jackherd 1.15.2 → 1.17.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 What changed for people who use jackherd, newest first.
 
+## 1.17.0
+
+- **Jack resumes after a crash.** After a machine or herdr crash, herdr restored the agents but nobody restarted the watcher, and every lane whose command was cut off stood still. The watcher now keeps a record in `~/.jackherd/resume/`, and a second `[[startup]]` entry of the herdr plugin runs `jh resume`: it wakes the coordinator with a fixed `/orchestrate` line and every lane that was working with a fixed resume text, at most once per crash. Nothing resumes after a clean stop, for a record older than 12 hours, while a watcher runs, or when a target is ambiguous; `~/.jackherd/logs/resume.log` says why.
+- **The herd finds its coordinator after a herdr restart.** `herd --ensure` ended with 0 when it found no coordinator, and with several unnamed agents in the main checkout it found none. It now exits with 3 in that case, the startup hook keeps waiting for exactly those repositories, and the coordinator is the one agent whose tab holds a pane labelled `herd`.
+- **A failed source says why.** A source's command may print one stdout line `jackherd-reason: <reason>`; the watcher shows the last such line as `exit 1: <reason>`, with the values of the source's `secrets`, URL credentials and URL query values masked, control characters dropped and the text cut to 160 characters. stderr is still never read. The recipe scripts print such a line for a missing variable, an HTTP status or a failed tool call.
+- **A personal source can name its repositories.** `"repos": ["owner/name"]` (one to twenty) in `~/.jackherd/sources.json` runs the source only where the main checkout's `origin` names one of them; elsewhere the watcher notes `<name>: not for this repo`, or `<name>: no origin`. `jh watch source <name> --dry-run` of a left-out source prints the note and exits 2, and `jh secret list` still names its secrets. The repository's own config refuses `repos`.
+- **`deploy`, `feedback`, `previews` and `checks` change without a restart.** The watcher reads them again with the sources. A change that applies prints `config reloaded: <parts>`; an invalid or deleted config keeps every value and says `config not reloaded: <file>: <reason>` once. A part switched on starts from a baseline, so only what happens after the reload is reported.
+- **Writing SQL against stage under a standing approval.** With `guard.approvals.standing.tools` naming an SQL tool as `stage` (production, any other target and any name saying `prod` are refused), a single insert, update or delete passes without a dialog while you approved the environment (at most 24 hours) and Jack marked that exact call checked with `jh approval checked <id> <hash>`. Each pass leaves a line in the board's history with the lane, the kind of statement and its first table, never a value. A select, a schema change or several statements still ask you. `jh approval show` prints a held call for Jack's reading.
+- **A question without its recommendation is sent back.** The first option of a dialog must end in `(recommended)` (`(Empfohlen)` in German); a single choice marks exactly one option, a multi-select marks its first and may mark more. A question that offers a label a guard reads word for word, such as the self-merge or standing approval, needs no mark and must not carry one.
+- **The coordinator's rules are checked in code.** A dialog needs the paw in its header chip, at most 15 words in the question and 5 in a label; `lane-start-guard` refuses `herdr agent start <lane>` from the main checkout while no board row names the lane; `jh lane send` sends the prompt once and tells a stalled lane from a working one; `jh lane base <plan>` prints the base ref; `jh plan check` prints a `base:` line and exits 3 for a plan missing on the base branch; after `merged #n` the watcher names the checks each rebasing lane runs.
+- **The merge guard closes four more ways around it.** A merge through `gh api graphql` or `curl` against the GitHub API asks; a self-merge approval is bound to the change you saw (the patch id), so a push after the answer asks again, and a pull request that changes the guard itself always asks; `herdr agent send-keys` and `prompt` into the coordinator ask. `herdr pane send-text` and `send-keys` always ask, and `herdr pane run` passes only into a plain pane that is not the herd, with a single-line text. The README says what the guards are: they catch mistakes, not intent.
+- **`jh check` fails on open boxes of the phase a lane builds.** The phase comes from the lane's board row; `check.openBoxes` is `fail` (default), `warn` or `off`. A row marked `(Teil)` is left alone. After `merged #<n>` the watcher says once when a phase merged with open boxes.
+- **`jh context --usage` counts a lane's tokens.** `jh context --usage [--since 24h|7d|<date>] [<name>] [--coordinator]` prints the input, cache and output tokens of a lane's sessions and subagents as one line of JSON.
+- **A half-closed lane closes.** `jh lane close --branch <name>` finishes a lane whose worktree is already gone, and a detached worktree closes when the base branch holds its head. `jh lane space [--min-gb <n>]` refuses a new lane below `lanes.minFreeGb` free disk space (5 GB by default).
+- **Board lines are written at once and reach `main` bundled.** History lines, waiting rows and appointments go into the main checkout's board immediately, where the herd reads them, and travel to the base with the next documentation pull request instead of one of their own. The herd also drops a closed lane without waiting for that merge.
+- **A shorter orchestrate skill.** Rules that only some wake-ups need moved into references, and the watcher appends `· read <skill>/references/<file>` to the event that needs one. Word budgets are targets with ceilings that may only fall, and `jh check` prints `over target` hints. Run `jh sync` to get the new texts.
+- **Fewer false alarms from the watcher.** "Keine Rückfragen." no longer counts as a question, the model alarm measures against the row of the phase the lane works on, and a phase whose box stayed open after its merge is not reported as ready.
+- **The herd draws more calmly.** A source's entries block has a head with a count that folds, a resting lane's badge keeps its padding until the name would be cut, and exactly one line per working lane shimmers: its activity line, else its running task, else its first subagent line.
+- **`jh check` warns on rules that belong in your linter.** A rule block you added or changed in `**/rules/**/*.md`, `CLAUDE.md` or `AGENTS.md` that carries a banned import path, a literal comparison, a comment form or a banned call, and names no lint rule, shows as `Lint pointers`. Name the rule with `` `lint:<rule id>` ``, or write `` `lint:none` `` and a reason where it stays prose. `check.lintPointers.level` is `warn` (default), `fail` or `off`; `check.lintPointers.exclude` lists globs never read. Files `jh sync` installed are not read.
+- **The kit asks for the linter first.** `/jh-plan` asks of every rule it writes whether your linter can check it, `skill-review` has a seventh lens for rules that could be lint rules, and the kit's code style rule shrinks by about eighty words. Run `jh sync` to get the new texts.
+- **macOS and Linux.** The system requirements are written down in INSTALL.md, and the orchestrate reference names the macOS form of the working-directory check.
+
+## 1.16.0
+
+- **Sources of your own.** A source that belongs to you alone, such as your calendar, goes into `~/.jackherd/sources.json` instead of the repository's config: same shape as `watch.sources`. Its command runs in `~/.jackherd/`, not in the repository, in every repository where you start the watcher, and for nobody else. The watcher, the herd and `jh watch source <name> --dry-run` take it up after the repository's sources. If the repository has a source of the same name, the repository's wins and yours is skipped with a note. A broken personal file never stops the watcher. The file has a JSON schema, `schemas/sources.schema.json`.
+- **Secrets in the keychain: `jh secret`.** A source lists the variables it needs in its `"secrets"` field. `jh secret set <NAME>` asks for the value hidden, from a terminal only, and keeps it in the system keychain; `jh secret list` shows which names your sources need and whether each is set, never a value; `jh secret delete <NAME>` removes one. A repository source, which anyone with a commit can change, gets only the watcher's environment, never a keychain value. A value reaches the environment of its source's command and nowhere else: no argument, output, state or log. A missing one fails the run with `secret missing: <NAME>` before the command starts.
+- **Sources change without a restart.** The watcher reads the repository's config and your personal file again when one of them changed; a new source runs at once, a removed one stops. A changed file that does not read keeps the sources as they were and says so once. The herd takes the sources from the running watcher, so a new one shows there too without restarting either.
+- **Entries in a block of their own.** `"show": "entries"` opens a source's entries in a block under "Your turn", headed by its label, in its colour and linked where an entry has an address. Together such blocks show at most five rows, at least one per block, and `+<n>` opens the rest of a block. The source's status stays in the `Sources` line.
+- **`/jh-follow` asks where a source belongs.** It asks whether the source is yours or the repository's and writes exactly that file. For a personal source with a secret, you set the value with `jh secret set` in a terminal of your own; the skill then checks it with `jh secret list` and dry-runs the source by name.
+- **A recipe for today's appointments.** The Google Calendar recipe shows the day's appointments of one or more calendars from their secret iCal addresses, kept in the keychain, recurring events included, each linked to the calendar's day view. No Google login and no API project. A failed request prints nothing of the address.
+- **`[done]` hides its row at once.** A click on `[done]` in "Your turn" removes the row right away instead of at the next read; if the write fails, the row stays and the footer says why.
+- **A cut activity line opens on a click.** The `↳` line of a working lane or subagent that did not fit unfolds when you click it.
+- **The merge guard says why it asks.** An approved merge passes without a question only as a plain `gh pr merge <n>` standing alone. When it asks anyway, the question now says why: run a chained or piped merge alone, and a merge with other flags is let through only in its plain form.
+
 ## 1.15.2
 
 - **The installer no longer crashes on macOS.** `install.sh` redirected `jh init --global` from `/dev/tty`, which the macOS kqueue that Bun reads input through rejects (`EINVAL: invalid argument, kqueue`) at the first question. It now names the terminal's own device (such as `/dev/ttys003`) first, through `tty` on its input or, since macOS prints `/dev/tty` for `tty </dev/tty`, through `ps`, and reads from that.

package/INSTALL.md

@@ -19,6 +19,7 @@ If the user wants the kit in the repository, shared with the team, run `bunx jac
 
 ## Requirements
 
+- Linux or macOS; on Windows, through WSL. `git`, `sh`, `ps` and `tty` must be there: both systems bring them.
 - [Bun](https://bun.sh) 1.3 or later, and Claude Code.
 - Optional: [herdr](https://herdr.dev) for parallel lanes (`/jh-orchestrate`, the watcher, agent states and context fill in the herd), and `gh` for pull requests and checks in the herd and the watcher.
 
@@ -54,7 +55,7 @@ When `init` creates a new config, it asks:
 | Use it when | the team shares the kit through the repository | the repository must stay untouched, not even untracked files |
 | Lives in | the project's `.claude/` | `~/.claude/` |
 | Skill names | `/plan`, `/implement`, `/orchestrate`, … | `/jh-plan`, `/jh-implement`, `/jh-orchestrate`, … |
-| Hooks | `git-guard`, `watch-guard`, `merge-guard`, `approval-gate`, `model-gate`, `model-log`, `ask-hint`, `open-question`, `plain-question`, `sent-file`, `format-on-edit` | none; `init --global` offers only a `SessionStart` update notice |
+| Hooks | `git-guard`, `watch-guard`, `lane-start-guard`, `merge-guard`, `approval-gate`, `model-gate`, `model-log`, `ask-hint`, `open-question`, `plain-question`, `sent-file`, `format-on-edit` | none; `init --global` offers only a `SessionStart` update notice |
 | Config | `.jackherd/config.json` | `~/.jackherd/config.json`, used where a repository has none |
 | Update | `jh sync` | `jh update` |
 

package/README.md

@@ -1,9 +1,9 @@
 <p>
-<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.15.2/assets/branding/jackherd-logo-outline.svg" width="340">
+<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.17.0/assets/branding/jackherd-logo-outline.svg" width="340">
 <br>
 </p>
 
-[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
+[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies) [![macOS](https://img.shields.io/badge/macOS-supported-brightgreen?logo=apple)](https://unpkg.com/jackherd/INSTALL.md) [![Linux](https://img.shields.io/badge/Linux-supported-brightgreen?logo=linux&logoColor=white)](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg">
 
 # Jack herds your coding agents.
 
@@ -15,31 +15,31 @@ For developers who'd rather decide than supervise.
 curl -fsSL https://unpkg.com/jackherd/install.sh | sh
 ```
 
-Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
+Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg">
 
 <p>
-<img src="https://unpkg.com/jackherd@1.15.2/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
+<img src="https://unpkg.com/jackherd@1.17.0/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
 <br>
-<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
+<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg">
 </p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Nothing is committed, pushed or merged without your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Commits, pushes and merges wait for your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours. The guards catch mistakes, not intent; a hard boundary takes branch protection.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A blocked lane, a red check, a review comment: Jack wakes, and the herd view shows where every lane stands.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A blocked lane, a red check, a review comment: Jack wakes, and the herd view shows where every lane stands.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments go to the lane that fixes them, with a test. <code>/jh-follow</code> brings anything with a CLI or an API into the herd: tickets, error logs, status pages, deploys, and whatever else you point it at.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments go to the lane that fixes them, with a test. <code>/jh-follow</code> brings anything with a CLI or an API into the herd: tickets, error logs, status pages, deploys, and whatever else you point it at.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>Picks up where you left off.</b><br>Plan and board hold the state, not the chat.</p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>Picks up where you left off.</b><br>Plan and board hold the state, not the chat.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.15.2/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg"></p>
+<p><img src="https://unpkg.com/jackherd@1.17.0/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg"></p>
 
 ## Quickstart
 
-1. **Install** (Linux and macOS; needs Claude Code and git). → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)
+1. **Install** (needs Claude Code and git). → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)
 
    ```bash
    curl -fsSL https://unpkg.com/jackherd/install.sh | sh
@@ -71,22 +71,22 @@ Then `/jh-start` in a repository, and Jack offers your first plan. → [Quicksta
    /jh-orchestrate docs/plans/board-<name>/board.md
    ```
 
-By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks. → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
+Linux and macOS are supported (Windows through WSL); the requirements are in [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md). By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks. → [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg">
 
 ## Follow anything outside GitHub
 
 Whatever you check by hand, Jack can watch: tickets, error logs, status pages, deploys. One `/jh-follow`, one yes, and every change comes to you like this:
 
-<img src="https://unpkg.com/jackherd@1.15.2/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
+<img src="https://unpkg.com/jackherd@1.17.0/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
 
-The herd sums up your sources in one `Sources` line: per source its new entries, or when it last ran, red while it fails; opened, a click on an entry opens it. A ticket shows on the lane that works it, and a row in Your turn that came from a source starts with that source's label.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.15.2/assets/icons/space.svg">
+The herd sums up your sources in one `Sources` line: per source its new entries, or when it last ran, red while it fails; opened, a click on an entry opens it. A ticket shows on the lane that works it, and a row in Your turn that came from a source starts with that source's label.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.17.0/assets/icons/space.svg">
 
 ## In detail
 
 <details>
 <summary><b>What Jack does on his own, and what waits for you</b></summary>
 
-<img src="https://unpkg.com/jackherd@1.15.2/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
+<img src="https://unpkg.com/jackherd@1.17.0/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
 
 | On his own | After your approval | Never |
 | --- | --- | --- |
@@ -108,7 +108,7 @@ A project install adds two hooks to Claude Code's [permission rules](https://cod
 
 `jh sync` also adds ask rules for check reruns and `gh api` writes.
 
-A merge passes without a question on green checks after self-merge, or under a standing approval: one plan's lanes until a time you pick, at most 24 hours; workflows, migrations, env files and the guards' own files still ask. A pull request whose files all match `merge.withoutChecks`, such as docs only, skips question and checks, unless a file lies on a path that always asks.
+A merge passes without a question on green checks after self-merge, or under a standing approval: one plan's lanes until a time you pick, at most 24 hours; workflows, migrations, env files and the guards' own files still ask. A write against stage works the same way: with `guard.approvals.standing.tools` naming an SQL tool as `stage` (never production), you approve the environment for up to 24 hours, Jack reads each statement and marks it checked with `jh approval checked`, and a single insert, update or delete then runs without a dialog, leaving a line in the board's history that names the table but no value. A select, a schema change or several statements still ask you. A pull request whose files all match `merge.withoutChecks`, such as docs only, skips question and checks, unless a file lies on a path that always asks.
 
 `"merge": { "openAsDraft": true }` has lanes open every pull request as a draft, so pushes while it is worked on start no workflow that skips drafts; Jack runs `gh pr ready` before the merge. The guard never merges a draft, and a check in `guard.requiredChecks` counts only with a run that succeeded, not with the skipped run a draft leaves behind; without that list, at least one run must have succeeded.
 
@@ -121,7 +121,7 @@ The guards catch mistakes, not intent; for that, use branch protection. The hook
 
 A **plan** is Markdown with phases, checkbox tasks, a model and a review gate per phase. A **board** lists the lanes of one or more plans: which phases each lane builds, on which model, after what. A **lane** is one agent session in its own git worktree (a second checkout of your repository), and **Jack** is the session in the main checkout that runs `/jh-orchestrate` on a board.
 
-<img src="https://unpkg.com/jackherd@1.15.2/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
+<img src="https://unpkg.com/jackherd@1.17.0/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
 
 | Skill | Does |
 | --- | --- |
@@ -203,7 +203,9 @@ How the herd reads the board:
 
 Jack doesn't watch the terminals himself. `jh watch`, which he starts, wakes him when a lane is blocked or done, a check turns red, a pull request gets feedback, a lane's context fills up, a lane waits for an approval or works for ten minutes without reporting its task; deploys and previews too, when configured.
 
-`/jh-follow PROJ-123` adds anything a command can print as JSON: a ticket, an issue, error logs, a status page. It checks the tool and its login, shows you a dry run and writes the source to `watch.sources` after your yes. A token stays in the environment, read by a small Bun script, never in an argument. Each source runs on its own interval, kept across a restart of the watcher. Recipes for Jira, Linear, GitHub issues and Projects, Sentry and status pages come with it. The reports need herdr; a source can be set up and dry-run without it.
+`/jh-follow PROJ-123` adds anything a command can print as JSON: a ticket, an issue, error logs, a status page. It checks the tool and its login, shows you a dry run and writes the source to `watch.sources` after your yes. A token stays in the environment, read by a small Bun script, never in an argument. Each source runs on its own interval, kept across a restart of the watcher. Recipes for Jira, Linear, GitHub issues and Projects, Sentry, status pages and today's Google Calendar appointments come with it. The reports need herdr; a source can be set up and dry-run without it.
+
+A source that is yours alone, such as your calendar, goes into `~/.jackherd/sources.json` instead: it runs for nobody else, in every repository where you start the watcher, or only in the ones its `repos` list (`owner/name`) names. Its secrets live in the system keychain: `jh secret set <NAME>` asks for the value hidden, and only the command of the source that lists it receives it. The watcher takes up a changed source, and a changed `deploy`, `feedback`, `previews` or `checks`, without a restart. A source that fails can say why: a line `jackherd-reason: <reason>` on its stdout shows as `exit 1: <reason>`, with your secrets masked. Any source can show its entries in a block of their own under Your turn with `"show": "entries"`.
 
 </details>
 
@@ -225,11 +227,13 @@ Each phase in the plan names its model: the planning model (Opus by default) whe
 | `jh check` | types, lint and tests of what you touched, plus the plan and board checks (`--skip-slow`, `--parallel <plan>`) |
 | `jh herd` | the live view (`--once`, `--lane <name>`) |
 | `jh watch` | the watcher Jack runs |
+| `jh resume` | after herdr restarts, wakes the coordinator and the lanes that worked when the machine crashed; runs once per crash and only when the watcher's record shows no `stoppedAt`. Stopping the watcher before quitting herdr prevents it. |
+| `jh secret` | keeps a personal source's secrets in the system keychain (`set <NAME>`, `list`, `delete <NAME>`); `list` shows which are set, never a value |
 | `jh lane prompt <lane>` | writes a lane's first prompt from its board row and its plan (`--out`, `--handover`); your additions below the marker line at its end stay |
 | `jh lane close <lane>` | removes a finished lane: agent, worktree, herdr workspace and branch, and marks the board; first checks that nothing is lost, and refuses with every reason; `--dry-run` only checks. Claude Code asks before each call |
 | `jh preview <file>` | renders a Markdown file through the GitHub API into a preview in GitHub and npm style |
 | `jh waiting` | the files and Artifacts sent to you that you have not answered yet (`close <id>…` or `close --all` once you have) |
-| `jh context` | how full an agent's context is, as JSON |
+| `jh context` | how full an agent's context is, as JSON; `--usage [--since 24h\|7d\|<date>]` the tokens a lane used instead (Jack's with `--coordinator`) |
 | `jh config` | the commands and the base branch the repository uses; a missing value goes to stderr with the line to set, and `jh config <key>` for an unset value exits 3 |
 
 Without a global install, run them as `bunx jackherd <command>`. The config is `.jackherd/config.json` in a project and `~/.jackherd/config.json` globally, checked against [one schema](https://unpkg.com/jackherd/schemas/jackherd.schema.json), which your editor completes in the project config. What usually needs setting:
@@ -246,7 +250,7 @@ Without a global install, run them as `bunx jackherd <command>`. The config is `
 }
 ```
 
-`jh check` counts the words of every skill, agent and always-loaded rule an agent reads, and warns above its budget; `check.skillBudgets` sets your own, by path or glob. `watch.parallelTasks.auto` (`since`, `until`, at most seven days) lets Jack start up to two extra subagents in a running lane without asking, under the cost limit and away from paths that always ask; he switches it on only after asking you.
+`jh check` counts the words of every skill, agent and always-loaded rule an agent reads, and warns above its budget; `check.skillBudgets` sets your own, by path or glob. It also reads the rule blocks you added or changed in `**/rules/**/*.md`, `CLAUDE.md` and `AGENTS.md`, and warns (`Lint pointers`) where a block carries a rule your linter could check (a banned import path, a literal comparison, a comment form, a banned call) and names no lint rule. Name it with `` `lint:<rule id>` ``, or write `` `lint:none` `` and a reason where the rule stays prose. `check.lintPointers.level` is `warn` (default), `fail` or `off`; `check.lintPointers.exclude` lists globs that are never read. `watch.parallelTasks.auto` (`since`, `until`, at most seven days) lets Jack start up to two extra subagents in a running lane without asking, under the cost limit and away from paths that always ask; he switches it on only after asking you.
 
 </details>
 

package/dist/{chunk-4LUFR7RC.js → chunk-N5FAOQZL.js}

@@ -23,6 +23,10 @@ var STANDING_APPROVAL_TEXTS = {
   [PLAN_LANGUAGE.en]: { approve: "Approve standing", until: "until" },
   [PLAN_LANGUAGE.de]: { approve: "Stehend freigeben", until: "bis" }
 };
+var RECOMMENDED_MARK = {
+  [PLAN_LANGUAGE.en]: "(recommended)",
+  [PLAN_LANGUAGE.de]: "(Empfohlen)"
+};
 var LANE_PROMPT_OPENING = {
   [PLAN_LANGUAGE.en]: "You are the lane",
   [PLAN_LANGUAGE.de]: "Du bist die Spur"
@@ -96,6 +100,7 @@ var PLAN_VOCABULARY = {
     phase: "Phase",
     noReviewGate: "Kein Review-Gate",
     laneClosed: "abger\xE4umt",
+    partialPhase: "(Teil)",
     openSubagents: "offene Sub-Agenten",
     sideOrderMarker: "dazu (User",
     startsNow: ["sofort"],
@@ -130,6 +135,7 @@ var PLAN_VOCABULARY = {
     phase: "Phase",
     noReviewGate: "No review gate",
     laneClosed: "cleaned up",
+    partialPhase: "(part)",
     openSubagents: "open subagents",
     sideOrderMarker: "also (User",
     startsNow: ["now", "immediately"],
@@ -184,6 +190,7 @@ export {
   ADDRESS_FORM,
   SELF_MERGE_LABEL,
   STANDING_APPROVAL_TEXTS,
+  RECOMMENDED_MARK,
   LANE_PROMPT_OPENING,
   APPROVAL_TEXTS,
   APPOINTMENT_VOCABULARY,

package/dist/config.d.ts

@@ -8,6 +8,10 @@ declare const TERMINAL_ADAPTER: {
     readonly herdr: "herdr";
 };
 type TerminalAdapter = (typeof TERMINAL_ADAPTER)[keyof typeof TERMINAL_ADAPTER];
+/** The environments a standing approval may cover; production is never one. */
+declare const STANDING_ENVIRONMENT: {
+    readonly stage: "stage";
+};
 declare const MODEL_ROLE: {
     readonly plan: "plan";
     readonly implement: "implement";
@@ -75,6 +79,7 @@ declare const sourceSchema: z.ZodObject<{
     reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
     secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
     show: z.ZodOptional<z.ZodLiteral<"entries">>;
+    repos: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 declare const jackherdConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
@@ -114,6 +119,7 @@ declare const jackherdConfigSchema: z.ZodObject<{
     lanes: z.ZodPrefault<z.ZodObject<{
         copy: z.ZodDefault<z.ZodArray<z.ZodString>>;
         lockFile: z.ZodOptional<z.ZodString>;
+        minFreeGb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     models: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
         review: "review";
@@ -254,6 +260,7 @@ declare const jackherdConfigSchema: z.ZodObject<{
             reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
             secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
             show: z.ZodOptional<z.ZodLiteral<"entries">>;
+            repos: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
     guard: z.ZodPrefault<z.ZodPipe<z.ZodObject<{
@@ -264,6 +271,11 @@ declare const jackherdConfigSchema: z.ZodObject<{
         }, z.core.$strict>>;
         approvals: z.ZodPrefault<z.ZodObject<{
             waitMinutes: z.ZodDefault<z.ZodNumber>;
+            standing: z.ZodOptional<z.ZodObject<{
+                tools: z.ZodRecord<z.ZodString, z.ZodEnum<{
+                    stage: "stage";
+                }>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         alwaysAsk: z.ZodDefault<z.ZodArray<z.ZodString>>;
         requiredChecks: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -281,6 +293,9 @@ declare const jackherdConfigSchema: z.ZodObject<{
         };
         approvals: {
             waitMinutes: number;
+            standing?: {
+                tools: Record<string, "stage">;
+            } | undefined;
         };
     }, {
         commands: string[];
@@ -290,6 +305,9 @@ declare const jackherdConfigSchema: z.ZodObject<{
         };
         approvals: {
             waitMinutes: number;
+            standing?: {
+                tools: Record<string, "stage">;
+            } | undefined;
         };
         alwaysAsk: string[];
         requiredChecks?: string[] | undefined;
@@ -333,6 +351,19 @@ declare const jackherdConfigSchema: z.ZodObject<{
             reviewer: z.ZodDefault<z.ZodString>;
         }, z.core.$strict>>;
         skillBudgets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        openBoxes: z.ZodDefault<z.ZodEnum<{
+            fail: "fail";
+            warn: "warn";
+            off: "off";
+        }>>;
+        lintPointers: z.ZodOptional<z.ZodObject<{
+            level: z.ZodDefault<z.ZodEnum<{
+                fail: "fail";
+                warn: "warn";
+                off: "off";
+            }>>;
+            exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         looseTests: z.ZodDefault<z.ZodBoolean>;
         roots: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
         sourceFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -378,6 +409,7 @@ declare const personalSourcesSchema: z.ZodObject<{
         reportOn: z.ZodOptional<z.ZodArray<z.ZodString>>;
         secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
         show: z.ZodOptional<z.ZodLiteral<"entries">>;
+        repos: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 type PersonalSourcesFile = z.infer<typeof personalSourcesSchema>;
@@ -386,4 +418,4 @@ declare const parsePersonalSourcesFile: (raw: unknown, label: string) => Persona
 /** One `watch.sources` entry outside the config, such as a draft to try; invalid throws with `label` and the issues. */
 declare const parseSourceDraft: (raw: unknown, label: string) => z.infer<typeof sourceSchema>;
 
-export { COMMAND_KEYS, type CommandKey, DEFAULT_CONTEXT_WINDOW, DEFAULT_MODELS, DEFAULT_SKILL_PREFIX, type JackherdConfig, KIT_CORE, MODEL_ROLE, type ModelRole, type PersonalSourcesFile, SKILL_PREFIX, TERMINAL_ADAPTER, type TerminalAdapter, isModelRole, isTerminalAdapter, jackherdConfigSchema, parseConfigFile, parseJackherdConfig, parsePersonalSourcesFile, parseSourceDraft, personalSourcesSchema, renderConfigJsonSchema, renderSourcesJsonSchema };
+export { COMMAND_KEYS, type CommandKey, DEFAULT_CONTEXT_WINDOW, DEFAULT_MODELS, DEFAULT_SKILL_PREFIX, type JackherdConfig, KIT_CORE, MODEL_ROLE, type ModelRole, type PersonalSourcesFile, SKILL_PREFIX, STANDING_ENVIRONMENT, TERMINAL_ADAPTER, type TerminalAdapter, isModelRole, isTerminalAdapter, jackherdConfigSchema, parseConfigFile, parseJackherdConfig, parsePersonalSourcesFile, parseSourceDraft, personalSourcesSchema, renderConfigJsonSchema, renderSourcesJsonSchema };

package/dist/config.js

@@ -1,7 +1,7 @@
 import {
   PLAN_LANGUAGE,
   RESPONSE_ADDRESS
-} from "./chunk-4LUFR7RC.js";
+} from "./chunk-N5FAOQZL.js";
 
 // src/config/json-schema.ts
 import { z as z3 } from "zod";
@@ -73,6 +73,15 @@ var publicContent = z.strictObject({
   reviewer: nonEmpty.default("public-content")
 });
 var skillBudgets = z.record(glob, z.number().int().positive());
+var OPEN_BOXES_LEVEL = { fail: "fail", warn: "warn", off: "off" };
+var LINT_POINTERS_LEVEL = { warn: "warn", fail: "fail", off: "off" };
+var lintPointers = z.strictObject({
+  /** `warn` reports a block and lets the commit through; `fail` stops it; `off` skips the check. */
+  level: z.enum([LINT_POINTERS_LEVEL.warn, LINT_POINTERS_LEVEL.fail, LINT_POINTERS_LEVEL.off]).default(LINT_POINTERS_LEVEL.warn),
+  /** Rule files left unread, as globs from the project root; the kit copies in the lock file are always left out. */
+  exclude: z.array(glob).default([])
+});
+var DEFAULT_LINT_POINTERS = { level: LINT_POINTERS_LEVEL.warn, exclude: [] };
 var checkConfigSchema = z.strictObject({
   /**
    * Run once over the changed files, which are appended as arguments. Separate from `commands.lint`,
@@ -90,6 +99,17 @@ var checkConfigSchema = z.strictObject({
    * path and sets one for the project's own skills; a file with none is measured against the kit's default.
    */
   skillBudgets: skillBudgets.optional(),
+  /**
+   * What a lane's check does when the phase its board row names still has open boxes without `→ P<n>`: `fail` (the
+   * default) stops the commit, `warn` reports, `off` skips. A row carrying the `partialPhase` word (`(Teil)` in German) builds part of the phase and is
+   * left alone; a branch whose directory is no lane's is not checked.
+   */
+  openBoxes: z.enum([OPEN_BOXES_LEVEL.fail, OPEN_BOXES_LEVEL.warn, OPEN_BOXES_LEVEL.off]).default(OPEN_BOXES_LEVEL.fail),
+  /**
+   * Whether a new or changed block of a rule file (or `CLAUDE.md`, `AGENTS.md`) that a linter could check, such
+   * as a forbidden import path or call, must name its lint rule with `` `lint:<rule id>` `` (or `` `lint:none` `` and a reason).
+   */
+  lintPointers: lintPointers.optional(),
   /** Also run tests in directories that hold test files but belong to no package. */
   looseTests: z.boolean().default(false),
   /**
@@ -275,6 +295,9 @@ import { isAbsolute } from "path";
 var segmentsOf = (path) => path.split(/[\\/]/).filter((segment) => segment !== "" && segment !== ".");
 var isRepositoryDirectory = (value) => !isAbsolute(value) && segmentsOf(value).length > 0 && !segmentsOf(value).includes("..");
 
+// src/config/repository-identity.ts
+var REPOSITORY_NAME = /^[\w.-]+\/[\w.-]+$/;
+
 // src/config/tones.ts
 var TONE = {
   amber: "amber",
@@ -303,6 +326,7 @@ var DEFAULT_TONES = {
 
 // src/config/schema.ts
 var TERMINAL_ADAPTER = { none: "none", herdr: "herdr" };
+var STANDING_ENVIRONMENT = { stage: "stage" };
 var MODEL_ROLE = {
   plan: "plan",
   implement: "implement",
@@ -482,7 +506,12 @@ var sourceSchema = z2.strictObject({
    */
   secrets: z2.array(z2.string().regex(SECRET_NAME, "capital letters, digits and `_`, starting with a letter")).max(10).refine((names) => new Set(names).size === names.length, "secret names must be unique").optional(),
   /** `entries` shows the source's entries open, in a herd block of its own; not for a ticket source, whose entries are badges. */
-  show: z2.literal(SOURCE_SHOW.entries).optional()
+  show: z2.literal(SOURCE_SHOW.entries).optional(),
+  /**
+   * `owner/name` of the repositories a personal source runs in (matched without regard to case); without it every
+   * repository. Only in the personal sources file: the repository's own config is for that repository already.
+   */
+  repos: z2.array(z2.string().regex(REPOSITORY_NAME, "owner/name, such as acme/tool")).min(1).max(20).refine((repos) => new Set(repos.map((repo) => repo.toLowerCase())).size === repos.length, "repos must be unique").optional()
 }).refine(canChange, {
   message: "map needs updatedAt, a content field (title, author, body, url) or reportOn",
   path: ["map"]
@@ -500,12 +529,26 @@ var sourceSchema = z2.strictObject({
   path: ["reportOn"]
 });
 var hasUniqueNames = (sources) => new Set(sources.map(({ name }) => name)).size === sources.length;
+var repositorySources = z2.array(sourceSchema).refine(hasUniqueNames, "source names must be unique").superRefine((sources, context) => {
+  sources.forEach((source, index) => {
+    if (source.repos === void 0) return;
+    context.addIssue({
+      code: "custom",
+      path: [index, "repos"],
+      message: "repos belongs in the personal sources file (~/.jackherd/sources.json): this config is for one repository"
+    });
+  });
+});
 var coordinatorSchema = z2.strictObject({
   /** Tokens in the coordinator's context from which the watcher reports `coordinator warn`. */
   warnTokens: tokenCount.default(35e4),
   /** Tokens in the coordinator's context from which the watcher reports `coordinator alert`. */
   alertTokens: tokenCount.default(5e5)
 }).refine(warnBelowAlert, WARN_BELOW_ALERT);
+var standingTool = z2.string().regex(
+  /^mcp__[A-Za-z0-9_-]+__execute_sql$/,
+  "a full MCP tool name ending in execute_sql, such as mcp__<server>__execute_sql"
+).refine((name) => !/prod/i.test(name), "a tool whose name says prod never runs under a standing approval");
 var guardedCommand = z2.string().regex(/^[a-z][a-z0-9-]*( [a-z][a-z0-9-]*){1,3}$/, "a program and one to three plain words, such as gh pr merge");
 var checkFreePattern = z2.string().regex(/^[A-Za-z0-9_.*/-]+$/, "path words with * and ** only, such as docs/**/*.md").refine(
   (pattern) => !pattern.startsWith("/") && !pattern.split("/").includes(".."),
@@ -551,7 +594,13 @@ var guardFields = z2.strictObject({
   }).prefault({}),
   approvals: z2.strictObject({
     /** How long the approval gate hook holds a lane's call for the coordinator's dialog before it denies it; below the hook's 10 minutes. */
-    waitMinutes: z2.number().int().min(1).max(9).default(8)
+    waitMinutes: z2.number().int().min(1).max(9).default(8),
+    /**
+     * The calls a standing approval of the user may let through once the coordinator marked them checked: each tool
+     * by its full name and the environment it writes to, only `stage`. A tool whose name says `prod` is refused, as the
+     * hook refuses it under a broken config; which project a server reaches is the project's start script's to say.
+     */
+    standing: z2.strictObject({ tools: z2.record(standingTool, z2.enum(Object.values(STANDING_ENVIRONMENT))) }).optional()
   }).prefault({}),
   /**
    * Paths that always ask, on top of the ones jackherd brings (`.github/**`, `**\/migrations/**`, `**\/.env*`,
@@ -638,7 +687,9 @@ var jackherdConfigSchema = z2.strictObject({
     /** Untracked files copied into every new worktree; empty means the files `.worktreeinclude` lists. */
     copy: z2.array(laneCopyPath).default([]),
     /** The dependency lock file a rebase takes from the base branch and regenerates, never merges by hand; detected from the repository when left out. */
-    lockFile: lockFilePath.optional()
+    lockFile: lockFilePath.optional(),
+    /** Free gigabytes the disk must hold before `jh lane space` lets a new lane install its dependencies; 5 when left out. */
+    minFreeGb: z2.number().positive().optional()
   }).prefault({}),
   models: z2.record(z2.enum(Object.values(MODEL_ROLE)), modelId).default(DEFAULT_MODELS),
   terminal: z2.strictObject({ adapter: z2.enum(Object.values(TERMINAL_ADAPTER)).default(TERMINAL_ADAPTER.none) }).prefault({}),
@@ -680,7 +731,7 @@ var jackherdConfigSchema = z2.strictObject({
     parallelTasks: parallelTasksSchema.prefault({}),
     taskSignalMinutes: z2.number().int().positive().default(DEFAULT_TASK_SIGNAL_MINUTES),
     previews: previewsSchema.optional(),
-    sources: z2.array(sourceSchema).refine(hasUniqueNames, "source names must be unique").default([])
+    sources: repositorySources.default([])
   }).prefault({}),
   /** Read by the merge guard hook, which asks before the listed commands run, and by `/orchestrate`. */
   guard: guardSchema.prefault({}),
@@ -719,6 +770,7 @@ export {
   KIT_CORE,
   MODEL_ROLE,
   SKILL_PREFIX,
+  STANDING_ENVIRONMENT,
   TERMINAL_ADAPTER,
   isModelRole,
   isTerminalAdapter,

package/dist/plan-format.d.ts

@@ -32,6 +32,11 @@ declare const STANDING_APPROVAL_TEXTS: Record<PlanLanguage, {
     approve: string;
     until: string;
 }>;
+/**
+ * The mark at the end of the first option's label that says it is the recommendation. The plain question hook sends
+ * a dialog back whose first option lacks it, so it is fixed per language and not a config value.
+ */
+declare const RECOMMENDED_MARK: Record<PlanLanguage, string>;
 /**
  * The words a lane prompt opens with, followed by the lane's name. The ask hint hook and the project's lane exception
  * recognise a lane by them, so they are fixed per language and not a config value.
@@ -133,6 +138,8 @@ type PlanVocabulary = {
     noReviewGate: string;
     /** Marks a lane as closed when its name cell contains it. */
     laneClosed: string;
+    /** Stands in a board row's phases cell when that pull request builds only part of the phase. */
+    partialPhase: string;
     /** Opens the line a lane's hand-over file must hold as `<word>: 0`, so the coordinator hands over only after a wave. */
     openSubagents: string;
     /** Words a starts-after cell begins with when the lane may start at once. */
@@ -460,13 +467,12 @@ declare const tallyPhases: (markdown: string, language: PlanLanguage) => PhaseTa
 type PhaseWithoutGate = PhaseHeading;
 /** A row of the lanes table (1-based line) whose phases cell names no phase id. */
 type RowWithoutPhase = OpenLaneRow;
-/**
- * A `### Phase` heading (1-based line) whose tasks are all ticked on the base branch while its own section still
- * has open checkboxes not moved on with `→ P<n>` (`openLines`, 1-based).
- */
-type MergedPhaseWithOpenBoxes = PhaseWithoutGate & {
+/** A `### Phase` heading (1-based line) whose own section has open checkboxes not moved on with `→ P<n>` (`openLines`, 1-based). */
+type PhaseWithOpenBoxes = PhaseWithoutGate & {
     openLines: number[];
 };
+/** A `PhaseWithOpenBoxes` whose tasks are all ticked on the base branch. */
+type MergedPhaseWithOpenBoxes = PhaseWithOpenBoxes;
 /** The ids of the `### Phase` headings of a plan. */
 declare const phaseIdsOfPlan: (markdown: string, language: PlanLanguage) => Set<string>;
 /**
@@ -485,6 +491,12 @@ declare const hasLanesTable: (markdown: string, language: PlanLanguage) => boole
  * with an open task there, is still being worked on.
  */
 declare const mergedPhasesWithOpenBoxes: (markdown: string, base: string, language: PlanLanguage) => MergedPhaseWithOpenBoxes[];
+/**
+ * The phase `id` of `markdown` when its own section still has open checkboxes, gate boxes included, that no `→ P<n>`
+ * at their end moves on; null when it has none or the plan lacks the phase. Unlike `mergedPhasesWithOpenBoxes` it
+ * does not ask whether the phase counts as merged: the caller knows which phase a branch builds.
+ */
+declare const openBoxesOfPhase: (markdown: string, language: PlanLanguage, id: string) => PhaseWithOpenBoxes | null;
 /**
  * The changed rows of open lanes whose phases cell names no phase id (`P10c`), so neither the view nor the watcher
  * can tie that step to a phase.
@@ -614,4 +626,4 @@ declare const readSprintDocument: (markdown: string, language: PlanLanguage) =>
  */
 declare const readPhaseDependencies: (planMarkdown: string, language: PlanLanguage) => Record<string, string>;
 
-export { ADDRESS_FORM, APPOINTMENT_VOCABULARY, APPROVAL_TEXTS, type ChecklistItem, type ColumnModel, type DeferredItem, type DriftFinding, LANE_PROMPT_OPENING, LANGUAGE_NAME, type LaneProgress, type LongPhaseTitle, type MergedPhaseWithOpenBoxes, type MisplacedDeferral, type ModelRow, NEXT_VOCABULARY, NO_DEPENDENCY_TABLE, PHASE_CELL_LIMIT, PHASE_ID_PREFIX, PHASE_TITLE_LIMIT, PHASE_WORK, PLAN_LANGUAGE, PLAN_STATUS, PLAN_VOCABULARY, PROSE_REASON, type PhaseDependency, type PhaseHeading, type PhaseProgress, type PhaseSchedule, type PhaseTally, type PhaseWithoutGate, type PhaseWithoutRow, type PhaseWork, type PhaseWorkFields, type PlanHeader, type PlanLanguage, type PlanPhase, type PlanStatus, type PlanStep, type PlanVocabulary, type PlansByHref, type ProseReason, RESPONSE_ADDRESS, type ResponseAddress, type RowWithProse, type RowWithoutPhase, SELF_MERGE_LABEL, SHORT_NAME_LIMIT, SHORT_NAME_PROBLEM, STANDING_APPROVAL_TEXTS, type ShortNameFinding, type ShortNameProblem, type SprintDocument, type SprintLane, type SprintPlanRow, type SprintPlanTable, type StatusWord, type StepProgress, WAITING_VOCABULARY, activeItem, boardRowsWithProse, boardRowsWithoutPhase, classifyStatus, columnModels, countDecisions, criticalPath, currentPhase, currentPhaseOf, deferralTarget, differsFromColumn, endsPhase, findDrift, hasLanesTable, isCheckboxLine, isDocumentationGateItem, isOpenCheckboxLine, isPhaseFinished, isPhaseOpen, isPlanLanguage, isReviewGateLine, isTickedUnmerged, laneNameOf, laneProgress, longPhaseTitles, mergedPhasesWithOpenBoxes, misplacedDeferrals, newPhasesWithoutReviewGate, onlyDocumentationOpen, parallelGroups, parallelGroupsOfPlan, parseDependencyTable, parseModelTable, parsePlanPhases, parseSprintLanes, phaseCount, phaseHeading, phaseHeadingPattern, phaseHeadings, phaseIdOf, phaseIdsOfCell, phaseIdsOfPlan, phaseLabel, phaseLabels, phaseProgress, phaseWaves, phaseWorkFields, phasesText, phasesWithoutDependencyRow, readPhaseDependencies, readPlanHeader, readSprintDocument, resolvePlanPath, sectionHeading, shortNameFindings, shortTitle, sprintTitleOf, sumPhases, tallyPhases, wavesOfPlan, withoutRepeats };
+export { ADDRESS_FORM, APPOINTMENT_VOCABULARY, APPROVAL_TEXTS, type ChecklistItem, type ColumnModel, type DeferredItem, type DriftFinding, LANE_PROMPT_OPENING, LANGUAGE_NAME, type LaneProgress, type LongPhaseTitle, type MergedPhaseWithOpenBoxes, type MisplacedDeferral, type ModelRow, NEXT_VOCABULARY, NO_DEPENDENCY_TABLE, PHASE_CELL_LIMIT, PHASE_ID_PREFIX, PHASE_TITLE_LIMIT, PHASE_WORK, PLAN_LANGUAGE, PLAN_STATUS, PLAN_VOCABULARY, PROSE_REASON, type PhaseDependency, type PhaseHeading, type PhaseProgress, type PhaseSchedule, type PhaseTally, type PhaseWithOpenBoxes, type PhaseWithoutGate, type PhaseWithoutRow, type PhaseWork, type PhaseWorkFields, type PlanHeader, type PlanLanguage, type PlanPhase, type PlanStatus, type PlanStep, type PlanVocabulary, type PlansByHref, type ProseReason, RECOMMENDED_MARK, RESPONSE_ADDRESS, type ResponseAddress, type RowWithProse, type RowWithoutPhase, SELF_MERGE_LABEL, SHORT_NAME_LIMIT, SHORT_NAME_PROBLEM, STANDING_APPROVAL_TEXTS, type ShortNameFinding, type ShortNameProblem, type SprintDocument, type SprintLane, type SprintPlanRow, type SprintPlanTable, type StatusWord, type StepProgress, WAITING_VOCABULARY, activeItem, boardRowsWithProse, boardRowsWithoutPhase, classifyStatus, columnModels, countDecisions, criticalPath, currentPhase, currentPhaseOf, deferralTarget, differsFromColumn, endsPhase, findDrift, hasLanesTable, isCheckboxLine, isDocumentationGateItem, isOpenCheckboxLine, isPhaseFinished, isPhaseOpen, isPlanLanguage, isReviewGateLine, isTickedUnmerged, laneNameOf, laneProgress, longPhaseTitles, mergedPhasesWithOpenBoxes, misplacedDeferrals, newPhasesWithoutReviewGate, onlyDocumentationOpen, openBoxesOfPhase, parallelGroups, parallelGroupsOfPlan, parseDependencyTable, parseModelTable, parsePlanPhases, parseSprintLanes, phaseCount, phaseHeading, phaseHeadingPattern, phaseHeadings, phaseIdOf, phaseIdsOfCell, phaseIdsOfPlan, phaseLabel, phaseLabels, phaseProgress, phaseWaves, phaseWorkFields, phasesText, phasesWithoutDependencyRow, readPhaseDependencies, readPlanHeader, readSprintDocument, resolvePlanPath, sectionHeading, shortNameFindings, shortTitle, sprintTitleOf, sumPhases, tallyPhases, wavesOfPlan, withoutRepeats };

package/dist/plan-format.js

@@ -8,6 +8,7 @@ import {
   PLAN_LANGUAGE,
   PLAN_STATUS,
   PLAN_VOCABULARY,
+  RECOMMENDED_MARK,
   RESPONSE_ADDRESS,
   SELF_MERGE_LABEL,
   STANDING_APPROVAL_TEXTS,
@@ -17,7 +18,7 @@ import {
   phaseHeading,
   sectionHeading,
   terminalSafe
-} from "./chunk-4LUFR7RC.js";
+} from "./chunk-N5FAOQZL.js";
 
 // src/plan-format/lanes.ts
 import { posix } from "path";
@@ -830,6 +831,10 @@ var mergedPhasesWithOpenBoxes = (markdown, base, language) => {
   };
   return phaseSections(markdown, language).filter(({ id, openLines }) => openLines.length > 0 && isMerged(id)).map(({ line, id, title, openLines }) => ({ line, id, title, openLines }));
 };
+var openBoxesOfPhase = (markdown, language, id) => {
+  const section = phaseSections(markdown, language).find((candidate) => candidate.id === id);
+  return section && section.openLines.length > 0 ? { line: section.line, id: section.id, title: section.title, openLines: section.openLines } : null;
+};
 var boardRowsWithoutPhase = (markdown, language, previousLines) => changedOpenLaneRows(markdown, language, previousLines).filter(
   ({ phases }) => phaseIdsOfCell(phases, language).length === 0
 );
@@ -920,6 +925,7 @@ export {
   PLAN_STATUS,
   PLAN_VOCABULARY,
   PROSE_REASON,
+  RECOMMENDED_MARK,
   RESPONSE_ADDRESS,
   SELF_MERGE_LABEL,
   SHORT_NAME_LIMIT,
@@ -955,6 +961,7 @@ export {
   misplacedDeferrals,
   newPhasesWithoutReviewGate,
   onlyDocumentationOpen,
+  openBoxesOfPhase,
   parallelGroups,
   parallelGroupsOfPlan,
   parseDependencyTable,

package/docs/plan-contract.md

@@ -82,3 +82,4 @@ dependencies: missing no dependency table: phases run one after another
 | 0 | the contract is met (a missing dependency table is a note, not a gap) |
 | 1 | at least one part is missing or malformed |
 | 2 | wrong command line: no subcommand, unknown subcommand, no file, unreadable file, unreadable config |
+| 3 | the contract is met, but the plan or a board that links it is not on the base branch (a `base:` line names each path); the coordinator commits it first (`/orchestrate` § 2 step 0), after which the check counts as done |