@winding-labs/glow 0.1.1 → 0.1.11

package/README.md

@@ -15,11 +15,19 @@ branch, commits and pull request. From that post in Glow you can send the sessio
 - **Only to Glow** (`https://app.meetglow.ai`). The address is fixed when you set up and can't be changed by a repo or
   an environment variable (the hook runs with an empty environment but `HOME` and `PATH`).
 - **Only from linked repos.** A session in any other repo sends nothing. You link repos to products in Glow.
-- **Only the agent's last reply**, with keys and tokens masked, plus the branch, the titles of the branch's commits and
-  a pull request link on the same repo. Never your code, files, prompts or the transcript.
-- Glow turns the reply into a short summary right away and **doesn't keep the reply itself**.
+- **Never from a repo you ignore.** `/glow:ignore` in a repo (or `npx @winding-labs/glow ignore`) and its sessions send
+  nothing from this computer, even if it's linked: the hook stops before it makes any request.
+- **Only the agent's last reply and the request it answers**, with keys and tokens masked, plus the branch, the titles
+  of the branch's commits and a pull request link on the same repo, and which of GitHub (`gh` signed in), Chrome, Docker
+  and Xcode this computer has (yes or no each, for its tags in Glow). Never your code, files or the transcript: the hook
+  reads only your latest request from the agent's own session file.
+- Glow turns the reply into a short summary right away and **doesn't keep the reply or the request**. From the request
+  it keeps only the recipe it names when it's a job you'd run again ("Pen test the API", "Optimize SEO"), so it can
+  count how often you run it and offer to run it for you. Don't want that? `npx @winding-labs/glow recipes off`.
 - This computer's key can do three things: send a report, read which repos are linked, and fetch messages you sent to
-  its sessions. It can't read anything else in your workspace. It stops working after 90 days unused.
+  its sessions. While `glow run` is on, it also picks up the sessions you start here and says how they're going (the
+  repo, the last command or file, masked; never output or code). It can't read anything else in your workspace. It
+  stops working after 90 days unused.
 
 ## Messages back
 
@@ -27,19 +35,85 @@ Only the person who paired the computer can message its sessions, and Glow asks
 first. Claude Code picks a message up while it's idle (for 25 minutes after its last reply); Codex picks it up when its
 current turn ends. Don't want that? `npx @winding-labs/glow messages off` on the computer.
 
+## Run your queue here
+
+```
+npx @winding-labs/glow run ~/code --background
+```
+
+Only if you want it, and only while it runs: press **Run** on your queue in the Glow app, look at your phone (Face ID),
+and the tasks in it run here in Claude Code, a few at once, oldest first, with your own Claude Code model and effort
+(whatever `claude` uses in a terminal). For the next 5 minutes, anything you add to the queue runs too. Nothing starts by
+itself. Glow's Agents tab shows the
+queue live: what's running and its last step, what's next, what finished and what came of it, with each run's time,
+turns, cost and how full its context is. Tap one for its whole run: what it was asked, what it said and did, its reply.
+**Run now** starts any task at once (Glow's suggestions and teammates' tasks run only when you press it); **New
+session** starts one with a prompt you type. Each runs in your checkout of a repo that's linked to the task's product
+and found under the folders you give it (the current folder by default). Its reply posts to the product's channel like
+any session's, except for a task someone else wrote or one filed from a capture: then only you see it, on its run.
+Pause the computer in Glow to hold the queue.
+
+- **Only with your Glow phone's Face ID:** one phone on your account is your Glow phone (the app: Settings › Glow phone).
+  It holds a key that never leaves its Secure Enclave (or Android Keystore) and signs each session, and each message to
+  a session, after Face ID or your fingerprint: what runs, in which repo, on this computer. This computer checks that
+  signature against the phone it trusts before anything runs or reaches an agent, so Glow alone, or anyone who got into
+  your Glow account, can't run anything here. It trusts the first Glow phone Glow names; after you make a new phone
+  yours, run `npx @winding-labs/glow phone trust` here (it shows the fingerprint to check against the app).
+  `npx @winding-labs/glow phone` says which one it trusts.
+- **Only yours:** only you (the person who paired the computer) start sessions on it. Glow's suggestions and teammates'
+  tasks run when you press Run on them, like yours.
+- **Full access:** every session runs like your own `claude --dangerously-skip-permissions`: nothing asks before a
+  command, so start the runner only on a computer where you'd run that yourself. Each works in a git worktree of its own
+  (`.claude/worktrees/glow-…`, a new branch from your default branch), so your checkout stays as it is, and is told to
+  ship its work as a pull request: commit, push its branch, `gh pr create`, never your default branch. pnpm and yarn work
+  even if only Node's corepack is installed. Glow's own CLI and `~/.glow` stay denied (a session can't turn
+  Glow off, stop the runner or read the computer's key). Read a task someone else wrote, or one from a capture, before
+  you press Run: it runs with the same access.
+- **This computer decides too**, whatever Glow sends: `--repo owner/name` (repeat it) runs only those repos,
+  and `--repo owner/name=~/code/zest` picks the checkout when a repo is checked out more than once (otherwise it doesn't
+  run; worktrees don't count: it runs in the main checkout). Only in a folder you've trusted in Claude Code (opened `claude` there and said yes), since its own `.claude`
+  settings and hooks apply. A session id is run once, never again.
+- **What Glow keeps of a run:** its usage (how many of its tool calls failed, and how much of your Claude plan was used
+  when it started), and for 2 days its transcript (Claude Code's words, each tool or command,
+  the first lines of each result, its reply), keys masked and cut short, at most 256 KB, that only you can read.
+- **Up to 3 at once** on a computer, even in one repo (each in its own worktree), the rest wait their turn, 30 a day, 3 hours each at most. Stop from Glow ends the session and
+  the commands it started. Pausing the computer in Glow stops them all; Ctrl-C (or closing the terminal) stops the
+  runner and its sessions, and everything they started.
+- `run --background` keeps it going after you close the terminal (log: `~/.glow/runner.log`); `run stop` stops it. A
+  session the runner started can't stop it or turn Glow off.
+
+## In Claude Code and Codex
+
+```
+/glow:status      what this folder sends (and why not), what's set up, which repos report or are ignored
+/glow:ignore      this repo never sends to Glow from this computer (add a folder or owner/name for another)
+/glow:unignore    let it send again (only when you type it: an agent can't run it on its own in Claude Code)
+/glow:run         start (or stop) the runner in the background, for the linked repos under the session's folder
+                  (only when you type it; --repo and other folders are for the terminal)
+```
+
+In Codex they're `$glow:status`, `$glow:ignore`, `$glow:unignore` and `$glow:run`. Setup adds them as a `glow` plugin, through each
+agent's own `plugin` command; each may run only its own `~/.glow/glow` command, and a session Glow started can't run
+any of them.
+
 ## Commands
 
 ```
 npx @winding-labs/glow                 set up (or add an agent you installed later)
-npx @winding-labs/glow status          what's set up and which repos report
+npx @winding-labs/glow status          what this folder sends, what's set up, which repos report
+npx @winding-labs/glow ignore [repo]   this repo (or a folder, or owner/name) never sends from this computer
+npx @winding-labs/glow unignore [repo] let it send again
 npx @winding-labs/glow off | on        stop or start sending from this computer
 npx @winding-labs/glow messages off    messages from Glow no longer reach your agents here (messages on: again)
-npx @winding-labs/glow uninstall       remove the hooks, revoke the key, delete ~/.glow
+npx @winding-labs/glow run [folders]   run your queue (and sessions you start in Glow) in the linked repos under these folders
+    [--repo owner/name[=path]…] [--background]
+npx @winding-labs/glow run stop        stop the runner (and its sessions)
+npx @winding-labs/glow uninstall       remove the hooks and the plugin, revoke the key, delete ~/.glow
 ```
 
 Codex asks before it runs any new hook: open Codex and run `/hooks` once to trust Glow's.
 
-Files: `~/.glow/` (the key, owner-only), a `Stop` hook in `~/.claude/settings.json` and `~/.codex/hooks.json` (a
+Files: `~/.glow/` (owner-only: the key, the ignored repos, a copy of this package and the plugin), a `Stop` hook in `~/.claude/settings.json` and `~/.codex/hooks.json` (a
 symlinked settings file stays a link). The first time, the originals are copied to `*.before-glow`.
 
 Security: [SECURITY.md](SECURITY.md).

package/SECURITY.md

@@ -7,12 +7,75 @@ Report a vulnerability to **security@meetglow.ai**. Please don't open a public i
 - **Talk to one host:** `https://app.meetglow.ai`, fixed at setup in `~/.glow/config.json` (owner-only) and checked on
   every call. Redirects are refused. The hook runs with an empty environment except `HOME` and `PATH`, so no proxy, TLS
   or `NODE_*` setting can send it anywhere else.
-- **Send only from repos you linked** to a product in Glow: the agent's last reply (keys and tokens masked), the branch,
-  up to five commit titles on it, and a pull request link on the same repo. Never code, files, prompts or transcripts.
+- **Send only from repos you linked** to a product in Glow: the agent's last reply and the request it answers (keys and
+  tokens masked; the request only from a .jsonl under ~/.claude/projects or ~/.codex/sessions, never with `recipes
+  off`), the branch, up to five commit titles on it, and a pull request link on the same repo. Never code, files or
+  transcripts.
+  A repo you ignore here (`/glow:ignore`) sends nothing, linked or not: the hook stops before any request.
 - **Run git read-only** (the origin URL, the branch, commit titles), with no shell, hooks, fsmonitor, pager, signature
-  checks or `GIT_*` variables, so a repo's `.git/config` can't make it run a program.
+  checks or `GIT_*` variables, so a repo's `.git/config` can't make it run a program. The runner (below) also fetches a
+  linked repo's default branch and adds a worktree for each session: hooks, fsmonitor and pager still off and none of
+  your `GIT_*` variables, but with your git credentials, so the fetch works.
 - **Edit two settings files:** add one `Stop` hook to `~/.claude/settings.json` and `~/.codex/hooks.json`, keep
   everything else, back up the originals once (`*.before-glow`), and never overwrite a file that isn't valid JSON.
+- **Add one plugin** (`glow`, from `~/.glow/marketplace`) with each agent's own `claude plugin` / `codex plugin`
+  command. Each may run only its own `~/.glow/glow` command (`status`, `ignore …`, `unignore …`; `/glow:run`: exactly
+  `run --background`, `run stop` or `status`), and `/glow:unignore` and `/glow:run` run only when you type them.
+
+- **Start Claude Code, only while `glow run` runs** (you start it; nothing installs it to start on its own). It runs
+  `claude` as an argument list (no shell), in your checkout of a linked repo found under the folders you gave it, with
+  the prompt on stdin (so a prompt can't become a flag), with `--dangerously-skip-permissions`: like your own Claude
+  Code with that flag, nothing asks before a command, and your Claude Code settings pick its model and effort (Glow
+  passes neither). Starting the runner is how you say yes to that, on this computer; it says so when it starts. Each
+  session runs in a git worktree of its own that the runner makes (`.claude/worktrees/glow-<id>`, letters and digits
+  only, on a new branch of that name from the default branch as origin has it, kept afterwards), never in the checkout
+  you work in. It's told to ship its work as a pull request: commit on that branch, push it and open one with `gh`,
+  never pushing to the default branch or merging (an instruction, not a limit: with full access it could). Where pnpm or
+  yarn isn't installed, corepack's own shims for them (`~/.cache/glow/bin`) go last on its PATH. Nothing starts by
+  itself: each session runs only with your Glow phone's signature over it (below), up to 3 at once; a task someone else
+  wrote, or one from a capture, runs with the same access when you press Run, so read it first. Always `--disallowedTools` for
+  Glow's own CLI (`~/.glow/glow`, `npx @winding-labs/glow`, `node …/glow.mjs`) and files (`~/.glow`, the computer's
+  key), which holds with permission checks skipped and no allow rule (the plugin's included) can grant back. That list
+  matches the command's text, so a session could spell its way around it (`~/.gl?w/glow`); the CLI also refuses any
+  command run from inside a session. One command per call: `glow ignore x run …` is refused, so a skill allowed to run one
+  command can't reach another. Stop, a pause in Glow, the 3-hour limit, Ctrl-C or closing the
+  terminal ends a session and everything it started: Claude Code's Bash tool and hooks start each command in a process
+  group of its own, so the runner signals every group under that Claude Code (SIGTERM, then SIGKILL after 5 s; SIGTERM
+  at once if the runner itself exits).
+- **Run only what your Glow phone signed** (review-2026-11-03-signed-runs.md). Each session comes with a signature by
+  your Glow phone: ECDSA P-256 with a key made in its Secure Enclave or Android Keystore, usable only after Face ID or a
+  fingerprint (one check covers 5 minutes), over the session's id, this computer's id, the repo, the SHA-256 of the
+  prompt and the time. The runner checks it against the phone key this computer pinned (`~/.glow/config.json` `phone`:
+  the first phone Glow named, or the one you trusted with `glow phone trust` after checking its fingerprint at the
+  terminal; Glow naming another is only reported) before anything else, rebuilding what was signed from what would run,
+  within 6 hours (5 minutes of clock skew), and each signature once (`~/.glow/seen`). One that fails is reported failed
+  (`not_signed`, `bad_signature`, `untrusted_phone`) and never runs. Messages to a session are checked the same way by
+  the hook (over the message id, this computer, the session and the exact text, within a day) and dropped otherwise.
+  So a compromise of Glow's servers, or of your Glow account without your phone, can't run anything here.
+- **Not take Glow's word for it.** The runner refuses, on your computer: a repo outside `--repo` when you gave it; a
+  folder Claude Code hasn't been trusted in (`claude -p` skips that question, and a repo's own `.claude` settings and
+  hooks would apply); a repo with more than one main checkout unless you pinned one (`--repo owner/name=path`; its
+  worktrees aren't copies: it runs in the main one); and a session id it has already been given. Glow sends only the
+  repo, the title and the prompt: no flag, model or effort of Glow's ever reaches `claude`. A command run inside one of
+  its sessions can't stop the runner, turn Glow off or change what it sends: besides the denied tools, `glow` refuses
+  when its environment has the session's marker (`GLOW_RUN_SESSION`, kept by `~/.glow/glow`), when a session's Claude
+  Code is among its parent processes, or when it runs in a session's process group.
+  Signed launch tokens (Glow signs each session, the computer checks it with a key it keeps) are a later step: today a
+  compromised Glow account or server could start a session within those limits, which, with full access, means a
+  command as you on this computer. Run the runner only where you'd run `claude --dangerously-skip-permissions`
+  yourself, and stop it (`glow run stop`) when you don't need it.
+- **Say what runs here:** Glow's version on every call, and while the runner is on, Claude Code's and Codex's versions
+  (each one's `--version`), for the tags beside this computer in Glow.
+- **Report how a session goes:** running, done, failed or stopped; the model Claude Code says it runs on; how much of
+  your Claude plan is used (a share of its fullest window, as Claude Code says once a session); turns, cost, tokens, how full its context is, how
+  many tool calls it made, failed or were turned down; and its last step as one line: a command by its program and subcommand only
+  (`$ psql …`, never its arguments), a file path relative to the repo, a search pattern or a web host. Keys and tokens
+  are masked before anything is cut, the home folder is `~`, and Glow cuts and scrubs it again.
+- **Its transcript, for you only, for 2 days:** Claude Code's words, each tool call (a command whole, with secret-named
+  variables and keys masked), the first 600 characters of each result and its reply, each entry masked here and again
+  in Glow and cut short (4,000 characters), at most 2,000 entries and 256 KB a session. Glow keeps it in its storage
+  under the workspace, deletes it after 2 days (and with the workspace), and shows it only to the person who started
+  the session. Never file contents it wrote.
 
 ## What the key can do in Glow
 
@@ -23,5 +86,16 @@ The key (`glowc_…`, stored in Glow only as a hash) can send a session report,
 messages you sent to this computer's sessions, and revoke itself. It can't read anything else in your workspace. It
 stops working when you remove the computer, leave the workspace, or don't use it for 90 days.
 
-Messages back: only the person who paired the computer can message its sessions, with a fresh second factor each time.
+Messages back: only the person who paired the computer can message its sessions, with a fresh second factor each time and their Glow phone's signature, which the hook checks.
 `npx @winding-labs/glow messages off` turns them off on the computer.
+
+Sessions started from Glow: only the person who paired the computer can start one, in a repo linked to a product and
+checked out on the computer, while `glow run` (0.1.10 or later) is on there, and only with their Glow phone's
+signature (Face ID), which the computer checks. Nothing starts by itself. With the runner on, the key can
+also say which linked repos are checked out, pick up a waiting session (Glow hands the prompt over once and then
+deletes it) and report its status. Glow allows 3 at once per computer, the rest waiting their turn, and 30 a day; a session not signed in 2 minutes,
+or signed but not picked up (in 6 hours, or 10 minutes with the runner off) fails (closed nightly at the latest, prompt deleted), and pausing or removing the computer stops
+its sessions, as does Glow's own kill switch. Every session has full access (`--dangerously-skip-permissions`): nothing
+asks before a command, and a task runs as you on this computer. When someone else wrote the task, or it came from a
+capture, the session's reply goes to you only (under the session in the Agents tab), never to a channel. Only you see
+which repos the runner found on your computer.