@sealant/mend 0.27.5 → 0.29.0

package/README.md

@@ -11,11 +11,24 @@ npm install -g @sealant/mend
 
 Requires Node 22+ and a running Mend server.
 
-Run bare `mend` for the interactive dashboard. Highlight a session and press `v` to review its
-accumulated change in the terminal: navigate files and hunks, switch between unified and split
-diffs, reveal whitespace, select line ranges, add line or whole-change comments, inspect linked
-evidence, and draft a follow-up for the same session. Press `y` to deliver a pending follow-up and
-relaunch that session, or `o` to continue the review in the web app.
+Run bare `mend` for the interactive dashboard. The session pane takes three quarters of the screen
+and previews the recorded conversation without taking terminal control. The remaining quarter is a
+sidebar of three stacked sections — **Projects**, **Worktrees**, **Sessions** — where the section
+you are in stands open and the other two fold to the line that says what is selected; moving into
+the session pane leaves the sidebar as it was.
+
+Use `↑↓` to select rows and `←→` or Tab to move between the sections and the session pane. Enter
+moves right; it never launches or attaches. Press `a` to attach, `r` to resume a settled session, or
+`n` to create a session in the selected worktree (`w` creates a worktree). After starting or
+resuming, press `a` when ready to attach. Nothing is ever squeezed: a terminal too narrow for both
+gives the whole width to the side you are on, a terminal too short for three drawn panes shows the
+open section alone, and a one-line breadcrumb states whatever did not fit.
+
+Highlight a session and press `v` to review its accumulated change in the terminal: navigate files
+and hunks, switch between unified and split diffs, reveal whitespace, select line ranges, add line
+or whole-change comments, inspect linked evidence, and draft a follow-up for the same session. Press
+`y` to deliver a pending follow-up and relaunch that session, or `o` to continue the review in the
+web app.
 
 ## Local server
 
@@ -75,7 +88,7 @@ mend doctor                      # every fact above, on one screen
 
 ### mend pair
 
-```
+```text
 mend pair [--url <base url>]
 ```
 
@@ -88,16 +101,17 @@ from the Mend app later. The device names itself when it claims the code.
 
 ### mend doctor
 
-```
+```sh
 mend doctor
 ```
 
 Reads, and changes nothing: server reachable, token accepted, the Sealant connection, each connected
 account, adopted projects, the `claude` / `codex` / `gh` CLIs on PATH and whether their credentials
-exist on this machine, and the tailnet address. One line per fact — `✓` observed, `○` not set up
-yet, `✗` a blocker — and every line that needs an action ends with the one command that takes it:
+exist on this machine, and how the instance is exposed: what its operator declared and what the
+server observed. One line per fact — `✓` observed, `○` not set up yet, `✗` a blocker — and every
+line that needs an action ends with the one command that takes it:
 
-```
+```text
 ✓ server      http://localhost:3105 · mend 0.5.0
 ✓ signed in   token accepted
 ✓ sealant     connected · http://127.0.0.1:4000
@@ -105,14 +119,14 @@ yet, `✗` a blocker — and every line that needs an action ends with the one c
 ○ codex       not connected → mend connect codex
 ✓ projects    2 adopted
 ○ gh cli      on PATH · no credential here → gh auth login
-○ tailnet     not detected
+✓ exposure    declared loopback · http origin
 ```
 
 It exits 1 when a `✗` is printed, so a setup script can gate on it. No request waits longer than 3s.
 
 ## Commands
 
-```
+```text
 mend adopt [git-url] [--name <name>]  clone a network Git repository into the store
                                       (default: the current checkout's origin URL)
 mend codex|claude|opencode            new session worktree + launch the harness in it
@@ -138,7 +152,7 @@ mend version                          this CLI's version, and the server's when
 
 ## Signing in
 
-```
+```sh
 mend login                 # opens the browser at <server>/authorize; press Authorize there
 mend login --url https://mend.example.com
 mend logout                # revokes this terminal's device token and forgets it
@@ -228,6 +242,15 @@ on first connection, but refuses a changed key. Rerunning setup does not replace
 | `MEND_DETACH_KEY`         | Set to `none` when an outer multiplexer detaches                                                           |
 | `~/.config/mend/cli.json` | `{ "url": ..., "token": ..., "deviceId": ... }` — env vars win; a pre-XDG `~/.mend/cli.json` keeps working |
 
+## Colors
+
+The dashboard and review screen use Ayu Mirage backgrounds and accents, with brighter text and
+borders for terminal legibility. `src/tui-theme.ts` defines the shared palette. Inactive pane titles
+use the primary text color, not the border color.
+
+Palette tests require at least 7:1 text contrast on the main backgrounds and 6:1 on selected rows.
+Selection and diff backgrounds use solid, precomposited colors. The web theme is unchanged.
+
 ## Herdr
 
 When Mend attaches Codex, Claude Code, or OpenCode inside a Herdr pane, it reports that harness to

package/dist/{chunk-A5I5EW2Y.js → chunk-F6AJNFVE.js}

@@ -4,6 +4,64 @@ var __export = (target, all3) => {
     __defProp(target, name, { get: all3[name], enumerable: true });
 };
 
+// ../../packages/domain/src/workbench/connected-credential.ts
+var CLAUDE_GRANT_SECTION = "claudeAiOauth";
+var narrowCredential = (provider, secret) => {
+  if (provider !== "claude") return { kind: "unchanged", secret };
+  const parsed = parseDocument(secret);
+  if (parsed === null) return { kind: "unchanged", secret };
+  const grant = parsed[CLAUDE_GRANT_SECTION];
+  if (grant === void 0) return { kind: "unchanged", secret };
+  const dropped = Object.keys(parsed).filter((key) => key !== CLAUDE_GRANT_SECTION).toSorted();
+  return {
+    kind: "narrowed",
+    // Two spaces and a trailing newline: the shape Claude Code writes, so a round trip through
+    // Mend leaves a file a person can still read.
+    secret: `${JSON.stringify({ [CLAUDE_GRANT_SECTION]: grant }, null, 2)}
+`,
+    dropped
+  };
+};
+var parseDocument = (secret) => {
+  const trimmed = secret.trim();
+  if (!trimmed.startsWith("{")) return null;
+  try {
+    const value3 = JSON.parse(trimmed);
+    return typeof value3 === "object" && value3 !== null && !Array.isArray(value3) ? value3 : null;
+  } catch {
+    return null;
+  }
+};
+var claudeGrantFacts = (secret) => {
+  const parsed = parseDocument(secret);
+  const grant = parsed?.[CLAUDE_GRANT_SECTION];
+  if (typeof grant !== "object" || grant === null) return null;
+  const record3 = { ...grant };
+  const refreshToken = record3["refreshToken"];
+  return {
+    accessExpiresAt: asDate(record3["expiresAt"]),
+    refreshExpiresAt: asDate(record3["refreshTokenExpiresAt"]),
+    subscriptionType: typeof record3["subscriptionType"] === "string" ? record3["subscriptionType"] : null,
+    hasRefreshToken: typeof refreshToken === "string" && refreshToken !== ""
+  };
+};
+var asDate = (value3) => {
+  if (typeof value3 !== "number" || !Number.isFinite(value3) || value3 <= 0) return null;
+  const date2 = new Date(value3);
+  return Number.isNaN(date2.getTime()) ? null : date2;
+};
+var sameGrant = (left, right) => {
+  const token = (secret) => {
+    const grant = parseDocument(secret)?.[CLAUDE_GRANT_SECTION];
+    if (typeof grant !== "object" || grant === null) return null;
+    const value3 = grant["refreshToken"];
+    return typeof value3 === "string" && value3 !== "" ? value3 : null;
+  };
+  const a = token(left);
+  const b = token(right);
+  return a !== null && b !== null && a === b;
+};
+
 // ../../node_modules/.pnpm/effect@4.0.0-beta.93/node_modules/effect/dist/Pipeable.js
 var pipeArguments = (self, args2) => {
   switch (args2.length) {
@@ -26436,6 +26494,11 @@ var ProjectEnvironmentVariableId = Schema_exports.String.pipe(
 );
 var ProjectSecretId = Schema_exports.String.pipe(Schema_exports.brand("ProjectSecretId"));
 var ProjectClusterBindingId = Schema_exports.String.pipe(Schema_exports.brand("ProjectClusterBindingId"));
+var OrganizationId = Schema_exports.String.pipe(Schema_exports.brand("OrganizationId"));
+var InvitationId = Schema_exports.String.pipe(Schema_exports.brand("InvitationId"));
+var FolderId = Schema_exports.String.pipe(Schema_exports.brand("FolderId"));
+var AuditEventId = Schema_exports.String.pipe(Schema_exports.brand("AuditEventId"));
+var SessionControlEventId = Schema_exports.String.pipe(Schema_exports.brand("SessionControlEventId"));
 
 // ../../packages/domain/src/settings.ts
 var PrMode = Schema_exports.Literals(["draft-immediately", "pr-on-approval"]);
@@ -26563,6 +26626,45 @@ var Timestamp = Schema_exports.Union([
 ]);
 var SequenceNumber = Schema_exports.Union([Schema_exports.BigIntFromString, Schema_exports.BigInt]);
 
+// ../../packages/domain/src/workbench/organization.ts
+var OrganizationRole = Schema_exports.Literals(["owner", "member"]);
+var InstanceRole = Schema_exports.Literals(["operator"]);
+var TenancyMode = Schema_exports.Literals(["single", "multi"]);
+var ProjectVisibility = Schema_exports.Literals(["private", "shared"]);
+var Organization = class extends Schema_exports.Class("Organization")({
+  id: OrganizationId,
+  /** Display name, unique per instance after trimming and case folding. */
+  name: Schema_exports.String,
+  /** The account that created it; null for the organization the upgrade created. */
+  createdByUserId: Schema_exports.NullOr(Schema_exports.String),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}) {
+};
+var OrganizationMember = class extends Schema_exports.Class("OrganizationMember")({
+  organizationId: OrganizationId,
+  userId: Schema_exports.String,
+  name: Schema_exports.String,
+  email: Schema_exports.String,
+  role: OrganizationRole,
+  joinedAt: Timestamp
+}) {
+};
+var Invitation = class extends Schema_exports.Class("Invitation")({
+  id: InvitationId,
+  organizationId: OrganizationId,
+  role: OrganizationRole,
+  /** When set, only the account with this email can accept. */
+  email: Schema_exports.NullOr(Schema_exports.String),
+  createdByUserId: Schema_exports.String,
+  createdAt: Timestamp,
+  expiresAt: Timestamp,
+  acceptedByUserId: Schema_exports.NullOr(Schema_exports.String),
+  acceptedAt: Schema_exports.NullOr(Timestamp),
+  revokedAt: Schema_exports.NullOr(Timestamp)
+}) {
+};
+
 // ../../packages/domain/src/workbench/project.ts
 var AutomationChoice = Schema_exports.Literals(["inherit", "on", "off"]);
 var GitAuthMode = Schema_exports.Literals(["ambient", "mend-key", "bridge"]);
@@ -26586,7 +26688,10 @@ var repositoryCloneUrlIssue = (value3) => {
   } catch {
     return REPOSITORY_CLONE_URL_GUIDANCE;
   }
-  if (url.protocol !== "http:" && url.protocol !== "https:" && url.protocol !== "ssh:" && url.protocol !== "git:" || url.hostname === "" || url.pathname === "" || url.pathname === "/") {
+  if (url.protocol !== "http:" && url.protocol !== "https:" && url.protocol !== "ssh:" && url.protocol !== "git:" || url.hostname === "" || url.pathname === "" || url.pathname === "/" || // A host is a DNS name or an IP literal. `ssh:` is not a special scheme, so URL keeps any
+  // code point in its host; a `$`, backtick or `;` there would reach a shell through
+  // GIT_SSH_COMMAND.
+  !/^(?:[a-z0-9_-]+(?:\.[a-z0-9_-]+)*\.?|\[[0-9a-f:.]+\])$/i.test(url.hostname)) {
     return REPOSITORY_CLONE_URL_GUIDANCE;
   }
   return null;
@@ -26597,11 +26702,20 @@ var RepositoryCloneUrl = Schema_exports.String.pipe(
 );
 var Project = class extends Schema_exports.Class("Project")({
   id: ProjectId,
-  /** Short name; also the store directory name. */
+  /** Short name, unique within the organization. */
   name: Schema_exports.String,
+  /** The organization that owns the project (docs/adr/0003-organizations-and-tenancy.md). */
+  organizationId: OrganizationId,
+  /** `private`: its creator only. `shared`: every member of its organization. */
+  visibility: ProjectVisibility,
+  /** The account that adopted it; the creator a private project is visible to. */
+  createdByUserId: Schema_exports.NullOr(Schema_exports.String),
   /** Network Git URL used for adoption. Null only for legacy bare-created repositories. */
   originUrl: Schema_exports.NullOr(Schema_exports.String),
-  /** Absolute path of the bare repo inside the store: `<storeRoot>/<name>/repo.git`. */
+  /**
+   * Absolute path of the bare repo inside the store: `<storeRoot>/<projectId>/repo.git` for
+   * projects adopted after organizations, `<storeRoot>/<name>/repo.git` before.
+   */
   storePath: Schema_exports.String,
   defaultBranch: Schema_exports.String,
   /** HEAD of the default branch at adoption — display only; git is the source of truth. */
@@ -26653,6 +26767,45 @@ var Project = class extends Schema_exports.Class("Project")({
 }) {
 };
 
+// ../../packages/domain/src/workbench/audit.ts
+var AuditAction = Schema_exports.Literals([
+  "invitation.created",
+  "invitation.revoked",
+  "invitation.accepted",
+  "member.role_changed",
+  "member.removed",
+  "project.visibility_changed",
+  "project.taken_over",
+  "folder.created",
+  "folder.removed",
+  "reference.added",
+  "reference.removed",
+  "session.shared_control_on",
+  "session.shared_control_off",
+  "member.password_reset_issued",
+  "organization.created",
+  "organization.renamed",
+  "recovery.owner_granted",
+  "recovery.password_reset_issued"
+]);
+var AuditData = Schema_exports.Record(
+  Schema_exports.String,
+  Schema_exports.Union([Schema_exports.String, Schema_exports.Number, Schema_exports.Boolean, Schema_exports.Null])
+);
+var AuditEvent = class extends Schema_exports.Class("AuditEvent")({
+  id: AuditEventId,
+  organizationId: OrganizationId,
+  /** The account that acted. */
+  actorUserId: Schema_exports.String,
+  action: AuditAction,
+  /** What the action touched: `member`, `invitation`, `project`, `session`, `folder` or `reference`. */
+  subjectType: Schema_exports.String,
+  subjectId: Schema_exports.String,
+  data: AuditData,
+  createdAt: Timestamp
+}) {
+};
+
 // ../../packages/domain/src/workbench/agent-protocol.ts
 var AgentLaunchMode = Schema_exports.Literals(["pty", "protocol"]);
 var AgentTurnStatus = Schema_exports.Literals([
@@ -26888,6 +27041,36 @@ var ContextSnapshot = class extends Schema_exports.Class("ContextSnapshot")({
 }) {
 };
 
+// ../../packages/domain/src/workbench/folder.ts
+var Folder = class extends Schema_exports.Class("Folder")({
+  id: FolderId,
+  organizationId: OrganizationId,
+  /** Short name, unique within the organization; the default mount directory name. */
+  name: Schema_exports.String,
+  /** Absolute path of the directory inside the store: `_organizations/<org>/folders/<id>`. */
+  path: Schema_exports.String,
+  createdByUserId: Schema_exports.NullOr(Schema_exports.String),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}) {
+};
+var ProjectFolder = class extends Schema_exports.Class("ProjectFolder")({
+  projectId: ProjectId,
+  folderId: FolderId,
+  /** Mount directory under `/workspace/home/`. */
+  name: Schema_exports.String,
+  readOnly: Schema_exports.Boolean,
+  createdAt: Timestamp
+}) {
+};
+var FolderFile = class extends Schema_exports.Class("FolderFile")({
+  path: Schema_exports.String,
+  bytes: Schema_exports.Int
+}) {
+};
+var FOLDER_MAX_FILE_BYTES = 1024 * 1024;
+var FOLDER_MAX_REQUEST_BYTES = 4 * 1024 * 1024;
+
 // ../../packages/domain/src/workbench/review-slice.ts
 var DiffDigest = Schema_exports.String.pipe(
   Schema_exports.check(Schema_exports.isPattern(/^[0-9a-f]{64}$/)),
@@ -26966,11 +27149,22 @@ var SessionExtraMount = class extends Schema_exports.Class("SessionExtraMount")(
 // ../../packages/domain/src/workbench/reference.ts
 var Reference2 = class extends Schema_exports.Class("Reference")({
   id: ReferenceId,
-  /** Short name; also the clone directory and the mount directory name. */
+  /** Short name, unique within the organization; also the mount directory name. */
   name: Schema_exports.String,
+  /** The organization that owns the reference (docs/adr/0003-organizations-and-tenancy.md). */
+  organizationId: OrganizationId,
+  /**
+   * The account that added it. References added before organizations are credited to the oldest
+   * account; null only on an instance that had no account yet.
+   */
+  createdByUserId: Schema_exports.NullOr(Schema_exports.String),
   /** Where the clone comes from — a remote URL or a local path. */
   originUrl: Schema_exports.String,
-  /** Absolute path of the clone inside the store: `<storeRoot>/_references/<name>`. */
+  /**
+   * Absolute path of the clone inside the store:
+   * `<storeRoot>/_organizations/<organizationId>/references/<id>`, or
+   * `<storeRoot>/_references/<name>` for references added before organizations.
+   */
   path: Schema_exports.String,
   /** Branch or tag the clone is held at; null = the remote's default branch. */
   pinnedRef: Schema_exports.NullOr(Schema_exports.String),
@@ -27062,6 +27256,16 @@ var Session = class extends Schema_exports.Class("Session")({
   dotfiles: Schema_exports.NullOr(SessionDotfiles),
   /** Who provisioned the session — whose dotfiles apply. Null for pre-column rows. */
   ownerUserId: Schema_exports.NullOr(Schema_exports.String),
+  /**
+   * Shared control (docs/adr/0003-organizations-and-tenancy.md): when set, anyone who can see the
+   * session may steer it, still on the owner's credentials. Who turned it on, and when.
+   */
+  sharedControlEnabledByUserId: Schema_exports.NullOr(Schema_exports.String).pipe(
+    Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
+  ),
+  sharedControlEnabledAt: Schema_exports.NullOr(Timestamp).pipe(
+    Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
+  ),
   /**
    * Whether the harness left a conversation behind — a transcript Mend captured at settle or
    * found in the live harness home. False is a dead end: nothing to resume, nothing to hand
@@ -27105,8 +27309,11 @@ var HotWorkspace = class extends Schema_exports.Class("HotWorkspace")({
    * launch. Rows from before still carry the pre-created worktree the drain must remove.
    */
   worktreeId: Schema_exports.NullOr(WorktreeId),
-  /** Whose dotfiles were resolved at prewarm. Null when no user has dotfiles configured. */
-  ownerUserId: Schema_exports.NullOr(Schema_exports.String),
+  /**
+   * The account the workspace was provisioned as: its connected accounts, dotfiles and signer.
+   * Only that account's sessions claim it (docs/adr/0003-organizations-and-tenancy.md).
+   */
+  ownerUserId: Schema_exports.String,
   status: HotWorkspaceStatus,
   /** Why provisioning failed, when it did — surfaced on the project setup page. */
   error: Schema_exports.NullOr(Schema_exports.String),
@@ -27188,7 +27395,7 @@ var ProjectClusterBindingsSnapshot = class extends Schema_exports.Class(
 }) {
 };
 
-// ../../node_modules/.pnpm/@sealant+api-contracts@0.32.0_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts/dist/workspace-environment.js
+// ../../node_modules/.pnpm/@sealant+api-contracts@0.36.0_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts/dist/workspace-environment.js
 var RESERVED_NAMES = new Map([
   // Identity/process roots the daemon and shells own.
   ...[
@@ -27523,6 +27730,26 @@ var ServiceView = class extends Schema_exports.Class("ServiceView")({
 }) {
 };
 
+// ../../packages/domain/src/workbench/session-control.ts
+var SessionControlKind = Schema_exports.Literals([
+  "interrupt",
+  "terminal-attach",
+  "shell-open",
+  "stop",
+  "shared-control-on",
+  "shared-control-off"
+]);
+var SessionControlEvent = class extends Schema_exports.Class("SessionControlEvent")({
+  id: SessionControlEventId,
+  sessionId: SessionId,
+  actorUserId: Schema_exports.String,
+  kind: SessionControlKind,
+  /** The turn, process or Service the act concerned, when it concerned one. */
+  refId: Schema_exports.NullOr(Schema_exports.String),
+  createdAt: Timestamp
+}) {
+};
+
 // ../../packages/domain/src/workbench/session-run.ts
 var SessionRun = class extends Schema_exports.Class("SessionRun")({
   sealantRunId: SealantRunId,
@@ -27879,6 +28106,9 @@ var trackBracketedPaste = (output, current) => {
 var pasteBytes = (text, bracketed) => Buffer.from(bracketed ? `\x1B[200~${text}\x1B[201~` : text, "utf8");
 
 export {
+  narrowCredential,
+  claudeGrantFacts,
+  sameGrant,
   repositoryCloneUrlIssue,
   RepositoryCloneUrl,
   HARNESS_COMMANDS,