@mattstack/rt-client 0.4.0 → 0.5.0

package/README.md

@@ -26,6 +26,54 @@ Bun-only: the settings exec path (`src/settings/exec.ts`) shells out via
 `@mattstack/glance` is a peer dependency: rt-client returns glance's forge types
 so merge request shapes stay identical across rt, gitq, and mr-board.
 
+## Repo identity
+
+Every per-repo key in the rt estate is a stable serialized identity, not a
+repo name. Whatever you store per-repo, send to the daemon, or put in a REST
+path is keyed by the wire form this package emits. The one exception:
+settings-store sections (`repos.<identity>`) key on the RAW `host/path` form
+(`RepoIdentity.id` for a remote-kind identity) — the settings resolver never
+sees the wire form, and a serialized key there misses silently.
+
+```text
+remote:gitlab.com%2Facme%2Facme-dev     path:%2FUsers%2Fdev%2Fscratch
+└─┬──┘ └──────────┬─────────────┘
+ kind    the id, encodeURIComponent'd — slash-free, fits one URL segment
+```
+
+`kind` is `remote` (the repo has an origin: id is normalized `host/path`) or
+`path` (no usable remote: id is the main worktree's realpath). The `:` is a
+literal delimiter.
+
+```ts
+import {
+  deriveRepoIdentity,   // (repoPath: string) => Promise<RepoIdentity> — never null
+  serializeIdentity,    // (id: RepoIdentity) => string — the wire form above
+  parseIdentity,        // (wire: string) => RepoIdentity | null — THE validity check
+  identityFromRemote,   // (remoteUrl: string) => RepoIdentity | null — sync
+  type RepoIdentity,    // { kind: "remote" | "path"; id: string }
+} from '@mattstack/rt-client';
+
+const identity = serializeIdentity(await deriveRepoIdentity(repoPath));
+
+await rtCommand(['worktree', 'list', '--repo', identity]);        // daemon key
+const url = `/api/runs/${encodeURIComponent(identity)}/${runId}`; // URL segment
+```
+
+| Do | Don't |
+|---|---|
+| Get identities from these functions, once, at the boundary | Re-derive with your own git calls (`git remote get-url` diverges under `insteadOf`) |
+| Key stores and daemon payloads on the serialized form | Key anything on a folder basename or a remote's last segment |
+| Key settings sections (`repos.<identity>`) on the raw `host/path` id | Put the serialized form in a settings lookup, or the raw form in a daemon payload |
+| `encodeURIComponent(identity)` in URL path segments | Ship the wire form raw in a URL — its `%` signs decode into slashes |
+| Decode for display: `parseIdentity(wire)`, then the id's last path segment (remote) or basename (path) — the returned `id` is already decoded | `decodeURIComponent` the id again, show the wire form to a human, or build a chat handle from it |
+| Treat the `repo` field from `runs:list` as an opaque key, passed back verbatim | Validate or re-derive `runs:*` repo keys — pre-cutover runs keep their original keys |
+
+Repo-keyed daemon verbs accept serialized identities only; a bare repo name
+doesn't error, it resolves empty. `parseIdentity` is strict — only strings
+`serializeIdentity` emitted parse — so validate payloads with it, and never
+hand-assemble or string-split a wire.
+
 ## License
 
 MIT

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import type { RtResponse, RtClientOptions } from "./transport.ts";
-import type { DemandDecl, ProjectMRsData, DiscussionsData, MrByBranchData, ForgeSlug, ForgeTokenData, RunSummary, RunDetail, WakeMode, ChatMember, ChatMessage, RoomSummary } from "./commands.ts";
+import type { DemandDecl, ProjectMRsData, DiscussionsData, MrByBranchData, BranchEnrichment, ForgeSlug, ForgeTokenData, RunSummary, RunDetail, WakeMode, ChatMember, ChatMessage, RoomSummary } from "./commands.ts";
 /**
  * One repo's project open-MR store. A cold repo forces a full paginated sync
  * on the daemon side when maxAgeMs demands it, which can run tens of seconds
@@ -13,6 +13,12 @@ import type { DemandDecl, ProjectMRsData, DiscussionsData, MrByBranchData, Forge
 export declare function readProjectMRs(repoName: string, maxAgeMs?: number, opts?: RtClientOptions, demand?: DemandDecl): Promise<RtResponse<ProjectMRsData>>;
 export declare function readDiscussions(repoName: string, iid: number, opts?: RtClientOptions): Promise<RtResponse<DiscussionsData>>;
 export declare function readMrsByBranch(repoName: string, branches: string[], opts?: RtClientOptions): Promise<RtResponse<MrByBranchData>>;
+/**
+ * Cached ticket/MR enrichment for a set of branches, keyed by branch name
+ * (the cache's own primary key -- see lib/state/branch-cache.ts). Serves
+ * whatever the daemon already has; it does not trigger a fetch.
+ */
+export declare function readBranchCache(branches: string[], opts?: RtClientOptions): Promise<RtResponse<Record<string, BranchEnrichment>>>;
 /**
  * The forge token for one tracked repo (MAT-33). Grant-gated on the daemon
  * side: an untracked repo comes back `ok: false` with the `rt daemon track`

package/dist/commands.d.ts

@@ -10,17 +10,24 @@ export type Discussion = MRDetail["discussions"][number];
 export interface DemandDecl {
     client: string;
     authors: string[];
+    /** Codeowner sections this client needs covered (spec: second demand axis). */
+    codeownerSections?: string[];
     declaredAt: number;
 }
 export interface ProjectMRsScope {
     authors: string[];
     windowDays: number;
     uncovered: string[];
+    /** Effective synced section union; absent from a pre-sections daemon. */
+    sections?: string[];
+    /** Demanded sections not yet swept for this client. */
+    uncoveredSections?: string[];
 }
 export interface ProjectMRsData {
     mrs: Record<string, {
         pr: PullRequest;
         fetchedAt: number;
+        codeownerSections?: string[];
     }>;
     listSyncedAt: number;
     source: "poll" | "events" | "mutation";
@@ -40,6 +47,31 @@ export interface MrByBranchData {
     byBranch: Record<string, MrByBranchEntry | null>;
     syncedAt: number;
 }
+/**
+ * Trimmed, structural view of the daemon's `CacheEntry` (lib/state/branch-cache.ts) --
+ * rt-client cannot import daemon/lib internals, so this names only the fields
+ * console's run-view rows read, spelled exactly as they land on the wire
+ * (`mr` is `toMRInfo(pr)`, i.e. `getMRDashboardProps` -- camelCase `webUrl`,
+ * nested `pipeline.status`, no `ciStatus`). Extra wire fields (including the
+ * rest of `pipeline`) are fine; anything this shape doesn't name is simply
+ * not surfaced.
+ */
+export interface BranchEnrichment {
+    ticket: {
+        identifier: string;
+        title: string;
+        url: string;
+    } | null;
+    mr: {
+        iid: number;
+        webUrl: string | null;
+        state: string;
+        pipeline: {
+            status: string;
+        } | null;
+    } | null;
+    fetchedAt: number;
+}
 /** Forges the daemon can hold a token for. */
 export type ForgeSlug = "gitlab" | "github";
 export interface ForgeTokenData {
@@ -90,7 +122,7 @@ export interface RoomSummary {
 }
 export type Attention = {
     needs: boolean;
-    reason: "failed" | "stale" | "stranded" | null;
+    reason: "failed" | "stale" | "stranded" | "blocked" | null;
     evidence: string;
 };
 export interface RunSummary {
@@ -115,6 +147,20 @@ export interface RunSummary {
         the run has not produced that field yet. */
     ticket: string | null;
     branch: string | null;
+    /** The herdr agent attributed to this run (matched by recorded claude
+        session, else by worktree), mirrored live from `herdr agent list`.
+        Null when no agent matches or herdr is unavailable; absent on
+        pre-mirror daemons. */
+    agent?: RunAgent | null;
+    /** Executed stages only, in run order — the pipeline may define more that have not started. */
+    stages?: {
+        name: string;
+        status: string;
+    }[];
+}
+export interface RunAgent {
+    status: "working" | "idle" | "blocked" | "done" | "unknown";
+    pane: string;
 }
 export interface RunStageRow {
     name: string;

package/dist/index.d.ts

@@ -1,14 +1,14 @@
 export { rtCommand, DEFAULT_SOCK } from "./transport.ts";
 export type { RtResponse, RtClientOptions } from "./transport.ts";
-export { readProjectMRs, readDiscussions, readMrsByBranch, resolveForgeToken, listRuns, getRun, abandonRun, chatJoin, chatLeave, chatPost, chatRead, chatRooms, chatWho, chatMark, chatMessages, chatArm, chatTouch, chatDisarm, chatUnreadWaking, eventsHead, } from "./client.ts";
+export { readProjectMRs, readDiscussions, readMrsByBranch, readBranchCache, resolveForgeToken, listRuns, getRun, abandonRun, chatJoin, chatLeave, chatPost, chatRead, chatRooms, chatWho, chatMark, chatMessages, chatArm, chatTouch, chatDisarm, chatUnreadWaking, eventsHead, } from "./client.ts";
 export { COMMAND_NAMES } from "./commands.ts";
-export type { Discussion, DemandDecl, ProjectMRsScope, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, RoomSummary, } from "./commands.ts";
+export type { Discussion, DemandDecl, ProjectMRsScope, ProjectMRsData, DiscussionsData, MrByBranchEntry, MrByBranchData, BranchEnrichment, Commands, CommandName, ForgeSlug, ForgeTokenData, Attention, RunSummary, RunStageRow, RunFieldRow, RunDecisionRow, RunDetail, WakeMode, ChatMember, ChatMessage, RoomSummary, } from "./commands.ts";
 export { subscribe, DEFAULT_WS_URL } from "./relay.ts";
 export type { RelayEventType } from "./relay.ts";
 export { repoNameForPath } from "./repos.ts";
 export { getSetting, listSettings, explainSetting, expandVariables, SCOPE_ORDER } from "./settings/resolve.ts";
 export type { Scope, Provenance, ResolveOpts, Resolved, InvalidScope, ListedSetting, ExplainRow, ExpandCtx, } from "./settings/resolve.ts";
-export { setSetting } from "./settings/write.ts";
+export { setSetting, unsetSetting } from "./settings/write.ts";
 export type { SetSettingOpts } from "./settings/write.ts";
 export { getDef, allDefs, validateValue, isMigrated } from "./settings/registry-machinery.ts";
 export type { SettingDef, SettingScope } from "./settings/registry-machinery.ts";

package/dist/index.js

@@ -39,6 +39,9 @@ function readDiscussions(repoName, iid, opts = {}) {
 function readMrsByBranch(repoName, branches, opts = {}) {
   return rtCommand("mr:by-branch", { repoName, branches }, { sockPath: opts.sockPath, timeoutMs: 60000 });
 }
+function readBranchCache(branches, opts = {}) {
+  return rtCommand("cache:read", { branches }, { sockPath: opts.sockPath, timeoutMs: 1e4 });
+}
 function resolveForgeToken(repoName, forge, opts = {}) {
   return rtCommand("secrets:forge-token", { repoName, forge }, { sockPath: opts.sockPath, timeoutMs: 1e4 });
 }
@@ -612,6 +615,13 @@ var REGISTRY = [
     merge: "replace",
     description: "Doctor skill the board's own API-tier triage sweep runs on your MRs; deliberately never resolved through a repo's skills.jsonc manifest. A sibling flat key of board.triage, not a field inside it — the board reader assembles the two independently."
   },
+  {
+    key: "board.tabs",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Board tab definitions ({id, label, source, slackChannel?, reviewSkill?}); source.kind 'authors' is the classic roster board, 'codeowners' lists MRs blocked on an unapproved CODEOWNERS section. Absent = one implicit authors tab (fallback lives in the board reader, never here)."
+  },
   {
     key: "board.staleAfterDays",
     type: "number",
@@ -1202,6 +1212,30 @@ function setSetting(key, value, scope, opts = {}) {
   writeIntoStore(storePath, jsonPath, value, scope !== "team");
   console.error(`rt: wrote "${key}" to the local ${scope} store (${storePath}) — this is local only until you commit and push it.`);
 }
+function unsetSetting(key, scope, opts = {}) {
+  const def = getDef(key);
+  if (!def) {
+    refuse(`unknown setting "${key}" — not in the settings registry (see \`rt settings list\`)`);
+  }
+  if (!isMigrated(def)) {
+    refuse(migratedFalseMessage(key, def));
+  }
+  if (!def.scopes.includes(scope)) {
+    refuse(`"${key}" cannot be unset in the ${scope} store (allowed: ${def.scopes.join(", ")})`);
+  }
+  if (opts.repoIdentity !== undefined && def.repoScoped !== true) {
+    refuse(`"${key}" is not repo-scoped — omit the repo identity`);
+  }
+  const storePath = resolveStorePathForUnset(scope, opts);
+  if (storePath === null || !existsSync3(storePath))
+    return false;
+  const jsonPath = opts.repoIdentity !== undefined ? ["repos", opts.repoIdentity, key] : [key];
+  const removed = removeFromStore(storePath, jsonPath);
+  if (removed) {
+    console.error(`rt: removed "${key}" from the local ${scope} store (${storePath}) — this is local only until you commit and push it.`);
+  }
+  return removed;
+}
 function migratedFalseMessage(key, def) {
   const legacyPart = def.legacyFile ? ` — it is still read from ${def.legacyFile}` : "";
   return `"${key}" is not writable through the settings resolver yet${legacyPart}`;
@@ -1227,6 +1261,23 @@ function resolveStorePath(scope, opts) {
   }
   return teamSettingsPath(teams[0]);
 }
+function resolveStorePathForUnset(scope, opts) {
+  if (scope === "user")
+    return userSettingsPath();
+  if (scope === "machine")
+    return machineSettingsPath();
+  if (opts.team !== undefined) {
+    const path = teamSettingsPath(opts.team);
+    return existsSync3(path) ? path : null;
+  }
+  const teams = listTeams();
+  if (teams.length === 0)
+    return null;
+  if (teams.length > 1) {
+    refuse(`multiple local team stores found (${teams.join(", ")}) — pass opts.team to choose one`);
+  }
+  return teamSettingsPath(teams[0]);
+}
 function seedHeader() {
   return `// rt settings — created by \`rt settings set\`. JSONC: comments and trailing commas are fine.
 {}
@@ -1289,6 +1340,24 @@ function writeIntoStore(storePath, jsonPath, value, createIfMissing) {
   const finalText = next.endsWith(`
 `) ? next : `${next}
 `;
+  writeTempThenRename(storePath, finalText);
+}
+function removeFromStore(storePath, jsonPath) {
+  const content = readFileSync4(storePath, "utf8");
+  if (content.trim() === "")
+    return false;
+  assertEditableJsonc(storePath, content);
+  const edits = modify(content, jsonPath, undefined, { formattingOptions: FORMAT });
+  if (edits.length === 0)
+    return false;
+  const next = applyEdits(content, edits);
+  const finalText = next.endsWith(`
+`) ? next : `${next}
+`;
+  writeTempThenRename(storePath, finalText);
+  return true;
+}
+function writeTempThenRename(storePath, finalText) {
   const tmp = `${storePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
     writeFileSync(tmp, finalText);
@@ -1336,7 +1405,7 @@ async function runCapture(argv, opts = {}) {
   }
 }
 
-// src/settings/identity.ts
+// src/settings/identity-codec.ts
 var URL_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/]+)\/(.+)$/;
 var SCP_RE = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
 function serializeIdentity(id) {
@@ -1384,6 +1453,8 @@ function normalizeRemote(remote) {
     return null;
   return `${host.toLowerCase()}/${normalizedPath}`;
 }
+
+// src/settings/identity.ts
 function identityFromRemote(remote) {
   const store = readStore(machineSettingsPath());
   const overrides = store.global["rt.repoIdentityOverrides"];
@@ -1451,6 +1522,7 @@ async function resolveNameToIdentity(name, reposJsonPath) {
 }
 export {
   validateValue,
+  unsetSetting,
   subscribe,
   setSetting,
   serializeIdentity,
@@ -1462,6 +1534,7 @@ export {
   readProjectMRs,
   readMrsByBranch,
   readDiscussions,
+  readBranchCache,
   parseIdentity,
   normalizeRemote,
   listTeams,

package/dist/settings/identity-codec.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The pure half of the repo-identity contract: the wire codec and the
+ * remote-URL normalizer. Split from identity.ts so browser bundles can key
+ * and label repos without dragging in fs/child_process — this module must
+ * never import node builtins or anything that does (the `./identity`
+ * subpath export points here, and a browser consumer evaluates it at module
+ * scope). Override-aware and derivation entry points stay in identity.ts.
+ */
+export type RepoIdentity = {
+    kind: "remote";
+    id: string;
+} | {
+    kind: "path";
+    id: string;
+};
+/**
+ * The wire form crosses the daemon socket, sits in board config, and lands in
+ * console's `/runs/:repo/...` URL — all of which need one slash-free segment.
+ * `encodeURIComponent` guarantees that and is exactly reversible.
+ */
+export declare function serializeIdentity(id: RepoIdentity): string;
+export declare function parseIdentity(wire: string): RepoIdentity | null;
+/**
+ * Pure normalization: `remote` → `host/path` (lowercase host, `.git` and
+ * embedded credentials stripped) or null when the remote doesn't match a
+ * recognized host form (local paths, garbage input).
+ */
+export declare function normalizeRemote(remote: string): string | null;

package/dist/settings/identity-codec.js

@@ -0,0 +1,53 @@
+// src/settings/identity-codec.ts
+var URL_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/]+)\/(.+)$/;
+var SCP_RE = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
+function serializeIdentity(id) {
+  return `${id.kind}:${encodeURIComponent(id.id)}`;
+}
+function parseIdentity(wire) {
+  const colon = wire.indexOf(":");
+  if (colon === -1)
+    return null;
+  const kind = wire.slice(0, colon);
+  if (kind !== "remote" && kind !== "path")
+    return null;
+  const encoded = wire.slice(colon + 1);
+  let id;
+  try {
+    id = decodeURIComponent(encoded);
+  } catch {
+    return null;
+  }
+  if (encodeURIComponent(id) !== encoded)
+    return null;
+  return { kind, id };
+}
+function normalizeRemote(remote) {
+  const trimmed = remote.trim();
+  if (!trimmed)
+    return null;
+  let host;
+  let path;
+  const urlMatch = URL_RE.exec(trimmed);
+  if (urlMatch) {
+    host = urlMatch[1];
+    path = urlMatch[2];
+  } else if (!trimmed.startsWith("/") && !trimmed.startsWith("~")) {
+    const scpMatch = SCP_RE.exec(trimmed);
+    if (scpMatch) {
+      host = scpMatch[1];
+      path = scpMatch[2];
+    }
+  }
+  if (!host || !path)
+    return null;
+  const normalizedPath = path.replace(/\.git$/, "").replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!normalizedPath)
+    return null;
+  return `${host.toLowerCase()}/${normalizedPath}`;
+}
+export {
+  serializeIdentity,
+  parseIdentity,
+  normalizeRemote
+};

package/dist/settings/identity.d.ts

@@ -25,26 +25,9 @@
  *    through `identityFromRemote`, memoized per path so repeated callers in
  *    one process don't re-spawn git.
  */
-export type RepoIdentity = {
-    kind: "remote";
-    id: string;
-} | {
-    kind: "path";
-    id: string;
-};
-/**
- * The wire form crosses the daemon socket, sits in board config, and lands in
- * console's `/runs/:repo/...` URL — all of which need one slash-free segment.
- * `encodeURIComponent` guarantees that and is exactly reversible.
- */
-export declare function serializeIdentity(id: RepoIdentity): string;
-export declare function parseIdentity(wire: string): RepoIdentity | null;
-/**
- * Pure normalization: `remote` → `host/path` (lowercase host, `.git` and
- * embedded credentials stripped) or null when the remote doesn't match a
- * recognized host form (local paths, garbage input).
- */
-export declare function normalizeRemote(remote: string): string | null;
+import { type RepoIdentity } from "./identity-codec.ts";
+export { serializeIdentity, parseIdentity, normalizeRemote } from "./identity-codec.ts";
+export type { RepoIdentity } from "./identity-codec.ts";
 /**
  * The sync helper every non-derivation call site uses: machine-store
  * fork/multi-remote overrides (exact remote-URL match) then normalizeRemote.

package/dist/settings/write.d.ts

@@ -108,3 +108,15 @@ export interface SetSettingOpts {
  * doc for the full refusal list and the team-selection rule.
  */
 export declare function setSetting(key: string, value: unknown, scope: SettingScope, opts?: SetSettingOpts): void;
+/**
+ * Removes `key` from the given scope's store, comment-preserving. The refusal
+ * ladder is `setSetting`'s minus the value check (there is no value): unknown
+ * key, unmigrated, scope not in `def.scopes`, repoIdentity on a non-repoScoped
+ * key, and the team-selection rule when ambiguous. Divergences from set, both
+ * because removal has nothing to act on: a store FILE that does not exist is a
+ * clean no-op rather than a refusal (an explicit `opts.team` naming a team
+ * with no local store included — nothing to remove is success, not an error),
+ * and a key not present in the store is a no-op. Returns whether anything was
+ * actually removed; the local-only reminder prints only on a real removal.
+ */
+export declare function unsetSetting(key: string, scope: SettingScope, opts?: SetSettingOpts): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mattstack/rt-client",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "exports": {
     ".": {
@@ -9,6 +9,12 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./identity": {
+      "types": "./dist/settings/identity-codec.d.ts",
+      "bun": "./src/settings/identity-codec.ts",
+      "import": "./dist/settings/identity-codec.js",
+      "default": "./dist/settings/identity-codec.js"
+    },
     "./test/fake-daemon.ts": "./test/fake-daemon.ts"
   },
   "peerDependencies": {
@@ -39,7 +45,7 @@
     "bun": ">=1.0.0"
   },
   "scripts": {
-    "build": "bun build src/index.ts --outdir dist --target node --format esm --packages external && tsc -p tsconfig.json",
+    "build": "bun build src/index.ts --outdir dist --target node --format esm --packages external && bun build src/settings/identity-codec.ts --outfile dist/settings/identity-codec.js --target browser --format esm && tsc -p tsconfig.json",
     "check-types": "tsc --noEmit -p tsconfig.json",
     "prepack": "bun run build"
   },

package/src/client.ts

@@ -10,6 +10,7 @@ import type {
   ProjectMRsData,
   DiscussionsData,
   MrByBranchData,
+  BranchEnrichment,
   ForgeSlug,
   ForgeTokenData,
   RunSummary,
@@ -66,6 +67,22 @@ export function readMrsByBranch(
   );
 }
 
+/**
+ * Cached ticket/MR enrichment for a set of branches, keyed by branch name
+ * (the cache's own primary key -- see lib/state/branch-cache.ts). Serves
+ * whatever the daemon already has; it does not trigger a fetch.
+ */
+export function readBranchCache(
+  branches: string[],
+  opts: RtClientOptions = {},
+): Promise<RtResponse<Record<string, BranchEnrichment>>> {
+  return rtCommand<Record<string, BranchEnrichment>>(
+    "cache:read",
+    { branches },
+    { sockPath: opts.sockPath, timeoutMs: 10_000 },
+  );
+}
+
 /**
  * The forge token for one tracked repo (MAT-33). Grant-gated on the daemon
  * side: an untracked repo comes back `ok: false` with the `rt daemon track`

package/src/commands.ts

@@ -12,6 +12,8 @@ export type Discussion = MRDetail["discussions"][number];
 export interface DemandDecl {
   client: string;
   authors: string[];
+  /** Codeowner sections this client needs covered (spec: second demand axis). */
+  codeownerSections?: string[];
   declaredAt: number;
 }
 
@@ -19,10 +21,14 @@ export interface ProjectMRsScope {
   authors: string[];
   windowDays: number;
   uncovered: string[];
+  /** Effective synced section union; absent from a pre-sections daemon. */
+  sections?: string[];
+  /** Demanded sections not yet swept for this client. */
+  uncoveredSections?: string[];
 }
 
 export interface ProjectMRsData {
-  mrs: Record<string, { pr: PullRequest; fetchedAt: number }>;
+  mrs: Record<string, { pr: PullRequest; fetchedAt: number; codeownerSections?: string[] }>;
   listSyncedAt: number;
   source: "poll" | "events" | "mutation";
   syncedAt: number;
@@ -45,6 +51,21 @@ export interface MrByBranchData {
   syncedAt: number;
 }
 
+/**
+ * Trimmed, structural view of the daemon's `CacheEntry` (lib/state/branch-cache.ts) --
+ * rt-client cannot import daemon/lib internals, so this names only the fields
+ * console's run-view rows read, spelled exactly as they land on the wire
+ * (`mr` is `toMRInfo(pr)`, i.e. `getMRDashboardProps` -- camelCase `webUrl`,
+ * nested `pipeline.status`, no `ciStatus`). Extra wire fields (including the
+ * rest of `pipeline`) are fine; anything this shape doesn't name is simply
+ * not surfaced.
+ */
+export interface BranchEnrichment {
+  ticket: { identifier: string; title: string; url: string } | null;
+  mr: { iid: number; webUrl: string | null; state: string; pipeline: { status: string } | null } | null;
+  fetchedAt: number;
+}
+
 /** Forges the daemon can hold a token for. */
 export type ForgeSlug = "gitlab" | "github";
 
@@ -99,7 +120,7 @@ export interface RoomSummary {
 // never derive two verdicts that can disagree.
 export type Attention = {
   needs: boolean;
-  reason: "failed" | "stale" | "stranded" | null;
+  reason: "failed" | "stale" | "stranded" | "blocked" | null;
   evidence: string;
 };
 
@@ -120,6 +141,17 @@ export interface RunSummary {
       the run has not produced that field yet. */
   ticket: string | null;
   branch: string | null;
+  /** The herdr agent attributed to this run (matched by recorded claude
+      session, else by worktree), mirrored live from `herdr agent list`.
+      Null when no agent matches or herdr is unavailable; absent on
+      pre-mirror daemons. */
+  agent?: RunAgent | null;
+  /** Executed stages only, in run order — the pipeline may define more that have not started. */
+  stages?: { name: string; status: string }[];
+}
+export interface RunAgent {
+  status: "working" | "idle" | "blocked" | "done" | "unknown";
+  pane: string;
 }
 export interface RunStageRow {
   name: string; status: string; attempt: number;

package/src/index.ts

@@ -5,6 +5,7 @@ export {
   readProjectMRs,
   readDiscussions,
   readMrsByBranch,
+  readBranchCache,
   resolveForgeToken,
   listRuns,
   getRun,
@@ -33,6 +34,7 @@ export type {
   DiscussionsData,
   MrByBranchEntry,
   MrByBranchData,
+  BranchEnrichment,
   Commands,
   CommandName,
   ForgeSlug,
@@ -68,7 +70,7 @@ export type {
   ExpandCtx,
 } from "./settings/resolve.ts";
 
-export { setSetting } from "./settings/write.ts";
+export { setSetting, unsetSetting } from "./settings/write.ts";
 export type { SetSettingOpts } from "./settings/write.ts";
 
 export { getDef, allDefs, validateValue, isMigrated } from "./settings/registry-machinery.ts";

package/src/settings/identity-codec.ts

@@ -0,0 +1,82 @@
+/**
+ * The pure half of the repo-identity contract: the wire codec and the
+ * remote-URL normalizer. Split from identity.ts so browser bundles can key
+ * and label repos without dragging in fs/child_process — this module must
+ * never import node builtins or anything that does (the `./identity`
+ * subpath export points here, and a browser consumer evaluates it at module
+ * scope). Override-aware and derivation entry points stay in identity.ts.
+ */
+
+// Full-URL forms: scheme://[user[:pass]@]host/path — https, ssh, git, http, ...
+const URL_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/]+)\/(.+)$/;
+
+// scp-like scp syntax: [user@]host:path (git@gitlab.com:group/repo.git).
+// Deliberately excludes anything starting with "/" (absolute local paths)
+// so a Windows-drive-letter-free local remote never falsely matches.
+const SCP_RE = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
+
+export type RepoIdentity =
+  | { kind: "remote"; id: string }
+  | { kind: "path"; id: string };
+
+/**
+ * The wire form crosses the daemon socket, sits in board config, and lands in
+ * console's `/runs/:repo/...` URL — all of which need one slash-free segment.
+ * `encodeURIComponent` guarantees that and is exactly reversible.
+ */
+export function serializeIdentity(id: RepoIdentity): string {
+  return `${id.kind}:${encodeURIComponent(id.id)}`;
+}
+
+export function parseIdentity(wire: string): RepoIdentity | null {
+  const colon = wire.indexOf(":");
+  if (colon === -1) return null;
+  const kind = wire.slice(0, colon);
+  if (kind !== "remote" && kind !== "path") return null;
+  const encoded = wire.slice(colon + 1);
+  let id: string;
+  try {
+    id = decodeURIComponent(encoded);
+  } catch {
+    return null;
+  }
+  // Canonical wires only: the id segment must be byte-for-byte what
+  // serializeIdentity emits. Guard sites validate with parseIdentity and then
+  // use the WIRE as a single path component (repoDataDir et al.) — a
+  // hand-built wire with a literal "/" ("path:../..") would otherwise parse
+  // and escape the state directory.
+  if (encodeURIComponent(id) !== encoded) return null;
+  return { kind, id };
+}
+
+/**
+ * Pure normalization: `remote` → `host/path` (lowercase host, `.git` and
+ * embedded credentials stripped) or null when the remote doesn't match a
+ * recognized host form (local paths, garbage input).
+ */
+export function normalizeRemote(remote: string): string | null {
+  const trimmed = remote.trim();
+  if (!trimmed) return null;
+
+  let host: string | undefined;
+  let path: string | undefined;
+
+  const urlMatch = URL_RE.exec(trimmed);
+  if (urlMatch) {
+    host = urlMatch[1];
+    path = urlMatch[2];
+  } else if (!trimmed.startsWith("/") && !trimmed.startsWith("~")) {
+    const scpMatch = SCP_RE.exec(trimmed);
+    if (scpMatch) {
+      host = scpMatch[1];
+      path = scpMatch[2];
+    }
+  }
+
+  if (!host || !path) return null;
+
+  const normalizedPath = path.replace(/\.git$/, "").replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!normalizedPath) return null;
+
+  return `${host.toLowerCase()}/${normalizedPath}`;
+}

package/src/settings/identity.ts

@@ -32,79 +32,10 @@ import { runCapture } from "./exec.ts";
 import { machineSettingsPath } from "./paths.ts";
 import { readStore } from "./stores.ts";
 
-// Full-URL forms: scheme://[user[:pass]@]host/path — https, ssh, git, http, ...
-const URL_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/]+)\/(.+)$/;
+import { normalizeRemote, type RepoIdentity } from "./identity-codec.ts";
 
-// scp-like scp syntax: [user@]host:path (git@gitlab.com:group/repo.git).
-// Deliberately excludes anything starting with "/" (absolute local paths)
-// so a Windows-drive-letter-free local remote never falsely matches.
-const SCP_RE = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
-
-export type RepoIdentity =
-  | { kind: "remote"; id: string }
-  | { kind: "path"; id: string };
-
-/**
- * The wire form crosses the daemon socket, sits in board config, and lands in
- * console's `/runs/:repo/...` URL — all of which need one slash-free segment.
- * `encodeURIComponent` guarantees that and is exactly reversible.
- */
-export function serializeIdentity(id: RepoIdentity): string {
-  return `${id.kind}:${encodeURIComponent(id.id)}`;
-}
-
-export function parseIdentity(wire: string): RepoIdentity | null {
-  const colon = wire.indexOf(":");
-  if (colon === -1) return null;
-  const kind = wire.slice(0, colon);
-  if (kind !== "remote" && kind !== "path") return null;
-  const encoded = wire.slice(colon + 1);
-  let id: string;
-  try {
-    id = decodeURIComponent(encoded);
-  } catch {
-    return null;
-  }
-  // Canonical wires only: the id segment must be byte-for-byte what
-  // serializeIdentity emits. Guard sites validate with parseIdentity and then
-  // use the WIRE as a single path component (repoDataDir et al.) — a
-  // hand-built wire with a literal "/" ("path:../..") would otherwise parse
-  // and escape the state directory.
-  if (encodeURIComponent(id) !== encoded) return null;
-  return { kind, id };
-}
-
-/**
- * Pure normalization: `remote` → `host/path` (lowercase host, `.git` and
- * embedded credentials stripped) or null when the remote doesn't match a
- * recognized host form (local paths, garbage input).
- */
-export function normalizeRemote(remote: string): string | null {
-  const trimmed = remote.trim();
-  if (!trimmed) return null;
-
-  let host: string | undefined;
-  let path: string | undefined;
-
-  const urlMatch = URL_RE.exec(trimmed);
-  if (urlMatch) {
-    host = urlMatch[1];
-    path = urlMatch[2];
-  } else if (!trimmed.startsWith("/") && !trimmed.startsWith("~")) {
-    const scpMatch = SCP_RE.exec(trimmed);
-    if (scpMatch) {
-      host = scpMatch[1];
-      path = scpMatch[2];
-    }
-  }
-
-  if (!host || !path) return null;
-
-  const normalizedPath = path.replace(/\.git$/, "").replace(/^\/+/, "").replace(/\/+$/, "");
-  if (!normalizedPath) return null;
-
-  return `${host.toLowerCase()}/${normalizedPath}`;
-}
+export { serializeIdentity, parseIdentity, normalizeRemote } from "./identity-codec.ts";
+export type { RepoIdentity } from "./identity-codec.ts";
 
 /**
  * The sync helper every non-derivation call site uses: machine-store

package/src/settings/registry-defs.ts

@@ -345,6 +345,13 @@ export const REGISTRY: readonly SettingDef[] = [
     merge: "replace",
     description: "Doctor skill the board's own API-tier triage sweep runs on your MRs; deliberately never resolved through a repo's skills.jsonc manifest. A sibling flat key of board.triage, not a field inside it — the board reader assembles the two independently.",
   },
+  {
+    key: "board.tabs",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Board tab definitions ({id, label, source, slackChannel?, reviewSkill?}); source.kind 'authors' is the classic roster board, 'codeowners' lists MRs blocked on an unapproved CODEOWNERS section. Absent = one implicit authors tab (fallback lives in the board reader, never here).",
+  },
 
   // --- board (user) ----------------------------------------------------------
   {

package/src/settings/write.ts

@@ -160,6 +160,49 @@ export function setSetting(key: string, value: unknown, scope: SettingScope, opt
   );
 }
 
+/**
+ * Removes `key` from the given scope's store, comment-preserving. The refusal
+ * ladder is `setSetting`'s minus the value check (there is no value): unknown
+ * key, unmigrated, scope not in `def.scopes`, repoIdentity on a non-repoScoped
+ * key, and the team-selection rule when ambiguous. Divergences from set, both
+ * because removal has nothing to act on: a store FILE that does not exist is a
+ * clean no-op rather than a refusal (an explicit `opts.team` naming a team
+ * with no local store included — nothing to remove is success, not an error),
+ * and a key not present in the store is a no-op. Returns whether anything was
+ * actually removed; the local-only reminder prints only on a real removal.
+ */
+export function unsetSetting(key: string, scope: SettingScope, opts: SetSettingOpts = {}): boolean {
+  const def = getDef(key);
+  if (!def) {
+    refuse(`unknown setting "${key}" — not in the settings registry (see \`rt settings list\`)`);
+  }
+
+  if (!isMigrated(def)) {
+    refuse(migratedFalseMessage(key, def));
+  }
+
+  if (!def.scopes.includes(scope)) {
+    refuse(`"${key}" cannot be unset in the ${scope} store (allowed: ${def.scopes.join(", ")})`);
+  }
+
+  if (opts.repoIdentity !== undefined && def.repoScoped !== true) {
+    refuse(`"${key}" is not repo-scoped — omit the repo identity`);
+  }
+
+  const storePath = resolveStorePathForUnset(scope, opts);
+  if (storePath === null || !existsSync(storePath)) return false;
+
+  const jsonPath: JSONPath = opts.repoIdentity !== undefined ? ["repos", opts.repoIdentity, key] : [key];
+  const removed = removeFromStore(storePath, jsonPath);
+
+  if (removed) {
+    console.error(
+      `rt: removed "${key}" from the local ${scope} store (${storePath}) — this is local only until you commit and push it.`,
+    );
+  }
+  return removed;
+}
+
 function migratedFalseMessage(key: string, def: SettingDef): string {
   const legacyPart = def.legacyFile ? ` — it is still read from ${def.legacyFile}` : "";
   return `"${key}" is not writable through the settings resolver yet${legacyPart}`;
@@ -188,6 +231,29 @@ function resolveStorePath(scope: SettingScope, opts: SetSettingOpts): string {
   return teamSettingsPath(teams[0] as string);
 }
 
+/**
+ * `resolveStorePath` for removal: same selection rule, but "no store to
+ * target" answers null (nothing to remove) instead of refusing — EXCEPT the
+ * multiple-teams case, which still refuses: guessing which team's store to
+ * edit is banned on the unset side for the same reason as the set side.
+ */
+function resolveStorePathForUnset(scope: SettingScope, opts: SetSettingOpts): string | null {
+  if (scope === "user") return userSettingsPath();
+  if (scope === "machine") return machineSettingsPath();
+
+  if (opts.team !== undefined) {
+    const path = teamSettingsPath(opts.team);
+    return existsSync(path) ? path : null;
+  }
+
+  const teams = listTeams();
+  if (teams.length === 0) return null;
+  if (teams.length > 1) {
+    refuse(`multiple local team stores found (${teams.join(", ")}) — pass opts.team to choose one`);
+  }
+  return teamSettingsPath(teams[0] as string);
+}
+
 /** `// header comment\n{}\n` — see module doc for why the object must be seeded before the first `modify`. */
 function seedHeader(): string {
   return `// rt settings — created by \`rt settings set\`. JSONC: comments and trailing commas are fine.\n{}\n`;
@@ -279,6 +345,31 @@ function writeIntoStore(storePath: string, jsonPath: JSONPath, value: unknown, c
   // a torn write would sit as a corrupt uncommitted file until a human
   // noticed. The edited TEXT is written as-is, never round-tripped through
   // JSON.stringify, so comments and formatting survive.
+  writeTempThenRename(storePath, finalText);
+}
+
+/**
+ * Removes `jsonPath` from an existing store file. A key that isn't present
+ * yields zero edits from `modify` and the file is left untouched (no write,
+ * no mtime churn). Malformed stores refuse exactly as on the set side —
+ * `modify`-by-offset against a duplicate-key document is as wrong for
+ * removal as it is for writes.
+ */
+function removeFromStore(storePath: string, jsonPath: JSONPath): boolean {
+  const content = readFileSync(storePath, "utf8");
+  if (content.trim() === "") return false;
+  assertEditableJsonc(storePath, content);
+
+  const edits = modify(content, jsonPath, undefined, { formattingOptions: FORMAT });
+  if (edits.length === 0) return false;
+
+  const next = applyEdits(content, edits);
+  const finalText = next.endsWith("\n") ? next : `${next}\n`;
+  writeTempThenRename(storePath, finalText);
+  return true;
+}
+
+function writeTempThenRename(storePath: string, finalText: string): void {
   const tmp = `${storePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   try {
     writeFileSync(tmp, finalText);