breakaway 0.0.0-stage → 1.0.0-main.10

package/.agents/skills/tasks/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: tasks
+description: Use when picking up, claiming, starting, handing over, or finishing breakaway work; when asked what to work on next or about a work ID like BRK-12 or WEB-3; when adding follow-up tasks, dependencies, or notes; when several agents work in parallel; and at the start of any session, local or cloud, that should work from the task board.
+---
+
+# Working from the board
+
+breakaway's work is on the board that tracks this repository. The CLI is `npx breakaway` (`tasks` below; in breakaway's own checkout, `node scripts/tasks.mjs` is the same); `tasks help` lists every command. The board's rules for agents it starts are in [`prompts/core.md`](../../../prompts/core.md).
+
+**The claim is the lock.** Many agents share the board. Only work on a task you claimed, claim only through the CLI (it's atomic), and never set a claim any other way.
+
+## The loop
+
+1. **Name yourself** once: the name the board gave you if it started you, or `claude-<branch>`; export the agent-name variable `npx breakaway help` names (`BREAKAWAY_AGENT`), or pass `--as <name>` to every command.
+2. **Check the board works:** `tasks health`. No token? Stop and tell the owner; don't hunt for one.
+3. **Pick:**
+   - asked for a task → `tasks claim <ID>`
+   - asked to "pick something" → `tasks next --claim` (add `--project`, `--horizon` to narrow it)
+
+   A `409` means someone has it or it's blocked. Pick another; never `--force` someone else's claim.
+4. **Read it:** `tasks show <ID>` (description, done when, comments, spec, what it waits for and holds up), then [`AGENTS.md`](../../../AGENTS.md) if you haven't this session.
+5. **Work** on a branch. Record what you learn as you go: `tasks comment <ID> "<finding>"`. Comments are append-only; the description is the current brief, and you edit it only on a task you made or are refining. New work you find becomes `tasks add "<title>" --project <area> --tag agent|owner --horizon <h> --brief "<what and why>" --done-when "<done when>"`, with `--depends <ID>` when it waits for something. breakaway's areas: `board`, `web`, `docs`, `launch`, `brand`.
+6. **Hand over:** open the pull request with `Closes <ID>.` in its description, then `tasks modify <ID> --pr <number>` and `tasks comment <ID> "<one-line result>"`. The board moves the task to In review and marks it done when the pull request merges; don't mark it done yourself. If you stop before a pull request: `comment` where you got to, then `release <ID>`.
+
+## Rules
+
+| Situation | Do |
+| --- | --- |
+| Task is `+decide` | Don't start it. If it has no questions, add some with `modify <ID> --decision <file.json>` (`decision --template` prints an example). |
+| You need the owner to choose | Ask with a decision, not prose: `add "<title>" --tag owner --decision <file.json>` and make the work that waits `--depends` on it. Only the owner answers, on the board; read the answers with `show`. |
+| Part of the work needs the owner (an install, a dashboard, a sign-off) | Finish your part, then `add` a `+owner` task for the rest that `--depends` on yours. |
+| Task needs design choices | Write the spec in `docs/specs/<ID>-<slug>.md` and `modify <ID> --spec <path>`. |
+| You're blocked by another task | `comment` why, `release`, and pick the blocker or another task. |
+| A claim looks abandoned | Ask the owner; don't take it. |
+| Opening a pull request for a spec, plan, or partial step | Write `Part of <ID>.`, not `Closes`, and don't put it in `--pr`: merging the pull request in that field finishes the task. A branch name alone never closes anything. |
+| Checking your pull request | `tasks github` (checks, reviews, failing runs) or `tasks show <ID>`. |
+| `claim` says the task belongs to another repository | Don't cross it with `--repo`: that work belongs in a checkout of its own repository. `comment` and `release` if the board started you on it. |
+| The board started you | Follow [`prompts/breakaway.md`](../../../prompts/breakaway.md), which starts with the core. Check the payload's `Repository:` line against `git remote get-url origin` first. |
+| The task is an `IDEA-` | Shape it, don't build it: "Shaping an idea" in the core. |
+| Only the owner can help, or the task is already done or won't reproduce | `ping <ID> --kind blocked\|question\|stale\|done "<message>"`, then `release`. Ping only when the owner must act or would want to know now, never for progress. Full rules: "Pinging the owner" in the core. |
+| Adding a task that could run by itself | Never set `--autostart`: whether a task starts an agent by itself is the owner's choice. |
+
+## Working across repositories
+
+The board runs several repositories, and every task belongs to one. The CLI works in the repository `git remote get-url origin` names: `list`, `next`, `claim`, and `add` stay in it, and `show <ID>` works for any ID. Work that spans repositories is a task in each, with a `depends` between them; a task never moves, and `Closes <ID>.` in this repository's pull request only closes this repository's tasks.
+
+This repository is public and the board isn't. Never copy another repository's tasks, comments, or names into a file, commit, or pull request here, and never put a person's details or any secret in a task's title, description, or comments.
+
+## Common mistakes
+
+- Starting work before `claim` returns: another agent may already have it.
+- Marking `done` yourself while the pull request is open: the board does it on merge.
+- Writing `Closes <ID>` in a spec pull request, or putting it in `--pr`.
+- Pinging to report progress or a pull request: the board shows both.
+- Leaving a claim when you stop: always `release` with a comment.

package/LICENSE

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 TheAnarchoX
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,3 +1,194 @@
-# Temporary Holding Version
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/hero-light.png">
+    <img alt="breakaway: Leave the pack. A task board for you and your coding agents: they claim the work, you merge it. Beside it, a board with four made-up tasks; the claimed one, BRK-12, has a red work ID." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/hero-dark.png" width="100%">
+  </picture>
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<p align="center">
+  <b>breakaway is a task board for you and your coding agents.</b><br>
+  They claim the work. You merge it. Free, and it runs on your own Cloudflare account.
+</p>
+
+<p align="center">
+  <a href="#run-your-own"><b>Run your own</b></a> ·
+  <a href="#how-it-works">How it works</a> ·
+  <a href="#docs">Docs</a> ·
+  <a href="https://breakaway.samewave.dev">Website</a> ·
+  <a href="#licence">Licence</a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/breakaway"><img alt="npm" src="https://img.shields.io/npm/v/breakaway?style=flat-square&label=npm&labelColor=0d0e10&color=f4f4f1"></a>
+  <a href="https://github.com/TheAnarchoX/breakaway/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/TheAnarchoX/breakaway/actions/workflows/ci.yml/badge.svg"></a>
+  <a href="https://github.com/TheAnarchoX/breakaway/blob/main/LICENSE"><img alt="Licence: FSL-1.1-Apache-2.0" src="https://img.shields.io/badge/licence-FSL--1.1--Apache--2.0-f4f4f1?style=flat-square&labelColor=0d0e10"></a>
+</p>
+
+## Run your own
+
+Paste this into [Claude Code](https://claude.com/claude-code), in an empty folder:
+
+```text
+Set up a breakaway board for me. Read https://breakaway.samewave.dev/install.md and follow it.
+```
+
+It sets up your board with you: it runs and checks what it can, and stops for each step only you can do, like signing in or making a token. It never asks for a secret in the chat.
+
+You need a Cloudflare account, a GitHub account, and Node 20 or later. A Claude plan with routines lets the board start agents for you. Without one, the board works the same, and the agents you start yourself use the CLI.
+
+Rather do it by hand? [The self-hosting guide](https://github.com/TheAnarchoX/breakaway/blob/main/docs/self-hosting.md) has the same steps, from an install repository (`npx breakaway install init`) to a board that starts agents and updates itself. Each step ends in a check on the board's Connections view.
+
+## See it
+
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/board-light.png">
+  <img alt="The board in the browser, with made-up work in a repository called widgets: columns from Needs a decision to Done, and the Now horizon's tasks. Three are claimed by agents and show their red work IDs; one waits for another; two are done." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/board-dark.png" width="100%">
+</picture>
+
+## How it works
+
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/how-light.png">
+  <img alt="Agents claim the work. You merge it. In three steps: an agent, claude-brk-12, claims the task BRK-12; it opens a pull request that says Closes BRK-12.; you merge, and the task is done." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/how-dark.png" width="100%">
+</picture>
+
+1. **Write the work down.** Add tasks with a description and what done means, or write an idea and let an agent shape it into a spec and tasks.
+2. **Agents claim it.** A claim is atomic, so two agents never work the same task. Start Claude Code cloud agents from the board, or let local Claude Code sessions pick up work through the CLI.
+3. **Pull requests close tasks.** A pull request that says `Closes BRK-12.` puts the task in review. The task is done when you merge it.
+4. **They ping you when they're stuck.** An agent that needs you sends a ping to your inbox. The rest waits on the board.
+
+## What you get
+
+<table>
+  <tr>
+    <td width="42%" valign="top">
+      <picture>
+        <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/task-light.png">
+        <img alt="A task's panel: APP-2, Sort the inbox by age, claimed by claude-app-2, with its live output: what it read, what it's thinking, the files it edited, and the tests it ran." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/task-dark.png" width="100%">
+      </picture>
+    </td>
+    <td valign="top">
+      <h3>Watch them work.</h3>
+      <p>Start Claude Code cloud agents on tasks from the board, cap how many run, and follow each one's output live on its task: what it read, what it changed, and what it ran.</p>
+      <h3>One claim per task.</h3>
+      <p>Claiming is atomic, so two agents never work on the same task. An agent names itself, claims, comments as it goes, and hands over with a pull request.</p>
+      <h3>One board, several repositories.</h3>
+      <p>Each repository has its own areas and work-ID prefixes, its own agent prompt, and its own agents.</p>
+    </td>
+  </tr>
+</table>
+
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/inbox-light.png">
+  <img alt="A ping in the inbox: a question from claude-api-3 on API-3, Name a widget only once: A taken name: answer 409, or suggest the name with a number after it? With buttons Handled and Dismiss." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/inbox-dark.png" width="100%">
+</picture>
+
+**Agents ping you when they need you.** A question, a decision only you can make, or a task that looks done comes to your inbox, and as a push if you want one. The rest waits on the board.
+
+<table>
+  <tr>
+    <td valign="top">
+      <h3>Three ways in, one set of data.</h3>
+      <p>The web board in your browser, installable on your phone. The CLI, <code>npx breakaway</code>, for you and your agents, cloud sessions included. And Taskwarrior 3, which syncs with the board using its own protocol.</p>
+
+```sh
+npx breakaway next --claim --as claude-brk-12
+npx breakaway comment BRK-12 "The inbox sorts by age."
+npx breakaway list --ready
+```
+
+  </td>
+    <td width="30%" valign="top">
+      <picture>
+        <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/phone-light.png">
+        <img alt="The board on a phone: the Now horizon's tasks in one column, with filters and a search above." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/phone-dark.png" width="100%">
+      </picture>
+    </td>
+  </tr>
+</table>
+
+## One person's real run
+
+Agents claimed the work and opened the pull requests. It happened once, and these are the numbers: **160 pull requests in under 48 hours. One person. No editor opened.**
+
+## What it is, and isn't
+
+- **Self-hosted.** It runs on your own Cloudflare account: one Worker and one Durable Object. There's no hosted breakaway, and no accounts, teams, or pricing.
+- **Your data stays yours.** No analytics, telemetry, or tracking, and no call to a service you didn't connect (GitHub, Claude, push).
+- **You decide.** Agents claim, build, and open pull requests. You merge, deploy, and start agents. Nothing merges or deploys on an agent's word.
+- **Taskwarrior is a first-class way in.** The sync protocol is Taskwarrior's.
+- **Free and fair source.** The source is public, and each release becomes Apache 2.0 two years after it ships.
+
+## How it's built
+
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/built-light.png">
+  <img alt="How breakaway is built. Three ways in: the web board, the CLI, and Taskwarrior. They reach one Worker and its Durable Object on your own Cloudflare account, which holds every task. The board talks to GitHub through its own GitHub App, and starts Claude Code cloud agents through your routine; agents work the board through the CLI." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/built-dark.png" width="100%">
+</picture>
+
+One Cloudflare Worker serves the API, the web app (Preact), and Taskwarrior sync, and one SQLite Durable Object holds every task, claim, comment, and change. The board reads GitHub through a private GitHub App you make for it, and starts cloud agents through a Claude Code routine you save. [Architecture](https://breakaway.samewave.dev/docs/architecture/) has the rest.
+
+## Docs
+
+| Read | For |
+| --- | --- |
+| [Run your own board](https://breakaway.samewave.dev/docs/quickstart/) | From nothing to a board that starts agents and updates itself |
+| [Concepts](https://breakaway.samewave.dev/docs/concepts/) | Tasks and work IDs, areas, horizons, claims, dependencies, and how a pull request closes a task |
+| [Playbook](https://breakaway.samewave.dev/docs/playbook/) | Write tasks agents finish, run many agents without collisions, and keep the review load to one person |
+| [Agents](https://breakaway.samewave.dev/docs/agents/) | Cloud agents from the board, local agents, limits, live output, and messaging a running agent |
+| [Ideas, decisions, and pings](https://breakaway.samewave.dev/docs/ideas-decisions-pings/) | Let an agent shape an idea, answer its questions in a form, and get a ping when only you can help |
+| [The CLI](https://breakaway.samewave.dev/docs/cli/) | Every command of `npx breakaway` |
+| [GitHub](https://breakaway.samewave.dev/docs/github/) | Your own private App, how pull requests link to tasks, and merging, promoting, and rolling back |
+| [Taskwarrior](https://breakaway.samewave.dev/docs/taskwarrior/) | Sync, reports, and contexts with Taskwarrior 3 |
+| [Deploying](https://breakaway.samewave.dev/docs/deploying/) | Releases, channels, the Deploy and Update workflows, and rollbacks |
+| [FAQ](https://breakaway.samewave.dev/docs/faq/) | The licence, your data, what it works with, and what it won't do |
+
+<details>
+<summary><b>Run it locally</b></summary>
+
+You need Node and [pnpm](https://pnpm.io).
+
+```sh
+pnpm install
+pnpm dev        # the board, locally
+pnpm test       # the tests
+pnpm build      # the web app
+pnpm interop    # checks sync against real Taskwarrior 3
+```
+
+`pnpm interop` needs Taskwarrior 3 on your `PATH`.
+
+| Path | What |
+| --- | --- |
+| `src/` | The Worker: the API, the `TaskStore` Durable Object, GitHub, routines, pings, push, sync |
+| `web/` | The board's web app (Preact and `@preact/signals`) |
+| `scripts/tasks.mjs` | The CLI |
+| `prompts/` | What the agents the board starts follow, and the install prompt |
+| `site/` | The website, the docs, and the update feed |
+| `brand/` | The brand guide, tokens, and logo |
+| `test/` | Tests, run in the Workers pool |
+
+</details>
+
+<details>
+<summary><b>Releases</b></summary>
+
+breakaway publishes releases and never deploys. Every install, the owner's included, deploys a release from its own repository, and this repository holds no Cloudflare credentials.
+
+- **Every merge to `main`**, once CI passes, publishes a GitHub pre-release `vX.Y.Z-main.N` on the `main` channel. It carries the bundle (`breakaway-bundle.tar.gz`: the Worker's files and the web app's `dist`), a `manifest.json` (version, channel, commit, `manual`, and the lowest version it updates from), and `SHA256SUMS`. The notes list the merged pull requests by title.
+- **A stable release** `vX.Y.Z` is the owner's: they run the **Release** workflow with the pre-release to promote. The bundle is that pre-release's, unchanged, and the notes cover everything since the last stable.
+- **The CLI** is on npm as [`breakaway`](https://www.npmjs.com/package/breakaway), staged on npm by the same workflow, with provenance, and live once the owner approves it there with 2FA. npm's trusted publishing can't yet read the OIDC identity of a repository as new as this one ([npm/cli#9969](https://github.com/npm/cli/issues/9969)), so until it can, a token that can stage but never publish by itself stands in, in an environment only `main` can use. Every pre-release goes out under the `next` dist-tag, and a stable release as `latest`. `npx breakaway <command>` is `node scripts/tasks.mjs <command>`.
+- **A major release** is one where an install has to do something by hand: a config or binding change, a Durable Object class or migration, a route or cron. Its notes have a **Manual steps** section and its manifest says `manual: true`, which an install's deploy stops on. A change that needs it sets `manual` and `manualSteps` in `release.json`, and the pull request that ships the steps clears them. Data the Durable Object stores changes forward-only and additively, so an install can always go back one release.
+- **The version** is `package.json`'s; the release workflow sets it to the pre-release's before it builds. `GET /api/ping` and `GET /api/health` report it as `release`. An install that deploys a stable passes it as the `BREAKAWAY_VERSION` variable, since the bundle was built as the pre-release.
+
+</details>
+
+## Who builds it
+
+breakaway is built by its owner and their agents, and takes no pull requests or issues from anyone else: [`CONTRIBUTING.md`](https://github.com/TheAnarchoX/breakaway/blob/main/CONTRIBUTING.md) says what you can do instead. Report a security problem privately, as [`SECURITY.md`](https://github.com/TheAnarchoX/breakaway/blob/main/SECURITY.md) says. The agents follow [`AGENTS.md`](https://github.com/TheAnarchoX/breakaway/blob/main/AGENTS.md), and anything people see or read follows the [brand guide](https://github.com/TheAnarchoX/breakaway/blob/main/brand/README.md).
+
+## Licence
+
+Free to use, change, and self-host for anything except offering a competing service, under [FSL-1.1-Apache-2.0](https://github.com/TheAnarchoX/breakaway/blob/main/LICENSE). Each release becomes Apache 2.0 two years after it ships.
+
+breakaway works with Claude Code, GitHub, Taskwarrior, and Cloudflare. None of them made it or endorse it.

package/package.json

@@ -1,6 +1,77 @@
 {
   "name": "breakaway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0-main.10",
+  "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
+  "license": "FSL-1.1-Apache-2.0",
+  "type": "module",
+  "bin": {
+    "breakaway": "scripts/tasks.mjs"
+  },
+  "files": [
+    "scripts/tasks.mjs",
+    "scripts/tasks/*.js",
+    "scripts/tasks/*.mjs",
+    "!scripts/tasks/*.test.js",
+    "!scripts/tasks/vitest.config.js",
+    "scripts/task",
+    "scripts/*.mjs",
+    "scripts/install/*.js",
+    "scripts/lib/*.js",
+    "!scripts/lib/*.test.js",
+    "!scripts/install/*.test.js",
+    "src/cli-version.js",
+    "src/decision.js",
+    "src/install.js",
+    "src/model.js",
+    "src/ping.js",
+    "src/promote.js",
+    "src/prompt.js",
+    "src/redact.js",
+    "src/repos.js",
+    "src/versions.js",
+    "prompts/*.md",
+    "taskrc",
+    ".agents/skills/tasks/SKILL.md",
+    "template"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TheAnarchoX/breakaway.git"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "test": "vitest run && vitest run --config scripts/tasks/vitest.config.js",
+    "brand": "node scripts/brand-lint.mjs",
+    "format": "biome format --write .",
+    "lint": "biome check .",
+    "typecheck": "wrangler types && tsc -p tsconfig.json && tsc -p scripts/tsconfig.json && tsc -p web/tsconfig.json",
+    "site": "node site/build.mjs",
+    "interop": "node interop.mjs",
+    "deploy": "vite build && wrangler deploy -c wrangler.jsonc"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.15",
+    "@cloudflare/vitest-pool-workers": "^0.22.0",
+    "@fontsource-variable/archivo": "^5.3.0",
+    "@fontsource-variable/chivo-mono": "^5.3.0",
+    "@noble/ciphers": "^2.4.0",
+    "@preact/preset-vite": "^2.10.6",
+    "@preact/signals": "^2.11.2",
+    "@types/node": "^26.6.4",
+    "fflate": "^0.8.3",
+    "lucide-preact": "^1.48.0",
+    "preact": "^10.29.8",
+    "typescript": "^7.0.2",
+    "vite": "^8.3.1",
+    "vitest": "^4.1.11",
+    "wrangler": "^4.144.0"
+  }
+}

package/prompts/add-repository.md

@@ -0,0 +1,51 @@
+<!--
+  The sidekick prompt for adding a repository to the task board (CLD-194). The board's Add a repository
+  wizard copies it with <slug> and <owner/name> filled in ("Copy a prompt for a local agent"); paste it into
+  Claude Code in a checkout of the board's own repository. It's reviewed like code: change it here, never on the page.
+-->
+You're helping the owner add a repository to the owner's task board, step by step, the way the board's **Add a repository** wizard lays it out. You're the sidekick: you check each step, do the parts an agent may do, and hand the owner the exact command for the parts that are theirs.
+
+The repository: **<owner/name>** on GitHub, slug **<slug>** on the board. If the slug still reads as a placeholder, the owner hasn't picked one yet: suggest one (the GitHub name in lowercase letters, digits, and hyphens) and ask.
+
+## Before anything else
+
+1. Check you're in the board's own checkout: `docs/tasks.md` and `scripts/tasks.mjs` are here, and `npx breakaway health` answers. If not, stop and say so. Read `AGENTS.md` and the "Adding a repository" section of `docs/tasks.md`.
+2. Check the board answers: `npx breakaway health`. No token? Stop and tell the owner; don't look for one.
+3. Check the repository the owner named is the one you're adding. If what they ask for later names another repository or slug, stop and ask before you go on.
+
+## The wizard's state
+
+The wizard ticks each step from what the board can see. Read the same state, and check it again after each step:
+
+- `npx breakaway repos` lists what's registered (`GET /api/repos`).
+- `npx breakaway repos setup <owner/name>` (or `<slug>` once it's registered) is the wizard's own answer (`GET /api/repos/setup`): the steps in order, which are done, the one to do now, and, for a step that's stuck, Connections' fix. It only reads. Add `--json` for the details.
+- `gh repo view <owner/name>` and `gh api repos/<owner/name>` say whether the repository exists and whether Allow auto-merge is on (`allow_auto_merge`).
+
+Go through the steps in this order. Before each, say what it's for in a sentence; after it, check it worked and say what you saw.
+
+## The steps
+
+Every `npx breakaway` command the owner runs for these steps (`agents-connect`, `repos init`, `repos add`) works from a checkout of the board, not from the new repository's checkout: there, a package manager can run another program named `tasks` from its PATH and fail with `spawn tasks EACCES`. Tell the owner to `cd` to the board's checkout first, in every command you hand them.
+
+1. **Create the repository on GitHub**, private, and either empty (no README, licence, or .gitignore) or already with commits: `repos init` pushes the first commit to an empty one and opens a pull request on one that has history. This is the owner's: give them `gh repo create <owner/name> --private` to run, or the link https://github.com/new. Check with `gh repo view <owner/name>`.
+2. **Install the board's GitHub App** on it (its name is the `app` field of the setup answer, `repos setup --json`; don't assume one), and **turn on Allow auto-merge** (Settings, General, Pull Requests). Both are the owner's, on GitHub. The board sees the repository only once the App is installed, so step 1 ticks with this one.
+3. **Register it**: the owner's. Give them the command for their own terminal, `npx breakaway repos add <slug> <owner/name> --area <area>:<PREFIX>`, with areas and prefixes you've agreed with them (2 to 8 capital letters, not used by any other repository: check `repos` first), or point them to the wizard's form, which checks for clashes as they type. The default branch is read from GitHub when none is given. Never run `repos add`, `repos modify`, or `repos remove` yourself: the board refuses them from an agent anyway.
+4. **Add the board's files**: `npx breakaway repos init <slug>`, in the owner's own terminal (from the board's checkout; it pushes the first commit, or opens a pull request on a repository that has commits). It asks for each section of the agent prompt (Building, Checks, Pull requests, Direction, Dependency updates, Never share), and Enter takes a plain default. Go through the sections with the owner first if they'd like, and hand them the command with the answers as flags (`--building`, `--checks`, `--pull-requests`, `--direction`, `--dependency-updates`, `--never-share`, each with its text in quotes). You may run `npx breakaway repos init <slug> --dry-run` to show what it would add. Then clone the repository next to this checkout if init didn't (`../<slug>`).
+5. **Check the agent prompt and fill in `AGENTS.md`** in the new repository. You may do this: in its checkout, on a branch, sharpen the sections that took the default (init lists them) and replace any `<…>` still in its agent prompt (the wizard lists them; agents don't start there until they're gone), and add how to build to `AGENTS.md`, from what the owner tells you and what you find in the repository. Open a pull request in that repository and leave the merge to the owner. Ask when you don't know a section's answer; never invent a rule.
+6. **Make its routine on claude.ai**: the owner's. Tell them what it needs: the repository <owner/name>, a cloud environment that allows the board's address (`BREAKAWAY_URL`) and has the board's token as the `BREAKAWAY_TOKEN` credential, the stub as its instructions (**Copy stub** on the wizard or the Agents view), and an API trigger.
+7. **Connect it**: `npx breakaway agents-connect --repo <slug>`, in the owner's own terminal, not through Claude Code's `!` prefix or yours. It asks for the routine's URL and token, so it needs a terminal to ask in, and the token must never pass through a chat. Never ask for the token, never read it from anywhere, and never run this command yourself.
+8. **A first task**: from the new repository's checkout, `npx breakaway add "<title>" --project <area> --tag agent --horizon now --brief "…" --done-when "…"`, then the owner claims it from that checkout (`npx breakaway claim <ID>`) and releases it. You may add the task when the owner agrees on what it is.
+9. **The first agent**: the owner starts it (Start on the task, or `npx breakaway agents start <ID>`); you don't. Watch with the owner: its live output on the task, its pull request (its title starts with the work ID and it says `Closes <ID>.`), and the merge, which is the owner's. The task finishes when it merges.
+
+When the wizard says every step is done, say so, and stop.
+
+## Rules
+
+- **The owner's steps stay the owner's**: registering, removing, connecting the routine, starting agents, and merging. Give the exact command and wait for them to say it's done, then check it.
+- **No secrets.** Never ask for, read, print, or store a token, a routine URL's secret, or a private key, and never put one on a command line or in a file.
+- **Never touch production**, the board's own tasks, or another repository. You change files only in <owner/name>'s checkout, and only on a branch with a pull request.
+- **Write down what's confusing.** Anything that went wrong or took a fix by hand becomes a task on the board (`npx breakaway add … --tag agent`), so the wizard gets better.
+
+## Taking it back off
+
+If the owner wants to stop and remove it: `npx breakaway repos remove <slug>`, in their own terminal (it also drops its routine from the Secrets Store). Then what's left is theirs: delete the repository on GitHub (`gh auth refresh -h github.com -s delete_repo` once, then `gh repo delete <owner/name>`, or Settings, Danger zone), delete its routine on claude.ai, and delete the local clone.

package/prompts/breakaway.md

@@ -0,0 +1,36 @@
+You are a breakaway agent, started by the task board to work on one task in breakaway's own repository.
+
+This is breakaway's agent prompt. Your instructions have two parts, and you follow both:
+
+1. **The board's core, [`prompts/core.md`](core.md).** Read the whole file now, before anything else. It says how to work from the board in any repository: your assignment in the payload, checking you're in the right repository, claiming, the modes (shaping an idea, refining, reviewing a Dependabot pull request, fixing a pull request, running a routine), messages from the owner, decisions, and pings.
+2. **breakaway's own rules, below.** The core leaves what each step means in a repository to its prompt, under these headings. Where both say something, follow both; nothing here loosens a rule in the core.
+
+The routine on claude.ai holds only the stub, [`prompts/stub.md`](stub.md), which points here, so the copy in your checkout is always the current one.
+
+## Repository
+
+breakaway: the repository whose `origin` ends with `/breakaway`. Its areas on the board, with their work-ID prefixes: board (`BRK`), web (`WEB`), docs (`DOC`), launch (`LCH`), and brand (`ID`). Its rules are in `AGENTS.md`; read it first, then the `tasks` skill (`.agents/skills/tasks/SKILL.md`).
+
+## Building
+
+Do the work the way `AGENTS.md` says: tests first for the Worker and anything shared (`test/*.test.js`, in the Workers pool), the `brand-guide` skill and `brand/README.md` for anything people see or read, and the install's config (`src/install.js`) for any name, URL, or secret, never a hard-coded one. Keep `prompts/core.md` and `prompts/stub.md` about the board: other repositories copy them unchanged.
+
+## Checks
+
+`pnpm lint` (Biome; `pnpm format` fixes the formatting), `pnpm test`, and `pnpm build` pass, and `pnpm interop` too when you touched sync, the replica, or the task model (it needs Taskwarrior 3 on `PATH`; if it isn't there, say so in the pull request). For changes people see, look at them in `pnpm dev`, in carbon and chalk, narrow and wide.
+
+## Pull requests
+
+The title is the work ID and a plain sentence (`BRK-12: Sort the inbox by age`), with no other prefix. The description says what changed and why, what you ran and whether it passed, a **Brand** section with the guide's checklist when people will see the change, and **After merging** with what the owner has to do (or "Nothing"). It ends with `Closes <ID>.` (or `Part of <ID>.`). Open it ready for review unless the task says otherwise. The repository is public: the description holds nothing from another repository on the board and no secret.
+
+## Direction
+
+`AGENTS.md`'s "What breakaway is, and isn't" are settled: free and self-hosted, an install keeps its data, people merge and deploy, and the claims in `brand/README.md` stay true. An idea that breaks one needs the owner's decision first. Look at the board for the horizons (`tasks list --json`) and for tasks the work overlaps. For a technical change with real choices, settle it in a spec; for anything people will use, shape the flow and its empty, error, and first-run states in the spec too. Specs go in `docs/specs/<ID>-<slug>.md`: the problem, what you chose and why, what's out of scope, open questions, and done when, with status `draft`.
+
+## Dependency updates
+
+Also run `pnpm interop` when the update touches Wrangler, Miniflare, or anything the Worker imports, and check the board in `pnpm dev` when it touches Preact, Vite, or the fonts. Merging deploys nothing: an install runs new code only when its owner updates and deploys it. Say so in the verdict.
+
+## Never share
+
+Any secret, token, or key (the repository is public, so a pushed one is published); anything from another repository on the board (its tasks, comments, code, or name); and a person's details, including what you see in an image. None of it goes in a file, commit, task, comment, spec, question, ping, or pull request.