@leftoff/cli 0.8.0 → 0.8.3

package/docs/peer-protocol.md

@@ -0,0 +1,136 @@
+# Leftoff peer protocol (v1)
+
+How one Leftoff daemon asks another to **answer** a permission prompt or a question, **reply** to a session, or **Go** (bring its terminal tab to the front), without Tailscale and without trusting whatever carries the bytes. Shipped in 0.5.2; the hosted relay in 0.6.0. The code is `src/peer.js` (keys, cards, envelopes, the hub) and `src/relay.js` (the relay transport and a fake relay for tests).
+
+## Trust: the synced folder
+
+Every daemon has a **machine identity**: an Ed25519 key pair that signs and an X25519 key pair that receives encrypted envelopes. The private halves stay on the Mac, at `~/.config/checkpoints/identity/<machine>.json` (`$XDG_CONFIG_HOME` if set), mode `0600`. That's next to the folder pointer, **not** in the synced folder, so the sync service (and every other Mac) never holds them.
+
+The public halves are published in the synced folder as a **machine card**, `machines/<machine>.json`:
+
+```json
+{
+  "v": 1, "app": "leftoff", "machine": "laptop", "hostname": "Your-MacBook-Air.local", "version": "0.5.2",
+  "sign": "<Ed25519 public key, base64url>", "box": "<X25519 public key, base64url>",
+  "fingerprint": "6923-89FD-4409-0E0F",
+  "accepts": true,
+  "addresses": [{ "url": "http://192.168.1.20:7821", "kind": "lan" }, { "url": "http://100.101.102.103:7821", "kind": "tailscale" }],
+  "relay": false,
+  "updatedAt": "2026-10-10T15:00:00.000Z",
+  "sig": "<Ed25519 signature by `sign` over the card without sig, canonical JSON>"
+}
+```
+
+- `fingerprint` is the first 64 bits of `sha256(sign ‖ box)`, shown in Settings → Privacy & security.
+- `accepts` is the machine's opt-in, "Allow other machines to answer and Go here". It's **off by default**. While it's off, `addresses` is empty and nothing listens.
+- A card is rewritten only when something other than `updatedAt` changes.
+
+**Pinning.** The first time a daemon sees a machine's card it pins that fingerprint locally (in its own identity file). If the card later carries a different key, the machine shows **key changed** and every action to or from it is refused until you confirm the new key on this Mac (Settings → Privacy & security → Trust the new key, or `leftoff machines trust <machine>`). So a file dropped into the folder can't silently take over a machine name you already trust. Someone who can write the folder *before* the first sighting can still introduce a machine. The folder is the trust root, as the brief asked, so keep it in a sync service you trust.
+
+## Envelopes
+
+Each command is one envelope. It's JSON and travels the same way over every transport:
+
+| field | meaning |
+|---|---|
+| `v` | `1` |
+| `kind` | `req`, or `res` for the answer |
+| `from`, `to` | machine names |
+| `id` | 16 random bytes, base64url: the nonce, the replay key and the HKDF salt |
+| `iat`, `exp` | issued-at and expiry, epoch ms. `exp = iat + 60 s`; a lifetime over 120 s is refused |
+| `re` | on a `res`: the `id` of the request it answers |
+| `epk` | a fresh X25519 public key for this envelope only |
+| `iv` | 12 bytes for AES-GCM |
+| `ct` | AES-256-GCM ciphertext of the body, with its 16-byte tag appended |
+| `sig` | Ed25519 signature by the sender's `sign` key over the canonical JSON of every field above (sorted keys, no `sig`) |
+
+**Encryption.** `key = HKDF-SHA256(X25519(epk_private, recipient.box), salt = id, info = "leftoff-peer-v1|<from>|<to>")`. The AES-GCM additional data is the canonical JSON of the header (`v kind from to id iat exp re epk iv`). The ephemeral key gives each envelope its own key.
+
+**Bodies.** A request is `{ "action": …, …args }`. A response is `{ "ok": true, "result": … }` or `{ "ok": false, "error": { "code", "message", "status" } }`.
+
+| action | args | runs, on the receiving machine |
+|---|---|---|
+| `ping` | none | `{ machine, version, accepts }` (answered even when not accepting) |
+| `needs.list` | none | that machine's own *Needs you* items (the same list its board shows) |
+| `ask.answer` | `askId`, `body` | `engine.answerAsk()`: the board's Allow / Deny / answer code path |
+| `session.reply` | `sessionId`, `text` | `engine.postReply()`: the board's reply box |
+| `session.go` | `sessionId` | `engine.jump()`: the board's Go |
+
+Answers are recorded in the session's `answers.md` as *from studio's board (direct)* or *(through the relay)*.
+
+**Checks, in order, before anything runs:** the shape, `to` is this machine, the sender has a card in the folder, its key is pinned and unchanged, the signature, `exp` hasn't passed, `iat` is no more than 30 s in the future (clock skew), the `id` hasn't been seen (the replay cache keeps ids until they expire), and decryption. Then, unless the action is `ping`, this machine must accept (`not_allowed` otherwise). Refusal codes: `bad_envelope`, `wrong_target`, `unknown_sender`, `key_changed`, `bad_signature`, `expired`, `not_yet_valid`, `replayed`, `decrypt_failed`, `not_allowed`, `unknown_action`. When the sender is known and the envelope isn't forged or replayed, a refusal comes back as a sealed `res`. Otherwise it's a plain `{ "kind": "err", "code" }`.
+
+## Transports
+
+The sender tries them in order and the first that answers wins. One request uses one fresh envelope per attempt.
+
+1. **Direct HTTP.** `POST <address>/peer/v1/envelope` with the envelope as the body, and the response envelope as the reply. Each accepting daemon listens on its own port (the board's port + 1 by default, `peers.port` in config). It binds `0.0.0.0` by default (`peers.bind`) and serves nothing else. Addresses are the Mac's LAN and Tailscale IPv4s, or `peers.addresses` if set. Tailscale isn't needed. It's just one more address when present.
+2. **Relay.** Both daemons hold one outbound WebSocket to `peers.relay` (`LEFTOFF_RELAY`) and the relay forwards envelopes it can't read. Neither Mac opens a port. With `peers.direct: false` a machine is relay-only and never listens.
+
+### Relay wire format
+
+JSON text frames on a WebSocket:
+
+```
+relay → client  { "t": "challenge", "nonce" }
+client → relay  { "t": "hello", "machine", "sign", "nonce", "sig" }   sig = Ed25519("leftoff-relay-hello|<machine>|<nonce>")
+relay → client  { "t": "welcome", "machine" }   or   { "t": "error", "code": "bad_hello" | "name_taken" }
+client → relay  { "t": "send", "to", "ref", "env" }                    ref = env.id
+relay → client  { "t": "deliver", "from", "ref", "env" }               or   { "t": "error", "ref", "code": "offline" }
+```
+
+The relay learns which machines talk and when, and nothing else: bodies are end-to-end encrypted and signed. The fake relay (`FakeRelay` in `src/relay.js`, used by `test/sync-e2e.mjs`) pins name → key at the first hello. The client reconnects with backoff (1 s up to 30 s) and pings every 25 s.
+
+### The hosted relay (0.6.0)
+
+`wss://<user>.leftoff.dev/_connect` (the Worker in `relay/`, [relay.md](relay.md)) speaks the same frames, plus accounts and the board tunnel:
+
+```
+relay → client  { "t": "challenge", "nonce", "user" }
+client → relay  { "t": "hello", "machine", "sign", "nonce", "sig", "version", "activeAt" }
+                sig = Ed25519("leftoff-relay-hello|<user>|<machine>|<nonce>")   (the user is bound in)
+relay → client  { "t": "welcome", "machine", "user", "machines" }  or  { "t": "error", "code": "bad_hello" | "not_registered" | "key_mismatch" }
+client → relay  { "t": "ping" }  →  { "t": "pong" }                  (answered without waking the Durable Object; the round trip is the latency in Settings)
+client → relay  { "t": "machine.add", "id", "machine", "sign" }      a registered Mac vouches for a Mac in its folder (its card has "anywhere": "<user>")
+client → relay  { "t": "activity", "at" }                           latest session activity, for the default Mac
+client → relay  { "t": "pair.create" | "pair.cancel", "id", "pair", "expiresAt" }    → { "t": "ack", "id", "ok" }
+client → relay  { "t": "device.revoke", "id", "device" } · { "t": "devices.sync", "id", "revoked": [...] } · { "t": "devices.list", "id" }
+relay → client  { "t": "static", "id", "path" }                      → { "t": "static.res", "id", "status", "type", "b64" }   (public app files)
+relay → client  { "t": "pair", "id", "pair", "pub", "name", "mac" }  → { "t": "pair.res", "id", "ok", "device", "pub", "mac" }
+relay → client  { "t": "tunnel", "id", "env" }                       → { "t": "tunnel.res", "id", "env" } or { …, "error": { "code" } }
+```
+
+Only Macs registered for that user can connect: the first with `leftoff relay register <user>` (the relay's admin token), the rest vouched for by a Mac already there. A tunnel `env` is `{ v: 1, d: device, to: machine, id, ts, iv, ct }`, AES-256-GCM under the device key with `leftoff-tunnel-v1|req|<d>|<to>|<id>|<ts>` as additional data; the answer is `{ v: 1, re: id, iv, ct }` with `leftoff-tunnel-v1|res|<d>|<to>|<id>`. The code is `ui/relay-crypto.js`, shared by the browser and the daemon.
+
+## What the board does with it
+
+Every few seconds (`peers.pollMs`, default 4 s) each daemon asks every machine that accepts for `needs.list`, so another Mac's permission prompts and questions show on this board with a ⌂ machine chip. Answer, reply and Go on another machine's session go out as envelopes. When that isn't possible, the button is grey and says why: not allowed on that machine, unreachable, key changed, no key yet (that Mac needs 0.5.2), or no route. Answering from a phone keeps its own rules (Settings → Privacy & security), and Go stays a local-browser action.
+
+## Pairing through Syncthing (0.5.3)
+
+Before two Macs share a folder they have no channel to each other, so pairing rides on Syncthing itself. Leftoff never opens a port for it.
+
+**Code** (`LO1-` + Crockford base32, read case-insensitively, dashes and spaces ignored):
+
+| bytes | field |
+|---|---|
+| 1 | version (1) |
+| 4 | expiry, Unix seconds, big-endian (15 minutes after it's made) |
+| 16 | secret (random) |
+| 35 | the first Mac's Syncthing device ID (its 56 base32 characters, decoded) |
+| 1 + n | folder ID (`leftoff`) |
+| 1 + n | the first Mac's machine name (up to 40 bytes, for "Waiting for studio…") |
+| 4 | first 4 bytes of SHA-256 of everything above (catches typos) |
+
+**Proof:** `tag = base32(HMAC-SHA256(secret, "leftoff-pair-v1\n" + joinerID + "\n" + firstID + "\n" + folderID))[0:16]`. IDs are normalized: upper case, no dashes. While it waits, the joining Mac's own Syncthing device name is `<name> (leftoff-pair <tag>)`.
+
+**First Mac** (the daemon, every 1.5 s while a code is live; or `leftoff sync pair` without a daemon): it reads `GET /rest/cluster/pending/devices`. For each entry whose `name` ends in a tag, it recomputes the tag for **that entry's device ID** and compares in constant time. On a match it erases the secret first, then `PUT /rest/config/devices/<id>` (a new entry only) and adds the device to the `leftoff` folder's device list. Anything else is left pending.
+
+**Joining Mac:** it adds the first Mac (`PUT /rest/config/devices/<id>`, `addresses: ["dynamic"]`), then creates or reuses the `leftoff` folder shared with it, with `.stignore`. It sets its own name with the tag and waits for `GET /rest/system/connections` to show the first Mac connected, then restores its name. It then watches `GET /rest/db/status?folder=leftoff` until the folder is idle, nothing is needed and `config.json` has arrived, and finally runs the join merge (`leftoff move`, or `leftoff setup` on a fresh Mac).
+
+Refusals the joining Mac shows: `bad_code` (typo, cut short, not a Leftoff code), `expired`, `used` (already used on this Mac), `same_mac`, `nested` (the path is inside another Syncthing folder), `not_empty`, `needs_install`, and a timeout while waiting to be accepted ("is Leftoff running there?").
+
+## Not covered (yet)
+
+- Key rotation other than "confirm the new key" (a Mac that's reinstalled gets a new key and shows as changed).
+- Pushing changes: other machines' prompts arrive by polling, so they show up within a few seconds.

package/hooks/README.md

@@ -19,4 +19,4 @@ To add them by hand, copy `settings-hooks.example.json` into your settings (with
 
 Hooks installed before 0.4.5 run `bin/checkpoints.js` and carry `--tag=checkpoints-hook`. They keep working (that file is now an alias of `bin/leftoff.js`), and `leftoff upgrade` replaces them with `--tag=leftoff-hook` ones, without duplicates.
 
-Without the mod you get no heartbeat, no `/cp` or `/cp-name`, and no pane. The daemon infers idle time from the last event and makes checkpoints itself. Use the web UI's "Checkpoint now" button for a manual one.
+Without the mod you get no heartbeat, no `/cp`, `/cp-name` or `/cp-park`, and no pane. The daemon infers idle time from the last event and makes checkpoints itself. Use the web UI's "Checkpoint now" button for a manual one, and Park on a session's page (or `leftoff park [session] [note]`) to park one.

package/mod/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "leftoff",
-  "version": "0.8.0",
+  "version": "0.8.3",
   "description": "Leftoff (formerly Checkpoints): WTF was I working on? Tracks every Claude Code session on this machine, writes a 3-line checkpoint when one goes quiet, and adds /cp (checkpoint now), /cp-name and a /leftoff pane. Talks to the local Leftoff daemon on 127.0.0.1:7429 and falls back to writing markdown in ~/checkpoints.",
   "author": {
     "name": "Joel"

package/mod/hooks/core.js

@@ -33,10 +33,11 @@ export const DEFAULT_CONFIG = {
 }
 
 export const STATUSES = ['active', 'waiting', 'background', 'needs_input', 'dormant', 'ended', 'stale']
-export const TRIGGERS = ['dormant', 'manual', 'session_end', 'clear', 'long_run']
+export const TRIGGERS = ['dormant', 'manual', 'session_end', 'clear', 'long_run', 'park']
 export const EVENT_TYPES = [
   'session.opened', 'session.started', 'activity', 'turn_started', 'turn_completed',
   'notification', 'title_changed', 'heartbeat', 'session.ended',
+  'session.parked', 'session.unparked', // 0.8.2: /cp-park and Park on the board
 ]
 export const NEEDS_INPUT_NOTIFICATIONS = ['permission_prompt', 'elicitation_dialog', 'agent_needs_input']
 
@@ -508,7 +509,7 @@ const SESSION_ORDER = ['id', 'title', 'title_source', 'machine', 'cwd', 'repo',
 export const SESSION_EXTRA = ['inTurn', 'needsInput', 'backgroundTasks', 'turnsSinceCheckpoint', 'dormantStretch',
   'finalCheckpointDone', 'firstPrompt', 'lastPreview', 'lastNotification', 'lastEventAt', 'statusChanges', 'folder',
   'pid', 'tty', 'pidStartedAt', 'pidSource', 'term', 'closedAt', 'answers', 'lastNotificationMessage', 'needsInputAt', 'question', 'questionAt',
-  'startSource', 'historyTurns', 'healedAt', 'healedVia', 'archivedReason', 'backend', 'prLinks', 'prUnlinked', 'todos', 'files', 'startRepo', 'editedRepos']
+  'startSource', 'historyTurns', 'healedAt', 'healedVia', 'archivedReason', 'backend', 'prLinks', 'prUnlinked', 'todos', 'files', 'startRepo', 'editedRepos', 'parked']
 
 export const SESSION_FIELDS = ['id', 'title', 'titleSource', 'machine', 'cwd', 'repo', 'transcriptPath', 'model', 'surface', 'capture',
   'status', 'startedAt', 'lastActivityAt', 'lastHeartbeatAt', 'endedAt', 'endReason', 'turns', 'lastCheckpointId',
@@ -800,7 +801,17 @@ export function applyEvent(s, ev) {
   }
   if (d.term && typeof d.term === 'object') s.term = d.term
   else if (d.termEnv && typeof d.termEnv === 'object') s.term = detectTerminal(d.termEnv)
+  // 0.8.2: a parked session comes back by itself. Resumed (claude --resume, a
+  // reopened process, codex resume) or a new prompt after the park clears it;
+  // replayed older events (a Codex rollout read again) don't.
+  if (s.parked && ms(at) > ms(s.parked.at) && unparks(s, ev, d)) delete s.parked
   switch (ev.type) {
+    case 'session.parked':
+      s.parked = { at, note: d.note ? clip(String(d.note).replace(/\s+/g, ' ').trim(), 300) || null : null, checkpoint: d.checkpoint ? String(d.checkpoint) : null, by: d.by ? String(d.by) : null }
+      break
+    case 'session.unparked':
+      delete s.parked
+      break
     case 'session.opened':
       s.lastHeartbeatAt = at
       if (s.endedAt) { s.endedAt = null; s.endReason = null; s.closedAt = null } // reopened (claude --resume) in a new process
@@ -819,6 +830,7 @@ export function applyEvent(s, ev) {
         s.question = null
         s.lastNotification = null
         if (d.prompt && !s.firstPrompt) s.firstPrompt = clip(d.prompt, 300)
+        if (d.countTurn === true) s.turns = (s.turns || 0) + 1 // 0.8.1: Codex counts a turn at its prompt when no task_started came first
         if (s.capture === 'hooks') { s.inTurn = true; s.activeSince = s.activeSince || at }
       }
       break
@@ -828,13 +840,14 @@ export function applyEvent(s, ev) {
       s.needsInput = false
       s.question = null
       s.activeSince = s.activeSince || at
+      if (d.countTurn === true) s.turns = (s.turns || 0) + 1 // 0.8.1: Codex counts a turn when it starts
       break
     case 'turn_completed':
       activity()
       s.inTurn = false
       s.activeSince = null
       s.needsInput = false
-      s.turns = (s.turns || 0) + 1
+      if (d.countTurn !== false) s.turns = (s.turns || 0) + 1 // false: Codex already counted it at the start
       s.turnsSinceCheckpoint = (s.turnsSinceCheckpoint || 0) + 1
       s.backgroundTasks = Number(d.backgroundTasks || 0) + Number(d.sessionCrons || 0)
       if (d.lastAssistantPreview) s.lastPreview = clip(d.lastAssistantPreview, 280)
@@ -866,6 +879,23 @@ export function applyEvent(s, ev) {
   return s
 }
 
+// 0.8.2: does this event bring a parked session back?
+function unparks(s, ev, d) {
+  if (ev.type === 'session.opened') return !d.again // a new process (claude --resume); the mod's hello again is the same one
+  if (ev.type === 'session.started') return d.source === 'resume' && !!s.endedAt
+  if (ev.type === 'turn_started') return true
+  if (ev.type === 'activity') return d.kind === 'prompt'
+  return false
+}
+
+// /cp-park [note] -> { note } (quotes around the whole note are dropped)
+export function parseParkArgs(args) {
+  let note = String(args == null ? '' : args).replace(/\s+/g, ' ').trim()
+  const q = note.match(/^(["'“‘])(.*)(["'”’])$/)
+  if (q) note = q[2].trim()
+  return { note: note ? clip(note, 300) : null }
+}
+
 // The question Claude ended its turn on, if it ended on one: the last paragraph
 // of the answer when its last sentence ends with "?" (markdown and closing
 // quotes ignored). Code blocks don't count. -> string or null

package/mod/hooks/register.js

@@ -3,7 +3,7 @@
 //
 // It posts session lifecycle and activity to the local daemon
 // (http://127.0.0.1:7429), builds checkpoints with $.model.complete when the
-// daemon says one is due, adds /cp, /cp-name and /leftoff (and /checkpoints, its old name), and draws
+// daemon says one is due, adds /cp, /cp-name, /cp-park and /leftoff (and /checkpoints, its old name), and draws
 // a pane listing every open session. When the daemon is down it spools events
 // to ~/checkpoints/.spool, keeps a session record in $.store, tracks idle
 // itself and writes checkpoint markdown straight into the folder.
@@ -18,7 +18,7 @@ import {
   sessionFolderName, id8, clip, toIso, resumeCommand, repoName,
   shortId, formatTabTitle, parseTabTitle, detectTerminal, parseProcLine, trailingQuestion,
   parseCheckpointArgs, SUMMARY_LENGTHS, parseBulletList, parseCatchupArgs,
-  listHintFrom, extractChecklists, parseTodoArgs, parseDoneArgs, detectBackend,
+  listHintFrom, extractChecklists, parseTodoArgs, parseDoneArgs, detectBackend, parseParkArgs,
 } from './core.js'
 
 const PANE_ID = 'checkpoints'
@@ -27,7 +27,7 @@ const END_TIMEOUT_MS = 1000
 const MODEL_TIMEOUT_MS = 20000
 
 // Module state. $.state is not used: the pane redraws with $.ui.invalidate.
-const MOD_VERSION = '0.8.0' // keep in step with .claude-plugin/plugin.json
+const MOD_VERSION = '0.8.3' // keep in step with .claude-plugin/plugin.json
 
 const st = {
   internal: false,
@@ -202,6 +202,8 @@ const COMMANDS = [
   { key: 'catchup', names: ['cp-catchup', 'leftoff-catchup'], description: 'Leftoff: catch me up — what got done, where each session stopped, what\'s waiting on you', argumentHint: '[24h|3d|workday|friday] [repo…|here|all]', immediate: true },
   // v0.5.1: save the checklist Claude just wrote; tick its items.
   { key: 'todo', names: ['cp-todo', 'leftoff-todo'], description: 'Leftoff: save the checklist Claude just wrote as a list you can tick off (board, phone, or here)', argumentHint: '[name] [--pick [N]]', immediate: true },
+  // v0.8.2: checkpoint, mark the session Parked (not Closed when it exits), then close it.
+  { key: 'park', names: ['cp-park', 'leftoff-park'], description: 'Leftoff: checkpoint and park this session to come back to (your note becomes the Next line), then exit', argumentHint: '[note]', immediate: false },
   { key: 'done', names: ['cp-done', 'leftoff-done'], description: 'Leftoff: tick items on this session\'s list (/cp-done 3, /cp-done 2 4, /cp-done undo 3)', argumentHint: '<n…> [in <list>]', immediate: true },
 ]
 
@@ -254,6 +256,28 @@ async function checkpointCommand($, args) {
   return {}
 }
 
+// ------------------------------------------------------------ park (v0.8.2)
+
+// /cp-park [note]: a checkpoint now (the note, if any, is its Next line, else
+// the usual summary), then the session is marked Parked, so it stays on the
+// board under Parked instead of going to Closed when Claude Code exits. Then
+// it runs the built-in /exit for you (registered with immediate: false, so it
+// only runs once Claude is done with the turn). If that's refused, it says to
+// type /exit. Nothing is ever killed.
+const PARK_FALLBACK = 'Parked. Type /exit when you\'re ready, and it\'ll stay on your board.'
+async function parkCommand($, args) {
+  if (st.internal || !st.sessionId) return { text: 'Leftoff: not in a tracked session.' }
+  const a = parseParkArgs(args)
+  const cp = await makeCheckpoint($, 'park', a.note, null, { next: a.note })
+  if (!cp) return { text: 'Leftoff: a checkpoint is already being made. Try /cp-park again in a moment.' }
+  await sendOrSpool($, 'session.parked', { note: a.note, checkpoint: cp.id || null, by: 'command' })
+  // After this command returns, not inside it: the built-in /exit.
+  $.clock.after(400, async () => {
+    try { await $.command.run({ command: 'exit' }) } catch { try { $.ui.toast(PARK_FALLBACK, { timeoutMs: 8000 }) } catch {} }
+  })
+  return { text: 'Parked' + (a.note ? ': ' + clip(a.note, 120) : '') + '. Closing this session; it stays on your board under Parked.' }
+}
+
 // ------------------------------------------------------------ lists (v0.5.1)
 
 // This session's saved lists, when they changed since Claude last heard
@@ -568,7 +592,8 @@ async function writeCheckpointDirect($, cp) {
 
 // length: 'short' | 'informative' | 'long' for this checkpoint only (/cp --short,
 // /cp --long); null = config summary.length.
-async function makeCheckpoint($, trigger, userNote, length) {
+// opts.next (0.8.2, /cp-park): the note is the checkpoint's Next line, word for word.
+async function makeCheckpoint($, trigger, userNote, length, opts = {}) {
   if (st.internal || st.checkpointing || !st.sessionId) return null
   st.checkpointing = true
   try {
@@ -581,11 +606,12 @@ async function makeCheckpoint($, trigger, userNote, length) {
     let generator = reply ? { by: 'mod', model: reply.model, ...(reply.backend ? { backend: reply.backend } : {}) } : null
     if (!parsed) {
       // No model answer: let the daemon try its own summarizer, if it's there.
-      const r = await api($, 'POST', '/v1/sessions/' + encodeURIComponent(st.sessionId) + '/checkpoints', { trigger, generate: true, userNote: userNote || undefined, length: ctx.length }, MODEL_TIMEOUT_MS * 3)
+      const r = await api($, 'POST', '/v1/sessions/' + encodeURIComponent(st.sessionId) + '/checkpoints', { trigger, generate: true, userNote: userNote || undefined, length: ctx.length, next: opts.next || undefined }, MODEL_TIMEOUT_MS * 3)
       if (r && r.ok && r.json) return afterCheckpoint($, r.json, trigger)
       parsed = heuristicCheckpoint(messages, record, { length: ctx.length })
       generator = { by: 'heuristic' }
     }
+    if (opts.next) parsed = { ...parsed, next: opts.next }
     const cp = {
       sessionId: st.sessionId, createdAt: nowIso(), trigger, machine: st.machine,
       sessionTitle: record.title || null, repo: record.repo ? repoName(record) : null, branch: (record.repo && record.repo.branch) || null, cwd: record.cwd || null,
@@ -988,6 +1014,8 @@ export function register(on, options) {
   on('command.run', { command: 'cp-done' }, async ($, e) => tickTodo($, e.args))
   on('command.run', { command: 'leftoff-done' }, async ($, e) => tickTodo($, e.args))
   on('command.run', { command: 'leftoff-catchup' }, async ($, e) => makeCatchup($, e.args))
+  on('command.run', { command: 'cp-park' }, async ($, e) => parkCommand($, e.args))
+  on('command.run', { command: 'leftoff-park' }, async ($, e) => parkCommand($, e.args))
 
   on('command.run', { command: 'checkpoints' }, async ($, e) => paneCommand($, e.args))
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leftoff/cli",
-  "version": "0.8.0",
+  "version": "0.8.3",
   "description": "Leftoff: WTF was I working on? Tracks every Claude Code session, writes a 3-line checkpoint when one goes quiet, and gives you a daily digest and a board, on your Mac and (optionally) your phone.",
   "keywords": [
     "claude",
@@ -28,6 +28,7 @@
     "assets",
     "templates",
     "hooks",
+    "docs",
     "CHANGELOG.md",
     "README.md",
     "LICENSE.md"

package/ui/app.css

@@ -1478,6 +1478,24 @@ li.todo.ticked .todo-text { text-decoration: line-through; }
 .todo-add { display: flex; gap: 8px; margin-top: 10px; }
 .todo-add input { flex: 1; min-width: 0; font-size: 16px; padding: 9px 12px; border-radius: 10px; border: 1px solid var(--line); background: var(--field); color: var(--text); }
 .todo-add input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--focus); }
+/* 0.8.2: Parked */
+.s-parked { color: var(--accent); background: var(--tint-accent); }
+.parked-sec { margin-top: 22px; }
+.parked-h { font-size: 13px; text-transform: uppercase; letter-spacing: .6px; color: var(--muted); margin: 0 0 8px; display: flex; align-items: center; gap: 8px; }
+.parked-h .count { font-size: 12px; color: var(--faint); letter-spacing: 0; }
+.parked-card { border-style: dashed; }
+.parked-card .row1 .title a { color: var(--text); }
+.park-note { font-size: 13.5px; color: var(--text); background: var(--subtle); border: 1px solid var(--line); border-radius: 10px; padding: 8px 11px; overflow-wrap: anywhere; }
+.park-note .k { color: var(--faint); font-size: 11.5px; text-transform: uppercase; letter-spacing: .6px; margin-right: 6px; }
+.parked-card .park-done { margin-left: auto; color: var(--muted); font-size: 13px; padding: 6px 4px; }
+.park-row { margin: 14px 0 4px; }
+.park-row.is-on { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; justify-content: space-between; border: 1px dashed var(--line-strong); border-radius: 10px; padding: 8px 12px; }
+.park-row .park-on { min-width: 0; overflow-wrap: anywhere; }
+.park-note-inline { color: var(--text); }
+.park-form { display: flex; gap: 8px; }
+.park-form input { flex: 1; min-width: 0; font-size: 16px; padding: 9px 12px; border-radius: 10px; border: 1px solid var(--line); background: var(--field); color: var(--text); }
+.park-form input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--focus); }
+.park-hint { font-size: 12.5px; margin-top: 6px; }
 .handoff-chips { display: flex; flex-wrap: wrap; gap: 6px; margin: 8px 0 2px; }
 .handoff-chips .chip { text-decoration: none; }
 .chip.todochip { color: var(--yellow); border-color: color-mix(in srgb, var(--yellow) 35%, transparent); background: var(--tint-yellow); }
@@ -1516,6 +1534,7 @@ html.dv-open, html.dv-open body { overflow: hidden; }
 .doc-md blockquote { margin: 10px 0; padding: 2px 12px; border-left: 3px solid var(--line-strong); color: var(--muted); }
 .doc-md li.sub { margin-left: 18px; }
 .doc-md li.task { list-style: none; margin-left: -18px; }
+.doc-page { max-width: 760px; padding-bottom: 32px; } /* 0.8.1: #/docs/<name> */
 .doc-md .tbox { display: inline-block; width: 13px; height: 13px; border: 1.5px solid var(--line-strong); border-radius: 3px; margin-right: 7px; vertical-align: -1px; }
 .doc-md .tbox.on { background: var(--green); border-color: var(--green); }
 .doc-table { overflow-x: auto; }
@@ -1525,3 +1544,26 @@ html.dv-open, html.dv-open body { overflow: hidden; }
 .doc-md th, .doc-md td { border: 1px solid var(--line); padding: 5px 8px; text-align: left; }
 .doc-img { text-align: center; padding-top: 10px; }
 .doc-img img { max-width: 100%; height: auto; border-radius: 8px; background: #fff; }
+
+/* 0.8.3: fix lines, low disk, sync chip, "Set up this Mac too" */
+.fixline { font-family: var(--mono); font-size: 12px; color: var(--text3, var(--text2)); opacity: .85; margin-top: 3px; overflow-wrap: anywhere; }
+.stpeer .fixline { flex-basis: 100%; margin-top: 0; }
+.ststatus .fixline { flex-basis: 100%; }
+.banner.needs-style { border-color: color-mix(in srgb, var(--red) 45%, var(--line)); background: linear-gradient(180deg, var(--tint-red), transparent 80%), var(--card); }
+.banner.needs-style b { color: var(--red); }
+.banner .grow { min-width: 0; }
+.banner.setup-mac .joinline { margin-top: 6px; }
+.banner.setup-mac code.cmd { overflow-wrap: anywhere; }
+.pagehead .syncchip { margin-top: 8px; }
+.chip.syncchip { display: inline-flex; align-items: center; gap: 6px; cursor: pointer; font: inherit; font-size: 12.5px; padding: 3px 10px; border-radius: 999px; border: 1px solid var(--line); background: var(--card); color: var(--text2); }
+.chip.syncchip .sdot { width: 8px; height: 8px; border-radius: 50%; background: var(--yellow); flex: none; }
+.chip.syncchip.warn { border-color: color-mix(in srgb, var(--yellow) 45%, transparent); background: var(--tint-yellow); color: var(--text); }
+.chip.syncchip.red { border-color: color-mix(in srgb, var(--red) 45%, transparent); background: var(--tint-red); color: var(--text); }
+.chip.syncchip.red .sdot { background: var(--red); }
+.syncdetails { margin: 0 0 14px; padding: 10px 14px; border: 1px solid var(--line); border-radius: 12px; background: var(--card); font-size: 13px; display: flex; flex-direction: column; gap: 8px; }
+.syncitem.red b { color: var(--red); }
+.stale-line { font-size: 12.5px; margin: -6px 0 12px; }
+.chip.machine.stale { border-style: dashed; }
+.rchip .rx { margin-left: 4px; font-size: 11px; opacity: .7; }
+.syncdetails .joinline { margin-top: 4px; }
+.syncdetails code.cmd { font-family: var(--mono); font-size: 12px; background: var(--bg2); border: 1px solid var(--line); border-radius: 6px; padding: 3px 8px; overflow-wrap: anywhere; min-width: 0; }