@warren-dean/code-kit 0.9.1 → 0.11.0

package/hooks/lib/next.mjs

@@ -9,6 +9,8 @@ import { buildStatus, readStories, DESIGN, LEAD } from './plan.mjs';
 import { pendingSetup } from './adapters/index.mjs';
 import { CONFIG_FILE, SETUP_VERSION } from './config.mjs';
 import { readQueue, waiting } from './queue.mjs';
+import { laneOf } from './rules.mjs';
+import { SECURITY_AGENT_FILE } from './security.mjs';
 
 export const DRAFT_FILE = '.claude/code-kit.draft.json';
 export const BRIEF_STATES = ['framed', 'explored', 'scoped', 'specified', 'planned', 'ready'];
@@ -149,11 +151,17 @@ export function nextStep(root, base) {
   }
   const [setup] = pendingSetup(raw, root);
   if (setup) return result('setup', setup.why, { args: setup.skill });
-  // ONB-5: a project set up before setup did all of this is told what re-running init adds.
-  if ((raw?.setup ?? 1) < SETUP_VERSION)
+  // ONB-5: a project set up before setup did all of this is told what re-running init adds; when
+  // ONB-6 finds what it's missing, no new story starts until init has added it.
+  const older = (raw?.setup ?? 1) < SETUP_VERSION;
+  const gaps = older ? setupGaps(config, readStories(root, plan), files) : [];
+  if (older && !gaps.length)
     attention.push(
-      "This project's code-kit setup predates what init now sets up: project skills with each lane agent, designs approved before screens are built, a QA lane for end-to-end tests, and companion tools set up before coding. Re-run /code-kit:init to add what's missing; it keeps everything that's still right and shows you the difference first.",
+      "This project's code-kit setup predates what init now sets up: project skills with each lane agent, designs approved before screens are built, a QA lane for end-to-end tests, a security reviewer that checks each sensitive change as an attacker would, and companion tools set up before coding. Re-run /code-kit:init to add what's missing; it keeps everything that's still right and shows you the difference first.",
     );
+  const missingWords = gaps.length
+    ? `This project's setup is missing what init now sets up: ${gaps.join('; ')}.`
+    : '';
   // ONB-1: a lane agent naming a skill that doesn't exist works without the recipe it was given.
   for (const missing of missingSkills(root)) attention.push(missing);
 
@@ -194,6 +202,16 @@ export function nextStep(root, base) {
   // ONB-2: design stories, designed with the person before any screen that depends on them is built.
   const forDesign = readyStories.filter((s) => buildable(s) && s.lane === DESIGN).map((s) => s.id);
   const unbuildable = readyStories.filter((s) => !buildable(s)).map((s) => s.id);
+  // ONB-6: work already started finishes; nothing new starts until init has filled the gaps.
+  const held = gaps.length
+    ? [...ready, ...forDesign, ...forLead].sort((a, b) => a.slice(3) - b.slice(3))
+    : [];
+  if (held.length) {
+    ready.length = forDesign.length = forLead.length = 0;
+    attention.push(
+      `${missingWords} ${held.join(', ')} ${held.length === 1 ? 'waits' : 'wait'} until /code-kit:init has added it.`,
+    );
+  }
   if (unbuildable.length)
     attention.push(
       `${unbuildable.join(', ')} can't be dispatched until the plan's gaps are fixed.`,
@@ -262,6 +280,12 @@ export function nextStep(root, base) {
       `${forLead.join(', ')} ${forLead.length === 1 ? 'is' : 'are'} the lead's own: build ${forLead.length === 1 ? 'it' : 'them'} on ${forLead.map((id) => `lead/${id.toLowerCase()}`).join(', ')}, then review like any branch.`,
       { args: forLead.join(' ') },
     );
+  // ONB-6: with nothing in flight, the setup is brought up to date before the next story.
+  if (gaps.length && !building.length && !queued.length)
+    return result(
+      'update',
+      `${missingWords} Re-run /code-kit:init before the next story: it shows the person the difference before anything changes.`,
+    );
   if (building.length)
     return result(
       'wait',
@@ -294,6 +318,66 @@ export function nextStep(root, base) {
   );
 }
 
+const SCREEN_LANE = /(^|-)(web|mobile|frontend|front-end|ui|desktop|ios|android|admin|portal)(-|$)/;
+const SCREEN_FILE = /\.(tsx|jsx|vue|svelte|swift|dart)$/;
+const TEST_FILE = /(^|\/)(__tests__|e2e|tests?)\/|\.(test|spec|stories)\.\w+$/;
+const QA_LANE = /(^|-)(qa|e2e|tests?)(-|$)/;
+
+/**
+ * ONB-6: what a setup older than init's is missing, in words, from the config, the plan and the code.
+ * A lane owns screens when its name or agent says so (web, mobile, desktop…) or it holds screen
+ * files. It's missing the design gate, design stories before the screen stories not yet started, and a
+ * QA lane for the end-to-end suites; and, with or without screens, the security reviewer (ONB-7), when
+ * its agent file isn't among the tracked files.
+ */
+export function setupGaps(config, stories, files = []) {
+  const gaps = screenGaps(config, stories, files);
+  if (!files.includes(SECURITY_AGENT_FILE))
+    gaps.push(
+      `a security reviewer (${SECURITY_AGENT_FILE}) that checks each change touching sign-in, permissions, personal data, payments, secrets or dependencies as an attacker would`,
+    );
+  return gaps;
+}
+
+/** ONB-6: the gaps of a setup whose lanes own screens: the design gate, design stories, a QA lane. */
+function screenGaps(config, stories, files) {
+  const lanes = Object.entries(config.lanes);
+  const holdsScreens = new Set(
+    files.filter((f) => SCREEN_FILE.test(f) && !TEST_FILE.test(f)).map((f) => laneOf(f, config)),
+  );
+  const screens = lanes
+    .filter(
+      ([name, l]) => SCREEN_LANE.test(name) || SCREEN_LANE.test(l.agent) || holdsScreens.has(name),
+    )
+    .map(([name]) => name);
+  if (!screens.length) return [];
+  const gaps = [];
+  const list = (names) => names.join(', ').replace(/, ([^,]*)$/, ' and $1');
+  if (!config.designGate)
+    gaps.push(
+      `a design gate for ${list(screens)}, so screens are built only from approved designs`,
+    );
+  // A screen story not yet started, with no design story among everything it depends on.
+  const byId = new Map(stories.map((s) => [s.id, s]));
+  const designed = (s, seen = new Set()) =>
+    s.dependsOn.some((d) => {
+      if (seen.has(d)) return false;
+      seen.add(d);
+      const dep = byId.get(d);
+      return dep && (dep.lane === DESIGN || designed(dep, seen));
+    });
+  const undesigned = stories
+    .filter((s) => screens.includes(s.lane) && ['todo', 'ready'].includes(s.status) && !designed(s))
+    .map((s) => s.id);
+  if (undesigned.length)
+    gaps.push(
+      `design stories before the screens: ${list(undesigned)} ${undesigned.length === 1 ? 'is' : 'are'} planned with no design to build from`,
+    );
+  if (!lanes.some(([name, l]) => QA_LANE.test(name) || QA_LANE.test(l.agent)))
+    gaps.push('a QA lane with a test-engineer for the end-to-end tests of the journeys');
+  return gaps;
+}
+
 /** The code-kit skills every agent may name without a project copy. */
 const KIT_SKILLS = (() => {
   try {

package/hooks/lib/plan.mjs

@@ -20,7 +20,8 @@ export const DESIGN = 'design';
 const TEST =
   /(^|\/)(tests?|__tests__|e2e)\/|\.(test|spec)\.[^/]+$|_test\.(go|py)$|(^|\/)test_[^/]+\.py$/;
 
-const markdownFiles = (root, path) => {
+/** The markdown files at `path`: the file itself, or every one under the folder, sorted. */
+export const markdownFiles = (root, path) => {
   const full = join(root, path);
   if (!existsSync(full)) return [];
   if (statSync(full).isFile()) return path.endsWith('.md') ? [path] : [];

package/hooks/lib/security.mjs

@@ -0,0 +1,180 @@
+// ONB-7: which branches the security reviewer looks at. Security is a reviewer, not a lane: it owns no
+// paths and checks everyone's work. A story's change gets the security review when it touches sign-in,
+// permissions, outside input, personal data, encryption, payments, secrets or commands built from
+// strings, adds dependencies, or cites a requirement from a spec's `## Security requirements`. Read
+// from git (base...branch): the files changed and the lines added, tests and docs left out.
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isDependencyFile } from './dependencies.mjs';
+import { markdownFiles, readStories } from './plan.mjs';
+import { storyOfBranch } from './teamfacts.mjs';
+
+export const SECURITY_AGENT = 'security-reviewer';
+export const SECURITY_AGENT_FILE = `.claude/agents/${SECURITY_AGENT}.md`;
+
+// Tests, docs and design files describe the change; the review looks at the code that ships.
+const NOT_SHIPPED =
+  /(^|\/)(tests?|__tests__|e2e|docs?|design)\/|\.(test|spec|stories)\.[^/]+$|_test\.(go|py)$|(^|\/)test_[^/]+\.py$|\.(md|mdx|txt|png|jpe?g|gif|svg|webp)$/i;
+
+/**
+ * What makes a change sensitive, by kind: `path` matches a changed file's path, `code` (one pattern or
+ * several) an added line.
+ * Each kind reads as the reason a person is given.
+ */
+export const SENSITIVE = [
+  {
+    kind: 'sign-in',
+    why: 'sign-in or sessions',
+    path: /(^|[/_.-])(auth\w*|login|logout|sign-?in|sign-?up|sessions?|oauth|sso|jwt|passwords?|mfa|otp)([/_.-]|$)/i,
+    code: /\b(signIn|signOut|login|logout|getSession|setSession|jwt\.(sign|verify)|jsonwebtoken|passport\.|bcrypt|argon2|verifyPassword|hashPassword|Set-Cookie|cookies\(\)|httpOnly)\b/,
+  },
+  {
+    kind: 'permissions',
+    why: 'permissions',
+    path: /(^|[/_.-])(permissions?|roles?|rbac|acl|polic(y|ies)|guards?|middleware|authori[sz]\w*)([/_.-]|$)/i,
+    code: [
+      /\b(isAdmin|hasRole|hasPermission|can[A-Z]\w*|[Aa]uthori[sz]e\w*|requireRole)\b/,
+      /\b(enable row level security|create policy|grant\s+\w+\s+on)\b/i,
+    ],
+  },
+  {
+    kind: 'input',
+    why: 'input from outside (requests, forms, uploads, webhooks)',
+    path: /(^|[/_.-])(webhooks?|uploads?|handlers?)([/_.-]|$)|(^|\/)(api|routes?)\/|(^|\/)route\.[jt]s$/i,
+    code: /\b(req\.(body|query|params|files?)|request\.(json|form|args|body)\(?|formData\(\)|searchParams|FormData|multer|busboy|ctx\.request\.body|@Body\(|@Query\(|@Param\()/,
+  },
+  {
+    kind: 'personal data',
+    why: 'personal data',
+    path: /(^|[/_.-])(users?|profiles?|accounts?|customers?|patients?|members?|children|students?|contacts?)([/_.-]|$)/i,
+    code: /\b(email|phone(_?number)?|date_?of_?birth|dob|home_?address|street_?address|passport|tax_?file|national_?id|medicare|ssn|first_?name|last_?name|full_?name)\b/i,
+  },
+  {
+    kind: 'encryption',
+    why: 'encryption, hashing or random values',
+    path: /(^|[/_.-])(crypto|encrypt\w*|decrypt\w*|ciphers?|hash(ing)?|keys?|kms|signing)([/_.-]|$)/i,
+    code: /\b(createCipheriv|createDecipheriv|createHash|createHmac|randomBytes|Math\.random|crypto\.subtle|md5|sha1|AES|RSA|hashlib|Fernet)\b/,
+  },
+  {
+    kind: 'payments',
+    why: 'payments',
+    path: /(^|[/_.-])(payments?|billing|checkout|invoices?|stripe|subscriptions?|refunds?|payouts?|wallet)([/_.-]|$)/i,
+    code: /\b(stripe|paymentIntent|checkout\.sessions|charge|refund|payout|amount_?cents)\b/i,
+  },
+  {
+    kind: 'secrets',
+    why: 'secrets or credentials',
+    path: /(^|\/)\.env(\.|$)|(^|[/_.-])(secrets?|credentials?|tokens?)([/_.-]|$)/i,
+    code: /\b(api_?key|secret_?key|client_?secret|private_?key|access_?token|refresh_?token|password\s*[:=])/i,
+  },
+  {
+    kind: 'injection',
+    why: 'queries, commands, templates or redirects built from strings',
+    code: /(\$queryRawUnsafe|\$executeRawUnsafe|\.raw\(|sql\.unsafe|execute\(\s*[`'"]?\s*(select|insert|update|delete)\b.*(\$\{|\+)|child_process|\bexec(Sync)?\(|\bspawn(Sync)?\(|subprocess\.|os\.system|\beval\(|new Function\(|dangerouslySetInnerHTML|\.innerHTML\s*=|v-html|\{\{\{|pickle\.loads|yaml\.load\(|unserialize\(|res\.redirect\(|redirect\(\s*(req|request|params|searchParams)|fetch\(\s*(req|request|params|body|url)\b)/i,
+  },
+];
+
+/**
+ * The requirement IDs of each spec's `## Security requirements` section (spec-design writes a spec's
+ * security requirements there, as `### AREA-n` headings like any other requirement).
+ */
+export function securityRequirementIds(texts) {
+  const ids = new Set();
+  for (const text of texts) {
+    let inSecurity = false;
+    for (const line of text.split('\n')) {
+      if (/^##\s/.test(line)) inSecurity = /^##\s+Security requirements\b/i.test(line);
+      const m = inSecurity && line.match(/^###\s+((?!ST-)[A-Z][A-Z0-9]*-\d+)\b/);
+      if (m) ids.add(m[1]);
+    }
+  }
+  return ids;
+}
+
+/** Added lines of a unified diff (`git diff -U0`): [{ file, line, text }]. */
+export function addedLines(diff) {
+  const added = [];
+  let file = null;
+  let line = 0;
+  for (const l of diff.split('\n')) {
+    if (l.startsWith('+++ ')) {
+      file = l === '+++ /dev/null' ? null : l.slice(4).replace(/^b\//, '');
+      continue;
+    }
+    const hunk = l.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+    if (hunk) {
+      line = Number(hunk[1]);
+      continue;
+    }
+    if (!file) continue;
+    if (l.startsWith('+')) added.push({ file, line: line++, text: l.slice(1) });
+    else if (l.startsWith(' ')) line++;
+  }
+  return added;
+}
+
+const examples = (list) =>
+  `${list.slice(0, 3).join(', ')}${list.length > 3 ? ` and ${list.length - 3} more` : ''}`;
+
+/**
+ * Why a change needs the security review, in words, one per kind: [{ kind, why, where: [...] }].
+ * Empty when it touches nothing sensitive. `files` are the changed files, `added` the added lines,
+ * `cites` the story's requirements and `security` the IDs of the specs' security requirements.
+ */
+export function securityReasons({ files = [], added = [], cites = [], security = new Set() }) {
+  const reasons = [];
+  const shipped = files.filter((f) => !NOT_SHIPPED.test(f));
+  const lines = added.filter((a) => !NOT_SHIPPED.test(a.file));
+  for (const s of SENSITIVE) {
+    const code = [s.code].flat();
+    const where = [
+      ...(s.path ? shipped.filter((f) => s.path.test(f)) : []),
+      ...lines.filter((a) => code.some((c) => c.test(a.text))).map((a) => `${a.file}:${a.line}`),
+    ];
+    if (where.length) reasons.push({ kind: s.kind, why: s.why, where: [...new Set(where)] });
+  }
+  const deps = files.filter(isDependencyFile);
+  if (deps.length) reasons.push({ kind: 'dependencies', why: 'dependencies', where: deps });
+  const cited = cites.filter((id) => security.has(id));
+  if (cited.length)
+    reasons.push({ kind: 'requirements', why: 'security requirements it cites', where: cited });
+  return reasons;
+}
+
+/** The reasons as one sentence: "sign-in or sessions (src/auth/login.ts), dependencies (package.json)". */
+export const reasonsInWords = (reasons) =>
+  reasons.map((r) => `${r.why} (${examples(r.where)})`).join('; ');
+
+const git = (root, ...args) =>
+  execFileSync('git', ['-C', root, ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  });
+
+/**
+ * Whether `branch` needs the security review against `base`, read from git:
+ * { branch, story, needed, reasons, agent } where `agent` says whether the project has the
+ * security-reviewer agent.
+ */
+export function securityReview(root, { base, branch, config }) {
+  const range = `${base}...${branch}`;
+  const files = git(root, 'diff', '--name-only', '--no-renames', range).split('\n').filter(Boolean);
+  const added = addedLines(git(root, 'diff', '-U0', '--no-renames', '--no-color', range));
+  const story = storyOfBranch(branch);
+  const { specs, plan } = config.docs ?? {};
+  const cites =
+    (plan ? readStories(root, plan) : []).find((s) => s.id === story)?.requirements ?? [];
+  const texts = specs
+    ? markdownFiles(root, specs).map((f) => readFileSync(join(root, f), 'utf8'))
+    : [];
+  const reasons = securityReasons({ files, added, cites, security: securityRequirementIds(texts) });
+  return {
+    branch,
+    story,
+    needed: reasons.length > 0,
+    reasons,
+    agent: existsSync(join(root, SECURITY_AGENT_FILE)),
+  };
+}

package/hooks/lib/team.mjs

@@ -60,9 +60,16 @@ export function teamProblems(c) {
     if (
       t.provider !== undefined &&
       t.provider !== 'github' &&
-      !(isObj(t.provider) && typeof t.provider.command === 'string' && t.provider.command.trim())
+      !(
+        isObj(t.provider) &&
+        typeof t.provider.command === 'string' &&
+        t.provider.command.trim() &&
+        (t.provider.fallback === undefined || t.provider.fallback === 'github')
+      )
     )
-      p.push('"team.provider" must be "github" or { "command": "<the provider\'s command>" }');
+      p.push(
+        '"team.provider" must be "github" or { "command": "<the provider\'s command>", "fallback"?: "github" }',
+      );
   }
   for (const [name, lane] of Object.entries(isObj(c.lanes) ? c.lanes : {})) {
     if (!isObj(lane) || lane.owners === undefined) continue;
@@ -148,11 +155,44 @@ function claimOf(message) {
   }
 }
 
-/** The provider for this project's team: GitHub's, or the config's command. */
+/**
+ * The provider for this project's team: GitHub's, or the config's command. A command with
+ * `fallback: "github"` (a hosted provider, such as the code-kit teams hub) hands each operation it
+ * can't reach to the GitHub provider, so claims are still checked while it's down (TEAM-8).
+ */
 export function teamProvider(root, team) {
-  return team.provider === 'github'
-    ? githubProvider(root, team)
-    : commandProvider(root, team, team.provider.command);
+  if (team.provider === 'github') return githubProvider(root, team);
+  const command = commandProvider(root, team, team.provider.command);
+  if (team.provider.fallback !== 'github') return command;
+  const github = githubProvider(root, team);
+  const down = (r) => Boolean(r?.unreachable) || r?.reachable === false;
+  const either =
+    (op) =>
+    (...args) => {
+      const r = command[op](...args);
+      if (!down(r) && r !== null) return r;
+      const g = github[op](...args);
+      // The state says it came through GitHub, and why, for the band.
+      return op === 'state' && g
+        ? { ...g, fallback: r?.why ?? "The team provider can't be reached." }
+        : g;
+    };
+  return {
+    ...Object.fromEntries(
+      [
+        'whoami',
+        'claim',
+        'release',
+        'state',
+        'intend',
+        'settle',
+        'reassign',
+        'intent',
+        'since',
+      ].map((op) => [op, either(op)]),
+    ),
+    forget: () => (command.forget(), github.forget()),
+  };
 }
 
 function githubProvider(root, team) {
@@ -402,11 +442,26 @@ function githubProvider(root, team) {
           'number,title,author,headRefName,isDraft,updatedAt,url',
         ]) ?? 'null',
       );
+      const who = me();
       const state = {
         at: new Date().toISOString(),
         reachable: Boolean(claims),
         github: Boolean(intents && pulls),
-        me: me(),
+        me: who,
+        // What coordinates the team, for the Team pane: GitHub itself, through refs and discussions.
+        provider: {
+          name: 'GitHub',
+          live: false,
+          detail: `claims are refs on origin, intents are discussions in "${team.intents}"`,
+        },
+        // TEAM-13: what the team still needs set up for its claims and intents to work.
+        setup: [
+          ...(who ? [] : ["gh isn't signed in on this machine: run gh auth login."]),
+          ...(claims ? [] : ["The shared repository (origin) can't be reached."]),
+          ...(found && !found.category
+            ? [noCategory(found).replace(/, then raise the intent again\.$/, '.')]
+            : []),
+        ],
         techLead: team.techLead,
         owners: team.owners,
         staleDays: team.staleDays,

package/hooks/mod/decisions.mjs

@@ -16,6 +16,7 @@ export const DECISION_KINDS = new Set([
   'teamCollision',
   'teamIntent',
   'teamReview',
+  'teamDrift',
 ]);
 
 /** What each answer does, in the person's words. */
@@ -72,6 +73,8 @@ function whyOf(line, check) {
   if (line.kind === 'teamIntent')
     return "You're the tech lead: a change of direction is agreed or dropped by you, and until then everyone builds on what was agreed.";
   if (line.kind === 'teamReview') return "It's in a lane you own, so its review is yours.";
+  if (line.kind === 'teamDrift')
+    return "The team's drift check found your work building on something that has since changed, or heading into someone else's: settle it before it merges.";
   return null;
 }
 

package/hooks/mod/loop.mjs

@@ -3,7 +3,16 @@
 // existing skills, and the hooks judge every call as before.
 
 /** The steps the loop hands the lead; the rest (spec-design, init, check) wait for the person. */
-const LEAD_STEPS = new Set(['dispatch', 'review', 'lead', 'merge', 'rules', 'design', 'setup']);
+const LEAD_STEPS = new Set([
+  'dispatch',
+  'review',
+  'lead',
+  'merge',
+  'rules',
+  'design',
+  'setup',
+  'update',
+]);
 
 /**
  * The prompt for a step from `code-kit next --json` (LOOP-1), or null when it isn't the lead's to
@@ -27,6 +36,9 @@ export function leadPrompt(step, { cli = 'code-kit' } = {}) {
     return ids.length
       ? `Before any code is written, set up ${ids[0].split(':')[0]}: run /${ids[0]}. ${step.why ?? ''}`.trim()
       : null;
+  // ONB-6: an older setup brought up to date before the next story; init shows the person the diff.
+  if (step.step === 'update')
+    return `Before the next story, bring code-kit's setup up to date: run /code-kit:init. ${step.why ?? ''}`.trim();
   // ONB-2: the screens designed, and approved by the person, before they're built.
   if (step.step === 'design')
     return ids.length
@@ -61,6 +73,7 @@ export function stepLabel(step) {
       rules: 'Rules onto',
       design: 'Design',
       setup: 'Set up',
+      update: 'Update the setup',
     }[step.step] ?? step.step;
   return ids ? `${verb} ${ids}` : verb;
 }

package/hooks/mod/panes.mjs

@@ -1,7 +1,6 @@
 // Panes v2 (docs/specs/11-panes.md): the Lanes pane's frame. A counts header, tabs, what needs the
 // person, the tab's body and the keys, as pure functions of what the mod already holds. The Lanes
 // tab's body is view.mjs's lanesPane; the Queue and Usage tabs reuse its sections.
-import { teamTab } from './teamview.mjs';
 import { trailRows as trailRowsDrawn, trailSvg } from './trail.mjs';
 import {
   MAP_LEGEND,
@@ -32,7 +31,6 @@ export const TABS = [
   { id: 'map', label: 'Trail', hotkey: '5' },
   { id: 'queue', label: 'Queue', hotkey: '6' },
   { id: 'usage', label: 'Usage', hotkey: '7' },
-  { id: 'team', label: 'Team', hotkey: '8' },
 ];
 
 /** The pane's own state, kept by the mod between draws. */
@@ -246,8 +244,7 @@ export function lanesFrame(view, els, on) {
     key: 'tabs',
     flexDirection: 'row',
     columnGap: 1,
-    // The Team tab is there only for a team (TEAM-7).
-    children: TABS.filter((t) => t.id !== 'team' || view.team).map((t) =>
+    children: TABS.map((t) =>
       Button({
         key: `tab-${t.id}`,
         label: t.label,
@@ -272,52 +269,48 @@ export function lanesFrame(view, els, on) {
 
   const selected = state.lanes.find((l) => l.name === ui.selected) ?? null;
   const body =
-    ui.tab === 'team'
-      ? teamTab(view.team ?? null, view.teamSince ?? null, els, on)
-      : ui.tab === 'decisions'
-        ? decisionsTab(view.cards ?? [], ui, els, on)
-        : ui.tab === 'journal'
-          ? journalTab(view.journal ?? [], els, view.now)
-          : ui.tab === 'code'
-            ? codeTab(view, els, on)
-            : ui.tab === 'map'
-              ? mapTab(view.status, ui.cell, els, on, view.trail, {
-                  surface: view.surface,
-                  columns: view.columns,
-                })
-              : ui.tab === 'queue'
-                ? queueSection(loop, text, Box)
-                : ui.tab === 'usage'
-                  ? usageSection(view.usage, plan, text, Box)
-                  : [
-                      lanesPane(state, els, view.usage, plan, loop, {
-                        filter: ui.filter,
-                        search: ui.search,
-                        selected: ui.selected,
-                        live: view.live ?? {},
-                        art: view.art ?? null,
-                        detail: selected
-                          ? {
-                              agent: selected.agent ?? null,
-                              owns: view.paths?.[selected.name] ?? [],
-                              stories: laneStories(selected, state),
-                            }
-                          : null,
-                        combined: view.combined ?? null,
-                      }),
-                    ];
+    ui.tab === 'decisions'
+      ? decisionsTab(view.cards ?? [], ui, els, on)
+      : ui.tab === 'journal'
+        ? journalTab(view.journal ?? [], els, view.now)
+        : ui.tab === 'code'
+          ? codeTab(view, els, on)
+          : ui.tab === 'map'
+            ? mapTab(view.status, ui.cell, els, on, view.trail, {
+                surface: view.surface,
+                columns: view.columns,
+              })
+            : ui.tab === 'queue'
+              ? queueSection(loop, text, Box)
+              : ui.tab === 'usage'
+                ? usageSection(view.usage, plan, text, Box)
+                : [
+                    lanesPane(state, els, view.usage, plan, loop, {
+                      filter: ui.filter,
+                      search: ui.search,
+                      selected: ui.selected,
+                      live: view.live ?? {},
+                      art: view.art ?? null,
+                      detail: selected
+                        ? {
+                            agent: selected.agent ?? null,
+                            owns: view.paths?.[selected.name] ?? [],
+                            stories: laneStories(selected, state),
+                          }
+                        : null,
+                      combined: view.combined ?? null,
+                    }),
+                  ];
   const empty =
-    ui.tab === 'team'
-      ? 'This project has no team in its config.'
-      : ui.tab === 'decisions'
-        ? 'Nothing needs you. The lead is handling the build.'
-        : ui.tab === 'journal'
-          ? 'Nothing recorded yet: the journal starts with the brief.'
-          : ui.tab === 'queue'
-            ? 'The merge queue is empty.'
-            : ui.tab === 'usage'
-              ? 'No usage measured yet this session.'
-              : null;
+    ui.tab === 'decisions'
+      ? 'Nothing needs you. The lead is handling the build.'
+      : ui.tab === 'journal'
+        ? 'Nothing recorded yet: the journal starts with the brief.'
+        : ui.tab === 'queue'
+          ? 'The merge queue is empty.'
+          : ui.tab === 'usage'
+            ? 'No usage measured yet this session.'
+            : null;
 
   // VIEW-6: j/k move between lanes; the selected lane's acts; f filters.
   const opening = selected ? storyToOpen(selected, state) : null;