gitroots 0.5.0 → 0.6.0

package/README.md

@@ -1,6 +1,22 @@
 # gitroots CLI
 
-Code governance and agent sessions in the terminal. Built from the **gitroots CLI Terminal** design canvas. Each artboard maps to one command, using the same colors, symbols and layout.
+gitroots in your terminal, as a session like Claude Code. Run `gitroots` and you get a welcome box with the gitroots mark and what needs you right now. Type `/` to pick a command from the list, use ↑↓ and Enter, and everything works on your real workspace.
+
+```
+╭──────────────────────────────────────────────────────────────╮
+│ ██ ██ ██ ██   gitroots v0.6.0                                │
+│ ██ ██ ██ ██   code governance and agent sessions             │
+│ ██ ██ ██ ██   Shawki Aladdin · Acme ERP (owner) · gitroots.com│
+│ ██ ██ ██ ██   ~/work/erp · acme/erp @ main                   │
+╰──────────────────────────────────────────────────────────────╯
+  ◐ 1 approval waiting  ·  ◐ 1 agent needs you   → /approvals
+
+╭──────────────────────────────────────────────────────────────╮
+│ > /ap                                                        │
+╰──────────────────────────────────────────────────────────────╯
+ ❯ /approvals      Review merge and access requests · approve or decline
+   /attach         Open one session live · approve, message, stop, resume
+```
 
 ## Install
 
@@ -36,85 +52,69 @@ From a checkout: `npm link`.
 
 ## Releasing
 
-```bash
-npm test
-node scripts/build.mjs            # all platforms → dist/
-```
-`dist/` is the whole release. Upload it as-is to the download location: `https://gitroots.com/cli` by default, or any static host/bucket. To use another host, set `GITROOTS_DOWNLOAD_BASE` at build time (it goes into the Homebrew formula) and in `src/runtime.js` (`DOWNLOAD_BASE`, used by `update` and `doctor`).
-```
-dist/install.sh  dist/install.ps1  dist/latest
-dist/0.5.0/gitroots-0.5.0-{darwin-arm64,darwin-x64,linux-x64,linux-arm64}.tar.gz
-dist/0.5.0/gitroots-0.5.0-win32-x64.zip
-dist/0.5.0/gitroots-0.5.0.tgz  dist/0.5.0/SHA256SUMS  dist/0.5.0/manifest.json
-dist/Formula/gitroots.rb
-```
-- The binaries are Node 22 LTS single-executable apps, about 35–42 MB compressed. macOS builds are ad-hoc signed. For Gatekeeper-friendly distribution outside the curl installer, sign and notarize them with your Developer ID.
-- For npm, run `npm publish` from this folder (the name `gitroots` was free on npm when this was written).
-- For a new version, bump `version` in `package.json` and `VERSION` in `src/runtime.js`. The build refuses to run if they differ.
+1. Bump `version` in `package.json` and `VERSION` in `src/runtime.js`. The build refuses to run if they differ.
+2. Build and publish:
+   ```bash
+   npm test
+   npm run build      # binaries for all platforms, installers, checksums → dist/
+   npm run deploy     # uploads to the gitroots-cli Railway service; https://gitroots.com/cli serves it
+   npm publish        # npm asks you to approve with your passkey in the browser
+   ```
+
+How it's hosted:
+- https://gitroots.com/cli is the install page, in the Django app on `railway-main` (`apps/core/cli_downloads.py`, `templates/landing/cli.html`).
+- Every file under `/cli/` redirects to the `gitroots-cli` service in the GITROOTS Railway project (production). Its server is in `deploy/downloads/`. The redirect target can be changed with `GITROOTS_CLI_DOWNLOADS_URL`.
+- Railway caps uploads at a few hundred MB, so `npm run deploy` uploads only the current release's binaries. Older versions stay installable from npm with `npm install -g gitroots@<version>`.
+
+Notes:
+- The binaries are Node 22 LTS single-executable apps, about 35–42 MB compressed each. macOS builds are ad-hoc signed. Sign and notarize them with a Developer ID if you distribute outside the curl installer.
+- The Homebrew formula is written to `dist/Formula/gitroots.rb`. Publish it in a tap repo to enable `brew install`.
 
 ## Commands
 
-| Design screen | Command |
+Inside the session, type `/` to see and pick them. Outside it, each one also runs on its own (`gitroots status`, `gitroots repos --json`) for scripts and CI.
+
+| | |
 |---|---|
-| Welcome and boot | `gitroots` |
-| Status | `gitroots status` |
-| Repo · branch · clone | `gitroots repo list` · `branch list <repo> [--all]` · `branch rules <repo> <branch>` · `branch restore <repo> <branch>` · `clone <repo\|url> [--url <git-url>]` |
-| git push · gitroots checks | `gitroots hooks install` then a normal `git push` · `gitroots check` (dry run) |
-| PR list · view | `gitroots pr list [repo]` · `pr view <n>` · `pr diff <n>` |
-| PR create | `gitroots pr create [--base staging] [--head branch] [--title "…"] [--draft]` |
-| PR approve · merge | `gitroots pr approve <n> -m "…"` · `pr review <n> --request-changes -m "…"` · `pr merge <n> [--yes]` |
-| Audit · follow | `gitroots audit [--repo --since 2h --actor --action --decision --pr --csv]` · `audit <ev-id>` · `audit follow` |
-| Watch (live dashboard) | `gitroots watch [--machine m --agent codex --repo erp --state running]` (full screen) · `gitroots sessions` (plain list) |
-| Attach | `gitroots attach <session>` · `attach <session> --shell` (prefix `ctrl-g`: d detach · b backup · t transfer · f fork · s share · h history) |
-| Transfer | `gitroots transfer <session> --to <machine>` |
-| Backup · backups | `gitroots backup <session> --label "…"` · `backups [--repo --session --all]` · `backup policy` · `backup policy set --every 10m --store s3://bucket` |
-| Restore | `gitroots restore <session> --pick` · `restore <b-id>` · `--point <turn\|b-id>` · `--machine <m>` · `--fork` |
-| Tunnel · share | `gitroots tunnel <session> --port 8069` · `tunnel ls` · `tunnel close <t-id>\|--all` · `share <session> --read-only --expires 1h` |
-| (account) | `gitroots login [--server URL] [--org slug]` · `whoami` · `logout` |
-| (setup) | `gitroots doctor` · `update` · `uninstall [--purge]` · `completion bash\|zsh\|fish` |
-
-`gitroots help <command>` shows the details for one command.
-
-## Terminal design rules (from the canvas)
-
-- Every state pairs a symbol with a word: `● running`, `◐ waiting`, `○ queued`, `✓ done`, `✕ blocked`.
-- Green is used only for success and the one next action. Amber means it needs you. Red means a real block or failure.
-- Every screen ends with the next command (`→ gitroots pr view 412`).
-- `--json` works on every command. Colors drop when output is piped or `NO_COLOR` is set.
-- Motion (spinners, progress bars, live rows) stops when output is piped, with `NO_COLOR`, in `CI`, or when `GITROOTS_REDUCED_MOTION=1`.
-- The welcome screen shows the real logo image (`assets/logo.png`) in Kitty, Ghostty, WezTerm and iTerm2. Other terminals, tmux and screen get a plain `gitroots` line. Set `GITROOTS_NO_IMAGES=1` to turn the image off.
-
-## What is real and what is sample data
-
-- **Push checks (real):** `gitroots hooks install` writes a `pre-push` hook. An existing hook is kept and run first with `--force`. On every `git push` the hook checks your actual commits:
-  - the branch rule
-  - protected paths
-  - a secrets scan of added lines (AWS, GitHub, GitLab, Slack, Stripe, Google, Anthropic and OpenAI keys, private keys, hard-coded passwords)
-  - commit authors and signatures
-  - migration files
-
-  A blocked push exits non-zero, so nothing leaves the machine. If gitroots itself can't be found, the hook blocks the push rather than skipping the checks.
-- **Rules:** rules come from the gitroots org. For any other repo, put a `.gitroots.json` at its root:
+| `/status` | What needs you, workspace posture, agents |
+| `/approvals` | Merge and access requests: pick one, then approve, request changes or decline |
+| `/repos` · `/repo [name]` | Repositories, their branch rules, environments and people |
+| `/pushes [--blocked]` | Recent pushes and the ones gitroots blocked |
+| `/audit [blocked\|merges\|access] [search]` | Who did what, when |
+| `/activity` · `/members` | Team activity, people and roles |
+| `/agents` | Agent sessions on your machines (as the gitroots app reports them) and on this computer (Claude Code, Codex): approve, deny, message, stop, or resume a local one |
+| `/watch` · `/attach` | Full-screen live view of agent sessions (`y` approve, `n` deny, `m` message, `s` stop, `r` resume) |
+| `/machines` | Machines the gitroots app manages |
+| `/hooks [install]` · `/check` | Push checks for the repository you're in |
+| `/login` · `/logout` · `/whoami` · `/workspace` | Account and workspace |
+| `/doctor` · `/update` · `/help` · `/clear` · `/exit` | |
+
+Keys: `/` opens the list (type to filter, ↑↓ choose, Tab completes, Enter runs) · ↑↓ history · Esc clears · ctrl-c cancels a running command, twice to exit.
+
+## Where the data comes from
+
+All of it is real: nothing is sample data.
+
+- **Sign-in:** `/login` shows a code and opens gitroots.com/cli/auth. Approve it there while you're signed in, and the CLI receives your API token, which it keeps in the macOS Keychain (or `~/.gitroots/credentials.json`, mode 600). It works for GitHub-login accounts too.
+- **Workspace:** status, approvals, repositories, branch rules, pushes, audit, activity and members come from the gitroots API (`/api/mobile/gov/…`), the same endpoints the mobile app uses.
+- **Agents:**
+  - Your machines: from what the gitroots app reports (`/api/cli/agents`). Approve, deny, message and stop are queued through gitroots, and the app on that machine runs them.
+  - This computer: read from Claude Code (`~/.claude/projects`) and Codex (`~/.codex/sessions`) session files. "Resume here" runs `claude --resume <id>` or `codex resume <id>` in the session's folder, and you come back to gitroots when it exits.
+- **Push checks:** `gitroots hooks install` adds a `pre-push` hook. It uses your workspace's branch rules for the GitHub repo you push to: no direct push, leads only, required approvals. The rules are cached so the hook works offline. Repos outside gitroots can use a `.gitroots.json`:
   ```json
   { "protected": ["main", "release/*"], "paths": [{ "pattern": "infra/**", "needs": "an ops review" }] }
   ```
-- **Signed in (real):** `gitroots login` signs in to your gitroots server (gitroots_core) with its Basic auth. The password is stored in the macOS Keychain, or in `~/.gitroots/credentials.json` (mode 600) elsewhere. After that, these use the real API:
-  - `whoami` and the `status` header
-  - `repo list` and `branch list` (GitHub repos synced in the dashboard)
-  - `audit`, `audit <ev-id>` and `audit follow` (which polls the API)
-  - the welcome screen's sign-in and repository checks
-- **Sample data:** PRs, agent sessions, machines, backups and tunnels aren't in the gitroots API yet. They run on the design's sample org, and screens say so when you're signed in. Your changes to them are saved in `~/.gitroots/state.json`, so commands build on each other. `gitroots demo reset` starts over. When the API grows those endpoints, add them in `src/connected.js` the same way repos and audit work.
-- **Shells:** `attach --shell` opens a real shell for sessions on this machine. A remote shell would need an agentd on that machine, which doesn't exist yet.
+  Every push also gets a secrets scan, an author check and migration flags. A blocked push never leaves the machine.
 
 ## Environment
 
 | Variable | Effect |
 |---|---|
 | `GITROOTS_HOME` | where state, config and credentials live (default `~/.gitroots`) |
-| `GITROOTS_SERVER` | default server for `gitroots login` (default `https://gitroots.com`) |
+| `GITROOTS_SERVER` | gitroots server (default `https://gitroots.com`) |
+| `GITROOTS_TOKEN` | use this API token instead of the stored sign-in (CI) |
 | `GITROOTS_DOWNLOAD_BASE` | where `update` and the installers fetch releases |
 | `GITROOTS_NO_KEYCHAIN` | store the password in credentials.json even on macOS |
-| `GITROOTS_RELAY_DOMAIN` | domain used for tunnel and share links (default `<relay>.relay.gitroots.com`) |
 | `NO_COLOR` / `FORCE_COLOR` | turn colors off or force them on |
 | `GITROOTS_REDUCED_MOTION` | no spinners or animation |
 | `GITROOTS_NO_IMAGES` | no inline logo image |
@@ -124,15 +124,15 @@ dist/Formula/gitroots.rb
 
 ```
 bin/gitroots.js        entry
-src/cli.js             argument parsing, dispatch, help
-src/runtime.js         version, npm vs standalone binary, install paths
-src/api.js             gitroots API client, credentials
-src/connected.js       real data when signed in
-src/installer.js       download, verify, install (gitroots update)
-scripts/               build.mjs (release), install.sh, install.ps1
-src/ui/                colors (design tokens), steps/spinners/prompts, full-screen helpers, inline images
-src/commands/          one file per design screen
-src/git/checks.js      the real push checks
-src/data/              sample org, persisted store, live activity streams
-test/                  node --test (includes a real git push against a scratch repo)
+src/cli.js             one-shot commands and plumbing (hook, completion, uninstall)
+src/session/           the session: repl.js (input, / menu, history), logo.js, registry.js (every command),
+                       workspace.js, agents.js (incl. /watch and /attach), account.js, setup.js
+src/api.js             gitroots API client (token auth)
+src/config.js          settings, Keychain/credentials, caches
+src/agents/local.js    Claude Code and Codex sessions on this computer
+src/rules.js           branch rules for the push hook
+src/commands/push.js   the pre-push hook and checks · update.js · completion.js
+src/git/checks.js      secrets scan, authors, migrations
+scripts/               build.mjs (release), deploy.sh, install.sh, install.ps1
+test/                  node --test (includes a mock gitroots API and real git pushes)
 ```

package/bin/gitroots.js

@@ -1,6 +1,14 @@
 #!/usr/bin/env node
 import { main } from '../src/cli.js';
 
+// `gitroots status | head` closes the pipe early: stop quietly instead of crashing.
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on('error', (err) => {
+    if (err && err.code === 'EPIPE') process.exit(0);
+    throw err;
+  });
+}
+
 main(process.argv.slice(2)).then(
   (code) => { process.exitCode = code ?? 0; },
   (err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitroots",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "gitroots CLI: code governance and agent sessions.",
   "type": "module",
   "bin": {
@@ -16,6 +16,7 @@
     "test": "node --test test/",
     "build": "node scripts/build.mjs",
     "build:npm": "node scripts/build.mjs --no-binaries",
+    "deploy": "bash scripts/deploy.sh",
     "prepublishOnly": "node --test test/"
   },
   "keywords": [

package/src/agents/local.js

@@ -0,0 +1,219 @@
+// Agent sessions on this machine, read from the agents' own session files.
+//   Claude Code   ~/.claude/projects/<folder>/<session-id>.jsonl     resume: claude --resume <id>
+//   Codex         ~/.codex/sessions/YYYY/MM/DD/rollout-…-<id>.jsonl  resume: codex resume <id>
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const TAIL = 192 * 1024;
+const LIVE_MS = 2 * 60 * 1000;
+const RECENT_MS = 14 * 24 * 3600 * 1000;
+
+function readSlice(file, start, length) {
+  const fd = fs.openSync(file, 'r');
+  try {
+    const buf = Buffer.alloc(length);
+    const n = fs.readSync(fd, buf, 0, length, start);
+    return buf.subarray(0, n).toString('utf8');
+  } finally { fs.closeSync(fd); }
+}
+
+// Walk the start of a file line by line, 128 KB at a time, until visit() returns true (max 2 MB).
+function scanHead(file, size, visit) {
+  const CHUNK = 128 * 1024;
+  let pos = 0;
+  let carry = '';
+  while (pos < Math.min(size, 2 * 1024 * 1024)) {
+    const text = carry + readSlice(file, pos, CHUNK);
+    pos += CHUNK;
+    const lines = text.split('\n');
+    carry = pos < size ? lines.pop() : '';
+    for (const l of lines) {
+      if (!l.trim()) continue;
+      let d;
+      try { d = JSON.parse(l); } catch { continue; }
+      if (visit(d)) return;
+    }
+  }
+}
+
+function jsonLines(text, dropFirst) {
+  const lines = text.split('\n');
+  if (dropFirst) lines.shift();
+  const out = [];
+  for (const l of lines) { if (!l.trim()) continue; try { out.push(JSON.parse(l)); } catch { /* partial line */ } }
+  return out;
+}
+
+function textOf(content) {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content.map((c) => (c && (c.type === 'text' || c.type === 'input_text' || c.type === 'output_text') ? c.text : '')).filter(Boolean).join(' ');
+}
+
+const clean = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+const isNoise = (t) => !t || t.startsWith('<') || t.startsWith('Caveat:') || /^\[Request interrupted/.test(t);
+
+function state(mtime) {
+  const age = Date.now() - mtime;
+  return age < LIVE_MS ? 'live' : 'idle';
+}
+
+// ---------------------------------------------------------------- Claude Code
+
+function claudeSession(file, st) {
+  const size = st.size;
+  const tail = jsonLines(readSlice(file, Math.max(0, size - TAIL), Math.min(size, TAIL)), size > TAIL);
+  let title = '';
+  let cwd = '';
+  let branch = '';
+  let id = path.basename(file, '.jsonl');
+  scanHead(file, size, (d) => {
+    if (d.cwd && !cwd) cwd = d.cwd;
+    if (d.sessionId) id = d.sessionId;
+    if (d.type === 'summary' && d.summary && !title) title = d.summary;
+    if (!title && d.type === 'user' && d.message && d.message.role === 'user') {
+      const t = clean(textOf(d.message.content));
+      if (!isNoise(t)) title = t;
+    }
+    return Boolean(title && cwd);
+  });
+  const log = [];
+  let lastUser = '';
+  for (const d of tail) {
+    if (d.cwd) cwd = d.cwd;
+    if (d.gitBranch) branch = d.gitBranch;
+    const m = d.message;
+    if (!m) continue;
+    if (d.type === 'user' && m.role === 'user') {
+      const t = clean(textOf(m.content));
+      if (!isNoise(t)) { lastUser = t; log.push({ who: 'you', text: t, at: d.timestamp }); }
+    } else if (d.type === 'assistant' && Array.isArray(m.content)) {
+      for (const c of m.content) {
+        if (c.type === 'text' && clean(c.text)) log.push({ who: 'agent', text: clean(c.text), at: d.timestamp });
+        if (c.type === 'tool_use') log.push({ who: 'tool', text: `${c.name}${c.input && (c.input.command || c.input.file_path || c.input.pattern) ? ` ${clean(c.input.command || c.input.file_path || c.input.pattern)}` : ''}`, at: d.timestamp });
+      }
+    }
+  }
+  if (!cwd) return null;
+  return {
+    source: 'local', agent: 'claude', agentName: 'Claude Code', id, file, cwd, branch: branch === 'HEAD' ? '' : branch,
+    title: title || lastUser || '(no prompt yet)', lastPrompt: lastUser, mtime: st.mtimeMs, status: state(st.mtimeMs),
+    log: log.slice(-60), resume: { cmd: 'claude', args: ['--resume', id] },
+  };
+}
+
+function findClaude(root) {
+  const out = [];
+  let dirs = [];
+  try { dirs = fs.readdirSync(root); } catch { return out; }
+  for (const d of dirs) {
+    let files = [];
+    try { files = fs.readdirSync(path.join(root, d)); } catch { continue; }
+    for (const f of files) {
+      if (!f.endsWith('.jsonl')) continue;
+      const p = path.join(root, d, f);
+      try { const st = fs.statSync(p); if (Date.now() - st.mtimeMs < RECENT_MS && st.size > 0) out.push([p, st]); } catch { /* gone */ }
+    }
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------- Codex
+
+function codexSession(file, st) {
+  const size = st.size;
+  const tail = jsonLines(readSlice(file, Math.max(0, size - TAIL), Math.min(size, TAIL)), size > TAIL);
+  let id = (/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/.exec(file) || [])[1] || path.basename(file);
+  let cwd = '';
+  let title = '';
+  let branch = '';
+  scanHead(file, size, (d) => {
+    const p = d.payload || {};
+    if (d.type === 'session_meta') { id = p.id || id; cwd = p.cwd || cwd; if (p.git && p.git.branch) branch = p.git.branch; }
+    if (!title && d.type === 'response_item' && p.type === 'message' && p.role === 'user') {
+      const t = clean(textOf(p.content));
+      if (!isNoise(t)) title = t;
+    }
+    return Boolean(title && cwd);
+  });
+  const log = [];
+  let lastUser = '';
+  for (const d of tail) {
+    const p = d.payload || {};
+    if (d.type === 'turn_context' && p.cwd) cwd = p.cwd;
+    if (d.type !== 'response_item') continue;
+    if (p.type === 'message' && (p.role === 'user' || p.role === 'assistant')) {
+      const t = clean(textOf(p.content));
+      if (isNoise(t)) continue;
+      if (p.role === 'user') lastUser = t;
+      log.push({ who: p.role === 'user' ? 'you' : 'agent', text: t, at: d.timestamp });
+    } else if (p.type === 'function_call' || p.type === 'local_shell_call' || p.type === 'custom_tool_call') {
+      let args = '';
+      try { const a = JSON.parse(p.arguments || '{}'); args = Array.isArray(a.command) ? a.command.join(' ') : a.command || a.cmd || ''; } catch { args = ''; }
+      log.push({ who: 'tool', text: `${p.name || 'shell'}${args ? ` ${clean(args)}` : ''}`, at: d.timestamp });
+    }
+  }
+  if (!cwd) return null;
+  return {
+    source: 'local', agent: 'codex', agentName: 'Codex', id, file, cwd, branch,
+    title: title || lastUser || '(no prompt yet)', lastPrompt: lastUser, mtime: st.mtimeMs, status: state(st.mtimeMs),
+    log: log.slice(-60), resume: { cmd: 'codex', args: ['resume', id] },
+  };
+}
+
+function findCodex(root) {
+  const out = [];
+  const walk = (dir, depth) => {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory() && depth < 3) walk(p, depth + 1);
+      else if (e.isFile() && e.name.endsWith('.jsonl')) {
+        try { const st = fs.statSync(p); if (Date.now() - st.mtimeMs < RECENT_MS && st.size > 0) out.push([p, st]); } catch { /* gone */ }
+      }
+    }
+  };
+  walk(root, 0);
+  return out;
+}
+
+// ---------------------------------------------------------------- public
+
+export function localSessions({ limit = 40, homeDir = os.homedir() } = {}) {
+  const claudeRoot = process.env.CLAUDE_CONFIG_DIR ? path.join(process.env.CLAUDE_CONFIG_DIR, 'projects') : path.join(homeDir, '.claude', 'projects');
+  const codexRoot = path.join(process.env.CODEX_HOME || path.join(homeDir, '.codex'), 'sessions');
+  const files = [
+    ...findClaude(claudeRoot).map(([p, st]) => ['claude', p, st]),
+    ...findCodex(codexRoot).map(([p, st]) => ['codex', p, st]),
+  ].sort((a, b) => b[2].mtimeMs - a[2].mtimeMs).slice(0, limit);
+  const out = [];
+  for (const [kind, p, st] of files) {
+    try {
+      const s = kind === 'claude' ? claudeSession(p, st) : codexSession(p, st);
+      if (s) out.push(s);
+    } catch { /* unreadable */ }
+  }
+  return out;
+}
+
+export function refreshLocal(s) {
+  try {
+    const st = fs.statSync(s.file);
+    return s.agent === 'claude' ? claudeSession(s.file, st) : codexSession(s.file, st);
+  } catch { return s; }
+}
+
+export function shortPath(p) {
+  const h = os.homedir();
+  return p && p.startsWith(h) ? `~${p.slice(h.length)}` : p || '';
+}
+
+export function ago(ms) {
+  const s = Math.max(0, Math.round((Date.now() - ms) / 1000));
+  if (s < 60) return `${s}s ago`;
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+}

package/src/api.js

@@ -1,121 +1,84 @@
-// gitroots API client (gitroots_core, Django REST framework).
-// Sign-in uses the API's Basic auth; the password is kept in the macOS Keychain,
-// or in $GITROOTS_HOME/credentials.json (mode 600) elsewhere.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { home } from './data/store.js';
-
-export const DEFAULT_SERVER = process.env.GITROOTS_SERVER || 'https://gitroots.com';
-
-const configFile = () => path.join(home(), 'config.json');
-const credFile = () => path.join(home(), 'credentials.json');
-
-export function readConfig() {
-  try { return JSON.parse(fs.readFileSync(configFile(), 'utf8')); } catch { return {}; }
-}
-
-export function writeConfig(cfg) {
-  fs.mkdirSync(home(), { recursive: true });
-  fs.writeFileSync(configFile(), JSON.stringify(cfg, null, 2), { mode: 0o600 });
-}
-
-const service = (server) => `gitroots:${server}`;
-const useKeychain = () => process.platform === 'darwin' && !process.env.GITROOTS_NO_KEYCHAIN;
-
-export function savePassword(server, username, password) {
-  if (useKeychain()) {
-    const r = spawnSync('security', ['add-generic-password', '-U', '-a', username, '-s', service(server), '-w', password], { stdio: 'ignore' });
-    if (r.status === 0) return 'keychain';
-  }
-  fs.mkdirSync(home(), { recursive: true });
-  let all = {};
-  try { all = JSON.parse(fs.readFileSync(credFile(), 'utf8')); } catch { /* none */ }
-  all[`${username}@${server}`] = password;
-  fs.writeFileSync(credFile(), JSON.stringify(all, null, 2), { mode: 0o600 });
-  fs.chmodSync(credFile(), 0o600);
-  return 'file';
-}
-
-export function loadPassword(server, username) {
-  if (process.env.GITROOTS_PASSWORD) return process.env.GITROOTS_PASSWORD;
-  if (useKeychain()) {
-    const r = spawnSync('security', ['find-generic-password', '-a', username, '-s', service(server), '-w'], { encoding: 'utf8' });
-    if (r.status === 0) return r.stdout.replace(/\n$/, '');
-  }
-  try { return JSON.parse(fs.readFileSync(credFile(), 'utf8'))[`${username}@${server}`] || null; } catch { return null; }
-}
-
-export function forgetPassword(server, username) {
-  if (process.platform === 'darwin') spawnSync('security', ['delete-generic-password', '-a', username, '-s', service(server)], { stdio: 'ignore' });
-  try {
-    const all = JSON.parse(fs.readFileSync(credFile(), 'utf8'));
-    delete all[`${username}@${server}`];
-    fs.writeFileSync(credFile(), JSON.stringify(all, null, 2), { mode: 0o600 });
-  } catch { /* none */ }
-}
+// gitroots API client. Uses the same token as the gitroots mobile app.
+import { DEFAULT_SERVER, readConfig, loadToken } from './config.js';
 
 export class ApiError extends Error {
-  constructor(message, status) { super(message); this.status = status; }
+  constructor(message, status, body) { super(message); this.status = status; this.body = body; }
 }
 
 export class Api {
-  constructor({ server, username, password }) {
+  constructor({ server = DEFAULT_SERVER, token = null, orgId = null } = {}) {
     this.server = server.replace(/\/+$/, '');
-    this.username = username;
-    this.auth = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
+    this.token = token;
+    this.orgId = orgId;
   }
 
   static fromConfig() {
     const cfg = readConfig();
-    if (!cfg.server || !cfg.username) return null;
-    const password = loadPassword(cfg.server, cfg.username);
-    if (!password) return null;
-    return new Api({ server: cfg.server, username: cfg.username, password });
+    const server = process.env.GITROOTS_SERVER || cfg.server || DEFAULT_SERVER;
+    const token = loadToken(server, cfg.username);
+    return new Api({ server, token, orgId: cfg.org?.id ?? null });
   }
 
-  async get(p, query = {}) {
+  get signedIn() { return Boolean(this.token); }
+  get host() { return this.server.replace(/^https?:\/\//, ''); }
+
+  async request(method, p, { query = {}, body, signal, auth = true, timeout = 20000, okStatuses = [] } = {}) {
     const url = new URL(`${this.server}/api/${p.replace(/^\/+/, '')}`);
-    for (const [k, v] of Object.entries(query)) if (v !== undefined && v !== null) url.searchParams.set(k, v);
+    for (const [k, v] of Object.entries(query)) if (v !== undefined && v !== null && v !== '') url.searchParams.set(k, v);
+    const headers = { Accept: 'application/json', 'User-Agent': 'gitroots-cli' };
+    if (auth) {
+      if (!this.token) throw new ApiError('not signed in · /login', 401);
+      headers.Authorization = `Token ${this.token}`;
+    }
+    if (body !== undefined) headers['Content-Type'] = 'application/json';
+    const signals = [AbortSignal.timeout(timeout)];
+    if (signal) signals.push(signal);
     let res;
     try {
-      res = await fetch(url, { headers: { Authorization: this.auth, Accept: 'application/json', 'User-Agent': 'gitroots-cli' }, signal: AbortSignal.timeout(15000) });
+      res = await fetch(url, { method, headers, body: body === undefined ? undefined : JSON.stringify(body), signal: AbortSignal.any ? AbortSignal.any(signals) : signals[0] });
     } catch (e) {
-      throw new ApiError(`can't reach ${this.server} (${e.cause?.code || e.name})`, 0);
-    }
-    if (res.status === 401 || res.status === 403) {
-      let detail = '';
-      try { detail = (await res.json()).detail || ''; } catch { /* not json */ }
-      throw new ApiError(res.status === 401 ? 'not signed in, or the password changed · gitroots login' : `not allowed${detail ? `: ${detail}` : ''}`, res.status);
-    }
-    if (!res.ok) {
-      let detail = '';
-      try { detail = (await res.json()).detail || ''; } catch { /* not json */ }
-      throw new ApiError(`${res.status} from ${url.pathname}${detail ? `: ${detail}` : ''}`, res.status);
+      if (signal?.aborted) throw new ApiError('cancelled', 0);
+      throw new ApiError(`can't reach ${this.host} (${e.cause?.code || e.name})`, 0);
     }
+    let data = null;
     const ct = res.headers.get('content-type') || '';
-    if (!ct.includes('json')) throw new ApiError(`${url.pathname} did not return JSON · is ${this.server} a gitroots server?`, res.status);
-    return res.json();
+    if (ct.includes('json')) { try { data = await res.json(); } catch { data = null; } }
+    if (res.ok || okStatuses.includes(res.status)) return { status: res.status, data };
+    const detail = (data && (data.detail || data.error)) || '';
+    if (res.status === 401) throw new ApiError('your sign-in expired or was revoked · /login', 401, data);
+    if (res.status === 403) throw new ApiError(detail || 'not allowed for your role in this workspace', 403, data);
+    if (res.status === 404) throw new ApiError(detail || `not found (${url.pathname})`, 404, data);
+    if (!ct.includes('json')) throw new ApiError(`${this.host} answered ${res.status} · is it a gitroots server?`, res.status);
+    throw new ApiError(detail || `${res.status} from ${url.pathname}`, res.status, data);
   }
 
-  // DRF list: a plain array, or paginated { results, next }.
-  async list(p, query = {}) {
-    let data = await this.get(p, query);
-    if (Array.isArray(data)) return data;
-    const out = [...(data.results || [])];
-    let pages = 0;
-    while (data.next && pages++ < 50) {
-      const next = new URL(data.next);
-      data = await this.get(next.pathname.replace(/^\/api\//, ''), Object.fromEntries(next.searchParams));
-      out.push(...(data.results || []));
-    }
-    return out;
+  async get(p, query, opts = {}) { return (await this.request('GET', p, { ...opts, query: { org_id: this.orgId, ...query } })).data; }
+  async post(p, body, opts = {}) { return (await this.request('POST', p, { ...opts, body, query: { org_id: this.orgId, ...(opts.query || {}) } })).data; }
+
+  // ---- sign-in (no token yet)
+  authStart(clientName) { return this.request('POST', 'cli/auth/start', { auth: false, body: { client_name: clientName } }).then((r) => r.data); }
+  authPoll(deviceCode, signal) {
+    return this.request('POST', 'cli/auth/poll', { auth: false, body: { device_code: deviceCode }, signal, okStatuses: [202, 403, 404, 410] });
   }
 
-  me() { return this.list('users/').then((us) => us.find((u) => u.username === this.username || u.email === this.username) || null); }
-  orgs() { return this.list('orgs/'); }
-  memberships() { return this.list('memberships/'); }
-  auditEvents() { return this.list('audit/events/'); }
-  repos(orgId) { return this.get('integrations/github/org-repos', { org_id: orgId, limit: 200 }).then((d) => d.repos || []); }
-  branches(orgId, fullName) { return this.get('integrations/github/org-branches', { org_id: orgId, full_name: fullName }).then((d) => d.branches || []); }
+  // ---- account & workspace
+  me(opts) { return this.get('mobile/me', {}, opts); }
+
+  // ---- governance
+  home(opts) { return this.get('mobile/gov/home', {}, opts); }
+  repos(opts) { return this.get('mobile/gov/repos', {}, opts); }
+  repo(fullName, opts) { return this.get('mobile/gov/repos/detail', { repo: fullName }, opts); }
+  approvals(state = 'waiting', opts) { return this.get('mobile/gov/approvals', { state }, opts); }
+  approveSync(id, note, opts) { return this.request('POST', `provision/sync-requests/${id}/approve/`, { ...opts, body: { note: note || '' } }).then((r) => r.data); }
+  declineSync(id, mode, reason, opts) { return this.post(`mobile/gov/sync-requests/${id}/decline`, { mode, reason }, opts); }
+  decideAccess(id, decision, reason, opts) { return this.post(`mobile/gov/access-requests/${id}/decide`, { decision, reason }, opts); }
+  pushEvents(blocked, opts) { return this.get('mobile/gov/push-events', { blocked: blocked ? 1 : undefined }, opts); }
+  audit(category, q, opts) { return this.get('mobile/gov/audit', { category, q }, opts); }
+  teamActivity(opts) { return this.get('mobile/gov/team-activity', {}, opts); }
+  members(opts) { return this.get('mobile/gov/members', {}, opts); }
+
+  // ---- agents
+  agents(opts) { return this.get('cli/agents', {}, opts); }
+  agentSession(id, opts) { return this.get(`cli/agents/sessions/${id}`, {}, opts); }
+  agentAction(id, action, text, opts) { return this.post(`cli/agents/sessions/${id}/action`, { action, text }, opts); }
 }