@miroshnik/elves 2026.1018.0 → 2026.1018.1

package/docs/cloud-sessions.md

@@ -149,8 +149,9 @@ and prints the same steps:
 
 1. `est fact <N>` computes this session's part of the actual from its
    transcript in the container (linking — the branch `<type>/<N>-…` or the
-   only `#N` in the first prompt, section "The brief") and prints an
-   `Actual (cloud)` comment
+   only `#N` in the first prompt, section "The brief"; the session's PR in
+   its own repository, by the clone's `origin`, doesn't break it, #617) and
+   prints an `Actual (cloud)` comment
    with hours, tokens, a link to the session and a part marker — post it to
    the issue with a GitHub tool. Project fields (`Actual, h`, tokens, cost)
    are set by the next local session: `est fact <N> --write` or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miroshnik/elves",
-  "version": "2026.1018.0",
+  "version": "2026.1018.1",
   "type": "module",
   "description": "Elves — a development flow with AI agents: shared rules and skills for any agent; install — bunx @miroshnik/elves install -g; the installer and skill scripts — TypeScript under Bun, tests — bun test in tests/",
   "repository": {
@@ -66,5 +66,5 @@
     "eslint-plugin-boundaries": "^7.2.0",
     "knip": "^6.41.0"
   },
-  "gitHead": "e6b283ff871be91cc91f33e2a5637893d1f5e538"
+  "gitHead": "28a9863fbdf5acfd5706b44b8d3c3ecd87fd39fd"
 }

package/skills/est/SKILL.md

@@ -136,7 +136,8 @@ its own part; GraphQL and GitHub Projects are closed there. When a task is
 closed, `est fact <N>` in the cloud takes this session's transcript in the
 container (linking — the branch `<type>/<N>-…` or the only "#N" in the first
 prompt, its background block included — `docs/cloud-sessions.md`, "The brief";
-PRs and commits aren't visible from there) and prints the comment
+PRs and commits aren't visible from there: a PR of the clone's `origin`
+repository keeps the link, another repository's breaks it) and prints the comment
 «Actual (cloud): …» with hours, tokens and a link to the session, with a part
 marker (`cloud`) (or «Actual unavailable (cloud)», if the transcript isn't linked
 to the task) — the agent writes it into the issue with a GitHub tool. Other

package/skills/est/scripts/est.ts

@@ -2732,6 +2732,8 @@ export function computeFact(repo: FactRepo, number: number, prObjs: PR[], closer
       return head ? (s.wt_branches ?? []).findIndex((bs) => bs.includes(head)) + 1 : 0;
     };
     const anchors: Anchor[] = [];
+    // a PR of our repository that isn't the task's is a foreign anchor: every PR of the repository is known here. Mirror:
+    // cloudOwnPart — the cloud knows none, its own repository's pr-links aren't anchors there
     for (const [ts, pr] of links) {
       const own = ourPrs.has(pr);
       // Claude Code repeats the pr-link of the PR bound to the session even after the merge — that's the app's status,
@@ -3338,15 +3340,26 @@ const cloudSid = (sessionId: string | undefined) => (sessionId ? "session_" + se
 /**
  * This cloud session's part of the actual — from its transcript in the container (the work directory is the git
  * root). Without GitHub: linking is by the `<type>/<N>-…` branch, a "#N" first prompt, a subagent assignment; PRs and
- * commits aren't visible from here.
+ * commits aren't visible from here. The repository — `owner/repo` of the clone's origin, as for a local one (#617):
+ * otherwise a PR of its own repository the session opened looks like another repository's and unlinks the first
+ * prompt's period; no origin — "cloud", any PR with a repository is then another's.
  */
 function cloudOwnPart(number: number, session: string, gap: number): CloudPart | null {
   const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
   const cwd = top.status === 0 && top.stdout.trim() ? top.stdout.trim() : process.cwd();
-  const sessions = transcriptFilesIn([cwd]).map((f) => parseSessionFile(f)).filter((x) => x.ev.length); // don't discard a routine one: a cloud session is often a single prompt
+  const origin = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const full = (origin.status === 0 && originRepo(origin.stdout)) || "cloud";
+  // The cloud sees no PRs, so a PR of its own repository is neither the task's nor another task's: computeFact would
+  // take it for a foreign anchor and end the first prompt's period when the session opened it — CI, the merge and the
+  // actual after it are the task's too. Mirror: computeFact, the pr-link anchors — locally every PR is known.
+  const ownLink = (r?: string) => !r || r.toLowerCase() === full.toLowerCase();
+  const sessions = transcriptFilesIn([cwd])
+    .map((f) => parseSessionFile(f))
+    .filter((x) => x.ev.length) // don't discard a routine one: a cloud session is often a single prompt
+    .map((s) => ({ ...s, prlinks: s.prlinks.filter(([, , r]) => !ownLink(r)) }));
   if (!sessions.length) return null;
   const stub: FactRepo = {
-    full: "cloud",
+    full,
     prs: () => new Map(),
     openPrs: () => ({ at: 0, items: {} }),
     closers: () => ({ oid: {}, pr: {} }),

package/skills/task-env/SKILL.md

@@ -125,9 +125,9 @@ removes it for good). Routes follow Docker events — no reload; an unknown host
 skill update brings the container to the new compose file. Its network, health and the API the dashboard reads
 addresses from — reference.md, "The proxy".
 
-**Before the rename** the proxy was `ai-dev-proxy`. For one release `proxy up` (and `up`, which starts the proxy)
-takes its place: removes its container, which holds the port, and joins its network, so stacks brought up before the
-rename keep their addresses; the network isn't removed or created — reference.md, "The proxy before the rename".
+**Before the rename** the proxy was `ai-dev-proxy`. `proxy up` (and `up`, which starts the proxy) takes its place:
+removes its container, which holds the port. Its network the proxy doesn't join: a stack brought up before the rename
+gets its addresses back by `up` again — reference.md, "The proxy before the rename".
 
 ## Compose file isolation rules
 
@@ -146,9 +146,7 @@ each with `task-env check`, a violation is code 1 of `check`.
 
 A bind mount of a machine resource — the Docker socket, `/etc/localtime`, a
 device (a source in `/var/run`, `/run`, `/etc`, `/dev`, `/proc`, `/sys`) — is
-not code and is fine; `~/…` is an absolute path. A network named `ai-dev-proxy`
-(the proxy before the rename, written by hand) — its own `❌` line: remove it,
-`up` adds the proxy's network to the `env.http` services itself.
+not code and is fine; `~/…` is an absolute path.
 
 `task-env check` reads `docker compose config`, not the YAML, so every form of writing is covered, and needs no Docker
 daemon — reference.md, "What the compose file check reads".

package/skills/task-env/proxy/compose.yaml

@@ -1,10 +1,8 @@
 # The machine's proxy (the task-env skill, SKILL.md, «The proxy»): one Traefik per machine routes
 # http://<service>.<N>.<project>.localhost to containers of task stacks by their labels. Started by
-# `task-env proxy up`. The name — the Compose project and the network —, the port and the provider's default network
-# come from ELVES_PROXY, ELVES_PROXY_PORT and ELVES_PROXY_DEFAULT_NETWORK, which scripts/task-env.ts passes explicitly
-# (`composeEnv`): their defaults live only there, so the file has none (`${…:?}`) and doesn't come up without the
-# script. The network of the proxy before the rename (`FORMER_PROXY` of the script) the script adds on Compose's stdin
-# when it is on the machine — it isn't always, so it isn't here.
+# `task-env proxy up`. The name — the Compose project and the network — and the port come from ELVES_PROXY and
+# ELVES_PROXY_PORT, which scripts/task-env.ts passes explicitly (`composeEnv`): their defaults live only there, so the
+# file has none (`${…:?}`) and doesn't come up without the script.
 name: ${ELVES_PROXY:?set by task-env.ts}
 services:
   traefik:
@@ -17,9 +15,8 @@ services:
       # a container is published only with traefik.enable=true
       - --providers.docker.exposedByDefault=false
       # task containers sit in several networks: a task stack's service names the proxy's one by the label
-      # traefik.docker.network; a container without the label is reached through this one — the proxy's own, or the
-      # network of the proxy before the rename while the proxy is in it (its stacks carry no label)
-      - --providers.docker.network=${ELVES_PROXY_DEFAULT_NETWORK:?set by task-env.ts}
+      # traefik.docker.network; a container without the label is reached through the proxy's own
+      - --providers.docker.network=${ELVES_PROXY:?set by task-env.ts}
       # the API — the routes for the dashboard: on the web entry point by the host <name>.localhost (labels below),
       # without Traefik's own UI
       - --api=true

package/skills/task-env/reference.md

@@ -83,7 +83,7 @@ unavailable or (`prune`) a task's state isn't checked; `proxy status` — 0 runn
 | image | `traefik:v3.7` |
 | provider | Docker, `exposedByDefault: false` — a container without `traefik.enable=true` isn't published |
 | network | `elves-proxy`: the proxy reaches a task stack's service through it — the service names it by the label `traefik.docker.network` |
-| default network | `providers.docker.network` — for a container without the label: `elves-proxy`, `ai-dev-proxy` while the proxy is in it (below, section "The proxy before the rename") |
+| default network | `providers.docker.network` — for a container without the label: `elves-proxy`, the proxy's own |
 | entry point | `web` — HTTP on `127.0.0.1:80`; not on all interfaces: task apps aren't visible on the local network |
 | restart | `unless-stopped` — comes back with Docker; `proxy down` removes it for good |
 | health | `traefik healthcheck --ping`: `proxy up` returns when the proxy serves |
@@ -110,39 +110,28 @@ drop.
 ## The proxy before the rename
 
 Before the rename of the flow (ai-dev → Elves) the proxy was the Compose
-project `ai-dev-proxy` with the network of that name, and stacks brought up
-then are in that network, their services without a network label. For one
-release `proxy up` — and `up`, which starts a proxy that isn't running —
-takes its place:
+project `ai-dev-proxy` with the network of that name. `proxy up` — and `up`,
+which starts a proxy that isn't running — takes its place:
 
 - **its container goes** — it holds the port; the new one is created first
   (the image pulled), so a failed pull leaves the former proxy serving:
   `proxy ai-dev-proxy: removed — the proxy before the rename; elves-proxy
-  takes its port, its network ai-dev-proxy stays`;
-- **its network stays and the proxy joins it** — an override on Compose's
-  stdin, as for a task stack: the stacks in it keep their addresses; a
-  machine without that network — the proxy is in its own only, the network
-  isn't created; `proxy status` names it: `(network elves-proxy; and
-  ai-dev-proxy — …)`;
-- **the network a container is reached through is deterministic**: a
-  container without the proxy's network among its own gets from Traefik "the
-  first" of them in Go's map order — a random one per configuration, and a
-  stack in its `default` and the proxy's network answers or not by chance. So
-  a task stack's service names the network by the label (section "Labels of
-  a task stack's service"), and the provider's default is `ai-dev-proxy`
-  while the proxy is in it — the stacks before the rename carry no label;
-- **`check`** names a network `ai-dev-proxy` written in a project's compose
-  file (`networks: [default, ai-dev-proxy]`, `external: true`) with its fix:
-  remove it, `up` adds the proxy's network itself. The project moves by a
-  task of its own; until then the network is there and its stack comes up;
+  takes its port`;
+- **its network isn't joined** — the proxy is in its own network only, even
+  with `ai-dev-proxy` on the machine; a stack brought up before the rename,
+  left in `ai-dev-proxy` alone, gets its addresses back by `up` again: the
+  override puts its HTTP services into `elves-proxy`;
+- **`check`** holds a network `ai-dev-proxy` written in a project's compose
+  file (`networks: [default, ai-dev-proxy]`, `external: true`) to the rule of
+  any external network; the fix — remove it, `up` adds the proxy's network
+  itself;
 - **the port** — `ELVES_PROXY_PORT`, unset — `AI_DEV_PROXY_PORT` of the
   profile; **the settings** — `.agents/elves.json`, before `update` moves it
   — `.agents/ai-dev.json`.
 
 The former proxy is `ai-dev-proxy` only for the proxy of the default name;
 a proxy of another name (a test's) has `<name>-former`, so a test never
-touches the machine's proxy. The next release drops the transition: stacks
-still in `ai-dev-proxy` alone lose their addresses — `up` again moves them.
+touches the machine's proxy.
 
 ## Labels of a task stack's service
 
@@ -183,9 +172,12 @@ it by hand shares the proxy's network as `external`, and `check` names it.
 - The network is `external`: the proxy creates it, so `proxy up` goes before
   the task stack — `up` and `e2e` start it themselves.
 - `traefik.docker.network` — the network the proxy reaches the service
-  through: the service is in its own networks too, and without the label
-  Traefik's pick among them is random (section "The proxy before the
-  rename").
+  through: the service is in its own networks too, and the label names the
+  proxy's one, so the pick doesn't depend on the provider's default network.
+  Without the label a container outside that default gets from Traefik "the
+  first" of its networks in Go's map order — a random one per configuration,
+  and a stack in its `default` and the proxy's network would answer or not by
+  chance.
 - Networks: the service's own as Compose normalized them (one without
   `networks` is in `default`) plus the proxy's — listed networks replace the
   implicit `default`, and a key with null keeps the project's aliases.

package/skills/task-env/scripts/task-env.ts

@@ -33,12 +33,10 @@
  * another. The defaults live only here: the script passes both to the compose file explicitly (`composeEnv`), the file
  * has none (`${…:?}`); `check -g` of the installer imports `proxyName`.
  *
- * The rename of the flow to Elves renamed the proxy: `FORMER_PROXY` → `PROXY`. For one release `proxy up` takes the
- * former proxy's place: removes its container — it holds the port — and joins its network, where stacks brought up
- * before the rename stay, so their addresses keep working; `check` names the former network in a project's compose
- * file. Which network the proxy reaches a container through is deterministic: a task
- * stack's service names it by a label, the provider's default is the former network while the proxy is in it
- * (`proxyLabels`, `up`).
+ * The rename of the flow to Elves renamed the proxy: `FORMER_PROXY` → `PROXY`. `proxy up` takes the former proxy's
+ * place — removes its container, which holds the port — but not its network: the proxy is in its own network only, and
+ * `check` holds a hand-written former network to the rule of any external one (#564). A task stack's service names the
+ * proxy's network by a label (`proxyLabels`).
  *
  * The proxy's API (Traefik `/api/http/routers`) answers on its port by the host `<name>.localhost`: `proxyHosts` reads
  * the hosts of its routes, `taskAddress` tells a task's address among them — the dashboard shows a task's services by
@@ -98,9 +96,8 @@ Examples:
 
 Holds the compose file in <dir> (default — the current directory) to the task isolation rules: no container_name, no
 fixed host port, volumes and networks without name and external, code by paths relative to the compose file; one ❌ line
-per violation; the network of the proxy's former name ai-dev-proxy — remove it, task-env up adds the proxy's network
-itself. Code 0 — the rules hold or there is no compose file, 1 — violations, 2 — not checked (no docker compose, the
-config doesn't parse).
+per violation. Code 0 — the rules hold or there is no compose file, 1 — violations, 2 — not checked (no docker compose,
+the config doesn't parse).
 
 Examples:
   task-env check
@@ -108,8 +105,8 @@ Examples:
   "proxy up": `task-env proxy up
 
 Starts the machine's proxy (Traefik) or brings it to the skill's compose file and waits until it is healthy; port 80 busy
-— another one in ELVES_PROXY_PORT. The proxy before the rename (ai-dev-proxy) — its container removed, its network
-joined: stacks brought up before the rename keep their addresses.
+— another one in ELVES_PROXY_PORT. The proxy before the rename (ai-dev-proxy) holds the port — its container removed;
+stacks brought up before the rename get their addresses back by task-env up.
 
 Examples:
   task-env proxy up`,
@@ -158,9 +155,9 @@ export const ENTRY_POINT = "web";
 export const PROXY = "elves-proxy";
 
 /**
- * The proxy's default name before the rename of the flow (ai-dev → Elves), read for the transition — one release
- * (#545): `proxy up` takes its place, `check` names its network in a project's compose file, `check -g` of the
- * installer names a proxy left under this name.
+ * The proxy's default name before the rename of the flow (ai-dev → Elves), read for the transition (#545): `proxy up`
+ * removes its container, which holds the port, `check -g` of the installer names a proxy left under this name. Its
+ * network the proxy no longer joins (#564).
  */
 export const FORMER_PROXY = "ai-dev-proxy";
 
@@ -183,15 +180,13 @@ export const formerProxyName = (env: NodeJS.ProcessEnv = process.env) => {
 export const proxyPort = (env: NodeJS.ProcessEnv = process.env) => env.ELVES_PROXY_PORT || env.AI_DEV_PROXY_PORT || "80";
 
 /**
- * The environment of the proxy's compose file: the name, the port and the provider's default network are passed
- * explicitly — the file has no defaults of its own (`${…:?}`), they live only here (#396, question 1). The default
- * network is the proxy's own unless `up` joins the former proxy's network (`up`); not a setting — the script sets it.
+ * The environment of the proxy's compose file: the name and the port are passed explicitly — the file has no defaults
+ * of its own (`${…:?}`), they live only here (#396, question 1).
  */
-export const composeEnv = (env: NodeJS.ProcessEnv = process.env, network = proxyName(env)): NodeJS.ProcessEnv => ({
+export const composeEnv = (env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv => ({
   ...env,
   ELVES_PROXY: proxyName(env),
   ELVES_PROXY_PORT: proxyPort(env),
-  ELVES_PROXY_DEFAULT_NETWORK: network,
 });
 
 /** The host of the proxy's API: a router of the proxy's own labels on the `web` entry point (proxy/compose.yaml). */
@@ -307,8 +302,7 @@ export interface ProxyRoute {
  * one service (`--scale`) carry the same labels — Traefik balances between them. The network for reaching the
  * container — by a label (#545): without it Traefik takes the provider's default network, and when the container isn't
  * in that one — the first of its networks in Go's map order, a random one per configuration, and a stack in its
- * `default` and the proxy's network would answer or not by chance; the default is the former proxy's network while
- * the proxy is in it (`up`).
+ * `default` and the proxy's network would answer or not by chance.
  */
 export function proxyLabels(r: ProxyRoute): Record<string, string> {
   const id = `${r.stack}-${r.service}`;
@@ -344,17 +338,9 @@ function hint(reason: string, env: NodeJS.ProcessEnv) {
   return "";
 }
 
-/**
- * `docker compose` of the proxy. `former` — the former proxy's network to join: an override on Compose's stdin (the
- * network isn't always on the machine, so it isn't in the file), and it becomes the provider's default network.
- */
-function compose(args: string[], env: NodeJS.ProcessEnv, former?: string) {
-  const override = former ? { services: { [SERVICE]: { networks: { proxy: null, former: null } } }, networks: { former: { name: former, external: true } } } : undefined;
-  return spawnSync("docker", ["compose", "-f", PROXY_FILE, ...(override ? ["-f", "-"] : []), ...args], {
-    encoding: "utf8",
-    input: override ? JSON.stringify(override) : undefined,
-    env: composeEnv(env, former),
-  });
+/** `docker compose` of the proxy. */
+function compose(args: string[], env: NodeJS.ProcessEnv) {
+  return spawnSync("docker", ["compose", "-f", PROXY_FILE, ...args], { encoding: "utf8", env: composeEnv(env) });
 }
 
 /** The proxy containers of a Compose project in any state — a `format` line each; Docker unavailable — the reason. */
@@ -371,31 +357,18 @@ export function proxyRunning(env: NodeJS.ProcessEnv = process.env): boolean | st
   return typeof states === "string" ? states : states.includes("running");
 }
 
-/** Whether a network is on the machine; Docker unavailable — the reason. */
-function networkExists(name: string, env: NodeJS.ProcessEnv): boolean | string {
-  const r = spawnSync("docker", ["network", "ls", "--filter", `name=^${name}$`, "--format", "{{.Name}}"], { encoding: "utf8", env, timeout: 10_000 });
-  if (r.error || r.status !== 0) return why(r);
-  return r.stdout.split("\n").includes(name);
-}
-
 function status(env: NodeJS.ProcessEnv): Result {
   const name = proxyName(env);
-  const found = proxyContainers(name, "{{.State}}\t{{.Networks}}", env);
-  if (typeof found === "string") return { code: 2, out: `proxy ${name}: Docker unavailable — ${found}${hint(found, env)}` };
-  const running = found.map((l) => l.split("\t")).find(([state]) => state === "running");
+  const running = proxyRunning(env);
+  if (typeof running === "string") return { code: 2, out: `proxy ${name}: Docker unavailable — ${running}${hint(running, env)}` };
   if (!running) return { code: 1, out: `proxy ${name}: not running — start: ${START}` };
-  const former = formerProxyName(env);
-  const also = running[1]?.split(",").includes(former) ? `; and ${former} — of the proxy before the rename, with the stacks brought up before it` : "";
-  return { code: 0, out: `proxy ${name}: running — ${addressUrl("<service>.<N>.<project>.localhost", proxyPort(env))} on 127.0.0.1, routes by container labels (network ${name}${also})` };
+  return { code: 0, out: `proxy ${name}: running — ${addressUrl("<service>.<N>.<project>.localhost", proxyPort(env))} on 127.0.0.1, routes by container labels (network ${name})` };
 }
 
 /**
- * `proxy up`: the proxy brought to the compose file and healthy. The transition from the proxy before the rename
- * (#545, one release): its container holds the port — removed once the new one is created (a failed pull leaves the
- * former proxy serving); its network stays — stacks brought up before the rename are in it — and the proxy joins it as
- * the provider's default network: their services carry no network label, and a container outside the default network
- * gets a random one of its networks (`proxyLabels`). No former network on the machine — the proxy is in its own only,
- * the former one isn't created.
+ * `proxy up`: the proxy brought to the compose file and healthy, in its own network only. The proxy before the rename
+ * (#545) holds the port: its container is removed once the new one is created (a failed pull leaves the former proxy
+ * serving). Its network the proxy doesn't join (#564): stacks left only in it get their addresses back by `up`.
  */
 function up(env: NodeJS.ProcessEnv): Result {
   const name = proxyName(env);
@@ -404,17 +377,14 @@ function up(env: NodeJS.ProcessEnv): Result {
   const fail = (reason: string) => ({ code: 2, out: [...out, `proxy ${name}: not started — ${reason}${hint(reason, env)}`].join("\n") });
   const old = proxyContainers(former, "{{.ID}}", env);
   if (typeof old === "string") return fail(old);
-  const joined = networkExists(former, env);
-  if (typeof joined === "string") return fail(joined);
-  const network = joined ? former : undefined;
   if (old.length) {
-    const created = compose(["up", "--no-start", "--quiet-pull"], env, network);
+    const created = compose(["up", "--no-start", "--quiet-pull"], env);
     if (created.error || created.status !== 0) return fail(why(created));
     const rm = spawnSync("docker", ["rm", "--force", ...old], { encoding: "utf8", env });
     if (rm.error || rm.status !== 0) return fail(`the proxy before the rename, ${former}, not removed: ${why(rm)}`);
-    out.push(`proxy ${former}: removed — the proxy before the rename; ${name} takes its port${joined ? `, its network ${former} stays` : ""}`);
+    out.push(`proxy ${former}: removed — the proxy before the rename; ${name} takes its port`);
   }
-  const r = compose(["up", "--detach", "--wait", "--quiet-pull"], env, network);
+  const r = compose(["up", "--detach", "--wait", "--quiet-pull"], env);
   if (r.error || r.status !== 0) return fail(why(r));
   const s = status(env);
   return { code: s.code, out: [...out, s.out].join("\n") };
@@ -515,12 +485,6 @@ function violations(config: Config, file: string): string[] {
   }
   for (const [key, r] of Object.entries(config.networks ?? {})) {
     const users = services.filter(([, s]) => Object.hasOwn(s.networks ?? {}, key)).map(([n]) => n);
-    // the proxy's network under its name before the rename (#545): a compose file wrote it by hand, as the example of
-    // reference.md did; the proxy stays in that network one release (`up`), and a machine without it fails the stack
-    if (r.name === FORMER_PROXY) {
-      line(`network ${key} (${list(users)})`, `${FORMER_PROXY} is the machine's proxy before the rename, now ${PROXY}: remove the network from the compose file and its services; task-env up adds the proxy's network to the HTTP services of env.http itself`);
-      continue;
-    }
     shared("network", key, r, users, "task stacks share it and reach each other's services");
   }
   return out;