crewforth 3.2.0-rc.2 → 3.2.0-rc.3

package/kit/hooks/precompact-snapshot.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# PreCompact hook — just before the context is compacted, write down the state of the work in a few lines, so the
+# session that comes back after the compaction is told it (session-rehydrate.sh reads it on SessionStart, source
+# compact). A compaction summary is the model's own retelling; this is what the files and the gates say.
+#
+# What it writes, at most ~2 KB: the branch, the uncommitted files (five named, the rest counted), the last refusal in
+# the gate log, how many findings each document under .crewforth/ holds, and whether a handover
+# (docs/SESSION_STATE.md) is there. With the session id and the trigger, so a snapshot is only read back into the
+# session that wrote it.
+#
+# Where: inside the repository's git directory (crewforth-session-snapshot.json), so it is never committed even in a
+# project that tracks .claude/; outside a repository, .claude/state/session-snapshot.json.
+#
+# NEVER BLOCKS. PreCompact exit 2 blocks the compaction (docs: hooks, PreCompact), and blocking an automatic one at
+# the context limit fails the request that needed it. Every path here ends in exit 0, and nothing is printed: a
+# PreCompact hook's output does not reach the summary.
+set -u
+IN="$(cat 2>/dev/null || true)"
+_here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
+LIB="$_here/../eval/lib"
+
+ROOT="${CLAUDE_PROJECT_DIR:-}"
+[ -n "$ROOT" ] || ROOT="$(printf '%s' "$IN" | sed -n 's/.*"cwd"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)"
+[ -n "$ROOT" ] || ROOT="$PWD"
+ROOT="${ROOT//\\\\//}"; ROOT="${ROOT//\\//}"
+cd "$ROOT" 2>/dev/null || exit 0
+
+field(){ local v="${IN#*\"$1\"}"; [ "$v" = "$IN" ] && return 1; v="${v#*:}"; v="${v#"${v%%[![:space:]]*}"}"; case "$v" in \"*) v="${v#\"}"; printf '%s' "${v%%\"*}" ;; *) printf '%s' "${v%%[,\}]*}" ;; esac; }
+SID="$(field session_id)" || SID=""
+TRIG="$(field trigger)" || TRIG=""
+case "$SID" in ''|*[!A-Za-z0-9._-]*) exit 0 ;; esac   # a snapshot no session can claim is not written
+
+# ---- what the files and the gates say ----
+LINES=()
+GD=""
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  GD="$(git rev-parse --absolute-git-dir 2>/dev/null)" || GD=""
+  BR="$(git rev-parse --abbrev-ref HEAD 2>/dev/null)" || BR=""
+  [ -n "$BR" ] && LINES+=("branch $BR")
+  # quotePath off: a name in Turkish (or any non-ASCII) is given as written, not as octal escapes (seen on Windows).
+  CH="$(git -c core.quotePath=false status --porcelain 2>/dev/null)" || CH=""
+  if [ -n "$CH" ]; then
+    n=0; names=""
+    while IFS= read -r l; do n=$((n+1)); [ "$n" -le 5 ] && names="${names:+$names, }${l:3}"; done <<< "$CH"
+    LINES+=("$n uncommitted file(s): $names$([ "$n" -gt 5 ] && printf ', and %d more' $((n-5)))")
+  else LINES+=("nothing uncommitted"); fi
+fi
+if [ -f "$LIB/gate-log.sh" ]; then
+  . "$LIB/gate-log.sh"; crew_gate_log_read
+  if [ -n "${_CREW_GL:-}" ] && [ -f "$_CREW_GL" ]; then
+    last=""; while IFS= read -r l; do case "$l" in BLOCK$'\t'*) last="$l" ;; esac; done < "$_CREW_GL"
+    if [ -n "$last" ]; then IFS=$'\t' read -r _ rule why _ <<< "$last"; LINES+=("the last refusal in the gate log: ${rule} ${why:0:120}"); fi
+  fi
+fi
+fnd=""
+for f in .crewforth/*.json; do
+  [ -f "$f" ] || continue
+  c=0; while IFS= read -r l; do case "$l" in *'"rule": '*) c=$((c+1)) ;; esac; done < "$f"
+  [ "$c" -gt 0 ] && { b="${f##*/}"; fnd="${fnd:+$fnd, }${b%.json} $c"; }
+done
+[ -n "$fnd" ] && LINES+=("findings on record: $fnd")
+[ -s docs/SESSION_STATE.md ] && LINES+=("a handover is at docs/SESSION_STATE.md")
+[ "${#LINES[@]}" -gt 0 ] || exit 0
+
+SUM=""; for l in "${LINES[@]}"; do SUM="${SUM:+$SUM; }$l"; done
+SUM="${SUM:0:1800}"
+
+# ---- where it goes ----
+if [ -n "$GD" ] && [ -d "$GD" ]; then OUT="$GD/crewforth-session-snapshot.json"
+else mkdir -p .claude/state 2>/dev/null || exit 0; OUT=".claude/state/session-snapshot.json"; fi
+if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v NOW '%(%Y-%m-%dT%H:%M:%SZ)T' -1; else NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
+ESC="$(printf '%s\n' "$SUM" | LC_ALL=C awk -f "$LIB/json-string.awk" 2>/dev/null)" || exit 0
+printf '{"session_id":"%s","trigger":"%s","at":"%s","summary":"%s"}\n' "$SID" "${TRIG//[!a-z]/}" "$NOW" "$ESC" > "$OUT.$$" 2>/dev/null && mv -f "$OUT.$$" "$OUT" 2>/dev/null
+rm -f "$OUT.$$" 2>/dev/null
+exit 0

package/kit/hooks/session-rehydrate.sh

@@ -68,11 +68,34 @@ if [ -f "$ROOT/.claude/hooks/pre-commit" ] && git -C "$ROOT" rev-parse --git-dir
   esac
 fi
 [ -n "$HOOKMSG" ] && MSG="${MSG:+$MSG }$HOOKMSG"
-[ -n "$MSG" ] || exit 0   # no handover to offer and nothing to say about language -> stay silent
+
+# THE STATE BEFORE THE COMPACTION. precompact-snapshot.sh wrote it just before this context was compacted: the
+# branch, the uncommitted files, the last gate refusal, the findings on record. Read back only after a compaction and
+# only into the session that wrote it (same session id); its summary is already JSON-escaped, so it is put into the
+# output as it is, and the rest of MSG stays fixed text that needs no escaping and no extra process.
+SNAP=""
+_rh="${BASH_SOURCE%[/\\]*}"; [ "$_rh" = "${BASH_SOURCE}" ] && _rh=.
+if [ "$SRC" = compact ] && [ -f "$_rh/../eval/lib/gate-log.sh" ]; then
+  . "$_rh/../eval/lib/gate-log.sh"
+  _sf=""
+  if crew_git_dir "$ROOT" && [ -f "$_CREW_GD/crewforth-session-snapshot.json" ]; then _sf="$_CREW_GD/crewforth-session-snapshot.json"
+  elif [ -f "$ROOT/.claude/state/session-snapshot.json" ]; then _sf="$ROOT/.claude/state/session-snapshot.json"; fi
+  _sid(){ _SID=""; local v="${1#*\"session_id\"}"; [ "$v" = "$1" ] && return 0; v="${v#*\"}"; _SID="${v%%\"*}"; }
+  if [ -n "$_sf" ] && IFS= read -r _sj < "$_sf" 2>/dev/null; then
+    _sid "$IN"; _mine="$_SID"; _sid "$_sj"
+    case "$_sj" in *'"summary":"'*)
+      if [ -n "$_mine" ] && [ "$_mine" = "$_SID" ]; then
+        _sum="${_sj#*\"summary\":\"}"; _sum="${_sum%\"\}*}"
+        SNAP="Before this context was compacted, Crewforth wrote down the state of the work from the files and the gates: $_sum. It is a record of that moment; check the files before relying on it."
+      fi ;;
+    esac
+  fi
+fi
+[ -n "$MSG$SNAP" ] || exit 0   # nothing to offer -> stay silent
 
 # hookSpecificOutput.additionalContext is the documented channel that injects text into the model's context.
 # ONE PATH, no jq: MSG is built from fixed constants with no quote, backslash, control character or newline, so it needs no
 # escaping and every machine emits the same bytes. If you ever make MSG dynamic, escape it the way board-sync.sh
 # does (jq-identical, measured) — a raw quote or tab here makes JSON the CLI silently drops.
-printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s"}}\n' "$MSG"
+printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s%s%s"}}\n' "$MSG" "${MSG:+${SNAP:+ }}" "$SNAP"
 exit 0

package/kit/settings.json

@@ -216,6 +216,18 @@
         ]
       }
     ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/precompact-snapshot.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "matcher": "startup|resume|clear|compact|fork",

package/kit/skills/crew-code-review/SKILL.md

@@ -17,6 +17,21 @@ Trigger phrases: "code-review", "review the code", "review the PR", "review my c
 A review runs in four steps — **group, plan, review, fact-check** — and reports few findings that are right rather
 than many that might be. Every step below says what it produces.
 
+## 0. The pre-pass first, and the findings in one shape
+Before reading the diff, run the deterministic pre-pass (`eval/lib/review-prepass/` in either edition):
+`bash <dir>/prepass.sh` for the staged change, `--base <ref>` for a branch. It writes
+`.crewforth/review-prepass.json`: secret patterns, a debug call or TODO left in code, shellcheck on shell files, a
+lock file that moved without its manifest, a very large change. **Carry those over, do not re-derive them**; your
+time goes to what a pattern cannot see. rc 3 (no Node) or a `notMeasured` line means that part was NOT checked:
+say so in the review, never read it as clean.
+
+Write your own findings in the same shape (`crewforth.findings/1`: `rule` `review-<category>`, `severity`,
+`confidence`, `evidence` with `file`, `line` and a `text` quote, `detail` = what to do instead) and store them with
+`bash <dir>/../findings/findings.sh write review <file>`. A `critical` or `high` finding first goes to
+**crew-refuter** (claim + `file:line`, one call per lens, in parallel) and the document is written with
+`--verified`, which then refuses any `medium`-or-higher finding without its verifiers. This is model discipline:
+no hook runs the pre-pass or reads `review.json`.
+
 ## 1. Scope
 - **Review the lines this change adds or edits.** Deleted code is context for understanding them, not a target.
 - Code that is correct, or that the change did not touch, gets no comment.
@@ -142,6 +157,7 @@ five questions that decide *answer in the thread* vs *edit the code*: **`referen
 item leaves with a disposition from the triage table above — a reasoned refusal is an answer, silence is not.
 
 ## DoD (this skill's contribution)
+- The pre-pass ran (or its rc 3 / `notMeasured` is reported as unchecked), and the findings are in `.crewforth/review.json`.
 - The plan (what changed, the risks) came before the findings; every file in each group was read.
 - Every finding has a severity, a category and a reason, in the finding format above.
 - Scope creep and hidden complexity are flagged.

package/kit/skills/crew-map/SKILL.md

@@ -27,18 +27,29 @@ the scan itself read, and a gate holds it to that. **Never commit.** Show the di
 
 3. **Describe.** Read `.crewforth/crew-map.json`, and as much of the cited source as you need. Then edit that
    file, changing ONLY these fields:
-   - each `module` node's `narrative`: `{ "text": "…", "cites": ["file:line", …] }`. What the module is for, in
-     at most two sentences. Every cite is a `file:line` from THAT node's own `evidence`; cite at least one. Leave a
-     node `null` when its evidence does not tell you what it is for: an honest gap beats a guess.
+   - each `module` node's `narrative`: `{ "text": "…", "cites": ["file:line", …], "layer": "…", "domain": "…" }`.
+     What the module is for, in at most two sentences. Every cite is a `file:line` the scan read for THAT node: its
+     `evidence`, its `entryPoint`, or its `about` (the first prose line of its README); cite at least one. `layer` is where it sits, one of `ui` (what a person uses: an app, a site),
+     `api` (serves requests to others), `service` (runs work: a worker, a job), `data` (holds or shapes data),
+     `infra` (deploys and runs the rest), `tool` (a script or CLI for the team), `library` (code other modules
+     import); `domain` is the part of the business it serves, a short phrase ("payments", "mail import"). Both
+     are optional and rest on the same cites: leave one out rather than guess. Leave a node `null` when its
+     evidence does not tell you what it is for: an honest gap beats a guess.
    - the document's `overview`: the same shape, at most 2000 characters, for someone new to the project: the entry
      points, where data goes, the risky places. Its cites may be any node's evidence.
+   - the document's `tour`: `[{ "node": "<id>", "text": "…", "cites": ["file:line"] }, …]`, one to eight stops a
+     newcomer reads in order, usually the entry point first and the riskiest place last. Each stop names a node of
+     the map, says in at most two sentences why to look there, and cites lines from that node's own evidence.
    Describe what the cited lines show. A connection, a purpose or a risk the scan did not find is not added here:
    say it to the user instead.
 
 4. **Validate:** `bash MAP --validate` (Bash tool, not PowerShell). It refuses a description that cites a line
-   the scan did not read, cites nothing, or runs past two sentences, and a map whose scanner fields were changed.
+   the scan did not read, cites nothing, or runs past two sentences; a layer not on the list or a domain written
+   as a sentence; a tour stop at no node, citing another node's lines, or at a node twice; and a map whose
+   scanner fields were changed.
    Fix what it names, in the descriptions only, until it holds.
 
-5. **Hand over:** the scan's summary line, how many modules you described and how many you left `null` and why,
+5. **Hand over:** the scan's summary line, how many modules you described (and gave a layer) and how many you
+   left `null` and why, the tour's stops,
    then `git diff --stat .crewforth/crew-map.json`. Studio's **Map** view (`/crew-studio`) draws the result.
    Committing it is the user's call.

package/kit/skills/crew-review/SKILL.md

@@ -16,7 +16,8 @@ Run the change set through the review trio (read-only). **The audits go out in p
    - @agent-crew-privacy-agent (`privacy-compliance`) — **when the diff touches personal data**: legal basis,
      minimisation, retention, transfer.
 2. (if SonarQube is in use) **sonarqube-check** — 0/0/0/0 gate (language-agnostic).
-3. **Last, once 1-2 leave no blocker:** @agent-crew-review-agent (crew-code-review) — "does it improve overall
+3. **Last, once 1-2 leave no blocker:** @agent-crew-review-agent (crew-code-review) — it starts from the
+   deterministic pre-pass (`.crewforth/review-prepass.json`) and writes `.crewforth/review.json`; "does it improve overall
    code health": the plan (what changed, the risks), then findings with a severity and a category. "Clean" means
    what crew-code-review means by it: **no critical or high finding open**. A medium or low audit finding does not
    hold the reviewer back; hand it over in the reviewer's prompt and keep it in the report. A critical or high one

package/kit/studio/README.md

@@ -201,14 +201,23 @@ loopback and the tunnel does the crossing.
 ## Remote viewers
 
 A viewer is a second token that reads and changes nothing, for watching the
-panel from another device without handing that device the panel. Add one in the
-Machines tab; its link is shown once. The server refuses a viewer's every
-request that is not a `GET`, and its reads of `/api/remote`, with 403 before any
-handler runs (`server/lib/remote.js`). Revoke ends the token and closes a
-stream it holds open. Viewers live in memory and end with the server.
-
-The server still binds to loopback. Reaching it from a phone is a tunnel the
-user runs, an ssh forward or `tailscale serve 7777`; Studio starts none.
+panel from a phone on the same Wi-Fi without handing it the panel. Add one in
+the Machines tab; its link is shown once, as a QR code (`web/qr.js`, made in the
+page). The server refuses a viewer's every request that is not a `GET`, and its
+reads of `/api/remote`, with 403 before any handler runs (`server/lib/remote.js`).
+A viewer lasts eight hours, then its link answers 401 and the page says Session
+expired. Revoke ends the token at once and closes a stream it holds open.
+Viewers live in memory and end with the server.
+
+Transcripts are hidden unless the viewer was added with them shown: the routes
+that are only transcript are refused, and every other answer, the event stream
+included, passes through `server/lib/redact.js`, which drops every string whose
+key is not on its allow-list.
+
+While a viewer is live the server also listens on the machine's private Wi-Fi
+address (`server/lib/lan.js`), and there it takes a viewer's token only, never
+the panel's. With none, it is on loopback alone. Every viewer connection and
+refusal is logged (`GET /api/remote`, and the server's output).
 
 ## What Crewforth already measured
 
@@ -261,8 +270,10 @@ channel that does not exist.
 
 ## Security
 
-The server binds to `127.0.0.1` only, and the host is deliberately not
-configurable — it reads a developer's live sessions and can start new ones.
+The server binds to `127.0.0.1`, and the host is deliberately not configurable —
+it reads a developer's live sessions and can start new ones. The one exception is
+the Wi-Fi listener above: open only while a viewer is live, for viewer tokens
+only, read-only.
 
 A token is always required for `/api/`. Supply one, or let the server generate
 one and print it with the URL:

package/kit/studio/server/index.js

@@ -31,14 +31,17 @@ import { palette } from './lib/palette.js';
 import { latestVersion, latestVersionCached, kitStatus } from './lib/kit.js';
 import { parsePeers, askAll, ask } from './lib/peers.js';
 import {
-  createSession, getSession, listSessionsOwned, reap, stopAll, dropSpools, ALLOWED_MODES,
+  createSession, getSession, listSessionsOwned, reap, stopAll, dropSpools, ALLOWED_MODES, isHeldOpen,
 } from './lib/session.js';
 import { decide, pending, alwaysList, revoke, sweepLeft } from './lib/permissions.js';
-import { open as openTerminal, plan as terminalPlan } from './lib/terminal.js';
+import { open as openTerminal, plan as terminalPlan, desktopLine } from './lib/terminal.js';
 import { gateLog, gateReport, sessionStats, board } from './lib/kit-telemetry.js';
 import { writeState, clearStateSync, findRunning } from './lib/instance.js';
 import { remoteRoster } from './lib/roster.js';
-import { addViewer, listViewers, viewerByToken, revokeViewer, noteRequest, viewerMay, MAX_VIEWERS } from './lib/remote.js';
+import { addViewer, listViewers, viewerByToken, revokeViewer, noteRequest, noteRefusal, viewerMay, MAX_VIEWERS, VIEWER_TTL_MS,
+  liveCount, remoteLog, sweep as sweepViewers, onViewersChange, onLog } from './lib/remote.js';
+import { redact, transcriptOnly } from './lib/redact.js';
+import { lanListener } from './lib/lan.js';
 import { randomUUID } from 'node:crypto';
 import { spawn } from 'node:child_process';
 
@@ -98,8 +101,12 @@ function send(res, status, body, headers = {}) {
   res.end(body);
 }
 
+// The answers that go to a viewer whose link hides transcripts: every one of them passes through redact() on its way
+// out, here and in the event stream, so no route has to remember to.
+const REDACTED = new WeakSet();
+
 function sendJson(res, status, value) {
-  send(res, status, JSON.stringify(value, null, 2), {
+  send(res, status, JSON.stringify(REDACTED.has(res) ? redact(value) : value, null, 2), {
     'content-type': 'application/json; charset=utf-8',
   });
 }
@@ -114,8 +121,12 @@ function sendJson(res, status, value) {
 const TOKEN = process.env.CREW_STUDIO_TOKEN || randomUUID();
 const TOKEN_GENERATED = !process.env.CREW_STUDIO_TOKEN;
 
+// The Wi-Fi listener (lib/lan.js): set by main() once the port is known, and opened and closed with the number of
+// live viewers. Null in the self-check unless it makes one.
+let LAN = null;
+
 /** For the self-check, which asks a real server as the owner and as a viewer. */
-export const _internals = { token: TOKEN };
+export const _internals = { token: TOKEN, setLan: (l) => { LAN = l; } };
 
 // Peers are other machines running Studio, reached over a forwarded port. This
 // server still listens on loopback only; a peer never widens that.
@@ -130,9 +141,12 @@ function whoAsks(req, url) {
   const header = req.headers['authorization'];
   const bearer = typeof header === 'string' && header.startsWith('Bearer ') ? header.slice(7) : null;
   const given = [bearer, url.searchParams.get('token')].filter(Boolean);
-  if (given.includes(TOKEN)) return { role: 'owner' };
+  // The panel's own token is accepted on loopback only. From the Wi-Fi it is not a token at all: a phone holding it
+  // would hold the panel, and nothing on the network should.
+  if (!req.crewLan && given.includes(TOKEN)) return { role: 'owner' };
   for (const t of given) {
     const viewer = viewerByToken(t);
+    if (viewer?.expired) return { role: 'expired', label: viewer.expired };
     if (viewer) return { role: 'viewer', viewer };
   }
   return null;
@@ -247,14 +261,30 @@ export async function handle(req, res) {
   // it for /style.css served an unstyled page and protected nothing: the shell
   // holds no secrets, and every /api/ path below is still gated.
   const who = url.pathname.startsWith('/api/') ? whoAsks(req, url) : null;
+  // From the Wi-Fi, no token (or the panel's own) is 401: the network is asked who it is. On loopback the answer
+  // stays 403, as it always was.
   if (url.pathname.startsWith('/api/') && !who) {
-    return sendJson(res, 403, { ok: false, reason: 'token required' });
+    if (req.crewLan) noteRefusal(req, { status: 401, reason: 'no viewer token' });
+    return sendJson(res, req.crewLan ? 401 : 403, { ok: false, reason: 'token required' });
+  }
+  if (who?.role === 'expired') {
+    noteRefusal(req, { viewer: who.label, status: 401, reason: 'expired' });
+    return sendJson(res, 401, { ok: false, expired: true, reason: 'this link has expired: viewer links last eight hours' });
   }
   // A viewer is refused HERE, before any handler: no route below has to remember that a viewer exists, and a
-  // route added tomorrow is read-only for a viewer without anyone writing a line for it.
+  // route added tomorrow is read-only for a viewer without anyone writing a line for it. The same holds for a
+  // link that hides transcripts: the routes that are nothing but transcript are refused here, and every other
+  // answer is filtered on its way out (REDACTED).
   if (who?.role === 'viewer') {
     const may = viewerMay(req.method, url.pathname);
-    if (!may.ok) return sendJson(res, 403, { ok: false, reason: may.reason });
+    if (!may.ok) { noteRefusal(req, { viewer: who.viewer.label, status: 403, reason: may.reason }); return sendJson(res, 403, { ok: false, reason: may.reason }); }
+    if (!who.viewer.transcripts) {
+      if (transcriptOnly(url.pathname)) {
+        noteRefusal(req, { viewer: who.viewer.label, status: 403, reason: 'transcripts hidden' });
+        return sendJson(res, 403, { ok: false, transcriptsHidden: true, reason: 'transcripts are hidden on this link' });
+      }
+      REDACTED.add(res);
+    }
     noteRequest(who.viewer, req, res);
   }
 
@@ -262,6 +292,7 @@ export async function handle(req, res) {
     return sendJson(res, 200, {
       ok: true,
       role: who.role,
+      ...(who.role === 'viewer' ? { transcripts: who.viewer.transcripts, expiresAt: who.viewer.expiresAt } : {}),
       node: process.version,
       pid: process.pid,
       uptimeMs: Math.round(process.uptime() * 1000),
@@ -502,8 +533,12 @@ export async function handle(req, res) {
     const cwd = url.searchParams.get('cwd') || (session ? await sessionCwd(session.file, session.bytes) : null);
 
     if (req.method === 'GET') {
-      // What WOULD run, so the panel can show it before anything is launched.
-      return sendJson(res, 200, { measured: true, cwd, plan: cwd ? terminalPlan({ cwd, sessionId: id }) : null });
+      // What WOULD run, so the panel can show it before anything is launched; and, before Continue here is pressed,
+      // what it will do: continue this same session (nothing else holds it), or start a copy (something does). The
+      // answer is the one createSession acts on, asked the same way.
+      const held = await isHeldOpen(id);
+      return sendJson(res, 200, { measured: true, cwd, plan: cwd ? terminalPlan({ cwd, sessionId: id }) : null,
+        continueAs: held ? 'copy' : 'same', desktop: cwd ? desktopLine({ cwd, sessionId: id }) : null });
     }
 
     const gate = writeAllowed(req);
@@ -515,7 +550,6 @@ export async function handle(req, res) {
     const out = openTerminal({
       cwd: typeof body.cwd === 'string' ? body.cwd : cwd,
       sessionId: id,
-      command: typeof body.command === 'string' ? body.command : undefined,
     });
     return sendJson(res, out.ok ? 200 : 400, out);
   }
@@ -529,7 +563,8 @@ export async function handle(req, res) {
      the owner reaches this far; a viewer was refused above. */
 
   if (url.pathname === '/api/remote' && req.method === 'GET') {
-    return sendJson(res, 200, { measured: true, viewers: listViewers(), max: MAX_VIEWERS, now: Date.now() });
+    return sendJson(res, 200, { measured: true, viewers: listViewers(), max: MAX_VIEWERS, ttlMs: VIEWER_TTL_MS, now: Date.now(),
+      lan: LAN ? LAN.state() : { listening: false, addresses: [], errors: [] }, log: remoteLog(30) });
   }
 
   const remoteMatch = url.pathname.match(/^\/api\/remote(?:\/([^/]+))?$/);
@@ -539,11 +574,16 @@ export async function handle(req, res) {
     if (req.method === 'POST' && !remoteMatch[1]) {
       const body = await readBody(req);
       if (!body) return sendJson(res, 400, { ok: false, reason: 'body was not JSON' });
-      const made = addViewer(body.label);
-      return sendJson(res, made.ok ? 201 : 409, { ...made, viewers: listViewers() });
+      const made = addViewer(body.label, { transcripts: body.transcripts === true });
+      // The Wi-Fi listener opens with the first viewer; its links are known once it listens.
+      if (made.ok && LAN) await LAN.sync(liveCount());
+      const lanUrls = made.ok && LAN ? LAN.urls(made.viewer.token) : [];
+      return sendJson(res, made.ok ? 201 : 409, { ...made, lanUrls, lan: LAN ? LAN.state() : null, viewers: listViewers() });
     }
     if (req.method === 'DELETE' && remoteMatch[1]) {
-      return sendJson(res, 200, { ...revokeViewer(decodeURIComponent(remoteMatch[1])), viewers: listViewers() });
+      const out = revokeViewer(decodeURIComponent(remoteMatch[1]));
+      if (LAN) await LAN.sync(liveCount());
+      return sendJson(res, 200, { ...out, lan: LAN ? LAN.state() : null, viewers: listViewers() });
     }
     return sendJson(res, 405, { ok: false, reason: 'POST to add a viewer, or DELETE a viewer id' });
   }
@@ -744,7 +784,7 @@ async function stream(req, res, url) {
   });
 
   const send = (event, data) => {
-    res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    res.write(`event: ${event}\ndata: ${JSON.stringify(REDACTED.has(res) ? redact(data) : data)}\n\n`);
   };
 
   // A session the panel just started has no transcript until its first turn
@@ -988,9 +1028,11 @@ async function main() {
         '  --help       this text\n\n' +
         'Set CREW_STUDIO_TOKEN to require a bearer token, CREW_STUDIO_PEERS for a\n' +
         'comma-separated peer list.\n\n' +
-        'To watch from another device, add a viewer under Machines in the panel\n' +
-        'and open its link through a tunnel of your own. A viewer reads and\n' +
-        'changes nothing, and the server stays on loopback.\n\n' +
+        'To watch from a phone on the same Wi-Fi, add a viewer under Machines in\n' +
+        'the panel and scan its QR code. A viewer reads and changes nothing, its\n' +
+        'link lasts eight hours, and transcripts stay hidden unless you show them.\n' +
+        'While a viewer is live the server also listens on this machine\'s Wi-Fi\n' +
+        'address, for viewer links only; with none it is on loopback alone.\n\n' +
         'Peers are normally reached over a forwarded port, which keeps every\n' +
         'Studio on loopback:\n' +
         '  ssh -N -L 7778:127.0.0.1:7777 other-machine\n' +
@@ -1007,12 +1049,21 @@ async function main() {
   // Only a server that is about to run does this; asking for --help or --selftest removes nothing.
   sweepLeft();
 
-  const server = http.createServer((req, res) => {
+  const handler = (req, res) => {
     handle(req, res).catch((e) => {
       process.stderr.write(`crewforth-studio: unhandled: ${e?.stack ?? e}\n`);
       if (!res.headersSent) send(res, 500, 'internal error');
     });
-  });
+  };
+  const server = http.createServer(handler);
+
+  // Viewers on the same Wi-Fi: a second listener on this machine's private address, open only while a viewer is
+  // live (lib/lan.js). It closes when the last one is revoked or expires; the sweep ends expired ones even when no
+  // request comes to notice them.
+  LAN = lanListener({ handler, port: args.port });
+  onViewersChange((n) => { LAN.sync(n); });
+  onLog((e) => process.stdout.write(`            viewer ${e.event}: ${e.viewer ?? 'unknown'}${e.ip ? ` from ${e.ip}` : ''}${e.over ? ` (${e.over})` : ''}${e.result ? ` — ${e.result}` : ''}\n`));
+  setInterval(sweepViewers, 60 * 1000).unref();
 
   // A BUSY PORT IS NOT AUTOMATICALLY A PROBLEM. Before 2.10.2 this printed "try --port n+1" and exited 1, which
   // is the right answer only when a stranger holds the port. When the holder is our OWN panel -- the common case,
@@ -1093,6 +1144,7 @@ async function main() {
       // leaks running sessions is worse than one that never started them.
       stopAll();
       dropSpools();
+      LAN?.close();
       server.close(() => process.exit(0));
       setTimeout(() => process.exit(0), 2000).unref();
     });

package/kit/studio/server/lib/graph.js

@@ -17,7 +17,7 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 
-import { readAll, contextFill } from './transcript.js';
+import { readAll, contextFill, contextMix } from './transcript.js';
 import { agentMetaFiles } from './projects.js';
 import { Usage, withTimes } from './usage.js';
 import { detailOf } from './permissions.js';
@@ -139,6 +139,7 @@ export function linkRetries(calls) {
     if (!c.refused) return;
     const again = list.slice(i + 1).find((n) => n.subagentType === c.subagentType && n.description === c.description);
     if (!again) return;
+    c.retried = true;
     // A call refused twice keeps the first thing that was asked.
     again.firstTry = c.firstTry ?? { asked: c.model, floor: c.refused.floor, text: c.refused.text };
   });
@@ -456,7 +457,14 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
     version: main.version,
     status: 'session',
     turns: main.userTurns,
+    // Agent calls the model gate refused and the session has not made again: no agent started, so nothing else on
+    // the canvas says they happened (seen on a real project: two refused calls, an empty canvas, "2 failed" only in
+    // the session's own view). A refused call made again is shown on the call that ran (`firstTry`).
+    refusedCalls: [...main.agentCalls.values()].filter((c) => c.refused && !c.retried)
+      .map((c) => ({ agent: c.subagentType ?? null, model: c.model ?? null, text: c.refused.text })),
     tokens: contextFill(records),
+    // What that context is made of: the tool-output share since the last compaction, and the compactions so far.
+    context: contextMix(records),
     startedAt: main.startedAt,
     endedAt: main.updatedAt,
     usage: withTimes(usage, records),

package/kit/studio/server/lib/kit-telemetry.js

@@ -52,11 +52,36 @@ function kitPaths(cwd) {
  * empty unless CREW_GATE_LOG_CMD=1 was set, and there is no timestamp at all —
  * both facts are returned rather than papered over.
  */
+/**
+ * Where the gate log is, by the rule the gates write by (eval/lib/gate-log.sh): .claude/gate-log.tsv, else the
+ * repository's own .git/crewforth-gate-log.tsv (a project that tracks .claude/ has it there), searched from the
+ * project root up. null when there is none yet.
+ */
+export function gateLogPath(cwd) {
+  const own = path.join(cwd, '.claude', 'gate-log.tsv');
+  if (fs.existsSync(own)) return own;
+  let d = cwd;
+  for (let n = 0; n < 12; n += 1) {
+    const g = path.join(d, '.git');
+    let st = null;
+    try { st = fs.statSync(g); } catch { /* not here */ }
+    if (st?.isDirectory()) { const f = path.join(g, 'crewforth-gate-log.tsv'); return fs.existsSync(f) ? f : null; }
+    if (st?.isFile()) {
+      const m = /^gitdir: (.+)$/m.exec(fs.readFileSync(g, 'utf8'));
+      if (!m) return null;
+      const gd = path.resolve(d, m[1].trim()); const f = path.join(gd, 'crewforth-gate-log.tsv');
+      return fs.existsSync(f) ? f : null;
+    }
+    const up = path.dirname(d); if (up === d) return null; d = up;
+  }
+  return null;
+}
+
 export function gateLog(cwd, { limit = 200 } = {}) {
-  const file = path.join(cwd, '.claude', 'gate-log.tsv');
+  const file = gateLogPath(cwd);
   let st;
-  try { st = fs.statSync(file); } catch {
-    return { measured: false, reason: 'no .claude/gate-log.tsv in this project', entries: [] };
+  try { st = fs.statSync(file ?? ''); } catch {
+    return { measured: false, reason: 'no gate log in this project yet (.claude/gate-log.tsv, or .git/crewforth-gate-log.tsv where .claude/ is tracked)', entries: [] };
   }
 
   // Only the tail: this file reached 21,730 lines in Crewforth's own checkout and
@@ -119,9 +144,9 @@ export async function gateReport(cwd) {
   // should read is one level up. Both layouts are given what they expect rather
   // than the script being asked to guess.
   const from = kit.kind === 'installed' ? cwd : path.dirname(kit.hooks);
-  const logPath = path.join(cwd, '.claude', 'gate-log.tsv');
+  const logPath = gateLogPath(cwd);
   const env = { ...process.env };
-  if (kit.kind !== 'installed' && fs.existsSync(logPath)) env.CREW_GATE_LOG = logPath;
+  if (logPath) env.CREW_GATE_LOG = logPath;
 
   const r = await run('bash', [script, '--json'], { cwd: from, env });
   // 3 means there is no log to read, which the script calls "not an error"; 4