codehere 0.7.1 → 1.0.1

package/dist/infrastructure/protocols/ui/app-script-context-sources.js

@@ -0,0 +1,168 @@
+/**
+ * Context Sources panel — the settings-drawer section that connects, tests and disconnects
+ * the external sources an agent can read from, and renders their state.
+ *
+ * Split out of app-script.ts (strangler fig, split 7). Verbatim slice, interpolated back at
+ * the position it was cut from so it keeps sharing the surrounding IIFE scope —
+ * loadContextSources is still called from the drawer code left behind. Verified by hashing
+ * the composed APP_SCRIPT before and after: same bytes.
+ */
+export const CONTEXT_SOURCES = `// v0.8 S2.5 · Context Sources panel · lives inside the settings drawer
+function csIconHtml(id){
+  const initials=id==='linear'?'L':id==='figma'?'F':id.slice(0,1).toUpperCase();
+  return '<span class="cs-icon '+id+'">'+initials+'</span>';
+}
+function csRelativeTime(ts){
+  if(!ts) return '';
+  const delta=Date.now()-ts;
+  const m=Math.floor(delta/60000); if(m<60)return m+'m ago';
+  const h=Math.floor(m/60); if(h<24)return h+'h ago';
+  return Math.floor(h/24)+'d ago';
+}
+function csDescription(id){
+  // Fix D6 (2026-05-23) · {placeholder} syntax avoids browser eating
+  // <angle-bracket-tags> · the description renders correctly + agents
+  // recognize the convention from man-page conventions.
+  if(id==='linear') return 'Read Linear issues by ID. Agent can pull title, status, assignee, description, comments.';
+  if(id==='figma')  return 'Read Figma files or single nodes. Agent gets the tree, dimensions, and text content.';
+  if(id==='drawio') return 'Read draw.io diagrams (XML). Drop drawio://gh/{owner}/{repo}/{path} into a prompt.';
+  if(id==='github') return 'Connect once to import issues as tasks and post results back. Also unlocks github://{owner}/{repo}/issues/{n} reads in a prompt.';
+  return '';
+}
+function csExampleUrl(id){
+  if(id==='linear') return 'linear://INFRA-247';
+  if(id==='figma')  return 'figma://file/abc123';
+  if(id==='drawio') return 'drawio://gh/owner/repo/docs/arch.drawio';
+  if(id==='github') return 'github://owner/repo/issues/42';
+  return '';
+}
+async function loadContextSources(){
+  const list=document.getElementById('cs-list');
+  if(!list)return;
+  list.innerHTML='<div style="color:var(--fg-40); font-size:12px; padding:8px 0">loading\\u2026</div>';
+  try{
+    // Time-box the fetch so the drawer never sits on 'loading…' forever.
+    const ctrl=new AbortController();
+    const tmo=setTimeout(function(){ctrl.abort();},8000);
+    const r=await fetch('/api/context-sources',{signal:ctrl.signal}).then(x=>x.json());
+    clearTimeout(tmo);
+    const rawItems=(r&&r.providers)||[];
+    const items=rawItems.filter(function(p){
+      return p.authType==='public' || p.clientIdConfigured || p.status==='connected' || p.status==='manual' || p.status==='expired';
+    });
+    const hiddenN=rawItems.length-items.length;
+    const hiddenLine=hiddenN>0
+      ? '<div class="cs-empty-hint">more integrations when configured: <a href="https://github.com/muhammadegaa/codehere" target="_blank" rel="noopener">docs</a></div>'
+      : '';
+    if(!items.length){list.innerHTML=hiddenLine||'<div style="color:var(--fg-40); font-size:12px; padding: 8px 0">no providers registered</div>'; return;}
+    const rows=items.map(function(p){
+      const statusChip='<span class="cs-status '+p.status+'">'+p.status+'</span>';
+      let meta='';
+      if((p.status==='connected'||p.status==='expired') && p.userLabel){
+        meta='<span class="cs-meta">· '+String(p.userLabel).replace(/</g,'&lt;');
+        if(p.connectedAt) meta+=' · '+csRelativeTime(p.connectedAt);
+        meta+='</span>';
+      } else if(p.status==='manual'){
+        meta='<span class="cs-meta">· apiKey set</span>';
+      }
+      let actions='';
+      let belowDesc='';
+      if(p.authType==='public'){
+        belowDesc='<div style="margin-top:6px;"><span class="ctx-url-chip" data-url="'+csExampleUrl(p.id)+'" title="click to preview · or copy + paste into a prompt">'+csExampleUrl(p.id)+'</span></div>';
+        // Fix D5/D6 (2026-05-23) · for public adapters, render the example
+        // URL on its OWN line BELOW the description (via belowDesc) so the
+        // description column doesn't collapse to a narrow strip when the
+        // URL chip takes a wide actions slot. No actions slot needed —
+        // Connect doesn't apply for public adapters.
+        actions='';
+      } else if(p.authType==='github-device'){
+        // GitHub uses the device flow, not auth-code OAuth — its own Connect handler.
+        actions=(p.status==='connected'||p.status==='expired')
+          ? '<button class="cs-btn danger" onclick="disconnectCS(\\''+p.id+'\\', this)">Disconnect</button>'
+          : (p.clientIdConfigured?'<button class="cs-btn primary" onclick="ghConnectCS(\\''+p.id+'\\')">Connect</button>':'');
+      } else if(p.status==='connected'){
+        actions='<button class="cs-btn" onclick="testCS(\\''+p.id+'\\')">Test</button>'
+             +'<button class="cs-btn danger" onclick="disconnectCS(\\''+p.id+'\\', this)">Disconnect</button>';
+      } else if(p.status==='expired'){
+        actions=p.clientIdConfigured
+          ? '<button class="cs-btn primary" onclick="connectCS(\\''+p.id+'\\')">Reconnect</button>'
+          : '';
+      } else if(p.status==='manual'){
+        actions='<button class="cs-btn" onclick="testCS(\\''+p.id+'\\')">Test</button>'
+          +(p.clientIdConfigured?'<button class="cs-btn primary" onclick="connectCS(\\''+p.id+'\\')">Switch to OAuth</button>':'');
+      } else {
+        actions=p.clientIdConfigured
+          ? '<button class="cs-btn primary" onclick="connectCS(\\''+p.id+'\\')">Connect</button>'
+          : '';
+      }
+      return '<div class="cs-row" id="cs-row-'+p.id+'">'
+        + csIconHtml(p.id)
+        + '<div style="display:flex; flex-direction:column; min-width:0; flex:1;">'
+        +   '<div style="display:flex; align-items:center; gap:6px;"><span class="cs-label">'+p.label+'</span>'+statusChip+meta+'</div>'
+        +   '<div style="font-size:12px; color:var(--fg-50); margin-top:3px; line-height:1.5;">'+csDescription(p.id)+'</div>'
+        +   belowDesc
+        + '</div>'
+        + (actions ? '<div class="cs-actions">'+actions+'</div>' : '')
+        + '</div>'
+        + '<div id="cs-test-'+p.id+'"></div>';
+    }).join('');
+    list.innerHTML=rows+hiddenLine;
+  }catch(e){
+    list.innerHTML='<div style="color:var(--fg-50); font-size:12px; padding:8px 0">couldn\\u2019t reach the daemon \\u00b7 <a href="#" onclick="loadContextSources();return false" style="color:var(--accent)">retry</a></div>';
+  }
+}
+async function connectCS(provider){
+  try{
+    const r=await fetch('/api/context-sources/'+encodeURIComponent(provider)+'/connect',{method:'POST'});
+    const data=await r.json();
+    if(!r.ok){
+      if(data.error==='provider_not_registered'){
+        al(provider+' OAuth app not registered. Set '+data.envVar+' and restart the daemon.');
+      } else {
+        al('connect failed: '+(data.error||r.status));
+      }
+      return;
+    }
+    if(data.authorizeUrl){
+      window.open(data.authorizeUrl,'_blank');
+      let poll=setInterval(loadContextSources, 2000);
+      setTimeout(()=>clearInterval(poll), 120000);
+    }
+  }catch(e){
+    al('connect failed: '+(e&&e.message?e.message:String(e)));
+  }
+}
+async function disconnectCS(provider, btnEl){
+  // Inline confirmation · replace the button with a confirm/cancel pair
+  if(btnEl && !btnEl.dataset.confirming){
+    const orig=btnEl.outerHTML;
+    btnEl.outerHTML='<span style="font-size:10.5px; color:var(--fg-50); margin-right:6px;">disconnect?</span><button class="cs-btn danger" id="cs-confirm-'+provider+'">yes</button><button class="cs-btn" id="cs-cancel-'+provider+'">cancel</button>';
+    const yes=document.getElementById('cs-confirm-'+provider);
+    const no=document.getElementById('cs-cancel-'+provider);
+    if(yes) yes.onclick=async()=>{
+      await fetch('/api/context-sources/'+encodeURIComponent(provider)+'/disconnect',{method:'POST'});
+      loadContextSources();
+    };
+    if(no) no.onclick=()=>{loadContextSources();};
+    return;
+  }
+}
+async function testCS(provider){
+  const slot=document.getElementById('cs-test-'+provider);
+  if(slot) slot.innerHTML='<div class="cs-test-result" style="color:var(--fg-50); background: rgba(255,255,255,0.02)">testing...</div>';
+  try{
+    const r=await fetch('/api/context-sources/'+encodeURIComponent(provider)+'/test',{method:'POST'});
+    const data=await r.json();
+    if(slot){
+      if(data.ok){
+        slot.innerHTML='<div class="cs-test-result ok">&check; reachable · '+(data.who||'authenticated')+'</div>';
+      } else {
+        slot.innerHTML='<div class="cs-test-result fail">&times; failed: '+(data.error||'unknown')+'</div>';
+      }
+      setTimeout(()=>{ if(slot) slot.innerHTML=''; }, 6000);
+    }
+  }catch(e){
+    if(slot) slot.innerHTML='<div class="cs-test-result fail">&times; '+(e&&e.message?e.message:String(e))+'</div>';
+  }
+}`;
+//# sourceMappingURL=app-script-context-sources.js.map

package/dist/infrastructure/protocols/ui/app-script-conversation.js

@@ -0,0 +1,67 @@
+// The conversation turn — one speaker's turn in the room thread, extracted from
+// app-script.ts (strangler-fig split 3, 2026-07-06; same pattern as
+// app-script-render.ts). A browser-JS string fragment interpolated into
+// APP_SCRIPT at the same scope: function declarations hoist exactly as before,
+// so no behavior change — the monolith just no longer owns the conversation.
+//
+// Owns: speaker identity (isAgentSpeaker/speakerName), escaping
+// (convHe), the identity rail hue (railHue), and the turn itself
+// (renderTurn/renderConversation) — Direction A "The Record", Ega-picked
+// 2026-07-05: hue rail + dot marks the speaker, voice text full-width, no
+// bubbles; the human is the only ember.
+//
+// House rules for this file (it is INSIDE a TS template literal when served):
+// no literal backticks, unicode escapes stay double-escaped (\\uXXXX), served
+// regexes double-escaped.
+export const CONVERSATION_TURN = `
+// Multi-speaker conversation · the demo v12 thread model · turns from the human
+// (me), other team members, and agents (claude-code/codex/aider/...) — each with
+// an avatar badge. A turn's speaker is an agent key, user/conductor, or a
+// human name. This is the thread spine, not a collapsed afterthought.
+function isAgentSpeaker(sp){
+  var s=String(sp||'').toLowerCase();
+  return /^(claude|codex|aider|gemini|opencode|conductor)/.test(s);
+}
+function speakerName(sp,name){
+  if(name) return name;
+  if(isAgentSpeaker(sp)) return agentLabel(sp);
+  return sp||'unknown';
+}
+function convHe(s){ return String(s==null?'':s).replace(/[&<>"]/g, c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
+// One conversation row · reused by the conversation panel AND the unified
+// timeline so a turn looks identical wherever it appears.
+// Direction A "The Record" (Ega-picked 2026-07-05) — the identity hue for a
+// speaker's rail/dot. You are the only ember; agents get their hue; a human
+// teammate gets a distinct mauve. Same treatment for everyone else.
+function railHue(sp, name, human){
+  if(sp==='user') return 'var(--accent)';
+  if(human) return '#c9a3d9';
+  var k=(typeof agentKey==='function'?agentKey(name||sp):String(sp||''));
+  var m={claude:'#d9a679',codex:'#a3b8d9',aider:'#c9a3d9',gemini:'#8fb8c7',opencode:'#a8c79a',conductor:'#c8c2bb',cursor:'#d4b483'};
+  return m[k]||'#c8c2bb';
+}
+function renderTurn(u){
+  var sp=u.speaker||u.role||'assistant';
+  var body=convHe(u.content||u.body||'').replace(/@(claude-code|claude|codex|aider|gemini|opencode)/g,'<span class="at-route">@$1</span>');
+  var human=!isAgentSpeaker(sp);
+  // Routing / hand-off reads as a thin centered divider, not a turn.
+  if(u.routeLine){
+    return '<div class="conv-turn route-div"><span class="rl-line"></span><span class="rl-txt" data-user-content>'+body+'</span><span class="rl-line"></span></div>';
+  }
+  // Direction A · The Record — ONE consistent treatment: a hue rail + dot marks
+  // who's speaking, voice text full-width, no bubbles; you are the only ember.
+  var role=human?(sp==='user'?'you':'teammate'):'agent';
+  return '<div class="rec-row'+(sp==='user'?' you':'')+'" style="--rail:'+railHue(sp,u.name,human)+'">'
+    +'<div class="rec-rail"></div>'
+    +'<div class="rec-body">'
+      +'<div class="rec-meta"><span class="rec-dot"></span><span class="rec-who">'+convHe(speakerName(sp,u.name))+'</span><span class="rec-role">'+role+'</span>'
+      +(u.ts?'<span class="rec-time">'+convHe(u.ts)+'</span>':'')+'</div>'
+      +'<div class="rec-text" data-user-content>'+body+'</div>'
+    +'</div></div>';
+}
+function renderConversation(turns){
+  if(!Array.isArray(turns)||!turns.length) return '';
+  return '<div class="panel"><div class="panel-title">Conversation</div>'+turns.map(renderTurn).join('')+'</div>';
+}
+`;
+//# sourceMappingURL=app-script-conversation.js.map

package/dist/infrastructure/protocols/ui/app-script-drawer.js

@@ -0,0 +1,115 @@
+/**
+ * Settings drawer and its neighbours — open/close for the drawer, reshape, and clone, plus the
+ * shape apply/reset/classify/restore helpers that share its state.
+ *
+ * Split out of app-script.ts (strangler fig). Verbatim slice, interpolated back at the
+ * position it was cut from so it keeps sharing the surrounding IIFE scope. Verified by
+ * hashing the composed APP_SCRIPT before and after: same bytes.
+ */
+export const SETTINGS_DRAWER = `function openDrawer(){
+  document.getElementById('settings-drawer')?.classList.add('open');
+  document.getElementById('drawer-overlay')?.classList.add('open');
+  loadContextSources();
+}
+function closeDrawer(){
+  document.getElementById('settings-drawer')?.classList.remove('open');
+  document.getElementById('drawer-overlay')?.classList.remove('open');
+}
+
+// v0.8 S3 · Reshape view · port of demo v12 lines 2486-2534.
+// Body-class-driven view modifier. Three preset shapes + a free-text
+// classifier that maps to the closest preset. Persists the active shape
+// to localStorage so the user's choice survives a reload.
+const SHAPE_CLASSES=['shape-ship-only','shape-velocity','shape-security'];
+const SHAPE_CONFIGS={
+  'ship-only': 'density: standard · hide: tc, audit, code · expand: final-report, file-chips',
+  'velocity':  'density: compact · hide: tc-outputs, audit, code · expand: outcome, duration',
+  'security':  'density: standard · amplify: audit, hook-block, trust · hide: prose, repl-beats',
+};
+function openReshape(){
+  const m=document.getElementById('reshape-modal');
+  const ac=document.getElementById('agent-compose');
+  const inp=document.getElementById('reshape-input');
+  m?.classList.add('open');
+  ac?.classList.remove('show');
+  if(inp){ inp.value=''; setTimeout(()=>inp.focus(), 100); }
+}
+function closeReshape(){
+  document.getElementById('reshape-modal')?.classList.remove('open');
+}
+function openClone(){
+  const m=document.getElementById('clone-modal');
+  const inp=document.getElementById('clone-url');
+  const st=document.getElementById('clone-status');
+  if(st){ st.style.display='none'; st.textContent=''; }
+  m?.classList.add('open');
+  if(inp){ inp.value=''; inp.disabled=false; setTimeout(()=>inp.focus(), 100); }
+  const b=document.getElementById('clone-submit'); if(b) b.disabled=false;
+}
+function closeClone(){
+  document.getElementById('clone-modal')?.classList.remove('open');
+}
+async function doClone(){
+  const inp=document.getElementById('clone-url');
+  const btn=document.getElementById('clone-submit');
+  const st=document.getElementById('clone-status');
+  const url=(inp&&inp.value||'').trim();
+  if(!url){ if(st){ st.style.display='block'; st.className='clone-status warn'; st.textContent='Paste a repo URL first.'; } return; }
+  if(btn) btn.disabled=true; if(inp) inp.disabled=true;
+  if(st){ st.style.display='block'; st.className='clone-status'; st.textContent='Cloning \\u2026 this can take a moment for a big repo.'; }
+  try{
+    const r=await fetch('/api/projects/clone',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({url:url})});
+    const j=await r.json().catch(function(){return {};});
+    if(r.ok && j.cwd){
+      if(st){ st.className='clone-status ok'; st.textContent=(j.alreadyHere?'Already here. Opening\\u2026':'Cloned. Opening\\u2026'); }
+      closeClone();
+      openRoom(encodeURIComponent(j.cwd));
+      return;
+    }
+    // honest, plain failure — never a vanishing toast, never a fake check
+    const map={url_required:'Paste a repo URL first.',invalid_url:'That doesn\\u2019t look like a git or GitHub URL.',invalid_json:'Something went wrong reading that. Try again.',invalid_body:'Something went wrong reading that. Try again.',dir_exists:'A different folder already sits at '+(j.detail||'the target path')+'. Move or rename it, then retry.'};
+    let msg=map[j.error]||('Couldn\\u2019t clone'+(j.detail?' \\u00b7 '+String(j.detail):''));
+    if(j.error==='clone_failed') msg='Couldn\\u2019t clone \\u00b7 '+String(j.detail||'check the URL and your git access');
+    if(st){ st.className='clone-status warn'; st.textContent=msg; }
+  }catch(e){
+    if(st){ st.className='clone-status warn'; st.textContent='Network error \\u00b7 '+(e&&e.message||'try again'); }
+  }
+  if(btn) btn.disabled=false; if(inp) inp.disabled=false;
+}
+function applyShape(shape, promptText, configText){
+  // Clear existing
+  SHAPE_CLASSES.forEach(s=>document.body.classList.remove(s));
+  document.body.classList.add('shape-'+shape);
+  document.body.classList.add('custom-view');
+  // Update banner with prompt
+  const bp=document.getElementById('custom-view-prompt');
+  if(bp) bp.textContent='"'+promptText+'"';
+  // Animate the compose preview
+  const echo=document.getElementById('compose-prompt-echo');
+  const cfg=document.getElementById('compose-config');
+  if(echo) echo.textContent=promptText;
+  if(cfg) cfg.textContent=configText;
+  document.getElementById('agent-compose')?.classList.add('show');
+  // Persist
+  try{ localStorage.setItem('codehere_shape', JSON.stringify({shape, promptText, configText})); }catch{}
+  // Close modal after compose animation finishes
+  setTimeout(()=>closeReshape(), 2600);
+}
+function resetShape(){
+  SHAPE_CLASSES.forEach(s=>document.body.classList.remove(s));
+  document.body.classList.remove('custom-view');
+  try{ localStorage.removeItem('codehere_shape'); }catch{}
+}
+function classifyShape(text){
+  const lower=text.toLowerCase();
+  if(/shipped|final|cost|outcome/.test(lower)) return 'ship-only';
+  if(/security|audit|trust|block|hook/.test(lower)) return 'security';
+  if(/velocity|duration|fast|quick|time/.test(lower)) return 'velocity';
+  return 'velocity';
+}
+function restoreShape(){
+  // Reshape removed (2026-06-20) — one consistent view. Never re-apply a saved
+  // shape; clear any leftover so it can't resurface.
+  try{ SHAPE_CLASSES.forEach(s=>document.body.classList.remove(s)); document.body.classList.remove('custom-view'); localStorage.removeItem('codehere_shape'); }catch{}
+}`;
+//# sourceMappingURL=app-script-drawer.js.map

package/dist/infrastructure/protocols/ui/app-script-failover.js

@@ -0,0 +1,133 @@
+/**
+ * Failover banner — surfaces that a vendor call fell back to another vendor, so a result that
+ * came from somewhere other than the agent you picked never arrives unlabelled.
+ *
+ * Split out of app-script.ts (strangler fig). Verbatim slice, interpolated back at the
+ * position it was cut from so it keeps sharing the surrounding IIFE scope — its functions
+ * are still called from the code left behind. Verified by hashing the composed APP_SCRIPT
+ * before and after: same bytes.
+ */
+export const FAILOVER_BANNER = `  /* Failover banner · ported from v1 on 2026-05-23 /v1 kill.
+     Polls /api/failover-offers · when a rate-limited agent has a viable
+     fallback, an amber strip appears with Switch + Dismiss. */
+  (function wireFailover(){
+    const fbEl = document.getElementById('failover-banner');
+    if(!fbEl) return;
+    let fbDismissed = false;
+    function escFb(s){ return String(s||'').replace(/[&<>"]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
+    function render(offers){
+      if(!offers || offers.length === 0 || fbDismissed){ fbEl.classList.remove('show'); return; }
+      fbEl.classList.add('show');
+      fbEl.innerHTML = offers.map(o => {
+        const msg = '<b>'+escFb(o.signal && o.signal.fromAgent)+'</b> hit '+escFb(o.signal && o.signal.errorCode)+
+          ' · switch to <b>'+escFb(o.target)+'</b>?';
+        const actions = '<div class="fb-actions">'+
+          '<button class="fb-accept" data-session="'+escFb(o.sessionId)+'" data-target="'+escFb(o.target)+'">Switch</button>'+
+          '<button class="fb-dismiss" data-session="'+escFb(o.sessionId)+'">Dismiss</button>'+
+          '</div>';
+        return '<div class="fb-msg">'+msg+'</div>'+actions;
+      }).join('');
+      fbEl.querySelectorAll('.fb-accept').forEach(btn => {
+        btn.addEventListener('click', async ()=>{
+          btn.disabled = true; btn.textContent = 'Switching…';
+          try{
+            const r = await fetch('/api/failover-accept', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({ sessionId: btn.dataset.session, targetAgent: btn.dataset.target }),
+            });
+            const d = await r.json();
+            if(d.error || !d.ok || !d.newSessionId){
+              fbEl.innerHTML = '<div class="fb-msg"><b>Failover failed:</b> '+escFb(d.error || d.detail || 'Target agent not ready')+'</div>';
+              return;
+            }
+            fbEl.innerHTML = '<div class="fb-msg">Switched to <b>'+escFb(btn.dataset.target)+'</b> · new session <b>'+escFb(d.newSessionId.slice(0,8))+'</b></div>'+
+              '<div class="fb-actions"><button class="fb-dismiss" id="fb-ok">OK</button></div>';
+            document.getElementById('fb-ok').addEventListener('click', ()=>{ fbDismissed = true; fbEl.classList.remove('show'); });
+          }catch(err){
+            fbEl.innerHTML = '<div class="fb-msg"><b>Failover failed:</b> network error · check daemon</div>';
+          }
+        });
+      });
+      fbEl.querySelectorAll('.fb-dismiss').forEach(btn => {
+        btn.addEventListener('click', ()=>{ fbDismissed = true; fbEl.classList.remove('show'); });
+      });
+    }
+    // Expose the REAL render so /verify coverage can observe the banner's own
+    // render path with a real offer shape (no fake DOM injection). The 5s poll
+    // still drives it live from /api/failover-offers in normal use.
+    window.__fbRender = function(offers){ fbDismissed = false; render(offers); };
+    setInterval(async ()=>{
+      try{
+        const r = await fetch('/api/failover-offers');
+        const d = await r.json();
+        render(d.offers);
+      }catch{ /* fine */ }
+    }, 5000);
+  })();
+
+  document.addEventListener('keydown',e=>{
+    // Gate on the VISIBLE state, not just _detail: the not-found screen nulls
+    // _detail while advertising "· Esc" — a dead advertised key is the
+    // recovery-buttons-must-not-lie class (verify-distill loop-5 catch).
+    // Spend joins the gate (loop-6): Esc is the way out of every non-home
+    // surface, and hideD already clears the #/spend hash correctly.
+    if(e.key==='Escape'&&(_detail||document.body.classList.contains('detail-open')||_spendVisible())&&!e.defaultPrevented)hideD();
+    // S14 · the Your-call block's filled button shows a ⏎ hint — make it
+    // true: Enter on an open detail (focus NOT in an input/summary, so the
+    // composer + the conversation row keep their own Enter) clicks the one
+    // enabled primary action. No primary rendered -> Enter does nothing.
+    if(e.key==='Enter'&&_detail&&!e.defaultPrevented){
+      const _ae=document.activeElement;
+      if(!_ae||_ae===document.body){
+        const _yc=document.querySelector('#task-detail-view .recovery-card button.primary:not([disabled])');
+        if(_yc){ e.preventDefault(); _yc.click(); }
+      }
+    }
+    // S13 · ⌘K / Ctrl-K opens (or toggles) the command palette — every
+    // control that left the header lives there.
+    if((e.metaKey||e.ctrlKey)&&(e.key==='k'||e.key==='K')){
+      e.preventDefault();
+      const sc=document.getElementById('palette-scrim');
+      if(sc&&sc.classList.contains('open')) closePalette(); else openPalette();
+    }
+    // S12 AX · full keyboard path: Tab to a card, Enter opens it (Esc above
+    // already goes back). Only when the card ITSELF is focused — buttons
+    // inside the card keep their own Enter behavior.
+    if(e.key==='Enter'&&e.target instanceof Element&&e.target.classList.contains('task-card')){
+      e.preventDefault(); e.target.click();
+    }
+  });
+
+  // Composer .typing toggle · brand border the moment the input has chars.
+  // The focus-within border handles "input is focused"; the .typing class
+  // handles "input has content" so the affordance stays even if the user
+  // tabs away mid-prompt.
+  function bindTypingState(taEl){
+    if(!taEl) return;
+    const bar = taEl.closest('.input-bar');
+    if(!bar) return;
+    taEl.addEventListener('input', ()=>{
+      if(taEl.value.length > 0) bar.classList.add('typing');
+      else bar.classList.remove('typing');
+    });
+  }
+
+  const ta=document.getElementById('main-ta'), btn=document.getElementById('main-btn');
+  if(btn)btn.addEventListener('click',()=>submit(ta,btn));
+  if(ta)ta.addEventListener('keydown',e=>{if(e.key==='Enter'&&!e.shiftKey&&!ta.disabled&&btn&&!btn.disabled){e.preventDefault();submit(ta,btn);}});
+  bindTypingState(ta);
+
+  const dta=document.getElementById('detail-ta'), dbtn=document.getElementById('detail-btn');
+  // S7 · the estimate tracks what it claims to track: prompt length + the
+  // picked agent. Recompute on type and on picker change.
+  const _mta=document.getElementById('main-ta'), _pick=document.getElementById('agent-pick');
+  if(_mta)_mta.addEventListener('input',updateCostEst);
+  if(_pick)_pick.addEventListener('change',updateCostEst);
+  if(dta)dta.addEventListener('input',updateCostEst);
+  updateCostEst();
+  if(dbtn)dbtn.addEventListener('click',()=>submit(dta,dbtn,_detail));
+  if(dta)dta.addEventListener('keydown',e=>{if(e.key==='Enter'&&!e.shiftKey&&!dta.disabled&&dbtn&&!dbtn.disabled){e.preventDefault();submit(dta,dbtn,_detail);}});
+  bindTypingState(dta);
+});`;
+//# sourceMappingURL=app-script-failover.js.map

package/dist/infrastructure/protocols/ui/app-script-github.js

@@ -0,0 +1,113 @@
+/**
+ * GitHub integration — one device-flow connect shared by the welcome card, the context-sources
+ * panel and the composer import row, plus the issue picker and posting a finished result back
+ * as a comment.
+ *
+ * Split out of app-script.ts (strangler fig, split 11 — the first one that needed reading
+ * rather than a banner, since every marked region was already gone). Verbatim slice,
+ * interpolated back where it was cut so it keeps sharing the surrounding IIFE scope: the
+ * onboarding card calls welcomeConnectTool, render() calls initGhImport on every SSE tick, and
+ * the context-sources panel calls ghConnectCS. Verified by hashing the composed APP_SCRIPT
+ * before and after: same bytes.
+ */
+export const GITHUB_INTEGRATION = `// ONE GitHub device-flow connect, reused by the welcome card, the context-sources
+// panel, and the composer import row. noteEl is where progress/code renders;
+// onConnected fires once the token lands so each surface can refresh itself.
+async function _ghDeviceConnect(noteEl, onConnected){
+  function set(html){ if(noteEl) noteEl.innerHTML=html; }
+  set('Connecting GitHub\\u2026');
+  var r; try{ r=await fetch('/api/github/connect/start',{method:'POST'}).then(function(x){return x.json();}); }catch(e){ set('Could not reach the daemon.'); return; }
+  if(r&&r.error==='github_not_configured'){
+    set('GitHub needs a one-time setup: create an OAuth App with <b>Device Flow</b> enabled at <a href="https://github.com/settings/developers" target="_blank" rel="noopener">github.com/settings/developers</a>, set <code>CODEHERE_GITHUB_CLIENT_ID</code>, and restart codehere.');
+    return;
+  }
+  if(!r||!r.deviceCode){ set('GitHub error: '+((r&&r.error)||'unknown')); return; }
+  set('Open <a href="'+r.verificationUri+'" target="_blank" rel="noopener"><b>'+r.verificationUri+'</b></a> and enter code <b>'+r.userCode+'</b>. Waiting for approval\\u2026');
+  (function poll(intervalSec){
+    setTimeout(async function(){
+      var o; try{ o=await fetch('/api/github/connect/poll',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({deviceCode:r.deviceCode})}).then(function(x){return x.json();}); }catch(e){ return; }
+      if(o.status==='connected'){ set('GitHub connected.'); if(onConnected)onConnected(); return; }
+      if(o.status==='error'){ set('GitHub connect failed: '+o.error); return; }
+      poll((o.status==='slow_down'&&o.intervalSec)?o.intervalSec:intervalSec);
+    }, Math.max(2,intervalSec)*1000);
+  })(r.intervalSec||5);
+}
+function welcomeConnectTool(){
+  var n=document.getElementById('hw-note'); if(!n) return;
+  n.style.display='block';
+  _ghDeviceConnect(n, function(){ if(typeof initGhImport==='function') initGhImport(); });
+}
+// Composer import row · gated on connection. Disconnected -> a Connect button;
+// connected -> repo field + an issue PICKER (no more typing owner/repo#123 blind).
+// Snapshot-guarded (same reason as upHero's _heroSnap): render() calls this on
+// every SSE tick, and an unconditional innerHTML rewrite wipes the user's typed
+// repo, the open select, and focus mid-interaction.
+var _ghiSnap=null;
+async function initGhImport(){
+  var box=document.getElementById('gh-import'); if(!box) return;
+  var s; try{ s=await fetch('/api/github/status').then(function(x){return x.json();}); }catch(e){ s={connected:false}; }
+  var snap=String(!!s.connected)+'|'+String(!!s.clientIdConfigured);
+  if(snap===_ghiSnap && box.firstChild) return;
+  _ghiSnap=snap;
+  if(!s.connected){
+    box.innerHTML='<span>from GitHub:</span>'
+      +(s.clientIdConfigured
+        ? '<button type="button" class="ghi-btn" onclick="ghConnectComposer()">Connect GitHub</button><span class="ghi-hint">import an issue as a task</span>'
+        : '<span class="ghi-hint">connect a GitHub OAuth App to import issues</span>')
+      +'<span id="gh-import-msg" class="ghi-msg"></span>';
+    return;
+  }
+  box.innerHTML='<span>from GitHub:</span>'
+    +'<input id="gh-repo" type="text" placeholder="owner/repo" class="ghi-in">'
+    +'<button type="button" class="ghi-btn" onclick="ghLoadIssues()">load issues</button>'
+    +'<select id="gh-issue-sel" class="ghi-sel" style="display:none" onchange="ghPickIssue()"></select>'
+    +'<span id="gh-import-msg" class="ghi-msg"></span>';
+}
+function ghConnectComposer(){
+  var box=document.getElementById('gh-import'); if(!box) return;
+  var note=document.getElementById('gh-import-msg')||box;
+  _ghDeviceConnect(note, function(){ initGhImport(); });
+}
+async function ghLoadIssues(){
+  var repoEl=document.getElementById('gh-repo'); var msg=document.getElementById('gh-import-msg');
+  var repo=repoEl?repoEl.value.trim():'';
+  if(!repo){ if(msg)msg.textContent='enter owner/repo'; return; }
+  if(msg)msg.textContent='loading issues\\u2026';
+  var o; try{ o=await fetch('/api/github/issues?repo='+encodeURIComponent(repo)).then(function(x){return x.json();}); }catch(e){ if(msg)msg.textContent='daemon unreachable'; return; }
+  if(!o||o.error){ if(msg)msg.textContent=((o&&(o.message||o.error))||'could not list issues'); return; }
+  var sel=document.getElementById('gh-issue-sel'); if(!sel) return;
+  var issues=Array.isArray(o.issues)?o.issues:[];
+  if(!issues.length){ if(msg)msg.textContent='no open issues'; sel.style.display='none'; return; }
+  sel.innerHTML='<option value="">pick an issue ('+issues.length+')</option>'
+    +issues.map(function(i){ return '<option value="'+Number(i.number)+'">#'+Number(i.number)+' '+convHe(i.title)+'</option>'; }).join('');
+  sel.setAttribute('data-repo', o.repo); sel.style.display=''; if(msg)msg.textContent='';
+}
+async function ghPickIssue(){
+  var sel=document.getElementById('gh-issue-sel'); var msg=document.getElementById('gh-import-msg');
+  if(!sel||!sel.value){ return; }
+  var ref=sel.getAttribute('data-repo')+'#'+sel.value;
+  if(msg)msg.textContent='fetching '+ref+'\\u2026';
+  var o; try{ o=await fetch('/api/github/issue-to-task',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({ref:ref})}).then(function(x){return x.json();}); }catch(e){ if(msg)msg.textContent='daemon unreachable'; return; }
+  if(!o||!o.prompt){ if(msg)msg.textContent=((o&&(o.message||o.error))||'could not fetch that issue'); return; }
+  var ta=document.getElementById('main-ta'); if(ta){ ta.value=o.prompt; ta.focus(); try{ ta.dispatchEvent(new Event('input',{bubbles:true})); }catch(e){} }
+  if(msg)msg.textContent='loaded #'+o.issue.number+' \\u00b7 review and send';
+}
+// Connect GitHub from the context-sources panel (device flow) — refreshes the
+// panel + the composer import row on success.
+function ghConnectCS(id){
+  var note=document.getElementById('cs-test-'+id); if(!note){ return; }
+  _ghDeviceConnect(note, function(){ loadContextSources(); if(typeof initGhImport==='function') initGhImport(); });
+}
+// results -> GitHub: post a finished task's result back as a comment on its source issue.
+async function _ghPostResult(sid){
+  var m=document.getElementById('gh-back-msg');
+  var t=findS(sid); if(!t){ if(m)m.textContent='task not found'; return; }
+  var bodyTxt=(t.finalReport&&t.finalReport.summary)?String(t.finalReport.summary):'';
+  if(!bodyTxt){ if(m)m.textContent='no result to post yet'; return; }
+  var comment='codehere \\u00b7 '+(t.agent||'agent')+' result:\\n\\n'+bodyTxt;
+  if(m)m.textContent='posting\\u2026';
+  var o; try{ o=await fetch('/api/github/post-result',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({text:t.prompt,body:comment})}).then(function(x){return x.json();}); }catch(e){ if(m)m.textContent='daemon unreachable'; return; }
+  if(o&&o.htmlUrl){ if(m)m.innerHTML='posted to <a href="'+o.htmlUrl+'" target="_blank" rel="noopener">'+(o.issue||'the issue')+'</a>'; return; }
+  if(m)m.textContent='failed: '+((o&&(o.message||o.error))||'unknown');
+}`;
+//# sourceMappingURL=app-script-github.js.map