jackherd 1.15.0 → 1.15.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 What changed for people who use jackherd, newest first.
 
+## 1.15.2
+
+- **The installer no longer crashes on macOS.** `install.sh` redirected `jh init --global` from `/dev/tty`, which the macOS kqueue that Bun reads input through rejects (`EINVAL: invalid argument, kqueue`) at the first question. It now names the terminal's own device (such as `/dev/ttys003`) first, through `tty` on its input or, since macOS prints `/dev/tty` for `tty </dev/tty`, through `ps`, and reads from that.
+- **An unreadable terminal takes the default.** If the terminal cannot be read during a question, `jh init` prints one note on stderr and takes the default answer instead of stopping with an error.
+
+- **The herd recognises an older herd on macOS.** The herd view found out whether an earlier view of the same terminal was still running by reading `/proc`, which macOS does not have, so it never took one over and two herds could draw into one terminal. It now asks `ps` there and keeps `/proc` on Linux.
+- **Copying env files into a lane works on macOS.** The copy command in the lane setup used `cp --parents` and `grep -z`, which only the GNU tools know. It now uses `git ls-files` with an exclude pattern and `tar`, which keep folders and file modes (an env file stays `600`) with the tools of both systems. Run `jh sync` to get the new text.
+- **Every `ps` call is bounded.** A `ps` that hangs no longer holds up the herd or the watcher.
+- **The installer refuses a bun under a relative `PATH` entry on macOS too.** `install.sh` asked `command -v` for the path, which bash 3.2 (macOS `/bin/sh`) answers with an absolute path even for a relative entry, so the refusal never fired. It now walks `PATH` itself and names the entry as written.
+
+## 1.15.1
+
+- **A test with a variable no longer asks.** The merge guard read the `[` of `[ -f $P ]` as a glob program, so any variable after it could be `gh pr merge` and the guard asked, also for a plain grep. `[` and `[[` now count as the test builtin; a merge after a test, and a program from a variable, still ask.
+- **A draft says when it turns ready.** With `"merge": { "openAsDraft": true }` the pull request rule tells an agent outside `/jh-orchestrate` as well when to run `gh pr ready`: before it hands the pull request to you to merge, or before it waits on the checks that start then for its own `gh pr merge`.
+
 ## 1.15.0
 
 - **Any plan, once it meets the contract.** `docs/plan-contract.md` writes down what Jack needs from a plan: phases with an id, checkbox tasks, a model per phase, and from two phases on a dependency table. `jh plan check <file>` says per part whether it is there, missing or malformed, and exits 0 when the plan meets it. Without a dependency table, phases run one after another, and `jh check --parallel` says so.

package/README.md

@@ -1,9 +1,9 @@
 <p>
-<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.15.0/assets/branding/jackherd-logo-outline.svg" width="340">
+<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.15.2/assets/branding/jackherd-logo-outline.svg" width="340">
 <br>
 </p>
 
-[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg">
+[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
 
 # Jack herds your coding agents.
 
@@ -15,27 +15,27 @@ For developers who'd rather decide than supervise.
 curl -fsSL https://unpkg.com/jackherd/install.sh | sh
 ```
 
-Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg">
+Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
 
 <p>
-<img src="https://unpkg.com/jackherd@1.15.0/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
+<img src="https://unpkg.com/jackherd@1.15.2/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
 <br>
-<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg">
+<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
 </p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Nothing is committed, pushed or merged without your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Nothing is committed, pushed or merged without your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A blocked lane, a red check, a review comment: Jack wakes, and the herd view shows where every lane stands.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A blocked lane, a red check, a review comment: Jack wakes, and the herd view shows where every lane stands.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments go to the lane that fixes them, with a test. <code>/jh-follow</code> brings anything with a CLI or an API into the herd: tickets, error logs, status pages, deploys, and whatever else you point it at.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments go to the lane that fixes them, with a test. <code>/jh-follow</code> brings anything with a CLI or an API into the herd: tickets, error logs, status pages, deploys, and whatever else you point it at.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>Picks up where you left off.</b><br>Plan and board hold the state, not the chat.</p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>Picks up where you left off.</b><br>Plan and board hold the state, not the chat.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.0/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg"></p>
+<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg"></p>
 
 ## Quickstart
 
@@ -71,22 +71,22 @@ Then `/jh-start` in a repository, and Jack offers your first plan. → [Quicksta
    /jh-orchestrate docs/plans/board-<name>/board.md
    ```
 
-By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks. → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg">
+By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks. → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
 
 ## Follow anything outside GitHub
 
 Whatever you check by hand, Jack can watch: tickets, error logs, status pages, deploys. One `/jh-follow`, one yes, and every change comes to you like this:
 
-<img src="https://unpkg.com/jackherd@1.15.0/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
+<img src="https://unpkg.com/jackherd@1.15.2/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
 
-The herd sums up your sources in one `Sources` line: per source its new entries, or when it last ran, red while it fails; opened, a click on an entry opens it. A ticket shows on the lane that works it, and a row in Your turn that came from a source starts with that source's label.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.0/assets/icons/space.svg">
+The herd sums up your sources in one `Sources` line: per source its new entries, or when it last ran, red while it fails; opened, a click on an entry opens it. A ticket shows on the lane that works it, and a row in Your turn that came from a source starts with that source's label.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
 
 ## In detail
 
 <details>
 <summary><b>What Jack does on his own, and what waits for you</b></summary>
 
-<img src="https://unpkg.com/jackherd@1.15.0/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
+<img src="https://unpkg.com/jackherd@1.15.2/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
 
 | On his own | After your approval | Never |
 | --- | --- | --- |
@@ -121,7 +121,7 @@ The guards catch mistakes, not intent; for that, use branch protection. The hook
 
 A **plan** is Markdown with phases, checkbox tasks, a model and a review gate per phase. A **board** lists the lanes of one or more plans: which phases each lane builds, on which model, after what. A **lane** is one agent session in its own git worktree (a second checkout of your repository), and **Jack** is the session in the main checkout that runs `/jh-orchestrate` on a board.
 
-<img src="https://unpkg.com/jackherd@1.15.0/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
+<img src="https://unpkg.com/jackherd@1.15.2/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
 
 | Skill | Does |
 | --- | --- |

package/dist/{chunk-V4HOLGFP.js → chunk-4LUFR7RC.js}

@@ -160,6 +160,23 @@ var classifyStatus = (language, statusText) => {
 var phaseHeading = (language, id, title) => `### ${PLAN_VOCABULARY[language].phase} ${id}: ${title}`;
 var sectionHeading = (language, section) => `## ${PLAN_VOCABULARY[language].sections[section]}`;
 
+// src/plan-format/terminal-text.ts
+var UNSAFE_RANGES = [
+  [0, 31],
+  [127, 159],
+  [1564, 1564],
+  [8206, 8207],
+  [8232, 8233],
+  [8234, 8238],
+  [8294, 8297]
+];
+var escapeCodePoint = (codePoint) => `\\u${codePoint.toString(16).padStart(4, "0")}`;
+var UNSAFE_TERMINAL_TEXT = new RegExp(
+  `[${UNSAFE_RANGES.map(([from, to]) => `${escapeCodePoint(from)}-${escapeCodePoint(to)}`).join("")}]`,
+  "g"
+);
+var terminalSafe = (text) => text.replace(UNSAFE_TERMINAL_TEXT, "");
+
 export {
   PLAN_LANGUAGE,
   LANGUAGE_NAME,
@@ -177,5 +194,6 @@ export {
   PLAN_VOCABULARY,
   classifyStatus,
   phaseHeading,
-  sectionHeading
+  sectionHeading,
+  terminalSafe
 };

package/dist/config.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 
 declare const renderConfigJsonSchema: () => string;
+declare const renderSourcesJsonSchema: () => string;
 
 declare const TERMINAL_ADAPTER: {
     readonly none: "none";
@@ -72,6 +73,8 @@ declare const sourceSchema: z.ZodObject<{
         magenta: "magenta";
     }>>;
     reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    show: z.ZodOptional<z.ZodLiteral<"entries">>;
 }, z.core.$strict>;
 declare const jackherdConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
@@ -113,9 +116,9 @@ declare const jackherdConfigSchema: z.ZodObject<{
         lockFile: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     models: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        review: "review";
         plan: "plan";
         implement: "implement";
-        review: "review";
         explore: "explore";
         orchestrate: "orchestrate";
     }>, z.ZodString>>;
@@ -249,6 +252,8 @@ declare const jackherdConfigSchema: z.ZodObject<{
                 magenta: "magenta";
             }>>;
             reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            show: z.ZodOptional<z.ZodLiteral<"entries">>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
     guard: z.ZodPrefault<z.ZodPipe<z.ZodObject<{
@@ -338,7 +343,47 @@ type JackherdConfig = z.infer<typeof jackherdConfigSchema>;
 declare const parseJackherdConfig: (raw: unknown) => JackherdConfig;
 /** `parseJackherdConfig` for a file: an invalid one throws with `label` (its path) and the issues in words. */
 declare const parseConfigFile: (raw: unknown, label: string) => JackherdConfig;
+/** The personal sources file (`~/.jackherd/sources.json`): the same entries as `watch.sources`. */
+declare const personalSourcesSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    sources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodArray<z.ZodString>;
+        every: z.ZodDefault<z.ZodNumber>;
+        items: z.ZodOptional<z.ZodString>;
+        map: z.ZodObject<{
+            id: z.ZodString;
+            updatedAt: z.ZodOptional<z.ZodString>;
+            title: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+            body: z.ZodOptional<z.ZodString>;
+            author: z.ZodOptional<z.ZodString>;
+            status: z.ZodOptional<z.ZodString>;
+            count: z.ZodOptional<z.ZodString>;
+        }, z.core.$catchall<z.ZodString>>;
+        ignoreAuthors: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        reportLimit: z.ZodDefault<z.ZodNumber>;
+        label: z.ZodOptional<z.ZodString>;
+        lane: z.ZodOptional<z.ZodString>;
+        ticket: z.ZodOptional<z.ZodBoolean>;
+        tone: z.ZodOptional<z.ZodEnum<{
+            amber: "amber";
+            teal: "teal";
+            grey: "grey";
+            red: "red";
+            green: "green";
+            blue: "blue";
+            magenta: "magenta";
+        }>>;
+        reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        show: z.ZodOptional<z.ZodLiteral<"entries">>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+type PersonalSourcesFile = z.infer<typeof personalSourcesSchema>;
+/** The personal sources file as read from JSON; invalid throws with `label` (its path) and the issues in words. */
+declare const parsePersonalSourcesFile: (raw: unknown, label: string) => PersonalSourcesFile;
 /** One `watch.sources` entry outside the config, such as a draft to try; invalid throws with `label` and the issues. */
 declare const parseSourceDraft: (raw: unknown, label: string) => z.infer<typeof sourceSchema>;
 
-export { COMMAND_KEYS, type CommandKey, DEFAULT_CONTEXT_WINDOW, DEFAULT_MODELS, DEFAULT_SKILL_PREFIX, type JackherdConfig, KIT_CORE, MODEL_ROLE, type ModelRole, SKILL_PREFIX, TERMINAL_ADAPTER, type TerminalAdapter, isModelRole, isTerminalAdapter, jackherdConfigSchema, parseConfigFile, parseJackherdConfig, parseSourceDraft, renderConfigJsonSchema };
+export { COMMAND_KEYS, type CommandKey, DEFAULT_CONTEXT_WINDOW, DEFAULT_MODELS, DEFAULT_SKILL_PREFIX, type JackherdConfig, KIT_CORE, MODEL_ROLE, type ModelRole, type PersonalSourcesFile, SKILL_PREFIX, TERMINAL_ADAPTER, type TerminalAdapter, isModelRole, isTerminalAdapter, jackherdConfigSchema, parseConfigFile, parseJackherdConfig, parsePersonalSourcesFile, parseSourceDraft, personalSourcesSchema, renderConfigJsonSchema, renderSourcesJsonSchema };

package/dist/config.js

@@ -1,7 +1,7 @@
 import {
   PLAN_LANGUAGE,
   RESPONSE_ADDRESS
-} from "./chunk-V4HOLGFP.js";
+} from "./chunk-4LUFR7RC.js";
 
 // src/config/json-schema.ts
 import { z as z3 } from "zod";
@@ -112,6 +112,15 @@ var SKILL_PATH = new RegExp(`^${SKILLS_DIRECTORY}/([^/]+)/(.+)$`);
 var AGENT_PATH = new RegExp(`^${AGENTS_DIRECTORY}/([^/]+)\\.md$`);
 var claudePath = (...segments) => [CLAUDE_DIRECTORY, ...segments].join("/");
 
+// src/version/release.ts
+var CLI_NAME = "jh";
+
+// src/secrets/options.ts
+var SECRET_NAME = /^[A-Z][A-Z0-9_]*$/;
+var SECRET_USAGE = `Usage: ${CLI_NAME} secret set <NAME>     store a value in the keychain, typed hidden in a terminal
+       ${CLI_NAME} secret list           the names the sources need, set or missing, never a value
+       ${CLI_NAME} secret delete <NAME>  remove the value from the keychain`;
+
 // src/watch/source-fields.ts
 var SOURCE_FIELD = {
   id: "id",
@@ -141,6 +150,38 @@ var pathSteps = (path) => {
 };
 var isSourcePath = (path) => pathSteps(path) !== null;
 
+// src/watch/sources.ts
+import { createHash } from "crypto";
+
+// src/watch/feedback-item.ts
+var FEEDBACK_FORM = { review: "review", inline: "inline", comment: "comment" };
+
+// src/watch/no-finding.ts
+var ROUND_WINDOW_MS = 5 * 6e4;
+
+// src/watch/pull-requests.ts
+var WATCHED_PULL_REQUEST_FIELDS = "number,title,url,headRefName,isDraft,state,headRefOid,mergeCommit";
+var OPEN_PULL_REQUEST_FIELDS = `${WATCHED_PULL_REQUEST_FIELDS},statusCheckRollup,files`;
+
+// src/watch/feedback.ts
+var REVIEW_STATE = {
+  approved: "APPROVED",
+  changesRequested: "CHANGES_REQUESTED",
+  commented: "COMMENTED",
+  dismissed: "DISMISSED"
+};
+var DECISIVE_REVIEW_STATES = [
+  REVIEW_STATE.approved,
+  REVIEW_STATE.changesRequested,
+  REVIEW_STATE.dismissed
+];
+
+// src/watch/previews.ts
+var PREVIEW_SOURCE = { deployment: "deployment", comment: FEEDBACK_FORM.comment };
+
+// src/watch/sources.ts
+var SOURCE_SHOW = { entries: "entries" };
+
 // src/watch/watch-defaults.ts
 var CLEAN_REVIEW_TEXT = "## Code review\n\nNo issues found. Checked for bugs and CLAUDE.md compliance.";
 var BUN_FAILED_TEST_PATTERN = "^\\(fail\\) (.+?)(?: \\[[\\d.]+m?s\\])?$";
@@ -434,13 +475,23 @@ var sourceSchema = z2.strictObject({
    * The mapped fields whose change reports, with the old and the new value, in place of the content of `title`,
    * `author`, `body` and `url`; without it a change of that content reports.
    */
-  reportOn: z2.array(z2.string().min(1)).min(1).max(10).optional()
+  reportOn: z2.array(z2.string().min(1)).min(1).max(10).optional(),
+  /**
+   * Names of secrets the command needs, handed to it as environment variables of the same name; each is looked up
+   * in the keychain, then in the watcher's environment.
+   */
+  secrets: z2.array(z2.string().regex(SECRET_NAME, "capital letters, digits and `_`, starting with a letter")).max(10).refine((names) => new Set(names).size === names.length, "secret names must be unique").optional(),
+  /** `entries` shows the source's entries open, in a herd block of its own; not for a ticket source, whose entries are badges. */
+  show: z2.literal(SOURCE_SHOW.entries).optional()
 }).refine(canChange, {
   message: "map needs updatedAt, a content field (title, author, body, url) or reportOn",
   path: ["map"]
 }).refine((source) => source.ignoreAuthors.length === 0 || source.map.author !== void 0, {
   message: "ignoreAuthors needs map.author",
   path: ["ignoreAuthors"]
+}).refine((source) => source.show === void 0 || source.ticket !== true, {
+  message: "show cannot be set on a ticket source",
+  path: ["show"]
 }).refine((source) => !source.reportOn?.includes(SOURCE_FIELD.id), {
   message: "reportOn cannot name id",
   path: ["reportOn"]
@@ -648,11 +699,18 @@ ${z2.prettifyError(parsed.error)}`);
   return parsed.data;
 };
 var parseConfigFile = (raw, label) => parseLabelled(jackherdConfigSchema, raw, label);
+var personalSourcesSchema = z2.strictObject({
+  $schema: z2.string().optional(),
+  sources: z2.array(sourceSchema).refine(hasUniqueNames, "source names must be unique").default([])
+});
+var parsePersonalSourcesFile = (raw, label) => parseLabelled(personalSourcesSchema, raw, label);
 var parseSourceDraft = (raw, label) => parseLabelled(sourceSchema, raw, label);
 
 // src/config/json-schema.ts
-var renderConfigJsonSchema = () => `${JSON.stringify(z3.toJSONSchema(jackherdConfigSchema, { io: "input" }), null, 2)}
+var renderJsonSchema = (schema) => `${JSON.stringify(z3.toJSONSchema(schema, { io: "input" }), null, 2)}
 `;
+var renderConfigJsonSchema = () => renderJsonSchema(jackherdConfigSchema);
+var renderSourcesJsonSchema = () => renderJsonSchema(personalSourcesSchema);
 export {
   COMMAND_KEYS,
   DEFAULT_CONTEXT_WINDOW,
@@ -667,6 +725,9 @@ export {
   jackherdConfigSchema,
   parseConfigFile,
   parseJackherdConfig,
+  parsePersonalSourcesFile,
   parseSourceDraft,
-  renderConfigJsonSchema
+  personalSourcesSchema,
+  renderConfigJsonSchema,
+  renderSourcesJsonSchema
 };

package/dist/plan-format.js

@@ -15,29 +15,13 @@ import {
   classifyStatus,
   isPlanLanguage,
   phaseHeading,
-  sectionHeading
-} from "./chunk-V4HOLGFP.js";
+  sectionHeading,
+  terminalSafe
+} from "./chunk-4LUFR7RC.js";
 
 // src/plan-format/lanes.ts
 import { posix } from "path";
 
-// src/plan-format/terminal-text.ts
-var UNSAFE_RANGES = [
-  [0, 31],
-  [127, 159],
-  [1564, 1564],
-  [8206, 8207],
-  [8232, 8233],
-  [8234, 8238],
-  [8294, 8297]
-];
-var escapeCodePoint = (codePoint) => `\\u${codePoint.toString(16).padStart(4, "0")}`;
-var UNSAFE_TERMINAL_TEXT = new RegExp(
-  `[${UNSAFE_RANGES.map(([from, to]) => `${escapeCodePoint(from)}-${escapeCodePoint(to)}`).join("")}]`,
-  "g"
-);
-var terminalSafe = (text) => text.replace(UNSAFE_TERMINAL_TEXT, "");
-
 // src/plan-format/markdown.ts
 var SECTION_END = /^##\s/;
 var TABLE_SEPARATOR = /^\|[\s|:-]+\|$/;

package/herdr-plugin/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "crossdelta.jackherd"
 name = "jackherd"
-version = "1.15.0"
+version = "1.15.2"
 min_herdr_version = "0.8.2"
 description = "Show the herd, the state of a board's lanes, in a herdr pane"
 platforms = ["linux", "macos"]

package/install.sh

@@ -9,11 +9,14 @@ set -eu
 
 # The default is the version this file ships with. The release bump changes it together with
 # package.json; install.test.ts fails while the two differ. Overridable, but only by a plain release.
-JACKHERD_VERSION="${JACKHERD_VERSION:-1.15.0}"
+JACKHERD_VERSION="${JACKHERD_VERSION:-1.15.2}"
 
 JACKHERD_PACKAGE='jackherd'
 # Test seam: the terminal the wizard asks its questions on.
 JACKHERD_TEST_TTY="${JACKHERD_TEST_TTY:-/dev/tty}"
+# Test seam: a packed tarball (absolute path) installed instead of the published package, so CI can prove a build
+# before it is released. Unset in every real run.
+JACKHERD_TEST_PACKAGE="${JACKHERD_TEST_PACKAGE:-}"
 BUN_INSTALLER_URL='https://bun.com/install'
 BUN_MIN_MAJOR=1
 BUN_MIN_MINOR=3
@@ -55,10 +58,29 @@ bun_bin_dir() {
   printf '%s/bin\n' "${BUN_INSTALL:-$HOME/.bun}"
 }
 
+# The first executable bun along PATH, spelled the way PATH names it. Walked here and not asked of
+# 'command -v', which some shells (bash 3.2 as sh on macOS) answer with an absolute path even for a
+# relative entry, so the check for a relative one in main would never fire. An empty entry means the
+# current directory and counts as relative.
+bun_on_path() {
+  rest="$PATH:"
+  while [ -n "$rest" ]; do
+    entry=${rest%%:*}
+    rest=${rest#*:}
+    [ -n "$entry" ] || entry=.
+    if [ -f "$entry/bun" ] && [ -x "$entry/bun" ]; then
+      printf '%s/bun\n' "$entry"
+      return 0
+    fi
+  done
+  return 1
+}
+
 # The bun on PATH, else the one the official installer leaves in ~/.bun/bin; empty when there is none.
 find_bun() {
-  if command -v bun >/dev/null 2>&1; then
-    command -v bun
+  found=$(bun_on_path) || found=''
+  if [ -n "$found" ]; then
+    printf '%s\n' "$found"
   elif [ -x "$(bun_bin_dir)/bun" ]; then
     printf '%s\n' "$(bun_bin_dir)/bun"
   fi
@@ -111,10 +133,32 @@ terminal_available() {
   (: <"$JACKHERD_TEST_TTY") 2>/dev/null
 }
 
+# The controlling terminal's own device node, else the path as given. macOS kqueue, which Bun reads stdin through,
+# rejects /dev/tty with EINVAL but accepts the real device (/dev/ttys003). On macOS 'tty </dev/tty' prints
+# /dev/tty itself, so the device comes from 'tty' on the inherited stdin when that is a terminal, else from the
+# shell's own TTY column of 'ps' (ttys003 on macOS, pts/3 on Linux; ? or ?? when there is none).
+terminal_device() {
+  device=$(tty 2>/dev/null) || device=''
+  if [ "$device" = /dev/tty ] || [ ! -c "$device" ]; then
+    name=$(ps -o tty= -p $$ 2>/dev/null) || name=''
+    # shellcheck disable=SC2086 # word splitting trims the padding ps puts around the column
+    set -- $name
+    case ${1:-} in
+      '' | '?' | '??') device='' ;;
+      *) device="/dev/$1" ;;
+    esac
+  fi
+  if [ -c "$device" ] && [ "$device" != /dev/tty ]; then
+    printf '%s\n' "$device"
+  else
+    printf '%s\n' "$JACKHERD_TEST_TTY"
+  fi
+}
+
 run_setup() {
   if terminal_available; then
     say "starting the setup: jh init --global"
-    "$1" init --global <"$JACKHERD_TEST_TTY" || fail "jh init --global failed"
+    "$1" init --global <"$(terminal_device)" || fail "jh init --global failed"
   else
     say "no terminal to ask questions on, setting up with the defaults: jh init --global --yes"
     "$1" init --global --yes </dev/null || fail "jh init --global --yes failed"
@@ -145,6 +189,7 @@ main() {
   export PATH
 
   spec="$JACKHERD_PACKAGE@$JACKHERD_VERSION"
+  [ -z "$JACKHERD_TEST_PACKAGE" ] || spec="$JACKHERD_TEST_PACKAGE"
   say "installing $spec: bun add -g --ignore-scripts $spec"
   "$bun" add -g --ignore-scripts "$spec" || fail "bun add -g failed"
 

package/kit/hooks/hooks/merge-guard/decision.ts

@@ -194,6 +194,8 @@ const UP_TO_LAST_EXPANSION = /^[\s\S]*\$(\{[^}]*\}|\w+)?/
 /** A file name with nothing the shell expands: no brace, glob, quote or closing brace of a default value. */
 const PLAIN_FILE_NAME = /^[\w.+-]+$/
 const ENV = 'env'
+/** The test builtin's brackets: as a program word they name `test`, not a glob pattern. */
+const TEST_BRACKETS = new Set(['[', '[['])
 
 /** A word that is nothing but expansions: it may become any number of words, options among them. */
 const isOpaque = ({ value }: Word): boolean => isExpanded(value) && value.replace(EXPANSION_IN_VALUE, '') === ''
@@ -374,7 +376,7 @@ const isExpandedProgram = (words: SimpleCommand, index: number): boolean => {
   return (
     !isOptionNamingNoProgram(words, index) &&
     !hasFixedName(word) &&
-    (isExpanded(word.value) || (word.literal && GLOB.test(word.value)))
+    (isExpanded(word.value) || (word.literal && GLOB.test(word.value) && !TEST_BRACKETS.has(word.value)))
   )
 }
 

package/kit/rules/rules/kit/pull-requests.md

@@ -8,7 +8,7 @@ How an agent opens a pull request so every PR reads consistently and is review-
 - **Base = `{{kit.baseBranch}}`** unless the user names another.
 - **Work on a branch.** If the working branch is `{{kit.baseBranch}}`, branch first.
 - **Push before creating, with the user's go-ahead for the push.** The head branch must be on the remote so `gh pr create` has a target.
-- **Drafts:** Opening as a draft is **{{kit.merge.openAsDraft}}** (`merge.openAsDraft`); `on` opens every PR with `gh pr create --draft`; you turn it ready (`gh pr ready <n>`) once it goes to merge.
+- **Drafts** (`merge.openAsDraft`: **{{kit.merge.openAsDraft}}**). When `on`, open every PR with `gh pr create --draft`; run `gh pr ready <n>` before handing it to the user to merge, or before waiting on its checks for your own `gh pr merge`.
 - **Check for an existing PR first** (`gh pr view <branch>`). If a prior PR for the same branch is already **merged**, the new one is a continuation — mark it in the title.
 
 ## Title

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jackherd",
-  "version": "1.15.0",
+  "version": "1.15.2",
   "keywords": [
     "claude-code",
     "coding-agents",

package/schemas/jackherd.schema.json

@@ -633,6 +633,18 @@
                   "type": "string",
                   "minLength": 1
                 }
+              },
+              "secrets": {
+                "maxItems": 10,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "pattern": "^[A-Z][A-Z0-9_]*$"
+                }
+              },
+              "show": {
+                "type": "string",
+                "const": "entries"
               }
             },
             "required": [