acstack 0.48.5 → 0.49.1

package/assets/terminal-workspace/setup.sh

@@ -7,10 +7,19 @@
 #   setup.sh disable <herdr|delta|diffnav|gh_dash|harlequin|lazygit|neovim|pi|tuicr>
 #   setup.sh uninstall  remove every managed block, keep the binaries
 #
+# Layout map:
+#   config readers and shared helpers
+#   installers and embedded acstack-* helper scripts
+#   per-tool config writers
+#   pi state, pi package, and pi config helpers
+#   version, status, apply, upgrade, disable, and uninstall commands
+#
 # Idempotent. Only ever edits between managed markers, so hand-written config
 # around it survives.
 set -uo pipefail
 
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" && pwd)"
+
 CFG="${ACSTACK_TW_CONFIG:-$HOME/.config/acstack/terminal-workspace.yaml}"
 BIN="${ACSTACK_TW_BIN:-$HOME/.local/bin}"
 # Everything installs into $BIN, and the config steps then ask `have <tool>`
@@ -37,6 +46,7 @@ PI_SUBAGENT_CFG="$PI_DIR/extensions/subagent/config.json"
 # pi's override, so look where it writes.
 PI_RETRO_EXT="${PI_HOME:-$HOME/.pi}/agent/extensions/agentic-retro.ts"
 PI_ACSTACK="npm:acstack"
+PI_ACSTACK_GIT="git:github.com/ac8318740/spechub"
 PI_BILLION="npm:billion-context"
 BILLION_CONFIG="$HOME/.config/billion-context/billion-context.json"
 PI_SLASH_ANYWHERE="npm:pi-slash-anywhere"
@@ -50,4644 +60,21 @@ PI_LENS_CFG="$HOME/.pi-lens/config.json"
 PI_MD_BEGIN="<!-- >>> acstack terminal-workspace >>> -->"
 PI_MD_END="<!-- <<< acstack terminal-workspace <<< -->"
 PI_DELEGATION="When an ACStack skill or the ACStack orchestrator says to launch a subagent, you may delegate to it."
-ACTION="${1:-status}"
-
-have() { command -v "$1" >/dev/null 2>&1; }
-
-require_yaml() {
-  python3 -c 'import yaml' 2>/dev/null && return 0
-  echo "PyYAML is required to read $CFG" >&2
-  echo "Install it (pip install --user pyyaml) and run again. Refusing to" >&2
-  echo "continue, because without it every setting falls back to a default" >&2
-  echo "and your config is silently ignored." >&2
-  exit 1
-}
-
-arch_supported() {
-  case "$(uname -m)" in
-    x86_64|amd64) return 0 ;;
-    *) say "prebuilt binaries are x86_64 only, and this is $(uname -m)"
-       say "install herdr, delta, diffnav, and lazygit yourself, then run apply again"
-       return 1 ;;
-  esac
-}
-say()  { printf '  %s\n' "$*"; }
-
-py() { python3 - "$@"; }
-
-# Reads one dotted path. require_yaml runs first, so a fallback here means
-# the key is absent, never that yaml failed to import.
-cfg_get() {  # cfg_get <dotted.path> <default>
-  ACSTACK_CFG="$CFG" py "$1" "${2:-}" <<'PY'
-import os, sys
-import yaml
-p = os.environ["ACSTACK_CFG"]
-if not os.path.isfile(p):
-    print(sys.argv[2]); raise SystemExit
-d = yaml.safe_load(open(p)) or {}
-for k in sys.argv[1].split("."):
-    d = d.get(k) if isinstance(d, dict) else None
-    if d is None: break
-if isinstance(d, bool): d = "true" if d else "false"
-print(d if d is not None else sys.argv[2])
-PY
-}
-
-# neovim and pi write into a config the user built, so they start off. Every
-# other component owns its files outright and starts on.
-enabled_default() {  # enabled_default <component>
-  case "$1" in neovim|pi) echo false ;; *) echo true ;; esac
-}
-
-# The example config that shipped beside this script. Both `outdated` and the
-# stamp read it, so resolve it once.
-EXAMPLE="$(dirname "$0")/config.example.yaml"
-STAMP="$(dirname "$CFG")/terminal-workspace.applied"
-# What the pi component changed, so disable undoes that and nothing else. A
-# package or a setting the user already had is theirs, and stays.
-PI_OWNED="$(dirname "$CFG")/terminal-workspace.pi.json"
-
-# Reads a yaml list into one item per line. cfg_get prints a python list repr
-# for a list value, which no caller can use.
-cfg_get_list() {  # cfg_get_list <dotted.path> <space-separated default>
-  ACSTACK_CFG="$CFG" py "$1" "${2:-}" <<'PY'
-import os, sys
-import yaml
-p = os.environ["ACSTACK_CFG"]
-d = (yaml.safe_load(open(p)) or {}) if os.path.isfile(p) else {}
-for k in sys.argv[1].split("."):
-    d = d.get(k) if isinstance(d, dict) else None
-    if d is None: break
-print("\n".join(str(x) for x in d) if isinstance(d, list) else sys.argv[2].replace(" ", "\n"))
-PY
-}
-
-# What `apply` had to offer, recorded so a later run can tell what arrived
-# since. Without it, a component added by an upgrade is invisible: cfg_get
-# returns its default, apply installs it, and nobody is ever told it is there.
-write_stamp() {
-  [ -f "$EXAMPLE" ] || return 0
-  mkdir -p "$(dirname "$STAMP")"
-  { echo "# written by acstack terminal-workspace apply, do not edit"
-    py "$EXAMPLE" <<'PY'
-import sys
-import yaml
-for k in (yaml.safe_load(open(sys.argv[1])) or {}):
-    print(k)
-PY
-  } > "$STAMP"
-}
-
-install_binary() {  # install_binary <name> <repo> <asset-match>
-  local name="$1" repo="$2" match="$3"
-  # `upgrade` reinstalls over a binary that is already here. `apply` never
-  # does: it installs what is missing and leaves what is not.
-  if [ "${INSTALL_FORCE:-0}" != "1" ] && have "$name"; then
-    say "$name already installed"; return 0
-  fi
-  local url json
-  # py reads its script from stdin, so the release JSON has to arrive by
-  # environment rather than by pipe: a pipe here is silently swallowed by
-  # the heredoc and python then reads an empty stdin.
-  json=$(curl -sSf "https://api.github.com/repos/$repo/releases/latest" 2>/dev/null)
-  [ -z "$json" ] && { say "$name: could not reach the GitHub release API"; return 1; }
-  url=$(ACSTACK_JSON="$json" py "$match" <<'PY'
-import json, os, sys
-try:
-    d = json.loads(os.environ["ACSTACK_JSON"])
-except ValueError:
-    raise SystemExit
-for a in d.get("assets", []):
-    # yazi publishes .zip only; delta and glow publish .tar.gz. Take either.
-    if sys.argv[1] in a["name"] and a["name"].endswith((".tar.gz", ".tgz", ".zip")):
-        print(a["browser_download_url"]); break
-PY
-)
-  [ -z "$url" ] && { say "$name: no matching release asset, install manually"; return 1; }
-  # Explicit cleanup rather than `trap ... RETURN`: a RETURN trap stays
-  # registered for every later function return in this shell, where $tmp is
-  # gone and `set -u` then aborts the run.
-  local tmp found ar; tmp=$(mktemp -d)
-  case "$url" in *.zip) ar="$tmp/a.zip" ;; *) ar="$tmp/a.tgz" ;; esac
-  if ! curl -sL "$url" -o "$ar"; then
-    rm -rf "$tmp"; say "$name: download failed"; return 1
-  fi
-  case "$ar" in
-    *.zip) have unzip || { rm -rf "$tmp"; say "$name: needs unzip"; return 1; }
-           unzip -qo "$ar" -d "$tmp" || { rm -rf "$tmp"; say "$name: unzip failed"; return 1; } ;;
-    *)     tar xzf "$ar" -C "$tmp" || { rm -rf "$tmp"; say "$name: untar failed"; return 1; } ;;
-  esac
-  found=$(find "$tmp" -type f -name "$name" | head -1)
-  if [ -z "$found" ]; then
-    rm -rf "$tmp"; say "$name: binary not found in archive"; return 1
-  fi
-  mkdir -p "$BIN"; cp "$found" "$BIN/$name"; chmod +x "$BIN/$name"
-  rm -rf "$tmp"
-  say "$name installed to $BIN/$name"
-}
-
-install_plain_github_binary() {  # install_plain_github_binary <name> <repo> <asset-match>
-  local name="$1" repo="$2" match="$3"
-  if [ "${INSTALL_FORCE:-0}" != "1" ] && have "$name"; then
-    say "$name already installed"; return 0
-  fi
-  local json url tmp
-  json=$(curl -sSf "https://api.github.com/repos/$repo/releases/latest" 2>/dev/null)
-  [ -z "$json" ] && { say "$name: could not reach the GitHub release API"; return 1; }
-  url=$(MAPFLOW_JSON="$json" py "$match" <<'PY'
-import json, os, sys
-try:
-    d = json.loads(os.environ["MAPFLOW_JSON"])
-except ValueError:
-    raise SystemExit
-for a in d.get("assets", []):
-    if sys.argv[1] in a["name"]:
-        print(a["browser_download_url"]); break
-PY
-)
-  [ -z "$url" ] && { say "$name: no matching release asset, install manually"; return 1; }
-  tmp=$(mktemp)
-  if ! curl -fsSL "$url" -o "$tmp"; then
-    rm -f "$tmp"; say "$name: download failed"; return 1
-  fi
-  mkdir -p "$BIN"; cp "$tmp" "$BIN/$name"; chmod +x "$BIN/$name"
-  rm -f "$tmp"
-  say "$name installed to $BIN/$name"
-}
-
-install_npm_tool() {  # install_npm_tool <command> <package>
-  local command="$1" package="$2"
-  if have "$command"; then say "$command already installed"; return 0; fi
-  have npm || { say "$command: npm not installed, skipping"; return 0; }
-  if npm install -g "$package" >/dev/null 2>&1; then
-    say "$command installed with npm"
-  else
-    say "$command install failed, run: npm install -g $package"
-  fi
-}
-
-install_uv_tool() {  # install_uv_tool <command> <package>
-  local command="$1" package="$2"
-  if have "$command"; then say "$command already installed"; return 0; fi
-  have uv || { say "$command: uv not installed, skipping"; return 0; }
-  if uv tool install "$package" >/dev/null 2>&1; then
-    say "$command installed with uv"
-  else
-    say "$command install failed, run: uv tool install $package"
-  fi
-}
-
-write_helpers() {
-  mkdir -p "$BIN"
-  # Helpers this script used to write and no longer does. Upgrading otherwise
-  # leaves them on PATH, shadowing nothing but confusing everything.
-  rm -f "$BIN"/acstack-files "$BIN"/acstack-files-tab \
-        "$BIN"/acstack-yazi-tab "$BIN"/acstack-tab "$BIN"/acstack-renumber
-  cat > "$BIN/acstack-diff" <<'H'
-#!/usr/bin/env bash
-# Show a git diff in diffnav, with a banner naming what is being compared.
-#
-#   acstack-diff        this branch against dev, committed work only (alt+f)
-#   acstack-diff pick   choose the comparison from a menu (alt+x)
-#   acstack-diff auto   first non-empty of working tree, staged, last commit
-#
-# Every launch prepends a COMPARING block to the diff. diffnav renders whatever
-# precedes the first "diff --git" line, which is how git show's commit header
-# reaches the screen, so the block lands at the top of the content pane.
-#
-# diffnav's "o" key opens the file under the cursor with $EDITOR, in diffnav's
-# own pane. That pane is a herdr popup for alt+f and alt+x, and a popup cannot
-# host a second full-screen app, so the editor never draws there. acstack-edit
-# gives the file its own herdr tab instead, and both diff keys then match.
-set -uo pipefail
-if command -v acstack-edit >/dev/null 2>&1; then
-  case "${EDITOR:-}" in *acstack-edit) EDITOR=nvim ;; esac   # never nest
-  export ACSTACK_EDIT_EDITOR="${EDITOR:-nvim}"
-  export EDITOR=acstack-edit
-fi
-pick_checkout() {
-  # herdr groups worktrees as <root>/<repo>/<branch-slug>, so a pane often
-  # sits in the parent of several checkouts rather than in one.
-  local -a repos=()
-  while IFS= read -r d; do repos+=("$d"); done < <(
-    find . -mindepth 1 -maxdepth 1 -type d -exec test -e '{}/.git' \; -print 2>/dev/null | sort)
-  case ${#repos[@]} in
-    0) return 1 ;;
-    1) cd "${repos[0]}" && return 0 ;;
-    *) echo "Not a repo, but it holds ${#repos[@]} checkouts:"; echo
-       local i=1
-       for d in "${repos[@]}"; do
-         printf '  %d) %-34s %s\n' "$i" "${d#./}" "$(git -C "$d" branch --show-current 2>/dev/null)"
-         i=$((i+1))
-       done
-       echo; read -rp "Which one? [1-${#repos[@]}, q to quit] " choice
-       [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le ${#repos[@]} ] \
-         && cd "${repos[$((choice-1))]}" && return 0
-       return 1 ;;
-  esac
-}
-if ! git rev-parse --git-dir >/dev/null 2>&1; then
-  pick_checkout || { echo "No git checkout here: $PWD"; echo "Press any key..."; read -rsn1; exit 0; }
-fi
-
-BRANCH=$(git branch --show-current 2>/dev/null) || BRANCH=""
-[ -n "$BRANCH" ] || BRANCH="HEAD (detached)"
-
-# ---- refs -----------------------------------------------------------------
-ref_exists() { git rev-parse --verify --quiet "$1" >/dev/null 2>&1; }
-first_ref() { local r; for r in "$@"; do ref_exists "$r" && { echo "$r"; return 0; }; done; return 1; }
-dev_ref()     { first_ref origin/dev dev; }          # the server's dev wins over a stale local one
-              # default_compare falls back to the default branch only where no dev branch exists
-default_ref() {
-  local d; d=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null)
-  [ -n "$d" ] && { echo "$d"; return 0; }
-  first_ref origin/main main origin/master master
-}
-tip() {  # tip <ref> -> "1b298bd . 4 hours ago . Merge pull request ..."
-  # kept short: diffnav's content pane is narrower than the popup, so a long
-  # line wraps and the banner stops looking like a banner.
-  git log -1 --format='%h  %ar  %s' "$1" 2>/dev/null | cut -c1-70
-}
-
-# ---- what diffnav cannot draw ---------------------------------------------
-# diffnav hands each file to delta, and delta dies on SIGABRT when one line
-# runs to hundreds of kilobytes. diffnav reports the child's death as
-# "FATA signal: aborted (core dumped)" and quits, so one such file takes the
-# whole diff down with it. A committed build artifact is what does it: this
-# project's own cli/dist/index.js.map holds a single 982,428-character line,
-# and the merge commit touching it aborted diffnav in 1.7 seconds.
-#
-# So the file goes, not the diff. Any file whose patch holds a line over the
-# limit is dropped and named in the banner, and the rest is drawn as usual.
-# 20000 is far above any line a person writes and far below where delta gives
-# out. Raise or lower it with ACSTACK_DIFF_LINE_LIMIT.
-LINE_LIMIT_DEFAULT=20000
-LINE_LIMIT="${ACSTACK_DIFF_LINE_LIMIT:-$LINE_LIMIT_DEFAULT}"
-# awk compares a length against whatever this holds. Hand it "abc" and every
-# comparison is a string comparison that is never true, so the guard turns
-# itself off and the abort comes back with nothing on screen to explain it.
-# Hand it 0 and every file is dropped instead. Refuse both, out loud.
-case "$LINE_LIMIT" in
-  ''|0|*[!0-9]*)
-    echo "acstack-diff: ACSTACK_DIFF_LINE_LIMIT is \"$LINE_LIMIT\", which is not a" >&2
-    echo "  positive whole number. Using $LINE_LIMIT_DEFAULT." >&2
-    LINE_LIMIT=$LINE_LIMIT_DEFAULT ;;
-esac
-drop_unrenderable() {  # drop_unrenderable <skipped-file>  ; diff in, diff out
-  # One file at a time: a patch has to be held whole before its longest line
-  # is known. Everything before the first "diff --git" is a header, so it goes
-  # straight through. Written for gawk, mawk and busybox awk alike.
-  awk -v lim="$LINE_LIMIT" -v skip="$1" '
-    function flush() {
-      if (path == "") return
-      # A tab between the two fields. banner reads this file back and splits
-      # on the same tab, so the two have to move together.
-      if (long) printf "%s\t%d\n", path, maxlen > skip
-      else for (i = 1; i <= n; i++) print buf[i]
-    }
-    /^diff --git / {
-      flush()
-      split("", buf); n = 0; long = 0; maxlen = 0
-      path = $0; sub(/^diff --git a\//, "", path); sub(/ b\/.*$/, "", path)
-      if (path == "") path = "?"
-    }
-    {
-      if (path == "") { print; next }
-      if (length($0) > maxlen) maxlen = length($0)
-      if (length($0) > lim) long = 1
-      buf[++n] = $0
-    }
-    END { flush() }'
-}
-
-# ---- banner ---------------------------------------------------------------
-banner() {  # banner <source-label> <change-label> <what> <command>
-  # No line may start with a space: diffnav strips leading whitespace, so any
-  # indentation collapses and columns stop lining up.
-  printf 'COMPARING  %s  ==>  %s\n' "$1" "$2"
-  # base and compare repeat their ref so each row ties back to the first line.
-  [ -n "${SRC_TIP:-}" ] && printf 'base     %s\n' "$(printf '%s  %s' "$1" "$SRC_TIP" | cut -c1-70)"
-  [ -n "${CHG_TIP:-}" ] && printf 'compare  %s\n' "$(printf '%s  %s' "$2" "$CHG_TIP" | cut -c1-70)"
-  printf 'showing  %s\n' "$3"
-  printf 'command  %s\n' "$4"
-  # A dropped file is named here rather than left to be noticed as missing.
-  # The tab is what drop_unrenderable writes between the two fields.
-  [ -s "${SKIP:-}" ] && while IFS="$(printf '\t')" read -r p len; do
-    printf 'skipped  %s  (one line is %s chars, and diffnav aborts on it)\n' "$p" "$len"
-  done < "$SKIP"
-  return 0
-}
-launch() {  # launch <source> <change> <what> <git-args...>
-  local src="$1" chg="$2" what="$3"; shift 3
-  local cmd="git $*"
-  local tmp; tmp=$(mktemp); SKIP=$(mktemp)
-  git "$@" 2>/dev/null | drop_unrenderable "$SKIP" > "$tmp"
-  if grep -q '^diff --git' "$tmp"; then
-    # diffnav puts the line after "commit <sha>" in its status bar, and the bar
-    # stays put while you walk the file tree. A git show stream carries its own
-    # header, so only a plain diff needs one synthesised.
-    { [ "${1:-}" = diff ] && printf 'commit %s\n' "$(git rev-parse HEAD 2>/dev/null)"
-      banner "$src" "$chg" "$what" "$cmd"; echo; cat "$tmp"; } | diffnav
-  else
-    # Nothing for diffnav to draw, for one of two different reasons. The
-    # banner and the wait for a keypress are the same either way, so only the
-    # explanation sits inside the branch.
-    banner "$src" "$chg" "$what" "$cmd"
-    echo
-    if [ -s "$SKIP" ]; then
-      echo "  Every file that changed carries a line too long for diffnav."
-      echo "  They are named above, and nothing else differs between these two."
-    else
-      echo "  No difference between these two. Nothing to show."
-      local dirty; dirty=$(git status --porcelain 2>/dev/null | grep -cv '^??')
-      if [ "${dirty:-0}" -gt 0 ]; then
-        echo "  You do have $dirty file(s) changed but not committed."
-        echo "  Press alt+x and pick \"my uncommitted changes\" to see them."
-      else
-        echo "  Press alt+x to compare something else."
-      fi
-    fi
-    echo; echo "Press any key..."; read -rsn1
-  fi
-  rm -f "$tmp" "$SKIP"
-}
-
-# ---- comparisons ----------------------------------------------------------
-against() {  # against <base-ref> <committed|everything>
-  local base="$1" mode="$2" mb
-  SRC_TIP=$(tip "$base")
-  mb=$(git merge-base "$base" HEAD 2>/dev/null); mb=${mb:0:9}
-  [ -n "$mb" ] || { echo "No common history between $base and $BRANCH."
-                    echo; echo "Press any key..."; read -rsn1; return 1; }
-  if [ "$mode" = committed ]; then
-    CHG_TIP=$(tip HEAD)
-    launch "$base" "$BRANCH" \
-      "commits on $BRANCH that $base does not have" \
-      diff "$base...HEAD"
-  else
-    CHG_TIP="the files as they sit on disk right now"
-    launch "$base" "$BRANCH plus my uncommitted changes" \
-      "everything $BRANCH has since it left $base, committed or not" \
-      diff "$mb"
-  fi
-}
-local_only() {
-  SRC_TIP=$(tip HEAD); CHG_TIP="the files as they sit on disk right now"
-  launch "the newest commit on $BRANCH" "my uncommitted changes" \
-    "edits I have made but not committed, staged or not" diff HEAD
-}
-one_commit() {  # one_commit <sha>
-  SRC_TIP=$(tip "$1^" 2>/dev/null); CHG_TIP=$(tip "$1")
-  launch "the commit just before $1" "commit $1" "what this one commit changed" \
-    show "$1" -m --first-parent
-}
-auto() {  # fallback when there is no branch comparison to make; $1 says why
-  local why="${1:-nothing new to compare against another branch}"
-  if ! git diff --quiet || ! git diff --cached --quiet; then local_only
-  else SRC_TIP=$(tip HEAD^ 2>/dev/null); CHG_TIP=$(tip HEAD)
-       launch "$BRANCH one commit back" "$BRANCH at its newest commit" \
-         "$why, and nothing is uncommitted, so here is that commit alone" \
-         show HEAD -m --first-parent; fi
-}
-
-# ---- picker ---------------------------------------------------------------
-strip_ansi() { sed 's/\x1b\[[0-9;]*m//g'; }
-pick_ref() {  # pick_ref <prompt> -> a branch name
-  git for-each-ref --sort=-committerdate --format='%(refname:short)' \
-      refs/heads refs/remotes 2>/dev/null | grep -v '^origin/HEAD$' \
-    | fzf --prompt="$1 > " --no-multi --cycle --preview-window='right,60%' \
-          --preview='git log --oneline --decorate --color=always -20 {}'
-}
-pick_commit() {  # pick_commit -> a short sha
-  git log --oneline --decorate --color=always -300 2>/dev/null \
-    | fzf --ansi --prompt="commit > " --no-multi --cycle --preview-window='right,60%' \
-          --preview='git show --stat --color=always {1}' \
-    | strip_ansi | awk '{print $1}'
-}
-pick() {
-  command -v fzf >/dev/null 2>&1 || { echo "fzf is not installed."; echo; auto; return; }
-  local dev def choice a b
-  dev=$(dev_ref); def=$(default_ref)
-  local -a rows=()
-  row() { rows+=("$(printf '%s\t%-24s ==>  %-30s %s' "$1" "$2" "$3" "$4")"); }
-  [ -n "$dev" ] && [ "$dev" != "$BRANCH" ] && {
-    row dev-committed  "$dev" "$BRANCH"                "committed work only"
-    row dev-everything "$dev" "$BRANCH + uncommitted"  "committed work plus what is not committed"; }
-  [ -n "$def" ] && [ "$def" != "$BRANCH" ] && [ "$def" != "$dev" ] && {
-    row def-committed  "$def" "$BRANCH"                "committed work only"
-    row def-everything "$def" "$BRANCH + uncommitted"  "committed work plus what is not committed"; }
-  row local  "HEAD"        "my uncommitted work" "staged and unstaged changes only"
-  row commit "its parent"  "one commit"          "pick a commit from this branch's history"
-  row branch "any branch"  "any branch"          "pick the source, then the branch to compare"
-  choice=$(printf '%s\n' "${rows[@]}" \
-    | fzf --delimiter=$'\t' --with-nth=2.. --no-multi --cycle \
-          --prompt="diff > " --header="on $BRANCH   ·   source ==> change" \
-    | cut -f1)
-  case "$choice" in
-    dev-committed)  against "$dev" committed ;;
-    dev-everything) against "$dev" everything ;;
-    def-committed)  against "$def" committed ;;
-    def-everything) against "$def" everything ;;
-    local)          local_only ;;
-    commit)         a=$(pick_commit); [ -n "$a" ] && one_commit "$a" ;;
-    branch)         a=$(pick_ref "source (compare against)") ; [ -z "$a" ] && exit 0
-                    b=$(pick_ref "change (the new work)")    ; [ -z "$b" ] && exit 0
-                    SRC_TIP=$(tip "$a"); CHG_TIP=$(tip "$b")
-                    launch "$a" "$b" "commits on $b that $a does not have" diff "$a...$b" ;;
-    *)              exit 0 ;;
-  esac
-}
-
-# ---- entry ----------------------------------------------------------------
-default_compare() {  # alt+f: the newest commit on this branch, against origin/dev
-  local base; base=$(dev_ref) || base=$(default_ref)
-  # Only when this checkout IS the base branch is there nothing to compare.
-  if [ -z "$base" ] || [ "$base" = "$BRANCH" ] || [ "origin/$BRANCH" = "$base" ]; then
-    auto "$BRANCH is the branch everything else compares against"; return; fi
-  against "$base" committed
-}
-case "${1:-}" in
-  "")   default_compare ;;
-  pick) pick ;;
-  auto) auto ;;
-  *)    echo "usage: acstack-diff [pick|auto]"; exit 2 ;;
-esac
-H
-  chmod +x "$BIN/acstack-diff"
-
-  cat > "$BIN/acstack-dash" <<'H'
-#!/usr/bin/env bash
-# gh-dash with a section for the repo you are standing in. Installed by acstack.
-set -uo pipefail
-# Every action gh-dash takes shells out to gh and discards its stderr, so a
-# refusal from GitHub reaches you as "exit status 1" for two seconds. acstack-gh
-# goes in front of the real gh under that name and speaks the refusal aloud.
-# Its directory holds nothing else, so nothing else on PATH is shadowed.
-SHIM="$(mktemp -d)"; GEN=""
-trap 'rm -rf "$SHIM"; rm -f "$GEN"' EXIT
-ln -s "$(command -v acstack-gh)" "$SHIM/gh" 2>/dev/null && export PATH="$SHIM:$PATH"
-BASE="$HOME/.config/gh-dash/config.yml"
-REPO="$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null)"
-# Not exec, so the trap above still gets to clean up after the dashboard.
-[ -z "$REPO" ] && { gh dash "$@"; exit $?; }
-GEN="$(mktemp)"
-REPO="$REPO" python3 - "$BASE" "$GEN" <<'PY'
-import os, sys, yaml
-cfg = yaml.safe_load(open(sys.argv[1])) or {}
-repo = os.environ["REPO"]; short = repo.split("/")[-1]
-s = [x for x in cfg.get("prSections", []) if x.get("title") != short]
-s.insert(0, {"title": short, "filters": f"repo:{repo} is:open"})
-cfg["prSections"] = s
-yaml.safe_dump(cfg, open(sys.argv[2], "w"), sort_keys=False)
-PY
-gh dash --config "$GEN" "$@"
-H
-  chmod +x "$BIN/acstack-dash"
-
-  cat > "$BIN/acstack-db" <<'H'
-#!/usr/bin/env bash
-# Open harlequin, the SQL editor, on one of your connection profiles.
-#
-#   acstack-db            one profile launches straight in, more than one opens a menu
-#   acstack-db <profile>  that profile, no menu
-#
-# Profiles live in a TOML file of your own. This writes a starter the first
-# time and never touches it again. Installed by acstack.
-set -uo pipefail
-# apply rewrites this line from harlequin.config_path. What ships here is the
-# default, so the helper is right even on a machine nothing rewrote it on.
-DB_CFG_DEFAULT="~/.config/acstack/harlequin.toml"  # acstack:config_path
-CFG="${ACSTACK_DB_CONFIG:-$DB_CFG_DEFAULT}"
-# A human writes ~ for home, and a human writes this config. Expanding it here
-# rather than at write time keeps the helper right on a machine whose HOME is
-# not the one apply ran under.
-case "$CFG" in
-  "~")   CFG="$HOME" ;;
-  "~/"*) CFG="$HOME/${CFG#\~/}" ;;
-esac
-
-command -v harlequin >/dev/null 2>&1 || {
-  echo "harlequin is not installed. Run: setup.sh apply"; exit 1; }
-
-if [ ! -f "$CFG" ]; then
-  mkdir -p "$(dirname "$CFG")"
-  cat > "$CFG" <<'T'
-# harlequin connection profiles. acstack wrote this once and will not write it
-# again. Edit it freely.
-default_profile = "local"
-
-[profiles.local]
-adapter = "postgres"
-conn_str = "postgres://localhost:5432/postgres"
-
-# Snowflake. Take the # marks off and fill in your own account.
-#
-# Put the credentials in ~/.snowflake/connections.toml and name the connection
-# here, rather than writing them into this file.
-#
-# externalbrowser authentication needs a browser on this machine. A dev machine
-# reached over SSH has none, so use a key pair or a password instead.
-#
-# [profiles.snowflake]
-# adapter = "snowflake"
-# connection_name = "default"
-T
-  echo "wrote a starter config at $CFG - edit it to reach your own database"
-fi
-
-launch() { exec harlequin --config-path "$CFG" -P "$1"; }
-[ $# -gt 0 ] && launch "$1"
-
-# Profile names, read with a regex rather than tomllib: tomllib needs python
-# 3.11 and nothing else this script writes has a floor that high. Names are all
-# that is wanted here, and a table header is the one line a regex reads safely.
-rows=$(python3 - "$CFG" <<'PY'
-import re, sys
-text = open(sys.argv[1]).read()
-d = re.search(r'(?m)^\s*default_profile\s*=\s*"([^"]+)"', text)
-default = d.group(1) if d else ""
-for m in re.finditer(r'(?m)^\s*\[profiles\.("?)([^\]"]+)\1\]\s*$', text):
-    name = m.group(2)
-    body = text[m.end():].split("\n[", 1)[0]
-    a = re.search(r'(?m)^\s*adapter\s*=\s*"([^"]+)"', body)
-    mark = "   (default)" if name == default else ""
-    print("%s\t%-24s %-12s%s" % (name, name, a.group(1) if a else "?", mark))
-PY
-)
-count=$(printf '%s\n' "$rows" | grep -c .)
-case "$count" in
-  0) echo "no profiles in $CFG"; exit 1 ;;
-  1) launch "$(printf '%s' "$rows" | cut -f1)" ;;
-esac
-
-command -v fzf >/dev/null 2>&1 || {
-  echo "fzf is not installed, so there is no menu. Naming a profile still works:"
-  printf '%s\n' "$rows" | cut -f1 | sed 's/.*/  acstack-db "&"/'
-  exit 1; }
-
-choice=$(printf '%s\n' "$rows" \
-  | fzf --delimiter=$'\t' --with-nth=2.. --no-multi --cycle \
-        --prompt="db > " --header="harlequin   ·   profile   adapter" \
-  | cut -f1)
-[ -n "$choice" ] || exit 0
-launch "$choice"
-H
-  chmod +x "$BIN/acstack-db"
-  # The one helper with a path in the config, so the one write that is not a
-  # heredoc on its own. The line above already holds the default, so this
-  # carries nothing but a value the user chose.
-  ACSTACK_DB_CFG="$(cfg_get harlequin.config_path "~/.config/acstack/harlequin.toml")" \
-    py "$BIN/acstack-db" <<'PY'
-import os, re, sys
-# A bash single-quoted literal, so a path with a space or a quote in it reaches
-# the helper as one word rather than as shell syntax.
-v = "'" + os.environ["ACSTACK_DB_CFG"].replace("'", "'\\''") + "'"
-p = sys.argv[1]
-t = open(p).read()
-t, n = re.subn(r"(?m)^DB_CFG_DEFAULT=.*# acstack:config_path$",
-               lambda m: "DB_CFG_DEFAULT=" + v + "  # acstack:config_path", t)
-if n:
-    open(p, "w").write(t)
-PY
-
-  cat > "$BIN/acstack-gh" <<'H'
-#!/usr/bin/env bash
-# gh, plus the reason a pull request action failed.
-#
-# gh-dash runs gh for everything it does to a pull request - approve, comment,
-# merge - and throws the command's stderr away, so GitHub refusing one shows as
-# "exit status 1" in the footer for two seconds and nothing else. Approving your
-# own pull request is the everyday case: GitHub always refuses that, and the
-# dashboard looks like it simply ignored the keypress.
-#
-# acstack-dash links this into a directory of its own at the front of $PATH
-# under the name gh, so gh-dash finds it first. Everything is handed to the real
-# gh untouched and its exit code is returned as-is; the only thing added is a
-# notification when an action fails, because a suspended TUI cannot print for
-# us. Installed by acstack.
-set -uo pipefail
-
-# The real gh is the first one on $PATH that is not this script under another
-# name. Comparing what each resolves to sees through both the link acstack-dash
-# makes and a plain copy of this file.
-ME="$(readlink -f "$0")"
-REAL=""
-while IFS= read -r dir; do
-  [ -n "$dir" ] && [ -x "$dir/gh" ] || continue
-  [ "$(readlink -f "$dir/gh")" = "$ME" ] && continue
-  REAL="$dir/gh"; break
-done < <(printf '%s\n' "${PATH//:/$'\n'}")
-[ -n "$REAL" ] || { echo "acstack-gh: no gh on \$PATH besides this shim" >&2; exit 127; }
-
-# The dashboard is not an action: it owns the terminal for as long as it runs.
-[ "${1:-}" = "dash" ] && exec "$REAL" "$@"
-
-ERR="$(mktemp)"; trap 'rm -f "$ERR"' EXIT
-"$REAL" "$@" 2>"$ERR"
-RC=$?
-cat "$ERR" >&2
-
-# Only what a dashboard key fires. gh's own plumbing - repo view, api, auth -
-# fails for reasons a notification cannot help with, and acstack-dash asks gh
-# which repository this is before the dashboard has even started.
-case "${1:-}" in pr|issue) ;; *) exit $RC ;; esac
-[ "$RC" -eq 0 ] && exit 0
-
-MSG="$(grep -v '^[[:space:]]*$' "$ERR" | head -3)"
-[ -n "$MSG" ] || MSG="gh exited with status $RC"
-command -v herdr >/dev/null 2>&1 \
-  && herdr notification show "gh ${1:-} ${2:-} failed" --body "$MSG" >/dev/null 2>&1
-exit $RC
-H
-  chmod +x "$BIN/acstack-gh"
-
-  cat > "$BIN/acstack-md" <<'H'
-#!/usr/bin/env bash
-# Read a markdown file in the terminal with its mermaid diagrams drawn as text.
-#
-#   acstack-md FILE.md              render to the terminal
-#   acstack-md --preview FILE.md    render into a preview pane: width from
-#                                   $COLUMNS, straight to stdout, no pager
-#   acstack-md --numbered FILE.md   the source instead, line numbers down the
-#                                   left, for quoting a line back in a review
-#   acstack-md --toggle-line-numbers  flip which of the two --preview shows
-#   acstack-md --diagram N FILE.md  one diagram alone, with horizontal scroll
-#   acstack-md --serve FILE.md      serve it for a real browser, print the link
-#   acstack-md --html FILE.md       print that same page as one HTML document
-#   acstack-md --browser FILE.md    open it in the browser you are sitting at
-#
-# While reading, b opens the page in that browser and # switches between the
-# rendered document and its source with line numbers. $ACSTACK_MD_BROWSER_KEY
-# and $ACSTACK_MD_LINE_NUMBERS_KEY move them.
-#
-# Text, not images, is deliberate: herdr emits the kitty graphics protocol and
-# no terminal reachable from Windows or Android renders that, and e-ink panels
-# render text far better than bitmaps anyway. Installed by acstack.
-set -uo pipefail
-
-PORT="${ACSTACK_MD_PORT:-6419}"
-# Named rather than inherited from an ambient $AGENT_BROWSER_CDP, for the
-# reason acstack-open gives at its own bridge branch: leaning on the ambient
-# one launches a headless Chrome nobody can see and calls it success.
-BRIDGE="${ACSTACK_BRIDGE_URL:-http://127.0.0.1:19988}"
-OPENER="${ACSTACK_OPENER_URL:-http://127.0.0.1:19989}"
-# The opener refuses anything without this, so its absence is the same as the
-# opener being down - which is exactly how the route probe treats it.
-OPENER_TOKEN="${XDG_CONFIG_HOME:-$HOME/.config}/acstack/opener.token"
-SERVE=0; ONLY=0; PREVIEW=0; HTML=0; BROWSER=0; NUMBERED=0; TOGGLE=0
-usage() { echo "usage: acstack-md [--preview] [--numbered] [--toggle-line-numbers] [--diagram N] [--serve|--html|--browser] FILE.md" >&2; exit 1; }
-# The preview pane and the key that flips it are two processes that never meet,
-# so the choice between the rendered view and the source lives in a file both
-# of them can find. One name, defined once, is what keeps them agreeing.
-LINE_NUMBER_FLAG="${XDG_STATE_HOME:-$HOME/.local/state}/acstack/md-line-numbers"
-# A loop rather than a fixed order, so --preview composes with --diagram and
-# a caller can pass them either way round.
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --serve)   SERVE=1; shift ;;
-    --html)    HTML=1; shift ;;
-    --browser) BROWSER=1; shift ;;
-    --preview) PREVIEW=1; shift ;;
-    --numbered) NUMBERED=1; shift ;;
-    --toggle-line-numbers) TOGGLE=1; shift ;;
-    --diagram) ONLY="${2:-1}"; shift; [ $# -gt 0 ] && shift ;;
-    --)        shift; break ;;
-    --*)       usage ;;
-    *)         break ;;
-  esac
-done
-# The toggle names no file: it changes what the next preview will draw and has
-# nothing to draw itself. So it answers here, before the file check below.
-if [ "$TOGGLE" = "1" ]; then
-  if [ -e "$LINE_NUMBER_FLAG" ]; then
-    rm -f "$LINE_NUMBER_FLAG"
-    echo "acstack-md: markdown previews render again"
-  else
-    # A machine that has never had a state directory is every machine the
-    # first time, so make it rather than fail on it.
-    mkdir -p "$(dirname "$LINE_NUMBER_FLAG")" && : > "$LINE_NUMBER_FLAG" \
-      || { echo "acstack-md: could not write $LINE_NUMBER_FLAG" >&2; exit 1; }
-    echo "acstack-md: markdown previews show source with line numbers"
-  fi
-  exit 0
-fi
-# --preview, --serve and --html are three answers to the same question - where
-# does this end up - so at most one can be true. A preview pane is somewhere to
-# read, not somewhere to run a server or hand a document out of.
-if [ $((SERVE + PREVIEW + HTML + BROWSER)) -gt 1 ]; then
-  echo "acstack-md: --preview, --serve, --html and --browser do different things - pick one" >&2
-  exit 1
-fi
-# --numbered answers a different question - which of the two views - so it
-# composes with --preview and with nothing else. The others all want the
-# rendered document, and numbered source is not one.
-if [ "$NUMBERED" = "1" ] && [ $((SERVE + HTML + BROWSER)) -gt 0 ]; then
-  echo "acstack-md: --numbered prints the source, so --serve, --html and --browser have nothing to render" >&2
-  exit 1
-fi
-# The flag is what the file manager's key flips, and the pane is the only
-# place it applies: every other route was asked for a rendered document by
-# name, and the opener menu lists the numbered read as its own entry.
-#
-# --diagram is the exception the pane itself holds. It names one drawing to
-# show, which is a different question from which of the two views the pane is
-# on, and a reader who left the flag set and then asked for a diagram still
-# wants the diagram. So an explicit --diagram outranks the flag. An explicit
-# --numbered still wins over it, for the same reason in the other direction.
-if [ "$PREVIEW" = "1" ] && [ "$ONLY" = "0" ] && [ -e "$LINE_NUMBER_FLAG" ]; then NUMBERED=1; fi
-# Node labels set a diagram's width, so padding cannot rescue a wide one.
-# Tightening still buys roughly a third of the height back.
-PAD="${ACSTACK_MD_PAD:--x 2 -y 2}"
-# A caller that exports COLUMNS means it, so it wins outright. tput reads
-# COLUMNS too, ahead of terminfo, but that is a side effect worth naming
-# rather than resting on - it goes when TERM is unset and tput fails.
-case "${COLUMNS:-}" in
-  ''|*[!0-9]*) COLS=$(tput cols 2>/dev/null || echo 80) ;;
-  *)           COLS="$COLUMNS" ;;
-esac
-[ "$COLS" -gt 0 ] 2>/dev/null || COLS=80
-FILE="${1:-}"
-[ -n "$FILE" ] && [ -f "$FILE" ] || usage
-# One place to clean up, so no exit path leaks a temp file.
-trap "rm -f /tmp/acstack-md.$$.md /tmp/acstack-md-out.$$.md /tmp/acstack-md-art.$$.* /tmp/acstack-md-keys.$$" EXIT
-
-# Wanting a document in a browser happens while reading it, so the key belongs
-# in the pager rather than before or after one.
-#
-# less has no action that runs a fixed command, and its one shell escape
-# expands % to the file it was handed - which here is the rendered temp copy,
-# not the markdown someone asked for. So the key quits instead: lesskey's quit
-# action takes the first character of its extra string as the exit status, and
-# "A" is 65, a value less never returns of its own accord. Nothing has to be
-# passed through the binding, because this script already knows the file.
-BROWSE_STATUS=65
-BROWSE_KEY="${ACSTACK_MD_BROWSER_KEY:-b}"
-# The same trick a second time, for the other thing a reader wants mid-document.
-# Wanting a line number happens while reading too - that is the moment you are
-# about to quote one - and by then the file list with its own binding is not in
-# front of you. So the key means the same thing in both places.
-NUMBER_STATUS=66
-NUMBER_KEY="${ACSTACK_MD_LINE_NUMBERS_KEY:-#}"
-KEYS="/tmp/acstack-md-keys.$$"
-
-# A preview pane cannot page, so the same render goes straight to stdout.
-emit() {
-  local f="$1" nk rc; shift
-  if [ "$PREVIEW" = "1" ]; then cat "$f"; return; fi
-  # The binding is a less feature, so only less is handed it. Setting
-  # LESSKEYIN for a pager that never reads it is at best noise, and acting on
-  # an exit status that pager chose for its own reasons is a bug waiting.
-  case "${1:-}" in
-    less|*/less)
-      # b is back-a-page in less. ^B and PageUp both still do that, so this
-      # costs nothing (measured). LESSKEYIN wants less 582 or newer; older
-      # versions ignore it and quietly keep b as it was.
-      #
-      # lesskey reads a line starting with # as a comment, so the key that
-      # means line numbers has to be escaped or the binding is silently
-      # dropped and the key does nothing but ring the bell - measured on less
-      # 590, and how this arrived as a bug report. Only a leading # needs it:
-      # backslash means something of its own to lesskey, and \b would bind
-      # backspace rather than the letter.
-      case "$NUMBER_KEY" in
-        '#'*) nk="\\$NUMBER_KEY" ;;
-        *)    nk="$NUMBER_KEY" ;;
-      esac
-      { printf '#command\n'
-        printf '%s quit A\n' "$BROWSE_KEY"
-        printf '%s quit B\n' "$nk"
-      } > "$KEYS"
-      LESSKEYIN="$KEYS" "$@" "$f"
-      rc=$?
-      if [ "$rc" = "$BROWSE_STATUS" ]; then
-        "$0" --browser "$FILE"
-        exit $?
-      fi
-      if [ "$rc" = "$NUMBER_STATUS" ]; then
-        # One key, both directions: the view you are not in is the one it
-        # takes you to. $FILE is the markdown throughout, never the rendered
-        # temp copy, so either re-read starts from the source again.
-        if [ "$NUMBERED" = "1" ]; then "$0" "$FILE"; else "$0" --numbered "$FILE"; fi
-        exit $?
-      fi
-      ;;
-    *) "$@" "$f" ;;
-  esac
-}
-
-# A wide diagram left a marker behind rather than art glow would wrap. Turn
-# the marker into a line a person can read and put the drawing back under it.
-# Both output paths run this: without it the marker reaches the reader raw.
-splice() {
-  ACSTACK_PID=$$ ACSTACK_PREVIEW="$PREVIEW" python3 - "$1" <<'PY'
-import os, pathlib, re, sys
-f = pathlib.Path(sys.argv[1])
-pid = os.environ["ACSTACK_PID"]
-preview = os.environ.get("ACSTACK_PREVIEW") == "1"
-lines = []
-for line in f.read_text().split("\n"):
-    m = re.search(r"\x00ACSTACKART(\d+)\x00", line)
-    if not m:
-        lines.append(line); continue
-    art = pathlib.Path(f"/tmp/acstack-md-art.{pid}.{m.group(1)}")
-    lines.append(re.sub(r"\x00ACSTACKART\d+\x00", f"Diagram {m.group(1)}:", line))
-    if art.exists():
-        # Art too wide for the pane would spill past it, so a preview pane
-        # keeps the placeholder and leaves the drawing to a full-width read.
-        if not preview:
-            lines.extend("  " + l for l in art.read_text().splitlines())
-        art.unlink()
-f.write_text("\n".join(lines) + "\n")
-PY
-}
-
-# Rendered markdown has no line numbers, and a reader who wants to quote a
-# line back in a review needs the file's own. The gutter is as wide as the
-# largest number in it, so the source stays on one column whatever the length.
-numbered() {  # numbered <file> -> stdout
-  local total width avail
-  total=$(awk 'END { print NR }' "$1")
-  width=${#total}
-  [ "$width" -lt 3 ] && width=3
-  if [ "$PREVIEW" = "1" ]; then
-    # A wrapped line makes the gutter lie about which source line you are
-    # looking at, and a pane has no arrow keys to pan with, so it chops.
-    avail=$((COLS - width - 2))
-    [ "$avail" -lt 1 ] && avail=1
-    awk -v w="$width" -v a="$avail" \
-      '{ printf "%" w "d  %s\n", NR, substr($0, 1, a) }' "$1"
-  else
-    awk -v w="$width" '{ printf "%" w "d  %s\n", NR, $0 }' "$1"
-  fi
-}
-
-if [ "$NUMBERED" = "1" ]; then
-  numbered "$FILE" > /tmp/acstack-md.$$.md
-  # -S chops rather than wraps, so the arrow keys pan across a long line
-  # instead of the gutter losing its column. emit sends a pane straight to
-  # stdout and keeps the browser key working in the pager, both unchanged.
-  emit /tmp/acstack-md.$$.md less -SR
-  exit 0
-fi
-
-# --browser names a destination rather than a rendering: work out where the
-# browser actually is, then pick the delivery that reaches it. acstack-open
-# already answers that question for URLs, so ask it rather than deciding the
-# same thing twice and drifting from it later.
-if [ "$BROWSER" = "1" ]; then
-  case "$(command -v acstack-open >/dev/null 2>&1 && acstack-open --why 2>/dev/null)" in
-    opener)
-      # The opener stores the document on the laptop and serves it to the
-      # browser there, so the page still works once this machine stops
-      # answering - and a re-render of the same file updates the tab already
-      # showing it instead of stacking up a second one. That reuse is why the
-      # key has to be stable per file: it is the absolute path, hex-encoded
-      # because a path may hold anything a URL cannot.
-      tok=$(cat "$OPENER_TOKEN" 2>/dev/null || true)
-      if [ -z "$tok" ]; then
-        echo "acstack-md: no opener token at $OPENER_TOKEN." >&2
-        echo "  run register-tasks.ps1 on the laptop to install one." >&2
-        exit 1
-      fi
-      hex() { od -An -v -tx1 | tr -d ' \n'; }
-      key=$(printf '%s' "$(cd "$(dirname "$FILE")" && pwd -P)/$(basename "$FILE")" | hex)
-      name=$(basename "$FILE")
-      # Vendored mermaid, uploaded once so diagrams draw without reaching a
-      # CDN. Best effort throughout: the opener redirects to the CDN when it
-      # has no copy, so a failure here costs nothing but an outbound fetch.
-      vendored="$HOME/.local/share/acstack/mermaid.min.js"
-      # tr, because whitespace inside JSON carries no meaning and a match that
-      # depends on its absence is a match waiting to break. Same reasoning as
-      # acstack-open's /json/list check.
-      if [ -s "$vendored" ] && ! curl -fsS -m 3 -H "X-ACStack-Token: $tok" \
-           "$OPENER/health" 2>/dev/null | tr -d '[:space:]' | grep -q '"mermaid":true'; then
-        curl -fsS -m 60 -X POST -H "X-ACStack-Token: $tok" \
-          --data-binary "@$vendored" "$OPENER/asset/mermaid.js" >/dev/null 2>&1 || true
-      fi
-      # The opener answers with what it did, and that answer is what success
-      # means - it says whether a tab was opened or a live one reused. An exit
-      # status of 0 is not a page that arrived.
-      answer=$(ACSTACK_MD_OPENER=1 "$0" --html "$FILE" \
-        | curl -fsS -m 60 -X POST -H "X-ACStack-Token: $tok" \
-            -H 'Content-Type: text/html; charset=utf-8' --data-binary @- \
-            "$OPENER/doc?key=$key&title=$(printf '%s' "$name" | hex)" 2>/dev/null \
-        | tr -d '[:space:]')
-      case "$answer" in
-        *'"reused":true'*)
-          printf '%s updated in the tab already open on your machine\n' "$name" >&2
-          exit 0 ;;
-        *'"opened":true'*)
-          printf '%s is on screen in the browser on your machine\n' "$name" >&2
-          exit 0 ;;
-      esac
-      echo "acstack-md: the opener did not confirm the page reached a browser." >&2
-      echo "  check it is up:  acstack-open --why" >&2
-      exit 1
-      ;;
-    bridge)
-      # Under `herdr --remote` the tunnel runs laptop-to-here, so nothing over
-      # there can open a port on this machine and a link to localhost:6419
-      # names the wrong localhost. Hand the whole document down the CDP link
-      # that is already open instead, and let Chrome hold it. That is also why
-      # --html exists: a document travels, a port does not.
-      #
-      # $0 is the path bash resolved this script to - absolute when it came off
-      # PATH - so the page pushed is the one --html renders, not a second copy
-      # of the renderer that can disagree with it.
-      html=$("$0" --html "$FILE") || exit 1
-      # base64 because the document is full of quotes and newlines and has to
-      # survive being a JavaScript string literal. tr rather than `base64 -w0`,
-      # which is GNU-only.
-      payload=$(printf '%s' "$html" | base64 | tr -d '\n')
-      # A tab of its own, and never over a page that is already there. The
-      # extension attaches per tab through chrome.debugger, and rewriting a
-      # real document detaches it - measured: pushing over an https page left
-      # /json/list empty and the bridge unusable until it was armed again by
-      # hand. A fresh about:blank tab survives the same rewrite, because the
-      # document being replaced has the same origin. So the armed tab is left
-      # exactly as it was, and this writes into a new one.
-      #
-      # The default session deliberately, as acstack-open explains: the relay
-      # takes one CDP client at a time, so a session of our own could not
-      # connect while an agent holds it.
-      #
-      # The last expression is the page title, so the browser answers with
-      # what it is now holding. That answer is what success means here - a
-      # command that exited 0 is not a page that arrived.
-      name=$(basename "$FILE")
-      timeout 20 agent-browser --cdp "$BRIDGE" tab new >/dev/null 2>&1
-      landed=$(printf 'const b64="%s";const doc=new TextDecoder().decode(Uint8Array.from(atob(b64),c=>c.charCodeAt(0)));document.open();document.write(doc);document.close();document.title;\n' \
-                 "$payload" \
-                 | timeout 60 agent-browser --cdp "$BRIDGE" eval --stdin 2>/dev/null)
-      # Writing into the tab is only half of it. A tab created over CDP is
-      # created in the background, so it has to be brought forward or the page
-      # is real, correct, and never seen - which is exactly how this first went
-      # wrong. agent-browser carries Page.bringToFront on its tab switch, so
-      # switch to the tab just written into, which is the one it already has
-      # selected. Best effort: a page in a background tab still beats an error.
-      # The arrow marks the active tab, which is the one just written into.
-      # Taking the first line instead would raise whatever sits at index 0 -
-      # somebody else's tab, and the page still unseen.
-      idx=$(timeout 20 agent-browser --cdp "$BRIDGE" tab list 2>/dev/null \
-              | grep -m1 -- "$(printf '\342\206\222')" \
-              | sed -n 's/.*\[\([0-9][0-9]*\)\].*/\1/p')
-      [ -n "$idx" ] && timeout 20 agent-browser --cdp "$BRIDGE" tab "$idx" >/dev/null 2>&1
-      case "$landed" in
-        *"$name"*)
-          printf '%s is on screen in the browser on your machine\n' "$name" >&2
-          exit 0 ;;
-      esac
-      # Serving instead would print a link the laptop resolves to its own
-      # localhost, which is a wrong answer dressed as a working one.
-      echo "acstack-md: the bridge answered but is not holding the page." >&2
-      echo "  the document goes to the tab the Playwriter extension is armed on." >&2
-      echo "  check something is still armed:  acstack-open --why" >&2
-      exit 1
-      ;;
-  esac
-  # Every other route has a browser that can reach this machine's ports, or a
-  # terminal that can hand someone a link. Serving is already exactly that.
-  SERVE=1
-fi
-
-if [ "$SERVE" = "1" ] || [ "$HTML" = "1" ]; then
-  # One program, two ways out: --serve keeps answering with the document,
-  # --html hands it over once and stops. Same renderer either way, so the two
-  # cannot drift into disagreeing about what the page looks like.
-  MODE=serve; NAME=acstack-md-serve
-  if [ "$HTML" = "1" ]; then MODE=html; NAME=acstack-md-html; fi
-  # A document bound for the opener on the laptop is handed over once, like
-  # --html, but it does end up behind a server - the opener's. So it wants the
-  # relative mermaid src that --html cannot use. Internal: set by the --browser
-  # dispatch below, never by a caller.
-  if [ "${ACSTACK_MD_OPENER:-0}" = "1" ] && [ "$HTML" = "1" ]; then MODE=opener; fi
-  # exec -a names the process. Without it a running server is just "python3 -"
-  # and there is nothing sensible to pkill.
-  exec -a "$NAME" python3 - "$FILE" "$PORT" "$MODE" <<'PY'
-import html, http.server, pathlib, re, socketserver, sys
-try:
-    import markdown
-except ImportError:
-    sys.exit("acstack-md: needs the python markdown package: pip install --user markdown")
-
-src, port, MODE = pathlib.Path(sys.argv[1]), int(sys.argv[2]), sys.argv[3]
-VENDOR = pathlib.Path.home() / ".local/share/acstack/mermaid.min.js"
-
-CSS = """*{box-sizing:border-box}body{max-width:54rem;margin:0 auto;padding:2rem 1.25rem;
-font:16px/1.65 -apple-system,Segoe UI,system-ui,sans-serif;color:#1a1a1a;background:#fff}
-h1,h2,h3{line-height:1.25;margin:2rem 0 .75rem}h1{font-size:1.9rem}h2{font-size:1.45rem}
-code{font:14px/1.5 ui-monospace,Consolas,monospace;background:#f2f2f2;padding:.15em .35em;border-radius:3px}
-pre{background:#f7f7f7;padding:1rem;border-radius:6px;overflow-x:auto}pre code{background:none;padding:0}
-pre.mermaid{background:none;text-align:center}table{border-collapse:collapse;width:100%}
-th,td{border:1px solid #ddd;padding:.4rem .6rem;text-align:left}
-blockquote{margin:1rem 0;padding:.1rem 1rem;border-left:3px solid #ccc;color:#555}
-img{max-width:100%}
-@media(prefers-color-scheme:dark){body{background:#151515;color:#e6e6e6}
-code{background:#242424}pre{background:#1d1d1d}th,td{border-color:#333}
-blockquote{border-color:#444;color:#aaa}}"""
-
-def render():
-    body = markdown.markdown(src.read_text(),
-        extensions=["fenced_code", "tables", "toc", "sane_lists"])
-    # mermaid.js wants <pre class="mermaid">, not a highlighted code block.
-    body = re.sub(r'<pre><code class="language-mermaid">(.*?)</code></pre>',
-                  lambda m: '<pre class="mermaid">' + html.unescape(m.group(1)) + "</pre>",
-                  body, flags=re.S)
-    # --serve answers for /mermaid.js itself off the vendored copy. A document
-    # standing on its own has no server behind it, so a relative src would be
-    # fetched from whatever host the page ended up on and find nothing there -
-    # it names the CDN instead. Inlining the vendored 3.5MB would make the page
-    # offline-proof and far too big to push through a CDP payload, which is the
-    # whole reason --html exists.
-    # The opener serves the page from the laptop and answers /mermaid.js off
-    # the copy this machine uploaded to it - falling back to the CDN itself if
-    # it has none. So a relative src is right there too, and unlike --serve it
-    # does not depend on this machine having vendored anything.
-    js = ('<script src="/mermaid.js"></script>'
-          if MODE == "opener" or (MODE == "serve" and VENDOR.exists()) else
-          '<script src="https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.min.js"></script>')
-    return f"""<!doctype html><html><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>{html.escape(src.name)}</title><style>{CSS}</style></head><body>
-{body}
-{js}
-<script>mermaid.initialize({{startOnLoad:true,securityLevel:"loose",
-theme:matchMedia("(prefers-color-scheme:dark)").matches?"dark":"default"}});</script>
-</body></html>""".encode()
-
-# Out before the port is ever looked at: a document is not a server, and a
-# caller that only wants the page must not be stopped by a busy 6419.
-if MODE in ("html", "opener"):
-    sys.stdout.buffer.write(render())
-    raise SystemExit
-
-class H(http.server.BaseHTTPRequestHandler):
-    def do_GET(self):
-        if self.path == "/mermaid.js" and VENDOR.exists():
-            body, ctype = VENDOR.read_bytes(), "application/javascript"
-        else:
-            body, ctype = render(), "text/html; charset=utf-8"   # re-read: edits show on reload
-        self.send_response(200)
-        self.send_header("Content-Type", ctype)
-        self.send_header("Content-Length", str(len(body)))
-        self.send_header("Cache-Control", "no-store")
-        self.end_headers()
-        self.wfile.write(body)
-    def log_message(self, *a): pass
-
-socketserver.TCPServer.allow_reuse_address = True
-def holder(port):
-    """pid and command line of whatever is listening, best effort."""
-    import subprocess
-    try:
-        out = subprocess.run(["ss", "-ltnpH", f"sport = :{port}"],
-                             capture_output=True, text=True, timeout=3).stdout
-        pid = re.search(r"pid=(\d+)", out)
-        if not pid:
-            return None, None
-        pid = pid.group(1)
-        cmd = pathlib.Path(f"/proc/{pid}/cmdline").read_bytes().replace(b"\0", b" ").decode()
-        return pid, cmd.strip()
-    except Exception:
-        return None, None
-
-try:
-    srv = socketserver.TCPServer(("127.0.0.1", port), H)
-except OSError as e:
-    pid, cmd = holder(port)
-    msg = [f"port {port} is busy: {e}"]
-    if pid:
-        mine = "acstack-md-serve" in cmd or "acstack-md" in cmd
-        msg.append(f"  held by pid {pid}: {cmd[:90]}")
-        msg.append(f"  stop it with:  kill {pid}" if mine else
-                   f"  not acstack-md. use another port:  ACSTACK_MD_PORT=<n> acstack-md --serve ...")
-    else:
-        msg.append("  could not identify the holder. try:  ss -ltnp | grep " + str(port))
-    sys.exit("\n".join(msg))
-url = f"http://localhost:{port}"
-# OSC 8 makes it ctrl+clickable; the bare URL below covers terminals without it.
-sys.stderr.write(f"\033]8;;{url}\033\\{src.name}\033]8;;\033\\  {url}\n")
-sys.stderr.write("  reload the page after editing. ctrl+C to stop.\n")
-if not VENDOR.exists():
-    sys.stderr.write("  note: mermaid.js not vendored, falling back to CDN\n")
-try: srv.serve_forever()
-except KeyboardInterrupt: pass
-PY
-fi
-
-
-# Terminal render: swap each mermaid fence for its text drawing, then page it.
-ACSTACK_COLS="$COLS" ACSTACK_PAD="$PAD" ACSTACK_ONLY="$ONLY" ACSTACK_RUN="$$" \
-ACSTACK_PREVIEW="$PREVIEW" \
-python3 - "$FILE" <<'PY' > /tmp/acstack-md.$$.md 2>/dev/null
-import os, pathlib, re, shlex, shutil, subprocess, sys, tempfile
-text = pathlib.Path(sys.argv[1]).read_text()
-# "$HOME/..." rather than the absolute path: shorter, and unlike ~'/x y'
-# it expands correctly when the path contains spaces.
-_raw = sys.argv[1]
-_home = str(pathlib.Path.home())
-SELF = ('"$HOME' + _raw[len(_home):].replace('"', '\\"') + '"'
-        if _raw.startswith(_home) else shlex.quote(_raw))
-have = shutil.which("mermaid-ascii")
-COLS = int(os.environ.get("ACSTACK_COLS") or 80)
-PAD = (os.environ.get("ACSTACK_PAD") or "").split()
-ONLY = int(os.environ.get("ACSTACK_ONLY") or 0)
-PREVIEW = os.environ.get("ACSTACK_PREVIEW") == "1"
-# glow indents and pads a fenced block, so the art has less room than the pane.
-BUDGET = max(20, COLS - 6)
-seen = 0
-
-# mermaid-ascii understands `graph`/`flowchart` with [square] nodes. It draws
-# styling directives as if they were nodes, and leaks any other shape syntax
-# into the label, so both are normalised away before it sees the source.
-DROP = re.compile(r"^\s*(style|classDef|class|linkStyle|click|%%)\b")
-SHAPES = [
-    (re.compile(r"(\w+)\{\{(.+?)\}\}"), r"\1[\2]"),   # {{hexagon}}
-    (re.compile(r"(\w+)\(\((.+?)\)\)"), r"\1[\2]"),   # ((circle))
-    (re.compile(r"(\w+)\(\[(.+?)\]\)"), r"\1[\2]"),   # ([stadium])
-    (re.compile(r"(\w+)\[\((.+?)\)\]"), r"\1[\2]"),   # [(database)]
-    (re.compile(r"(\w+)\{(.+?)\}"),     r"\1[\2]"),   # {decision}
-    (re.compile(r"(\w+)\((.+?)\)"),     r"\1[\2]"),   # (rounded)
-]
-
-def to_ascii(src):
-    if not have:
-        return None, "mermaid-ascii not installed"
-    body = "\n".join(l for l in src.splitlines() if not DROP.match(l))
-    for pat, rep in SHAPES:
-        body = pat.sub(rep, body)
-    if not re.match(r"\s*(graph|flowchart|sequenceDiagram)\b", body):
-        kind = (body.strip().split(None, 1) or ["?"])[0]
-        return None, f"{kind} diagrams are not supported by mermaid-ascii"
-    with tempfile.NamedTemporaryFile("w", suffix=".mmd", delete=False) as f:
-        f.write(body); path = f.name
-    # mermaid-ascii reads a file, not stdin. A preview redraws on every cursor
-    # move, so a file left behind here fills /tmp at cursor speed.
-    try:
-        r = subprocess.run(["mermaid-ascii", "--file", path] + PAD,
-                           capture_output=True, text=True)
-    finally:
-        os.unlink(path)
-    if r.returncode != 0 or not r.stdout.strip():
-        return None, (r.stderr.strip().splitlines() or ["could not draw it"])[0]
-    return r.stdout.rstrip("\n"), None
-
-def repl(m):
-    global seen
-    seen += 1
-    n = seen
-    art, err = to_ascii(m.group(1))
-    if not art:
-        # Keep the source visible rather than swallowing the diagram.
-        return (f"\n```\nDiagram {n} not drawn: {err}\n```\n\n"
-                f"```\n{m.group(1).rstrip()}\n```")
-    lines = art.splitlines()
-    width = max((len(l) for l in lines), default=0)
-    if ONLY:
-        # Raw, unwrapped, for a pager that can scroll sideways.
-        return "\0DIAGRAM%d\0%s\0" % (n, art) if n == ONLY else ""
-    if width > BUDGET:
-        # glow wraps whatever it renders, and wrapped box-drawing art is
-        # noise. Emit a marker instead and splice the raw art back in after
-        # glow has run, so prose wraps to the pane and the diagram does not.
-        run = os.environ.get("ACSTACK_RUN") or str(os.getpid())
-        # /tmp, not gettempdir(): the shell trap and the splicer both look
-        # there, and a stray $TMPDIR would hide the art from either.
-        art_path = pathlib.Path(f"/tmp/acstack-md-art.{run}.{n}")
-        art_path.write_text(art + "\n")
-        # The arrow keys belong to the pager. A preview pane has none, and
-        # opening the file is what draws the diagram there.
-        hint = "open it full width" if PREVIEW else "pans sideways with the arrow keys"
-        return f"\n```\n\x00ACSTACKART{n}\x00 {width} cols, {hint}\n```"
-    return "```\n" + art + "\n```"
-
-out = re.sub(r"```mermaid\n(.*?)```", repl, text, flags=re.S)
-if ONLY:
-    hit = re.search(r"\0DIAGRAM(\d+)\0(.*?)\0", out, re.S)
-    sys.stdout.write(hit.group(2) if hit else f"no diagram {ONLY} in this file\n")
-else:
-    sys.stdout.write(out)
-PY
-
-if [ "$ONLY" != "0" ]; then
-  # -S chops instead of wrapping: arrow keys scroll sideways.
-  emit /tmp/acstack-md.$$.md less -SR
-elif command -v glow >/dev/null 2>&1; then
-  # glow drops all styling when stdout is not a terminal, and its output has
-  # to be captured to splice the diagrams into, so it runs under a pty.
-  ACSTACK_COLS="$COLS" ACSTACK_STYLE="${ACSTACK_MD_STYLE:-}" \
-    python3 - /tmp/acstack-md.$$.md /tmp/acstack-md-out.$$.md <<'PY'
-import fcntl, os, pathlib, pty, re, struct, subprocess, sys, termios
-src, dst = pathlib.Path(sys.argv[1]), pathlib.Path(sys.argv[2])
-cols = int(os.environ.get("ACSTACK_COLS") or 80)
-# Leave glow on "auto": under a pty it picks its full palette. Pinning a
-# named style here gives a noticeably flatter one.
-style = os.environ.get("ACSTACK_STYLE") or ""
-
-cmd = ["glow", "-w", str(cols - 2)] + (["--style", style] if style else []) + [str(src)]
-master, slave = pty.openpty()
-# glow reads the width from the pty, not just -w, so set it to match.
-fcntl.ioctl(slave, termios.TIOCSWINSZ, struct.pack("HHHH", 200, min(cols, 65535), 0, 0))
-proc = subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=slave, stderr=subprocess.DEVNULL)
-os.close(slave)
-chunks = []
-while True:
-    try:
-        b = os.read(master, 65536)
-    except OSError:
-        break
-    if not b:
-        break
-    chunks.append(b)
-os.close(master); proc.wait()
-raw = b"".join(chunks)
-text = raw.decode("utf-8", "replace").replace("\r\n", "\n")
-# A pty makes glow probe the terminal for its background colour. Those replies
-# are meant for a real terminal, not a file, so drop them.
-text = re.sub(r"\x1b\][01][01];\?(\x07|\x1b\\)", "", text)
-text = re.sub(r"\x1b\[6n", "", text)
-dst.write_text(text)
-PY
-  splice /tmp/acstack-md-out.$$.md
-  emit /tmp/acstack-md-out.$$.md ${PAGER:-less -SR}
-else
-  splice /tmp/acstack-md.$$.md
-  emit /tmp/acstack-md.$$.md ${PAGER:-less -R}
-fi
-H
-  chmod +x "$BIN/acstack-md"
-
-  cat > "$BIN/acstack-view" <<'H'
-#!/usr/bin/env bash
-# View one file, picked by what the file is.
-#
-#   acstack-view README.md      rendered markdown, mermaid diagrams included
-#   acstack-view src/main.rs    yazi, opened with the cursor on that file
-#
-# tuicr's <leader>v hands us the file under its cursor. Everything this
-# dispatches to is a terminal program, so `q` hands the screen back to tuicr
-# the same way a terminal editor does - which is the whole reason the choice
-# lives in a script rather than in tuicr: changing it is an edit, not a
-# rebuild.
-# Installed by acstack.
-set -uo pipefail
-
-FILE="${1:-}"
-[ -n "$FILE" ] || { echo "usage: acstack-view <file>" >&2; exit 2; }
-[ -e "$FILE" ] || { echo "acstack-view: no such file: $FILE" >&2; exit 1; }
-
-# Markdown is worth rendering rather than listing: acstack-md draws mermaid
-# diagrams as text, and offers --serve for a browser when a diagram needs to
-# be rendered properly.
-case "$FILE" in
-  *.md|*.MD|*.markdown|*.Markdown|*.mdown|*.mkd)
-    command -v acstack-md >/dev/null 2>&1 && exec acstack-md "$FILE"
-    ;;
-esac
-
-# yazi opens on the file's own directory with the cursor on it, so the preview
-# pane shows the file and the tree is right there to move around in.
-command -v yazi >/dev/null 2>&1 && exec yazi "$FILE"
-
-# Neither installed: a pager still beats nothing, and -R keeps any colour.
-exec ${PAGER:-less -R} "$FILE"
-H
-  chmod +x "$BIN/acstack-view"
-
-  cat > "$BIN/acstack-popup" <<'H'
-#!/bin/sh
-# Run a herdr popup's command with this folder first on PATH.
-#
-#   acstack-popup <command> [args...]
-#
-# herdr runs a popup with its server's environment, not a login shell. A
-# server started by `herdr --remote` has the sshd default PATH, which lacks
-# this folder, so a bare popup target exits 127. apply calls this helper by
-# absolute path, and it finds its folder from $0. herdr and harlequin always
-# link into ~/.local/bin, so that goes on PATH too. The target and every tool
-# it starts then resolve whatever PATH the server has. Installed by acstack.
-PATH="$(dirname "$0"):$HOME/.local/bin:$PATH"; export PATH
-exec "$@"
-H
-  chmod +x "$BIN/acstack-popup"
-
-  cat > "$BIN/acstack-herdr-tab" <<'H'
-#!/usr/bin/env bash
-# Run a command in a new herdr tab, beside the pane the key was pressed in.
-#
-#   acstack-herdr-tab <label> <command> [args...]
-#
-# herdr has no type = "tab" custom command, and its tab.create API launches a
-# shell rather than a command, so the tab is created first and the command
-# sent into it with `herdr pane run`.
-#
-# The target comes from `herdr pane current`, not from HERDR_* variables: a
-# type = "shell" binding runs detached with none of them set, and reading the
-# environment sent every one of these commands off to run with no terminal.
-# Asked without that environment, herdr reports the focused pane, which is
-# exactly the one the key was pressed in. Installed by acstack.
-set -uo pipefail
-
-label="${1:?usage: acstack-herdr-tab <label> <command> [args...]}"; shift
-[ $# -gt 0 ] || { echo "acstack-herdr-tab: no command given" >&2; exit 1; }
-
-command -v herdr >/dev/null 2>&1 || exec "$@"
-
-cur=$(herdr pane current 2>/dev/null) || exec "$@"
-read -r ws cwd <<<"$(printf '%s' "$cur" | python3 -c '
-import json, sys
-p = json.load(sys.stdin).get("result", {}).get("pane", {})
-print(p.get("workspace_id") or "", p.get("foreground_cwd") or p.get("cwd") or "")
-' 2>/dev/null)"
-[ -n "${ws:-}" ] || exec "$@"
-
-resp=$(herdr tab create --workspace "$ws" ${cwd:+--cwd "$cwd"} --label "$label" --focus 2>/dev/null) \
-  || exec "$@"
-pane=$(printf '%s' "$resp" | python3 -c \
-  'import json,sys; print(json.load(sys.stdin)["result"]["root_pane"]["pane_id"])' 2>/dev/null)
-[ -n "$pane" ] || exec "$@"
-
-# herdr hosts a type = "shell" command in a real pane for as long as the
-# process lives, so anything slow here shows up as a stray terminal in the
-# current tab. Hand the wait to a detached child and return immediately: the
-# host pane then lasts only as long as the tab.create call.
-#
-# The settle is because the new tab's shell may not have drawn its prompt yet.
-# The pty buffers input, so it is belt and braces, not a correctness need.
-#
-# `herdr pane run` hands the string to a shell, so each argument is quoted on
-# the way in. A bare "$*" loses any file path holding a space.
-printf -v cmd '%q ' "$@"
-( sleep 0.3; herdr pane run "$pane" "$cmd" >/dev/null 2>&1 ) </dev/null >/dev/null 2>&1 &
-disown 2>/dev/null || true
-exit 0
-H
-  chmod +x "$BIN/acstack-herdr-tab"
-
-  cat > "$BIN/acstack-edit" <<'H'
-#!/usr/bin/env bash
-# Open one file in its own herdr tab, for tools that shell out to $EDITOR.
-#
-#   acstack-edit <file>
-#
-# diffnav's "o" key runs $EDITOR inside diffnav's own pane. For alt+f and alt+x
-# that pane is a herdr popup, and a popup cannot host a second full-screen app,
-# so the editor never draws and the key looks dead. This gives the file its own
-# herdr tab and returns at once, which leaves the diff untouched behind the
-# popup. Close the popup to reach the tab.
-#
-# ACSTACK_EDIT_EDITOR names the real editor: whatever set this script as
-# $EDITOR has already taken that variable.
-#
-# acstack-herdr-tab does the work. It finds the pane behind the popup, creates
-# the tab, and runs the editor in it, and it runs the editor in place when
-# there is no herdr to ask. Installed by acstack.
-set -uo pipefail
-
-ED="${ACSTACK_EDIT_EDITOR:-nvim}"
-case "$ED" in *acstack-edit) ED=nvim ;; esac   # never call itself
-FILE="${1:?usage: acstack-edit <file>}"
-
-command -v acstack-herdr-tab >/dev/null 2>&1 || exec "$ED" "$FILE"
-exec acstack-herdr-tab "$(basename "$FILE")" "$ED" "$FILE"
-H
-  chmod +x "$BIN/acstack-edit"
-
-  cat > "$BIN/acstack-herdr-renumber" <<'H'
-#!/usr/bin/env python3
-"""Make the herdr sidebar numbers match prefix+1..9.
-
-herdr draws a workspace's position in its stored list, but prefix+N targets the
-row's position in the grouped sidebar, where worktrees sit indented under their
-parent repo. The two agree until you create or tear down a worktree: new ones
-append to the end of the list but appear mid-sidebar under their parent, so the
-numbers you read stop being the numbers you press.
-
-This rewrites the stored order to match the grouped order, so both agree again.
-Run it after adding or removing a worktree. Safe to run repeatedly. Installed
-by acstack.
-"""
-import json
-import os
-import socket
-import sys
-
-
-def socket_path():
-    override = os.environ.get("HERDR_SOCKET_PATH")
-    if override:
-        return override
-    config = os.environ.get("XDG_CONFIG_HOME") or os.path.expanduser("~/.config")
-    return os.path.join(config, "herdr", "herdr.sock")
-
-
-def call(method, params=None):
-    try:
-        conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        conn.connect(socket_path())
-    except OSError as err:
-        sys.exit(f"acstack-herdr-renumber: no herdr server at {socket_path()} ({err})")
-    with conn:
-        conn.sendall((json.dumps({"id": "renumber", "method": method,
-                                  "params": params or {}}) + "\n").encode())
-        buf = b""
-        while not buf.endswith(b"\n"):
-            chunk = conn.recv(65536)
-            if not chunk:
-                break
-            buf += chunk
-    lines = buf.decode().strip().splitlines()
-    if not lines:
-        sys.exit(f"acstack-herdr-renumber: herdr closed the connection during {method}")
-    reply = json.loads(lines[0])
-    if "error" in reply:
-        sys.exit(f"acstack-herdr-renumber: {method} failed: {reply['error']}")
-    return reply
-
-
-def workspaces():
-    return call("workspace.list")["result"]["workspaces"]
-
-
-def grouped_order(spaces):
-    """The order the sidebar draws: every repo's rows contiguous, the repo
-    checkout above the worktrees indented under it, stored order within each
-    of those two parts. A group sits where its repo checkout sits, not where
-    its first row happens to sit, so a worktree cannot drag its parent up."""
-    groups, anchors = {}, {}
-    for position, space in enumerate(spaces):
-        tree = space.get("worktree") or {}
-        root = tree.get("repo_root") or space["workspace_id"]
-        groups.setdefault(root, []).append((bool(tree.get("is_linked_worktree")),
-                                            position, space["workspace_id"]))
-        if not tree.get("is_linked_worktree") and root not in anchors:
-            anchors[root] = position
-    # A group of nothing but worktrees, its repo checkout never opened, anchors
-    # on its first row instead.
-    for root, members in groups.items():
-        anchors.setdefault(root, min(position for _, position, _ in members))
-    order = []
-    for root in sorted(groups, key=lambda key: anchors[key]):
-        order.extend(wid for _, _, wid in sorted(groups[root]))
-    return order
-
-
-def main():
-    before = workspaces()
-    target = grouped_order(before)
-    if [space["workspace_id"] for space in before] == target:
-        print("already aligned")
-    else:
-        for index, workspace_id in enumerate(target):
-            call("workspace.move", {"workspace_id": workspace_id, "insert_index": index})
-    for space in workspaces():
-        indent = "  " if (space.get("worktree") or {}).get("is_linked_worktree") else ""
-        print(f"{space['number']:>3}  {indent}{space['label']}")
-
-
-if __name__ == "__main__":
-    main()
-H
-  chmod +x "$BIN/acstack-herdr-renumber"
-
-  cat > "$BIN/acstack-clip" <<'H'
-#!/usr/bin/env bash
-# Put text on the clipboard of the machine your terminal is on.
-#
-#   acstack-clip "text"      copy the arguments
-#   ... | acstack-clip       copy stdin
-#   acstack-clip --out       print what was copied last
-#
-# A VM reached over SSH has no display and no clipboard of its own, so
-# xclip and friends have nothing to talk to. OSC 52 is the escape sequence
-# that asks the terminal at the far end - Windows Terminal, iTerm2, kitty -
-# to put text on its own clipboard. It is only bytes in the terminal stream,
-# so it crosses SSH for free, and herdr forwards it from a pane to whatever
-# terminal is hosting it.
-#
-# Reading back is not symmetrical. Windows Terminal refuses OSC 52 reads on
-# purpose, so --out replays a local cache instead. Installed by acstack.
-set -uo pipefail
-
-CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/acstack/clipboard"
-
-# A real clipboard beats an escape sequence when one exists. Anything sitting
-# in this script's own directory is skipped, so the xclip shim installed
-# beside it can never call back into here in a loop.
-native() {  # native <tool>; prints the path of a real one, if any
-  local tool="$1" self candidate
-  self="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
-  while IFS= read -r candidate; do
-    [ "$(cd "$(dirname "$candidate")" 2>/dev/null && pwd)" = "$self" ] && continue
-    printf '%s' "$candidate"; return 0
-  done < <(type -ap "$tool" 2>/dev/null)
-  return 1
-}
-
-has_display() { [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]; }
-
-if [ "${1:-}" = "--out" ] || [ "${1:-}" = "-o" ]; then
-  if has_display; then
-    for tool in wl-paste xclip xsel; do
-      real="$(native "$tool")" || continue
-      case "$tool" in
-        wl-paste) exec "$real" --no-newline ;;
-        xclip)    exec "$real" -out -selection clipboard ;;
-        xsel)     exec "$real" --output --clipboard ;;
-      esac
-    done
-  fi
-  [ -f "$CACHE" ] || { echo "acstack-clip: nothing copied yet" >&2; exit 1; }
-  cat "$CACHE"
-  exit 0
-fi
-
-if [ $# -gt 0 ]; then text="$*"; else text="$(cat)"; fi
-
-mkdir -p "$(dirname "$CACHE")"
-printf '%s' "$text" > "$CACHE"
-chmod 600 "$CACHE" 2>/dev/null
-
-if has_display; then
-  for tool in wl-copy xclip xsel; do
-    real="$(native "$tool")" || continue
-    case "$tool" in
-      wl-copy) printf '%s' "$text" | "$real" && exit 0 ;;
-      xclip)   printf '%s' "$text" | "$real" -in -selection clipboard && exit 0 ;;
-      xsel)    printf '%s' "$text" | "$real" --input --clipboard && exit 0 ;;
-    esac
-  done
-fi
-
-b64="$(printf '%s' "$text" | base64 | tr -d '\n')"
-# 74994 bytes is the ceiling tmux puts on an OSC 52 payload, and the lowest
-# of anything in this path. Past it the sequence is dropped without a word,
-# so say so rather than report a copy that did not happen.
-if [ ${#b64} -gt 74994 ]; then
-  echo "acstack-clip: too large for the terminal clipboard (${#b64} bytes encoded)" >&2
-  exit 1
-fi
-
-esc=$'\033]52;c;'"$b64"$'\a'
-# tmux drops escape sequences it does not recognise unless they are wrapped
-# for passthrough. herdr needs no wrapping - it forwards OSC 52 itself.
-if [ -n "${TMUX:-}" ]; then
-  esc=$'\033Ptmux;'"${esc//$'\033'/$'\033\033'}"$'\033\\'
-fi
-
-# The controlling terminal, not stdout. Callers are usually TUIs that have
-# redirected both streams, and OSC 52 has to reach the terminal itself.
-if { printf '%s' "$esc" > /dev/tty; } 2>/dev/null; then exit 0; fi
-printf '%s' "$esc" >&2
-H
-  chmod +x "$BIN/acstack-clip"
-
-  cat > "$BIN/acstack-open" <<'H'
-#!/usr/bin/env bash
-# Open a URL from a machine that has no browser of its own.
-#
-#   acstack-open https://github.com/owner/repo/pull/1
-#   acstack-open --why      which route this machine will take, without taking it
-#
-# gh-dash binds o to this. It is bound as a keybinding rather than left to
-# $BROWSER because gh-dash runs $BROWSER with its output discarded and the
-# dashboard still drawn: a route that needs to say anything, or to hand you a
-# link to click, has nowhere to put it. As a keybinding gh-dash steps aside
-# and gives us the terminal.
-#
-# In order: an explicit override, a desktop on this machine, WSL, the opener
-# service on the laptop, the Playwriter bridge to Chrome on the laptop, and
-# last a link you can click.
-# Installed by acstack.
-set -uo pipefail
-
-LOG="${XDG_CACHE_HOME:-$HOME/.cache}/acstack/open.log"
-# An ambient $AGENT_BROWSER_CDP is a hint, never the thing we rely on. See
-# the bridge branch below for what happened when it was.
-BRIDGE="${ACSTACK_BRIDGE_URL:-${AGENT_BROWSER_CDP:-http://127.0.0.1:19988}}"
-OPENER="${ACSTACK_OPENER_URL:-http://127.0.0.1:19989}"
-# The opener refuses anything without this, so its absence is the same as the
-# opener being down - which is exactly how the route probe treats it.
-OPENER_TOKEN="${XDG_CONFIG_HOME:-$HOME/.config}/acstack/opener.token"
-
-WHY=0
-[ "${1:-}" = "--why" ] && { WHY=1; shift; }
-URL="${1:-}"
-[ -n "$URL" ] || [ "$WHY" = 1 ] \
-  || { echo "usage: acstack-open [--why] <url>" >&2; exit 2; }
-
-log() {  # the only record of what happened when the caller discards output
-  mkdir -p "$(dirname "$LOG")"
-  printf '%s %s\n' "$(date -Is)" "$*" >> "$LOG"
-  if [ "$(wc -l < "$LOG" 2>/dev/null || echo 0)" -gt 400 ]; then
-    tail -n 200 "$LOG" > "$LOG.trim" && mv "$LOG.trim" "$LOG"
-  fi
-}
-
-note() {  # say something a suspended TUI cannot print for us
-  command -v herdr >/dev/null 2>&1 \
-    && herdr notification show "$1" --body "$2" >/dev/null 2>&1
-  return 0
-}
 
-# Not [ -t 1 ]: route() runs inside a command substitution for --why, which
-# makes stdout a pipe even when the terminal is right there.
-has_tty() { { : > /dev/tty; } 2>/dev/null; }
 
-# The relay answering on its HTTP port is not the same as the browser being
-# reachable through it. agent-browser quietly launches a headless Chrome on
-# this machine when it cannot attach, and that Chrome navigates happily and
-# shows nobody anything - which is how o came to report a page it had opened
-# where no one could see it. So ask what is actually on the far end.
-#
-# /json/list is the Playwriter extension's own answer to that question. The
-# extension attaches per tab, so `[]` means it is armed on nothing and there
-# is no browser to drive, however healthy the tunnel underneath looks.
-#
-# This used to gate on $HOME/.agent-browser/default.sock existing first, on
-# the reasoning that probing starts a browser as a side effect. It does not:
-# curl starts nothing. What that gate did do was make the bridge unreachable,
-# because nothing on this machine creates that socket until an agent-browser
-# session is already running - so a perfectly healthy bridge still fell
-# through to the link route. Asking the relay is both safer and correct.
-bridge_attached() {
-  [ "${ACSTACK_OPEN_BRIDGE:-auto}" != "off" ] || return 1
-  # agent-browser has to exist to take the route, but is never run to decide
-  # it: deciding must cost one round trip, not a browser launch.
-  command -v agent-browser >/dev/null 2>&1 || return 1
-  # Seconds, not tens of them: the tunnel stays bound on this side after the
-  # relay at the far end stops answering, so an unhealthy bridge connects and
-  # then hangs rather than refusing. Every one of those seconds is spent in
-  # front of someone who just pressed a key.
-  local targets
-  targets=$(curl -fsS --connect-timeout 1 -m 2 "$BRIDGE/json/list" 2>/dev/null) || return 1
-  # Whitespace-only and [] both mean armed on no tab.
-  case "$(printf '%s' "$targets" | tr -d '[:space:]')" in
-    ''|'[]') return 1 ;;
-  esac
-  return 0
-}
-
-# Same discipline as bridge_attached: ask the far end rather than believing
-# anything local. A token on disk proves nothing about a service being up, and
-# a service being up proves nothing without the token it will demand - so the
-# probe carries the token and the route is only taken if that round trip
-# answered.
-opener_ready() {
-  [ "${ACSTACK_OPEN_OPENER:-auto}" != "off" ] || return 1
-  local tok
-  tok=$(cat "$OPENER_TOKEN" 2>/dev/null) || return 1
-  [ -n "$tok" ] || return 1
-  # Seconds, not tens of them - someone just pressed a key and is watching.
-  curl -fsS --connect-timeout 1 -m 2 -H "X-ACStack-Token: $tok" \
-    "$OPENER/health" >/dev/null 2>&1
-}
-
-route() {  # the route this machine will take, decided without taking it
-  [ -n "${ACSTACK_OPEN_CMD:-}" ] && { echo "command"; return; }
-  [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ] && command -v xdg-open >/dev/null 2>&1 \
-    && { echo "xdg-open"; return; }
-  local opener
-  for opener in wslview wsl-open explorer.exe; do
-    command -v "$opener" >/dev/null 2>&1 && { echo "$opener"; return; }
-  done
-  # Ahead of the bridge deliberately. The bridge drives a browser for an
-  # agent: it attaches per tab, only after someone clicks the extension icon,
-  # and it does so in a Chrome profile that is not the default browser. The
-  # opener needs no click and reaches the browser the user actually uses. See
-  # docs/adr/0006-document-opener-service.md.
-  opener_ready && { echo "opener"; return; }
-  bridge_attached && { echo "bridge"; return; }
-  has_tty && { echo "link"; return; }
-  echo "clipboard"
-}
-
-# A clickable link, on the terminal you are actually sitting at. OSC 8 is a
-# hyperlink the terminal draws itself, so ctrl+click reaches the browser on
-# your own machine with nothing installed anywhere in between. The bare URL
-# on the next line covers terminals that ignore OSC 8, and the clipboard
-# copy covers not wanting to click at all.
-link_screen() {
-  printf '%s' "$URL" | acstack-clip
-  {
-    printf '\n  Open on GitHub\n\n  '
-    printf '\033]8;;%s\033\\%s\033]8;;\033\\\n' "$URL" "$URL"
-    printf '  ctrl+click the link, or paste it - it is on your clipboard\n\n'
-    printf '  Press any key to go back.'
-  } > /dev/tty
-  read -rsn1 < /dev/tty
-  printf '\n' > /dev/tty
-}
-
-ROUTE="$(route)"
-[ "$WHY" = 1 ] && { echo "$ROUTE"; exit 0; }
-
-case "$ROUTE" in
-  command)
-    log "override: $ACSTACK_OPEN_CMD $URL"
-    exec ${ACSTACK_OPEN_CMD} "$URL"
-    ;;
-  xdg-open)
-    # $BROWSER is cleared first: xdg-open reads it too, and $BROWSER may well
-    # be pointing back here, which would loop.
-    log "xdg-open: $URL"
-    BROWSER= exec xdg-open "$URL"
-    ;;
-  explorer.exe)
-    # explorer.exe reports failure even when it opened the page. Ignore it.
-    log "explorer.exe: $URL"
-    explorer.exe "$URL" >/dev/null 2>&1
-    exit 0
-    ;;
-  wslview|wsl-open)
-    log "$ROUTE: $URL"
-    exec "$ROUTE" "$URL"
-    ;;
-  opener)
-    # One POST and the laptop opens it in whatever it considers the default
-    # browser. No tab to arm, no extension, no CDP session to contend for.
-    #
-    # A URL carrying a double quote or a backslash would break out of the JSON
-    # string it is about to become. Rather than escape it, fall through to the
-    # link screen: those characters are not legal in a URL unescaped, so a URL
-    # holding one is malformed and worth showing a human rather than sending.
-    tok=$(cat "$OPENER_TOKEN" 2>/dev/null || true)
-    case "$URL" in
-      *'"'*|*'\\'*) tok="" ;;
-    esac
-    if [ -n "$tok" ] && curl -fsS --connect-timeout 2 -m 10 -X POST \
-         -H "X-ACStack-Token: $tok" -H 'Content-Type: application/json' \
-         --data "$(printf '{"url":"%s"}' "$URL")" \
-         "$OPENER/open" 2>/dev/null | tr -d '[:space:]' | grep -q '"opened":true'; then
-      log "opener $OPENER: $URL"
-      exit 0
-    fi
-    log "opener $OPENER did not open it, handing over the link: $URL"
-    if has_tty; then link_screen; exit 0; fi
-    ;;
-  bridge)
-    # Name the endpoint rather than inheriting one. Leaning on an ambient
-    # $AGENT_BROWSER_CDP made this launch a headless Chrome on the VM when
-    # run from a herdr popup, which reported success and opened nothing
-    # anybody could see.
-    #
-    # The default session, deliberately: the relay takes one CDP client at a
-    # time, so a session of our own cannot connect while an agent holds it.
-    # That also means the new tab becomes the active one for any agent
-    # driving that browser. ACSTACK_OPEN_BRIDGE=off trades the one-key open
-    # for never touching it.
-    if timeout 20 agent-browser --cdp "$BRIDGE" tab new >/dev/null 2>&1 \
-       && timeout 30 agent-browser --cdp "$BRIDGE" open "$URL" >/dev/null 2>&1; then
-      log "bridge $BRIDGE: $URL"
-      exit 0
-    fi
-    log "bridge $BRIDGE unavailable, handing over the link: $URL"
-    if has_tty; then link_screen; exit 0; fi
-    ;;
-esac
-
-[ "$ROUTE" = link ] && { log "link: $URL"; link_screen; exit 0; }
-
-# No terminal to draw on and no browser to reach. The clipboard is still one
-# paste from the browser on the machine you are sitting at, which beats
-# nothing, but report failure anyway: a silent success here is what left
-# gh-dash saying "Opened in browser" about a page that never opened.
-if printf '%s' "$URL" | acstack-clip; then
-  log "copied, not opened: $URL"
-  note "URL copied, not opened" "No browser reachable from here. Paste: $URL"
-  exit 3
-fi
-log "no route: $URL"
-note "Cannot open URL" "$URL"
-exit 1
-H
-  chmod +x "$BIN/acstack-open"
-
-  cat > "$BIN/acstack-bridge" <<'H'
-#!/usr/bin/env bash
-# Look at the Playwriter bridge from the dev machine, and fix it where that is
-# possible from here.
-#
-#   acstack-bridge status        what is up, on both machines
-#   acstack-bridge fix [what]    restart relay | tunnel | both (default both)
-#
-# Restarting either is a Windows scheduled task, so this machine cannot do it
-# directly. It asks the opener, which runs over there and can. When the opener
-# is not reachable either, it prints the handoff block to paste into a
-# PowerShell on the laptop instead - the same block the bridge skill defines.
-#
-# What it still cannot do is arm the extension. That is a click inside a
-# third-party extension and nothing on either machine can press it.
-# Installed by acstack.
-set -uo pipefail
-
-BRIDGE="${ACSTACK_BRIDGE_URL:-http://127.0.0.1:19988}"
-OPENER="${ACSTACK_OPENER_URL:-http://127.0.0.1:19989}"
-OPENER_TOKEN="${XDG_CONFIG_HOME:-$HOME/.config}/acstack/opener.token"
-FREE_PORT="${ACSTACK_FREE_PORT:-$HOME/.claude/acstack/bin/vm-free-port.sh}"
-
-CMD="${1:-status}"
-WHAT="${2:-both}"
-
-tok() { cat "$OPENER_TOKEN" 2>/dev/null; }
-
-clear_port() {  # clear_port <port> - let go of a forward this machine still holds
-  # A tunnel that will not rebind is usually held from this side: the VM's sshd
-  # still owns the forward channel of a session that dropped. Restarting the
-  # task on the laptop then fails exactly the way it failed before, because
-  # nothing here let go of the port. So this runs first.
-  #
-  # The clearer ships with acstack and may simply not be installed on a machine
-  # that got the terminal workspace some other way. Worth saying, but not a
-  # reason to refuse the restart, which may be all that was needed.
-  if [ ! -f "$FREE_PORT" ]; then
-    echo "no port clearer at $FREE_PORT - asking for the restart without freeing $1 first." >&2
-    return 0
-  fi
-  #
-  # A clearer that predates --port is the awkward case in between: it exists,
-  # so the missing-file warning never fires, but it only knows how to free
-  # 19988. Called bare it would clear the bridge port twice, never touch 19989,
-  # and hand back two successes - so the caller would believe both ports were
-  # freed. Report the version and clear nothing; guessing is worse than saying.
-  # It announces its age two ways: the flag is nowhere in its text, or it takes
-  # the flag, does not recognise the argument, and exits 64 - the usage code,
-  # which is not "the port is stuck" and is not worth a retry without the flag.
-  local older="is older than this branch, so it cannot free $1 on request."
-  local fix="Update acstack on this machine to refresh it. Asking for the restart anyway."
-  if ! grep -q -- '--port' "$FREE_PORT" 2>/dev/null; then
-    echo "$FREE_PORT $older It has no --port support at all. $fix" >&2
-    return 0
-  fi
-  local rc=0
-  bash "$FREE_PORT" --port "$1" >/dev/null 2>&1 || rc=$?
-  if [ "$rc" = "64" ]; then
-    echo "$FREE_PORT $older It refused --port with the usage code 64. $fix" >&2
-  elif [ "$rc" != "0" ]; then
-    echo "$FREE_PORT could not free $1 - asking for the restart anyway." >&2
-  fi
-}
-
-opener_call() {  # opener_call <method> <path> [data]
-  local t; t=$(tok) || return 1
-  [ -n "$t" ] || return 1
-  if [ "$1" = "POST" ]; then
-    curl -fsS --connect-timeout 2 -m 40 -X POST -H "X-ACStack-Token: $t" \
-      -H 'Content-Type: application/json' --data "${3:-{\}}" "$OPENER$2" 2>/dev/null
-  else
-    curl -fsS --connect-timeout 2 -m 10 -H "X-ACStack-Token: $t" "$OPENER$2" 2>/dev/null
-  fi
-}
-
-handoff() {  # what this machine cannot do, in the shape the other side expects
-  # Unquoted, because $1 names what is being asked for - so every PowerShell $
-  # inside has to be escaped or the shell eats it. A handoff block is pasted
-  # verbatim into a shell on the other machine, so a mangled one is worse than
-  # no block at all.
-  cat >&2 <<HANDOFF
-
---- BEGIN VM-SIDE HANDOFF (to Windows agent) ---
-Context: the bridge needs $1 on the laptop, and the opener on 19989 is not
-reachable from this machine either, so nothing here can do it.
-
-Run on the Windows laptop:
-  Stop-ScheduledTask -TaskName 'Playwriter-*'
-  Start-ScheduledTask -TaskName 'Playwriter-Relay'
-  Start-ScheduledTask -TaskName 'Playwriter-Opener'
-  Get-ScheduledTask -TaskName 'Playwriter-Tunnel-*','Playwriter-OpenerTunnel-*' |
-    ForEach-Object { Start-ScheduledTask -TaskName \$_.TaskName }
-  .\doctor.ps1
-
-Expected result:
-  doctor.ps1 exits with all green rows, including "Relay listening on 19988"
-  and "Opener listening on 19989", and no tunnel-*.stuck markers.
-
-Report back:
-  The doctor.ps1 output (paste the table).
---- END VM-SIDE HANDOFF ---
-HANDOFF
-}
-
-case "$CMD" in
-  status)
-    # This machine's own view first: these say whether the tunnels arrived,
-    # which is the half the laptop cannot see.
-    if curl -fsS --connect-timeout 1 -m 3 "$BRIDGE/json/version" >/dev/null 2>&1; then
-      armed=$(curl -fsS --connect-timeout 1 -m 3 "$BRIDGE/json/list" 2>/dev/null | tr -d '[:space:]')
-      case "$armed" in
-        ''|'[]') echo "relay:   reachable, but the extension is armed on no tab" ;;
-        *)       echo "relay:   reachable, extension armed" ;;
-      esac
-    else
-      echo "relay:   not reachable on $BRIDGE"
-    fi
-
-    if health=$(opener_call GET /health); then
-      echo "opener:  reachable - $(printf '%s' "$health" | tr -d '[:space:]')"
-    elif [ -z "$(tok)" ]; then
-      echo "opener:  no token at $OPENER_TOKEN (run register-tasks.ps1 on the laptop)"
-    else
-      echo "opener:  not reachable on $OPENER"
-    fi
-
-    # And the laptop's view, which only the opener can fetch.
-    if tasks=$(opener_call GET /bridge/health); then
-      echo "tasks:   $(printf '%s' "$tasks" | tr -d '[:space:]')"
-    else
-      echo "tasks:   unknown - the opener is the only way to see them from here"
-    fi
-    echo "route:   $(acstack-open --why 2>/dev/null || echo unknown)"
-    ;;
-  fix)
-    case "$WHAT" in
-      relay|tunnel|both) ;;
-      *) echo "usage: acstack-bridge fix [relay|tunnel|both]" >&2; exit 2 ;;
-    esac
-    # A tunnel restart is the only case where a port here is in the way. Both
-    # ports get cleared, because the opener's 19989 is forwarded by its own task
-    # and wedges on its own. fix relay touches no tunnel, so clearing a port
-    # there would be tearing down a working connection to fix something else.
-    if [ "$WHAT" != "relay" ]; then
-      clear_port 19988
-      clear_port 19989
-    fi
-    if out=$(opener_call POST /bridge/restart "$(printf '{"what":"%s"}' "$WHAT")"); then
-      echo "asked the laptop to restart: $WHAT"
-      printf '%s\n' "$out"
-      # Restarting is not recovering. Give the tunnels a moment to rebind, then
-      # say whether they actually came back rather than reporting the request.
-      sleep 5
-      rc=0
-      if curl -fsS --connect-timeout 1 -m 3 "$BRIDGE/json/version" >/dev/null 2>&1; then
-        echo "relay is answering again on $BRIDGE"
-      else
-        echo "the restart was accepted but the relay is still not answering here on 19988." >&2
-        echo "  if this persists the port may be wedged on this machine:" >&2
-        echo "  bash $FREE_PORT --port 19988" >&2
-        rc=1
-      fi
-      # Two tunnels, two verdicts. A relay that came back says nothing about
-      # the opener, and an opener that stayed down is the half that leaves this
-      # machine unable to reach a browser at all - so it is checked, and named.
-      if [ "$WHAT" != "relay" ]; then
-        if opener_call GET /health >/dev/null; then
-          echo "opener is answering again on $OPENER"
-        else
-          echo "the restart was accepted but the opener is still not answering here on 19989." >&2
-          echo "  if this persists the port may be wedged on this machine:" >&2
-          echo "  bash $FREE_PORT --port 19989" >&2
-          rc=1
-        fi
-      fi
-      exit $rc
-    fi
-    handoff "a restart of $WHAT"
-    exit 1
-    ;;
-  *)
-    echo "usage: acstack-bridge [status|fix [relay|tunnel|both]]" >&2
-    exit 2
-    ;;
-esac
-H
-  chmod +x "$BIN/acstack-bridge"
-
-  say "helpers written: acstack-diff, acstack-dash, acstack-db, acstack-md, acstack-view"
-  say "remote helpers written: acstack-clip, acstack-open, acstack-bridge"
-  say "herdr helpers written: acstack-popup, acstack-herdr-tab, acstack-herdr-renumber, acstack-edit"
-}
-
-apply_herdr() {
-  have herdr || { say "herdr not installed, skipping keymap"; return 0; }
-  # Every popup runs through acstack-popup. disable reaches here without
-  # apply, so after an upgrade the helper may not exist yet.
-  [ -x "$BIN/acstack-popup" ] || write_helpers
-  mkdir -p "$(dirname "$HERDR_CFG")"; touch "$HERDR_CFG"
-  local mod wt diffkey dashkey filekey filetabkey difftabkey dashtabkey
-  local pickkey picktabkey gitkey gittabkey dbkey dbtabkey scrollbars
-  local theme themeauto themelight toast labels panelsort
-  mod=$(cfg_get herdr.chord_modifier alt)
-  wt=$(cfg_get herdr.worktrees_directory "~/.herdr/worktrees")
-  # f, not d: Windows Terminal keeps alt+shift+d for "duplicate pane", so the
-  # tab half of a d pair never reaches herdr. Both diff keys sit on f instead.
-  diffkey=$(cfg_get diffnav.popup_key "alt+f")
-  dashkey=$(cfg_get gh_dash.popup_key "alt+i")
-  filekey=$(cfg_get yazi.popup_key "alt+y")
-  filetabkey=$(cfg_get yazi.tab_key "alt+shift+y")
-  difftabkey=$(cfg_get diffnav.tab_key "alt+shift+f")
-  dashtabkey=$(cfg_get gh_dash.tab_key "alt+shift+i")
-  pickkey=$(cfg_get diffnav.pick_key "alt+x")
-  picktabkey=$(cfg_get diffnav.pick_tab_key "alt+shift+x")
-  gitkey=$(cfg_get lazygit.popup_key "alt+g")
-  gittabkey=$(cfg_get lazygit.tab_key "alt+shift+g")
-  dbkey=$(cfg_get harlequin.popup_key "alt+q")
-  dbtabkey=$(cfg_get harlequin.tab_key "alt+shift+q")
-  # herdr counts the scrollbar column inside the pane rect but reports the
-  # full rect width to the program running in the pane. A full-screen app then
-  # writes one column more than it has, so every wrapped row starts a column
-  # left of the row above it. Turning the scrollbar off gives the column back.
-  scrollbars=$(cfg_get herdr.pane_scrollbars false)
-  # Four settings that are not keys. Each one is empty by default and then
-  # written only when the config names it, so a machine that says nothing
-  # keeps whatever herdr already paints. The exception is the pane label,
-  # which is written either way: several agents in several panes is what this
-  # workspace is for, and an unlabelled pane does not say which agent it holds.
-  theme=$(cfg_get herdr.theme.name "")
-  themeauto=$(cfg_get herdr.theme.auto_switch true)
-  themelight=$(cfg_get herdr.theme.light "")
-  toast=$(cfg_get herdr.toast_delivery "")
-  labels=$(cfg_get herdr.agent_labels_on_pane_borders true)
-  panelsort=$(cfg_get herdr.agent_panel_sort "")
-  [ "$(cfg_get diffnav.enabled true)" = "true" ] \
-    || { diffkey=""; difftabkey=""; pickkey=""; picktabkey=""; }
-  [ "$(cfg_get gh_dash.enabled true)" = "true" ] || { dashkey=""; dashtabkey=""; }
-  [ "$(cfg_get yazi.enabled true)"    = "true" ] || { filekey=""; filetabkey=""; }
-  [ "$(cfg_get lazygit.enabled true)" = "true" ] || { gitkey=""; gittabkey=""; }
-  [ "$(cfg_get harlequin.enabled true)" = "true" ] || { dbkey=""; dbtabkey=""; }
-
-  ACSTACK_ARGS="$mod|$wt|$diffkey|$dashkey|$filekey|$filetabkey|$difftabkey|$dashtabkey|$pickkey|$picktabkey|$gitkey|$gittabkey|$dbkey|$dbtabkey|$scrollbars|$theme|$themeauto|$themelight|$toast|$labels|$panelsort|$BEGIN|$END" ACSTACK_BIN="$BIN" py "$HERDR_CFG" <<'PY'
-import os, re, sys
-path = sys.argv[1]
-# herdr runs a popup with its server's PATH, which can lack $BIN. Each popup
-# goes through acstack-popup by absolute path, which puts $BIN back on PATH.
-popup = os.path.join(os.environ["ACSTACK_BIN"], "acstack-popup")
-(mod, wt, diffkey, dashkey, filekey, filetabkey, difftabkey, dashtabkey,
- pickkey, picktabkey, gitkey, gittabkey, dbkey, dbtabkey, scrollbars,
- theme, themeauto, themelight, toast, labels, panelsort,
- begin, end) = os.environ["ACSTACK_ARGS"].split("|")
-
-# key, command, description, herdr custom-command type, popup size.
-# type "shell" takes no size: herdr rejects width/height on a non-popup.
-CUSTOM = [
-    (diffkey,    "acstack-diff",                  "diff: branch vs dev", "popup", "90%"),
-    (difftabkey, "acstack-herdr-tab diff acstack-diff", "diff: branch vs dev (tab)", "shell", None),
-    (pickkey,    "acstack-diff pick",             "diff: pick what to compare", "popup", "90%"),
-    (picktabkey, "acstack-herdr-tab diffpick acstack-diff pick",
-                                                  "diff: pick what to compare (tab)", "shell", None),
-    (dashkey,    "acstack-dash",                  "PR dashboard",       "popup", "95%"),
-    (dashtabkey, "acstack-herdr-tab dash acstack-dash", "PR dashboard (tab)", "shell", None),
-    (filekey,    "yazi",                          "file tree",          "popup", "95%"),
-    (filetabkey, "acstack-herdr-tab yazi yazi",         "file tree (tab)",    "shell", None),
-    (gitkey,     "lazygit",                       "git: stage, commit, push", "popup", "90%"),
-    (gittabkey,  "acstack-herdr-tab lazygit lazygit",
-                                                  "git: stage, commit, push (tab)", "shell", None),
-    (dbkey,      "acstack-db",                    "db: harlequin SQL editor", "popup", "90%"),
-    (dbtabkey,   "acstack-herdr-tab harlequin acstack-db",
-                                                  "db: harlequin SQL editor (tab)", "shell", None),
-]
-
-def custom_blocks():
-    out = []
-    for key, cmd, desc, typ, size in CUSTOM:
-        if not key:
-            continue
-        if typ == "popup":
-            cmd = f"{popup} {cmd}"
-        out += ["", "[[keys.command]]", f'key = "{key}"', f'type = "{typ}"',
-                f'command = "{cmd}"', f'description = "{desc}"']
-        if size:
-            out += [f'width = "{size}"', f'height = "{size}"']
-    return out
-text = open(path).read() if os.path.isfile(path) else ""
-# Drop any previous managed region so this is idempotent.
-text = re.sub(re.escape(begin) + r".*?" + re.escape(end) + r"\n?", "", text, flags=re.S)
-
-keys = []
-if mod != "none":
-    m = mod
-    keys = [
-        f'focus_agent = "{m}+1..9"',
-        f'focus_pane_left  = ["prefix+h", "{m}+h"]',
-        f'focus_pane_down  = ["prefix+j", "{m}+j"]',
-        f'focus_pane_up    = ["prefix+k", "{m}+k"]',
-        f'focus_pane_right = ["prefix+l", "{m}+l"]',
-        f'next_agent = "{m}+n"',
-        f'previous_agent = "{m}+u"',
-        f'next_tab = ["prefix+n", "{m}+right"]',
-        f'previous_tab = ["prefix+p", "{m}+left"]',
-        f'next_workspace = ["{m}+down"]',
-        f'previous_workspace = ["{m}+up"]',
-        # herdr puts switch_tab on prefix+1..9 by default. Move it aside so
-        # switch_workspace below can have the plain digits.
-        f'switch_tab = "prefix+{m}+1..9"',
-        f'toggle_sidebar = ["prefix+b", "{m}+s"]',
-        # g belongs to git only when lazygit is on. alt+g is lazygit and
-        # alt+shift+g is its tab, so goto moves off the letter on both layers:
-        # prefix+g one key away from alt+g reads as the same thing. With
-        # lazygit off, nothing wants the letter and goto keeps it.
-        ('goto = "prefix+t"' if gitkey else f'goto = ["prefix+g", "{m}+g"]'),
-        f'zoom = ["prefix+z", "{m}+z"]',
-        f'last_pane = "{m}+a"',
-        f'new_tab = ["prefix+c", "{m}+c"]',
-        f'new_workspace = ["prefix+shift+n", "{m}+w"]',
-        # Also off g, for the same reason, and back on it when lazygit is off.
-        (f'new_worktree = "{m}+r"' if gitkey
-         else f'new_worktree = ["prefix+shift+g", "{m}+r"]'),
-        f'split_vertical = ["prefix+v", "{m}+e"]',
-        f'split_horizontal = ["prefix+minus", "{m}+minus"]',
-    ]
-
-# herdr leaves switch_workspace unbound, so without this there is no way to
-# reach a workspace by number at all. It is prefix-only, so it is written even
-# when the chord family is off: opting out of alt chords should not cost you
-# workspace numbers.
-keys.append('switch_workspace = "prefix+1..9"')
-
-# See the comment on `scrollbars` above for what the scrollbar column costs.
-# The label is written either way; the sort order only when the config names
-# one, because herdr's own default is a reasonable answer and this script has
-# no better one.
-ui = [
-    "pane_scrollbars = " + ("true" if scrollbars == "true" else "false"),
-    "show_agent_labels_on_pane_borders = " + ("true" if labels == "true" else "false"),
-]
-if panelsort:
-    ui.append(f'agent_panel_sort = "{panelsort}"')
-
-# A theme, and a toast. Both tables stay empty unless the config names a value,
-# so a machine that says nothing about either keeps what herdr already does.
-#
-# auto_switch asks the attached client for its background colour over OSC 11
-# and picks dark_name or light_name from the answer. That is the setting that
-# lets one herdr server serve a dark terminal on one device and a light one on
-# another - an e-ink panel among them - without either client changing the
-# other. dark_name repeats `name` because a client that answers nothing at all
-# falls back to dark.
-themelines = []
-if theme:
-    themelines = [f'name = "{theme}"']
-    if themelight:
-        themelines += [
-            "auto_switch = " + ("true" if themeauto == "true" else "false"),
-            f'dark_name = "{theme}"',
-            f'light_name = "{themelight}"',
-        ]
-
-toastlines = [f'delivery = "{toast}"'] if toast else []
-
-# TOML forbids a duplicate key, so a hand-written keymap that already sets
-# something this script manages would make the merged file unparseable and
-# herdr would reject the lot. Drop our own keys from the user's [keys] table,
-# and any [[keys.command]] bound to a key we are about to claim, before
-# inserting. Anything we do not manage is left exactly as it was.
-def names(lines):
-    return {k.split("=", 1)[0].strip() for k in lines if "=" in k}
-
-
-managed = names(keys)
-# One set per table. An empty set strips nothing, so a table this run writes
-# no value into leaves whatever the user wrote in it exactly as it was.
-MANAGED_BY_TABLE = {"[keys]": managed, "[ui]": names(ui),
-                    "[theme]": names(themelines), "[ui.toast]": names(toastlines)}
-# A theme is one setting spelled across four keys, so it is claimed whole or
-# not at all. Claiming only what gets written leaves a hand-written
-# `auto_switch` and `light_name` beside the new `name`, and a light client then
-# keeps the theme the user is replacing.
-if themelines:
-    MANAGED_BY_TABLE["[theme]"] = {"name", "auto_switch", "dark_name", "light_name"}
-claimed = {key for key, *_ in CUSTOM if key}
-
-
-def strip_managed(table, names):
-    # Drop the settings this script manages, and the comment block that
-    # introduced each one. Removing the setting alone strands its comment: the
-    # user is left with a run of bare headings describing settings that are no
-    # longer there, which reads as a broken config.
-    #
-    # A value can run over several lines, because every key here holds an array
-    # and TOML lets one span as many lines as it likes. Dropping the first line
-    # alone strands the rest as bare list items, which is invalid TOML - and
-    # herdr answers that by rejecting the whole file, so one hand-written
-    # binding written that way would cost the user every binding.
-    out, pending, depth = [], [], 0
-    for ln in table:
-        if depth > 0:
-            depth += ln.count("[") - ln.count("]")
-            continue
-        stripped = ln.strip()
-        if stripped.startswith("#") or not stripped:
-            pending.append(ln)
-            continue
-        if "=" in ln and ln.split("=", 1)[0].strip() in names:
-            pending = []
-            value = ln.split("=", 1)[1]
-            depth = value.count("[") - value.count("]")
-            continue
-        out.extend(pending)
-        pending = []
-        out.append(ln)
-    out.extend(pending)
-    return out
-
-
-# A table header on its own line, and nothing else. `line.startswith("[")` is
-# not enough: a value spanning several lines puts its own list items at the
-# start of a line, and `  [1, 2],` would then read as a new table.
-HEADER = re.compile(r"^\s*\[\[?[^\[\]]*\]\]?\s*(?:#.*)?$")
-
-
-def tables(lines):
-    current, depth = [], 0
-    for line in lines:
-        if depth <= 0 and HEADER.match(line) and current:
-            yield current
-            current = []
-        # Only outside a multi-line value, for the same reason.
-        if not HEADER.match(line):
-            depth += line.count("[") - line.count("]")
-            depth = max(depth, 0)
-        current.append(line)
-    if current:
-        yield current
-
-
-kept = []
-for table in tables(text.splitlines()):
-    header = table[0].strip()
-    # The managed block re-declares [worktrees] in full, and TOML forbids
-    # declaring a table twice.
-    if header == "[worktrees]":
-        continue
-    if header == "[[keys.command]]":
-        bound = re.search(r'(?m)^\s*key\s*=\s*"([^"]+)"', "\n".join(table))
-        if bound and bound.group(1) in claimed:
-            continue
-    if header in MANAGED_BY_TABLE:
-        table = strip_managed(table, MANAGED_BY_TABLE[header])
-    kept.extend(table)
-text = "\n".join(kept)
-if text and not text.endswith("\n"):
-    text += "\n"
-
-def merge(text, header, lines):
-    # Merge into a table the user already declared rather than declaring a
-    # second one, because TOML forbids declaring the same table twice. Returns
-    # the text and whether the merge happened.
-    # re.escape, because a sub-table header carries a dot: an unescaped
-    # "ui.toast" matches "[ui-toast]" too.
-    head = r"^\[" + re.escape(header) + r"\][ \t]*\n"
-    if not re.search(head, text, flags=re.M):
-        return text, False
-    region = begin + "\n" + "\n".join(lines) + "\n" + end
-    return re.sub(head, f"[{header}]\n" + region + "\n",
-                  text, count=1, flags=re.M), True
-
-
-block = []
-for header, lines in (("keys", keys), ("ui", ui),
-                      ("theme", themelines), ("ui.toast", toastlines)):
-    if not lines:
-        continue
-    text, merged = merge(text, header, lines)
-    if merged:
-        continue
-    if block:
-        block.append("")
-    block += [f"[{header}]"] + lines
-
-# [[keys.command]] and [worktrees] are top-level, so they can never sit inside
-# a merged region and always land in a block of their own at the end.
-block += custom_blocks() + ["", "[worktrees]", f'directory = "{wt}"']
-text = text.rstrip("\n") + "\n\n" + "\n".join([begin] + block + [end]) + "\n"
-
-open(path, "w").write(text)
-PY
-  if herdr config check 2>&1 | grep -q "^config: ok"; then
-    herdr server reload-config >/dev/null 2>&1
-    say "herdr keymap applied and reloaded"
-  else
-    say "herdr config check failed, review $HERDR_CFG"
-    herdr config check 2>&1 | sed 's/^/    /' | head -5
-  fi
-
-  local integ; integ=$(cfg_get herdr.integration none)
-  if [ "$integ" != "none" ] && [ -n "$integ" ]; then
-    herdr integration install "$integ" >/dev/null 2>&1 && say "herdr $integ state hook installed"
-  fi
-}
-
-build_tuicr_fork() {
-  # TEMPORARY path. Builds the two unmerged upstream pull requests the config
-  # comments name. Once both land, set build_from_fork: false and this whole
-  # function stops being reachable.
-  # `have cargo` is not enough: a rustup shim on PATH with no default
-  # toolchain installed exits non-zero on every invocation.
-  if ! cargo --version >/dev/null 2>&1; then
-    say "tuicr fork build needs a working cargo (see rustup.rs), skipping"
-    cargo --version 2>&1 | head -2 | sed 's/^/    /'
-    return 1
-  fi
-  have git   || { say "tuicr fork build needs git, skipping"; return 1; }
-  local url branch dir
-  url=$(cfg_get tuicr.fork "https://github.com/ac8318740/tuicr")
-  branch=$(cfg_get tuicr.fork_branch "local/daily")
-  dir="${ACSTACK_TUICR_SRC:-$HOME/tuicr}"
-  if [ -d "$dir/.git" ]; then
-    git -C "$dir" fetch --quiet --all 2>/dev/null
-    git -C "$dir" checkout --quiet "$branch" 2>/dev/null || { say "tuicr: no branch $branch in $dir"; return 1; }
-    git -C "$dir" pull --quiet --ff-only 2>/dev/null
-  else
-    git clone --quiet -b "$branch" "$url" "$dir" || { say "tuicr: clone failed"; return 1; }
-  fi
-  say "building tuicr from $branch (a few minutes on a cold cache)"
-  local log; log=$(mktemp)
-  if ! ( cd "$dir" && cargo build --release ) >"$log" 2>&1; then
-    say "tuicr: build failed in $dir"
-    # Swallowing cargo's output here made a missing toolchain look identical
-    # to a compile error.
-    grep -E '^(error|warning: unused)' "$log" | head -5 | sed 's/^/    /'
-    tail -3 "$log" | sed 's/^/    /'
-    rm -f "$log"; return 1
-  fi
-  rm -f "$log"
-  mkdir -p "$BIN"
-  # mv, not cp: cp fails with "Text file busy" when tuicr is running.
-  cp "$dir/target/release/tuicr" "$BIN/tuicr.new" && mv -f "$BIN/tuicr.new" "$BIN/tuicr"
-  say "tuicr built from $branch and installed to $BIN/tuicr"
-}
-
-apply_tuicr() {
-  local from_fork; from_fork=$(cfg_get tuicr.build_from_fork false)
-  if ! have tuicr; then
-    if [ "$from_fork" = "true" ]; then
-      build_tuicr_fork || return 0
-    else
-      install_binary tuicr agavra/tuicr x86_64-unknown-linux-gnu || return 0
-    fi
-  fi
-  have tuicr || { say "tuicr not installed, skipping config"; return 0; }
-
-  mkdir -p "$HOME/.config/tuicr"
-  # show_file_line_stats and file_list_width only exist in the fork build.
-  # Writing them against a stock release makes tuicr warn on every start.
-  ACSTACK_ARGS="$from_fork|$(cfg_get tuicr.file_list_width 30)|$(cfg_get tuicr.show_file_line_stats true)|$(cfg_get tuicr.appearance "")|$BEGIN|$END" \
-    py "$HOME/.config/tuicr/config.toml" <<'PY'
-import os, re, sys
-path = sys.argv[1]
-from_fork, width, stats, appearance, begin, end = os.environ["ACSTACK_ARGS"].split("|")
-text = open(path).read() if os.path.isfile(path) else ""
-text = re.sub(re.escape(begin) + r".*?" + re.escape(end) + r"\n?", "", text, flags=re.S)
-
-block = [begin]
-managed = set()
-if from_fork == "true":
-    block += [
-        "# These two keys exist only in the fork build. See the tuicr section",
-        "# of ~/.config/acstack/terminal-workspace.yaml.",
-        f"show_file_line_stats = {stats}",
-        f"file_list_width = {width}",
-        "# A local build must not be replaced by a stock release.",
-        "no_update_check = true",
-    ]
-    managed |= {"show_file_line_stats", "file_list_width", "no_update_check"}
-else:
-    block += ["# Stock release: the fork-only keys are omitted so tuicr does not",
-              "# warn about unknown config keys at startup."]
-# `system` asks the terminal for its background colour over OSC 11. Under
-# `herdr --remote` nothing answers, so tuicr falls back to a desktop setting
-# that a headless machine reports as light, and paints dark text on a black
-# terminal. Pinning the value sidesteps the whole detection path.
-if appearance:
-    block += ["# Pinned rather than detected. See the tuicr section of",
-              "# ~/.config/acstack/terminal-workspace.yaml.",
-              f'appearance = "{appearance}"']
-    managed.add("appearance")
-block.append(end)
-
-# TOML forbids a duplicate key, so a value the user set by hand before this
-# script managed it would make the merged file unparseable and tuicr would
-# reject the lot. Drop only the keys this run writes, and the comment block
-# that introduced each one: the setting alone leaves a heading over nothing.
-kept, pending, cut = [], [], None
-for ln in text.splitlines():
-    stripped = ln.strip()
-    if stripped.startswith("#") or not stripped:
-        pending.append(ln)
-        continue
-    # Every key this script writes is top level, so the first table header ends
-    # the search. A key of the same name inside a table is a different key.
-    if cut is None and stripped.startswith("["):
-        # Before the comments introducing that header, not after them.
-        cut = len(kept)
-    if cut is None and "=" in ln and ln.split("=", 1)[0].strip().strip('"') in managed:
-        pending = []
-        continue
-    kept.extend(pending)
-    pending = []
-    kept.append(ln)
-kept.extend(pending)
-
-# The block holds top-level keys, so it goes above the first table header
-# rather than at the end of the file. Appended after a `[export]` or
-# `[forge]` section, every key in it would belong to that section instead:
-# tuicr would warn about an unknown key there and never see the setting, and
-# a name the section already uses makes the file invalid outright.
-if cut is None:
-    text = "\n".join(kept).rstrip("\n")
-    text = (text + "\n\n" if text else "") + "\n".join(block) + "\n"
-else:
-    head = "\n".join(kept[:cut]).rstrip("\n")
-    text = ((head + "\n\n" if head else "") + "\n".join(block) + "\n\n"
-            + "\n".join(kept[cut:]).strip("\n") + "\n")
-open(path, "w").write(text)
-PY
-  say "tuicr config written"
-}
-
-# The sidebar draws a workspace's position in herdr's stored list, but
-# prefix+1..9 targets its row in the grouped sidebar. Creating or removing a
-# worktree moves one and not the other, so the numbers you read stop being the
-# numbers you press. This links a tiny herdr plugin that reruns the alignment
-# on every event that can move a row, so it never needs remembering.
-apply_herdr_numbers() {
-  have herdr || return 0
-  [ "$(cfg_get herdr.renumber_plugin true)" = "true" ] || return 0
-
-  local dir="$HOME/.config/acstack/herdr-numbers"
-  mkdir -p "$dir"
-  # An absolute command: herdr runs argv without a shell and resolves relative
-  # commands from the plugin root, not from PATH.
-  cat > "$dir/herdr-plugin.toml" <<H
-id = "acstack.herdr-numbers"
-name = "ACStack workspace numbers"
-version = "1.0.0"
-min_herdr_version = "0.8.0"
-description = "Keep the sidebar numbers matching prefix+1..9"
-platforms = ["linux", "macos", "windows"]
-
-# Every event that can move a sidebar row. workspace.moved and
-# workspace.reordered are deliberately absent: the realignment emits both, so
-# hooking them would loop forever. The helper is idempotent, so the overlap
-# between the workspace and worktree events costs nothing.
-[[events]]
-on = "workspace.created"
-command = ["$BIN/acstack-herdr-renumber"]
-
-[[events]]
-on = "workspace.closed"
-command = ["$BIN/acstack-herdr-renumber"]
-
-[[events]]
-on = "worktree.created"
-command = ["$BIN/acstack-herdr-renumber"]
-
-[[events]]
-on = "worktree.opened"
-command = ["$BIN/acstack-herdr-renumber"]
-
-[[events]]
-on = "worktree.removed"
-command = ["$BIN/acstack-herdr-renumber"]
-H
-
-  if herdr plugin list 2>/dev/null | grep -q "acstack.herdr-numbers"; then
-    say "herdr numbers plugin already linked"
-  elif herdr plugin link "$dir" >/dev/null 2>&1; then
-    say "herdr numbers plugin linked, sidebar numbers stay aligned"
-  else
-    say "herdr plugin link failed; run acstack-herdr-renumber by hand"
-  fi
-}
-
-apply_yazi() {
-  [ "$(cfg_get yazi.enabled true)" = "true" ] || return 0
-  if ! have yazi; then
-    install_binary yazi sxyazi/yazi x86_64-unknown-linux-gnu || return 0
-    install_binary ya   sxyazi/yazi x86_64-unknown-linux-gnu || true
-  fi
-  have yazi || { say "yazi not installed, skipping config"; return 0; }
-
-  # piper turns any shell command into a previewer, which is how acstack-md
-  # gets to draw markdown in the preview pane.
-  if have ya && ! ya pkg list 2>/dev/null | grep -q "plugins:piper"; then
-    ya pkg add yazi-rs/plugins:piper >/dev/null 2>&1 \
-      && say "yazi piper plugin installed" \
-      || say "piper install failed; markdown will preview as plain text"
-  fi
-
-  mkdir -p "$HOME/.config/yazi"
-  ACSTACK_ARGS="$(cfg_get yazi.show_hidden true)|$BEGIN|$END" \
-    py "$HOME/.config/yazi/yazi.toml" <<'PY'
-import os, re, sys
-path = sys.argv[1]
-hidden, begin, end = os.environ["ACSTACK_ARGS"].split("|")
-text = open(path).read() if os.path.isfile(path) else ""
-# Drop any previous managed region, both to stay idempotent and so what is
-# left to inspect below is exactly the config the user wrote.
-text = re.sub(re.escape(begin) + r".*?" + re.escape(end) + r"\n?", "", text, flags=re.S)
-
-# Every namespace the block writes into. TOML forbids declaring any of them
-# twice, and yazi answers one duplicate by throwing the entire config away and
-# falling back to presets. So a namespace the user already occupies is theirs:
-# the block gives that piece up rather than cost them every other setting they
-# have. Deciding which are taken is a question about the parsed document, not
-# about the text: [ mgr ], [ "mgr" ], [ 'mgr' ] and mgr.show_hidden = false are
-# all the same table, and only a parser knows that.
-NAMESPACES = ("mgr", "opener.markdown", "plugin.prepend_previewers", "open.prepend_rules")
-
-try:
-    import tomllib
-except ImportError:  # tomllib is 3.11 and newer
-    tomllib = None
-
-
-def claimed(cfg):
-    """Which of NAMESPACES the user's own config already occupies."""
-    if tomllib is None:
-        # No parser to reason with, so read the text conservatively: name the
-        # top-level table wherever TOML could open one, as a header or as a
-        # key of its own. That concedes namespaces which would have been safe
-        # to write, and each of those costs one setting; guessing the other
-        # way costs the file. One thing text cannot see is that the config is
-        # broken already, so unlike the parsed path below this branch does not
-        # concede everything for a file that never parsed.
-        found = set()
-        for ns in NAMESPACES:
-            root = re.escape(ns.split(".")[0])
-            # A key may be bare, a basic string or a literal string, and all
-            # three name the same table: [mgr], ["mgr"] and ['mgr'] are one.
-            name = r"""(?:%s|"%s"|'%s')""" % (root, root, root)
-            header = r'\[\[?\s*%s\s*[.\]]' % name
-            key = r'%s\s*[.=]' % name
-            if re.search(r"(?m)^\s*(?:%s|%s)" % (header, key), cfg):
-                found.add(ns)
-        return found
-    try:
-        tomllib.loads(cfg)
-    except tomllib.TOMLDecodeError:
-        # Their config does not parse as it stands. We cannot tell what it
-        # claims, and repairing it is not ours to do, so concede everything:
-        # the file ends up exactly as broken as it arrived, never more.
-        return set(NAMESPACES)
-    found = set()
-    for ns in NAMESPACES:
-        # Whether a namespace is free is not "is the key there". TOML also
-        # refuses to reopen an inline table and to overwrite a scalar, so
-        # opener = { text = [...] } and opener = "nope" both have no
-        # opener.markdown key and are both fatal to write under. tomllib
-        # hands an inline table back as an ordinary dict, so no walk over the
-        # parsed document can tell those apart from a table that is still
-        # open. Put the question to the parser instead, in the exact form the
-        # block would write it: append that header to their config and see
-        # whether the whole thing still parses. Whatever it refuses is theirs.
-        probe = "[mgr]" if ns == "mgr" else "[[%s]]" % ns
-        try:
-            tomllib.loads(cfg + "\n" + probe + "\n")
-        except tomllib.TOMLDecodeError:
-            found.add(ns)
-    return found
-
-
-taken = claimed(text)
-parts = []
-
-if "plugin.prepend_previewers" not in taken:
-    parts.append("""
-[[plugin.prepend_previewers]]
-url = "*.md"
-run = 'piper -- COLUMNS=$w acstack-md --preview "$1"'
-
-[[plugin.prepend_previewers]]
-url = "*.markdown"
-run = 'piper -- COLUMNS=$w acstack-md --preview "$1"'
-""")
-
-if "opener.markdown" not in taken:
-    # An array of tables rather than a markdown key under [opener]: a second
-    # [opener] table would be a duplicate, while a subtable of one the user
-    # has already declared is legal.
-    parts.append("""
-# The preview pane is narrow, so a wide diagram shows its placeholder there.
-# Enter opens the same renderer full width, where more of them fit.
-#
-# %s is what yazi substitutes for the files being opened, already quoted. Not
-# "$@": an opener template is run as `sh -c '<run>'` with nothing after it, so
-# $0 is "sh" and $@ is empty - measured on yazi 26.8.15, where "$@" left
-# acstack-md with no file at all and Enter did nothing but print its usage.
-[[opener.markdown]]
-run = 'acstack-md %s'
-block = true
-desc = "Read (acstack-md)"
-
-# Rendered markdown has no line number to quote back in a review, so the same
-# file is also readable as its own source. Second, not first: it answers a
-# narrower question than reading does, and still a readier one than editing.
-# Enter takes the first entry, so O is the key that offers this one.
-[[opener.markdown]]
-run = 'acstack-md --numbered %s'
-block = true
-desc = "Read with line numbers"
-
-[[opener.markdown]]
-run = '${EDITOR:-vi} %s'
-block = true
-desc = "Edit"
-""")
-
-if "open.prepend_rules" not in taken:
-    # Worth writing even when the opener above was skipped: the rules point
-    # markdown files at whichever opener.markdown ends up in the file.
-    parts.append("""
-[[open.prepend_rules]]
-url = "*.md"
-use = "markdown"
-
-[[open.prepend_rules]]
-url = "*.markdown"
-use = "markdown"
-""")
-
-if "mgr" not in taken:
-    parts.append(f"[mgr]\nshow_hidden = {hidden}")
+. "$SCRIPT_DIR/lib/core.sh"
+. "$SCRIPT_DIR/lib/helper-install.sh"
+. "$SCRIPT_DIR/lib/apply-herdr.sh"
+. "$SCRIPT_DIR/lib/apply-tuicr.sh"
+. "$SCRIPT_DIR/lib/apply-herdr-numbers.sh"
+. "$SCRIPT_DIR/lib/apply-yazi.sh"
+. "$SCRIPT_DIR/lib/apply-tools.sh"
+. "$SCRIPT_DIR/lib/apply-ghdash.sh"
+. "$SCRIPT_DIR/lib/pi-state.sh"
+. "$SCRIPT_DIR/lib/pi-packages.sh"
+. "$SCRIPT_DIR/lib/versions.sh"
+. "$SCRIPT_DIR/lib/commands.sh"
 
-# The markers go down even when every piece was conceded, so the shell below
-# can still read the region back and see what is missing from it.
-block = begin + "\n" + "\n\n".join(p.strip("\n") for p in parts) + "\n" + end
-text = text.rstrip("\n")
-open(path, "w").write((text + "\n\n" if text else "") + block + "\n")
-PY
-  # A setting the block gave up to the user's own config is simply absent from
-  # what was written, so read the region back rather than let it go unsaid.
-  local written; written="$(sed -n "/$BEGIN/,/$END/p" "$HOME/.config/yazi/yazi.toml")"
-  case "$written" in *"[[plugin.prepend_previewers]]"*) ;; *)
-    say "yazi: your yazi.toml already sets plugin.prepend_previewers, so the"
-    say "     markdown previewer was left alone. Add a *.md entry there to"
-    say "     preview markdown with acstack-md." ;;
-  esac
-  case "$written" in *"[[opener.markdown]]"*) ;; *)
-    say "yazi: your yazi.toml already opens markdown its own way, so it was left"
-    say "     alone. Add acstack-md to that opener to read markdown with it." ;;
-  esac
-  case "$written" in *"[[open.prepend_rules]]"*) ;; *)
-    say "yazi: your yazi.toml already sets open.prepend_rules, so the markdown"
-    say "     rules were left alone. Add *.md and *.markdown entries there"
-    say "     pointing at the markdown opener." ;;
-  esac
-  case "$written" in *show_hidden*) ;; *)
-    say "yazi: your yazi.toml already claims mgr itself, so show_hidden was left"
-    say "     alone. Set it there yourself to show hidden files." ;;
-  esac
-  # The keymap is its own file, and prepend_keymap has two spellings: an array
-  # of tables, which is additive and safe to extend, and an inline array under
-  # [mgr], which is one key that TOML forbids declaring twice. Only the second
-  # collides with the entry below, and telling them apart takes the text - both
-  # spellings parse to the same list.
-  ACSTACK_ARGS="$(cfg_get yazi.browser_key "b")|$(cfg_get yazi.line_numbers_key "#")|$(cfg_get yazi.download_key "D")|$(cfg_get yazi.download_target "")|$(cfg_get yazi.edit_key "e")|$BEGIN|$END" \
-    py "$HOME/.config/yazi/keymap.toml" <<'PY'
-import os, re, sys
-
-path = sys.argv[1]
-key, numkey, dlkey, dltarget, editkey, begin, end = os.environ["ACSTACK_ARGS"].split("|")
-text = open(path).read() if os.path.isfile(path) else ""
-# Drop any previous managed region, both to stay idempotent and so what is
-# left to inspect below is exactly the keymap the user wrote.
-text = re.sub(re.escape(begin) + r".*?" + re.escape(end) + r"\n?", "", text, flags=re.S)
-
-try:
-    import tomllib
-except ImportError:  # tomllib is 3.11 and newer
-    tomllib = None
-
-
-def claimed(t):
-    """True when the user's keymap declares prepend_keymap as an inline array
-    under [mgr] - the one spelling our own entry cannot sit beside."""
-    if not re.search(r"^\s*prepend_keymap\s*=", t, flags=re.M):
-        return False
-    if tomllib is None:
-        # No parser to say which table that assignment sits in, so assume the
-        # worst. A conceded binding costs one key; a collision costs the whole
-        # keymap, because yazi answers invalid TOML by falling back to presets.
-        return True
-    try:
-        return "prepend_keymap" in (tomllib.loads(t).get("mgr") or {})
-    except Exception:
-        return True
-
-
-CLAIMED = {k for k in (key, numkey, editkey) if k}
-if dltarget and dlkey:
-    CLAIMED.add(dlkey)
-
-
-def drop_claimed(t):
-    """Remove any prepend_keymap block the user wrote on a key this script is
-    about to bind.
-
-    yazi accepts both, lists both in its help, and runs one of them. So a
-    binding written by hand before this script managed the key leaves two
-    entries saying different things and no way to tell which one fires. Both
-    table spellings, because `manager` is what yazi called `mgr` before the
-    rename and an older keymap still says it.
-    """
-    out, block = [], None
-
-    def bound_key(lines):
-        """The single key this block binds, or None.
-
-        yazi spells `on` four ways: a double-quoted scalar, a single-quoted
-        one, a one-element array, and any of those with a trailing comment.
-        Reading only the first spelling leaves the other three in place, which
-        is the state this function exists to prevent. A longer array is a
-        multi-key sequence and never collides with a single key.
-        """
-        body = "\n".join(lines[1:])
-        if tomllib is not None:
-            try:
-                on = tomllib.loads(body).get("on")
-            except Exception:
-                on = ...  # unparseable, so fall through to the regex
-            if on is not ...:
-                if isinstance(on, str):
-                    return on
-                if isinstance(on, list) and len(on) == 1 and isinstance(on[0], str):
-                    return on[0]
-                return None
-        m = re.search(r"""(?m)^\s*on\s*=\s*\[?\s*(?:"([^"]*)"|'([^']*)')""", body)
-        return (m.group(1) if m.group(1) is not None else m.group(2)) if m else None
-
-    def close():
-        nonlocal block
-        if block is None:
-            return
-        # Trailing blank lines belong to whatever comes next, not to the
-        # binding, so they stay even when the binding goes.
-        tail = []
-        while block and not block[-1].strip():
-            tail.insert(0, block.pop())
-        if bound_key(block) not in CLAIMED:
-            out.extend(block)
-        out.extend(tail)
-        block = None
-
-    for ln in t.splitlines():
-        if re.match(r"^\s*\[\[\s*(?:mgr|manager)\.prepend_keymap\s*\]\]\s*$", ln):
-            close()
-            block = [ln]
-            continue
-        if block is not None:
-            # Any other table header ends this binding and belongs to what
-            # follows, so it is never dropped with the block.
-            if ln.lstrip().startswith("["):
-                close()
-                out.append(ln)
-                continue
-            block.append(ln)
-            continue
-        out.append(ln)
-    close()
-    return "\n".join(out)
-
-
-parts = []
-if not claimed(text):
-    # A binding conceded below is one this script never writes, so the user's
-    # own must survive. Only strip when the bindings are actually going in.
-    text = drop_claimed(text)
-    # %h is the hovered file. $0 and $@ are not: yazi runs the template through
-    # a shell, where $0 names the shell itself and $@ is empty - both measured,
-    # and both would open the browser on nothing at all.
-    #
-    # %h stays bare, here and in every binding below. yazi shell-quotes it
-    # itself, so quotes around it end up inside the path and nothing is found.
-    #
-    # --block because the delivery has something to say. On the bridge it is a
-    # line of confirmation; on every other route it is a link, and a served
-    # page that has to stay up. Detached, all of that goes nowhere.
-    parts.append(
-        "[[mgr.prepend_keymap]]\n"
-        f'on = "{key}"\n'
-        """run = 'shell --block -- acstack-md --browser %h'\n"""
-        'desc = "Open in the browser you are sitting at"'
-    )
-    # Flipping the flag changes nothing a reader can see: the pane already
-    # holds the view it drew before the key was pressed. So the binding is two
-    # actions, and peek redraws it.
-    #
-    # --block, though the toggle has nothing to say. Detached, yazi spawns it
-    # and runs peek immediately, and the pane is redrawn while the flag is
-    # still whatever it was - a race the reader settles by pressing the key
-    # twice. Blocking costs a frame and wins it outright.
-    parts.append(
-        "[[mgr.prepend_keymap]]\n"
-        f'on = "{numkey}"\n'
-        "run = [ 'shell --block -- acstack-md --toggle-line-numbers', 'peek --force' ]\n"
-        'desc = "Preview markdown as source with line numbers"'
-    )
-    # `e` edits, everywhere. tuicr's diff and file tree both put the editor on
-    # `e`, so yazi matching it means one key means edit across the workspace.
-    # `o` is left alone: it opens by rule, which for markdown is the reader.
-    #
-    # ${EDITOR:-vi} rather than a fixed editor, the same expansion the opener
-    # in yazi.toml uses, so both paths land in whatever the user actually runs.
-    parts.append(
-        "[[mgr.prepend_keymap]]\n"
-        f'on = "{editkey}"\n'
-        """run = 'shell --block -- ${EDITOR:-vi} %h'\n"""
-        'desc = "Edit in $EDITOR"'
-    )
-    # Taildrop is Tailscale's file send. It is the one route off a headless
-    # machine that needs nothing installed on the machine the user sits at,
-    # and no inbound port there either.
-    #
-    # %h, the hovered file, for the same reason the browser key uses it. %* is
-    # not a keybinding placeholder at all - yazi passes it through untouched,
-    # and tailscale then reports `open %*: no such file or directory`.
-    # Measured on yazi 26.8.15.
-    #
-    # --block because a send reports progress, and a refused one reports why.
-    if dltarget:
-        parts.append(
-            "[[mgr.prepend_keymap]]\n"
-            f'on = "{dlkey}"\n'
-            f"""run = 'shell --block -- tailscale file cp %h {dltarget}:'\n"""
-            f'desc = "Send this file to {dltarget} over Taildrop"'
-        )
-
-# The markers go down even when the binding was conceded, so the shell below
-# can read the region back and see what is missing from it.
-block = begin + "\n" + "\n\n".join(parts) + ("\n" if parts else "") + end
-text = text.rstrip("\n")
-open(path, "w").write((text + "\n\n" if text else "") + block + "\n")
-PY
-  local kmwritten; kmwritten="$(sed -n "/$BEGIN/,/$END/p" "$HOME/.config/yazi/keymap.toml")"
-  case "$kmwritten" in *prepend_keymap*) ;; *)
-    say "yazi: your keymap.toml already sets mgr.prepend_keymap as an inline"
-    say "     array, which these bindings cannot sit beside. Add them there"
-    say "     yourself:  shell --block -- acstack-md --browser %h"
-    say "     and:       [ 'shell --block -- acstack-md --toggle-line-numbers', 'peek --force' ]"
-    say "     and:       shell --block -- \${EDITOR:-vi} %h" ;;
-  esac
-  # The download key is written from the config alone, so it can be wrong in
-  # three ways the config cannot see. Name whichever one holds, rather than
-  # leaving the user to read `status code: 1` out of a yazi popup.
-  local dltarget; dltarget="$(cfg_get yazi.download_target "")"
-  if [ -n "$dltarget" ]; then
-    if ! have tailscale; then
-      say "yazi: download_target names $dltarget, but this machine has no"
-      say "     tailscale. Install it, or clear the key to drop the binding."
-    elif ! tailscale file cp --targets >/dev/null 2>&1; then
-      say "yazi: tailscale refuses file access to this user account. Run once:"
-      say "       sudo tailscale set --operator=\$USER"
-    elif ! tailscale file cp --targets 2>/dev/null \
-         | awk -F'\t' -v t="$dltarget" '$2 == t { f = 1 } END { exit !f }'; then
-      say "yazi: $dltarget is not a Taildrop target of this machine. Taildrop"
-      say "     only sends between devices one Tailscale account owns on one"
-      say "     tailnet. Check both ends with: tailscale file cp --targets"
-    fi
-  fi
-  say "yazi config written"
-}
-
-apply_markdown() {
-  [ "$(cfg_get markdown.enabled true)" = "true" ] || return 0
-  install_binary mermaid-ascii AlexanderGrooff/mermaid-ascii Linux_x86_64
-  install_binary glow charmbracelet/glow Linux_x86_64
-  # Vendored so the preview page pulls nothing from a CDN: it works offline,
-  # and on a managed laptop there is no third-party fetch to explain.
-  local share="$HOME/.local/share/acstack"
-  mkdir -p "$share"
-  if [ ! -s "$share/mermaid.min.js" ]; then
-    curl -fsSL -o "$share/mermaid.min.js" \
-      "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.min.js" \
-      && say "mermaid.js vendored to $share" \
-      || say "mermaid.js download failed, the preview will fall back to a CDN"
-  fi
-  python3 -c 'import markdown' 2>/dev/null \
-    || say "acstack-md --serve needs python markdown: pip install --user markdown"
-  have chafa || say "optional: apt install chafa, to draw images as text"
-}
-
-# The plugin file's name is ours by convention alone, and the directory around
-# it is the user's. A file of that name this script did not write is theirs,
-# so apply must not overwrite it and disable must not delete it. It says so
-# where it refuses, so both paths report it the same way.
-nvim_ours() {
-  [ ! -e "$NVIM_PLUGIN" ] && return 0
-  grep -q "$NVIM_MARK" "$NVIM_PLUGIN" 2>/dev/null && return 0
-  say "neovim: $NVIM_PLUGIN was written by hand, left alone"
-  return 1
-}
-
-# The dot is appended to LazyVim's lualine section, and LazyVim loads every
-# file under lua/plugins. So a lualine override the user wrote in a file of
-# their own does exactly what this component does, and installing on top of it
-# draws two dots side by side. Print the file that already does it, if any.
-nvim_dot_elsewhere() {
-  local dir="$HOME/.config/nvim/lua/plugins" f
-  [ -d "$dir" ] || return 1
-  for f in "$dir"/*.lua; do
-    [ -e "$f" ] || continue
-    [ "$f" = "$NVIM_PLUGIN" ] && continue
-    # Both, not either: a lualine override that says nothing about a modified
-    # buffer is not this dot, and neither is a modified check outside lualine.
-    grep -q 'lualine' "$f" 2>/dev/null || continue
-    grep -q 'vim\.bo\.modified' "$f" 2>/dev/null || continue
-    printf '%s\n' "$f"
-    return 0
-  done
-  return 1
-}
-
-# Print the first lua file of the user's own that sets a pattern, ignoring
-# comment lines, since a setting tried and commented out decides nothing.
-nvim_user_sets() {
-  local f
-  while IFS= read -r f; do
-    grep -v '^[[:space:]]*--' "$f" 2>/dev/null | grep -q "$1" || continue
-    printf '%s\n' "$f"
-    return 0
-  done < <(find "$HOME/.config/nvim" -name '*.lua' ! -path "$NVIM_PLUGIN" 2>/dev/null | sort)
-  return 1
-}
-
-# The clipboard part of the plugin file. The comment inside it says why.
-NVIM_CLIPBOARD_LUA='
--- Over SSH, neovim finds no clipboard and :%y+ fails. Copy goes out over
--- OSC 52, which asks the terminal you sit at to put the text on its own
--- clipboard. Paste replays what this neovim copied last, because Windows
--- Terminal refuses OSC 52 reads. Use the terminal paste key for anything else.
-local function set(v)
-  return v ~= nil and v ~= ""
-end
-if not (set(vim.env.DISPLAY) or set(vim.env.WAYLAND_DISPLAY) or set(vim.env.TMUX)
-    or vim.fn.has("mac") == 1 or vim.fn.has("wsl") == 1) then
-  local osc52 = require("vim.ui.clipboard.osc52")
-  local last = {}
-  local function copy(reg)
-    local send = osc52.copy(reg)
-    return function(lines, regtype)
-      last[reg] = { lines, regtype }
-      send(lines)
-    end
-  end
-  local function paste(reg)
-    return function()
-      return last[reg] or { { "" }, "v" }
-    end
-  end
-  vim.g.clipboard = {
-    name = "OSC 52 (acstack)",
-    copy = { ["+"] = copy("+"), ["*"] = copy("*") },
-    paste = { ["+"] = paste("+"), ["*"] = paste("*") },
-  }
-'
-# LazyVim empties clipboard over SSH, then restores that value on VeryLazy.
-# Scheduled, this runs after the restore, so a plain y copies too. It is left
-# out when the user sets clipboard themselves.
-NVIM_UNNAMEDPLUS_LUA='  vim.api.nvim_create_autocmd("User", {
-    pattern = "VeryLazy",
-    once = true,
-    callback = function()
-      vim.schedule(function()
-        if vim.o.clipboard == "" then
-          vim.opt.clipboard = "unnamedplus"
-        end
-      end)
-    end,
-  })
-'
-
-apply_neovim() {
-  # The one component that is off unless asked for. Every other one writes
-  # files this setup owns end to end, or a marked region inside a config that
-  # invites one. A neovim config is neither: the user built it, so this waits.
-  [ "$(cfg_get neovim.enabled false)" = "true" ] || return 0
-  # The dot appends to LazyVim's own lualine section, and the clipboard undoes
-  # a LazyVim default, so both mean nothing on a config that is not LazyVim.
-  # Two markers, because a LazyVim config never opened has no plugins yet.
-  if ! grep -q LazyVim "$HOME/.config/nvim/lua/config/lazy.lua" 2>/dev/null \
-     && [ ! -d "$HOME/.local/share/nvim/lazy/LazyVim" ]; then
-    say "neovim: no LazyVim config on this machine, plugin file not written"
-    return 0
-  fi
-  nvim_ours || return 0
-
-  local dot_spec="" clip_lua="" mine
-  if mine="$(nvim_dot_elsewhere)"; then
-    say "neovim: $mine already marks a modified buffer in lualine."
-    # nvim_ours has already run, so a file at this path is one we wrote. A user
-    # who installed first and wrote their own override later would otherwise
-    # keep both, which is the pair of dots this guard exists to prevent.
-    if grep -q 'vim\.bo\.modified' "$NVIM_PLUGIN" 2>/dev/null; then
-      say "     The dot this component wrote was removed, so only one is drawn."
-    else
-      say "     The dot was not written. Two would be drawn side by side."
-    fi
-    say "     Delete $mine to hand the dot back to this component."
-  else
-    local dot; dot="$(cfg_get neovim.unsaved_dot_color '#f38ba8')"
-    dot_spec="$(cat <<H
-
--- LazyVim marks an unsaved buffer by recolouring the filename and nothing
--- else, because its pretty_path component sets modified_sign = "". A glance
--- at the statusline then cannot tell a saved buffer from an unsaved one.
--- This appends a dot to the same section, which can.
-return {
-  {
-    "nvim-lualine/lualine.nvim",
-    opts = function(_, opts)
-      table.insert(opts.sections.lualine_c, {
-        function()
-          return vim.bo.modified and "●" or ""
-        end,
-        color = { fg = "$dot" },
-      })
-    end,
-  },
-}
-H
-)"
-  fi
-
-  if [ "$(cfg_get neovim.osc52_clipboard true)" = "true" ]; then
-    # Whichever lua sets vim.g.clipboard last wins, and the user's own files
-    # load after ours, so ours would only add a forced clipboard option.
-    if mine="$(nvim_user_sets 'g\.clipboard')"; then
-      say "neovim: $mine already sets vim.g.clipboard."
-      if grep -q 'vim\.g\.clipboard' "$NVIM_PLUGIN" 2>/dev/null; then
-        say "     The OSC 52 copy this component wrote was removed."
-      else
-        say "     The OSC 52 copy was not written."
-      fi
-    else
-      clip_lua="$NVIM_CLIPBOARD_LUA"
-      if mine="$(nvim_user_sets '[.]o[pt]*[.]clipboard')"; then
-        say "neovim: $mine sets clipboard, so y keeps the value set there"
-      else
-        clip_lua="$clip_lua$NVIM_UNNAMEDPLUS_LUA"
-      fi
-      clip_lua="${clip_lua}end
-"
-    fi
-  fi
-
-  if [ -z "$dot_spec$clip_lua" ]; then
-    rm -f "$NVIM_PLUGIN"
-    return 0
-  fi
-  mkdir -p "$(dirname "$NVIM_PLUGIN")"
-  {
-    printf -- '-- %s. Remove it with: setup.sh disable neovim\n' "$NVIM_MARK"
-    printf '%s' "$clip_lua"
-    # Every file under lua/plugins must return a spec, even an empty one.
-    if [ -n "$dot_spec" ]; then printf '%s\n' "$dot_spec"; else printf '\nreturn {}\n'; fi
-  } > "$NVIM_PLUGIN"
-  [ -n "$dot_spec" ] && say "neovim: unsaved-changes dot written to $NVIM_PLUGIN"
-  [ -n "$clip_lua" ] && say "neovim: OSC 52 copy written to $NVIM_PLUGIN"
-  return 0
-}
-
-apply_delta() {
-  have delta || { say "delta not installed, skipping git pager"; return 0; }
-  [ "$(cfg_get delta.set_git_pager true)" = "true" ] || { say "delta: git pager left alone"; return 0; }
-  git config --global core.pager delta
-  git config --global interactive.diffFilter "delta --color-only"
-  git config --global delta.navigate true
-  git config --global delta.line-numbers true
-  git config --global merge.conflictstyle zdiff3
-  say "delta set as git pager"
-}
-
-apply_remote() {
-  # A VM reached over SSH has no display and no clipboard of its own, so
-  # anything that shells out to xclip fails. Put an xclip on PATH that speaks
-  # OSC 52 to the terminal at the far end instead.
-  [ "$(cfg_get remote.clipboard_shim true)" = "true" ] || {
-    say "clipboard: xclip stand-in not installed"; return 0; }
-  local real
-  # Only when the machine has neither a real xclip nor a display for one to
-  # talk to. Shadowing a working clipboard would be a downgrade. A stand-in
-  # this script wrote before is not a real one, wherever it turns up.
-  real="$(command -v xclip 2>/dev/null)"
-  if [ -n "$real" ] && ! grep -q "Installed by acstack" "$real" 2>/dev/null; then
-    say "clipboard: real xclip at $real, stand-in not installed"
-    return 0
-  fi
-  if [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]; then
-    say "clipboard: this machine has a display, stand-in not installed"
-    return 0
-  fi
-  cat > "$BIN/xclip" <<'H'
-#!/usr/bin/env bash
-# xclip, for a machine whose clipboard is at the other end of an SSH session.
-# acstack installs this only when no real xclip is present.
-#
-# It exists for programs that reach for xclip directly instead of offering a
-# setting. gh-dash copies pull request URLs through a Go library that looks
-# only for xclip, xsel, wl-copy and termux-clipboard-set, and gives up when
-# none is on PATH. This puts one there, and acstack-clip sends the text to
-# the terminal's own clipboard with OSC 52.
-#
-# Hands over to a real xclip if one turns up on PATH with a display to talk
-# to. Remove it with `setup.sh uninstall`. Installed by acstack.
-set -uo pipefail
-
-PATH="$(cd "$(dirname "$0")" 2>/dev/null && pwd):$PATH"
-
-# A real xclip, anywhere on PATH except beside this script.
-if [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]; then
-  self="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
-  while IFS= read -r candidate; do
-    [ "$(cd "$(dirname "$candidate")" 2>/dev/null && pwd)" = "$self" ] && continue
-    exec "$candidate" "$@"
-  done < <(type -ap xclip 2>/dev/null)
+if [ "${ACSTACK_TW_NO_MAIN:-0}" != "1" ] && [ "${BASH_SOURCE[0]:-$0}" = "$0" ]; then
+  acstack_tw_main "$@"
 fi
-
-for arg in "$@"; do
-  case "$arg" in
-    -o|-out|-output) exec acstack-clip --out ;;
-  esac
-done
-exec acstack-clip
-H
-  chmod +x "$BIN/xclip"
-  say "clipboard: xclip stand-in written, copying over OSC 52"
-}
-
-apply_harlequin() {
-  # uv is astral's python installer. harlequin is a python program, so there is
-  # no release tarball to unpack: uv builds it an environment of its own and
-  # links one command into ~/.local/bin. Nothing else here needs uv, so a
-  # machine without it loses this component and keeps the rest.
-  have uv || {
-    say "uv not installed, skipping harlequin"
-    say "install it with: curl -LsSf https://astral.sh/uv/install.sh | sh"
-    return 0
-  }
-  local a adapters missing=0
-  adapters=$(cfg_get_list harlequin.adapters "postgres snowflake")
-  local -a with=()
-  for a in $adapters; do with+=(--with "harlequin-$a"); done
-
-  # uv records what it installed in a receipt beside the environment.
-  # `uv tool install` on an already-installed tool does nothing at all, so an
-  # adapter added to the config would never arrive without --force. Compare the
-  # receipt against the config and force only when they differ.
-  local receipt="${UV_TOOL_DIR:-$HOME/.local/share/uv/tools}/harlequin/uv-receipt.toml"
-  if have harlequin && [ -f "$receipt" ]; then
-    for a in $adapters; do
-      grep -q "name = \"harlequin-$a\"" "$receipt" || missing=1
-    done
-    [ "$missing" = "0" ] && { say "harlequin already installed"; return 0; }
-    say "harlequin: adapters changed, reinstalling"
-    uv tool install --force harlequin "${with[@]}" >/dev/null 2>&1 \
-      && say "harlequin reinstalled with: $(echo $adapters)" \
-      || say "harlequin reinstall failed, run: uv tool install --force harlequin"
-    return 0
-  fi
-  uv tool install harlequin "${with[@]}" >/dev/null 2>&1 \
-    && say "harlequin installed with: $(echo $adapters)" \
-    || say "harlequin install failed, run: uv tool install harlequin"
-}
-
-apply_lens_extra_tools() {
-  # A small machine-wide pi-lens toolbelt for common project ecosystems.
-  # Pi-lens can fall back to npx or prompt for some tools, but putting these
-  # on PATH makes them available in any repo without per-project setup.
-  if [ "$(cfg_get pi.lens_extra_tools.python false)" = "true" ]; then
-    install_uv_tool black black
-    install_uv_tool mypy mypy
-    install_npm_tool pyright pyright
-  fi
-  if [ "$(cfg_get pi.lens_extra_tools.docker false)" = "true" ]; then
-    install_plain_github_binary hadolint hadolint/hadolint Linux-x86_64
-    install_npm_tool docker-langserver dockerfile-language-server-nodejs
-  fi
-  if [ "$(cfg_get pi.lens_extra_tools.github_actions false)" = "true" ]; then
-    install_binary actionlint rhysd/actionlint linux_amd64
-    install_uv_tool zizmor zizmor
-  fi
-  if [ "$(cfg_get pi.lens_extra_tools.terraform false)" = "true" ]; then
-    install_binary terraform-ls hashicorp/terraform-ls linux_amd64
-    install_binary tflint terraform-linters/tflint linux_amd64
-    install_plain_github_binary terragrunt gruntwork-io/terragrunt linux_amd64
-  fi
-}
-
-apply_ghdash() {
-  have gh || { say "gh not installed, skipping dashboard"; return 0; }
-  gh extension list 2>/dev/null | grep -q gh-dash || gh extension install dlvhdr/gh-dash >/dev/null 2>&1
-  mkdir -p "$(dirname "$GHDASH_CFG")"
-  ACSTACK_CFG="$CFG" py "$GHDASH_CFG" <<'PY'
-import os, sys, yaml
-src, dst = os.environ["ACSTACK_CFG"], sys.argv[1]
-# `or {}` on the section as well as the file. A bare "gh_dash:" with nothing
-# under it, which is what commenting the block out leaves behind, parses to
-# None, and every tw.get below then raises AttributeError. apply_ghdash died
-# on that with a traceback and wrote no config at all. The keybindings and
-# remote lookups below already guard the same way.
-tw = ((yaml.safe_load(open(src)) or {}).get("gh_dash") or {}) if os.path.isfile(src) else {}
-cfg = yaml.safe_load(open(dst)) or {} if os.path.isfile(dst) else {}
-if tw.get("sections"):
-    cfg["prSections"] = [{"title": s["title"], "filters": s["filters"]} for s in tw["sections"]]
-if tw.get("repo_paths"):
-    cfg["repoPaths"] = tw["repo_paths"]
-kb = tw.get("keybindings", {}) or {}
-# Every other setting reaches this script through cfg_get, which carries its
-# own default. This block reads the yaml itself, so a machine with no
-# terminal-workspace config used to land here with an empty dict: the prune
-# below dropped the review and agent keys, and nothing was written back. D
-# and S went silently dead while o, which already defaulted, kept working.
-# Defaults here, matching config.example.yaml. An empty string still disables.
-review = kb.get("review", "D")
-agent_review = kb.get("agent_review", "S")
-# "tree diff" is the old name for the review key, kept here so re-applying
-# over a config written before the rename drops it rather than leaving two
-# bindings on the same key.
-MANAGED = ("review (tuicr)", "tree diff", "agent review", "open in browser")
-prs = [k for k in (cfg.get("keybindings", {}) or {}).get("prs", [])
-       if k.get("name") not in MANAGED]
-if review:
-    prs.append({"key": review, "name": "review (tuicr)",
-                "command": "cd {{.RepoPath}} && tuicr pr {{.PrNumber}}\n"})
-if agent_review:
-    prs.append({"key": agent_review, "name": "agent review",
-                "command": 'cd {{.RepoPath}} && claude "/code-review {{.PrNumber}}"\n'})
-kbs = cfg.setdefault("keybindings", {})
-# o built into gh-dash opens through $BROWSER, whose output it discards. That
-# is enough for a machine with a desktop and nothing at all for one without,
-# where the only way to reach a browser is to hand the terminal a link. Take
-# the key so acstack-open gets a terminal to draw on. GH_HOST covers
-# GitHub Enterprise, whose URLs are the same shape on a different host.
-open_key = (tw.get("remote", {}) or {}).get("open_key", "o")
-if open_key:
-    host = "https://${GH_HOST:-github.com}"
-    prs.append({"key": open_key, "name": "open in browser",
-                "command": f'acstack-open "{host}/{{{{.RepoName}}}}/pull/{{{{.PrNumber}}}}"\n'})
-    issues = [k for k in (cfg.get("keybindings", {}) or {}).get("issues", [])
-              if k.get("name") not in MANAGED]
-    issues.append({"key": open_key, "name": "open in browser",
-                   "command": f'acstack-open "{host}/{{{{.RepoName}}}}/issues/{{{{.IssueNumber}}}}"\n'})
-    kbs["issues"] = issues
-kbs["prs"] = prs
-if tw.get("page_keys", True):
-    uni = [k for k in kbs.get("universal", []) if k.get("builtin") not in ("pageUp", "pageDown")]
-    uni += [{"key": "pgup", "builtin": "pageUp"}, {"key": "pgdown", "builtin": "pageDown"}]
-    kbs["universal"] = uni
-yaml.safe_dump(cfg, open(dst, "w"), sort_keys=False, default_flow_style=False, width=200)
-print("  gh-dash config written")
-PY
-}
-
-# Every edit the pi component makes to pi's own files goes through here, and
-# so does the record of what it changed. pi's config is JSON, which has no
-# comment to mark a managed region with, so ownership lives in $PI_OWNED.
-#   pkg <identity>             the configured source pi holds for a package
-#   own|disown pkg|file <name> record or forget one thing this setup added
-#   owns pkg|file <name>       exit 0 when this setup added it
-#   parses <file>              exit 0 when the file is absent or valid JSON
-#   merge <file> <slot> <json> claim each dotted key with a value, and release
-#                              each one set to null, putting back what it held
-#   pin <identity> <prior> <ours>  record a pin apply moved, keeping the first prior
-#   pin-get <identity>         the prior and our pin, tab-separated
-#   pin-forget <identity>      drop that record
-#   md write|strip             the delegation block in pi's context file
-pi_state() {
-  ACSTACK_PI_OWNED="$PI_OWNED" ACSTACK_PI_SETTINGS="$PI_SETTINGS" \
-  ACSTACK_PI_DIR="$PI_DIR" ACSTACK_PI_MD="$PI_MD_BEGIN|$PI_MD_END|$PI_DELEGATION" \
-    py "$@" <<'PY'
-import json, os, re, sys
-
-OWNED = os.environ["ACSTACK_PI_OWNED"]
-MISSING = object()
-
-def load_owned():
-    try:
-        d = json.load(open(OWNED))
-    except (OSError, ValueError):
-        d = {}
-    return d if isinstance(d, dict) else {}
-
-def save_owned(d):
-    d = {k: v for k, v in d.items() if v}
-    if not d:
-        if os.path.exists(OWNED):
-            os.remove(OWNED)
-        return
-    os.makedirs(os.path.dirname(OWNED), exist_ok=True)
-    json.dump(d, open(OWNED, "w"), indent=2)
-
-def load_json(path):
-    if not os.path.exists(path):
-        return {}
-    d = json.load(open(path))
-    if not isinstance(d, dict):
-        raise ValueError("not an object")
-    return d
-
-def identity(src):
-    # pi names a package by its npm name or its repository without the ref, so
-    # two pins of one repository are one package.
-    if isinstance(src, dict):
-        src = src.get("source", "")
-    if src.startswith("npm:"):
-        spec = src[4:]
-        at = spec.rfind("@")
-        return "npm:" + (spec[:at] if at > 0 else spec)
-    m = re.match(r"^(?:git:|https?://|ssh://)(?:git@)?(.+?)(?:\.git)?(?:@[^/@]+)?$", src)
-    if m:
-        return "git:" + m.group(1).replace(":", "/")
-    return src
-
-cmd, args = sys.argv[1], sys.argv[2:]
-
-if cmd == "pkg":
-    try:
-        pkgs = load_json(os.environ["ACSTACK_PI_SETTINGS"]).get("packages") or []
-    except ValueError:
-        raise SystemExit(1)
-    for p in pkgs:
-        if identity(p) == args[0]:
-            print(p.get("source") if isinstance(p, dict) else p)
-            raise SystemExit
-    raise SystemExit(1)
-
-if cmd in ("own", "disown", "owns"):
-    kind, name = args
-    slot = {"pkg": "packages", "file": "files"}[kind]
-    d = load_owned()
-    have = d.get(slot, [])
-    if cmd == "owns":
-        raise SystemExit(0 if name in have else 1)
-    have = [x for x in have if x != name] + ([name] if cmd == "own" else [])
-    d[slot] = have
-    save_owned(d)
-    raise SystemExit
-
-if cmd in ("pin", "pin-get", "pin-forget"):
-    d = load_owned()
-    pins = d.setdefault("pins", {})
-    if cmd == "pin":
-        ident, was, ours = args
-        pins[ident] = {"prior": pins.get(ident, {}).get("prior", was), "ours": ours}
-    elif cmd == "pin-forget":
-        pins.pop(args[0], None)
-    else:
-        rec = pins.get(args[0])
-        if not rec:
-            raise SystemExit(1)
-        print("%s\t%s" % (rec["prior"], rec["ours"]))
-        raise SystemExit
-    save_owned(d)
-    raise SystemExit
-
-if cmd == "parses":
-    try:
-        load_json(args[0])
-    except ValueError:
-        raise SystemExit(1)
-    raise SystemExit
-
-if cmd == "merge":
-    path, slot, want = args[0], args[1], json.loads(args[2])
-    try:
-        d = load_json(path)
-    except ValueError:
-        print("  pi: %s does not parse, so it was left alone" % path)
-        raise SystemExit(3)
-    owned = load_owned()
-    mine = owned.setdefault(slot, {})
-    # What a claimed key held before apply first changed it, so release can
-    # put the user's value back rather than delete it.
-    prior = owned.setdefault(slot + "_prior", {})
-    wrote, dropped = [], []
-    for key, value in want.items():
-        parents, leaf = ([], key) if slot == "keybindings" else (key.split(".")[:-1], key.split(".")[-1])
-        node = d
-        for p in parents:
-            if node.get(p, MISSING) is MISSING and value is not None:
-                node[p] = {}
-            node = node.get(p)
-            if not isinstance(node, dict):
-                break
-        if not isinstance(node, dict):
-            # A parent the user set to something other than an object, or
-            # deleted. Writing through it would replace their value, so
-            # concede this key. On release there is nothing left of ours.
-            if value is not None:
-                print("  pi: %s in %s is not an object, %s left alone" % (".".join(parents), path, key))
-            else:
-                mine.pop(key, None)
-                prior.pop(key, None)
-            continue
-        have = node.get(leaf, MISSING)
-        if value is None:
-            # Released. Delete only a value this setup wrote and nobody has
-            # changed since; anything else is the user's.
-            if key in mine and have == mine[key]:
-                if key in prior:
-                    node[leaf] = prior[key]
-                else:
-                    del node[leaf]
-                    cur = d
-                    for p in parents[:-1]:
-                        cur = cur[p]
-                    if parents and not node:
-                        del cur[parents[-1]]
-                dropped.append(key)
-            mine.pop(key, None)
-            prior.pop(key, None)
-        elif have != value:
-            if key not in mine and have is not MISSING:
-                prior[key] = have
-            node[leaf] = value
-            mine[key] = value
-            wrote.append(key)
-    save_owned(owned)
-    if wrote or dropped:
-        if d or not os.path.exists(path):
-            os.makedirs(os.path.dirname(path), exist_ok=True)
-            with open(path, "w") as f:
-                # pi writes its own settings unescaped, so a value in any
-                # script round-trips as the user typed it.
-                json.dump(d, f, indent=2, ensure_ascii=False)
-                f.write("\n")
-        else:
-            # Everything in it was ours, and an empty file is no setting at all.
-            os.remove(path)
-        if wrote:
-            print("  pi: set %s in %s" % (", ".join(wrote), path))
-        if dropped:
-            print("  pi: released %s in %s" % (", ".join(dropped), path))
-    raise SystemExit
-
-if cmd == "md":
-    begin, end, line = os.environ["ACSTACK_PI_MD"].split("|")
-    agent_dir = os.environ["ACSTACK_PI_DIR"]
-    # pi reads one context file from its agent directory, the first of these
-    # that exists. A block in any other one would never reach the model.
-    names = ["AGENTS.override.md", "AGENTS.md", "AGENTS.MD", "CLAUDE.md", "CLAUDE.MD"]
-    paths = [os.path.join(agent_dir, n) for n in names]
-    target = next((p for p in paths if os.path.isfile(p)), paths[1])
-    block = re.compile(re.escape(begin) + r".*?" + re.escape(end) + r"\n?", re.S)
-    # The blank line write puts before the block goes with it, so stripping
-    # hands back the user's text exactly as it was.
-    gap = re.compile(r"\n?" + block.pattern, re.S)
-    state = load_owned()
-    owned_md = state.get("md", {})
-    for p in paths:
-        if not os.path.isfile(p) or (args[0] == "write" and p == target):
-            continue
-        t = open(p).read()
-        # write records the exact separator it added. Removing that and no
-        # more hands back the user's file byte for byte, final newline or not.
-        sep = owned_md.get("sep")
-        cut = re.compile(re.escape(sep) + block.pattern, re.S) if sep is not None else gap
-        stripped = cut.sub("", t)
-        if stripped != t:
-            if stripped.strip():
-                open(p, "w").write(stripped)
-            else:
-                os.remove(p)
-            print("  pi: delegation line removed from %s" % p)
-    if args[0] == "strip":
-        state.pop("md", None)
-        save_owned(state)
-    if args[0] == "write":
-        t = open(target).read() if os.path.isfile(target) else ""
-        mine = "%s\n%s\n%s\n" % (begin, line, end)
-        if block.search(t):
-            new = block.sub(lambda m: mine, t, count=1)
-        else:
-            sep = ("\n" if t and not t.endswith("\n") else "") + ("\n" if t else "")
-            new = t + sep + mine
-            state["md"] = {"sep": sep}
-            save_owned(state)
-        if new != t:
-            os.makedirs(agent_dir, exist_ok=True)
-            open(target, "w").write(new)
-            print("  pi: delegation line written to %s" % target)
-    raise SystemExit
-PY
-}
-
-# The four personal settings, from the config, as the JSON merge reads them.
-# An empty value releases the key rather than writing an empty one.
-pi_settings_wanted() {
-  ACSTACK_CFG="$CFG" py <<'PY'
-import json, os, sys
-import yaml
-p = os.environ["ACSTACK_CFG"]
-c = (yaml.safe_load(open(p)) or {}) if os.path.isfile(p) else {}
-s = ((c.get("pi") or {}).get("settings") or {})
-# config key -> (pi's dotted key, the default config.example.yaml ships, the
-# values pi accepts). YAML reads a bare off as false, so mermaid maps it back.
-KEYS = {"hide_thinking_block": ("hideThinkingBlock", True, (True, False)),
-        "mermaid": ("markdown.mermaid", "streaming", ("off", "final", "streaming")),
-        "install_telemetry": ("enableInstallTelemetry", False, (True, False)),
-        "theme": ("theme", "alex-mid-grey", None)}
-out = {}
-for k, (key, default, allowed) in KEYS.items():
-    v = s.get(k, default)
-    if v in ("", None):
-        out[key] = None
-        continue
-    if k == "mermaid" and v is False:
-        v = "off"
-    ok = (v in allowed and type(v) is type(allowed[0])) if allowed else isinstance(v, str)
-    if not ok:
-        # Left out entirely, so pi keeps whatever it holds now.
-        print("  pi: settings.%s cannot be %r, left alone" % (k, v), file=sys.stderr)
-        continue
-    out[key] = v
-print(json.dumps(out))
-PY
-}
-
-pi_zentui_wanted() {
-  cat <<'JSON'
-{
-  "components.editor.enabled": true,
-  "components.editor.style": "accent-rail",
-  "components.editor.styles.accent-rail.transparent": false,
-  "components.userMessages.enabled": false,
-  "components.footer.style": "starship",
-  "components.footer.modelLabel": "id",
-  "components.footer.styles.starship.segments.modelInfo": true,
-  "components.footer.styles.starship.extensionStatuses.defaultPlacement": "off",
-  "components.extensionStatuses.defaultVisibility": "hide",
-  "components.extensionStatuses.visibility.pi-lens": "hide",
-  "components.extensionStatuses.visibility.pi-lens-lsp": "hide",
-  "components.extensionStatuses.visibility.ponytail": "hide",
-  "components.footer.styles.starship.responsive": true,
-  "components.footer.styles.starship.format": "$cwd( in $session_name)( on $git_branch)( $git_status)( via $runtime)$fill$model($sep$provider)($sep$thinkingLevel)($sep$context)( $auto_compaction)($sep$tokens)( $cache_read)( $cache_write)($sep$cost)( $subscription)",
-  "components.footer.styles.starship.compactFormat": "$cwd$wrap(in $session_name)$wrap(on $git_branch) $git_status$fill$model$wrap_sep($provider)$wrap_sep($thinkingLevel)$wrap_sep$context$wrap_sep$tokens"
-}
-JSON
-}
-
-pi_zentui_release() {
-  cat <<'JSON'
-{
-  "components.editor.enabled": null,
-  "components.editor.style": null,
-  "components.editor.styles.accent-rail.transparent": null,
-  "components.userMessages.enabled": null,
-  "components.footer.style": null,
-  "components.footer.modelLabel": null,
-  "components.footer.styles.starship.segments.modelInfo": null,
-  "components.footer.styles.starship.extensionStatuses.defaultPlacement": null,
-  "components.extensionStatuses.defaultVisibility": null,
-  "components.extensionStatuses.visibility.pi-lens": null,
-  "components.extensionStatuses.visibility.pi-lens-lsp": null,
-  "components.extensionStatuses.visibility.ponytail": null,
-  "components.footer.styles.starship.responsive": null,
-  "components.footer.styles.starship.format": null,
-  "components.footer.styles.starship.compactFormat": null
-}
-JSON
-}
-
-pi_write_theme() {
-  if [ -e "$PI_THEME" ] && ! pi_state owns file "$PI_THEME"; then
-    say "pi: $PI_THEME already exists, so the Mapflow theme was left alone"
-    return 0
-  fi
-  MAPFLOW_PI_THEME="$PI_THEME" py <<'PY'
-import json, os
-
-target = os.environ["MAPFLOW_PI_THEME"]
-theme = {
-    "$schema": "https://pi.dev/schemas/theme.schema.json",
-    "name": "alex-mid-grey",
-    "vars": {
-        "surfaceMuted": "#21262D",
-        "border": "#30363D",
-        "borderSubtle": "#21262D",
-        "text": "#C9D1D9",
-        "textBright": "#E6EDF3",
-        "muted": "#8B949E",
-        "dim": "#6E7681",
-        "toolStatus": "#59616B",
-        "blue": "#58A6FF",
-        "blueSoft": "#79C0FF",
-        "inlineCode": "#D2A8FF",
-        "green": "#3FB950",
-        "red": "#F85149",
-        "yellow": "#E0A052",
-        "orange": "#FFA657",
-        "purple": "#D2A8FF",
-        "toolAccent": "#95A7FF",
-        "toolName": "#8B85D6",
-        "toolText": "#98A1AC",
-        "pink": "#FF7B72",
-        "userPromptBg": "#24272e",
-    },
-    "colors": {
-        "accent": "toolAccent",
-        "border": "border",
-        "borderAccent": "toolStatus",
-        "borderMuted": "borderSubtle",
-        "success": "green",
-        "error": "red",
-        "warning": "yellow",
-        "muted": "muted",
-        "dim": "dim",
-        "text": "text",
-        "thinkingText": "toolText",
-        "selectedBg": "surfaceMuted",
-        "searchMatchBg": "#3B2E10",
-        "searchMatchText": "textBright",
-        "userMessageBg": "userPromptBg",
-        "userMessageText": "textBright",
-        "customMessageBg": "",
-        "customMessageText": "text",
-        "customMessageLabel": "muted",
-        "toolPendingBg": "",
-        "toolSuccessBg": "",
-        "toolErrorBg": "#211414",
-        "toolTitle": "toolName",
-        "toolOutput": "toolText",
-        "scrollbarTrack": "borderSubtle",
-        "scrollbarThumb": "border",
-        "mdHeading": "textBright",
-        "mdLink": "blue",
-        "mdLinkUrl": "dim",
-        "mdCode": "inlineCode",
-        "mdCodeBlock": "text",
-        "mdCodeBlockBorder": "#0D1117",
-        "mdQuote": "toolText",
-        "mdQuoteBorder": "border",
-        "mdHr": "borderSubtle",
-        "mdListBullet": "muted",
-        "toolDiffAdded": "#45B85A",
-        "toolDiffRemoved": "#E45D57",
-        "toolDiffContext": "dim",
-        "syntaxComment": "dim",
-        "syntaxKeyword": "pink",
-        "syntaxFunction": "purple",
-        "syntaxVariable": "text",
-        "syntaxString": "blueSoft",
-        "syntaxNumber": "orange",
-        "syntaxType": "orange",
-        "syntaxOperator": "muted",
-        "syntaxPunctuation": "muted",
-        "thinkingOff": "borderSubtle",
-        "thinkingMinimal": "border",
-        "thinkingLow": "dim",
-        "thinkingMedium": "muted",
-        "thinkingHigh": "blue",
-        "thinkingXhigh": "blueSoft",
-        "thinkingMax": "#9FCFF8",
-        "bashMode": "green",
-    },
-    "export": {"pageBg": "#0D1117", "cardBg": "#161B22", "infoBg": "#1C2128"},
-}
-os.makedirs(os.path.dirname(target), exist_ok=True)
-json.dump(theme, open(target, "w"), indent=2, ensure_ascii=False)
-open(target, "a").write("\n")
-PY
-  pi_state own file "$PI_THEME"
-  say "pi: Mapflow theme written to $PI_THEME"
-}
-
-# npm installs pi into its global bin, which a fresh shell may not have on
-# PATH. Asking npm costs a process, so only when pi is not already found.
-find_pi() {
-  have pi || ! have npm || PATH="$PATH:$(npm prefix -g 2>/dev/null)/bin"
-}
-
-
-# Pi's bundled TUI does not always receive Windows Terminal paste as plain
-# text. Through Herdr and ConPTY it can arrive as Win32 input records such as
-# ESC[13;28;13;1;0;1_. Patch the installed bundle after install or update.
-patch_pi_win32_paste() {
-  have pi || return 0
-  local pi_bin pi_real root chunks
-  pi_bin=$(command -v pi) || return 0
-  pi_real=$(readlink -f "$pi_bin" 2>/dev/null || printf '%s' "$pi_bin")
-  case "$pi_real" in
-    */dist/bundle/cli.js) root=${pi_real%/dist/bundle/cli.js} ;;
-    *)
-      root="${pi_real%/bin/pi}/lib/node_modules/@earendil-works/pi-coding-agent"
-      if [ ! -d "$root/dist/bundle/chunks" ]; then
-        have npm || { say "pi: npm not on PATH, so Win32 paste patch was skipped"; return 0; }
-        root="$(npm root -g 2>/dev/null)/@earendil-works/pi-coding-agent"
-      fi
-      ;;
-  esac
-  chunks="$root/dist/bundle/chunks"
-  [ -d "$chunks" ] || { say "pi: bundle chunks not found, so Win32 paste patch was skipped"; return 0; }
-  SPECHUB_PI_CHUNKS="$chunks" py <<'PI_PATCH_PY'
-import os, pathlib
-chunks = pathlib.Path(os.environ["SPECHUB_PI_CHUNKS"])
-target = None
-for p in chunks.glob("*.js"):
-    try:
-        s = p.read_text()
-    except (OSError, UnicodeDecodeError):
-        continue
-    if "function decodePrintableKey(data)" in s and "handlePaste(pastedText)" in s:
-        target = p
-        break
-if target is None:
-    print("  pi: TUI bundle not found, so Win32 paste patch was skipped")
-    raise SystemExit
-s = target.read_text()
-changed = False
-repls = [
-('function isKeyRelease(data){return data.includes("\\x1B[200~")?!1:!!(data.includes(":3u")||data.includes(":3~")||data.includes(":3A")||data.includes(":3B")||data.includes(":3C")||data.includes(":3D")||data.includes(":3H")||data.includes(":3F"))}',
- 'function isKeyRelease(data){let win32=parseWin32InputRecord(data);if(win32)return!win32.keyDown;return data.includes("\\x1B[200~")?!1:!!(data.includes(":3u")||data.includes(":3~")||data.includes(":3A")||data.includes(":3B")||data.includes(":3C")||data.includes(":3D")||data.includes(":3H")||data.includes(":3F"))}'),
-('function parseModifyOtherKeysSequence(data){let match=data.match(/^\\x1b\\[27;(\\d+);(\\d+)~$/);if(!match)return null;let modValue=parseInt(match[1],10);return{codepoint:parseInt(match[2],10),modifier:modValue-1}}',
- 'function parseModifyOtherKeysSequence(data){let match=data.match(/^\\x1b\\[27;(\\d+);(\\d+)~$/);if(!match)return null;let modValue=parseInt(match[1],10);return{codepoint:parseInt(match[2],10),modifier:modValue-1}}function parseWin32InputRecord(data){let match=data.match(/^\\x1b\\[(\\d+);(\\d+);(-?\\d+);([01]);(\\d+);(\\d+)_$/);if(!match)return null;let virtualKey=Number.parseInt(match[1],10),scanCode=Number.parseInt(match[2],10),codepoint=Number.parseInt(match[3],10),keyDown=match[4]==="1",controlState=Number.parseInt(match[5],10),modifier=0;if((controlState&16)!==0)modifier|=MODIFIERS.shift;if((controlState&(1|2))!==0)modifier|=MODIFIERS.alt;if((controlState&(4|8))!==0)modifier|=MODIFIERS.ctrl;if((controlState&32)!==0)modifier|=128;if((controlState&128)!==0)modifier|=64;return{virtualKey,scanCode,codepoint,keyDown,modifier}}'),
-('function parseKey(data){let kitty=parseKittySequence(data);',
- 'function parseKey(data){let win32=parseWin32InputRecord(data);if(win32){_lastEventType=win32.keyDown?"press":"release";if(!win32.keyDown)return;let codepoint=win32.codepoint;if(win32.virtualKey===46)codepoint=FUNCTIONAL_CODEPOINTS.delete;else if(win32.virtualKey===45)codepoint=FUNCTIONAL_CODEPOINTS.insert;else if(win32.virtualKey===33)codepoint=FUNCTIONAL_CODEPOINTS.pageUp;else if(win32.virtualKey===34)codepoint=FUNCTIONAL_CODEPOINTS.pageDown;else if(win32.virtualKey===35)codepoint=FUNCTIONAL_CODEPOINTS.end;else if(win32.virtualKey===36)codepoint=FUNCTIONAL_CODEPOINTS.home;else if(win32.virtualKey===37)codepoint=ARROW_CODEPOINTS.left;else if(win32.virtualKey===38)codepoint=ARROW_CODEPOINTS.up;else if(win32.virtualKey===39)codepoint=ARROW_CODEPOINTS.right;else if(win32.virtualKey===40)codepoint=ARROW_CODEPOINTS.down;else if(win32.virtualKey===8)codepoint=CODEPOINTS.backspace;else if(win32.virtualKey===9)codepoint=CODEPOINTS.tab;else if(win32.virtualKey===13)codepoint=CODEPOINTS.enter;else if(win32.virtualKey===27)codepoint=CODEPOINTS.escape;return formatParsedKey(codepoint,win32.modifier)}let kitty=parseKittySequence(data);'),
-('function decodeModifyOtherKeysPrintable(data){let parsed=parseModifyOtherKeysSequence(data);if(!(!parsed||(parsed.modifier&~LOCK_MASK&~MODIFIERS.shift)!==0)&&!(!Number.isFinite(parsed.codepoint)||parsed.codepoint<32))try{return String.fromCodePoint(parsed.codepoint)}catch{return}}function decodePrintableKey(data){return decodeKittyPrintable(data)??decodeModifyOtherKeysPrintable(data)}',
- 'function decodeModifyOtherKeysPrintable(data){let parsed=parseModifyOtherKeysSequence(data);if(!(!parsed||(parsed.modifier&~LOCK_MASK&~MODIFIERS.shift)!==0)&&!(!Number.isFinite(parsed.codepoint)||parsed.codepoint<32))try{return String.fromCodePoint(parsed.codepoint)}catch{return}}function decodeWin32Printable(data){let parsed=parseWin32InputRecord(data);if(!parsed||!parsed.keyDown)return;let modifier=parsed.modifier&~LOCK_MASK;if((modifier&(MODIFIERS.ctrl|MODIFIERS.alt|MODIFIERS.super))!==0)return;if(!Number.isFinite(parsed.codepoint)||parsed.codepoint<32)return;try{return String.fromCodePoint(parsed.codepoint)}catch{return}}function decodePrintableKey(data){return decodeKittyPrintable(data)??decodeModifyOtherKeysPrintable(data)??decodeWin32Printable(data)}'),
-('let decodedText=pastedText.replace(/\\x1b\\[(\\d+);5u/g,(match,code)=>{let cp=Number(code);return cp>=97&&cp<=122?String.fromCharCode(cp-96):cp>=65&&cp<=90?String.fromCharCode(cp-64):match}),filteredText=this.normalizeText(decodedText).split("").filter(char=>char===`\n`||char.charCodeAt(0)>=32).join("");',
- 'let decodedText=pastedText.replace(/\\x1b\\[(\\d+);(\\d+);(-?\\d+);([01]);(\\d+);(\\d+)_/g,(match,vk,sc,uc,kd)=>{if(kd!=="1")return "";let cp=Number(uc),key=Number(vk);if(key===13||cp===13)return `\n`;if(cp>=32)try{return String.fromCodePoint(cp)}catch{return ""}return ""}).replace(/\\x1b\\[(\\d+);5u/g,(match,code)=>{let cp=Number(code);return cp>=97&&cp<=122?String.fromCharCode(cp-96):cp>=65&&cp<=90?String.fromCharCode(cp-64):match}),filteredText=this.normalizeText(decodedText).split("").filter(char=>char===`\n`||char.charCodeAt(0)>=32).join("");')]
-missing = []
-for old, new in repls:
-    if new in s:
-        continue
-    if old not in s:
-        missing.append(old[:80])
-        continue
-    s = s.replace(old, new, 1)
-    changed = True
-if missing:
-    print("  pi: Win32 paste patch did not match this Pi bundle")
-    raise SystemExit
-if changed:
-    try:
-        target.write_text(s)
-    except OSError as exc:
-        print(f"  pi: could not patch {target} ({exc})")
-        raise SystemExit
-    print("  pi: Win32 paste patch applied")
-else:
-    print("  pi: Win32 paste patch already applied")
-PI_PATCH_PY
-}
-
-# The ACStack version running this script, which is the one pi should pin.
-acstack_version() {
-  json_field "$(dirname "$0")/../../.claude-plugin/plugin.json" version
-}
-
-# Installs one pi package, or moves its pin. Ownership is taken only when the
-# package was absent: one the user installed stays theirs, pin and all.
-pi_add() {  # pi_add <source> <identity>
-  local cur
-  cur=$(pi_state pkg "$2")
-  if [ -n "$cur" ]; then
-    # Unpinned, presence is enough: a pin the user chose stays.
-    case "$1" in "$2"@*) ;; *) say "pi: $2 already installed"; return 0 ;; esac
-    [ "$cur" = "$1" ] && { say "pi: $1 already installed"; return 0; }
-  fi
-  if ! pi install "$1" >/dev/null 2>&1; then
-    say "pi: install of $1 failed, run: pi install $1"
-    return 1
-  fi
-  if [ -n "$cur" ]; then
-    pi_state pin "$2" "$cur" "$1"
-    say "pi: $cur moved to $1"
-  else
-    pi_state own pkg "$2"
-    say "pi: $1 installed"
-  fi
-}
-
-# Puts back a pin apply moved, while the pin is still the one apply set.
-pi_unpin() {  # pi_unpin <identity>
-  local rec prior ours cur
-  rec=$(pi_state pin-get "$1") || return 0
-  prior="${rec%%$'\t'*}" ours="${rec#*$'\t'}"
-  cur=$(pi_state pkg "$1")
-  if [ "$cur" = "$ours" ]; then
-    have pi || { say "pi: not on PATH, so $cur stays pinned"; return 0; }
-    pi install "$prior" >/dev/null 2>&1 \
-      || { say "pi: could not put back $prior, run: pi install $prior"; return 0; }
-    say "pi: $cur put back to $prior"
-  fi
-  pi_state pin-forget "$1"
-}
-
-# Removes a package this setup installed. One the user installed is left.
-pi_drop() {  # pi_drop <identity>
-  local cur
-  pi_state owns pkg "$1" || return 0
-  cur=$(pi_state pkg "$1")
-  if [ -n "$cur" ]; then
-    have pi || { say "pi: not on PATH, so $cur stays installed"; return 0; }
-    pi remove "$cur" >/dev/null 2>&1 || { say "pi: remove of $cur failed, run: pi remove $cur"; return 0; }
-    say "pi: $cur removed"
-  fi
-  pi_state disown pkg "$1"
-}
-
-# A package pi holds at a fixed version, such as npm:pi-subagents@1.0.0.
-pi_npm_pin() {  # pi_npm_pin <name>
-  local src
-  version_table | awk -F'\t' -v n="$1" '$1==n && $2=="pi" && $3=="npm"{found=1} END{exit !found}' \
-    || return 1
-  src=$(pi_state pkg "npm:$1") || return 1
-  [ "$src" != "npm:$1" ]
-}
-
-pi_suggest_todo_discipline() {
-  local needle="When using a todo list, keep it current as work completes."
-  grep -qsF "$needle" "$PI_DIR"/AGENTS.override.md "$PI_DIR"/AGENTS.md "$PI_DIR"/AGENTS.MD \
-    "$PI_DIR"/CLAUDE.md "$PI_DIR"/CLAUDE.MD && return 0
-  say "pi: todo tool installed. For stricter todo discipline, ask the agent"
-  say "pi: running this setup to hand-edit $PI_DIR/AGENTS.md and add:"
-  say "pi: $needle Before reporting a task as done, check the todo list"
-  say "pi: and mark every completed step completed. Do not leave stale"
-  say "pi: in-progress or pending todos after a commit, PR, merge or workflow gate."
-}
-
-# The pin apply would move to, or nothing when the installed one is current
-# or newer. A newer pin is one the user chose, so it is never moved back.
-pi_acstack_behind() {
-  local cur ver pin
-  ver=$(acstack_version); [ -n "$ver" ] || return 0
-  cur=$(pi_state pkg "$PI_ACSTACK") || return 0
-  case "$cur" in "$PI_ACSTACK"@*) pin="${cur##*@}" ;; *) return 0 ;; esac
-  [ "$pin" = "$ver" ] && return 0
-  [ "$(printf '%s\n%s\n' "$pin" "$ver" | sort -V | tail -1)" = "$ver" ] || return 0
-  printf '%s\t%s' "$pin" "$ver"
-}
-
-bili_bin() {
-  if [ -x "$PI_DIR/npm/node_modules/.bin/bili" ]; then
-    printf '%s' "$PI_DIR/npm/node_modules/.bin/bili"
-  elif have bili; then
-    command -v bili
-  else
-    return 1
-  fi
-}
-
-bili_status() {  # bili_status <bin> <client> -> installed|absent|unknown
-  local line
-  line=$("$1" plugin list 2>/dev/null | awk -v c="$2" '$1==c{print; exit}') || true
-  [ -n "$line" ] || { echo unknown; return 0; }
-  case "$line" in *"not installed"*) echo absent ;; *) echo installed ;; esac
-}
-
-bili_client() {  # bili_client install|remove <client>
-  local op="$1" client="$2" bin marker status
-  marker="bili:$client"
-  if [ "$op" = "install" ]; then
-    [ "$client" = "pi" ] || have "$client" || return 0
-    pi_state owns file "$marker" && return 0
-    if bin=$(bili_bin); then
-      status=$(bili_status "$bin" "$client")
-      if [ "$status" = "installed" ]; then
-        say "pi: billion-context already enabled for $client"
-        return 0
-      fi
-      if "$bin" plugin install "$client" >/dev/null 2>&1; then
-        pi_state own file "$marker"
-        say "pi: billion-context enabled for $client"
-      else
-        say "pi: billion-context $client setup failed, run: bili plugin install $client"
-      fi
-    else
-      say "pi: bili command not found, so billion-context $client setup was skipped"
-    fi
-  elif pi_state owns file "$marker"; then
-    if bin=$(bili_bin); then
-      if "$bin" plugin remove "$client" >/dev/null 2>&1; then
-        pi_state disown file "$marker"
-        say "pi: billion-context disabled for $client"
-      else
-        say "pi: billion-context $client removal failed, run: bili plugin remove $client"
-      fi
-    else
-      say "pi: bili command not found, so billion-context $client setup was left installed"
-    fi
-  fi
-}
-
-apply_pi() {
-  find_pi
-  if ! have pi; then
-    have npm || {
-      say "npm not installed, skipping pi"
-      say "install Node.js, then run apply again"
-      return 0
-    }
-    npm install -g @earendil-works/pi-coding-agent >/dev/null 2>&1 \
-      || { say "pi install failed, run: npm install -g @earendil-works/pi-coding-agent"; return 0; }
-    have pi || { say "pi installed, but npm's global bin is not on PATH"; return 0; }
-    say "pi installed"
-  fi
-  # pi rewrites settings.json on every install. Handing it a file it cannot
-  # parse risks the user's settings, so concede the whole component instead.
-  if ! pi_state parses "$PI_SETTINGS"; then
-    say "pi: $PI_SETTINGS does not parse, so nothing was installed into pi"
-    say "fix that file, then run apply again"
-    return 0
-  fi
-
-  patch_pi_win32_paste
-
-  # ACStack cannot launch a subagent on pi without pi-subagents.
-  pi_add npm:pi-subagents npm:pi-subagents
-  if [ "$(cfg_get pi.todo true)" = "true" ]; then
-    pi_add npm:@juicesharp/rpiv-todo npm:@juicesharp/rpiv-todo
-    pi_suggest_todo_discipline
-  else
-    pi_drop npm:@juicesharp/rpiv-todo
-  fi
-  if [ "$(cfg_get pi.plugin_manager true)" = "true" ]; then
-    pi_add npm:pi-plugin-manager npm:pi-plugin-manager
-  else
-    pi_drop npm:pi-plugin-manager
-  fi
-  # bili's proxy dies with the session that started it, cutting off every
-  # other Claude Code or Codex session. Keep it in pi; undo older installs.
-  bili_client remove codex
-  bili_client remove claude
-  if [ "$(cfg_get pi.billion_context true)" = "true" ]; then
-    pi_state merge "$BILLION_CONFIG" billion '{"pi.subagents": false}'
-    if [ "$(json_field "$BILLION_CONFIG" pi.subagents)" = "False" ]; then
-      pi_add "$PI_BILLION" "$PI_BILLION"
-      bili_client install pi
-    else
-      say "pi: billion-context acp_delegate could not be disabled, so billion-context setup was skipped"
-    fi
-  else
-    bili_client remove pi
-    pi_state merge "$BILLION_CONFIG" billion '{"pi.subagents": null}'
-    pi_drop "$PI_BILLION"
-  fi
-  if [ "$(cfg_get pi.question_tool true)" = "true" ]; then
-    pi_add npm:@juicesharp/rpiv-ask-user-question npm:@juicesharp/rpiv-ask-user-question
-  else
-    pi_drop npm:@juicesharp/rpiv-ask-user-question
-  fi
-  if [ "$(cfg_get pi.web_access true)" = "true" ]; then
-    pi_add npm:pi-web-access npm:pi-web-access
-  else
-    pi_drop npm:pi-web-access
-  fi
-  if [ "$(cfg_get pi.lens false)" = "true" ]; then
-    pi_add npm:pi-lens npm:pi-lens
-  else
-    pi_drop npm:pi-lens
-  fi
-  if [ "$(cfg_get pi.slash_anywhere true)" = "true" ]; then
-    pi_add "$PI_SLASH_ANYWHERE" "$PI_SLASH_ANYWHERE"
-  else
-    pi_drop "$PI_SLASH_ANYWHERE"
-  fi
-  local ver cur; ver=$(acstack_version)
-  if [ -n "$ver" ]; then
-    if cur=$(pi_state pkg "$PI_ACSTACK") && [ -z "$(pi_acstack_behind)" ]; then
-      say "pi: $cur already installed"
-    else
-      pi_add "$PI_ACSTACK@$ver" "$PI_ACSTACK"
-    fi
-  else
-    say "pi: no plugin version beside this script, so ACStack was not installed into pi"
-  fi
-  if [ "$(cfg_get pi.compact_tools true)" = "true" ]; then
-    pi_add npm:pi-compact-tools npm:pi-compact-tools
-  else
-    pi_drop npm:pi-compact-tools
-  fi
-  [ "$(cfg_get pi.settings.theme alex-mid-grey)" = "alex-mid-grey" ] && pi_write_theme
-  if [ "$(cfg_get pi.zentui true)" = "true" ]; then
-    pi_add "$PI_ZENTUI" "$PI_ZENTUI"
-    pi_state merge "$PI_ZENTUI_CFG" zentui "$(pi_zentui_wanted)"
-  else
-    pi_state merge "$PI_ZENTUI_CFG" zentui "$(pi_zentui_release)"
-    pi_drop "$PI_ZENTUI"
-  fi
-  if [ "$(cfg_get pi.hide_lens_lsp_status true)" = "true" ]; then
-    pi_state merge "$PI_LENS_CFG" pi_lens '{"ui.hideLspStatus": true, "widget.visible": false}'
-  else
-    pi_state merge "$PI_LENS_CFG" pi_lens '{"ui.hideLspStatus": null, "widget.visible": null}'
-  fi
-  apply_lens_extra_tools
-
-  # agentic-retro writes its own extension file. This setup only asks it to,
-  # and owns the file only when it was not there before.
-  if [ "$(cfg_get pi.agentic_retro true)" = "true" ]; then
-    if have agentic-retro; then
-      local fresh=0; [ -e "$PI_RETRO_EXT" ] || fresh=1
-      if agentic-retro install-pi >/dev/null 2>&1; then
-        [ "$fresh" = "1" ] && pi_state own file "$PI_RETRO_EXT"
-        say "pi: agentic-retro extension written"
-      else
-        say "pi: agentic-retro install-pi failed, run it yourself"
-      fi
-    else
-      say "pi: agentic-retro not on PATH, so its pi extension was skipped"
-      say "install the agentic-retro plugin first, then run apply again"
-    fi
-  elif pi_state owns file "$PI_RETRO_EXT"; then
-    rm -f "$PI_RETRO_EXT"
-    pi_state disown file "$PI_RETRO_EXT"
-    say "pi: agentic-retro extension removed"
-  fi
-
-  pi_state merge "$PI_SETTINGS" settings "$(pi_settings_wanted)"
-  pi_state merge "$PI_KEYBINDINGS" keybindings '{"app.message.dequeue": "ctrl+enter"}'
-  pi_state merge "$PI_SUBAGENT_CFG" subagent '{"toolActivation": "eager"}'
-  pi_state md write
-  patch_pi_win32_paste
-
-  # Logging in is interactive and stores a credential, so it stays the user's.
-  [ -f "$PI_DIR/auth.json" ] || say "pi: not logged in yet. Run pi, then /login"
-  return 0
-}
-
-# disable pi and uninstall both come here. It undoes what apply_pi recorded
-# and leaves the pi binary, its logins and its sessions alone.
-remove_pi() {
-  find_pi
-  if pi_state parses "$PI_SETTINGS"; then
-    pi_unpin "$PI_ACSTACK"
-    pi_drop "$PI_ACSTACK"
-    bili_client remove codex
-    bili_client remove claude
-    bili_client remove pi
-    pi_drop "$PI_BILLION"
-    pi_drop npm:pi-plugin-manager
-    pi_drop npm:@juicesharp/rpiv-todo
-    pi_drop npm:pi-compact-tools
-    pi_drop "$PI_ZENTUI"
-    pi_drop npm:@juicesharp/rpiv-ask-user-question
-    pi_drop npm:pi-web-access
-    pi_drop npm:pi-lens
-    pi_drop "$PI_SLASH_ANYWHERE"
-    pi_drop npm:pi-subagents
-  else
-    say "pi: $PI_SETTINGS does not parse, so its packages were left installed"
-  fi
-  pi_state merge "$BILLION_CONFIG" billion '{"pi.subagents": null}'
-  if pi_state owns file "$PI_RETRO_EXT"; then
-    rm -f "$PI_RETRO_EXT"
-    pi_state disown file "$PI_RETRO_EXT"
-    say "pi: agentic-retro extension removed"
-  fi
-  pi_state merge "$PI_SETTINGS" settings \
-    '{"hideThinkingBlock": null, "markdown.mermaid": null, "enableInstallTelemetry": null, "theme": null}'
-  pi_state merge "$PI_ZENTUI_CFG" zentui "$(pi_zentui_release)"
-  pi_state merge "$PI_LENS_CFG" pi_lens '{"ui.hideLspStatus": null, "widget.visible": null}'
-  if pi_state owns file "$PI_THEME"; then
-    rm -f "$PI_THEME"
-    pi_state disown file "$PI_THEME"
-    say "pi: Mapflow theme removed"
-  fi
-  pi_state merge "$PI_KEYBINDINGS" keybindings '{"app.message.dequeue": null}'
-  pi_state merge "$PI_SUBAGENT_CFG" subagent '{"toolActivation": null}'
-  pi_state md strip
-  return 0
-}
-
-# Every tool with a version worth comparing.
-#   name | component key | source | reference | release asset match
-# mermaid-ascii is deliberately absent: it has no version flag at all, so
-# nothing here can read what is installed. `upgrade mermaid-ascii` still works,
-# because upgrade_one carries an arm of its own for it. A tool that is in
-# neither place is one upgrade cannot reach, whatever the docs promise.
-version_table() {
-  cat <<'T'
-delta	delta	github	dandavison/delta	x86_64-unknown-linux-gnu
-diffnav	diffnav	github	dlvhdr/diffnav	Linux_x86_64
-fzf	diffnav	github	junegunn/fzf	linux_amd64
-lazygit	lazygit	github	jesseduffield/lazygit	linux_x86_64
-tuicr	tuicr	github	agavra/tuicr	x86_64-unknown-linux-gnu
-yazi	yazi	github	sxyazi/yazi	x86_64-unknown-linux-gnu
-glow	markdown	github	charmbracelet/glow	Linux_x86_64
-herdr	herdr	herdr	-	-
-gh-dash	gh_dash	ghext	dlvhdr/gh-dash	-
-harlequin	harlequin	pypi	harlequin	-
-pi	pi	npm	@earendil-works/pi-coding-agent	-
-pi-subagents	pi	npm	pi-subagents	-
-billion-context	pi	npm	billion-context	-
-@juicesharp/rpiv-todo	pi	npm	@juicesharp/rpiv-todo	-
-pi-plugin-manager	pi	npm	pi-plugin-manager	-
-@juicesharp/rpiv-ask-user-question	pi	npm	@juicesharp/rpiv-ask-user-question	-
-pi-web-access	pi	npm	pi-web-access	-
-pi-lens	pi	npm	pi-lens	-
-pi-slash-anywhere	pi	npm	pi-slash-anywhere	-
-pi-compact-tools	pi	npm	pi-compact-tools	-
-pi-zentui	pi	npm	pi-zentui	-
-actionlint	pi	github	rhysd/actionlint	linux_amd64
-hadolint	pi	github	hadolint/hadolint	Linux-x86_64
-terraform-ls	pi	github	hashicorp/terraform-ls	linux_amd64
-tflint	pi	github	terraform-linters/tflint	linux_amd64
-terragrunt	pi	github	gruntwork-io/terragrunt	linux_amd64
-T
-}
-
-installed_version() {  # installed_version <name> -> a bare version, or nothing
-  local v=""
-  case "$1" in
-    # delta 0.19.2
-    delta)     v=$(delta --version 2>/dev/null | awk '{print $2}') ;;
-    # an ASCII banner, then: version v0.12.0
-    diffnav)   v=$(diffnav --version 2>/dev/null | sed -n 's/^version //p') ;;
-    # 0.74.3 (15f64c49)
-    fzf)       v=$(fzf --version 2>/dev/null | awk '{print $1}') ;;
-    # commit=..., version=0.64.1, os=linux, arch=amd64, git version=2.43.0
-    # Split on the commas first: the line ends in git's own version, and one
-    # regex over the whole line reads that one instead of lazygit's.
-    lazygit)   v=$(lazygit --version 2>/dev/null | tr ',' '\n' | sed -n 's/^ *version=//p') ;;
-    # glow version 3.0.0 (add5e7a)
-    glow)      v=$(glow --version 2>/dev/null | awk '{print $3}') ;;
-    # tuicr 0.23.0
-    tuicr)     v=$(tuicr --version 2>/dev/null | awk '{print $2}') ;;
-    # a block of lines, one of them: "    Version: 26.8.15 (1f3588d 2026-08-15)"
-    yazi)      v=$(yazi --version 2>/dev/null | sed -n 's/^ *Version: \([^ ]*\).*/\1/p') ;;
-    # herdr 0.8.2
-    herdr)     v=$(herdr --version 2>/dev/null | awk '{print $2}') ;;
-    # gh dash<TAB>dlvhdr/gh-dash<TAB>v4.25.2
-    gh-dash)   v=$(gh extension list 2>/dev/null | awk -F'\t' '$2=="dlvhdr/gh-dash"{print $3}') ;;
-    # harlequin v2.13.0, then an indented line per command it installed
-    harlequin) v=$(uv tool list 2>/dev/null | awk '$1=="harlequin"{print $2}') ;;
-    # 1.1.0
-    pi)        find_pi; v=$(pi --version 2>/dev/null | awk '{print $NF}') ;;
-    # actionlint version 1.7.7
-    actionlint) v=$(actionlint -version 2>/dev/null | awk '{print $2}') ;;
-    # Haskell Dockerfile Linter 2.12.0
-    hadolint)  v=$(hadolint --version 2>/dev/null | awk '{print $NF}') ;;
-    # terraform-ls version 0.36.5
-    terraform-ls) v=$(terraform-ls version 2>/dev/null | awk '{print $2}') ;;
-    # TFLint version 0.59.1
-    tflint)    v=$(tflint --version 2>/dev/null | awk 'NR==1{print $3}') ;;
-    # terragrunt version v0.91.2
-    terragrunt) v=$(terragrunt --version 2>/dev/null | awk '{print $NF}') ;;
-    # pi installs npm packages under its own directory, not npm's global one.
-    pi-subagents|pi-compact-tools|pi-zentui|pi-web-access|pi-lens|pi-slash-anywhere|@juicesharp/rpiv-ask-user-question|billion-context|@juicesharp/rpiv-todo|pi-plugin-manager)
-               v=$(json_field "$PI_DIR/npm/node_modules/$1/package.json" version) ;;
-  esac
-  printf '%s' "${v#v}"
-}
-
-# One JSON field, by dotted path, read from a file. install_binary hands its
-# release document to python through the environment; this one cannot, because
-# herdr's manifest carries a whole changelog and a document that size overflows
-# the environment an exec is allowed. A file has no such ceiling.
-json_field() {  # json_field <file> <dotted.path>
-  py "$1" "$2" <<'PY'
-import json, sys
-try:
-    d = json.load(open(sys.argv[1]))
-except (ValueError, OSError):
-    raise SystemExit
-for k in sys.argv[2].split("."):
-    d = d.get(k) if isinstance(d, dict) else None
-    if d is None: raise SystemExit
-print(d)
-PY
-}
-
-latest_version() {  # latest_version <source> <reference> -> a version, or nothing
-  [ "${ACSTACK_TW_OFFLINE:-0}" = "1" ] && return 0
-  local url field tmp v="" tok="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
-  local -a auth=()
-  case "$1" in
-    github|ghext)
-      url="https://api.github.com/repos/$2/releases/latest"; field=tag_name
-      # An unauthenticated GitHub call gets 60 an hour, shared with everything
-      # else on the machine. Ten tools in one run is a sixth of that. A token
-      # raises it to 5000 and costs nothing to pass. It goes to GitHub and
-      # nowhere else: the two hosts below never see it.
-      [ -n "$tok" ] && auth=(-H "Authorization: Bearer $tok") ;;
-    # herdr publishes its own manifest, and `herdr update` installs from it.
-    herdr) url="https://herdr.dev/latest.json"; field=version ;;
-    pypi)  url="https://pypi.org/pypi/$2/json"; field=info.version ;;
-    # A scoped name keeps its @ and escapes its slash.
-    npm)   url="https://registry.npmjs.org/${2/\//%2F}/latest"; field=version ;;
-    *) return 0 ;;
-  esac
-  tmp=$(mktemp)
-  curl -sSf "${auth[@]}" --max-time 10 "$url" -o "$tmp" 2>/dev/null \
-    && v=$(json_field "$tmp" "$field")
-  rm -f "$tmp"
-  printf '%s' "${v#v}"
-}
-
-outdated_report() {  # tab-separated rows on stdout, one per finding
-  local name key src ref inst latest
-  # Components that arrived since the last apply. See write_stamp for why this
-  # reads the stamp rather than the user's own config: a config that overrides
-  # four keys and defaults the rest is normal, and diffing against it would
-  # report every defaulted component as new.
-  if [ ! -f "$STAMP" ]; then
-    # No stamp and no managed block is a machine apply has never touched.
-    # Comparing versions there would report a workspace as current when none
-    # of it is installed, so say the one true thing and stop.
-    if ! grep -q "$BEGIN" "$HERDR_CFG" 2>/dev/null; then
-      printf 'missing\tworkspace\tnever applied on this machine\n'
-      return 0
-    fi
-    printf 'unknown\tcomponents\tno stamp yet, run apply once\n'
-  elif [ -f "$EXAMPLE" ]; then
-    # The row stays until apply installs the component and writes a new stamp.
-    # Only the detail moves: once upgrade has appended the block, "not in your
-    # config" is false, and a report that says it is stops being worth reading.
-    ACSTACK_STAMP="$STAMP" py "$EXAMPLE" "$CFG" <<'PY'
-import os, re, sys
-import yaml
-had = {l.strip() for l in open(os.environ["ACSTACK_STAMP"])
-       if l.strip() and not l.startswith("#")}
-mine = open(sys.argv[2]).read() if os.path.isfile(sys.argv[2]) else ""
-for k in (yaml.safe_load(open(sys.argv[1])) or {}):
-    if k in had:
-        continue
-    if re.search(r"(?m)^%s:" % re.escape(k), mine):
-        print("new\t%s\tnew component, run apply to install it" % k)
-    else:
-        print("new\t%s\tnew component, not in your config" % k)
-PY
-  fi
-
-  while IFS=$'\t' read -r name key src ref _; do
-    [ "$(cfg_get "$key.enabled" "$(enabled_default "$key")")" = "true" ] || continue
-    # A fork build's version comes from a local checkout, so a release tag says
-    # nothing about it.
-    [ "$name" = "tuicr" ] && [ "$(cfg_get tuicr.build_from_fork false)" = "true" ] && continue
-    # pi update never moves a pinned npm source, so a newer release is nothing
-    # upgrade could fetch. Say so once instead of reporting it stale forever.
-    if pi_npm_pin "$name"; then
-      printf 'unknown\t%s\tpinned to %s in pi, which pi update never moves\n' "$name" "$(pi_state pkg "npm:$name")"
-      continue
-    fi
-    inst=$(installed_version "$name")
-    [ -n "$inst" ] || continue          # not installed is apply's business, not this one
-    latest=$(latest_version "$src" "$ref")
-    if [ -z "$latest" ]; then
-      [ "${ACSTACK_TW_OFFLINE:-0}" = "1" ] \
-        || printf 'unknown\t%s\tcould not reach %s\n' "$name" "$src"
-    elif [ "$inst" != "$latest" ]; then
-      printf 'stale\t%s\t%s -> %s\n' "$name" "$inst" "$latest"
-    fi
-  done < <(version_table)
-
-  # The ACStack package on pi is pinned to a release, so it falls behind the
-  # moment this plugin updates. Both versions are local, so this needs no
-  # network and reports even offline.
-  if [ "$(cfg_get pi.enabled false)" = "true" ]; then
-    local behind; behind=$(pi_acstack_behind)
-    [ -n "$behind" ] && printf 'stale\tpi-acstack\t%s -> %s\n' "${behind%%$'\t'*}" "${behind#*$'\t'}"
-  fi
-}
-
-# Reinstalls over what is there, from the coordinates the table already holds.
-# Split out so the tuicr arm can guard the fork build and still reach it,
-# rather than carrying a second copy of the repository and the asset match.
-upgrade_from_table() {  # upgrade_from_table <name>
-  local repo match
-  read -r repo match < <(version_table | awk -F'\t' -v n="$1" '$1==n{print $4, $5}')
-  [ -n "${repo:-}" ] && [ "$repo" != "-" ] \
-    || { say "$1 is not a tool this script installs"; return 1; }
-  INSTALL_FORCE=1 install_binary "$1" "$repo" "$match"
-  # yazi's archive carries ya beside it, and the two must not drift.
-  if [ "$1" = "yazi" ]; then
-    INSTALL_FORCE=1 install_binary ya sxyazi/yazi "$match"
-  fi
-}
-
-upgrade_one() {  # upgrade_one <name>
-  if [ "$1" = "pi-acstack" ] \
-     || version_table | awk -F'\t' -v n="$1" '$1==n && $2=="pi" && $3=="npm"{found=1} END{exit !found}'; then
-    find_pi
-  fi
-  case "$1" in
-    herdr)     herdr update >/dev/null 2>&1 \
-                 && say "herdr updated" || say "herdr update failed" ;;
-    gh-dash)   gh extension upgrade dlvhdr/gh-dash >/dev/null 2>&1 \
-                 && say "gh-dash upgraded" || say "gh-dash upgrade failed" ;;
-    harlequin) uv tool upgrade harlequin >/dev/null 2>&1 \
-                 && say "harlequin upgraded" || say "harlequin upgrade failed" ;;
-    # With no target, pi update updates pi itself and no package.
-    pi)        if pi update >/dev/null 2>&1; then
-                 say "pi updated"
-                 patch_pi_win32_paste
-               else
-                 say "pi update failed"
-               fi ;;
-    pi-subagents|pi-compact-tools|pi-zentui|pi-web-access|pi-lens|pi-slash-anywhere|@juicesharp/rpiv-ask-user-question|billion-context|@juicesharp/rpiv-todo|pi-plugin-manager)
-      if pi_npm_pin "$1"; then
-        say "$1 is pinned to $(pi_state pkg "npm:$1") in pi, which pi update never moves"
-        return 0
-      fi
-      pi update "npm:$1" >/dev/null 2>&1 \
-        && say "$1 updated" || say "$1 update failed" ;;
-    # Only a pin behind this plugin. A newer pin is the user's choice, and an
-    # absent or unpinned ACStack is apply's business.
-    pi-acstack)
-      [ -n "$(pi_acstack_behind)" ] || { say "pi-acstack: nothing behind this plugin to move"; return 0; }
-      pi_add "$PI_ACSTACK@$(acstack_version)" "$PI_ACSTACK" ;;
-    # Absent from the table, because it has no version flag for outdated to
-    # read. Naming it is the only way to refresh it, so the arm it needs is
-    # here rather than behind a table lookup that will never find it.
-    mermaid-ascii)
-      INSTALL_FORCE=1 install_binary mermaid-ascii AlexanderGrooff/mermaid-ascii Linux_x86_64 ;;
-    hadolint)
-      INSTALL_FORCE=1 install_plain_github_binary hadolint hadolint/hadolint Linux-x86_64 ;;
-    terragrunt)
-      INSTALL_FORCE=1 install_plain_github_binary terragrunt gruntwork-io/terragrunt linux_amd64 ;;
-    # The fork build comes from a local checkout, so a release archive would
-    # replace it with the stock binary and silently drop the patches it carries.
-    # outdated already skips it; naming it here has to skip it too.
-    tuicr)
-      if [ "$(cfg_get tuicr.build_from_fork false)" = "true" ]; then
-        say "tuicr is built from a fork here, so run apply to rebuild it"
-        return 0
-      fi
-      upgrade_from_table tuicr ;;
-    *) upgrade_from_table "$1" ;;
-  esac
-}
-
-case "$ACTION" in
-  status)
-    echo "config: $CFG $([ -f "$CFG" ] && echo '(found)' || echo '(missing, using defaults)')"
-    find_pi
-    for t in herdr delta diffnav fzf lazygit tuicr yazi glow mermaid-ascii harlequin gh nvim pi; do
-      case "$t" in
-        gh) k=gh_dash ;; glow|mermaid-ascii) k=markdown ;; fzf) k=diffnav ;;
-        nvim) k=neovim ;;
-        *) k="$t" ;;
-      esac
-      # neovim and pi default to off, so reading them with the default every
-      # other one takes would report them enabled when the config says nothing.
-      printf '  %-13s %-14s enabled=%s\n' "$t" "$(have "$t" && echo installed || echo 'not installed')" \
-        "$(cfg_get "$k.enabled" "$(enabled_default "$k")")"
-    done
-    grep -q "$BEGIN" "$HERDR_CFG" 2>/dev/null && say "herdr managed block: present" || say "herdr managed block: absent"
-    echo
-    # Where a copy and an open actually land, which is the first thing to
-    # check when o or y misbehaves on a machine reached over SSH.
-    if [ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]; then
-      say "clipboard: this machine has a display, using its own"
-    elif [ -x "$BIN/xclip" ]; then
-      say "clipboard: xclip stand-in, copying to your terminal over OSC 52"
-    else
-      say "clipboard: none - run apply, or copy will fail in gh-dash and friends"
-    fi
-    if grep -q 'vim\.g\.clipboard' "$NVIM_PLUGIN" 2>/dev/null; then
-      say "neovim clipboard: OSC 52, written by this setup"
-    elif mine="$(nvim_user_sets 'g\.clipboard')"; then
-      say "neovim clipboard: set by $mine"
-    elif [ "$(cfg_get neovim.enabled false)" = "true" ]; then
-      say "neovim clipboard: none - run apply, or :%y+ fails over SSH"
-    fi
-    # Ask the opener itself rather than repeating its rules here. Two copies
-    # of this decision drifting apart is exactly how o came to claim it had
-    # opened a page it had not.
-    case "$(acstack-open --why 2>/dev/null)" in
-      command)      say "browser: \$ACSTACK_OPEN_CMD = $ACSTACK_OPEN_CMD" ;;
-      xdg-open)     say "browser: xdg-open on this machine" ;;
-      wslview|wsl-open|explorer.exe)
-                    say "browser: the Windows side of this machine" ;;
-      opener)       say "browser: your default browser on your laptop, through the opener" ;;
-      bridge)       say "browser: Chrome on your laptop, through the Playwriter bridge" ;;
-      link)         say "browser: none - o hands you a ctrl+clickable link and copies it" ;;
-      clipboard)    say "browser: none, and no terminal either - o copies and reports failure" ;;
-      *)            say "browser: unknown - run apply" ;;
-    esac
-    [ -f "$HOME/.cache/acstack/open.log" ] \
-      && say "last open: $(tail -1 "$HOME/.cache/acstack/open.log")"
-    # What the pi component set up, read from pi's own files. Shown whenever
-    # pi is here or asked for, because a pi installed by hand is still one the
-    # user may want to know about.
-    if have pi || [ "$(cfg_get pi.enabled false)" = "true" ]; then
-      echo
-      have pi && say "pi: $(installed_version pi)" || say "pi: not installed"
-      for id in npm:pi-subagents "$PI_ACSTACK" "$PI_BILLION" npm:@juicesharp/rpiv-todo npm:pi-plugin-manager npm:@juicesharp/rpiv-ask-user-question npm:pi-web-access npm:pi-lens "$PI_SLASH_ANYWHERE" npm:pi-compact-tools "$PI_ZENTUI"; do
-        src=$(pi_state pkg "$id") && say "pi package: $src" || say "pi package: $id not installed"
-      done
-      [ -e "$PI_RETRO_EXT" ] && say "pi agentic-retro extension: present" \
-        || say "pi agentic-retro extension: absent"
-      grep -qsF "$PI_MD_BEGIN" "$PI_DIR"/AGENTS.override.md "$PI_DIR"/AGENTS.md "$PI_DIR"/AGENTS.MD \
-        "$PI_DIR"/CLAUDE.md "$PI_DIR"/CLAUDE.MD \
-        && say "pi delegation line: present" || say "pi delegation line: absent"
-      ta=$(json_field "$PI_SUBAGENT_CFG" toolActivation)
-      say "pi toolActivation: ${ta:-not set}"
-      [ -f "$PI_DIR/auth.json" ] && say "pi login: logged in" \
-        || say "pi login: not logged in - run pi, then /login"
-    fi
-    if [ "$(cfg_get tuicr.build_from_fork false)" = "true" ]; then
-      echo
-      say "tuicr: local fork build - this is meant to be temporary"
-      if have gh; then
-        for pr in 607 633; do
-          state=$(gh pr view "$pr" --repo agavra/tuicr --json state -q .state 2>/dev/null || echo "unknown")
-          printf '    agavra/tuicr#%s  %s\n' "$pr" "$state"
-        done
-        say "both MERGED? set tuicr.build_from_fork: false and re-run apply"
-        say "check the merged key names first - review can rename them"
-      else
-        say "install gh to have this check agavra/tuicr#607 and #633 for you"
-      fi
-    fi
-    ;;
-  apply)
-    require_yaml
-    arch_supported || exit 1
-    # Every setting has a default, so a missing config is a working setup and
-    # not an error. Say so anyway: the alternative is a run that looks like it
-    # read your settings and did not.
-    [ -f "$CFG" ] || say "no config at $CFG, so every setting takes its default"
-    [ "$(cfg_get enabled true)" = "true" ] || { echo "terminal workspace disabled in config"; exit 0; }
-    if [ "$(cfg_get herdr.enabled true)" = "true" ] && ! have herdr; then
-      # herdr ships an installer that picks the right build and verifies a
-      # checksum. Prefer it over matching release asset names ourselves.
-      curl -fsSL https://herdr.dev/install.sh | sh >/dev/null 2>&1 \
-        && say "herdr installed" || say "herdr install failed, see herdr.dev"
-    fi
-    [ "$(cfg_get delta.enabled true)"   = "true" ] && install_binary delta dandavison/delta x86_64-unknown-linux-gnu
-    [ "$(cfg_get diffnav.enabled true)" = "true" ] && install_binary diffnav dlvhdr/diffnav Linux_x86_64
-    # fzf drives the comparison picker behind acstack-diff pick.
-    [ "$(cfg_get diffnav.enabled true)" = "true" ] && install_binary fzf junegunn/fzf linux_amd64
-    [ "$(cfg_get lazygit.enabled true)" = "true" ] && install_binary lazygit jesseduffield/lazygit linux_x86_64
-    write_helpers
-    [ "$(cfg_get tuicr.enabled true)"   = "true" ] && apply_tuicr
-    apply_yazi
-    apply_markdown
-    apply_neovim
-    [ "$(cfg_get herdr.enabled true)"   = "true" ] && apply_herdr
-    [ "$(cfg_get herdr.enabled true)"   = "true" ] && apply_herdr_numbers
-    [ "$(cfg_get delta.enabled true)"   = "true" ] && apply_delta
-    [ "$(cfg_get remote.enabled true)" = "true" ] && apply_remote
-    [ "$(cfg_get gh_dash.enabled true)" = "true" ] && apply_ghdash
-    [ "$(cfg_get harlequin.enabled true)" = "true" ] && apply_harlequin
-    [ "$(cfg_get pi.enabled false)" = "true" ] && apply_pi
-    echo "done. open a herdr session and press prefix+? to see the keymap"
-    # Last, so a run that died half way leaves no stamp claiming success.
-    write_stamp
-    ;;
-  outdated)
-    # Exit 2 means "cannot tell", and a missing PyYAML is exactly that.
-    # require_yaml exits 1, which every caller reads as "there is something to
-    # fetch" and acts on findings this run was never able to produce.
-    python3 -c 'import yaml' 2>/dev/null || {
-      echo "PyYAML is required to read $CFG, so nothing here can be compared" >&2
-      exit 2; }
-    [ -f "$EXAMPLE" ] || { echo "no config.example.yaml beside $0" >&2; exit 2; }
-    out=$(outdated_report)
-    [ -n "$out" ] || exit 0
-    printf '%s\n' "$out"
-    # An unknown is not a finding: nothing can be done about a tool with no
-    # version flag or a GitHub that did not answer. Only a real one exits 1.
-    printf '%s\n' "$out" | grep -qE '^(missing|new|stale)' && exit 1
-    exit 0
-    ;;
-  upgrade)
-    require_yaml
-    arch_supported || exit 1
-    shift
-    names="$*"
-    report=""
-    if [ -z "$names" ]; then
-      report=$(outdated_report)
-      names=$(printf '%s\n' "$report" | awk -F'\t' '$1=="stale"{print $2}')
-    fi
-    for n in $names; do upgrade_one "$n"; done
-
-    # A new component is a config edit, not a download. Append the block the
-    # example ships, comments and all, rather than rewriting the file through
-    # yaml - a round trip through the parser drops every comment the user has.
-    printf '%s\n' "$report" | awk -F'\t' '$1=="new"{print $2}' | while read -r comp; do
-      [ -n "$comp" ] || continue
-      ACSTACK_COMP="$comp" py "$EXAMPLE" "$CFG" <<'PY'
-import os, re, sys
-comp = os.environ["ACSTACK_COMP"]
-ship = open(sys.argv[1]).read()
-# The block runs from the component's own key to the next top-level key. A
-# top-level key is the only thing that starts in column zero and ends in a
-# colon, which is what makes a plain text slice safe here.
-m = re.search(r"(?ms)^%s:.*?(?=^\S+:|\Z)" % re.escape(comp), ship)
-if not m:
-    raise SystemExit
-block = m.group(0).rstrip() + "\n"
-mine = open(sys.argv[2]).read() if os.path.isfile(sys.argv[2]) else ""
-if re.search(r"(?m)^%s:" % re.escape(comp), mine):
-    raise SystemExit
-open(sys.argv[2], "a").write(("" if mine.endswith("\n\n") else "\n") + block)
-print("  %s added to your config, with its comments" % comp)
-PY
-    done
-
-    say "run apply to install anything new"
-    ;;
-  disable)
-    DISABLE_USAGE="usage: setup.sh disable <herdr|delta|diffnav|gh_dash|harlequin|lazygit|neovim|pi|tuicr>"
-    comp="${2:?$DISABLE_USAGE}"
-    case "$comp" in
-      delta) for k in core.pager interactive.diffFilter delta.navigate delta.line-numbers; do
-               git config --global --unset "$k" 2>/dev/null
-             done
-             say "delta unset as git pager"
-             say "now set delta.enabled: false in $CFG so apply does not restore it" ;;
-      herdr)
-        py "$HERDR_CFG" "$BEGIN" "$END" <<'PY'
-import re, sys, os
-p, b, e = sys.argv[1:4]
-if os.path.isfile(p):
-    t = open(p).read()
-    open(p, "w").write(re.sub(re.escape(b) + r".*?" + re.escape(e) + r"\n?", "", t, flags=re.S))
-PY
-        say "managed block removed from herdr config"
-        say "now set herdr.enabled: false in $CFG so apply does not restore it" ;;
-      neovim)
-        # A whole file of ours, so turning it off is a deletion. Anything the
-        # user wrote by hand under that name is theirs and stays.
-        if nvim_ours; then
-          rm -f "$NVIM_PLUGIN"
-          say "neovim plugin file removed"
-        fi
-        say "now set neovim.enabled: false in $CFG so apply does not restore it" ;;
-      pi)
-        # Only what apply added. The pi binary, its logins and its sessions
-        # stay, and so does anything the user installed into pi themselves.
-        remove_pi
-        say "now set pi.enabled: false in $CFG so apply does not restore it" ;;
-      diffnav|gh_dash|harlequin|lazygit|tuicr)
-        # Only this component's popup goes away. Rebuild the managed block so
-        # the rest of the keymap survives.
-        require_yaml
-        ACSTACK_CFG="$CFG" py "$comp" <<'PY'
-import os, sys, yaml
-p = os.environ["ACSTACK_CFG"]
-c = yaml.safe_load(open(p)) or {}
-c.setdefault(sys.argv[1], {})["enabled"] = False
-yaml.safe_dump(c, open(p, "w"), sort_keys=False)
-PY
-        apply_herdr
-        say "$comp disabled, rest of the keymap left in place" ;;
-      yazi|markdown|remote)
-        # These three have no keys to remove and no git settings to unset, so
-        # there is nothing here to carry out. Refusing says so; the arm that
-        # was missing let the script exit 0 in silence, which reads as done.
-        say "$comp has no disable step"
-        say "set $comp.enabled: false in $CFG and run apply instead"
-        exit 1 ;;
-      *) echo "$comp is not a component. $DISABLE_USAGE" >&2; exit 1 ;;
-    esac
-    ;;
-  uninstall)
-    "$0" disable herdr; "$0" disable delta; "$0" disable neovim; "$0" disable pi
-    # By prefix, which is why helpers are named acstack-*: anything this
-    # script ever wrote goes, including helpers retired in an older version.
-    herdr plugin unlink acstack.herdr-numbers >/dev/null 2>&1 || true
-    rm -rf "$HOME/.config/acstack/herdr-numbers"
-    rm -f "$BIN"/acstack-*
-    # The xclip stand-in is the one managed file without the prefix.
-    grep -q "Installed by acstack" "$BIN/xclip" 2>/dev/null && rm -f "$BIN/xclip"
-    # Every file apply leaves a marked region in. Removing the region is the
-    # same edit `disable herdr` makes, so whatever the user wrote around it
-    # comes through untouched. Left behind, the yazi regions keep routing
-    # markdown at acstack-md, a helper this command has just deleted.
-    ACSTACK_ARGS="$BEGIN|$END" py \
-      "$HOME/.config/tuicr/config.toml" \
-      "$HOME/.config/yazi/yazi.toml" \
-      "$HOME/.config/yazi/keymap.toml" <<'PY'
-import os, re, sys
-b, e = os.environ["ACSTACK_ARGS"].split("|")
-for p in sys.argv[1:]:
-    if os.path.isfile(p):
-        t = open(p).read()
-        open(p, "w").write(re.sub(re.escape(b) + r".*?" + re.escape(e) + r"\n?", "", t, flags=re.S))
-PY
-    # gh-dash reads YAML that python rewrites whole, so a marker comment never
-    # survives the round trip. What identifies acstack's work there is the name
-    # on each keybinding, the same handle apply_ghdash uses to replace its own
-    # entries, plus the two page keys it binds. Sections, repo paths and every
-    # other keybinding belong to the user and stay.
-    if [ -f "$GHDASH_CFG" ] && python3 -c 'import yaml' 2>/dev/null; then
-      py "$GHDASH_CFG" <<'PY'
-import sys, yaml
-p = sys.argv[1]
-cfg = yaml.safe_load(open(p)) or {}
-MANAGED = ("review (tuicr)", "tree diff", "agent review", "open in browser")
-kbs = cfg.get("keybindings") or {}
-for scope in ("prs", "issues"):
-    if scope in kbs:
-        kbs[scope] = [k for k in kbs[scope] or [] if k.get("name") not in MANAGED]
-        if not kbs[scope]:
-            del kbs[scope]
-if "universal" in kbs:
-    kbs["universal"] = [k for k in kbs["universal"] or []
-                        if k.get("builtin") not in ("pageUp", "pageDown")]
-    if not kbs["universal"]:
-        del kbs["universal"]
-if kbs:
-    cfg["keybindings"] = kbs
-else:
-    cfg.pop("keybindings", None)
-yaml.safe_dump(cfg, open(p, "w"), sort_keys=False, default_flow_style=False, width=200)
-PY
-      say "gh-dash keybindings removed"
-    fi
-    # The one tool uv owns rather than this script. Leaving it behind leaves an
-    # environment nothing on the machine points at any more.
-    if have uv && uv tool list 2>/dev/null | grep -q '^harlequin '; then
-      uv tool uninstall harlequin >/dev/null 2>&1 && say "harlequin removed"
-    fi
-    say "managed config and helpers removed. binaries left in place, except"
-    say "harlequin, which uv owns whole rather than as a file in $BIN"
-    say "pi stays too, with its logins and sessions: npm uninstall -g @earendil-works/pi-coding-agent"
-    ;;
-  *) echo "usage: setup.sh [status|apply|outdated|upgrade|disable <component>|uninstall]"; exit 1 ;;
-esac