cloving 1.0.1 → 1.1.0

package/dist/src/cli/commands.js

@@ -1,8 +1,8 @@
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { record, } from "../protocol.js";
-import { follow, mutate, send } from "./client.js";
-import { errorText, eventText, pendingSummary, rendered } from "./render.js";
+import { follow, listRuns, mutate, send } from "./client.js";
+import { errorText, eventText, pendingSummary, rendered, runOverview, statusJson, } from "./render.js";
 import { commandUsage } from "./usage.js";
 import { defaultWatchPort, watchServer } from "./watch-server.js";
 function errorObject(error, format) {
@@ -39,7 +39,9 @@ function presented(environment, outcome) {
     const { reply, format } = outcome;
     if (reply.kind === "error")
         return failed(environment, { error: reply.error, format });
-    environment.terminal.out(format.json ? `${JSON.stringify(reply.result)}\n` : rendered(reply.result));
+    environment.terminal.out(format.json
+        ? `${JSON.stringify(statusJson(reply.result))}\n`
+        : rendered(reply.result));
     return 0;
 }
 async function requested(environment, exchange) {
@@ -135,6 +137,15 @@ async function status(environment, invocation) {
     const { runId, limit, after, json } = invocation;
     if (!json && runId === null)
         await summarized(environment);
+    if (!json && runId === null && limit === null && after === null) {
+        const reply = await listRuns(environment.runtimeDirectory);
+        return presented(environment, {
+            format: { json },
+            reply: reply.kind === "result"
+                ? { kind: "result", result: runOverview(reply.result) }
+                : reply,
+        });
+    }
     return requested(environment, {
         format: { json },
         request: {
@@ -235,14 +246,7 @@ function located(invocation, environment) {
     if (invocation.kind === "events")
         return events(environment, invocation);
     if (invocation.kind === "watch")
-        return watchServer({
-            runtimeDirectory: environment.runtimeDirectory,
-            port: invocation.port ?? defaultWatchPort,
-            client: environment.client ?? "cloving",
-            announce: environment.terminal.out,
-            complain: environment.terminal.error,
-            stopped: environment.interrupted(),
-        });
+        return watch(environment, invocation);
     return requested(environment, {
         format: { json: invocation.json },
         request: {
@@ -251,3 +255,17 @@ function located(invocation, environment) {
         },
     });
 }
+function watch(environment, invocation) {
+    return watchServer({
+        actions: environment.watchActions ?? "on",
+        ...(environment.watchPr === undefined
+            ? {}
+            : { pullRequests: environment.watchPr }),
+        runtimeDirectory: environment.runtimeDirectory,
+        port: invocation.port ?? defaultWatchPort,
+        client: environment.client ?? "cloving",
+        announce: environment.terminal.out,
+        complain: environment.terminal.error,
+        stopped: environment.interrupted(),
+    });
+}

package/dist/src/cli/main.d.ts

@@ -1 +1,2 @@
-export declare function main(argumentsList: readonly string[]): Promise<void>;
+import type { WatchPrSettings } from "./watch-pr-settings.ts";
+export declare function main(argumentsList: readonly string[], watchPr?: WatchPrSettings): Promise<void>;

package/dist/src/cli/main.js

@@ -1,34 +1,43 @@
 import { randomUUID } from "node:crypto";
 import packageMetadata from "#package" with { type: "json" };
+import { redactImport } from "../chats/redact-import.js";
+import { emptyCounts } from "../chats/redaction.js";
 import { importChats } from "../chats/import.js";
 import { parseInvocation } from "./arguments.js";
 import { runtimeCommand } from "./commands.js";
 import { clientCommand, runtimeDirectory } from "./runtime-directory.js";
-import { chatsImportUsage, usage, validateUsage } from "./usage.js";
+import { chatsRedactUsage, chatsImportUsage, usage, validateUsage, } from "./usage.js";
 import { validateWorkflow } from "./validate.js";
-export async function main(argumentsList) {
+const helpTexts = {
+    help: usage,
+    version: `${packageMetadata.version}\n`,
+    "validate-help": validateUsage,
+    "chats-import-help": chatsImportUsage,
+    "chats-redact-help": chatsRedactUsage,
+};
+function helpInvocation(invocation) {
+    return Object.hasOwn(helpTexts, invocation.kind);
+}
+export async function main(argumentsList, watchPr) {
     const invocation = parseInvocation(argumentsList);
+    if (refuseChatPlatform(invocation))
+        return;
+    if (helpInvocation(invocation)) {
+        process.stdout.write(helpTexts[invocation.kind]);
+        return;
+    }
     if (invocation.kind === "usage-error") {
         presentUsageError(invocation);
     }
     else if (invocation.kind === "validate") {
         await validationCommand(invocation);
     }
-    else if (invocation.kind === "version") {
-        process.stdout.write(`${packageMetadata.version}\n`);
-    }
-    else if (invocation.kind === "help") {
-        process.stdout.write(usage);
-    }
-    else if (invocation.kind === "validate-help") {
-        process.stdout.write(validateUsage);
-    }
-    else if (invocation.kind === "chats-import-help") {
-        process.stdout.write(chatsImportUsage);
+    else if (invocation.kind === "chats-redact") {
+        await redactionCommand(invocation.importId);
     }
     else if (invocation.kind === "chats-import") {
         const result = await importChats({
-            paths: invocation.paths,
+            ...invocation,
             workingDirectory: process.cwd(),
             runtimeDirectory: runtimeDirectory(process.env),
         });
@@ -38,6 +47,10 @@ export async function main(argumentsList) {
     else {
         process.exitCode = await runtimeCommand(invocation, {
             runtimeDirectory: runtimeDirectory(process.env),
+            ...(process.env["CLOVING_WATCH_ACTIONS"] === undefined
+                ? {}
+                : { watchActions: process.env["CLOVING_WATCH_ACTIONS"] }),
+            ...(watchPr === undefined ? {} : { watchPr }),
             client: clientCommand(process.env),
             workingDirectory: process.cwd(),
             terminal: {
@@ -54,6 +67,16 @@ export async function main(argumentsList) {
         });
     }
 }
+function refuseChatPlatform(invocation) {
+    if (process.platform === "darwin")
+        return false;
+    if (invocation.kind !== "chats-import" && invocation.kind !== "chats-redact")
+        return false;
+    process.stdout.write(`${JSON.stringify({ code: "platform-unsupported" })}\n`);
+    process.stderr.write("platform-unsupported: Chat commands require macOS.\n");
+    process.exitCode = 1;
+    return true;
+}
 function presentUsageError(invocation) {
     if (invocation.json)
         process.stdout.write(`${JSON.stringify({ schemaVersion: 1, kind: "usage-error", code: invocation.code })}\n`);
@@ -78,3 +101,27 @@ function present(report, format) {
     for (const error of report.errors)
         process.stderr.write(`${error.code}: ${error.file}: ${error.detail}\n`);
 }
+async function redactionCommand(importId) {
+    let privateTexts = [];
+    try {
+        const setting = process.env["CLOVING_PRIVATE_TEXTS"];
+        if (setting !== undefined)
+            privateTexts = JSON.parse(setting);
+        if (!Array.isArray(privateTexts) ||
+            !privateTexts.every((item) => typeof item === "string" && item.trim() !== ""))
+            throw new Error("invalid-settings");
+    }
+    catch {
+        process.stdout.write(`${JSON.stringify({ code: "invalid-settings", importId, recordCount: 0, counts: emptyCounts(), totalCount: 0 })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const result = await redactImport({
+        importId,
+        workingDirectory: process.cwd(),
+        runtimeDirectory: runtimeDirectory(process.env),
+        settings: { home: process.env["HOME"] || null, privateTexts },
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.code === "redaction-complete" ? 0 : 1;
+}

package/dist/src/cli/render.d.ts

@@ -1,5 +1,7 @@
 import { type Fields } from "../protocol.ts";
 export declare function errorText(error: Fields): string;
+export declare function runOverview(result: Fields): Fields;
+export declare function statusJson(result: Fields): Fields;
 export declare function runStatus(result: Fields): readonly string[];
 export declare function decisionLines(decision: unknown): readonly string[];
 export declare function decisionList(result: Fields): readonly string[];

package/dist/src/cli/render.js

@@ -1,3 +1,4 @@
+import { priceText, usageText, totalsSuffix } from "./usage-render.js";
 import { record } from "../protocol.js";
 function show(value) {
     return typeof value === "string" ? value : JSON.stringify(value);
@@ -58,13 +59,38 @@ function admitted(result) {
 function runLine(run) {
     return `  ${show(part(run, "runId"))}  ${show(part(run, "workflowId"))}  ${show(part(run, "condition"))}  revision ${show(part(run, "revision"))}  latest at ${show(part(run, "latestAt") ?? "none")}`;
 }
+function ended(run) {
+    return ["completed", "failed", "cancelled"].includes(show(run["state"]));
+}
+function newest(first, second) {
+    return show(second["latestAt"] ?? "").localeCompare(show(first["latestAt"] ?? ""));
+}
+export function runOverview(result) {
+    const listed = result["runs"];
+    const runs = Array.isArray(listed)
+        ? listed.map(record).filter((run) => run !== undefined)
+        : [];
+    const active = runs.filter((run) => !ended(run)).toSorted(newest);
+    const finished = runs.filter(ended).toSorted(newest);
+    return {
+        ...result,
+        runs: [...active, ...finished.slice(0, 20)],
+        hiddenRuns: Math.max(0, finished.length - 20),
+    };
+}
 function runList(result) {
     const runs = result["runs"];
     const lines = Array.isArray(runs) ? runs.map(runLine) : [];
+    const hiddenRuns = result["hiddenRuns"];
     return [
         `Workflows: ${visible(listing(result["workflows"]))}`,
         "Runs:",
         ...(lines.length === 0 ? ["  none"] : lines),
+        ...(typeof hiddenRuns === "number" && hiddenRuns > 0
+            ? [
+                `${String(hiddenRuns)} older runs: use --limit and --after to see them`,
+            ]
+            : []),
     ];
 }
 function observation(value) {
@@ -82,17 +108,57 @@ function outcome(value) {
     const kind = visible(part(value, "kind"));
     return typeof reason === "string" ? `${kind}: ${visible(reason)}` : kind;
 }
+function workerLines(value) {
+    return (Array.isArray(value) ? value : []).flatMap((turn) => [
+        `Worker turn ${visible(part(turn, "operationId"))}: ${priceText(part(turn, "costUsd"), part(turn, "estimatedCostUsd"))}`,
+        `  ${usageText(part(turn, "usage"))}`,
+    ]);
+}
+export function statusJson(result) {
+    const run = record(result["run"]);
+    if (result["kind"] !== "run-status" || run === undefined)
+        return result;
+    const turns = run["workerTurns"];
+    return {
+        ...result,
+        run: {
+            ...run,
+            costDisplay: priceText(run["claudeCostUsd"], run["estimatedCostUsd"]),
+            ...(Array.isArray(turns)
+                ? {
+                    workerTurns: turns.map((turn) => {
+                        const fields = record(turn);
+                        if (fields === undefined)
+                            return turn;
+                        return {
+                            ...fields,
+                            costDisplay: priceText(fields["costUsd"], fields["estimatedCostUsd"]),
+                        };
+                    }),
+                }
+                : {}),
+        },
+    };
+}
 export function runStatus(result) {
     const run = result["run"];
     const reason = part(run, "reason");
     const recovery = part(run, "recovery");
     const at = part(run, "nextActionAt") ?? null;
-    const cost = part(run, "claudeCostUsd");
+    const suffix = totalsSuffix(part(run, "state"));
     return [
         `Run ${show(part(run, "runId"))} (${show(part(run, "workflowId"))})`,
         `Title: ${visible(part(run, "title") ?? "none")}`,
         `State: ${show(part(run, "state"))}`,
         `Outcome: ${outcome(part(run, "outcome"))}`,
+        ...(typeof part(part(run, "outcome"), "ticketStatus") === "string"
+            ? [
+                `Ticket status: ${visible(part(part(run, "outcome"), "ticketStatus"))}`,
+            ]
+            : []),
+        ...(part(part(run, "outcome"), "issueUpdate") === "failed"
+            ? ["Issue status update failed; check the GitHub operation."]
+            : []),
         `Condition: ${show(part(run, "condition"))}`,
         `Reason: ${show(part(reason, "code"))}: ${show(part(reason, "detail"))}`,
         `Revision: ${show(part(run, "revision"))}, latest sequence ${show(part(run, "latestSequence"))}`,
@@ -101,7 +167,9 @@ export function runStatus(result) {
         `Evidence: ${listing(part(run, "evidence"))}`,
         `Last confirmed observation: ${observation(part(run, "lastConfirmedObservation"))}`,
         `Recovery: ${show(part(recovery, "attempts"))} of ${show(part(recovery, "limit") ?? "no limit")}`,
-        `Claude cost: ${(typeof cost === "number" ? cost : 0).toFixed(2)} USD`,
+        `Cost${suffix}: ${priceText(part(run, "claudeCostUsd"), part(run, "estimatedCostUsd"))}`,
+        `Token usage${suffix}: ${usageText(part(run, "usage"))}`,
+        ...workerLines(part(run, "workerTurns")),
         `Next action: ${show(part(run, "nextAction") ?? "none")}${at === null ? "" : ` at ${show(at)}`}`,
         `Human input can help: ${part(run, "humanInputCanHelp") === true ? "yes" : "no"}`,
         ...feedbackLines(part(run, "feedback")),

package/dist/src/cli/usage-render.d.ts

@@ -0,0 +1,3 @@
+export declare function priceText(value: unknown, estimate?: unknown): string;
+export declare function usageText(value: unknown): string;
+export declare function totalsSuffix(state: unknown): string;

package/dist/src/cli/usage-render.js

@@ -0,0 +1,28 @@
+import { priceOf, usageOf } from "../worker-usage.js";
+export function priceText(value, estimate) {
+    const price = priceOf(value);
+    if (price === null && priceOf(estimate) !== null)
+        return `≈ ${priceText(estimate)} (estimate)`;
+    if (price === null)
+        return "Price not known";
+    return `${price.toLocaleString("en-US", {
+        useGrouping: false,
+        minimumFractionDigits: 2,
+        maximumFractionDigits: 2,
+    })} USD`;
+}
+export function usageText(value) {
+    const usage = usageOf(value);
+    return [
+        ["Input tokens", usage.input_tokens],
+        ["Cache read tokens", usage.cache_read_input_tokens],
+        ["Output tokens", usage.output_tokens],
+    ]
+        .map(([label, count]) => `${String(label)}: ${count === null ? "Token usage not known" : String(count)}`)
+        .join(" · ");
+}
+export function totalsSuffix(state) {
+    return ["completed", "failed", "cancelled"].includes(String(state))
+        ? ""
+        : " so far";
+}

package/dist/src/cli/usage.d.ts

@@ -1,4 +1,5 @@
 export declare const commandUsage: Readonly<Record<string, string>>;
-export declare const usage = "Usage: cloving [--help] [--version]\n       cloving workflows validate <manifest-path> [--input <json-file>] [--json]\n       cloving <command> [--help]\n\nCommands:\n  workflows validate  Check a compiled workflow manifest, its artifacts and optional runtime input.\n  chats import  Import explicitly selected Claude Code transcripts into private runtime files.\n  run        Submit one run of an admitted workflow.\n  status     List the runs or show one run.\n  questions  List the pending decisions.\n  answer     Answer one design question.\n  approve    Approve one pending approval.\n  deny       Deny one pending approval.\n  pause      Stop new dispatch for a run.\n  resume     Resume a paused run.\n  drop       Cancel a run and keep its files.\n  events     Print the committed events.\n  watch      Serve a page that shows the runs live.\n  start      Start the service for a repository.\n\nThe runtime commands need a Cloving service. CLOVING_RUNTIME_DIR names its runtime directory.\nUse npm exec -- cloving ... for a project-local installation.\n";
-export declare const chatsImportUsage = "Usage: cloving chats import [--] <path> [<path> ...]\n\nImports only the selected Claude Code JSONL files. Relative paths use the current directory.\nThis local command needs no service. It does not expand globs or scan directories.\nThe file limit is 10 MiB (10,485,760 bytes). Links and nonregular files are refused.\nPrivate corpus.jsonl and coverage.json files go into a new import directory under the runtime directory's chats directory.\nThe runtime selection is CLOVING_RUNTIME_DIR, XDG_RUNTIME_DIR, XDG_STATE_HOME, then HOME.\nOutput contains only counts, fixed codes and an opaque import ID. Source paths stay in the private manifest.\nExit codes: 0 for complete coverage, 1 for refused sources or output failure, 2 for invalid usage.\n";
+export declare const usage = "Usage: cloving [--help] [--version]\n       cloving workflows validate <manifest-path> [--input <json-file>] [--json]\n       cloving <command> [--help]\n\nCommands:\n  workflows validate  Check a compiled workflow manifest, its artifacts and optional runtime input.\n  chats redact  Redact one imported chat corpus into private runtime files.\n  chats import  Import explicitly selected Claude Code transcripts into private runtime files.\n  run        Submit one run of an admitted workflow.\n  status     List the runs or show one run.\n  questions  List the pending decisions.\n  answer     Answer one design question.\n  approve    Approve one pending approval.\n  deny       Deny one pending approval.\n  pause      Stop new dispatch for a run.\n  resume     Resume a paused run.\n  drop       Cancel a run and keep its files.\n  events     Print the committed events.\n  watch      Serve a page that shows the runs live.\n  start      Start the service for a repository.\n\nThe runtime commands need a Cloving service. CLOVING_RUNTIME_DIR names its runtime directory.\nUse npm exec -- cloving ... for a project-local installation.\n";
+export declare const chatsImportUsage = "Usage: cloving chats import [--] <path> [<path> ...]\n       cloving chats import --root <projects-folder> [--root <projects-folder> ...] [--exclude-project <name> ...] [-- <path> ...]\n\nImports only the selected Claude Code JSONL files. Relative paths use the current directory.\nThis local command needs no service. It scans only explicitly named roots and does not expand globs or discover configuration.\nPositional files come first, retaining order and repetitions. Roots sort by canonical path, then entries by relative path in JavaScript string order.\nExclusions match direct project folder names exactly and prune their children. Exclusions require a root.\nScans accept lowercase .jsonl filenames, attempt at most 100 eligible files across roots, and stop before entering folders at depth four.\nLater file candidates and depth-limited folders are pending. Select pending files explicitly in a later import.\nLinked components, containment changes and roots in Git repositories are refused. Scan protections require the supported macOS kernel.\nThe file limit is 10 MiB (10,485,760 bytes). Links and nonregular files are refused.\nThe total normalized corpus limit is 50 MiB (52,428,800 UTF-8 bytes), including newlines and repeated selections.\nExceeding that total returns output-failed with exit code 1 and no completed coverage manifest; partial files may remain.\n--previous-import <IMPORT_ID> compares against one explicitly named UUID v4 import before --.\nThe earlier coverage and optional revision must be valid, completed private metadata; otherwise previous-import-refused returns exit 1 with no new import.\nA comparison writes private revision.json with ordered selection evidence and six status counts. Matching uses source path and selected root path; repetitions pair in order.\nByte-verified extensions are extended; shorter sources are truncated. Legacy imports without sizes can establish unchanged digests but cannot prove extension or truncation.\nMissing or truncated evidence makes the import partial. History completeness remains unknown.\nPrivate corpus.jsonl, structure.json and coverage.json files go into a new import directory under the runtime directory's chats directory.\nThe runtime selection is CLOVING_RUNTIME_DIR, XDG_RUNTIME_DIR, XDG_STATE_HOME, then HOME.\nOutput contains only counts, fixed codes and an opaque import ID. Source paths stay in the private manifest.\nStructure preserves branches and marks known copies without removing records. History completeness remains unknown.\nRoot imports write coverage version 2 and add excluded and pending entry counts; positional-only imports retain coverage version 1.\nExit codes: 0 for no refused, pending, missing or truncated entries (exclusions alone permit success without comparison), 1 for partial coverage or processing failure, 2 for invalid usage.\n";
 export declare const validateUsage = "Usage: cloving workflows validate <manifest-path> [--input <json-file>] [--json]\n\nChecks a Cloving workflow manifest, its compiled SDK artifacts, declared resources and toolchain, and an optional runtime input file. Relative paths resolve against the current directory.\n\nOptions:\n  --input <json-file>  Validate this runtime input file.\n  --json               Print one versioned JSON result on stdout.\n\nValidation does not admit a run, dispatch effects, import workflow code or call a model.\n\nExample:\n  cloving workflows validate cloving.workflow.json --input input.json\n";
+export declare const chatsRedactUsage = "Usage: cloving chats redact <IMPORT_ID>\n\nRedact one existing import selected by its UUID v4 import ID. No service is required.\nWrite redacted.jsonl and redaction.json beside the original corpus with mode 0600.\nHOME supplies the home folder. CLOVING_PRIVATE_TEXTS is an optional JSON list of nonblank strings.\nOriginals and metadata remain private. Redaction does not authorize model use or guarantee removal of every private value.\nExit codes: 0 complete, 1 processing failure, 2 invalid usage.\n";

package/dist/src/cli/usage.js

@@ -50,28 +50,36 @@ Serves a page on http://127.0.0.1:<port>/ that shows the runs live: the state,
 the events, the work of the Claude worker and each pending decision.
 The default port is 3663. The page is read only. Stop it with Control-C.
 `,
-    start: `Usage: cloving start [--repository <directory>]
+    start: `Usage: cloving start [--repository <directory>] [--reset-queue]
 
 Starts the Cloving service for one git repository, with the workflow host,
 the Claude worker and the watch page. The default repository is the current
 directory. This command works in a development checkout of Cloving.
 Stop it with Control-C.
 
+The queue continues after unsuccessful runs and stops after three runs in a row
+without a successful handoff. A successful handoff resets the count; ordinary restarts preserve the count.
+Stop the service, inspect the failures and reconcile affected issues, then start with --reset-queue and the same queue settings to clear the failure streak once. Tracked commands are preserved.
+
 The command reads these settings from the environment:
   CLOVING_RUNTIME_DIR              The path of the runtime directory. The default is ~/.local/state/cloving/run, if XDG_RUNTIME_DIR and XDG_STATE_HOME are not set.
   CLOVING_TICKET_COMMAND           A JSON list of a command and its arguments. The command gets a ticket ID as its last argument and prints the ticket. The setting has no default, and a run with --ticket needs it.
   CLOVING_NOTIFY_COMMAND           A JSON list of a command and its arguments. Every 15 seconds, new decisions, blocked runs and failed runs send JSON on standard input with no added argument. The setting has no default.
   CLOVING_NEXT_COMMAND             A JSON list of a command and its arguments. The command runs with no added argument and prints one ready ticket ID for --next. The setting has no default.
-  CLOVING_QUEUE_SECONDS            A whole number from 10 to 3600 seconds between develop-issue queue checks; requires CLOVING_NEXT_COMMAND and CLOVING_TICKET_COMMAND. Unset means no queue. The queue stops after a failed, cancelled or unsuccessful run until restart; manual develop-issue submissions are refused with workflow-active while an issue run is active.
+  CLOVING_QUEUE_SECONDS            A whole number from 10 to 3600 seconds between develop-issue queue checks; requires CLOVING_NEXT_COMMAND and CLOVING_TICKET_COMMAND. Unset means no queue. The queue stops after three runs in a row without a successful handoff; manual develop-issue submissions are refused with workflow-active while an issue run is active.
   CLOVING_SELF_UPDATE_SECONDS      A whole number from 30 to 3600 seconds between checks of the own checkout; unset means no update. An update stops the daemon and restarts with new code. A change of package-lock.json needs the operator to update and install by hand.
+  CLOVING_ANALYSIS_TOKEN_COMMAND   A JSON list of a program and its nonempty string arguments, run without a shell just before analysis. It has limits of 10 seconds and 4096 combined stdout/stderr bytes; stdout must be one printable ASCII token without spaces, at most 512 bytes after one final line break. Only analysis receives CLAUDE_CODE_OAUTH_TOKEN; API keys are excluded. There is no default.
   CLOVING_CLAUDE_COMMAND           A JSON list of a command and its arguments for the Claude worker. The default is the claude command with a limit of 5 USD for each turn.
   CLOVING_PROFILES                 The path of a JSON file of operator-defined Claude turn profiles, read once at start. The setting has no default.
+  CLOVING_TOKEN_PRICES             A JSON object from model names to input, cachedInput and output USD prices per million tokens for estimates; entries override matching built-in prices.
   CLOVING_WORKER                   The worker for each turn: claude or codex. The default is claude. Other values stop the start with invalid-worker.
   CLOVING_CODEX_COMMAND            A JSON list of a command and its arguments, used only when CLOVING_WORKER is codex; CLOVING_CLAUDE_COMMAND is then ignored. The default is codex exec --json --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -, with no sandbox and no approval prompts.
+  CLOVING_WATCH_REPOSITORY         The service repository context for the watch board, set by start from --repository. Its local origin supplies the GitHub identity. There is no current-directory default.
+  CLOVING_WATCH_ACTIONS            The value off removes the board run form and its write endpoint. The default is on.
   CLOVING_WATCH_PORT               The port number of the watch page. The value off starts no watch page. The default is 3663.
   CLOVING_OWNERSHIP_LEASE_SECONDS  The time in seconds of the ownership lease of a started workflow step. The default is 15.
   CLOVING_HOST_BOUND               The largest number of queue messages that the workflow host handles at one time, from 1 to 64. The default is 8.
-  CLOVING_GH_COMMAND               A JSON list of a command and its arguments for the GitHub CLI, which the workflow develop-issue uses for pull requests and develop-prd uses for issues. The default is gh.
+  CLOVING_GH_COMMAND               A JSON list of a command and its arguments for the GitHub CLI, which the workflow develop-issue uses for pull requests and develop-prd uses for issues. The watch board also uses it to read pull request status. The default is gh.
   CLOVING_CHECK_COMMAND            A JSON list of a command and its arguments that the workflow develop-issue runs in the work tree before a merge. A merge does not occur if the command fails. The setting has no default, and with no setting the merge occurs with no check.
   CLOVING_PRIVATE_TEXTS            A JSON list of texts that the workflow develop-issue does not push in a file or in a commit message. The workflow develop-prd requires the list before posting an issue. The list adds to the path of the home folder, and the case of the letters does not matter. The setting has no default.
 `,
@@ -82,6 +90,7 @@ export const usage = `Usage: cloving [--help] [--version]
 
 Commands:
   workflows validate  Check a compiled workflow manifest, its artifacts and optional runtime input.
+  chats redact  Redact one imported chat corpus into private runtime files.
   chats import  Import explicitly selected Claude Code transcripts into private runtime files.
   run        Submit one run of an admitted workflow.
   status     List the runs or show one run.
@@ -100,14 +109,29 @@ The runtime commands need a Cloving service. CLOVING_RUNTIME_DIR names its runti
 Use npm exec -- cloving ... for a project-local installation.
 `;
 export const chatsImportUsage = `Usage: cloving chats import [--] <path> [<path> ...]
+       cloving chats import --root <projects-folder> [--root <projects-folder> ...] [--exclude-project <name> ...] [-- <path> ...]
 
 Imports only the selected Claude Code JSONL files. Relative paths use the current directory.
-This local command needs no service. It does not expand globs or scan directories.
+This local command needs no service. It scans only explicitly named roots and does not expand globs or discover configuration.
+Positional files come first, retaining order and repetitions. Roots sort by canonical path, then entries by relative path in JavaScript string order.
+Exclusions match direct project folder names exactly and prune their children. Exclusions require a root.
+Scans accept lowercase .jsonl filenames, attempt at most 100 eligible files across roots, and stop before entering folders at depth four.
+Later file candidates and depth-limited folders are pending. Select pending files explicitly in a later import.
+Linked components, containment changes and roots in Git repositories are refused. Scan protections require the supported macOS kernel.
 The file limit is 10 MiB (10,485,760 bytes). Links and nonregular files are refused.
-Private corpus.jsonl and coverage.json files go into a new import directory under the runtime directory's chats directory.
+The total normalized corpus limit is 50 MiB (52,428,800 UTF-8 bytes), including newlines and repeated selections.
+Exceeding that total returns output-failed with exit code 1 and no completed coverage manifest; partial files may remain.
+--previous-import <IMPORT_ID> compares against one explicitly named UUID v4 import before --.
+The earlier coverage and optional revision must be valid, completed private metadata; otherwise previous-import-refused returns exit 1 with no new import.
+A comparison writes private revision.json with ordered selection evidence and six status counts. Matching uses source path and selected root path; repetitions pair in order.
+Byte-verified extensions are extended; shorter sources are truncated. Legacy imports without sizes can establish unchanged digests but cannot prove extension or truncation.
+Missing or truncated evidence makes the import partial. History completeness remains unknown.
+Private corpus.jsonl, structure.json and coverage.json files go into a new import directory under the runtime directory's chats directory.
 The runtime selection is CLOVING_RUNTIME_DIR, XDG_RUNTIME_DIR, XDG_STATE_HOME, then HOME.
 Output contains only counts, fixed codes and an opaque import ID. Source paths stay in the private manifest.
-Exit codes: 0 for complete coverage, 1 for refused sources or output failure, 2 for invalid usage.
+Structure preserves branches and marks known copies without removing records. History completeness remains unknown.
+Root imports write coverage version 2 and add excluded and pending entry counts; positional-only imports retain coverage version 1.
+Exit codes: 0 for no refused, pending, missing or truncated entries (exclusions alone permit success without comparison), 1 for partial coverage or processing failure, 2 for invalid usage.
 `;
 export const validateUsage = `Usage: cloving workflows validate <manifest-path> [--input <json-file>] [--json]
 
@@ -122,3 +146,11 @@ Validation does not admit a run, dispatch effects, import workflow code or call
 Example:
   cloving workflows validate cloving.workflow.json --input input.json
 `;
+export const chatsRedactUsage = `Usage: cloving chats redact <IMPORT_ID>
+
+Redact one existing import selected by its UUID v4 import ID. No service is required.
+Write redacted.jsonl and redaction.json beside the original corpus with mode 0600.
+HOME supplies the home folder. CLOVING_PRIVATE_TEXTS is an optional JSON list of nonblank strings.
+Originals and metadata remain private. Redaction does not authorize model use or guarantee removal of every private value.
+Exit codes: 0 complete, 1 processing failure, 2 invalid usage.
+`;

package/dist/src/cli/watch-actions.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage } from "node:http";
+import { type CardForm } from "./watch-run-input.ts";
+export interface WatchActions {
+    readonly forms: readonly CardForm[];
+    readonly token: string;
+    readonly runtimeDirectory: string;
+}
+export declare function watchActions(runtimeDirectory: string): Promise<WatchActions>;
+export declare function watchHost(request: IncomingMessage): boolean;
+export declare function watchAction(actions: WatchActions, request: IncomingMessage): Promise<string | null>;

package/dist/src/cli/watch-actions.js

@@ -0,0 +1,58 @@
+import { randomBytes } from "node:crypto";
+import { send } from "./client.js";
+import { watchCardForms } from "./watch-card-forms.js";
+import { join } from "node:path";
+import { cardRunRequest } from "./watch-run-input.js";
+export async function watchActions(runtimeDirectory) {
+    return {
+        runtimeDirectory,
+        forms: await watchCardForms(join(import.meta.dirname, "../../workflows")),
+        token: randomBytes(32).toString("hex"),
+    };
+}
+export function watchHost(request) {
+    const port = request.socket.localPort;
+    return [`127.0.0.1:${String(port)}`, `localhost:${String(port)}`].includes(request.headers.host ?? "");
+}
+function authorized(actions, request) {
+    return (watchHost(request) &&
+        request.headers.origin === `http://${request.headers.host ?? ""}` &&
+        request.headers["x-cloving-token"] === actions.token &&
+        /^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(request.headers["content-type"] ?? ""));
+}
+async function bodyOf(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += bytes.length;
+        if (size > 16384)
+            return null;
+        chunks.push(bytes);
+    }
+    try {
+        const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+export async function watchAction(actions, request) {
+    if (!authorized(actions, request))
+        return null;
+    const given = cardRunRequest(actions.forms, await bodyOf(request));
+    if (given === null)
+        return null;
+    const status = await send(actions.runtimeDirectory, {
+        operation: "status",
+        parameters: {},
+    });
+    if (status.kind === "error")
+        return JSON.stringify(status);
+    const workflows = status.result["workflows"];
+    if (!Array.isArray(workflows) ||
+        !workflows.includes(given.parameters["workflowId"]))
+        return null;
+    return JSON.stringify(await send(actions.runtimeDirectory, given));
+}

package/dist/src/cli/watch-board-view.d.ts

@@ -1,5 +1,20 @@
+import { type CardControls } from "./watch-card-view.ts";
+import type { CardForm } from "./watch-run-input.ts";
 import { type Shown } from "./watch-element.ts";
 import type { WatchCard, WatchWorkflow } from "./watch-render.ts";
+export declare const boardSizing: {
+    minimumColumnWidth: number;
+    collapsedColumnWidth: number;
+    gap: number;
+};
+export declare function boardLayout(input: {
+    readonly contentWidth: number;
+    readonly openColumns: number;
+    readonly collapsedColumns: number;
+}): {
+    readonly columnWidth: number;
+    readonly totalWidth: number;
+};
 export declare function cardStep(card: WatchCard, now: string): string;
 export declare function cardReview(card: WatchCard): string;
 export declare function CardReview(props: {
@@ -16,7 +31,24 @@ export declare function WorkflowList(props: {
     readonly workflows: readonly WatchWorkflow[];
     readonly selected: string | null;
 }): Shown;
+export interface ColumnControls {
+    readonly choices: Readonly<Record<string, boolean>> | null;
+    readonly onToggle: (name: string) => void;
+    readonly onHover?: (name: string | null) => void;
+    readonly onFocus?: (name: string | null) => void;
+}
+export declare function columnCollapsed(choices: Readonly<Record<string, boolean>> | null, name: string): boolean;
+export declare function Column(props: {
+    readonly column: WatchWorkflow["columns"][number];
+    readonly addCard?: Shown;
+    readonly workflowId: string;
+    readonly now: string;
+    readonly controls?: ColumnControls | undefined;
+}): Shown;
 export declare function Board(props: {
     readonly workflow: WatchWorkflow;
+    readonly cardForm?: CardForm | undefined;
+    readonly cards?: CardControls | undefined;
     readonly now: string;
+    readonly controls?: ColumnControls | undefined;
 }): Shown;