@neuralis/brain-core 0.3.1 → 0.4.0

package/app/filesystem/ui/PolicyEditor.tsx

@@ -2,6 +2,12 @@
 
 import { useCallback, useMemo, useState } from 'react';
 import { Plus, Save, Trash2 } from 'lucide-react';
+import {
+  BUILTIN_ROLE_PRIORITY,
+  MAX_ROLE_PRIORITY,
+  MIN_ROLE_PRIORITY,
+  isValidRolePriority,
+} from '@neuralis/package-system/access';
 import { cn } from '../lib/cn';
 import type {
   HierarchicalPermissionsRecord,
@@ -19,9 +25,11 @@ import type {
  *   - By User overrides.
  *   - By Agent overrides ($self maps to the agent's own files).
  *   - Path Rules (pattern + R/W/X + roles + agents + users + override).
+ *     The role row names roles one by one and/or — `≥` — the caller's ROLE
+ *     priority, n or stronger (`priority`; lower = stronger, 2 = admin); both ANDed.
  *     `users` names the REQUESTER (`$owner` = the resource's creator, or a
- *     user id) and is honoured only on a grant rule — OVR on, every set bit
- *     allow; the server refuses any other shape.
+ *     user id). `priority` and `users` are honoured only on a grant rule — OVR
+ *     on, every set bit allow; the server refuses any other shape.
  *
  * Visual budget: dense, admin-style layout — pill-shaped R/W/X badges,
  * small uppercase section headers, no large card chrome. Designed to fit
@@ -45,7 +53,7 @@ type Props = {
 const DEFAULT_KNOWN_ROLES = ['member', 'owner', 'admin'];
 
 /** The persisted rule fields this editor round-trips beyond the shared record type. */
-type RuleRecord = PathPermissionRecord & { users?: string[]; floor?: true };
+type RuleRecord = PathPermissionRecord & { users?: string[]; priority?: number; floor?: true };
 const PERMS = ['read', 'write', 'exec'] as const;
 
 function clonePermissions(p: HierarchicalPermissionsRecord): HierarchicalPermissionsRecord {
@@ -232,7 +240,7 @@ export function PolicyEditor({
 
   const toggleRuleRole = useCallback((index: number, role: string) => {
     setDraft((prev) => {
-      const paths = [...(prev.paths ?? [])];
+      const paths = [...(prev.paths ?? [])] as RuleRecord[];
       const cur = paths[index];
       const roles = new Set(cur.roles ?? []);
       if (roles.has(role)) roles.delete(role);
@@ -242,6 +250,28 @@ export function PolicyEditor({
     });
   }, []);
 
+  // `priority` is a SEPARATE subject field ANDed with `roles` on the same rule:
+  // the toggle adds or removes only the threshold (admin by default) and never
+  // touches the named roles, so an AND row never reads wider than it is.
+  const toggleRulePriority = useCallback((index: number) => {
+    setDraft((prev) => {
+      const paths = [...(prev.paths ?? [])] as RuleRecord[];
+      const { priority, ...cur } = paths[index];
+      paths[index] = priority !== undefined ? cur : { ...cur, priority: BUILTIN_ROLE_PRIORITY.admin };
+      return { ...prev, paths };
+    });
+  }, []);
+
+  const setRulePriority = useCallback((index: number, raw: string) => {
+    setDraft((prev) => {
+      const paths = [...(prev.paths ?? [])] as RuleRecord[];
+      // An unparsable entry stays visible as NaN (the hint names the range)
+      // instead of silently dropping the condition, which would widen the grant.
+      paths[index] = { ...paths[index], priority: raw.trim() === '' ? Number.NaN : Number(raw) };
+      return { ...prev, paths };
+    });
+  }, []);
+
   const addRuleEntry = useCallback((index: number, field: RuleListField, value: string) => {
     const trimmed = value.trim();
     if (!trimmed) return;
@@ -486,29 +516,73 @@ export function PolicyEditor({
                 </div>
                 <div className="flex flex-wrap items-center gap-1 text-[9px] text-white/50">
                   <span className="text-white/35 mr-0.5">Roles:</span>
-                  {knownRoles.map((role) => {
-                    const active = (rule.roles ?? []).includes(role);
-                    return (
-                      <button
-                        key={role}
-                        type="button"
+                  <button
+                    type="button"
+                    disabled={readOnly}
+                    onClick={() => toggleRulePriority(index)}
+                    title={rule.priority !== undefined
+                      ? 'Remove the role-priority condition (the named roles stay)'
+                      : 'Also require the caller\'s role priority: n or stronger (lower = stronger); ANDed with the named roles'}
+                    className={cn(
+                      'h-5 px-1.5 rounded text-[8px] font-semibold border transition disabled:cursor-default',
+                      rule.priority !== undefined
+                        ? 'bg-amber-500/15 text-amber-200 border-amber-400/30'
+                        : 'bg-white/[0.04] text-white/35 border-white/[0.08] hover:text-white/65',
+                    )}
+                  >
+                    ≥
+                  </button>
+                    <>
+                      {[...new Set([...knownRoles, ...(rule.roles ?? [])])].map((role) => {
+                        const active = (rule.roles ?? []).includes(role);
+                        return (
+                          <button
+                            key={role}
+                            type="button"
+                            disabled={readOnly}
+                            onClick={() => toggleRuleRole(index, role)}
+                            className={cn(
+                              'h-5 px-1.5 rounded border text-[9px] font-medium capitalize transition disabled:cursor-default',
+                              active
+                                ? 'bg-cyan-500/15 text-cyan-200 border-cyan-400/30'
+                                : 'bg-white/[0.04] text-white/40 border-white/[0.08] hover:text-white/70',
+                            )}
+                          >
+                            {role}
+                          </button>
+                        );
+                      })}
+                      {(rule.roles ?? []).length === 0 && rule.priority === undefined && (
+                        <span className="italic text-white/30">all roles</span>
+                      )}
+                    </>
+                  {rule.priority !== undefined && (
+                    <>
+                      <span className="text-white/35">priority</span>
+                      <input
+                        type="number"
+                        min={MIN_ROLE_PRIORITY}
+                        max={MAX_ROLE_PRIORITY}
+                        step={1}
                         disabled={readOnly}
-                        onClick={() => toggleRuleRole(index, role)}
-                        className={cn(
-                          'h-5 px-1.5 rounded border text-[9px] font-medium capitalize transition disabled:cursor-default',
-                          active
-                            ? 'bg-cyan-500/15 text-cyan-200 border-cyan-400/30'
-                            : 'bg-white/[0.04] text-white/40 border-white/[0.08] hover:text-white/70',
-                        )}
-                      >
-                        {role}
-                      </button>
-                    );
-                  })}
-                  {(rule.roles ?? []).length === 0 && (
-                    <span className="italic text-white/30">all roles</span>
+                        value={Number.isFinite(rule.priority) ? rule.priority : ''}
+                        onChange={(e) => setRulePriority(index, e.target.value)}
+                        className="w-12 h-5 rounded bg-white/[0.04] border border-white/[0.08] px-1 text-[9px] font-mono text-white/85 outline-none focus:border-white/20 disabled:opacity-70"
+                      />
+                      <span className="italic text-white/30">or stronger{priorityHint(rule.priority)}</span>
+                    </>
                   )}
                 </div>
+                {rule.priority !== undefined && !isValidRolePriority(rule.priority) && (
+                  <div className="text-[9px] text-amber-200/80">
+                    Priority is a whole number from {MIN_ROLE_PRIORITY} (owner) to {MAX_ROLE_PRIORITY}; lower = stronger.
+                  </div>
+                )}
+                {rule.priority !== undefined && !isGrantRule(rule) && (
+                  <div className="text-[9px] text-amber-200/80">
+                    “Or stronger” applies only to an allow rule: turn on OVR and set every bit to allow.
+                  </div>
+                )}
                 <RuleChipRow
                   label="Agents"
                   values={rule.agents ?? []}
@@ -562,6 +636,17 @@ export function PolicyEditor({
 
 type RuleListField = 'agents' | 'users';
 
+/** The built-in role anchored at `priority`, if any. */
+function builtinNameAt(priority: number): string | undefined {
+  return Object.entries(BUILTIN_ROLE_PRIORITY).find(([, value]) => value === priority)?.[0];
+}
+
+/** ` (2 = admin)` beside a built-in anchor, nothing for a custom strength. */
+function priorityHint(priority: number): string {
+  const named = builtinNameAt(priority);
+  return named ? ` (${priority} = ${named})` : '';
+}
+
 /** `users` is honoured only here — the server's grant-only rule, mirrored for the hint. */
 function isGrantRule(rule: RuleRecord): boolean {
   const set = PERMS.map((p) => rule.permissions[p]).filter((v) => v !== undefined);

package/app/filesystem/ui/README.md

@@ -17,7 +17,7 @@ Re-exported from `app/filesystem/ui/index.ts`:
 - `FileTree`, `FileTreeNode`, `FileTreeSearch`, `SourceBranchHeader` — virtualised tree components (uses `@tanstack/react-virtual`). `FileTreeSearch` is the search PANEL body only (mode selector `keyword|semantic|grep`, filter row, results) — the query input rides inline in the sidebar HEADER (`FilesystemWidget`), panel visibility keys on `sidebarView === 'search'` alone (the header toggle/Escape clears + closes even with text), and the ≥2-char gate inside the panel only switches results-vs-hint. The store keeps the answer's `requested_mode`/`effective_mode`/`embedding_degraded`/`warning` as `searchEffect` (a `contextResetPatch` key) and the panel prints ONE `searchEffectLine` ("Searched as keyword — semantic search unavailable (<reason>)") plus an `embedding missing|stale` badge per row.
 - `FileTreeContextMenu`, `TreeDeleteConfirm` — the VS Code-style file-management surface (see the section below).
 - `ReembedDialog` — the ONE estimate-first embed dialog, shared by the Sources panel (a whole source) and the tree's context menu (a folder or a file): opening it asks `sources/reindex` for a sample-based ESTIMATE only (no queue job, no sync-marker change); the work starts on its button and nowhere else. `kind="reembed"` (default) = the forced re-embed of every file with the active model; `kind="pending"` = **Embed pending…**, the `embeddingOnly` debt pass (only missing/stale embeddings; the estimate is the scope's upper bound). Portaled like `TreeDeleteConfirm`.
-- `DiscoverDock` — the **Discover** list of attachable-but-unattached sources (`GET /sources/discoverable`), pinned below the tree. **It is a SIBLING of the virtualized scroller, never a `FlatItemKind`**: a sixth item kind would have to join the `rowEstimate`/`isMeasuredRow` contract for a list that is never long enough to need virtualizing. Two placements, one component — COLLAPSED it sits in normal flow below the scroller (takes height, covers nothing, bounded to 5 rows); EXPANDED the tree renders it as an `absolute bottom-0` overlay, the ONLY state in which it may hide tree rows. Never both, so the scroller's height cannot change while the overlay is up. Visible only while EVERY source branch is collapsed (`sourceBranchExpanded`, the React-local BRANCH state — not the store's `expandedFolders`) and only for a caller holding `drive.mount`. **Consequence to know:** `activeFile` is persisted and `FileTree`'s auto-expand opens its source branch, so a returning user with an open tab lands with the dock hidden until they collapse that branch. Clicking a row hands the whole suggestion to the Sources panel through the store (`pendingSourceSuggestion`) and opens it — the prefill body lives in `SourcesPanel.applySuggestion`, ONE body shared with the panel's own Discoverable list.
+- `DiscoverDock` — the **Discover** list of attachable-but-unattached sources (`GET /sources/discoverable`), pinned below the tree. **It is a SIBLING of the virtualized scroller, never a `FlatItemKind`**: a sixth item kind would have to join the `rowEstimate`/`isMeasuredRow` contract for a list that is never long enough to need virtualizing. Two placements, one component — COLLAPSED it sits in normal flow below the scroller (takes height, covers nothing, bounded to 5 rows); EXPANDED the tree renders it as an `absolute bottom-0` overlay, the ONLY state in which it may hide tree rows — and the only one with a surface: a scrim derived from `--w-bg-rgb`, so it matches every theme (collapsed it has none). Never both, so the scroller's height cannot change while the overlay is up. Visible only while EVERY source branch is collapsed (`sourceBranchExpanded`, the React-local BRANCH state — not the store's `expandedFolders`) and only for a caller holding `sources.mount`. **Consequence to know:** `activeFile` is persisted and `FileTree`'s auto-expand opens its source branch, so a returning user with an open tab lands with the dock hidden until they collapse that branch. Clicking a row hands the whole suggestion to the Sources panel through the store (`pendingSourceSuggestion`) and opens it — the prefill body lives in `SourcesPanel.applySuggestion`, ONE body shared with the panel's own Discoverable list.
 - `FileEditor`, `FileTab`, `FileMetaBar`, `CodeEditor`, `ReviewDiffView`, `EditorTabBar`, `DiffModeToggle` — the **VS Code-like editor stack**.
   - **`CodeEditor`** (CodeMirror 6 + an in-repo Shiki bridge under `codeEditor/`) is the ONE editor instance behind BOTH the read view (`readOnly`) and edit — toggling Edit only flips the `readOnly` Compartment, so the `EditorView` never remounts (no flash / scroll loss / re-tokenize). Syntax colors are the exact VS Code `dark-plus` TextMate grammars via Shiki's **JavaScript regex engine** — so **no web worker, no `.wasm`, no host CSP change** (`codeEditor/shikiHighlighter.ts` = the memoized core + `tokenizeLines` for the git-diff path — the core, the engine, both themes and all 50 `@shikijs/langs` grammars are dynamic imports, one split chunk each, so nothing of Shiki is on the module's cold path; the 15 base grammars load WITH the core so a markdown fence in one of them colours at once, the rest on first use; `codeEditor/shikiChunks.ts` = the INCREMENTAL tokenizer — position-anchored, line-aligned chunks closed at 64 lines OR 4 KB of text (whichever first) with TextMate grammar-state continuation, chunk-relative token offsets, the visible chunks tokenized synchronously under a 16 KB per-paint character budget (CodeMirror's `visibleRanges` right after a whole-document replace spans thousands of unmeasured lines — the budget, not the viewport estimate, bounds the sync path) and the prefix + a 4-chunk horizon after the viewport in idle slices (a slice is at least one chunk: measured ~90 ms worst case on dense TS/TSX and on long-line markdown, ~50 ms typical code, ~2–5 ms short-line prose — chunks past the horizon wait until scrolled to, so opening a file costs the viewport, not the document), a keystroke re-tokenizing its own chunk and walking forward only until the grammar state converges, a far scroll coloured provisionally first and corrected by the idle pass, and a whole-document replace (every file switch / reload / revert is one) split back into chunks eagerly so the first paint never tokenizes the whole file; `codeEditor/shikiDecorations.ts` = the per-view `ViewPlugin`→`DecorationSet` bridge that owns one engine per editor, because `@shikijs/codemirror` does not exist). The 120k wall is gone; `MAX_HIGHLIGHT_CHARS` (2 MB) is a memory guard on the document (above it the file renders plain), not a tokenization budget. Shared 12px/18px base theme (`codeEditor/editorTheme.ts`).
   - **`ReviewDiffView`** renders the vector-sync **pending-review** diff on `@codemirror/merge` (unified / split, read-only, accept/reject chunk controls disabled — Approve/Revert stays the banner's job) on the SAME base theme, so the editor↔diff transition never jumps.
@@ -39,7 +39,7 @@ Re-exported from `app/filesystem/ui/index.ts`:
 - `PolicyEditor` — compact admin-style permissions editor for the source-config panel. Renders the persisted JSON tree (`default`, `byRole`, `byUser`, `byAgent`, `paths[]`) with tri-state R/W/X pill badges (allow / deny / inherit cycle), per-role/user/agent override rows (with `+ Add` input + trash), and path rules with clickable role chips + per-rule agent chips (`$self/agentId`, inline-add). `OVR` toggles the rule's `override` flag. Adding a rule **prepends** it (visible at the top of long policy sets; first-match-wins means the fresh rule also takes precedence). Two modes: `edit` (Save button visible when dirty) and `view` (read-only chat-config render). It is wired into `SourcesPanel`, laid out admin-style, and carries the By Role / By User / By Agent sections. Save threads through `handlePolicySave` → `updateSourceConfig` without disturbing the user's pending sync/credential edits.
 - `SourcesPanel` "Discoverable" section — lives INSIDE the Vector Health expandable, alongside a `mount.mts` explainer card. Suggestions arrive from `GET /sources/discoverable` and use the shared `dimmedSourceTone('unattached')` util. The icon name (`AppWindow`, `GitBranch`, `FolderTree`, …) resolves through the shared `resolveLucideIcon` helper (same `ICON_MAP` as the workspace dock-left). Click pre-fills the add-source form with `{ key, path, kind, hostRoot? }` from the suggestion, plus the suggestion's optional `suggestedAccess` (read/write/exec) which overrides the connector-kind default, and — for `seed:'discoverable'` package declarations (e.g. the admin app zone, suggestion id `discover:decl:app`) — the **declared `description`** prefills the add form's description field. The **Full Host** suggestion (native/non-Docker only — `/` is the readable host root; in Docker the host must first be bound via `pnpm neuralis:mount add /`) ships `suggestedAccess: { read:true, write:false, exec:false }` so the whole-host root attaches **read-only by default** — the owner widens it (or narrows the uri-policy) in the form before saving. A host source is readable from the container shell, but host-native binaries still won't execute under the container runtime (a host PTY broker is a separate, future capability).
 - `SourcesPanel` row actions say what they do: **Rescan changes** (the `reindex` route without `force` — changed files are embedded again, unchanged ones keep their vectors), **Re-embed…** (`ReembedDialog` — every file of the source with the active model, estimate first), **Embed pending…** (`ReembedDialog kind="pending"`; it and **Re-embed…** are disabled while the row's live `embedding_enabled` says off), **Forget sync state** (the `reset` route — the next sync compares every file again; deletes no file and no vector). A started re-embed is followed by the same job poll + count refresh as a rescan (`followReindex`); an embedding pass that ends `paused` (terminal, not failed) shows "Embedding paused: <reason>" with **Resume** (the same owed-only apply). The Modify-source body states `binarySkipLine` ("N binary files not indexed" — the last count a pass measured) and `embeddingLine` beside `mediaSkipLine`: off — the live `embedding_enabled`, never the last pass — reads neutral ("Semantic embedding off — text and field search only"); the last pass's other reasons read amber ("Semantic embedding pending: <reasons>").
-- `SourcesPanel` row is **name-first** (the redesign for the always-narrow widget). The source name stays left-aligned and is the dominant element (`flex-1`, larger/bold); the kind icon uses the SAME resolved icon set as the file tree (`resolveIconWithFallback` over the connector-manifest `kind_icon`/`meta.icon`) and is **coloured by `getSourceVisualTone`** — so the icon tone IS the sync/live signal, matching the tree (the old `Healthy/Idle/Error` status text + `statusTone` are gone). The per-row **trust badge** (`first-party`/…) and the **scope badge** (`project`/`user`/`agent` — already a tab filter above) are removed; only `observed`, `orphan`, `unsaved`, and the enabled toggle remain inline. Rows are **grouped by `origin_package`** — the **declaring package id** the server resolves per source (the CONTRACT-BACKED `PackageSourceDeclaration` owner, returned on each `SourceRuntimeSummary` / `s.origin_package`), one group **per package**: each real `@neuralis/*` (or any other) package sorts **alphabetically** and user-added mounts collapse into a single **`Mounted (user-added)`** group that sorts **LAST** (`sourceOriginGroup` / `MOUNTED_GROUP`). The small left-indented group header **replaces** the per-row trust/`first-party` badge. The old client-side heuristic that inferred the owner from the connector kind's npm scope (`sourceOriginLabel`) is **gone** — attribution is now resolved server-side from the declarations (`matchDeclaredSource`, slug + resolved-root for rooted kinds; kind-only for rootless sandbox kinds), so a user mount named `app` that is NOT rooted at the platform app zone is NOT attributed to admin — the grouping is **unspoofable**.
+- `SourcesPanel` row is **name-first** (the redesign for the always-narrow widget). The source name stays left-aligned and is the dominant element (`flex-1`, larger/bold); the kind icon uses the SAME resolved icon set as the file tree (`resolveIconWithFallback` over the connector-manifest `kind_icon`/`meta.icon`) and is **coloured by `getSourceVisualTone`** — so the icon tone IS the sync/live signal, matching the tree (the old `Healthy/Idle/Error` status text + `statusTone` are gone). The per-row **trust badge** (`native`/…) and the **scope badge** (`project`/`user`/`agent` — already a tab filter above) are removed; only `observed`, `orphan`, `unsaved`, and the enabled toggle remain inline. Rows are **grouped by `origin_package`** — the **declaring package id** the server resolves per source (the CONTRACT-BACKED `PackageSourceDeclaration` owner, returned on each `SourceRuntimeSummary` / `s.origin_package`), one group **per package**: each real `@neuralis/*` (or any other) package sorts **alphabetically** and user-added mounts collapse into a single **`Mounted (user-added)`** group that sorts **LAST** (`sourceOriginGroup` / `MOUNTED_GROUP`). The small left-indented group header **replaces** the per-row trust/`native` badge. The old client-side heuristic that inferred the owner from the connector kind's npm scope (`sourceOriginLabel`) is **gone** — attribution is now resolved server-side from the declarations (`matchDeclaredSource`, slug + resolved-root for rooted kinds; kind-only for rootless sandbox kinds), so a user mount named `app` that is NOT rooted at the platform app zone is NOT attributed to admin — the grouping is **unspoofable**.
 - `SourcesPanel` source body: when a row is expanded it renders at **full height** (no `max-h` clamp) so every Path Rule / uri-policy is visible and the outer panel scrolls — the closed state keeps the collapse animation. The Sync sub-section shows a per-trigger explainer (Manual = only the Sync button; Auto = file-watch + reconcile; Scheduled = interval) and clarifies the "Always active" pin. Disabling sync (unchecking "Enable sync" + Save) sends `clearSync: true` — an omitted `sync` means "no change" server-side, so without the flag the disable would silently revert.
 - `SourcesPanel` per-source counts are **lazy** — the exact `connector` / `indexed` / `unindexed` stats row is fetched ONLY when its row is opened (`toggleSource` → `fetchSourceCounts` → a list scoped to `<source>://` with `include_counts`, so `computeSourcesRegistry` walks that ONE source), cached in `countsBySource`, and shown behind a "Loading counts…" placeholder. Panel-open itself does a **count-FREE** `refresh()` (no `withCounts`) — that still populates `sourceSummaries` (`s.sources`) for source discovery (observed-only sources, project scope) + per-row connector liveness dim, but fires **zero** project-wide count walks. There is deliberately no eager `refresh({withCounts:true})` on open — that, together with the Vector Health walk below, is what used to make opening one panel slow everything. Counted refreshes are narrowed to the operations that actually MOVE a number: sync, reindex, and a config save that changed the sync FILTER set (`syncFilterChanged` — exclude/include/`maxScanFiles`/a cleared sync block, which `connector.count()` applies, so the on-disk total shifts at once). A permissions save, a delete and an add refresh count-FREE: the indexed count is a project-scoped `countByFilter` with no per-caller policy input, the on-disk count is physical truth, a deleted row is gone and a brand-new row's numbers are one expand away. Every counted path also evicts that source's cached counts (`clearCachedCounts`) so the fresh summary is what renders — the lazy cache used to shadow it indefinitely after an exclude edit. `pollSyncJob` (1.5 s × `MAX_POLLS` 2400 = a sixty-minute ceiling) checks a `mountedRef` each turn and returns the moment the panel unmounts; the ref is cleared on UNMOUNT ONLY, never in a dependency-change cleanup, so a live poll is never dropped while the panel is still there. And EVERY hook in `SourcesPanel` sits above its `if (!open) return null` guard: two `useCallback`s used to live below it, so the component rendered a different number of hooks open than closed — React refuses that on one instance, and only the parent's mount gate carrying the same `workspacePanels.sources` flag kept it from ever firing.
 - `useFilesystemSSE` `sync:completed`: the handler is matched **before** the `if (!uri) return` guard — the event carries `source` (the slug), NOT a file `uri`. It runs the authoritative `reconcileSourceFolders` over that source's VISIBLE folders (a sync can have removed files), skips the pass entirely when every change count on the payload is zero (a missing count is unknown and still re-lists), and falls back to `refreshTree` only when no source is present. That pass rides the ONE per-source reconcile schedule shared with external-change events (a trailing quiet window with a max-wait), so a burst of changes becomes one pass. Owner: `app/filesystem/hooks/README.md`.
@@ -48,36 +48,37 @@ Re-exported from `app/filesystem/ui/index.ts`:
 - `VectorHealthPanel` heads its stats with ONE `semanticLine` from the report's `embedding` block (`Semantic: off / metadata only / dense (N missing · M stale)`).
 - `VectorHealthPanel` = **janitor** — the panel's role is "remove leftover records" (deleted past retention, orphaned chunks, duplicate report). Full per-source vector wipe lives on `SourceDeleteConfirm`, not here. `dryRun` default is `false` (clicking actually deletes); destructive buttons need a 2-click confirm; the Deleted stat card shows a `before → after (−Δ)` line after `GC`. Per-action explainer copy + tooltips spell out what each button does (GC / Repair are destructive; Deduplicate is read-only on the service side).
 - `VectorHealthPanel` is **lazy** — `SourcesPanel` renders it ONLY when the "Vector Health" section is expanded (`{healthOpen && …}`, the store's `vectorHealthOpen`, so a notification's `open-vector-health` nav can open it; a `contextResetPatch` key), never a CSS-only collapse, because the panel auto-fetches on mount; a mounted-but-hidden panel would fire the health request every time the Sources tab opens. On open it fetches the CHEAP count stats (`checkVectorHealth` → `/health`, count-only). The **Orphans** card and **Duplicate groups** count come from the EXPENSIVE on-demand scan (`scanVectorHealth` → `/health/scan`) behind an explicit **"Scan for problems"** button — they show `—` until the user runs it (and re-scan after a destructive action only if a scan was already loaded). This is the "ne lassítson 1 dolog mindent" rule: opening Sources triggers no collection walk.
-- `SourcesPanel` add form, the ROOT field — **derived from the declaration, not from `isDocker` and not from the kind name** (`lib/sourceKindForm.ts` `rootFieldMeta`, drift-tested against the real manifests in `test/ui/sourceKindForm.test.ts`). Every other field in that form already rendered from its declared `x-neuralis.ui`; `root` was the one hand-written, kind-BLIND exception, which is why the **Host Machine** kind used to show the `local` connector's `/mounts` volume picker, its `pnpm neuralis:mount add` callout and a `/mounts/...` placeholder while its own declaration said `Host root path` / `/home/you/projects` (warded-wren, closing the UI half of F-B5). The discriminator is the declared `x-neuralis.ui.control` on `root`: `container-path` gets the volume picker + callout + Browse; `host-path` gets none of them; a bare legacy `path` (or an absent control) is treated as container-plane, so an externally authored connector is unchanged. **Not `isHostPlaneKind`** — that is a NAME test whose own docstring says a future `ssh`/`smb` kind joins the plane by being added to its body, so a negative test on it would hand the container chrome to every future non-`local` kind. Browse is additionally gated on `canMount` (the shared `meetsRequires` mirror `FileTree` uses) and stays absent for host-plane roots at all times: `GET /sources/browse` readdirs in the SERVER process, the wrong machine for a broker-resolved host root — a host-plane root browser would need a broker-backed listing route, which does not exist.
+- `SourcesPanel` add form, the ROOT field — **derived from the declaration, not from `isDocker` and not from the kind name** (`lib/sourceKindForm.ts` `rootFieldMeta`, drift-tested against the real manifests in `test/ui/sourceKindForm.test.ts`). Every other field in that form already rendered from its declared `x-neuralis.ui`; `root` was the one hand-written, kind-BLIND exception, which is why a device root used to show the in-process folder's `/mounts` volume picker, its `pnpm neuralis:mount add` callout and a `/mounts/...` placeholder while its own declaration said `Host root path` / `/home/you/projects` (closing the UI half of F-B5). The root's control is `container-path` (or a bare legacy `path` / an absent control, treated the same, so an externally authored connector is unchanged); `ui.browse` offers the folder picker. One kind may serve both planes: the `host` kind's `device` field is marked `x-neuralis.ui.transport`, so while it holds a device (`transportChosen`) the root takes the declared `deviceLabel`, the `devicePlaceholders` entry for that device's claimed `platform` (the WHERE option carries it — agent-core `devices.listMine` returns it for the caller's own devices only; an undeclared platform falls back to `devicePlaceholder`) and none of the container chrome; the WHERE field's declared `help` names both pairing routes for a computer not yet listed; the schema's `not: {required: [device, hostRoot]}` hides the in-process `hostRoot` mirror then (`hiddenByExclusion`), the scope picker drops `agent` and the prefill turns to user scope with nothing granted (the server's own device-folder default). **Never keyed on a kind name** — a name test would hand the container chrome to every future kind it does not list. The form is one page in decision order (`configFields`): kind → WHERE (the transport field) → the folder + Browse → plain fields → scope + access → sync (trigger included) → an "Advanced" fold (URI scheme, the `ui.advanced` host mirror path, description, package folders). Browse opens `FolderPicker` (the extracted former inline browser): on this server only for a `canMount` caller (the shared `meetsRequires` mirror `FileTree` uses), starting from the host-kind discoverable suggestions the panel already loaded (no request of its own), in Docker the `/mounts` zone and below; on a chosen device through `sources/browse?device=` (the device's owner only), starting from the folders that device allows this server, with "Ask on that device" for one it does not (the host value's `requestDeviceFolder` → agent-core `POST devices/:id/requests`, plus the pending count and the `neuralis device grant` line). The Exec chip shows only where a shell can run in the kind's sources (`sources/kinds` `shell`: the `host` kind's own planes — it declares no `exec` capability — or a connector declaring `exec`; not `brain`) — `execRequires` is its tooltip, never a reason to hide the policy bit; the package-folders field calls the kernel `isOwnerOrAdminEffective`, the server gate's own predicate.
+- `SourcesPanel` add form, every OTHER field — renders from the closed control set in the same file (`fieldControl`): a text input (numeric for a number type), or `control: "select"`, whose options come from `x-neuralis.ui.optionsRoute` — a relative route in the DECLARING package (`kinds[].packageId`), read once per form through that package's own route client and quietly again after each burst of `devices` frames (the store's `deviceRevision`, bumped by `useFilesystemSSE`'s ONE `devices` subscription, which also re-reads the source summaries so a host source's liveness follows its device), label `name · OS · status · confinement` (the OS word from a row's `platform` — `Windows` · `macOS` · `Linux`, any other token raw — and the picked row's `platform` travels with the value to the root hint), a `revoked` row never offered, any other non-`online` row dimmed but selectable (the host connector's `device` field lists `sources/devices`: agent-core's `devices.listMine`, the caller's own devices). An `optionsRoute` that is absolute, carries a scheme, a `.`/`..` segment or a `%`/`\` is refused and the field renders as text with the reason. The list is UX only — the declaring package re-checks the value at create.
 - `SourcesPanel` description field — the VALUE is empty whenever the description is RESOLVED rather than stored (`description_effective`), and that is load-bearing: prefilling the value would freeze a copy of the package's wording into this source's config and stop it tracking the package. The resolved text therefore rides as the **placeholder** in edit state (with a one-line note saying an empty box keeps following the package) and as **labelled** text — `"… (from the package)"` — in the read state and the collapsed summary. **Both states must carry the label**: live-testing warded-wren caught it present in the read state and absent in the edit state, where the box simply looked empty; an opacity difference alone is not a label, because it does not survive the state that matters (editing).
 
 - `SourceDeleteConfirm` — inline rose-tinted popover under the row (no modal, matches the panel's "no overlay" pattern). Headline + one-line reminder that the host folder is not touched + `[ ] Purge vector index entries (~N point(s))` checkbox (default OFF — conservative) + Docker-bind-mount warning ribbon when `connection.config.hostRoot` is set, telling the user to run `neuralis mount remove <slug>` before restarting the container. On confirm, `SourcesPanel.handleDelete` calls `deleteSource({ purgeVectors })` and surfaces a transient `successMsg` ("Deleted "<source>" (vectors purged: N)").
 - **`SkillLauncher` coverage** (`@neuralis/package-system/client`, additive "+" launchers) — every filesystem function the LLM can drive has a visible composer-prefill trace. Clicking a launcher PREFILLS the chat composer with the skill (+ scripts) like a `/` slash pick; it never sends/streams. **No launcher states a feature list**: visibility is DERIVED from the host's per-caller skill catalog, so it cannot drift from each skill's own `SKILL.md` `requiredFeatures` and an unresolved catalog renders nothing (the gate named per row below is the SKILL's, documented here, not repeated in the JSX). `packageId` is the REGISTRY id (`@neuralis/brain-core`), matched as an exact pair with the skill id. The launchers resolve the `WorkspaceHostPort` from the `WorkspaceHostPortProvider` mounted once in `host/installFilesystemHostComponents.tsx` — without it they render `null` silently. Current placements:
-  - `Toolbar` — `sync` (`drive.sync`, icon-`brain`, script-less) next to the Sources panel toggle, and `manage-files` (`drive.write`; `scripts: mkdir, copy, modify`) as the general file-ops handoff. The tree's CONTEXT MENU deliberately carries none: it is a keyboard-navigable click-to-act list with one uniform item model, and a composer-prefill affordance would need a bespoke item kind there.
-  - `SourcesPanel` header — `manage-sources` (`drive.read`, attached-left to the `+ Source` button).
-  - `SourcesPanel` per-source **Permissions** header — `manage-uri-policy` (`drive.policy` — no grant below the `admin` tier, grantable to any custom role) hands the URI-policy / path-permission edit for that source to the agent, alongside the `PolicyEditor`.
-  - `FileTree` empty-state — `manage-files` (`drive.write`, label; `scripts: upload, modify`) to populate a source.
-  - `GitControlPanel` header — `git` (`drive.read`) next to the refresh button. The `git` skill drives the SAME `/git/*` routes this panel does — its own SKILL.md says so — and the panel shipped with no way to reach it until 2026-07-28.
-  - `PendingChangesPanel` toolbar — `manage-files` (`drive.write`) for bulk review; the per-row approve/revert buttons stay the primary path.
-  - `VectorHealthPanel` actions row — `manage-sources` (`drive.read`). The index is per-SOURCE, so the agent-side equivalent of scan/repair is a source reindex plus a sync-status readout.
-  - `PackagesPanel` header — `create-package` (label, script-less) hands the whole authoring flow (scaffold, manifest, tools, surfaces, connectors, build — including the WASM pipeline) to the agent; additive to the per-row `Build` button. This is the ONE launcher that narrows further, with `alsoRequires={["packages.author"]}`, even though the SKILL ships ungated (so it stays importable): it scaffolds into `packages://`, which needs write + install/build capability the default `member` role does not hold, so showing it to a caller whose first action would be denied is worse UX than hiding it. `alsoRequires` can only ever hide a launcher, never reveal one, so this cannot become a disclosure. Deliberate — do not "align" it with the skill frontmatter.
+  - `Toolbar` — `sync` (`sources.sync`, icon-`brain`, script-less) next to the Sources panel toggle, and `manage-files` (`files.write`; `scripts: mkdir, copy, modify`) as the general file-ops handoff. The tree's CONTEXT MENU deliberately carries none: it is a keyboard-navigable click-to-act list with one uniform item model, and a composer-prefill affordance would need a bespoke item kind there.
+  - `SourcesPanel` header — `manage-sources` (`files.read`, attached-left to the `+ Source` button).
+  - `SourcesPanel` per-source **Permissions** header — `manage-uri-policy` (`sources.policy` — no grant below the `admin` tier, grantable to any custom role) hands the URI-policy / path-permission edit for that source to the agent, alongside the `PolicyEditor`.
+  - `FileTree` empty-state — `manage-files` (`files.write`, label; `scripts: upload, modify`) to populate a source.
+  - `GitControlPanel` header — `git` (`files.read`) next to the refresh button. The `git` skill drives the SAME `/git/*` routes this panel does — its own SKILL.md says so — and the panel shipped with no way to reach it until 2026-07-28.
+  - `PendingChangesPanel` toolbar — `manage-files` (`files.write`) for bulk review; the per-row approve/revert buttons stay the primary path.
+  - `VectorHealthPanel` actions row — `manage-sources` (`files.read`). The index is per-SOURCE, so the agent-side equivalent of scan/repair is a source reindex plus a sync-status readout.
+  - `PackagesPanel` header — `create-package` (label, script-less) hands the whole authoring flow (scaffold, manifest, tools, surfaces, connectors, build — including the WASM pipeline) to the agent; additive — Build itself lives in Admin → Packages. This is the ONE launcher that narrows further, with `alsoRequires={["packages.author"]}`, even though the SKILL ships ungated (so it stays importable): it scaffolds into `packages://`, which needs write + install/build capability the default `member` role does not hold, so showing it to a caller whose first action would be denied is worse UX than hiding it. `alsoRequires` can only ever hide a launcher, never reveal one, so this cannot become a disclosure. Deliberate — do not "align" it with the skill frontmatter.
 
 ## How it plugs into the package-system kernel
 
 - Every component consumes the `useFilesystemHost()` context for agent state, file marks, accent colors, SSE URLs, and optional content renderers (the host can pass a markdown / code-highlight component).
-- API calls go through the `api/` module which wraps the kernel `PackageApi` — the brain-core route layer enforces `drive.read`, `drive.write`, `drive.search`, `drive.mount` features and source-scope checks server-side.
-- `PackagesPanel` calls host-side routes (`/api/packages/runtime`, `/api/projects/:id/packages/:slug/{build,trust,access-feature}`) through `api/projectPackages.ts`. The widget surfaces project-package operations here because they are project-scoped — they are NOT brain-core package routes.
+- API calls go through the `api/` module which wraps the kernel `PackageApi` — the brain-core route layer enforces `files.read`, `files.write`, `files.search`, `sources.mount` features and source-scope checks server-side.
+- `PackagesPanel` reads the host's scoped snapshot (`/api/packages/runtime` with the window agent's `x-agent-id`) through `api/projectPackages.ts` — NOT a brain-core package route.
 
-### `recognizesPackages` source toggle + package access-feature governance
+### Package folders + the Packages panel
 
-- **`SourcesPanel`** renders a **Recognize packages** checkbox on BOTH the Add-source wizard and the Modify-source body — shown only for `local`-kind sources AND only to an owner/admin-effective caller (`host.currentRole.priority <= 2`); it is hidden otherwise and the server re-gates. On create it rides the `createSource` body; on edit it joins the shared draft + Save (and is **stripped** from the PATCH of any caller below that strength, so an unrelated description/sync edit never trips the server's strength gate). Turning it on makes the source a runtime package source (additive to `_packages/`); the loaded packages are advertised only within the source's own scope.
-- **`PackagesPanel`** is the consumption-governance surface. Per package (first-party AND project WASM — both appear in the snapshot it lists), an owner/admin-effective caller sees a **base-access feature** control: attach or clear an override feature id (`ProjectRecord.packageAccessFeature`, restrict-only) that hides the whole package from anyone lacking it. The control is a **datalist picker** sourced from the project feature catalog (`getGrantableFeatureIds` → `/api/admin/feature-catalog`; free-text fallback if the fetch fails) — datalist, not a native `<select>`, to avoid the option-popup opacity gotcha; the route rejects an unknown feature id (400). A manifest-declared `requires.accessFeature` shows read-only (cannot be cleared here; an override adds an additional requirement). Non-owners see the effective feature read-only. (Grant the chosen feature to a role in Admin → Roles — a declared/overridden access feature is grantable there.)
+- **`SourcesPanel`** renders a **Package folders** field (`PackageFoldersField`, one folder per line relative to the source root, `.` = the whole folder) on BOTH the Add-source wizard and the Modify-source body — shown only for `host` sources AND only to an owner/admin-effective caller (the kernel `isOwnerOrAdminEffective` over `host.currentRole.priority` and `host.grantedFeatures` — the server's own predicate); it is hidden otherwise and the server re-gates. On create it rides the `createSource` body; on edit it joins the shared draft + Save (and is **stripped** from the PATCH of any caller below that strength, so an unrelated description/sync edit never trips the server's strength gate). Each listed folder is a runtime package source (additive to `_packages/`); the loaded packages are advertised only within the source's own scope, and a folder on another machine's device loads nothing.
+- **`PackagesPanel`** lists exactly what the window's agent gets: the scoped snapshot for this caller and that agent (scope, base-access feature, project membership — the stream's own ladder; an agent-scoped package of another agent and a member's private one stay out), native packages left out (they are the host's, in Admin → Packages). Each row shows its state (a device package whose device is offline reads "Not available"), trust, runtime, contribution counts and its effective access feature, read-only. Trust, Build and the access feature moved to **Admin → Packages** (project scope); the panel's header link opens it (`host.openAdminPackages`) and shows only to a holder of `packages.manage` — the admin route's own gate, hidden (never disabled) otherwise.
 
 ## Security & scope
 
 - Components never display raw `_meta` payloads (runtime billing telemetry); only `content` and `structuredContent` are rendered.
-- Cross-agent file marks and source observations are gated server-side by `filesystem.observeScoped` — the UI surfaces what the route returns and never tries to bypass the gate.
-- `PackagesPanel.setPackageTrust` / `setPackageAccessFeature` write to the platform zone via host routes; both require owner / admin role (`canManagePackages`). The access-feature override is restrict-only — it can attach a required feature, never grant access. Owner-only UI controls (the `recognizesPackages` toggle, the access-feature override) hide for non-owners via `host.currentRole`, but the server route is the enforcement floor.
+- Cross-agent file marks and source observations are gated server-side by `files.readOthers` — the UI surfaces what the route returns and never tries to bypass the gate.
+- `PackagesPanel` writes nothing: the package changes are Admin → Packages calls whose host body re-derives `canManagePackages` (the governance flag or `packages.manage`). The package-folders field hides for non-owners via `host.currentRole`, but the server route is the enforcement floor.
 
 ## VS Code-style file management (context menu · drag · inline edit)
 
@@ -97,7 +98,7 @@ agent share the same server path, deny-by-default, server re-gated):
   target (rename = single file OR folder; New Folder disabled on `brain://`; Paste
   needs a clipboard; Re-embed… = a single file or folder, not on `brain://` — its
   content lives in the vector store, there is no file to read again — and only
-  for a `drive.sync` holder, the reindex route's gate, mirrored hide-only).
+  for a `sources.sync` holder, the reindex route's gate, mirrored hide-only).
 - **Multi-select** — Ctrl/⌘-click toggles, Shift-click ranges over the flat visible
   list; bulk delete/cut/copy fan out client-side, each server-gated.
 - **Inline rename + inline New File / New Folder** — an `<input>` in the tree row
@@ -155,13 +156,19 @@ EPHEMERAL (never persisted).
 - **Gutter idiom.** The DIFF renderers use a per-row `DiffLineRow` gutter (scrolls horizontally with the row); the editor's gutter is CodeMirror's own. They look the same but differ on horizontal scroll by design.
 - **The virtualizer's `estimateSize` / `getItemKey` are STABLE `useCallback`s reading the row list through a ref** — `getItemKey` is the only memo dependency of virtual-core's measurement options, so an inline arrow (a new identity per render) invalidated the measurement cache and re-ran the estimator for every unmeasured row on each render. No `measureElement` override: the default measurer already reads `offsetHeight`.
 - **The tab strip keeps the ACTIVE tab in view and scrolls on a vertical wheel.** The strip lives in `FileEditor`'s `data-tab-scroller` div, whose scrollbar is an invisible overlay until hover. Measured 2026-09-04 in a 536 px widget with a 327 px sidebar: the strip is 165 px, and a third opened tab was ACTIVE yet fully outside it, with nothing on screen saying the strip scrolls. `EditorTabBar` applies two exported pure rules — `tabScrollDelta` (the active tab's overflow, applied to the scroller's `scrollLeft`; never `scrollIntoView`, which would also scroll the stage) and `wheelToHorizontal` (a native non-passive `wheel` listener — React's `onWheel` is passive and cannot `preventDefault`). The panel CLIPS the strip: a tab rect past the panel edge is geometry, not paint (`elementFromPoint` there hits the neighbour), so the defect was the invisible active tab, never an overflow.
-- **A tab's content is fetched by the STORE, never by a widget effect.** `rehydrateActiveTab` runs from `loadList` (a same-context mount — page reload) and from `setActiveFile` (a tab click), against the store's own active pair and the read STATE (`hasCompletedRead`: a string baseline or an error — a folder listing materialises content-less nodes, so FileNode presence means nothing). The effect it replaced decided from its render closure and re-opened the PREVIOUS agent's tab under the new one after a switch, and skipped the read for a listed-but-unread sibling tab ("Empty file" on click). While a read is pending the editor's placeholder says "Loading…"; "Empty file" is reserved for a completed read. The whole widget state is per context: a switch stashes the outgoing `(user, project, agent)` context's tree, tabs, caches and panels and restores the incoming one's (`contextStateByKey`, `../store/README.md`), so switching back finds the tree and the editor where they were.
-- **Root-listing failure is visible.** `loadList`'s catch sets `snapshotError`; the tree renders it as a rose banner with Retry (re-runs the root listing) and Dismiss, in place of "Empty Drive" when no source is known yet. A listing that answers clears it.
-- **Overlays.** `position: fixed` inside the widget is panel-anchored and panel-clipped at `dim` and `opaque` (the panel's `backdrop-filter`, load-bearing) and viewport-level only at `transparent` — so every toast and confirm dialog here (`PackagesPanel`'s toast + build log, `GitControlPanel`'s destructive-op confirm) is `createPortal`ed to `document.body` like `TreeDeleteConfirm`. The three header-picker click-away catchers in `GitControlPanel` are NOT scrims any more: their popovers stay inside the panel's isolated stacking context, so a body-level scrim would paint over them — they are one `useClickAway` capture-phase `mousedown` listener on the picker's zone, which also closes the picker on a click outside the widget (the clipped scrim never could).
+- **A tab's content is fetched by the STORE, never by a widget effect.** `rehydrateActiveTab` runs from `loadList` (a same-context mount — page reload) and from `setActiveFile` (a tab click), against the store's own active pair and the read STATE (`hasCompletedRead`: a string baseline or an error — a folder listing materialises content-less nodes, so FileNode presence means nothing). The effect it replaced decided from its render closure and re-opened the PREVIOUS agent's tab under the new one after a switch, and skipped the read for a listed-but-unread sibling tab ("Empty file" on click). While a read is pending the editor's placeholder says "Loading…"; "Empty file" is reserved for a completed read, and a failed one says `Read failed: <label>` and disables Edit in-place until a read lands (nothing loaded is nothing to type over) — `CodeEditor` reconfigures its placeholder and aria label through a Compartment, because the one view outlives the file it shows. The whole widget state is per context: a switch stashes the outgoing `(user, project, agent)` context's tree, tabs, caches and panels and restores the incoming one's (`contextStateByKey`, `../store/README.md`), so switching back finds the tree and the editor where they were.
+- **Root-listing failure is visible.** `loadList`'s catch sets `snapshotError`; the tree renders it as a rose banner with Retry (re-runs the root listing) and Dismiss, in place of "No files yet" when no source is known yet. A listing that answers clears it.
+- **Overlays.** `position: fixed` inside the widget is panel-anchored and panel-clipped at `dim` and `opaque` (the panel's `backdrop-filter`, load-bearing) and viewport-level only at `transparent` — so every confirm dialog here (`GitControlPanel`'s destructive-op confirm) is `createPortal`ed to `document.body` like `TreeDeleteConfirm`. The three header-picker click-away catchers in `GitControlPanel` are NOT scrims any more: their popovers stay inside the panel's isolated stacking context, so a body-level scrim would paint over them — they are one `useClickAway` capture-phase `mousedown` listener on the picker's zone, which also closes the picker on a click outside the widget (the clipped scrim never could).
 - The editor diff is `whitespace-pre` + horizontal scroll (long lines scroll), NOT wrapping — matching the chat card (a deliberate change from the old `<table>` `whitespace-pre-wrap break-all`).
 - **Getting the pre-edit baseline: ONE current read.** The canonical way for the file editor and chat card modify diff is a single `readFiles({ agentId, files:[uri] })` whose response carries `version.baseline.content` (the pre-edit snapshot, locked while `pending_review`) — parse it with `parseFilePrev` (`store/helpers.ts`). The pending baseline is **cumulative** (locked to pre-FIRST-edit); approval preserves the stored baseline, so ONE read gives the editor both sides of the diff. `src/routes/read.ts` used to DROP `read_version`/`line_start`/`line_end`/`include_ids` from the body, which made a `read_version:'baseline'` request over the route silently return CURRENT; it now forwards all four, so that request works — but it still answers with the baseline ALONE, and the diff needs both sides. Keep the single current read for those surfaces; Changes instead uses the bounded pending preview, whose receipt fences subsequent resolution.
-- The file-tree sidebar is a **fixed-pixel** column (mirrors the admin widget), not a percentage split: resizing the outer widget never reflows the tree. Its width is drag-resizable via a custom pointer-capture handle and persisted in the store / `localStorage` (`sidebarWidth`, min `FILESYSTEM_SIDEBAR_MIN_WIDTH = 120`px). The drag upper bound is the live container width, so the tree can fully cover the editor (tree + chat only). The `sidebarOpen` toggle collapses the column to width `0`.
+- The file-tree sidebar is a **fixed-pixel** column (mirrors the admin widget), not a percentage split: resizing the outer widget never reflows the tree until the widget edge reaches it — then the rendered width is capped at the container (`max-width`, CSS only) and grows back to the stored width on widening, and a drag starts from the rendered width; the editor column clips (`overflow-hidden`), so at zero width its empty state and line/char metrics never paint over the tree. Its width is drag-resizable via a custom pointer-capture handle and persisted in the store / `localStorage` (`sidebarWidth`, min `FILESYSTEM_SIDEBAR_MIN_WIDTH = 120`px). The drag upper bound is the live container width, so the tree can fully cover the editor (tree + chat only). The `sidebarOpen` toggle collapses the column to width `0`.
 - `FilesystemWidget` triggers `loadList()` when the agent, project or user id changes (the user comes from `port.useUserId()` through the install entry and is part of the context key); the in-flight dedupe in the list slice prevents thrash during rapid switches.
+- **Git graph rows:** **hovering** a collapsed row floats a **full-message card** (subject + the full commit **body** — `%b`, carried on `GitGraphCommit.body`, a NUL-terminated `logGraph` record so a multi-line body is parsed safely, server-capped — plus sha/author/relative-date), anchored to the graph ROOT and `pointer-events-none` so it never steals the hover.
+- **`source.git` row summary:** The field is CHEAP and bounded O(1)/source (a `.git` stat + an O(1) `.git/HEAD` branch read via `getSourceGitSummary`, TTL-cached — never a whole-repo status on the list path) and is stamped in the **two** source-summary builders: `FilesystemService.list`'s `filteredSources` (the tree) and `GET /sources` (the config panel), both AFTER the source-level access filter so a non-member never infers a project's git repos.
+- **`source.git` row summary:** `dirty` stays deferred off the list path; ahead/behind now ride the ON-DEMAND panel status (below) — the source-ROW summary itself stays O(1) and tracking-free.
+- **Diff expanders:** Expansion lazily fetches the NEW-side full source on first click (unchanged gaps are identical on both sides), routed per mode: an unstaged diff reads the working-tree file via the read API, a staged diff fetches the index blob via `GET /git/show?rev=index`, a commit diff fetches `rev=<sha>` and a range diff `rev=<head>` (never `<sha>^` — the show route rejects it); the result is cached per `(source, path, rev)` and any refusal (`not_a_blob`/`too_large`/`binary`/missing file) degrades the expanders to static "N hidden lines" text — fail-soft, never an error banner.
+- **Git commit tab:** Clearing the descriptor (pill close) falls the active tab back to `file` — the store centralises the fallback so a `git-commit` tab id is never stranded without a target — and BOTH git targets reset on an agent/project switch.
+- **Vector Health panel:** The UI panel (`VectorHealthPanel.tsx`) ships with `dryRun=false` by default plus an inline 2-click confirm on destructive buttons; the previous `dryRun=true` default made every click a no-op. Before/after deltas appear on the Deleted / Orphans stat cards after GC / Repair completes.
 
 ## Tests
 

package/app/filesystem/ui/RawMediaPreview.tsx

@@ -0,0 +1,58 @@
+import { useEffect, useState } from 'react';
+import { deviceRefusalLabel, sourceLiveReasonLabel } from '../lib/treeVisualState';
+
+/**
+ * What a failed preview says, from the byte lane's own answer: a 413 names the
+ * ceiling it hit (`limit`, bytes) — "Too large to preview (limit N MB)" —, a
+ * 503 the source's live state in the Files tree's own words, a 403 the
+ * device's refusal code, and anything else is a plain "Preview failed". Never
+ * a broken-image icon.
+ */
+export function previewFailureText(status: number, body: unknown): string {
+  const reason = (body as { reason?: unknown } | null)?.reason;
+  // A 503 is a device folder's answer only (the `host` connector's device transport).
+  const notReady = (body as { not_ready?: unknown } | null)?.not_ready;
+  if (status === 503 && typeof reason === 'string') {
+    return `Preview unavailable — ${sourceLiveReasonLabel(reason, { kind: 'host', notReady: Array.isArray(notReady) ? notReady : null })}`;
+  }
+  const refused = status === 403 ? deviceRefusalLabel(reason) : undefined;
+  if (refused) return refused;
+  const limit = (body as { limit?: unknown } | null)?.limit;
+  if (status === 413 && typeof limit === 'number' && Number.isFinite(limit) && limit > 0) {
+    const mb = limit / (1024 * 1024);
+    return `Too large to preview (limit ${mb >= 10 ? Math.round(mb) : Number(mb.toFixed(1))} MB)`;
+  }
+  if (status === 413) return 'Too large to preview';
+  return 'Preview failed';
+}
+
+/**
+ * An image or video preview from the raw byte lane. When the element fails to
+ * load, ONE request asks the route why and the honest line replaces the media
+ * (the route answers a refusal with a small JSON body, never the file).
+ */
+export function RawMediaPreview(props: { kind: 'image' | 'video'; src: string; alt: string; className: string }) {
+  const [failure, setFailure] = useState<string | null>(null);
+  useEffect(() => { setFailure(null); }, [props.src]);
+
+  const onError = (): void => {
+    void (async () => {
+      try {
+        const res = await fetch(props.src, { credentials: 'same-origin' });
+        if (res.ok) { setFailure('Preview failed'); return; }
+        const body = await res.json().catch(() => null);
+        setFailure(previewFailureText(res.status, body));
+      } catch {
+        setFailure('Preview failed');
+      }
+    })();
+  };
+
+  if (failure) {
+    return <div role="status" className="rounded-xl border border-white/10 bg-white/[0.035] px-4 py-3 text-xs text-white/55">{failure}</div>;
+  }
+  return props.kind === 'image'
+    // eslint-disable-next-line @next/next/no-img-element
+    ? <img src={props.src} alt={props.alt} className={props.className} onError={onError} />
+    : <video src={props.src} controls className={props.className} onError={onError} />;
+}

package/app/filesystem/ui/SourceBranchHeader.tsx

@@ -36,10 +36,10 @@ export function resolveSourceRepoHint(
 
 function SourceIcon({ info }: { info: SourceInfo }) {
   const Icon = resolveIconWithFallback(info.kind_icon ?? undefined, HardDrive);
-  // Vector-backed sources (brain itself, and local-disk sources that sync into
-  // the vector index) get a small overlay badge. Other source kinds — e.g.
-  // machine, remote APIs — render the icon plain.
-  const showVectorBadge = info.source_kind === 'brain' || info.source_kind === 'local-disk';
+  // Vector-backed sources (brain itself, and folders — on this server or on a
+  // device — that sync into the vector index) get a small overlay badge. Other
+  // source kinds — e.g. machine, remote APIs — render the icon plain.
+  const showVectorBadge = info.source_kind === 'brain' || info.source_kind === 'host';
   // Git indicator (G2.1 / F2) — a small GitBranch overlay when the source root
   // is a git repo OR its folders contain checkouts (`containsRepos`). ORTHOGONAL
   // to the sync tone (getSourceVisualTone owns the icon colour; this only adds a