseId` are a subagent's), `session_state.turnStop` carries it to every greeting, `turn_stop` goes out just before the `done`, and `useChat` keeps it apart from `messages` so a refetch cannot erase it. Several `session_state` builders (model, effort, thinking) omit the field, which is why the client only touches `turnStop` when the key is present. Verify with `node tests/e2e/turn-stop-e2e.mjs` (`PPM_PLAYWRIGHT_MODULE` if Playwright is not installed here).
 - **`PRAGMA auto_vacuum` takes the write lock even when it changes nothing, so `busy_timeout` must be set first**: the session trace set it after `auto_vacuum`/`journal_mode` (copied from `query-audit-db.ts`, which still has that order), and a second process opening the file while another was mid-write got `SQLITE_BUSY` at once — measured: a lock held for 300 ms failed the open outright against a 2 s timeout. Only the full unit suite's server-plus-CLI race caught it. `journal_mode = WAL` on a file already in WAL does *not* wait on a writer, which is why `db.service.ts`'s order is harmless. Put `busy_timeout` first in any opener two processes share.
 - **The Claude SDK interleaves a data-less `system/thinking_tokens` between every two thinking deltas**, so anything folding *consecutive* deltas folds nothing: the trace's coalescer turned one real turn into 92 rows, 84 of them single deltas and ticks. The provider forwards every SDK system message it does not special-case as a bare `{type, subtype}` (`claude-agent-sdk.ts`), and that shape is how to recognise a signal — `trace-coalescer.ts` counts one arriving inside a block on the block (`signals`) instead of closing it. A mock or scripted provider that never sends these hides the bug entirely, which is why the replay test's script now does.
+- **A terminal with no layout is fitted to 2x1, and zsh does not survive 2x1**: xterm's FitAddon never proposes less than 2 columns by 1 row, which is exactly its answer for a 0x0 container. A terminal is mounted with no layout more often than it looks. The dock's active tab is mounted while the dock is hidden (`collectFromDock` marks it active either way), and a phone restores every dock collapsed (`collapseRestoredDockOnMobile`). Fitted at mount, such a terminal got 2x1, and its socket sent that size on open. zsh with a themed prompt then corrupted its own heap redrawing at 2 columns. glibc aborted it with `double free or corruption (!prev)` on the first keystroke after the terminal was shown, up to an hour later and at an ordinary size. That is why every core in `coredumpctl` read 156-269 columns and none pointed at a resize. Replayed against zsh with an oh-my-zsh + oh-my-posh config: left at 2x1 or 2x2, 20 of 20 shells died on that keystroke; at 3x1, 10x1, 2x20, 156x1 or 80x24, none did, and a bare zsh survived 2x1. Every `fit()` in `use-terminal.ts` now asks `proposeDimensions()` first, and `terminalService.resize` drops anything `isUsableTerminalSize` (20x2, `src/shared/terminal-size.ts`) rejects, so a browser on an older bundle cannot do it either. Two lessons for the next one. A crash that lands long after its cause needs the history of the shell's size, and the live PTYs hold it: `stty -F /dev/pts/N size` on each `zsh` under `ppm.service` found a hidden terminal still sitting at 2x1. And the ResizeObserver's own `contentRect` zero check was never enough, because its debounced fit runs 100 ms later, when the tab may already be parked. Verify with `PPM_E2E_DIST=<scratch dist> node tests/e2e/terminal-hidden-resize-e2e.mjs`, which reads the size from the shell's tty rather than from xterm.
+- **A session's "before" for a file is PPM's to keep, because no transcript holds it**: Claude Code records a tool's `toolUseResult.originalFile` only for small files (measured: kept at 9,836 B, gone from 13.6 KB up), an Edit's `old_string` is a fragment at an unknown offset, SDK checkpointing is off, and git HEAD also holds whatever was uncommitted before the session began. So the session review reads `session-baselines/` (see Architecture), filled at PreToolUse **in every permission mode**. That last part is new: before it, a bypass-mode session — the default — installed **no PreToolUse hook at all** (the permission hook is skipped there by design), so anything added to the permission hook does not run for most sessions. `buildToolHooks` therefore gives bypass mode a file-write hook of its own (`PreToolUse[0]` there), while every other mode runs it from the permission hook once that has allowed the write — a denied write records nothing; `permissionHook()` in `claude-agent-sdk.test.ts` finds that `.*` one. Verified against the real CLI in bypass mode: the hook fires for a sub-agent's Write too. A record is hard-linked into place so the **first capture wins**; never "fix" a missing record by writing one later in the session, which would record a state the session itself produced. Shell commands are the exception that proves it: `shell-change-tracker.ts` reads a file's bytes *before* the command runs and records them only if the command moved it, and a file git did not list is HEAD — read from the **pre-command** HEAD, because `git commit` in the same command moves it (the post-command HEAD would name the new content as the "before"). Outside bypass mode that snapshot is taken by the permission hook once it has allowed the command, not by a hook of its own, so it cannot be taken while the approval prompt is still open — an edit made during that wait would otherwise be put on the command (checked with the real CLI: a file edited during a 1.5 s approval wait was not recorded).
+- **Codex's `FileUpdateChange.diff` is a diff only for an update**: for `add` and `delete` it is the file's **raw content**, and an update may end in `\n\nMoved to: <path>`. Parsing all three as a unified diff (`diffToOldNew`) dropped every line without a `+`/`-`/space prefix, so a created file counted +0. The rollout's `item_completed` FileChange carries `changes` as a dict keyed by path, not the live array (`rolloutFileChanges` vs `fileUpdateChanges` in `codex-patch.ts`). One patch over several files is **one** Edit/Write card whose own fields describe only the first file, with `input.files` listing all of them — read `files`, or every file after the first is invisible. And the patch is on disk before PPM hears of it, so its "before" is the diff reverse-applied (`reverse-unified-diff.ts`), which refuses rather than guesses when a hunk does not match.
+- **`@monaco-editor/react` 4.7 disposes a diff's models before the diff editor holding them**, and Monaco 0.55 reports it as an uncaught "TextModel got disposed before DiffEditorWidget model got reset" on every unmount — every closed diff tab, every file a review steps to. `DiffEditor` in `diff-viewer.tsx` is the library component's parent and detaches and disposes the models in its own cleanup, which React runs first because it runs a removed subtree's cleanups parent before child (every layout one before any passive one). The layout effect there is margin, not the fix: measured on React 19.2, a `useEffect` cleanup in the wrapper also runs before the library's passive one. `diff-viewer-dispose-order.test.ts` mounts the real viewer over the real library and goes red without the cleanup. Separately, that file's word-wrap sync forced `wordWrapOverride2` onto the original editor in **inline** mode too, where the original is a hidden 35px column: every line wrapped many rows tall and the inline view padded the visible side to match, so a phone showed one changed line between screens of hatching (`.diagonal-fill`). Monaco itself keeps that editor unwrapped when inline; only a side-by-side original wraps now.
+- **A bounded read of a file stream has to count its own bytes and end with `cancel()`**: on Bun 1.3.11, `Bun.file(f).slice(a, b).stream()` never finishes when `b` is well short of the end of a multi-MB file — the last `read()` neither resolves nor errors (a 4MB file's `slice(0, 259)` hung; `slice(0, size - 1)` and an endless `slice(a)` did not) — so `readLines` takes `toByte` and stops at it itself. And a reader let go of before its end with `releaseLock()` keeps its file descriptor: 2000 early stops left 2000 open, `reader.cancel()` closes it. Both bite the windowed transcript reads in `compact-segment.ts`, which stop early on every scroll up by design; `compact-segment.test.ts` pins both.
+
+- **Rebuilding a table that others reference deletes their rows unless foreign keys are off — and that pragma is ignored inside a transaction**: SQLite's recipe for changing a constraint (create the new table, copy, drop the old one, rename) is how migration 55 let `connections` accept `mysql` / `mariadb`. With `foreign_keys = ON`, `DROP TABLE connections` runs an implicit `DELETE` that cascades through `connection_table_cache`'s `ON DELETE CASCADE` and empties it before the new table exists — no error, just a cache that is gone. `PRAGMA foreign_keys = OFF` is a no-op inside a transaction, so `allowConnectionTypes` in `db.service.ts` turns it off *before* `BEGIN`, reads it back and refuses to run when a caller's transaction kept it on, and restores it afterwards. It also rebuilds from the table's own recorded SQL with only the CHECK replaced, so a column a later migration added is carried over, and keeps the `AUTOINCREMENT` high-water mark, because query-audit rows still name the ids of deleted connections.
+- **SQLite has no `ILIKE`, and its `LIKE` ignores case for ASCII only**: a filter written with Postgres's `ILIKE` is a syntax error on SQLite. Case-insensitive matching goes through each dialect's `likeInsensitive` (`src/services/database/dialect-*.ts`): `ILIKE … ESCAPE E'\\'` on Postgres, plain `LIKE … ESCAPE '\'` on SQLite (already case-blind for ASCII; "Ä" and "ä" stay different because `bun:sqlite` loads no ICU), and `LIKE … ESCAPE CHAR(92)` under the column's own collation on MySQL, where a `_ci` collation ignores case and `LOWER(col)` would give up the index (the escape is named because a server whose `sql_mode` has `NO_BACKSLASH_ESCAPES` gives `LIKE` none, and as `CHAR(92)` because a backslash written as a string literal is spelled differently in each mode). Build filter SQL through the dialect, never by pasting an operator into a string.
+- **A result read as objects loses the columns that share a name**: `SELECT 1 AS a, 2 AS b, 3 AS a` has three columns, but a row object holds one `a`, so a header built from `Object.keys(row)` shows two. bun:sqlite is worse than lossy: its `columnNames` is built from an object's keys too, so the repeat collapses *and moves* — `["b", "a"]` over three values, pairing every value with the wrong name. Read rows as arrays next to the driver's column metadata (postgres.js `.values()`, mysql2 `rowsAsArray: true`, bun:sqlite `.values()`), and for SQLite recover the names with `statementColumnNames` in `sqlite.service.ts`, which prepares the statement again as a subquery — never runs it — because SQLite then renames the repeats to `a:1`, `a:2`.
+- **`git pull` refuses a diverged branch on git ≥ 2.33 unless the repository says how to reconcile**: it fails with "Need to specify how to reconcile divergent branches", so a Pull or Sync button works every time until the first time it is needed. `git-workflow.service.ts` adds `--no-rebase` (a merge, as GitHub Desktop does) only when none of `pull.rebase`, `pull.ff` and `branch.<name>.rebase` is set — passed unconditionally it would override `pull.ff = only` and merge anyway.
+- **`git stash pop`/`apply` without `--index` puts staged changes back unstaged, silently**; with it, git refuses outright when the staged part no longer applies, and touches nothing. So `git-workflow.service.ts` tries `--index` first, falls back to a plain apply, and the UI says the changes "came back unstaged". It also checks the hash of `stash@{n}` before acting, because the list renumbers whenever anything else pushes or drops a stash.
+- **Since git 2.48, `git fetch` creates `refs/remotes/origin/HEAD`, and `%(refname:short)` prints it as `origin`**: a ref list that does not skip symbolic refs (`%(symref)` set) grows a branch called "origin" and an extra label on the default branch's commit. The Git Graph showed both until it skipped them.
+- **Codex renames a new chat during its first turn, so anything holding a session id across a turn has to follow it**: the tab tools' token is minted under PPM's id and handed to the Codex app-server in its environment, for the life of that process. During the first turn Codex emits `session_migrated` and `ws/chat.ts` re-keys `activeSessions` and the sockets to the thread id — so every later `open_file`/`open_preview` named an id with no sockets, and in a new Codex chat the tools answered "no device" while the chat sat open in front of the user. `tab-open-broker.ts` keys its pending calls, limits and delivery by `resolveMigratedSession(id)`. Claude keeps its id, which is why only Codex showed it.
+- **History pairs a tool's result with its call inside one message, so results must be merged into the message that holds the call**: the Claude SDK writes every content block as its own record, so two calls made at once are two assistant records followed by both results. The old merge put every result on the *last* assistant message, which left the first call's card with no result — fine while streaming, then lost when the chat refetches history at the end of the turn. `mergeToolResultMessages` in `jsonl-transcript-parser.ts` routes each result by `toolUseId`, and both history paths (`getMessages` and `parseJsonlTranscript`) use it.
+- **`handleEditorMount` in `code-editor.tsx` is memoised on `[isSql]`, so it sees the props of the render that created it**: a tab can be asked for a line before its editor exists — `open_file` with `line` on an HTML page open in preview mounts Monaco only when it switches to code — and the stale closure revealed the first render's target, i.e. none. It reads `revealTargetRef` now; anything else that handler needs from props has to go through a ref too.
+- **In a Playwright-driven preview check, a page error naming `localStorage` or `serviceWorker` is Playwright's, not the page's**: `addInitScript` runs in every frame, the sandboxed previews included, where storage access throws `SecurityError`, and `serviceWorkers: "block"` injects a read of `navigator.serviceWorker` that an opaque-origin frame refuses too. The bridge reports both as the page's own errors, so the check lists problems the page does not have. Guard init scripts with `window.top !== window` and filter the service-worker one (`ai-tab-tools-e2e.mjs`).
+- **An AI uses PPM's tool only if it does not think it has a better one**: with the user's Playwright MCP available, Opus given `open_preview`'s first description wrote the page, checked it in its own headless browser for four minutes (28 Playwright calls) and opened the tab only at the end — the user watched nothing. Saying *when* to call (as soon as the file is written; the user watches while you fix) and that the check needs no browser of its own put the call 5 s after the Write (Codex's came 34 s after its Write). Opus still opened its own browser afterwards, but only for what the check does not cover: hover tooltips and dark mode. The first run also inherited a max effort, so the two changes are not separated. Claude Code 2.1.280+ defers MCP tools, so a session's first call to either tool costs a `ToolSearch` round first.
+- **A Tailscale Service is three admin steps the CLI cannot take, and its approval is not in the serve config**: `tailscale serve --service=svc:<name>` refuses an untagged node (`service hosts must be tagged nodes`), cannot define the service (the admin console's Services page does) and leaves the host waiting for an admin. Whether that approval happened is only in `status --json`: `Self.CapMap["service-host"]` maps each service this node may host to its VIPs (`[{ "svc:ppm": [...] }]`), and `CapMap["services/<name>"]` is present for a definition the node can see. `--service` forces `--bg`, so tailscaled keeps the handler across PPM restarts and reboots: PPM's switch is a desired state, re-applied by `ensureServiceOnStartup`, and a switch never touched counts an address already pointing at PPM as on (the address this dev host is reached at was set up by hand). A `svc:<name>` pointing anywhere else is never taken over without `replace` (409 `code: "conflict"`), which is also what keeps a dev instance off the live one's name. Two traps in `tailscale up`: on a node with any non-default pref it refuses with `requires mentioning all non-default flags` and prints the command that keeps them, which `tailscale-login.ts` retries once; and a stopped node must get a bare `up`, because any flag, `--json` included, takes it into that same refusal. `tailscale debug prefs` carries the node's private keys (`Config.PrivateNodeKey`, the network-lock key): `parsePrefs` keeps three fields, so never log or return the raw output. On Linux tailscaled takes changes from root and its `OperatorUser` only, which is why the pane's operator step (`sudo tailscale set --operator=<user>`) comes before sign-in. Never run `tailscale up`, `login`, `logout` or a `serve` change against this dev host from a test; `tests/fixtures/fake-tailscale.ts` answers every command the pane uses.
+- **A forwarded page that refuses framing is let into PPM's tab by the hop, never by stripping the header**: the web-preview tab is an iframe on PPM's origin, so Rails' default `X-Frame-Options: SAMEORIGIN`, Django's `DENY` or any CSP `frame-ancestors` rendered a blocked frame. Deleting those headers would let every site frame the dev app, which matters for a public Cloudflare forward. `frame-ancestors.ts` translates instead: SAMEORIGIN becomes `frame-ancestors 'self' <PPM>`, DENY becomes `frame-ancestors <PPM>`, and an existing `frame-ancestors` gains PPM's origins (`'none'` dropped, since it cannot stand beside a source). `X-Frame-Options` cannot name an origin (`ALLOW-FROM` is ignored everywhere), and an enforced `frame-ancestors` makes browsers skip it. PPM's origin has to come from the browser: the server cannot know every name it is reached by (LAN address, tunnel, reverse proxy). So the tab POSTs `location.origin` to `/api/tunnels/frame-ancestors` before its frame loads and again on Reload; the list is in memory like the hops, so a restart forgets it. CSP has no IPv6 literal, so a PPM opened at `http://[::1]:<port>` cannot be named. `bun tests/e2e/forward-hop-framing-e2e.ts` checks the verdict in Chromium, Firefox and WebKit: PPM may frame every page, another site still may not. In a UI e2e, note that Forward opens the tab by itself, so nothing read after Forward is a "before".
+- **Headless Chromium cannot subscribe to push, so a push e2e has to enter at the service worker**: `pushManager.subscribe` there fails with `Registration failed - permission denied`, so no test ever reaches a real FCM endpoint. The two halves are checked apart: the server's by encrypting a real push (`src/services/web-push/`) to a local HTTPS receiver, the worker's with CDP `ServiceWorker.deliverPushMessage` for `push` and a `NotificationEvent` dispatched inside the worker (`page.context().serviceWorkers()` → `evaluate`) for `notificationclick`. Chrome accepts only `userVisibleOnly: true` subscriptions, so `sw.ts` shows a notification for every push and never drops one. Like wake lock and WebCodecs, push needs a secure context, and on iOS a Home Screen install too; the Notifications pane says which one is missing instead of offering a switch that cannot work.
+- **A log line's timestamp is a claim, not its place in the file**: the live `ppm.log.1` held a record stamped `2026-10-06T03:06:13Z` among `20:49Z` ones. The old build logged tool output verbatim (`tool_result: … output=`), that output quoted an example log line from the docs, and the reader took the quoted line for a record of its own. Merged by timestamp, it carried everything after it in the file seven hours forward. `formatLogLine` still writes a multi-line message as it is, so any text that quotes a log line can do it again. `log-columns.ts` therefore orders records by an `order` key: the longest run of in-step timestamps (patience sort), with each line off that run taking the time of the last in-step line before it. `merge()` and the time-range search compare that key, and `ppm.log.3` → `ppm.log` are one chain read in file order; only separate logs are interleaved by time. Related: Show in Logs reaches lines older than the first page with `reach=<id>`, one request capped at `MAX_REACH` (15,000 lines) that answers `reachMissed: "far" | "gone"` rather than leaving an empty selection.
 
 ## UI Rules
 
@@ -250,13 +278,15 @@ Before planning or implementing a new feature, read `docs/project-roadmap.md` to
   - The contract everywhere here is **`undefined` = cannot measure**, and the UI renders that as an em dash. Never substitute `0`: "this GPU has no dedicated memory" and "this GPU has 0 MB of memory" are different claims, and `tests/unit/web/overview-gpu-card-vram.test.tsx` pins the difference.
 - `src/services/db-backup/` — verified `VACUUM INTO` snapshots of `ppm.db` (hourly + at start + before every migration), GFS retention, `ppm backup` / `ppm restore`
 - `src/services/session-trace/` — the session trace ("every run is traceable"): its own `session-trace.db` (outside `db-backup` — a log, not state), one trace per run keyed by the PPM session id with `trace_aliases` for ids a provider migrated to. `ChatService` records every input it handles (`user_message`, `context_added`, `approval_resolved`, `turn_aborted`) and every provider event, text/thinking deltas coalesced per block (`trace-coalescer.ts`), through a batching writer that never throws into a chat (`trace-writer.ts`). Browser half: `src/web/lib/trace-client.ts` (every console level; errors carry the 50 lines before them) posting to `POST /api/trace` keyed by device id, plus the inline watchdog beacon in `index.html`. Read a session with `GET /api/trace/sessions/:id`; retention in `session-trace-cleanup.ts`. Design and as-built notes: `docs/architecture/plugins-and-tracing.md`
+- `src/services/logs/` — the Logs window, which replaced Report Bug. `log-store.ts` reads every log as one list — `ppm.log` and its rotated copies, `cloudflared.log`, and the browser rows the session trace already keeps (`browser-logs.ts`) — indexed per file inode as typed columns (`log-file-index.ts`, `log-columns.ts`: ~450k records in ~13 MB where objects cost ~200 MB), with the text read back a page at a time. `log-live.ts` is the live tail: a one-second poll that runs only while some view is subscribed over `/ws/global` (`logs:subscribe`). `log-issues.ts` is the Issues tab — the last 24 hours of errors and warnings grouped by `src/shared/log-fingerprint.ts`, then sorted by cause by Claude Haiku through `log-ai.ts` (`completeOnce`, the person's own account, no tools), remembered per fingerprint in `<ppm dir>/logs-issues.json`; Auto runs at most every ten minutes and only while something reads the issues. `log-report-draft.ts` drafts a report from chosen lines, `log-environment.ts` is its Environment block, `github-issues.ts` asks GitHub for labels and look-alike open issues — never posts. What the Logs window's own AI is shown and what goes into a report go through `src/shared/log-redact.ts` first, which takes out secrets whatever the switches say (a process's own stderr reaches `ppm.log` unredacted); Add to chat puts lines in a chat as they are. Routes `src/server/routes/logs.ts` (authenticated, like the old bug report's `/api/logs/recent` in `src/server/index.ts`, which nothing in PPM reads any more), shapes `src/shared/logs-model.ts` + `logs-api.ts`. UI `src/web/components/logs/` — a window on desktop, the `logs` tab below `md`, both through `open-logs.ts` — with the pure halves in `src/web/lib/logs/` (`logs-view-model.ts`: folding repeats, ranges; `logs-report.ts`: the issue Markdown and its URL limit). The GitHub button is a real `<a target=_blank>`, so it cannot be popup-blocked, and a body too long for the URL is copied instead
 - `src/services/remote-desktop/` — Remote Desktop: one ffmpeg per WS session (`remote-desktop-capture.ts` + per-platform `remote-desktop-capture-input.ts` + `remote-desktop-encoder-args.ts`) → Annex-B H.264 access units → WebCodecs; input via `remote-desktop-input.ts` facade over `remote-desktop-input-{win32,darwin,linux,uinput}.ts` (bun:ffi, no helper binary); host checklist in `remote-desktop-requirements.ts` (ffmpeg install command, macOS TCC pre-flight, Linux session/XTEST/uinput rows); display list in `remote-desktop-displays.ts` (`CGGetActiveDisplayList` order = avfoundation `Capture screen N`, names/bounds via one JXA call; X11 monitors via `XRRGetMonitors`). Linux specifics: `remote-desktop-linux-session.ts` decides X11 vs Wayland and resolves `DISPLAY`/`XAUTHORITY` (a Wayland session then takes a separate capture backend: `remote-desktop-portal.ts` holds the `org.freedesktop.portal.ScreenCast` session over libdbus FFI and `remote-desktop-capture-wayland.ts` runs `gst-launch-1.0` against the PipeWire node it hands back, producing the same Annex-B stdout ffmpeg does),  `remote-desktop-x11.ts` is the shared Xlib connection, `remote-desktop-evdev-key-map.ts` is the one key table both Linux backends use. Clipboard sync is `remote-desktop-clipboard.ts` (host side, one helper process per read/write) and `src/web/components/remote-desktop/remote-desktop-clipboard-client.ts` (which key combos mean copy/paste, plus the insecure-origin copy fallback). The in-session controls are `remote-desktop-toolbar.tsx` (desktop, RustDesk's grouped menus) and `remote-desktop-mobile-toolbar.tsx` + `remote-desktop-mobile-settings.tsx` (thumb zone), with the scale maths in `remote-desktop-view-style.ts`. Host audio is `remote-desktop-audio.ts` (a second ffmpeg, Opus in Ogg) demuxed by `remote-desktop-ogg-opus.ts` and played by `use-opus-audio-player.ts`; privacy mode is `remote-desktop-privacy.ts` (X grabs + DPMS); host resolution is `remote-desktop-resolution.ts` (XRandR FFI) with the menu collapse and the fit-local decision in `remote-desktop-resolution-list.ts`; the custom image-quality maths ported from RustDesk's `video_qos.rs` are `src/shared/remote-desktop-custom-quality.ts` behind `remote-desktop-custom-quality-dialog.tsx`; screenshot/recording are `remote-desktop-recording.ts` + `use-remote-desktop-recorder.ts` (client-side `MediaRecorder` over the canvas). The WebRTC transport is an optional downloaded relay: `mediamtx-catalog.ts` (pinned version + SHA-256 per platform), `mediamtx-install.service.ts`, `mediamtx-paths.ts`, `mediamtx-config.ts` (the generated config — the one place the relay's exposure is decided) and `mediamtx-process.ts` (one relay per session, free ports, waits until it is really listening); `buildCaptureArgs`'s last argument swaps `pipe:1` for an RTSP push, `remote-desktop-whep-registry.ts` + `POST /api/remote-desktop/whep/:ticket` are the authenticated, **ticket-addressed** handshake proxy, and `use-webrtc-canvas-video.ts` paints the track into the same canvas the WebCodecs path draws to. Settings pane `settings/remote-desktop-settings-section.tsx`. Codec choice comes from `workingEncoders()` in `media-transcode/ffmpeg-capabilities.ts`, which probes *every* candidate rather than short-circuiting. Routes `src/server/routes/remote-desktop.ts`, WS `src/server/ws/remote-desktop.ts`, UI `src/web/components/remote-desktop/`, e2e `tests/e2e/remote-desktop-e2e.mjs`
 - `src/services/git-hunks/` — hunk/line-level stage, unstage and discard (`/api/projects/:name/git/{hunks,stage-hunks,unstage-hunks,discard-hunks}`). `unified-diff.ts` holds the patch surgery (recomputed `@@` counts, unselected deletions demoted to context); the UI is `src/web/components/git/hunk-stage-dialog.tsx`
 - `src/services/git-repos/` — which repository a project's git surfaces run in, when the project folder is a container of checkouts rather than a repository itself. `git-repo-discovery.ts` walks the folder (`GET /git/repos`), the `?repo=` middleware in `src/server/routes/git.ts` scopes every git route to one of them, and the browser side is `src/web/lib/git-repo-scope.ts` (pure decisions and both directions of path rebasing), `src/web/stores/git-repo-store.ts` (the device-local choice), `src/web/hooks/use-git-repo.ts` (what every panel calls) and `src/web/components/git/git-repo-picker.tsx`. Extension panels are opened on the repository, so `packages/ext-git-graph/src/project-scope.ts` maps that path back to the containing project
+- `src/services/git-changes/` + `src/services/git-workflow/` + `src/services/git-discard-journal/` + `src/services/git-commit-draft.service.ts` — Source Control, the Review changes tab and the Git Graph as one flow over the same routes. `GET /git/changes` is the working tree file by file and block by block (one `git status --porcelain=v2`, at most one `git diff` per side, `GIT_OPTIONAL_LOCKS=0`; a block's id is the fingerprint `git-hunks` resolves), every POST on the git router emits `git:changed` on `/ws/global`, a discard is kept for Undo under `<ppm dir>/git-discards/`, and the commit message is one per repository in `chat_drafts` (`git:commit-draft`). UI: `src/web/components/git/git-status-panel.tsx` and its `git-*.tsx` parts (decisions in `src/web/lib/git-changes-view.ts`), the `git-review` tab in `src/web/components/git-review/` over `src/web/lib/git-review-model.ts`, and the Git Graph reaching the same routes through `packages/ext-git-graph/src/ppm-git.ts` — a git write that bypasses them is heard by nobody until the next poll. The Git Graph's file icons are the app's, answered per name by `src/web/components/extensions/webview-file-icons.ts`. Docs `docs/architecture/workspace-and-ui.md` → Source Control, Review changes and Git Graph
 - `src/web/lib/icons.ts` + `src/web/lib/icons.generated.tsx` + `src/web/lib/fluent-icon.tsx` — the product icons (Fluent System Icons 20px Regular, MIT, microsoft/fluentui-system-icons) for the app's own chrome. Every UI icon is imported from `@/lib/icons`; regenerate with `bun scripts/gen-product-icons.ts` after editing its `MAP`
 - `src/server/routes/static-fallback.ts` + `src/web/components/root-error-boundary.tsx` + `src/web/lib/chunk-recovery.ts` + the inline watchdog in `src/web/index.html` — the four halves of not going blank when a chunk is missing: 404 instead of the shell, a boundary above `App`, one guarded purge-and-reload on `vite:preloadError`, and a dependency-free last resort for when the entry never ran at all
 - `src/web/lib/file-icons.tsx` + `src/web/lib/file-icon-name.ts` + `src/web/lib/file-icons.generated.ts` + `src/web/styles/file-icons.generated.css` — the file icon theme (real `vscode-icons` artwork, MIT). `FileIcon` for a component slot, `fileIconElement` for the `icon: ElementType` slots (tab bar, command palette, both through `src/web/lib/tab-type-icons.ts`). Name resolution is the pure half in `file-icon-name.ts` (importable under `bun:test`); the framework preset comes from `src/web/stores/project-framework-store.ts`. Regenerate with `bun scripts/gen-file-icons.ts`
-- `src/services/lsp/` — language servers for the editor. `server-registry.ts` says which binary serves which language and how to find it (project `node_modules/.bin`, then PATH, then PPM's own directory), `lsp-protocol.ts` is the `Content-Length` framing, `lsp-session.ts` owns one child process, `lsp-manager.ts` decides how many exist and shares them by *server + root directory*. `lsp-install.ts` is the Install button's host half, one plan per server: `bun add` of the registry's packages into `<ppm dir>/lsp-servers` — never `-g` — `go install` with `GOBIN` pointed at that same directory, and for rust-analyzer alone `rustup component add` **in the project's directory**, keeping no copy because the component belongs to whichever toolchain that project selects. All three behind `POST /api/project/:name/lsp/install`, which takes a server **id** and never a package name; a toolchain PPM cannot find means no button rather than one that fails; the browser side is `retryUnavailableLspDocuments()` in `lsp-client.ts`, which reopens the files that had no server so an install needs no reopened tab. The same pair exists machine-wide at `/api/lsp/{servers,install}` for `settings/language-servers-section.tsx` — Settings is open on no project, so nothing project-local is consulted there — and that pane reaches the client through a **dynamic** import, because the lazy-boundary test scans all of `src/web`. That pane's Remove (`POST /api/lsp/uninstall`, Settings only — the editor's dialog is only ever shown for a *missing* server) is gated on `origin` from `availability()`, which is where `resolveCommand` found the server: only `ppm` and `rustup` may be removed, because a copy on `PATH` is the user's, one in a project is the repository's and `bundled` is PPM's own dependency. One npm package can serve several rows (`vscode-langservers-extracted` is JSON + HTML + CSS), which `serversSharingInstall` names so the confirmation can say so before the removal takes all three. Bridge at `src/server/ws/lsp.ts` on `/ws/project/:name/lsp`, status at `/api/projects/:name/lsp/status`. Browser side in `src/web/lib/lsp/` (client, Monaco conversions, providers, shadow models, F12 navigation) driven by `src/web/hooks/use-lsp.ts`. All of it is behind the `lspEnabled` setting — off by default, per device, never on below the `md` breakpoint — and mounted by `src/web/components/editor/editor-language-service.tsx`, which `code-editor.tsx` may only reach through `lazy()`. Real-server check: `bun tests/e2e/lsp-e2e.ts`
+- `src/services/lsp/` — language servers for the editor. `server-registry.ts` says which binary serves which language and how to find it (project `node_modules/.bin`, then PATH, then PPM's own directory), `lsp-protocol.ts` is the `Content-Length` framing, `lsp-session.ts` owns one child process, `lsp-manager.ts` decides how many exist and shares them by *server + root directory*. `lsp-install.ts` is the Install button's host half, one plan per server: `bun add` of the registry's packages into `<ppm dir>/lsp-servers` — never `-g` — `go install` with `GOBIN` pointed at that same directory, `gem install --install-dir <lsp dir>/ruby` for Solargraph (spawned with `GEM_PATH` pointing there — `installedServerEnv` — and not offered on Windows, whose `.bat` binstub is unverified), a release download for clangd and lua-language-server (`lsp-release-catalog.ts`, version + SHA-256 per platform; staged beside the target, unpacked, started once with `--version`, then swapped in whole), and for rust-analyzer alone `rustup component add` **in the project's directory**, keeping no copy because the component belongs to whichever toolchain that project selects. All of them behind `POST /api/project/:name/lsp/install`, which takes a server **id** and never a package name; a toolchain PPM cannot find means no button rather than one that fails; the browser side is `retryUnavailableLspDocuments()` in `lsp-client.ts`, which reopens the files that had no server so an install needs no reopened tab. The same pair exists machine-wide at `/api/lsp/{servers,install}` for `settings/language-servers-section.tsx` — Settings is open on no project, so nothing project-local is consulted there — and that pane reaches the client through a **dynamic** import, because the lazy-boundary test scans all of `src/web`. That pane's Remove (`POST /api/lsp/uninstall`, Settings only — the editor's dialog is only ever shown for a *missing* server) is gated on `origin` from `availability()`, which is where `resolveCommand` found the server: only `ppm` and `rustup` may be removed, because a copy on `PATH` is the user's, one in a project is the repository's and `bundled` is PPM's own dependency. One npm package can serve several rows (`vscode-langservers-extracted` is JSON + HTML + CSS), which `serversSharingInstall` names so the confirmation can say so before the removal takes all three. Bridge at `src/server/ws/lsp.ts` on `/ws/project/:name/lsp`, status at `/api/projects/:name/lsp/status`. Browser side in `src/web/lib/lsp/` (client, Monaco conversions, providers, shadow models, F12 navigation) driven by `src/web/hooks/use-lsp.ts`. All of it is behind the `lspEnabled` setting — off by default, per device, never on below the `md` breakpoint — and mounted by `src/web/components/editor/editor-language-service.tsx`, which `code-editor.tsx` may only reach through `lazy()`. Real-server check: `bun tests/e2e/lsp-e2e.ts`
 - `src/web/components/problems/` + `src/web/stores/problems-store.ts` — the Problems panel: a dock tab (`DOCK_ALLOWED_TAB_TYPES`) fed by every mounted editor's `useLsp`, opened from the status bar counts on desktop and the editor's LSP row on mobile. Scoped to the active project because `tab-pool` keeps other projects' editors mounted for keep-alive, so their servers keep publishing
 - `src/services/git-blame/` — `git blame --porcelain` for the editor's inline annotation (`/api/projects/:name/git/blame`); shared shape and formatting in `src/shared/blame.ts`, editor wiring in `src/web/hooks/use-inline-blame.ts`. The annotation's GitLens-style hover adds one `git show --unified=0` per commit *and line* (`/git/commit-line`, parsed by `commit-line-diff.ts`), with the markdown built in `src/web/lib/blame-hover.ts` and its buttons registered in `blame-hover-commands.ts`, which hand off to the Git Graph extension's own views over `ext:command:execute`
 - `dist/web` asset pipeline — `scripts/copy-monaco.ts` stages `monaco-editor/min/vs` under `dist/web/assets/monaco/` (inside `assets/` so it inherits the immutable cache header, the SW runtime cache and the compressed siblings), `scripts/precompress-web.ts` writes `.br`/`.gz` siblings, and `src/server/routes/static-encoding.ts` chooses one per request (honouring `q=0` and `*`, keeping the original MIME, adding `Vary: Accept-Encoding` and the encoding in the ETag). Both scripts run after `build:web` in the `build` chain
@@ -264,6 +294,11 @@ Before planning or implementing a new feature, read `docs/project-roadmap.md` to
 - `scripts/gen-nerd-font.ts` + `src/web/styles/nerd-font.generated.css` + `src/web/styles/fonts/` — the terminal's icon glyphs (Nerd Fonts symbols-only, MIT, ryanoasis/nerd-fonts), subset per icon set so each `@font-face` is fetched only when something draws a character in its range. Regenerate with `bun scripts/gen-nerd-font.ts` after editing its `BLOCKS`; `TERMINAL_FONT_FAMILY` in `src/web/lib/editor-font.ts` is what names the family, and `use-terminal.ts` is what invalidates xterm's glyph atlas when a face lands
 - `src/services/speech-to-text/` — speech to text for the chat mic, run on the host. `whisper-catalog.ts` pins the whisper.cpp build and every model by SHA-256, `whisper-download.ts` streams and hashes in one pass onto a `.part` file, `whisper-install.service.ts` installs under `<ppm dir>/whisper` and proves the binary runs before calling it installed, `whisper-transcribe.service.ts` is one `whisper-cli` run per request (serialised — two at once just make both slow), with `whisper-hallucinations.ts` dropping the sentences the model invents as a second line of defence behind the VAD. Routes `src/server/routes/speech.ts`, browser side `src/web/hooks/use-whisper-voice-input.ts` + `src/web/lib/voice-wav.ts`, Settings pane `src/web/components/settings/voice-settings-section.tsx` (the engine choice only appears once it is installed), e2e `bun tests/e2e/whisper-e2e.ts`
 - `src/services/mcp-oauth/` — MCP sign-in for `needs-auth` servers: `mcp-oauth-flows.ts` (one prompt-less Claude subprocess per flow, opened by the provider's `openMcpControlQuery`), `mcp-status-probe.ts` (cached per-directory status), `mcp-oauth-redirect.ts` (pure redirect/host rules). Routes `src/server/routes/mcp-auth.ts` (public `GET /api/mcp-auth/callback` mounted before auth), chat sync `src/server/ws/chat-mcp-sign-in-sync.ts`, UI `src/web/components/mcp-auth/` (dialog/bottom sheet, chat bar, the list shown in Settings → AI Provider and the AI Resources panel), e2e `tests/e2e/mcp-sign-in-e2e.mjs`
-- `src/services/named-tunnel/` — Named tunnel (stable `https://<prefix>.<zone>` URL via Cloudflare login), orchestrated from `src/server/routes/named-tunnel.ts`, spawned/probed by the supervisor; UI in `src/web/components/tunnels/named-tunnel/`
-- `src/services/design/` — Design mode: a design is `designs/<slug>/` with its canvas data in the git-ignored, unwatched `.design/`. `design-store.service.ts` (folders, `design.json`), `design-snapshots.service.ts` + `design-restore.service.ts`/`design-restore-journal.ts` (history, crash-safe restore), `design-turn-snapshot.ts` (a snapshot after each design turn, scheduled from `chatService.sendMessage`), `design-instructions.ts` + `design-tool-policy.ts` (the per-turn instructions `chatService.prepareSendOptions` adds, and the `acceptEdits` policy), `preview/` (capability tokens, CSP, parse5 `data-ppm-id` instrumentation, print view), `bridge/` (the in-frame script, shipped as source), `source/` (the patchers behind tweaks and move/resize), `comments/`, `export/` and `design-edit-undo-journal.ts`. Routes `src/server/routes/designs.ts` with its `design-*.ts` sub-routers, and `design-preview.ts` for the canvas; protocol `src/shared/design-bridge-protocol.ts`; UI `src/web/components/design/` with client helpers in `src/web/lib/design/`; docs `docs/architecture/workspace-and-ui.md` → Design mode; e2e `tests/e2e/design-mode-e2e.mjs` (fixture server and scripted provider in `tests/e2e/fixtures/design-mode-server.ts` / `design-script-provider.ts`)
+- `src/services/named-tunnel/` — Named tunnel (stable `https://<prefix>.<zone>` URL via Cloudflare login), orchestrated from `src/server/routes/named-tunnel.ts`, spawned/probed by the supervisor; UI in `src/web/components/tunnels/named-tunnel/` (the setup flow, shared by the first-run popup and Settings)
+- `src/services/tailscale/` — Settings → Remote Access → Tailscale, PPM at `https://<name>.<tailnet>.ts.net` through the Tailscale Service `svc:<name>`. `tailscale-cli.ts` finds and runs the CLI (shared with `port-forward/tailscale-forward.ts`), `tailscale-state.ts` reads the setup from `status --json`, `debug prefs` and `serve status --json` and changes nothing, `tailscale-login.ts` is the in-app sign-in (`tailscale up --json`, its link and QR code), `tailscale-app-service.ts` is the switch (the `tailscale_service` config row) and the start-up re-apply. The step order is `currentSetupStep` in `src/shared/tailscale-setup.ts`, shared by the server's refusal messages and the pane's checklist. Routes `src/server/routes/tailscale.ts` (`/api/tailscale`), UI `src/web/components/settings/tailscale/`, fake CLI for tests `tests/fixtures/fake-tailscale.ts`
+- `src/web/components/settings/remote-access/` — Settings → Remote Access, every way to reach PPM itself from another device, one sub-tab each (`remote-access-tab-store.ts`, which `openRemoteAccess(tab)` sets before opening Settings): Tailscale (the pane above, mounted as it is) and Public link (`public-link-pane.tsx`: the `/api/tunnel` switch plus the temporary-vs-own-domain choice, the named-tunnel flow rendered inline). Forwarding a dev server is the sidebar's Port Forwarding section (id `tunnels`), `src/web/components/tunnels/port-forwarding-panel.tsx` over `/api/tunnels`, which the palette's Forward a Port reaches through `open-port-forwarding.ts` (the drawer on a phone). Its two rows say where Tailscale (`/api/tunnels/transports`) and PPM's own Cloudflare domain (`/api/tunnel/named/status`) stand, and their Set up / Manage buttons are the links into these sub-tabs — signing in to either is never done in the panel. `tests/unit/web/remote-access-settings.test.tsx`, `tests/unit/web/port-forwarding-panel.test.tsx`
+- `src/services/design/` — Design mode: a design is `designs/<slug>/` with its canvas data in the git-ignored, unwatched `.design/`. `design-store.service.ts` (folders, `design.json`), `design-snapshots.service.ts` + `design-restore.service.ts`/`design-restore-journal.ts` (history, crash-safe restore), `design-turn-snapshot.ts` (a snapshot after each design turn, scheduled from `chatService.sendMessage`), `design-instructions.ts` + `design-tool-policy.ts` (the per-turn instructions `chatService.prepareSendOptions` adds, and the `acceptEdits` policy), `design-skill-install.service.ts` (Settings → Design's Install for the suggested skill: the pinned npm tarball laid out exactly as upstream's `uipro init --global`, checked by `tests/e2e/design-skill-install-e2e.ts`), `preview/` (capability tokens, CSP, parse5 `data-ppm-id` instrumentation, print view), `bridge/` (the in-frame script, shipped as source), `source/` (the patchers behind tweaks and move/resize), `comments/`, `export/` and `design-edit-undo-journal.ts`. Routes `src/server/routes/designs.ts` with its `design-*.ts` sub-routers, and `design-preview.ts` for the canvas; protocol `src/shared/design-bridge-protocol.ts`; UI `src/web/components/design/` with client helpers in `src/web/lib/design/`; docs `docs/architecture/workspace-and-ui.md` → Design mode; e2e `tests/e2e/design-mode-e2e.mjs` (fixture server and scripted provider in `tests/e2e/fixtures/design-mode-server.ts` / `design-script-provider.ts`)
+- `src/services/tab-tools-mcp/` — the AI's tab tools, `open_file` (optional `line`) and `open_preview`, given to every chat that is not a design session while Settings → AI Provider → *Let the AI open tabs in PPM* (`ai.tab_tools`) is on; Claude's claude.ai Artifact tools are turned off with it (`CLAUDE_CODE_DISABLE_ARTIFACT=1`), and a call made after the setting went off is refused at the endpoint, because a chat keeps the tools it started with. `/api/tab-tools-mcp` (`tab-tools-mcp-endpoint.ts`, mounted before auth) is built from the same parts as `/api/design-mcp`: `src/services/mcp-http-endpoint.ts` (JSON-only Streamable HTTP, a request with an `Origin` refused, 64 KB cap) and `src/services/mcp-session-tokens.ts` (per-session capability tokens, memory only, looked up by SHA-256); `tab-tools-mcp-tokens.ts` binds a token to the session id alone, so a warm spare's token is the one its session's turns mint. `tab-target.ts` resolves the agent's `path` under the editor's own read rules, and `tab-open-broker.ts` sends `tab_open` over the chat WebSocket and waits for the first `tab_open_result` (8 s for a file, 40 s for a page; 4 calls in flight and 20 a minute per session) — `deliverTabOpen` in `src/server/ws/chat.ts` picks the device that sent the turn's message, else every device showing the chat, and never buffers it for replay. Protocol and the per-provider tool names in `src/shared/tab-open-protocol.ts`; provider wiring `tabToolsMcpServers` (`claude-agent-sdk-query-options.ts`) and `tabToolsMcpConfig`/`tabToolsMcpEnv` (`codex-thread-params.ts`), from the access `chatService.prepareSendOptions` mints. Browser: `src/web/lib/open-ai-tab.ts` (answers `tab_open` from `use-chat.ts`: opens the tab, waits for the page, runs its check), `ai-tab-placement.ts` (pure: beside the chat on a desktop, the whole screen on a phone), `html-preview-loads.ts` (which preview shows which page, by load), `tab-tool-call.ts` + `src/web/components/chat/tab-tool-card.tsx` (the card and its Open button). The HTML preview route serves the design canvas's CSP (`buildDesignCsp`, so the design CDNs load) and injects `design/bridge/html-preview-bridge.ts`, the design bridge's core plus its self-check. Docs `docs/architecture/ai-chat-and-providers.md` → AI tab tools; e2e `PPM_PLAYWRIGHT_MODULE=<playwright>/index.mjs node tests/e2e/ai-tab-tools-e2e.mjs` (scripted provider in `tests/e2e/fixtures/tab-tools-server.ts`; `PPM_TAB_TOOLS_WEB_DIR` reuses a scratch build) and `tests/e2e/html-preview-cdn-check-e2e.mjs`
 - `src/services/agent-transcript/` — one hub per `(providerId, sessionId)` streaming an Agent card's or teammate's own transcript live over `/ws/global`, independent of the chat WebSocket and of whether the root turn is still running. `session-ownership.ts` proves the session belongs to the caller's project before any file is named; `agent-transcript-sources.ts` resolves a card/teammate to the exact file(s), including Codex descendants via `session_meta.parent_thread_id`; `agent-transcript-session-hub.ts` + `agent-transcript-hub.ts` are the per-session tail/page/cursor loop, `agent-transcript-session-hub-activity.ts` the separate "who is running" feed. Protocol in `src/shared/agent-transcript-protocol.ts`; UI entry points `src/web/components/chat/{agent-card-summary,agent-session-window-content,agent-session-sheet,running-agents-bar}.tsx` via `use-agent-session-stream.ts`/`use-agent-activity.ts`; docs `docs/architecture/ai-chat-and-providers.md` → Agent session transcripts
+- `src/services/session-file-baselines/` — the session review (the changes bar above the composer and the block-by-block Review tab): `session-file-baselines.service.ts` keeps each file's state from before the session's first write (`<ppm dir>/session-baselines/<session id>/`, first capture wins, 5 MB cap, credential paths never copied, 30-day prune), `session-file-changes.service.ts` compares it with the disk (git HEAD only as a fallback inside the project), `reverse-unified-diff.ts` works a Codex patch's "before" out, `shell-change-tracker.ts` brackets each Claude shell command with `git status`, `session-review-marks.ts` keeps what the user marked reviewed (a snapshot per file under `<session dir>/reviewed/`, written only at the version the browser showed; a file changed after its mark is diffed against the mark). Blocks are cut by `src/shared/review-blocks.ts`, shared because the server cuts them again from the disk before acting on a key the browser sent; `session-review-blocks.ts` records the kept ones per base hash, and `session-review-actions.ts` keeps, reopens and reverts blocks or whole files on disk (`/file-changes/answer`, refused as `stale` unless the file is at the version drawn) and undoes any answer all-or-nothing from its journal (`/file-changes/undo`). `session-file-history.ts` logs each file's state just before and after every call that writes it (`<session dir>/history/`, as line deltas), `session-file-blame.ts` replays that log to name the calls behind each block, and `session-turn-revert.ts` puts a turn's calls back where their lines are still intact (`/file-changes/revert-turn`: a preview first, then `stale` unless every file is at the previewed version). Captured by the Claude PreToolUse file-write hook and the shell hooks around each `Bash` call (`buildToolHooks` in `claude-agent-sdk-query-options.ts`) and by `codex-file-baselines.ts`. Routes `src/server/routes/chat-file-changes.ts`, shapes `src/shared/session-file-changes.ts`; UI `src/web/components/chat/session-changes-bar.tsx` + `session-change-row.tsx`, and `src/web/components/session-review/` (`review-desktop.tsx`, `review-phone.tsx` below `md`, `review-code.tsx` for the blocks and their turn chips, `review-tokens.tsx` for shiki colours), the chat's per-answer pill and tray `src/web/components/chat/turn-change-{rollup,tray,sheet,review}.tsx` over `src/web/hooks/use-turn-review.ts` + `src/web/lib/turn-review.ts` (the list reaches them through `session-changes-context.tsx`), turns from `src/web/lib/session-turns.ts` through `src/web/stores/session-turns-store.ts` (published by the chat, read by `use-session-turns.ts` when no chat is open), Show in chat through `src/web/stores/chat-jump-store.ts`, state `src/web/hooks/use-session-review.ts` over the pure `src/web/lib/session-review-model.ts`, data `src/web/hooks/use-session-file-changes.ts` + `src/web/lib/session-file-changes{,-client}.ts`; docs `docs/architecture/ai-chat-and-providers.md` → Session changes and review; e2e `bun tests/e2e/session-changes-e2e.mjs`
+- `src/services/notification.service.ts` — notifications, configured in Settings → Notifications. `broadcast(type, payload, { stillUnseen })` drops a switched-off event, waits `delay_seconds` (one pending per session: a newer event replaces it) and sends only if `stillUnseen()` still holds — the chat is still unread, and for an approval the same request is still pending (`src/server/ws/chat.ts`); schedules and Jira pass none and always send. `deliver` fans out to push, Telegram and ntfy, plus PPM Cloud's `sendNotification`, which is inert in the server process because that connection lives in the supervisor. Settings shape and defaults in `src/shared/notification-settings.ts`, text and links in `notification-format.ts`. Push is standard Web Push with no dependency, `src/services/web-push/` (VAPID ES256 + RFC 8291 aes128gcm on WebCrypto; keys and subscriptions are the config rows `web_push_vapid` / `web_push_subscriptions` and never reach a browser); the browser half is `src/web/sw.ts` (`push`, and `notificationclick` → `src/web/sw-notification-click.ts`, which hands the session to an open window through `src/web/hooks/use-notification-clicks.ts`) and `src/web/lib/web-push-{support,client}.ts`. Telegram sends through `telegram-notification.service.ts` to the chats in the `telegram_notify_chats` config row, and to nobody else: PPMBot has a bot and chats of its own (`telegram-bots.ts` — the `ppmbot_telegram` row and `clawbot_paired_chats`; both rows sit outside `CONFIG_TABLE_KEYS` like the VAPID key, and an install that shared one bot is split once, on first read). The one-tap Connect link is `telegram-connect.service.ts`, one per bot owner, which polls a bot itself unless PPMBot is reading that bot (Telegram allows one `getUpdates` reader per bot; the bots are compared by id, the digits before the token's colon). ntfy is `ntfy-notification.service.ts`: one JSON publish per notification (the header form cannot carry a non-ASCII title), the config row `ntfy` with its token in `SECRET_CONFIG_KEYS`, dropped when Settings saves a different server so it is not sent to the new one (`PUT /ntfy`; `ppm config set ntfy.server` does not drop it). Both channels take their link back into PPM from `notification-link.ts`: the tunnel URL, else the Tailscale Service address, else localhost — never the LAN address, which is plain HTTP on an insecure origin where the browser withholds every permission PPM asks for. Routes `src/server/routes/notifications.ts` (`/api/notifications/*`), UI `src/web/components/settings/notifications-settings-section.tsx` + `telegram-bot-token-field.tsx` + `ntfy-server-form.tsx`, fake ntfy for tests `tests/helpers/fake-ntfy-server.ts`