@leftoff/cli 0.9.18-beta.8 → 0.9.18

package/ui/chip-fade.js

@@ -18,7 +18,7 @@ export function paintFade(track) {
   return s
 }
 
-const SEL = '.repos .track'
+const SEL = '.repos .track, #tabStrip .tab-scroll' // 0.9.18: the tab strip fades where tabs run off too
 // Keeps every chip row's fade right: on first paint (any re-render adds new
 // tracks), on its own scroll, and when its width or its chips' widths change.
 export function watchChipFades(doc = document) {

package/ui/cp-fold.js

@@ -0,0 +1,42 @@
+// A checkpoint's folded extras, named for what's inside (2026-11-05). The old fixed summary said
+// "Decisions, files, open questions" although that section has been Approach notes since
+// 2026-11-03 (real decisions live under Decided), which made decision memory look broken.
+// Unit-tested in test/unit/cp-fold-1105.test.mjs.
+
+// In the order the summary names them. 'decided' counts only where the Decided lines are shown.
+const FOLD_NAMES = [['decided', 'decisions'], ['recap', 'recap'], ['decisions', 'approach notes'], ['files', 'files'], ['questions', 'open questions'], ['didntWork', 'what didn’t work'], ['nextSteps', 'next steps']]
+
+const present = (cp, k, decided) => {
+  if (!cp) return false
+  if (k === 'decided') return !!decided && Array.isArray(cp.decided) && cp.decided.length > 0
+  const v = cp[k]
+  return Array.isArray(v) ? v.length > 0 : !!v
+}
+
+// "Approach notes, files, open questions": the first three sections present, sentence case. '' when none.
+export function cpFoldSummary(cp, { decided = false } = {}) {
+  const names = FOLD_NAMES.filter(([k]) => present(cp, k, decided)).map(([, n]) => n).slice(0, 3)
+  if (!names.length) return ''
+  const t = names.join(', ')
+  return t.charAt(0).toUpperCase() + t.slice(1)
+}
+
+// 2026-11-06: a checkpoint's "Got done" facts (cp.work: commits, PRs, pushes, the last test run, from the
+// commands' own output) as short lines for its card: [{ kind, text }], at most max, then "+N more".
+// kind is a class name (merged, opened, commit, push, pass, fail); the words say the same, shape and text.
+export function workItems(cp, { max = 5 } = {}) {
+  const w = cp && Array.isArray(cp.work) ? cp.work : []
+  const out = []
+  for (const f of w) {
+    if (!f || typeof f !== 'object') continue
+    if (f.kind === 'pr' && f.number) out.push({ kind: f.state === 'merged' ? 'merged' : 'opened', text: (f.state === 'merged' ? 'Merged' : f.state === 'auto' ? 'Set to merge' : 'Opened') + ' PR #' + f.number + (f.title ? ': ' + String(f.title) : '') + (f.state === 'opened' ? ' (not merged yet)' : '') })
+    else if (f.kind === 'commit' && f.subject) out.push({ kind: 'commit', text: 'Committed ' + (f.sha ? '`' + String(f.sha).slice(0, 7) + '` ' : '') + String(f.subject) })
+    else if (f.kind === 'push' && f.branch) out.push({ kind: 'push', text: 'Pushed ' + String(f.branch) })
+    else if (f.kind === 'tests') out.push({ kind: f.ok ? 'pass' : 'fail', text: (f.ok ? 'Tests passed' : 'Tests failing') + (f.passed != null ? ': ' + (f.ok ? f.passed + ' passed' : f.failed + ' failed, ' + f.passed + ' passed') : '') + (f.cmd ? ' (`' + String(f.cmd).replace(/`/g, '') + '`)' : '') })
+  }
+  // the PRs and tests matter most; commits fill what's left
+  const top = out.filter((x) => x.kind !== 'commit' && x.kind !== 'push'), rest = out.filter((x) => x.kind === 'commit' || x.kind === 'push')
+  const all = [...top, ...rest]
+  if (all.length <= max) return all
+  return [...all.slice(0, max - 1), { kind: 'more', text: '+' + (all.length - max + 1) + ' more' }]
+}

package/ui/decisions.js

@@ -10,29 +10,79 @@ export const SOURCE_WORDS = { asked: 'You answered', plan: 'Plan approved', corr
 export const STATUS_SHAPE = { proposed: '◌', accepted: '●', rejected: '✕', superseded: '↻' }
 export const STATUS_WORD = { proposed: 'Proposed', accepted: 'Accepted', rejected: 'Rejected', superseded: 'Superseded' }
 
-// A checkpoint's decisions, under the newest checkpoint in the session panel.
-// log: the session's decisions from its repo's log, when loaded ({ <text norm>: { id, status } }).
+// 2026-11-05: a status Leftoff set on its own (statusAuto), in words beside the source, and why in the tip.
+export const AUTO_WORDS = { asked: 'automatically', plan: 'automatically', reversed: 'you changed it later' }
+export const AUTO_TIPS = {
+  asked: 'Accepted on its own: you picked this answer in the session. Reject keeps it out of new sessions.',
+  plan: 'Accepted on its own: you approved this plan in the session. Reject keeps it out of new sessions.',
+  reversed: 'Rejected on its own: later in the session you answered the same question differently.',
+}
+const autoOf = (d) => (d && ((d.status === 'accepted' && (d.statusAuto === 'asked' || d.statusAuto === 'plan')) || (d.status === 'rejected' && d.statusAuto === 'reversed')) ? d.statusAuto : null)
+const autoBit = (d, esc) => { const a = autoOf(d); return a ? '<span class="dec-auto" data-tip="' + esc(AUTO_TIPS[a]) + '">' + esc(AUTO_WORDS[a]) + '</span>' : '' }
+const normD = (t) => String(t || '').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim()
+const byNewest = (a, b) => String(b.createdAt || '').localeCompare(String(a.createdAt || ''))
+
+// Every decision a session made (2026-11-05), newest first. Each later checkpoint leaves out what an earlier one
+// recorded, so the newest checkpoint alone loses them. entries: the session's rows from its repo's log (GET
+// /v1/decisions, sessionId === this session), or null until the log loads / with no repo. A checkpoint's line the
+// log doesn't have yet (written on another Mac, not folded in) still shows, without a status.
+// -> [{ text, why, alternatives, source, entry }]
+export function sessionDecisions(checkpoints, entries = null) {
+  const out = [], seen = new Set()
+  const log = Array.isArray(entries) ? [...entries].sort(byNewest) : []
+  for (const d of log) {
+    out.push({ text: d.text, why: d.why || '', alternatives: d.alternatives || [], source: d.source, entry: d })
+    seen.add(normD(d.text)); if (d.original && d.original.text) seen.add(normD(d.original.text))
+  }
+  const cps = (Array.isArray(checkpoints) ? checkpoints : []).filter((c) => c && !c.doubt).sort(byNewest)
+  for (const cp of cps) for (const d of Array.isArray(cp.decided) ? cp.decided : []) {
+    const k = normD(d && d.text)
+    if (!k || seen.has(k)) continue
+    seen.add(k); out.push({ text: d.text, why: d.why || '', alternatives: d.alternatives || [], source: d.source, entry: null })
+  }
+  return out
+}
+// The fold's count: the total, and how many wait on you.
+export function sessionDecisionsCount(list) {
+  const n = (list || []).length, rev = (list || []).filter((d) => d.entry && d.entry.status === 'proposed').length
+  return n + (rev ? ' · ' + rev + ' to review' : '')
+}
+// The log's rows for one session, as the decided list reads them ({ <text norm>: row }, the original wording too).
+export function logBySession(decisions, sessionId) {
+  const by = {}
+  for (const d of decisions || []) if (d && d.sessionId === sessionId) { by[normD(d.text)] = d; if (d.original && d.original.text) by[normD(d.original.text)] = d }
+  return by
+}
+
+// A session's decisions, in the session panel's Decided fold.
+// decided: sessionDecisions() rows ({ entry }), or a checkpoint's plain decided list read against log
+// ({ <text norm>: { id, status } }, when loaded).
 // 1k: a proposed one is reviewed right here (Accept / Reject / Edit, the log page's API and gate). trusted: false on a
 // device that may look but not change the log (the buttons show disabled, with the reason). editing: the id being edited.
-export function decidedListHtml(decided, { esc = escD, log = null, repoId = null, trusted = true, editing = null, may = true } = {}) {
+// readOnly: an older checkpoint's lines in the Timeline (status only, no buttons, no link).
+export function decidedListHtml(decided, { esc = escD, log = null, repoId = null, trusted = true, editing = null, may = true, readOnly = false } = {}) {
   const list = Array.isArray(decided) ? decided : []
   if (!list.length) return ''
-  const norm = (t) => String(t || '').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim()
   const rows = list.map((d) => {
-    const hit = log && log[norm(d.text)]
+    const hit = d.entry || (log && log[normD(d.text)]) || null
     const st = hit ? '<span class="dec-st dec-st-' + esc(hit.status) + '"><span aria-hidden="true">' + STATUS_SHAPE[hit.status] + '</span> ' + esc(STATUS_WORD[hit.status]) + '</span>' : ''
-    if (hit && editing === hit.id) return '<li class="dec-row" id="decp-' + esc(hit.id) + '"><span class="dec-id">' + esc(hit.id) + '</span>' + editForm({ ...hit, repo: hit.repo || repoId }, esc) + '</li>'
+    if (!readOnly && hit && editing === hit.id) return '<li class="dec-row" id="decp-' + esc(hit.id) + '"><span class="dec-id">' + esc(hit.id) + '</span>' + editForm({ ...hit, repo: hit.repo || repoId }, esc) + '</li>'
     const rp = (hit && (hit.repo || repoId)) || ''
     const btn = (act, label, cls) => '<button type="button" class="btn' + cls + '" data-action="dec-act" data-act="' + act + '" data-id="' + esc(hit.id) + '" data-repo="' + esc(rp) + '"' + offAttrs(trusted, esc) + '>' + label + '</button>'
-    const acts = hit && hit.status === 'proposed' && may ? '<div class="dec-acts dec-acts-panel">' + btn('accept', 'Accept', ' primary') + btn('reject', 'Reject', '') +
-      '<button type="button" class="btn" data-action="dec-edit" data-id="' + esc(hit.id) + '" data-repo="' + esc(rp) + '"' + offAttrs(trusted, esc) + '>Edit</button></div>' : ''
-    return '<li class="dec-row"' + (hit ? ' id="decp-' + esc(hit.id) + '"' : '') + '>' + (hit ? '<span class="dec-id">' + esc(hit.id) + '</span> ' : '') + '<span class="dec-text">' + esc(hit && hit.edited ? hit.text : d.text) + '</span>' + st +
-      (d.why ? '<div class="dec-why">' + esc(d.why) + '</div>' : '') +
-      (d.alternatives && d.alternatives.length ? '<div class="dec-alt">Over: ' + d.alternatives.map(esc).join(' · ') + '</div>' : '') +
-      '<div class="dec-src">' + esc(SOURCE_WORDS[d.source] || SOURCE_WORDS.agent) + '</div>' + acts + '</li>'
+    const acts = !readOnly && hit && hit.status === 'proposed' && may ? '<div class="dec-acts dec-acts-panel">' + btn('accept', 'Accept', ' primary') + btn('reject', 'Reject', '') +
+      '<button type="button" class="btn" data-action="dec-edit" data-id="' + esc(hit.id) + '" data-repo="' + esc(rp) + '"' + offAttrs(trusted, esc) + '>Edit</button></div>'
+      : !readOnly && hit && may && autoOf(hit) && hit.status === 'accepted' ? '<div class="dec-acts dec-acts-panel dec-acts-quiet">' + btn('reject', 'Reject', '') + '</div>' : ''
+    const why = (hit && hit.why) || d.why, alts = (hit && hit.alternatives && hit.alternatives.length ? hit.alternatives : d.alternatives) || []
+    // a quiet line first (status · id · where it came from), then the decision in words, then why / over
+    const src = '<span class="dec-src">' + esc(SOURCE_WORDS[(hit && hit.source) || d.source] || SOURCE_WORDS.agent) + '</span>'
+    const head = [st, hit ? '<span class="dec-id">' + esc(hit.id) + '</span>' : '', src, autoBit(hit, esc)].filter(Boolean).join('<span class="dec-dot" aria-hidden="true"> · </span>')
+    return '<li class="dec-row' + (hit ? ' dec-row-' + esc(hit.status) : '') + '"' + (hit && !readOnly ? ' id="decp-' + esc(hit.id) + '"' : '') + '><div class="dec-row-h">' + head + '</div>' +
+      '<div class="dec-text">' + esc(hit && (hit.edited || d.entry) ? hit.text : d.text) + '</div>' +
+      (why ? '<div class="dec-why">' + esc(why) + '</div>' : '') +
+      (alts.length ? '<div class="dec-alt">Over: ' + alts.map(esc).join(' · ') + '</div>' : '') + acts + '</li>'
   }).join('')
-  const link = repoId ? '<a class="linkish dec-open" href="' + esc(decisionsHref(repoId)) + '">Decision log →</a>' : ''
-  return '<ul class="dec-list">' + rows + '</ul>' + link
+  const link = repoId && !readOnly ? '<a class="linkish dec-open" href="' + esc(decisionsHref(repoId)) + '">Decision log →</a>' : ''
+  return '<ul class="dec-list' + (readOnly ? ' dec-list-ro' : '') + '">' + rows + '</ul>' + link
 }
 
 // 1b: one quiet line in the session panel: the session started with its repo's decisions (shape plus
@@ -115,13 +165,13 @@ export function decisionItemHtml(d, { esc = escD, byId = new Map(), may = true,
   const editBtn = (cls) => edit ? '<button type="button" class="' + cls + '" data-action="dec-edit" data-id="' + esc(d.id) + '" data-repo="' + esc(d.repo) + '"' + offAttrs(trusted, esc) + '>Edit</button>' : ''
   const link = replaces && !(d.supersedes || []).includes(replaces) ? '<button type="button" class="btn" data-action="dec-link" data-id="' + esc(d.id) + '" data-to="' + esc(replaces) + '" data-repo="' + esc(d.repo) + '"' + offAttrs(trusted, esc) + '>Confirm it replaces ' + esc(replaces) + '</button>' : ''
   const acts = !may && !link ? '' : !may ? '<div class="dec-acts">' + link + '</div>' : review ? '<div class="dec-acts">' + btn('accept', 'Accept', ' primary') + btn('reject', 'Reject') + editBtn('btn') + link + '</div>'
-    : '<div class="dec-acts dec-acts-quiet">' + (d.status === 'rejected' ? btn('reopen', 'Review again') : editBtn('linkish')) + link + '</div>'
+    : '<div class="dec-acts dec-acts-quiet">' + (d.status === 'rejected' ? btn('reopen', 'Review again') : (autoOf(d) && d.status === 'accepted' ? btn('reject', 'Reject') : '') + editBtn('linkish')) + link + '</div>'
   return '<li class="dec-item dec-' + esc(d.status) + '" id="dec-' + esc(d.id) + '">' + head +
     '<div class="dec-text">' + esc(d.text) + (d.edited ? ' <span class="faint" data-tip="' + esc('Edited · was: ' + ((d.original && d.original.text) || '')) + '">(edited)</span>' : '') + '</div>' +
     (d.why ? '<div class="dec-why">' + esc(d.why) + '</div>' : '') +
     (d.alternatives && d.alternatives.length ? '<div class="dec-alt">Over: ' + d.alternatives.map(esc).join(' · ') + '</div>' : '') +
     chainBit(d, byId, esc) + sug +
-    '<div class="dec-meta"><span class="dec-src">' + esc(SOURCE_WORDS[d.source] || SOURCE_WORDS.agent) + '</span>' + (sessionBit(d, esc) ? ' · ' + sessionBit(d, esc) : '') + '</div>' + acts + '</li>'
+    '<div class="dec-meta"><span class="dec-src">' + esc(SOURCE_WORDS[d.source] || SOURCE_WORDS.agent) + '</span>' + (autoBit(d, esc) ? ' · ' + autoBit(d, esc) : '') + (sessionBit(d, esc) ? ' · ' + sessionBit(d, esc) : '') + '</div>' + acts + '</li>'
 }
 
 // The storage choice (one per project). Off by default: the log stays in Leftoff's folder.
@@ -135,6 +185,12 @@ export function storageChoiceHtml(project, { esc = escD, may = true, trusted = t
       : 'The log stays in Leftoff’s folder, shared by your Macs. Turn this on to also write accepted decisions into each repo’s ' + esc(project.file || 'docs/DECISIONS.md') + '.') + '</p></div>'
 }
 
+// 2026-11-05 an empty log says where decisions come from, so nobody has to guess whether it's working
+export const DECISIONS_EMPTY = ['Decisions come from checkpoints. A question Claude asked that you answered, a plan you approved, or a correction you gave becomes a proposed decision here at the next checkpoint.', 'Checkpoints written before decision memory aren’t read for it.']
+export function decisionsEmptyHtml({ esc = escD } = {}) {
+  return '<div class="dec-empty">' + DECISIONS_EMPTY.map((t) => '<p class="faint">' + esc(t) + '</p>').join('') + '</div>'
+}
+
 // The whole page. v: GET /v1/decisions. ui: { all, editing, may }
 export function decisionsPageHtml(v, ui = {}, { esc = escD } = {}) {
   const list = (v && v.decisions) || []
@@ -149,11 +205,12 @@ export function decisionsPageHtml(v, ui = {}, { esc = escD } = {}) {
     (multi ? '<p class="faint">' + v.repos.map((r) => esc(r.label)).join(' · ') + '</p>' : '') + '</header>'
   if (ui.trusted === false) h += '<p class="faint dec-trust"><span aria-hidden="true">◌</span> View only on this device. ' + esc(DEC_TRUST_TIP) + '</p>' // 1h: the reason in words too (a phone shows no tips)
   if (v && (v.project || sc.kind === 'repo')) h += '<section class="proj-sec">' + storageChoiceHtml(v.project, { esc, may: ui.may !== false, trusted: ui.trusted !== false }) + '</section>'
-  if (review.length) h += '<section class="proj-sec dec-review"><h2>To review <span class="count">' + review.length + '</span></h2><p class="faint">Proposed from checkpoints. Only accepted decisions reach new sessions, Ask and walkthroughs.</p><ul class="dec-tl">' + review.map((d) => decisionItemHtml(d, { ...opts, review: true })).join('') + '</ul></section>'
+  if (review.length) h += '<section class="proj-sec dec-review"><h2>To review <span class="count">' + review.length + '</span></h2><p class="faint">Proposed from checkpoints. Questions you answered and plans you approved are accepted on their own. Only accepted decisions reach new sessions, Ask and walkthroughs.</p><ul class="dec-tl">' + review.map((d) => decisionItemHtml(d, { ...opts, review: true })).join('') + '</ul></section>'
   const ctl = '<div class="dec-ctl"><button type="button" class="sask-opt" data-action="dec-all" aria-pressed="' + !!ui.all + '">' + (ui.all ? 'Showing superseded and rejected' : 'Include superseded and rejected' + (hidden ? ' (' + hidden + ')' : '')) + '</button>' +
-    '<button type="button" class="btn" data-action="dec-copy">Copy as Markdown</button>' + testplanLinkHtml(sc, { esc, cls: 'btn' }) + '</div>'
+    '<button type="button" class="btn" data-action="dec-copy">Copy as Markdown</button>' +
+    '<button type="button" class="btn save-html" data-action="dec-save-html" data-tip="Save as HTML · one file with nothing linked out: opens offline, on a phone, and prints">Save as HTML</button>' + testplanLinkHtml(sc, { esc, cls: 'btn' }) + '</div>' // 2026-11-06
   h += '<section class="proj-sec dec-timeline"><h2>Timeline <span class="count">' + rows.length + '</span></h2>' + ctl +
-    (rows.length ? '<ol class="dec-tl">' + rows.map((d) => decisionItemHtml(d, opts)).join('') + '</ol>' : '<p class="faint">' + (review.length ? 'Nothing accepted yet.' : 'No decisions yet. They’re proposed here when a checkpoint sees one: a question you answered, a plan you approved, a correction.') + '</p>') + '</section>'
+    (rows.length ? '<ol class="dec-tl">' + rows.map((d) => decisionItemHtml(d, opts)).join('') + '</ol>' : list.length ? '<p class="faint">Nothing accepted yet.</p>' : decisionsEmptyHtml({ esc })) + '</section>'
   return '<div class="proj dec-page">' + h + '</div>'
 }
 
@@ -175,12 +232,15 @@ export function reviewCountHtml(n, { esc = escD, href = null, cls = '' } = {}) {
 }
 
 // The project page's short Decisions section: counts, the storage choice, the way in.
+// 2026-11-05 a single repo's page (v.scope.kind 'repo') gets it too, without the storage choice: that stays a project's.
 export function projectDecisionsHtml(v, { esc = escD, may = true, trusted = true, scopeArg = '' } = {}) {
   if (!v) return ''
+  const isRepo = !!(v.scope && v.scope.kind === 'repo')
   const list = v.decisions || []
   const cur = list.filter((d) => d.status === 'accepted').length, rev = list.filter((d) => d.status === 'proposed').length
   return '<section class="proj-sec dec-proj" id="projDecisions"><h2>Decisions <span class="count">' + cur + '</span></h2>' +
-    '<p>' + (cur ? cur + ' current' : 'None accepted yet') + (rev ? ' · <strong>' + rev + ' to review</strong>' : '') + ' · <a class="linkish" href="' + esc(decisionsHref(scopeArg)) + '">Open the timeline →</a></p>' +
+    '<p>' + (!list.length ? 'None yet' : cur ? cur + ' current' : 'None accepted yet') + (rev ? ' · <strong>' + rev + ' to review</strong>' : '') + ' · <a class="linkish" href="' + esc(decisionsHref(scopeArg)) + '">Open the timeline →</a></p>' +
+    (list.length ? '' : decisionsEmptyHtml({ esc })) +
     '<div class="dec-acts">' + testplanLinkHtml(v.scope, { esc }) + '</div>' +
-    storageChoiceHtml(v.project, { esc, may, trusted }) + (trusted === false ? '<p class="faint dec-trust"><span aria-hidden="true">◌</span> View only on this device. ' + esc(DEC_TRUST_TIP) + '</p>' : '') + '</section>'
+    (isRepo ? '<p class="faint dec-local">' + (v.project ? 'Where its log is kept is set on ' + esc(v.project.name) + '’s page.' : 'Keeping the log in the repo too is a project choice: available once this repo is in a project.') + '</p>' : storageChoiceHtml(v.project, { esc, may, trusted })) + (trusted === false ? '<p class="faint dec-trust"><span aria-hidden="true">◌</span> View only on this device. ' + esc(DEC_TRUST_TIP) + '</p>' : '') + '</section>'
 }

package/ui/digest-versions.js

@@ -0,0 +1,57 @@
+// The digest's version note (2026-11-06, src/history.js): a quiet "v3 · changed since 9:00 AM" under the
+// title when a day's digest was made more than once, and a list to open an older version
+// (#/digest/<date>?v=N). "Since" is the version this device last opened, kept in localStorage; with none
+// (or the newest), it just says how many versions there are. An older version says so in words, with a
+// way back. Pure functions plus one paint; the board's renderer is not touched.
+
+export const SEEN_KEY = 'lo.digestSeen'
+const hm = (iso) => { const t = new Date(iso); return Number.isNaN(t.getTime()) ? '' : t.toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' }) }
+
+// { date: version } this device opened
+export function readSeen(storage) { try { const o = JSON.parse(storage.getItem(SEEN_KEY) || '{}'); return o && typeof o === 'object' ? o : {} } catch { return {} } }
+export function markSeen(storage, date, version) {
+  try {
+    const o = readSeen(storage)
+    if ((o[date] || 0) >= version) return
+    o[date] = version
+    const keep = Object.keys(o).sort().slice(-30) // a month of days is plenty
+    storage.setItem(SEEN_KEY, JSON.stringify(Object.fromEntries(keep.map((k) => [k, o[k]]))))
+  } catch {}
+}
+
+// d: the GET /v1/digests/<date> answer; seen: the version this device last opened (or null)
+// -> { label, older, latest, items: [{ version, label, href, current, shown }] } | null (one version: nothing to show)
+export function versionNote(d, date, seen = null) {
+  const vs = d && d.versions
+  if (!vs || !Array.isArray(vs.versions) || vs.count < 2) return null
+  const shown = d.version || vs.latest
+  const latest = vs.versions.find((v) => v.version === vs.latest) || vs.versions[vs.versions.length - 1]
+  const since = seen && seen < vs.latest ? vs.versions.find((v) => v.version === seen) : null
+  const label = shown !== vs.latest ? 'v' + shown + ' of ' + vs.count : since ? 'v' + vs.latest + ' · changed since ' + hm(since.generatedAt) : 'v' + vs.latest + ' · ' + vs.count + ' versions'
+  const items = vs.versions.slice().reverse().map((v) => ({ version: v.version, label: 'v' + v.version + ' · ' + hm(v.generatedAt) + (v.version === vs.latest ? ' (latest)' : ''), href: '#/digest/' + date + (v.version === vs.latest ? '' : '?v=' + v.version), current: v.version === vs.latest, shown: v.version === shown }))
+  return { label, older: shown !== vs.latest, shown, latest: vs.latest, latestAt: latest.generatedAt, shownAt: (vs.versions.find((v) => v.version === shown) || {}).generatedAt, items }
+}
+
+export function versionNoteHtml(n, { esc, date }) {
+  if (!n) return null
+  // a div, not a ul: the digest's repo filter shows and hides every ul in the article
+  const menu = '<div class="dv-list" id="dvList" role="list" hidden>' + n.items.map((i) => '<a role="listitem" href="' + esc(i.href) + '"' + (i.shown ? ' aria-current="page"' : '') + '>' + (i.shown ? '● ' : '○ ') + esc(i.label) + '</a>').join('') + '</div>'
+  const btn = '<button type="button" class="dv-btn" aria-expanded="false" aria-controls="dvList" data-tip="Earlier versions of this digest">' + esc(n.label) + ' ▾</button>'
+  const old = n.older ? '<div class="banner dv-old" role="status"><span class="grow"><b>◷ An earlier version</b>: v' + n.shown + ', made ' + esc(hm(n.shownAt)) + '. The latest is v' + n.latest + ' (' + esc(hm(n.latestAt)) + ').</span><a class="btn" href="#/digest/' + esc(date) + '">Back to latest</a></div>' : ''
+  return { old, note: '<span class="dv">' + btn + menu + '</span>' }
+}
+
+// After the digest is on the page: the note on its own line under the meta line, the banner above the article.
+export function paintDigestVersion(root, d, date, { esc, storage }) {
+  const seen = storage ? readSeen(storage)[date] || null : null
+  const n = versionNote(d, date, seen)
+  if (storage && d && d.version && d.versions && d.version === d.versions.latest) markSeen(storage, date, d.version)
+  if (!n) return null
+  const html = versionNoteHtml(n, { esc, date })
+  const meta = root.querySelector('article.md .digest-meta')
+  if (meta) meta.insertAdjacentHTML('afterend', '<div class="dv-line">' + html.note + '</div>')
+  if (html.old) { const art = root.querySelector('article.md'); if (art) art.insertAdjacentHTML('beforebegin', html.old) }
+  const btn = root.querySelector('.dv-btn'), list = root.querySelector('#dvList')
+  if (btn && list) btn.addEventListener('click', () => { const open = btn.getAttribute('aria-expanded') !== 'true'; btn.setAttribute('aria-expanded', String(open)); list.hidden = !open })
+  return n
+}

package/ui/fs-side.js

@@ -80,3 +80,32 @@ export function fsSideHtml({ id, side = '', foot = '', label = '', away = '', cp
   return '<aside class="fs-side' + (collapsed ? ' collapsed' : '') + (sheet ? ' sheet-up' : '') + (scrolled ? ' is-scrolled' : '') + '" id="fsSide" data-sid="' + esc(id) + '" aria-label="This session">' +
     resizeHandleHtml({ width, viewport }, { esc }) + peek + '<div class="fs-side-in">' + side + '</div>' + foot + railHtml({ cpCount, cu, away }, { esc, icon }) + '</aside>'
 }
+
+// 2026-11-06 The phone's sheet follows a finger: drag its peek up to raise it, and drag the raised
+// sheet down to lower it, from the peek or from its content when that's scrolled to the very top.
+// Everywhere else a finger scrolls the sheet's content natively, both ways (a drag never starts
+// once the content has room above it, nor when the finger first heads the way that scrolls it).
+export const SHEET_DRAG_SLOP = 8 // px a finger moves before it's a drag or a scroll
+export const SHEET_DRAG_FLIP = 64 // px of drag that raises or lowers the sheet on letting go
+// up: the sheet is raised; fromPeek: the finger started on the peek; scrollTop: the content's at the touch's start;
+// dy, dx: the finger's travel so far (down and right positive) -> 'drag' | 'scroll' | null (not decided yet)
+export function sheetDragStart({ up = false, fromPeek = false, scrollTop = 0, dy = 0, dx = 0 } = {}) {
+  const ay = Math.abs(dy), ax = Math.abs(dx)
+  if (ay < SHEET_DRAG_SLOP && ax < SHEET_DRAG_SLOP) return null
+  if (ax > ay) return 'scroll' // sideways: a table or code block, never the sheet
+  if (!up) return fromPeek && dy < 0 ? 'drag' : 'scroll' // lowered: only the peek, only upwards
+  if (dy <= 0) return 'scroll' // raised, finger heading up: the content scrolls down
+  return fromPeek || (Number(scrollTop) || 0) <= 0 ? 'drag' : 'scroll'
+}
+// How far the sheet sits from where it rests while dragged (px, down positive; never past either end).
+// travel: the px between raised and lowered.
+export function sheetDragOffset({ up = false, dy = 0, travel = 0 } = {}) {
+  const t = Math.max(0, Number(travel) || 0)
+  return up ? Math.round(Math.max(0, Math.min(t, dy))) : Math.round(Math.max(-t, Math.min(0, dy)))
+}
+// Letting go: true when the sheet should change (raise or lower), from the travel or a quick flick.
+export function sheetDragFlips({ up = false, dy = 0, ms = 1000 } = {}) {
+  const d = up ? dy : -dy
+  if (d >= SHEET_DRAG_FLIP) return true
+  return d >= 24 && ms > 0 && d / ms > 0.5 // a flick: 0.5 px/ms
+}

package/ui/html-preview.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<meta charset="utf-8">
+<!-- The HTML file viewer's sandbox (ui/html-preview.js). Served with its own CSP
+     (sandbox allow-scripts, inline only unless ?remote=1). It takes one page from
+     the board by postMessage and becomes that page. -->
+<script>
+addEventListener('message', function (e) {
+  if (e.source !== parent || !e.data || e.data.t !== 'lo-hp-html') return
+  document.open(); document.write(String(e.data.html)); document.close()
+})
+parent.postMessage({ t: 'lo-hp-ready' }, '*')
+</script>

package/ui/html-preview.js

@@ -0,0 +1,136 @@
+// 2026-11-06 An HTML file in the viewer renders as a page (Preview · Code).
+// The page never runs in the board: it runs in ui/html-preview.html, a shell
+// served with its own CSP (previewCsp) whose `sandbox` gives it an opaque
+// origin, so it can't read the board's storage or cookies, and its calls to
+// the daemon carry Origin: null (refused). The board hands it the file by
+// postMessage. Remote resources (fonts, CDN scripts, images) are blocked until
+// you press Allow, for that view only; the bar lists what the file asks for.
+const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
+
+export const PREVIEW_PAGE = '/html-preview.html'
+export const VIEW_KEY = 'lo-html-view-v1'
+
+// The shell's CSP. Inline only by default; `remote` adds https: alone (not
+// http:, which would match a local board's own http://127.0.0.1 and pull its
+// files in for the page's ./style.css). Never 'self'. Copied in
+// relay/src/user.js (a unit test keeps them the same).
+export function previewCsp(remote = false) {
+  const r = remote ? ' https:' : ''
+  return "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'" + r + "; style-src 'unsafe-inline'" + r +
+    '; img-src data: blob:' + r + '; font-src data:' + r + '; media-src data: blob:' + r + '; connect-src ' + (remote ? 'https:' : "'none'") +
+    "; frame-src 'none'; worker-src 'none'; form-action 'none'; base-uri 'none'; frame-ancestors 'self'; sandbox allow-scripts"
+}
+
+// An HTML file, from either reader: the session's files (type html) or a path
+// in a message (type code, lang html).
+export function isHtmlDoc(r) {
+  if (!r || r.missing || r.tooBig || r.binary || typeof r.text !== 'string') return false
+  return r.type === 'html' || (r.type === 'code' && (r.lang === 'html' || /^text\/html\b/.test(r.mime || '')))
+}
+
+// What the file loads by itself (not links you'd click): src, srcset, poster,
+// <link href> (not a resource hint), <object data>, CSS url() and @import.
+// Remote ones are blocked until Allow (scripts can fetch more once allowed; the
+// bar says so). Local ones (./style.css, img/x.png, /app.js) never load: the
+// preview has only the file itself, so the bar names them.
+const HINT_RELS = /\b(preconnect|dns-prefetch|prerender)\b/i
+const LINK_TAGS = /^(a|area|base|form)$/i
+const unquote = (u) => String(u || '').trim().replace(/^['"]|['"]$/g, '')
+function remoteUrl(u) {
+  const s = unquote(u)
+  if (/^https?:\/\//i.test(s)) return s
+  if (/^\/\/[^/]/.test(s)) return 'https:' + s
+  return ''
+}
+function localUrl(u) {
+  const s = unquote(u)
+  if (!s || remoteUrl(s) || s.charAt(0) === '#' || /^[a-z][a-z\d+.-]*:/i.test(s)) return '' // data:, blob:, about:, mailto:, any other scheme
+  return s
+}
+function cssUrls(css, add) {
+  for (const m of String(css).matchAll(/url\(\s*(['"]?)([^'")]+)\1\s*\)/gi)) add(m[2], 'style')
+  for (const m of String(css).matchAll(/@import\s+(['"])([^'"]+)\1/gi)) add(m[2], 'style')
+}
+function scanRefs(html, add) {
+  const src = String(html || '').replace(/<!--[\s\S]*?-->/g, '')
+  for (const m of src.matchAll(/<([a-z][\w-]*)\b([^>]*)>/gi)) {
+    const tag = m[1].toLowerCase(), attrs = m[2]
+    const attr = (n) => { const a = attrs.match(new RegExp('(?:^|\\s)' + n + '\\s*=\\s*(?:"([^"]*)"|\'([^\']*)\'|([^\\s>]+))', 'i')); return a ? (a[1] ?? a[2] ?? a[3]) : null }
+    if (LINK_TAGS.test(tag)) continue
+    const kind = tag === 'script' ? 'script' : tag === 'link' ? (/stylesheet/i.test(attr('rel') || '') ? 'style' : 'link') : tag === 'img' || tag === 'picture' || tag === 'source' ? 'image' : tag
+    if (attr('src')) add(attr('src'), kind)
+    if (attr('poster')) add(attr('poster'), 'image')
+    if (tag === 'object' && attr('data')) add(attr('data'), 'object')
+    if (tag === 'link' && attr('href') && !HINT_RELS.test(attr('rel') || '')) add(attr('href'), kind)
+    for (const c of String(attr('srcset') || '').matchAll(/(\S+)(?:\s+[^,]*)?(?:,|$)/g)) add(c[1].replace(/,+$/, ''), 'image') // a data: URL keeps its comma
+    if (attr('style')) cssUrls(attr('style'), add)
+  }
+  for (const m of src.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)) cssUrls(m[1], add)
+}
+export function remoteRefs(html) {
+  const seen = new Map()
+  scanRefs(html, (u, kind) => { const url = remoteUrl(u); if (url && !seen.has(url)) { let host = ''; try { host = new URL(url).host } catch { return } seen.set(url, { url, host, kind }) } })
+  return [...seen.values()]
+}
+export function localRefs(html) {
+  const seen = new Map()
+  scanRefs(html, (u, kind) => { const url = localUrl(u); if (url && !seen.has(url)) seen.set(url, { url, kind }) })
+  return [...seen.values()]
+}
+
+// The hosts, in first-seen order: "fonts.googleapis.com, fonts.gstatic.com".
+export function refHosts(refs) { return [...new Set((refs || []).map((x) => x.host))] }
+
+// What the shell writes: the file, plus a first script that keeps a link click
+// inside the preview from leaving it (it says where the link goes instead),
+// passes Esc on, answers the board's ping, and says when the page is leaving.
+// The preview's own CSP can't stop a page sending its frame somewhere (a script
+// setting location); the board's CSP does (frame-src 'self' covers a child's
+// navigations, so another site is refused before any request). Behind that, the
+// board stops a preview that leaves for anywhere it can go (ping unanswered after
+// a load, or pagehide) and says so. A meta refresh, which
+// leaves with no script, is taken out; while blocked, so are resource hints (a
+// preconnect isn't covered by CSP).
+const GUARD = '<script>(function(){var P=parent,D=document;D.addEventListener("click",function(e){var a=e.target&&e.target.closest&&e.target.closest("a[href],area[href]");if(!a)return;var h=a.getAttribute("href")||"";if(h.charAt(0)==="#")return;e.preventDefault();P.postMessage({t:"lo-hp-link",href:h},"*")},true);D.addEventListener("keydown",function(e){if(e.key==="Escape")P.postMessage({t:"lo-hp-esc"},"*")});addEventListener("message",function(e){if(e.source===P&&e.data&&e.data.t==="lo-hp-ping")P.postMessage({t:"lo-hp-pong",n:e.data.n},"*")});addEventListener("pagehide",function(){P.postMessage({t:"lo-hp-left"},"*")})})()</script>'
+const attrOf = (t, n) => (t.match(new RegExp('\\b' + n + '\\s*=\\s*(?:"([^"]*)"|\'([^\']*)\'|([^\\s>]+))', 'i')) || []).slice(1).join(' ')
+export function previewDoc(html, { remote = false } = {}) {
+  let s = String(html || '')
+  s = s.replace(/<meta\b[^>]*>/gi, (t) => (/^\s*refresh\s*$/i.test(attrOf(t, 'http-equiv')) ? '' : t))
+  if (!remote) s = s.replace(/<link\b[^>]*>/gi, (t) => (HINT_RELS.test(attrOf(t, 'rel')) ? '' : t))
+  const dt = s.match(/^\s*(?:<!--[\s\S]*?-->\s*)*<!doctype[^>]*>/i)
+  return dt ? dt[0] + GUARD + s.slice(dt[0].length) : GUARD + s
+}
+
+// The bar above the file: Preview · Code, and in Preview what's blocked.
+export function previewBarHtml({ mode = 'preview', refs = [], remote = false, open = false, locals = [], openLocal = false, icon = () => '' } = {}) {
+  const seg = (m, label, tip) => '<button type="button" data-action="hp-mode" data-mode="' + m + '" aria-pressed="' + (mode === m) + '" data-tip="' + esc(tip) + '">' + esc(label) + '</button>'
+  let h = '<div class="wt-seg wt-seg-sm hp-seg" role="group" aria-label="Show the file as">' + seg('preview', 'Preview', 'The page, rendered in a sandbox') + seg('code', 'Code', 'The file’s source') + '</div>'
+  if (mode === 'preview' && refs.length) {
+    const hosts = refHosts(refs)
+    const n = refs.length
+    const words = remote ? 'Loading ' + n + ' remote ' + (n === 1 ? 'resource' : 'resources') : n + ' remote ' + (n === 1 ? 'resource' : 'resources') + ' blocked'
+    h += '<div class="hp-remote' + (remote ? ' on' : '') + '">' + icon(remote ? 'globe' : 'shield', 'ic hp-ric') +
+      '<span class="hp-rw"><b>' + esc(words) + '</b><span class="hp-hosts"> from ' + esc(hosts.slice(0, 2).join(', ') + (hosts.length > 2 ? ' and ' + (hosts.length - 2) + ' more' : '')) + '</span></span>' +
+      '<button type="button" class="btn sm hp-show" data-action="hp-show" aria-expanded="' + !!open + '" aria-controls="hpList' + (locals.length ? ' hpLocal' : '') + '">' + (open ? 'Hide' : 'Show') + '</button>' +
+      (remote ? '<button type="button" class="btn sm" data-action="hp-block" data-tip="Reload the preview with remote resources blocked">Block</button>'
+        : '<button type="button" class="btn sm" data-action="hp-allow" data-tip="Load these, and anything they load, for this view only">Allow</button>') + '</div>'
+    if (open) {
+      h += '<ul class="hp-list" id="hpList">' + refs.map((x) => '<li><span class="hp-kind">' + esc(x.kind) + '</span><code>' + esc(x.url) + '</code></li>').join('') + '</ul>' +
+        '<p class="hp-note faint">' + (remote ? '' : 'Allowing also lets the page’s scripts load anything else they ask for. ') + 'Links in the page don’t open from the preview.</p>'
+    }
+  }
+  if (mode === 'preview' && locals.length) {
+    // with a remote line above, its Show lists both, so this line is words only
+    const n = locals.length, own = !refs.length
+    const names = locals.slice(0, 2).map((x) => x.url.split(/[?#]/)[0].split('/').pop() || x.url)
+    const shown = own ? openLocal : open
+    h += '<div class="hp-remote hp-local' + (own ? '' : ' hp-words') + '">' + icon('file-text', 'ic hp-ric') +
+      '<span class="hp-rw"><b>' + n + ' local ' + (n === 1 ? 'file' : 'files') + ' not loaded</b><span class="hp-hosts">: ' + esc(names.join(', ') + (n > 2 ? ' and ' + (n - 2) + ' more' : '')) + '</span></span>' +
+      (own ? '<button type="button" class="btn sm hp-show" data-action="hp-show-local" aria-expanded="' + !!openLocal + '" aria-controls="hpLocal">' + (openLocal ? 'Hide' : 'Show') + '</button>' : '') + '</div>'
+    if (shown) {
+      h += '<ul class="hp-list" id="hpLocal">' + locals.map((x) => '<li><span class="hp-kind">' + esc(x.kind) + '</span><code>' + esc(x.url) + '</code></li>').join('') + '</ul>' +
+        '<p class="hp-note faint">The preview has only this file, so files it loads from beside it aren’t there and the page may look unstyled. Open it in a browser from its folder to see it whole.</p>'
+    }
+  }
+  return h
+}

package/ui/icons.js

@@ -57,6 +57,7 @@ export const ICONS = {
   "layers": "<path d=\"M12.83 2.18a2 2 0 0 0-1.66 0L2.6 6.08a1 1 0 0 0 0 1.83l8.58 3.91a2 2 0 0 0 1.66 0l8.58-3.9a1 1 0 0 0 0-1.83z\"/> <path d=\"M2 12a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 12\"/> <path d=\"M2 17a1 1 0 0 0 .58.91l8.6 3.91a2 2 0 0 0 1.65 0l8.58-3.9A1 1 0 0 0 22 17\"/>",
   "bot": "<path d=\"M12 8V4H8\"/> <rect width=\"16\" height=\"12\" x=\"4\" y=\"8\" rx=\"2\"/> <path d=\"M2 14h2\"/> <path d=\"M20 14h2\"/> <path d=\"M15 13v2\"/> <path d=\"M9 13v2\"/>",
   "smartphone": "<rect width=\"14\" height=\"20\" x=\"5\" y=\"2\" rx=\"2\" ry=\"2\"/> <path d=\"M12 18h.01\"/>",
+  "globe": "<circle cx=\"12\" cy=\"12\" r=\"10\"/> <path d=\"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20\"/> <path d=\"M2 12h20\"/>",
   "shield": "<path d=\"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z\"/>",
   "info": "<circle cx=\"12\" cy=\"12\" r=\"10\"/> <path d=\"M12 16v-4\"/> <path d=\"M12 8h.01\"/>",
   "chevron-right": "<path d=\"m9 18 6-6-6-6\"/>",

package/ui/live-status.js

@@ -44,17 +44,83 @@ function resetWords(raw) {
   const m = raw.match(/\bresets?\s+(?:at\s+)?([^·|\n.]{1,40})/i) // "You've hit your limit · resets 7am (America/Chicago)"
   return m ? 'resets ' + ago(m[1]).replace(/\s*\(.*$/, '') : ''
 }
+// Claude Code 2.1.318 prints one stderr line from 10 days before a stored
+// claude.ai sign-in ends (text output only; read from its own code). It is a
+// notice, not why anything failed, and its "claude auth login" would read as
+// "signed out": every classifier drops it first. Its three wordings, exactly:
+//   Warning: this sign-in ends between <d> and <d> (in N day(s) at the earliest). Renewing it does not move those dates. Run claude auth login before then, or use claude setup-token for unattended jobs.
+//   Warning: this sign-in can end at any time from now until <d>. Renewing it does not move that date. Run claude auth login now, or use claude setup-token for unattended jobs.
+//   Warning: this sign-in may have ended between <d> and <d>. If requests are refused, run claude auth login, or use claude setup-token for unattended jobs.
+const SIGNIN_WARNING_RE = /^[ \t]*Warning: this sign-in (?:ends between [^\n]*? at the earliest\)\. Renewing it does not move those dates\.|can end at any time from now until [^\n]*?\. Renewing it does not move that date\.|may have ended between [^\n]*?\. If requests are refused,) run claude auth login[^\n]*? or use claude setup-token for unattended jobs\.[ \t]*(?:\r?\n|$)/gim
+export function dropSignInWarning(text) { return String(text == null ? '' : text).replace(SIGNIN_WARNING_RE, '') }
+
+// Claude Code's own "signed out" lines, matched specifically, so an MCP server's
+// or another tool's "failed to authenticate", or a 10-day warning whose words
+// drifted from the three above, never reads as signed out. 2.1.318 (read from
+// its package; test/fixtures/cc-2.1.318/from-package.json signedOut):
+//   Failed to authenticate: this login reached its time limit … / OAuth session expired …
+//   Login reached its time limit · Please run /login
+// plus the API's own authentication_error. Each line is checked on its own, past
+// a "claude -p exited N:" / "claude -p:" prefix (how Ask and the summarizer
+// report it), and a line starting "Warning: this sign-in" is never one.
+export function signInLines(text) {
+  return String(text == null ? '' : text).split('\n').filter((l) => !/^\s*Warning: this sign-in\b/i.test(l)).map((l) => l.replace(/^\s*claude -p\b[^:\n]{0,40}:\s*/i, '')).join('\n')
+}
+// 2026-11-05: a line that names an MCP server or another tool is that tool's failure, never Claude signed
+// out, whatever its words ('MCP server "github": HTTP 401 Unauthorized', 'gh: HTTP 401: Requires authentication').
+export const OTHER_TOOL_RE = /\bMCP\b|\bmcp__|\bgh\b|\bgithub\b|\bgitlab\b|\bbitbucket\b|\bjira\b|\bslack\b|\bnpm\b|\bdocker\b|\bcurl\b|\bgit\b|\bplugin\b/i
+const claudeLines = (text) => signInLines(text).split('\n').filter((l) => l.trim() && !OTHER_TOOL_RE.test(l))
+export function claudeAuthFailed(text) {
+  return claudeLines(text).some((l) => /^[ \t]*Failed to authenticate:|login reached its time limit|\bauthentication_error\b/i.test(l))
+}
+// Claude's own API refusing the login: an "API Error: 401 …" / "API Error: 403 …" line, or the API's
+// authentication_error / permission_error JSON, on a line that names no other tool. -> 401 | 403 | null.
+// A bare 401, 403, "unauthorized", "forbidden" or "credentials" anywhere else is someone else's.
+export function claudeApiAuthStatus(text) {
+  for (const l of claudeLines(text)) {
+    if (/\bAPI Error:?\s*401\b|\bauthentication_error\b/i.test(l)) return 401
+    if (/\bAPI Error:?\s*403\b|\bpermission_error\b/i.test(l)) return 403
+  }
+  return null
+}
+// Claude Code's own signed-out words (not tied to a status), line by line, past other tools' lines.
+const CLAUDE_SIGNED_OUT_RE = /invalid api key|run \/login|please (?:log|sign) ?in|not (?:logged|signed) in|log ?in again|login required|oauth token|token (?:has )?expired/i
+export function claudeSignedOut(text) {
+  return claudeAuthFailed(text) || claudeApiAuthStatus(text) === 401 || claudeLines(text).some((l) => CLAUDE_SIGNED_OUT_RE.test(l))
+}
+
+// 2.1.318: claude -p refuses to start on an invalid config file (it no longer
+// resets it): "Configuration error in <file>: <why>" / "Claude configuration
+// file at <file> is corrupted" / "Fix the JSON in <file>, or move the file aside".
+// -> the file (home shown as ~ when given), or '' when named nowhere, or null.
+// The path runs to the ".json" that ends it (":", ",", ";", ")", " is corrupted", a
+// sentence's "." , " (" or the line's end), so a folder with a space ("/Users/a b/.claude.json")
+// is kept whole and drifted wording ("….json.", "….json (line 3)", "….json; fix it") still reads.
+const CONFIG_BAD_RE = /(?:Configuration error in|Claude configuration file at|Fix the JSON in) ([^\n]*?\.json)(?=[:,;)]| is corrupted|\.(?:[ \t]|$)|[ \t]+\(|[ \t]*$)/im
+export function claudeConfigError(text, home = '') {
+  const m = CONFIG_BAD_RE.exec(String(text == null ? '' : text))
+  if (!m) return null
+  const f = m[1]
+  return home && f.startsWith(home + '/') ? '~' + f.slice(home.length) : f
+}
+
 export function turnErrorWhy(raw0, { subtype = null, code = null, signal = null, endReason = null } = {}) {
-  const raw = ago(raw0).slice(0, WHY_RAW_MAX)
+  const raw = ago(dropSignInWarning(raw0)).slice(0, WHY_RAW_MAX)
   const w = (label) => ({ label, raw: raw || null })
   if (raw && /^\[?Request interrupted by user/i.test(raw)) return null
   if (!raw && endReason === 'aborted') return null
+  const cfg = claudeConfigError(raw)
+  if (cfg != null) return w('Claude Code’s config file is invalid · fix the JSON in ' + (cfg || '~/.claude.json') + ', or move it aside')
   if (/usage limit|hit your (usage )?limit|limit reached|out of (extra )?usage|weekly limit|session limit/i.test(raw)) { const r = resetWords(raw); return w('Claude’s usage limit is reached' + (r ? ' · ' + r : '')) }
   if (/rate[ _-]?limit|\b429\b|too many requests/i.test(raw)) return w('Claude is rate limited right now · try again in a minute')
   if (/prompt is too long|context (length|window)|too many tokens|maximum context|input is too long/i.test(raw)) return w('The conversation is too long for Claude · run /compact in its terminal, then retry')
   if (/overloaded|\b529\b/i.test(raw)) return w('Claude’s servers are overloaded · try again in a minute')
   if (/credit balance|billing|payment required|\b402\b/i.test(raw)) return w('Claude’s account is out of credit')
-  if (/invalid api key|run \/login|please (log|sign) ?in|not logged in|oauth token|token (has )?expired|authentication|\b401\b|\b403\b|unauthori[sz]ed|forbidden/i.test(raw)) return w(SIGNED_OUT_LABEL)
+  // 2.1.318's own signed-out lines (claudeAuthFailed), never a bare "authenticat" or
+  // "claude auth login": an MCP server's auth failure or the 10-day warning isn't a sign-out
+  const auth = signInLines(dropSignInWarning(raw0)) // by line, before raw's newlines are folded
+  // 2026-11-05: a 401 / 403 counts only from Claude's own API error, never another tool's line (claudeApiAuthStatus)
+  if (claudeSignedOut(auth) || claudeApiAuthStatus(auth) === 403) return w(SIGNED_OUT_LABEL)
   if (/timed? ?out|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed|network|socket hang up|connection (error|refused|reset)/i.test(raw)) return w('Claude couldn’t reach its servers · check this Mac’s connection')
   if (/no conversation found|session .*not found/i.test(raw)) return w('Claude Code couldn’t reopen this conversation')
   const api = raw.match(/API Error:?\s*(\d{3})?/i)