@promptctl/cc-candybar 1.32.0 → 1.34.0

package/src/config/presets.ts

@@ -188,6 +188,36 @@ export function sanitizePersistedPresetOverride(
   return rest;
 }
 
+// [LAW:no-silent-failure] sanitizePersistedPresetOverride's twin for the
+// SAME machine-global overrides file, one field over: `presets.<name>.
+// rootOps` entries persist by NAME, and that name only has meaning against
+// the config it was clicked against. Loading a DIFFERENT project's config
+// — one that never declared "compact", say — would otherwise reach
+// applyPresetRootOpsOverrides -> presetRoot -> presetByName, which THROWS
+// for an undeclared name (correctly so for a hand-AUTHORED preset root: a
+// typo in a file the author can see). A stale overrides entry is not that
+// — it is the expected shape of a file that outlives any one project's
+// preset names — so it gets the SAME treatment sanitizePersistedPresetOverride
+// already gives `globals.preset`: dropped before replay ever sees it,
+// never a fatal error replacing an unrelated project's entire bar
+// (brandon-layout-edit-2gc.5 PR review).
+export function sanitizePersistedPresetRootOps(
+  presetRootOps: Readonly<Record<string, readonly string[]>>,
+  declaredPresets: Readonly<Record<string, PresetDecl>>,
+): Readonly<Record<string, readonly string[]>> {
+  const known = new Set(presetNames(declaredPresets));
+  const entries = Object.entries(presetRootOps).filter(([name]) =>
+    known.has(name),
+  );
+  // [LAW:carrying-cost] Identity return when nothing was dropped — the
+  // common case (this daemon serves one project, or every persisted name
+  // happens to be declared) costs one Set build and no new allocation.
+  if (entries.length === Object.keys(presetRootOps).length) {
+    return presetRootOps;
+  }
+  return Object.fromEntries(entries);
+}
+
 // [LAW:one-source-of-truth] brandon-layout-edit-2gc.1's replay step — the
 // SAME "patch an already-merged config" shape applySegmentPaletteOverrides
 // (src/config/loader/merge.ts) uses one field over, run at the SAME point in
@@ -208,6 +238,48 @@ export function sanitizePersistedPresetOverride(
 // already removed it. A malformed individual token (decodeLayoutOp -> null;
 // can only arise from hand-edited or previous-version state, never from this
 // process's own encodeLayoutOp) is filtered the same way, never applied.
+// [LAW:one-source-of-truth] brandon-layout-edit-2gc.5's diagnostic seam — the
+// ONE definition of "does this preset's rendered layout currently differ
+// from what's literally declared in the config file", read from the SAME
+// raw op-log record applyPresetRootOpsOverrides replays (never re-derived by
+// diffing the replayed tree against a fresh presetRoot() call, which would
+// be a second, weaker definition — a structural coincidence between two
+// unrelated edits could equal zero net ops and still disagree with the raw
+// log's own length). A name absent from the record (never edited) and a
+// name present with an empty token list (edited down to nothing, e.g. by
+// undo) are the SAME "not customized" — presence in the record only ever
+// means "this reload's overrides file had an entry", not "and it's non-
+// empty" [LAW:no-defensive-null-guards].
+//
+// Decodes each token the SAME way applyPresetRootOpsOverrides does, rather
+// than trusting the raw token COUNT — a token list where every token
+// decodes to null (malformed, or written by a previous protocol version)
+// is exactly the case applyPresetRootOpsOverrides itself treats as "no ops
+// to replay" (`ops.length === 0 → continue`, leaving the root untouched).
+// Counting raw tokens would disagree with that: "customized" would read
+// true over a tree that is, in fact, byte-identical to the literal
+// declared root — the inverted form of the drift this diagnostic exists to
+// catch.
+//
+// [LAW:carrying-cost] Verifies DECODE only, not whether the decoded op's
+// target/anchor still resolves against the CURRENT tree — that check would
+// need this to duplicate applyLayoutOps' own stale-target resolution
+// (a real walk of the tree) just to COUNT, on every render, a fact only a
+// LATER hand-authored config edit can produce (removing a segment a stored
+// op still names — see the stale-op comment on applyPresetRootOpsOverrides
+// above). A rare, later-edit-triggered false "customized" is the honest,
+// documented cost of keeping this an O(tokens) check rather than an O(tree)
+// one; the doc at docs/interaction-authoring.md's "Knowing when a preset's
+// layout has been edited" section states this same limit.
+export function presetIsCustomized(
+  presetRootOps: Readonly<Record<string, readonly string[]>>,
+  name: string,
+): boolean {
+  const tokens = presetRootOps[name];
+  if (tokens === undefined) return false;
+  return tokens.some((t) => decodeLayoutOp(t) !== null);
+}
+
 export function applyPresetRootOpsOverrides(
   config: DslConfig,
   presetRootOps: Readonly<Record<string, readonly string[]>>,

package/src/daemon/cache/render.ts

@@ -28,6 +28,7 @@ import { configOverridesPath } from "../paths.js";
 import {
   applyPresetRootOpsOverrides,
   sanitizePersistedPresetOverride,
+  sanitizePersistedPresetRootOps,
 } from "../../config/presets.js";
 import { VariableStore } from "../../var-system/store.js";
 import { SourceRegistry } from "../../var-system/sources.js";
@@ -85,6 +86,21 @@ export interface DslRenderState {
   readonly compiled: CompiledConfig;
   readonly neededInputPaths: ReadonlySet<string>;
   readonly lastRenderCellsBySegment: Map<string, readonly RichText[]>;
+  // [LAW:one-source-of-truth] The accumulated-ops record this reload read
+  // from the overrides file, sanitized against THIS config's declared
+  // presets (sanitizePersistedPresetRootOps — never the raw file content: a
+  // stale entry naming a preset from a different project must not surface
+  // as "customized" here either) — the exact input
+  // applyPresetRootOpsOverrides replayed into `config.presets[name].root`
+  // above. Carried alongside the replayed config because the replay
+  // CONSUMES the op count: by the time a preset's tree is spliced/
+  // validated, nothing about it says how many ops (if any) produced it.
+  // brandon-layout-edit-2gc.5 reads this per render (keyed by the active
+  // preset name) to answer "does the bar's current arrangement differ from
+  // what's literally in the user's file" without a second overrides read
+  // (this entry rebuilds on the SAME watcher that rebuilds `config`, so the
+  // two never drift).
+  readonly presetRootOps: Readonly<Record<string, readonly string[]>>;
   // [LAW:single-enforcer] Disposers for the SessionState validators this config
   // installed (derived from its action table). Disposed on swap/eviction in the
   // same dispose-before-swap transaction as the SourceRegistry, so a reload
@@ -327,6 +343,19 @@ export class RenderCache {
       withGlobalsOverrides,
       overrides.segmentPalette,
     );
+    // [LAW:no-silent-failure] Drop any entry naming a preset THIS config
+    // never declared before replay ever sees it — the shared overrides file
+    // outlives any one project's preset names (brandon-layout-edit-2gc.5 PR
+    // review: without this, a stale entry from a DIFFERENT project reaches
+    // applyPresetRootOpsOverrides -> presetRoot -> presetByName, which
+    // throws for an undeclared name, failing this unrelated project's
+    // ENTIRE render). Sanitized against `merged.presets` — the SAME config
+    // sanitizePersistedPresetOverride checks `globals.preset` against, two
+    // lines up, for the identical reason.
+    const sanitizedPresetRootOps = sanitizePersistedPresetRootOps(
+      overrides.presetRootOps,
+      merged.presets,
+    );
     // [LAW:one-source-of-truth] brandon-layout-edit-2gc.1's replay step —
     // the SAME "patch an already-merged config" cascade as the segment-
     // palette overlay above, one field over (a preset's `root` instead of a
@@ -337,7 +366,7 @@ export class RenderCache {
     // be.
     const withPresetRootOps = applyPresetRootOpsOverrides(
       withOverrides,
-      overrides.presetRootOps,
+      sanitizedPresetRootOps,
     );
     const config = validateConfig(
       withPresetRootOps,
@@ -414,6 +443,7 @@ export class RenderCache {
       neededInputPaths: buildNeededPrefixes(config),
       lastRenderCellsBySegment: new Map<string, readonly RichText[]>(),
       validatorDisposers,
+      presetRootOps: sanitizedPresetRootOps,
     };
   }
 

package/src/daemon/render-payload.ts

@@ -61,6 +61,15 @@ export interface EffectiveGlobals {
   // carried alongside so a menu label states the arrangement that actually
   // rendered [LAW:one-source-of-truth].
   readonly preset: string;
+  // [LAW:one-source-of-truth] brandon-layout-edit-2gc.5 — the SAME "does the
+  // active preset have accumulated rootOps right now" fact
+  // presetIsCustomized derives, resolved alongside `preset` (not a second
+  // lookup later) because both come from the SAME entry.state read: the
+  // resolved name and the resolved op-log presence must trace to one
+  // rebuild, or a diagnostic could name the wrong preset after a reload
+  // lands mid-render. Not itself a display value either — see `preset`'s
+  // own comment.
+  readonly presetCustomized: boolean;
   readonly style: StripStyle;
   readonly charset: Charset;
   readonly colorCompatibility: ColorCompatibility;
@@ -108,7 +117,13 @@ export interface RenderPayload extends ClaudeHookData {
   // and look's twin one level up: the SAME name that selected the layout this
   // render walked and the globals it rendered with, surfaced so a preset
   // trigger's label can never claim an arrangement the bar is not in.
-  readonly preset: { readonly effective: string };
+  // [LAW:one-source-of-truth] brandon-layout-edit-2gc.5 — `customized` rides
+  // alongside `effective` rather than as a sibling top-level field, mirroring
+  // the shape a `when`-gated status segment reads (`.preset.customized`)
+  // beside the trigger's own `.preset.effective` label. Required for the
+  // same reason as `effective`: resolved unconditionally per render from
+  // presetIsCustomized, never absent.
+  readonly preset: { readonly effective: string; readonly customized: boolean };
   // [LAW:one-type-per-behavior] style/charset/colorCompatibility/autoWrap/
   // padding are theme/look's twins over the remaining persistable globals
   // (candybar-config-engine-71o.3) — each REQUIRED and unconditionally
@@ -858,7 +873,10 @@ export async function buildRenderPayload(
     // hand) and a config reading e.g. `.padding.effective` must always find it.
     theme: { effective: effective.theme },
     look: { effective: effective.look },
-    preset: { effective: effective.preset },
+    preset: {
+      effective: effective.preset,
+      customized: effective.presetCustomized,
+    },
     style: { effective: effective.style },
     charset: { effective: effective.charset },
     colorCompatibility: { effective: effective.colorCompatibility },

package/src/daemon/server.ts

@@ -70,7 +70,11 @@ import {
   lookKeyByName,
   paletteForThemeName,
 } from "../themes/index.js";
-import { effectivePresetName, presetGlobals } from "../config/presets.js";
+import {
+  effectivePresetName,
+  presetGlobals,
+  presetIsCustomized,
+} from "../config/presets.js";
 import {
   renderStripCells,
   DEFAULT_CHARSET,
@@ -888,6 +892,15 @@ async function handleRequest(req: Request): Promise<HandledRequest> {
         const globals = presetGlobals(entry.state.config, preset);
         const effective: EffectiveGlobals = {
           preset,
+          // [LAW:one-source-of-truth] brandon-layout-edit-2gc.5 — read from
+          // THIS entry's own presetRootOps (the record that fed the SAME
+          // reload that produced entry.state.config), never a fresh
+          // loadOverrides() here — a second read could race a concurrent
+          // write and disagree with the tree that actually rendered.
+          presetCustomized: presetIsCustomized(
+            entry.state.presetRootOps,
+            preset,
+          ),
           theme: effectiveThemeName(
             sessionState.get(req.hookData.session_id, "theme"),
             globals.palette,

package/src/daemon/verbs/config-validators.ts

@@ -19,6 +19,10 @@ import { addableSegmentDomains } from "../../config/edit-chrome";
 import type { DslConfig } from "../../config/dsl-types";
 import { isGlobalsField } from "../config-overrides-store";
 import { encodeLayoutOp } from "../../config/layout-ops";
+import {
+  parsePersistTarget,
+  presetRootOpsKey,
+} from "../../config/loader/persist-target";
 import {
   clampSeed,
   createValidatorRegistry,
@@ -168,6 +172,43 @@ function configKeySeeds(config: DslConfig): ReadonlyMap<string, number> {
   return seeds;
 }
 
+// [LAW:one-source-of-truth] Every preset a config's action table ALREADY
+// targets via a `presets.<name>.rootOps` key (persist OR reset — the
+// contribution is keyed off intent to use structural editing for that
+// preset, not off "this config has any presets block") stays a
+// registered key EVEN when that preset's CURRENT tree has no
+// addable/removable segment for removeChrome/insertChrome to contribute
+// from. Without this, a preset edited down to zero non-exempt segments
+// (spliceContainer then contributes nothing for it at all) would orphan
+// its OWN reset action: the one affordance meant to undo a fully-emptied
+// preset would throw "unknown config key" at the exact moment it's needed
+// most (brandon-layout-edit-2gc.5 PR review). An EMPTY allow-list
+// registers the key (so `reset-config`'s membership check —
+// src/daemon/verbs/index.ts's resetConfig — passes) without granting any
+// illegitimate WRITE: a real persist write still needs a real
+// removeSegment/insertSegment/insertSegmentFrom action elsewhere;
+// mergeContributions unions an empty array with whatever those contribute.
+//
+// [LAW:no-mode-explosion] Deliberately narrower than "every declared
+// preset" — a config with a `presets` block but ZERO persist/reset actions
+// over it has no structural-editing surface at all, so it registers
+// nothing here, preserving this module's own "zero baseline keys" floor
+// (a globals field, and now a preset's rootOps, is writable only because
+// SOME action names it).
+function presetRootOpsContributions(config: DslConfig): KeySpecContribution[] {
+  const presets = new Set<string>();
+  for (const a of Object.values(config.actions)) {
+    const key = "persist" in a ? a.persist : "reset" in a ? a.reset : null;
+    if (key === null) continue;
+    const target = parsePersistTarget(key);
+    if (target?.scope === "preset-root-ops") presets.add(target.preset);
+  }
+  return [...presets].map((name) => ({
+    key: presetRootOpsKey(name),
+    spec: { kind: "allow-list", allowed: [] },
+  }));
+}
+
 function actionContributions(config: DslConfig): KeySpecContribution[] {
   const seeds = configKeySeeds(config);
   // [LAW:one-source-of-truth] The "addable segment" domains
@@ -180,9 +221,12 @@ function actionContributions(config: DslConfig): KeySpecContribution[] {
     ...perConfigDomainsFor(config),
     ...addableSegmentDomains(config),
   ]);
-  return Object.values(config.actions).flatMap((a) =>
-    actionKeySpecs(a, seeds, perConfigDomains),
-  );
+  return [
+    ...presetRootOpsContributions(config),
+    ...Object.values(config.actions).flatMap((a) =>
+      actionKeySpecs(a, seeds, perConfigDomains),
+    ),
+  ];
 }
 
 // [LAW:single-enforcer] The SOLE install-site derivation: a config's