@lchase/kiln 0.6.1 → 0.7.0

package/dist/reliability.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { z } from "zod";
+import { authenticationFailureLine } from "./auth.js";
 import { jobBasename } from "./paths.js";
 import { FAILURE_REASONS } from "./reconcile.js";
 /**
@@ -79,8 +80,10 @@ export function resetAttemptLedger(kilnDir, jobId, runId) {
 }
 /**
  * Stall, orphan, crash, and non-zero-exit handling for one observation.
- * Caller holds the tick lock. Safe to run twice: a run id is recorded once,
- * and worktree cleanup no-ops once the tree is gone or must be kept.
+ * A run that finishes with status `failed` takes the same worktree decision
+ * as a crash. Caller holds the tick lock. Safe to run twice: a run id is
+ * recorded once, and worktree cleanup no-ops once the tree is gone or must
+ * be kept.
  */
 export function recoverRuns(config, jobs, options) {
     const notes = [];
@@ -164,22 +167,79 @@ function pendingFailure(job, config, options) {
     if (runLive)
         return undefined;
     if (run && (run.status === "dead" || (run.status === "alive" && run.pid !== undefined && !isPidAlive(run.pid)))) {
-        return options.startup
+        return classifyAuth(job, options.startup
             ? { reason: "orphaned", runId: run.runId, pid: run.pid, detail: "process gone at startup" }
-            : { reason: "crashed", runId: run.runId, pid: run.pid, detail: "process exited" };
+            : { reason: "crashed", runId: run.runId, pid: run.pid, detail: "process exited" });
     }
+    // A normal failed exit (journal status failed) is not a crash. It still
+    // records an attempt and reaches cleanupRunWorktree below.
     if (run?.status === "failed") {
-        return { reason: "failed", runId: run.runId, pid: run.pid, detail: "non-zero exit" };
+        return classifyAuth(job, { reason: "failed", runId: run.runId, pid: run.pid, detail: "non-zero exit" });
     }
     if (job.launchFailed) {
-        return {
+        return classifyAuth(job, {
             reason: "crashed",
             ...(job.launchPid !== undefined ? { pid: job.launchPid } : {}),
             detail: "launch exited before a journal",
-        };
+        });
     }
     return undefined;
 }
+/** A rejected Claude login is recorded once and is not scheduled for retry. */
+function classifyAuth(job, pending) {
+    const line = authenticationFailureLine(authTexts(job));
+    if (!line)
+        return pending;
+    return {
+        reason: "auth-failed",
+        ...(pending.runId ? { runId: pending.runId } : {}),
+        ...(pending.pid !== undefined ? { pid: pending.pid } : {}),
+        detail: line,
+    };
+}
+function authTexts(job) {
+    const texts = [];
+    for (const event of job.run?.stepEvents ?? []) {
+        if (event.detail)
+            texts.push(event.detail);
+    }
+    if (job.logTail)
+        texts.push(job.logTail);
+    const log = readAuthLog(job.logPath);
+    if (log)
+        texts.push(log);
+    return texts;
+}
+/** Tail of the kiln log. Yak prints the Claude stderr line here, past the 40-line status tail. */
+function readAuthLog(logPath) {
+    if (!logPath)
+        return undefined;
+    let size;
+    try {
+        size = statSync(logPath).size;
+    }
+    catch {
+        return undefined;
+    }
+    if (size <= 0)
+        return undefined;
+    const take = Math.min(size, 256 * 1024);
+    let fd;
+    try {
+        fd = openSync(logPath, "r");
+        const buffer = Buffer.alloc(take);
+        readSync(fd, buffer, 0, take, size - take);
+        const text = buffer.toString("utf8").trim();
+        return text || undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 function recordFailure(config, jobId, existing, pending, now) {
     const ledger = existing ?? { jobId, attempts: [] };
     if (alreadyRecorded(ledger, pending))
@@ -193,7 +253,7 @@ function recordFailure(config, jobId, existing, pending, now) {
         detail: pending.detail,
     };
     const attempts = [...ledger.attempts, attempt];
-    const exhausted = attempts.length >= config.maxAttempts;
+    const exhausted = attempts.length >= config.maxAttempts || pending.reason === "auth-failed";
     const next = exhausted ? undefined : new Date(now.getTime() + retryDelayMs(attempts.length)).toISOString();
     const written = {
         jobId,
@@ -243,6 +303,8 @@ function writeLedger(kilnDir, ledger) {
  * Drop a failed run's worktree only when that loses no commits.
  * A branch with commits that are not on HEAD and not on a remote is kept,
  * and so is a dirty worktree. The checkout's own worktree is not removed.
+ * The branch is left in place.
+ * A second call, or a call when the worktree is already gone, does nothing.
  */
 export function cleanupRunWorktree(checkout, runId) {
     if (!safeRunId(runId))
@@ -253,25 +315,19 @@ export function cleanupRunWorktree(checkout, runId) {
     const worktreeRoot = resolve(root, ".yak", "worktrees");
     if (worktree === root || !worktree.startsWith(`${worktreeRoot}${sep}`))
         return "kept";
-    const branchExists = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
-    const worktreeExists = existsSync(worktree);
-    if (!branchExists && !worktreeExists)
+    if (!existsSync(worktree))
         return "absent";
+    const branchExists = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
     if (checkedOut(root, branch))
         return "kept";
     if (branchExists && hasUnpushedCommits(root, branch))
         return "kept";
-    if (worktreeExists && worktreeDirty(worktree))
+    if (worktreeDirty(worktree))
         return "kept";
-    if (worktreeExists && worktreeListed(root, worktree)) {
+    if (worktreeListed(root, worktree)) {
         gitOk(root, ["worktree", "remove", worktree]);
     }
-    if (existsSync(worktree))
-        return "kept";
-    if (branchExists)
-        gitOk(root, ["branch", "-D", branch]);
-    const stillBranch = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
-    return existsSync(worktree) || stillBranch ? "kept" : "removed";
+    return existsSync(worktree) ? "kept" : "removed";
 }
 function safeRunId(runId) {
     return RUN_ID.test(runId) && !runId.includes("..");
@@ -280,9 +336,14 @@ function checkedOut(checkout, branch) {
     const result = git(checkout, ["rev-parse", "--abbrev-ref", "HEAD"]);
     return result.status === 0 && result.stdout.trim() === branch;
 }
-/** Commits on the branch that are neither in HEAD nor on any remote. Failure keeps the branch. */
+/**
+ * Commits on the branch that are neither in HEAD nor on any remote.
+ * `--not` toggles exclusion for every following revision, so it must appear
+ * once: a second `--not` would count commits that exist only on a remote.
+ * A git error keeps the worktree.
+ */
 function hasUnpushedCommits(checkout, branch) {
-    const result = git(checkout, ["rev-list", "--count", branch, "--not", "HEAD", "--not", "--remotes"]);
+    const result = git(checkout, ["rev-list", "--count", branch, "--not", "HEAD", "--remotes"]);
     if (result.status !== 0)
         return true;
     const count = Number(result.stdout.trim());

package/dist/report.js

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
+import { AUTH_FAILED_LINE } from "./auth.js";
 import { readBoardFiles, readReviewRounds } from "./board.js";
 import { feedbackRoundText } from "./feedback.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
@@ -162,6 +163,8 @@ export function statusDetails(job) {
         lines.push(`attempts ${job.attemptCount}`);
     if (job.lastFailureReason)
         lines.push(`reason ${job.lastFailureReason}`);
+    if (job.lastFailureReason === "auth-failed")
+        lines.push(AUTH_FAILED_LINE);
     if (job.nextRetryAt)
         lines.push(`next retry ${job.nextRetryAt}`);
     if (job.state === "dead" && job.attemptCount > 0)
@@ -224,6 +227,7 @@ function toStatusJob(job, observation) {
             canApprove: false,
             canReject: false,
             steps: progressFor(job),
+            ...(job.deliver ? { deliver: job.deliver } : {}),
             ...(job.createdAt ? { createdAt: job.createdAt } : {}),
             ...(job.logTail ? { logTail: job.logTail } : {}),
             ...boardFields(job),
@@ -250,7 +254,8 @@ function toStatusJob(job, observation) {
         stack: job.stack === true,
         ...(job.source ? { source: { kind: job.source.kind, ref: job.source.ref } } : {}),
         ...(runId ? { runId } : {}),
-        ...(showBranch ? { branch: `yak/${runId}` } : {}),
+        ...(showBranch ? { branch: job.delivery?.branch ?? `yak/${runId}` } : {}),
+        ...(job.deliver ? { deliver: job.deliver } : {}),
         ...(job.delivery?.prUrl ? { prUrl: job.delivery.prUrl } : {}),
         ...(prNumber ? { prNumber } : {}),
         ...(job.logPath ? { logPath: job.logPath } : {}),
@@ -397,7 +402,7 @@ export function renderTick(observation, actions, launches, delivers = [], findin
             : `findings ${recorded.jobId}  missing`);
     }
     for (const note of notes) {
-        const next = note.nextRetryAt ? `  next ${note.nextRetryAt}` : "  dead";
+        const next = note.nextRetryAt ? `  next ${note.nextRetryAt}` : note.reason === "auth-failed" ? "" : "  dead";
         lines.push(`${note.kind} ${note.jobId}  ${note.reason}  attempt ${note.attempt}${next}`);
     }
     for (const note of feedbackNotes) {

package/dist/schemas.js

@@ -10,12 +10,35 @@ import { z } from "zod";
  * `pr` pushes that branch and opens a draft pull request against `base`.
  * `base` defaults to origin's default branch, discovered with git, when omitted.
  */
+/** Jira-style issue keys (`ABC-123`). Stored and matched in uppercase. */
+export const ISSUE_KEY = /^[A-Z][A-Z0-9]+-\d+$/;
+export function parseIssueKey(raw) {
+    const key = raw.trim().toUpperCase();
+    if (!ISSUE_KEY.test(key)) {
+        throw new Error(`Issue key ${JSON.stringify(raw)} must match KEY-123.`);
+    }
+    return key;
+}
+export const REPO_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 export const RepoEntrySchema = z.object({
-    path: z.string().min(1),
-    test: z.string().min(1).optional(),
+    path: z.string().min(1, "Path is required."),
+    test: z.string().min(1, "Test command is empty.").optional(),
     deliver: z.enum(["local", "pr"]).optional(),
-    base: z.string().min(1).optional(),
+    base: z.string().min(1, "Base branch is empty.").optional(),
+    /**
+     * Pull request title when the job has an `issue`. Placeholders `{issue}` and `{title}`.
+     * Default `[{issue}] {title}`. A job with no issue keeps its title and ignores this.
+     */
+    prTitle: z.string().min(1, "PR title template is empty.").optional(),
+    /**
+     * Remote branch for `deliver=pr`. Placeholders `{issue}`, `{slug}`, and `{jobId}`.
+     * Default `<issue>-<slug>`, or `kiln/<slug>-<short id>` when there is no issue.
+     * The local branch stays `yak/<run-id>`.
+     */
+    branch: z.string().min(1, "Branch template is empty.").optional(),
 });
+/** Repo map shared by the config file and the settings API. */
+export const KilnReposSchema = z.record(z.string().regex(REPO_NAME, "must start with a letter or digit and contain only letters, digits, dots, underscores, and hyphens"), RepoEntrySchema);
 /**
  * Optional Jira Cloud credentials in the gitignored kiln config.
  * `JIRA_BASE_URL`, `JIRA_EMAIL`, and `JIRA_API_TOKEN` override these.
@@ -41,6 +64,14 @@ export const SandboxSettingsSchema = z.object({
         .optional(),
     allowDomains: z.array(z.string().regex(HOSTNAME, "must be a hostname")).min(1).optional(),
 });
+/**
+ * Sandbox fields the settings UI edits. `image` stays on the file schema only
+ * and is preserved when settings are saved.
+ */
+export const EditableSandboxSchema = SandboxSettingsSchema.pick({
+    mode: true,
+    allowDomains: true,
+}).strict();
 const WORKFLOW_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** No yak event and no log output for this long stalls a running job. `<= 0` disables it. */
 export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60 * 1000;
@@ -48,26 +79,53 @@ export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60 * 1000;
 export const DEFAULT_MAX_ATTEMPTS = 3;
 /** Pull request fix rounds before the job is needs-human (`feedback-exhausted`). */
 export const DEFAULT_MAX_FIX_ROUNDS = 2;
+/**
+ * Milliseconds without a yak event or log output before a running job is
+ * killed and retried. Default 15 minutes. `0` or negative disables stall detection.
+ */
+const stallTimeoutMs = z.number().int("Stall timeout must be a whole number of milliseconds.").optional();
+/** Transient failures before the job is dead. Default 3. */
+const maxAttempts = z
+    .number()
+    .int("Max attempts must be a whole number.")
+    .min(1, "Max attempts must be at least 1.")
+    .optional();
+/**
+ * Fix rounds for an open pull request before the job is needs-human with
+ * reason `feedback-exhausted`. Default 2. Kiln does not merge.
+ */
+const maxFixRounds = z
+    .number()
+    .int("Max fix rounds must be a whole number.")
+    .min(1, "Max fix rounds must be at least 1.")
+    .optional();
+/**
+ * The subset `kiln serve` settings can edit. The file schema below uses these
+ * same field validators. Settings does not accept jira, tokens, adapter,
+ * workflows, or sandbox image.
+ */
+export const EditableKilnSettingsSchema = z.object({
+    repos: KilnReposSchema,
+    stallTimeoutMs,
+    maxAttempts,
+    maxFixRounds,
+    sandbox: EditableSandboxSchema.optional(),
+});
+/** PUT /api/settings body. `revision` is the sha256 of the file the client loaded. */
+export const SettingsWriteSchema = EditableKilnSettingsSchema.extend({
+    revision: z.string().min(1, "Reload settings and try again."),
+}).strict();
 export const KilnConfigFileSchema = z.object({
     note: z.string().min(1).optional(),
     maxConcurrent: z.number().int().min(1).optional(),
-    /**
-     * Milliseconds without a yak event or log output before a running job is
-     * killed and retried. Default 15 minutes. `0` or negative disables stall detection.
-     */
-    stallTimeoutMs: z.number().int().optional(),
-    /** Transient failures before the job is dead. Default 3. */
-    maxAttempts: z.number().int().min(1).optional(),
-    /**
-     * Fix rounds for an open pull request before the job is needs-human with
-     * reason `feedback-exhausted`. Default 2. Kiln does not merge.
-     */
-    maxFixRounds: z.number().int().min(1).optional(),
+    stallTimeoutMs,
+    maxAttempts,
+    maxFixRounds,
     adapter: z.enum(["mock", "claude-code"]).optional(),
     sandbox: SandboxSettingsSchema.optional(),
     /** Per-workflow sandbox override. A set field replaces the global one; an omitted field inherits. */
     workflows: z.record(z.string().regex(WORKFLOW_KEY), z.object({ sandbox: SandboxSettingsSchema.optional() })).optional(),
-    repos: z.record(z.string(), RepoEntrySchema),
+    repos: KilnReposSchema,
     jira: JiraConfigSchema.optional(),
 });
 /**
@@ -101,6 +159,8 @@ export const JobSchema = z.object({
      * a branch.
      */
     stack: z.boolean().optional(),
+    /** Issue id such as `ABC-123`. Omitted when intake had no key. */
+    issue: z.string().regex(ISSUE_KEY).optional(),
     source: JobSourceSchema.optional(),
     createdAt: z.string().min(1),
 });

package/dist/serve-page.js

@@ -5,6 +5,7 @@ import { readBoardFiles, stageOf, stagesFor } from "./board.js";
 import { feedbackRoundLabel } from "./feedback.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { packageRoot } from "./paths.js";
+import { listWorkflowNames } from "./workflow.js";
 const REVIEWERS = [
     ["security", "sec"],
     ["ux", "ux"],
@@ -22,7 +23,8 @@ function kilnVersion() {
     }
 }
 const VERSION = kilnVersion();
-export function renderConsole(css, attention) {
+export function renderConsole(css, attention, page) {
+    const intake = page ?? { csrf: "", repos: [], workflows: listWorkflowNames() };
     const items = [...attention.needsYou, ...attention.inFlight, ...attention.doneRecently];
     const stages = stagesFor(items.map((item) => item.job));
     const grouped = new Map();
@@ -46,27 +48,34 @@ export function renderConsole(css, attention) {
 <div class="brand"><span class="logo" aria-hidden="true"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#fff" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M3 12V6l5-3 5 3v6l-5 3-5-3z"/><path d="M3 6l5 3 5-3M8 9v6"/></svg></span><h1>Kiln</h1>${version}</div>
 <div class="status" id="status">${items.length === 1 ? "1 job" : `${items.length} jobs`}</div>
 </header>
+<p class="meta config-error" id="config-error" role="status"${intake.configError ? "" : " hidden"}>${escapeHtml(intake.configError ?? "")}</p>
 <nav class="repos" aria-label="Filter by repo">${chips}</nav>
 <main class="board" id="board" style="--cols: ${tracks}">
 ${columns}
 </main>
 <nav class="toolbar" aria-label="Kiln commands">
+<button class="tool" type="button" id="add-job" data-tip="Add job" aria-label="Add job"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M12 5v14M5 12h14"/></svg></button>
 <button class="tool" type="button" data-act="approve" data-tip="Approve" aria-label="Approve"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M5 12.5l4.5 4.5L19 7.5"/></svg></button>
 <button class="tool" type="button" data-act="retry" data-tip="Retry" aria-label="Retry"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 12a9 9 0 1 0 3-6.7L3 8M3 3v5h5"/></svg></button>
 <button class="tool" type="button" data-act="pr" data-tip="Open pull request" aria-label="Open pull request"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="6" cy="6" r="2.5"/><circle cx="6" cy="18" r="2.5"/><circle cx="18" cy="18" r="2.5"/><path d="M6 8.5v7M18 15.5V10a3 3 0 0 0-3-3h-3"/></svg></button>
 <button class="tool" type="button" id="notify" data-tip="Notify me" aria-label="Notify me"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 8a6 6 0 0 1 12 0c0 7 3 7 3 7H3s3 0 3-7"/><path d="M10 19a2 2 0 0 0 4 0"/></svg></button>
 <span class="sep" aria-hidden="true"></span>
 <button class="tool" type="button" id="compact" aria-pressed="true" data-tip="expand empty columns" aria-label="expand empty columns"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M3 12h7m0 0-3-3m3 3-3 3M21 12h-7m0 0 3-3m-3 3 3 3M12 4v16"/></svg></button>
+<span class="sep" aria-hidden="true"></span>
+<button class="tool" type="button" id="open-settings" data-tip="Settings" aria-label="Settings"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M12 3v2.2M12 18.8V21M3 12h2.2M18.8 12H21M5.6 5.6l1.6 1.6M16.8 16.8l1.6 1.6M18.4 5.6l-1.6 1.6M7.2 16.8l-1.6 1.6"/></svg></button>
 </nav>
 <div class="scrim" data-close></div>
 <aside class="drawer" id="drawer" role="dialog" aria-modal="true" aria-label="Job">
-${items.map((item) => sheet(item)).join("\n")}
+${intakeSheet(intake, items)}
+${settingsSheet()}
+${items.map((item) => sheet(item, intake.csrf)).join("\n")}
 </aside>`;
     return document({
         css,
         title: `(${attention.needsYouCount}) Kiln`,
         needsYou: attention.needsYouCount,
         revision: attention.revision,
+        csrf: intake.csrf,
         live: true,
         body,
     });
@@ -114,7 +123,7 @@ function card(item, stage) {
         classes.push("retrying");
     else if (stage === "needs-human")
         classes.push("human");
-    if (stage === "merged")
+    if (stage === "done" || stage === "merged")
         classes.push("merged");
     if (stage === "queued")
         classes.push("queued");
@@ -124,7 +133,7 @@ function card(item, stage) {
     const branch = branchOf(job);
     return `<div role="button" tabindex="0" class="${classes.join(" ")}" id="job-${escapeHtml(job.jobId)}" data-job="${escapeHtml(job.jobId)}" data-deps="${escapeHtml(deps)}" data-repo="${escapeHtml(job.repo)}" data-stage="${escapeHtml(stage)}">
 <div class="card-top">${pulse}<span class="num">${escapeHtml(job.jobId)}</span>${flag}</div>
-<div class="branch repo">${escapeHtml(job.repo)}</div>
+<div class="branch repo">${escapeHtml(repoLabel(job))}</div>
 <p class="title">${escapeHtml(job.title || job.jobId)}</p>
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
 ${sandboxHtml(job)}
@@ -135,7 +144,130 @@ ${waiting ? "" : noteHtml(item)}
 ${dependsHtml(job)}
 </div>`;
 }
-function sheet(item) {
+function intakeSheet(intake, items) {
+    return `<section class="sheet intake" id="intake" aria-label="Add job" hidden>
+<div class="d-head">
+<div class="num">kiln add</div>
+<h3>Add job</h3>
+<button type="button" class="close" data-close aria-label="Close">×</button>
+</div>
+<form id="add-form" class="intake-form">
+<div class="field"><span class="k">Repo</span><div class="picks" id="repo-pick">${repoButtons(intake.repos)}</div></div>
+<label class="field"><span class="k">Workflow</span><select id="workflow" name="workflow">${workflowOptions(intake.workflows)}</select></label>
+<div class="seg" role="tablist" aria-label="Source">
+<button type="button" data-source="prompt" aria-pressed="true">Prompt</button>
+<button type="button" data-source="spec" aria-pressed="false">Spec file</button>
+<button type="button" data-source="tickets" aria-pressed="false">Tickets folder</button>
+<button type="button" data-source="jira" aria-pressed="false">Jira</button>
+</div>
+<div data-pane="prompt"><label class="field"><span class="k">Prompt</span><textarea id="prompt-text" rows="4" placeholder="What should this job do?"></textarea></label></div>
+<div id="browser-field" hidden>
+<div class="k" id="browser-label">Spec file</div>
+<div class="fs" id="browser"></div>
+<p class="meta" id="picked"></p>
+</div>
+<div data-pane="jira" hidden><label class="field"><span class="k">Jira key</span><input id="jira-key" type="text" placeholder="PROJ-123" autocomplete="off" spellcheck="false"></label></div>
+<label class="field" id="issue-field"><span class="k">Issue</span><input id="job-issue" type="text" placeholder="ABC-123" autocomplete="off" spellcheck="false"></label>
+<label class="field" id="title-field"><span class="k">Title</span><input id="job-title" type="text" autocomplete="off"></label>
+<fieldset class="field" id="after-field"><legend class="k">After</legend><div id="after-list">${afterOptions(items)}</div></fieldset>
+<pre class="text preview" id="intake-preview" hidden></pre>
+<p class="form-error" id="intake-error" role="alert" hidden></p>
+<div class="d-actions"><button type="button" id="preview-job" hidden>Preview</button><button type="submit">Add</button></div>
+</form>
+</section>`;
+}
+function settingsSheet() {
+    return `<section class="sheet intake" id="settings" aria-label="Settings" hidden>
+<div class="d-head">
+<div class="num">kiln.config.json</div>
+<h3>Settings</h3>
+<button type="button" class="close" data-close aria-label="Close">×</button>
+</div>
+<form id="settings-form" class="intake-form">
+<p class="meta" id="settings-path"></p>
+<p class="saved" id="settings-saved" role="status" hidden>Saved</p>
+<p class="form-error" id="settings-error" role="alert" hidden></p>
+<div class="seg" role="tablist" aria-label="Settings sections">
+<button type="button" data-settings-tab="repos" aria-pressed="true">Repos</button>
+<button type="button" data-settings-tab="global" aria-pressed="false">Global</button>
+</div>
+<div id="settings-repos">
+<div id="repo-editor" hidden>
+<label class="field"><span class="k">Name</span><input id="repo-name" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="field-error" data-error="name" hidden></p>
+<div class="field"><span class="k">Path</span><div class="path-row"><input id="repo-path" type="text" autocomplete="off" spellcheck="false" placeholder="~/code/web"><button type="button" class="pick" id="repo-browse">Browse</button></div></div>
+<div class="fs" id="repo-browser" hidden></div>
+<p class="field-error" data-error="path" hidden></p>
+<label class="field"><span class="k">Test command</span><input id="repo-test" type="text" autocomplete="off" spellcheck="false" placeholder="npm test"></label>
+<p class="field-error" data-error="test" hidden></p>
+<div class="field"><span class="k">Deliver</span><div class="seg" id="repo-deliver" role="group" aria-label="Deliver mode">
+<button type="button" data-deliver="local" aria-pressed="true">local</button>
+<button type="button" data-deliver="pr" aria-pressed="false">pr</button>
+</div></div>
+<p class="field-error" data-error="deliver" hidden></p>
+<label class="field"><span class="k">Base branch</span><input id="repo-base" type="text" autocomplete="off" spellcheck="false" placeholder="main"></label>
+<p class="field-error" data-error="base" hidden></p>
+<label class="field"><span class="k">PR title template</span><input id="repo-pr-title" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="hint" id="hint-pr-title">Default [{issue}] {title}, which renders as [ABC-123] Title.</p>
+<p class="field-error" data-error="prTitle" hidden></p>
+<label class="field"><span class="k">Branch template</span><input id="repo-branch" type="text" autocomplete="off" spellcheck="false"></label>
+<p class="hint" id="hint-branch">Default {issue}-{slug}, which renders as ABC-123-slug.</p>
+<p class="field-error" data-error="branch" hidden></p>
+<div class="d-actions"><button type="button" id="repo-done">Done</button></div>
+</div>
+<div id="repo-list"></div>
+<div class="d-actions"><button type="button" id="repo-add">Add repo</button></div>
+</div>
+<div id="settings-global" hidden>
+<div class="field"><span class="k">Sandbox</span><div class="seg" id="sandbox-mode" role="group" aria-label="Sandbox mode">
+<button type="button" data-sandbox="off" aria-pressed="true">Off</button>
+<button type="button" data-sandbox="docker" aria-pressed="false">Docker</button>
+</div>
+<p class="hint">Off leaves the agent unsandboxed. Docker runs agent steps in the sandbox.</p>
+<p class="field-error" data-error="sandbox.mode" hidden></p></div>
+<label class="field"><span class="k">Allow domains</span><textarea id="sandbox-domains" rows="3" placeholder="example.com" spellcheck="false"></textarea></label>
+<p class="hint">One hostname per line. When set, this replaces the built-in host list.</p>
+<p class="field-error" data-error="sandbox.allowDomains" hidden></p>
+<label class="field"><span class="k">Max attempts</span><input id="max-attempts" type="number" min="1" step="1"></label>
+<p class="hint" id="hint-attempts"></p>
+<p class="field-error" data-error="maxAttempts" hidden></p>
+<label class="field"><span class="k">Stall timeout (ms)</span><input id="stall-timeout" type="number" step="1"></label>
+<p class="hint" id="hint-stall"></p>
+<p class="field-error" data-error="stallTimeoutMs" hidden></p>
+<label class="field"><span class="k">Max fix rounds</span><input id="max-fix-rounds" type="number" min="1" step="1"></label>
+<p class="hint" id="hint-fix"></p>
+<p class="field-error" data-error="maxFixRounds" hidden></p>
+</div>
+<div class="d-actions"><button type="submit">Save</button></div>
+</form>
+</section>`;
+}
+function repoButtons(repos) {
+    if (repos.length === 0)
+        return `<p class="empty">No repos are registered.</p>`;
+    return repos
+        .map((repo, index) => `<button type="button" class="pick" data-repo="${escapeHtml(repo.name)}" data-path="${escapeHtml(repo.path)}" aria-pressed="${index === 0 ? "true" : "false"}">${escapeHtml(repo.name)}</button>`)
+        .join("");
+}
+function workflowOptions(names) {
+    if (names.length === 0)
+        return `<option value="">none</option>`;
+    return names
+        .map((name) => `<option value="${escapeHtml(name)}"${name === "feature" ? " selected" : ""}>${escapeHtml(name)}</option>`)
+        .join("");
+}
+function afterOptions(items) {
+    const open = items.filter((item) => item.job.state !== "done");
+    if (open.length === 0)
+        return `<p class="empty">No open jobs.</p>`;
+    return open
+        .map((item) => {
+        const job = item.job;
+        return `<label class="after"><input type="checkbox" name="after" value="${escapeHtml(job.jobId)}"><span class="num">${escapeHtml(job.jobId)}</span><span>${escapeHtml(job.title || job.jobId)}</span></label>`;
+    })
+        .join("");
+}
+function sheet(item, csrf) {
     const job = item.job;
     const files = displayFiles(job);
     const round = lastRound(job);
@@ -149,7 +281,7 @@ function sheet(item) {
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
 ${sandboxHtml(job)}
 ${prLink(job)}
-${actionsHtml(item)}
+${actionsHtml(item, csrf)}
 <button type="button" class="close" data-close aria-label="Close">×</button>
 </div>
 <div class="d-body">${filesNav(files, job)}</div>
@@ -184,17 +316,18 @@ function routeLinks(job) {
         return "";
     return `<div class="group">Open</div>${links.join("")}`;
 }
-function actionsHtml(item) {
+function actionsHtml(item, csrf) {
     const id = encodeURIComponent(item.job.jobId);
+    const token = `<input type="hidden" name="csrf" value="${escapeHtml(csrf)}">`;
     const forms = [];
     if (item.job.canApprove) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/approve" class="act approve"><button type="submit">Approve</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/approve" class="act approve">${token}<button type="submit">Approve</button></form>`);
     }
     if (item.job.canReject) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/reject" class="act reject"><button type="submit">Reject</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/reject" class="act reject">${token}<button type="submit">Reject</button></form>`);
     }
     if (item.retry) {
-        forms.push(`<form method="post" action="/api/jobs/${id}/retry" class="act retry"><button type="submit">Retry</button></form>`);
+        forms.push(`<form method="post" action="/api/jobs/${id}/retry" class="act retry">${token}<button type="submit">Retry</button></form>`);
     }
     if (forms.length === 0)
         return "";
@@ -268,10 +401,21 @@ function noteHtml(item) {
     }
     return `<div class="note">${lines.map((line) => escapeHtml(line)).join("<br>")}</div>`;
 }
+function repoLabel(job) {
+    if (job.deliver === "local" || job.deliver === "pr")
+        return `${job.repo} · ${job.deliver}`;
+    return job.repo;
+}
 function noteText(item) {
     const job = item.job;
-    if (job.state === "done")
-        return safeUrl(job.prUrl) ? "merged via PR" : "landed locally";
+    if (job.state === "done") {
+        if (job.prNumber)
+            return `merged · PR #${job.prNumber}`;
+        if (safeUrl(job.prUrl))
+            return "merged · PR";
+        const branch = branchOf(job);
+        return branch ? `landed locally · ${branch}` : "landed locally";
+    }
     return item.reason;
 }
 function dependsHtml(job) {
@@ -348,7 +492,7 @@ function document(options) {
 ${options.css}
 </style>
 </head>
-<body data-needs-you="${options.needsYou}" data-revision="${escapeHtml(options.revision)}">
+<body data-needs-you="${options.needsYou}" data-revision="${escapeHtml(options.revision)}" data-csrf="${escapeHtml(options.csrf ?? "")}">
 ${options.body}
 ${options.live ? `<script>\n${LIVE_SCRIPT}\n</script>` : ""}
 </body>