npm - conductor-remote - Versions diffs - 1.67.0 → 1.68.1 - Mend

conductor-remote 1.67.0 → 1.68.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/assets/index-BqCdHovG.js +47 -0
package/dist/index.html +1 -1
package/dist/sw.js +1 -1
package/dist-node/src/conductor.applescript +266 -41
package/dist-node/src/mcp-tools.js +1 -1
package/dist-node/src/server.js +38 -5
package/dist-node/src/shared.js +33 -0
package/dist-node/src/writes.js +15 -7
package/package.json +1 -1
package/dist/assets/index-P1erC-f5.js +0 -47

package/dist/index.html CHANGED Viewed

@@ -13,7 +13,7 @@
 		<title>Conductor Remote</title>
 		<!-- Runs before the module bundle so it can catch a stale shell that fails to boot. -->
 		<script src="/self-heal.js"></script>
-		<script type="module" crossorigin src="/assets/index-P1erC-f5.js"></script>
+		<script type="module" crossorigin src="/assets/index-BqCdHovG.js"></script>
 		<link rel="stylesheet" crossorigin href="/assets/index-YPRuGHP4.css">
 	<link rel="manifest" href="/manifest.webmanifest"></head>
 	<body>

package/dist/sw.js CHANGED Viewed

	@@ -1 +1 @@
1	- if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]\|\|new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(s[o])return;let l={};const t=e=>i(e,o),c={module:{uri:o},exports:l,require:t};s[o]=Promise.all(n.map(e=>c[e]\|\|t(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";importScripts("/push-sw.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"push-sw.js",revision:"e1e682e2e5e88fa03b7808ae9db8e098"},{url:"index.html",revision:"~~ec17857cd8f5147616d1519402604e64~~"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-YPRuGHP4.css",revision:null},{url:"assets/index-~~P1erC-f5~~.js",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});
1	+ if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]\|\|new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(s[o])return;let l={};const t=e=>i(e,o),c={module:{uri:o},exports:l,require:t};s[o]=Promise.all(n.map(e=>c[e]\|\|t(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";importScripts("/push-sw.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"push-sw.js",revision:"e1e682e2e5e88fa03b7808ae9db8e098"},{url:"index.html",revision:"82beeb823118f5808af7be9a2f306f5d"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-YPRuGHP4.css",revision:null},{url:"assets/index-BqCdHovG.js",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});

package/dist-node/src/conductor.applescript CHANGED Viewed

@@ -340,7 +340,7 @@ on activateConductor()
 	-- retry loop polls this cheaply until its deadline, so an unlock mid-budget
 	-- lands the send by itself — that is the observed recovery, not a theory.
 	if (item 1 of firstProbe) < 1 and my screenLocked() is "locked" then
-		error "The Mac is locked - the lock screen hides Conductor from the relay, so a send can't reach it. Unlock the Mac and send again." & my windowEvidence()
+		error "The Mac is locked - the lock screen hides Conductor from the relay, so nothing can be sent or pressed. Unlock the Mac and try again." & my windowEvidence()
 	end if
 	try
 		tell application "Conductor" to activate
@@ -379,14 +379,14 @@ on activateConductor()
 		-- window server can tell the difference, so a window it CAN see blocks the
 		-- restart — this is a human's problem, said in words, not the relay's.
 		if my serverWindowCount() > 0 then
-			if lockState is "locked" then error "The Mac is locked - Conductor's window is open behind the lock screen, where the relay can't reach it. Unlock the Mac and send again." & ev
+			if lockState is "locked" then error "The Mac is locked - Conductor's window is open behind the lock screen, where the relay can't reach it. Unlock the Mac and try again." & ev
 			error "Conductor's window exists but is not reachable - it is probably full screen on another Space. Take Conductor out of full screen, then send again." & ev
 		end if
 		-- No window anywhere and the lock screen up: don't restart. Every relaunch
 		-- fired behind the lock screen in the live incident came up windowless, and
 		-- the last one came up wedged — answering deep links, hanging every AX
 		-- read. A restart here is not a lever, it is how the wreckage happened.
-		if lockState is "locked" then error "The Mac is locked and Conductor has no window. Relaunching behind the lock screen is what leaves it wedged, so the relay won't - unlock the Mac and send again." & ev
+		if lockState is "locked" then error "The Mac is locked and Conductor has no window. Relaunching behind the lock screen is what leaves it wedged, so the relay won't - unlock the Mac and try again." & ev
 		set restartError to my restartConductor()
 		if restartError is not "" then error restartError & ev
 		error "Conductor was running with no window and ignored both reopen and a Dock click, so the relay restarted it. Give it a few seconds and send again." & ev
@@ -430,39 +430,243 @@ on sidebarLinks()
 	end tell
 end sidebarLinks
-on findSidebarRow()
-	-- The workspace's own sidebar row. Only rows that are actually rendered exist
-	-- in the AX tree (a collapsed section has none), and the title follows
-	-- Conductor's precedence, so we try each candidate and require a *unique* hit —
-	-- anything ambiguous returns nothing rather than guessing at a neighbour.
+on findSidebarRowOnce()
 	set titles to my targetSidebarTitles()
 	if (count of titles) is 0 then return missing value
 	set repoName to system attribute "RELAY_WS_REPO"
-	set rows to my sidebarLinks()
-	-- Every name once, ahead of the candidates, rather than once per candidate: each
-	-- is its own round trip, and there are up to four candidates over 45 rows. It is
-	-- also one snapshot, so a row that renames between candidates can't match twice.
-	-- Guarded read: the sidebar re-renders constantly (every commit changes a row's
-	-- "+adds -dels"), and one row going stale mid-scan must not take the search down.
-	set rowNames to {}
-	repeat with entry in rows
-		set end of rowNames to my axName(contents of entry)
-	end repeat
+	set pair to my sidebarRowsAndNames()
+	set refs to item 1 of pair
+	set nms to item 2 of pair
+	set total to count of refs
+	if total is 0 or (count of nms) is not total then return missing value
 	repeat with candidate in titles
-		if (candidate as text) is not "" then
-			set matches to {}
-			repeat with i from 1 to (count of rows)
-				set rowName to item i of rowNames
-				if rowName contains (candidate as text) then
-					if repoName is "" or rowName contains repoName then set end of matches to item i of rows
+		set needle to candidate as text
+		if needle is not "" then
+			set hits to {}
+			repeat with i from 1 to total
+				set rowName to my textOrEmpty(item i of nms)
+				if rowName contains needle then
+					if repoName is "" or rowName contains repoName then set end of hits to i
 				end if
 			end repeat
-			if (count of matches) is 1 then return item 1 of matches
+			if (count of hits) is 1 then
+				set idx to item 1 of hits
+				set hit to item idx of refs
+				-- The references and the names are two reads, so a sidebar that
+				-- re-rendered between them (every commit rewrites a row's
+				-- "+adds -dels") would have shifted the index under us — and pressing
+				-- the neighbour sets the wrong workspace's status, which is the one
+				-- failure this whole file is built to refuse. Confirm the element
+				-- still carries the name it was picked for.
+				if (my axName(hit)) is (my textOrEmpty(item idx of nms)) then return hit
+				return missing value
+			end if
 		end if
 	end repeat
 	return missing value
+end findSidebarRowOnce
+on findSidebarRow()
+	-- The workspace's own sidebar row. Only rows that are actually rendered exist
+	-- in the AX tree (a collapsed section has none — expandSections is what opens
+	-- those), and the title follows Conductor's precedence, so we try each
+	-- candidate and require a *unique* hit — anything ambiguous returns nothing
+	-- rather than guessing at a neighbour. Two passes because the only thing that
+	-- fails the check inside is a sidebar that moved mid-read, and that is worth
+	-- one cheap retry.
+	set hit to my findSidebarRowOnce()
+	if hit is not missing value then return hit
+	return my findSidebarRowOnce()
 end findSidebarRow
+on textOrEmpty(v)
+	try
+		if v is missing value then return ""
+		return v as text
+	on error
+		return ""
+	end try
+end textOrEmpty
+on childRoles(el)
+	-- Every child's role in *one* Apple event. Every AX read here is a round trip
+	-- to another process, so asking element by element is what turned a sidebar
+	-- scan into 15 seconds — more, by itself, than this write's whole budget.
+	tell application "System Events" to tell process "Conductor"
+		try
+			return role of (UI elements of el)
+		on error
+			return {}
+		end try
+	end tell
+end childRoles
+on childRolesAndNames(el)
+	tell application "System Events" to tell process "Conductor"
+		try
+			return {role of (UI elements of el), name of (UI elements of el)}
+		on error
+			return {{}, {}}
+		end try
+	end tell
+end childRolesAndNames
+on looksLikeSidebarList(el)
+	-- The sidebar's workspace list is one flat run of section headers
+	-- (AXStaticText) and workspace rows (AXLink), with nothing else beside them.
+	-- That shape is the whole test, because the *transcript* hangs off the same
+	-- web area and holds AXLinks of its own — "the element with links in it"
+	-- would happily hand back a message bubble, and every press below would then
+	-- land in one.
+	set roleList to my childRoles(el)
+	if (count of roleList) is 0 then return false
+	set seenLink to false
+	repeat with r in roleList
+		set rt to my textOrEmpty(contents of r)
+		if rt is "AXLink" then
+			set seenLink to true
+		else if rt is not "AXStaticText" then
+			return false
+		end if
+	end repeat
+	return seenLink
+end looksLikeSidebarList
+on sidebarList()
+	-- Found by that shape rather than by an index, since the chrome above it
+	-- (project pickers, the resource-usage button) comes and goes. Two levels
+	-- deep, the same reach sidebarLinks() uses.
+	set wa to my webArea()
+	repeat with a in (my axKids(wa))
+		set nodeA to contents of a
+		if my looksLikeSidebarList(nodeA) then return nodeA
+		repeat with b in (my axKids(nodeA))
+			set nodeB to contents of b
+			if my looksLikeSidebarList(nodeB) then return nodeB
+		end repeat
+	end repeat
+	return missing value
+end sidebarList
+on sidebarRowsAndNames()
+	-- Every sidebar row paired with its name. Two Apple events off the list found
+	-- above, against one per row before.
+	set listEl to my sidebarList()
+	if listEl is not missing value then
+		tell application "System Events" to tell process "Conductor"
+			try
+				return {(UI elements of listEl whose role is "AXLink"), name of (UI elements of listEl whose role is "AXLink")}
+			end try
+		end tell
+	end if
+	-- No list matched the shape, so Conductor has reorganised its sidebar. Fall
+	-- back to the broad two-level sweep and one name read per row: slow, and the
+	-- reason the fast path exists, but it assumes nothing about the layout.
+	set refs to my sidebarLinks()
+	set nms to {}
+	repeat with entry in refs
+		set end of nms to my axName(contents of entry)
+	end repeat
+	return {refs, nms}
+end sidebarRowsAndNames
+on looksNumeric(t)
+	-- A folded section draws its row count where its rows would be. That number is
+	-- a sibling of the header, not a child of it, so it has to be told apart from a
+	-- header by hand — digits only, which no status or repo name is.
+	if t is "" then return false
+	repeat with c in (characters of t)
+		if "0123456789" does not contain (c as text) then return false
+	end repeat
+	return true
+end looksNumeric
+on collapsedSectionNames()
+	-- The sections someone has folded shut. A section's rows are *siblings* of
+	-- its header, so an expanded one is followed by an AXLink and a collapsed one
+	-- by its count, by the next header, or by nothing — and a collapsed section
+	-- renders no rows at all, which is why its workspaces are invisible to
+	-- Accessibility. Names, not element references: everything below re-finds the
+	-- header when it needs it, because the list re-renders under us (a status
+	-- change moves a row to another group) and a System Events reference is an
+	-- index into a tree that has already changed.
+	set listEl to my sidebarList()
+	if listEl is missing value then return {}
+	set pair to my childRolesAndNames(listEl)
+	set roleList to item 1 of pair
+	set nameList to item 2 of pair
+	set total to count of roleList
+	if total is 0 or (count of nameList) is not total then return {}
+	set out to {}
+	repeat with i from 1 to total
+		if (my textOrEmpty(item i of roleList)) is "AXStaticText" then
+			set nm to my textOrEmpty(item i of nameList)
+			if nm is not "" and not (my looksNumeric(nm)) then
+				set nextRole to ""
+				if i < total then set nextRole to my textOrEmpty(item (i + 1) of roleList)
+				if nextRole is not "AXLink" then set end of out to nm
+			end if
+		end if
+	end repeat
+	return out
+end collapsedSectionNames
+on sectionHeaderNamed(wanted)
+	-- Unique or nothing, like every other lookup here: two sections cannot share
+	-- a name, so an ambiguous hit means we are reading the wrong list.
+	set listEl to my sidebarList()
+	if listEl is missing value then return missing value
+	tell application "System Events" to tell process "Conductor"
+		try
+			set hits to (UI elements of listEl whose role is "AXStaticText" and name is wanted)
+		on error
+			return missing value
+		end try
+	end tell
+	if (count of hits) is 1 then return item 1 of hits
+	return missing value
+end sectionHeaderNamed
+on toggleSection(headerName)
+	set head to my sectionHeaderNamed(headerName)
+	if head is missing value then return false
+	tell application "System Events" to tell process "Conductor"
+		try
+			perform action "AXScrollToVisible" of head
+		end try
+		try
+			perform action "AXPress" of head
+			return true
+		on error
+			return false
+		end try
+	end tell
+end toggleSection
+on expandSections()
+	-- Open every folded section and report which ones we opened, so the caller can
+	-- put the sidebar back the way it found it. The header is the whole control —
+	-- it carries AXPress and toggles the group — so this needs no chevron, which
+	-- the webview does not expose anyway.
+	set opened to {}
+	repeat with nm in (my collapsedSectionNames())
+		if my toggleSection(nm as text) then set end of opened to (nm as text)
+	end repeat
+	if (count of opened) > 0 then delay 0.6
+	return opened
+end expandSections
+on restoreSections(names)
+	-- Fold back exactly what we opened. Best-effort on purpose: this runs after
+	-- the write has already landed, so a header that moved or vanished must not
+	-- turn a status change that worked into a reported failure.
+	repeat with nm in names
+		try
+			my toggleSection(nm as text)
+		end try
+	end repeat
+end restoreSections
 on focusViaSidebar()
 	-- Press that row: no keystrokes at all, so nothing can be swallowed by a
 	-- focused field or fire a palette *command*. Being wrong is survivable here —
@@ -506,9 +710,10 @@ on atTargetWorkspace()
 	-- "Are we already there?" — the *strict* form of the question, so it needs a
 	-- branch to have been checked and not merely skipped. Worth asking first because
 	-- the pane header answers in ~0.5s where reading the sidebar's rows to press one
-	-- measured 5-7s, the single largest cost in a send: a phone sends to the same
-	-- workspace over and over, and Conductor stays where it was left. Safe as a
-	-- shortcut because it *is* the assertion the send makes before typing anyway.
+	-- measured 5-7s, and ~1s since that scan went to bulk reads — still the larger
+	-- cost of the two: a phone sends to the same workspace over and over, and
+	-- Conductor stays where it was left. Safe as a shortcut because it *is* the
+	-- assertion the send makes before typing anyway.
 	if (system attribute "RELAY_WS_BRANCH") is "" then return false
 	return my paneAgrees()
 end atTargetWorkspace
@@ -1316,23 +1521,13 @@ on dismissMenus()
 	end tell
 end dismissMenus
-on setWorkspaceStatus()
-	-- Conductor has no menu-bar or palette command for this, so the only lever is
-	-- the sidebar row's own context menu (Mark as unread / Pin / Set status /
-	-- Rename / Copy link / Archive). Right-clicking the row needs no focus change,
-	-- so unlike a send this never disturbs which workspace is on screen.
-	set wanted to system attribute "RELAY_SET_STATUS"
-	if wanted is "" then error "no status requested"
-	set theRow to my findSidebarRow()
-	if theRow is missing value then
-		error "couldn't find this workspace in the sidebar — a collapsed section hides its row from Accessibility"
-	end if
+on pressStatusMenu(rowEl, wanted)
 	-- Scroll it into view first. A row that exists in the AX tree but sits outside
 	-- the sidebar's visible strip accepts AXShowMenu and draws nothing — which is
 	-- exactly what happens right after a status change moves it to another group.
 	tell application "System Events" to tell process "Conductor"
 		try
-			perform action "AXScrollToVisible" of theRow
+			perform action "AXScrollToVisible" of rowEl
 		end try
 	end tell
 	delay 0.4
@@ -1341,7 +1536,7 @@ on setWorkspaceStatus()
 	tell application "System Events" to key code 53
 	delay 0.3
 	tell application "System Events" to tell process "Conductor"
-		perform action "AXShowMenu" of theRow
+		perform action "AXShowMenu" of rowEl
 	end tell
 	-- Depth 4, not the whole tree: the row menu is a portal near the top of the web
 	-- area, and the *transcript* hangs off that same root — a deep sweep walks every
@@ -1381,6 +1576,36 @@ on setWorkspaceStatus()
 		perform action "AXPress" of choice
 	end tell
 	delay 0.6
+end pressStatusMenu
+on setWorkspaceStatus()
+	-- Conductor has no menu-bar or palette command for this, so the only lever is
+	-- the sidebar row's own context menu (Mark as unread / Pin / Set status /
+	-- Rename / Copy link / Archive). Right-clicking the row needs no focus change,
+	-- so unlike a send this never disturbs which workspace is on screen.
+	set wanted to system attribute "RELAY_SET_STATUS"
+	if wanted is "" then error "no status requested"
+	set theRow to my findSidebarRow()
+	set opened to {}
+	if theRow is missing value then
+		-- A folded section renders no rows, so the row may simply not be in the tree
+		-- yet. There is no palette command to fall back to, so open the sections
+		-- ourselves and look again — then fold them back, since the one thing this
+		-- write promises is that the sidebar is where you left it.
+		set opened to my expandSections()
+		if (count of opened) > 0 then set theRow to my findSidebarRow()
+	end if
+	if theRow is missing value then
+		my restoreSections(opened)
+		error "couldn't find this workspace in the sidebar"
+	end if
+	try
+		my pressStatusMenu(theRow, wanted)
+	on error errMsg
+		my restoreSections(opened)
+		error errMsg
+	end try
+	my restoreSections(opened)
 end setWorkspaceStatus
 (* -- Instant Hotspot ----------------------------------------------------------

package/dist-node/src/mcp-tools.js CHANGED Viewed

@@ -613,7 +613,7 @@ export function createTools(call) {
         },
         {
             name: 'set_workspace_status',
-            description: 'Set a workspace’s status in Conductor’s sidebar (backlog, in-progress, in-review, done, canceled). Drives the real UI through the sidebar row menu, but changes nothing on screen. Fails if the sidebar section holding that row is collapsed, because a collapsed row is invisible to Accessibility and there is no fallback.',
+            description: 'Set a workspace’s status in Conductor’s sidebar (backlog, in-progress, in-review, done, canceled). Drives the real UI through the sidebar row menu, but changes nothing on screen. A collapsed section hides its rows from Accessibility, so folded sections are opened, used, and folded back — which makes this run a few seconds longer.',
             inputSchema: {
                 type: 'object',
                 properties: {

package/dist-node/src/server.js CHANGED Viewed

@@ -27,6 +27,7 @@ import { isRoute, routeParam, routes } from "./routes.js";
 import { foldHits, queryTokens, SearchIndex } from "./search.js";
 import { SendOnce } from "./sendonce.js";
 import { readSettings, writeSettings } from "./settings.js";
+import { withoutWindowEvidence } from "./shared.js";
 import { discardStagedAttachment, materializeStagedAttachments, stageAttachment, stagedAttachments } from "./staged-attachments.js";
 import { driftWarningLines, readExposeMode, tailscaleBin } from "./tailscale.js";
 import { renderTranscript } from "./transcript.js";
@@ -573,6 +574,31 @@ function previewRefusal(filePath) {
 const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 class PayloadTooLargeError extends Error {
 }
+/**
+ * The last thing that happens to an error before it leaves the relay: the diagnostic
+ * tail `windowEvidence()` appends comes off, and the full text goes to the log instead.
+ *
+ * One place rather than the dozen routes that hand back a UI-write failure, for the
+ * same reason `redactSecrets` sits in front of every served log line: a rule applied at
+ * the boundary cannot be forgotten by the next route someone adds. What it prevents is
+ * what a tap on Fork against a locked Mac used to answer with — the sentence, then
+ * "[window server: 6; screen: locked] [processes: conductor=0] [menus: Apple, Conductor,
+ * File, ...]", in 11px red, on a phone that can do nothing with any of it. The evidence
+ * is still the fastest way to tell a wedged Conductor from a hidden window, so it lands
+ * in relay.log, which `/api/logs` serves to the same phone on request.
+ */
+function forTheClient(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return body;
+    const error = body.error;
+    if (typeof error !== 'string')
+        return body;
+    const clean = withoutWindowEvidence(error);
+    if (clean === error)
+        return body;
+    console.warn(`[relay] ${error}`);
+    return { ...body, error: clean };
+}
 /**
  * Successful GETs are conditional + compressed to keep the phone's polling cheap.
  * `no-cache` (not `no-store`) means the browser must revalidate on every tick —
@@ -581,7 +607,7 @@ class PayloadTooLargeError extends Error {
  * ~1 KB go out gzipped. Errors and non-GETs stay unconditional `no-store`.
  */
 function json(req, res, status, body) {
-    const payload = Buffer.from(JSON.stringify(body));
+    const payload = Buffer.from(JSON.stringify(forTheClient(body)));
     if (status !== 200 || req.method !== 'GET') {
         res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
         return void res.end(payload);
@@ -844,15 +870,21 @@ const server = http.createServer(async (req, res) => {
             // instead of asking someone to type a network name from memory on a phone keyboard.
             // `ssid` is best-effort and often null (macOS gates it behind Location Services).
             if (isRoute(routes.settings, req.method, pathname)) {
-                // Four subprocesses, all concurrent: this is the one route that shells out more
+                // Five subprocesses, all concurrent: this is the one route that shells out more
                 // than once, and serialising them would put the phone's polls behind the sum.
-                const [known, current, autoJoinHotspot, nosleep] = await Promise.all([
+                const [known, current, autoJoinHotspot, nosleep, locked] = await Promise.all([
                     preferredNetworks(),
                     currentSsid(),
                     // macOS's own Auto-join Hotspot setting. On "Never" the Mac won't reach for
                     // your phone unprompted, which no amount of relay code can substitute for.
                     autoJoinHotspotMode(),
-                    nosleepState()
+                    nosleepState(),
+                    // Read here rather than polled: this sheet is where someone goes when the Mac
+                    // stopped answering, and a keep-awake window that says "automatic screen lock
+                    // is off" beside a Mac that is locked right now reads as the relay lying. The
+                    // assertion blocks the *idle* lock; it cannot lift one already up, and a lid
+                    // close or a manual lock puts one up whatever it holds.
+                    screenLocked()
                 ]);
                 return json(req, res, 200, {
                     settings: readSettings(),
@@ -863,7 +895,8 @@ const server = http.createServer(async (req, res) => {
                         likelyHotspots: known.filter(looksLikeHotspot),
                         autoJoinHotspot
                     },
-                    nosleep: { ...nosleep, maxSeconds: NOSLEEP_MAX_SECONDS }
+                    nosleep: { ...nosleep, maxSeconds: NOSLEEP_MAX_SECONDS },
+                    screenLocked: locked
                 });
             }
             // PATCH /api/settings { fallbackSsids?, autoRejoin? } — merge and persist.

package/dist-node/src/shared.js CHANGED Viewed

@@ -214,3 +214,36 @@ export function isPreviewableSource(filePath) {
 export function isToolResult(e) {
     return e.role === 'tool' && !e.tool && e.output !== undefined;
 }
+/**
+ * The sentence every locked-Mac refusal starts with (src/conductor.applescript), and
+ * the one thing two sides must agree it means.
+ *
+ * The relay decides control flow on it — `lockBlocked` (src/writes.ts) parks the prompt
+ * rather than burning a phone's retry budget against a screen that will not answer for
+ * hours — and the phone decides what to draw: a link to Screen Sharing, because the
+ * relay will never unlock the Mac itself. Two matchers over one phrase, spelled out in
+ * two files, is how one of them quietly stops matching. macOS's own wording is never
+ * matched anywhere here; this sentence is ours, so it cannot drift under us.
+ */
+export const MAC_LOCKED = 'The Mac is locked';
+export function isLockedError(error) {
+    return (error ?? '').includes(MAC_LOCKED);
+}
+/**
+ * The diagnostic tail `windowEvidence()` (src/conductor.applescript) appends to every
+ * window and lock refusal: the window server's count, the lock state, every process
+ * named Conductor with its window count, and the menu bar titles.
+ *
+ * It exists to separate "genuinely windowless" from "we are addressing the wrong
+ * process", which is a question for the relay's log. It reached the phone as well,
+ * where a tap on Fork against a locked Mac answered with four lines of red text ending
+ * in "[menus: Apple, Conductor, File, Edit, View, Window, Help]" and nothing to act on.
+ * So `json()` in src/server.ts cuts it on the way out and logs the full text instead.
+ *
+ * Anchored on our own format: the whole tail is one run of bracketed groups that starts
+ * at "[window server:", so a single cut takes all of it and never touches a message
+ * that carries none.
+ */
+export function withoutWindowEvidence(error) {
+    return error.replace(/\s*\[window server:.*$/s, '').trim();
+}

package/dist-node/src/writes.js CHANGED Viewed

@@ -3,7 +3,7 @@ import { execFile } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { modelPickerLabel } from "./shared.js";
+import { isLockedError, modelPickerLabel } from "./shared.js";
 import { sidecarAvailable, sidecarSendUserMessage } from "./sidecar.js";
 const exec = promisify(execFile);
 /** Waiting runs past this are refused rather than queued. */
@@ -145,10 +145,12 @@ export function retryWontHelp(error) {
  * warm-up cost a retry loop should burn budget on — the caller parks the prompt
  * instead (src/parked.ts) and the queue delivers it when the lock lifts. Matched
  * on the phrase every lock refusal in conductor.applescript starts with; the
- * words are ours, so they can't drift under us the way macOS's can.
+ * words are ours, so they can't drift under us the way macOS's can. The phrase
+ * itself lives in src/shared.ts because the phone matches it too — it is what
+ * puts the Screen Sharing link beside a refusal nobody else can clear.
  */
 export function lockBlocked(error) {
-    return (error ?? '').includes('The Mac is locked');
+    return isLockedError(error);
 }
 /**
  * A run that ended with the prompt still sitting in Conductor's composer
@@ -596,9 +598,15 @@ export const WORKSPACE_STATUS_LABELS = {
  *
  * Unlike every other write here this one never changes what's on screen: it
  * right-clicks the workspace's *row* (AXShowMenu) and works the menu, so the
- * workspace you were reading stays open. It does need the row to be rendered,
- * which a collapsed sidebar section prevents — that case is reported in words
- * rather than guessed around, because there is no palette command to fall back to.
+ * workspace you were reading stays open. It does need the row to be rendered, and
+ * a collapsed sidebar section renders none — so the script opens the folded
+ * sections itself, looks again, and folds back exactly the ones it opened. That
+ * costs a second sidebar scan, which is affordable only because that scan reads
+ * every row's name in two Apple events rather than one per row (15s → ~1s on a
+ * 50-workspace sidebar; see findSidebarRow). Measured end to end on 2026-09-01:
+ * 8.2s through a folded section, 5.4s through an open one. The budget is 35s
+ * anyway, because sidebarRowsAndNames falls back to the per-row reads when the
+ * list no longer matches its shape, and that path pays the old 15s twice.
  */
 export async function setWorkspaceStatus(workspace, status) {
     const label = WORKSPACE_STATUS_LABELS[status];
@@ -617,7 +625,7 @@ return "ok"`.trim();
                 ...targetEnvironment,
                 RELAY_SET_STATUS: label
             },
-            timeout: 25000
+            timeout: 35000
         })));
         return { ok: true, strategy: 'applescript' };
     }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.67.0",
+	"version": "1.68.1",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",