@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (319) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +141 -2
  3. package/bin/codeflow.mjs +8 -0
  4. package/bin/launcher.mjs +127 -0
  5. package/dist/remote-host.json +1 -0
  6. package/licenses/inter.txt +92 -0
  7. package/licenses/preact.txt +21 -0
  8. package/licenses/signals-core.txt +21 -0
  9. package/licenses/signals.txt +21 -0
  10. package/licenses/typescript-notices.txt +193 -0
  11. package/licenses/typescript.txt +55 -0
  12. package/licenses/uqr.txt +22 -0
  13. package/licenses/xterm-fit.txt +19 -0
  14. package/licenses/xterm.txt +21 -0
  15. package/package.json +34 -4
  16. package/public/assets/changes-62ZIEQSN.js +1 -0
  17. package/public/assets/chunk-2PZVOKID.js +1 -0
  18. package/public/assets/chunk-4D5IENEB.js +1 -0
  19. package/public/assets/chunk-5SARP5MU.js +1 -0
  20. package/public/assets/chunk-63YLZ3PR.js +1 -0
  21. package/public/assets/chunk-7FUHKF2M.js +1 -0
  22. package/public/assets/chunk-APQEVJ2K.js +1 -0
  23. package/public/assets/chunk-CGOZQMEZ.js +2 -0
  24. package/public/assets/chunk-J4VYS3KV.js +2 -0
  25. package/public/assets/chunk-L7TUCIYF.js +1 -0
  26. package/public/assets/chunk-SIHDWM2Y.js +154 -0
  27. package/public/assets/chunk-TEJVYIKC.js +1 -0
  28. package/public/assets/code-browser-VB2HGZSG.js +4 -0
  29. package/public/assets/filtered-tasks-ES5CP4KV.js +1 -0
  30. package/public/assets/interactive-browser-7F5ZXRUV.js +7 -0
  31. package/public/assets/join-project-6RTFHNCA.js +1 -0
  32. package/public/assets/main-65EW73SB.js +1 -0
  33. package/public/assets/project-invitations-view-GMPWGWYM.js +1 -0
  34. package/public/assets/settings-UB5Q4AQM.js +9 -0
  35. package/public/assets/styles-18792BB4.css +32 -0
  36. package/public/assets/team-server-wizard-2GLDWS6D.js +8 -0
  37. package/public/assets/terminal-IWAIM4DE.js +62 -0
  38. package/public/assets.json +1 -0
  39. package/public/bundle-meta.json +1 -0
  40. package/public/docs/.nojekyll +0 -0
  41. package/public/docs/accessibility.html +19 -0
  42. package/public/docs/acp-agents.html +117 -0
  43. package/public/docs/agent-containers.html +79 -0
  44. package/public/docs/api.html +1130 -0
  45. package/public/docs/app.js +342 -0
  46. package/public/docs/application-improvements.html +275 -0
  47. package/public/docs/architecture-explorer.html +19 -0
  48. package/public/docs/architecture.html +149 -0
  49. package/public/docs/auto-team.html +148 -0
  50. package/public/docs/automations.html +109 -0
  51. package/public/docs/checkpoint-review.html +37 -0
  52. package/public/docs/code-hosts.html +35 -0
  53. package/public/docs/code-intelligence.html +35 -0
  54. package/public/docs/configuration.html +346 -0
  55. package/public/docs/context-inspection.html +23 -0
  56. package/public/docs/coordinated-changes.html +28 -0
  57. package/public/docs/deferred-runs.html +25 -0
  58. package/public/docs/dependency-discovery.html +19 -0
  59. package/public/docs/documentation.html +84 -0
  60. package/public/docs/dynamic-teams-evaluation.html +174 -0
  61. package/public/docs/dynamic-teams-implementation-plan.html +882 -0
  62. package/public/docs/dynamic-teams-implementation-review-1.html +141 -0
  63. package/public/docs/dynamic-teams-plan-review-0.html +204 -0
  64. package/public/docs/extensions.html +42 -0
  65. package/public/docs/external-sources.html +96 -0
  66. package/public/docs/filesystem-policy.html +26 -0
  67. package/public/docs/filtered-tasks.html +44 -0
  68. package/public/docs/font-license.txt +92 -0
  69. package/public/docs/getting-started.html +143 -0
  70. package/public/docs/github-review-threads.html +26 -0
  71. package/public/docs/github.html +157 -0
  72. package/public/docs/help.html +69 -0
  73. package/public/docs/index.html +88 -0
  74. package/public/docs/installation.html +80 -0
  75. package/public/docs/launch-profiles.html +48 -0
  76. package/public/docs/maintenance.html +60 -0
  77. package/public/docs/memory-claims.html +31 -0
  78. package/public/docs/memory-storage.html +58 -0
  79. package/public/docs/notifications.html +39 -0
  80. package/public/docs/patterns.html +195 -0
  81. package/public/docs/performance-results.html +210 -0
  82. package/public/docs/performance.html +166 -0
  83. package/public/docs/project-conventions.html +22 -0
  84. package/public/docs/project-first-navigation-plan.html +587 -0
  85. package/public/docs/project-teams-implementation-plan.html +772 -0
  86. package/public/docs/project-teams.html +129 -0
  87. package/public/docs/provider-compatibility.html +20 -0
  88. package/public/docs/releasing.html +65 -0
  89. package/public/docs/remote-workers.html +64 -0
  90. package/public/docs/review-inbox.html +26 -0
  91. package/public/docs/run-storage.html +23 -0
  92. package/public/docs/runs.html +141 -0
  93. package/public/docs/search.json +1 -0
  94. package/public/docs/security.html +133 -0
  95. package/public/docs/shared-projects.html +31 -0
  96. package/public/docs/ssh-projects.html +60 -0
  97. package/public/docs/style.css +768 -0
  98. package/public/docs/task-reruns.html +30 -0
  99. package/public/docs/team-collaboration.html +412 -0
  100. package/public/docs/verification.html +22 -0
  101. package/public/docs/vscode.html +53 -0
  102. package/public/docs/worker-permission-verification.html +131 -0
  103. package/public/index.html +17 -0
  104. package/scripts/check-node.mjs +7 -0
  105. package/scripts/codeflow.mjs +55 -0
  106. package/scripts/computer-use.swift +64 -0
  107. package/scripts/pty.py +273 -0
  108. package/src/acp-connections.js +110 -0
  109. package/src/adapters/acp-presets.js +37 -0
  110. package/src/adapters/acp-types.js +0 -0
  111. package/src/adapters/acp.js +328 -0
  112. package/src/adapters/agent-tools.js +28 -0
  113. package/src/adapters/agy-auth.js +67 -0
  114. package/src/adapters/agy-isolation.js +242 -0
  115. package/src/adapters/agy-tools.js +45 -0
  116. package/src/adapters/agy.js +326 -0
  117. package/src/adapters/claude-stream.js +58 -0
  118. package/src/adapters/claude.js +282 -0
  119. package/src/adapters/codex-app-server.js +555 -0
  120. package/src/adapters/codex.js +311 -0
  121. package/src/adapters/errors.js +57 -0
  122. package/src/adapters/index.js +91 -0
  123. package/src/adapters/managed-permissions.js +37 -0
  124. package/src/adapters/model-discovery.js +100 -0
  125. package/src/adapters/process.js +433 -0
  126. package/src/adapters/team-tools.js +103 -0
  127. package/src/adapters/types.js +0 -0
  128. package/src/agent-browser.js +688 -0
  129. package/src/agent-computer.js +88 -0
  130. package/src/agent-container.js +155 -0
  131. package/src/agent-team-definitions.js +131 -0
  132. package/src/agent-tool-client.mjs +79 -0
  133. package/src/agent-tools.js +296 -0
  134. package/src/approvals.js +134 -0
  135. package/src/architecture.js +456 -0
  136. package/src/assets.js +44 -0
  137. package/src/automation.js +901 -0
  138. package/src/browser-files.js +293 -0
  139. package/src/browser-ownership.js +150 -0
  140. package/src/certificate-renewal.js +75 -0
  141. package/src/chat-family.js +25 -0
  142. package/src/chat-handoff.js +87 -0
  143. package/src/checkpoint-review.js +72 -0
  144. package/src/checks.js +303 -0
  145. package/src/code-host-git.js +102 -0
  146. package/src/code-hosts-api.js +99 -0
  147. package/src/code-hosts.js +482 -0
  148. package/src/code-intelligence-worker.mjs +452 -0
  149. package/src/code-intelligence.js +141 -0
  150. package/src/collab/api.js +365 -0
  151. package/src/collab/checkpoints.js +198 -0
  152. package/src/collab/connections.js +139 -0
  153. package/src/collab/host-execution.js +347 -0
  154. package/src/collab/hub-client.js +210 -0
  155. package/src/collab/link-api.js +229 -0
  156. package/src/collab/link.js +595 -0
  157. package/src/collab/model.js +496 -0
  158. package/src/collab/runner.js +1014 -0
  159. package/src/collab/store.js +1452 -0
  160. package/src/collab/terminals.js +361 -0
  161. package/src/collaboration-reviews.js +116 -0
  162. package/src/config.js +48 -0
  163. package/src/context-budget.js +14 -0
  164. package/src/context-inspection.js +204 -0
  165. package/src/context.js +154 -0
  166. package/src/conventions.js +283 -0
  167. package/src/coordinated-api.js +247 -0
  168. package/src/deferred-launch.js +82 -0
  169. package/src/deferred-runs.js +515 -0
  170. package/src/dependency-health.js +35 -0
  171. package/src/diff.js +43 -0
  172. package/src/docs-help.js +316 -0
  173. package/src/doctor.js +232 -0
  174. package/src/documentation-changes.js +20 -0
  175. package/src/engine.js +5258 -0
  176. package/src/env.js +44 -0
  177. package/src/execution-budget.js +8 -0
  178. package/src/experience.js +50 -0
  179. package/src/extensions.js +144 -0
  180. package/src/filesystem-access.js +107 -0
  181. package/src/filesystem-policy.js +238 -0
  182. package/src/filtered-task-limits.js +93 -0
  183. package/src/filtered-tasks-api.js +53 -0
  184. package/src/filtered-tasks.js +576 -0
  185. package/src/frame-policy.js +66 -0
  186. package/src/fs.js +57 -0
  187. package/src/git.js +626 -0
  188. package/src/github-review-threads.js +181 -0
  189. package/src/github.js +538 -0
  190. package/src/http.js +69 -0
  191. package/src/improve-settings.js +38 -0
  192. package/src/improve.js +187 -0
  193. package/src/integrations.js +373 -0
  194. package/src/integrity.js +259 -0
  195. package/src/journey-api.js +77 -0
  196. package/src/journey-replay.js +65 -0
  197. package/src/journey-store.js +97 -0
  198. package/src/journeys.js +60 -0
  199. package/src/json.js +81 -0
  200. package/src/launch-profiles.js +292 -0
  201. package/src/learnings.js +80 -0
  202. package/src/local-app-url.js +19 -0
  203. package/src/log.js +39 -0
  204. package/src/maintenance.js +335 -0
  205. package/src/memory-analysis.js +182 -0
  206. package/src/memory-claims.js +153 -0
  207. package/src/memory-sqlite.js +236 -0
  208. package/src/memory.js +552 -0
  209. package/src/merge-validation.js +58 -0
  210. package/src/model-catalog.js +239 -0
  211. package/src/model-research.js +91 -0
  212. package/src/notes.js +176 -0
  213. package/src/notifications.js +413 -0
  214. package/src/patterns/auto-team-model.js +230 -0
  215. package/src/patterns/auto-team.js +816 -0
  216. package/src/patterns/council.js +199 -0
  217. package/src/patterns/debate.js +188 -0
  218. package/src/patterns/findings.js +141 -0
  219. package/src/patterns/index.js +21 -0
  220. package/src/patterns/loop.js +158 -0
  221. package/src/patterns/pipeline.js +125 -0
  222. package/src/patterns/prompts.js +181 -0
  223. package/src/patterns/race.js +147 -0
  224. package/src/patterns/schemas.js +40 -0
  225. package/src/patterns/solo.js +46 -0
  226. package/src/patterns/supervisor.js +235 -0
  227. package/src/patterns/task-draft.js +29 -0
  228. package/src/patterns/task-review.js +45 -0
  229. package/src/patterns/tdd.js +231 -0
  230. package/src/patterns/team-strategies.js +67 -0
  231. package/src/performance.js +43 -0
  232. package/src/persistence-status.js +35 -0
  233. package/src/phone-sessions.js +96 -0
  234. package/src/preview-overlay.js +392 -0
  235. package/src/preview.js +230 -0
  236. package/src/privacy.js +23 -0
  237. package/src/project-report.js +22 -0
  238. package/src/project-team-budget.js +22 -0
  239. package/src/project-team-model.js +225 -0
  240. package/src/project-team-policy.js +42 -0
  241. package/src/project-team-store.js +234 -0
  242. package/src/project-team-usage.js +24 -0
  243. package/src/project-teams-api.js +43 -0
  244. package/src/project-teams.js +644 -0
  245. package/src/projects.js +290 -0
  246. package/src/provider-eligibility.js +9 -0
  247. package/src/readiness.js +98 -0
  248. package/src/remote-tls.js +66 -0
  249. package/src/remote-workers/bundles.js +198 -0
  250. package/src/remote-workers/client.js +332 -0
  251. package/src/remote-workers/durability.js +37 -0
  252. package/src/remote-workers/protocol.js +68 -0
  253. package/src/remote-workers/stdio.js +138 -0
  254. package/src/remote-workers/worker.js +304 -0
  255. package/src/remote.js +204 -0
  256. package/src/repo-config.js +201 -0
  257. package/src/repo-coordination.js +725 -0
  258. package/src/repo-tree.js +106 -0
  259. package/src/repository-identity.js +13 -0
  260. package/src/retention-policy.js +466 -0
  261. package/src/review-inbox.js +38 -0
  262. package/src/routing.js +49 -0
  263. package/src/run-analysis.js +111 -0
  264. package/src/run-cold-store.js +231 -0
  265. package/src/run-environment.js +15 -0
  266. package/src/run-history.js +91 -0
  267. package/src/run-log.js +160 -0
  268. package/src/run-permissions.js +111 -0
  269. package/src/run-projection.js +77 -0
  270. package/src/run-recovery.js +53 -0
  271. package/src/run-status.js +56 -0
  272. package/src/serve.js +138 -0
  273. package/src/server.js +2871 -0
  274. package/src/shared-access.js +103 -0
  275. package/src/shared-accounts.js +381 -0
  276. package/src/shared-api.js +239 -0
  277. package/src/shell.js +346 -0
  278. package/src/ship.js +344 -0
  279. package/src/slots.js +74 -0
  280. package/src/snapshot.js +388 -0
  281. package/src/source-context.js +17 -0
  282. package/src/sse-writer.js +70 -0
  283. package/src/ssh-projects/bootstrap.mjs +95 -0
  284. package/src/ssh-projects/config.js +45 -0
  285. package/src/ssh-projects/gateway.js +143 -0
  286. package/src/ssh-projects/manager.js +320 -0
  287. package/src/ssh-projects/team-autostart.mjs +93 -0
  288. package/src/ssh-projects/team-remove.mjs +69 -0
  289. package/src/ssh-projects/team-status.mjs +39 -0
  290. package/src/ssh-projects/transport.js +133 -0
  291. package/src/stats.js +139 -0
  292. package/src/store.js +544 -0
  293. package/src/stream.js +91 -0
  294. package/src/sweeps.js +241 -0
  295. package/src/tailscale.js +101 -0
  296. package/src/task-draft.js +23 -0
  297. package/src/task-team.js +164 -0
  298. package/src/team-evaluation.js +243 -0
  299. package/src/team-mailbox.js +160 -0
  300. package/src/team-memory.js +84 -0
  301. package/src/team-rerun-graph.js +15 -0
  302. package/src/team-reruns.js +130 -0
  303. package/src/team-scheduler.js +121 -0
  304. package/src/team-steering.js +21 -0
  305. package/src/team-template-store.js +98 -0
  306. package/src/team-templates.js +117 -0
  307. package/src/team-tool-client.mjs +79 -0
  308. package/src/team-tools.js +235 -0
  309. package/src/teams.js +0 -0
  310. package/src/templates.js +62 -0
  311. package/src/transcript.js +134 -0
  312. package/src/verification-integrity.js +27 -0
  313. package/src/verification.js +183 -0
  314. package/src/watch.js +195 -0
  315. package/src/work-queue.js +47 -0
  316. package/src/workflow-control.js +83 -0
  317. package/src/workspace-api.js +207 -0
  318. package/src/workspace-changes.js +61 -0
  319. package/src/workspace.js +146 -0
package/public/docs/code-hosts.html ADDED
@@ -0,0 +1,35 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="GitLab and Bitbucket code workflows — code-flow guides and reference"><title>GitLab and Bitbucket code workflows · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="code-hosts"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" aria-current="page">GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Connect and collaborate</div><article><h1 id="gitlab-and-bitbucket-code-workflows">GitLab and Bitbucket code workflows</h1>
7
+ <p>Configure the GitLab or Bitbucket connection, fetch the change into an isolated review workflow, and inspect the pinned result before commenting, pushing or opening a pull request.</p>
8
+ <h2 id="review-on-another-code-host">Review on another code host</h2>
9
+ <p>Settings → Integrations → GitLab and Bitbucket code hosts provides explicit owner workflows for GitLab and Bitbucket Cloud. Jira, Linear and source-provider extensions remain read-only. No provider account is contacted in the fixture tests.</p>
10
+ <p>Configure integrations with <code>CODEFLOW_INTEGRATIONS_JSON</code> or <code>CODEFLOW_INTEGRATIONS_FILE</code>:</p>
11
+ <pre><code class="language-json">[
12
+ {&quot;id&quot;:&quot;gitlab&quot;,&quot;provider&quot;:&quot;gitlab&quot;,&quot;project&quot;:&quot;group/repository&quot;,&quot;credentialEnv&quot;:&quot;GITLAB_TOKEN&quot;},
13
+ {&quot;id&quot;:&quot;bitbucket&quot;,&quot;provider&quot;:&quot;bitbucket&quot;,&quot;project&quot;:&quot;workspace/repository&quot;,&quot;credentialEnv&quot;:&quot;BITBUCKET_TOKEN&quot;}
14
+ ]
15
+ </code></pre>
16
+ <p>Tokens remain server environment references. GitLab defaults to its v4 API and GitLab HTTPS Git root; Bitbucket defaults to its Cloud v2 API and bitbucket.org Git root. Self-hosted GitLab may set <code>baseUrl</code> and <code>gitBaseUrl</code>. A custom Bitbucket API base requires an explicit HTTPS <code>gitBaseUrl</code>; Bitbucket Data Center APIs are not supported. Neither root may contain credentials, query parameters or fragments. Fork paths must remain within the configured Git host/root; cross-host credential redirects are refused.</p>
17
+ <p>Choose a configured host, PR number and local Git repository. Loading a preview reads bounded provider metadata, discussions and available merge policy. Fetch explicitly imports exact source/target objects and their actual merge base into random application refs, without checking out or executing incoming code. Each snapshot expires after 15 minutes and all snapshots disappear on restart. Changed heads, targets, discussion revisions and project membership require a fresh preview. Truncated discussion lists cannot be resolved or replied to here; inspect the remaining discussion in the provider UI.</p>
18
+ <p>Fetched-code review runs require an explicitly prepared agent Docker image and optional named authentication volume. Build the image with the official CLI and authenticate inside that image/volume first. No host credential directory is mounted, images are never pulled automatically, and there is no native host fallback. The container runs with the host UID, dropped capabilities and resource limits; the CLI needs its own configured network access for inference. Check/setup commands run in a separate network-disabled container. Safe mode alone is not filesystem isolation. See the existing agent-container setup in the application architecture documentation.</p>
19
+ <p>The run begins at the fetched source commit, reads conventions from the trusted merge base, uses Safe mode, inherits no uploads or parent run, copies no ignored files, and cannot wait for native tool approvals. It needs at least one required verification command. Raw client <code>externalSource</code> or commit-provenance objects cannot establish authority. A restored or resumed run still needs its prepared agent container.</p>
20
+ <p>Review actions include general and new-file inline comments, replies, resolution/reopening, and GitLab exact-SHA approval/removal. Comments label the observed source and target commits. GitLab inline positions include its base/head/start diff identities. Bitbucket inline comments and approvals do not expose an atomic expected-head precondition: comments explicitly label the observed commit, postflight drift is reported, and commit-bound Bitbucket approval is deliberately unavailable here. Use Bitbucket&#39;s native UI for its approval action. Review content remains untrusted reference text.</p>
21
+ <p>Push starts with a preview of a completed, owned, currently verified result branch. The result must descend from the observed PR source and include current required check evidence. Push sends only that exact commit to the observed source branch with <code>--force-with-lease=&lt;ref&gt;:&lt;observed-head&gt;</code>; arbitrary force pushes are not available. GitLab fork pushes require a separately configured source integration. No push occurs when merely loading the preview.</p>
22
+ <p>New PR creation accepts a completed owned verified result, configured destination host, title/body and target branch. The result must contain new commits descending from that exact current target. Its preview shows a unique server-generated source branch, source/target commits and outgoing text. The explicit action creates the source branch with an expected-absent Git lease, then sends the native GitLab MR or Bitbucket PR creation request. Those two remote actions are not atomic. A timeout preserves the exact branch/commit/run receipt as unknown; inspect that branch and the provider before another attempt. The application never retries creation automatically or deletes ambiguous remote branches.</p>
23
+ <p>Merge is an explicitly labelled <strong>pinned Git merge</strong>, not a provider-native merge queue. A completed owned result must exactly match the current PR source and required verification/review evidence. The actual source-plus-target tree is built and checked in a disposable worktree using network-disabled check isolation and tracked-file/index/HEAD drift guards. The final commit has exactly the pinned target and source as parents. Its push uses an atomic exact-target Git lease. Source advancement cannot add unreviewed code; target advancement refuses the push. The local target branch is unchanged.</p>
24
+ <p>Provider policy must be readable and pass at preview and immediately before the action. GitLab approval state, exact-head pipeline requirements, discussion requirements, external checks and protected-branch metadata are inspected. Native trains, merged pipelines and enforced squash/rebase workflows are blocked. Bitbucket mergeability checks and complete branch restrictions must be readable, including the admin scope required by the restrictions API. Native queues, custom on-merge checks, dependency-merge requirements, incomplete results and unknown restriction types block merging. Direct target push permission is required and the Git server still enforces its push permissions. Provider APIs do not offer an atomic approval-policy snapshot tied to the Git ref update; organizations requiring exclusively native policy enforcement should merge in the provider UI.</p>
25
+ <p>GitLab&#39;s native merge endpoint pins the source SHA but does not pin the target SHA. Bitbucket&#39;s native merge endpoint does not expose an expected-head precondition and can queue its operation. Consequently this application does not call either native merge endpoint while claiming an exact validated target. A confirmed Git merge receipt does not imply atomic PR closure; the current provider state is reported separately and the PR may remain open. No native merge queue parity is claimed.</p>
26
+ <p>Credentialed Git runs in a private temporary bare repository with no user/global Git config, hooks, credential helper, redirects or submodules. Authentication is a process-only URL-scoped HTTPS header. Local object imports receive no provider credential. Fetches are bounded in time, output, file count and temporary storage (256 MiB); oversized histories fail closed. Local application refs keep imported objects reachable and are normal repository data; no credential is stored in them.</p>
27
+ <p>The bounded <code>code-host-operations.json</code> ledger retains at most 200 explicit actions and safe identity/commit/run/branch facts. Unknown receipts are never silently evicted: if all slots are unresolved, new actions stop until the owner explicitly records manual inspection of one exact outcome. Inspection is labelled separately from provider confirmation and never replays the action. The ledger stores no tokens, comment bodies, tasks or executable callbacks. Claims are fsynced before remote mutation; interrupted or restored claims become unknown metadata, all server previews are lost, and there is no startup dispatch or automatic replay. Retention protects referenced run receipts. Encrypted restore also excludes executable extension caches and live identity/session credentials. Any custom filesystem policy blocks all code-host POST operations, and shared project sessions cannot access these owner-only routes.</p>
28
+ <p>Provider protocol references: <a href="https://docs.gitlab.com/api/merge_requests/">GitLab merge requests</a>, <a href="https://docs.gitlab.com/api/discussions/">GitLab discussions</a>, <a href="https://docs.gitlab.com/api/merge_request_approvals/">GitLab approvals</a>, <a href="https://docs.gitlab.com/api/status_checks/">GitLab external status checks</a>, <a href="https://developer.atlassian.com/cloud/bitbucket/rest/api-group-pullrequests/">Bitbucket Cloud pull requests</a>, <a href="https://developer.atlassian.com/cloud/bitbucket/rest/api-group-branch-restrictions/">Bitbucket branch restrictions</a>, <a href="https://docs.gitlab.com/user/profile/personal_access_tokens/">GitLab HTTPS tokens</a>, <a href="https://support.atlassian.com/bitbucket-cloud/docs/using-access-tokens/">Bitbucket HTTPS access tokens</a>.</p>
29
+ <hr>
30
+ <p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
31
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/code-hosts.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="remote-workers.html"><small>← Previous</small>Remote agent workers</a><a href="external-sources.html"><small>Next →</small>Read-only external sources</a></nav></main>
32
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#review-on-another-code-host">Review on another code host</a></aside>
33
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
34
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
35
+ </body></html>
package/public/docs/code-intelligence.html ADDED
@@ -0,0 +1,35 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Code intelligence — code-flow guides and reference"><title>Code intelligence · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="code-intelligence"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" aria-current="page">Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Your workspace</div><article><h1 id="code-intelligence">Code intelligence</h1>
7
+ <p>Open Project → Repository tools → Code, search for a JavaScript or TypeScript symbol, and choose Find references. Save editor changes first: the inspection reads saved files.</p>
8
+ <h2 id="find-a-symbol">Find a symbol</h2>
9
+ <p>Project → Repository tools → Code offers text search, simple multi-language declaration search,
10
+ and JavaScript/TypeScript symbols backed by TypeScript&#39;s language service.
11
+ Semantic symbol results include a <strong>Find references</strong> action. Imported aliases
12
+ are resolved; ordinary text mentions are not treated as references. Each request
13
+ uses saved repository files, so unsaved editor drafts are excluded.</p>
14
+ <p>Language-service computation runs in a separate worker with a 10-second deadline and a
15
+ 192 MiB heap ceiling, and only one inspection runs at once. The in-memory file
16
+ host contains at most 500 regular source files and 8 MiB of source. Results stop
17
+ at 200 locations and explicitly report truncation. Credential selections,
18
+ symbolic links, external libraries, compiler plugins and generated directories
19
+ are excluded. Repository compiler configuration is not executed or loaded; the
20
+ initial implementation uses a fixed safe compiler configuration and relative
21
+ module resolution. Project-specific path aliases may therefore be unresolved.</p>
22
+ <p>The API supports <code>GET /api/v1/workspace/search?repo=...&amp;mode=semantic&amp;q=...</code>
23
+ and <code>GET /api/v1/workspace/references?repo=...&amp;path=...&amp;line=...&amp;column=...</code>.
24
+ Locations are one-based and columns use UTF-16 code units, matching the language
25
+ service. Results include the actual language-service version and scope limits.</p>
26
+ <p>Unit fixtures check imported aliases, string-mention exclusions, current-content
27
+ refresh, symlink/credential/plugin boundaries and cancellation. Browser acceptance
28
+ exercises symbol search and cross-file reference navigation against saved JavaScript.</p>
29
+ <hr>
30
+ <p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
31
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/code-intelligence.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="launch-profiles.html"><small>← Previous</small>Service launch profiles</a><a href="architecture-explorer.html"><small>Next →</small>Architecture explorer</a></nav></main>
32
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#find-a-symbol">Find a symbol</a></aside>
33
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
34
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
35
+ </body></html>
package/public/docs/configuration.html ADDED
@@ -0,0 +1,346 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Configuration — code-flow guides and reference"><title>Configuration · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="configuration"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" aria-current="page">Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Your workspace</div><article><h1 id="configuration">Configuration</h1>
7
+ <p>Use Settings for application preferences and connections. Open a project’s Repository tools for verification, history and services. Use <code>.codeflow/config.json</code> for committed repository defaults.</p>
8
+ <h2 id="application-settings">Application settings</h2>
9
+ <p>Open <strong>Settings</strong> at the bottom of the sidebar, press <strong>⌘, / Ctrl+,</strong>, or search for a settings category in the command palette. Categories have shareable addresses such as <code>#/settings/ssh</code>; browser Back and Forward preserve navigation. Search settings by a feature name such as “theme”, “permissions”, “VM”, or “Tailscale”.</p>
10
+ <ul>
11
+ <li><strong>General:</strong> light, dark, or system appearance; sidebar grouping; archived runs; keyboard shortcuts. Terminals follow the selected appearance.</li>
12
+ <li><strong>Agents &amp; models:</strong> provider health and usage, model and effort defaults. Sign in through the provider CLI on the current machine.</li>
13
+ <li><strong>Run defaults:</strong> workflow, plan approval, agent permissions and run limits. These update the composer’s remembered choices and the current draft; running work is unchanged. Project defaults and per-role choices can override model preferences.</li>
14
+ <li><strong>Notifications:</strong> browser notifications and outbound notification destinations.</li>
15
+ <li><strong>SSH connections:</strong> save and open remote VMs, with optional port and identity-file overrides. See <a href="ssh-projects.html">SSH projects</a>.</li>
16
+ <li><strong>Remote access:</strong> Tailscale, Wi-Fi, pairing and device access to the local workspace.</li>
17
+ <li><strong>Team:</strong> connect this computer to a team server as a runner and map repository keys to local clones; on the team server, define each project&#39;s repository keys and the owner&#39;s display name, read the <code>https://</code> address teammates connect to and revoke runners. See <a href="team-collaboration.html">Team collaboration</a>.</li>
18
+ <li><strong>Integrations, Projects &amp; access, Extensions, Data &amp; storage:</strong> existing source/code-host/worker integrations, project conventions, filesystem policies, shared accounts, extensions and retention controls.</li>
19
+ <li><strong>Advanced:</strong> collect/export diagnostics and find the server configuration reference. Process-level settings and credentials remain environment configuration and require a restart.</li>
20
+ </ul>
21
+ <p>Appearance, run defaults and sidebar preferences save in this browser, separately for each SSH workspace. SSH definitions and the team link with its repository mappings save on the local server; project, access, notification and retention settings save on the machine hosting that workspace; team board tasks, checkpoints and runner registrations save on the team server the link points to. Controls with a <strong>Save</strong> action keep their existing explicit save behavior. Numeric run limits save when you leave the field; invalid values restore the previous setting.</p>
22
+ <p><strong>Project → Repository tools</strong> contains verification, code editing, dependency and context inspection, checkpoints, services, coordinated changes and filtered tasks. <strong>Inbox</strong> and <strong>Automations</strong> are sidebar destinations. Open <strong>Insights</strong> and the workspace from the application menu or command palette. Older Settings URLs redirect to the current destinations.</p>
23
+ <h2 id="per-repo-config">Per-repo config</h2>
24
+ <p>Commit <code>.codeflow/config.json</code> and every run in that repo (and every teammate) gets the same defaults. Anything you set in the UI wins.</p>
25
+ <pre><code class="language-json">{
26
+ &quot;check&quot;: &quot;npm test&quot;,
27
+ &quot;setup&quot;: &quot;npm ci&quot;,
28
+ &quot;copy&quot;: [&quot;.env&quot;, &quot;.env.local&quot;, &quot;config/*.local.json&quot;],
29
+ &quot;run&quot;: { &quot;command&quot;: &quot;npm run dev&quot;, &quot;port&quot;: 3000 },
30
+ &quot;models&quot;: { &quot;claude&quot;: { &quot;model&quot;: &quot;opus&quot;, &quot;effort&quot;: &quot;high&quot; } },
31
+ &quot;limits&quot;: { &quot;maxMinutes&quot;: 90, &quot;maxSteps&quot;: 60 },
32
+ &quot;trust&quot;: &quot;standard&quot;,
33
+ &quot;image&quot;: &quot;node:22&quot;,
34
+ &quot;learn&quot;: true,
35
+ &quot;prove&quot;: true
36
+ }
37
+ </code></pre>
38
+ <ul>
39
+ <li><p><code>check</code> and <code>setup</code>: the composer suggests both from the repo (see <a href="patterns.html#checks-loops-and-limits">Checks</a>), but set them here when the guess is wrong. A uv workspace whose tests live in their own member might use:</p>
40
+ <pre><code class="language-json">{ &quot;setup&quot;: &quot;uv sync --all-packages&quot;, &quot;check&quot;: &quot;cd tests &amp;&amp; uv run --no-sync pytest -q&quot; }
41
+ </code></pre>
42
+ <p>Setup runs once per worktree outside the agents&#39; sandboxes, so the check can run without network (<code>--no-sync</code>). When a run&#39;s check can&#39;t run at all (not installed, nothing collected, <code>conftest.py</code> can&#39;t import the project), the run says so and asks you to set these.</p>
43
+ </li>
44
+ <li><p><code>copy</code> brings files git doesn&#39;t carry (like <code>.env</code>) from your checkout into every new worktree. Only regular files that git ignores are copied. Symlinks are refused, since a cloned repo&#39;s <code>.env</code> could point at your credentials, and so are files git would commit. Patterns can&#39;t reach outside the repo, and nothing is copied through a symlink in the worktree.</p>
45
+ <ul>
46
+ <li>Copied files are never committed, even when an agent un-ignores one or runs <code>git add -f</code>. Neither are new files named like secrets (<code>.env</code>, <code>.env.*</code> other than <code>.env.example</code>, <code>.env.sample</code> and <code>.env.template</code>, <code>*.pem</code>, <code>id_rsa*</code>, <code>id_ed25519*</code>). They stay in the worktree, and a warning names what was left out. Commit such a file yourself if it belongs in the repo.</li>
47
+ </ul>
48
+ </li>
49
+ <li><p><code>image</code> is the Docker image for running checks in isolation (automations, untrusted sources). <code>learn</code> passes recurring review problems on to later runs. <code>prove</code> checks that each passing result has a test that fails without it (<a href="patterns.html#checks-loops-and-limits">fail-to-pass</a>); set it to <code>false</code> when the check is too slow to run twice.</p>
50
+ </li>
51
+ <li><p>A result&#39;s worktree that was removed (archived) is set up again when you follow up on it: files copied, setup run, context restored, and the files you sent with the follow-up added. If its branch was deleted, that follow-up fails with a clear message; the run itself stays finished. A follow-up also fails, rather than delete anything, when the worktree&#39;s folder is there but holds something else: move that folder away, then send it again.</p>
52
+ </li>
53
+ <li><p><strong>Try it:</strong> each result has <strong>Terminal</strong>, <strong>Editor</strong> (Cursor, VS Code, Zed or Sublime, whichever is installed) and <strong>Folder</strong> buttons that open its worktree, plus <strong>▶ Run app</strong>.</p>
54
+ <ul>
55
+ <li>Run app starts your dev server in the worktree on a free port (passed as <code>$PORT</code>), with logs and <strong>Stop app</strong>. Servers stop when the run is archived or code-flow shuts down.</li>
56
+ </ul>
57
+ </li>
58
+ </ul>
59
+ <h2 id="what-agents-may-do-while-building">What agents may do while building</h2>
60
+ <p><strong>Settings → Run defaults → Agent permissions:</strong></p>
61
+ <div class="table-scroll" tabindex="0"><table>
62
+ <thead>
63
+ <tr>
64
+ <th>Mode</th>
65
+ <th>Claude Code</th>
66
+ <th>Codex</th>
67
+ <th>Antigravity</th>
68
+ </tr>
69
+ </thead>
70
+ <tbody><tr>
71
+ <td>Safe</td>
72
+ <td>edits files; no shell beyond read-only git</td>
73
+ <td>edits inside its sandbox</td>
74
+ <td>sandboxed to the worktree</td>
75
+ </tr>
76
+ <tr>
77
+ <td>Standard (default)</td>
78
+ <td>edits + common build/test commands (npm, node, pytest, uv, poetry, cargo, go, make…)</td>
79
+ <td>sandboxed, no network</td>
80
+ <td>sandboxed to the worktree</td>
81
+ </tr>
82
+ <tr>
83
+ <td>Trusted</td>
84
+ <td>any command</td>
85
+ <td>sandboxed, with network</td>
86
+ <td>sandboxed to the worktree</td>
87
+ </tr>
88
+ <tr>
89
+ <td>Full access</td>
90
+ <td>any tool, no permission checks (<code>bypassPermissions</code>)</td>
91
+ <td>no sandbox (<code>danger-full-access</code>)</td>
92
+ <td>no sandbox (no <code>--sandbox</code>)</td>
93
+ </tr>
94
+ </tbody></table>
95
+ </div><p><strong>Full access</strong> turns every agent&#39;s sandbox off in steps that build: an agent can run anything, use the network, and change files outside its worktree with your credentials. Use it only on repos and tasks you trust completely. To keep it a choice you make:</p>
96
+ <ul>
97
+ <li>It&#39;s picked per run in the composer, which warns while it&#39;s on, and the run shows ⚠ full access. A repo&#39;s <code>.codeflow/config.json</code> can&#39;t turn it on: <code>&quot;trust&quot;: &quot;full&quot;</code> there is ignored.</li>
98
+ <li>Planning, reviewing and judging steps stay read-only, as in every mode.</li>
99
+ <li>Runs nobody watches get less: automations and sweeps run with Trusted, and fixes for watched pull requests with Standard.</li>
100
+ <li>A run started from someone outside the repo is locked down to Safe whatever you picked (see <a href="github.html#untrusted-text">Untrusted text</a>).</li>
101
+ </ul>
102
+ <p>Whatever the mode, code-flow never merges or pushes on its own.</p>
103
+ <h2 id="models">Models</h2>
104
+ <p>Per provider in <strong>Settings → Agents &amp; models</strong>, and per role right under each role&#39;s agents in the team. See <a href="getting-started.html#models-and-effort">Getting started</a>.</p>
105
+ <h2 id="light-or-dark">Light or dark</h2>
106
+ <p>code-flow follows your system’s appearance until you choose Light or Dark in <strong>Settings → General</strong>. The pick is kept in that browser, and a side panel popped out into its own window follows it.</p>
107
+ <h2 id="health">Health</h2>
108
+ <p>Click the agent dots at the bottom of the sidebar to see, for each CLI, whether it&#39;s installed, its version, and whether it&#39;s signed in. It uses <code>claude auth status</code>, <code>codex login status</code>, and for agy whether it can list models; credentials are never read. Claude&#39;s 5-hour and 7-day usage windows are shown from its own reports, with how to fix anything that&#39;s wrong. A run won&#39;t start with an agent that&#39;s signed out, and Auto skips an agent that turned out to be signed out for 15 minutes. If agy can&#39;t reach its servers, its sign-in shows as unknown rather than signed out.</p>
109
+ <p>Health also checks that each installed CLI still accepts the flags and subcommands code-flow passes (from its <code>--help</code>), and warns when one is missing: after a CLI update, that&#39;s the difference between &quot;healthy&quot; and every step failing on an unknown option. It also checks for git 2.38 or newer, which Merge needs.</p>
110
+ <p>Once an agent CLI reports its final result, it gets 10 seconds to exit; one that&#39;s still running then (a hook or MCP server that hangs on shutdown) is stopped and its result kept. A single output line over 16 MB is skipped, not read into memory.</p>
111
+ <h2 id="environment-variables">Environment variables</h2>
112
+ <div class="table-scroll" tabindex="0"><table>
113
+ <thead>
114
+ <tr>
115
+ <th>Env var</th>
116
+ <th>Default</th>
117
+ <th>Purpose</th>
118
+ </tr>
119
+ </thead>
120
+ <tbody><tr>
121
+ <td><code>PORT</code></td>
122
+ <td><code>4317</code></td>
123
+ <td>Server port</td>
124
+ </tr>
125
+ <tr>
126
+ <td><code>CODEFLOW_HOME</code></td>
127
+ <td><code>~/.codeflow</code></td>
128
+ <td>Run logs and code-flow&#39;s own files (see <a href="#files-in-codeflow">below</a>)</td>
129
+ </tr>
130
+ <tr>
131
+ <td><code>CODEFLOW_WORKTREE_DIR</code></td>
132
+ <td><code>.worktrees</code></td>
133
+ <td>Worktree folder; relative paths are inside each repo, absolute paths are used as-is</td>
134
+ </tr>
135
+ <tr>
136
+ <td><code>CODEFLOW_STEP_TIMEOUT_MIN</code></td>
137
+ <td><code>30</code></td>
138
+ <td>Timeout per agent step</td>
139
+ </tr>
140
+ <tr>
141
+ <td><code>CODEFLOW_STEP_IDLE_MIN</code></td>
142
+ <td><code>15</code></td>
143
+ <td>An agent CLI that prints nothing for this long is stuck (a login prompt, a stalled network, a hook that never returns) and is stopped. Keep it above your longest silent test run</td>
144
+ </tr>
145
+ <tr>
146
+ <td><code>CODEFLOW_GIT_TIMEOUT_SEC</code></td>
147
+ <td><code>300</code></td>
148
+ <td>Longest a git command may run, hooks included; cloning a new worktree&#39;s submodules gets 10 minutes</td>
149
+ </tr>
150
+ <tr>
151
+ <td><code>CODEFLOW_MERGE_TIMEOUT_SEC</code></td>
152
+ <td><code>1800</code></td>
153
+ <td>Longest <strong>Merge…</strong> may take in a checkout, your hooks included (a post-merge <code>npm install</code>, Git LFS). If git is stopped after it made the merge commit, the merge counts as done, with a warning</td>
154
+ </tr>
155
+ <tr>
156
+ <td><code>CODEFLOW_MAX_AGENTS</code></td>
157
+ <td><code>6</code></td>
158
+ <td>Agent CLIs running at once, across all runs</td>
159
+ </tr>
160
+ <tr>
161
+ <td><code>CODEFLOW_MAX_CHECKS</code></td>
162
+ <td><code>3</code></td>
163
+ <td>Check and setup commands running at once, across all runs</td>
164
+ </tr>
165
+ <tr>
166
+ <td><code>CODEFLOW_RETRY_DELAYS_MS</code></td>
167
+ <td><code>20000,60000</code></td>
168
+ <td>Waits before retrying an agent turn that failed for a passing reason</td>
169
+ </tr>
170
+ <tr>
171
+ <td><code>CODEFLOW_TOKEN</code></td>
172
+ <td>random per start</td>
173
+ <td>The session token (set it to keep browsers signed in across restarts; anything that can read it can use the API)</td>
174
+ </tr>
175
+ <tr>
176
+ <td><code>CODEFLOW_MAX_DIFF_CHARS</code></td>
177
+ <td><code>60000</code></td>
178
+ <td>Diffs longer than this are fitted (whole files first) before being passed to another agent</td>
179
+ </tr>
180
+ <tr>
181
+ <td><code>CODEFLOW_CLAUDE_WRITE_TOOLS</code></td>
182
+ <td>build/test allow-list</td>
183
+ <td>Comma-separated Claude tool rules for write mode, e.g. <code>Edit,Bash</code></td>
184
+ </tr>
185
+ <tr>
186
+ <td><code>CODEFLOW_REMOTE_PORT</code></td>
187
+ <td><code>PORT+1</code></td>
188
+ <td>Port for the phone view (or the full app, with phone control) and webhooks on your network, when Wi-Fi or Tailscale is selected under <strong>Remote access</strong></td>
189
+ </tr>
190
+ <tr>
191
+ <td><code>CODEFLOW_TLS_CERT</code>, <code>CODEFLOW_TLS_KEY</code></td>
192
+ <td>unset</td>
193
+ <td>Optional certificate/key file paths overriding saved HTTPS setup in Settings → Connections → Share access. Configure both together; full control requires TLS on Wi-Fi and Tailscale so browser session cookies remain Secure</td>
194
+ </tr>
195
+ <tr>
196
+ <td><code>CODEFLOW_ALLOW_INSECURE_PHONE_CONTROL</code></td>
197
+ <td>unset</td>
198
+ <td>Explicit <code>1</code> permits full phone control over HTTP for development</td>
199
+ </tr>
200
+ <tr>
201
+ <td><code>CODEFLOW_INTEGRATIONS_FILE</code>, <code>CODEFLOW_INTEGRATIONS_JSON</code></td>
202
+ <td>unset</td>
203
+ <td>Explicit external source definitions with server credential references; imports are read-only, while <a href="code-hosts.html">GitLab/Bitbucket code actions</a> require separate explicit previews/actions</td>
204
+ </tr>
205
+ <tr>
206
+ <td><code>CODEFLOW_REMOTE_WORKERS_FILE</code>, <code>CODEFLOW_REMOTE_WORKERS_JSON</code></td>
207
+ <td>unset</td>
208
+ <td>Explicit provisioned SSH targets and repository mapping names; see <a href="remote-workers.html">remote workers</a></td>
209
+ </tr>
210
+ <tr>
211
+ <td><code>CODEFLOW_EXTENSIONS_FILE</code>, <code>CODEFLOW_EXTENSIONS_JSON</code></td>
212
+ <td>unset</td>
213
+ <td>Explicit trusted bundled provider/workflow plugins with API negotiation and SHA-256 pins; choose one configuration source; see <a href="extensions.html">extensions</a></td>
214
+ </tr>
215
+ <tr>
216
+ <td><code>CODEFLOW_NOTIFICATIONS_FILE</code>, <code>CODEFLOW_NOTIFICATIONS_JSON</code></td>
217
+ <td>unset</td>
218
+ <td>Explicit outbound destinations; targets remain disabled until event/project opt-in; see <a href="notifications.html">notifications</a></td>
219
+ </tr>
220
+ <tr>
221
+ <td><code>CODEFLOW_SCHEDULER_TICK_MS</code></td>
222
+ <td><code>30000</code></td>
223
+ <td>How often due automations are checked</td>
224
+ </tr>
225
+ <tr>
226
+ <td><code>CODEFLOW_WATCH_INTERVAL_MS</code></td>
227
+ <td><code>60000</code></td>
228
+ <td>How often watched PRs are checked for CI results and new comments. A PR that stays green with no new comments is checked less often, up to every 10 minutes</td>
229
+ </tr>
230
+ <tr>
231
+ <td><code>CODEFLOW_CODEX_TRANSPORT</code></td>
232
+ <td><code>auto</code></td>
233
+ <td><code>auto</code>: <code>codex app-server</code> when the installed Codex has it, else <code>codex exec</code>. A Codex without app-server is re-checked every 10 minutes; a slow or failed app-server start fails only that turn. <code>app-server</code>: require it. <code>exec</code>: always <code>codex exec</code> (your notes then wait for Codex&#39;s next turn)</td>
234
+ </tr>
235
+ <tr>
236
+ <td><code>CODEFLOW_PYTHON</code></td>
237
+ <td><code>python3</code></td>
238
+ <td>The Python 3 that runs the side panel Terminal&#39;s pseudo-terminal (<code>scripts/pty.py</code>). It&#39;s found once and run by its full path, so a repository that pins another Python (pyenv, asdf, mise) still gets a terminal. Without a working one, terminals are line-based (<code>interactiveTerminal: false</code> in <code>/api/health</code>)</td>
239
+ </tr>
240
+ <tr>
241
+ <td><code>CODEFLOW_CHROME</code></td>
242
+ <td>first one installed</td>
243
+ <td>The Chrome, Chromium, Edge or Brave the side panel Browser&#39;s <strong>Snapshot</strong> runs headless. Without one, Snapshot says so</td>
244
+ </tr>
245
+ <tr>
246
+ <td><code>CODEFLOW_AGY_SKIP_PERMISSIONS</code></td>
247
+ <td><code>1</code></td>
248
+ <td>Set to <code>0</code> to stop passing <code>--dangerously-skip-permissions</code> to agy; then configure <code>permissions.allow</code> in <code>~/.gemini/antigravity-cli/settings.json</code></td>
249
+ </tr>
250
+ </tbody></table>
251
+ </div><p>A numeric setting that isn&#39;t a valid number (<code>30m</code>, say) or is out of range falls back to its default, with a warning in the terminal.</p>
252
+ <p>Child processes exclude the application API token, scoped team capabilities, integration/notification configuration and their registered server credential variables. They also exclude npm lifecycle variables about code-flow itself and its own dependency bin paths; your <code>npm_config_*</code> settings remain. A check&#39;s tools come from its repository. Explicit agent containers use a smaller environment and only their configured authentication volume; see <a href="agent-containers.html">container setup</a>.</p>
253
+ <h2 id="files-in-codeflow">Files in <code>~/.codeflow</code></h2>
254
+ <div class="table-scroll" tabindex="0"><table>
255
+ <thead>
256
+ <tr>
257
+ <th>File</th>
258
+ <th>What it is</th>
259
+ </tr>
260
+ </thead>
261
+ <tbody><tr>
262
+ <td><code>runs/&lt;run&gt;.jsonl</code></td>
263
+ <td>Each run&#39;s event log, appended as it happens; runs are rebuilt from it at startup. A run snapshot after the first is written as what changed; logs from older versions are compacted once, in the background. Unreadable lines (a crash mid-write) are skipped and noted in <code>server.log</code></td>
264
+ </tr>
265
+ <tr>
266
+ <td><code>runs/&lt;run&gt;.journal.jsonl</code></td>
267
+ <td>The result of each completed step, written to disk at once, so <strong>Resume</strong> replays them instead of running them again</td>
268
+ </tr>
269
+ <tr>
270
+ <td><code>runs/&lt;run&gt;.cold-index.json</code>, <code>runs/&lt;run&gt;.cold-detail.json</code></td>
271
+ <td>Optional source-validated archived projections; corrupt/stale projections rebuild from the event log. Full archived detail uses a bounded cache; see <a href="run-storage.html">run storage</a></td>
272
+ </tr>
273
+ <tr>
274
+ <td><code>shared-accounts.json</code></td>
275
+ <td>Private password/session hashes, expiring accounts and project roles. Never exported in backups; see <a href="shared-projects.html">shared projects</a></td>
276
+ </tr>
277
+ <tr>
278
+ <td><code>shared-reviews/&lt;run&gt;.json</code></td>
279
+ <td>Commit-anchored human comments, separate from agent notes and prompts</td>
280
+ </tr>
281
+ <tr>
282
+ <td><code>team/</code></td>
283
+ <td>The team board this instance serves: <code>board.json</code> (each project&#39;s repository keys and its tasks with attempts, checkpoint manifests, discussion, decisions, instructions, reviews, hand-overs and audit), <code>runners.json</code> (runner names and credential hashes, never credentials), <code>inbox.json</code> and <code>checkpoints/&lt;checkpoint id&gt;.bundle</code>. Written whole through temporary files (heartbeats and progress reports reach <code>board.json</code> with the next durable change or within 30 s); one that can&#39;t be read is moved aside to <code>&lt;name&gt;.corrupt-&lt;time&gt;</code> and logged. At startup, temporary files and bundles that no available checkpoint lists are removed from <code>checkpoints/</code> and the removal is logged. Included in backups; see <a href="team-collaboration.html">team collaboration</a></td>
284
+ </tr>
285
+ <tr>
286
+ <td><code>team-link.json</code></td>
287
+ <td>This computer&#39;s link to a team server: its address, this computer&#39;s runner credential, your account, your repository mappings and defaults (mode 0600). Never exported in backups, like <code>shared-accounts.json</code>, and skipped by a restore; after restoring a backup on a linked computer, connect it again in <strong>Settings → Connections → Share access → People</strong> and re-enter its repository mappings and defaults</td>
288
+ </tr>
289
+ <tr>
290
+ <td><code>team-link/attempts/&lt;attempt&gt;.json</code></td>
291
+ <td>Which local run belongs to which board attempt, and what was published; read at startup, by the recovery pass every minute and after a restore to reconcile with the team server, never to start anything again</td>
292
+ </tr>
293
+ <tr>
294
+ <td><code>team-link/bundles/&lt;checkpoint id&gt;.bundle</code></td>
295
+ <td>A checkpoint bundle this computer created, kept until the team server has received it; a failed upload is retried with the same file, and the file of a checkpoint that was given up is deleted</td>
296
+ </tr>
297
+ <tr>
298
+ <td><code>filesystem-policies/&lt;project&gt;.json</code></td>
299
+ <td>Revisioned read/write rules and content hashes; see <a href="filesystem-policy.html">filesystem policy</a></td>
300
+ </tr>
301
+ <tr>
302
+ <td><code>filtered-tasks/</code></td>
303
+ <td>Private filtered exports, exact policy/source/result records and explicit import receipts; never a startup execution queue</td>
304
+ </tr>
305
+ <tr>
306
+ <td><code>remote-worker-private/</code></td>
307
+ <td>Private SSH receipt capabilities; excluded from ordinary result projections and restore authority</td>
308
+ </tr>
309
+ <tr>
310
+ <td><code>code-host-operations.json</code></td>
311
+ <td>Safe confirmed/unknown code-host mutation receipts; no automatic replay after restart or restore</td>
312
+ </tr>
313
+ <tr>
314
+ <td><code>extension-cache/</code></td>
315
+ <td>Captured trusted plugin bundles; excluded from backup/restore and rebuilt only from explicit reviewed configuration</td>
316
+ </tr>
317
+ <tr>
318
+ <td><code>projects.json</code></td>
319
+ <td>Your <a href="runs.html#projects">projects</a>: names, repositories, and the team each one last used. Written whole (through a temporary file); a change that can&#39;t be saved fails and is undone. One that can&#39;t be read is moved aside to <code>projects.json.corrupt-&lt;time&gt;</code> and logged; if it can&#39;t be moved either, projects are off (runs start without one) until it&#39;s fixed</td>
320
+ </tr>
321
+ <tr>
322
+ <td><code>server.log</code></td>
323
+ <td>code-flow&#39;s own log, one JSON line per entry: failed requests, unhandled errors, failed writes, processes it cleaned up. Past 5 MB it moves to <code>server.log.1</code> (one old file is kept)</td>
324
+ </tr>
325
+ <tr>
326
+ <td><code>processes.json</code></td>
327
+ <td>The process groups code-flow has started and not seen finish. If code-flow dies without a clean exit (a crash, <code>kill -9</code>, a closed terminal), the next start stops what&#39;s left before resuming anything, so an orphaned agent can&#39;t keep editing a worktree. Pids from before a reboot, or reused by another program, are left alone</td>
328
+ </tr>
329
+ <tr>
330
+ <td><code>server.lock</code></td>
331
+ <td>One server per <code>CODEFLOW_HOME</code>. It records the server&#39;s pid, start time and the boot, so a lock left by a crash is taken over even when another program now has that pid, or after a reboot</td>
332
+ </tr>
333
+ </tbody></table>
334
+ </div><h2 id="dynamic-teams">Dynamic teams</h2>
335
+ <p><code>CODEFLOW_AUTO_TEAM_ENABLED=false</code> disables new Auto team runs while preserving saved-run viewing and recovery. The rollout record and evaluation evidence are shown in Insights; the composer selects Auto initially only at the <code>default</code> stage when there is no saved workflow preference. The recorded stage is informational (and a composer default when set to <code>default</code>); only <code>CODEFLOW_AUTO_TEAM_ENABLED</code> changes whether new Auto runs can start. Existing runs without the <code>eventDriven</code> option retain dependency-wave replay; newly created Auto runs default it on.</p>
336
+ <p>The authenticated run API accepts <code>loop.maxInvocations</code> as an additional per-allocation ceiling on actual CLI launches, including retries. Auto already caps launches with its step budget. Follow-up requests can specify <code>budget: { maxSteps, maxInvocations, maxMinutes }</code>; the UI exposes this fresh allocation and retains lifetime usage.</p>
337
+ <p>Project memory is in <code>memory.sqlite</code>, with automatic verified import from <code>memory.json</code>, indexed keyword search and a lightweight knowledge graph. See <a href="memory-storage.html">Memory storage</a> for migration, rollback, runtime requirements and backup behavior. Evaluation reports and the explicit rollout decision still use durable replacement files under the evaluation store in <code>CODEFLOW_HOME</code>. See <a href="auto-team.html">Auto team</a> for scope, trust, revision and deletion semantics.</p>
338
+ <h2 id="project-missions">Project missions</h2>
339
+ <p>Click <strong>Enable project missions</strong> on a project page to enable the feature immediately and save the choice for this host across restarts. <code>CODEFLOW_PROJECT_TEAMS_ENABLED=true</code> is an optional initial default; a saved UI choice takes precedence. <code>CODEFLOW_AUTO_TEAM_ENABLED</code> must also permit Auto team execution. Each team is separately activated by its owner. Schedules, budgets, missions, recovery and provider limits are described in <a href="project-teams.html">Project missions</a>.</p>
340
+ <hr>
341
+ <p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
342
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/configuration.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="deferred-runs.html"><small>← Previous</small>Deferred runs</a><a href="context-inspection.html"><small>Next →</small>Context and budgets</a></nav></main>
343
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#application-settings">Application settings</a><a class="depth-2" href="#per-repo-config">Per-repo config</a><a class="depth-2" href="#what-agents-may-do-while-building">What agents may do while building</a><a class="depth-2" href="#models">Models</a><a class="depth-2" href="#light-or-dark">Light or dark</a><a class="depth-2" href="#health">Health</a><a class="depth-2" href="#environment-variables">Environment variables</a><a class="depth-2" href="#files-in-codeflow">Files in ~/.codeflow</a><a class="depth-2" href="#dynamic-teams">Dynamic teams</a><a class="depth-2" href="#project-missions">Project missions</a></aside>
344
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
345
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
346
+ </body></html>
package/public/docs/context-inspection.html ADDED
@@ -0,0 +1,23 @@
1
+ <!doctype html>
2
+ <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Context and budgets — code-flow guides and reference"><title>Context and budgets · code-flow</title><link rel="icon" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
3
+ <body data-page="context-inspection"><a class="skip-link" href="#content">Skip to content</a>
4
+ <header class="topbar"><a class="brand" href="index.html"><img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSIzMCIgZmlsbD0iIzFlMWYxYSIgc3Ryb2tlPSIjM2Q0MDM2IiBzdHJva2Utd2lkdGg9IjIiLz4KICA8c3ZnIHg9IjE1IiB5PSIxNSIgd2lkdGg9IjM0IiBoZWlnaHQ9IjM0IiB2aWV3Qm94PSIwIDAgMjQgMjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2VjZWJlNCIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiPgogICAgPHBhdGggZD0iTTEyIDNsOSA1LTkgNS05LTV6TTMgMTNsOSA1IDktNU0zIDE3LjVsOSA1IDktNSIvPgogIDwvc3ZnPgo8L3N2Zz4K" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
5
+ <div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" aria-current="page">Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
6
+ <main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Your workspace</div><article><h1 id="context-and-budgets">Context and budgets</h1>
7
+ <p>Open Context inspector before starting a run. Review file sources, omissions and size estimates; select individual modified files when you need the current working copy included.</p>
8
+ <h2 id="check-what-you-are-sending">Check what you are sending</h2>
9
+ <p>The composer’s <strong>Context inspector</strong> previews explicit repository selections and attachment metadata before a run. Folder selections expand tracked files from the chosen committed base. Current modified or uncommitted descendants are not implicitly copied by a folder selection; select those individual files to stage their current copies. Explicit file previews use the current file where present and fall back to the selected base when it is missing locally. Each preview identifies its source and content hash.</p>
10
+ <p>Inspection is bounded to 50 selections, 200 result entries, 512 KiB per text file and 8 MiB of inspected text. Larger, binary, invalid UTF-8, symbolic and Git LFS material is reported as omitted. Credential names and Git internals are not previewed. Per-file sizes and approximate text-token counts are shown with aggregate inspected, omitted and attachment bytes. Unscanned file sizes and binary/image tokens remain unknown. Uploaded text estimates use byte size; uploaded contents are not sent to the inspector again.</p>
11
+ <p>Potential credential paths such as <code>.env</code>, private-key files, credential stores and <code>.git</code> are also rejected by actual context preparation and message attachment staging. A preview omission is not the sole defense. Selecting a symbolic file, a symbolic ancestor or a base symlink/submodule is refused before copying. Preview redaction only hides recognized secret patterns from this display; it does not rewrite other repository files. Agents can still read files already in their worktree according to their existing permissions.</p>
12
+ <p>Reference files are not pasted wholesale into prompts: the assembled request identifies their locations so agents can read them. Consequently, reference-file estimates and invocation-input budgets measure different things.</p>
13
+ <p>Enable an explicit <strong>Invocation context budget</strong> to choose a byte ceiling, an approximate token ceiling, or both. Its policy either records a warning or stops the run before a provider launch. Budgets default to unset and never infer a provider’s context-window size. The server measures the fully assembled per-turn prompt (including notes and selected memory already added by code-flow) plus its explicit JSON schema immediately before the adapter is invoked. A blocked attempt does not launch a CLI. Retrying with the same exceeded ceiling will block again; deliberately choose a suitable budget for a new run. Retries and fresh-session fallbacks are measured again with their actual current prompt.</p>
14
+ <p>Saved team presets capture this budget, including previous revisions and library import/export. Applying an older preset without a budget clears a current ceiling. The Effective settings inspector identifies the browser preference or exact preset revision that supplied the current budget. Version 1 preset libraries remain compatible when the optional <code>contextBudget</code> field is absent.</p>
15
+ <p>Evidence records exact UTF-8 prompt/schema byte counts, their aggregate, an approximate token count of one token per four bytes, a content hash, resumed-session status, exclusions and any exceeded ceilings. Prompt bodies are not duplicated into this size evidence. Earlier CLI conversations, hidden provider system instructions, protocol wrappers, tool outputs, later file reads, and image/audio tokenization are outside this measurement. An approximate guard cannot guarantee that the provider’s complete context fits its window.</p>
16
+ <p><code>POST /api/workspace/context</code> accepts <code>{repo,baseRef?,paths,attachments?:[{name,size}]}</code> and returns source-labeled file results, attachment metadata, byte/token aggregates, omissions and limits. Run settings carry <code>loop.contextBudget = {maxPromptBytes?,maxApproximateTokens?,policy:&#39;warn&#39;|&#39;block&#39;}</code>. Both ceilings require positive bounded integers. The warning and block policies are enforced on the server and persisted with per-step input-size evidence.</p>
17
+ <hr>
18
+ <p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
19
+ </article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/context-inspection.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.3 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="configuration.html"><small>← Previous</small>Configuration</a><a href="project-conventions.html"><small>Next →</small>Versioned project conventions</a></nav></main>
20
+ <aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#check-what-you-are-sending">Check what you are sending</a></aside>
21
+ <aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
22
+ <dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
23
+ </body></html>