@jossuealcala/madre 1.0.1 → 1.0.3

package/src/modules/playwright.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // PLAYWRIGHT: a headless browser for the crew, pointed only at this MADRE. Agents open the
 // RIPLEY preview of project files, click, read the console and take screenshots into the turn's
 // scratch folder. Runs @playwright/mcp per turn, isolated, with allowed origins limited to the
@@ -9,11 +11,16 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { t } from '../i18n.mjs';
 import { defineModule } from './sdk.mjs';
+import { switchIn } from '../module-scope.mjs';
 import { packageVersion } from './helpers.mjs';
 import { terminateProcessTree, lastWords } from '../adapters/process.mjs';
 
 export const PLAYWRIGHT_PACKAGE = '@playwright/mcp';
 export const PLAYWRIGHT_BROWSERS = ['chromium', 'firefox', 'webkit'];
+// The browser the server downloads for each engine: `install-browser` is `playwright install <name>`
+// underneath, so the name is the engine's own. The remedy used to say chrome-for-testing whatever
+// was chosen, and a person on webkit installed a browser that could never fix it (2026-10-14).
+export const installBrowserLine = (browser = 'chromium') => `npx ${PLAYWRIGHT_PACKAGE} install-browser ${PLAYWRIGHT_BROWSERS.includes(browser) ? browser : 'chromium'}`;
 export const PLAYWRIGHT_SERVER_NAME = 'pulse-playwright';
 // The tools @playwright/mcp exposes that a room turn may use. Screenshots and files land in scratch.
 export const PLAYWRIGHT_TOOLS = ['browser_navigate', 'browser_navigate_back', 'browser_snapshot', 'browser_click', 'browser_type', 'browser_fill_form', 'browser_hover', 'browser_press_key', 'browser_select_option', 'browser_wait_for', 'browser_console_messages', 'browser_network_requests', 'browser_take_screenshot', 'browser_resize', 'browser_tabs', 'browser_close'];
@@ -29,6 +36,51 @@ export async function playwrightVersion({ env = process.env, projectRoot = proce
   return version;
 }
 
+// Why npm stopped, in its own words: the line that says it, not the last one, which only points at
+// a log file («npm error A complete log of this run can be found in …», 2026-10-18).
+export function npmReason(output) {
+  const lines = String(output ?? '').split('\n').map((line) => line.trim()).filter(Boolean);
+  const said = lines.filter((line) => /^npm (error|ERR!)/i.test(line)).map((line) => line.replace(/^npm (error|ERR!)\s*/i, '')).filter((line) => line && !/complete log of this run|^(code|errno|syscall)\b/i.test(line));
+  return said.find((line) => !/^path\b/i.test(line)) ?? said[0] ?? lastWords(output);
+}
+
+// One command of the module's own, run to its end with no terminal: getting the server or its
+// browser onto this computer. What it printed last is kept for the case it fails.
+function runToEnd(command, args, { cwd, env, timeoutMs = 900000 } = {}) {
+  return new Promise((resolve) => {
+    let err = '';
+    let child;
+    try { child = spawn(command, args, { cwd, env: { ...env, CI: '1', NO_COLOR: '1' }, stdio: ['ignore', 'ignore', 'pipe'], shell: false, detached: true, windowsHide: true }); }
+    catch (error) { resolve({ code: 1, said: error.message }); return; }
+    const timer = setTimeout(() => terminateProcessTree(child, { graceMs: 1000 }), timeoutMs);
+    timer.unref?.();
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => { err = (err + chunk).slice(-4000); });
+    child.on('error', (error) => { clearTimeout(timer); resolve({ code: 1, said: error.message }); });
+    child.on('close', (code) => { clearTimeout(timer); resolve({ code, said: npmReason(err) }); });
+  });
+}
+
+// What the switch puts in place by itself before it gives up (2026-10-18): the person turned it
+// on, and a browser to download is MADRE's to fetch, not a line to copy into a terminal. The
+// server, globally (where `npx --no` finds it at turn time), when it is missing; then the browser
+// the server itself downloads for the engine chosen. Asked again after.
+export async function preparePlaywright({ browser = 'chromium', env = process.env, cwd = process.cwd(), run = runToEnd, starts = playwrightStarts, version = playwrightVersion } = {}) {
+  const engine = PLAYWRIGHT_BROWSERS.includes(browser) ? browser : 'chromium';
+  let installed = await version({ env, projectRoot: cwd, fresh: true });
+  const steps = [];
+  if (!installed) {
+    const server = await run('npm', ['install', '-g', PLAYWRIGHT_PACKAGE], { cwd, env });
+    steps.push({ display: `npm install -g ${PLAYWRIGHT_PACKAGE}`, code: server.code });
+    installed = await version({ env, projectRoot: cwd, fresh: true });
+    if (!installed) return { ok: false, steps, problem: server.said ?? t('the browser server could not be installed') };
+  }
+  const fetched = await run('npx', ['--no', PLAYWRIGHT_PACKAGE, 'install-browser', engine], { cwd, env });
+  steps.push({ display: installBrowserLine(engine), code: fetched.code });
+  const check = await starts({ browser, env, cwd });
+  return { ...check, steps, ...(check.ok ? {} : { problem: check.problem ?? fetched.said }) };
+}
+
 // Does the browser server start, with its browser? Asked when the switch is turned on, with the
 // same server a turn gets: the card said «on · chromium» while every turn's server closed before it
 // spoke, and the agents saw only CONNECTION_CLOSED. It is asked to open about:blank, because a
@@ -87,7 +139,7 @@ export async function playwrightStarts({ browser = 'chromium', env = process.env
     });
     child.stderr.on('data', (chunk) => { err += chunk; });
     child.on('error', (error) => finish({ ok: false, problem: error.message }));
-    child.on('close', (code) => finish({ ok: false, problem: lastWords(err) ?? t('it exited with code {code} before it spoke', { code }) }));
+    child.on('close', (code) => finish({ ok: false, problem: npmReason(err) ?? t('it exited with code {code} before it spoke', { code }) }));
     send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'madre', version: '1' } } });
   });
 }
@@ -101,15 +153,18 @@ export const wantsBrowser = (text) => BROWSER_INTENT.test(String(text ?? ''));
 // The last answer to «does it start?», for a switch that was already on: asked again in the
 // background at most every ten minutes, so the card can say the browser is missing and no turn
 // carries a server that would only fail.
-let started = { at: 0, result: null, asking: null };
+// The answer belongs to the browser it was asked about: chosen another, it is asked again, or a
+// browser that does not start would ride on the answer of one that does.
+let started = { at: 0, result: null, asking: null, browser: null };
 export function playwrightHealth({ browser = 'chromium', env = process.env, cwd = process.cwd(), now = Date.now(), check = playwrightStarts } = {}) {
   if (env.PULSE_PLAYWRIGHT_CHECK === '0') return started.result;
+  if (started.browser !== browser) started = { at: 0, result: null, asking: null, browser };
   if (!started.asking && now - started.at > 10 * 60 * 1000) {
-    started.asking = check({ browser, env, cwd }).then((result) => { started = { at: Date.now(), result, asking: null }; return result; }, () => { started.asking = null; return null; });
+    started.asking = check({ browser, env, cwd }).then((result) => { if (started.browser === browser) started = { at: Date.now(), result, asking: null, browser }; return result; }, () => { started.asking = null; return null; });
   }
   return started.result;
 }
-export function forgetPlaywrightHealth(result = null) { started = { at: result ? Date.now() : 0, result, asking: null }; }
+export function forgetPlaywrightHealth(result = null, browser = null) { started = { at: result ? Date.now() : 0, result, asking: null, browser }; }
 
 // What the browser may open: this room, and the servers the human started from RUNS in this project
 // while they listen on 127.0.0.1. RIPLEY's sealed frame keeps no data, so an app that stores its
@@ -134,6 +189,24 @@ export function playwrightServerFor({ port, outputDir, browser = 'chromium', hea
   };
 }
 
+async function playwrightReady(ctx) {
+  const browser = ctx.settings.browser ?? 'chromium';
+  let check = await playwrightStarts({ browser, env: ctx.env, cwd: ctx.projectRoot });
+  // Something missing: MADRE fetches it, then asks again, before saying anything to the person.
+  if (!check.ok && process.platform !== 'win32') {
+    await ctx.record('extension.preparing', { id: 'playwright', name: 'PLAYWRIGHT', browser });
+    check = await preparePlaywright({ browser, env: ctx.env, cwd: ctx.projectRoot });
+  }
+  forgetPlaywrightHealth(check, browser);
+  if (check.ok) return null;
+  // The server is there and only the browser is missing: say which one, and the one line that
+  // installs it. Without the server, both lines.
+  const version = await playwrightVersion({ env: ctx.env, projectRoot: ctx.projectRoot });
+  return { status: 412, body: { error: version
+    ? t('TEST BROWSER stays off: MADRE downloaded the {browser} browser and it still does not start ({problem}). Check your internet connection and turn it on again, or choose another browser in its settings.', { problem: String(check.problem).replace(/[.\s]+$/, ''), browser })
+    : t('TEST BROWSER stays off: MADRE could not install its browser server ({problem}). Check your internet connection and turn it on again.', { problem: String(check.problem).replace(/[.\s]+$/, '') }), code: 'MU-054' } };
+}
+
 export default defineModule({
   id: 'playwright',
   name: 'Test browser',
@@ -141,7 +214,7 @@ export default defineModule({
   tracks: { name: PLAYWRIGHT_PACKAGE, npm: PLAYWRIGHT_PACKAGE },
   summary: 'Hands an agent a headless browser that reaches only this project and the servers you start from COMMANDS, on the turns that ask to look at a page, click through it, read its console or take screenshots.',
   creates: ['nothing in the project \u00b7 screenshots land in .pulse/out/<turn>/', 'a switch in ~/.pulse/config.json', 'a browser per turn, started and stopped by the CLI', 'no origin but this project is reachable through it'],
-  requires: ['@playwright/mcp and a chromium browser on this machine', 'PREVIEW on, to have pages to open'],
+  requires: ['@playwright/mcp and the browser you choose for it (chromium by default) on this machine', 'PREVIEW on, to have pages to open'],
   settings: { enabled: false, browser: 'chromium', headless: true },
   card: 'switch',
   controls: [
@@ -154,8 +227,8 @@ export default defineModule({
     return {
       runs: [{ name: PLAYWRIGHT_PACKAGE, version }],
       settings: { browser: ctx.settings.browser ?? 'chromium', headless: ctx.settings.headless !== false },
-      status: { installed: Boolean(ctx.settings.enabled), detail: ctx.settings.enabled ? (!version ? t('on · the browser server is not installed') : health?.ok === false ? t('on · the browser does not start: {problem}', { problem: String(health.problem).slice(0, 160) }) : `${t('on')} · ${ctx.settings.browser}`) : version ? t('off') : t('off · the browser server is not installed') },
-      preflight: version ? { ok: true, problems: [] } : { ok: false, problems: ['Install the browser server first: npm install -g @playwright/mcp, then its browser: npx @playwright/mcp install-browser chrome-for-testing'] },
+      status: { installed: Boolean(ctx.settings.enabled), detail: ctx.settings.enabled ? (!version ? t('on · the browser server is not installed') : health?.ok === false ? t('on · the browser does not start: {problem}. Turn it off and on again: MADRE downloads what is missing.', { problem: String(health.problem).replace(/[.\s]+$/, '').slice(0, 160) }) : `${t('on')} · ${ctx.settings.browser}`) : version ? t('off') : t('off · the browser server is not installed') },
+      preflight: version ? { ok: true, problems: [] } : { ok: false, problems: [`Install the browser server first: npm install -g @playwright/mcp, then its browser: ${installBrowserLine(ctx.settings.browser)}`] },
       install: { display: ctx.settings.enabled ? 'disable PLAYWRIGHT' : 'enable PLAYWRIGHT (config.json)', platforms: ['codex', 'claude', 'gemini', 'opencode'] },
     };
   },
@@ -183,15 +256,15 @@ export default defineModule({
     const outputDir = turn.scratchDir ?? join(turn.roomDir ?? ctx.stateRoot, 'playwright');
     return [playwrightServerFor({ port: turn.port, outputDir, browser: ctx.settings.browser ?? 'chromium', headless: ctx.settings.headless !== false, servers: turn.servers ?? [] })];
   },
-  // The switch, guarded: on only if the server starts and has its browser. Off is always allowed.
+  // Before it turns on, in one project or in all: the server starts and has its browser, or MADRE
+  // fetches what is missing and asks again. `null` is ready; anything else is the refusal.
+  ready: playwrightReady,
+  // The switch, guarded: on only if it is ready. Off is always allowed. A project's switch is that
+  // project's (module-scope.mjs).
   async toggle(ctx) {
     const enabled = !ctx.settings.enabled;
-    if (enabled) {
-      const check = await playwrightStarts({ browser: ctx.settings.browser ?? 'chromium', env: ctx.env, cwd: ctx.projectRoot });
-      forgetPlaywrightHealth(check);
-      if (!check.ok) return { status: 412, body: { error: t('TEST BROWSER did not start, so it stays off: {problem}. Install the server and its browser (npm install -g @playwright/mcp, then npx @playwright/mcp install-browser chrome-for-testing) and turn it on again.', { problem: String(check.problem).replace(/[.\s]+$/, '') }), code: 'MU-054' } };
-    }
-    await ctx.updateConfig({ modules: { playwright: { ...(ctx.config.modules?.playwright ?? {}), enabled } } });
+    if (enabled) { const refused = await playwrightReady(ctx); if (refused) return refused; }
+    await ctx.updateConfig({ modules: { playwright: switchIn(ctx.config.modules?.playwright ?? {}, ctx.roomId ?? null, enabled) } });
     await ctx.record('extension.toggled', { id: 'playwright', name: 'PLAYWRIGHT', enabled });
     return { status: 200, body: { enabled } };
   },
@@ -203,6 +276,6 @@ export default defineModule({
     match: /@playwright\/mcp|playwright.*not (found|installed)|browser server/i,
     diagnosis: 'The TEST BROWSER module runs @playwright/mcp per turn. Two different things have to be on this computer and only one of them is the package: the server, and the browser build that this version of it expects. A server that starts without its browser answers every tool call with "Browser … is not installed", and one that cannot start at all reaches the agent as CONNECTION_CLOSED.',
     remedy: 'Install the server once, globally, then its browser — the browser is downloaded by the server itself, not by the playwright CLI — and RECHECK in MODULES.',
-    fixes: { darwin: ['npm install -g @playwright/mcp', 'npx @playwright/mcp install-browser chrome-for-testing'], linux: ['npm install -g @playwright/mcp', 'npx @playwright/mcp install-browser chrome-for-testing'] },
+    fixes: { darwin: ['npm install -g @playwright/mcp', 'npx @playwright/mcp install-browser chromium'], linux: ['npm install -g @playwright/mcp', 'npx @playwright/mcp install-browser chromium'] },
   }],
 });

package/src/modules/ripley.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // RIPLEY: the file viewer renders HTML, SVG and Markdown inside a sealed frame.
 // A switch in config.json, read live by the preview route.
 

package/src/modules/runs.mjs

@@ -1,9 +1,11 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Runs: letting an agent ask the human to run a command instead of asking them to copy it.
 //
 // Below #4 AIRLOCK an agent cannot run anything, and some answers turn on a command anyway: the
 // tests after a fix, a build, a linter. This gives that request a shape — a fenced block the room
-// turns into one button per command — and brings the output back to the room as a card every
-// agent reads on its next turn.
+// turns into one button per command — and brings the output back to the room as a card, and to
+// the agent that asked in a turn of its own once every line has run (src/room/returns.mjs).
 //
 // Nothing an agent writes runs by itself. Each line is pressed by the human, runs alone from the
 // project root with no shell, and is photographed first so UNDO can put the files back. What a
@@ -22,7 +24,7 @@ export default defineModule({
   name: 'Commands',
   vendor: 'MADRE',
   version: '1.0.0',
-  summary: 'Lets an agent ask you to run a command it cannot run in its mode (tests, a build, a linter). Each command is a button: nothing runs until you press it, it runs from the project root with no shell, a restore point is taken first, and the output comes back to the project. Costs about 300 tokens of instruction per turn below FULL ACCESS while it is on.',
+  summary: 'Lets an agent ask you to run a command it cannot run in its mode (tests, a build, a linter). Each command is a button: nothing runs until you press it, it runs from the project root with no shell, a restore point is taken first, and when it has run the output goes back to the agent that asked, which goes on. Costs about 300 tokens of instruction per turn below FULL ACCESS while it is on.',
   creates: ['nothing in the project', 'a switch in ~/.pulse/config.json'],
   async status(ctx) {
     return {

package/src/modules/sdk.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // MADRE's module SDK. A module is one file: what it is, the settings it keeps
 // in ~/.pulse/config.json, how it describes itself to MODULES, what its switch
 // does, the routes it serves and the events it listens to. The server builds a
@@ -17,6 +19,7 @@
 
 import { readFile, stat } from 'node:fs/promises';
 import { forgetSecret, readSecret, summary as vaultSummary, writeSecret } from '../vault.mjs';
+import { moduleOnIn, roomsOf, scopeIn, settingsIn, switchIn } from '../module-scope.mjs';
 
 const camel = (id) => id.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 
@@ -65,7 +68,7 @@ export function dependencies(runs) {
   return list.filter((dep) => dep && dep.name).map((dep) => ({ name: String(dep.name), version: dep.version ?? null, target: dep.target ?? null }));
 }
 
-// Every field this contract answers to. Thirty-four of them and all but two optional, which is
+// Every field this contract answers to. Thirty-eight of them and all but two optional, which is
 // generous until you misspell one: `sumary` used to install without a word and leave a card with
 // an empty summary. A key MADRE does not know is not fatal — a module written for a newer MADRE
 // may carry fields this one has not learned yet — so it is said out loud instead of refused.
@@ -74,10 +77,31 @@ export const MODULE_FIELDS = new Set([
   'requires', 'models', 'commands', 'card', 'configKey', 'settings', 'controls', 'routes', 'reaches',
   'conditions', 'slash', 'status', 'preflight', 'detect', 'confirm', 'installCommand', 'secrets',
   'updatePlan', 'toolsForTurn', 'toggle', 'onToggle', 'onSettings', 'onEvent', 'toggledEvent',
-  'toggledBody', 'describe',
+  'toggledBody', 'describe', 'ready', 'footer',
 ]);
 export const unknownFields = (spec) => Object.keys(spec ?? {}).filter((key) => !MODULE_FIELDS.has(key));
 
+// A key beside MADRE's version (2026-10-18): what a module may put on the page, and nothing more.
+// MADRE draws it — one of its own icons, the module's words, an https address that opens in a new
+// tab — so a module never reaches into the page itself.
+export const FOOTER_ICONS = ['heart', 'star', 'link'];
+const footerWords = (value) => {
+  if (typeof value === 'string') return value.slice(0, 160);
+  if (!value || typeof value !== 'object') return null;
+  const out = {};
+  for (const lang of ['en', 'es']) if (typeof value[lang] === 'string') out[lang] = value[lang].slice(0, 160);
+  return Object.keys(out).length ? out : null;
+};
+function footerKeys(spec) {
+  return (Array.isArray(spec.footer) ? spec.footer : []).slice(0, 2).map((key) => {
+    let url = null;
+    try { url = new URL(String(key?.url ?? '')); } catch { /* said below */ }
+    if (url?.protocol !== 'https:') throw new Error(`Module ${spec.id}: a key beside the version needs an https address.`);
+    if (!footerWords(key.label)) throw new Error(`Module ${spec.id}: a key beside the version needs a label.`);
+    return { icon: FOOTER_ICONS.includes(key.icon) ? key.icon : 'link', label: footerWords(key.label), text: footerWords(key.text), action: footerWords(key.action), url: url.href };
+  });
+}
+
 export function defineModule(spec) {
   if (!spec?.id || !/^[a-z][a-z0-9-]*$/.test(spec.id)) throw new Error(`Module id must be kebab-case: ${spec?.id}`);
   if (!spec.name) throw new Error(`Module ${spec.id} needs a name.`);
@@ -95,6 +119,8 @@ export function defineModule(spec) {
     // lives and MADRE can go and get it: the file is fetched, checked the same way an upload is,
     // and only replaces the one installed if it passes and says it is newer.
     updates: spec.updates?.url && /^https:\/\//.test(String(spec.updates.url)) ? { url: String(spec.updates.url) } : null,
+    // Keys beside MADRE's version, drawn by MADRE while the module is on (footerKeys).
+    footer: footerKeys(spec),
     summary: spec.summary ?? '', creates: spec.creates ?? [], requires: spec.requires ?? [], models: spec.models ?? [], commands: spec.commands ?? (spec.slash?.length ? spec.slash.map((command) => command.usage ?? `/${command.name}`) : undefined),
     card: spec.card ?? (kind === 'builtin' ? 'switch' : 'installer'),
     // The settings floor of the card, declared instead of drawn: MADRE renders these and saves
@@ -131,8 +157,14 @@ export function defineModule(spec) {
       return { name: secret.name, label: secret.label ?? secret.name.toUpperCase(), note: secret.note ?? '', where: secret.where ?? '' };
     }),
   };
-  const settingsFrom = (config) => ({ ...defaults, ...(config?.modules?.[configKey] ?? {}) });
+  // A project reads its own word on `enabled` when it said one (module-scope.mjs).
+  const settingsFrom = (config, roomId = null) => ({ ...defaults, ...settingsIn(config?.modules?.[configKey] ?? {}, roomId) });
   const mine = (ctx, settings) => ({ ...ctx, settings, vault: vaultFor(spec.id, ctx.stateRoot) });
+  const scopeHere = (ctx) => {
+    const block = ctx.config?.modules?.[configKey] ?? {};
+    const own = ctx.roomId ? roomsOf(block)[ctx.roomId] : undefined;
+    return { all: typeof block.enabled === 'boolean' ? block.enabled : Boolean(defaults.enabled), here: typeof own === 'boolean' ? own : null };
+  };
   const module = {
     ...base,
     configKey,
@@ -150,14 +182,14 @@ export function defineModule(spec) {
     }),
     // Tools for a turn, only while the module is on. Failures never break a turn.
     toolsForTurn: spec.toolsForTurn ? async (ctx, turn) => {
-      const settings = settingsFrom(ctx.config);
+      const settings = settingsFrom(ctx.config, ctx.roomId);
       if (kind === 'builtin' && !settings.enabled) return [];
       try { return (await spec.toolsForTurn(mine(ctx, settings), turn)) ?? []; } catch (error) { console.error(`MADRE module ${spec.id}: toolsForTurn failed: ${error.message}`); return []; }
     } : null,
     // How the outside thing this module drives gets a newer version onto this computer. MADRE
     // shows the command before it runs and never runs one the human has not read. A module that
     // cannot update what it drives returns the note that says where to get it instead.
-    updatePlan: spec.updatePlan ? async (ctx, what) => spec.updatePlan(mine(ctx, settingsFrom(ctx.config)), what) : null,
+    updatePlan: spec.updatePlan ? async (ctx, what) => spec.updatePlan(mine(ctx, settingsFrom(ctx.config, ctx.roomId)), what) : null,
     // Legacy installer hooks, kept on the object so the confirm-and-run path can use them.
     detect: spec.detect ?? null,
     preflight: spec.preflight ?? null,
@@ -165,7 +197,7 @@ export function defineModule(spec) {
 
     // What MODULES shows: base fields plus status, preflight, install line and whatever the module adds.
     async describe(ctx) {
-      const settings = settingsFrom(ctx.config);
+      const settings = settingsFrom(ctx.config, ctx.roomId);
       const own = spec.status ? await spec.status(mine(ctx, settings)) : {};
       const installed = own.installed ?? (kind === 'builtin' ? Boolean(settings.enabled) : false);
       const runs = dependencies(own.runs);
@@ -186,6 +218,8 @@ export function defineModule(spec) {
         status: own.status ?? { installed, detail: own.detail ?? (installed ? 'on' : 'off') },
         preflight: own.preflight ?? { ok: true, problems: [] },
         install: own.install ?? (kind === 'builtin' ? { display: installed ? `disable ${base.name}` : `enable ${base.name} (config.json)`, platforms: [] } : { display: '', platforms: [] }),
+        // Whether it is on for every project, and this project's own word when it said one.
+        ...(kind === 'builtin' ? { scope: scopeHere(ctx) } : {}),
       };
     },
 
@@ -202,7 +236,7 @@ export function defineModule(spec) {
       } else {
         next = String(value ?? '').slice(0, 500);
       }
-      const settings = { ...settingsFrom(ctx.config), [key]: next };
+      const settings = { ...settingsFrom(ctx.config, ctx.roomId), [key]: next };
       await ctx.updateConfig({ modules: { [configKey]: { ...(ctx.config.modules?.[configKey] ?? {}), [key]: next } } });
       if (spec.onSettings) await spec.onSettings(mine(ctx, settings), settings);
       return { status: 200, body: { settings: Object.fromEntries(base.controls.map((known) => [known.key, settings[known.key] ?? null])) } };
@@ -211,15 +245,35 @@ export function defineModule(spec) {
     // The switch. Default for builtins: flip `enabled`, persist, tell the room.
     // A module may guard it (`confirm`) or replace it (`toggle`).
     toggle: kind === 'builtin' || spec.toggle ? async (ctx, payload = {}) => {
-      const settings = settingsFrom(ctx.config);
+      const settings = settingsFrom(ctx.config, ctx.roomId);
       if (spec.toggle) return spec.toggle(mine(ctx, settings), payload);
       const enabled = !settings.enabled;
       if (enabled && spec.confirm && payload.confirm !== true) return { status: 400, body: { error: spec.confirm } };
-      await ctx.updateConfig({ modules: { [configKey]: { ...(ctx.config.modules?.[configKey] ?? {}), enabled } } });
+      if (enabled && spec.ready) { const refused = await spec.ready(mine(ctx, settings)); if (refused) return refused; }
+      // A project's switch is that project's (module-scope.mjs); Home's is every project's.
+      await ctx.updateConfig({ modules: { [configKey]: switchIn(ctx.config.modules?.[configKey] ?? {}, ctx.roomId ?? null, enabled) } });
       const after = spec.onToggle ? await spec.onToggle(mine(ctx, { ...settings, enabled }), enabled) : null;
       await ctx.record('extension.toggled', { id: spec.id, name: base.name, enabled, ...(spec.toggledEvent ?? {}) });
       return { status: 200, body: { enabled, ...(after ?? {}), ...(spec.toggledBody?.(enabled) ?? {}) } };
     } : null,
+
+    // Home's word on which projects (2026-10-18): `{ all }` for every project, `{ rooms: { id: on } }`
+    // for some. Turning it on anywhere asks what turning it on asks (`confirm`, `ready`); the
+    // project rooms read the new word on their next turn.
+    scope: kind === 'builtin' || spec.toggle ? async (ctx, change = {}) => {
+      const block = ctx.config.modules?.[configKey] ?? {};
+      const next = scopeIn(block, change);
+      const fallback = Boolean(defaults.enabled);
+      const turningOn = change.all === true || Object.values(change.rooms ?? {}).some((on) => on === true);
+      const settings = settingsFrom(ctx.config, ctx.roomId);
+      if (turningOn && spec.confirm && change.confirm !== true) return { status: 400, body: { error: spec.confirm } };
+      if (turningOn && spec.ready) { const refused = await spec.ready(mine(ctx, settings)); if (refused) return refused; }
+      await ctx.updateConfig({ modules: { [configKey]: next } });
+      const here = moduleOnIn(next, ctx.roomId ?? null, fallback);
+      if (spec.onToggle && here !== Boolean(settings.enabled)) await spec.onToggle(mine(ctx, { ...settings, enabled: here }), here);
+      await ctx.record('extension.toggled', { id: spec.id, name: base.name, enabled: here, scope: { all: typeof next.enabled === 'boolean' ? next.enabled : fallback, rooms: roomsOf(next) } });
+      return { status: 200, body: { all: typeof next.enabled === 'boolean' ? next.enabled : fallback, rooms: roomsOf(next) } };
+    } : null,
   };
   return Object.freeze(module);
 }

package/src/modules/updates.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Is there a newer version of what a module is? Two kinds of answer, because there are two kinds
 // of module.
 //

package/src/mother.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // MU/TH/UR's private channel. When someone strikes at her memory core, MOTHER
 // tells her children (the agents) in a code the console cannot read; the room
 // shows the code, the agents get the words. The channel lives in

package/src/npm-launch.mjs

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
+// What `npx` leaves in MADRE's environment about the call that started it, taken away before MADRE
+// runs anything (2026-10-18).
+//
+// npm hands every process it starts the details of its own run: which package it was asked for
+// (npm_config_package), that it may say yes for you (npm_config_yes), the folder it was typed in
+// (npm_config_local_prefix, INIT_CWD), its own command and script. They are about that one call,
+// and every npm or npx MADRE ran after inherited them: Continuity's installer, started in a
+// project, went to install the package MADRE had been launched from, in the project's folder,
+// and failed. The person's npm configuration (cache, registry, prefix, their npmrc) stays.
+const LAUNCH = /^(npm_config_(package|yes|call|local_prefix|npm_version|user_agent)|npm_command|npm_execpath|npm_node_execpath|npm_lifecycle_event|npm_lifecycle_script|npm_package_json|INIT_CWD)$/i;
+
+export function forgetNpxLaunch(env = process.env) {
+  const gone = [];
+  for (const name of Object.keys(env)) if (LAUNCH.test(name)) { delete env[name]; gone.push(name); }
+  return gone;
+}

package/src/ollama.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Ollama: the local intelligence MADRE leans on when it is there. Embeddings
 // for recall by meaning and a model to distil memories, both on this machine,
 // so remembering costs no tokens elsewhere and nothing leaves. Nothing here is
@@ -8,10 +10,11 @@ import { t } from './i18n.mjs';
 export const DEFAULT_OLLAMA_HOST = 'http://127.0.0.1:11434';
 // Embedding models we know how to talk to, best first.
 export const EMBED_MODELS = ['nomic-embed-text', 'mxbai-embed-large', 'snowflake-arctic-embed', 'all-minilm', 'bge-m3'];
-// Chat models that follow instructions well enough to distil, best first for a 16 GB machine.
-// General chat models first: @madre speaks for the room in the human's language, and coder
-// models drift into other voices. A coder is taken only when nothing else is there.
-export const CHAT_MODELS = ['qwen2.5:7b', 'llama3.1:8b', 'gemma3:4b', 'qwen2.5:3b', 'llama3.2:3b', 'qwen2.5:1.5b', 'llama3.2:1b', 'qwen2.5-coder:7b', 'qwen2.5-coder:1.5b'];
+// Chat models that follow instructions well enough to distil, best first. The larger Qwen2.5
+// sizes lead: the room only offers one to a computer that runs it (src/modules/local-models.mjs),
+// so when it is there it was pulled for this machine. General chat models before coders: @madre
+// speaks for the room in the human's language, and coder models drift into other voices.
+export const CHAT_MODELS = ['qwen2.5:72b', 'qwen2.5:32b', 'qwen2.5:14b', 'qwen2.5:7b', 'llama3.1:8b', 'gemma3:4b', 'qwen2.5:3b', 'llama3.2:3b', 'qwen2.5:1.5b', 'llama3.2:1b', 'qwen2.5-coder:7b', 'qwen2.5-coder:1.5b'];
 // Ollama's default window is 4k tokens and it drops the OLDEST text when a prompt overflows:
 // the system prompt goes first. Every MADRE call asks for a wider window.
 export const DEFAULT_NUM_CTX = 8192;
@@ -58,7 +61,7 @@ export async function probeOllama({ host = ollamaHost(), fetchImpl = globalThis.
     // What Ollama itself is running. It answers or it does not; either way the probe goes on.
     const version = await fetchImpl(`${host}/api/version`, { signal: AbortSignal.timeout(timeoutMs) })
       .then((answer) => (answer.ok ? answer.json() : null)).then((body) => body?.version ?? null).catch(() => null);
-    const models = (payload.models ?? []).map((model) => ({ name: model.name, size: model.size ?? 0, family: model.details?.family ?? '', details: model.details ?? {} }));
+    const models = (payload.models ?? []).map((model) => ({ name: model.name, size: model.size ?? 0, digest: model.digest ?? null, family: model.details?.family ?? '', details: model.details ?? {} }));
     const embeds = models.filter(isEmbedModel);
     const chats = models.filter((model) => !isEmbedModel(model));
     return {

package/src/outbound.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What left this machine.
 //
 // MADRE runs on your computer and keeps everything it knows in a file you own, and that sentence
@@ -48,7 +50,7 @@ export const DESTINATIONS = [
     inside: false,
   },
   {
-    id: 'embeddings', host: 'generativelanguage.googleapis.com', match: (url) => /batchEmbedContents/.test(url.pathname), to: 'Google · Gemini embeddings',
+    id: 'embeddings', host: 'generativelanguage.googleapis.com', match: (url) => /batchEmbedContents/.test(url.pathname), to: 'Google · Gemini search by meaning',
     what: 'The text of what is being embedded: the first 2000 characters of each memory, and the question a recall is made of.',
     when: 'a memory is written or recalled, while embeddings are set to Gemini',
     where: 'Settings › Memory › Smart search · Ollama keeps it on this computer, off drops back to words',
@@ -57,7 +59,7 @@ export const DESTINATIONS = [
   {
     id: 'image', host: 'generativelanguage.googleapis.com', match: (url) => /generateContent/.test(url.pathname), to: 'Google · Gemini image model',
     what: 'The prompt an agent wrote for an image.',
-    when: 'an agent calls the image tool during a lease',
+    when: 'an agent uses the image tool during a permission to create',
     where: 'Modules › Images',
     // It runs in a process of its own and writes its own line into this same log, so it is here.
     inside: true,
@@ -65,7 +67,7 @@ export const DESTINATIONS = [
   {
     id: 'npm', host: 'registry.npmjs.org', to: 'the npm registry',
     what: 'The name of a package, to read the version of its latest release. Nothing about you or your project.',
-    when: 'at most once a day per package, while the release channel is on',
+    when: 'at most once a day per package, while Look for new versions is on',
     where: 'Settings › Version and reports › Look for new versions · or PULSE_UPDATE_CHECK=0',
     inside: true,
   },
@@ -73,7 +75,7 @@ export const DESTINATIONS = [
     // Only the release read: the rest of api.github.com is the GitHub module's, and says so itself.
     id: 'github', host: 'api.github.com', match: (url) => /\/releases\/latest$/.test(url.pathname), to: 'GitHub',
     what: 'The name of a repository, to read the tag of its latest release. Nothing about you or your project.',
-    when: 'at most once a day per repository, while the release channel is on',
+    when: 'at most once a day per repository, while Look for new versions is on',
     where: 'Settings › Version and reports › Look for new versions · or PULSE_UPDATE_CHECK=0',
     inside: true,
   },
@@ -85,6 +87,14 @@ export const DESTINATIONS = [
     where: 'Always on: it is how the author knows how many people use MADRE',
     inside: true,
   },
+  {
+    // The Market (src/market-remote.mjs): a signed catalog, and the file of a module you get from it.
+    id: 'market', host: 'madre.run', match: (url) => url.pathname.startsWith('/mercado/'), to: "madre.run · the Market",
+    what: 'Nothing about you: it asks for the catalog of modules, and for the file of a module you got or that has a newer version. Every file is checked against the author\'s signature before it is used.',
+    when: 'when MADRE opens, at most every ten minutes, and when you get a module',
+    where: 'Settings › Version and reports › Look for new versions · or PULSE_MARKET=0',
+    inside: true,
+  },
   {
     id: 'usage', host: 'madre.run', match: (url) => url.pathname === '/api/usage', to: "madre.run · the author's usage figures",
     what: "The author's token, to read how many copies are on. Only in the author's own copy, run from source.",
@@ -321,7 +331,7 @@ export class OutboundLog {
 export function outboundView({ log = null, state = {}, agents = [] } = {}) {
   const counts = log?.counts() ?? {};
   // Said in the room's language (2026-10-12): the list read in English inside a Spanish room.
-  const vendors = { codex: 'OpenAI', claude: 'Anthropic', gemini: 'Google', opencode: t('the provider OpenCode is signed in to') };
+  const vendors = { codex: 'OpenAI', claude: 'Anthropic', gemini: 'Google', opencode: t('the provider OpenCode is signed in to'), cursor: 'Cursor' };
   const crew = agents.filter((agent) => agent.detected && !agent.local).map((agent) => `@${agent.id} → ${agent.route?.destination ?? vendors[agent.id] ?? t('its own provider')}`);
   const destinations = DESTINATIONS.map((one) => ({
     id: one.id,
@@ -344,7 +354,7 @@ export function outboundView({ log = null, state = {}, agents = [] } = {}) {
     recent: log?.recent({ limit: 40 }) ?? [],
     undeclared,
     says: undeclared
-      ? (undeclared === 1 ? t('1 request went to an address nothing here declares. A module can do that; nothing can do it unlogged.') : t('{n} requests went to an address nothing here declares. A module can do that; nothing can do it unlogged.', { n: undeclared }))
+      ? (undeclared === 1 ? t('1 request went to an address not on this list. A module can do that, but it is always logged.') : t('{n} requests went to addresses not on this list. A module can do that, but it is always logged.', { n: undeclared }))
       : t('Every request this process made went to an address declared above.'),
   };
 }

package/src/override.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { createHash, timingSafeEqual } from 'node:crypto';
 
 // How #3 CONTROL and #4 AIRLOCK are unlocked, as the person chose it in AJUSTES › Permissions.

package/src/ports.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What is listening on this computer, so RIPLEY can look at it.
 //
 // A room that renders a project's files but cannot open the project's own dev server is half a
@@ -14,8 +16,10 @@
 const SYSTEM_PORTS = new Set([22, 25, 53, 88, 139, 445, 548, 631, 5353, 7000]);
 // Processes that always listen and never serve a page worth previewing.
 // Ollama is here because MADRE itself uses it (the local model, @madre): started from a project
-// folder it would pass for that project's server.
-const NOISE = /^(rapportd|sharingd|identityservicesd|controlce|remoted|launchd|mDNSResponder|cupsd|Spotify|Dropbox|Docker|com\.docker|ollama)/i;
+// folder it would pass for that project's server. So is its runner, `llama-server` («llama-ser» in
+// lsof's nine letters): each model it loads listens on a port of its own and closes it when the
+// model is unloaded after a few idle minutes, which read as «your server stopped» (2026-10-17).
+const NOISE = /^(rapportd|sharingd|identityservicesd|controlce|remoted|launchd|mDNSResponder|cupsd|Spotify|Dropbox|Docker|com\.docker|ollama|llama-ser)/i;
 
 // One `lsof -nP -iTCP -sTCP:LISTEN` table into the ports a human might want to look at.
 // Loopback only: a line bound to * or 0.0.0.0 is reachable from the network, and this room does

package/src/prices.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What a turn would cost at the provider's API list price, for the CLIs that do not say it
 // themselves. Claude Code reports its own figure (`total_cost_usd`); Codex and Gemini report only
 // tokens, and OpenCode reports 0 when the model runs on a subscription. So the room prices those

package/src/privacy.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Privacy: terms that must never travel through a room. ERROR-001 in a real room
 // showed the channel: an agent's own configuration (organisation instructions,
 // the account it runs under) leaks into its reply, the reply enters the shared

package/src/quota-monitor.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 export class QuotaMonitor {
   #sources;
   #onReport;

package/src/quota-sources.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { execFile } from 'node:child_process';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';

package/src/request-guard.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The room listens on 127.0.0.1, which keeps other computers out but not other web pages: any
 // site open in this browser can send a request to 127.0.0.1:4317, and an uploaded module is code
 // MADRE runs with your permissions. Two checks, before any route, close that door.

package/src/review-ask.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Asking for a star or a review (2026-10-10): three times at most, and never again once answered.
 //
 // After twenty minutes of MADRE in use, and on the second and the seventh day after it was first

package/src/room/archivist.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The archivist: every so often the cheapest allowed agent reads what nobody
 // has distilled and keeps the few notes worth remembering. Scheduling by count
 // or by quiet, one batch per run, a bench for whoever fails, a report to the

package/src/room/attachments.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Human uploads, stored under the room (never in the project). Registered
 // here so a message can reference them by id; the ledger lets a restarted
 // room rebuild the registry.

package/src/room/budget.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The local token budget: a rolling window per agent (five hours, like the
 // providers' short windows), raw totals for the record, and the seeding of the
 // usage sentinel from the ledger on start.