heyquilt 0.3.90 → 0.3.107

package/README.md

@@ -32,8 +32,9 @@ within milliseconds. Your agents can also see what the other agents are doing.
   WebSockets, and only lets in people signed in to heyquilt.com. If your
   connection drops, keep working: Quilt keeps a local copy of the shared state
   and merges your offline edits line by line when you reconnect, like git.
-  Edits to the same lines land in the **Merges** bar for the people involved
-  to settle.
+  Nobody is ever asked to merge: where two people changed the same lines,
+  Quilt keeps the newer edit, keeps the other in the file's history, and tells
+  whoever wrote it. The same goes for commits pulled or pushed to GitHub.
 - **Watch each other's AI, live.** The app shows your partner's AI conversation
   as it happens: their prompts, the AI's replies, and one-line actions like
   "Edited src/app.ts" or "Ran npm test". Quilt reads Claude Code's and Cursor's
@@ -70,11 +71,11 @@ within milliseconds. Your agents can also see what the other agents are doing.
 
 ### Download the app
 
-Get Quilt for [Mac (Apple silicon)](https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/quilt-mac-arm64.dmg),
-[Mac (Intel)](https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/quilt-mac-x64.dmg),
-[Windows](https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/quilt-windows-x64.exe) or
-Linux ([x86_64](https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/quilt-linux-x86_64.AppImage),
-[ARM](https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/quilt-linux-arm64.AppImage): an
+Get Quilt for [Mac (Apple silicon)](https://heyquilt.com/download/quilt-mac-arm64.dmg),
+[Mac (Intel)](https://heyquilt.com/download/quilt-mac-x64.dmg),
+[Windows](https://heyquilt.com/download/quilt-windows-x64.exe) or
+Linux ([x86_64](https://heyquilt.com/download/quilt-linux-x86_64.AppImage),
+[ARM](https://heyquilt.com/download/quilt-linux-arm64.AppImage): an
 AppImage, `chmod +x` it), and open it.
 Everything happens in the app: start a session, send the invite link, and
 partners click it to join. Closing the window keeps your sessions syncing from
@@ -97,7 +98,7 @@ A Linux machine with no desktop (a server, a cloud VM, a container, an agent's s
 gets the command line with its own Node.js, so nothing else needs installing:
 
 ```bash
-curl -fsSL https://github.com/DanielCarmichaelGit/heyquilt/releases/latest/download/install.sh | sh
+curl -fsSL https://heyquilt.com/install.sh | sh
 quilt login
 ```
 
@@ -514,9 +515,11 @@ person with `@name`. Messages are kept in the room, so anyone offline sees
 them when they reconnect, and `quilt status` shows your unread count.
 
 Files you **send** (screenshots, logs, exports, a PDF spec) go through the relay
-as attachments. They are *not* added to the shared project folder. Recipients
-get them automatically in `.quilt/inbox/`, including files sent while they
-were offline. The limit is 100 MB per file.
+as attachments. They are *not* added to the shared project. Everyone who can
+see the message gets the file in the `Chat files` folder of their session
+folder, including files sent while they were offline or before they joined.
+Quilt never syncs that folder and git ignores it, so it never reaches GitHub:
+only the people in the session have it. The limit is 100 MB per file.
 
 Direct messages and files are only shown to the sender and recipient, but they
 travel through the shared room, so they're private from other collaborators'

package/RELEASES.md

@@ -11,6 +11,139 @@ Format: `## <version> — <YYYY-MM-DD>`, an optional one-line summary, then bull
 Lead each bullet with a short bold phrase. Inline `code` and **bold** are rendered;
 nothing else is.
 
+## 0.3.107 — 2026-10-19
+
+- **Your cloud AI's sessions stay listed.** Settings → Your AI shows the sessions your cloud AI is in while its machine sleeps and after Quilt's servers restart, instead of "In no session yet". A session nobody named shows as your folder's name, as the rest of the app shows it.
+
+## 0.3.106 — 2026-10-19
+
+0.3.105 didn't publish (GitHub didn't run its builds), so it comes with this one.
+
+- **Agents' folders are git checkouts again.** The relay's newer git no longer came with the part that serves git to agents (`git http-backend`), so agents' and cloud AIs' folders synced without git. It's back.
+- **A relay that can't serve git says so.** If its git ever lacks that part again, the relay logs it at start and agents' folders use GitHub's git instead of failing; a failed git request through the relay is logged with what git said.
+- **An agent's main is the session's main.** When several branches in a session started from main, the relay could give agents' folders an old main from one of them. Now they get the session's own main.
+- **Your cloud AI joins the sessions you already have open.** A cloud AI connected while sessions were open now joins them too, instead of only the sessions you start afterwards, so it can hear and answer there.
+
+## 0.3.105 — 2026-10-19
+
+Your cloud AI's sign-in shows its link in seconds.
+
+- **Every AI tool is ready before you connect.** The spare cloud machine now reads Claude Code, Codex and Cursor into memory before anyone connects, then sleeps. Connecting wakes it as yours, so the sign-in link shows in a few seconds instead of sitting at "Starting Claude's own sign-in…" while the machine read the tool off its disk.
+- **Switching tools signs the new one in at once.** Changing Claude Code to Codex or Cursor no longer shows the old tool's link, and the new tool's sign-in starts straight away instead of after about 25 seconds.
+- **Even right after someone else connects.** A spare that is still getting its tools ready when you connect stops and starts your sign-in at once.
+- **A code Claude doesn't take shows a new link.** Pasting a wrong or expired code used to leave "Checking the code" up forever. Now Claude's sign-in starts over by itself and shows its new link, with a note that the code wasn't taken.
+- **`npx heyquilt` is always current.** The npm package is published with every release, so agents in a sandbox running `npx heyquilt sync` get the same version as the app.
+
+## 0.3.104 — 2026-10-19
+
+0.3.102 and 0.3.103 didn't publish (a test of the release itself failed), so they come with this one.
+
+- **Downloads and updates come from heyquilt.com (0.3.102).** Installers, the Linux one-liner (`curl -fsSL https://heyquilt.com/install.sh | sh`) and the app's update check no longer depend on the GitHub repository, which is private.
+- **git never waits on Quilt (0.3.103).** `git fetch`, `git push` and `git ls-remote` in a folder Quilt signs in to GitHub no longer hang when Quilt is slow to answer.
+
+## 0.3.103 — 2026-10-19
+
+- **git never waits on Quilt.** In a folder where Quilt signs git in to GitHub, `git fetch`, `git push` and `git ls-remote` could hang for minutes when Quilt was slow to answer. Quilt now answers within a few seconds or steps aside, and your own sign-in (a keychain, `gh`) is used instead.
+
+## 0.3.102 — 2026-10-19
+
+Downloads and updates come from heyquilt.com.
+
+- **Downloads work with Quilt's code kept private.** The installers, the Linux one-liner (`curl -fsSL https://heyquilt.com/install.sh | sh`) and the app's update check now go through heyquilt.com instead of the GitHub repository, which is private. A pinned version still works: `heyquilt.com/download/v0.3.102/<file>`.
+- **The update check asks Quilt, not GitHub.** Your app learns about new versions from Quilt's own servers, and "Update Quilt" downloads from heyquilt.com.
+
+## 0.3.101 — 2026-10-18
+
+Three updates in one: 0.3.98, 0.3.99 and 0.3.100 were built but couldn't be published, so they come with this one.
+
+- **Nobody is asked to merge any more (0.3.99).** When your offline edits, a `git pull`, a push to GitHub or an AI's sandbox meet the session's work, Quilt combines them itself. Where both changed the same lines the newer edit stays, and whoever's lines were replaced gets a message listing them; they're kept in the file's history. The Merges bar, Keep mine / Keep theirs and merge tasks are gone.
+- **Your cloud AI is ready in seconds (0.3.100).** A spare machine waits for the next person, so connecting takes about 4 seconds, and Claude's sign-in link shows again.
+- **An AI's edits stay in their box (0.3.98)**, even with several of its conversations going at once.
+- **Releases publish reliably.** Builds now go straight onto the release instead of through GitHub's build storage, which had filled up and stopped the last three.
+
+## 0.3.100 — 2026-10-18
+
+Your cloud AI is ready in seconds.
+
+- **A cloud machine waits ready for you.** Quilt keeps a spare machine made and stopped ahead of time (a stopped machine costs only its disk). Connecting a cloud AI gives you that one, running in about 4 seconds instead of the 15 to 20 a new machine took, and another spare is made for the next person.
+- **Claude's sign-in shows its link again.** Claude Code now prints its sign-in link on claude.com, which the cloud machine didn't recognise, so the sign-in sat at "Starting Claude's own sign-in…". It shows the link and takes your code again.
+
+## 0.3.99 — 2026-10-18
+
+Nobody is asked to merge any more.
+
+- **Quilt merges on its own, every time.** When two versions of a file meet (you worked offline, `git pull` brought commits in, someone pushed to GitHub, or an AI's sandbox synced), Quilt combines them itself. Changes to different lines both go in, including changes on neighbouring lines. Where both sides changed the same lines, the newer edit keeps them; a pulled commit counts as new as when it was made, not when git wrote it. An edit always beats a deletion. Nobody is asked to pick a side, and nobody's AI is handed a merge to do.
+- **Nothing is lost, and whoever lost lines is told.** The merge is in the file's history like any edit. The version that lost is kept, and its writer gets one message listing the lines that were replaced, which they can put back with an ordinary edit if they want them.
+- **A file someone holds still waits for them.** Your change to a file another person or AI is working on goes in, merged, the moment they let go of it.
+- **GitHub too.** Commits pushed to GitHub outside Quilt come into the session at once, combined with the session's work the same way (a commit counts as new as when it was made); there are no clash tasks, no merger and reviewer, and no file held for a merge or for failing checks. A local commit the relay pushes for you is combined with GitHub's newer commits the same way, and conflict markers a git merge left in a file are settled (both sides' lines kept) before it goes to GitHub. `quilt_clash` stays for older guides and says there is nothing to do.
+- **Gone: the Merges bar and the "to merge" pill**, Keep mine / Keep theirs / Edit by hand / Send to, conflict markers in shared files, merge tasks and their merger and reviewer, and handing a merge to your AI. `quilt_merges` now says what Quilt merged; `quilt_resolve_merge` answers that there is nothing to settle.
+
+## 0.3.98 — 2026-10-18
+
+- **A new heyquilt.com.** The website is dark by default, like the app, with a light mode a click away. The homepage shows Quilt working instead of describing it: a live Loom where three people's AIs work at once, wait for a file and hand it over with notes; side by side, what happens to two AIs on one file with and without Quilt; then the steps, what Quilt does, how agents join, what stays yours, and answers to the usual questions. It's drawn in the page rather than from screenshots, so it's sharp at any size and quick to load, and it moves only while you're looking, and not at all with reduced motion.
+- **Fixed: an AI's edits could escape their box.** With several Claude Code or Cursor conversations going at once, one finishing its turn made Quilt think your AI had stopped, so another conversation's edits counted as yours and weren't boxed: half a change could reach everyone's folder before it was committed. Quilt now counts your AI as working while any of its conversations is mid-turn.
+
+## 0.3.97 — 2026-10-18
+
+Files sent in chat get a folder of their own.
+
+- **A Chat files folder only the session has.** Files sent in a session's chat now land in a `Chat files` folder in your session folder, instead of hidden in `.quilt/inbox/`. Quilt never syncs it and git ignores it, so it never reaches GitHub or the workspace: everyone who can see the message gets the file, and a file sent to one person goes only to them. Files you send are kept there too, and files sent before you joined or while you were away come in when you open the session. A file you delete from the folder stays deleted; open it in chat to get it back.
+- **See them in the file tree.** The app's file tree shows the Chat files folder, marked session only, with who sent each file. Open one to read it, see a picture, or download it, and AIs see them in `quilt_list_files`.
+- **git no longer hangs on Quilt's sign-in.** In the desktop app, the helper Quilt gives git to sign in to GitHub, and its pre-push hook, could open as a second copy of the app instead of answering, so `git fetch`, `git pull` and `git push` waited for ever. They answer at once now.
+- **A file you had open is there after a reload.** A file tab put back when the app reloads now shows the file, instead of "Loading…" until you clicked it again.
+- **A stopped session lets go of its folder.** If git's `index.lock` came and went just as a session stopped, Quilt could keep watching the folder, and `quilt` stayed running after you left. It now stops watching for good.
+
+## 0.3.96 — 2026-10-18
+
+- **Your commits can't delete what someone just pushed.** When Quilt put your local commits on GitHub and someone pushed again a moment later, your folder could jump to their newer commit before its files arrived, so a `git commit -a` made right then recorded those files as deleted. Your folder now follows the commit Quilt pushed, and their newer work comes in the usual way, files first.
+
+## 0.3.95 — 2026-10-18
+
+The relay scales on real load, both ways.
+
+- **Sessions go where there's room.** Each relay machine reports its memory, event-loop lag, CPU and traffic, and new sessions go to the least loaded machine under its target. The number of sessions is now only a hard ceiling.
+- **Busy machines get relief.** A relay machine over its load target for a while moves its lightest sessions to a quieter machine, or to a new one. It never moves a session during a git push or commit, and never moves the same session twice within 30 minutes.
+- **Idle machines go away.** Relay machines left empty for 30 minutes, including a heavy session's own machine after that session ends, are stopped and removed. Two lightly loaded machines merge into one, and at least one machine always stays.
+
+## 0.3.94 — 2026-10-18
+
+Secrets your team can use but nobody can read.
+
+- **Team, workspace and session secrets.** Add API keys in session settings, on the workspace page, or for the whole team on heyquilt.com (your org's Secrets page). Once saved a value is never shown again, to anyone: replace or delete it. Each secret goes to one service only (for example `api.stripe.com`), and each shows when it was last used.
+- **`quilt run -- <command>`.** Runs your project with its secrets without ever handing them over: the command gets `STRIPE_KEY=quilt` and `STRIPE_BASE_URL` pointing at Quilt's vault, which adds the real key on the way to Stripe. Point an SDK at the base URL (OpenAI and Anthropic's are set for you).
+- **People-only secrets ask you first.** Mark a secret People only and every run that needs it asks you to allow it in the app; agents never get it.
+- **Turn inherited secrets off.** A session owner can switch workspace and team secrets off for their session, and a workspace can switch team secrets off, for a leak or when they aren't needed. Choose which agents may use secrets at all.
+- **Import a `.env` file** straight into the vault, then delete it.
+- **For agents:** a new `quilt_secret_names` tool lists names and where they go, never values. `quilt git-token` no longer prints a token.
+
+## 0.3.93 — 2026-10-18
+
+Sandbox keys you can see and manage.
+
+- **An agent's keys in one table.** In the app (Settings → Agents, open an agent) and on heyquilt.com, each agent lists its sandbox keys: which session, when it was last used, its use over the last seven days, and whether it is in use, idle or revoked.
+- **New key, Rotate, Revoke.** Make a key for a session in place; it is shown once, with Copy. Rotate swaps it for a new one with the same name and session; Revoke stops it at once; Remove clears a revoked one.
+
+## 0.3.92 — 2026-10-18
+
+Everything from 0.3.88 to 0.3.91, which did not publish: git for everyone, boxes, your AI on a cloud machine, and the relay on many machines.
+
+- **A new session follows its workspace's git rule at once.** A session made in a workspace, or moved into or out of one, picks up the workspace's, team's or org's git rule right away instead of up to ten minutes later. Deleting a workspace lifts its rule from its sessions at once too.
+- **Your AI on a cloud machine.** Settings → Your AI: connect Claude Code, Codex or Cursor and it runs on a cloud machine of your own, so it keeps taking tasks, answering @mentions and messages while your computer is closed. Sign the tool in right in the card with its own login: Quilt never sees it. See its status, its sessions and today's use against its daily cap; change its model, instructions and cap; wake it or disconnect it. Included in every plan for now.
+- **See who has unfinished work.** In the people panel, each person's boxed files are listed under them with what changed, opened in place. Ask for someone's boxed file there, or unpack your own to put it in everyone's folder. Boxed files have an amber mark in the file tree.
+- **One control for git, everywhere.** Off for everyone, on with agents pushing their own branches, or on with agents pushing any branch: the same three-way control in session, workspace, org and default settings, and for teams and orgs on heyquilt.com. Choices a higher rule doesn't allow are greyed, with who set the rule.
+- **Your AI's unfinished work stays in a box.** When an AI edits a file in a git folder, the change is boxed: everyone sees it, but it is only in its owner's folder, so nobody else's AI can commit it. It reaches everyone when its owner commits it, puts the file back, unpacks it (`quilt_unpack`) or hands the file off. `quilt_status` lists boxed work, and a box whose owner has been away a day gets one reminder a day.
+- **Hosted agents' writes box too**, until they commit with `quilt_git_commit`.
+- **The relay runs on many machines.** Each session lives on one machine, and new sessions go to the least busy. A heavy session (big or busy) gets a machine of its own and moves there; people reconnect by themselves in a few seconds.
+- **Fixed: hosted agents' and branch leases' files could be removed** by the relay's sweep of idle sessions.
+- **Everyone pushes once one person connects GitHub.** When the session owner (or a workspace, team or org rule) has git on and someone has connected GitHub, everyone in the session, people and agents alike, can `git push` with nothing to set up. Each person gets a one-hour token for that repository only, taken back when they leave or git is turned off. Your own git settings and keychain are never touched.
+- **Off means off for everyone.** Turning git off now stops people's pushes too, not just agents'. Commits from the app's commit panel still go.
+- **Team git rules.** A team can set git for the sessions its members own. Org, team and workspace rules are ceilings: a session owner can tighten them, never loosen them, and is told who set the rule.
+- **No more `gh auth login`.** Quilt no longer tells you to sign in to GitHub in another tool; it says whose connection git goes through.
+
+## 0.3.91 — 2026-10-18
+
+- **A new session follows its workspace's git rule at once.** A session made in a workspace, or moved into or out of one, picks up the workspace's, team's or org's git rule right away instead of up to ten minutes later. Deleting a workspace lifts its rule from its sessions at once too.
+
 ## 0.3.90 — 2026-10-18
 
 Your AI on a cloud machine, boxes you can see, and one control for git.
@@ -48,9 +181,9 @@ A new look for Quilt: the Patch Q mark, and the app and heyquilt.com in ink, ver
 - **A cleaner light mode.** Light mode drops the cream for neutral greys with a hint of ink. The top bar, Files, chat and the sidebar are white, and the work (the Loom, the board, a file, Home, Settings) sits on a cool grey, so its white cards and the Loom's lane heads stand out with firm lines and a soft shadow. The task board sits on white, with pale columns and borderless cards; column titles are quiet, with a coloured dot for the status; the open tab is underlined in vermilion; and type is a step lighter. Every card, Loom cards included, lifts the same way. Edits, locks and In progress are now blue, so vermilion only marks the open file, what needs you and what's live. Errors are crimson, so they no longer look like links. Small grey text, warnings and edits are easier to read, and every text colour now passes WCAG AA. Workspace covers lose their gloss, and the workspace swatches in the sidebar have an edge so you can see them. One person colour moved from rust to indigo, so nobody's lane looks like an alert. In dark mode, counts on vermilion badges are readable now.
 - **Code in the file view is no longer ruled into boxes.** Every line of a file or a merge was drawn as a little card, with a border and a shadow, because it shared a class name with the Loom's cards.
 - **Every wait shows the mark piecing itself together.** Loading files, people, invites, repositories, changes, agents and the rules check, signing in, and updating Quilt now show the mark being pieced together, patch by patch, instead of plain "Loading…" text. With reduced motion turned on, it fades gently instead.
-- **Tell your conversations apart in the Loom.** When someone has several AI conversations going at once, each gets its own piece of the Q, shown on its cards and in a single row in their lane's header. One working right now has its piece run a lap of the Q and come home. Names come from the AI tool itself (the thread names in Claude Code, the chat names in Cursor), and you can rename one with the pencil (on this computer). Click a conversation to follow just it: its name opens out, the Loom shows its latest card and everything else steps back. Click again or press Esc to see everything.
+- **Tell your conversations apart in the Loom.** When someone has several AI conversations going at once, each gets its own piece of the Q, shown on its cards and in a single row in their lane's header. One working right now has its piece run a lap of the Q and come home. Names come from the AI tool itself (the thread names in Claude Code, the chat names in Cursor), and you can rename one with the pencil (on this computer). Click a conversation to follow just it: it moves to the front with its name readable, the others shrink to small marks beside it (or a "+N" in a narrow lane), the Loom shows its latest card and everything else steps back. Click again or press Esc to see everything.
 - **A working AI pieces its lane's quilt.** In the Loom, the needle under a working AI's lane is now a patch being pieced on the lane's thread and sewn down into a Q, slot by slot in that person's colour, the vermilion corner last. Each piece hangs from the end of the thread before it drops in, so the thread no longer runs through the pieces, the quilt or its label. With reduced motion turned on, it shows the finished Q.
-- **Back to the latest in one click.** Scroll up the Loom to read back and a Latest button appears at the bottom; click it to glide back down to what's happening now. If anything new comes in while you're up there, it says New activity instead.
+- **Back to the latest in one click.** Scroll up the Loom to read back and a Latest button appears at the bottom; click it to glide back down to what's happening now. If anything new comes in while you're up there, it says New activity instead. The New activity button in an AI's chat also takes a click anywhere on it now: pressing it slid it sideways, so a click on its arrow missed.
 - **Something live glows like the mark's corner.** The dot that pulses while an AI is working is now the mark's vermilion half-square, and the update bar's dot, the release notes' versions and their bullets use it too.
 - **Crisp at the smallest sizes.** The favicon, menu-bar icon and smallest app icons are drawn pixel by pixel at 16, 24 and 32 px, so they stay sharp instead of blurring. The full design spec is in `brand/SPEC.md`.
 - **heyquilt.com, re-branded to match.** The website moves to ink, vermilion and linen too, in light and dark. The patchwork behind its screenshots is now an ink quilt on the mark's own grid, finished with the vermilion corner, and the screenshots, blog pictures, favicons and link previews all show the new look. Buttons that are working and pages that are loading show the mark piecing itself together, and a missing page shows the mark with a piece gone.

package/bin/quilt.js

@@ -40,9 +40,9 @@ Usage:
                                                       Show unread messages, or read back: the conversation
                                                       with one person, a search, earlier messages
   quilt get <message-id> [dest]                       Download a shared file again
-  quilt git-token                                     Agents: a short-lived GitHub token for this folder's repository,
-                                                      for gh or GitHub's API (GH_TOKEN=$(quilt git-token) gh pr create);
-                                                      git itself signs in through Quilt without it
+  quilt run -- <command> [args...]                    Run a command with the session's secrets: it gets NAME=quilt and
+                                                      NAME's base URL (STRIPE_BASE_URL), and its requests go through
+                                                      Quilt's vault; it never sees a value
   quilt commit-request <message> [--files a,b] [--task id]
                                                       Ask a person to commit for you (when agents may not push here)
   quilt commits                                       Open commit requests and recent commits
@@ -99,6 +99,7 @@ async function main () {
     case 'commits': return commits()
     case 'github': return githubStatusCmd()
     case 'git-token': return gitToken()
+    case 'run': return runCmd()
     case 'git-credential': return gitCredential()
     case 'git-pre-push': return gitPrePush()
     case 'chat': return chat()
@@ -212,11 +213,16 @@ async function apiCmd () {
     github: (await import('../src/api/github-app.js')).appConfig(env),
     // Fly's Machines API for the relay (RELAY_FLY_API_TOKEN, QUILT_RELAY_APP): heavy sessions get a relay machine of their own.
     relayFly: (await import('../src/api/relay-machines.js')).relayFlyFromEnv(env),
+    // The load each shared relay machine stays under, and when the cluster scales down (QUILT_RELAY_TARGET_*, QUILT_RELAY_*; relay-cluster.js TARGETS).
+    relayTargets: (await import('../src/api/relay-cluster.js')).relayTargetsFromEnv(env),
     // Where agents reach this API (invite links point here).
     apiUrl: env.QUILT_API_PUBLIC_URL || (values.memory ? `http://${host}:${port}` : 'https://api.heyquilt.com'),
     siteUrl: env.QUILT_SITE_URL || 'http://localhost:3000',
     trustProxy: /^(1|true|yes)$/i.test(env.QUILT_TRUST_PROXY || ''), log: console.log,
     workspaces: env.QUILT_WORKSPACES === '1' || env.QUILT_WORKSPACES === 'true',
+    // Secrets: the vault (quilt-vault) and the secret it calls this API with; off when not set.
+    vaultSecret: env.QUILT_VAULT_SECRET || '',
+    vaultUrl: env.QUILT_VAULT_URL || 'https://vault.heyquilt.com',
     // People's cloud AI machines (FLY_API_TOKEN, AI_VM_APP, AI_VM_IMAGE, AI_VM_REGION); off when not set.
     fly: (await import('../src/api/fly-machines.js')).flyFromEnv(env),
     fileStore: makeFileStore(
@@ -227,6 +233,7 @@ async function apiCmd () {
   console.log(`quilt accounts API listening on ${api.url}`)
   if (!env.RELAY_API_SECRET) console.log('RELAY_API_SECRET is not set: the relay cannot report sessions for the dashboard')
   if (!env.FLY_API_TOKEN || !env.AI_VM_APP || !env.AI_VM_IMAGE) console.log('FLY_API_TOKEN, AI_VM_APP or AI_VM_IMAGE is not set: people cannot connect a cloud AI')
+  if (!env.QUILT_VAULT_SECRET) console.log('QUILT_VAULT_SECRET is not set: secrets are off')
   const shutdown = async () => { await api.close(); process.exit(0) }
   process.on('SIGINT', shutdown); process.on('SIGTERM', shutdown)
 }
@@ -340,6 +347,7 @@ async function join () {
       prefer: values.prefer === 'local' ? 'local' : 'remote',
       kind: auth.kind,
       passes: auth.passes,
+      apiAuth: auth.apiAuth,
       identity: auth.identity,
       inviteServer: saved.room === conn.room ? saved.inviteServer : undefined,
       onLog: (m) => console.log(`[${stamp()}] ${m}`),
@@ -599,7 +607,12 @@ async function commitRequest () {
 
 // git in an agent's folder runs these (installGitHelpers, gitstate.js); `--dir` is the folder, whose
 // running session answers. They never print anything but what git expects, and never fail a git
-// command when Quilt isn't running: git then behaves as it would without Quilt.
+// command when Quilt isn't running: git then behaves as it would without Quilt. Nor do they make git
+// wait: a session that doesn't answer within HELPER_WAIT is taken as no session, and the whole helper
+// exits by HELPER_LIMIT whatever is still pending (the env overrides are for tests).
+const HELPER_WAIT = Number(process.env.QUILT_HELPER_WAIT_MS) || 4000
+const HELPER_LIMIT = Number(process.env.QUILT_HELPER_LIMIT_MS) || 10000
+function helperDeadline () { setTimeout(() => process.exit(0), HELPER_LIMIT).unref() }
 function helperDir () {
   const i = argv.indexOf('--dir')
   const dir = i >= 0 ? argv[i + 1] : process.cwd()
@@ -611,7 +624,13 @@ async function helperDaemon (dir) {
   const d = findDaemon(dir)
   return d ? { d, call } : null
 }
-const readStdin = () => new Promise((resolve) => { let s = ''; process.stdin.setEncoding('utf8'); process.stdin.on('data', (c) => { s += c }); process.stdin.on('end', () => resolve(s)); process.stdin.on('error', () => resolve(s)) })
+// git closes stdin after what it sends; one that stays open is read for HELPER_WAIT at most.
+const readStdin = () => new Promise((resolve) => {
+  let s = ''
+  const done = () => { clearTimeout(t); process.stdin.pause(); resolve(s) }
+  const t = setTimeout(done, HELPER_WAIT)
+  process.stdin.setEncoding('utf8'); process.stdin.on('data', (c) => { s += c }); process.stdin.on('end', done); process.stdin.on('error', done)
+})
 
 /**
  * git's credential helper protocol: `get` answers with the session's token for the host; store and erase
@@ -624,12 +643,13 @@ async function gitCredential () {
   const fallback = argv.includes('--fallback')
   if (fallback) argv.splice(argv.indexOf('--fallback'), 1)
   if (argv[0] !== 'get') return
+  helperDeadline()
   const input = await readStdin()
   const fields = Object.fromEntries(input.split('\n').filter((l) => l.includes('=')).map((l) => { const i = l.indexOf('='); return [l.slice(0, i), l.slice(i + 1)] }))
   try {
     const h = await helperDaemon(dir)
     if (h) {
-      const r = await h.call(h.d, 'POST', '/git/credential', { host: fields.host || '', protocol: fields.protocol || '' })
+      const r = await h.call(h.d, 'POST', '/git/credential', { host: fields.host || '', protocol: fields.protocol || '' }, { timeoutMs: HELPER_WAIT })
       if (r && r.username && r.password) return process.stdout.write(`username=${r.username}\npassword=${r.password}\n`)
     }
   } catch {}
@@ -642,7 +662,7 @@ async function ownCredential (input) {
   const { execFile } = await import('node:child_process')
   const away = os.tmpdir()
   const out = await new Promise((resolve) => {
-    const c = execFile('git', ['credential', 'fill'], { cwd: away, encoding: 'utf8', timeout: 60000, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '', SSH_ASKPASS: '', GIT_CEILING_DIRECTORIES: path.dirname(away) } }, (err, stdout) => resolve(err ? '' : stdout))
+    const c = execFile('git', ['credential', 'fill'], { cwd: away, encoding: 'utf8', timeout: Math.max(1000, HELPER_LIMIT - HELPER_WAIT - 1000), killSignal: 'SIGKILL', env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '', SSH_ASKPASS: '', GIT_CEILING_DIRECTORIES: path.dirname(away) } }, (err, stdout) => resolve(err ? '' : stdout))
     c.stdin.end(input.endsWith('\n\n') ? input : `${input.replace(/\n*$/, '')}\n\n`)
   })
   const lines = out.split('\n').filter((l) => /^(username|password)=/.test(l))
@@ -653,22 +673,35 @@ async function ownCredential (input) {
 async function gitPrePush () {
   const dir = helperDir()
   const [remote = 'origin'] = argv
+  helperDeadline()
   const input = await readStdin()
   const refs = input.split('\n').filter(Boolean).map((l) => { const [localRef, localSha, remoteRef, remoteSha] = l.trim().split(/\s+/); return { localRef, localSha, remoteRef, remoteSha } })
   try {
     const h = await helperDaemon(dir)
     if (!h) return
-    const r = await h.call(h.d, 'POST', '/git/push-check', { remote, refs })
+    const r = await h.call(h.d, 'POST', '/git/push-check', { remote, refs }, { timeoutMs: HELPER_WAIT })
     if (r && r.ok === false) { process.stderr.write(`Quilt: ${r.why || 'this push is not allowed here'}\n`); process.exitCode = 1 }
   } catch {}
 }
 
 /** A short-lived token for this folder's repository (agents), for gh or GitHub's API. */
+/** `quilt git-token` no longer prints a token (a value in a terminal is a value in an AI's context). */
 async function gitToken () {
-  const { d, call } = await daemonOrFail()
-  const r = await call(d, 'POST', '/git/credential', { host: 'github.com' }).catch((err) => fail(err.message))
-  if (!r || !r.password) fail('No GitHub token for this folder: it needs to be an agent\'s folder in a session that follows a GitHub repository, with GitHub connected (quilt github says).')
-  console.log(r.password)
+  const { GIT_TOKEN_GONE } = await import('../src/secret-run.js')
+  fail(GIT_TOKEN_GONE)
+}
+
+/** `quilt run -- <command>`: the command gets its secrets' stand-ins and gateways (src/secret-run.js). */
+async function runCmd () {
+  const { RUN_USAGE, runSource, runWithSecrets } = await import('../src/secret-run.js')
+  const command = argv[0] === '--' ? argv.slice(1) : argv
+  if (!command.length || (argv[0] !== '--' && ['-h', '--help', 'help'].includes(command[0]))) return console.log(RUN_USAGE)
+  const { findDaemon, call } = await import('../src/control.js')
+  // The session syncing this folder first (its person or agent), else a sandbox's key.
+  const daemon = findDaemon()
+  const source = runSource({ key: daemon ? null : await envKey(), daemon, call })
+  if (!source) fail('quilt run needs a session: run it in a folder Quilt is syncing (quilt join, or the app), or in a sandbox with QUILT_AGENT_KEY.')
+  try { process.exitCode = await runWithSecrets({ command, source }) } catch (err) { fail(err.message) }
 }
 
 async function githubStatusCmd () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "heyquilt",
-  "version": "0.3.90",
+  "version": "0.3.107",
   "description": "Real-time, tool-agnostic pair vibe coding: sync a project folder live between collaborators using any AI coding tool.",
   "author": {
     "name": "Daniel Carmichael",
@@ -13,10 +13,10 @@
     "cowove": "bin/quilt.js"
   },
   "scripts": {
-    "test": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test test/unit/*.test.js test/integration/*.test.js test/e2e/*.test.js",
+    "test": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test --test-timeout=600000 test/unit/*.test.js test/integration/*.test.js test/e2e/*.test.js",
     "test:unit": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test test/unit/*.test.js",
     "test:integration": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test test/integration/*.test.js",
-    "test:e2e": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test test/e2e/*.test.js",
+    "test:e2e": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test --test-timeout=600000 test/e2e/*.test.js",
     "test:stress": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test --test-concurrency=1 test/stress/*.test.js",
     "test:file": "node --disable-warning=ExperimentalWarning --import ./test/helpers/setup.js --test",
     "test:coverage": "node scripts/coverage.mjs",

package/src/account.js

@@ -186,6 +186,34 @@ export async function listAgents ({ token, api = apiUrl(), fetch: fetchImpl = gl
   return r.agents
 }
 
+// Sandbox keys (QUILT_AGENT_KEY) on one of your agents: its Keys table in Settings › Agents.
+const sandbox$ = (id, rest = '') => `/v1/agents/${encodeURIComponent(id)}/sandbox-keys${rest}`
+
+/** An agent's sandbox keys ({ keys, sessions }): never the keys themselves. */
+export async function listSandboxKeys ({ token, id, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
+  const r = await call(fetchImpl, api, 'GET', sandbox$(id), null, token)
+  if (!Array.isArray(r.keys) || !Array.isArray(r.sessions)) throw new Error(BAD_REPLY)
+  return r
+}
+/** A new sandbox key for a session (`session`, its invite link, or `room`, one a key already has): { envKey, key }, shown once. */
+export async function createSandboxKey ({ token, id, name, session, room, sessionName, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
+  const r = await call(fetchImpl, api, 'POST', `/v1/agents/${encodeURIComponent(id)}/env-key`, { name, ...(session ? { session } : { room }), ...(sessionName ? { sessionName } : {}) }, token)
+  if (!r.envKey) throw new Error(BAD_REPLY)
+  return r
+}
+/** Rotate: the same key made again (shown once), the old one revoked. */
+export async function rotateSandboxKey ({ token, id, keyId, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
+  const r = await call(fetchImpl, api, 'POST', sandbox$(id, `/${encodeURIComponent(keyId)}/rotate`), {}, token)
+  if (!r.envKey) throw new Error(BAD_REPLY)
+  return r
+}
+export async function revokeSandboxKey ({ token, id, keyId, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
+  return call(fetchImpl, api, 'POST', sandbox$(id, `/${encodeURIComponent(keyId)}/revoke`), {}, token)
+}
+export async function removeSandboxKey ({ token, id, keyId, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
+  return call(fetchImpl, api, 'DELETE', sandbox$(id, `/${encodeURIComponent(keyId)}`), null, token)
+}
+
 /** This account's GitHub connection (Quilt's GitHub App): { available, connected, login? }. */
 export async function githubStatus ({ token, api = apiUrl(), fetch: fetchImpl = globalThis.fetch }) {
   return call(fetchImpl, api, 'GET', '/v1/me/github', null, token)

package/src/agents/claude-code.js

@@ -36,7 +36,11 @@ export function startClaudeCodeReader ({ dir, chatDir, onEntries, onState, onLog
   const slug = slugFor(chatRoot)
   const files = new Map() // path -> { offset, partial, seen: Set<path> }
   let status = null
-  let lastLineAt = 0
+  // Each conversation mid-turn, by its transcript file, with when it last wrote: the tool is working
+  // while any of them is, so one conversation ending its turn never makes another's edits look like a
+  // person's (they'd go unboxed). A conversation silent for IDLE_AFTER_MS counts as done.
+  const midTurn = new Map()
+  const settle = () => setStatus(midTurn.size ? 'working' : 'idle')
   let stopped = false
   let failed = false
   let first = true
@@ -127,8 +131,10 @@ export function startClaudeCodeReader ({ dir, chatDir, onEntries, onState, onLog
       if (!r) continue
       entries.push(...r.entries)
       if (r.relevant) {
-        lastLineAt = now()
-        if (!backfill) setStatus(r.endTurn ? 'idle' : 'working')
+        if (!backfill) {
+          if (r.endTurn) midTurn.delete(file); else midTurn.set(file, now())
+          settle()
+        }
       }
     }
     return backfill ? entries.slice(-BACKFILL_ENTRIES) : entries
@@ -161,7 +167,8 @@ export function startClaudeCodeReader ({ dir, chatDir, onEntries, onState, onLog
         }
       }
       first = false
-      if (status === 'working' && now() - lastLineAt > IDLE_AFTER_MS) setStatus('idle')
+      for (const [f, at] of midTurn) if (now() - at > IDLE_AFTER_MS) midTurn.delete(f)
+      settle()
       if (out.length) onEntries(out.sort((a, b) => a.ts - b.ts))
     } catch (err) {
       if (!failed) { failed = true; onLog(`Claude Code feed error: ${err.message}`) }

package/src/agents/cursor-transcripts.js

@@ -48,7 +48,11 @@ export function startCursorTranscriptReader ({ dir, onEntries, onState, onLog =
   const root = projectsDir || cursorProjectsDir()
   const files = new Map() // path -> { offset, partial, lineNo }
   let status = null
-  let lastLineAt = 0
+  // Each conversation mid-turn, by its transcript file, with when it last wrote: the tool is working
+  // while any of them is, so one conversation ending its turn never makes another's edits look like a
+  // person's (they'd go unboxed). A conversation silent for IDLE_AFTER_MS counts as done.
+  const midTurn = new Map()
+  const settle = () => setStatus(midTurn.size ? 'working' : 'idle')
   let stopped = false
   let failed = false
   let first = true
@@ -112,8 +116,10 @@ export function startCursorTranscriptReader ({ dir, onEntries, onState, onLog =
       if (!r) continue
       entries.push(...r.entries)
       if (r.relevant) {
-        lastLineAt = now()
-        setStatus(r.endTurn ? 'idle' : 'working')
+        {
+          if (r.endTurn) midTurn.delete(file); else midTurn.set(file, now())
+          settle()
+        }
       }
     }
     return backfill ? entries.slice(-BACKFILL_ENTRIES) : entries
@@ -157,7 +163,8 @@ export function startCursorTranscriptReader ({ dir, onEntries, onState, onLog =
         }
       }
       first = false
-      if (status === 'working' && now() - lastLineAt > IDLE_AFTER_MS) setStatus('idle')
+      for (const [f, at] of midTurn) if (now() - at > IDLE_AFTER_MS) midTurn.delete(f)
+      settle()
       if (out.length) onEntries(out)
     } catch (err) {
       if (!failed) { failed = true; onLog(`Cursor feed error: ${err.message}`) }

package/src/ai-vm-signin.js

@@ -16,9 +16,14 @@ export const SIGN_IN = {
     exe: ['claude'],
     args: ['setup-token'],
     env: {},
-    urlHost: /^(claude\.ai|console\.anthropic\.com)$/,
+    // Claude's sign-in page has moved between hosts (claude.ai, then claude.com/cai/oauth).
+    urlHost: /^((www\.)?claude\.(ai|com)|console\.anthropic\.com)$/,
     needsCode: true,
     token: /sk-ant-oat01-[A-Za-z0-9_-]{20,}/,
+    // A code it can't use: "OAuth error: … Press Enter to retry", and Enter shows a new link.
+    // Its screen is redrawn a few letters at a time, so only fragments are looked for.
+    refused: /rror|status code|retry/i,
+    retry: '\r',
     status: { file: 'claude-token' }
   },
   Codex: {
@@ -55,10 +60,11 @@ export function readSignIn (tool, text) {
   const out = { url: '', code: '', needsCode: false, token: '' }
   if (!t) return out
   const s = plain(text)
+  // The latest link: a sign-in that starts over prints a new one.
   for (const m of s.matchAll(/https:\/\/[^\s"'<>]+/g)) {
     try {
       const u = new URL(m[0].replace(/[).,;]+$/, ''))
-      if (t.urlHost.test(u.hostname)) { out.url = u.href; break }
+      if (t.urlHost.test(u.hostname)) out.url = u.href
     } catch {}
   }
   if (t.code) {
@@ -71,6 +77,12 @@ export function readSignIn (tool, text) {
   return out
 }
 
+/** Whether what a tool printed after a pasted code says it didn't take it. */
+export function codeRefused (tool, text) {
+  const t = SIGN_IN[tool]
+  return !!(t && t.refused && t.refused.test(plain(text)))
+}
+
 /** Where a tool's token is kept on the machine (only Claude Code hands one over). */
 export const tokenFile = (home, tool) => (SIGN_IN[tool]?.status?.file ? path.join(home, '.quilt', 'ai-vm', SIGN_IN[tool].status.file) : null)