conductor-remote 1.117.0 → 1.118.0

package/dist-node/src/conductor.applescript

@@ -1,2279 +0,0 @@
-(*
-	Everything the relay drives Conductor's UI with, in one place.
-
-	Loaded verbatim by src/writes.ts, which appends a few lines naming the
-	handlers to run and hands the result to `osascript`. It lives in its own file
-	rather than a TypeScript template literal for three reasons: an editor can
-	highlight it, `yarn verify` can compile-check it (scripts/check-applescript.ts,
-	the repository validator for this language), and a backtick in a comment
-	no longer terminates the string it used to sit inside — so this sentence,
-	which contains `one`, is now harmless.
-
-	The target rides in on the environment (RELAY_WS_*, RELAY_TAB_*, RELAY_SET_*,
-	RELAY_PROMPT_FILE) rather than being interpolated, which keeps AppleScript
-	string escaping out of the picture entirely. The three matching labels use a
-	UTF-8 temporary file because `system attribute` decodes text as MacRoman.
-
-	Two traps to respect when editing:
-
-	 - Inside a `tell application "System Events"` block, ordinary-looking variable
-	   names resolve as System Events terms. `tabs` and `groups` become "every
-	   tab/group of the process", so a loop over your own list quietly iterates the
-	   wrong thing and the handler returns nothing. Keep logic outside the tell and
-	   reach in through one-line helpers, or name the variables `strip` and `pane`.
-	 - Every read is rooted at `window 1`, and Conductor keeps running with its
-	   windows closed. Go through `requireWindow` / `webArea` so a window that
-	   closed mid-run says so in words.
-
-	How the chat targeting works, and why each step is here:
-
-	`openViaDeepLink` normally selects the chat already, by id. The handlers below
-	are what confirm that, and what still does the work for the fallback focus
-	paths, which only reach the right workspace. A workspace holds several chats
-	and Conductor keeps typing in whichever tab is already active, so a send
-	addressed to a non-active chat would land in the wrong agent.
-
-	Conductor's webview exposes its whole tree through macOS Accessibility. The
-	chat strip is an AXTabGroup whose AXRadioButtons are the tabs (AXValue marks
-	the selected one, AXPress switches to it and does *not* close the chat). The
-	strip's order matches reads.listSessions (created_at ASC), so the caller
-	addresses a tab by 1-based index and we cross-check the label.
-
-	Three traps that targeting has to survive:
-
-	 - The tabs are not the strip's direct children. Each sits one AXGroup deep and
-	   is named for its own close action ("Close chat <title>"), while a "Close file
-	   view" radio button, which is not a chat, *is* a direct child. Reading the
-	   direct children and stopping there made every chat strip look like a one-tab
-	   strip called "Close file view", which then lost the scoring below to the
-	   terminal panel and failed every send with "chat tab 1 not found". So
-	   `stripRadios` reads both levels and `chatTabs` keeps the "Close chat" ones.
-	 - The terminal panel is an AXTabGroup too (radio buttons named Setup / Run /
-	   Terminal 1), a sibling of the chat strip in the same pane. Picking "the first
-	   tab group" would sometimes press a terminal tab, so candidates are *scored*
-	   on tab count plus label and a tie refuses to act.
-	 - The palette can land on the wrong workspace (a loose query matches a command;
-	   a deleted branch opens a modal). The pane header carries the branch and repo,
-	   so we read them back and bail if they disagree.
-
-	Target is read from RELAY_TAB_{INDEX,COUNT,TITLE} and RELAY_WS_{BRANCH,REPO};
-	index 0 disables the tab step. Every failure path errors out so the caller
-	aborts *before* typing — landing in the wrong chat is worse than not sending.
-*)
-
-on splitLines(s)
-	-- `do shell script` converts the file's LF separators to AppleScript returns.
-	-- `paragraphs` handles that form and keeps empty fields between separators.
-	return paragraphs of s
-end splitLines
-
--- The target file's first two lines are tab title and palette query. The
--- remaining lines are sidebar-title candidates. The path is ASCII; the file
--- contents reach AppleScript through `do shell script` as UTF-8.
-on targetField(fieldIndex)
-	set fields to my splitLines(do shell script "cat " & quoted form of (system attribute "RELAY_TARGET_FILE"))
-	if fieldIndex > (count of fields) then return ""
-	return item fieldIndex of fields
-end targetField
-
-on targetSidebarTitles()
-	set fields to my splitLines(do shell script "cat " & quoted form of (system attribute "RELAY_TARGET_FILE"))
-	if (count of fields) < 3 then return {}
-	set titles to {}
-	repeat with fieldIndex from 3 to (count of fields)
-		set end of titles to item fieldIndex of fields
-	end repeat
-	return titles
-end targetSidebarTitles
-
-on windowProbe()
-	-- One read, three outcomes, none of them guessed: {count, errNum, errText}.
-	-- count is -1 when macOS refused the read at all. Everything that wants to
-	-- know about windows goes through here, because "returned 0" and "refused to
-	-- answer" are different facts and only this handler still has both.
-	-- The timeout is load-bearing: a wedged Conductor (seen live after a restart
-	-- collided with a relaunch) answers deep links but hangs every AX read, and
-	-- without a cap this call blocks until the node-side ceiling kills the whole
-	-- run as "took too long" — 28s of silence instead of a named cause. 6s turns
-	-- that into error -1712, which refusalReason maps to words.
-	try
-		with timeout of 6 seconds
-			tell application "System Events" to tell process "Conductor"
-				set winCount to (count of windows)
-			end tell
-		end timeout
-		return {winCount, 0, ""}
-	on error errText number errNum
-		return {-1, errNum, errText}
-	end try
-end windowProbe
-
-on hasWindow()
-	-- Also false when the process is gone or macOS refused: callers that only
-	-- need a boolean keep getting one. windowFailure() is what tells them why.
-	return (item 1 of my windowProbe()) > 0
-end hasWindow
-
-on refusalReason(probe)
-	-- macOS's own words, matched on the error it actually returned rather than on
-	-- a capability flag we hope is accurate. "UI elements enabled" was the earlier
-	-- attempt at this and is not trustworthy — it can report true for a process
-	-- that is not itself trusted, and then the refusal reappears downstream as
-	-- "no open window". These strings are the two grants the write path needs.
-	set errNum to item 2 of probe
-	set errText to item 3 of probe
-	if errText contains "assistive access" then return "the relay is not trusted for Accessibility - grant it to the node binary running the relay in System Settings > Privacy & Security > Accessibility, then restart the relay (upgrading node silently revokes it). macOS said: " & errText
-	if errNum is -1743 or errText contains "Not authorized" then return "macOS blocked the relay from controlling the UI - grant Automation permission to the node binary running the relay in System Settings > Privacy & Security > Automation. macOS said: " & errText
-	if errNum is -1712 then return "Conductor stopped answering UI reads (the Accessibility query timed out) - the app looks wedged even though it may still process deep links. Force-quit Conductor on your Mac and open it again; if it repeats with a healthy Conductor, System Events is stuck - run: killall 'System Events'"
-	return ""
-end refusalReason
-
-on conductorRunning()
-	try
-		tell application "System Events" to return (exists process "Conductor")
-	on error
-		return false
-	end try
-end conductorRunning
-
-on joinList(lst, sep)
-	set saved to AppleScript's text item delimiters
-	set AppleScript's text item delimiters to sep
-	set out to lst as text
-	set AppleScript's text item delimiters to saved
-	return out
-end joinList
-
-on processWindowCounts()
-	-- Every process whose name looks like Conductor, with its window count. If the
-	-- app is visibly on screen while "process Conductor" reports zero, the windows
-	-- belong to a process we are not addressing — and that only shows up here.
-	set out to {}
-	try
-		tell application "System Events"
-			repeat with proc in (every process whose name contains "Conductor")
-				set end of out to ((name of proc) & "=" & (count of windows of proc))
-			end repeat
-		end tell
-	end try
-	return out
-end processWindowCounts
-
-on menuTitles()
-	try
-		tell application "System Events" to tell process "Conductor"
-			return name of every menu bar item of menu bar 1
-		end tell
-	on error
-		return {}
-	end try
-end menuTitles
-
-on serverWindowCount()
-	-- Second opinion from the window server, because the Accessibility tree only
-	-- shows windows on the *current* Space: a full-screen Conductor (which owns its
-	-- own Space) or a Mac sitting at the lock screen reads as "no window" from AX
-	-- while the window very much exists — and acting on the AX answer alone once
-	-- quit a Conductor whose window the user had left open all along.
-	-- CGWindowListCopyWindowInfo(kCGWindowListOptionAll) sees every Space; owner
-	-- name and layer are readable without the Screen Recording grant (only window
-	-- *titles* are gated). Layer 0 keeps it to real windows. -1 = the probe itself
-	-- failed, which callers must treat as "no opinion", never as "no window".
-	-- The bindFunction is the load-bearing part, twice over: as shipped this read
-	-- "$.CFBridgingRelease(...)", which is an *inline*, not a symbol, and calling it
-	-- through JXA segfaults the osascript child (measured: exit 139) — so this probe
-	-- returned -1 on every call and the veto it feeds never once fired. And without
-	-- the rebind, JXA types the CF return as a bare pointer that deepUnwrap answers
-	-- with undefined — same wrong verdict, silently. Rebinding the function to
-	-- return 'id' makes the array real (verified live: 12 windows, behind a lock).
-	set jxa to "ObjC.import('CoreGraphics'); ObjC.bindFunction('CGWindowListCopyWindowInfo', ['id', ['unsigned int', 'unsigned int']]); const w = ObjC.deepUnwrap($.CGWindowListCopyWindowInfo(0, 0)) || []; w.filter(x => x.kCGWindowOwnerName === 'Conductor' && x.kCGWindowLayer === 0).length"
-	try
-		return (do shell script "osascript -l JavaScript -e " & quoted form of jxa) as integer
-	on error
-		return -1
-	end try
-end serverWindowCount
-
-on screenLocked()
-	-- "locked" / "unlocked" / "unknown". CGSessionCopyCurrentDictionary carries
-	-- CGSSessionScreenIsLocked = 1 while the lock screen is up and omits the key
-	-- entirely when it is not — same stdlib JXA channel as serverWindowCount.
-	-- This matters because the lock screen is the product's home ground: sends
-	-- come from a phone precisely when nobody is at the Mac, so "is the lock up"
-	-- is the difference between a state a restart can fix and one it provably
-	-- makes worse (see the restart gate in activateConductor).
-	-- Same two traps as serverWindowCount: $.CFBridgingRelease segfaults under JXA,
-	-- and without the rebind deepUnwrap reads the CF dictionary as undefined — which
-	-- the "|| {}" then turned into a confident "unlocked" on a locked Mac. The fixed
-	-- probe was verified against a genuinely locked screen (CGSSessionScreenIsLocked
-	-- true, every session key present).
-	set jxa to "ObjC.import('CoreGraphics'); ObjC.bindFunction('CGSessionCopyCurrentDictionary', ['id', []]); const d = ObjC.deepUnwrap($.CGSessionCopyCurrentDictionary()) || {}; d.CGSSessionScreenIsLocked ? 'locked' : 'unlocked'"
-	try
-		return do shell script "osascript -l JavaScript -e " & quoted form of jxa
-	on error
-		return "unknown"
-	end try
-end screenLocked
-
-on windowEvidence()
-	-- Zero windows is a dead end without knowing what the AX tree *does* show, and
-	-- guessing the next thing to press has already cost a round trip (there is no
-	-- "New Window" item — Conductor is single-window). So the error carries the
-	-- evidence instead: who macOS thinks Conductor is, what its menus offer, how
-	-- many windows the window server counts across all Spaces (AX only sees the
-	-- current one), and whether the lock screen is up.
-	set procs to my processWindowCounts()
-	set titles to my menuTitles()
-	set ev to " [window server: " & my serverWindowCount() & "; screen: " & my screenLocked() & "]"
-	if (count of procs) > 0 then set ev to ev & " [processes: " & my joinList(procs, ", ") & "]"
-	if (count of titles) > 0 then set ev to ev & " [menus: " & my joinList(titles, ", ") & "]"
-	return ev
-end windowEvidence
-
-on windowFailure()
-	-- "" when a window is there; otherwise why not, in words the phone can act on.
-	-- ASCII on purpose: these reach the phone, and osascript decodes -e by the
-	-- caller's locale, which a LaunchAgent doesn't set. The last branch carries
-	-- the raw error number and text on purpose — an unrecognised refusal must
-	-- arrive as itself, not as the most plausible-sounding of the known causes.
-	set probe to my windowProbe()
-	set winCount to item 1 of probe
-	if winCount > 0 then return ""
-	if winCount is 0 then return "Conductor is running but exposes no window - reopen and a Dock click both drew nothing. Open or restart it on your Mac and try again." & my windowEvidence()
-	set refusal to my refusalReason(probe)
-	if refusal is not "" then return refusal
-	if not (my conductorRunning()) then return "Conductor is not running - the relay started it, but it did not come up in time. Try again in a few seconds."
-	return "couldn't read Conductor's windows (" & (item 2 of probe) & "): " & (item 3 of probe)
-end windowFailure
-
-on requireWindow()
-	set reason to my windowFailure()
-	if reason is not "" then error reason
-end requireWindow
-
-on dockClick()
-	-- Last resort when the "reopen" AppleEvent draws nothing: click the app's Dock
-	-- tile. Same intent, different delivery — the Dock raises it through the app's
-	-- own event loop rather than as an Apple event we send, which is what an app
-	-- that never wired up reopen can still answer. (There is no "New Window" menu
-	-- item to press: Conductor is single-window and single-instance.)
-	try
-		tell application "System Events" to tell application process "Dock"
-			click UI element "Conductor" of list 1
-		end tell
-		return true
-	on error
-		return false
-	end try
-end dockClick
-
-on restartConductor()
-	-- The last lever: Conductor is single-window and single-instance, so when a
-	-- running app answers neither reopen nor a Dock click there is nothing left to
-	-- press. Deliberately fire-and-forget — a cold launch is 5-10s on its own,
-	-- past what the phone's budget leaves once the send's own delays are counted —
-	-- so this returns as soon as the relaunch is under way and the caller tells the
-	-- phone to send again into a warm app. Gated by RELAY_ALLOW_RESTART, which the
-	-- relay only sets when the DB says no session is mid-turn.
-	try
-		tell application "Conductor" to quit
-	on error errText
-		return "couldn't quit Conductor to restart it: " & errText
-	end try
-	repeat with attempt from 1 to 16
-		if not (my conductorRunning()) then exit repeat
-		delay 0.25
-	end repeat
-	if my conductorRunning() then return "Conductor ignored the quit, so the relay left it alone - quit it on your Mac and try again."
-	try
-		tell application "Conductor" to activate
-	on error errText
-		return "quit Conductor but couldn't start it again: " & errText
-	end try
-	return ""
-end restartConductor
-
-on restartApp()
-	-- The restart the phone asks for (POST /api/conductor/restart), as opposed to
-	-- the one activateConductor falls back to on its own. Same lever, different
-	-- entry, and the second entry is the whole point: that fallback fires only when
-	-- a *running* Conductor draws no window, so it is unreachable for the failure
-	-- this exists for — a Conductor whose window, sidebar and composer are all fine
-	-- while its agent runtime has stopped producing output. Measured live
-	-- (2026-09-02): prompts kept landing as `session_messages` rows for hours after
-	-- the last agent frame, so every window probe here would have said "healthy".
-	--
-	-- RELAY_ALLOW_RESTART is deliberately NOT consulted. That flag exists so the
-	-- fallback never destroys work the caller didn't ask about; here the caller is
-	-- a person who pressed a button, and server.ts has already counted the working
-	-- chats from the DB and refused without `stopAgents`.
-	set refusal to my refusalReason(my windowProbe())
-	if refusal is not "" then error refusal
-	-- Behind the lock screen a relaunch comes up windowless, and once came up
-	-- wedged (answering deep links, hanging every AX read) — the same reason the
-	-- fallback refuses there. The sentence starts with the phrase both sides match
-	-- on (MAC_LOCKED in src/shared.ts) so the phone draws its unlock link.
-	if my screenLocked() is "locked" then error "The Mac is locked - relaunching Conductor behind the lock screen is what leaves it wedged, so the relay won't. Unlock the Mac and try again." & my windowEvidence()
-	set restartError to my restartConductor()
-	if restartError is not "" then error restartError & my windowEvidence()
-	-- The fallback returns the moment the relaunch starts, because it is spending a
-	-- *send's* budget and a cold launch doesn't fit beside one. This run has nothing
-	-- else to do with its budget, so it waits for the window and the phone hears
-	-- what actually happened instead of "try again": ~5-10s for a cold launch here.
-	if not my waitForWindow(60) then error "Conductor was relaunched but hasn't drawn a window yet. Give it a few seconds, then try again." & my windowEvidence()
-	return "ok"
-end restartApp
-
-on waitForWindow(attempts)
-	-- "reopen" is the dock-click Apple event, and for most apps that is what
-	-- recreates a closed window ("activate" on its own does not). Nudge a few times
-	-- across the wait: a cold launch can reach "process exists" long before it
-	-- draws anything. If reopen has drawn nothing by ~3s the app isn't answering
-	-- that event, so escalate to a real Dock click rather than repeating what has
-	-- already failed twice.
-	repeat with attempt from 1 to attempts
-		if my hasWindow() then return true
-		if attempt is 2 or attempt is 8 or attempt is 20 then
-			try
-				tell application "Conductor" to reopen
-				tell application "Conductor" to activate
-			end try
-		end if
-		if attempt is 12 or attempt is 28 then my dockClick()
-		delay 0.25
-	end repeat
-	return false
-end waitForWindow
-
-on activateConductor()
-	-- Conductor keeps running with every window closed (standard macOS: the red
-	-- button doesn't quit), and it may not be running at all. Both used to surface
-	-- as "Can't get window 1 of process Conductor. Invalid index." from whichever
-	-- handler happened to run first. So: launch-or-front it ("activate" starts it
-	-- when it isn't running), wait for a real window, then say what actually went
-	-- wrong in words the phone can act on.
-	-- Permissions first: a refusal reads as "no process, no window" from every
-	-- probe below, and waiting out the patience budget to say the wrong thing
-	-- helps nobody. A refusal is the one failure launching can't fix.
-	set firstProbe to my windowProbe()
-	set refusal to my refusalReason(firstProbe)
-	if refusal is not "" then error refusal
-	-- The lock ahead of everything else: the lock screen hides the whole session
-	-- from Accessibility, so a locked Mac reads "no window" from every probe below
-	-- and the ladder spends the patience budget, the Dock click and the evidence
-	-- sweeps discovering what one read already knew — measured live (2026-08-14),
-	-- the attempt died at the node-side ceiling as "took too long" and the phone
-	-- never heard the word "locked". Asking here also stops "activate" from
-	-- launching Conductor behind the lock screen, which is where the windowless
-	-- launches that wedged it came from. A probe that already shows a window
-	-- proves the session is unlocked (AX can't see into a locked one), so the
-	-- happy path pays nothing. The error stays retryable on purpose: the caller's
-	-- retry loop polls this cheaply until its deadline, so an unlock mid-budget
-	-- lands the send by itself — that is the observed recovery, not a theory.
-	if (item 1 of firstProbe) < 1 and my screenLocked() is "locked" then
-		error "The Mac is locked - the lock screen hides Conductor from the relay, so nothing can be sent or pressed. Unlock the Mac and try again." & my windowEvidence()
-	end if
-	try
-		tell application "Conductor" to activate
-	on error errText
-		error "couldn't bring Conductor to the front: " & errText
-	end try
-	delay 0.4
-	-- Patience sized to what we're waiting for. An app that already shows a window
-	-- returns from waitForWindow immediately, so the short budget only ever times a
-	-- redraw (~4s is plenty). Zero windows gets the cold-launch budget (~9s) even
-	-- when the process exists: the restart below is fire-and-forget, so the *next*
-	-- attempt arrives while Conductor is still drawing its first window — "process
-	-- exists, no window yet" — and a 4s wait there quits it again mid-launch,
-	-- which is how one restart becomes a loop that never lets it come up. ~9s
-	-- still fits the 28s script budget once the send's own delays are counted.
-	set patience to 16
-	if (item 1 of firstProbe) < 1 then set patience to 36
-	if my waitForWindow(patience) then return
-	-- Running, readable, and still zero windows: reopen and the Dock click have
-	-- both drawn nothing, so a restart is the only thing left. "Open it on your
-	-- Mac" is not advice a phone can act on — that is the whole point of this app.
-	if (system attribute "RELAY_ALLOW_RESTART") is "1" and (item 1 of my windowProbe()) is 0 then
-		-- Evidence before the restart tears the state down: which processes match
-		-- Conductor and who owns a window is the one fact that separates "genuinely
-		-- windowless" (a locked or unattended Mac) from "we're addressing the wrong
-		-- process" — and after the relaunch it would describe the new process, not
-		-- the state that failed. windowFailure() already carries it; this branch
-		-- used to drop it, which made a repeating no-window failure undebuggable
-		-- from the log alone.
-		set ev to my windowEvidence()
-		set lockState to my screenLocked()
-		-- AX saying "no window" is not the same as there being no window: full
-		-- screen on another Space and the lock screen both hide a live window from
-		-- AX, and restarting then destroys a window the user left open (measured
-		-- live: exactly that loop wedged Conductor for a whole evening). Only the
-		-- window server can tell the difference, so a window it CAN see blocks the
-		-- restart — this is a human's problem, said in words, not the relay's.
-		if my serverWindowCount() > 0 then
-			if lockState is "locked" then error "The Mac is locked - Conductor's window is open behind the lock screen, where the relay can't reach it. Unlock the Mac and try again." & ev
-			error "Conductor's window exists but is not reachable - it is probably full screen on another Space. Take Conductor out of full screen, then send again." & ev
-		end if
-		-- No window anywhere and the lock screen up: don't restart. Every relaunch
-		-- fired behind the lock screen in the live incident came up windowless, and
-		-- the last one came up wedged — answering deep links, hanging every AX
-		-- read. A restart here is not a lever, it is how the wreckage happened.
-		if lockState is "locked" then error "The Mac is locked and Conductor has no window. Relaunching behind the lock screen is what leaves it wedged, so the relay won't - unlock the Mac and try again." & ev
-		set restartError to my restartConductor()
-		if restartError is not "" then error restartError & ev
-		error "Conductor was running with no window and ignored both reopen and a Dock click, so the relay restarted it. Give it a few seconds and send again." & ev
-	end if
-	my requireWindow()
-end activateConductor
-
-on webArea()
-	-- The webview root: the window, then four nested containers. Guarded, or a
-	-- window that closed mid-run reappears as an "Invalid index" from a caller
-	-- that has nothing to do with windows.
-	my requireWindow()
-	tell application "System Events" to tell process "Conductor"
-		return UI element 1 of UI element 1 of UI element 1 of UI element 1 of window 1
-	end tell
-end webArea
-
-on sidebarLinks()
-	-- The sidebar rows are AXLinks named "<repo> <title> +adds -dels". They live
-	-- two levels under the web area; collect them wherever they are at that depth.
-	--
-	-- `get` in front of each `whose` clause is load-bearing, and it is the whole
-	-- cost of this handler. Without it the clause stays a *reference*, so pulling
-	-- the elements out of it one at a time re-runs the filter against the live tree
-	-- for each one: measured on a 45-row sidebar, walking the references cost
-	-- 10.8s against 0.9s for the same query forced to a list once. That is paid by
-	-- every send the deep link doesn't answer and by every status change, which has
-	-- no path but this one.
-	set wa to my webArea()
-	tell application "System Events" to tell process "Conductor"
-		set out to {}
-		repeat with a in (UI elements of wa)
-			try
-				set out to out & (get UI elements of a whose role is "AXLink")
-				repeat with b in (UI elements of a)
-					set out to out & (get UI elements of b whose role is "AXLink")
-				end repeat
-			end try
-		end repeat
-		return out
-	end tell
-end sidebarLinks
-
-on findSidebarRowOnce()
-	set titles to my targetSidebarTitles()
-	if (count of titles) is 0 then return missing value
-	set repoName to system attribute "RELAY_WS_REPO"
-	set pair to my sidebarRowsAndNames()
-	set refs to item 1 of pair
-	set nms to item 2 of pair
-	set total to count of refs
-	if total is 0 or (count of nms) is not total then return missing value
-	repeat with candidate in titles
-		set needle to candidate as text
-		if needle is not "" then
-			set hits to {}
-			repeat with i from 1 to total
-				set rowName to my textOrEmpty(item i of nms)
-				if rowName contains needle then
-					if repoName is "" or rowName contains repoName then set end of hits to i
-				end if
-			end repeat
-			if (count of hits) is 1 then
-				set idx to item 1 of hits
-				set hit to item idx of refs
-				-- The references and the names are two reads, so a sidebar that
-				-- re-rendered between them (every commit rewrites a row's
-				-- "+adds -dels") would have shifted the index under us — and pressing
-				-- the neighbour sets the wrong workspace's status, which is the one
-				-- failure this whole file is built to refuse. Confirm the element
-				-- still carries the name it was picked for.
-				if (my axName(hit)) is (my textOrEmpty(item idx of nms)) then return hit
-				return missing value
-			end if
-		end if
-	end repeat
-	return missing value
-end findSidebarRowOnce
-
-on findSidebarRow()
-	-- The workspace's own sidebar row. Only rows that are actually rendered exist
-	-- in the AX tree (a collapsed section has none — expandSections is what opens
-	-- those), and the title follows Conductor's precedence, so we try each
-	-- candidate and require a *unique* hit — anything ambiguous returns nothing
-	-- rather than guessing at a neighbour. Two passes because the only thing that
-	-- fails the check inside is a sidebar that moved mid-read, and that is worth
-	-- one cheap retry.
-	set hit to my findSidebarRowOnce()
-	if hit is not missing value then return hit
-	return my findSidebarRowOnce()
-end findSidebarRow
-
-on textOrEmpty(v)
-	try
-		if v is missing value then return ""
-		return v as text
-	on error
-		return ""
-	end try
-end textOrEmpty
-
-on childRoles(el)
-	-- Every child's role in *one* Apple event. Every AX read here is a round trip
-	-- to another process, so asking element by element is what turned a sidebar
-	-- scan into 15 seconds — more, by itself, than this write's whole budget.
-	tell application "System Events" to tell process "Conductor"
-		try
-			return role of (UI elements of el)
-		on error
-			return {}
-		end try
-	end tell
-end childRoles
-
-on childRolesAndNames(el)
-	tell application "System Events" to tell process "Conductor"
-		try
-			return {role of (UI elements of el), name of (UI elements of el)}
-		on error
-			return {{}, {}}
-		end try
-	end tell
-end childRolesAndNames
-
-on looksLikeSidebarList(el)
-	-- The sidebar's workspace list is one flat run of section headers
-	-- (AXStaticText) and workspace rows (AXLink), with nothing else beside them.
-	-- That shape is the whole test, because the *transcript* hangs off the same
-	-- web area and holds AXLinks of its own — "the element with links in it"
-	-- would happily hand back a message bubble, and every press below would then
-	-- land in one.
-	set roleList to my childRoles(el)
-	if (count of roleList) is 0 then return false
-	set seenLink to false
-	repeat with r in roleList
-		set rt to my textOrEmpty(contents of r)
-		if rt is "AXLink" then
-			set seenLink to true
-		else if rt is not "AXStaticText" then
-			return false
-		end if
-	end repeat
-	return seenLink
-end looksLikeSidebarList
-
-on sidebarList()
-	-- Found by that shape rather than by an index, since the chrome above it
-	-- (project pickers, the resource-usage button) comes and goes. Two levels
-	-- deep, the same reach sidebarLinks() uses.
-	set wa to my webArea()
-	repeat with a in (my axKids(wa))
-		set nodeA to contents of a
-		if my looksLikeSidebarList(nodeA) then return nodeA
-		repeat with b in (my axKids(nodeA))
-			set nodeB to contents of b
-			if my looksLikeSidebarList(nodeB) then return nodeB
-		end repeat
-	end repeat
-	return missing value
-end sidebarList
-
-on sidebarRowsAndNames()
-	-- Every sidebar row paired with its name. Two Apple events off the list found
-	-- above, against one per row before.
-	set listEl to my sidebarList()
-	if listEl is not missing value then
-		tell application "System Events" to tell process "Conductor"
-			try
-				return {(UI elements of listEl whose role is "AXLink"), name of (UI elements of listEl whose role is "AXLink")}
-			end try
-		end tell
-	end if
-	-- No list matched the shape, so Conductor has reorganised its sidebar. Fall
-	-- back to the broad two-level sweep and one name read per row: slow, and the
-	-- reason the fast path exists, but it assumes nothing about the layout.
-	set refs to my sidebarLinks()
-	set nms to {}
-	repeat with entry in refs
-		set end of nms to my axName(contents of entry)
-	end repeat
-	return {refs, nms}
-end sidebarRowsAndNames
-
-on looksNumeric(t)
-	-- A folded section draws its row count where its rows would be. That number is
-	-- a sibling of the header, not a child of it, so it has to be told apart from a
-	-- header by hand — digits only, which no status or repo name is.
-	if t is "" then return false
-	repeat with c in (characters of t)
-		if "0123456789" does not contain (c as text) then return false
-	end repeat
-	return true
-end looksNumeric
-
-on collapsedSectionNames()
-	-- The sections someone has folded shut. A section's rows are *siblings* of
-	-- its header, so an expanded one is followed by an AXLink and a collapsed one
-	-- by its count, by the next header, or by nothing — and a collapsed section
-	-- renders no rows at all, which is why its workspaces are invisible to
-	-- Accessibility. Names, not element references: everything below re-finds the
-	-- header when it needs it, because the list re-renders under us (a status
-	-- change moves a row to another group) and a System Events reference is an
-	-- index into a tree that has already changed.
-	set listEl to my sidebarList()
-	if listEl is missing value then return {}
-	set pair to my childRolesAndNames(listEl)
-	set roleList to item 1 of pair
-	set nameList to item 2 of pair
-	set total to count of roleList
-	if total is 0 or (count of nameList) is not total then return {}
-	set out to {}
-	repeat with i from 1 to total
-		if (my textOrEmpty(item i of roleList)) is "AXStaticText" then
-			set nm to my textOrEmpty(item i of nameList)
-			if nm is not "" and not (my looksNumeric(nm)) then
-				set nextRole to ""
-				if i < total then set nextRole to my textOrEmpty(item (i + 1) of roleList)
-				if nextRole is not "AXLink" then set end of out to nm
-			end if
-		end if
-	end repeat
-	return out
-end collapsedSectionNames
-
-on sectionHeaderNamed(wanted)
-	-- Unique or nothing, like every other lookup here: two sections cannot share
-	-- a name, so an ambiguous hit means we are reading the wrong list.
-	set listEl to my sidebarList()
-	if listEl is missing value then return missing value
-	tell application "System Events" to tell process "Conductor"
-		try
-			set hits to (UI elements of listEl whose role is "AXStaticText" and name is wanted)
-		on error
-			return missing value
-		end try
-	end tell
-	if (count of hits) is 1 then return item 1 of hits
-	return missing value
-end sectionHeaderNamed
-
-on toggleSection(headerName)
-	set head to my sectionHeaderNamed(headerName)
-	if head is missing value then return false
-	tell application "System Events" to tell process "Conductor"
-		try
-			perform action "AXScrollToVisible" of head
-		end try
-		try
-			perform action "AXPress" of head
-			return true
-		on error
-			return false
-		end try
-	end tell
-end toggleSection
-
-on expandSections()
-	-- Open every folded section and report which ones we opened, so the caller can
-	-- put the sidebar back the way it found it. The header is the whole control —
-	-- it carries AXPress and toggles the group — so this needs no chevron, which
-	-- the webview does not expose anyway.
-	set opened to {}
-	repeat with nm in (my collapsedSectionNames())
-		if my toggleSection(nm as text) then set end of opened to (nm as text)
-	end repeat
-	if (count of opened) > 0 then delay 0.6
-	return opened
-end expandSections
-
-on restoreSections(names)
-	-- Fold back exactly what we opened. Best-effort on purpose: this runs after
-	-- the write has already landed, so a header that moved or vanished must not
-	-- turn a status change that worked into a reported failure.
-	repeat with nm in names
-		try
-			my toggleSection(nm as text)
-		end try
-	end repeat
-end restoreSections
-
-on focusViaSidebar()
-	-- Press that row: no keystrokes at all, so nothing can be swallowed by a
-	-- focused field or fire a palette *command*. Being wrong is survivable here —
-	-- assertWorkspace re-checks before we type — and a miss falls back to the palette.
-	set hit to my findSidebarRow()
-	if hit is missing value then return false
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of hit
-	end tell
-	delay 0.9
-	return true
-end focusViaSidebar
-
-on focusViaPalette()
-	tell application "System Events"
-		key code 53
-		delay 0.25
-		keystroke "k" using {command down}
-		delay 0.7
-		keystroke (my targetField(2))
-		delay 0.9
-		key code 36
-		delay 1.3
-	end tell
-end focusViaPalette
-
-on paneAgrees()
-	-- Nothing in the open pane contradicts the target: a chat pane is there and its
-	-- header assertion passed (which is a no-op when there's no branch to check it
-	-- against). This is what confirms a sidebar press landed.
-	try
-		set strips to my tabGroups()
-		if (count of strips) is 0 then return false
-		my assertWorkspace(item 1 of strips)
-		return true
-	end try
-	return false
-end paneAgrees
-
-on atTargetWorkspace()
-	-- "Are we already there?" — the *strict* form of the question, so it needs a
-	-- branch to have been checked and not merely skipped. Worth asking first because
-	-- the pane header answers in ~0.5s where reading the sidebar's rows to press one
-	-- measured 5-7s, and ~1s since that scan went to bulk reads — still the larger
-	-- cost of the two: a phone sends to the same workspace over and over, and
-	-- Conductor stays where it was left. Safe as a shortcut because it *is* the
-	-- assertion the send makes before typing anyway.
-	if (system attribute "RELAY_WS_BRANCH") is "" then return false
-	return my paneAgrees()
-end atTargetWorkspace
-
-on openViaDeepLink()
-	-- Conductor's *own* workspace link, the one its sidebar row menu copies under
-	-- "Copy link" (Cmd+Shift+C): one URL carrying the workspace id and the chat id,
-	-- addressed the way the relay already reads them rather than by any label a
-	-- release can rename. It replaces the entire focus dance below - no sidebar
-	-- scan, no palette keystrokes, no title precedence to reproduce - and measures
-	-- ~0.6s against the 5-10s the row press costs on a 30-workspace sidebar.
-	--
-	-- Two things it fixes outright rather than merely speeding up. It navigates by
-	-- *id*, so a collapsed sidebar section (which hides the row from Accessibility
-	-- entirely) stops mattering; and it opens the chat tab explicitly, so a pane
-	-- left on a file view or a terminal - where the chat strip does not exist in
-	-- the AX tree at all, and every send failed with "couldn't identify the chat
-	-- tab strip" - comes back to the composer on its own.
-	--
-	-- Still fail-closed: the URL is fire-and-forget, so what counts as success is
-	-- the same pane assertion every other path here has to pass. A Conductor
-	-- without the route (before 0.71) ignores it silently, and a scheme macOS
-	-- can't resolve fails the "open" outright - both fall through to the sidebar.
-	set linkURL to system attribute "RELAY_WS_LINK"
-	if linkURL is "" then return false
-	try
-		do shell script "open " & quoted form of linkURL
-	on error
-		return false
-	end try
-	-- Bounded on purpose: this poll is also the cost of *not* having the route, and
-	-- the fallback below still has to run inside the same budget afterwards.
-	repeat with attempt from 1 to 10
-		delay 0.15
-		if my paneAgrees() then return true
-	end repeat
-	return false
-end openViaDeepLink
-
-on focusWorkspace()
-	if (my targetField(2)) is "" then return
-	if my openViaDeepLink() then return
-	if my atTargetWorkspace() then return
-	if my focusViaSidebar() then
-		if my paneAgrees() then return
-	end if
-	my focusViaPalette()
-end focusWorkspace
-
-on tabGroups()
-	-- Level-order search, returning every tab group at the shallowest depth that
-	-- has one (the chat strip and the terminal strip are siblings). Bounded: the
-	-- pane sits ~5 levels down, and we must never descend into the transcript.
-	my requireWindow()
-	tell application "System Events" to tell process "Conductor"
-		set level to {window 1}
-		set depth to 0
-		repeat while (count of level) > 0 and depth < 8
-			set found to {}
-			set nextLevel to {}
-			repeat with entry in level
-				set node to contents of entry
-				try
-					set found to found & (get UI elements of node whose role is "AXTabGroup")
-					set nextLevel to nextLevel & (get UI elements of node)
-				end try
-			end repeat
-			if (count of found) > 0 then return found
-			set level to nextLevel
-			set depth to depth + 1
-		end repeat
-	end tell
-	return {}
-end tabGroups
-
-on stripRadios(tg)
-	-- Every radio button in a tab strip, whether it is a direct child or sits one
-	-- group deep, in tree order. Both shapes are live at once: the terminal strip's
-	-- tabs are direct children, while a chat tab is wrapped in its own AXGroup with
-	-- the file-view toggle beside it as a plain child. Reading only the direct ones
-	-- (and stopping as soon as any turned up) is what made a chat strip look like a
-	-- one-tab strip called "Close file view".
-	tell application "System Events" to tell process "Conductor"
-		set acc to {}
-		repeat with k in (UI elements of tg)
-			set node to contents of k
-			if (role of node) is "AXRadioButton" then
-				set end of acc to node
-			else
-				try
-					set acc to acc & (get UI elements of node whose role is "AXRadioButton")
-				end try
-			end if
-		end repeat
-		return acc
-	end tell
-end stripRadios
-
-on chatTabs(tg)
-	-- Of those, a chat tab is the one whose accessible name is its own close action,
-	-- "Close chat <title>". The strip's other radio button is "Close file view",
-	-- which is not a chat and must not shift the indices this file addresses tabs
-	-- by — off by one is how a prompt lands in the wrong conversation. Falls back to
-	-- every radio button when none carries the prefix, so a renamed label costs the
-	-- filter rather than emptying the strip.
-	set radios to my stripRadios(tg)
-	set chats to {}
-	repeat with entry in radios
-		set node to contents of entry
-		if (my axName(node)) starts with "Close chat" then set end of chats to node
-	end repeat
-	if (count of chats) > 0 then return chats
-	return radios
-end chatTabs
-
-on tabLabel(t)
-	tell application "System Events" to tell process "Conductor"
-		return (name of t) as text
-	end tell
-end tabLabel
-
-on pickChatStrip(strips, wantCount, wantTitle)
-	-- Score each candidate strip: a label match outweighs a tab-count match, and
-	-- a tie means we cannot tell the chat strip from the terminal strip.
-	set best to missing value
-	set bestTabs to {}
-	set bestScore to 0
-	set tied to false
-	repeat with entry in strips
-		set tg to contents of entry
-		set strip to my chatTabs(tg)
-		set score to 0
-		if wantCount > 0 and (count of strip) is wantCount then set score to score + 1
-		if wantTitle is not "" then
-			repeat with t in strip
-				if (my tabLabel(t)) contains wantTitle then
-					set score to score + 2
-					exit repeat
-				end if
-			end repeat
-		end if
-		if score > bestScore then
-			set bestScore to score
-			set best to tg
-			set bestTabs to strip
-			set tied to false
-		else if score is bestScore and score > 0 then
-			set tied to true
-		end if
-	end repeat
-	if bestScore is 0 then error "couldn't identify the chat tab strip"
-	if tied then error "can't tell which tab strip holds the target chat"
-	return {best, bestTabs}
-end pickChatStrip
-
-on lastPathSegment(s)
-	set saved to AppleScript's text item delimiters
-	set AppleScript's text item delimiters to "/"
-	set parts to text items of s
-	set AppleScript's text item delimiters to saved
-	return item -1 of parts
-end lastPathSegment
-
-on paneLabels(tg, wantRole)
-	-- Kept out of the caller's scope on purpose: inside a System Events tell,
-	-- ordinary-looking names (tabs, count) resolve as app terms instead of vars.
-	tell application "System Events" to tell process "Conductor"
-		set pane to value of attribute "AXParent" of tg
-		return (name of (UI elements of pane whose role is wantRole))
-	end tell
-end paneLabels
-
-on anyContains(haystack, needle)
-	repeat with entry in haystack
-		try
-			if (entry as text) contains needle then return true
-		end try
-	end repeat
-	return false
-end anyContains
-
-on assertWorkspace(tg)
-	-- The pane holding the chat strip also labels the open workspace: an
-	-- AXStaticText with the branch (sans owner prefix) and a repo popup button.
-	set wantBranch to system attribute "RELAY_WS_BRANCH"
-	if wantBranch is "" then return
-	set tail to my lastPathSegment(wantBranch)
-	if not (my anyContains(my paneLabels(tg, "AXStaticText"), tail)) then
-		error "the palette didn't land on " & tail
-	end if
-	set wantRepo to system attribute "RELAY_WS_REPO"
-	if wantRepo is not "" then
-		if not (my anyContains(my paneLabels(tg, "AXPopUpButton"), wantRepo)) then
-			error "the palette didn't land in " & wantRepo
-		end if
-	end if
-end assertWorkspace
-
-on normalizeNewlines(s)
-	-- "do shell script" hands back CR-delimited text; the composer reads back LF.
-	-- Without this the verification below never matches a multi-line prompt.
-	set saved to AppleScript's text item delimiters
-	set AppleScript's text item delimiters to return
-	set parts to text items of s
-	set AppleScript's text item delimiters to linefeed
-	set joined to parts as text
-	set AppleScript's text item delimiters to saved
-	return joined
-end normalizeNewlines
-
-on composerField()
-	-- The composer's AXTextArea: an AXGroup named "composer" in the chat pane, one
-	-- text area inside it. Resolved once and handed to both the fill and the send
-	-- confirm below, because reaching it means walking the pane from the tab strip
-	-- and that walk measured ~0.5s on a live window. Returns missing value when the
-	-- composer isn't there at all, which is the caller's cue to fall back to pasting.
-	set strips to my tabGroups()
-	if (count of strips) is 0 then return missing value
-	try
-		tell application "System Events" to tell process "Conductor"
-			set pane to value of attribute "AXParent" of (item 1 of strips)
-			set composerBox to item 1 of (UI elements of pane whose name is "composer")
-			return item 1 of (UI elements of composerBox whose role is "AXTextArea")
-		end tell
-	end try
-	return missing value
-end composerField
-
-on composerTextOf(textBox)
-	-- What the box holds now, or missing value when it cannot be read at all. A pane
-	-- that re-rendered leaves the old reference pointing at a dead element, and
-	-- "can't read it" must never be reported as "still holding the prompt": that is
-	-- the one state that presses Enter again, and it would do so at the moment the
-	-- box may already be empty.
-	try
-		tell application "System Events" to tell process "Conductor"
-			return (value of textBox) as text
-		end tell
-	end try
-	return missing value
-end composerTextOf
-
-on fillComposer(textBox, promptText)
-	-- Write the prompt straight into the composer's AXTextArea instead of
-	-- stashing the clipboard, pressing Cmd+L and pasting. AXFocused and AXValue
-	-- are both settable, so this needs no keystrokes and no clipboard hijack.
-	-- Returns false (→ caller falls back to pasting) if anything looks off, but
-	-- *clears whatever it wrote first*: leaving half a prompt behind would make
-	-- the fallback paste append to it and send a garbled prompt.
-	if promptText is "" then return false
-	if textBox is missing value then return false
-	try
-		tell application "System Events" to tell process "Conductor"
-			set value of attribute "AXFocused" of textBox to true
-			set value of textBox to promptText
-			delay 0.25
-			if ((value of textBox) as text) does not contain promptText then
-				set value of textBox to ""
-				return false
-			end if
-		end tell
-	on error
-		try
-			my clearComposer(textBox)
-		end try
-		return false
-	end try
-	return true
-end fillComposer
-
-on clearComposer(textBox)
-	if textBox is missing value then return
-	tell application "System Events" to tell process "Conductor"
-		set value of textBox to ""
-	end tell
-end clearComposer
-
-on pressSend(queueIt)
-	-- Return sends, Command-Return queues the prompt behind the running answer.
-	-- The choice is made out here because inside a System Events tell an ordinary
-	-- parameter name can resolve as one of its own terms.
-	if queueIt then
-		tell application "System Events" to key code 36 using {command down}
-	else
-		tell application "System Events" to key code 36
-	end if
-end pressSend
-
-on submitComposer(textBox, promptText, queueIt)
-	-- Press Enter, then read the composer back. Conductor consumes the draft when it
-	-- accepts a prompt, so a box still holding the text is a keystroke that did
-	-- nothing — and that read is the only receipt a run can collect about its own
-	-- send.
-	--
-	-- Why it earns its place: the caller's other receipt is the transcript row, which
-	-- costs a 6s watch (CONFIRM_WINDOW_MS in server.ts) and then a whole second run
-	-- through activate, focus, tab and fill. Measured from this Mac's own relay logs,
-	-- a send whose single fault was a first Enter Conductor ignored took ~10s from the
-	-- prompt appearing in the composer to it being sent, with the text sitting on
-	-- screen the whole way. Exactly one user row was written, so the keystroke was
-	-- lost rather than delayed.
-	--
-	-- Pressing again is safe *because* of the read, not in spite of it: the prompt is
-	-- still in the box, so nothing was consumed, so there is nothing to duplicate.
-	-- The one state that would break that is a Conductor which queues on Command-Return
-	-- and *keeps* the draft, since the box would then read as unsent after a send that
-	-- worked. Unverified against the live app, and the only path that could reach it is
-	-- Command-Return in the phone's composer (Composer.tsx, a hardware keyboard); a tap
-	-- always sends. Worth checking before anything else starts queueing.
-	-- A Conductor too busy to have handled the first Enter is also too busy to answer
-	-- an AX read, which blocks here rather than handing back stale text.
-	--
-	-- **Two presses, not three, and the second one is on probation.** The first
-	-- occurrence in the wild (2026-09-01 16:59:57) had the box survive all three, and
-	-- no send has ever been recorded as rescued by a later press — so the value here
-	-- is the *detection*, which lets the caller stop watching for a row that cannot
-	-- come (`sendNeverStarted` in writes.ts) rather than spending the 6s window on it.
-	-- Every press past the first that doesn't work is pure delay added to a send that
-	-- is already failing, which is why the budget shrank from 3×1.2s to 2×0.8s.
-	--
-	-- Returns the press that cleared the box, or 0 for a box that never cleared. The
-	-- count is the point: a rescued send is otherwise indistinguishable from one that
-	-- worked first time, so the failure this handler exists for would stop appearing
-	-- in the log the day it stopped costing 10s, and nobody could tell whether it was
-	-- fixed or merely hidden.
-	if promptText is "" then
-		my pressSend(queueIt)
-		return 1
-	end if
-	repeat with pressCount from 1 to 2
-		my pressSend(queueIt)
-		if textBox is missing value then return pressCount
-		repeat with tick from 1 to 4
-			delay 0.2
-			set seen to my composerTextOf(textBox)
-			if seen is missing value then return pressCount
-			if seen does not contain promptText then return pressCount
-		end repeat
-	end repeat
-	return 0
-end submitComposer
-
-on pasteComposer()
-	-- Fallback for when the composer isn't reachable: Cmd+L focuses it (after the
-	-- palette, focus sits on a button, not the text box), then paste.
-	tell application "System Events"
-		set the clipboard to (do shell script "cat" & " " & quoted form of (system attribute "RELAY_PROMPT_FILE"))
-		keystroke "l" using {command down}
-		delay 0.3
-		keystroke "v" using {command down}
-		delay 0.15
-	end tell
-end pasteComposer
-
-on selectChatTab()
-	set wantIndex to (system attribute "RELAY_TAB_INDEX") as integer
-	if wantIndex is 0 then return
-	set wantCount to (system attribute "RELAY_TAB_COUNT") as integer
-	set wantTitle to my targetField(1)
-	set strips to my tabGroups()
-	if (count of strips) is 0 then
-		-- A lone chat has no ambiguity to resolve; more than one and we must not guess.
-		if wantCount <= 1 then return
-		error "couldn't find the chat tab strip"
-	end if
-	-- Assert the workspace first: every strip lives in the same pane, so this
-	-- reports "wrong workspace" rather than a confusing "no chat strip".
-	my assertWorkspace(item 1 of strips)
-	set picked to my pickChatStrip(strips, wantCount, wantTitle)
-	set tabs to item 2 of picked
-	tell application "System Events" to tell process "Conductor"
-		set target to missing value
-		if wantIndex <= (count of tabs) then
-			set candidate to contents of (item wantIndex of tabs)
-			if wantTitle is "" or (name of candidate) contains wantTitle then set target to candidate
-		end if
-		if target is missing value and wantTitle is not "" then
-			repeat with t in tabs
-				if (name of t) contains wantTitle then
-					if target is not missing value then error "several chat tabs match " & wantTitle
-					set target to contents of t
-				end if
-			end repeat
-		end if
-		if target is missing value then error "chat tab " & wantIndex & " not found"
-		if (value of target) is not true then
-			perform action "AXPress" of target
-			delay 0.5
-		end if
-		if (value of target) is not true then error "couldn't switch to the target chat tab"
-	end tell
-end selectChatTab
-
--- The workspace toolbar's run process. This is deliberately separate from the
--- chat-strip targeting above: the terminal strip is the sibling AXTabGroup whose
--- direct radio buttons include Setup / Run / Terminal, and its task button is
--- named "Run <task>" or "Stop <task>". Conductor may add more terminal tabs, so
--- identify the strip by the Run radio rather than by its position.
-on runStrip()
-	set matches to {}
-	repeat with entry in my tabGroups()
-		set tg to contents of entry
-		set hasRunTab to false
-		repeat with r in my stripRadios(tg)
-			if (my axName(contents of r)) is "Run" then set hasRunTab to true
-		end repeat
-		if hasRunTab then set end of matches to tg
-	end repeat
-	if (count of matches) is 0 then error "couldn't find Conductor's Run panel"
-	if (count of matches) > 1 then error "can't tell which panel holds Conductor's Run task"
-	return item 1 of matches
-end runStrip
-
-on runTaskButton(tg)
-	set matches to {}
-	tell application "System Events" to tell process "Conductor"
-		repeat with entry in (get UI elements of tg whose role is "AXButton")
-			set node to contents of entry
-			set label to my axName(node)
-			if label starts with "Run " or label starts with "Stop " then set end of matches to node
-		end repeat
-	end tell
-	if (count of matches) is 0 then error "this workspace has no selected Run task"
-	if (count of matches) > 1 then error "Conductor exposed more than one selected Run task"
-	return item 1 of matches
-end runTaskButton
-
-on runTaskChooser(tg)
-	set found to {}
-	tell application "System Events" to tell process "Conductor"
-		repeat with entry in (get UI elements of tg whose role is "AXPopUpButton")
-			set node to contents of entry
-			if (my axName(node)) is "Select task" then set end of found to node
-		end repeat
-	end tell
-	if (count of found) is 0 then return missing value
-	if (count of found) > 1 then error "Conductor exposed more than one Run task chooser"
-	return item 1 of found
-end runTaskChooser
-
-on openRunTaskMenu(tg)
-	-- Multiple Run configs live behind a Radix pop-up. AXPress is advertised but
-	-- does nothing on this control; focusing it and pressing Space opens the real
-	-- AXMenu. Choosing an item starts the task immediately — there is no second
-	-- press on the primary Run button. "Configure" is Conductor's own trailing
-	-- command, not a task choice.
-	set chooser to my runTaskChooser(tg)
-	if chooser is missing value then error "this workspace has no Run config chooser"
-	tell application "System Events" to tell process "Conductor"
-		set value of attribute "AXFocused" of chooser to true
-	end tell
-	tell application "System Events" to key code 49
-	delay 0.4
-	set choices to {}
-	set wa to my webArea()
-	tell application "System Events" to tell process "Conductor"
-		repeat with m in (get UI elements of wa whose role is "AXMenu")
-			repeat with entry in (get UI elements of m whose role is "AXMenuItem")
-				set node to contents of entry
-				set label to my axName(node)
-				if label is not "" and label is not "Configure" then set end of choices to node
-			end repeat
-		end repeat
-	end tell
-	return choices
-end openRunTaskMenu
-
-on startRunTaskNamed(tg, wantedTask)
-	try
-		set matches to {}
-		repeat with entry in my openRunTaskMenu(tg)
-			set node to contents of entry
-			if (my axName(node)) is wantedTask then set end of matches to node
-		end repeat
-		if (count of matches) is 0 then error "no Run config named " & wantedTask
-		if (count of matches) > 1 then error "several Run configs match " & wantedTask
-		tell application "System Events" to tell process "Conductor"
-			perform action "AXPress" of item 1 of matches
-		end tell
-	on error errText number errNum
-		tell application "System Events" to key code 53
-		error errText number errNum
-	end try
-end startRunTaskNamed
-
-on startSoleRunTask(tg)
-	try
-		set choices to my openRunTaskMenu(tg)
-		if (count of choices) is 0 then error "Conductor's Run menu contains no tasks"
-		if (count of choices) > 1 then error "choose which Run config to start"
-		tell application "System Events" to tell process "Conductor"
-			perform action "AXPress" of item 1 of choices
-		end tell
-	on error errText number errNum
-		tell application "System Events" to key code 53
-		error errText number errNum
-	end try
-end startSoleRunTask
-
-on runTaskState(btn)
-	set label to my axName(btn)
-	if label starts with "Stop " then return "running"
-	if label starts with "Run " then return "stopped"
-	error "couldn't read Conductor's Run task state"
-end runTaskState
-
-on runTaskName(btn)
-	set label to my axName(btn)
-	if label starts with "Stop " then return text 6 thru -1 of label
-	if label starts with "Run " then return text 5 thru -1 of label
-	return label
-end runTaskName
-
-on linkDestination(controlEl)
-	tell application "System Events" to tell process "Conductor"
-		try
-			return value of attribute "AXURL" of controlEl as text
-		on error
-			return ""
-		end try
-	end tell
-end linkDestination
-
-on openRunTargets(tg)
-	set foundPorts to {}
-	set foundLinks to {}
-	tell application "System Events" to tell process "Conductor"
-		set controls to UI elements of tg
-	end tell
-	repeat with entry in controls
-		set node to contents of entry
-		tell application "System Events" to tell process "Conductor"
-			set nodeRole to role of node
-		end tell
-		if nodeRole is "AXButton" or nodeRole is "AXLink" then
-			set label to my axName(node)
-			if label starts with "Open" then
-				set destination to my linkDestination(node)
-				if destination starts with "http://" or destination starts with "https://" then set end of foundLinks to destination
-				if label starts with "Open :" then set end of foundPorts to text 7 thru -1 of label
-			end if
-		end if
-	end repeat
-	return {foundPorts, foundLinks}
-end openRunTargets
-
-on setRunTask(wantRunning, wantedTask)
-	my activateConductor()
-	my focusWorkspace()
-	set tg to my runStrip()
-	my assertWorkspace(tg)
-	set btn to my runTaskButton(tg)
-	set beforeState to my runTaskState(btn)
-	set taskName to my runTaskName(btn)
-	set wantedState to "stopped"
-	if wantRunning then set wantedState to "running"
-	set changed to "false"
-	if wantRunning and wantedTask is not "" and beforeState is "running" and taskName is not wantedTask then error taskName & " is already running; stop it before starting " & wantedTask
-
-	if beforeState is not wantedState then
-		if wantRunning and wantedTask is not "" then
-			my startRunTaskNamed(tg, wantedTask)
-		else if wantRunning and (my runTaskChooser(tg)) is not missing value then
-			-- Legacy settings carry no name to the relay. Preserve their one-tap
-			-- behavior only when the live menu independently confirms one choice.
-			my startSoleRunTask(tg)
-		else
-			tell application "System Events" to tell process "Conductor"
-				perform action "AXPress" of btn
-			end tell
-		end if
-		set changed to "true"
-	end if
-
-	-- The panel re-renders after the press, invalidating every old AX handle.
-	-- Re-find it on each poll and require the opposite label before reporting the
-	-- action as complete. A started web server gets a short second window in which
-	-- Conductor can surface its Open control. New controls may expose their exact
-	-- AXURL; current builds expose only "Open :<port>". Non-server tasks return
-	-- with both lists empty.
-	set currentState to beforeState
-	set ports to {}
-	set previewURLs to {}
-	repeat with attempt from 1 to 44
-		set tg to my runStrip()
-		set btn to my runTaskButton(tg)
-		set currentState to my runTaskState(btn)
-		set taskName to my runTaskName(btn)
-		if currentState is wantedState then
-			if wantRunning and wantedTask is not "" and taskName is not wantedTask then error "Conductor started " & taskName & " instead of " & wantedTask
-			set runTargets to my openRunTargets(tg)
-			set ports to item 1 of runTargets
-			set previewURLs to item 2 of runTargets
-			if not wantRunning or (count of ports) > 0 or (count of previewURLs) > 0 or attempt > 20 then exit repeat
-		end if
-		delay 0.25
-	end repeat
-	if currentState is not wantedState then error "Conductor's Run task did not switch to " & wantedState
-	return currentState & tab & taskName & tab & changed & tab & my joinList(ports, ",") & tab & my joinList(previewURLs, ASCII character 30)
-end setRunTask
-
-on cancelAgent()
-	-- Stop the answer this chat is streaming: Conductor's own "Cancel agent"
-	-- command, Command-Shift-Delete (key code 51). Taken from its Keyboard
-	-- shortcuts dialog (Command-slash, section "Chat"), not guessed - and it is
-	-- the only lever there is. The menu bar carries no stop command and neither
-	-- does the palette, and the composer's stop BUTTON is unnamed to
-	-- Accessibility: no title, no description, no help, no identifier, telling
-	-- itself apart from the send button beside it only by its Tailwind classes.
-	-- Which is a distinction worth nothing at the moment it matters, because
-	-- while a chat is working with a draft in the composer BOTH buttons are on
-	-- screen - stop on the left, send on the right - so "press the last button"
-	-- steers the running agent with whatever was half-typed instead of stopping
-	-- it. A keystroke can't confuse the two.
-	--
-	-- The keystroke lands wherever focus is, so this asserts the pane first, the
-	-- same check a send makes before typing. Cancelling the wrong agent destroys
-	-- work that was running fine, which is the same class of damage as landing a
-	-- prompt in the wrong chat and gets the same answer: error out, never guess.
-	set strips to my tabGroups()
-	if (count of strips) is 0 then error "couldn't find the chat pane to cancel in"
-	my assertWorkspace(item 1 of strips)
-	-- Command-L ("Focus chat input") first, so the shortcut is delivered inside the
-	-- chat view rather than to a terminal panel that had focus, where the terminal
-	-- would swallow it. It also parks focus somewhere harmless: the composer keeps
-	-- its draft, since Conductor binds this chord to Cancel agent rather than to any
-	-- text-deletion the field would otherwise do with it.
-	tell application "System Events"
-		keystroke "l" using {command down}
-		delay 0.2
-		key code 51 using {command down, shift down}
-	end tell
-	delay 0.3
-end cancelAgent
-
-on closeChatTab()
-	-- Hide the selected chat through Conductor's own Close tab shortcut, Command-W.
-	-- The same chord closes a terminal tab when the terminal has focus, so Command-L
-	-- first is load-bearing: it moves focus into the chat whose workspace and tab were
-	-- asserted immediately above this handler.
-	set strips to my tabGroups()
-	if (count of strips) is 0 then error "couldn't find the chat pane to close from"
-	my assertWorkspace(item 1 of strips)
-	tell application "System Events"
-		keystroke "l" using {command down}
-		delay 0.2
-		keystroke "w" using {command down}
-	end tell
-
-	-- Conductor asks "Close anyway" when the chat's agent is still running. The
-	-- server normally catches that from sessions.status before touching the UI, but
-	-- a turn can start in the gap between that read and this keystroke. Detect the
-	-- live dialog too, and never infer permission to hide a running conversation.
-	set confirmEl to missing value
-	set checks to 1
-	if (system attribute "RELAY_CLOSE_RUNNING") is "1" then set checks to 4
-	repeat with attempt from 1 to checks
-		delay 0.25
-		set confirmEl to my closeConfirmButton()
-		if confirmEl is not missing value then exit repeat
-	end repeat
-	if confirmEl is missing value then return "closed"
-	if (system attribute "RELAY_CLOSE_RUNNING") is not "1" then
-		tell application "System Events" to key code 53
-		error "the agent started working before the tab closed - closing it now needs confirmation"
-	end if
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of confirmEl
-	end tell
-	delay 0.5
-	return "closed"
-end closeChatTab
-
-on buttonsUnder(root, maxDepth)
-	-- Every AXButton at or below root, level-order and bounded. Depth is the whole
-	-- cost here: the transcript hangs off the same web area as anything Conductor
-	-- portals into it, so each extra level multiplies the round trips and the sweep
-	-- gets slower the longer the chat is. That is why the callers below pass the
-	-- shallow depth that fits the thing they are looking for rather than one big cap.
-	set acc to {}
-	set level to {root}
-	set depth to 0
-	tell application "System Events" to tell process "Conductor"
-		repeat while (count of level) > 0 and depth < maxDepth
-			set nextLevel to {}
-			repeat with entry in level
-				set node to contents of entry
-				try
-					set acc to acc & (get UI elements of node whose role is "AXButton")
-					set nextLevel to nextLevel & (get UI elements of node)
-				end try
-			end repeat
-			set level to nextLevel
-			set depth to depth + 1
-		end repeat
-	end tell
-	return acc
-end buttonsUnder
-
-on shallowButtonsNamed(root, maxDepth, wanted)
-	-- Exact-name buttons at the first depth that contains one. Continue lives in
-	-- Conductor's workspace action bar, while a chat transcript hangs much deeper
-	-- off the same web area. Stopping at the shallowest hit both avoids walking a
-	-- long transcript and keeps a similarly named control inside a message from
-	-- impersonating the workspace action.
-	set level to {root}
-	set depth to 0
-	tell application "System Events" to tell process "Conductor"
-		repeat while (count of level) > 0 and depth < maxDepth
-			set found to {}
-			set nextLevel to {}
-			repeat with entry in level
-				set node to contents of entry
-				try
-					repeat with candidate in (get UI elements of node whose role is "AXButton")
-						set controlEl to contents of candidate
-						if (my axName(controlEl)) is wanted then set end of found to controlEl
-					end repeat
-					set nextLevel to nextLevel & (get UI elements of node)
-				end try
-			end repeat
-			if (count of found) > 0 then return found
-			set level to nextLevel
-			set depth to depth + 1
-		end repeat
-	end tell
-	return {}
-end shallowButtonsNamed
-
-on hasSiblingButtonNamed(controlEl, wanted)
-	-- The live merged action is the pair Continue + Archive. Requiring that pair
-	-- prevents a generic Continue in a modal from impersonating it while the
-	-- asserted workspace pane remains visible behind the modal.
-	try
-		tell application "System Events" to tell process "Conductor"
-			set actionRow to value of attribute "AXParent" of controlEl
-			repeat with peer in (get UI elements of actionRow whose role is "AXButton")
-				if (my axName(contents of peer)) is wanted then return true
-			end repeat
-		end tell
-	end try
-	return false
-end hasSiblingButtonNamed
-
-on continueWorkspaceOnNewBranch()
-	-- Press Conductor's own merged-workspace action. Its handler owns all of the
-	-- state that cannot be reproduced safely from the relay: it checks out a fresh
-	-- branch at the PR's target, updates the workspace row, keeps every chat, and
-	-- stages Branch continued.md in the selected chat. The relay never writes the
-	-- database; server.ts watches `workspaces.branch` for the receipt.
-	set strips to my tabGroups()
-	if (count of strips) is 0 then error "couldn't find the chat pane to continue from"
-	my assertWorkspace(item 1 of strips)
-	set found to my shallowButtonsNamed(my webArea(), 10, "Continue")
-	if (count of found) is 0 then error "Conductor isn't offering Continue for this workspace - it appears after its pull request is merged and refreshed"
-	if (count of found) > 1 then error "more than one Continue button is visible - close any dialog and try again"
-	set continueEl to item 1 of found
-	if not (my hasSiblingButtonNamed(continueEl, "Archive")) then error "couldn't verify Conductor's merged-workspace Continue action - close any dialog and try again"
-	set canPress to true
-	try
-		tell application "System Events" to tell process "Conductor"
-			set canPress to (value of attribute "AXEnabled" of continueEl) as boolean
-		end tell
-	end try
-	if not canPress then error "Conductor's Continue button is still busy - try again shortly"
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of continueEl
-	end tell
-	delay 0.4
-end continueWorkspaceOnNewBranch
-
-on dialogButtons()
-	-- Both places Conductor could be drawing a confirmation, each at the depth that
-	-- shape actually sits at. A real sheet hangs off the window a level or two down;
-	-- an in-webview dialog is a shallow portal near the top of the web area. Its
-	-- buttons are inside depth 3; going to 4 reaches the transcript and made an idle
-	-- close spend its whole 28-second budget proving that no dialog existed.
-	my requireWindow()
-	set fromWindow to {}
-	tell application "System Events" to tell process "Conductor"
-		set fromWindow to my buttonsUnder(window 1, 4)
-	end tell
-	return fromWindow & (my buttonsUnder(my webArea(), 3))
-end dialogButtons
-
-on closeConfirmButton()
-	-- The running-chat dialog has exactly Cancel + "Close anyway". Require the
-	-- pair so an unrelated destructive dialog can never donate a similarly named
-	-- button to this run.
-	set found to missing value
-	set sawCancel to false
-	repeat with entry in my dialogButtons()
-		set node to contents of entry
-		set label to my axName(node)
-		if label is "Cancel" then set sawCancel to true
-		if label starts with "Close anyway" then set found to node
-	end repeat
-	if sawCancel then return found
-	return missing value
-end closeConfirmButton
-
-on archiveConfirmButton()
-	-- Conductor asks before archiving a workspace whose agents are still running:
-	-- "Archive workspace?" over Cancel and "Stop agents and archive". Identified by
-	-- the *pair* - a button naming the verb, with a Cancel somewhere beside it -
-	-- rather than by the archive one alone, which is the same rule waitForMenuWith
-	-- follows: press nothing that has not proved which thing it belongs to.
-	-- "Unarchive" is excluded by name, since AppleScript's contains ignores case
-	-- and would otherwise read that as a confirmation of this.
-	set found to missing value
-	set sawCancel to false
-	repeat with entry in my dialogButtons()
-		set node to contents of entry
-		set label to my axName(node)
-		if label is "Cancel" then set sawCancel to true
-		if label contains "archive" and label does not contain "unarchive" then set found to node
-	end repeat
-	if sawCancel then return found
-	return missing value
-end archiveConfirmButton
-
-on archiveWorkspace()
-	-- Put this workspace away: Conductor's own "Archive workspace", Command-Shift-A.
-	-- A keystroke on purpose, like cancelAgent - the sidebar row menu carries an
-	-- Archive item, but reaching it costs a sidebar scan plus two menu waits, and
-	-- this chord acts on the workspace the pane is already showing.
-	--
-	-- Which is also the danger: it archives whatever is on screen, so the pane
-	-- assertion is the whole guard. Archiving the wrong workspace deletes a worktree
-	-- and kills a turn that was running fine, so a pane that cannot be checked is
-	-- refused rather than aimed at (writes.ts requires the branch for that reason).
-	--
-	-- Command-L ("Focus chat input") first, exactly as cancelAgent does: the chord
-	-- lands wherever focus is, and a focused terminal panel swallows it.
-	set strips to my tabGroups()
-	if (count of strips) is 0 then error "couldn't find the chat pane to archive from"
-	my assertWorkspace(item 1 of strips)
-	tell application "System Events"
-		keystroke "l" using {command down}
-		delay 0.2
-		keystroke "a" using {command down, shift down}
-	end tell
-	-- A workspace with agents still working draws a confirmation; an idle one is
-	-- archived by the chord alone. Both are live, so this waits a bounded moment for
-	-- the dialog and treats its absence as the second case - the DB is the receipt
-	-- either way (server.ts watches for state 'archived'), so nothing here has to
-	-- decide whether the archive landed.
-	set confirmEl to missing value
-	repeat with attempt from 1 to 5
-		delay 0.3
-		set confirmEl to my archiveConfirmButton()
-		if confirmEl is not missing value then exit repeat
-	end repeat
-	if confirmEl is missing value then return "archived"
-	-- The caller has to have opted into the damage before we press this: stopping
-	-- other people's agents is not something to infer from a tap that said Archive.
-	if (system attribute "RELAY_ARCHIVE_AGENTS") is not "1" then
-		tell application "System Events" to key code 53
-		error "agents are still running in this workspace - archiving would stop them"
-	end if
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of confirmEl
-	end tell
-	delay 0.5
-	return "archived"
-end archiveWorkspace
-
-on composerControls()
-	set strips to my tabGroups()
-	if (count of strips) is 0 then error "couldn't find the composer"
-	tell application "System Events" to tell process "Conductor"
-		set pane to value of attribute "AXParent" of (item 1 of strips)
-		set composerBox to item 1 of (UI elements of pane whose name is "composer")
-		set out to {}
-		repeat with e in (UI elements of composerBox)
-			set end of out to contents of e
-			repeat with e2 in (UI elements of e)
-				set end of out to contents of e2
-			end repeat
-		end repeat
-		return out
-	end tell
-end composerControls
-
-on controlNamed(wanted)
-	repeat with entry in my composerControls()
-		set c to contents of entry
-		if my tabLabel(c) is wanted then return c
-	end repeat
-	return missing value
-end controlNamed
-
-on effortButton()
-	-- The effort control is a button whose *label is its current value*, so it is
-	-- identified by that label rather than a stable name. Claude calls its top
-	-- level Ultracode while Codex calls the corresponding level Ultra. Codex's
-	-- None state is the exception: its button has no accessible name at all, so
-	-- accept one (and only one) unnamed button *after* the proven model picker.
-	-- The main composer also contains unnamed attachment/stop buttons before that
-	-- picker, and pressing one of those would be worse than failing.
-	set levels to {"Light", "Low", "Medium", "High", "Extra high", "Max", "Ultracode", "Ultra"}
-	set sawModel to false
-	set unnamed to {}
-	repeat with entry in my composerControls()
-		set c to contents of entry
-		if (my axRole(c)) is "AXPopUpButton" and (my axName(c)) contains "Change agent" then
-			set sawModel to true
-		else if sawModel and (my axRole(c)) is "AXButton" then
-			set label to my axName(c)
-			if label is in levels then return c
-			if label is "" then set end of unnamed to c
-		end if
-	end repeat
-	if (count of unnamed) is 1 then return item 1 of unnamed
-	return missing value
-end effortButton
-
-on setEffort(wanted)
-	-- Claude owns a six-value ring ending in Ultracode; Codex adds None and ends
-	-- in Ultra. Step around either ring once and confirm the label landed.
-	set btn to my effortButton()
-	if btn is missing value then error "couldn't find the effort control"
-	repeat 8 times
-		set currentLabel to my axName(btn)
-		if currentLabel is wanted or (wanted is "__UNNAMED_EFFORT__" and currentLabel is "") then return
-		tell application "System Events" to tell process "Conductor"
-			perform action "AXPress" of btn
-		end tell
-		delay 0.35
-		set btn to my effortButton()
-		if btn is missing value then error "the effort control vanished mid-cycle"
-	end repeat
-	error "couldn't set effort to " & wanted
-end setEffort
-
-on setPlan(wanted)
-	set box to my controlNamed("Plan")
-	if box is missing value then error "couldn't find the Plan toggle"
-	tell application "System Events" to tell process "Conductor"
-		set current to ((value of box) as text)
-		if (wanted is "1" and current is "0") or (wanted is "0" and current is not "0") then
-			perform action "AXPress" of box
-			delay 0.4
-			if ((value of box) as text) is current then error "the Plan toggle didn't change"
-		end if
-	end tell
-end setPlan
-
-on pressFast()
-	-- Fast has no AX state to read (its label is always "Fast"), so the caller
-	-- decides whether a press is needed and re-checks the DB afterwards.
-	set btn to my controlNamed("Fast")
-	if btn is missing value then error "this model has no Fast toggle"
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of btn
-	end tell
-	delay 0.4
-end pressFast
-
-on firstLine(s)
-	set saved to AppleScript's text item delimiters
-	set AppleScript's text item delimiters to linefeed
-	set parts to text items of s
-	set AppleScript's text item delimiters to saved
-	return item 1 of parts
-end firstLine
-
-on pickerShowsModel(popup, wanted)
-	set pickerLabel to my tabLabel(popup)
-	if pickerLabel contains ("(" & wanted & ")") then return true
-	-- The menu can label a newly released model "Opus 5 NEW", while the
-	-- composer deliberately drops that temporary badge and says "Opus 5".
-	-- Treat that exact display form as the same choice; the surrounding
-	-- parentheses keep "Opus 5" distinct from a longer model name.
-	if wanted ends with " NEW" then
-		set baseName to text 1 thru -5 of wanted
-		if pickerLabel contains ("(" & baseName & ")") then return true
-	end if
-	return false
-end pickerShowsModel
-
-on modelMenuItem(wanted)
-	-- Resolve one model from the picker that is already open. The menu can append
-	-- `NEW` to a freshly released model while the relay deliberately exposes the
-	-- stable name without it, so the same unique-prefix rule as setModel applies.
-	set chosen to missing value
-	set loose to {}
-	set wa to my webArea()
-	tell application "System Events" to tell process "Conductor"
-		repeat with m in (get UI elements of wa whose role is "AXMenu")
-			repeat with mi in (get UI elements of m whose role is "AXMenuItem")
-				set label to my firstLine(my tabLabel(mi))
-				if label is wanted then
-					set chosen to contents of mi
-				else if label starts with wanted then
-					set end of loose to contents of mi
-				end if
-			end repeat
-		end repeat
-	end tell
-	if chosen is missing value and (count of loose) is 1 then set chosen to item 1 of loose
-	if chosen is missing value then
-		if (count of loose) > 1 then error "several models match " & wanted
-		error "no model named " & wanted
-	end if
-	return chosen
-end modelMenuItem
-
-on modelDefaultButton(menuItem)
-	-- Every non-default row has a child star button named "Set <model> as
-	-- default and select". The starred row has no button at all. Read the role and
-	-- label together so an unrelated control a future picker grows cannot be
-	-- mistaken for a global preference write.
-	repeat with childNode in my axKids(menuItem)
-		set childEl to contents of childNode
-		if (my axRole(childEl)) is "AXButton" and (my axName(childEl)) contains " as default" then return childEl
-	end repeat
-	return missing value
-end modelDefaultButton
-
-on modelMenuItems()
-	set found to {}
-	set wa to my webArea()
-	tell application "System Events" to tell process "Conductor"
-		repeat with m in (get UI elements of wa whose role is "AXMenu")
-			set found to found & (get UI elements of m whose role is "AXMenuItem")
-		end repeat
-	end tell
-	return found
-end modelMenuItems
-
-on defaultModelInOpenPicker()
-	-- The selected star is exposed by *removing* the star button from that row.
-	-- Require exactly one such row. If managed settings disable every star, or a
-	-- Conductor release changes this tree, failing closed is safer than reporting
-	-- that whichever model was requested became the user's global default.
-	set defaults to {}
-	repeat with mi in my modelMenuItems()
-		set menuItem to contents of mi
-		if (my modelDefaultButton(menuItem)) is missing value then set end of defaults to my firstLine(my tabLabel(menuItem))
-	end repeat
-	if (count of defaults) is not 1 then error "couldn't identify Conductor's default model"
-	return item 1 of defaults
-end defaultModelInOpenPicker
-
-on modelPickerButton()
-	set popup to missing value
-	repeat with entry in my composerControls()
-		set c to contents of entry
-		if my tabLabel(c) contains "Change agent" then set popup to c
-	end repeat
-	if popup is missing value then error "couldn't find the model picker"
-	return popup
-end modelPickerButton
-
-on openModelPicker()
-	set popup to my modelPickerButton()
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of popup
-	end tell
-	delay 1.0
-end openModelPicker
-
-on setDefaultModel(wanted)
-	-- Conductor's star is one combined action: its accessible name is "Set … as
-	-- default and select". Mirror that rather than pretending this only changes a
-	-- preference — the target chat switches model too, and the picker label is
-	-- read back below as the receipt for that half.
-	set initialPopup to my modelPickerButton()
-	set alreadySelected to my pickerShowsModel(initialPopup, wanted)
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of initialPopup
-	end tell
-	delay 1.0
-	try
-		set chosen to my modelMenuItem(wanted)
-		set chosenLabel to my firstLine(my tabLabel(chosen))
-		set currentDefault to my defaultModelInOpenPicker()
-		if currentDefault is chosenLabel then
-			if alreadySelected then
-				tell application "System Events" to key code 53
-				return chosenLabel
-			end if
-			-- The star is already selected, but this chat is not. Its row is now
-			-- the remaining half of Conductor's combined action.
-			tell application "System Events" to tell process "Conductor"
-				perform action "AXPress" of chosen
-			end tell
-			delay 0.8
-			set selectedPopup to my modelPickerButton()
-			if not my pickerShowsModel(selectedPopup, chosenLabel) then error "the model didn't switch to " & chosenLabel
-			return chosenLabel
-		end if
-		set starButton to my modelDefaultButton(chosen)
-		if starButton is missing value then error "the default-model star is missing for " & chosenLabel
-		tell application "System Events" to tell process "Conductor"
-			perform action "AXPress" of starButton
-		end tell
-		delay 0.8
-		set selectedPopup to my modelPickerButton()
-		if not my pickerShowsModel(selectedPopup, chosenLabel) then error "the model didn't switch to " & chosenLabel
-		-- Re-open and read the star back. Pressing is fire-and-forget; the only safe
-		-- success is the requested row becoming the unique one with no star button.
-		my openModelPicker()
-		set verified to my modelMenuItem(wanted)
-		set verifiedLabel to my firstLine(my tabLabel(verified))
-		set currentDefault to my defaultModelInOpenPicker()
-		tell application "System Events" to key code 53
-		if currentDefault is not verifiedLabel then error "Conductor didn't mark " & verifiedLabel & " as the default model"
-		return verifiedLabel
-	on error errText number errNum
-		tell application "System Events" to key code 53
-		error errText number errNum
-	end try
-end setDefaultModel
-
-on setModel(wanted)
-	set popup to missing value
-	repeat with entry in my composerControls()
-		set c to contents of entry
-		if my tabLabel(c) contains "Change agent" then set popup to c
-	end repeat
-	if popup is missing value then error "couldn't find the model picker"
-	if my pickerShowsModel(popup, wanted) then return
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of popup
-	end tell
-	delay 1.0
-	-- The relay removes a temporary `NEW` badge before it sends this label back,
-	-- so a prefix match resolves that menu item. It is accepted only when unique:
-	-- "Sonnet 4.6" would
-	-- otherwise also match "Sonnet 4.6 1M"), which must fail rather than guess.
-	set chosen to missing value
-	set loose to {}
-	set wa to my webArea()
-	tell application "System Events" to tell process "Conductor"
-		repeat with m in (get UI elements of wa whose role is "AXMenu")
-			repeat with mi in (get UI elements of m whose role is "AXMenuItem")
-				set label to my firstLine(my tabLabel(mi))
-				if label is wanted then
-					set chosen to contents of mi
-				else if label starts with wanted then
-					set end of loose to contents of mi
-				end if
-			end repeat
-		end repeat
-	end tell
-	if chosen is missing value and (count of loose) is 1 then set chosen to item 1 of loose
-	if chosen is missing value then
-		tell application "System Events" to key code 53
-		if (count of loose) > 1 then error "several models match " & wanted
-		error "no model named " & wanted
-	end if
-	set chosenLabel to my firstLine(my tabLabel(chosen))
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of chosen
-	end tell
-	delay 0.8
-	set popup to missing value
-	repeat with entry in my composerControls()
-		set c to contents of entry
-		if my tabLabel(c) contains "Change agent" then set popup to c
-	end repeat
-	if popup is missing value then error "the model picker vanished"
-	if not my pickerShowsModel(popup, chosenLabel) then error "the model didn't switch to " & chosenLabel
-end setModel
-
-on listModels()
-	-- Enumerate the picker rather than hard-coding a model list that would rot on
-	-- every Conductor release. The first tagged line carries the unique starred
-	-- row, followed by the ordinary labels. Opens the menu, reads, closes it again.
-	my openModelPicker()
-	try
-		set labels to {}
-		repeat with mi in my modelMenuItems()
-			set end of labels to my firstLine(my tabLabel(mi))
-		end repeat
-		set defaultLabel to my defaultModelInOpenPicker()
-		tell application "System Events" to key code 53
-		set saved to AppleScript's text item delimiters
-		set AppleScript's text item delimiters to linefeed
-		set joined to labels as text
-		set AppleScript's text item delimiters to saved
-		return "__CONDUCTOR_DEFAULT_MODEL__" & tab & defaultLabel & linefeed & joined
-	on error errText number errNum
-		tell application "System Events" to key code 53
-		error errText number errNum
-	end try
-end listModels
-
-on applyAgentOptions()
-	set wantEffort to system attribute "RELAY_SET_EFFORT"
-	set wantPlan to system attribute "RELAY_SET_PLAN"
-	set wantFast to system attribute "RELAY_SET_FAST"
-	set wantModel to system attribute "RELAY_SET_MODEL"
-	if wantModel is not "" then my setModel(wantModel)
-	if wantEffort is not "" then my setEffort(wantEffort)
-	if wantPlan is not "" then my setPlan(wantPlan)
-	if wantFast is "1" then my pressFast()
-end applyAgentOptions
-
-on axRole(el)
-	tell application "System Events" to tell process "Conductor"
-		try
-			return role of el
-		on error
-			return ""
-		end try
-	end tell
-end axRole
-
-on axKids(el)
-	tell application "System Events" to tell process "Conductor"
-		try
-			return UI elements of el
-		on error
-			return {}
-		end try
-	end tell
-end axKids
-
-on menusUnder(root, maxDepth)
-	-- Every AXMenu at or below root, breadth-first and bounded. The status
-	-- submenu opens *nested inside* the row menu rather than beside it, so a
-	-- search that stops at the first hit (the way setModel scans the web area's
-	-- direct children) never sees it.
-	set level to {root}
-	set found to {}
-	set depth to 0
-	repeat while (count of level) > 0 and depth < maxDepth
-		set nextLevel to {}
-		repeat with entry in level
-			set node to contents of entry
-			if (my axRole(node)) is "AXMenu" then set end of found to node
-			set nextLevel to nextLevel & (my axKids(node))
-		end repeat
-		set level to nextLevel
-		set depth to depth + 1
-	end repeat
-	return found
-end menusUnder
-
-on axName(el)
-	-- Guarded: a menu re-renders under us, and reading the name of an element that
-	-- has since gone throws an object-specifier error from wherever we happened to be.
-	tell application "System Events" to tell process "Conductor"
-		try
-			set n to name of el
-			if n is missing value then return ""
-			return n as text
-		on error
-			return ""
-		end try
-	end tell
-end axName
-
-on menuItemNamed(m, wanted)
-	repeat with mi in (my axKids(m))
-		set node to contents of mi
-		if (my axRole(node)) is "AXMenuItem" and (my axName(node)) is wanted then return node
-	end repeat
-	return missing value
-end menuItemNamed
-
-on waitForMenuWith(root, maxDepth, itemName, attempts)
-	-- Identify the menu by an item it *contains*, never as "the first AXMenu on
-	-- screen": a model picker left open, or a menu from the run before, is also an
-	-- AXMenu, and picking it produced "no Set status item" on a menu that had never
-	-- been the workspace's. A menu is drawn by the webview, not by us, so how long
-	-- it takes varies with what Conductor is busy doing — poll rather than guess
-	-- one delay; the common case costs a single sweep.
-	repeat with i from 1 to attempts
-		repeat with entry in my menusUnder(root, maxDepth)
-			set node to contents of entry
-			if (my menuItemNamed(node, itemName)) is not missing value then return node
-		end repeat
-		delay 0.5
-	end repeat
-	return missing value
-end waitForMenuWith
-
-on dismissMenus()
-	-- Two escapes: one for the submenu, one for the row menu. Leaving either open
-	-- would swallow the next run's keystrokes.
-	tell application "System Events"
-		key code 53
-		delay 0.25
-		key code 53
-	end tell
-end dismissMenus
-
-on pressStatusMenu(rowEl, wanted)
-	-- Scroll it into view first. A row that exists in the AX tree but sits outside
-	-- the sidebar's visible strip accepts AXShowMenu and draws nothing — which is
-	-- exactly what happens right after a status change moves it to another group.
-	tell application "System Events" to tell process "Conductor"
-		try
-			perform action "AXScrollToVisible" of rowEl
-		end try
-	end tell
-	delay 0.4
-	-- Clear anything already open (a picker, or a menu a previous run left behind)
-	-- so the sweep below can only match the one this right-click draws.
-	tell application "System Events" to key code 53
-	delay 0.3
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXShowMenu" of rowEl
-	end tell
-	-- Depth 4, not the whole tree: the row menu is a portal near the top of the web
-	-- area, and the *transcript* hangs off that same root — a deep sweep walks every
-	-- message bubble and costs more than the rest of this write put together (it
-	-- grows with the conversation, so it degrades as you use the app).
-	set rowMenu to my waitForMenuWith(my webArea(), 4, "Set status", 6)
-	if rowMenu is missing value then
-		my dismissMenus()
-		error "the workspace's menu didn't open — or it no longer offers Set status"
-	end if
-	set statusItem to my menuItemNamed(rowMenu, "Set status")
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of statusItem
-	end tell
-	-- The submenu is an AXMenu nested a few levels *inside* the row menu (Conductor
-	-- expands it in place rather than opening a sibling), so search from that menu —
-	-- searching the web area again would re-walk the world. Two things make this a
-	-- poll rather than a read: the row-menu handle goes stale across the expansion
-	-- (it reports no children instead of erroring), so it is re-found each pass; and
-	-- the submenu's *items* arrive a beat after the submenu itself, so the thing we
-	-- wait for is the wanted status, not the container that will hold it.
-	set subMenu to missing value
-	repeat with attempt from 1 to 8
-		set liveMenu to my waitForMenuWith(my webArea(), 4, "Set status", 1)
-		if liveMenu is not missing value then
-			set subMenu to my waitForMenuWith(liveMenu, 5, wanted, 1)
-		end if
-		if subMenu is not missing value then exit repeat
-		delay 0.4
-	end repeat
-	if subMenu is missing value then
-		my dismissMenus()
-		error "Conductor never offered a status called " & wanted
-	end if
-	set choice to my menuItemNamed(subMenu, wanted)
-	tell application "System Events" to tell process "Conductor"
-		perform action "AXPress" of choice
-	end tell
-	delay 0.6
-end pressStatusMenu
-
-on setWorkspaceStatus()
-	-- Conductor has no menu-bar or palette command for this, so the only lever is
-	-- the sidebar row's own context menu (Mark as unread / Pin / Set status /
-	-- Rename / Copy link / Archive). Right-clicking the row needs no focus change,
-	-- so unlike a send this never disturbs which workspace is on screen.
-	set wanted to system attribute "RELAY_SET_STATUS"
-	if wanted is "" then error "no status requested"
-	set theRow to my findSidebarRow()
-	set opened to {}
-	if theRow is missing value then
-		-- A folded section renders no rows, so the row may simply not be in the tree
-		-- yet. There is no palette command to fall back to, so open the sections
-		-- ourselves and look again — then fold them back, since the one thing this
-		-- write promises is that the sidebar is where you left it.
-		set opened to my expandSections()
-		if (count of opened) > 0 then set theRow to my findSidebarRow()
-	end if
-	if theRow is missing value then
-		my restoreSections(opened)
-		error "couldn't find this workspace in the sidebar"
-	end if
-	try
-		my pressStatusMenu(theRow, wanted)
-	on error errMsg
-		my restoreSections(opened)
-		error errMsg
-	end try
-	my restoreSections(opened)
-end setWorkspaceStatus
-
-(* -- Instant Hotspot ----------------------------------------------------------
-   The funnel watchdog's last resort when this Mac has no route: press the row
-   for a personal hotspot in Control Center's Wi-Fi popover. networksetup can
-   only join a network that is broadcasting, and a personal hotspot usually
-   is not - the row in the Wi-Fi menu is fed by Continuity over Bluetooth, and
-   pressing it asks the phone to wake its hotspot, exactly like a human
-   clicking the Wi-Fi menu. Everything here targets process "ControlCenter",
-   not Conductor - same Accessibility grant, different process, which is why
-   the refusal mapping below skips refusalReason's -1712 branch (its words are
-   about a wedged Conductor).
-   Addressed by AXIdentifier throughout ("com.apple.menuextra.wifi",
-   "wifi-network-<name>", "wifi-header") - the items' names are missing value
-   and any visible text is localized, the identifiers are neither (measured
-   live on macOS 26.5, 2026-08). A "whose value of attribute ..." filter fails
-   wholesale (-1728) when any element lacks the attribute - several menu bar
-   items do - so every lookup here walks with a per-item try instead.
-   The SE-terms trap at the top of CLAUDE.md's applescript section bit this
-   code through a HANDLER PARAMETER: findAxId's first argument was once named
-   `container`, a System Events dictionary word, so inside the tell it
-   resolved as the term and the walk found nothing - through an error-eating
-   try, so a provably open popover read as "no popover" for a whole debugging
-   session while every direct read worked. osacompile accepts it, the handler
-   check can't see it. Keep every identifier in these handlers boring and
-   un-dictionary-like.
-   The menu bar item is a TOGGLE: the same press opens and closes the
-   popover, so nothing here presses it without first checking which state the
-   popover is in (wifiPopoverWindow), and an already-open popover aborts the
-   run - a human may be mid-gesture in it, and their next click kills an
-   automated run anyway (contention looks exactly like the status-row menu's:
-   fails while someone uses the Mac, clean when it is unattended). *)
-
-on wifiMenuBarItem()
-	try
-		with timeout of 6 seconds
-			tell application "System Events" to tell process "ControlCenter"
-				repeat with mi in menu bar items of menu bar 1
-					try
-						if (value of attribute "AXIdentifier" of mi) is "com.apple.menuextra.wifi" then return contents of mi
-					end try
-				end repeat
-			end tell
-		end timeout
-	on error errText number errNum
-		if errNum is not -1712 then
-			set refusal to my refusalReason({-1, errNum, errText})
-			if refusal is not "" then error refusal
-		end if
-		error "reading the menu bar failed (" & errNum & "): " & errText
-	end try
-	error "the Wi-Fi control is not in the menu bar - turn on Show in Menu Bar for Wi-Fi in System Settings > Control Center"
-end wifiMenuBarItem
-
-on findAxId(parentEl, wantedId, depth)
-	-- Depth-capped even though the popover is small: the cap is what keeps a
-	-- macOS reshuffle of this tree from turning one lookup into a full crawl.
-	-- `parentEl` is deliberately not `container` - see the section comment.
-	tell application "System Events"
-		try
-			set kids to UI elements of parentEl
-		on error
-			return missing value
-		end try
-	end tell
-	repeat with el in kids
-		try
-			tell application "System Events"
-				if (value of attribute "AXIdentifier" of el) is wantedId then return contents of el
-			end tell
-		end try
-		if depth > 1 then
-			set hit to my findAxId(el, wantedId, depth - 1)
-			if hit is not missing value then return hit
-		end if
-	end repeat
-	return missing value
-end findAxId
-
-on wifiPopoverWindow()
-	-- The popover is whichever ControlCenter window carries the "wifi-header"
-	-- id. Existence is read fresh on every call: pressing a network row can
-	-- close the popover by itself, and the menu bar item is a toggle, so a
-	-- blind second press would reopen what just closed.
-	tell application "System Events" to tell process "ControlCenter"
-		try
-			set wins to windows
-		on error
-			return missing value
-		end try
-	end tell
-	repeat with w in wins
-		if my findAxId(w, "wifi-header", 3) is not missing value then return contents of w
-	end repeat
-	return missing value
-end wifiPopoverWindow
-
-on closeWifiPopover(wifiItem)
-	if my wifiPopoverWindow() is not missing value then
-		try
-			tell application "System Events" to perform action "AXPress" of wifiItem
-		end try
-	end if
-end closeWifiPopover
-
-on joinInstantHotspot()
-	-- The name arrives via a file, like RELAY_PROMPT_FILE: do shell script
-	-- output is decoded as UTF-8, so a name with non-ASCII letters survives
-	-- where a system attribute read may not. AppleScript's default nonliteral
-	-- text comparison then treats composed and decomposed accents as equal,
-	-- which matters because the AX identifier uses whatever normalization
-	-- macOS chose.
-	set hotspotName to do shell script "cat " & quoted form of (system attribute "RELAY_HOTSPOT_FILE")
-	if hotspotName is "" then error "no hotspot name provided"
-	-- The lock screen hides the session from Accessibility, so behind it this
-	-- press has nothing to land on. Named up front, in the same words the send
-	-- path uses, instead of surfacing later as a popover that never opened.
-	if my screenLocked() is "locked" then error "The Mac is locked - the Wi-Fi menu can't be pressed until it unlocks"
-	set wifiItem to my wifiMenuBarItem()
-	if my wifiPopoverWindow() is not missing value then error "the Wi-Fi popover is already open - someone may be using it, so nothing was pressed"
-	tell application "System Events" to perform action "AXPress" of wifiItem
-	-- The popover renders in its own time (measured 1-2s), and a human's click
-	-- anywhere on the Mac closes it, so poll rather than sleep once.
-	set pop to missing value
-	repeat 8 times
-		delay 0.5
-		set pop to my wifiPopoverWindow()
-		if pop is not missing value then exit repeat
-	end repeat
-	if pop is missing value then error "pressing the Wi-Fi control opened no popover - someone clicking on the Mac closes it the moment it opens (contention, not a fault); otherwise Control Center is not answering"
-	set rowEl to missing value
-	repeat 4 times
-		set rowEl to my findAxId(pop, "wifi-network-" & hotspotName, 6)
-		if rowEl is not missing value then exit repeat
-		delay 0.5
-	end repeat
-	if rowEl is missing value then
-		my closeWifiPopover(wifiItem)
-		error quote & hotspotName & quote & " is not in the Wi-Fi menu - the iPhone is out of Bluetooth range, has Bluetooth off, or Personal Hotspot is off in its Settings"
-	end if
-	-- The row is a toggle too: value 1 means already connected, and pressing
-	-- it then would DISCONNECT - the one outcome worse than doing nothing.
-	-- Only a read of exactly 1 skips the press; an unreadable value presses.
-	set rowValue to 0
-	try
-		tell application "System Events" to set rowValue to value of rowEl
-	end try
-	if rowValue is 1 then
-		my closeWifiPopover(wifiItem)
-		return "already-connected"
-	end if
-	tell application "System Events" to perform action "AXPress" of rowEl
-	delay 1
-	my closeWifiPopover(wifiItem)
-	return "pressed"
-end joinInstantHotspot