@vibelord/lanes 1.0.0 → 1.0.2

package/payload/lanes/docs/SHARING.md

@@ -91,7 +91,7 @@ clears on its next refresh. Previously read output cannot be recalled.
 ## What viewers can see
 
 - The selected workspace's current and future **registered lanes**. Unregistered
-  sessions, legacy shells, extra/tool tabs and unrelated workspaces are excluded.
+  sessions, tool tabs and unrelated workspaces are excluded.
 - Lane names and observed activity; “active” describes recent terminal output,
   not a build verdict.
 - For tmux lanes, a selectable pane and its latest 2,000 lines, capped at

package/payload/lanes/holders/exec.sh

@@ -1,13 +1,10 @@
 #!/bin/sh
 # View-owned displays; interactive shells are persistent tmux sessions created by New +.
-# usage: exec.sh <container> monitor|legacy [cwd-or-id]
+# usage: exec.sh <container> monitor [cwd]   (the `legacy` view of pre-persistence Docker shells was retired by
+# plan Task 19: a leftover `exec … legacy` resolve file now ends as an unknown helper, and `lanes gc` removes it)
 set -u
 container=${1:-} kind=${2:-} cwd=${3:-/home/coder}
 case "$container" in ''|-*|*[!A-Za-z0-9_.-]*) echo 'invalid container' >&2; exit 64 ;; esac
-if [ "$kind" = legacy ]; then
-    repo=$(cd "$(dirname "$0")/.." && pwd)
-    exec python3 -S -E "$repo/libexec/legacy_sessions.py" view "$container" "$cwd"
-fi
 case "$cwd" in /*) ;; *) cwd=/home/coder ;; esac
 case "$cwd" in *[!A-Za-z0-9_./-]*) cwd=/home/coder ;; esac
 common="-it -u coder -e TERM=xterm-256color -e COLORTERM=truecolor -e LANG=C.UTF-8"

package/payload/lanes/holders/ssh.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Reconnecting viewer for an existing persistent session on another host.
+# The remote command is an attach-only helper: disconnecting never stops its agent.
+set -u
+host=${1:-} command=${2:-} pane=${3:-}
+# View sessions can be created by a clean server environment with no TERM.  ssh
+# then starts the remote tmux client without a terminal type and the helper
+# exits immediately with “open terminal failed”.  Keep the viewer attach-only,
+# but give the remote terminal a conservative type when the caller omitted it.
+export TERM=${TERM:-xterm-256color}
+case "$host" in ''|-*|*@*@*|*[!A-Za-z0-9_.@-]*) echo 'invalid SSH host' >&2; exit 64 ;; esac
+case "$command" in /*) ;; *) echo 'SSH command must be absolute' >&2; exit 64 ;; esac
+case "$command" in *[!A-Za-z0-9_./-]*|*/../*|*/..) echo 'invalid SSH command' >&2; exit 64 ;; esac
+case "$pane" in ''|-*|*[!A-Za-z0-9_.-]*) echo 'invalid pane' >&2; exit 64 ;; esac
+repo=$(cd "$(dirname "$0")/.." && pwd)
+exec python3 "$repo/libexec/connection.py" --title "$pane on $host" --retry -- \
+    ssh -tt -o BatchMode=yes -o ConnectTimeout=8 -o ServerAliveInterval=15 -o ServerAliveCountMax=3 \
+    "$host" "exec $command $pane"

package/payload/lanes/holders.lock

@@ -3,3 +3,6 @@
 # zellij 0.45.1: tarball digest matches GitHub's asset digest; inner binary d006c521…19dd matches the published .sha256sum.
 zellij 0.45.1 40bcc2e03f5d5ae8e054e39f676081fe12ab70871506996ba595834c3718eefc https://github.com/zellij-org/zellij/releases/download/v0.45.1/zellij-x86_64-unknown-linux-musl.tar.gz
 zmx 0.8.1 dfd75720b942466f28870731cc86dbc07afa72fb8f3bd5eeb4ff707e4eecebe8 https://github.com/neurosnap/zmx/releases/download/v0.8.1/zmx-0.8.1-linux-x86_64.tar.gz
+# glow 3.0.0 (markdown preview, `lanes preview`): tarball digest matches GitHub's asset digest and the release's checksums.txt;
+# the binary sits in glow_3.0.0_Linux_x86_64/. Installed only when no glow is on PATH; without either, the preview uses less -R.
+glow 3.0.0 13e05e4b2acc18d2aee44291aefe6325b077ec321b631a0cfa780e8e3bc33f78 https://github.com/charmbracelet/glow/releases/download/v3.0.0/glow_3.0.0_Linux_x86_64.tar.gz

package/payload/lanes/install/enable-phone.sh

@@ -2,20 +2,27 @@
 # Key-authenticated client entry point and local server setup. Tokens stay in the caller's terminal.
 set -eu
 repo=$(cd "$(dirname "$0")/.." && pwd)
-host= device=phone local=0 named=0
+host= device= local=0 named=0 layout=
 while [ "$#" -gt 0 ]; do
     case "$1" in
         --host) host=${2:?--host SSH_ALIAS}; shift ;;
         --local) local=1 ;;
+        --desktop|--mobile)
+            [ -z "$layout" ] || [ "$layout" = "$1" ] || { echo '--desktop and --mobile are exclusive' >&2; exit 2; }
+            layout=$1 ;;
         -h|--help)
-            echo 'usage: enable-phone.sh [--host SSH_ALIAS | --local] [device]'
+            echo 'usage: enable-phone.sh [--host SSH_ALIAS | --local] [--desktop|--mobile] [device]'
             echo 'Client: --host lanes uses the SSH key from ./install.sh. Server: --local.'
+            echo 'Mobile (phone lane pickers, device phone) is the default; --desktop serves the desktop sidebar layout'
+            echo '(device browser) for a laptop or tablet browser. A running view of the other layout is refused.'
             exit 0 ;;
         -*) echo "unknown option: $1" >&2; exit 2 ;;
         *) [ "$named" = 0 ] || { echo 'only one device name is allowed' >&2; exit 2; }; device=$1; named=1 ;;
     esac
     shift
 done
+# Mobile stays the default (and sends no flag to an older server); --desktop names its own default device.
+if [ "$layout" = --desktop ]; then device=${device:-browser} suffix=' --desktop'; else layout=--mobile device=${device:-phone} suffix=; fi
 case "$device" in ''|-*|*[!A-Za-z0-9_.-]*) echo 'invalid device name' >&2; exit 2 ;; esac
 case "$host" in -*|*[!A-Za-z0-9_.@:-]*) echo 'invalid SSH host' >&2; exit 2 ;; esac
 [ "$local" = 0 ] || [ -z "$host" ] || { echo '--local and --host are mutually exclusive' >&2; exit 2; }
@@ -23,10 +30,10 @@ if [ "$local" = 0 ] && [ "$(uname -s)" = Darwin ] && [ -z "$host" ]; then host=l
 [ -t 0 ] && [ -t 1 ] || { echo 'Run enable-phone.sh in your own terminal; it displays a private login token.' >&2; exit 64; }
 if [ -n "$host" ]; then
     exec ssh -t -o BatchMode=yes -o PreferredAuthentications=publickey -o ForwardAgent=no "$host" \
-        "exec sh \"\$HOME/.local/share/lanes/current/install/enable-phone.sh\" --local '$device'"
+        "exec sh \"\$HOME/.local/share/lanes/current/install/enable-phone.sh\" --local '$device'$suffix"
 fi
 command -v tailscale >/dev/null 2>&1 || { echo 'Install and connect Tailscale on the server first.' >&2; exit 1; }
-sh "$repo/install/enable-web.sh" "$device"
+sh "$repo/install/enable-web.sh" "$device" "$layout"
 if ! tailscale serve --bg --https=8443 http://127.0.0.1:8083; then
     echo 'The server admin must allow this account to manage Tailscale Serve:' >&2
     printf '  sudo tailscale set --operator=%s\n' "$(id -un)" >&2
@@ -35,9 +42,11 @@ if ! tailscale serve --bg --https=8443 http://127.0.0.1:8083; then
 fi
 dns=$(tailscale status --json | python3 -c 'import json,sys; print(json.load(sys.stdin)["Self"]["DNSName"].rstrip("."))')
 [ -n "$dns" ] || { echo 'This node needs Tailscale MagicDNS and HTTPS enabled.' >&2; exit 1; }
-printf '\nOn your phone, connect Tailscale and open:\n\n  https://%s:8443/%s\n\n' "$dns" "$device"
+if [ -n "$suffix" ]; then where='In a browser on your laptop or tablet'; else where='On your phone'; fi
+printf '\n%s, connect Tailscale and open:\n\n  https://%s:8443/%s\n\n' "$where" "$dns" "$device"
 printf 'The last line is NAME: TOKEN. Paste only TOKEN into the sign-in screen.\n'
-printf 'In Safari, Share > Add to Home Screen installs the app.\n\n'
+[ -n "$suffix" ] || printf 'In Safari, Share > Add to Home Screen installs the app.\n'
+printf '\n'
 # Zellij 0.45.1 requires --create-token by itself; --token-name cannot accompany it.
 exec "${LANES_SHARE:-$HOME/.local/share/lanes}/bin/zellij-0.45.1" \
     --config-dir "$repo/zellij" --config "$repo/zellij/config.kdl" web --create-token

package/payload/lanes/install/enable-web.sh

@@ -1,16 +1,29 @@
 #!/bin/sh
 # Enable loopback web services as the installed workspace user. Does not print a token.
+# The view is mobile (the phone's lane pickers, default device `phone`) unless --desktop asks for the desktop
+# sidebar layout (default device `browser`); a running view of the other layout is refused, never rebuilt.
 set -eu
 repo=$(cd "$(dirname "$0")/.." && pwd)
-device=${1:-phone}
-[ "$#" -le 1 ] || { echo 'usage: enable-web.sh [device]' >&2; exit 2; }
-case "$device" in ''|-*|*[!A-Za-z0-9_.-]*) echo 'invalid device name' >&2; exit 2 ;; esac
+usage='usage: enable-web.sh [device] [--desktop|--mobile]'
+device= layout=
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --desktop|--mobile)
+            [ -z "$layout" ] || [ "$layout" = "$1" ] || { echo '--desktop and --mobile are exclusive' >&2; exit 2; }
+            layout=$1 ;;
+        -*) echo "$usage" >&2; exit 2 ;;
+        *) [ -z "$device" ] || { echo "$usage" >&2; exit 2; }; device=$1 ;;
+    esac
+    shift
+done
+if [ "$layout" = --desktop ]; then device=${device:-browser} suffix=' --desktop'; else layout=--mobile device=${device:-phone} suffix=; fi
+case "$device" in -*|*[!A-Za-z0-9_.-]*) echo 'invalid device name' >&2; exit 2 ;; esac
 command -v caddy >/dev/null 2>&1 || { echo 'Install Caddy first (see docs/INSTALL.md).' >&2; exit 1; }
 export XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}
-"$repo/bin/lanes" prepare "$device" --mobile
+"$repo/bin/lanes" prepare "$device" "$layout"
 python3 "$repo/install/services.py"
 systemctl --user daemon-reload
 systemctl --user enable --now lanes-web.service lanes-mobile.service
 systemctl --user is-active --quiet lanes-web.service lanes-mobile.service
-printf '\nPhone frontend: 127.0.0.1:8083; Zellij: 127.0.0.1:8082 (loopback only).\n'
-printf 'For private HTTPS and a login token, run in your terminal:\n  sh "%s/install/enable-phone.sh" --local %s\n' "$repo" "$device"
+printf '\nWeb frontend: 127.0.0.1:8083; Zellij: 127.0.0.1:8082 (loopback only).\n'
+printf 'For private HTTPS and a login token, run in your terminal:\n  sh "%s/install/enable-phone.sh" --local %s%s\n' "$repo" "$device" "$suffix"

package/payload/lanes/install/host-install.sh

@@ -34,10 +34,15 @@ fi
 share=${LANES_SHARE:-$HOME/.local/share/lanes}
 state=${LANES_STATE:-$HOME/.local/state/lanes}
 mkdir -p "$share/bin" "$share/dl" "$state/flags"
+# The view server's PATH (bin/lanes clean_env): the Run pane that renders `lanes preview` sees this, never the
+# installer's PATH, so a glow in ~/.local/bin or ~/go/bin does not count as installed.
+pane_path=$share/bin:$repo/bin:/usr/local/bin:/usr/bin:/bin
 grep -v '^#' "$repo/holders.lock" | while read -r name version sha url; do
     [ -n "$name" ] || continue
     target=$share/bin/$name-$version
     if [ -x "$target" ]; then echo "ok  $name $version"; continue; fi
+    # The markdown preview's renderer is optional: a glow the pane can find serves `lanes preview` as well.
+    if [ "$name" = glow ] && system_glow=$(PATH=$pane_path; command -v glow); then echo "ok  glow (system: $system_glow)"; continue; fi
     archive=$share/dl/$(basename "$url")
     curl -fsSL --retry 3 -o "$archive" "$url"
     actual=$(sha256sum "$archive" | cut -d' ' -f1)
@@ -45,7 +50,11 @@ grep -v '^#' "$repo/holders.lock" | while read -r name version sha url; do
     temporary=$(mktemp -d)
     trap 'rm -rf "$temporary"' EXIT HUP INT TERM
     tar -xzf "$archive" -C "$temporary"
-    install -m 0755 "$temporary/$name" "$target"
+    binary=$temporary/$name
+    # zellij and zmx ship the binary at the top of the tarball; glow nests it in glow_<version>_Linux_x86_64/.
+    [ -f "$binary" ] || binary=$(find "$temporary" -type f -name "$name" | head -n 1)
+    [ -n "$binary" ] && [ -f "$binary" ] || { echo "no $name binary in $archive" >&2; exit 1; }
+    install -m 0755 "$binary" "$target"
     rm -rf "$temporary"
     trap - EXIT HUP INT TERM
     echo "installed $target"

package/payload/lanes/install/services.py

@@ -14,7 +14,28 @@ def unit_value(value, command=False):
     return value.replace('$', '$$') if command else value
 
 
-def register(repo, home, share, state, workspaces=None):
+# The opt-in economy poller's settings (libexec/economy_poll.py). Rendered into lanes-economy.service only, and only
+# when set in the installer's environment; the unit itself is never enabled by an install (operator gate).
+ECONOMY_SETTINGS = ('LANES_THROTTLE_CONTROL', 'LANES_THROTTLE_TOKEN_FILE', 'LANES_THROTTLE_LOG_DIR',
+                    'LANES_THROTTLE_CONTAINER')
+ECONOMY_UNITS = ('lanes-economy.service',)
+# The opt-in push notifier's config path (libexec/notify.py), rendered into lanes-notify.service only and only when
+# set in the installer's environment (a config FILE path; the ntfy token stays in the file its token_file names).
+NOTIFY_SETTINGS = ('LANES_NOTIFY_CONF',)
+NOTIFY_UNITS = ('lanes-notify.service',)
+
+
+def economy_settings(environ):
+    """The non-empty LANES_THROTTLE_* settings of `environ` (a token FILE path, never a token)."""
+    return {name: environ[name] for name in ECONOMY_SETTINGS if environ.get(name)}
+
+
+def notify_settings(environ):
+    """The non-empty LANES_NOTIFY_* settings of `environ`."""
+    return {name: environ[name] for name in NOTIFY_SETTINGS if environ.get(name)}
+
+
+def register(repo, home, share, state, workspaces=None, economy=None, notify=None):
     repo, home, share, state = (Path(p).resolve() for p in (repo, home, share, state))
     current = home / '.local/share/lanes/current'
     links = ((current, repo), (home / '.local/bin/lanes', repo / 'bin/lanes'))
@@ -25,6 +46,10 @@ def register(repo, home, share, state, workspaces=None):
     if workspaces:
         settings.append(('LANES_WORKSPACES', Path(workspaces).resolve()))
     environment = ''.join(f'Environment="{name}={unit_value(value)}"\n' for name, value in settings)
+    economy_environment = ''.join(f'Environment="{name}={unit_value(value)}"\n'
+                                  for name, value in sorted((economy or {}).items()) if name in ECONOMY_SETTINGS)
+    notify_environment = ''.join(f'Environment="{name}={unit_value(value)}"\n'
+                                 for name, value in sorted((notify or {}).items()) if name in NOTIFY_SETTINGS)
     rendered = {}
     for source in sorted((repo / 'systemd').iterdir()):
         if source.name.startswith('.') or source.suffix not in ('.service', '.timer', '.slice') or not source.is_file():
@@ -33,7 +58,9 @@ def register(repo, home, share, state, workspaces=None):
         content = content.replace('@SHARE@', unit_value(share, command=True))
         content = content.replace('@CADDY@', unit_value(shutil.which('caddy') or '/usr/bin/caddy', command=True))
         if '[Service]\n' in content:
-            content = content.replace('[Service]\n', '[Service]\n' + environment, 1)
+            extra = (economy_environment if source.name in ECONOMY_UNITS else
+                     notify_environment if source.name in NOTIFY_UNITS else '')
+            content = content.replace('[Service]\n', '[Service]\n' + environment + extra, 1)
         rendered[source.name] = '# Generated by lanes/install/services.py; re-run the server installer to update.\n' + content
     units = home / '.config/systemd/user'
     units.mkdir(parents=True, exist_ok=True)
@@ -58,4 +85,4 @@ if __name__ == '__main__':
     register(Path(__file__).resolve().parents[1], Path.home(),
              os.environ.get('LANES_SHARE', Path.home() / '.local/share/lanes'),
              os.environ.get('LANES_STATE', Path.home() / '.local/state/lanes'),
-             os.environ.get('LANES_WORKSPACES'))
+             os.environ.get('LANES_WORKSPACES'), economy_settings(os.environ), notify_settings(os.environ))

package/payload/lanes/install.sh

@@ -16,6 +16,8 @@
 #   --coder-launch    also provide the command name `coder-launch` (an existing one is kept as coder-launch-legacy)
 #   --no-desktop      skip desktop integration (Lanes.app / .desktop entry / Hyprland key binding)
 #   --no-uploads      skip the uploads watch folder and the upload helper service
+#   --palette         give the lanes window the cockpit's own Ghostty palette instead of your everyday theme
+#                     (off by default; a re-run without it puts the inherited look back)
 #   --yes             never prompt (a new key is then created WITHOUT a passphrase)
 #
 # Exit status: 0 ready to use · 3 installed, but this machine's key is not authorized on the server yet ·
@@ -35,7 +37,7 @@ stamp=$(date -u +%Y%m%dT%H%M%SZ)
 label=ai.beyondwork.lanes-upload
 helper_label=ai.beyondwork.lanes-helper
 
-mode=install device= key= site_file=$here/site/site.conf link=0 coder_launch=0 desktop=1 uploads=1 assume_yes=0
+mode=install device= key= site_file=$here/site/site.conf link=0 coder_launch=0 desktop=1 uploads=1 assume_yes=0 palette=0
 [ -r "$site_file" ] || site_file=$config/client-site.conf
 while [ $# -gt 0 ]; do
     case "$1" in
@@ -48,8 +50,9 @@ while [ $# -gt 0 ]; do
         --coder-launch) coder_launch=1 ;;
         --no-desktop) desktop=0 ;;
         --no-uploads) uploads=0 ;;
+        --palette) palette=1 ;;
         --yes|-y) assume_yes=1 ;;
-        -h|--help) sed -n '2,22p' "$0"; exit 0 ;;
+        -h|--help) sed -n '2,24p' "$0"; exit 0 ;;
         *) echo "install.sh: unknown option $1 (see --help)" >&2; exit 1 ;;
     esac
     shift
@@ -214,6 +217,108 @@ install_client() {
       cat "$target/ghostty/common.conf"
       if [ "$os" = Darwin ]; then cat "$target/ghostty/macos.conf"; else cat "$target/ghostty/omarchy.conf"; fi
     } > "$config/ghostty.conf"
+    install_palette
+}
+
+# The Ghostty binary, for its version only: on PATH, else inside the macOS app bundle.
+ghostty_bin() {
+    if command -v ghostty >/dev/null 2>&1; then command -v ghostty; return 0; fi
+    for app in /Applications/Ghostty.app "$HOME/Applications/Ghostty.app"; do
+        [ -x "$app/Contents/MacOS/ghostty" ] && { printf '%s' "$app/Contents/MacOS/ghostty"; return 0; }
+    done
+    return 1
+}
+# Ghostty >= 1.1 reads `theme = light:…,dark:…` (with absolute theme paths); unknown or older = no.
+ghostty_pairs_themes() {
+    gb=$(ghostty_bin) || return 1
+    ver=$("$gb" +version 2>/dev/null | sed -n '1s/^Ghostty \([0-9][0-9]*\)\.\([0-9][0-9]*\).*/\1 \2/p')
+    [ -n "$ver" ] || return 1
+    # shellcheck disable=SC2086  # split "MAJOR MINOR" into two words on purpose
+    set -- $ver
+    [ "$1" -gt 1 ] || { [ "$1" -eq 1 ] && [ "$2" -ge 1 ]; }
+}
+# Ghostty applies a `theme` UNDER every colour key set explicitly anywhere in the loaded configuration, whatever the
+# file order (Config.zig `loadTheme`: the theme loads, then the configuration is replayed over it). The lanes window
+# includes the everyday config first, so when that config — or a file it reaches through `config-file` (Omarchy: the
+# current theme's ghostty.conf) — sets a colour key, a theme pair would be a silent no-op.
+# And Ghostty loads `config-file` entries as ONE first-in-first-out list (Config.zig `loadRecursiveFiles` iterates the
+# list while each loaded file appends its own includes to the end): breadth-first, so a file two includes deep loads
+# after every direct include of the lanes ghostty.conf — the palette included there last included. Last assignment wins.
+# Walks the include graph from $1 the same way (bounded at 64 entries, cycle-safe: a repeat is skipped as Ghostty skips
+# it; `?`, quotes, `~/` and paths relative to the including file as Ghostty reads them) and sets
+#   ec_colour = the first file (in Ghostty's load order) that sets a colour key, empty when none does;
+#   ec_depth  = the deepest include depth of an existing file ($1 = 0, its direct includes = 1).
+scan_everyday_chain() {
+    ec_nl='
+'
+    ec_tab=$(printf '\t')
+    ec_queue="0$ec_tab$1$ec_nl" ec_seen=$ec_nl ec_n=0 ec_colour='' ec_depth=0
+    while [ -n "$ec_queue" ] && [ "$ec_n" -lt 64 ]; do
+        ec_e=${ec_queue%%"$ec_nl"*}; ec_queue=${ec_queue#*"$ec_nl"}; ec_n=$((ec_n + 1))
+        ec_d=${ec_e%%"$ec_tab"*}; ec_f=${ec_e#*"$ec_tab"}
+        case "$ec_seen" in *"$ec_nl$ec_f$ec_nl"*) continue ;; esac
+        ec_seen="$ec_seen$ec_f$ec_nl"
+        [ -f "$ec_f" ] && [ -r "$ec_f" ] || continue
+        [ "$ec_d" -gt "$ec_depth" ] && ec_depth=$ec_d
+        if [ -z "$ec_colour" ] && grep -Eq '^[[:space:]]*(background|foreground|palette|cursor-color|cursor-text|selection-background|selection-foreground)[[:space:]]*=' "$ec_f"; then
+            ec_colour=$ec_f
+        fi
+        ec_dir=$(dirname "$ec_f") ec_c=$((ec_d + 1))
+        ec_incs=$(sed -n 's/^[[:space:]]*config-file[[:space:]]*=[[:space:]]*//p' "$ec_f" \
+            | sed -e 's/[[:space:]]*$//' -e 's/^?//' -e 's/^"\(.*\)"$/\1/' -e 's/^?//')
+        while IFS= read -r ec_inc; do
+            case "$ec_inc" in
+                '') ;;
+                '~/'*) ec_queue="$ec_queue$ec_c$ec_tab$HOME/${ec_inc#"~/"}$ec_nl" ;;
+                /*) ec_queue="$ec_queue$ec_c$ec_tab$ec_inc$ec_nl" ;;
+                *) ec_queue="$ec_queue$ec_c$ec_tab$ec_dir/$ec_inc$ec_nl" ;;
+            esac
+        done <<EOF
+$ec_incs
+EOF
+    done
+}
+# --palette (spec §7): the cockpit tokens instead of the everyday theme. Two rules make it win:
+#  1. ORDER — the include is the last line of ghostty.conf, hence the last depth-1 entry of Ghostty's breadth-first
+#     list; the palette keys go in a chain of one-include hop files (ghostty-palette.conf → ghostty-palette.1.conf → …)
+#     so they sit at the everyday chain's deepest depth, where they are the last entry of that depth (every hop is its
+#     parent's only include) and nothing loads later. Omarchy's theme file sits two deep: one hop.
+#  2. KIND — a theme pair loses to ANY explicit colour key in the everyday chain (above), so the pair is installed only
+#     when that chain sets none; otherwise the explicit dark palette (last assignment wins) and `say` names the file.
+# Both rules are read from Ghostty's source, not observed on a running Ghostty here (DEF-1466 holds the live check).
+# Without the flag the include is absent and every earlier palette file is removed: inherit-first is the default.
+install_palette() {
+    rm -f "$config"/ghostty-palette*.conf
+    [ "$palette" = 1 ] || return 0
+    scan_everyday_chain "$config/ghostty.conf"
+    hops=0; [ "$ec_depth" -gt 1 ] && hops=$((ec_depth - 1))
+    keys="$config/ghostty-palette.conf" i=0
+    while [ "$i" -lt "$hops" ]; do
+        i=$((i + 1))
+        printf '%s\n' "# lanes palette hop $i of $hops (install.sh --palette): Ghostty loads includes breadth-first, so the palette" \
+            '# keys sit as deep as the everyday config'"'"'s deepest include and load after it.' \
+            "config-file = ?$config/ghostty-palette.$i.conf" > "$keys"
+        keys="$config/ghostty-palette.$i.conf"
+    done
+    cp "$target/ghostty/lanes-palette-light.conf" "$config/ghostty-palette-light.conf"
+    if ghostty_pairs_themes; then
+        if [ -n "$ec_colour" ]; then
+            cp "$target/ghostty/lanes-palette.conf" "$keys"
+            variant="dark only: $(tilde "$ec_colour") sets colours explicitly, which would override a light/dark theme pair (light variant: ghostty-palette-light.conf)"
+        else
+            # Both as theme files: explicit colours in the included file would override the pair, so it holds only this.
+            cp "$target/ghostty/lanes-palette.conf" "$config/ghostty-palette-dark.conf"
+            printf '%s\n' '# lanes cockpit palette (install.sh --palette): follows the system light/dark setting.' \
+                "theme = light:$config/ghostty-palette-light.conf,dark:$config/ghostty-palette-dark.conf" > "$keys"
+            variant='light and dark, following the system'
+        fi
+    else
+        cp "$target/ghostty/lanes-palette.conf" "$keys"
+        variant='dark (Ghostty 1.1+ follows the system; light variant: ghostty-palette-light.conf)'
+    fi
+    [ "$hops" -gt 0 ] && variant="$variant; $hops include hop(s) deep, after the everyday config's deepest include (depth $ec_depth)"
+    printf '\n# palette (install.sh --palette): the cockpit tokens instead of the everyday theme; remove with a plain re-run\nconfig-file = ?%s/ghostty-palette.conf\n' "$(tilde "$config")" >> "$config/ghostty.conf"
+    say "Ghostty palette: lanes tokens, $variant"
 }
 
 find_terminal() {
@@ -591,7 +696,7 @@ do_uninstall() {
     rm -rf "$share/client" "$state"
     # A Linux account can run both roles. Keep server catalogs and any files
     # the client did not create in the shared configuration directory.
-    rm -f "$config/device" "$config/ghostty.conf" "$config"/ghostty.*.conf \
+    rm -f "$config/device" "$config/ghostty.conf" "$config"/ghostty.*.conf "$config"/ghostty-palette*.conf \
         "$config/client-site.conf" "$config/client-known-hosts" "$config/site.cache" \
         "$config/upload-allow" "$config/uploads-dir" "$config/upload-watch.log"
     rmdir "$config" 2>/dev/null || :

package/payload/lanes/libexec/agent_state.py

@@ -0,0 +1,246 @@
+"""Agent-aware lane state from signals the harnesses already emit. Pure functions, no subprocesses.
+
+Measured 2026-10-03 on coder-dev-work: Claude Code writes ~/.claude/sessions/<pid>.json with
+status busy|idle|shell|waiting, waitingFor, name, sessionId and tmux "<session>:@<win>.%<pane>" (21/21
+live lanes matched); it never deletes them (669 files, 21 live), so liveness is /proc/<pid>. Codex sets the
+pane title "[ ! ] Action Required | <task> | <dir>" and rings BEL when it needs an approval, prefixes a
+braille spinner while working, and rings BEL on turn completion. Claude's title "✳ <name>" is static.
+
+The agent{} status vocabulary is fixed here and reused by statusd, the sidebar, the hook sidecar and the phone:
+working | needs_input | needs_approval | done | errored | shell | idle. It is a NEW key beside status.json's
+six-word `state`, never a replacement for it.
+
+Two stale-signal traps, both MEASURED 2026-10-04 on this host: (1) a Claude session file outlives its pid, and pids
+wrap (pid_max 4194304, live pids already ~2.3M), so a recycled pid would resurrect a dead session — every file
+carries `procStart` as a JSON STRING (669/669 files), equal to field 22 (starttime) of /proc/<pid>/stat, and a
+mismatch means the pid is someone else's; (2) tmux keeps a pane's title after Codex exits, so a bare shell can still
+read `<task> | <dir>` — spec §3 calls that state `shell` ("a harness that ended into a shell"), never idle/done.
+
+pane_current_command alone cannot tell (2) apart from a live harness: tmux reports the foreground process-group
+LEADER, and lanes launch harnesses non-interactively (`bash -c '<harness> …; exec bash -l'`) or through a wrapper
+script (`bash eval-claude`), where the harness shares its shell's pgid — MEASURED 2026-10-04: 21/21 live Claude
+panes and a live Codex pane report `bash` with a live harness child; Codex panes report `node` only where node IS
+the pane root. The stale panes are the ones whose shell has no child at all, so the liveness signal is
+`pane_has_child` (does pane_pid have any child process in the container's /proc). statusd computes it with
+child_liveness(): a per-pane read of /proc/<pid>/task/*/children (this kernel exposes it, CONFIG_PROC_CHILDREN —
+MEASURED 2026-10-04 on 6.8.0-106-generic), falling back to one child_parents() /proc walk only when that read
+fails; a pid whose liveness could not be determined gets no `pane_has_child` key (unknown never demotes).
+pane_current_command stays a secondary hint (a non-shell pane root such as node is the harness itself, child or not).
+"""
+import json
+import os
+from pathlib import Path
+
+SPINNER = set('⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏⠁⠂⠄⡀⢀⠠⠐⠈')
+ACTION = '[ ! ] Action Required'
+SHELL_TITLES = {'', 'work', 'bash', 'sh', 'zsh', 'fish'}
+STATUS_FROM_CLAUDE = {'busy': 'working', 'idle': 'needs_input', 'shell': 'shell', 'waiting': 'needs_input'}
+STATUSES = ('working', 'needs_input', 'needs_approval', 'done', 'errored', 'shell', 'idle')
+SHELL_COMMANDS = {'bash', 'sh', 'dash', 'zsh', 'fish', 'ksh', 'tcsh', 'csh'}
+
+
+def pane_has_child(proc_root, pid):
+    """Does `pid` have any child process? Reads every /proc/<pid>/task/<tid>/children (a child is listed under
+    the thread that forked it, so all threads are read): any non-empty -> True, all empty -> False. Any read
+    failure — pid gone, no task dir, a thread exiting mid-read, or a kernel without CONFIG_PROC_CHILDREN — is
+    None (unknown), never False. Same race caveat as child_parents(): the kernel guarantees the file only for a
+    stopped task, so a child forked or reaped during the read may be missed; one tick later it is seen."""
+    task = Path(proc_root, str(pid), 'task')
+    try:
+        tids = os.listdir(task)
+    except OSError:
+        return None
+    if not tids:
+        return None
+    for tid in tids:
+        try:
+            if Path(task, tid, 'children').read_text().split():
+                return True
+        except OSError:
+            return None
+    return False
+
+
+def child_parents(proc_root):
+    """The set of pids that have at least one child process in `proc_root` (field 4, ppid, of every
+    /proc/<pid>/stat, parsed after the last ')' since comm may contain spaces and ')'), or None when nothing could
+    be read — `proc_root` unlistable, or zero stat files parsed — so "could not look" is never "no children".
+    O(processes) (MEASURED 2026-10-04: ~140-170 ms over ~3.2k host processes), so it is only child_liveness()'s
+    fallback when the per-pane children read fails. A pid that exited mid-walk is skipped."""
+    parents = set()
+    parsed = 0
+    try:
+        names = os.listdir(proc_root)
+    except OSError:
+        return None
+    for name in names:
+        if not name.isdigit():
+            continue
+        try:
+            parents.add(int(Path(proc_root, name, 'stat').read_text().rsplit(')', 1)[1].split()[1]))
+        except (OSError, IndexError, ValueError):
+            continue
+        parsed += 1
+    return parents if parsed else None
+
+
+def child_liveness(proc_root, pids):
+    """pid -> True | False | None for each pane pid, as statusd's `pane_has_child`. pane_has_child() per pid
+    first (O(threads of that pid)); for a pid it cannot answer, one lazily computed child_parents() walk per call;
+    None when both fail. statusd sets the row key only for a non-None value, so unknown never demotes."""
+    out = {}
+    parents = walked = None
+    for pid in pids:
+        pid = int(pid)
+        has = pane_has_child(proc_root, pid)
+        if has is None:
+            if not walked:
+                parents, walked = child_parents(proc_root), True
+            has = None if parents is None else pid in parents
+        out[pid] = has
+    return out
+
+
+def _harness_ended(pane_row):
+    """True only when the row says the pane's root process has NO child (`pane_has_child is False`) and the
+    foreground is a bare shell: the harness exited into that shell, whatever title it left behind. A live
+    wrapper-launched harness is a child of the shell (has_child True); a node pane root is the harness itself (not
+    a shell). An absent or None `pane_has_child` is unknown and never demotes — the title then decides, since the
+    shell-foreground hint alone misreads every `bash -c` / wrapper launch as ended."""
+    return pane_row.get('pane_has_child') is False and _shell_foreground(pane_row)
+
+
+def _shell_foreground(pane_row):
+    """True when tmux reports a bare shell as the pane's foreground command (login '-bash' and paths normalised).
+    An absent/empty column is unknown, never a shell: the title alone then decides, as before."""
+    cmd = str(pane_row.get('pane_current_command') or '').strip().lstrip('-').rsplit('/', 1)[-1]
+    return cmd in SHELL_COMMANDS
+
+
+def _same_process(proc_root, pid, proc_start):
+    """The session file's `procStart` must equal the live pid's starttime (field 22 of /proc/<pid>/stat), else
+    the pid was recycled by an unrelated process. Claude writes procStart as a JSON string; str() normalises the
+    string and int forms alike. Unreadable stat -> treated as dead."""
+    try:
+        stat = Path(proc_root, pid, 'stat').read_text()
+        return stat.rsplit(')', 1)[1].split()[19] == str(proc_start)
+    except (OSError, IndexError):
+        return False
+
+
+def parse_codex_title(title):
+    """A Codex pane title -> {'harness','status','name'}, or None for a shell / non-agent title."""
+    t = (title or '').strip()
+    head = t.split('|')[0]
+    if t in SHELL_TITLES or (': ' in head and head.startswith(('coder@', 'root@'))):
+        return None
+    if t.startswith(ACTION):
+        rest = [p.strip() for p in t[len(ACTION):].split('|') if p.strip()]
+        return {'harness': 'codex', 'status': 'needs_approval', 'name': rest[0] if rest else ''}
+    if t and t[0] in SPINNER:
+        return {'harness': 'codex', 'status': 'working', 'name': t[1:].split('|')[0].strip()}
+    if t.startswith('✳'):
+        return None   # Claude's static title: presence only; the session file carries the state
+    if '|' in t or len(t.split()) >= 2:
+        return {'harness': 'codex', 'status': 'idle', 'name': head.strip()}
+    return None
+
+
+def claude_sessions(sessions_dir, proc_root):
+    """pane key -> agent dict, live pids only. Several files can name one pane (a resumed session leaves the
+    old pid's file behind): the newest `statusUpdatedAt` among LIVE pids wins. A file whose `procStart` does not
+    match the pid's current starttime is a recycled pid and is skipped (no `procStart` -> existence only). `proc_root` is the container's
+    /proc as seen from the host (/proc/<container-pid>/root/proc), so liveness is checked in the container's pid
+    namespace. A malformed file is skipped, never raised: one bad file costs nobody else their agent."""
+    out = {}
+    try:
+        names = os.listdir(sessions_dir)
+    except OSError:
+        return out
+    for fn in names:
+        stem = fn[:-5] if fn.endswith('.json') else ''
+        if not stem.isdigit() or not os.path.exists(os.path.join(proc_root, stem)):
+            continue
+        try:
+            d = json.loads(Path(sessions_dir, fn).read_text())
+        except (OSError, ValueError):
+            continue
+        if not isinstance(d, dict):
+            continue
+        if d.get('procStart') is not None and not _same_process(proc_root, stem, d['procStart']):
+            continue
+        key = d.get('tmux')
+        if not isinstance(key, str) or not key:
+            continue
+        try:
+            since = int((d.get('statusUpdatedAt') or 0) // 1000)
+        except (TypeError, ValueError):
+            continue
+        status = STATUS_FROM_CLAUDE.get(d.get('status'), 'idle')
+        if d.get('status') == 'waiting' and 'permission' in str(d.get('waitingFor') or '').lower():
+            status = 'needs_approval'
+        entry = {'harness': 'claude', 'status': status, 'name': str(d.get('name') or ''),
+                 'session_id': str(d.get('sessionId') or ''), 'pid': int(stem),
+                 'since': since, 'source': 'claude-session-file'}
+        if key not in out or entry['since'] >= out[key]['since']:
+            out[key] = entry
+    return out
+
+
+def read_sidecar_dict(d, now, max_age, proc_root=None):
+    """A hook-written sidecar (`~/.lz/state/hooks/<lane id>.json`, container `lane-signal`), or None when it is not
+    ours, malformed, older than `max_age` seconds, or written by an agent that no longer runs — an hour-old hook state
+    loses to the live signals (`merge` falls through to the session file / title).
+
+    Freshness is the LAST event (`at`; `since` when a writer predates `at`), while `since` is when the status began:
+    a `working` stretch re-signalled by every tool call keeps its start. lane-run's `{phase, exit, at, pid}` records
+    live one directory up and are never a sidecar (no `v`; the two writers never share a file name, DEF-1436). With
+    `proc_root` (the container's /proc as the host sees it) a recorded `pid` must be live and, when the writer
+    recorded `start`, still be the same process (field 22 of /proc/<pid>/stat, as `claude_sessions` checks Claude's
+    `procStart`): a crashed agent's last word is never published. `pid` 0 means the writer could not name its agent;
+    freshness alone then decides."""
+    if not isinstance(d, dict) or d.get('v') != 1 or d.get('status') not in STATUSES:
+        return None
+    try:
+        since = int(d.get('since') or 0)
+        at = int(d.get('at') or since)
+        pid = int(d.get('pid') or 0)
+    except (TypeError, ValueError):
+        return None
+    if since <= 0 or now - at > max_age:
+        return None
+    if proc_root is not None and pid > 0:
+        if not os.path.exists(os.path.join(proc_root, str(pid))):
+            return None
+        if d.get('start') is not None and not _same_process(proc_root, str(pid), d['start']):
+            return None
+    return {'harness': str(d.get('harness') or ''), 'status': d['status'], 'since': since,
+            'name': str(d.get('name') or ''), 'session_id': str(d.get('session') or ''),
+            'pid': pid, 'source': 'hook', 'event': str(d.get('event') or '')}
+
+
+def merge(pane_row, claude_by_pane, sidecar):
+    """Precedence: hook sidecar (event-driven, both harnesses) > Claude session file > Codex title > bell.
+    Any Codex title — idle, spinner or Action Required, bell or not — over a bare-shell pane whose shell has no
+    child process (`pane_has_child is False`, statusd's row key) publishes `shell`: the harness ended and tmux kept
+    its last title, so no ghost idle/done/working/needs_approval. Unknown liveness leaves the title in charge.
+    Returns None when nothing says an agent is here — the sidebar then draws a plain shell."""
+    if sidecar and sidecar.get('status') in STATUSES:
+        return dict(sidecar, source=sidecar.get('source') or 'hook')
+    key = f"{pane_row.get('session_name')}:{pane_row.get('window_id')}.{pane_row.get('pane_id')}"
+    if key in claude_by_pane:
+        return dict(claude_by_pane[key])
+    title = parse_codex_title(pane_row.get('pane_title'))
+    bell = pane_row.get('window_bell_flag') == '1'
+    if title:
+        if _harness_ended(pane_row):
+            title['status'] = 'shell'   # stale title on a childless shell: the harness ended, no ghost of any kind
+        elif title['status'] == 'idle' and bell:
+            title['status'] = 'done'
+        title['source'] = 'title'
+        try:
+            title['since'] = int(pane_row.get('window_activity') or 0)
+        except ValueError:
+            title['since'] = 0
+        return title
+    return None