@mattstack/rt-client 0.27.0 → 0.29.0

package/dist/commands.d.ts

@@ -27,6 +27,17 @@ export interface ProjectMRsScope {
         daemon or before the first sweep that demanded a section. */
     knownSections?: string[];
 }
+/** Classified cause of a repo's failing project sync (lib/daemon/project-sync-health.ts). */
+export type ProjectSyncErrorKind = "rate-limited" | "auth" | "server-error" | "timeout" | "other";
+/** A repo's current unbroken run of failed project syncs. */
+export interface ProjectSyncError {
+    /** First failure of the run; later failures leave it alone. */
+    since: number;
+    lastAt: number;
+    kind: ProjectSyncErrorKind;
+    /** Raw error text, capped at 200 chars. */
+    message: string;
+}
 export interface ProjectMRsData {
     mrs: Record<string, {
         pr: PullRequest;
@@ -37,6 +48,8 @@ export interface ProjectMRsData {
     source: "poll" | "events" | "mutation";
     syncedAt: number;
     scope?: ProjectMRsScope;
+    /** Present while this repo's most recent project sync failed. */
+    syncError?: ProjectSyncError;
 }
 export interface DiscussionsData {
     discussions: Discussion[];
@@ -247,7 +260,11 @@ export interface HerdStatusData {
         sessionDead: boolean | null;
         lastGateStatus: GateStatus | null;
         lastGateDelivery: "delivered" | "dead-pane" | "confirmed" | "stuck" | null;
-        lastGateConsumed: boolean | null;
+        lastGateConsumed: boolean | null; /** The daemon watchdog's escalation ladder for this job: strikes so far and when it last acted. Absent when the job is not on the ladder (healthy, no watchdog wired, or the daemon restarted since). */
+        watchdog?: {
+            strikes: number;
+            lastPokeAt: number | null;
+        };
     }>;
     unread: number;
     lifecycleConnected: boolean;
@@ -486,6 +503,10 @@ export interface ReconcilerStatus {
     herdrReachable: boolean;
     executors: ExecutorView[];
 }
+/** What a claude spawn's folder-trust check established, when one ran:
+    `none` = no dialog was up, `accepted` = one was answered, `stuck` = one is
+    still up and needs a human, `unchecked` = nothing could be established. */
+export type TrustOutcome = "none" | "accepted" | "stuck" | "unchecked";
 export interface AgentRecord {
     id: string;
     repo: string;
@@ -683,10 +704,14 @@ export interface WorktreeProvisionData {
     branchState: "new" | "tracking-remote" | "existing-clean" | "diverged" | "behind";
     readyFailed?: true;
     failedStep?: string;
+    /** Set only when the tree was built by hydrating from the repo's golden donor, not the on-deck pool or a cold create. */
+    hydratedFrom?: string;
 }
 export interface WorktreeCreateData {
     tree: string;
     path: string;
+    /** Set only for `--on-deck`, and only when that tree hydrated from the golden rather than cold-creating. */
+    hydratedFrom?: string;
 }
 export interface WorktreeDisposeData {
     disposed: string[];
@@ -779,6 +804,28 @@ export interface DiscussionsDiffsData {
     truncated: boolean;
 }
 export type MRActionName = "merge" | "rebase" | "approve" | "unapprove" | "setAutoMerge" | "cancelAutoMerge" | "retryJob" | "retryPipeline" | "toggleDraft" | "requestReReview";
+/** One worktree's git badge as the daemon sweep computed it. All timestamps ISO 8601. */
+export interface GitWorktreeBadge {
+    worktree: string;
+    branch: string | null;
+    detached: boolean;
+    staged: number;
+    unstaged: number;
+    untracked: number;
+    conflicted: number;
+    clean: boolean;
+    ahead: number | null;
+    behind: number | null;
+    upstream: string | null;
+    lastFetchedAt: string | null;
+    updatedAt: string;
+}
+/** repo is the serialized identity (the repo-index key). error is set when the last sweep could not read the repo; stale worktrees may accompany it. */
+export interface RepoStatusRow {
+    repo: string;
+    worktrees: GitWorktreeBadge[];
+    error: string | null;
+}
 export interface Commands {
     "project-mrs:read": {
         payload: {
@@ -1160,9 +1207,12 @@ export interface Commands {
             handle?: string;
             bg?: boolean;
             subject?: string;
-            yolo?: boolean;
+            yolo?: boolean; /** How long the folder-trust check lets the dialog paint before reading the screen; interactive launches keep the short default, herd:spawn passes its own longer budget. */
+            trustWaitMs?: number;
+        };
+        data: AgentRecord & {
+            trust?: TrustOutcome;
         };
-        data: AgentRecord;
     };
     "agent:resume": {
         payload: {
@@ -1445,6 +1495,15 @@ export interface Commands {
         };
         data: unknown;
     };
+    "repos:status": {
+        payload: {
+            refresh?: boolean;
+        };
+        data: {
+            repos: RepoStatusRow[];
+            sweptAt: string | null;
+        };
+    };
     "freshness:reconcile": {
         payload: Record<string, never>;
         data: unknown;
@@ -1513,13 +1572,23 @@ export interface Commands {
         /** `contextOmitted` appears only when the gate context plus every
             question's `context` exceeded their shared 8192-byte budget: the
             gate still opened, but question contexts were dropped, and the gate
-            context too when it was over the budget on its own. */
+            context too when it was over the budget on its own.
+            `formCapExceeded`/`formCapAdvisory` appear only when the pane could
+            have presented an in-pane form and one or more questions exceeded
+            its 4-option cap, which is the one thing that forced this gate to
+            `wait`: the gate still opens, and the advisory names the structural
+            fix so the caller can re-author. */
         data: {
             id: string;
             presentation: "form" | "wait";
             subject: string;
             supersededId: string | null;
             contextOmitted?: true;
+            formCapExceeded?: Array<{
+                question: string;
+                options: number;
+            }>;
+            formCapAdvisory?: string;
         };
     };
     /**
@@ -1634,6 +1703,7 @@ export interface Commands {
             repo: string;
             session: string;
             hidden?: boolean;
+            callerPane?: string;
         };
         data: {
             herd: string;
@@ -1648,6 +1718,7 @@ export interface Commands {
         payload: {
             herd: string;
             session: string;
+            callerPane?: string;
         };
         data: {
             subscription: string;

package/dist/gate.js

@@ -99,12 +99,12 @@ function gatePresentation(args) {
   return args.questions.every((q) => q.options.length <= GATE_FORM_OPTION_CAP) ? "form" : "wait";
 }
 export {
-  validateGateAnswers,
-  unwrapGateAnswerValue,
-  normalizeGateQuestions,
-  normalizeGateOptions,
-  gatePresentation,
-  gateOptionValue,
+  GATE_FORM_OPTION_CAP,
   gateOptionLabel,
-  GATE_FORM_OPTION_CAP
+  gateOptionValue,
+  gatePresentation,
+  normalizeGateOptions,
+  normalizeGateQuestions,
+  unwrapGateAnswerValue,
+  validateGateAnswers
 };

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { normalizeGateOptions, normalizeGateQuestions } from "./gate-options.ts"
 export type { GateOptionObject } from "./gate-options.ts";
 export { unwrapGateAnswerValue, validateGateAnswers } from "./gate-answers.ts";
 export type { GateAnswerWire } from "./gate-answers.ts";
-export type { Discussion, DemandDecl, ProjectMRsScope, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, BranchEnrichment, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, ChatClaimOutcome, RoomSummary, BuddyStatus, PresenceRow, AgentRecord, AgentSurface, AgentStatus, ExecutorState, ExecutorView, ReconcilerStatus, ChatPane, PaneAccount, PaneDirectory, InviteResult, PaneDelivery, PaneSendResult, PaneFocusResult, GateStatus, GateOption, GateOrigin, GateQuestion, GateAnswer, GateRow, GateSubscription, HerdInfo, HerdListRow, HerdJobInfo, HerdStatusData, } from "./commands.ts";
+export type { Discussion, DemandDecl, ProjectMRsScope, ProjectSyncError, ProjectSyncErrorKind, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, BranchEnrichment, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, ChatClaimOutcome, RoomSummary, BuddyStatus, PresenceRow, AgentRecord, AgentSurface, AgentStatus, ExecutorState, ExecutorView, ReconcilerStatus, ChatPane, PaneAccount, PaneDirectory, InviteResult, PaneDelivery, PaneSendResult, PaneFocusResult, GateStatus, GateOption, GateOrigin, GateQuestion, GateAnswer, GateRow, GateSubscription, HerdInfo, HerdListRow, HerdJobInfo, HerdStatusData, } from "./commands.ts";
 export { subscribe, createRelay, DEFAULT_WS_URL } from "./relay.ts";
 export type { RelayEventType } from "./relay.ts";
 export { daemonHealth } from "./health.ts";

package/dist/index.js

@@ -382,6 +382,8 @@ function herdStart(a, o = {}) {
   const payload = { name: a.name, repo: a.repo, session: a.session };
   if (a.hidden !== undefined)
     payload.hidden = a.hidden;
+  if (a.callerPane !== undefined)
+    payload.callerPane = a.callerPane;
   return rtCommand("herd:start", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 60000 });
 }
 function herdSpawn(a, o = {}) {
@@ -425,7 +427,10 @@ function herdList(a = {}, o = {}) {
   return rtCommand("herd:list", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function herdResume(a, o = {}) {
-  return rtCommand("herd:resume", { herd: a.herd, session: a.session }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
+  const payload = { herd: a.herd, session: a.session };
+  if (a.callerPane !== undefined)
+    payload.callerPane = a.callerPane;
+  return rtCommand("herd:resume", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 1e4 });
 }
 function herdClose(a, o = {}) {
   return rtCommand("herd:close", { herd: a.herd, job: a.job }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 30000 });
@@ -577,6 +582,7 @@ var COMMAND_NAMES = [
   "endpoint:release",
   "endpoint:status",
   "repos:locate",
+  "repos:status",
   "freshness:reconcile",
   "reconciler:status",
   "reconciler:clear",
@@ -1115,6 +1121,16 @@ var REGISTRY = [
     migrated: true,
     description: "Age floor in days for the log janitor pruning every surface's rotated log files under ~/.mattstack/rt/logs (default 14). A fresh key, not an ownership-latch port, so a default is fine here."
   },
+  {
+    key: "rt.gitStatus",
+    type: "object",
+    scopes: ALL_SCOPES,
+    default: { sweep: true, sweepIntervalSec: 300, fetchIntervalSec: 900 },
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Mission-control git badge sweep. sweep gates the daemon sweep and fetchIntervalSec (the background fetch cadence, 0 disables fetching) are both read per repo, so a per-repo override of either takes effect (a repo override of { sweep: false } opts that repo out). sweepIntervalSec, the minimum seconds between sweeps, is read only from the global config by the sweep tick; a per-repo override of sweepIntervalSec has no effect."
+  },
   {
     key: "rt.logLevel",
     type: "string",
@@ -1605,6 +1621,86 @@ var REGISTRY = [
     default: 10,
     merge: "replace",
     description: `Minutes an open herd-owned gate waits before the escalation sweep surfaces it to the human (topic gate/escalated/<id>). Fires on either trigger: the TTL elapses (reason "ttl"), or the owning herd's shepherd subscription is gone or dead before the TTL (reason "owner-dead"). 0 escalates any eligible gate on the first sweep after it opens. A fresh key, not an ownership-latch port, so a default is fine here.`
+  },
+  {
+    key: "herd.watchdog.enabled",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Turns the herd watchdog sweep on."
+  },
+  {
+    key: "herd.watchdog.fastMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 2,
+    merge: "replace",
+    description: "Idle minutes before a worker with a pending DM, mention, or answered gate is poked."
+  },
+  {
+    key: "herd.watchdog.shepherdFastMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 5,
+    merge: "replace",
+    description: "Minutes an open human-owned gate in the herd may stay unanswered before the shepherd is poked. Unread DMs and mentions for the shepherd wedge immediately and are not delayed by this key."
+  },
+  {
+    key: "herd.watchdog.backstopMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 15,
+    merge: "replace",
+    description: "Idle minutes before any non-gated active worker is poked."
+  },
+  {
+    key: "herd.watchdog.retryMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 5,
+    merge: "replace",
+    description: "Minutes between escalation strikes while the watchdog keeps poking an unresponsive worker."
+  },
+  {
+    key: "herd.watchdog.notifyQuietMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 30,
+    merge: "replace",
+    description: "Minimum minutes between macOS notifications for the same herd."
+  },
+  {
+    key: "herd.watchdog.nagMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 30,
+    merge: "replace",
+    description: "Minutes a done job may hold its pane before the shepherd is nagged to reclaim it."
+  },
+  {
+    key: "herd.watchdog.notifyHuman",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Whether the watchdog's top escalation rung sends a macOS notification to the human."
+  },
+  {
+    key: "herd.watchdog.midRunTrustAccept",
+    type: "boolean",
+    scopes: ["machine"],
+    default: false,
+    merge: "replace",
+    description: "Whether the watchdog may drive a mid-run folder-trust dialog on a daemon-provisioned tree itself, rather than only parking the job and notifying (RT-196). Off by default: the screen match cannot yet confirm the dialog's folder matches the job's worktree, so a working session showing an unrelated permission prompt with the same shape is a real risk."
+  },
+  {
+    key: "panes.relocationAutoAccept",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Whether the daemon may answer Claude Code's EnterWorktree permission-root relocation prompt on a blocked pane by itself (RT-200). Unlike the trust dialog, the prompt names the worktree path in its own body, and the daemon accepts only when that exact path is in rt's worktree registry, so this is on by default. Read by both the herd watchdog and the executor reconciler."
   }
 ];
 
@@ -1779,11 +1875,11 @@ function expandString(input, ctx) {
     return match;
   });
 }
-function teamPath(teamsDir2, name) {
+function teamPath(teamsDir, name) {
   if (name.includes("/") || name.includes("\\") || name.includes("..")) {
     throw new Error(`rt: cannot expand \${team:${name}} — a team name must be a single directory segment (no "/", "\\" or "..")`);
   }
-  return join6(teamsDir2, name);
+  return join6(teamsDir, name);
 }
 function required(value, name, needs) {
   if (value === undefined || value === "") {
@@ -2448,122 +2544,122 @@ async function resolveNameToIdentity(name, reposJsonPath) {
   }
 }
 export {
-  validateValue,
-  validateGateAnswers,
-  unwrapGateAnswerValue,
-  unsetSetting,
-  subscribe,
-  setSettingsWarnSink,
-  setSetting,
-  serializeIdentity,
-  rtCommand,
-  resolveNameToIdentity,
-  resolveForgeToken,
-  repoNameForPath,
-  reconcilerStatus,
-  reconcilerClear,
-  readStore,
-  readProjectMRs,
-  readMrsByBranch,
-  readDiscussions,
-  readBranchCache,
-  parsePaneRef,
-  parseIdentity,
-  paneSpawn,
-  paneSend,
-  panePeek,
-  paneList,
-  paneFocus,
-  paneDirectories,
-  paneAccounts,
-  openSmartPane,
-  normalizeRemote,
-  normalizeGateQuestions,
-  normalizeGateOptions,
-  listTeams,
-  listSettings,
-  listRuns,
-  isMigrated,
-  identityFromRemote,
-  herdWrapUp,
-  herdStopHidden,
-  herdStatus,
-  herdStart,
-  herdSpawn,
-  herdResume,
-  herdReport,
-  herdMilestone,
-  herdList,
-  herdGates,
-  herdClose,
-  herdAttend,
-  herdAsk,
-  herdAnswer,
-  guardTestDaemonEnv,
-  getSetting,
-  getRun,
-  getDef,
-  gateWait,
-  gateUnsubscribe,
-  gateSubscriptions,
-  gateSubscribe,
-  gatePresentation,
-  gatePark,
-  gateOptionValue,
-  gateOptionLabel,
-  gateOpen,
-  gateList,
-  gateClose,
-  gateAsk,
-  gateAnswer,
-  formatPaneRef,
-  explainSetting,
-  expandVariables,
-  eventsWait,
-  eventsList,
-  eventsHead,
-  eventsEmit,
-  deriveRepoIdentity,
-  decidePlacement,
-  daemonHealth,
-  createRelay,
-  clearIdentityMemo,
-  chatWho,
-  chatSignOut,
-  chatSignIn,
-  chatRooms,
-  chatRelease,
-  chatRead,
-  chatPost,
-  chatMessages,
-  chatMark,
-  chatLeave,
-  chatJoin,
-  chatInvite,
-  chatDmOpen,
-  chatDm,
-  chatClaim,
-  chatBuddies,
-  chatBack,
-  chatAway,
-  chatArchive,
-  chatAck,
-  bgStop,
-  bgStatus,
-  bgRelease,
-  bgEnsure,
-  allDefs,
-  agentStart,
-  agentResume,
-  agentList,
-  agentGet,
-  abandonRun,
-  SCOPE_ORDER,
-  REGISTRY,
-  GATE_FORM_OPTION_CAP,
-  GATE_BY_PANE,
-  DEFAULT_WS_URL,
-  DEFAULT_SOCK,
+  BG_PREFIX,
   COMMAND_NAMES,
-  BG_PREFIX
+  DEFAULT_SOCK,
+  DEFAULT_WS_URL,
+  GATE_BY_PANE,
+  GATE_FORM_OPTION_CAP,
+  REGISTRY,
+  SCOPE_ORDER,
+  abandonRun,
+  agentGet,
+  agentList,
+  agentResume,
+  agentStart,
+  allDefs,
+  bgEnsure,
+  bgRelease,
+  bgStatus,
+  bgStop,
+  chatAck,
+  chatArchive,
+  chatAway,
+  chatBack,
+  chatBuddies,
+  chatClaim,
+  chatDm,
+  chatDmOpen,
+  chatInvite,
+  chatJoin,
+  chatLeave,
+  chatMark,
+  chatMessages,
+  chatPost,
+  chatRead,
+  chatRelease,
+  chatRooms,
+  chatSignIn,
+  chatSignOut,
+  chatWho,
+  clearIdentityMemo,
+  createRelay,
+  daemonHealth,
+  decidePlacement,
+  deriveRepoIdentity,
+  eventsEmit,
+  eventsHead,
+  eventsList,
+  eventsWait,
+  expandVariables,
+  explainSetting,
+  formatPaneRef,
+  gateAnswer,
+  gateAsk,
+  gateClose,
+  gateList,
+  gateOpen,
+  gateOptionLabel,
+  gateOptionValue,
+  gatePark,
+  gatePresentation,
+  gateSubscribe,
+  gateSubscriptions,
+  gateUnsubscribe,
+  gateWait,
+  getDef,
+  getRun,
+  getSetting,
+  guardTestDaemonEnv,
+  herdAnswer,
+  herdAsk,
+  herdAttend,
+  herdClose,
+  herdGates,
+  herdList,
+  herdMilestone,
+  herdReport,
+  herdResume,
+  herdSpawn,
+  herdStart,
+  herdStatus,
+  herdStopHidden,
+  herdWrapUp,
+  identityFromRemote,
+  isMigrated,
+  listRuns,
+  listSettings,
+  listTeams,
+  normalizeGateOptions,
+  normalizeGateQuestions,
+  normalizeRemote,
+  openSmartPane,
+  paneAccounts,
+  paneDirectories,
+  paneFocus,
+  paneList,
+  panePeek,
+  paneSend,
+  paneSpawn,
+  parseIdentity,
+  parsePaneRef,
+  readBranchCache,
+  readDiscussions,
+  readMrsByBranch,
+  readProjectMRs,
+  readStore,
+  reconcilerClear,
+  reconcilerStatus,
+  repoNameForPath,
+  resolveForgeToken,
+  resolveNameToIdentity,
+  rtCommand,
+  serializeIdentity,
+  setSetting,
+  setSettingsWarnSink,
+  subscribe,
+  unsetSetting,
+  unwrapGateAnswerValue,
+  validateGateAnswers,
+  validateValue
 };

package/dist/settings/identity-codec.js

@@ -47,7 +47,7 @@ function normalizeRemote(remote) {
   return `${host.toLowerCase()}/${normalizedPath}`;
 }
 export {
-  serializeIdentity,
+  normalizeRemote,
   parseIdentity,
-  normalizeRemote
+  serializeIdentity
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mattstack/rt-client",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "type": "module",
   "exports": {
     ".": {

package/src/client.ts

@@ -561,6 +561,7 @@ export function herdStart(
 ): Promise<RtResponse<Commands["herd:start"]["data"]>> {
   const payload: Record<string, unknown> = { name: a.name, repo: a.repo, session: a.session };
   if (a.hidden !== undefined) payload.hidden = a.hidden;
+  if (a.callerPane !== undefined) payload.callerPane = a.callerPane;
   return rtCommand<Commands["herd:start"]["data"]>("herd:start", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 60_000 });
 }
 
@@ -635,7 +636,9 @@ export function herdResume(
   a: Commands["herd:resume"]["payload"],
   o: RtClientOptions = {},
 ): Promise<RtResponse<Commands["herd:resume"]["data"]>> {
-  return rtCommand<Commands["herd:resume"]["data"]>("herd:resume", { herd: a.herd, session: a.session }, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
+  const payload: Record<string, unknown> = { herd: a.herd, session: a.session };
+  if (a.callerPane !== undefined) payload.callerPane = a.callerPane;
+  return rtCommand<Commands["herd:resume"]["data"]>("herd:resume", payload, { sockPath: o.sockPath, timeoutMs: o.timeoutMs ?? 10_000 });
 }
 
 /** Closes a herdr pane, one CLI call under the runner's own 15s budget. */

package/src/commands.ts

@@ -31,12 +31,27 @@ export interface ProjectMRsScope {
   knownSections?: string[];
 }
 
+/** Classified cause of a repo's failing project sync (lib/daemon/project-sync-health.ts). */
+export type ProjectSyncErrorKind = "rate-limited" | "auth" | "server-error" | "timeout" | "other";
+
+/** A repo's current unbroken run of failed project syncs. */
+export interface ProjectSyncError {
+  /** First failure of the run; later failures leave it alone. */
+  since: number;
+  lastAt: number;
+  kind: ProjectSyncErrorKind;
+  /** Raw error text, capped at 200 chars. */
+  message: string;
+}
+
 export interface ProjectMRsData {
   mrs: Record<string, { pr: PullRequest; fetchedAt: number; codeownerSections?: string[] }>;
   listSyncedAt: number;
   source: "poll" | "events" | "mutation";
   syncedAt: number;
   scope?: ProjectMRsScope;
+  /** Present while this repo's most recent project sync failed. */
+  syncError?: ProjectSyncError;
 }
 
 export interface DiscussionsData {
@@ -171,7 +186,7 @@ export interface HerdJobInfo { herd: string; name: string; worktree: string; bra
 /** `lastGateStatus`/`lastGateDelivery` come from the job's `lastGate` row: a TERMINAL gate (answered or closed) whose delivery is `dead-pane` is the "worker not woken" case the shepherd must act on. `lastGateConsumed` is `null` when there is nothing to consume (no last gate, not answered, or not nudged), and otherwise reports whether the nudged pane has read its answer. */
 export interface HerdStatusData {
   herd: HerdInfo;
-  jobs: Array<HerdJobInfo & { openGate: string | null; paneStatus: string | null; /** The worker session behind this job's pane is gone while the job still reads in-flight: herdr lists the pane but no claude is on it. Null when herdr does not list the pane at all (it closed, or herdr is unreachable), which proves nothing either way. */ sessionDead: boolean | null; lastGateStatus: GateStatus | null; lastGateDelivery: "delivered" | "dead-pane" | "confirmed" | "stuck" | null; lastGateConsumed: boolean | null }>;
+  jobs: Array<HerdJobInfo & { openGate: string | null; paneStatus: string | null; /** The worker session behind this job's pane is gone while the job still reads in-flight: herdr lists the pane but no claude is on it. Null when herdr does not list the pane at all (it closed, or herdr is unreachable), which proves nothing either way. */ sessionDead: boolean | null; lastGateStatus: GateStatus | null; lastGateDelivery: "delivered" | "dead-pane" | "confirmed" | "stuck" | null; lastGateConsumed: boolean | null; /** The daemon watchdog's escalation ladder for this job: strikes so far and when it last acted. Absent when the job is not on the ladder (healthy, no watchdog wired, or the daemon restarted since). */ watchdog?: { strikes: number; lastPokeAt: number | null } }>;
   unread: number;
   lifecycleConnected: boolean;
   hiddenUp: boolean | null;
@@ -349,6 +364,11 @@ export interface ReconcilerStatus {
   executors: ExecutorView[];
 }
 
+/** What a claude spawn's folder-trust check established, when one ran:
+    `none` = no dialog was up, `accepted` = one was answered, `stuck` = one is
+    still up and needs a human, `unchecked` = nothing could be established. */
+export type TrustOutcome = "none" | "accepted" | "stuck" | "unchecked";
+
 export interface AgentRecord {
   id: string; repo: string; cwd: string; provider: string;
   surface: AgentSurface; sessionId: string;
@@ -459,8 +479,14 @@ export interface WorktreeProvisionData {
   tree: string; path: string; branch: string; wasOnDeck: boolean;
   readyAt: string | null; branchState: "new" | "tracking-remote" | "existing-clean" | "diverged" | "behind";
   readyFailed?: true; failedStep?: string;
+  /** Set only when the tree was built by hydrating from the repo's golden donor, not the on-deck pool or a cold create. */
+  hydratedFrom?: string;
+}
+export interface WorktreeCreateData {
+  tree: string; path: string;
+  /** Set only for `--on-deck`, and only when that tree hydrated from the golden rather than cold-creating. */
+  hydratedFrom?: string;
 }
-export interface WorktreeCreateData { tree: string; path: string }
 export interface WorktreeDisposeData {
   disposed: string[];
   /** `detail` is set only for a refusal whose bare `reason` code can't name
@@ -500,6 +526,30 @@ export type MRActionName =
   | "retryJob" | "retryPipeline"
   | "toggleDraft" | "requestReReview";
 
+/** One worktree's git badge as the daemon sweep computed it. All timestamps ISO 8601. */
+export interface GitWorktreeBadge {
+  worktree: string;
+  branch: string | null;
+  detached: boolean;
+  staged: number;
+  unstaged: number;
+  untracked: number;
+  conflicted: number;
+  clean: boolean;
+  ahead: number | null;
+  behind: number | null;
+  upstream: string | null;
+  lastFetchedAt: string | null;
+  updatedAt: string;
+}
+
+/** repo is the serialized identity (the repo-index key). error is set when the last sweep could not read the repo; stale worktrees may accompany it. */
+export interface RepoStatusRow {
+  repo: string;
+  worktrees: GitWorktreeBadge[];
+  error: string | null;
+}
+
 export interface Commands {
   "project-mrs:read": { payload: { repoName: string; maxAgeMs?: number; demand?: DemandDecl }; data: ProjectMRsData };
   "discussions:read": { payload: { repoName: string; iid: number }; data: DiscussionsData };
@@ -618,7 +668,7 @@ export interface Commands {
   "chat:dm-open": { payload: { from: string; to: string; sessionId?: string }; data: { room: string; created: boolean } };
 
   // ─── Agent handoff (rt agent) ────────────────────────────────────────────
-  "agent:start": { payload: { repo: string; cwd: string; prompt?: string; surface?: AgentSurface; provider?: string; model?: string; effort?: string; account?: string; label?: string; caller?: string; workspace?: string; tab?: string; extraArgs?: string; env?: Record<string, string>; herdrSocket?: string; handle?: string; bg?: boolean; subject?: string; yolo?: boolean }; data: AgentRecord };
+  "agent:start": { payload: { repo: string; cwd: string; prompt?: string; surface?: AgentSurface; provider?: string; model?: string; effort?: string; account?: string; label?: string; caller?: string; workspace?: string; tab?: string; extraArgs?: string; env?: Record<string, string>; herdrSocket?: string; handle?: string; bg?: boolean; subject?: string; yolo?: boolean; /** How long the folder-trust check lets the dialog paint before reading the screen; interactive launches keep the short default, herd:spawn passes its own longer budget. */ trustWaitMs?: number }; data: AgentRecord & { trust?: TrustOutcome } };
   "agent:resume": { payload: { id: string; prompt?: string; surface?: AgentSurface; workspace?: string; tab?: string }; data: AgentRecord };
   "agent:get": { payload: { id: string }; data: AgentRecord };
   "agent:list": { payload: { repo?: string }; data: { agents: AgentRecord[] } };
@@ -679,6 +729,7 @@ export interface Commands {
   "endpoint:status": { payload: { repo?: string }; data: EndpointStatusData };
 
   "repos:locate": { payload: { newPath: string; repo?: string; dryRun?: boolean }; data: unknown };
+  "repos:status": { payload: { refresh?: boolean }; data: { repos: RepoStatusRow[]; sweptAt: string | null } };
   "freshness:reconcile": { payload: Record<string, never>; data: unknown };
 
   // ─── Reconciler (executor state; lib/daemon/reconciler.ts) ───────────────
@@ -716,8 +767,17 @@ export interface Commands {
     /** `contextOmitted` appears only when the gate context plus every
         question's `context` exceeded their shared 8192-byte budget: the
         gate still opened, but question contexts were dropped, and the gate
-        context too when it was over the budget on its own. */
-    data: { id: string; presentation: "form" | "wait"; subject: string; supersededId: string | null; contextOmitted?: true };
+        context too when it was over the budget on its own.
+        `formCapExceeded`/`formCapAdvisory` appear only when the pane could
+        have presented an in-pane form and one or more questions exceeded
+        its 4-option cap, which is the one thing that forced this gate to
+        `wait`: the gate still opens, and the advisory names the structural
+        fix so the caller can re-author. */
+    data: {
+      id: string; presentation: "form" | "wait"; subject: string; supersededId: string | null; contextOmitted?: true;
+      formCapExceeded?: Array<{ question: string; options: number }>;
+      formCapAdvisory?: string;
+    };
   };
   /**
    * A CAS loss is a DEFINED OUTCOME, not an error: `ok:true` with
@@ -751,8 +811,8 @@ export interface Commands {
   "gate:subscriptions": { payload: { session?: string; live?: boolean }; data: { subscriptions: GateSubscription[] } };
 
   // ─── Herd (shepherd run registry) ────────────────────────────────────────
-  "herd:start":  { payload: { name: string; repo: string; session: string; hidden?: boolean }; data: { herd: string; room: string; workspace: string; subscription: string; handle: string; hidden: boolean } };
-  "herd:resume": { payload: { herd: string; session: string }; data: { subscription: string; gates: GateRow[]; unread: number; status: HerdStatusData; handle: string } };
+  "herd:start":  { payload: { name: string; repo: string; session: string; hidden?: boolean; callerPane?: string }; data: { herd: string; room: string; workspace: string; subscription: string; handle: string; hidden: boolean } };
+  "herd:resume": { payload: { herd: string; session: string; callerPane?: string }; data: { subscription: string; gates: GateRow[]; unread: number; status: HerdStatusData; handle: string } };
   "herd:status": { payload: { herd: string }; data: HerdStatusData };
   /** Active herds only unless `all`, so a shepherd's "which herd am I on" question has one answer. */
   "herd:list":   { payload: { all?: boolean }; data: { herds: HerdListRow[] } };
@@ -870,6 +930,7 @@ export const COMMAND_NAMES: readonly CommandName[] = [
   "endpoint:release",
   "endpoint:status",
   "repos:locate",
+  "repos:status",
   "freshness:reconcile",
   "reconciler:status",
   "reconciler:clear",

package/src/index.ts

@@ -88,6 +88,8 @@ export type {
   Discussion,
   DemandDecl,
   ProjectMRsScope,
+  ProjectSyncError,
+  ProjectSyncErrorKind,
   ProjectMRsData,
   DiscussionsData,
   MrByBranchEntry,

package/src/settings/registry-defs.ts

@@ -222,6 +222,16 @@ export const REGISTRY: readonly SettingDef[] = [
     migrated: true,
     description: "Age floor in days for the log janitor pruning every surface's rotated log files under ~/.mattstack/rt/logs (default 14). A fresh key, not an ownership-latch port, so a default is fine here.",
   },
+  {
+    key: "rt.gitStatus",
+    type: "object",
+    scopes: ALL_SCOPES,
+    default: { sweep: true, sweepIntervalSec: 300, fetchIntervalSec: 900 },
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Mission-control git badge sweep. sweep gates the daemon sweep and fetchIntervalSec (the background fetch cadence, 0 disables fetching) are both read per repo, so a per-repo override of either takes effect (a repo override of { sweep: false } opts that repo out). sweepIntervalSec, the minimum seconds between sweeps, is read only from the global config by the sweep tick; a per-repo override of sweepIntervalSec has no effect.",
+  },
   {
     key: "rt.logLevel",
     type: "string",
@@ -751,4 +761,86 @@ export const REGISTRY: readonly SettingDef[] = [
     merge: "replace",
     description: "Minutes an open herd-owned gate waits before the escalation sweep surfaces it to the human (topic gate/escalated/<id>). Fires on either trigger: the TTL elapses (reason \"ttl\"), or the owning herd's shepherd subscription is gone or dead before the TTL (reason \"owner-dead\"). 0 escalates any eligible gate on the first sweep after it opens. A fresh key, not an ownership-latch port, so a default is fine here.",
   },
+
+  // --- herd (watchdog) ---------------------------------------------------
+  {
+    key: "herd.watchdog.enabled",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Turns the herd watchdog sweep on.",
+  },
+  {
+    key: "herd.watchdog.fastMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 2,
+    merge: "replace",
+    description: "Idle minutes before a worker with a pending DM, mention, or answered gate is poked.",
+  },
+  {
+    key: "herd.watchdog.shepherdFastMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 5,
+    merge: "replace",
+    description: "Minutes an open human-owned gate in the herd may stay unanswered before the shepherd is poked. Unread DMs and mentions for the shepherd wedge immediately and are not delayed by this key.",
+  },
+  {
+    key: "herd.watchdog.backstopMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 15,
+    merge: "replace",
+    description: "Idle minutes before any non-gated active worker is poked.",
+  },
+  {
+    key: "herd.watchdog.retryMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 5,
+    merge: "replace",
+    description: "Minutes between escalation strikes while the watchdog keeps poking an unresponsive worker.",
+  },
+  {
+    key: "herd.watchdog.notifyQuietMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 30,
+    merge: "replace",
+    description: "Minimum minutes between macOS notifications for the same herd.",
+  },
+  {
+    key: "herd.watchdog.nagMins",
+    type: "number",
+    scopes: ["machine"],
+    default: 30,
+    merge: "replace",
+    description: "Minutes a done job may hold its pane before the shepherd is nagged to reclaim it.",
+  },
+  {
+    key: "herd.watchdog.notifyHuman",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Whether the watchdog's top escalation rung sends a macOS notification to the human.",
+  },
+  {
+    key: "herd.watchdog.midRunTrustAccept",
+    type: "boolean",
+    scopes: ["machine"],
+    default: false,
+    merge: "replace",
+    description: "Whether the watchdog may drive a mid-run folder-trust dialog on a daemon-provisioned tree itself, rather than only parking the job and notifying (RT-196). Off by default: the screen match cannot yet confirm the dialog's folder matches the job's worktree, so a working session showing an unrelated permission prompt with the same shape is a real risk.",
+  },
+  {
+    key: "panes.relocationAutoAccept",
+    type: "boolean",
+    scopes: ["machine"],
+    default: true,
+    merge: "replace",
+    description: "Whether the daemon may answer Claude Code's EnterWorktree permission-root relocation prompt on a blocked pane by itself (RT-200). Unlike the trust dialog, the prompt names the worktree path in its own body, and the daemon accepts only when that exact path is in rt's worktree registry, so this is on by default. Read by both the herd watchdog and the executor reconciler.",
+  },
 ];