clearotron 0.3.0-beta.2 → 0.3.0-beta.4

package/INSTALL.md

@@ -491,6 +491,25 @@ matches, the neutral Generic default applies.
 - **Your real customers live outside the repo.** Point `CLEAROTRON_CUSTOMERS_DIR` at your own private
   config store and the engine loads *those* accounts instead. **Same engine, different config path** —
   the code carries no customer identities.
+
+  Two things go with it, and both are refusals rather than preferences:
+
+  - **`PROFILE_REPO_ROOT` moves too.** The customer directory has to sit inside the repository that
+    variable names, because editing a profile is a commit. Point one somewhere new and leave the other
+    behind and the portal and the profile service both refuse to start, naming both variables.
+  - **That repository needs a `user.name` and a `user.email` of its own.** Saves are committed under
+    the name of whoever asked for them, but git also records who *made* the commit, and it will not
+    commit at all without one. A service account usually has no global git identity, so a store created
+    by hand needs its own:
+
+    ```bash
+    git init -b main /srv/clearotron-store
+    git -C /srv/clearotron-store config user.name  "clearotron local install"
+    git -C /srv/clearotron-store config user.email "clearotron@example.com"
+    ```
+
+    `clearotron start` does this for the store it creates. A store you make yourself does not get it,
+    and the symptom is the first save failing at a commit rather than anything about profiles.
 - **Run data is external too.** Published reports, audits, and per-run state go to the archive pool at
   `CLEAROTRON_REPORTS_DIR`. Nothing customer-specific is committed to the repository.
 
@@ -903,12 +922,19 @@ their own integration work.
 **Two shapes, and the line between them is what your assistant can do — not where it runs.** Ruling
 2026-09-03, on the vendor's own documented behaviour:
 
-1. **An assistant that can launch a local process** — Claude Code, Claude Desktop's local config,
-   Codex CLI, an agent that runs commands. It spawns the server over stdio. No address, no key, no
-   network, no ingress. `npx clearotron start` prints the one line to paste, and `npx clearotron
-   connect` hands it over per assistant.
-2. **Everything else, wherever it appears to run** — Cowork, ChatGPT, claude.ai, Perplexity, the mobile
-   apps. These need **a publicly reachable HTTPS address**, plus a key. Always.
+1. **Clearotron is installed on the machine the assistant runs on** — Claude's desktop app, Claude Code,
+   Codex, the ChatGPT desktop app, an agent that runs commands. The assistant spawns the server over
+   stdio. No address, no key, no network, no ingress. `npx clearotron start` prints the one line to
+   paste, and `npx clearotron connect --where here` hands it over per assistant.
+2. **Clearotron is running somewhere else** — a server, a cloud machine, anywhere the assistant is
+   not. These need **a publicly reachable HTTPS address**, plus a key made for the person connecting.
+   Always. Claude (app, web, Cowork and mobile), ChatGPT on the web, Perplexity and other agents only
+   ever connect this way; Claude Code and Codex can connect either way. `npx clearotron connect
+   --where elsewhere` makes the key and prints the steps for the assistant you name.
+
+Without `--where`, `connect` asks when both answers are possible, and `--client <name>` on its own keeps
+the answer that assistant had before: a key for Claude, the local line for Claude Code and Codex.
+`npx clearotron disconnect` takes the same `--where`.
 
 **A loopback address is never an answer for shape 2, and that is not about your network.** A remote MCP
 connector is reached **from the vendor's cloud**, never from the reader's device. Anthropic's own help

package/bin/connect.mjs

@@ -45,7 +45,7 @@ import { homedir, userInfo } from "node:os";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { createServer } from "node:net";
-import { CONNECT_CLIENTS, clientById, whatItNeeds } from "../shared/connect-clients.mjs";
+import { CONNECT_CLIENTS, WHERE_FLAG, clientById, leadRouteFor, plainStep, whatItNeeds } from "../shared/connect-clients.mjs";
 import { stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";
 import { defaultDenylistPath, clientDoorAddress, clientDoorPort, clientDoorState, enablePlan, applyEnablePlan, describeChange, recordConnectKey, CLIENT_DOOR_UNIT } from "../shared/client-door.mjs";
 import { mintToken, tokenId, resolvePerson, loadGrants } from "../shared/scope.mjs";
@@ -555,17 +555,12 @@ async function render(offer, have, { dryRun, running, allowMove = false }) {
     return 1;
   }
 
-  if (offer.route === "disk" || (offer.route === "either" && offer.command)) {
-    // A COMMAND AND A CONFIG BLOCK ARE NOT THE SAME INSTRUCTION, and saying "run this" over a TOML
-    // block is how a reader pastes four lines into a shell. The shape says which it is.
-    const s = offer.stdio;
-    say(s?.kind === "config"
-      ? `  Add this to ${s.where}:`
-      : "  Run this once, on this machine:");
+  if (offer.route === "disk") {
+    // THE ROW'S OWN STEPS, and nothing written here. A command and a settings block are not the same
+    // instruction — saying "run this" over a TOML block is how a reader pastes four lines into a shell —
+    // and the steps already say which each one is and where it goes.
+    printSteps(offer, null);
     say("");
-    for (const line of String(offer.command).split("\n")) say(`    ${line}`);
-    say("");
-    if (s?.after) { say(`  ${s.after}`); say(""); }
     say(`  ${offer.note}`);
     return 0;
   }
@@ -621,22 +616,40 @@ async function render(offer, have, { dryRun, running, allowMove = false }) {
   }
 
   say(`  Address:  ${offer.address}`);
-  if (key) say(`  Key:      ${key}`);          // printed once, stored nowhere
-  // ── AND WHERE TO PUT THEM ( — F35) ───────────────────────────────────────
-  //
-  // The owner was left with two strings and no destination: *"I don't know how to connect it in Claude
-  // Cowork with those details."* The steps were DEFINED IN THE PRODUCT the whole time — `withSteps`
-  // computes them for every offer, interpolating this install's own address and operator — and this
-  // verb simply never printed them. Nothing new is authored here; a second set of instructions written
-  // at the CLI would drift from the page's, which is the defect connect-clients-are-data exists against.
+  // Printed once, stored nowhere — and only here when no step hands it over. A step whose copy carries
+  // the key prints it inside the line the reader pastes, which is the one place it is needed.
+  const keyInSteps = (offer.steps ?? []).some((s) => s.copy?.kind === "secret");
+  if (key && !keyInSteps) say(`  Key:      ${key}`);
+  printSteps(offer, key);
+  say("");
+  say(`  ${offer.note}`);
+  return 0;
+}
+
+/**
+ * The offer's own steps, numbered, with each copy printed under the step that hands it over.
+ *
+ * ── AND WHERE TO PUT THEM ( — F35) ───────────────────────────────────────
+ *
+ * The owner was left with two strings and no destination: *"I don't know how to connect it in Claude
+ * Cowork with those details."* The steps were DEFINED IN THE PRODUCT the whole time and this verb simply
+ * never printed them. Nothing is authored here; a second set of instructions written at the CLI would
+ * drift from the page's, which is the defect connect-clients-are-data exists against. A secret copy is
+ * printed with the key this press minted put in its slot — the page does the same substitution into the
+ * clipboard — and with no key (a dry run) the step prints and its copy does not.
+ */
+function printSteps(offer, key) {
   if (offer.steps?.length) {
     say("");
     say(`  In ${offer.client?.name ?? "your assistant"}:`);
-    offer.steps.forEach((step, n) => say(`    ${n + 1}. ${step}`));
+    offer.steps.forEach((step, n) => {
+      say(`    ${n + 1}. ${plainStep(step.text)}`);
+      const c = step.copy;
+      const text = !c ? null : c.kind === "secret" ? (key ? c.template.split(c.slot).join(key) : null) : c.text;
+      if (text) { say(""); for (const line of text.split("\n")) say(`         ${line}`); say(""); }
+      if (step.hint) say(`       ${plainStep(step.hint)}`);
+    });
   }
-  say("");
-  say(`  ${offer.note}`);
-  return 0;
 }
 
 async function main() {
@@ -654,6 +667,9 @@ async function main() {
     say("  not about you.");
     say("");
     say("    --client <name>   skip the question (see --list for the names)");
+    say("    --where here      your assistant runs on this machine: it starts the software itself");
+    say("    --where elsewhere your assistant runs somewhere else and reaches this install over the");
+    say("                      internet, with a key made for you now");
     say("    --list            the assistants this build knows");
     say("    --dry-run         say what would change, change nothing");
     say("    --allow-checkout-move");
@@ -663,7 +679,7 @@ async function main() {
     say("");
     return 0;
   }
-  const known = new Set(["--client", "--list", "--dry-run", "--allow-checkout-move", "--help", "-h"]);
+  const known = new Set(["--client", "--where", "--list", "--dry-run", "--allow-checkout-move", "--help", "-h"]);
   const unknown = argv.filter((a) => a.startsWith("--") && !known.has(a));
   if (unknown.length) {
     console.error(`connect: unrecognised flag(s): ${unknown.join(", ")}`);
@@ -671,6 +687,12 @@ async function main() {
     process.exit(2);
   }
   const dryRun = argv.includes("--dry-run");
+  const w = argv.indexOf("--where");
+  if (w >= 0 && !Object.hasOwn(WHERE_FLAG, argv[w + 1] ?? "")) {
+    console.error(`connect: --where takes one of: ${Object.keys(WHERE_FLAG).join(", ")}`);
+    process.exit(2);
+  }
+  let route = w >= 0 ? WHERE_FLAG[argv[w + 1]] : null;
   // F40 — reason about the RUNNING product from the units' own environment, not this CLI's env file.
   const running = runningEnv();
   const have = deploymentHas(running.env);
@@ -712,9 +734,30 @@ async function main() {
       chosen = CONNECT_CLIENTS[Number(answer) - 1] ?? clientById(answer);
     } finally { rl.close(); }
     if (!chosen) { console.error("connect: not one of the listed assistants."); process.exit(2); }
+    // THE SECOND QUESTION, ASKED ONLY WHEN IT HAS TWO ANSWERS — the page's own, in the terminal's words.
+    // Where only one route is served here, asking would offer a choice whose other half cannot work.
+    const both = ["disk", "public-http"].filter((r) => whatItNeeds(chosen, have, r)?.served);
+    if (!route && both.length > 1) {
+      say("");
+      say("  Where does it run?");
+      say("");
+      say("    1) On this machine — it starts the software itself, nothing to open up");
+      say("    2) Somewhere else — it reaches this install over the internet, with a key made for you now");
+      say("");
+      const rl2 = createInterface({ input: stdin, output: stdout });
+      try {
+        const answer = (await rl2.question("  1-2: ")).trim();
+        route = answer === "1" ? "disk" : answer === "2" ? "public-http" : null;
+      } finally { rl2.close(); }
+      if (!route) { console.error("connect: answer 1 or 2."); process.exit(2); }
+    }
+    route ??= both[0] ?? chosen.lead;
   }
 
-  return await render(whatItNeeds(chosen, have), have, { dryRun, running, allowMove: argv.includes("--allow-checkout-move") });
+  // NAMED WITHOUT --where: the route this id had before every row took both, so a scripted
+  // `--client cowork` still mints a key and `--client codex` still prints a settings block.
+  route ??= leadRouteFor(argv[i + 1]);
+  return await render(whatItNeeds(chosen, have, route), have, { dryRun, running, allowMove: argv.includes("--allow-checkout-move") });
 }
 
 // THE DISPATCH RUNS ONLY WHEN THIS FILE IS THE COMMAND. Without the guard, importing

package/bin/disconnect.mjs

@@ -57,7 +57,7 @@ import { stdin, stdout } from "node:process";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, appendFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir, userInfo } from "node:os";
-import { CONNECT_CLIENTS, clientById } from "../shared/connect-clients.mjs";
+import { CONNECT_CLIENTS, WHERE_FLAG, clientById, leadRouteFor } from "../shared/connect-clients.mjs";
 import { defaultDenylistPath, disablePlan, revokeEveryonePlan, applyDisablePlan, describeClosure, recordedKeysFor, removeRecordedKeys } from "../shared/client-door.mjs";
 import { loadGrants } from "../shared/scope.mjs";
 import { envFrom } from "../shared/env-aliases.mjs";
@@ -83,6 +83,8 @@ async function main() {
     say("  `clearotron grant` manages that.");
     say("");
     say("    --client <name>   which assistant you connected (see --list for the names)");
+    say("    --where here|elsewhere");
+    say("                      how you connected it: on this machine, or over the internet with a key");
     say("    --list            the assistants this build knows");
     say("    --everyone        the admin act: revoke EVERY issued key on this install. It says");
     say("                      how many keys and how many people that is before doing it.");
@@ -90,7 +92,7 @@ async function main() {
     say("");
     return 0;
   }
-  const known = new Set(["--client", "--list", "--dry-run", "--everyone", "--help", "-h"]);
+  const known = new Set(["--client", "--where", "--list", "--dry-run", "--everyone", "--help", "-h"]);
   const unknown = argv.filter((a) => a.startsWith("--") && !known.has(a));
   if (unknown.length) {
     console.error(`disconnect: unrecognised flag(s): ${unknown.join(", ")}`);
@@ -137,18 +139,21 @@ async function main() {
   say(`  ${chosen.name}`);
   say("");
 
-  // The row's own property decides the side. `accepts: "stdio"` never touched this install; "either"
-  // only opens the door when its stdio route was missing, and on THIS box (the one disconnect runs on)
-  // the stdio route resolves, so its connect handed over a command too.
-  if (chosen.accepts === "stdio" || chosen.accepts === "either") {
+  // THE ROUTE DECIDES THE SIDE, not the assistant: every row takes both now. Connected on this machine,
+  // it never touched this install; connected over the internet, it holds a key and the key is what goes.
+  // Unnamed, the route is the one `connect` gives the same id unnamed, so the two verbs pair up.
+  const w = argv.indexOf("--where");
+  if (w >= 0 && !Object.hasOwn(WHERE_FLAG, argv[w + 1] ?? "")) {
+    console.error(`disconnect: --where takes one of: ${Object.keys(WHERE_FLAG).join(", ")}`);
+    process.exit(2);
+  }
+  const route = w >= 0 ? WHERE_FLAG[argv[w + 1]] : (i >= 0 ? leadRouteFor(argv[i + 1]) : chosen.lead);
+  if (route === "disk") {
     say("  Connecting this assistant changed nothing on this install — it runs the software itself,");
     say("  from the configuration you added on its side. To disconnect it, remove that entry in the");
     say("  assistant's own settings.");
-    if (chosen.accepts === "either") {
-      say("");
-      say("  If you connected it by address instead, the door and key are shared — disconnect the");
-      say("  assistant you named when the door was opened, and the closure covers this one too.");
-    }
+    say("");
+    say("  If you connected it over the internet instead, run this again with --where elsewhere.");
     return 0;
   }
 

package/bin/onboard.mjs

@@ -97,7 +97,7 @@ import { processTable } from "../shared/process-table.mjs";   // — /proc is no
 import { programsFromAnotherCheckout } from "../shared/checkout-move.mjs";
 import { entrypointOf } from "../driver/systemd/install-census.mjs";         // one ExecStart parser
 import { overlayReport, renderOverlayReport } from "../shared/doctrine-overlay.mjs";   // — the doctor reports the overlay
-import { whereSavesGo } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed
+import { whereSavesGo, storeCommitRefusal, storeInRepo, storeOutsideRepoMessage, resolveStoreRepoRoot } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed, and why saved searches are off
 import { engineInventory, engineMode, ENGINE_MODES } from "../driver/config-inventory.mjs";   //
 import { probeEngineTurn, probeFailureText, PROBE_MODEL, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
 import { runRequiredNames, missingRequirements, REGISTER_ENV, ENGINE_ENV } from "../driver/run-requirements.mjs";   // the order-time gate's own question, asked here rather than restated
@@ -1799,6 +1799,41 @@ export async function runCheck() {
     }
   }
 
+  // — SAVED SEARCHES, JUDGED BY THE RULE THE PORTAL APPLIES WHEN IT STARTS. The portal switches them off,
+  // and answers every saved-search route "not found", when the store is unset or sits outside the
+  // repository its saves are committed in. Its boot log said so and nothing an operator runs did, so an
+  // install whose Custom searches could never load passed this command. Same resolver, same containment
+  // check, read from the services' environment for the reason the roster lines give; when that could not
+  // be read, the lines above already said so and nothing is judged here. A store that is configured but
+  // holds a file that cannot be read fails every company's saved searches, in the portal and the
+  // connector alike, so that is read here too.
+  if (!hosted || serviceKnown) {
+    const recipesSet = hosted ? effectiveForService("CLEAROTRON_RECIPES_DIR") : effective("CLEAROTRON_RECIPES_DIR");
+    const recipesDir = recipesSet?.v || null;
+    if (!recipesDir) {
+      info("saved searches are off: CLEAROTRON_RECIPES_DIR is not set, so Custom searches in the portal and the "
+        + "connector offer none. Name a directory inside a git repository to switch them on");
+    } else {
+      // Layered as effectiveForService layers it — this command's environment over the services' file — so
+      // the repository root is read from the same place the store directory above was.
+      const storeEnv = { ...(serviceFileEnv ?? {}), ...process.env };
+      const resolved = resolveStoreRepoRoot({ names: ["RECIPE_REPO_ROOT", "PROFILE_REPO_ROOT"], fallback: REPO, env: storeEnv });
+      const reach = storeInRepo(recipesDir, resolved.root);
+      if (!reach.ok) {
+        warn(`saved searches are OFF: ${storeOutsideRepoMessage({ storeVar: "CLEAROTRON_RECIPES_DIR", storeDir: reach.store, repoVar: "RECIPE_REPO_ROOT", repoRoot: reach.repo })} `
+          + `The repository came from ${resolved.from}. Until this is fixed the portal answers every saved-search request as not found`);
+      } else {
+        const { loadRecipes } = await import("../driver/search-policy.mjs");
+        let unreadable = null;
+        try { loadRecipes({ dir: recipesDir, force: true }); } catch (e) { unreadable = String(e?.message ?? e).split("\n")[0]; }
+        if (unreadable) {
+          warn(`saved searches cannot be read from ${recipesDir}: ${unreadable}. Every company's saved searches fail `
+            + "to load, in the portal and the connector, until that file is fixed");
+        } else ok(`saved searches are read from ${recipesDir}, and saves are committed in ${reach.repo}`);
+      }
+    }
+  }
+
   // — WHICH DOCTRINE FILES THIS INSTALL OVERRIDES, AND WHETHER OURS HAVE MOVED UNDER THEM.
   //
   // The report itself shipped in and worked, reachable only as `npm run doctrine-report` — a name
@@ -1846,7 +1881,21 @@ export async function runCheck() {
   }
 
   say("\n  Register provider");
-  const prov = effective("CLEAROTRON_DATABASE");
+  // WHAT THE SERVICES WILL SEARCH, READ AS THE ORDER-TIME CHECK BELOW READS IT. This section asked the
+  // shell and this command's .env, so in a fresh terminal on a hosted box it told a working install that
+  // no register was selected, one screen above "nothing a search is refused for is missing from the units'
+  // environment": one install, two answers, and the fix it named was already set. effectiveForService is
+  // the reader that check asks, so the two lines cannot disagree; where it cannot read the units, this
+  // says it could not look rather than reporting the register absent.
+  // Only a HOSTED box has a second environment to read; with no units, the services are started from
+  // this command's own file, and `effective` has always read and labelled exactly that.
+  const serviceValue = hosted ? effectiveForService : effective;
+  const prov = serviceKnown ? serviceValue("CLEAROTRON_DATABASE") : null;
+  if (!serviceKnown) {
+    info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
+      + "which register the services search, and whether its keys are set, is not judged here: a failure to look, not a finding");
+  }
+  else
   // `blocking`, not `warn` and not `problem`. The exit status is a CONTRACT — an absence reports and
   // exits 0, a misconfiguration exits 1, and onboard-wizard.test.mjs holds it — so this cannot become a
   // `problem` however much it stops the reader: an install that has not chosen a register yet is
@@ -1865,7 +1914,7 @@ export async function runCheck() {
     else {
       ok(`${spec.id} — ${spec.label} (${prov.from})`);
       for (const k of spec.credentials) {
-        const c = effective(k);
+        const c = serviceValue(k);
         // issue 1871 — SET, not WORKING, and the line now says which. An operator reads a tick as "this
         // works"; this one is equally true of a valid key, an expired key, a key scoped to the wrong
         // account and forty characters of nonsense. --probe-providers is what settles it.
@@ -1876,7 +1925,7 @@ export async function runCheck() {
       // and never as a problem, but never silently either: the reader has to know which offices this
       // box will not reach before they read a report that says nothing was found there.
       for (const k of spec.optionalCredentials ?? []) {
-        const c = effective(k);
+        const c = serviceValue(k);
         if (c) ok(`${k} present (${c.from}) — presence only; add --probe-providers to prove it retrieves`);
         else info(`${k} is NOT set — ${spec.id} will run without it and DISCLOSE the offices it cannot reach as deferred coverage. Set it to search them.`);
       }
@@ -1884,8 +1933,10 @@ export async function runCheck() {
   }
 
   say("\n  Research provider");
-  const px = effective("PERPLEXITY_API_KEY");
-  if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
+  // The same reader as the register, for the same reason: this is a key the services use.
+  const px = serviceKnown ? serviceValue("PERPLEXITY_API_KEY") : null;
+  if (!serviceKnown) info("the units' environment could not be read, so whether the services hold PERPLEXITY_API_KEY is not judged here — a failure to look, not a finding");
+  else if (px) ok(`PERPLEXITY_API_KEY present (${px.from}) — presence only; add --probe-providers to prove it answers`);
   else info("PERPLEXITY_API_KEY is not set — the three clearance searches carry the common-law grid and cannot switch it off, so a clearance stops before it starts, and names the missing key; a Knockout search still runs and discloses the half it skipped");
 
   // ── — THE LANES A PRODUCT DECLARES IT NEEDS, BEFORE A REPORT NAMES THEM ──
@@ -3644,6 +3695,14 @@ try {
   candidate["CLEAROTRON_CUSTOMERS_DIR"] = join(cfg, "profiles");
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
+  // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
+  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
+  // unless somebody set it, and on a machine with no global identity the first company created in the
+  // portal is refused. Said here, with the command, rather than discovered on that first company.
+  if (existsSync(join(cfgAbs, ".git"))) {
+    const cannot = storeCommitRefusal(cfgAbs);
+    if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);
+  }
 
   // CLEAROTRON_INSTRUCTIONS_DIR IS DELIBERATELY NOT WRITTEN (found in review).
   //

package/bin/start.mjs

@@ -109,7 +109,7 @@ async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
 import { mergeEnvFile } from "../shared/env-file-merge.mjs";
 import { mcpOriginFor } from "../shared/lane-address.mjs";   // — one author for the origin
@@ -1252,6 +1252,12 @@ if (isMain) {
       // search is what will fail.
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
+  } else {
+    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
+    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
+    // the first company created in the portal is then refused. The one created above sets its own.
+    const cannot = storeCommitRefusal(paths.configStore);
+    if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
 
   // ── THE DEMO'S OWN STORE, WITH ITS COMPANY IN IT ────────────────────────────────────────────────

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f24d87c471bd3073f3a56dbf0edff39d1a640175",
-  "version": "0.3.0-beta.2"
+  "commit": "0fb023f5822c9458f9c63bf993876c3a3a8053e3",
+  "version": "0.3.0-beta.4"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,43 @@
 # clearotron-driver
 
+## 0.3.0-beta.4
+
+### Minor Changes
+
+- a9f5375: New: Use your own AI asks first where Clearotron is running, then shows the steps for your app beside the list. The same five apps are offered either way.
+  
+  New: Claude Code and Codex can connect to an installation running elsewhere, and the ChatGPT desktop app to one on the same machine.
+  
+  Fixed: Codex was told to paste a settings block into a terminal. Its steps now name the file the block goes in.
+  
+  For operators: `clearotron connect` and `clearotron disconnect` take `--where here` or `--where elsewhere`. Assistant names used before, such as `cowork`, still work.
+
+### Patch Changes
+
+- a9f5375: New: the company switcher in the sidebar ends with `+ New company`. Making a company is now one click from every screen, whether or not a company is selected.
+
+## 0.3.0-beta.3
+
+### Patch Changes
+
+- a782aad: Fixed: Creating a company is refused, with nothing left behind, when the configuration store cannot record it. The company used to be created anyway, with no record of who made it or when, and its organisation was given access to it.
+  
+  A store with no git identity is the usual cause on a new machine, and the refusal names the command that fixes it. Setup and `clearotron start` now check a store they adopt for this straight away.
+- d1ef225: Fixed: A stage stopped at its time limit now records the output it actually produced. It used to record a small fraction, so a stage that was working read as one that had stalled.
+  
+  The token totals `clearotron tokens` reports for runs with a stopped stage now include that output.
+- 0ff42d1: Fixed: `clearotron doctor` now says when saved searches are switched off and why, and when a saved search file cannot be read.
+  
+  An assistant asking for saved searches is told when they could not be read, instead of being told there are none.
+- a782aad: Fixed: `clearotron doctor` reports the register and the research key the background services will use, read from the file they read. Run from a new terminal, it used to say no register was selected on an install whose searches were running.
+- 0ff42d1: Fixed: Global config appears in the account menu only for people who can open it. Someone managing one organisation used to be offered it, and the page then said it was not available.
+  
+  Clearances and People no longer ask for installation-wide data that a manager of one organisation cannot see.
+- a782aad: Fixed: A clearance or knockout searched through Compumark now links each register record to the trade mark office's own page for it. Those records used to show an internal reference nobody could open.
+  
+  The offices linked are the United States, the European Union, the United Kingdom, Canada, Australia, Switzerland, France, Norway, Sweden and WIPO. A record from any other office is cited by its number, and the report says why once, under the findings.
+- a782aad: Fixed: Saved searches work on a fresh install and in the demo, for every company, Generic included. They used to fail to load for every company, with a message saying to try again shortly.
+
 ## 0.3.0-beta.2
 
 ### Minor Changes

package/driver/driver.config.mjs

@@ -1110,6 +1110,11 @@ export const PROVIDERS = {
           office: row?.office ?? null,
           application_date: row?.application_date ?? null,
           registration_date: row?.registration_date ?? null,
+          // The office's own numbers: publish addresses the filing at the office's page from these, the
+          // way it does for this register's clearance findings. Compumark states no filing route or IR
+          // number of its own, so a Madrid designation is addressed as the national filing it is listed as.
+          application_number: row?.application_number ?? null,
+          registration_number: row?.registration_number ?? null,
           // hasPublicRecordUrl:false on this provider — there is no per-record page to link, and a
           // fabricated one would be worse than none.
           record_url: null,

package/driver/engine/anthropic-agent.mjs

@@ -467,19 +467,32 @@ export const anthropicAgentEngine = {
       let rateLimitEvent = null;   // a 429 session-cap rejection rides a `rate_limit_event` (status:"rejected" + resetsAt)
       // Streamed-usage accumulator: what the turn PROVABLY moved, observed from the stream itself, so a
       // killed turn is never journalled as usage:null when millions of tokens moved (the "137 + usage:null
-      // ⇒ mislabelled transient/lane-wedge" class). Per completed API call the `assistant` event's usage is
-      // authoritative (summed); an in-flight call contributes its `message_start` usage + the latest
-      // `message_delta` output count until its own assistant event supersedes them (no double count).
-      const streamTotals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-      let pendingStart = null, pendingDeltaOut = 0;
+      // ⇒ mislabelled transient/lane-wedge" class).
+      //
+      // KEYED BY MESSAGE, AND EACH FIELD IS THE LARGEST READING SEEN FOR THAT MESSAGE. One API call's usage
+      // reaches the stream several times: on `message_start`, on every `assistant` event (one per content
+      // block), and on its `message_delta`, whose output count is the call's own running total. Summing the
+      // assistant events counted a call's input and cache once per block and its output at whatever it
+      // was when the block went out, and dropping the delta lost the rest: a turn killed after 75 calls
+      // journalled 810 output tokens. Which event carries the final count need not be known here, and the
+      // order is inferred rather than recorded, so every reading is kept and the largest wins. A delta names
+      // no message, so it belongs to the one its last `message_start` opened; an assistant event with no id
+      // and no open message is a call of its own, as it always was.
+      const perMessage = new Map();
+      let openMessage = null, anonMessages = 0;
+      const foldUsage = (key, u) => {
+        if (!u) return;
+        const was = perMessage.get(key);
+        perMessage.set(key, was
+          ? { input: Math.max(was.input, u.input), output: Math.max(was.output, u.output),
+              cacheRead: Math.max(was.cacheRead, u.cacheRead), cacheWrite: Math.max(was.cacheWrite, u.cacheWrite) }
+          : { input: u.input, output: u.output, cacheRead: u.cacheRead, cacheWrite: u.cacheWrite });
+      };
       const streamedUsage = () => {
-        const p = mapUsage(pendingStart) ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-        const u = {
-          input: streamTotals.input + p.input,
-          output: streamTotals.output + p.output + pendingDeltaOut,
-          cacheRead: streamTotals.cacheRead + p.cacheRead,
-          cacheWrite: streamTotals.cacheWrite + p.cacheWrite,
-        };
+        const u = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+        for (const m of perMessage.values()) {
+          u.input += m.input; u.output += m.output; u.cacheRead += m.cacheRead; u.cacheWrite += m.cacheWrite;
+        }
         u.total = u.input + u.output + u.cacheRead + u.cacheWrite;
         return u.total > 0 ? u : null;   // zero observed movement stays null — a never-admitted turn must keep classifying as a lane wedge
       };
@@ -703,9 +716,9 @@ export const anthropicAgentEngine = {
             periodStart = now; periodChunk = chunkSeq;
           }
           syncOpenAsk();
-          const u = mapUsage(ev.message?.usage);
-          if (u) { streamTotals.input += u.input; streamTotals.output += u.output; streamTotals.cacheRead += u.cacheRead; streamTotals.cacheWrite += u.cacheWrite; }
-          pendingStart = null; pendingDeltaOut = 0;   // this call's usage is now authoritative — drop its partials
+          // This block's usage, folded into its own call: the largest reading wins, so a block's early count
+          // never replaces the delta's running total, and a second block of the same call adds nothing twice.
+          foldUsage(ev.message?.id ?? openMessage ?? `__assistant_${++anonMessages}`, mapUsage(ev.message?.usage));
           progress();
         }
         else if (ev.type === "user") {
@@ -737,8 +750,12 @@ export const anthropicAgentEngine = {
         }
         else if (ev.type === "stream_event") {
           const t = ev.event?.type;
-          if (t === "message_start") { pendingStart = ev.event.message?.usage ?? null; progress(); }
-          else if (t === "message_delta") { const o = Number(ev.event?.usage?.output_tokens); if (o > 0) pendingDeltaOut = o; progress(); }
+          if (t === "message_start") {
+            openMessage = ev.event.message?.id ?? `__start_${++anonMessages}`;
+            foldUsage(openMessage, mapUsage(ev.event.message?.usage));
+            progress();
+          }
+          else if (t === "message_delta") { foldUsage(openMessage ?? "__delta_without_start", mapUsage(ev.event?.usage)); progress(); }
           else if (t === "content_block_delta" || t === "content_block_start") progress();
           // THINKING GAUGE (partials): the earliest tells. Any one is sufficient; belt-and-braces so a
           // display-mode or CLI-version change cannot silently blind the gauge.