@vibelord/lanes 1.0.3 → 1.1.0

package/README.md

@@ -4,32 +4,53 @@ npm distribution of [Lanes](../../lanes/README.md): shared agent terminals over
 registry sync, uploads and a phone interface. The package carries the committed `lanes/` tree and runs its own
 `install.sh`; every option and exit code of that installer applies unchanged.
 
-The package is **restricted** to the `@vibelord` npm organization.
+The package is **public**: installing needs no npm account or token. The only site facts it carries are the bundled
+profiles' public SSH host keys and tailnet names and addresses (reachable only inside that tailnet); access to a server
+is still its own key authorization or invite.
 
-## Install on a new Mac or Linux machine
+How to use Lanes once installed (desktop, phone and browser views, keys, uploads, operations): the
+[Lanes user guide](../../lanes/docs/USERGUIDE.md).
+
+## Join a site
 
 Requirements: Node.js 18+ (for npm only), OpenSSH, and a route to the server (Tailscale for the Beyond Work profile).
 
+A member of the site sends you an invite with a one-time code (`lanes invite` on the server). Join the tailnet with
+the Tailscale link in it, on this machine and on your phone; then:
+
 ```sh
-npm login --scope=@vibelord            # once per machine: an @vibelord member account
-npx @vibelord/lanes --site beyondwork  # install or update the client
-lanes-window                           # open the desktop view
+npx @vibelord/lanes --invite LN-xxxx-xxxxxxxxxxxx   # the prefix picks the bundled site (LN = beyondwork)
+lanes-launch                                         # your desktop view (lanes-window: in its own window)
+lanes-launch web phone                               # your phone's view: QR code of the URL, then a login token
+lanes-launch web laptop                              # this laptop's browser view
 ```
 
-Instead of `npm login`, a machine can use a **read-only** npm token (npmjs.com → Access Tokens → Granular,
-read-only, scoped to `@vibelord/lanes`):
+The wrapper prints `site beyondwork, inferred from the invite code's prefix LN` and passes the code to the installer,
+which redeems it at the server's enrolment service: `invite: redeemed — this machine's key is now authorized for
+<login> (device <device>)`. An unknown prefix is refused with the bundled list; `--site` given explicitly wins. The
+code is never printed, stored, or put on a command line. `LANES_INVITE` works like `--invite`.
+
+**Without a code:**
 
 ```sh
-printf '//registry.npmjs.org/:_authToken=%s\n' "$LANES_READ_TOKEN" >> ~/.npmrc
+npx @vibelord/lanes --site beyondwork  # install or update the client
+lanes-window                           # open the desktop view
 ```
 
-Never put the organization's publish token on an installing machine.
+When the server does not know this machine's key, the installer offers, on a terminal, to ask the site's members for
+access; a member approves it on their phone (`/enrol/pending`) or with `lanes enrol approve <id>` on the server, while
+the installer waits up to 10 minutes (`npx @vibelord/lanes --resume` waits again). Other sites pass their own profile:
+`npx @vibelord/lanes --site /path/to/site.conf`.
 
-Exit status is the installer's: `0` ready · `3` installed, but this machine's SSH key is not yet authorized on
-the server (send the printed **public** key to the admin, then run `npx @vibelord/lanes --check`) · `4` installed,
-but the server is unreachable (Tailscale?) · `1` error.
+Never put the organization's publish token on an installing machine; it needs no npm credential.
 
-Other sites pass their own profile: `npx @vibelord/lanes --site /path/to/site.conf`.
+Exit status is the installer's: `0` ready · `3` installed, but this machine's SSH key is not yet authorized on
+the server (a refused code, an unanswered request, or a server without the enrolment service: send the printed
+**public** key to the admin, then run `npx @vibelord/lanes --check`; a device name or key the server already has: run
+the printed command again with `--device NAME` or a key of its own — the invite is still valid) · `4` installed, but
+this machine is not in the
+tailnet (the installer names the Tailscale install command, or opens `tailscale login` and waits up to 120 s) or the
+server is unreachable · `1` error.
 
 ## Server
 
@@ -40,6 +61,14 @@ npx @vibelord/lanes --server --check
 npx @vibelord/lanes --server
 ```
 
+The server install also enables the enrolment service, `lanes-enrold`, that redeems invites and takes access
+requests. Once its operator check passes, pin request mode with `lanes enrol mode request` (`invite` for invites
+only), so no restart changes it. Members then invite from the server, in their own terminal, with `lanes invite <name>
+--email <address>`, decide requests with `lanes enrol approve <id>`, and remove a machine — key, browsers and phones,
+view — with `lanes offboard <device> --yes`; see the [install guide](../../lanes/docs/INSTALL.md#invite-a-user).
+Until the server runs this release, `lanes-launch web` from an updated client opens the view without a QR code and
+says the server is older.
+
 ## What the wrapper does
 
 `lanes-install` copies the bundled tree to `~/.local/share/lanes/pkg/<version>/` (`$LANES_PKG_ROOT` overrides the
@@ -50,11 +79,15 @@ server still runs from are kept.
 | Option | Effect |
 | --- | --- |
 | `--site NAME` | a bundled profile (`beyondwork`); a value with `/` or `.conf` is your own file |
+| `--invite CODE` | passed to the installer; without `--site`, the code's prefix picks the bundled profile (`LN` → `beyondwork`) |
 | `--stage-only` | stage the tree and print its path, run nothing |
 | `--version` | print the package version |
 | `--wrapper-help` | wrapper help only |
 
-Update: re-run `npx @vibelord/lanes@latest` with the same options. Remove the client: `npx @vibelord/lanes --uninstall`.
+Update: `lanes-launch update` on the client, or re-run `npx @vibelord/lanes@latest` — the installer repeats the
+options of the last install (remembered in `~/.config/lanes/install-options`; a flag given again overrides one), and
+`lanes-launch update` also gives each remembered option to it again as its flag. Remove the client:
+`npx @vibelord/lanes --uninstall`.
 
 ## Maintainers
 
@@ -67,4 +100,11 @@ scripts/publish.sh --dry-run    # then without --dry-run
 ```
 
 `publish.sh` reads the publish token from the main checkout's `.env.local` (`NPMJS2` by default; override with
-`LANES_NPM_ENV_FILE` / `LANES_NPM_TOKEN_KEY`) and hands it to npm through the environment only.
+`LANES_NPM_ENV_FILE` / `LANES_NPM_TOKEN_KEY`) and hands it to npm through the environment only. It publishes with
+`--access public`, as `publishConfig.access` says; `npm test` pins both, and fails when a bundled site profile carries
+more than its public host key, tailnet name and tailnet address, any shipped file looks like a key or token, or a
+shipped file names an e-mail address outside the example domains.
+
+Access is a setting of the whole package, not of one version: the first public publish makes every version already
+on the registry publicly installable too, including 1.0.0–1.0.4, which were published for `@vibelord` members only.
+Deprecating or unpublishing an earlier version is a separate, deliberate `npm deprecate` / `npm unpublish` step.

package/bin/lanes-install.mjs

@@ -20,7 +20,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-import { installArgs, platformError, prunable, splitArgs } from '../lib/plan.mjs';
+import { inferredSite, installArgs, platformError, prunable, splitArgs } from '../lib/plan.mjs';
 
 const packageDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const payload = path.join(packageDir, 'payload');
@@ -105,6 +105,7 @@ function prune(root, target) {
 function usage(manifest) {
   process.stdout.write(`@vibelord/lanes ${manifest.version} — installs Lanes from this package
 
+  npx @vibelord/lanes --invite LN-…            join a site with an invite code (the code's prefix picks the site)
   npx @vibelord/lanes --site beyondwork        install or update the client (macOS / Linux)
   npx @vibelord/lanes --check                  verify SSH path, key and server; changes nothing
   npx @vibelord/lanes --server                 install or update the Linux workspace server
@@ -116,6 +117,7 @@ Wrapper options
   --wrapper-help   this text
 
 Bundled site profiles: ${manifest.sites.join(', ') || 'none'} (or --site /path/to/site.conf)
+Invite prefixes: ${Object.entries(manifest.site_codes || {}).map(([p, site]) => `${p} → ${site}`).join(', ') || 'none'} (an explicit --site wins)
 Every other option goes to install.sh; its own help follows.
 
 `);
@@ -144,11 +146,15 @@ function main() {
   if (help) usage(manifest);
   if (own.has('--wrapper-help')) return 0;
   let args;
+  let inferred;
   try {
-    args = installArgs(passthrough, staged, manifest.sites);
+    const codes = manifest.site_codes || {};
+    args = installArgs(passthrough, staged, manifest.sites, codes, process.env);
+    inferred = inferredSite(passthrough, codes, process.env);
   } catch (error) {
     fail(error.message);
   }
+  if (inferred) process.stdout.write(`site ${inferred.site}, inferred from the invite code's prefix ${inferred.prefix}\n`);
   // Run through the staged path (not the npx cache), so install.sh resolves its checkout to the stable tree.
   const result = spawnSync('sh', [path.join(staged, 'install.sh'), ...args], { stdio: 'inherit', cwd: staged });
   if (result.error) fail(`could not run install.sh: ${result.error.message}`);

package/lib/plan.mjs

@@ -28,8 +28,10 @@ export function splitArgs(argv) {
 // Rewrite install.sh arguments for a staged tree:
 //   * `--site NAME` names a profile bundled under lanes/site/NAME/ (a value with a `/` or ending in `.conf` stays a
 //     path the user owns);
+//   * without `--site`, an invite code (`--invite CODE`, or LANES_INVITE in `env`) picks the bundled profile its prefix
+//     names (`LN-…` -> the site whose site.conf says LANES_SITE_CODE=LN); the code itself passes through unchanged;
 //   * `--server` must be install.sh's FIRST argument (it dispatches on $1 only).
-export function installArgs(passthrough, stagedDir, sites) {
+export function installArgs(passthrough, stagedDir, sites, siteCodes = {}, env = {}) {
   const out = [];
   let server = false;
   for (let i = 0; i < passthrough.length; i += 1) {
@@ -45,9 +47,40 @@ export function installArgs(passthrough, stagedDir, sites) {
     }
     out.push(arg);
   }
+  const inferred = inferredSite(passthrough, siteCodes, env);
+  if (inferred) out.unshift('--site', resolveSite(inferred.site, stagedDir, sites));
   return server ? ['--server', ...out] : out;
 }
 
+// The invite code of this run: the last `--invite CODE`, else LANES_INVITE; null when there is none.
+export function inviteCode(passthrough, env = {}) {
+  let code = null;
+  for (let i = 0; i < passthrough.length; i += 1) {
+    if (passthrough[i] !== '--invite') continue;
+    if (i + 1 >= passthrough.length) throw new Error('--invite CODE: the code is missing');
+    code = passthrough[i + 1];
+    i += 1;
+  }
+  if (code === null && env.LANES_INVITE) code = env.LANES_INVITE;
+  return code === null ? null : code.replace(/\s+/g, '');
+}
+
+// {site, prefix} when an invite code picks the profile (no explicit --site), else null. Messages name the prefix at
+// most, never the code: it is a secret until redeemed.
+export function inferredSite(passthrough, siteCodes, env = {}) {
+  if (passthrough.includes('--site') || passthrough.includes('--server')) return null;
+  const code = inviteCode(passthrough, env);
+  if (code === null) return null;
+  const match = /^([A-Za-z]{1,8})-[A-Za-z0-9-]+$/.exec(code);
+  if (!match) throw new Error('not an invite code (letters, digits and dashes, like LN-xxxx-xxxxxxxxxxxx)');
+  const prefix = match[1].toUpperCase();
+  if (!Object.hasOwn(siteCodes, prefix)) {
+    const known = Object.entries(siteCodes).map(([p, site]) => `${p} → ${site}`).join(', ') || 'none';
+    throw new Error(`unknown invite prefix '${prefix}' (bundled: ${known}); or pass --site /path/to/site.conf`);
+  }
+  return { site: siteCodes[prefix], prefix };
+}
+
 export function resolveSite(value, stagedDir, sites) {
   if (value.includes('/') || value.endsWith('.conf')) return value;
   if (!sites.includes(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibelord/lanes",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Installer for Lanes: shared agent terminals over SSH with Zellij views, registry sync, uploads and a phone interface.",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
     "test": "node --test"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "repository": {
     "type": "git",

package/payload/lanes/README.md

@@ -1,30 +1,67 @@
 # Lanes
 
-One setup for shared agent terminals: Zellij panes and workspace tabs, live lane status, registry sync,
-Cursor / VS Code integration, uploads, desktop launchers, and a phone interface. The complete implementation
-and its tests live in this folder.
-
-Each device gets its own view of the same long-running terminals. Closing a view or losing a connection
-leaves those terminals running in their workspace containers.
+Lanes is the shared terminal setup for long-running coding agents. The agents run in tmux sessions inside workspace
+containers on one Linux host; every device you use gets its own live view of the same terminals: Zellij workspace
+tabs with a lane sidebar that sorts the agents that need you to the top, registry sync from the repositories'
+terminal lists, Cursor / VS Code integration, file uploads, desktop launchers, and a phone, tablet and laptop browser
+interface. The complete implementation and its tests live in this folder.
+
+**Start here: the [Lanes user guide](docs/USERGUIDE.md)** covers daily use on every surface, every key, sidebar
+glyph and command, installation and updates, and the operations reference.
+
+Closing a view or losing a connection leaves the terminals running in their workspace containers: a lane ends only
+when someone closes it explicitly.
+
+**Who uses it.** Operators and teammates who run several Claude Code or Codex agents at once use Lanes daily to see
+which lane needs them, switch to it, answer, and move on, from a desk or from a phone. An administrator installs the
+server once on the workspace host. Any member invites a new person with `lanes invite`, and that person joins from
+their own Mac or Linux machine with one command, `npx @vibelord/lanes --invite <code>`, which installs the client and
+authorizes the machine.
+
+**Three surfaces, one set of lanes:**
+
+| Surface | How you reach it | Typical use |
+| --- | --- | --- |
+| Desktop terminal | `lanes-window` (own Ghostty window) or `lanes-launch` in any terminal, over SSH | Daily work: workspace tabs, the sidebar, one to three lanes side by side |
+| Browser | `lanes-launch web phone` or `lanes-launch web laptop` from a client: a private URL over Tailscale with a login token (on a phone, Add to Home Screen) | Checking and answering agents away from the desk |
+| Editor | Cursor / VS Code terminals that run `lane open <lane-id>` inside the container | Opening the same lane next to the code |
+
+**How it relates to the rest of the repository.**
+
+- **Throttle**: Lanes runs without it. With the opt-in economy poller, the sidebar shows what the fleet spends and
+  which lanes are starving, downgraded or mostly paid, read from the Throttle daemon. A lane created with the
+  canonical recipe sends a `lanes/<workspace>/<lane>` trace to the Throttle proxy (enabling that on a live workspace is
+  an operator decision).
+- **Throttle Studio**: a second client of the same lanes. Its **Shared lanes** console gives teammates a read-only,
+  SSO-protected view of selected workspaces, and one co-located Studio Host can serve every workspace of a Lanes server
+  ([sharing](docs/SHARING.md)).
+- **Cursor / VS Code**: each repository's `.vscode/terminals.json` is the source of truth for its lanes;
+  `lanes cursor-sync` points the editor's terminals at the same tmux sessions the views show.
 
 ```text
-Mac / Linux terminal ── SSH ───────┐
-                                 ├─ Linux workspace host ── container tmux sessions
-Safari / Home Screen ── HTTPS ────┘      Zellij views            agent lanes
-                                       registry + status
+Mac / Linux terminal ──── SSH ───────┐
+                                     ├─ Linux workspace host ── container tmux sessions ── Cursor / VS Code
+Phone / tablet / laptop ── HTTPS ────┘      Zellij views            agent lanes            `lane open <id>`
+  browser (Tailscale)                      registry + status
 ```
 
 ## Quick start
 
-**New Mac or Linux machine, from npm** (members of the `@vibelord` npm organization; Node.js 18+ for npm only):
+**Join a site with an invite** (public npm package, no npm login; Node.js 18+ for npm only). Join the tailnet with
+the Tailscale link in the invite, then:
 
 ```sh
-npm login                                 # once per machine
-npx @vibelord/lanes --site beyondwork     # install or update; no clone needed
-lanes-window
+npx @vibelord/lanes --invite LN-xxxx-xxxxxxxxxxxx   # installs the client and authorizes this machine
+lanes-launch                                         # your desktop view (lanes-window: in its own window)
+lanes-launch web phone                               # your phone's view: QR code of the URL, then a login token
+lanes-launch web laptop                              # this laptop's browser view
 ```
 
-The package runs the same installer with the same options and exit codes; see [`npm/lanes`](../npm/lanes/README.md).
+The code's prefix picks the site. Without a code, `npx @vibelord/lanes --site beyondwork` installs the client and, in
+your own terminal, offers to ask the site's members for access; a member approves it on their phone or with
+`lanes enrol approve <id>`. Later, `lanes-launch update` updates the client with the same choices. See the user
+guide's [Join a site](docs/USERGUIDE.md#2-join-a-site). The package runs the same
+installer with the same options and exit codes; see [`npm/lanes`](../npm/lanes/README.md).
 
 **From a checkout:** clone the repository once on each machine that needs it:
 
@@ -47,9 +84,13 @@ Beyond Work's existing deployment has an explicit profile:
 ```
 
 The client works on macOS and Linux. It needs OpenSSH and a route to the server (Tailscale for the supplied
-profile). Ghostty is recommended for a separate window; `lanes-launch` works in an existing terminal.
-The installer uses an existing SSH key or creates a dedicated one. An administrator authorizes its **public**
-key on the server. Re-run `./install.sh --check` after authorization. Your selected site is remembered.
+profile: the installer checks it first, names the install command when it is missing and opens `tailscale login`
+when this machine is logged out). Ghostty is recommended for a separate window; `lanes-launch` works in an existing
+terminal.
+The installer uses an existing SSH key or creates a dedicated one. An invite code or an approved access request
+authorizes it through the server's enrolment service; otherwise an administrator authorizes its **public** key on the
+server (`lanes keys add`). Re-run `./install.sh --check` after authorization. Your site and every other install choice
+are remembered.
 
 When an ended view was rebuilt on the server, the client probes that state and reconnects
 automatically. The probe's watchdog cancels and reaps its timer when the probe completes;
@@ -64,39 +105,49 @@ client installer after updating their checkout.
 ./install.sh --server
 ```
 
-Then configure the workspace catalog and install the container helper. Follow the
-[installation guide](docs/INSTALL.md) for prerequisites, a complete example, phone access, upgrades and removal.
+Then configure the workspace catalog and install the container helper — for one user's container, `lanes onboard`
+does both and attaches its agents. Follow the [installation guide](docs/INSTALL.md) for prerequisites, a complete
+example, invites, phone access, upgrades and removal.
 The installer starts an empty catalog safely; it does not assume anyone's containers, projects or login name.
 
 ## Daily use
 
 | Action | Command or control |
 | --- | --- |
+| Join a site from a new machine | `npx @vibelord/lanes --invite <code>` with the code from a member's invite: installs the client, authorizes this machine, then `lanes-launch`, `lanes-launch web phone`, `lanes-launch web laptop`. Without a code the installer asks the site's members for access ([guide](docs/USERGUIDE.md#2-join-a-site)) |
 | Open desktop view | `lanes-window` or the Lanes app; `lanes-launch` inside any terminal |
 | Independent second view | `lanes-window 2` |
 | Two or three panes per workspace | `lanes-window w2` / `lanes-window w3` |
 | Switch workspace | Ctrl–Alt–Left / Right |
 | Next or previous lane | Ctrl–Alt–Down / Up (the focused pane moves to the next / previous lane of its workspace; nothing is typed, the focus stays), or tap the sidebar |
 | Plain-ASCII glyphs, light or dark tokens | `lanes-window --ascii`, `lanes-window --light` / `--dark` (remembered per device in `devices/<device>.json`; a running sidebar picks it up within one tick) |
-| Lock the view (every key reaches the lane) | Ctrl–Alt–G, again to unlock; the bar shows LOCKED in red. Ctrl–G itself always reaches the lane (Claude Code's editor key) |
-| Search lanes | Ctrl–Alt–/ |
+| Lock the view (plain keys and Zellij's mode keys reach the lane) | Ctrl–Alt–G, again to unlock; the bar shows LOCKED in red. The Ctrl–Alt keys of `zellij/config.kdl`'s `shared` block (←/→/↓/↑, `/`, U, C, S, PageUp/PageDown/End) stay active while locked. Ctrl–G itself always reaches the lane (Claude Code's editor key) |
+| Zellij modes | Ctrl–Alt–P pane · Ctrl–Alt–T tab · Ctrl–Alt–N resize · Ctrl–Alt–H move · Ctrl–Alt–F scroll · Ctrl–Alt–O session (`d` detaches) · Ctrl–Alt–B tmux-style; Esc returns to normal. Every key: [user guide](docs/USERGUIDE.md#keybindings) |
+| Search lanes | Ctrl–Alt–/, or `/` in the sidebar: fuzzy (the letters in order, substring and prefix matches first); Enter opens the match under the cursor, Esc clears |
 | Select a lane for pane 2 or 3 | `2` / `3` in the sidebar of a wide view |
 | Open one lane directly | `lanes-launch lane <lane-id>`; find IDs with `lanes-launch ls` |
 | Read a markdown file a lane mentioned | Ctrl–Alt–M opens a floating **Preview** pane over the focused lane: the `.md` paths it printed in its last 300 lines that exist in its container (relative ones resolved against its working directory). One is shown at once; several give a numbered menu, newest first (Enter = the newest, `q` closes). Rendered by `glow` in the view's dark/light theme (the server installer adds a pinned glow unless the view server's PATH — `~/.local/share/lanes/bin`, the checkout's `bin`, `/usr/local/bin`, `/usr/bin`, `/bin` — already has one; a glow only in `~/.local/bin` or `~/go/bin` does not count), else `less -R`; `lanes doctor` names which (`preview renderer:`); quitting the pager closes the pane |
-| Create a persistent workspace shell | **+ New shell** under **Unregistered** (**New +** on the phone), or `+` in the sidebar |
-| Register an existing session | **+** beside an unregistered session, or select it and press `a`; choose a workspace |
+| Create a persistent workspace shell | The **+ New shell** row under **Unregistered** (desktop sidebar and phone picker), or `+` in the sidebar |
+| Register an existing session | **+** beside an unregistered session, or select it and press `a`; choose a workspace (`lanes register <lane-id> [workspace]` on the server) |
+| Declare a session in the repository | `P` in the sidebar, then `y`: writes the session's binding into the workspace's one repository `terminals.json`, so it becomes a repository lane `<workspace>--<slug>` |
+| Rename a lane | `R` in the sidebar (Enter saves, Esc cancels), or `lanes rename <lane-id> <name>` on the server; the lane id never changes |
+| Add a workspace (board) | `lanes workspaces add <id> --container <name> --repo /home/coder/<repo> [--title T]` on the server prints the catalog and manifest diff; add `--write` to apply, then `lanes sync` ([install](docs/INSTALL.md#2-configure-workspaces-and-editor-sync)) |
+| Onboard a user's container | `lanes onboard <login> --container <name> --workspace <id> --repo /home/coder/<repo>` on the server prints every step (board, contract, Claude and Codex hooks, Throttle attachment, canonical recipes, sync, doctor); add `--write` to apply them and keep a receipt ([install](docs/INSTALL.md#onboard-a-users-container)) |
 | See which agents need you | The sidebar sorts **Needs you** (◆ approval, ✗ error, ◇ waiting for a prompt), **Working** (▸) and **Done** (✓, until you open the lane) above the rest; the header counts them in the same glyphs (`◆1 ◇2 ▸6 ✓1`, zeros left out; `N lanes` when no lane runs an agent) |
 | Read a sidebar row | `▌` cursor · agent glyph · `›` the lane this pane shows (`²`/`³`: shown in pane 2/3) · the name (`·` per other viewer, `…` when clipped) · an **age column** on every row (agent turn, else last output: `45s`, ` 3m`, ` 2h`, ` 4d`; amber in **Needs you**) · stream glyph · one tail cell by priority (`?` not observed right now > `⚠` starving: producing output but no request for over 10 min, or a 429 > `↓` downgraded > `$` mostly paid — the economy cells need the opt-in economy poller; a dim `⚠`/`↓` is a frozen last-known figure, not a live alarm) · `×` close. `⋮ N more` ends a list that continues below |
 | End an unregistered session and its jobs | **×** beside the session, or select it and press `x`; confirm with `y` (any other key cancels) |
 | Every sidebar key | `?` replaces the list with the key sheet until the next key (that key only closes it). The footer legend says ` ⏎ open · / find · x close · ? keys`; prompts share one shape (` › close ‘name’? y/n`, ` › Rename: …█`, ` › Register ‘name’? y/n`) and a filter counts its matches (` /abc · 3 matches`) |
-| Jump to the next lane that needs you | `Tab` / `Shift-Tab` in the sidebar (cycles **Needs you** from the lane the pane shows; the pane title carries the counts and a lane that starts needing you raises one OSC 9 desktop notification — `LANES_NOTIFY=0` silences it) |
+| Jump to the next lane that needs you | `Tab` / `Shift-Tab` in the sidebar (cycles **Needs you** from the lane the pane shows; the pane title carries the counts and a lane that starts needing you raises one OSC 9 desktop notification on desktop layouts — `LANES_NOTIFY=0` in the sidebar's environment silences it, see the [user guide](docs/USERGUIDE.md#9-appearance) for how environment variables reach a sidebar) |
 | Other workspaces that need you | The row above the footer rule: ` ◆1 Worlds · ◇2 Code` (blank and absent when none; panes of 18 rows or more) |
 | What the fleet spends | With the opt-in economy poller ([RUNBOOK](docs/RUNBOOK.md#economy-projection-opt-in)) the same row is the fleet economy strip instead: ` $8.5k/16k 53% · F2 S1 · spill 76% · free 3/19` — overflow spend against the daily cap (amber at the alert level), new upstream 429s, this workspace's lanes by model tier (`F` fable, `O` opus, `S` sonnet, `H` haiku, `G` gpt), the pool's spill fraction, free accounts and the next 5 h reset, whole parts dropped from the end to fit; a leading `?` means the figures are frozen — the poller could not reach the daemon, or it stopped (no rewrite for over 3 min) |
 | Upload | Click the one-row upload strip above the footer (` ↑ uploads · click, then drop  (U)`) or press `U`, then drop anywhere on the window; or use `~/Lanes Uploads/<workspace>/`, or `lanes-upload <files>` |
-| Phone setup from a client | `sh install/enable-phone.sh --host lanes` |
-| Laptop or tablet browser view | `lanes web <device> --desktop [--token]` on the server, or `sh install/enable-phone.sh --host lanes --desktop <device>` ([guide](docs/INSTALL.md#laptop-and-tablet-browser)) |
+| Phone view from a client | `lanes-launch web phone` in your own terminal: prepares `<your device>-phone` (phone layout), makes Tailscale Serve forward private HTTPS 8443 when the mapping is missing, prints the private URL with a QR code of it and a login token; scan the code or open the URL in Safari. `sh install/enable-phone.sh --host lanes` is the older one-shot for the device `phone` ([guide](docs/USERGUIDE.md#phone-safari-home-screen)) |
+| Laptop or tablet browser view | `lanes-launch web laptop` (`<your device>-web`, desktop layout) or `lanes-launch web <device> [--desktop\|--mobile]` from a client; on the server `lanes web <device> [--desktop\|--mobile] [--viewports N] [--token \| --print-only]` (prepares the view, enables the loopback web services, adds the Tailscale Serve `https:8443` mapping when missing, prints the private URL) ([guide](docs/INSTALL.md#laptop-and-tablet-browser)) |
+| Web login tokens | `lanes token list` (each token with the device it was created for), `lanes token revoke <device>`, `lanes token revoke-all --yes` ([runbook](docs/RUNBOOK.md#login-tokens)) |
+| Update the client | `lanes-launch update` (the newest client from npm with your remembered install options; flags you add win). A client older than the server says so in one dim line when it attaches |
 | Switch workspace or lane in a laptop browser | The **Lanes** chip (top right) opens the workspace and lane pickers |
-| Detach | Close the window; the agents keep running |
+| Invite a teammate, approve a machine, remove one | On the server, in your own terminal: `lanes invite <name> --email <addr>` prints a five-line welcome kit with a one-time code (shown once, on a terminal only); `lanes enrol list` / `lanes enrol approve <id>` decide machines that asked without a code; `lanes enrol mode request` pins request mode once the Serve header check passed; `lanes offboard <device> --yes` revokes a machine's key, signs its browsers and phones out and ends its view ([guide](docs/USERGUIDE.md#invite-a-user-administrator), [install](docs/INSTALL.md#offboard-a-machine)) |
+| Detach | Close the window, or Ctrl–Alt–O then `d`; the agents keep running |
 
 Unregistered sessions also appear when they use shared or previously unlisted tmux servers. Reopening a
 session reuses it; closing a view leaves it running. Registered lanes have no **×** control. See the
@@ -180,13 +231,19 @@ See [workspace configuration](workspaces.example/README.md) and the [architectur
 | `site/`, `workspaces.example/` | Deployment profiles and editable configuration examples |
 | `sudo/` | Optional administrator setup and host protection, applied explicitly |
 | `tests/` | Unit tests plus isolated host/container integration suites |
-| `docs/` | [Install](docs/INSTALL.md), [architecture](docs/ARCHITECTURE.md), [operations](docs/RUNBOOK.md), [host guard](docs/HOST-GUARD.md) |
+| `docs/` | [User guide](docs/USERGUIDE.md), [install](docs/INSTALL.md), [architecture](docs/ARCHITECTURE.md), [operations](docs/RUNBOOK.md), [design](docs/DESIGN.md), [sharing](docs/SHARING.md), [host guard](docs/HOST-GUARD.md) |
 
 ## Update and verify
 
-After `git pull`, clients re-run `./install.sh`; servers re-run `./install.sh --server` from their installed
-checkout. The server installer resolves the checkout's actual path, including `bw-tools/lanes`; no `~/lanes`
-clone is required. It preserves configured workspaces and existing agent sessions.
+After `git pull`, clients re-run `./install.sh` (it repeats the options remembered in
+`~/.config/lanes/install-options`); servers re-run `./install.sh --server` from their installed checkout. npm
+client installations update with `lanes-launch update` (`npx @vibelord/lanes@latest` with those options given again
+as flags); a server updates with `npx @vibelord/lanes@latest --server` on the host. After a server
+update, restart `lanes-statusd.service` (and `lanes-web`/`lanes-mobile` when their units or the pinned Zellij
+changed); existing views keep their layout until `lanes rebuild <device>`. `lanes hello` prints the server's
+version ([user guide](docs/USERGUIDE.md#update)). The server installer resolves the checkout's actual path,
+including `bw-tools/lanes`; no `~/lanes` clone is required. It preserves configured workspaces and existing agent
+sessions.
 
 ```sh
 ./install.sh --check                       # client connectivity
@@ -201,7 +258,8 @@ For recovery, service updates and troubleshooting, see the [runbook](docs/RUNBOO
 
 The host's site catalog (`LANES_WORKSPACES/catalog.json`, normally
 `~/.config/lanes/workspaces/catalog.json`) is the workspace authority. Add its
-manifest there and run `lanes sync`. The existing sync timer refreshes it every
+manifest there (`lanes workspaces add <id> --container <name> --repo <path>
+--write` writes a one-repository board) and run `lanes sync`. The existing sync timer refreshes it every
 2 minutes; the ensure timer also reconciles known device sessions every minute.
 New desktop and phone tabs appear without rebuilding sessions or restarting
 agents. Changing a catalog title renames the existing tab using its workspace ID.

package/payload/lanes/VERSION

@@ -1 +1 @@
-1.0.3
+1.1.0