@stringsync/splates 0.0.53 → 0.0.55

package/index.js

@@ -0,0 +1,1844 @@
+#!/usr/bin/env bun
+// @bun
+
+// index.ts
+import { basename as basename2 } from "path";
+import {
+  LEGACY,
+  legacyWarnings,
+  systemPs
+} from "@stringsync/splates-server/config";
+import { assets } from "@stringsync/splates-server/server";
+import { NodeFs } from "webappwiz/system";
+
+// handoff.ts
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var devMounted = { value: false };
+var CHECKOUT_BIN = join("bin", "splates");
+var CHECKOUT_ENTRY = join("packages", "splates", "checkout.ts");
+function checkoutAbove(cwd) {
+  for (let dir = resolve(cwd);; dir = dirname(dir)) {
+    if (existsSync(join(dir, CHECKOUT_BIN)) && existsSync(join(dir, CHECKOUT_ENTRY))) {
+      return dir;
+    }
+    if (dirname(dir) === dir) {
+      return null;
+    }
+  }
+}
+async function handOffDev(argv, cwd) {
+  if (devMounted.value || argv[0] !== "dev") {
+    return null;
+  }
+  const checkout = checkoutAbove(cwd);
+  if (checkout === null) {
+    console.error("splates dev is only in a splates checkout, and this directory is in none: cd into one and run its bin/splates.");
+    return 1;
+  }
+  const proc = Bun.spawn([join(checkout, CHECKOUT_BIN), ...argv], {
+    cwd,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  return await proc.exited;
+}
+
+// splates.ts
+import { agents } from "@stringsync/splates-server/agents";
+import { attach } from "@stringsync/splates-server/artifacts";
+import { commaList as commaList5 } from "@stringsync/splates-server/comma-list";
+import { refuseGroomer as refuseGroomer4 } from "@stringsync/splates-server/conversations";
+import { exits, fail as fail9 } from "@stringsync/splates-server/exit";
+import { DEFAULT_COUNT, log as showLog } from "@stringsync/splates-server/log";
+import { merge } from "@stringsync/splates-server/merge";
+import { portsLs } from "@stringsync/splates-server/ports";
+import { forget, init } from "@stringsync/splates-server/projects";
+import {
+  MIGRATING,
+  MIGRATION_LIMIT,
+  migrateRecords,
+  repository as repository10
+} from "@stringsync/splates-server/records";
+import {
+  newest,
+  recordsFirst,
+  rosterOf as rosterOf2,
+  runHeavy,
+  seeded as seeded2,
+  update
+} from "@stringsync/splates-server/server";
+import { addFactTasks } from "@stringsync/splates-server/stats";
+import {
+  add,
+  checkpoint,
+  claim,
+  DEFAULT_TIMEOUT as DEFAULT_TIMEOUT3,
+  follow,
+  list,
+  path,
+  REMOVE_REASONS,
+  recordRetry,
+  remove,
+  serveProject,
+  show,
+  untilAfter as untilAfter3,
+  wait
+} from "@stringsync/splates-server/tasks";
+import { cli as cli16 } from "webappwiz/cmd";
+import { Duration as Duration3 } from "webappwiz/time";
+import { z as z17 } from "zod";
+
+// artifact.ts
+import { basename, resolve as resolve2 } from "node:path";
+import {
+  addArtifact,
+  listArtifacts,
+  removeArtifact
+} from "@stringsync/splates-server/artifacts";
+import { commaList as commaList2 } from "@stringsync/splates-server/comma-list";
+import { conversationOf } from "@stringsync/splates-server/conversations";
+import { fail as fail2 } from "@stringsync/splates-server/exit";
+import { repository } from "@stringsync/splates-server/records";
+import { cli } from "webappwiz/cmd";
+import { z as z2 } from "zod";
+
+// flags.ts
+import { BACKLOG_LANE } from "@stringsync/splates-server/board";
+import { commaList } from "@stringsync/splates-server/comma-list";
+import { SYSTEM_STORES } from "@stringsync/splates-server/creds";
+import { fail } from "@stringsync/splates-server/exit";
+import {
+  Offered,
+  pickAgent,
+  pickEffort,
+  splatesHome
+} from "@stringsync/splates-server/models";
+import { SLOT_POOL } from "@stringsync/splates-server/ports";
+import { rosterOf, seeded } from "@stringsync/splates-server/server";
+import { FsStorage } from "@stringsync/splates-server/storage";
+import { SavedTunnel } from "@stringsync/splates-server/tunnel";
+import { z } from "zod";
+var position = z.coerce.number().int().positive().optional();
+async function assigneeIn(deps, agent, model, effort) {
+  if (agent === "") {
+    if (model !== "" || effort !== "") {
+      fail("usage", "--model and --effort go with --agent", {
+        model,
+        effort
+      });
+    }
+    return;
+  }
+  if (agent === "none") {
+    return null;
+  }
+  return pickIn(deps, await seeded(rosterOf(deps)), agent, model, effort);
+}
+async function pickIn(deps, agents, agent, model, effort, data = {}) {
+  const picked = pickAgent(agents, agent, model === "" ? undefined : model, data);
+  return { ...picked, ...await effortIn(deps, picked.agent, effort, data) };
+}
+async function effortIn(deps, agent, effort, data = {}) {
+  if (effort === "") {
+    return {};
+  }
+  const offered = (await offeredOf(deps).all())[agent];
+  return { effort: pickEffort(offered, agent, effort, data) };
+}
+function offeredOf({ ps, fs }) {
+  return new Offered(new FsStorage(splatesHome(ps), fs).document("offered.json"));
+}
+function slotTunnelsOf({
+  ps,
+  fs,
+  secrets = SYSTEM_STORES
+}) {
+  return SLOT_POOL.map(({ word }) => SavedTunnel.in(new FsStorage(`${splatesHome(ps)}/slots/${word}`, fs), secrets.device));
+}
+function laneIn(raw) {
+  const value = raw.trim();
+  if (value === "") {
+    return;
+  }
+  if (value === "new") {
+    return "new";
+  }
+  if (value === "none") {
+    return null;
+  }
+  if (value === "backlog") {
+    return BACKLOG_LANE;
+  }
+  const id = Number(value);
+  if (!Number.isInteger(id) || id < 0) {
+    fail("usage", `'${value}' is not a lane: pass its number, new or none`, {
+      lane: value
+    });
+  }
+  return id;
+}
+function taskIds(raw) {
+  return commaList(raw).map((value) => {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+      fail("usage", `'${value}' is not a task number`, { number: value });
+    }
+    return id;
+  });
+}
+async function here({
+  service,
+  git,
+  ps,
+  project
+}) {
+  return project === undefined ? service.taskFor(await git.currentBranch(ps.cwd())) : null;
+}
+
+// artifact.ts
+var splatesArtifact = cli("artifact").description("files your conversation made as its outputs, such as a screenshot, a recording or an HTML page: kept by name for the life of the conversation, whatever task it was made in, and listed on the `splates server` page beside its thread. A file that shows a question or a demo step is no artifact: `splates attach` it. The conversation is $SPLATES_CONVERSATION, or --conversation <id> from an agent outside `splates server`");
+var conversation = [
+  "conversation",
+  z2.string(),
+  {
+    default: "",
+    description: "conversation id, when not run by an agent `splates server` started"
+  }
+];
+splatesArtifact.command("add").use(repository({ needs: "own" })).description("keep files as artifacts of this conversation, each named for its basename, or by --name when there is one; adding a name the conversation holds makes its next version, earlier ones kept until cleanup takes them. Past the project's limit (artifactProjectCapacity), `splates server` first evicts the oldest bytes the project keeps: removed and replaced versions, then what archived conversations show, then what live ones do. Past the file or conversation limit (artifactFileCapacity, artifactConversationCapacity), or the project's when even that would not make room, it stops with `too_large`, changing nothing for that file").arg("files", z2.string(), { description: "files to keep, comma separated" }).option("name", z2.string(), {
+  default: "",
+  description: "the artifact's name; for one file only"
+}).option(...conversation).action(async (opts, ctx) => {
+  const paths = commaList2(opts.files);
+  if (paths.length === 0) {
+    fail2("usage", "name the files to keep: nothing was changed");
+  }
+  if (opts.name !== "" && paths.length > 1) {
+    fail2("usage", "--name names one file: nothing was changed");
+  }
+  const id = await conversationOf(ctx.service, opts.conversation);
+  const files = await Promise.all(paths.map(async (given) => {
+    const path = resolve2(ctx.ps.cwd(), given);
+    const bytes = await ctx.fs.readBytes(path).catch(() => null);
+    if (bytes === null) {
+      fail2("usage", `cannot read ${path}: nothing was changed`, {
+        file: path
+      });
+    }
+    return { name: opts.name || basename(path), bytes };
+  }));
+  const task = await here(ctx);
+  for (const file of files) {
+    await ctx.journal.record("artifact add", task, () => addArtifact(ctx, id, file), (added) => ({
+      name: file.name,
+      version: added.version,
+      bytes: added.bytes
+    }));
+  }
+});
+splatesArtifact.command("remove").use(repository({ needs: "own" })).description("stop listing the artifact of that name, every version kept until cleanup takes them; adding the name again lists it again").arg("name", z2.string(), { description: "the artifact's name" }).option(...conversation).action(async (opts, ctx) => {
+  const id = await conversationOf(ctx.service, opts.conversation);
+  await ctx.journal.record("artifact remove", await here(ctx), () => removeArtifact(ctx, id, opts.name), (version) => ({ name: opts.name, version }));
+});
+splatesArtifact.command("list").use(repository({ needs: "own" })).description("the artifacts this conversation lists, and their current version").option(...conversation).action(async (opts, ctx) => listArtifacts(ctx, await conversationOf(ctx.service, opts.conversation)));
+splatesArtifact.command("show").use(repository({ needs: "own" })).description("every version of an artifact, and which is current").arg("name", z2.string(), { description: "the artifact's name" }).option(...conversation).action(async (opts, ctx) => listArtifacts(ctx, await conversationOf(ctx.service, opts.conversation), opts.name));
+
+// budget.ts
+import {
+  endBudgetRaise,
+  raiseBudget,
+  setBudget,
+  showBudget
+} from "@stringsync/splates-server/workers";
+import { cli as cli2 } from "webappwiz/cmd";
+import { z as z3 } from "zod";
+var DEV = {
+  default: "",
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV. With none answering, this machine's own budget file is read and changed"
+};
+var JSON_OPTION = { default: false, description: "emit JSON" };
+var LIMIT = z3.enum(["hour", "day", "month"]);
+var SET_LIMIT = z3.enum(["hour", "day", "month", "runners"]);
+var LIMIT_ARG = {
+  description: "hour, the rate cap on what made workers running at once cost an hour; day; or month"
+};
+var splatesBudget = cli2("budget").description("what the workers a `workerProvider` makes may cost, in dollars: a rate cap per hour on those running at once ($1/h by default), and limits on a day ($15) and a month ($200). Past the rate cap, or once a day's or month's limit is spent, no worker is made and the queue says why; reaching the day's or month's stops made workers, whose agents stop at their checkpoint. Each warns at 80%, 90% and 100% by Web Push and on the page's header. No more than 16 runners are up at once by default, those the server made and `splates run` made together, counted from the cloud's own list; past that the queue waits for one to free. Spend is an estimate at each type's list price. Agents' own API spend is not counted here");
+splatesBudget.command("show").description("show each limit: what made workers spent in its window, of how much, and what is left").option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => showBudget({
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesBudget.command("set").description("set a limit, in dollars (dollars an hour for hour, a count for runners), then show the budget").arg("limit", SET_LIMIT, {
+  description: `${LIMIT_ARG.description}; or runners, the most runners up at once in the account, whoever made them (16 by default)`
+}).arg("dollars", z3.string(), {
+  description: "like 5 or 0.25 (a whole number for runners, like 16), or `default` to give it back to its default"
+}).option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => setBudget({
+  limit: opts.limit,
+  dollars: opts.dollars,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesBudget.command("raise").description("add dollars to a limit for a while, on top of what it is set to, then show the budget").arg("limit", LIMIT, LIMIT_ARG).arg("dollars", z3.string(), { description: "how much to add, like 2 or 0.1" }).option("for", z3.string(), {
+  default: "1d",
+  description: "how long it lasts, in hours, days or weeks, like 24h, 1d or 2w"
+}).option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => raiseBudget({
+  limit: opts.limit,
+  dollars: opts.dollars,
+  for: opts.for,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesBudget.command("end").description("end a raise now, by the number `show` gives it").arg("id", z3.coerce.number().int(), { description: "the raise's number" }).option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => endBudgetRaise({
+  id: opts.id,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+
+// creds.ts
+import { DEFAULT_TIMEOUT, PROVIDERS } from "@stringsync/splates-server/creds";
+import { fail as fail3 } from "@stringsync/splates-server/exit";
+import { repository as repository2 } from "@stringsync/splates-server/records";
+import { untilAfter } from "@stringsync/splates-server/tasks";
+import { cli as cli3 } from "webappwiz/cmd";
+import { color } from "webappwiz/log";
+import { Duration } from "webappwiz/time";
+import { z as z4 } from "zod";
+var splatesCreds = cli3("creds").description("creds an agent needs a person for, such as an API token: request one saying what it is for, with instructions for getting it, which the Creds page of `splates server` shows for the person to paste, then wait for it; the value goes into the system's store (the macOS Keychain, Windows Credential Manager, a Linux secret service), never to the agent, and code reads it through webappwiz/creds");
+splatesCreds.command("request").use(repository2({ needs: "own" })).description("ask a person for a cred, saying why it is needed and what it will be used for, with markdown instructions for getting it; returns at once, and does nothing when the store already keeps it unless --replace; run from a worktree, it records the task asking").arg("name", z4.string(), {
+  description: "what it is kept as, an environment variable's name"
+}).option("purpose", z4.string(), {
+  default: "",
+  description: "why it is needed and what it will be used for, in a sentence the person reads before getting it"
+}).option("instructions", z4.string(), {
+  default: "",
+  description: "how to get it, in markdown: where to go, what to pick, what to paste"
+}).option("device", z4.boolean(), {
+  default: false,
+  description: "keep it for every project on this device, as for a person's own account, rather than this project alone"
+}).option("provider", z4.optional(z4.enum(PROVIDERS)), {
+  description: "who keeps it: `system`, the machine's own store"
+}).option("replace", z4.boolean(), {
+  default: false,
+  description: "ask again although one is kept, since the kept one does not work; --purpose and --instructions left off are those of the last request"
+}).action(async (opts, ctx) => {
+  const scope = opts.device ? "device" : "project";
+  const provider = opts.provider ?? "system";
+  const request = await ctx.journal.record("creds request", null, async () => ctx.creds.request(opts.name, {
+    scope,
+    provider,
+    purpose: opts.purpose,
+    instructions: opts.instructions,
+    task: await here(ctx),
+    replace: opts.replace
+  }), (asked) => ({ name: opts.name, asked: asked !== null }));
+  if (request === null) {
+    ctx.log.info(`${color.green("kept")} ${opts.name} in ${ctx.creds.label(scope, provider)}: nothing to ask`);
+    return;
+  }
+  ctx.log.info(`${color.yellow("requested")} ${opts.name}  ${color.dim(request.purpose)}`);
+  ctx.log.error(`It shows on the Creds page of \`splates server\`. \`splates creds wait ${opts.name}\` until it is saved.`);
+});
+splatesCreds.command("wait").use(repository2({ needs: "own" })).description("block until a person saves the cred requested, or dismisses the request (`dismissed`); gives up with `timeout` rather than waiting forever").arg("name", z4.string(), { description: "the cred requested" }).option("timeout-secs", z4.coerce.number(), {
+  default: DEFAULT_TIMEOUT.secs,
+  description: "how long to wait before giving up"
+}).action(async (opts, ctx) => {
+  const timeout = Duration.secs(opts["timeout-secs"]);
+  await ctx.journal.waiting("creds wait", null, { name: opts.name, until: untilAfter(timeout) }, async () => {
+    const ended = await ctx.creds.wait(opts.name, { timeout });
+    if (ended === "dismissed") {
+      fail3("dismissed", `${opts.name} was dismissed: carry on without it, or ask the person why`, { name: opts.name });
+    }
+  });
+  ctx.log.info(`${color.green("saved")} ${opts.name}`);
+});
+splatesCreds.command("list").use(repository2({ needs: "read" })).description("the creds requested and still open, with what each is for, and every cred the project's store and the device's keep, by name; never a value").option("json", z4.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const open = (await ctx.creds.requests()).filter((each) => each.status === "open");
+  const kept = await ctx.creds.kept();
+  if (opts.json) {
+    ctx.log.info(JSON.stringify({ requested: open, kept }, null, 2));
+    return;
+  }
+  for (const each of open) {
+    ctx.log.info(`${color.yellow("requested")} ${each.name}  ${color.dim(each.scope)}${each.task === null ? "" : color.dim(`  by ${each.task}`)}`);
+    if (each.purpose !== "") {
+      ctx.log.info(`          ${each.purpose}`);
+    }
+  }
+  for (const each of kept) {
+    ctx.log.info(`${color.green("kept")}      ${each.name}  ${color.dim(`${each.provider} ${each.scope}`)}${each.savedBy === null ? "" : color.dim(`  saved by ${each.savedBy}`)}`);
+  }
+  if (open.length === 0 && kept.length === 0) {
+    ctx.log.info(color.dim("no creds requested or kept"));
+  }
+});
+
+// hook.ts
+import { commaList as commaList3 } from "@stringsync/splates-server/comma-list";
+import { fail as fail4 } from "@stringsync/splates-server/exit";
+import {
+  HookStore,
+  hookAdd,
+  hookEdit,
+  hookGardener,
+  hookGroomer,
+  hookList,
+  hookPause,
+  hookRemove,
+  lanesNamed,
+  stagesNamed,
+  TASK_EVENTS
+} from "@stringsync/splates-server/hooks";
+import { repository as repository3 } from "@stringsync/splates-server/records";
+import { cli as cli4 } from "webappwiz/cmd";
+import { z as z5 } from "zod";
+var splatesHook = cli4("hook").description(`automations: what runs on a task event (${TASK_EVENTS.join(", ")}), as \`splates server\` sees the journal take it, or on a schedule it keeps: an agent told of it; or a shell command. Kept for you in this project's .git/splates, never checked in, since an agent hook spends your tokens; splates.config.ts's \`on\` holds the shell commands a project checks in. None set, nothing runs. The page's Automations tab lists them with when each last ran and for what task`);
+splatesHook.command("list").use(repository3({ needs: "read" })).description("every automation set here, by number, with its trigger").option("json", z5.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => hookList({ hooks: storeOf(ctx), log: ctx.log }, { json: opts.json }));
+splatesHook.command("add").use(repository3({ needs: "tasks" })).description("run something on a task event, or on a schedule with `--every` or `--cron` in place of the event: `--agent <a> --prompt <words>` starts that agent in the main tree, told the event as `[SPLATES EVENT <event> #N]`, or a schedule as `[SPLATES SCHEDULE <number>]`, then your words; `--run <command>` runs it via `sh -c` in the main tree, with $SPLATES_EVENT (`schedule` for one), $SPLATES_TASKS and $SPLATES_TASK set. A schedule that came due while `splates server` was down runs once as it starts").arg("event", z5.string().optional(), {
+  description: "the task event, as task.created; none for a schedule"
+}).option("stage", z5.string(), {
+  default: "",
+  description: "only for tasks in these stages, comma separated: backlog, ready, queued, running"
+}).option("lane", z5.string(), {
+  default: "",
+  description: "only for tasks in these lanes, by number, comma separated"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 30m, 2h or 1d"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1-5"`
+}).option("agent", z5.string(), {
+  default: "",
+  description: "the agent to run, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("prompt", z5.string(), {
+  default: "",
+  description: "what the agent is told after the event"
+}).option("run", z5.string(), {
+  default: "",
+  description: "a shell command to run"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  let hook;
+  if (opts.run !== "") {
+    if (pick != null || opts.prompt !== "") {
+      fail4("usage", "--run goes alone: a shell command runs no agent", {});
+    }
+    hook = { kind: "run", command: opts.run };
+  } else if (pick == null) {
+    fail4("usage", "say what runs: --agent with --prompt, or --run", {});
+  } else if (opts.prompt === "") {
+    fail4("usage", "an agent hook needs --prompt: what to tell it", {});
+  } else {
+    hook = { kind: "agent", prompt: opts.prompt, ...pick };
+  }
+  await hookAdd({ hooks: storeOf(ctx), log: ctx.log }, triggerOf(opts), hook);
+});
+splatesHook.command("edit").use(repository3({ needs: "tasks" })).description("change one of your automations, by its number in `splates hook list`, keeping its number, its pause and its last runs. Each flag changes only what it names, as `splates hook add` takes it: `--event`, `--every` or `--cron` sets what sets it off anew, `--stage` or `--lane` alone narrows its event again (`any` for no narrowing), `--prompt` or `--agent` changes what an agent is told or which agent, and `--run` makes it a shell command. The groomer changes through `splates hook groomer`").arg("id", z5.string(), { description: "its number in `splates hook list`" }).option("event", z5.string(), {
+  default: "",
+  description: "a task event to run on, as task.created, in place of what sets it off now"
+}).option("stage", z5.string(), {
+  default: "",
+  description: "only for tasks in these stages, comma separated, or `any`: backlog, ready, queued, running"
+}).option("lane", z5.string(), {
+  default: "",
+  description: "only for tasks in these lanes, by number, comma separated, or `any`"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 30m, 2h or 1d"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1-5"`
+}).option("agent", z5.string(), {
+  default: "",
+  description: "the agent to run, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model, with --agent (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level, with --agent (default: the agent's own)"
+}).option("prompt", z5.string(), {
+  default: "",
+  description: "what the agent is told after the event"
+}).option("run", z5.string(), {
+  default: "",
+  description: "a shell command to run in place of an agent"
+}).action(async (opts, ctx) => {
+  const { id, agent, model, effort, ...change } = opts;
+  const pick = await assigneeIn(ctx, agent, model, effort);
+  if (pick === null) {
+    fail4("usage", "an agent automation needs an agent: name one, or --run", {});
+  }
+  await hookEdit({ hooks: storeOf(ctx), log: ctx.log }, id, {
+    ...change,
+    ...pick === undefined ? {} : { pick }
+  });
+});
+splatesHook.command("remove").use(repository3({ needs: "tasks" })).description("take away an automation, by its number in `splates hook list`, or every one on an event").arg("id", z5.string(), {
+  description: "its number, or a task event, as task.created"
+}).action((opts, ctx) => hookRemove({ hooks: storeOf(ctx), log: ctx.log }, opts.id));
+splatesHook.command("pause").use(repository3({ needs: "tasks" })).description("stop an automation running, keeping it to resume").arg("id", z5.string(), { description: "its number in `splates hook list`" }).action((opts, ctx) => hookPause({ hooks: storeOf(ctx), log: ctx.log }, opts.id, true));
+splatesHook.command("resume").use(repository3({ needs: "tasks" })).description("let a paused automation run again").arg("id", z5.string(), { description: "its number in `splates hook list`" }).action((opts, ctx) => hookPause({ hooks: storeOf(ctx), log: ctx.log }, opts.id, false));
+splatesHook.command("groomer").use(repository3({ needs: "tasks" })).description("turn on the project's groomer, built-in automation `groomer`, or set the agent it runs as, as the Automations page does: on each task deferred to the backlog, and the backlog as `splates server` starts, a conversation of its own per run, archived as the run ends, organizes each task in order and marks it ready, never doing it. `--off` turns it off, retiring its conversations").option("agent", z5.string(), {
+  default: "",
+  description: "the agent it runs as, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("off", z5.boolean(), {
+  default: false,
+  description: "turn it off"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  if (opts.off === (pick != null)) {
+    fail4("usage", "say how it runs with --agent, or turn it off with --off", {});
+  }
+  await hookGroomer({ hooks: storeOf(ctx), log: ctx.log }, pick ?? null);
+});
+splatesHook.command("gardener").use(repository3({ needs: "tasks" })).description("turn on the notes gardener, built-in automation `notes-gardener`, or set the agent it runs as and its schedule, as the Automations page does: on each run, an agent reads each project note no open task names by its path, checks it against the code and the other notes, and drafts the fixes in one task, `notes-garden`: rewriting what went stale, merging notes that say one thing, splitting one that says several, settling a contradiction the code settles and sharpening descriptions, then asks you to review the change rather than merge it, asking about any contradiction the code does not settle. No run starts while `notes-garden` is open. Off by default, since each run reads code for every note on your tokens; it runs every 7d until you set `--every` or `--cron`. `--off` turns it off").option("agent", z5.string(), {
+  default: "",
+  description: "the agent it runs as, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 1d (default: as it was, or 7d)"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1"`
+}).option("off", z5.boolean(), {
+  default: false,
+  description: "turn it off"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  if (opts.off === (pick != null)) {
+    fail4("usage", "say how it runs with --agent, or turn it off with --off", {});
+  }
+  await hookGardener({ hooks: storeOf(ctx), log: ctx.log }, pick ?? null, {
+    every: opts.every,
+    cron: opts.cron
+  });
+});
+function triggerOf(opts) {
+  const given = [opts.event, opts.every, opts.cron].filter((each) => each !== undefined && each !== "");
+  if (given.length !== 1) {
+    fail4("usage", "say what sets it off: a task event, --every or --cron, one of them", {});
+  }
+  if (opts.event === undefined || opts.event === "") {
+    if (opts.stage !== "" || opts.lane !== "") {
+      fail4("usage", "--stage and --lane narrow a task event, not a schedule", {});
+    }
+    return opts.every !== "" ? { every: opts.every } : { cron: opts.cron };
+  }
+  const filter = {};
+  if (opts.stage !== "") {
+    filter.stages = stagesNamed(commaList3(opts.stage));
+  }
+  if (opts.lane !== "") {
+    filter.lanes = lanesNamed(opts.lane);
+  }
+  const event = opts.event;
+  return Object.keys(filter).length === 0 ? { event } : { event, filter };
+}
+function storeOf(ctx) {
+  return new HookStore(ctx.storage);
+}
+
+// lane.ts
+import {
+  APPROVAL,
+  BACKLOG_LANE as BACKLOG_LANE2,
+  laneAdd,
+  laneList,
+  laneRemove,
+  laneShow,
+  laneUpdate,
+  laneUpdated,
+  recordLaneRemove
+} from "@stringsync/splates-server/board";
+import { refuseGroomer } from "@stringsync/splates-server/conversations";
+import { UNTRIAGED } from "@stringsync/splates-server/plans";
+import { refuseAgentQueue } from "@stringsync/splates-server/queue";
+import { repository as repository4 } from "@stringsync/splates-server/records";
+import { cli as cli5 } from "webappwiz/cmd";
+import { z as z6 } from "zod";
+var laneNumber = z6.union([
+  z6.literal("backlog").transform(() => BACKLOG_LANE2),
+  z6.coerce.number().int().nonnegative()
+]);
+var splatesLane = cli5("lane").description("lanes: named groups of tasks, for you to see related work together on the board; queue one whole with `splates lane queue`. Backlog (lane 0) is permanent and holds unmatched deferred work. Untriaged is groomed into lanes and cannot be queued whole");
+splatesLane.command("list").use(repository4({ needs: "read" })).description("every lane: its name, its queued tasks in order, the started tasks on it, its next task, and what blocks that in other lanes").option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneList(ctx, { json: opts.json }));
+splatesLane.command("show").use(repository4({ needs: "read" })).description("one lane step by step, and what its agent does next: start the next task, or wait for the one blocking it in another lane to land first; `untriaged` lists the tasks in no lane, to place in lanes").arg("lane", z6.union([z6.literal(UNTRIAGED).transform(() => null), laneNumber], {
+  error: "pass a lane's number, backlog, or untriaged"
+}), { description: "lane number, `backlog`, or `untriaged`" }).option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneShow(ctx, opts.lane, { json: opts.json }));
+splatesLane.command("add").use(repository4({ needs: "tasks" })).description("start an empty lane, after the others").arg("name", z6.string(), {
+  description: "what its tasks are for, like `Licensing`"
+}).action(async (opts, ctx) => {
+  await ctx.journal.record("lane add", null, () => laneAdd(ctx, opts.name), (lane) => ({ lane: lane.id, name: lane.name }));
+});
+splatesLane.command("update").use(repository4({ needs: "tasks" })).description("rename a lane, or move it among the others").arg("lane", laneNumber, {
+  description: "lane number"
+}).option("name", z6.string().optional(), {
+  description: "what it is called from now on"
+}).option("position", position, {
+  description: "where to move it among the lanes, 1 the first column on the board; the others close up around it"
+}).action(async (opts, ctx) => {
+  const change = { name: opts.name, position: opts.position };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("queue").use(repository4({ needs: "tasks" })).description("queue a lane whole: each of its tasks is queued as soon as nothing blocks it, now and as tasks land, until the lane is empty; a task you take out with `splates queue remove` stays out until you queue it again. Untriaged cannot be queued whole").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane queue");
+  await refuseGroomer(ctx.service, "lane queue");
+  const change = { queued: true };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("approve").use(repository4({ needs: "tasks" })).description("let a queued lane queue more tasks on its own: it stops when its budget is spent, which starts at its tasks then plus 5, and this adds 10 to what is left; refused from an agent").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane approve");
+  const change = { approve: APPROVAL };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("unqueue").use(repository4({ needs: "tasks" })).description("stop queueing a lane whole, taking out of the queue each of its tasks that has yet to start; those under way go on").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane unqueue");
+  const change = { queued: false };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("remove").use(repository4({ needs: "tasks" })).description("remove a lane and its tasks, kept to restore; a lane whose last task merges goes on its own; refused from an agent, which asks with a permission card").arg("lane", laneNumber, {
+  description: "lane number"
+}).action((opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane remove");
+  return recordLaneRemove(ctx.journal, ctx.tasks, opts.lane, () => laneRemove(ctx, opts.lane));
+});
+
+// notes.ts
+import { loadConfig } from "@stringsync/splates-server/config";
+import { Notes } from "@stringsync/splates-server/notes";
+async function notes(ctx) {
+  const root = ctx.project === undefined ? (await ctx.git.run(ctx.ps.cwd(), "rev-parse", "--show-toplevel")).stdout.trim() : ctx.git.root;
+  const config = await loadConfig(root, { fs: ctx.fs, git: ctx.git });
+  const found = await new Notes(ctx.fs).list(root, config);
+  for (const note of found) {
+    ctx.log.info(note.description);
+  }
+}
+
+// projects.ts
+import {
+  grantReach,
+  listReaches,
+  REACHES
+} from "@stringsync/splates-server/projects";
+import { repository as repository5 } from "@stringsync/splates-server/records";
+import { cli as cli6 } from "webappwiz/cmd";
+import { z as z7 } from "zod";
+var splatesProjects = cli6("projects").description("the other splates projects on this machine, and what agents of each may do in the others through splates: `read` their tasks and lanes; add tasks to their untriaged lane with `queue`, as every project may until granted otherwise; or run their queue, lanes and hooks with `tasks`. Any repo command runs on another project as `splates --project <slug> <command>`, refused where it needs more than that project granted").fallback("list");
+splatesProjects.command("list").use(repository5({ needs: "read" })).description("print each other project: its slug, its root, what it may do here, and what this one may do there").option("json", z7.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listReaches(ctx, { json: opts.json }));
+splatesProjects.command("grant").use(repository5({ needs: "own" })).description("let agents of another project do as much as `read`, `queue` or `tasks` here, each including those before it; the user's call, so an agent runs it only when the user asks it to").arg("project", z7.string(), { description: "the other project's slug" }).arg("reach", z7.enum(REACHES), {
+  description: "read, queue or tasks"
+}).action((opts, ctx) => grantReach(ctx, opts.project, opts.reach));
+
+// queue.ts
+import { tasksNamed } from "@stringsync/splates-server/board";
+import { refuseGroomer as refuseGroomer2 } from "@stringsync/splates-server/conversations";
+import {
+  queueAdd,
+  queueList,
+  queueMove,
+  queueRemove,
+  refuseAgentQueue as refuseAgentQueue2
+} from "@stringsync/splates-server/queue";
+import { repository as repository6 } from "@stringsync/splates-server/records";
+import { cli as cli7 } from "webappwiz/cmd";
+import { z as z8 } from "zod";
+var splatesQueue = cli7("queue").description("the queue: the tasks a worker of `splates server` starts as soon as it has a slot free, each after every task it is blocked by, otherwise in the order you set. Only you queue a task, from the backlog or groomed, and an agent asks you to with a queue card; one that names no model runs on the roster's first agent");
+splatesQueue.command("list").use(repository6({ needs: "read" })).description("the queue in the order workers start it, with each task's model and what it waits on: the open tasks it is blocked by, or those removed without merging").option("json", z8.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => queueList(ctx, { json: opts.json }));
+splatesQueue.command("add").use(repository6({ needs: "tasks" })).description("queue tasks for a worker to start once nothing they are blocked by is open; refused for one already under way").rest("ids", z8.coerce.number().int().positive(), {
+  description: "task numbers"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue add");
+  await refuseGroomer2(ctx.service, "queue add");
+  await ctx.journal.record("queue add", await here(ctx), () => queueAdd(ctx, opts.ids), (queued) => ({ tasks: tasksNamed(queued) }));
+});
+splatesQueue.command("remove").use(repository6({ needs: "tasks" })).description("take tasks out of the queue, back to ready when they name a model, else the backlog; the tasks stay").rest("ids", z8.coerce.number().int().positive(), {
+  description: "task numbers"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue remove");
+  await ctx.journal.record("queue remove", await here(ctx), () => queueRemove(ctx, opts.ids), (removed) => ({ tasks: tasksNamed(removed) }));
+});
+splatesQueue.command("move").use(repository6({ needs: "tasks" })).description("move a queued task to another place in the queue, from 1 for the next to start; what it is blocked by still goes first. Then lists the queue").arg("id", z8.coerce.number().int().positive(), { description: "task number" }).arg("position", z8.coerce.number().int().positive(), {
+  description: "where in the queue to put it, from 1"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue move");
+  return queueMove(ctx, opts.id, opts.position);
+});
+
+// replica.ts
+import { dirname as dirname2 } from "node:path";
+import { loadConfig as loadConfig2 } from "@stringsync/splates-server/config";
+import { SYSTEM_STORES as SYSTEM_STORES2 } from "@stringsync/splates-server/creds";
+import { fail as fail5 } from "@stringsync/splates-server/exit";
+import { Projects } from "@stringsync/splates-server/projects";
+import {
+  FORMAT,
+  ProjectHome,
+  repository as repository7
+} from "@stringsync/splates-server/records";
+import {
+  openReplica,
+  REPLICA_ACCESS_KEY,
+  REPLICA_SECRET_KEY,
+  Replicator,
+  restoreFromReplica,
+  statusLines
+} from "@stringsync/splates-server/replica";
+import { cli as cli8 } from "webappwiz/cmd";
+import { Credentials } from "webappwiz/creds";
+import { z as z9 } from "zod";
+var splatesReplica = cli8("replica").description("the copy of this project's records `splates server` keeps a few seconds behind every change, in the bucket or folder `replica` names in splates.config.ts");
+splatesReplica.command("status").use(repository7({ needs: "read" })).description("print where the replica is, when it last held every change, how many changes wait to reach it and since when, and why it is failing if it is; as of the server's last batch, so it reads the same with the server stopped").option("json", z9.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const status = await Replicator.recorded(ctx.storage);
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(status));
+    return;
+  }
+  ctx.log.info(statusLines(status, ctx.config.replica !== null, Date.now()).join(`
+`));
+});
+splatesReplica.command("restore").description("with `splates server` stopped, rebuild this project's records from the replica `replica` names in splates.config.ts, adopting its origin so the server started on them replicates on into it: how a server moves to another machine or comes back after its box is lost. Stops when the project already has records here, unless --force leaves them aside as state.db.moved. The roster and Auto pick rules are not in the replica; set them up again. A bucket's REPLICA_ACCESS_KEY and REPLICA_SECRET_KEY must be filled on this machine first").option("force", z9.boolean(), {
+  default: false,
+  description: "restore over the records here, leaving them aside"
+}).action(async (opts, ctx) => {
+  const root = await mainTree(ctx);
+  const projects = Projects.ofMachine(ctx);
+  const home = new ProjectHome(root, { ...ctx, projects });
+  const stores = ctx.secrets ?? SYSTEM_STORES2;
+  const credentials = new Credentials([
+    await stores.project(root),
+    stores.device
+  ]);
+  const config = await loadConfig2(root, { fs: ctx.fs });
+  if (config.replica === null) {
+    fail5("usage", "no replica: name one as `replica` in splates.config.ts first");
+  }
+  const replica = openReplica(config.replica, {
+    root,
+    fs: ctx.fs,
+    creds: {
+      credentials,
+      request: async () => {
+        throw new Error(`fill ${REPLICA_ACCESS_KEY} and ${REPLICA_SECRET_KEY} with \`wiz creds\` first`);
+      }
+    }
+  });
+  try {
+    const done = await restoreFromReplica(replica, {
+      target: home,
+      fs: ctx.fs,
+      format: FORMAT,
+      force: opts.force
+    });
+    ctx.log.info([
+      `restored ${done.values} record(s) and ${done.logs} log(s) from ${replica.name}, last caught up on ${done.host}`,
+      ...done.replaced === null ? [] : [`the records here went aside as ${done.replaced}`],
+      `project: ${root} (register its checkout with \`splates init\` if it is new on this machine)`,
+      "start `splates server` to serve it and replicate on"
+    ].join(`
+`));
+  } catch (error) {
+    fail5("usage", error instanceof Error ? error.message : String(error));
+  }
+});
+splatesReplica.command("retire").use(repository7({ needs: "own" })).description("after the server moved elsewhere (stop it and check `splates replica status` says caught up first), leave this project's records aside as state.db.moved, so a splates run here finds no stale records and says where the server went").arg("to", z9.string(), {
+  description: "where the server went, as `droplet.example.com`"
+}).action(async (opts, ctx) => {
+  const home = new ProjectHome(ctx.git.root, ctx);
+  ctx.dispose();
+  const aside = await home.moveAside(opts.to);
+  ctx.log.info(`records left aside as ${aside}; the server is at ${opts.to}`);
+});
+async function mainTree(ctx) {
+  const { exitCode, stdout } = await ctx.ps.spawnCapture([
+    "git",
+    "-C",
+    ctx.ps.cwd(),
+    "rev-parse",
+    "--path-format=absolute",
+    "--git-common-dir"
+  ]);
+  if (exitCode !== 0) {
+    fail5("usage", `not a git repository: ${ctx.ps.cwd()}`);
+  }
+  return dirname2(stdout.trim());
+}
+
+// runners.ts
+import { join as join2 } from "node:path";
+import { loadConfig as loadConfig3 } from "@stringsync/splates-server/config";
+import { fail as fail6 } from "@stringsync/splates-server/exit";
+import { splatesHome as splatesHome2 } from "@stringsync/splates-server/models";
+import {
+  REAPER_FILE,
+  withRunners
+} from "@stringsync/splates-server/server";
+import {
+  DIRECT_IDLE,
+  NoRunner,
+  parseTimeout,
+  runnerServe,
+  sizeLabel
+} from "@stringsync/splates-server/workers";
+import { cli as cli9 } from "webappwiz/cmd";
+import { sleep } from "webappwiz/time";
+import { z as z10 } from "zod";
+var splatesRunners = cli9("runners").description(`the runners \`splates run\` makes for itself in the project's cloud (\`cloud\` in splates.config.ts) when \`splates server\` has none for it: each takes as many commands at once as fit in its CPUs and memory, another is made when none has room, within \`splates budget\`, and each is deleted once idle ${DIRECT_IDLE.mins} minutes`);
+splatesRunners.command("list").description("list them: name, size and price, the address Fly's proxy reaches them at, and busy, idle, or the machine's state").option("json", z10.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const runners = await opened(ctx, (each) => each.list());
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(runners));
+    return;
+  }
+  ctx.log.info(runners.length === 0 ? "no runner is up" : runners.map(runnerLine).join(`
+`));
+});
+splatesRunners.command("reap").description(`delete each runner idle ${DIRECT_IDLE.mins} minutes or more, every idle one once the budget's day or month is spent, and any that never booted; with --watch, again every so often for as long as any is up, which \`splates run\` leaves running behind it, one on this machine at a time, so none is left running unused`).option("watch", z10.string(), {
+  default: "",
+  description: "how long to wait before each look, as 10m or 90s, looking again for as long as any runner is up"
+}).option("idle", z10.string(), {
+  default: "",
+  description: `how long a runner must have stood idle, as 10m or 0s; ${DIRECT_IDLE.mins}m by default`
+}).action(async (opts, ctx) => {
+  const idle = opts.idle === "" ? DIRECT_IDLE : lengthOf(opts.idle);
+  if (opts.watch === "") {
+    const reaped = await opened(ctx, (each) => each.reap(idle));
+    ctx.log.info(reaped.length === 0 ? "nothing to reap" : reaped.map((line) => `deleted ${line}`).join(`
+`));
+    return;
+  }
+  if (!await watching(ctx)) {
+    return;
+  }
+  const every = lengthOf(opts.watch);
+  for (;; ) {
+    await sleep(every);
+    const left = await opened(ctx, async (each) => {
+      await each.reap(idle);
+      return (await each.list()).length;
+    });
+    if (left === 0) {
+      return;
+    }
+  }
+});
+async function watching(ctx) {
+  const file = reaperFile(ctx);
+  const held = Number((await ctx.fs.read(file).catch(() => "")).trim());
+  if (Number.isInteger(held) && held > 0 && held !== process.pid && ctx.ps.alive(held)) {
+    return false;
+  }
+  await ctx.fs.write(file, String(process.pid));
+  return true;
+}
+async function opened(ctx, use) {
+  const { stdout, exitCode } = await ctx.ps.spawnCapture([
+    "git",
+    "rev-parse",
+    "--show-toplevel"
+  ]);
+  if (exitCode !== 0) {
+    fail6("usage", "run it in a splates project", {});
+  }
+  const { cloud } = await loadConfig3(stdout.trim(), { fs: ctx.fs });
+  if (cloud === null) {
+    fail6("no_runner", "this project names no `cloud` in splates.config.ts, so `splates run` makes no runners", {});
+  }
+  try {
+    return await withRunners(ctx, cloud, use);
+  } catch (error) {
+    if (error instanceof NoRunner) {
+      fail6("no_runner", error.message, {});
+    }
+    throw error;
+  }
+}
+function lengthOf(text) {
+  return parseTimeout(text) ?? fail6("usage", `${text} is no length of time: name one as 10m or 90s`, {});
+}
+function runnerLine(runner) {
+  const size = runner.size === null ? runner.type : sizeLabel(runner.size, ...runner.dollarsPerHour === null ? [] : [runner.dollarsPerHour]);
+  return `${runner.id}  ${size}  ${runner.address ?? "no address yet"}  ${runner.state}`;
+}
+function reaperFile(ctx) {
+  return join2(splatesHome2(ctx.ps), REAPER_FILE);
+}
+splatesRunners.command("serve").description("serve only job channels at /api/jobs over authenticated WebSockets; for the runner image, with SPLATES_RUNNER_SECRET from its hosting environment").option("port", z10.coerce.number().int().min(0).max(65535), {
+  default: 8080,
+  description: "HTTP port behind the hosting proxy"
+}).action(({ port }, { ps }) => runnerServe({ port, ps }));
+
+// server.ts
+import {
+  DEFAULT_PORT,
+  serveDev
+} from "@stringsync/splates-server/server";
+import { cli as cli10 } from "webappwiz/cmd";
+import { z as z11 } from "zod";
+var splatesServer = cli10("server").description("the splates server: run it on this machine").fallback("run");
+splatesServer.command("run").description("serve every splates project on this machine as a web page, from wherever it is run: the page picks the project it shows, adds one by its path, running `splates init` there, and shows its queued and started tasks, where queued tasks can be added, updated, reordered or removed; it brings each project's records forward as it opens it. A server that crashes starts again after 2s, then 4s, 8s and 16s, and is left down after five crashes in a row that each came within a minute of its start").option("port", z11.coerce.number(), {
+  default: DEFAULT_PORT,
+  description: "port to listen on, or the next open one above it"
+}).option("allow-hosts", z11.string(), {
+  default: "",
+  description: "comma-separated host names the page may also be reached by, like a tunnel's; put Cloudflare Access in front of them with --access-team and --access-aud"
+}).option("access-team", z11.string(), {
+  default: "",
+  description: "the Cloudflare Access team in front of --allow-hosts, as in <team>.cloudflareaccess.com; with --access-aud, those hosts answer only to a verified Access token, and may then use conversations and terminals"
+}).option("access-aud", z11.string(), {
+  default: "",
+  description: "the AUD tag of that Access application"
+}).option("tunnel", z11.string(), {
+  default: "",
+  description: "the public host name of a tunnel to run, with cloudflared or the tunnel provider named by splates.config.ts in the repository it is run in, if any, which is allowed as a host too; refused without --access-team and --access-aud, so a tunnel never exposes the page unauthenticated. With none of the tunnel and Access flags, the tunnel `splates tunnel setup` saved runs, if any"
+}).option("tunnel-name", z11.string(), {
+  default: "",
+  description: "the named tunnel cloudflared runs for --tunnel, by default the one its own config names; not with a tunnel provider of splates.config.ts"
+}).option("ports-host", z11.string(), {
+  default: "",
+  description: "the wildcard base host to serve task ports under, saved for this machine so a bare `splates server` serves it too: each port a task's processes listen on opens at https://<task>-<port>.<base>, to whoever Cloudflare Access lets in, and is refused without Access; routing *.<base> here, its DNS and TLS, are yours. `none` forgets it, leaving each task port forwarded to a port on this machine's loopback alone"
+}).option("keepalive", z11.boolean(), {
+  default: false,
+  description: "keep a machine left to serve awake while the server runs: on macOS with `caffeinate`, on power or idle, though closing a laptop's lid still sleeps it; on Linux with a systemd-inhibit lock on sleep and idle, which the server serves on without, saying so, where systemd is missing or refuses it. Refused on other platforms"
+}).option("slot", z11.boolean(), {
+  default: false,
+  description: "serve this checkout's splates at https://<word>.<zone>, a slot of its own on the zone `splates tunnel setup` uses, behind the same Access policy, so several run side by side and a phone opens each by name: a task's worktree keeps its word, as fox, until the task merges or is removed, which stops its server; run again, it stops the tree's last server first. Refused in a splates repository's main tree, which every agent shares. A slot keeps its own projects in ~/.splates/slots/<word>, apart from yours, starting with a throwaway project there; not with the tunnel and Access flags"
+}).action((opts, ctx) => serveDev(ctx, opts));
+
+// setup.ts
+import { dirname as dirname3 } from "node:path";
+import { SYSTEM_STORES as SYSTEM_STORES3 } from "@stringsync/splates-server/creds";
+import { fail as fail7 } from "@stringsync/splates-server/exit";
+import { splatesHome as splatesHome3 } from "@stringsync/splates-server/models";
+import { Projects as Projects2 } from "@stringsync/splates-server/projects";
+import {
+  openRepository
+} from "@stringsync/splates-server/records";
+import { Replicator as Replicator2 } from "@stringsync/splates-server/replica";
+import {
+  SETUP_AREAS,
+  Setup,
+  setupProjectAt
+} from "@stringsync/splates-server/setup";
+import {
+  fetchWorkerBudget,
+  fetchWorkers,
+  putWorkerLimit
+} from "@stringsync/splates-server/workers";
+import { color as color2 } from "webappwiz/log";
+async function setup(deps, opts) {
+  if (opts.step === "" && (opts.skip || opts.unskip || opts.undo)) {
+    fail7("usage", "--skip and --unskip name a step, --undo an area", {});
+  }
+  if (opts.undo && (opts.skip || opts.unskip)) {
+    fail7("usage", "--undo names an area, not a step to skip", {
+      area: opts.step
+    });
+  }
+  if (opts.skip && opts.unskip) {
+    fail7("usage", "--skip or --unskip, not both", { step: opts.step });
+  }
+  const machine = await setupOf(deps);
+  const { log } = deps;
+  if (opts.undo) {
+    const plan = await machine.undoPlan(opts.step);
+    if (opts.json) {
+      log.info(JSON.stringify(plan, null, 2));
+      return;
+    }
+    printUndo(log, plan);
+    return;
+  }
+  if (opts.step !== "") {
+    machine.step(opts.step);
+    if (opts.skip) {
+      await machine.skip(opts.step);
+    } else if (opts.unskip) {
+      await machine.unskip(opts.step);
+    }
+  }
+  const progress = await machine.read();
+  if (opts.step === "") {
+    if (opts.json) {
+      log.info(JSON.stringify(progress, null, 2));
+      return;
+    }
+    printProgress(log, progress);
+    return;
+  }
+  const step = progress.areas.flatMap((area) => area.steps).find((each) => each.id === opts.step);
+  if (opts.json) {
+    log.info(JSON.stringify(step, null, 2));
+    return;
+  }
+  printStep(log, step);
+}
+async function setupOf(deps) {
+  const { fs, ps, secrets = SYSTEM_STORES3, fetch } = deps;
+  const root = deps.project === undefined ? await repoRoot(ps) : (await Projects2.ofMachine(deps).named(deps.project)).root;
+  return new Setup({
+    fs,
+    ps,
+    home: splatesHome3(ps),
+    device: secrets.device,
+    fetch,
+    workers: deps.ps.env("SPLATES_DEV") ? () => fetchWorkers({ dev: "", log: deps.log, ps: deps.ps }) : undefined,
+    workerBudget: deps.ps.env("SPLATES_DEV") ? {
+      report: () => fetchWorkerBudget({ dev: "", log: deps.log, ps: deps.ps }),
+      set: (limit, dollars) => putWorkerLimit(limit, dollars, {
+        dev: "",
+        log: deps.log,
+        ps: deps.ps
+      })
+    } : undefined,
+    project: root === null ? undefined : setupProjectAt(root, { fs, ps }, {
+      replica: () => withRecords(deps, root, ({ storage }) => Replicator2.recorded(storage)),
+      kept: (name) => withRecords(deps, root, async ({ creds }) => await creds.credentials.get(name) !== undefined)
+    })
+  }, SETUP_AREAS);
+}
+async function withRecords(deps, root, read) {
+  const records = await openRepository(deps, { at: root });
+  try {
+    return await read(records);
+  } finally {
+    records.dispose();
+  }
+}
+async function repoRoot(ps) {
+  const { exitCode, stdout } = await ps.spawnCapture([
+    "git",
+    "-C",
+    ps.cwd(),
+    "rev-parse",
+    "--path-format=absolute",
+    "--git-common-dir"
+  ]);
+  return exitCode === 0 ? dirname3(stdout.trim()) : null;
+}
+var MARKS = {
+  done: color2.green("✓"),
+  skipped: color2.dim("-"),
+  ready: color2.yellow("○"),
+  waiting: color2.dim("○")
+};
+function printProgress(log, progress) {
+  for (const area of progress.areas) {
+    const counts = [
+      `${area.done}/${area.steps.length} done`,
+      area.skipped > 0 ? `${area.skipped} skipped` : ""
+    ].filter(Boolean);
+    log.info(`${color2.bold(area.title)}  ${color2.dim(counts.join(", "))}`);
+    for (const step of area.steps) {
+      const notes = [
+        step.optional ? "optional" : "",
+        step.status === "waiting" ? `after ${step.after.join(", ")}` : "",
+        step.problem ?? "",
+        step.warning === null ? "" : "to put right"
+      ].filter(Boolean);
+      log.info(`  ${MARKS[step.status]} ${step.id}  ${step.title}${notes.length > 0 ? color2.dim(`  ${notes.join("; ")}`) : ""}`);
+    }
+  }
+  const steps = progress.areas.flatMap((area) => area.steps);
+  const next = steps.find((step) => step.id === progress.next);
+  for (const step of steps.filter((each) => each.warning !== null)) {
+    log.info(`${color2.yellow("put right:")} ${step.title}  ${color2.dim(`splates setup ${step.id}`)}`);
+  }
+  log.info(next === undefined ? color2.green("nothing left to set up") : `next: ${next.title}  ${color2.dim(`splates setup ${next.id}`)}`);
+}
+function printStep(log, step) {
+  log.info(`${color2.bold(step.title)}  ${color2.dim(`${step.status}${step.optional ? ", optional" : ""}`)}`);
+  log.info(step.why);
+  if (step.detail !== null) {
+    log.info(step.detail);
+  }
+  if (step.warning !== null) {
+    log.info(`${color2.yellow("put right:")} ${step.warning}`);
+  }
+  log.info(`you:    ${step.user}`);
+  log.info(`agent:  ${step.agent}`);
+  if (step.after.length > 0) {
+    log.info(`after:  ${step.after.join(", ")}`);
+  }
+  if (step.problem !== null) {
+    log.info(`${color2.red("problem:")} ${step.problem}`);
+  }
+}
+function printUndo(log, plan) {
+  log.info(`${color2.bold(`Undo ${plan.title}`)}  ${color2.dim(plan.area)}`);
+  if (plan.refused !== null) {
+    log.info(`${color2.red("refused:")} ${plan.refused}`);
+    return;
+  }
+  for (const step of plan.steps) {
+    const started = step.done ? "" : `  ${color2.yellow("started")}`;
+    log.info(`  ${step.title}  ${color2.dim(step.id)}${started}`);
+    for (const line of step.removes) {
+      log.info(`    removes  ${line}`);
+    }
+    for (const line of step.leaves) {
+      log.info(`    leaves   ${line}`);
+    }
+  }
+  for (const cred of plan.creds) {
+    log.info(cred.keptFor === null ? `  forgets ${cred.name}` : `  keeps   ${cred.name}  ${color2.dim(`${cred.keptFor} still uses it`)}`);
+  }
+  if (plan.confirm !== null) {
+    log.info(`  the page asks for ${plan.confirm} to be typed`);
+  }
+  log.info(color2.dim("the Setup page's Undo does it, after the user confirms"));
+}
+
+// slots.ts
+import { Slots } from "@stringsync/splates-server/ports";
+import { cli as cli11 } from "webappwiz/cmd";
+import { z as z12 } from "zod";
+var splatesSlots = cli11("slots").description("the words `splates server --slot` hands out on this machine, each held by the tree that claimed it: a task's worktree holds its word until the task merges or is removed, which stops its server and gives the word back");
+splatesSlots.command("list").description("print each claimed word, the tree holding it, its server's pid while one runs, and whether it is orphaned: its tree gone, or a splates repository's main tree, which every agent shares").option("json", z12.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const held = await Slots.ofMachine(ctx).status();
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(held.map(({ slot, tree, pid, orphaned }) => ({
+      word: slot.word,
+      tree,
+      pid,
+      orphaned
+    }))));
+    return;
+  }
+  if (held.length === 0) {
+    ctx.log.info("no slot is claimed");
+    return;
+  }
+  ctx.log.info(held.map(heldLine).join(`
+`));
+});
+splatesSlots.command("prune").description("free every orphaned word, stopping its server, so another tree can claim it; the slots a task's worktree holds are that task's, and left alone. The way to free a slot: never kill another tree's server or edit ~/.splates/slots.json").action(async (_opts, ctx) => {
+  const freed = await Slots.ofMachine(ctx).prune();
+  if (freed.length === 0) {
+    ctx.log.info("nothing to prune: each claimed word is held by a task's worktree");
+    return;
+  }
+  ctx.log.info(freed.map(({ slot, tree, pid }) => `freed ${slot.word} ${slot.emoji} from ${tree}${pid === null ? "" : `, its server (pid ${pid}) stopped`}`).join(`
+`));
+});
+function heldLine({ slot, tree, pid, orphaned }) {
+  const server = pid === null ? "no server" : `server pid ${pid}`;
+  return `${slot.word} ${slot.emoji}  ${tree}  ${server}${orphaned ? "  orphaned: `splates slots prune` frees it" : ""}`;
+}
+
+// task.ts
+import {
+  addedFacts,
+  recordUpdate,
+  taskAdd,
+  taskList,
+  taskRemove,
+  taskShow,
+  tasksNamed as tasksNamed2,
+  taskUpdate
+} from "@stringsync/splates-server/board";
+import { commaList as commaList4 } from "@stringsync/splates-server/comma-list";
+import { refuseGroomer as refuseGroomer3 } from "@stringsync/splates-server/conversations";
+import { fail as fail8 } from "@stringsync/splates-server/exit";
+import { repository as repository8 } from "@stringsync/splates-server/records";
+import {
+  DEFAULT_TIMEOUT as DEFAULT_TIMEOUT2,
+  taskWait,
+  untilAfter as untilAfter2
+} from "@stringsync/splates-server/tasks";
+import { cli as cli12 } from "webappwiz/cmd";
+import { Duration as Duration2 } from "webappwiz/time";
+import { z as z13 } from "zod";
+var splatesTask = cli12("task").description("the numbered tasks: defer work for later instead of growing the task you are in, and `splates add <slug> --task <n>` starts one; `merge` recommends the next one when a task lands. The person puts tasks in `splates queue`, for workers to start");
+async function projectFrom(ctx) {
+  if (ctx.elsewhere === null) {
+    return;
+  }
+  return (await ctx.projects.list()).find((each) => each.root === ctx.git.root)?.slug;
+}
+function adding(name, description, ready) {
+  splatesTask.command(name).use(repository8({ needs: "queue" })).description(description).arg("subject", z13.string(), {
+    description: "what is left to do, in a line"
+  }).arg("text", z13.string(), {
+    default: "",
+    description: "whatever more there is to say about it, in markdown"
+  }).option("slug", z13.string(), {
+    description: "a short name for the task that takes it (lowercase-with-dashes), naming its branch, worktree and conversation: a few words for what it changes, not the subject cut short"
+  }).option("position", position, {
+    description: "where it goes in the list, 1 at the top, pushing those from there down (default: the bottom)"
+  }).repeated("file", z13.string(), {
+    description: "files to attach, comma separated or the flag repeated: copied under .git/splates/tasks/<n>/"
+  }).repeated("blocked-by", z13.string(), {
+    description: "numbers of the tasks blocking it, comma separated or the flag repeated: each has to merge before this one starts"
+  }).option("lane", z13.string(), {
+    default: "",
+    description: "the lane it goes in, at the bottom: a lane's number, `backlog` for the permanent catch-all, or `new` for one of its own (default: none, untriaged)"
+  }).option("agent", z13.string(), {
+    default: "",
+    description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first"
+  }).option("model", z13.string(), {
+    default: "",
+    description: "with --agent: the model, by its id or name on the roster"
+  }).option("effort", z13.string(), {
+    default: "",
+    description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
+  }).action(async (opts, ctx) => {
+    if (ctx.elsewhere !== null && opts.lane !== "") {
+      fail8("not_granted", "a task from another project goes in its untriaged lane, for whoever orchestrates it there to place: leave --lane off", { subject: opts.subject });
+    }
+    const from = await here(ctx);
+    const assignee = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+    const origin = ctx.elsewhere === null ? undefined : {
+      project: ctx.elsewhere,
+      task: ctx.project === undefined ? null : ctx.service.taskFor(await ctx.git.currentBranch(ctx.ps.cwd()))
+    };
+    const project = await projectFrom(ctx);
+    await ctx.journal.record("task add", from, () => taskAdd(ctx, opts.subject, from, {
+      slug: opts.slug,
+      text: opts.text,
+      position: opts.position,
+      files: commaList4(opts.file.join(",")),
+      blockedBy: taskIds(opts["blocked-by"].join(",")),
+      lane: laneIn(opts.lane) ?? null,
+      assignee,
+      origin,
+      ready,
+      project
+    }), addedFacts);
+  });
+}
+adding("add", "queue a task to do later and move on, groomed, so it goes in ready: you checked no task already asks it, and linked what blocks it; run from a worktree, it records the task it came up in", true);
+adding("defer", "queue a task as it is, rough, in the backlog for whoever grooms it: to check for one that already asks it, link what blocks it, and mark it ready; run from a worktree, it records the task it came up in", false);
+splatesTask.command("list").use(repository8({ needs: "read" })).description("every queued task, top of the list first, with the task it came from and the started one that took it up").option("json", z13.boolean(), { default: false, description: "emit JSON" }).option("open", z13.boolean(), {
+  default: false,
+  description: "only tasks no started one has taken up: the ones free to pick up"
+}).option("ready", z13.boolean(), {
+  default: false,
+  description: "only tasks free to start now: none has taken them, and nothing blocking them is still open"
+}).action(async (opts, ctx) => taskList(ctx, {
+  json: opts.json,
+  open: opts.open,
+  ready: opts.ready,
+  project: await projectFrom(ctx)
+}));
+splatesTask.command("show").use(repository8({ needs: "read" })).description("one task in full: where it stands, its files, and its detail").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).option("json", z13.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => taskShow(ctx, opts.id, {
+  json: opts.json,
+  project: await projectFrom(ctx),
+  others: (await ctx.projects.list()).filter((project) => project.root !== ctx.git.root).map((project) => project.slug)
+}));
+splatesTask.command("update").use(repository8({ needs: "tasks" })).description("say what a queued task is in other words, move it up or down the list, or attach and drop files; it keeps its number").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).arg("text", z13.string(), {
+  default: "",
+  description: "whatever more there is to say about it, in markdown; leave out to keep the detail"
+}).option("subject", z13.string(), {
+  default: "",
+  description: "what is left to do, in a line; leave out to keep it"
+}).option("slug", z13.string(), {
+  default: "",
+  description: "a new name for the task that takes it (lowercase-with-dashes); leave out to keep it"
+}).option("position", position, {
+  description: "where to move it in the list, 1 at the top; the others close up around it"
+}).repeated("file", z13.string(), {
+  description: "files to attach, comma separated or the flag repeated"
+}).repeated("remove-file", z13.string(), {
+  description: "attached files to drop, comma separated or the flag repeated, by path or stored name"
+}).repeated("blocked-by", z13.string(), {
+  description: "numbers of more tasks blocking it, comma separated or the flag repeated: each has to merge before this one starts; refused when that makes a loop"
+}).repeated("remove-blocked-by", z13.string(), {
+  description: "numbers of tasks no longer blocking it, comma separated or the flag repeated"
+}).option("lane", z13.string(), {
+  default: "",
+  description: "move it to a lane, at the bottom: a lane's number, `backlog` for the permanent catch-all, `new` for one of its own, or `none` for untriaged"
+}).option("agent", z13.string(), {
+  default: "",
+  description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first, or `none`"
+}).option("model", z13.string(), {
+  default: "",
+  description: "with --agent: the model, by its id or name on the roster"
+}).option("effort", z13.string(), {
+  default: "",
+  description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
+}).option("ready", z13.boolean(), {
+  default: false,
+  description: "mark it groomed, moving it from the backlog to ready: no task already asks it, and what blocks it is linked"
+}).option("manual", z13.boolean(), {
+  default: false,
+  description: "queue it by hand only: a queued lane passes over it, and it starts once you `splates queue add` it"
+}).option("auto", z13.boolean(), {
+  default: false,
+  description: "let a queued lane queue it again, undoing --manual"
+}).action(async (opts, ctx) => {
+  if (opts.manual && opts.auto) {
+    fail8("usage", "pass --manual or --auto, not both", { number: opts.id });
+  }
+  await refuseGroomer3(ctx.service, "task update", await ctx.tasks.find(opts.id));
+  const assignee = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  await recordUpdate(ctx.journal, ctx.tasks, opts.id, () => taskUpdate(ctx, opts.id, {
+    subject: opts.subject,
+    slug: opts.slug,
+    text: opts.text,
+    position: opts.position,
+    files: commaList4(opts.file.join(",")),
+    removeFiles: commaList4(opts["remove-file"].join(",")),
+    blockedBy: taskIds(opts["blocked-by"].join(",")),
+    removeBlockedBy: taskIds(opts["remove-blocked-by"].join(",")),
+    lane: laneIn(opts.lane),
+    assignee,
+    ready: opts.ready,
+    manual: opts.manual ? true : opts.auto ? false : undefined
+  }));
+});
+splatesTask.command("remove").use(repository8({ needs: "tasks" })).description("drop a queued task that was done some other way or no longer applies").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).action(async (opts, ctx) => {
+  await refuseGroomer3(ctx.service, "task remove", await ctx.tasks.find(opts.id));
+  await ctx.journal.record("task remove", null, () => taskRemove(ctx, opts.id), (removed) => ({ tasks: tasksNamed2([removed]) }));
+});
+splatesTask.command("wait").use(repository8({ needs: "read" })).description("block until a task leaves the queue, which it does when the task that took it merges: for a task blocked by one another lane is on; ends early when that task waits on a person to answer its questions, and gives up with `timeout`").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).option("timeout-secs", z13.coerce.number(), {
+  default: DEFAULT_TIMEOUT2.secs,
+  description: "how long to wait before giving up"
+}).action(async (opts, ctx) => {
+  const timeout = Duration2.secs(opts["timeout-secs"]);
+  const task = (await ctx.tasks.all()).find((each) => each.id === opts.id);
+  await ctx.journal.waiting("task wait", null, {
+    number: opts.id,
+    subject: task?.subject ?? null,
+    until: untilAfter2(timeout)
+  }, () => taskWait(ctx, opts.id, { timeout }));
+});
+
+// tunnel.ts
+import { repository as repository9 } from "@stringsync/splates-server/records";
+import { savedTunnelOf } from "@stringsync/splates-server/server";
+import {
+  API_TOKEN,
+  tunnelRemove,
+  tunnelSetup
+} from "@stringsync/splates-server/tunnel";
+import { cli as cli13 } from "webappwiz/cmd";
+import { z as z14 } from "zod";
+var splatesTunnel = cli13("tunnel").description("reach `splates server` from elsewhere: a Cloudflare tunnel with Cloudflare Access in front, set up once per machine");
+splatesTunnel.command("setup").use(repository9({ needs: "own" })).description(`make a Cloudflare tunnel to \`splates server\`, the DNS record routing <host> to it, and an Access application letting in only --email, through the API with the token kept as the cred ${API_TOKEN}, then save them for this machine, so a bare \`splates server\` comes up tunneled; run again, it changes only what is not so already. Without that token it requests it on the Creds page of \`splates server\`, with how to make it, and exits \`requested\`: \`splates creds wait ${API_TOKEN}\`, then run it again`).arg("host", z14.string(), {
+  description: "the public host name, in a zone of the account, as in splates.example.com"
+}).option("email", z14.string(), {
+  default: "",
+  description: "comma-separated email addresses Access lets in"
+}).option("name", z14.string(), {
+  default: "splates",
+  description: "what the tunnel, the Access application and its policy are called"
+}).option("team", z14.string(), {
+  default: "",
+  description: "the Zero Trust team to make, as in <team>.cloudflareaccess.com, when the account has none yet"
+}).action(async (opts, ctx) => ctx.journal.record("tunnel setup", null, async () => tunnelSetup({
+  ...opts,
+  creds: ctx.creds,
+  task: await here(ctx),
+  saved: savedTunnelOf(ctx),
+  log: ctx.log,
+  fetch: ctx.fetch
+})));
+splatesTunnel.command("status").description("print the tunnel `splates tunnel setup` saved for this machine, which a bare `splates server` runs, and whether its token is in the system's secret store").option("json", z14.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const saved = savedTunnelOf(ctx);
+  const record = await saved.read();
+  const token = record === null ? false : await saved.token() !== undefined;
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(record === null ? null : { ...record, token }));
+    return;
+  }
+  if (record === null) {
+    ctx.log.info("no tunnel saved: `splates tunnel setup <host> --email <you>` makes one");
+    return;
+  }
+  ctx.log.info([
+    `host:    https://${record.host}`,
+    `team:    ${record.team}.cloudflareaccess.com`,
+    `aud:     ${record.aud}`,
+    `tunnel:  ${record.tunnel}`,
+    `token:   ${token ? "in the device's store" : "missing: run `splates tunnel setup` again"}`
+  ].join(`
+`));
+});
+splatesTunnel.command("remove").use(repository9({ needs: "own" })).description(`delete what \`splates tunnel setup\` and \`splates server --slot\` made in Cloudflare by what they saved: each tunnel, the DNS record routing to it, the Access applications and their policy, then forget the saved files and the tunnels' tokens; the API token kept as ${API_TOKEN} stays. Run again after a failure, it finishes what is left`).action(async (_opts, ctx) => ctx.journal.record("tunnel remove", null, async () => tunnelRemove({
+  saved: savedTunnelOf(ctx),
+  slots: slotTunnelsOf(ctx),
+  creds: ctx.creds,
+  task: await here(ctx),
+  fs: ctx.fs,
+  log: ctx.log,
+  fetch: ctx.fetch
+})));
+
+// worker.ts
+import { splatesHome as splatesHome4 } from "@stringsync/splates-server/models";
+import {
+  addWorker,
+  drainWorker,
+  FileLogger,
+  listWorkers,
+  removeWorker,
+  setWorkerSlots,
+  WORKER_JOIN,
+  workerJoin,
+  workerRecipe,
+  workerRun
+} from "@stringsync/splates-server/workers";
+import { cli as cli15 } from "webappwiz/cmd";
+import { CompositeLogger } from "webappwiz/log";
+import { z as z16 } from "zod";
+
+// waiting.ts
+import { listQueue, moveQueued } from "@stringsync/splates-server/workers";
+import { cli as cli14 } from "webappwiz/cmd";
+import { z as z15 } from "zod";
+var DEV2 = {
+  default: "",
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
+};
+var splatesWaiting = cli14("queue").description("the agents waiting for a slot on a worker of the running `splates server`: each one another agent started (with `splates add --agent`, or a lane's orchestrator handing out tasks), started or resumed while every worker it can run on is full, waits here, first come, first served, and starts once a slot frees, as when an agent left idle 30 minutes stops; none is ever failed for waiting. An agent you start waits only while no worker it can run on is up, as with this machine's own removed or none on the platform its project requires");
+splatesWaiting.command("list").description("list the agents waiting for a slot, first in line first: position, project, task, conversation, how long each has waited and why (no free slot, no worker up, or a platform no worker runs, as `needs macOS`)").option("dev", z15.string(), DEV2).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listQueue({
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWaiting.command("move").description("move an agent waiting for a slot to another place in line, from 1 for the next to start, then list the queue").arg("which", z15.string(), {
+  description: "the task it works, or its conversation's id"
+}).arg("position", z15.coerce.number().int(), {
+  description: "where in line to put it, from 1"
+}).option("dev", z15.string(), DEV2).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => moveQueued({
+  which: opts.which,
+  position: opts.position,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+
+// worker.ts
+var splatesWorker = cli15("worker").description("the machines that run tasks for `splates server`: each dials out to it and runs what it is given, agents, terminals and the git and process reads around them, on its own machine");
+splatesWorker.command("run").description("run a worker on this machine until stopped: it dials `splates server`, by default the one on this machine through a socket in ~/.splates only you may open, and dials again whenever the link drops, while what it runs carries on; it stops reading a process's output while the server is away too long, so nothing is lost. Once its agents have moved off it, a server on another build has it restart on that build, through `bunx @stringsync/splates@<build>`, as it does when it refuses this worker for another protocol; one that says no build has it exit `outdated`").option("server", z16.string(), {
+  default: "",
+  description: "the `splates server` to dial: its URL, whose /api/workers it opens, or unix:<path>; by default this machine's"
+}).option("coordinator", z16.string(), {
+  default: "",
+  description: "the old name for --server, still read for workers installed before it, and passed to a build older than it"
+}).option("slots", z16.coerce.number().int().min(0), {
+  default: 0,
+  description: "how many tasks this worker takes at once; by default one for each core and 4 GB of memory it has, whichever is fewer, as a VM such as WSL2 sees them"
+}).option("id", z16.string(), {
+  default: "",
+  description: "what the server knows this worker by, kept across restarts so it picks up where it was; by default the id it joined as, kept beside its key, else the machine's host name"
+}).option("join", z16.string(), {
+  default: "",
+  description: "a join token from `splates worker add` on the server, spent to join it before dialing; the key it answers is kept in this machine's system store, or read from SPLATES_WORKER_KEY on one without"
+}).option("ephemeral", z16.boolean(), {
+  default: false,
+  description: "keep the key --join answers in memory alone, for a machine destroyed rather than restarted, as one a worker provider makes"
+}).option("key-file", z16.boolean(), {
+  default: false,
+  description: "keep the key --join answers in ~/.splates/worker.env, which only this user may read, rather than the system store, for a machine whose store is locked or missing at boot, as WSL's is with no one signed in; read it from there on each run after"
+}).option("quiet", z16.boolean(), {
+  default: false,
+  description: "say only what went wrong, not each time it joins or loses its server, as the worker `splates server` starts beside itself does; all of it still goes to worker.log in ~/.splates, the one before it kept as worker.log.1"
+}).action((opts, ctx) => workerRun({
+  coordinator: opts.server || opts.coordinator,
+  slots: opts.slots,
+  id: opts.id,
+  join: opts.join || ctx.ps.env(WORKER_JOIN) || "",
+  ephemeral: opts.ephemeral,
+  keyFile: opts["key-file"],
+  log: opts.quiet ? quietLog(ctx) : ctx.log,
+  ps: ctx.ps,
+  fs: ctx.fs
+}));
+splatesWorker.command("join").description("spend a join token from `splates worker add` and keep the key it answers, as `splates worker run --join` does, then exit, for an installer that leaves running the worker to a service").option("server", z16.string(), {
+  default: "",
+  description: "the `splates server` to join: its URL"
+}).option("coordinator", z16.string(), {
+  default: "",
+  description: "the old name for --server"
+}).option("join", z16.string(), {
+  default: "",
+  description: "the join token `splates worker add` printed there; by default read from SPLATES_WORKER_JOIN, which keeps it out of the process list other users of the machine can read"
+}).option("id", z16.string(), {
+  default: "",
+  description: "what the server knows this worker by, kept beside its key so a change of host name leaves it the same; by default the machine's host name"
+}).option("key-file", z16.boolean(), {
+  default: false,
+  description: "keep the key in ~/.splates/worker.env, which only this user may read, rather than the system store, for `splates worker run --key-file` to read"
+}).action((opts, ctx) => workerJoin({
+  coordinator: opts.server || opts.coordinator,
+  join: opts.join || ctx.ps.env(WORKER_JOIN) || "",
+  id: opts.id,
+  keyFile: opts["key-file"],
+  log: ctx.log,
+  ps: ctx.ps,
+  fs: ctx.fs
+}));
+splatesWorker.command("recipe").description("print the shell script, run as root on a fresh Debian or Ubuntu machine, that installs what a Linux worker needs: bun, git, the shared browser and this build of splates, for the user `splates`. It is what a provider's snapshot is built from, and what the Windows installer runs in WSL").action((_opts, ctx) => workerRecipe({ log: ctx.log }));
+splatesWorker.command("list").description("list the workers the running `splates server` has: kind (local over its socket, registered otherwise), platform, build, protocol, slots used and total, health with when it was last heard, tasks and $/hour, then any it refused for speaking another protocol").option("dev", z16.string(), {
+  default: "",
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
+}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listWorkers({
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+var dev = {
+  default: "",
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
+};
+splatesWorker.command("add").description("add a worker to the running `splates server`: prints a join token, single use and good for 15 minutes, for `splates worker run --join <token>` on the machine to join, which gets a key of its own that `splates worker remove` revokes; with --local N, makes this machine's own worker run N agents at once and take new ones again, adding it back if it was removed; with --provider, has the `workerProvider` in splates.config.ts make one, booted from the snapshot splates builds for it, which joins on its own and whose machine `splates worker remove` destroys").option("local", z16.coerce.number().int().min(0), {
+  default: 0,
+  description: "this machine's own worker, with this many slots"
+}).option("provider", z16.boolean(), {
+  default: false,
+  description: "have the server's worker provider make the worker, of its cheapest type unless --type says"
+}).option("type", z16.string(), {
+  default: "",
+  description: "the worker provider's type to make, as it names it; implies --provider"
+}).option("dev", z16.string(), dev).action((opts, ctx) => addWorker({
+  local: opts.local,
+  provider: opts.provider,
+  type: opts.type,
+  dev: opts.dev,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWorker.command("drain").description("take no new agents on a worker, letting those on it run to their end, but for one asking you something in a task, which saves its task and lets its slot go, its question kept for you to answer and carry it on elsewhere; --undo takes new ones again").arg("id", z16.string(), {
+  description: "the worker, as `splates worker list` names it"
+}).option("undo", z16.boolean(), {
+  default: false,
+  description: "take new agents again"
+}).option("dev", z16.string(), dev).action((opts, ctx) => drainWorker({
+  id: opts.id,
+  undo: opts.undo,
+  dev: opts.dev,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWorker.command("slots").description("set how many agents a worker runs at once, from now on, over what it started with").arg("id", z16.string(), {
+  description: "the worker, as `splates worker list` names it"
+}).arg("slots", z16.coerce.number().int().min(1), {
+  description: "how many at once"
+}).option("dev", z16.string(), dev).action((opts, ctx) => setWorkerSlots({
+  id: opts.id,
+  slots: opts.slots,
+  dev: opts.dev,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWorker.command("remove").description("remove a worker, revoking its key: one with agents on it drains and is removed once they end; --force ends them now, frees their slots, and places each again on another worker, to carry on its task from the checkpoint it last pushed. This machine's own worker, `local`, stops taking agents, its agents running to their end, and leaves this machine only coordinating until `splates worker add --local <slots>`; it takes no --force").arg("id", z16.string(), {
+  description: "the worker, as `splates worker list` names it"
+}).option("force", z16.boolean(), {
+  default: false,
+  description: "end the agents on it now rather than wait for them"
+}).option("dev", z16.string(), dev).action((opts, ctx) => removeWorker({
+  id: opts.id,
+  force: opts.force,
+  dev: opts.dev,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWorker.mount("queue", splatesWaiting);
+function quietLog(ctx) {
+  const file = new FileLogger(ctx.fs, `${splatesHome4(ctx.ps)}/worker.log`);
+  return new CompositeLogger([
+    { info: () => {}, error: (...said) => ctx.log.error(...said) },
+    file
+  ]);
+}
+
+// splates.ts
+function projectArgs(argv) {
+  const [first, second, ...rest] = argv;
+  if (first === "--project" && second !== undefined) {
+    return { project: second, argv: rest };
+  }
+  if (first?.startsWith("--project=")) {
+    return {
+      project: first.slice("--project=".length),
+      argv: argv.slice(1)
+    };
+  }
+  return { argv };
+}
+var splates = cli16("splates").use(exits());
+splates.command("notes").use(repository10({ needs: "read" })).description("print each project note's frontmatter description, one per line; notesDir in splates.config.ts defaults to notes; an absent directory prints nothing").action((_opts, ctx) => notes(ctx));
+splates.command("init").use(repository10({ creates: true, needs: "own" })).description("make this repository a splates project: set up its records under .git/splates when it has none, install the splates skill of this release with `bunx skills add`, and register it in ~/.splates/projects.json, so `splates server` serves it beside every other; run again, it changes only what is not so already").action((_opts, ctx) => init(ctx));
+splates.command("migrate").description(`move this repository's records under .git/splates to this splates's format, as \`splates server\` does as it starts: backed up first, the steps run with ${MIGRATION_LIMIT.human()} to finish, and the backup put back if one fails or runs over, with why kept in .git/splates-migration.json; it tries again past a failure kept there, which the server and every other command leave alone. Run it only while no older \`splates server\` serves the repository, which would refuse the records once moved; \`splates update\` restarts one first`).action(async (_opts, ctx) => {
+  const format = await migrateRecords(ctx);
+  if (ctx.ps.env(MIGRATING) === undefined) {
+    ctx.log.info(`splates's records are in format ${format}`);
+  }
+});
+splates.command("update").use(recordsFirst()).use(repository10({ needs: "own" })).description("bring this repository up to the newest splates on npm: run `update` on that release when it is newer than this one, which moves the records under .git/splates to its format, as `splates migrate` does, unless an older `splates server` serves the repository, which it asks to restart onto that release once its agents have checkpointed, migrating them as it starts; then installs its splates skill with `bunx skills add` over the copy there, leaving one that links to your own; commit what changed").action(async (_opts, ctx) => {
+  const code = await update({
+    root: ctx.git.root,
+    fs: ctx.fs,
+    ps: ctx.ps,
+    log: ctx.log,
+    newest: () => newest()
+  });
+  if (code !== 0) {
+    ctx.ps.exit(code);
+  }
+});
+splates.command("run").description("run a command that needs a machine of its own (a full test run, an install) on a runner, in a checkout of this worktree as it stands, uncommitted edits included, its output streamed back and its exit code yours: one that has joined `splates server` when it has one, else, in a project whose splates.config.ts names a `cloud`, one `splates run` makes there itself, server or no server (`splates runners`), refusing with `no_runner` rather than run here when none can be had, as without the cloud's token or past `splates budget`. A project that names no cloud runs it here, in one of this machine's heavy-job slots, waiting for one to come free first, so agents testing at once queue rather than run out of memory; `SPLATES_HEAVY_JOBS` sets how many run at once, 1 by default. Run on a runner, it changes nothing here: files it writes stay there").option("cpus", z17.coerce.number().positive().optional(), {
+  description: "the CPUs it asks of a runner, which takes as many commands at once as fit; the project's `job` in splates.config.ts, else 4, by default"
+}).option("memory", z17.string(), {
+  default: "",
+  description: "the memory it asks of a runner, as 8GB or 512MB; the project's `job` in splates.config.ts, else 8GB, by default"
+}).option("timeout", z17.string(), {
+  default: "",
+  description: "how long it may run, as 30m, 90s or 2h, before it is killed and exits 124, so a hung command holds no runner or slot; the project's `job.timeout` in splates.config.ts, else 30m, by default"
+}).rest("command", z17.string(), {
+  description: "the command and its arguments, after `--`"
+}).action(async (opts, ctx) => {
+  const code = await runHeavy(ctx, opts.command, undefined, {
+    ...opts.cpus === undefined ? {} : { cpus: opts.cpus },
+    memory: opts.memory,
+    timeout: opts.timeout
+  });
+  if (code !== 0) {
+    ctx.ps.exit(code);
+  }
+});
+splates.command("forget").use(repository10({ needs: "own" })).description("take this repository off ~/.splates/projects.json, so `splates server` no longer offers it; its records stay, and `splates init` brings it back").action((_opts, ctx) => forget(ctx));
+splates.command("add").use(repository10({ needs: "tasks" })).description("start a task: a new one, or with --task one from the queue; create branch task/<slug>, a worktree at ../<repo>-splates.noindex/<slug> and a state record").arg("slug", z17.string(), {
+  description: "the task's name, for its branch and worktree (lowercase-with-dashes)"
+}).option("base", z17.string(), {
+  default: "",
+  description: "branch this task starts from and merges onto (default: trunk); `task/<other>` stacks this task on that one and lands the work in its worktree"
+}).option("task", z17.string(), {
+  default: "",
+  description: "start this queued task by number: its words become the plan's Goal, merging removes it, and removing this task puts it back where it was"
+}).option("goal", z17.string(), {
+  default: "",
+  description: "one or two lines on what done means, written under `## Goal` in the task's SPLATES.md; required unless --task seeds the Goal"
+}).option("agent", z17.string(), {
+  default: "",
+  description: "how `splates server`'s queue hands the task to an agent on the roster (`splates agents`), which it starts in the worktree; refused from an agent, which starts no agents and queues work with `splates task add` instead"
+}).option("model", z17.string(), {
+  default: "",
+  description: "with --agent: the model it works on, by its id or name on the roster (default: the agent's own)"
+}).option("effort", z17.string(), {
+  default: "",
+  description: "with --agent: the thinking level it works at, one the agent offers (default: the agent's own)"
+}).option("prompt", z17.string(), {
+  default: "",
+  description: "with --agent: what to tell the agent beyond claiming the task"
+}).option("held", z17.string(), {
+  default: "",
+  description: "with --agent: the conversation `splates server`'s queue held for the queued task, which takes the task rather than a new one"
+}).action(async (opts, ctx) => {
+  await refuseGroomer4(ctx.service, "add");
+  if (opts.agent === "" && (opts.model !== "" || opts.effort !== "" || opts.prompt !== "" || opts.held !== "")) {
+    fail9("usage", "--model, --effort, --prompt and --held go with --agent", {
+      task: opts.slug
+    });
+  }
+  if (opts.goal.trim() === "" && opts.task === "") {
+    fail9("usage", `say what done means: \`splates add ${opts.slug} --goal "<one or two lines>"\`, or start queued tasks with --task`, { task: opts.slug });
+  }
+  const dispatch = opts.agent === "" ? undefined : {
+    agent: opts.agent,
+    ...opts.model === "" ? {} : { model: opts.model },
+    ...await effortIn(ctx, opts.agent, opts.effort, {
+      task: opts.slug
+    }),
+    ...opts.prompt === "" ? {} : { prompt: opts.prompt },
+    ...opts.held === "" ? {} : { held: opts.held }
+  };
+  const agents = dispatch === undefined ? [] : await seeded2(rosterOf2(ctx));
+  const all = await ctx.tasks.all();
+  const subjects = taskIds(opts.task).flatMap((id) => all.find((each) => each.id === id)?.subject ?? []);
+  await ctx.journal.record("add", opts.slug, () => add(ctx, opts.slug, {
+    base: opts.base || undefined,
+    tasks: taskIds(opts.task),
+    goal: opts.goal.trim() || undefined,
+    dispatch,
+    agents,
+    away: ctx.elsewhere !== null,
+    onTree: dispatch === undefined ? () => follow(ctx, opts.slug, { base: opts.base || undefined }) : undefined
+  }), {
+    base: opts.base || ctx.config.trunk,
+    tasks: taskIds(opts.task),
+    goal: opts.goal.trim() || null,
+    subjects,
+    agent: dispatch?.agent ?? null,
+    model: dispatch?.model ?? null
+  });
+  if (ctx.elsewhere !== null) {
+    await serveProject(ctx);
+  }
+});
+splates.command("claim").use(repository10({ needs: "own" })).description("resume an existing task: take ownership of its worktree and print its path, status and any half-finished rebase; refuses while another agent holds the lease, but takes a stale one silently, so `splates show` first if the tree may not be abandoned").arg("task", z17.string(), { description: "task name" }).action(async (opts, ctx) => {
+  await ctx.journal.record("claim", opts.task, () => claim(ctx, opts.task), (claimed) => claimed);
+  await follow(ctx, opts.task);
+});
+splates.command("merge").use(repository10({ needs: "own" })).description("land this worktree's branch on its base (trunk unless created with --base): rebase onto it, run tests on the rebased code, fast-forward it in whichever worktree has it checked out, then discard the worktree, branch and record (linear history, never a merge commit, no flag to skip tests); requires committed work, refusing a dirty worktree").option("message", z17.string(), {
+  default: "",
+  description: "squash the task's commits into one with this message before landing, saying what the base gains in at least 5 characters"
+}).action(async (opts, ctx) => {
+  await refuseGroomer4(ctx.service, "merge");
+  const task = await here(ctx);
+  const facts = {};
+  await ctx.journal.record("merge", task, () => merge({ ...ctx, send: ctx.fetch }, ctx.ps.cwd(), facts, {
+    message: opts.message
+  }), facts);
+  if (task !== null) {
+    await addFactTasks(ctx, task).catch((error) => ctx.log.error(`could not queue tasks for what the merge found: ${error}`));
+    await follow(ctx, null, { from: task });
+  }
+});
+splates.command("remove").use(repository10({ needs: "tasks" })).description("discard a task: worktree, branch and state file; cheap and encouraged, since redoing a task against current trunk often beats a hard rebase").arg("task", z17.string(), { description: "task name" }).option("force", z17.boolean(), {
+  default: false,
+  description: "discard even when another agent holds the lease"
+}).option("reason", z17.optional(z17.enum(REMOVE_REASONS)), {
+  description: "why, for the Stats page: nothing (nothing to change), moot (no longer needed), superseded (done some other way), redo (better redone against current trunk), blocked (set aside until what it waits on lands, so back on the list)"
+}).action(async (opts, ctx) => {
+  await ctx.journal.record("remove", opts.task, () => remove(ctx, opts.task, { force: opts.force, reason: opts.reason }), ({ released }) => ({ why: opts.reason ?? null, released }));
+  await follow(ctx, null, { from: opts.task });
+});
+splates.command("list").use(repository10({ needs: "read" })).description("list every started task: its number, name, status, lease (held: an agent is on it now; stale: gone quiet, normal for a task mid-edit; none), commits ahead of trunk, age; `splates task list` lists the queue").option("json", z17.boolean(), { default: false, description: "emit JSON" }).option("files", z17.boolean(), {
+  default: false,
+  description: "add each task's Goal and changed files (committed or not), to check for overlap before starting"
+}).action((opts, ctx) => list(ctx, { json: opts.json, files: opts.files }));
+splates.command("show").use(repository10({ needs: "read" })).description("read one task without touching it: everything `list` shows for it, plus the SPLATES.md its agent left at the worktree root; takes no lease, so it cannot knock that agent off its own tree; for a task no longer live, the newest finished one of that name: how it ended, its base, the commit it landed as, its conversation and the SPLATES.md it ended on").arg("task", z17.string(), { description: "task name" }).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => show(ctx, opts.task, { json: opts.json }));
+splates.command("wait").use(repository10({ needs: "read" })).description("block until a task stops moving: waiting on a person to answer its questions, or gone (merged or removed), or broken; takes no lease, and gives up with `timeout` rather than waiting forever").arg("task", z17.string(), { description: "task name" }).option("timeout-secs", z17.coerce.number(), {
+  default: DEFAULT_TIMEOUT3.secs,
+  description: "how long to wait before giving up"
+}).action((opts, ctx) => {
+  const timeout = Duration3.secs(opts["timeout-secs"]);
+  return ctx.journal.waiting("wait", opts.task, { until: untilAfter3(timeout) }, () => wait(ctx, opts.task, { timeout }));
+});
+splates.command("log").use(repository10({ needs: "read" })).description("show what has been done here recently: one line per add, claim, merge, remove, retry, queued task and more, with how it ended; outlives the tasks themselves").option("count", z17.coerce.number(), {
+  default: DEFAULT_COUNT,
+  description: "how many entries to show"
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => showLog(ctx, { count: opts.count, json: opts.json }));
+splates.mount("server", splatesServer);
+splates.command("ports").description("list the ports tasks serve, found by the running `splates server` as an editor finds ports to forward: each port a process in a task's worktree, or under its agent, listens on, with its link through the ports host `splates server --ports-host` saved, behind Cloudflare Access, and its link on this machine; give the user both").arg("task", z17.string(), {
+  default: "",
+  description: "only this task's ports; every task's by default"
+}).option("dev", z17.string(), {
+  default: "",
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV, else this machine's on its default port"
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => portsLs({
+  task: opts.task,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splates.command("agents").description("print the roster of agents splates can start, kept for every project in ~/.splates/agents.json: each agent's launch command and models, with what each model is good at and what it costs, and the thinking levels `--effort` takes, as the agent offered them when last started, for choosing whom to delegate to; writes the defaults (Claude, Codex) there first when there is none, and `splates server` starts conversations with those it lists").option("json", z17.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => agents({
+  roster: rosterOf2(ctx),
+  offered: await offeredOf(ctx).all(),
+  log: ctx.log
+}, { json: opts.json }));
+splates.command("setup").description("set splates up on this machine, one step at a time: with no step, each area's steps, checked from real state, and the one to do next; with a step, why it matters, the one thing the user does and what the agent does. Skips are kept in ~/.splates/setup.json, so a skipped step stops asking").arg("step", z17.string(), {
+  default: "",
+  description: "a step's id; omit for every area's progress"
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).option("skip", z17.boolean(), {
+  default: false,
+  description: "with a step: stop asking for it"
+}).option("unskip", z17.boolean(), {
+  default: false,
+  description: "with a step: ask for it again"
+}).option("undo", z17.boolean(), {
+  default: false,
+  description: "with an area's id in place of a step: print what undoing it would remove, the creds it forgets and keeps, and what only the user can remove; the Setup page's Undo does it, after the user confirms"
+}).action((opts, ctx) => setup(ctx, opts));
+splates.command("path").use(repository10({ needs: "read" })).description("print a task's worktree path, or the main tree with no task; names another agent's tree without taking its lease").arg("task", z17.string(), {
+  default: "",
+  description: "task name; omit for the main tree"
+}).action((opts, ctx) => path(ctx, opts.task || undefined));
+splates.command("checkpoint").use(repository10({ needs: "own" })).description("save this task to the central remote (`remote` in splates.config.ts) before a stop: commit what is uncommitted as a `WIP: checkpoint` commit, to squash before merging, and push the branch as `splates/<task>`, so a worker that dies loses nothing; with no remote configured, leaves the tree as it is").action(async (_opts, ctx) => {
+  await checkpoint(ctx, ctx.ps.cwd());
+});
+splates.command("attach").use(repository10({ needs: "own" })).description("store screenshots and recordings for this task's questions to show: prints the path each was stored at, under .git/splates, which the `splates server` page shows inline; from a conversation (its $SPLATES_CONVERSATION, or --conversation) they stay with it past the task, otherwise they go when the task merges or is removed; those the task's final SPLATES.md shows are copied to keep with its finished record. A task holds at most attachmentCapacity bytes; with no files, lists what it holds. A file the user will come back for on its own is an artifact instead (`splates artifact add`)").arg("files", z17.string(), {
+  default: "",
+  description: "files to store, comma separated"
+}).option("task", z17.string(), {
+  default: "",
+  description: "task name, when run outside its worktree"
+}).option("remove", z17.string(), {
+  default: "",
+  description: "files it holds to drop first, comma separated, by path or stored name"
+}).option("conversation", z17.string(), {
+  default: "",
+  description: "conversation to keep the files with, when $SPLATES_CONVERSATION is not set"
+}).action(async (opts, ctx) => ctx.journal.record("attach", opts.task || await here(ctx), () => attach(ctx, commaList5(opts.files), ctx.ps.cwd(), {
+  task: opts.task || undefined,
+  remove: commaList5(opts.remove),
+  conversation: opts.conversation || undefined
+}), (stored) => ({ stored, removed: commaList5(opts.remove) })));
+splates.command("retry").use(repository10({ needs: "own" })).description("give a task that spent its merge attempts another mergeRetryCount of them; the way out of `budget_exhausted` that is not remove and redo, for a person to run once they have seen the tree").arg("task", z17.string(), { description: "task name" }).action((opts, ctx) => recordRetry(ctx, opts.task));
+splates.mount("artifact", splatesArtifact).mount("task", splatesTask).mount("lane", splatesLane).mount("projects", splatesProjects).mount("creds", splatesCreds).mount("tunnel", splatesTunnel).mount("slots", splatesSlots).mount("worker", splatesWorker).mount("runners", splatesRunners).mount("queue", splatesQueue).mount("hook", splatesHook).mount("budget", splatesBudget).mount("replica", splatesReplica);
+
+// index.ts
+if (basename2(process.argv[1] ?? "") === LEGACY) {
+  legacyWarnings.once(LEGACY, "splates");
+}
+var ps = systemPs();
+var { project, argv } = projectArgs(ps.args);
+var handedOff = await handOffDev(argv, ps.cwd());
+if (handedOff !== null) {
+  process.exit(handedOff);
+}
+await splates.run({ fs: new NodeFs, ps, assets, project }, argv);