gh-glance 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -7,6 +7,85 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-10-29
+
+### Added
+
+- Local Focus searches loaded Issues and PRs with `/`, topic words and exact
+  number, author, branch and updated-date filters, without extra GitHub requests.
+  Optional semantic Focus uses `--jev`, `TYPESAFE_API_KEY` and scoped consent;
+  `m` evaluates more loaded candidates. Model calls share a session cap and
+  four-second action deadline; results stay in memory. Live provider behavior,
+  semantic accuracy and developer benefit remain unqualified or unmeasured.
+- Standalone `a` shows exact personal review, assignment and authored-PR
+  attention among loaded rows, with explicit 25-item detail batches, unknown
+  relationship coverage and refresh/retry controls. Optional `J` metadata
+  badges preserve deterministic membership/order; `x` revokes permission.
+
+- Actions `d` opens exact run/attempt/job evidence in standalone mode; `l`
+  explicitly captures a bounded failed/timed-out job log. Enter opens the exact
+  selected job. Coverage and unsupported proxy/storage limitations are visible.
+- Optional CI `J` previews sanitized bounded log text before every send, then
+  reports six independent observations with existing original-line evidence.
+  `e` selects a clean smaller range; `x` revokes permission and clears active
+  log/excerpt/results. Exact GitHub facts stay authoritative; live semantic
+  qualification and developer benefit remain unmeasured.
+
+### Changed
+
+- Sutura's protected native-proof pilot records exact checkout evidence and
+  selects full native verification for repair proposals and authenticated exact
+  repair merges. Ordinary development checks and release publication authority
+  remain separate.
+- Shared quota protocol 8 upgrades the same ledger path with a private exact
+  `.pre-v8.backup`. Restart all gh-glance panes with this version; keep the
+  shared quota ledger. Never clear, delete or downgrade it for a version
+  mismatch. A future protocol requires updating every pane. Preserve a
+  conflicting backup under an unused archival filename before retrying;
+  recovery help/doctor reports its exact path. An unverified native connection
+  keeps its charge until the ledger's computed uncertainty-window recovery.
+
+### Fixed
+
+- Collector readiness now guarantees shutdown handlers are installed, so an
+  immediate stop closes the socket and lock cleanly.
+- Attention refresh compares live and cached metadata consistently, so an
+  unchanged unknown PR review value cannot invalidate its source binding.
+  Real metadata changes still retire the prior view and require explicit restart.
+
+## [0.17.1] - 2026-10-26
+
+### Fixed
+
+- A full debt-group journal no longer pins every pane of an account behind
+  "Local coordination accounting overflow". Quiescent groups now merge once the
+  journal is half full, after any active probe finishes or expires, so the
+  journal can free space for retiring a control receipt. Ledgers already wedged
+  in this state recover automatically after upgrading.
+- Pasted or multi-character input such as `12` is ignored instead of being read
+  as a tab number. Single-digit tab keys are unchanged.
+- Webhook events now match configured targets whose repository name differs in
+  case from the name GitHub sends, including access-removal events that fence
+  cached data. Ambiguity across hosts is still rejected.
+- A collector view with an old snapshot shows `Stale` or `Cached` with its
+  source age. It shows `Disconnected`, still with that age, only when the
+  collector connection or its app authorization is lost.
+
+### Changed
+
+- Updated React to 19.3.0 and refreshed existing tooling/action versions.
+  Patched the development-only brace-expansion and Zod vulnerabilities.
+- README: Homebrew installation (`brew install juan294/tap/gh-glance`) is
+  documented, with a note to use one installation method.
+- Development CI monitoring uses Sutura v0.4.0.
+- A journal that is genuinely full of unsettled requests reports "Local
+  coordination journal is full" with an automatic retry instead of the hard
+  accounting-overflow notice.
+- `gh-glance --doctor` reports debt-journal occupancy as `debt groups`, and
+  for a hard coordination failure, including a ledger that is missing or
+  unreadable, names the state file and the `repair`: quit every pane, move the
+  ledger, its recovery journal and `registry.json` aside, relaunch.
+
 ## [0.17.0] - 2026-10-25
 
 ### Added
@@ -1282,7 +1361,9 @@ engineering, security, QA and UX. What follows is what changed as a result.
 - The `main` field from `package.json`. It advertised the file as importable,
   but importing it took over the terminal or exited the host process.
 
-[Unreleased]: https://github.com/juan294/gh-glance/compare/v0.17.0...HEAD
+[Unreleased]: https://github.com/juan294/gh-glance/compare/v0.18.0...HEAD
+[0.18.0]: https://github.com/juan294/gh-glance/compare/v0.17.1...v0.18.0
+[0.17.1]: https://github.com/juan294/gh-glance/compare/v0.17.0...v0.17.1
 [0.17.0]: https://github.com/juan294/gh-glance/compare/v0.16.2...v0.17.0
 [0.16.2]: https://github.com/juan294/gh-glance/compare/v0.16.1...v0.16.2
 [0.16.1]: https://github.com/juan294/gh-glance/compare/v0.16.0...v0.16.1

package/README.md

@@ -69,6 +69,14 @@ current.
 - **Issues** -- open issues: title, author, first label, age
 - **Pull Requests** -- open PRs: title, author, branch, review status
   (approved / changes requested / pending), age
+- **[Focus](#focus-loaded-work)** -- `/` searches loaded Issues and PRs locally;
+  optional `J` adds semantic matching after explicit consent
+- **[Selected CI evidence](#selected-ci-evidence)** -- `d` opens exact run/job
+  facts and `l` loads a failed-job log in standalone mode; optional
+  [CI observations](#optional-ci-log-observations) cite original log lines
+- **[Personal attention](#personal-attention)** -- `a` shows personal review,
+  assignment and authored-PR facts in standalone mode; optional metadata badges
+  leave the exact queue and order unchanged
 - **Security** -- open Dependabot, code-scanning, and secret-scanning alerts,
   sorted with the most severe first and with severity spelled out rather than
   carried by colour alone. Each source starts with its newest 100 open alerts.
@@ -121,10 +129,28 @@ current.
 
 ## Install
 
+With Homebrew on macOS or Linux:
+
+```bash
+brew install juan294/tap/gh-glance
+```
+
+Future updates use your normal `brew upgrade`. The
+[Homebrew tap](https://github.com/juan294/homebrew-tap) follows published npm
+releases automatically and supplies its own Node runtime. If moving from npm,
+remove existing npm copies first; the tap README includes migration commands.
+Restart running dashboard panes after upgrading.
+
+Alternatively, install with npm (Node.js 22 or newer):
+
 ```bash
 npm install -g gh-glance
 ```
 
+Use one installation method. NVM keeps global npm packages separate for each
+Node installation, so an npm update may not affect a copy launched from another
+prefix.
+
 That is the whole install for the default standalone dashboard. `gh-glance`
 ships as a single `index.mjs` with no build step, so there is nothing to
 compile. The optional collector, SSH, webhook, and GitHub App modes use the
@@ -285,9 +311,16 @@ stdout isn't a terminal rather than streaming redraw frames into a pipe.
 | `R` | Resynchronize the current tab: one generation without validators, and the only key that clears a negative capability backoff. Still subject to the budget and the secondary cooldown. |
 | `s` | On Actions, request or reuse a read-only setup check (standalone only) |
 | `g` | On Actions, open the selected repository’s Actions page |
+| `/` | Search loaded Issues or Pull requests with Focus |
+| `d` | On Actions, inspect the selected run and jobs (standalone only) |
+| `a` | Open personal attention for a verified human user (standalone only) |
+| `J` | In Focus, a loaded CI log or attention, request optional Jev interpretation; requires `--jev`, an API key and scoped consent |
+| `m` | In semantic Focus, evaluate more loaded candidates; in attention, request the next GitHub detail batch |
+| `l` / `e` | In CI details, load the selected failed/timed-out job log / edit its excerpt range |
+| `x` | Revoke the current scope's Jev permission and clear its semantic results; in CI, also clear the active log and excerpt |
 | `w` | Adjust table column widths |
 | `?` | Open or close contextual help; `n` / `p` moves through its pages |
-| `q` / `Esc` / `Ctrl+C` | Quit (`Esc` leaves width mode) |
+| `q` / `Esc` / `Ctrl+C` | Quit from ordinary navigation; `Esc` leaves feature views, editors and width mode. While editing a query or range, `q` is text and `Ctrl+C` quits. |
 
 ### Adjusting column widths
 
@@ -364,6 +397,8 @@ pane definition. Flags are there when you want them:
 | `--refresh <seconds>` | Minimum automatic poll interval, 2-3600, default 5. A floor, never a ceiling: a tab whose content is unchanged twice in a row slows to 30 seconds (60 for Security), and Actions with a running or queued job is checked every 5. Safe shared grants can make any check later. |
 | `--tab <name>` | Start on `actions`, `issues`, `prs` or `security`. |
 | `--background <mode>` | `on-demand` (default): active Actions updates automatically; Issues, PRs and Security use cached data and check when opened or refreshed with `r`. Unopened tabs make no data requests. `all` continuously polls active and inactive tabs; `off` continuously polls only the selected tab. |
+| `--jev` | Enable optional semantic Focus, CI observations and attention badges in an interactive standalone dashboard. Requires `TYPESAFE_API_KEY` and explicit scoped consent; startup and ordinary refresh send no model requests. |
+| `--jev-max-requests <n>` | Set the per-process model-call cap, 1-10000 (default 100); requires `--jev`. |
 | `--verbose` | Log one line per dashboard `gh` call to stderr, with timing and outcome. Credential lookup and the account-identity proof are deliberately excluded, so that they cannot log anything derived from a token. stderr must be redirected: `gh-glance --verbose 2>gh-glance.log`. |
 | `--doctor` | Print a diagnostic report and exit. See [Diagnostics](#diagnostics). |
 | `--doctor --probe` | Add bounded, admitted GitHub capability probes to the local diagnostic report. |
@@ -590,6 +625,7 @@ Environment variables work too, and the flags take precedence:
 
 | Variable | Effect |
 |---|---|
+| `TYPESAFE_API_KEY` | TypeSafe credential used only with `--jev` and explicit scoped consent. Removed from child-process environments; never saved in dashboard or collector state. |
 | `GH_REPO=[host/]owner/name` | Watch a specific repository instead of the current directory's. A qualified value supplies the host; an unqualified value means `github.com`. An explicit `--repo` wins. |
 | `GH_HOST=<host>` | When no explicit `--repo` overrides it, send every call and the account governor to a GitHub Enterprise or EMU host instead of `github.com`. |
 | `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN`, `GITHUB_ENTERPRISE_TOKEN` | Used by the default `gh` provider with `gh`'s host-specific precedence. gh-glance never logs or stores the raw values. One-way credential digests keep private rows access-partitioned; credentials GitHub verifies as the same principal share its quota ledger. App-provider children remove these variables before setting their memory-only installation token. |
@@ -765,11 +801,14 @@ and the lock path separately. A readable metadata file does not make an aged
 orphan lock or invalid snapshot healthy; plain doctor never repairs either.
 When one cached identity names the selected host, plain doctor also reads its
 quota ledger without changing it or contacting GitHub. It reports receipt and
-debt totals, observer age, the current recovery cause, and an actual retry time
-when one is known. If several cached identities match, it says the scope is
-unavailable instead of choosing an account. For a corrupt or unreadable quota
+debt totals, debt-group occupancy (`debt groups`), observer age, the current
+recovery cause, and an actual retry time when one is known. If several cached
+identities match, it says the scope is unavailable instead of choosing an
+account. For a corrupt or unreadable quota
 file, it names the coordination directory and a `quota-[redacted].json` file
-pattern with the cause. The private quota fingerprint stays out of reports.
+pattern with the cause. For a hard coordination failure it also prints a
+`repair` line with the manual steps. The private quota fingerprint stays out of
+reports.
 
 Use `gh-glance --doctor --probe` when live capability evidence is needed. Probe
 mode uses an ephemeral governor lease and admits every quota-consuming endpoint
@@ -1123,7 +1162,8 @@ GH_GLANCE_ICONS=ascii gh-glance
 | `Upgrade waiting for legacy quota reset` | The older panes are gone, but left spend that cannot be proven settled. It waits for the affected rate-limit window to reset rather than assume the quota is free. This one has a deadline and clears itself. |
 | `Upgrade blocked: older spend cannot be settled or waited out` | Older spend has no reliable reset or child evidence. Verify old children ended and use `gh-glance --doctor` to inspect reserved units. An unidentifiable old child may require a verified system restart before a later observer can retire its charge. Keep the quota files as accounting evidence. |
 | `Coordination state unavailable; evidence preserved` | Coordination state could not be read and was deliberately not overwritten, so nothing is lost. Run `gh-glance --doctor` and check the config directory's permissions. |
-| `Local coordination` corruption, overflow, full storage, or unsafe permissions | Run `gh-glance --doctor`; its read-only report gives the exact cause and redacted local file location when known. Repair storage or permissions, then let the app retry. Preserve corrupt and overflow evidence for diagnosis. |
+| `Local coordination journal is full` | Every slot for unsettled or recently settled requests is in use. The app retries by itself, and older requests settle after about an hour. Nothing needs repair. `gh-glance --doctor` shows the occupancy as `debt groups`. |
+| `Local coordination` corruption, overflow, full storage, or unsafe permissions | Run `gh-glance --doctor`; its read-only report gives the exact cause and redacted local file location when known. For a hard failure it also prints a `repair` line: quit every pane, move the state file, its `.recovery.json` and `registry.json` aside, then relaunch. Otherwise repair storage or permissions and let the app retry. Preserve corrupt and overflow evidence for diagnosis. |
 | `Saving request result` or `Recovering interrupted request` | The original request may have consumed quota. The app keeps its charge, retries settlement without repeating HTTP, and waits for safe observer evidence before retiring uncertain debt. |
 | `GitHub request limit` | A shared secondary hold preserves GitHub's retry deadline. Wait for the shown time; if the repeated-limit circuit explicitly asks, press `r` once to retry. Repeated refresh cannot bypass a hold. |
 | `Collector connection unavailable` or `GitHub App authorization unavailable` | Restore the selected collector connection or App authorization. The mode does not switch to independent requests. Cached rows remain labeled with their source age. |
@@ -1143,3 +1183,90 @@ See [SECURITY.md](./SECURITY.md).
 ## License
 
 [MIT](./LICENSE)
+
+### Focus loaded work
+
+On Issues or Pull requests, press `/`, type a query, and press Enter. Focus searches loaded titles, available labels and PR branches locally. Exact filters are `#123`, `author:alice`, `branch:fix/session` (case sensitive), and `updated:>=2026-10-01`. Filters and topic words are combined. Prefixes and a single edit in words of five or more characters can match; no additional GitHub request is made. Counts and source age describe only loaded metadata. Press `/` to edit, Escape to cancel an edit or return to the ordinary list, and Enter on a selected result to open GitHub. While editing, `q` is text; Ctrl-C quits.
+
+For optional semantic Focus, set `TYPESAFE_API_KEY` in your shell and start `gh-glance --jev` in an interactive standalone terminal. A key alone enables nothing. Press `J` on submitted Focus results, review the exact repository/access scope and metadata disclosure, then Enter to send or Escape to cancel. TypeSafe receives the topic, titles, available labels and PR branches; separate repository/account identity, author, body and URL fields are omitted. Query and metadata text remain literal supplied text. Public metadata also needs permission. `x` revokes that scope's permission, cancels work and clears its results. Permission and normalized results remain in memory for this session only.
+
+Semantic Focus uses pinned `jev-1.14.0`, a four-second action deadline and at most 60 uncached eligible rows per explicit action. Exact filters still run locally, and all filter-eligible rows can be considered, including synonyms absent from local results. `m` evaluates the next loaded candidates. Coverage distinguishes matches, uncertain answers and unevaluated rows; all remain inspectable and Escape returns to the ordinary list. Filter-only queries send nothing. No automatic model requests or retries occur on startup, typing, polling or refresh. The session defaults to 100 dispatched calls; `--jev-max-requests 1..10000` changes that per-process cap. Errors, cooldowns and exhaustion retain local Focus and show the next explicit action. No account retention guarantee is implied. The live provider contract and semantic accuracy are not yet qualified.
+
+### Selected CI evidence
+
+On Actions, select a run and press `d` to inspect its exact run ID, attempt,
+head SHA, jobs and step facts. Failed and timed-out jobs appear first. Up/Down
+selects a job; `l` explicitly captures a selected failed/timed-out job's plaintext
+log, and Enter opens
+that exact job on GitHub. Escape returns to ordinary Actions. This view is
+standalone only; connected collectors offer the selected run's browser link.
+Nothing is acquired for this feature during ordinary polling or idle time.
+
+The view loads one page of at most 100 jobs and 100 steps per job, and displays
+loaded/total coverage. Metadata has a 2 MiB aggregate bound and 45-second total
+deadline. A selected log has a 1 MiB cumulative bound and 20-second total
+deadline: one admitted GitHub API GET and at most one credential-free HTTPS
+storage GET, with no automatic retries or pagination. Actions read permission
+is required. Unsupported proxies or storage redirects offer Open GitHub.
+Step metadata does not imply a step-to-log-line association. Log text stays in
+session memory and never enters dashboard/collector caches.
+
+This version upgrades the shared quota protocol from 7 to 8 at the same ledger
+path. **Restart all gh-glance panes with this version; keep the shared quota
+ledger. Never clear, delete, downgrade or replace it to resolve a version
+mismatch.** Live old leases hold the upgrade until they close or expire. The
+upgrade saves an exact private `.pre-v8.backup` before its first write. A
+conflicting backup names its path in recovery help/doctor: preserve it under an
+unused archival filename before retrying. Storage failures refuse new admission.
+A future protocol requires updating and restarting every pane.
+
+An unverified native connection closure retains its quota charge and displays
+the computed uncertainty-window deadline. Restarting a pane does not refund that
+charge. The ledger's existing verified closure/boot/window recovery rules apply;
+Open GitHub remains available while waiting.
+
+### Optional CI log observations
+
+With `--jev` and `TYPESAFE_API_KEY`, press `J` after explicitly loading a selected failed/timed-out job log. Every send opens a TypeSafe preview of the exact sanitized state, even when this session already has permission or the answer is cached. PgUp/PgDn reviews the complete preview; Enter sends and Escape cancels without sending. Separate repository/account/run identity fields and step names stay local. Log text can still contain private or identifying content; redaction does not guarantee that it is secret-free.
+
+Known credentials, authorization/cookie headers, private-key blocks and signed links are redacted locally and block cloud submission for the selected range. Press `e`, type an existing `start-end` line range, one line number, or `all`, and Enter to apply it. A clean smaller range can reach a new preview. While editing, `q` is text and Ctrl-C quits. Excerpts retain original line numbers, contain at most 40 spans/8 KiB, and disclose omitted or truncated lines. Source log capture and GitHub facts remain independent of inference.
+
+The six independent observations are assertion mismatch, dependency-download failure, explicit permission denial, reported execution timeout, explicit memory exhaustion, and concrete static-check diagnostics. A positive observation must point to an existing span in this exact run/attempt/SHA/job/excerpt. These are reported log observations rather than proven root causes or generated fixes. “No listed observation found” applies only to this excerpt; uncertain or missing evidence does not mean healthy CI. GitHub's conclusion is always retained. Results are invalidated by source, account, job, log or range changes and expire after ten minutes.
+
+`x` revokes this scope's Jev permission, cancels work and clears the active log/excerpt/results; press `l` to load a log again. Requests use the shared four-second deadline, call cap and bounded memory-only cache. Typing, refreshing, polling and opening a view never send model requests. Errors retain local evidence and show an explicit review/retry or smaller-range action. The live Jev contract, semantic accuracy and developer benefit remain unverified or unmeasured.
+
+### Personal attention
+
+Press `a` in standalone mode to inspect direct review requests, assignments and
+viewer-authored PRs among the currently loaded Issues and PRs. The account must
+be a verified human GitHub user. Cached identities without a human proof offer
+`r` to verify `/user` explicitly; connected views and GitHub App installations
+explain how to use standalone user authentication.
+
+Opening requests at most 25 details. `m` explicitly requests the next 25, up to
+300 frozen candidates; it never drains the list automatically. `r` refreshes the
+first source page for Issues and PRs, rebuilds the manifest, and requests one
+batch. Empty/unloaded lists require that explicit action. Source coverage/age
+and each detail batch's age remain separate. Details expire after five minutes;
+changed source metadata or account scope requires an explicit refresh/restart.
+Errors retain prior same-scope facts as partial/as-of and show retry controls.
+
+The fixed order is direct personal review requests, assigned Issues, changes
+requested on your non-draft PRs, assigned PRs, then other authored PRs under
+Following. Draft badges and all exact reasons remain visible. Within a tier,
+items use their update time, oldest first; this is not request age or an overdue
+claim. `u` inspects unknown/unqueried relationships. Truncated nested lists cannot
+prove absence; team review requests do not establish personal membership.
+PgUp/PgDn scroll disclosures, arrows select, Enter opens the original Issue/PR
+URL, and Escape returns to ordinary navigation.
+
+With `--jev`, `J` optionally annotates current unchanged attention metadata with
+“Reports regression” and “Describes user impact.” Review the TypeSafe destination,
+exact repository/access scope and title/label/branch disclosure, then Enter Send
+or Escape Cancel. Badges cannot change queue membership, reasons, tier, order or
+navigation. Each explicit `J` covers at most 60 eligible rows, using at most 15
+rows per HTTP request and complete badge pairs packed within 24 KiB. Repeated
+`J` advances remaining rows; `m` remains GitHub detail pagination. `x` revokes
+permission and clears badges while retaining exact facts. The shared deadline,
+call cap, cooldown and memory limits apply. The live provider contract, badge
+accuracy and developer benefit remain unverified or unmeasured.