heyquilt 0.3.121 → 0.3.138

package/bin/quilt.js

@@ -46,6 +46,7 @@ Usage:
   quilt run -- <command> [args...]                    Run a command with the session's secrets: it gets NAME=quilt and
                                                       NAME's base URL (STRIPE_BASE_URL), and its requests go through
                                                       Quilt's vault; it never sees a value
+  quilt commit <message>                              In a session that is a quilt: commit the square this folder follows
   quilt commit-request <message> [--files a,b] [--task id]
                                                       Ask a person to commit for you (when agents may not push here)
   quilt commits                                       Open commit requests and recent commits
@@ -108,6 +109,7 @@ async function main () {
     case 'webhook': return webhookCmd()
     case 'wake': return wakeCmd()
     case 'get': return getFile()
+    case 'commit': if (!argv.join(' ').trim()) fail('Usage: quilt commit <message>'); return simple('/square-commit', { message: argv.join(' ') }, (r) => r.text)
     case 'commit-request': return commitRequest()
     case 'commits': return commits()
     case 'github': return githubStatusCmd()
@@ -144,6 +146,7 @@ async function main () {
       if (!token.trim()) fail('no token given')
       return simple('/github-token', { token: token.trim() }, () => 'The relay has the token: it brings in commits from your private repository while nobody\'s folder is online.')
     }
+    case 'session': return sessionCmd()
     case 'invite': return invite()
     case 'workspace': case 'workspaces': return workspaceCmd()
     case 'stop': return stopAll()
@@ -233,6 +236,8 @@ async function apiCmd () {
     siteUrl: env.QUILT_SITE_URL || 'http://localhost:3000',
     trustProxy: /^(1|true|yes)$/i.test(env.QUILT_TRUST_PROXY || ''), log: console.log,
     workspaces: env.QUILT_WORKSPACES === '1' || env.QUILT_WORKSPACES === 'true',
+    // New sessions are quilts from the start (Seam's plans/quilt-source-control/16, flags order 8): apps read it from /v1/features.
+    quiltSourceDefault: env.QUILT_SOURCE_DEFAULT === '1' || env.QUILT_SOURCE_DEFAULT === 'true',
     // Secrets: the vault (quilt-vault) and the secret it calls this API with; off when not set.
     vaultSecret: env.QUILT_VAULT_SECRET || '',
     vaultUrl: env.QUILT_VAULT_URL || 'https://vault.heyquilt.com',
@@ -241,8 +246,11 @@ async function apiCmd () {
     // Its own machines through Fly's Machines API (QUILT_API_FLY_TOKEN): more as load climbs, fewer as it drops (src/api/scaler.js).
     apiFly: (await import('../src/api/api-machines.js')).apiFlyFromEnv(env),
     ...(env.QUILT_API_MAX_MACHINES ? { maxMachines: Number(env.QUILT_API_MAX_MACHINES) } : {}),
-    // Quilt source control (src/quilts/): off unless QUILT_SOURCE is set (src/quilts/setup.js).
-    quilts: await (await import('../src/quilts/setup.js')).quiltsFromEnv(env, { memory: !!values.memory, log: console.log }),
+    // Seam is its own service (Seam's docs/seam-service.md): its old routes here go on to it.
+    ...(env.QUILT_SEAM_URL !== undefined ? { seamUrl: env.QUILT_SEAM_URL } : {}),
+    ...(env.QUILT_SEAM_CLIENT_ID ? { seamClientId: env.QUILT_SEAM_CLIENT_ID } : {}),
+    ...(env.QUILT_SEAM_SITE_URL ? { seamSiteUrl: env.QUILT_SEAM_SITE_URL } : {}),
+    ...(env.QUILT_SEAM_CONNECT_SECRET ? { seamConnectSecret: env.QUILT_SEAM_CONNECT_SECRET } : {}),
     // Voice: Cloudflare TURN for calls on networks that block a direct line, Workers AI for transcripts; each off when not set.
     voice: {
       turnKeyId: env.CLOUDFLARE_TURN_KEY_ID || '',
@@ -351,6 +359,7 @@ async function join () {
 
   const { unsupportedRelay } = await import('../src/settings.js')
   let conn
+  let fresh = false // a session this command starts: a quilt from the start when the API says so (src/quilt-default.js)
   if (positionals[0]) {
     try { conn = decodeInvite(positionals[0]) } catch (err) { fail(err.message) }
   } else if (values.room) {
@@ -362,6 +371,7 @@ async function join () {
   } else {
     if (saved.server) console.log("This folder's last session ran on your computer's own relay, which Quilt no longer supports. Starting a new session.")
     conn = newConn()
+    fresh = true
     console.log('starting a new session')
   }
 
@@ -403,6 +413,7 @@ async function join () {
       apiAuth: auth.apiAuth,
       identity: auth.identity,
       inviteServer: saved.room === conn.room ? saved.inviteServer : undefined,
+      newSession: fresh,
       onLog: (m) => console.log(`[${stamp()}] ${m}`),
       onDebug: process.env.QUILT_DEBUG ? (m) => console.log(`[${stamp()}] debug: ${m}`) : undefined,
       onFatal: (err) => fail(whyStopped(err))
@@ -578,6 +589,57 @@ async function doSetup () {
   console.log('\nAn AI tool that was already open picks up the "quilt" MCP server when it restarts.')
 }
 
+// `quilt session migrate [--dry-run]` (Seam's plans/quilt-source-control/16): what making this folder's
+// session a quilt (Seam) would do, read only, or, without --dry-run, the move itself. The relay
+// does both, behind QUILT_SOURCE_URL there, and only for the session's owner. --switch then moves
+// the session's files into its squares (layout 3); --back returns it to its branches. `follow <folder>`
+// then makes that folder follow this branch's square live (session-follow.js).
+async function sessionCmd () {
+  if (argv[0] === 'follow') {
+    if (!argv[1]) fail('Usage: quilt session follow <folder>')
+    return simple('/quilt-follow', { dir: path.resolve(argv[1]) }, (r) => r.text)
+  }
+  if (argv[0] !== 'migrate') fail('Usage: quilt session migrate [--dry-run | --link-only | --switch | --back [--carried <square,...>] | --shadow <quilt> | --unshadow] | quilt session follow <folder>')
+  if (argv.includes('--dry-run')) return simple('/quilt-plan', {}, (r) => r.text)
+  if (argv.includes('--shadow')) {
+    const q = argv[argv.indexOf('--shadow') + 1]
+    if (!q || q.startsWith('-')) fail('Usage: quilt session migrate --shadow <quilt> (the quilt an import of this session\'s git remote fills)')
+    return simple('/quilt-shadow', { quilt: q }, (r) => r.text)
+  }
+  if (argv.includes('--unshadow')) return simple('/quilt-shadow', { quilt: null }, (r) => r.text)
+  if (argv.includes('--switch')) return sessionMove('/quilt-switch', {}, 'into its squares')
+  if (argv.includes('--back')) {
+    // --carried <id,id>: open squares whose work was carried over by hand (seam diff <square> | git apply).
+    const i = argv.indexOf('--carried')
+    const carried = i >= 0 && argv[i + 1] ? argv[i + 1].split(',').map((x) => x.trim().replace(/^sq:/, '')).filter(Boolean) : []
+    return sessionMove('/quilt-unswitch', { carried }, 'back to its branches')
+  }
+  // "Make this a quilt": made a quilt and moved into its squares in one go (16 flag 9); --link-only stops after the first.
+  if (argv.includes('--link-only')) return sessionMove('/quilt-migrate', {}, 'into Seam')
+  return sessionMove('/quilt-make', {}, 'into Seam')
+}
+
+/**
+ * A move of the session (into Seam, or back), through this folder's app. The relay does it; on a large
+ * session that takes minutes, so it says so first. An app that can't follow a square (older than
+ * 0.3.127) is sent away by the relay at the end of the move, and this command's answer is lost with it:
+ * refused here before anything moves. If the app stops answering meanwhile, the relay still finishes
+ * (or undoes) the move on its own: said, with how to see which.
+ */
+async function sessionMove (route, body, where) {
+  const { d, call } = await daemonOrFail()
+  let info = null
+  try { info = await call(d, 'GET', '/info') } catch (err) { fail(err.message) }
+  const { moveRefusal } = await import('../src/control.js')
+  const refused = moveRefusal(info, (await import('../src/releases.js')).currentVersion())
+  if (refused) fail(refused)
+  console.error(`Moving the session ${where}. The relay does it; a large session takes a few minutes. Keep Quilt open until this answers.`)
+  try { console.log((await call(d, 'POST', route, body)).text) } catch (err) {
+    if (err.cut) fail(`Quilt's app for ${d.dir} stopped answering while the relay moved the session (${err.code || 'the connection closed'}), so this command never heard how it went. The relay finishes the move, or undoes it, on its own. Open the session in Quilt again (if it says the session needs a newer version of Quilt, update Quilt first); then quilt status says whether this folder follows its square.`)
+    fail(err.message)
+  }
+}
+
 async function daemonOrFail () {
   const { findDaemon, call } = await import('../src/control.js')
   const d = findDaemon()
@@ -593,12 +655,16 @@ async function status () {
 async function history () {
   const { values, positionals } = parseArgs({ args: argv, allowPositionals: true, options: { by: { type: 'string' }, since: { type: 'string' }, task: { type: 'string' }, diff: { type: 'boolean' }, n: { type: 'string', short: 'n' } } })
   const { formatHistory } = await import('../src/history.js')
-  await simple('/history', { path: positionals[0], by: values.by, since: values.since, task: values.task, limit: Number(values.n || 30) }, (r) => formatHistory(r.entries, { withDiff: !!values.diff }))
+  await simple('/history', { path: positionals[0], by: values.by, since: values.since, task: values.task, limit: Number(values.n || 30), with_diff: !!values.diff }, (r) => `${formatHistory(r.entries, { withDiff: !!values.diff })}${r.note ? `\n\n${r.note}` : ''}`)
 }
 
 async function simple (route, body, format, method = 'POST') {
   const { d, call } = await daemonOrFail()
-  try { console.log(format(await call(d, method, route, body))) } catch (err) { fail(err.message) }
+  try { console.log(format(await call(d, method, route, body))) } catch (err) {
+    // The app doesn't know the route: it runs an older Quilt than this command.
+    if (err.status === 404 && err.message === 'not found') fail(`Quilt's app for ${d.dir} runs an older Quilt that doesn't have this yet. Update Quilt (or restart it on the new version), then try again.`)
+    fail(err.message)
+  }
 }
 
 /** Splits "@bob rest of message" into { to: 'bob', rest: [...] }. */
@@ -961,4 +1027,5 @@ function fail (msg) {
   process.exit(1)
 }
 
-main().catch((err) => fail(err.stack || err.message))
+// An app that can't be reached is said in words (control.js unreachable), not as a stack.
+main().catch((err) => fail(err.unreachable ? err.message : err.stack || err.message))

package/desktop/main.js

@@ -2,7 +2,7 @@
 // keep syncing from the menu bar when the window is closed, and invite links
 // (quilt://join?invite=…) open straight into the join screen.
 import '../src/quiet-warnings.js'
-import { app, BrowserWindow, Tray, Menu, shell, dialog, ipcMain, nativeTheme, systemPreferences } from 'electron'
+import { app, BrowserWindow, Tray, Menu, shell, dialog, ipcMain, nativeTheme, systemPreferences, desktopCapturer } from 'electron'
 import { execFile } from 'node:child_process'
 import fs from 'node:fs'
 import os from 'node:os'
@@ -18,6 +18,7 @@ import { registerOnStart } from '../src/integrations.js'
 import { adoptLoginShellPath } from '../src/shell-path.js'
 import { getSettings } from '../src/settings.js'
 import { allowPermission, checkPermission } from './media-permission.js'
+import { shareHandler } from './screen-share.js'
 
 adoptLegacyEnv()
 // Chromium's own error log goes to the terminal the app runs in. In a voice call it reports every
@@ -40,6 +41,7 @@ let tray = null
 let quitting = false
 let pendingInvite = null
 let rendererReady = false
+let shareWired = false // the screen share handler (and its answer channel), set up with the first window
 
 /** The invite link inside a quilt:// URL, or null. */
 function inviteFrom (url) {
@@ -206,10 +208,22 @@ function createWindow () {
   const ses = win.webContents.session
   ses.setPermissionRequestHandler((wc, permission, done, details) => {
     if (!allowPermission(permission, details, origin)) return done(false)
-    if (permission === 'media' && process.platform === 'darwin') return systemPreferences.askForMediaAccess('microphone').then(done, () => done(false))
+    if (permission === 'media' && process.platform === 'darwin' && details.mediaTypes?.includes('audio')) return systemPreferences.askForMediaAccess('microphone').then(done, () => done(false))
     done(true)
   })
   ses.setPermissionCheckHandler((wc, permission, requestingOrigin, details) => checkPermission(permission, requestingOrigin, details, origin))
+  // Sharing a screen in a call: the Mac's own picker where there is one (macOS 15+), otherwise the
+  // page shows what can be shared (screen-share.js).
+  if (!shareWired) {
+    shareWired = true
+    ses.setDisplayMediaRequestHandler(shareHandler({
+      win: () => win,
+      appOrigin: origin,
+      capturer: desktopCapturer,
+      ipcMain,
+      screenAccess: () => process.platform === 'darwin' ? systemPreferences.getMediaAccessStatus('screen') : 'granted'
+    }), { useSystemPicker: true })
+  }
   win.webContents.setWindowOpenHandler(({ url }) => {
     if (/^https?:/.test(url) && !url.startsWith(origin)) shell.openExternal(url)
     return { action: 'deny' }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "heyquilt",
-  "version": "0.3.121",
+  "version": "0.3.138",
   "description": "Real-time, tool-agnostic pair vibe coding: sync a project folder live between collaborators using any AI coding tool.",
   "author": {
     "name": "Daniel Carmichael",
@@ -37,6 +37,7 @@
   "dependencies": {
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/poppins": "^5.3.0",
+    "@heyquilt/seam": "0.237.313",
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@noble/hashes": "^2.4.0",
     "@supabase/supabase-js": "^2.117.2",
@@ -83,6 +84,7 @@
       "desktop/preload.cjs",
       "desktop/updater.js",
       "desktop/media-permission.js",
+      "desktop/screen-share.js",
       "desktop/icons/*.png",
       "desktop/icons/*.ico",
       "package.json",

package/src/agent-task-workflow.js

@@ -98,7 +98,7 @@ function agoText (ts, now) {
  * @param {string} [o.me]
  * @param {number} [o.now]
  */
-export function pickupBrief ({ task, history = [], claims = [], checklist = '', me = '', now = Date.now() }) {
+export function pickupBrief ({ task, history = [], claims = [], checklist = '', me = '', now = Date.now(), workflow = TASK_WORKFLOW }) {
   const files = task?.files || []
   const lines = [`Picked up "${task?.title || 'this ticket'}" [${task?.id || ''}].`]
   lines.push(files.length ? `Files: ${files.join(', ')}` : 'Files: none listed. Add them with quilt_assign_task once you know which you will touch.')
@@ -124,7 +124,7 @@ export function pickupBrief ({ task, history = [], claims = [], checklist = '',
     lines.push('', 'Claims to respect (ask for the file with quilt_request_file instead of editing it):')
     for (const c of others) lines.push(`- ${c.pattern} by ${c.by}${c.note ? ` (${c.note})` : ''}`)
   }
-  lines.push('', TASK_WORKFLOW, '', checklistBlock(checklist))
+  lines.push('', workflow, '', checklistBlock(checklist))
   return lines.join('\n')
 }
 

package/src/agents/common.js

@@ -19,3 +19,16 @@ export function toolLabel (client) {
   if (/gemini/i.test(n)) return 'Other'
   return n || 'AI agent'
 }
+
+// The tools a person can be shown as using.
+export const KNOWN_TOOLS = new Set(['Claude Code', 'Cursor', 'Codex', 'xAI', 'Windsurf', 'Zed'])
+
+/**
+ * The tool to show for a person: the one they set, unless the AIs connected through their app
+ * (MCP client names) are all another tool. A set tool can be a stale guess (Brandon showed as
+ * Windsurf while his Claude Code was connected); the AI that connects is what they really use.
+ */
+export function toolInUse (tool, agents = []) {
+  const used = [...agents].map(toolLabel).filter((t) => KNOWN_TOOLS.has(t))
+  return used.length && !used.includes(tool) ? used[used.length - 1] : tool
+}

package/src/ai-vm.js

@@ -526,9 +526,17 @@ export class AiVm {
       kind: 'agent',
       passes: auth.passes,
       identity: auth.identity,
+      // The accounts API (and Seam, through it) as this cloud AI, with its own key (seam-access.js).
+      apiAuth: auth.apiAuth,
       agentFeed: false,
       onLog: (line) => this.log(`[${room}] ${line}`),
-      onFatal: (err) => { this.log(`[${room}] stopped: ${err.message}`); this.runs.delete(room) }
+      // Stopped, not only forgotten: a session left running keeps its timers and the whole room in memory.
+      onFatal: (err) => {
+        this.log(`[${room}] stopped: ${err.message}`)
+        const r = this.runs.get(room)
+        this.runs.delete(room)
+        if (r) r.run.stop().catch(() => {})
+      }
     })
     this.runs.set(room, { run, link })
     // What reaches it in the session counts as activity: the machine stays up while there is work,

package/src/api/activity.js

@@ -136,6 +136,9 @@ export function summarize ({ me, sessions, visits, now, tz = 'UTC' }) {
     people.sort((a, b) => b.togetherMs - a.togetherMs || a.name.localeCompare(b.name))
     const ownerRows = s.ownerAccount ? inRoom.filter((v) => v.account === s.ownerAccount) : []
     const open = inRoom.some((v) => v.endedAt == null)
+    // Who is in it right now, among me and the people listed (an open visit).
+    const listed = new Set([me, ...people.map((p) => p.account)])
+    const here = [...new Set(inRoom.filter((v) => v.endedAt == null && listed.has(v.account)).map((v) => v.account))]
     rows.push({
       room: s.room,
       name: s.name || '',
@@ -143,6 +146,8 @@ export function summarize ({ me, sessions, visits, now, tz = 'UTC' }) {
       mine: !!s.ownerAccount && s.ownerAccount === me,
       createdAt: s.createdAt,
       lastActiveAt: open ? now : s.lastActiveAt,
+      live: open,
+      here,
       myTotalMs: total(mine),
       people
     })

package/src/api/memory-store.js

@@ -30,7 +30,8 @@ export function createMemoryStore ({ now = Date.now } = {}) {
   const orgGithub = new Map() // org id -> { requireGithub, updatedAt }
   const teamGithub = new Map() // team id -> { agentCommits, updatedAt }
   const settings = new Map() // the API's own settings (a webhook secret it made), key -> value
-  const leases = new Map() // "repo\0branch" -> { room, holder, generation, heartbeatAt } (git_sync_leases)
+  const leases = new Map() // key -> { room, holder, generation, heartbeatAt } (relay_leases)
+  const authSessions = new Map()
   const users = new Map(); const orgs = new Map(); const roles = new Map(); const members = new Map()
   const teams = new Map(); const teamMembers = new Map(); const invites = new Map(); const requests = new Map()
   const agentInvites = new Map(); const keyRows = new Map(); const appKeys = new Map()
@@ -55,7 +56,7 @@ export function createMemoryStore ({ now = Date.now } = {}) {
   const hostedRooms = new Map() // "account\nroom" -> { account, room, addedAt }
   const hostedWebhooks = new Map(); const resumeSignatures = new Map()
   // Secrets (20261018000000_secrets.sql): only what the vault sealed.
-  const secretRows = new Map(); const secretDataKeys = new Map(); const secretSettingsRows = new Map()
+  const seamLinks = new Map(); const secretRows = new Map(); const secretDataKeys = new Map(); const secretSettingsRows = new Map()
   const secretTickets = new Map(); const secretRuns = new Map(); const secretAsks = new Map(); const secretUses = []
   const scopeKey = (scopeType, scopeId) => `${scopeType}\n${scopeId}`
   // A secret as the API's routes see it: never its sealed value (secretSealed reads that, for the vault).
@@ -389,7 +390,15 @@ export function createMemoryStore ({ now = Date.now } = {}) {
     },
 
     // The address a person signs in with, and whether they've confirmed it.
-    async userEmail (userId) { const u = users.get(userId); return u ? { ...u } : null },
+    async userEmail (userId) { const u = users.get(userId); return u ? { email: u.email, confirmed: u.confirmed } : null },
+    // Email notices (notify.js): what each person turned on, and what was already sent (kept on the account).
+    setNotify (userId, notify) { const u = users.get(userId); if (u) u.notify = { ...notify } },
+    async notifyUsers () { return all(users, (u) => u.confirmed && u.notify).map((u) => ({ userId: [...users].find(([, x]) => x === u)[0], email: u.email, notify: { ...u.notify }, sent: { ...(u.notifySent || {}) } })) },
+    async setNotifySent (userId, sent) { const u = users.get(userId); if (u) u.notifySent = { ...sent } },
+    // A person's browser sign-ins (supabase-store.js: auth.sessions), for signing out one at a time.
+    addAuthSession (userId, s) { authSessions.set(s.id, { userId, createdAt: now(), lastActiveAt: now(), userAgent: '', ip: '', ...s }) },
+    async authSessions (userId) { return all(authSessions, (s) => s.userId === userId).sort((a, b) => b.lastActiveAt - a.lastActiveAt).map(({ userId: _, ...s }) => ({ ...s })) },
+    async endAuthSession (userId, id) { const s = authSessions.get(id); if (!s || s.userId !== userId) return false; authSessions.delete(id); return true },
     async githubLink (userId) { const g = githubLinks.get(userId); return g ? { ...g } : null },
     async setGithubLink (userId, { githubId, login }) { githubLinks.set(userId, { githubId, login, linkedAt: now() }) },
     async deleteGithubLink (userId) { githubLinks.delete(userId) },
@@ -421,9 +430,8 @@ export function createMemoryStore ({ now = Date.now } = {}) {
     },
     // The API's own settings (app_settings): a value it keeps across starts.
     async getSetting (key) { return settings.has(key) ? settings.get(key) : null },
-    // One live session per repository and branch (git_sync_leases; mirrors the SQL functions).
-    async takeLease ({ repo, branch, room, holder = '', ttlMs }) {
-      const k = `${repo}\0${branch}`
+    // Relay leases (relay_leases; mirrors the SQL functions). `key`: the relay's name for what it holds.
+    async takeLease ({ key: k, room, holder = '', ttlMs }) {
       const cur = leases.get(k)
       const t = now()
       if (!cur) { leases.set(k, { room, holder, generation: 1, heartbeatAt: t }); return { ok: true, generation: 1, room } }
@@ -433,15 +441,14 @@ export function createMemoryStore ({ now = Date.now } = {}) {
       leases.set(k, { room, holder, generation: cur.generation + 1, heartbeatAt: t })
       return { ok: true, generation: cur.generation + 1, room }
     },
-    async heartbeatLease ({ repo, branch, room, generation, ttlMs }) {
-      const cur = leases.get(`${repo}\0${branch}`)
+    async heartbeatLease ({ key: k, room, generation, ttlMs }) {
+      const cur = leases.get(k)
       if (!cur || cur.room !== room || cur.generation !== generation) return { ok: false, lost: true, room: cur ? cur.room : '' }
       if (cur.heartbeatAt < now() - ttlMs) return { ok: false, expired: true }
       cur.heartbeatAt = now()
       return { ok: true, generation }
     },
-    async releaseLease ({ repo, branch, room, generation }) {
-      const k = `${repo}\0${branch}`
+    async releaseLease ({ key: k, room, generation }) {
       const cur = leases.get(k)
       if (cur && cur.room === room && cur.generation === generation) leases.delete(k)
       return { ok: true }
@@ -1227,6 +1234,10 @@ export function createMemoryStore ({ now = Date.now } = {}) {
       if (!secretDataKeys.has(k)) secretDataKeys.set(k, { scopeType, scopeId, version, sealedKey, provider, createdAt: now() })
       return copy(secretDataKeys.get(k))
     },
+    // "Connect Seam" (routes/seam-connect.js): the person's Seam tokens, one row per Quilt user.
+    async seamLink (userId) { return copy(seamLinks.get(userId)) || null },
+    async putSeamLink (userId, link) { const row = { userId, access: link.access, refresh: link.refresh, scope: link.scope || '', expiresAt: link.expiresAt, connectedAt: link.connectedAt ?? now() }; seamLinks.set(userId, copy(row)); return copy(row) },
+    async deleteSeamLink (userId) { seamLinks.delete(userId) },
     async secretSettings (scopeType, scopeId) {
       return copy(secretSettingsRows.get(scopeKey(scopeType, scopeId))) || { scopeType, scopeId, inheritOff: false, inheritOffBy: null, inheritOffAt: null, agentsOn: false, agents: 'all', updatedAt: null }
     },

package/src/api/notify.js

@@ -0,0 +1,134 @@
+// Email notices from the website dashboard's Settings › Notifications (plans/dashboard ticket 11). Each
+// person picks what they want (kept on their account: user_metadata.notify), and the API's leader looks
+// every few minutes: messages to them nobody saw for a while (a mention or a direct message not answered
+// after MENTION_DELAY_MS), an agent asking to join a session they own, a daily digest of tasks for them,
+// and a weekly summary of their time in sessions. What's live comes from the relays (nowAsker in
+// routes/sessions.js), the week from the sessions the relays reported. What was already sent is kept on
+// the account too (user_metadata.notify_sent), so nothing is sent twice, across restarts as well.
+
+export const NOTIFY_KINDS = ['mentions', 'joins', 'tasks', 'weekly']
+export const NOTIFY_EVERY_MS = 10 * 60 * 1000
+export const MENTION_DELAY_MS = 15 * 60 * 1000
+const DAY_MS = 24 * 60 * 60 * 1000
+export const DIGEST_MS = DAY_MS
+export const WEEKLY_MS = 7 * DAY_MS
+
+/** A person's choices: each kind on or off (off unless it was turned on). */
+export function cleanNotify (v) {
+  const o = v && typeof v === 'object' ? v : {}
+  return Object.fromEntries(NOTIFY_KINDS.map((k) => [k, o[k] === true]))
+}
+
+/** What was sent already: the newest mention and join request mailed, and when the digest and summary went. */
+export function cleanSent (v) {
+  const o = v && typeof v === 'object' ? v : {}
+  const n = (x) => (Number.isFinite(x) && x > 0 ? x : 0)
+  return { mentionsAt: n(o.mentionsAt), joinsAt: n(o.joinsAt), tasksAt: n(o.tasksAt), weeklyAt: n(o.weeklyAt) }
+}
+
+const hours = (ms) => {
+  const m = Math.round(ms / 60000)
+  if (m < 60) return `${m}m`
+  return `${Math.floor(m / 60)}h${m % 60 ? ` ${m % 60}m` : ''}`
+}
+const line = (n, s) => `- ${s.name || 'Untitled session'}: ${n.by} · "${n.text}"`
+const footer = (site) => ['', `Open your dashboard: ${site}/dashboard`, `Change which emails you get: ${site}/settings/notifications`]
+
+/**
+ * The emails due for one person at `t`, and what to remember as sent. `now` is their summary of now
+ * (nowAsker), `overview` their week (overviewOf) or null; `site` the website's address.
+ */
+export function planNotices ({ notify, sent, now, overview = null, t, site }) {
+  const want = cleanNotify(notify)
+  const was = cleanSent(sent)
+  const next = { ...was }
+  const mails = []
+  const needs = []
+  for (const s of (now && now.sessions) || []) for (const n of s.needs || []) needs.push({ n, s })
+
+  if (want.mentions) {
+    const due = needs.filter(({ n }) => (n.kind === 'mention' || n.kind === 'dm') && n.at > was.mentionsAt && n.at <= t - MENTION_DELAY_MS)
+    if (due.length) {
+      next.mentionsAt = Math.max(...due.map(({ n }) => n.at))
+      mails.push({
+        subject: due.length === 1 ? `${due[0].n.by} is waiting for you in ${due[0].s.name || 'Quilt'}` : `${due.length} messages are waiting for you in Quilt`,
+        text: ['Messages to you nobody has answered yet:', '', ...due.map(({ n, s }) => line(n, s)), '', 'Answer them in the Quilt app.', ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.joins) {
+    const due = needs.filter(({ n }) => n.kind === 'join' && n.at > was.joinsAt)
+    if (due.length) {
+      next.joinsAt = Math.max(...due.map(({ n }) => n.at))
+      mails.push({
+        subject: due.length === 1 ? `${due[0].n.by} asks to join ${due[0].s.name || 'your session'}` : `${due.length} are asking to join your sessions`,
+        text: ['Waiting for you to let them in:', '', ...due.map(({ n, s }) => `- ${n.by}${n.agent ? ' (an agent)' : ''} in ${s.name || 'Untitled session'}`), '', 'Let them in, or not, from the session in the Quilt app.', ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.tasks && t - was.tasksAt >= DIGEST_MS) {
+    const due = needs.filter(({ n }) => n.kind === 'task')
+    if (due.length) {
+      next.tasksAt = t
+      mails.push({
+        subject: `${due.length} ${due.length === 1 ? 'task is' : 'tasks are'} waiting for you in Quilt`,
+        text: ['Tasks for you, still to do:', '', ...due.map(({ n, s }) => `- ${n.text} (${s.name || 'Untitled session'}, from ${n.by})`), ...footer(site)].join('\n')
+      })
+    }
+  }
+  if (want.weekly && t - was.weeklyAt >= WEEKLY_MS && overview) {
+    next.weeklyAt = t
+    const week = overview.sessions.filter((s) => s.lastActiveAt >= t - WEEKLY_MS)
+    const together = overview.totals?.collaboratingThisWeek || 0
+    if (week.length) {
+      const top = (overview.totals?.topCollaborators || []).slice(0, 3).map((c) => c.name)
+      mails.push({
+        subject: `Your week in Quilt: ${week.length} ${week.length === 1 ? 'session' : 'sessions'}${together ? `, ${hours(together)} together` : ''}`,
+        text: [
+          `This week you worked in ${week.length} ${week.length === 1 ? 'session' : 'sessions'}${together ? ` and spent ${hours(together)} working with others` : ''}.`,
+          ...(top.length ? [`You worked most with ${top.join(', ')}.`] : []),
+          '',
+          ...week.slice(0, 10).map((s) => `- ${s.name || 'Untitled session'}: ${hours(s.myTotalMs)} for you`),
+          ...footer(site)
+        ].join('\n')
+      })
+    }
+  }
+  return { mails, sent: next }
+}
+
+/**
+ * The job: every `everyMs` on the leading machine, each person who turned a notice on gets what's due.
+ * store.notifyUsers() lists them ({ userId, email, notify, sent }); store.setNotifySent keeps what went.
+ */
+export function notifier ({ store, mailer, ask, overview, now = Date.now, log = () => {}, site, leads = () => true, everyMs = NOTIFY_EVERY_MS }) {
+  let timer = null
+  let running = false
+  async function tick () {
+    if (running || !leads() || !store.notifyUsers) return 0
+    running = true
+    let sentCount = 0
+    try {
+      const users = await store.notifyUsers()
+      for (const u of users) {
+        const want = cleanNotify(u.notify)
+        if (!u.email || !NOTIFY_KINDS.some((k) => want[k])) continue
+        const t = now()
+        const account = `person:${u.userId}`
+        try {
+          const live = want.mentions || want.joins || want.tasks ? await ask(account, t) : null
+          const week = want.weekly && t - cleanSent(u.sent).weeklyAt >= WEEKLY_MS ? await overview(account, t) : null
+          const plan = planNotices({ notify: want, sent: u.sent, now: live, overview: week, t, site })
+          for (const m of plan.mails) { await mailer.send({ to: u.email, ...m }); sentCount++ }
+          if (JSON.stringify(plan.sent) !== JSON.stringify(cleanSent(u.sent))) await store.setNotifySent(u.userId, plan.sent)
+        } catch (err) { log(`notify ${u.userId}: ${err.message}`) }
+      }
+    } catch (err) { log(`notify: ${err.message}`) } finally { running = false }
+    return sentCount
+  }
+  return {
+    tick,
+    start () { if (!timer) { timer = setInterval(tick, everyMs); timer.unref?.() } },
+    stop () { clearInterval(timer); timer = null }
+  }
+}

package/src/api/routes/browsers.js

@@ -0,0 +1,29 @@
+// Signing out one browser at a time (plans/dashboard ticket 12, the website's Settings › Security):
+// your browser sign-ins (Supabase Auth's sessions), and ending one. Computers are unlinked on their own
+// (the devices table). Needs the 20261026235000_my_browser_sessions migration; without it, 503.
+import { HttpError, UUID } from '../http.js'
+
+const NOT_SET_UP = 'Signing out one browser at a time is not set up on this server yet.'
+
+export function browserRoutes ({ store, person, log = () => {} }) {
+  const guard = async (fn) => {
+    try { return await fn() } catch (err) {
+      if (err instanceof HttpError) throw err
+      log(`browsers: ${err.message}`)
+      throw new HttpError(503, NOT_SET_UP)
+    }
+  }
+  return [
+    ['GET', /^\/v1\/me\/browsers$/, async (req) => {
+      const { userId } = await person(req)
+      return guard(async () => ({ browsers: await store.authSessions(userId) }))
+    }],
+    ['DELETE', /^\/v1\/me\/browsers\/([^/]+)$/, async (req, body, [id]) => {
+      const { userId } = await person(req)
+      if (!UUID.test(id)) throw new HttpError(404, 'no such sign-in')
+      const ended = await guard(() => store.endAuthSession(userId, id.toLowerCase()))
+      if (!ended) throw new HttpError(404, 'no such sign-in')
+      return { ok: true }
+    }]
+  ]
+}

package/src/api/routes/github.js

@@ -10,7 +10,6 @@ export { ensureWebhookSecret, redeliverFailed } from '../github-app.js'
 
 const PART = /^[A-Za-z0-9_.-]{1,100}$/
 /** A lease lapses this long after its last heartbeat: two missed heartbeats (plan §8). */
-export const LEASE_TTL_MS = 2 * 60 * 1000
 const ACCOUNT = /^person:([A-Za-z0-9_-]{1,64})$/
 const ACTOR = /^(person|agent):([A-Za-z0-9_-]{1,64})$/
 const ROOM = /^[A-Za-z0-9_-]{1,64}$/
@@ -322,18 +321,6 @@ export function githubRoutes ({ store, person, bearer, relaySecret, github: cfg,
       // Stable: the first of the strictest, and rules are in order broadest first.
       return rules.reduce((best, r) => rank[r.agentCommits] < rank[best.agentCommits] ? r : best)
     }],
-    // The relay: one live session per repository and branch (plan §8). Leases lapse LEASE_TTL_MS after the last heartbeat.
-    ['POST', /^\/v1\/relay\/leases\/(take|heartbeat|release)$/, async (req, b) => {
-      fromRelay(req)
-      const what = new URL(req.url, 'http://x').pathname.split('/').pop()
-      const repo = String(b.repo || ''); const branch = String(b.branch || ''); const room = String(b.room || '')
-      if (!/^[A-Za-z0-9.-]{1,100}\/[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/.test(repo) || !branch || branch.length > 255 || !/^[A-Za-z0-9_-]{1,64}$/.test(room)) throw new HttpError(400, 'give repo (host/owner/name), branch and room')
-      const ttlMs = Math.max(1000, Math.min(10 * 60_000, Number(b.ttlMs) || LEASE_TTL_MS))
-      const generation = Number.isInteger(b.generation) ? b.generation : 0
-      if (what === 'take') return store.takeLease({ repo, branch, room, holder: String(b.holder || '').slice(0, 100), ttlMs })
-      if (what === 'heartbeat') return store.heartbeatLease({ repo, branch, room, generation, ttlMs })
-      return store.releaseLease({ repo, branch, room, generation })
-    }],
     // The relay: which GitHub accounts the session's people linked (login and id), for commit authorship
     // (relay-outbound.js: a person's commits carry their GitHub noreply address). Never a token.
     ['POST', /^\/v1\/relay\/github-logins$/, async (req, b) => {

package/src/api/routes/relay.js

@@ -15,6 +15,18 @@ const ROOM = /^[A-Za-z0-9_-]{1,64}$/
 const ACCOUNT = /^(person|agent):[A-Za-z0-9_-]{1,64}$/
 
 const VIA = ['app', 'hosted']
+// Relay leases (src/relay-lease.js), moved here from routes/github.js in 16's R2 so they outlive git sync.
+export const LEASE_TTL_MS = 2 * 60 * 1000
+const LEASE_KEY = /^[\x21-\x7e][\x20-\x7e]{0,599}$/
+const LEASE_REPO = /^[A-Za-z0-9.-]{1,100}\/[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/
+
+/** A lease's key: `key` as the relay names it, else (a relay from before R2) "<repo> <branch>", the same key either way; null when neither is one. */
+export function leaseKey (b) {
+  if (typeof b.key === 'string' && LEASE_KEY.test(b.key)) return b.key
+  const repo = String(b.repo || ''); const branch = String(b.branch || '')
+  if (!LEASE_REPO.test(repo) || !branch || branch.length > 255 || /\s/.test(branch)) return null
+  return `${repo} ${branch}`
+}
 /** A short label: printable, at most `n` characters. */
 const label = (x, n) => stripInvisible(x).slice(0, n).join('').replace(/[\u0000-\u001f\u007f]/g, '').trim()
 
@@ -51,9 +63,9 @@ export function cleanEvent (e, now) {
 export function relayRoutes ({ store, now, log, bearer, relaySecret }) {
   let prunedAt = 0
   const fromRelay = (req) => {
-    if (!relaySecret) throw new HttpError(503, 'presence is not set up on this server')
+    if (!relaySecret) throw new HttpError(503, 'the relay is not set up on this server')
     // Hashed first so the comparison takes the same time whatever was sent.
-    if (!crypto.timingSafeEqual(digest(bearer(req)), digest(relaySecret))) throw new HttpError(401, 'only the relay may report presence')
+    if (!crypto.timingSafeEqual(digest(bearer(req)), digest(relaySecret))) throw new HttpError(401, 'only the relay may ask for this')
   }
 
   return [
@@ -71,6 +83,17 @@ export function relayRoutes ({ store, now, log, bearer, relaySecret }) {
           .catch((err) => log(`could not prune session activity: ${err?.message || err}`))
       }
       return { ok: true, applied, skipped: body.events.length - events.length }
-    }, { maxBody: PRESENCE_BODY }]
+    }, { maxBody: PRESENCE_BODY }],
+    // One holder at a time per key, across relay machines (relay-lease.js). Leases lapse LEASE_TTL_MS after the last heartbeat.
+    ['POST', /^\/v1\/relay\/leases\/(take|heartbeat|release)$/, async (req, b, [what]) => {
+      fromRelay(req)
+      const key = leaseKey(b); const room = String(b.room || '')
+      if (!key || !/^[A-Za-z0-9_-]{1,64}$/.test(room)) throw new HttpError(400, 'give key (or repo as host/owner/name and branch) and room')
+      const ttlMs = Math.max(1000, Math.min(10 * 60_000, Number(b.ttlMs) || LEASE_TTL_MS))
+      const generation = Number.isInteger(b.generation) ? b.generation : 0
+      if (what === 'take') return store.takeLease({ key, room, holder: String(b.holder || '').slice(0, 100), ttlMs })
+      if (what === 'heartbeat') return store.heartbeatLease({ key, room, generation, ttlMs })
+      return store.releaseLease({ key, room, generation })
+    }]
   ]
 }