@useshifu/coding-harness 0.3.37 → 0.3.38

package/bin/onboarding-ui.js

@@ -52,7 +52,7 @@ function renderWelcome({ harness, upgraded = false } = {}, terminal) {
     "Automatic work sync: every hour, after Start sync",
     "Saves redacted work summaries to your Shifu account, keeping decisions, lessons and their reasoning available for future conversations.",
     "",
-    "Files stay off until you enable uploads and approve a folder. Files in that folder are uploaded separately for processing.",
+    "File parsing is selected by default for new setups. Review the folder before Start sync, or turn it off. Files are sent to your connected Shifu workspace for parsing into context.",
     "Preparing selected history uses your configured model account and allowance.",
     "",
     "Review your projects, history and optional file folder in local setup, then select Start sync. You can pause local preparation and uploads there anytime. Just ask your assistant to open setup.",

package/bin/onboarding.js

@@ -25,6 +25,11 @@ function write(fileName, value) {
   fs.renameSync(temporary, fileName);
 }
 function fingerprint(config) { return config?.token ? createHash('sha256').update(config.token).digest('hex') : null; }
+function wizardCodeRevision(runtime) {
+  const hash = createHash('sha256').update(fs.readFileSync(__filename));
+  for (const name of ['index.html', 'wizard.js']) hash.update(fs.readFileSync(path.join(runtime.assets, name)));
+  return hash.digest('hex');
+}
 function load(runtime, runId) {
   const state = read(file(runtime));
   if (runId && (!ID.test(runId) || state?.runId !== runId)) throw new Error('This setup run is not available on this device.');
@@ -159,6 +164,7 @@ async function bodyJSON(request) {
 }
 async function startServer(runtime, state, { port=0 }={}) {
   const token = randomBytes(32).toString('hex');
+  const codeRevision = wizardCodeRevision(runtime);
   let origin, busy=false;
   const server = http.createServer(async (request,response) => {
     response.setHeader('Cache-Control','no-store'); response.setHeader('Referrer-Policy','no-referrer'); response.setHeader('X-Content-Type-Options','nosniff');
@@ -209,7 +215,7 @@ async function startServer(runtime, state, { port=0 }={}) {
         if(runtime.readConfig()) runtime.pause();
         const result=await runtime.setupLock(()=>runtime.lock(async()=>{const current=load(runtime,state.runId);if(current.authorized && !TERMINAL.has(current.backfillStatus) && choice.abandon!==true)throw new Error('Active selection requires explicit abandonment.');state=initial(runtime);}));
         if(result?.skipped) return send(409,{error:'Another Shifu sync is active.'});
-        write(file(runtime,'wizard'),{pid:process.pid,url:origin+'/#'+token,runId:state.runId});
+        write(file(runtime,'wizard'),{pid:process.pid,url:origin+'/#'+token,runId:state.runId,codeRevision});
         return send(200,safeStatus(runtime,state));
       }
       if (request.method === 'POST' && url.pathname === '/api/resume') {
@@ -220,13 +226,13 @@ async function startServer(runtime, state, { port=0 }={}) {
       return send(404,{error:'This setup action is unavailable.'});
     } catch (error) {
       // Never relay provider or connector errors: those can contain source text or credentials.
-      return send(400,{error: ['Choose a valid history window and both feedback options.','The connection key format is invalid.','Unsupported setup option.','This run has a fixed history selection. Finish it before changing the history window.','Choose a project or explicitly choose all projects.','Choose valid file and schedule settings.','Review the selected scope before starting sync.','The selected scope changed. Review it again before starting sync.','The project list changed. Review the selection again.','Choose an existing readable folder.'].includes(error.message) ? error.message : 'Setup could not finish. Your accepted work is preserved; check the connection and retry.'});
+      return send(400,{error: ['Your connection key is saved, but the coding tool connection could not be completed. Open or update your coding tool, choose Edit selection, review it again and retry. You do not need a new key.','Could not reach Shifu to verify the connection key. Nothing was changed.','Shifu rejected this connection key for the selected coding tool. Nothing was changed.','The connection key is invalid.','Choose a valid history window and both feedback options.','The connection key format is invalid.','Unsupported setup option.','This run has a fixed history selection. Finish it before changing the history window.','Choose a project or explicitly choose all projects.','Choose valid file and schedule settings.','Review the selected scope before starting sync.','The selected scope changed. Review it again before starting sync.','The project list changed. Review the selection again.','Choose an existing readable folder.'].includes(error.message) ? error.message : 'Setup could not finish. Your accepted work is preserved; check the connection and retry.'});
     }
   });
   server.requestTimeout=15000;
   await new Promise((resolve,reject) => { server.once('error',reject); server.listen(port,'127.0.0.1',resolve); });
   origin = `http://127.0.0.1:${server.address().port}`;
-  return {server,token,origin,url:origin+'/#'+token};
+  return {server,token,origin,url:origin+'/#'+token,codeRevision};
 }
 async function main(runtime, options={}) {
   if(options.abandon && !options.fresh)throw new Error('Use --abandon only with --new to explicitly leave an unfinished selection.');
@@ -248,7 +254,7 @@ async function main(runtime, options={}) {
   }
   if (options.serve) {
     const instance=await startServer(runtime,state);
-    write(file(runtime,'wizard'),{pid:process.pid,url:instance.url,runId:state.runId});
+    write(file(runtime,'wizard'),{pid:process.pid,url:instance.url,runId:state.runId,codeRevision:instance.codeRevision});
     const close=()=>instance.server.close(); process.once('SIGTERM',close); process.once('SIGINT',close);
     // The wizard is temporary; scheduled runner state owns unfinished backfill.
     const idle=setTimeout(()=>instance.server.close(),60*60*1000); idle.unref();
@@ -257,7 +263,7 @@ async function main(runtime, options={}) {
   runtime.copyRunner();
   const endpoint=read(file(runtime,'wizard'));
   let url;
-  if (endpoint?.runId === state.runId) {
+  if (endpoint?.runId === state.runId && endpoint.codeRevision === wizardCodeRevision(runtime)) {
     try { const u=new URL(endpoint.url); const r=await fetch(u.origin+'/api/status',{headers:{'X-Shifu-Wizard':u.hash.slice(1)},signal:AbortSignal.timeout(1000)}); if(r.ok) url=endpoint.url; } catch {}
   }
   if (!url) {

package/bin/shifu-harness.js

@@ -70,13 +70,13 @@ const ACTIVE_WORK_FILE_STATUSES = new Set(["queued", "processing", "retrying"]);
 const INPUT_FOLDER_README_NAME = "README.md";
 const INPUT_FOLDER_README = `# Shifu sync folder
 
-File uploads stay off until you enable them and approve this folder in Shifu setup. Once approved, put work logs, meeting transcripts, and other work documents directly here; Shifu checks them on your selected schedule and keeps claims only when the file supports a contribution you made. Other people's work and meeting action items alone are not your claims.
+Files in this folder are processed only after you review the folder and select Start sync in Shifu setup. File parsing is selected by default for new setups and can be turned off. Once approved, put work logs, meeting transcripts, and other work documents directly here; Shifu checks them on your selected schedule and keeps claims only when the file supports a contribution you made. Other people's work and meeting action items alone are not your claims.
 
 Supported files: .txt, .md, .rtf, and .docx, up to 20 MB each. Subfolders, links, images, and screenshots are not processed. This README is not synced. Unsupported files are counted but never uploaded.
 
 Uploading starts a background job. Shifu checks unfinished jobs before the next scheduled or manual sync; a file is complete only when the server reports its final result. A partial result stays pending for retry. A completed file may have published claims, needs-evidence suggestions, or neither; suggestions are not verified claims.
 
-Files you add are sent to Shifu for parsing and sanitization; they are not redacted on this device. Only place files here if you want them processed. For named meeting transcripts, set your display name in Shifu Profile so your speaker turns can be matched.
+Files you add are sent as provided to your connected Shifu workspace for parsing and sanitization. In Shifu Desktop, parsing runs on your Mac; AI processing may send extracted text through Shifu’s gateway. In the web app, files are uploaded to your hosted workspace. Only place files here if you want them processed. For named meeting transcripts, set your display name in Shifu Profile so your speaker turns can be matched.
 `;
 
 function configRoot() {
@@ -3930,13 +3930,18 @@ function onboardingRuntime(harness, { prepareNative } = {}) {
   const scopeStatus = () => {
     const config = readJSON(configPath(harness), null);
     const authorization = controls.validAuthorization(config);
+    const desktop = readDesktopProfile(configRoot());
+    const apiUrl = requireSafeApiUrl(config?.apiUrl || option("--api-url") || process.env.SHIFU_API_URL || DEFAULT_API_URL);
+    let connectionKeyUrl;
+    if (desktop?.connectionKeyLinks === true) connectionKeyUrl = `shifu://sources/coding-sessions?${new URLSearchParams({ harness, profile: desktop.namespace, connection: 'key' })}`;
+    else if (!desktop && apiUrl === DEFAULT_API_URL) connectionKeyUrl = `https://app.useshifu.com/#/sources/coding-sessions?${new URLSearchParams({ harness, connection: 'key' })}`;
     let projects = [], projectDiscoveryError;
     try { projects = controls.projectCatalog(localSessions(harness)); }
     catch { projectDiscoveryError = "Local project history is unavailable. Check the coding tool installation before selecting history."; }
     const current = controls.projectIdentity({ workspace: process.cwd() }).ref;
     const projectRefs = authorization?.projectRefs || (projects.some((item) => item.ref === current) ? [current] : projects.length === 1 ? [projects[0].ref] : []);
-    return { runnerVersion: RUNNER_VERSION, projects, projectDiscoveryError, projectScope: authorization?.projectScope || "selected", projectRefs,
-      filesEnabled: authorization?.filesEnabled === true, inputFolder: config?.inputFolder || defaultInputFolder(),
+    return { runnerVersion: RUNNER_VERSION, connectionKeyUrl, projects, projectDiscoveryError, projectScope: authorization?.projectScope || "selected", projectRefs,
+      filesEnabled: authorization ? authorization.filesEnabled : true, inputFolder: config?.inputFolder || defaultInputFolder(),
       paused: config?.syncPaused === true, scopeReviewRequired: !authorization,
       syncPolicy: authorization ? normalizedPolicy(config) : { intervalHours: 1, approvalMode: "automatic", scheduleEnabled: true } };
   };
@@ -3995,7 +4000,8 @@ function onboardingRuntime(harness, { prepareNative } = {}) {
         await connect(harness, async () => key, choices.preferences, true);
         generation = readConfig(harness).syncGeneration || 0;
       }
-      await setupMcp(harness);
+      try { await setupMcp(harness); }
+      catch { throw new Error("Your connection key is saved, but the coding tool connection could not be completed. Open or update your coding tool, choose Edit selection, review it again and retry. You do not need a new key."); }
       const config = readConfig(harness);
       if ((config.syncGeneration || 0) !== generation) throw new Error("Setup was paused or changed. Review and start again.");
       if (choices.scope.filesEnabled) prepareInputFolder(choices.scope.inputFolder, choices.scope.inputFolder === defaultInputFolder());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@useshifu/coding-harness",
-  "version": "0.3.37",
+  "version": "0.3.38",
   "description": "Scheduled, redacted coding-harness activity sync for Shifu",
   "bin": {
     "coding-harness": "bin/shifu-harness.js",

package/wizard/index.html

@@ -25,14 +25,15 @@
     <p class="example">More history uses more of your coding model account’s allowance. You can start with a small window and add more later.</p>
     <fieldset class="option"><legend>Ongoing sync</legend><label><input id="schedule-enabled" type="checkbox" checked> Keep work context current with scheduled sync</label><p class="example">The schedule starts only after Start sync. You can leave it off and import just the selected history.</p></fieldset>
     <fieldset class="option"><legend>Files</legend>
-      <label><input id="files-enabled" type="checkbox"> Enable file uploads from a folder</label>
-      <div id="folder-choice" hidden><label class="label" for="input-folder">Folder to upload</label><input id="input-folder" type="text" autocomplete="off" spellcheck="false"><p class="example">Supported files in this folder upload as provided, separately from session-summary approval. The review shows the resolved folder and file count.</p></div>
-      <p class="example">Files stay off until you enable them and approve the folder. A folder change requires another review.</p>
+      <label><input id="files-enabled" type="checkbox" checked> Parse work files into context</label>
+      <div id="folder-choice"><label class="label" for="input-folder">Folder to read</label><input id="input-folder" type="text" autocomplete="off" spellcheck="false"><p class="example">Supported files are sent as provided to your connected Shifu workspace for parsing into context. The review shows the resolved folder and file count.</p></div>
+      <p class="example">In Shifu Desktop, parsing runs on your Mac; AI processing may use Shifu’s gateway. In the web app, files are uploaded to your hosted workspace.</p>
+      <p class="example">Review the folder before Start sync. Uncheck this option to leave files out. A folder change requires another review.</p>
     </fieldset>
     <fieldset class="option"><legend>Helpful growth feedback</legend><label><input type="radio" name="growth" value="on" checked> On · recommended</label><label><input type="radio" name="growth" value="off"> Off</label><p class="example">“Your trade-off is clear. Adding a success measure could strengthen the recommendation.”</p></fieldset>
     <fieldset class="option"><legend>Decision alignment</legend><label><input type="radio" name="alignment" value="on" checked> On · recommended</label><label><input type="radio" name="alignment" value="off"> Off</label><p class="example">“Earlier notes say 30 minutes; this proposal uses an hour. Has the requirement changed?”</p></fieldset>
     <p class="note">Historical retrieval stays on. Feedback choices are independent, and your current instructions take priority.</p>
-    <div id="key-entry"><label class="label" for="key">Connection key for <span id="harness"></span></label><input id="key" type="password" autocomplete="off" spellcheck="false" placeholder="Paste your tool-specific key"><p class="note">Create a key on your Shifu dashboard. It goes directly to Shifu through local setup for verification; keep it out of chat.</p></div>
+    <div id="key-entry"><label class="label" for="key">Connection key for <span id="harness"></span></label><input id="key" type="password" autocomplete="off" spellcheck="false" placeholder="Paste your Shifu connection key"><p><a id="get-key" hidden>Get connection key</a></p><ol class="note"><li>Select Get connection key to open this tool in Shifu, then select Create &amp; copy key (or Copy connection key).</li><li>Come back to this window and paste the key above. Then review your selection and select Start sync.</li><li>If the link does not open, return to the Shifu app or dashboard where you started setup, open Sources, and choose this coding tool.</li></ol><p class="note">Shifu creates this key to connect your coding tool to your workspace. It is not a Google password or a model provider API key. Keep it out of chat.</p></div>
     <div id="saved-key" class="note" hidden>Your saved connection is ready to use.
           <details><summary>Need to replace your key?</summary><p>Ask your assistant to reconnect Shifu. Enter the new key in the secure prompt, never in chat. Replacing a connection can reset local sync progress; work already saved in Shifu remains.</p></details>
         </div>
@@ -52,5 +53,5 @@
   <p id="handoff" class="note" hidden>Reload your coding assistant or start a new chat to load Shifu tools, then paste this short prompt. Your settings and saved import progress are kept.</p><textarea id="prompt" readonly hidden aria-label="Assistant resume prompt"></textarea>
 </div>
 <p id="message" role="status" aria-live="polite"></p>
-<details class="privacy"><summary>What happens to my data?</summary><p>Selection and review use local metadata. Preparing selected coding history uses your configured model account; actual allowance usage depends on that history. Shifu receives selected redacted work records, which can still contain confidential business context.</p><p>Files are optional and upload as provided from the folder you approve. Symlinks and subfolders are skipped and reported.</p><p>Revoking access stops future Shifu requests. Retained-data deletion is a separate request. <a href="https://www.useshifu.com/data" target="_blank" rel="noreferrer">Data handling</a> · <a href="https://www.useshifu.com/privacy" target="_blank" rel="noreferrer">Privacy policy</a></p></details>
+<details class="privacy"><summary>What happens to my data?</summary><p>Selection and review use local metadata. Preparing selected coding history uses your configured model account; actual allowance usage depends on that history. Shifu receives selected redacted work records, which can still contain confidential business context.</p><p>Files are included by default in a new setup and can be turned off. After you review the folder and select Start sync, supported files are sent as provided to the connected Shifu workspace for parsing into context. Symlinks and subfolders are skipped and reported.</p><p>Revoking access stops future Shifu requests. Retained-data deletion is a separate request. <a href="https://www.useshifu.com/data" target="_blank" rel="noreferrer">Data handling</a> · <a href="https://www.useshifu.com/privacy" target="_blank" rel="noreferrer">Privacy policy</a></p></details>
 </section></main></body></html>

package/wizard/wizard.js

@@ -32,6 +32,29 @@
     el('project-note').textContent = all ? 'All projects in this coding tool are included, including new projects.' : 'Select the projects whose history and new work you want Shifu to use.';
   }
 
+  function connectionKeyLink(value) {
+    const link = el('get-key');
+    link.hidden = true;
+    link.removeAttribute('href');
+    if (typeof value.connectionKeyUrl !== 'string' || !Object.hasOwn(names, value.harness)) return;
+    try {
+      const url = new URL(value.connectionKeyUrl);
+      if (url.username || url.password || url.port) return;
+      const desktop = url.protocol === 'shifu:' && url.hostname === 'sources' && url.pathname === '/coding-sessions' && !url.hash;
+      const hosted = url.origin === 'https://app.useshifu.com' && url.pathname === '/' && !url.search && url.hash.startsWith('#/sources/coding-sessions?');
+      if (!desktop && !hosted) return;
+      const params = desktop ? url.searchParams : new URLSearchParams(url.hash.slice('#/sources/coding-sessions?'.length));
+      const expected = desktop ? ['harness', 'profile', 'connection'] : ['harness', 'connection'];
+      if (params.size !== expected.length || expected.some((key) => params.getAll(key).length !== 1) ||
+          params.get('harness') !== value.harness || params.get('connection') !== 'key' ||
+          (desktop && !/^desktop-[a-f0-9]{12}$/.test(params.get('profile') || ''))) return;
+      link.href = url.href;
+      link.target = desktop ? '_self' : '_blank';
+      link.rel = 'noopener noreferrer';
+      link.hidden = false;
+    } catch { /* Keep the manual key instructions when a shortcut is unavailable. */ }
+  }
+
   function settings(value) {
     el('history').value = ['0', '15', '30'].includes(String(value.historyDays)) ? String(value.historyDays) : 'custom';
     el('custom').value = value.historyDays || 7;
@@ -59,12 +82,13 @@
     el('project-list').replaceChildren(...projects);
     projectScope();
     el('schedule-enabled').checked = value.scheduleEnabled ?? value.syncPolicy?.scheduleEnabled ?? true;
-    el('files-enabled').checked = value.filesEnabled === true;
+    el('files-enabled').checked = value.filesEnabled ?? true;
     el('input-folder').value = value.inputFolder || '';
     el('folder-choice').hidden = !el('files-enabled').checked;
     el('key-entry').hidden = value.configured;
     el('saved-key').hidden = !value.configured;
     el('harness').textContent = names[value.harness] || value.harness;
+    connectionKeyLink(value);
   }
 
   function syncLabel(value) {
@@ -114,6 +138,11 @@
   el('settings').addEventListener('submit', async (event) => {
     event.preventDefault();
     if (busy) return;
+    if (!state.configured && !/^cs_sk_[a-f0-9]{16}_[a-f0-9]{64}$/.test(el('key').value.trim())) {
+      el('message').textContent = `Return to Shifu → Sources → ${names[state.harness] || state.harness}, select Create & copy key (or Copy connection key), then paste it in Connection key below. This is a Shifu connection key, not a model provider key.`;
+      el('key').focus();
+      return;
+    }
     const historyDays = el('history').value === 'custom' ? Number(el('custom').value) : Number(el('history').value);
     if (!Number.isSafeInteger(historyDays) || historyDays < 0 || historyDays > 36500 || (el('history').value === 'custom' && historyDays === 0)) {
       el('message').textContent = 'Choose a positive whole number of custom days, or Start from now.';
@@ -128,7 +157,7 @@
     const filesEnabled = el('files-enabled').checked;
     const inputFolder = el('input-folder').value.trim();
     if (filesEnabled && !inputFolder) {
-      el('message').textContent = 'Choose the folder whose files you want to upload.';
+      el('message').textContent = 'Choose the folder whose files you want parsed into context.';
       return;
     }
     choices = { historyDays, projectScope, projectRefs, scheduleEnabled: el('schedule-enabled').checked, filesEnabled, ...(filesEnabled ? { inputFolder } : {}), growthFeedback: document.querySelector('input[name=growth]:checked').value === 'on', decisionAlignment: document.querySelector('input[name=alignment]:checked').value === 'on' };
@@ -157,23 +186,21 @@
     } catch (error) { el('message').textContent = error.message; }
     finally { busy = false; el('review-button').disabled = false; }
   });
-  el('edit').addEventListener('click', () => { choices = undefined; el('review').hidden = true; el('welcome').hidden = false; el('settings').hidden = false; });
+  el('edit').addEventListener('click', () => { choices = undefined; el('key-entry').hidden = state.configured; el('saved-key').hidden = !state.configured; el('review').hidden = true; el('welcome').hidden = false; el('settings').hidden = false; });
   el('apply').addEventListener('click', async () => {
     if (busy || !choices?.scopeRevision) return;
     busy = true;
     el('apply').disabled = true;
     el('message').textContent = 'Verifying your connection and starting the reviewed selection…';
     const key = el('key').value.trim();
-    el('key').value = '';
     try {
       state = await api('apply', { ...choices, ...(!state.configured ? { key } : {}) });
+      el('key').value = '';
       renderProgress();
       el('message').textContent = '';
     } catch (error) {
-      choices = undefined;
+      try { state = await api('status'); } catch { /* Keep the reviewed selection available during a connection failure. */ }
       el('message').textContent = error.message;
-      el('review').hidden = true;
-      el('welcome').hidden = false; el('settings').hidden = false;
     } finally { busy = false; el('apply').disabled = false; }
   });
   el('change').addEventListener('click', async () => {