frizz 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [
@@ -38,21 +38,27 @@
     "frizz-dev:uninstall": "nub scripts/install-global-cli.mjs --uninstall",
     "install:global": "nub scripts/install-global-cli.mjs",
     "typecheck": "tsc -b packages/shared packages/rpc packages/server . && pnpm --filter @frizz/web typecheck",
-    "test": "nub --test --test-force-exit 'board/*.test.mjs' 'scripts/**/*.test.mjs' 'src/**/*.test.ts' 'packages/shared/src/**/*.test.ts' 'packages/server/src/**/*.test.ts' 'packages/web/src/**/*.test.ts'",
+    "test": "nub scripts/run-tests.mjs",
     "prepack": "node ./scripts/prepare-package.mjs && node ./scripts/build-package.mjs && node ./scripts/publish-manifest.mjs --strip",
-    "postpack": "node ./scripts/publish-manifest.mjs --restore"
+    "postpack": "node ./scripts/publish-manifest.mjs --restore && node ./scripts/prepare-package.mjs --clean"
   },
   "dependencies": {
     "@parcel/watcher": "^2.5",
-    "node-pty": "^1.1"
+    "node-pty": "^1.1",
+    "qrcode-generator": "^2.0.4"
   },
   "devDependencies": {
     "@types/node": "^24",
     "esbuild": "^0.25.0",
+    "jsqr": "^1.4.0",
     "puppeteer": "^25.3.0",
     "typescript": "^5.7"
   },
   "pnpm": {
+    "overrides": {
+      "react": "19.2.7",
+      "react-dom": "19.2.7"
+    },
     "onlyBuiltDependencies": [
       "node-pty",
       "@parcel/watcher",

package/runtime/cc-worker/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "description": "Worker-side frizz plugin for frizz-spawned sessions. Each session is a WORKER driving ONE effort (slug via env FRIZZ_THREAD): it SIGNALS through its final message (done, human/timer awaiting, question), keeps automatable waits active with Claude wait tools, and PERSISTS through a scratchpad blackboard (.frizz/threads/<session-id>/scratch.md) with an optional stop_hook reminder. Supplies the frizz:<model>-<effort> sub-agent profiles (dispatch as frizz:opus-high, frizz:sonnet-medium, frizz:haiku, …), the on-demand frizz:gh skill, and hooks that seed the worker contract, enforce background/name-stripped sub-agent dispatch, and deny the interactive question/plan prompts (deny-ask, deny-plan) that would hang a dashboard worker. Hooks are inert unless FRIZZ_THREAD is set.",
+  "description": "Worker-side frizz plugin for frizz-spawned sessions. Each session is a WORKER driving ONE effort (slug via env FRIZZ_THREAD): it SIGNALS through its final message (done, human/timer awaiting, question), keeps automatable waits active with Claude wait tools, and keeps its own free-form scratch directory (.frizz/threads/<session-id>/). Supplies the frizz:<model>-<effort> sub-agent profiles (dispatch as frizz:opus-high, frizz:sonnet-medium, frizz:haiku, …), the on-demand frizz:gh skill, and hooks that seed the worker contract, enforce background/name-stripped sub-agent dispatch, and deny the interactive question/plan prompts (deny-ask, deny-plan) that would hang a dashboard worker. Hooks are inert unless FRIZZ_THREAD is set.",
   "version": "0.1.10",
   "author": { "name": "Colin McDonnell" },
   "homepage": "https://github.com/colinhacks/frizz",

package/runtime/cc-worker/DECISIONS.md

@@ -30,8 +30,8 @@ what was ported from the orchestrator `cc/` plugin, what was dropped, and why.
 | Hook | Event | Ported from | What it does for a worker |
 | --- | --- | --- | --- |
 | `session-seed.mjs` | SessionStart (startup/resume/clear/compact) | cc `session-seed.mjs` | Injects the single-thread worker contract + the bound slug + its file path; re-grounds on compact. Also writes cc's `off` sentinel defensively (see interplay). |
-| `precompact-instructions.mjs` | PreCompact (auto/manual) | new — no cc equivalent | Steers WHAT SURVIVES compaction: emits an editorial brief asking the summarizer to preserve the high-level approach (plan, alternatives rejected, rationale) at high fidelity, plus a closing "Re-grounding before continuing:" section naming the scratchpad path and the files to re-read. **PLAIN STDOUT is the channel** — cc's usual `hookSpecificOutput` JSON would be handed to the summarizer as its literal instructions. Skips sub-agent contexts (the derived scratchpad path is only guaranteed for the top-level worker). |
-| `scratchpad.mjs` | SessionStart (startup/resume/clear/compact) + PreCompact (auto/manual) + UserPromptSubmit + PostToolUse | new — no cc equivalent | Keeps the ONE per-thread scratchpad (`.frizz/threads/<sid>/scratch.md`) written and re-grounded across compaction. `--mode=session-start` injects the pad's HEAD back verbatim on the context-losing sources (compact/resume/clear) plus a re-read pointer, and teaches the contract when the pad is still an unwritten skeleton; `--mode=precompact` (**plain stdout**) hands the head to the summarizer; `--mode=nudge` fires on BOTH UserPromptSubmit and PostToolUse (mid-turn — the one that matters for long autonomous turns) once context has grown past `STALE_TOKENS` since the last write. Both nudge channels share one state file, so mid-turn firing does not multiply reminders. NOT gated on `FRIZZ_THREAD`; `--via=project` marks the repo-local registration and defers to this one inside a frizz worker. |
+| `precompact-instructions.mjs` | PreCompact (auto/manual) | new — no cc equivalent | Steers WHAT SURVIVES compaction: emits an editorial brief asking the summarizer to preserve the high-level approach (plan, alternatives rejected, rationale) at high fidelity, plus a closing "Re-grounding before continuing:" section naming the thread's scratch-directory path and the files to re-read. **PLAIN STDOUT is the channel** — cc's usual `hookSpecificOutput` JSON would be handed to the summarizer as its literal instructions. Skips sub-agent contexts (the derived scratch-directory path is only guaranteed for the top-level worker). |
+| `scratchpad.mjs` | SessionStart (startup/resume/clear/compact) + PreCompact (auto/manual) + UserPromptSubmit + PostToolUse | new — no cc equivalent | Keeps a worker aware of its per-thread scratch DIRECTORY (`.frizz/threads/<sid>/`). `--mode=session-start` NAMES the files in it on the context-losing sources (compact/resume/clear) — a listing, never their content — and otherwise teaches the arrangement (write a doc, then arm `post_compaction`); `--mode=precompact` (**plain stdout**) tells the summarizer those files exist so it carries their paths forward; `--mode=nudge` fires on BOTH UserPromptSubmit and PostToolUse (mid-turn — the one that matters for long autonomous turns) once context has grown past `STALE_TOKENS` since the last write. Both nudge channels share one state file, so mid-turn firing does not multiply reminders. NOT gated on `FRIZZ_THREAD`; `--via=project` marks the repo-local registration and defers to this one inside a frizz worker. |
 | `agent-dispatch.mjs` | PreToolUse(Agent) | cc `agent-dispatch.mjs` | Enforces `run_in_background:true`, strips `name`/`team_name`, appends a worker-flavored orchestration epilogue. |
 | `bash-background.mjs` | PreToolUse(Bash) | new | Denies a local shell job that escapes through `&` without a later `wait` or EXIT trap, including one hidden inside a command-position `bash -c '…'`. Shell job control bypasses Claude's task registry, so Frizz cannot track or wake it; self-contained probe concurrency, and a wrapper handed to another program (`ssh`/`docker run`/`limactl shell`), remain allowed. |
 | `agent-bind.mjs` | PostToolUse(Agent) | cc `agent-bind.mjs` (verbatim behavior) | Records `agentId → thread` into `.frizz/.agent-bindings.jsonl` in cc's exact format, so a worker's THREAD-tagged helper renders on the frizz board's per-thread liveness. |
@@ -125,6 +125,23 @@ decision, not an artifact-portability implementation detail. A future isolation
 which settings/auth surfaces are preserved before adding `--settings`, a config-home override, or a
 global-plugin disable mechanism.
 
+**2026-08-16 — the SDK broker had drifted off this policy, and is back on it.** The tmux transport
+spawned a plain `claude`, which reads all three settings scopes, so the policy above held by default.
+The Agent-SDK broker takes an explicit `settingSources` and the SDK's own default is `[]` — nothing at
+all — so when the broker became the default Claude transport it read no config whatsoever. The
+2026-07-26 fix restored `project` + `local` (the repo's `CLAUDE.md` / `AGENTS.md` / `.claude/skills`)
+and left `user` out, on a rationale written into the code — "the operator's personal `~/.claude` config
+is theirs, not something a dispatched worker should silently inherit" — that this record had already
+rejected. The gap was invisible because everything it withheld fails QUIETLY: the operator's `env`
+block (which is where an API-proxy front-end writes its base-URL/token pair, so a broker session
+authenticates differently from the CLI in the same shell), `autoCompactWindow` (so sessions compacted
+at the default threshold, not the configured one), `permissions`, `hooks` and `enabledPlugins`.
+Measured against the maintainer's real config, one variable, observed through a project-scope hook:
+`--setting-sources=project,local` reported their `env` block UNSET, `user,project,local` reported it
+applied, both sessions exiting 0 with empty stderr. The default is now all three scopes — the same
+thing a plain `claude` in the same cwd reads. A frizz thread is the operator's own session on their own
+machine, so the surprising behavior was the divergence, not the inheritance.
+
 ## 2026-07-02: Stop hook removed
 stop-flush.mjs is no longer wired (script kept for reference). User call: under frizz the
 tailer/board already surface worker state live, and the block-until-file-edited nag forced even
@@ -273,10 +290,22 @@ defect, and arguably correct: an explicit human rule should beat a blanket polic
 
 MARKER: `<stateDir>/perm-requests/<slug>.json` now carries `decision` / `rule` / `reason` / `command`
 alongside the original fields. The tailer treats ONLY a deferred request as a human block (an
-auto-resolved one must never card as "Needs you"), and surfaces the last allow/deny as `permPolicy` —
-the only durable record an approval leaves anywhere, since allows are never written to the transcript.
+auto-resolved one must never card as "Needs you"), and surfaces the last DENIAL as `permPolicy`.
 A marker with no `decision` (an older plugin build) still blocks exactly as before.
 
+APPROVALS ARE NOT SURFACED — reversed 2026-08-07. The tailer originally retained allows too, on the
+reasoning that an approval leaves no other durable record (Claude Code renders "Allowed by
+PermissionRequest hook" in the pane and writes nothing to the transcript), and Chat rendered them as
+one quiet `Auto-approved <command> · rule <name>` line. The flaw was that `permPolicy` has no CLEAR:
+the line stuck to the bottom of the thread permanently, so one routine `git status --short` read as
+the thread's standing condition long after the turn that ran it (maintainer: *"This message just
+showed up randomly, and now it's stuck showing up in the thread forever … it's fucking useless"*).
+Nothing was blocked and nobody was waiting, so the visibility it bought was worth less than the
+permanent noise. Denials keep the card: they are rare, they changed what the worker could do, and the
+refusal also lands in the transcript, so the card is a pointer to something real rather than the only
+copy of it. If approval visibility is ever wanted again it needs an EXPIRY (or a per-turn scope) —
+re-adding the sticky line is not the fix.
+
 VERIFICATION: `scripts/verify-perm-marker.mjs` runs the REAL hook the way Claude Code does and
 asserts every branch. The allow path was additionally driven against a REAL interactive `claude` (it
 cannot be exercised under `claude -p`, where PermissionRequest hooks do not fire).
@@ -1023,3 +1052,51 @@ The rule now LEADS both child-facing epilogues, with the collection paragraph ke
 This is a PROMPT-level default, deliberately NOT the hook-level depth-2 DENY rejected on 2026-07-31 as too blunt: a dispatcher that genuinely wants a prong fanned out says so in the prompt and the child dispatches, unmodified. Also left alone: `workerPrompt.ts` — the root contract already authorizes fan-out *"when work genuinely decomposes"*, and the root is the one agent whose fan-out is wanted.
 
 Pinned by a new test in `agent-dispatch-hook.test.ts` (the lead-with-the-default wording plus the re-hinged conditional) and one in `scratchpad-hook.test.ts` (the codex block).
+
+
+## 2026-08-06: the canonical scratchpad is DELETED — a free scratch directory, and compaction recovery moves to the recurring prompt
+
+Frizz provisioned one canonical `scratch.md` per thread and a `SessionStart` hook spliced its HEAD into
+the context window after every compaction. The argument for the injection was sound and is worth
+restating, because it is what any replacement has to answer: a bare "remember to read your scratchpad"
+routes recovery through a decision the model can skip, which is exactly the failure the pad existed to
+prevent.
+
+It still lost, on three counts. It made a MAINTAINED FILE the price of admission for every worker,
+including the ones whose whole task was one edit. It needed a merge-only contract per backend to stop
+sub-agents clobbering the one document — an epilogue in `agent-dispatch.mjs`, a `--mode=subagent-start`
+epilogue for codex, a legend line in every provisioned pad, and a paragraph of the worker contract, all
+of it policing a hazard rather than removing it. And the injection was INVISIBLE to the operator, who
+could neither see what their worker would be handed nor change it.
+
+**What replaced it, maintainer's design:** the thread gets `.frizz/threads/<session-id>/` as a free-form
+scratch DIRECTORY — nothing provisioned into it, no reserved filename, no format — and compaction
+recovery moves to `mcp__frizz__recurring_prompt`'s new POST-COMPACTION trigger (scheduler SOURCE 7,
+landed the same day). The worker writes whatever doc it likes and LINKS it in the prompt; frizz re-sends
+that text the instant the context is summarized away. Durable in SQLite, visible and editable in the
+thread footer, and the worker chooses what it gets back.
+
+The sub-agent story falls out for free: **one file per writer**. There is nothing to merge, so there is
+nothing to clobber, and the entire merge contract is deleted rather than reworded. Both child epilogues
+now say "write your OWN file; never edit or delete a file another agent wrote". The delegated-authority
+carve-out ("write only <path>" must not forbid the child's own coordination file) MOVED out of the
+worker contract and into the two epilogues that actually reach a child — it is pinned in
+`agent-dispatch-hook.test.ts` and `scratchpad-hook.test.ts` rather than in the contract goldens.
+
+**The accepted cost, stated plainly rather than engineered around.** The maintainer chose this over a
+hybrid that kept a canonical doc, knowing compaction recovery degrades from a guaranteed injection to a
+pointer the model can skip. So the hook now NAMES the files in the directory and never their content
+(`scratchpad-hook.test.ts` pins that a body written into a scratch file does not appear in the
+injection). Re-growing that listing back into a content injection would restore exactly what was
+removed. The guaranteed channel is the arming, and every surface that mentions the directory also
+mentions `post_compaction: true`, because a folder nothing ever reads back is a folder of notes nobody
+opens.
+
+**Two migrations that cost nothing.** `discover.ts`'s transcript-recovery sentinel shortened from
+`threads/<id>/scratch.md` to `threads/<id>/` — the new string is a PREFIX of the old one, so every
+transcript written before today still matches and no live thread lost its recovery path (pinned by
+`discover.test.ts`). And the Doc tab now renders the directory: files concatenated under a heading
+each, newest first, dotfiles excluded (frizz's own `.scratchpad-state.json` is not the worker's notes),
+binaries named rather than inlined, with per-file and total caps that say when they truncated. It is
+gated on the directory being NON-EMPTY rather than merely present, since dispatch now creates it empty
+and "exists" stopped meaning "the worker wrote something".