ledung 0.0.0-stage → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,222 @@
+# Ledung changelog
+
+For the person using Ledung. Newest first. One `## YYYY-MM-DD` heading per day (Ledung has no version
+numbers, and releases are per machine), then TERSE `- ` bullets: one short line per change, plain words
+saying what changed for the user, no prose paragraphs and no mechanism (that belongs in the commit
+message). Each bullet ends with the issue number(s) it closes, `(#12)` or `(#12, #15)`, or `(no issue)`
+when there is none, so the omission is deliberate. A PR that changes what Ledung does adds its bullet
+under today's date, creating the heading at the top if it is missing; the pre-push check refuses a push
+that changes `src/`, `web/` (not `web/dist/`) or `scripts/` without one (a commit trailer `Changelog: none` says there
+is nothing user-facing in it).
+
+## 2026-11-02
+- Settings → About has an update channel, Public or Dev: on Dev an npm-installed Ledung gets dev builds before they go to everyone, and Update & restart now checks npm and updates an npm install with one click (#461)
+
+## 2026-11-01
+- On the phone, a linked computer's tab keeps its Settings → Look choices (theme, typing, sidebar) instead of losing them (#459)
+- `ledung` and the Ledung icon start Ledung in the background with no window, so no terminal has to stay open; Stop Ledung in Settings → Update & restart or `ledung stop` stops it, Start Ledung when I sign in (off unless switched on) starts it with Windows, macOS or Linux, its output goes to ledung.log in the data folder, and `ledung --foreground` runs it in the terminal as before (#456)
+- Claude Code is now also found where WinGet puts it, through a PATH an installer changed while Ledung ran (Windows), and, when nothing else is installed, as the Claude desktop app's own copy, which runs when it is new enough; when that copy is too old, the banner says so and gives the command to install Claude Code. The banner and Settings → Claude Code list every place Ledung looked. Check again shows "Checking…" and then "Checked again at …: still the same" when nothing changed, and a Claude Code installed while Ledung runs clears the banner without a restart (#455)
+
+## 2026-10-30
+- The npm package is ready for its first publish: no longer marked private, and npm's page for it links to the public repository and its issues, with Project Ledung <martin@projectledung.com> as its author (#340)
+- Push notifications with several computers: switch push on once, in the first tab's Settings → Phones, and the phone also gets every linked computer's new Waiting-for-you items, each titled with that computer's name; tapping one opens that computer's tab. Another computer's tab now says pushes for it come through the first tab, instead of a switch the browser blocks there (#451)
+
+## 2026-10-29
+- Settings → About's Source link now points at Ledung's public repository, github.com/Fluffy-Fluffy-and-Bouncy/ledung (#340)
+- Ledung has a version, starting at v1: a public release is a plain number (v1, v2) and a dev build after it adds one (v1.1); Settings → About and the npm update panel show it that way (#340)
+- Installed from npm, Ledung gets exactly the dependency versions it was tested with (the Agent SDK above all), so it no longer asks for a newer Claude Code than the tested one; the install is about 70 MB instead of 300 MB, and `"claudeExecutable": "bundled"` is not available in it: its banner says to install Claude Code and set "installed". On every install, a running session that can't be reconnected after Restart Ledung now ends on its own with the reason, instead of stopping Ledung from starting (#421)
+- Installed from npm, Ledung's start no longer prints Node's "SQLite is an experimental feature" warning (other warnings still show) or the development trace lines that begin "EXERCISED #"; those now go to `exercised.log` in the user data folder (#422, #428)
+- Update Ledung and `npm run release` run the tests without this Ledung's data folder and config, and `npm test` gives the tests a throwaway data folder and config of their own, so a test can no longer read or change your Ledung's data; the update no longer fails on the shortcuts test (#435)
+- Settings → Claude & accounts: Open folder shows an account's sign-in folder in Finder or Explorer; only on the computer Ledung runs on (#414)
+- Macros: text you send often, set up in Settings → Ledung → Macros (name, text, put in the box or send at once, global or one project, a chip and a keybind each on their own switch, drag to reorder). A session's chips sit right-aligned in its info bar by the ship; what doesn't fit and the keybind-only ones are in the last chip's menu, with Edit macros…. Shift+click does the other of insert and send; `{issue}`, `{branch}`, `{pr}`, `{project}` and `{session}` are filled from the session, and one it has no value for puts the text in the box instead of sending. Keybinds work in the message box too; one the browser, the system or Ledung keeps is refused with the reason, and the free ones (Ctrl+Shift+1–9) are offered. A macro kept for a project that was since removed is marked "(removed)" in Settings, and a macro's scope there shows in full on hover. (#410)
+- A Ledung icon you can double-click: the first time the page opens on this computer it asks once, "Add a Ledung icon to your Desktop and Start menu?" (on macOS, "… to Applications?"), and **Settings → Update & restart → Shortcuts** adds or removes it later. The icon opens the page, and starts Ledung first if it isn't running: on Windows in a minimised window in the taskbar (closing it stops Ledung), on macOS in a Terminal window. Nothing is put on your Desktop unless you say Yes. `Ledung.cmd`, `ledung.sh` and the `ledung` command now open the page of a Ledung that already runs, instead of failing with "Port … is in use". (#415)
+- Claude accounts can be written in the config file, under `"claudeAccounts"` with plain fields (`whatItIsFor`, `signInFolderOnThisComputer`, `signInFolderInContainers`; explained with a worked example in `ledung.config.example.json`): Ledung adds them at its start and when the file changes, and marks them in Settings → Accounts; removing stays in the page. Each account's sign-in folder now holds an `ABOUT THIS FOLDER.txt` saying whose it is and the exact command to sign in. (#425)
+- When Ledung's port is already in use, the error names the config file to change the port in, wherever it is (for an npm install, in the user data folder). (#412)
+- Installed from npm, Settings → Update & restart no longer speaks of git, main and releases: Restart Ledung says it starts the installed package again. The Settings button on the Claude Code, usage stop and config file banners opens the part of Settings they are about. (#412)
+- Away with "dev ship" allowed, the project's dev ship also goes through when a session its manager started runs it (shown in the manager's away_log with the session's name), and with `cd <folder> &&` before it or an output redirect (`> file`, `2>&1`) after it; a held dev ship's reason says what form goes through. (#408)
+- A workflow can name a nudges file (`"nudgesFile"`): each nudge's text is shown on a session's prompt, under "Your context", while that session's context is at or over the nudge's threshold (by role, optionally by title prefix); a missing or broken file is told to the session. Usage → Sessions shows each session's context as "142k of 1000k". (#405)
+- A board problem now shows as amber text in the board chip, whose border stays green or red for the connection; the chip's tooltip starts with its whole text, which a narrow footer cuts with "…". (#403)
+
+## 2026-10-28
+
+- The sidebar's top no longer has the Overview, Usage and Board buttons; it starts with the limit meters. The footer is one row: ⚙, a Usage chip ("Usage · 1.2M today") and the board chip, the open one outlined. The "Connected" word is gone: the board chip's border is green while the page is connected and red while it is disconnected or reconnecting (the Usage chip's when no board is set up), with the state in its tooltip. The Overview's list of live sessions is now Usage's third tab, **Sessions**, and an old Overview address or bookmark opens it. (#400)
+- A saved config file is applied even when the file watch misses the save (macOS can drop one made just after Ledung starts): Ledung also looks at the file every 2 seconds. (#358)
+- Update Ledung no longer recognises a release from before #100, which has no `release.json`; such a Ledung runs as if from a source folder until the next `npm run release`. (#395)
+- A Publish usage setting still saved in its shape from before per-account publishing (#380) now reads as off, and Ledung no longer writes the old switch for older releases. (#395)
+- An old token account's token is no longer moved into its sign-in folder, and Settings no longer has the "Moving its old login token" line: every account is a sign-in folder you sign in to with Claude Code's /login. (#395)
+- `FLEET_*` settings (such as `FLEET_CONFIG` or `FLEET_DATA_DIR`) no longer work; use their `LEDUNG_*` names. (#395)
+- Ledung no longer falls back to an old `Fleet` data folder, `fleet.db` or `fleet.config.local.json`, and `npm run move-data` is gone: it uses the `Ledung` data folder, `ledung.db` and `ledung.config.local.json` only. (#395)
+- Ledung's tools answer only under the name `ledung`: a session whose host was started before the rename (a `fleet-host-` pipe) and its `mcp__fleet__*` tools are no longer recognised. (#395)
+- The sidebar names a project's Claude account in small grey text over the project's name, for every project that isn't on this computer's own login, even with only one account set up. A long name ends in "…" with the whole name on hover; managers' rows name none. (#394)
+- The sidebar names a project's Claude account after its name again, when you have more than one account set up (none with only this computer's own login). The usage meters' reset text names its window: "5 h limit resets in 4 h" (or "… in 40 min"), "Weekly limit resets in 2 d 4 h", and the same under a meter with a usage stop and in managers' usage line. (#392)
+- Ledung no longer aborts on Windows when its config folder is reached through a short name such as `ADMINI~1` (which also failed `npm run release` there): it watches the config file at its real long path. A config reached through a link reloads when the file it points at is saved. When the real path can't be found, Ledung starts anyway and logs that config changes need Restart Ledung. (#388)
+- The Settings search box has an **×** that clears it, shown while something is typed; the cursor stays in the box. (#383)
+- Publish usage is chosen per Claude account: each account has its own Publish switch in **Settings → Claude & usage → Publish usage**, and **All accounts** publishes every account, ones added later too. A project can publish to a usage repository of its own (project settings → General → Usage repository); empty, it uses the computer's default one. Each repository gets only its projects' usage of the accounts that are on; switching an account off or moving a project removes that usage from the old repository on the next publish. A removed project's usage stays in the repository it last had. Publishing that was on before counts as All accounts. Managers can set both (`usage_publish` accounts, a project's `usageRepo`); anything that shares more waits for your approval. (#380)
+- Settings has a search box above the side menu of every tab (Ledung, Chats and each project): `/` focuses it, and it finds a setting on any tab by its name, its explanation or a word such as "phone" or "colour", each with its tab and group. Choosing one opens that tab and group and highlights the setting; Escape clears the search before it leaves Settings. (#367)
+- A project's ⚙ and the chats' ⚙ open their tab in Settings, with a side menu of groups: **What always goes to you** is a group of its own instead of under More, fields with a Ledung default say "Ledung default: X" or "Overrides Ledung · Reset", and one Save bar with Discard saves the whole tab, the Message board included. The name colour pickers moved from the manager's ⚙ menu to the tab's **Look** group. (#366)
+- A question can attach what it points at: a session's reply, a PR or review comment, or an earlier question. Ledung fetches each itself when it is asked and shows it word for word in a folded box under "What it refers to", with a link to the original (the conversation at that reply, GitHub, or the question). One Ledung can't fetch is shown with the reason, and the question is asked all the same. (#369)
+- Managers can switch usage publishing on or off for their computer (`usage_publish`) and set which projects show by name (`publishUsageName` in project settings). Switching either on waits for your approval in Ledung; switching off runs at once. `settings_status` shows whether this computer publishes. (#376)
+- The Usage page has a Shared tab: everyone who publishes usage to the shared repo, with a limit card per account (each bar split by computer, "≈ N% by reset"), one daily chart stacked by person, account, computer, model or project, and a who's-who table that marks a computer stale after a day. Mine shows only your own computers. (#364)
+- **Settings → Claude & usage → Publish usage** (off by default) shares this computer's usage totals with a GitHub repository you choose, through your `gh` login: per account, day and model, tokens, cost and calls, and the plan limits, replaced every 5 minutes when something changed. A project shows by name only where you switch that on in its settings; every other is `other#` and four characters. Switching off removes this computer's file; a computer silent for 30 days can be removed by anyone who can write to the repo. (#363)
+- A question's page has a "What it refers to" section. A manager's question about one of its sessions' questions shows that original in a folded box: its title, issue, options with costs, who picked what, opinions and evidence, in the session's own words, however old it is. Every new question also has a folded "Earlier in the conversation" box with the asker's last messages before it asked, word for word as they were then, and a link to the conversation at the question. Also in reviews and the screenshot view. (#368)
+- Settings is one place: tabs for Ledung, Chats and each project, a side menu of groups with its own address each, the version and Restart Ledung always in the header; features that are off take one line with Set up; "this browser" and "config" tags (#365)
+- The usage page has two tabs: **This computer**, the page as before, and **Shared**, which for now says shared usage is not built yet. This computer loads in about a tenth of a second with 90 days of heavy use (was 1.5 s), from daily totals Ledung now keeps as it records each call; the first start after updating fills them in from the calls so far. (#362)
+- The plan limit meters say how old their figures are ("as of 2 h ago") once they are an hour old, and always in the hover; Ledung hears the limits only during a session's turn, so after a start or an account switch they can be old. A window that has reset since its last reading shows "reset" with no figure, instead of the old one. (#360)
+- The usage page loads much faster with many model calls in the chosen period (90 days of heavy use: from about 5 s to 1.5 s), and holds the rest of Ledung up for that much shorter while it loads. The same holds for typical costs under it. (#356)
+- Tool output of ended sessions is now cut to its first lines after 3 days instead of 14 (`keepToolResultsDays`), so the database stays small; the full output is still in Claude Code's own transcript. (no issue)
+- Changing the config file no longer needs **Restart Ledung**: Ledung reads it again when it is saved, and the settings apply at once to new and resumed sessions (running ones keep theirs). A shorter `keepToolResultsDays` shrinks old tool output straight away. The port, the network (`lan`, `lanSignIn`), the relay (`remote`, `relayJoin`), `computers`, `board` and `userName` still need a restart, and Settings says "Restart Ledung to apply: …". A broken file is refused, the settings in use stay, and a banner says what is wrong. **Settings → Config file** shows when it was last read. (#353)
+
+## 2026-10-27
+- Ledung's database no longer grows by gigabytes. Screenshots in tool output are no longer stored (the conversation still shows `[image]`), and tool output over 64 KB keeps only its start, with a note saying how much was cut. 14 days after a session ends, its tool output is cut to its first lines (`keepToolResultsDays` in the config). Conversations, questions, permissions and usage stay whole, and the full output is still in Claude Code's own transcript. The space comes back by itself. Once, at a start after the shrink has freed half the file, Ledung may take up to a minute to compact it before the page comes up; running sessions carry on. If it can't (too little disk, or another program has the database open), it says so and starts as usual. (#349)
+- The page offers to run as an app, in a window of its own: **Install as app** in Edge and Chrome, a **File → Add to Dock** hint in Safari on macOS. A notice shows it until you install or press **Not now**; **Settings → App** always has it, or says why this browser can't. (#350)
+- An account is now only a sign-in: Ledung no longer takes, keeps or passes a sign-in token, and moving a project to another account changes only whose plan and limits it uses; its conversations, memory, skills and settings stay as they are. Add an account and sign in to it once with Claude Code's own `/login`, using the command the page shows. Container projects can use accounts too, signed in inside the container (`~/.ledung-accounts/<name>`, or a mounted folder you name). An existing token account moves by itself, with no new sign-in: Ledung puts its token once into Claude Code's own sign-in store for the account, checks that Claude Code signs in with it, then deletes its own copy; until then Accounts says what it waits for (a stopped container, say). A place added later is signed in with `/login`. Removing an account removes its own sign-in here and in every container its projects ran in, and nothing else (not another account's, not the computer's own login), except where another login shares the folder. A login-folder account made before this keeps its sign-in, but its conversations, skills and settings from that folder no longer apply: sessions now use the Claude Code folder every session shares, and the old ones can still be opened with `claude --resume` and `CLAUDE_CONFIG_DIR` set to that folder. (#342)
+- Sessions now run your own installed Claude Code, which Ledung needs at least the version its Agent SDK was built for. If it is missing or too old, a banner says how to install or update it, and sessions don't start until **Check again** finds it. **Settings → Claude Code** shows what new sessions run and what each running session uses. Container projects are unchanged. (#341)
+- A project's **Name** field now suggests "e.g. Website". (#340)
+- Ledung is licensed under the AGPL version 3, with a commercial license too. **Settings → About** says so, shows the running version and links to its **Source**; the first start says Ledung runs Anthropic's Claude Agent SDK and Claude Code, which are under Anthropic's own terms. (#332)
+- When Claude Code isn't signed in, Ledung now says so at start and when you add an account: a banner tells you how to sign in (`claude` then /login, or an API key), with **Check again**. A session that has no login where it runs stops at once with the same steps instead of failing on its first message; a key in the project's own Claude Code settings counts, and if Ledung can't tell, the session starts with a warning. The check costs no tokens. (#333)
+- Away mode has a third choice, **computer control** (off by default). It tells managers they may take over this computer while you are away, and their prompt line says so. Ledung doesn't check it. When you press Back, every manager is told at once, an idle one too. Managers also hear when the away time runs out or a change takes computer control away, if it was on. **Change…** sets the time or the choices while away, with no Back first. away_log shows when the last away period ran, how it ended and what was allowed. (#328)
+
+## 2026-10-26
+- Managers and chats are now told they can show you a file (a PNG or JPEG screenshot, Markdown, code or a log) by linking its path in a reply; it opens beside the chat. Sessions under a manager aren't told, since their replies go to the manager. (#325)
+- Typing in the message box no longer lags in long conversations: a key press no longer redraws every message, and a new message redraws only itself. Quote and kept drafts work as before. (#323)
+
+## 2026-10-23
+- Session profiles can come from the workflow: `profilesFile` in a workflow's config block names its profiles file, read at every session start, with its default profiles and plugins to turn off. This computer's config still adds profiles and overrides them field by field. A profile can carry Claude Code settings of its own (`settings`); in a workflow's file only a short list of harmless keys is allowed, and Settings shows each profile's allow rules. Plugins listed as off that aren't installed are skipped. Settings → Session profiles shows where each profile comes from, and a warning when the workflow's file is missing or broken; its projects then use this computer's profiles. (#298)
+- New per-project toggle in ⚙: **Its manager reads and changes workflow settings of your projects**. It is off by default, and switching it on needs the open page. With it on, that manager can read and change the grant, workflow, question tiers, sensitive list, dev ship command and ticket pattern of every project that isn't locked, its own included. A new grant (its own too), a new dev ship command or a removed sensitive pattern still waits for your approval in Ledung, which shows the before and after; any other change happens at once. Locked projects are never read or changed this way. (#306)
+- A page whose live connection died without the browser noticing (another computer's tab after the Mac slept, say) no longer refuses a change with "Only Ledung's open page can do this": it opens a new connection and sends the change once more. A change with no live page behind it is still refused. (#303)
+- Skill picker: Settings → Skills sets which of your own skills (personal and claude.ai ones) managers and sessions get, and each project's ⚙ → Skills can override that per skill and per role. With nothing chosen, managers get every skill and sessions none, and a new skill follows that default. Plugin skills still go on and off with their plugin in the profile. (#300)
+
+## 2026-10-21
+- A question in Waiting for you that has a title or an issue now also shows the asker's own question text, as the chat does; before, it could show only the title and the option buttons. (#294)
+- "Not paired with … in this tab?" and Pair through the link now show over another computer's frame only when that frame really isn't paired; before, they showed over a paired frame too, which looked like a lost pairing. (#286)
+- While another computer's page shows, this computer's own tab shows how many things wait for you here, the same count as Waiting for you, so a new question isn't missed. On this computer's own page the tab shows no count, since the sidebar already does. (#291)
+- The sidebar no longer shows a project's account after its name; the account still shows in the project's settings and in each session's header. (#289)
+- The log now says when a computer device's cookie is renewed, and when a frame on another computer's page shows this Ledung as not paired, with why: the browser sent no device cookie, a removed device's, or one this Ledung doesn't know. (#286)
+- Settings → Accounts: choose the **Account for chats** (new chats run on it; a running chat keeps its own until it restarts, and its header shows it) and the **Account for new projects** (chosen for you in Add project). Both stay across restarts and can be set back to default. (#283)
+- Usage figures are information only: managers' prompt line says "no stop set" for a window without a stop and ends "Information only: don't delay or ration work for it; Ledung's usage stop holds work if needed.", and every session's built-in instructions say the same, so agents stop holding work back on a high figure. (#284)
+
+## 2026-10-20
+- Usage stops on the sidebar meters: under a meter with a stop, a line counts down ("93% · 2% to stop · resets in 11 h 30 min"; once held "Held at 95% · resets in 9 h" with Lift). Managers' prompt line says the same ("2% to stop", "held at 95%"), with figures rounded down like the meter. (#280)
+- Away mode now shows at the top of every view, not only on a manager: "Away until 08:00 · managers may: merge, dev ship" with Back, so away set from the phone or another computer is visible on the computer whatever it has open. A manager's view keeps its marker beside the ⚙. (#274)
+- Usage stops: in Settings → Usage stops, set a percent of the 5-hour or weekly plan window per account (e.g. weekly 98%) at which Ledung holds new turns for every session and manager on that account; a running turn finishes. A banner and one notification say so; it lifts with Lift, when you raise the stop, or when the window resets. Also `"usageStops"` in the config. Managers' prompts now show each window's usage and reset time. (#278)
+- Linked computers now get computer tabs by themselves: a computer linked in Settings → Linked computers shows as a tab and may show this Ledung in its frame, without a `"computers"` list in the config (a white tab is gone), and unlinking takes the tab and that permission away at once. The config's entry still wins for name, colour and port. (#273)
+- **Pair through the link**: on this computer's own screen, a linked computer's tab offers to pair its frame without a code. Confirm, and its pairing form opens in the frame; that browser can look at once and change nothing until it sets up its passkey and logs on there with Touch ID or Windows Hello. The other computer shows each such pairing in Waiting for you (OK, or Remove device) and on the device's row ("paired through the link from …"), and allows one every 10 minutes per computer. Never from a phone or through the public name. (#273)
+- A linked computer's tab shows how much waits for you there (its Waiting for you count), live; no badge at 0 or while that computer is offline. (#273)
+- The passkey window says why a passkey could not be made, with the browser's own error, instead of a bare "error"; on a computer with no Windows Hello or Touch ID it says so before you try, and what to set up. (#273)
+- A session's own messages in its conversation now have the same light tint in its colour as its message box, with no coloured edge, so answered questions still stand apart; no colour set, no tint. (#269)
+- Computer tabs: clicking another computer's tab now shows that computer's own Ledung page right here, in a frame in its colour, and clicking back is instant; a middle click still opens it in a browser tab of its own. The first time, pair this browser with that computer as a computer: on that computer, Settings → Devices → **Pair a computer**, then type its code into the frame. Set up its passkey (it opens in a window of its own, since Safari makes passkeys only there) and **Log on** in the tab (Touch ID or Windows Hello): it stays logged on until you log out, are removed, or leave it unused for 14 days, also through Restart Ledung, and only a sensitive call there asks for Touch ID or Windows Hello again. Phones work as before (**Pair a phone**: unlock for 30 minutes). Only your other computers' pages, listed under `"computers"`, may show a Ledung in a frame; give an entry `"port"` if its Ledung doesn't run on 4317. (#241)
+- Sessions see how much time has passed: the time line on each prompt now says when the previous message came and when the session started, e.g. "last message 13:41 (23 min ago) · session started 12:05 (2 h)". A manager's list_sessions says how long each session has been in its state: "running for 23 min", "idle for 1 h 10 min", "waiting for an answer for 5 min". A new config setting `pluginsOff` turns the plugins it lists off in every Ledung session, whatever the profile. (#265)
+- Your manager can do what Settings' Relay and Linked computers buttons do when you ask it: set the relay's address, make the relay admin key (it tells you the hash; the key stays on this computer), make a link code or link with one, and invite a computer (it gives you the join code). Each one asks you first, unless you already told it to on this computer: a plain instruction typed in its chat ("make a new admin key", "invite a computer for Anna"), or the button you pressed for an option in its question; then it runs once and its chat says you allowed it. Anything less plain, or a "yes", asks. From the phone it always asks, and you allow it with your passkey. (#263)
+- On an iPhone the page fills the screen again once the keyboard is gone, also after allowing a sensitive prompt with Face ID; no blank strip left where the keyboard was. (#262)
+- A session's boat now starts at size 5 instead of 7; clicking it still steps 7, 6, 5, 4, and a size you already chose is kept. (no issue)
+- Session pull requests cost far less of the GitHub budget: a session on the main branch or on a branch never pushed is not looked up, a merged or closed pull request is not looked up again until the branch moves, and all live sessions on a repository are looked up together in one query. The sidebar shows what is left of the GitHub budget ("GitHub: 4,476 of 5,000 left until 11:03"); under 20 % left the pull requests are checked every 10 minutes, under 5 % not until the reset. Pull requests are looked up only for a github.com remote (or a host with "github" in its name); a GitHub Enterprise host without it, or an SSH host alias, shows no pull request for now (#252)
+- `npm run release` (and so Update Ledung) names the failing tests or the error when its check or build fails; a step or `!` command past its time limit is stopped sooner. (#251)
+- Managers on linked computers work as one: list_managers shows every linked computer's managers under its name, and message_manager and list_projects take a computer. A message from another computer arrives and wakes the manager as one from this computer would, saying which computer it came from; lockdown holds as on one computer, a computer that is off gives a plain "offline" error at once, and a manager on another computer can wake one here at most 6 times an hour. (#245)
+- Settings → **Linked computers**: link this Ledung with another of your computers' Ledungs, once. **Link a computer** shows a one-time code (10 minutes); paste it on the other computer with a name for this one. The link goes end to end through the relay, needs both on a relay with end-to-end encryption, and **Unlink** on either side ends it. Nothing uses the link yet: managers talking across computers comes next. (#245)
+- Push notifications to the phone: on a paired phone (with its passkey), Settings → Devices → **Push notifications to this phone** sends a notification for each new question or permission prompt in Waiting for you, even with Ledung closed and the phone locked. It names the computer and the kind of item, never the text; tapping it opens the item. On an iPhone, add Ledung to the Home Screen first. Switching it off or removing the device stops them. (#246)
+- Computer tabs: this computer's tab is always first, the others after it in the config's order. Another computer's tab opens its page in a new browser tab, so this one stays open. Settings → Computers renames any computer's tab and changes its colour; this Ledung keeps them through Restart Ledung, and "Use the config's" goes back. (#240)
+- Invite a computer to your relay: Settings → Relay (for whoever runs one) makes an admin key, keeps it and a Cloudflare token on this computer only, and **Invite a computer** shows a one-time join code (24 hours). The other person pastes it in Settings → Remote → **Join with a code**: their Ledung makes its own secret and certificate account, joins and connects with no restart, always end-to-end encrypted; **Leave this relay** undoes it. The new computer then waits in your Waiting for you as "New computer … for …" with its exact CAA record: **Approve** writes it through Cloudflare (never over an existing one), or Copy it and press I added it. (#237)
+- Relay: its admin can add, remove and list computers on the running relay without a restart, so nobody connected is dropped (`node relay.ts add --hash … --owner …`); a computer added this way is always end to end and gets a word name unless one is given. On the new computer, `ledung remote-secret` (or `node src/main.ts remote-secret`) makes its relay secret and shows only the hash to send. (#236)
+
+## 2026-10-19
+- Computer tabs: with your other computers listed under `"computers"` in the config (a name, a colour and each one's public name), a thin strip of tabs at the top of the page shows them, this one raised; a tab opens that computer's own Ledung page, with its own sign-in. Opened through its public name, the page has a frame in this computer's colour with "Remote · <computer>" ("Remote" on a phone). (#232)
+- On a Mac or Linux, the Files pane refuses a full path outside the session's folder as outside, instead of saying the folder doesn't exist (#233)
+- Test feature: a **Files** button in a session's head (a chat's too) opens a pane beside the conversation, full screen on a phone, with two tabs. **Files** shows the folder tree of the session's worktree or the project folder, one folder at a time, with a name filter; hidden names are left out and node_modules and ignored files greyed, and a file opens read-only, now with line numbers. Code in the pane is colour-coded by file type (plain text for unknown types and very large files). **Changes** shows what the session changed against main, file by file; click a line to comment on it. Comments stay drafts until Send, which puts them in your answer to the open review (Changes needed, or Accept with them as notes), or else sends them to the session's manager as your message. (#225)
+
+## 2026-10-18
+- A chat or session not yet spoken to stays Ready with the idle boat through Restart Ledung. It showed as Thinking, and counted as working, until its first message. (#226)
+- Any session, chat or manager can be renamed: ✎ beside its name in its header, or double-click its row in the sidebar; Enter saves, Escape cancels, an empty name is not taken. The name shows everywhere, other managers see it too, and it stays through Restart Ledung, a stop and resume, archive, and a project rename; a named chat or session is no longer titled after its first message. Managers can't rename anything. (#223)
+- Chats can have a name colour, like projects: Chats ⚙ → Chats' names, one colour for all chats from the same palette, or None. Chat names, the "Chats" label, the chat's header and message box and its questions in Waiting for you show in it. (#222)
+- Changing `"acme"` from `"staging"` to `"production"` (or back) now gets a certificate from the new one: Ledung makes the new account and shows its CAA record, and keeps the old certificate in use until the new one arrives. Before, it kept the untrusted staging certificate until renewal, weeks later. (#214)
+- Chats: New chat in the sidebar (or on the start page) starts a Claude Code session of your own with no project, workflow or manager, in a folder you pick (by default your home folder, or `chats.folder` in the config), with your whole Claude Code setup, Claude Code's own model unless you choose one, and Auto mode unless you choose another. Chats have their own group in the sidebar, ask you directly in Waiting for you, survive Restart Ledung and resume where they started. Settings → Chats has their own "always goes to you" list, starting with the suggestions. A chat can't start inside a locked project, and its file viewer shows nothing in hidden folders or files such as `.ssh`, in `AppData` or `Library` in your home folder, or in Ledung's own data folder. (#211)
+- A line starting with `!` in the message box runs as a shell command in the session's folder (Git Bash on Windows, or PowerShell with `"windowsShell": "powershell"`; the project's container for a container project), as in the `claude` CLI. The chat shows the command, its output and its exit code; Claude gets them with your next message, with no reply, no permission prompt and no place under the working limit. It stops after 2 minutes, or on Stop, with everything it started. A command matching the sensitive list asks first; through the public name each one needs your passkey. It is off in level B projects and in sessions above or inside a locked project's folder. (#212)
+- Elevated commands on Windows (gsudo, sudo, `-Verb RunAs`, `runas`) are suggested sensitive patterns, added once to existing projects, so they are always asked; sensitive patterns now also check commands run through the PowerShell tool. Their prompt says they raise UAC on the PC and offers **Deny: not at the PC**, and the status line says "may be waiting for UAC on the PC" while one runs. The README says how to elevate and what never to do. (#213)
+- Ledung can get its own certificate for its public name from Let's Encrypt, through the relay: with `"acme": "staging"` or `"production"` in `"remote"` it makes an ACME account once the relay is connected, then Settings → Remote shows "Waiting for the CAA record" with the account and the exact DNS record to add (Copy buttons). It looks the record up every minute or on Check now, and orders only once the record names its account, so nobody else's account can get a certificate for the name. A lookup that fails says so, with the reason, and keeps waiting. It renews at two-thirds of the certificate's life, backs off after a failure (1, 5, 30 minutes, then hourly; also when a new certificate is already due, which asks to check the computer's clock), renews an expired one as soon as it connects, and orders nothing on a start with a valid one. Settings shows how long it is valid and warns under 7 days. Not in use until the server change. (#202)
+- On a phone, the Compact sidebar steps work as on a computer again: step 2 hides the time row, steps 3 and 4 show only the name, the ship and the badge. They kept every row on a touch screen, so the sidebar hardly changed. (#207)
+- Ledung can end the encryption of a phone's connection itself, so a relay that passes connections through can't read them: it uses `tls.key` and `tls.crt` from the `remote` folder in its data folder, picks up a replaced certificate without a restart, and closes encrypted connections while there is none (the local page is unaffected). `"tls": "required"` in `"remote"` closes unencrypted connections from the relay. Settings → Remote says what is wrong. Today's relay, which ends TLS itself, works as before. (#201)
+- The relay can pass a Ledung's connections through still encrypted: an agent set to `"tls": "passthrough"` is reached on the relay's new passthrough port, routed by the name the phone asks for, and the relay holds no certificate for it, so it cannot read or change what goes through. Such a name is refused on the relay's ordinary port, and with no Ledung online the connection is closed instead of showing the offline page. Only the server's own proxy (by default loopback and private network addresses, set with `passthroughFrom`) may connect to that port. Other agents are unchanged. Not in use yet: Ledung's own TLS and the server change come next. (#200)
+- The pairing QR code in Settings → Devices shows the Ledung logo in its middle and has fewer, larger squares: the pairing link is shorter (`/p/` and a 20-character code) and the code carries it in capitals, which QR packs more tightly. It still works once, for 10 minutes. (#194)
+- Project settings that let more past the sensitive check (removing a sensitive pattern, a new manager grant or dev ship command, project tools that run unasked) need Ledung's open page, not just the sign-in cookie; on a paired phone they ask for the passkey each time, even unlocked. Other settings save as before. (#107)
+- A manager's message to another manager that has ended (stopped with your approval, or by Ledung after idling) no longer starts it again: the message isn't sent, and the sender is told to use start_manager, which you approve. Messages to a running manager arrive as before. (#46)
+- On a paired phone, the 30-minute unlock now covers messages to a manager, its first message, a new project's task and answers to a manager's questions: no Face ID for each one. A locked phone unlocks once and sends. Sensitive permissions, and answers about them, are still signed one by one; this computer is unchanged. (#192)
+- On a phone, judging screenshots keeps the image and Pass / Fail / Unsure (now finger-sized) pinned at the top while the rest scrolls under them, when the window is tall enough to leave room for the rest (held sideways they scroll with the page); the image's ‹ › stay with it, and moving to the next shot brings its "Look for" back into view. The full-screen image keeps its ✕ clear of a notch. Wider windows are unchanged. (#177)
+- On a touch screen every button in Waiting for you is at least 44 px (the One project / All toggle, project chips, Withdraw, ← → and Close), the conversation button on each row shows at full strength without hover, and Evidence is a full-width bar to tap. What was only in a tooltip is written out there: who picked an option, what a plain question is, and the sidebar cards keep their time and usage rows at every Compact step. Desktop is unchanged. (#176)
+- On a phone or tablet the message box's Enter adds a new line and Send sends (Ctrl/⌘+Enter also sends from a tablet keyboard); its placeholder is just "Message Claude". With the on-screen keyboard up, the box and the newest message stay in view above it, and on a phone the box's text no longer zooms the page. Keys with a mouse are unchanged. (#174)
+- On a phone a permission card is readable: a long command and an Edit or Write diff wrap instead of scrolling sideways, Copy sits above the command instead of over it, and Allow once, Allow for this session and Deny stack full width with each label on one line. Wider windows are unchanged. (#175)
+- On a paired phone, before Face ID or the fingerprint check comes up the page says what it is for: unlocking the device for 30 minutes, signing an answer to a manager or a sensitive permission, and that a locked phone asks twice in a row. A cancelled or failed check offers Try again instead of only a status line. Nothing changes on this computer, nor in what Ledung asks for. (#179)
+- When the page reconnects (a phone waking up, the relay dropping a quiet connection), an open chat keeps the messages it shows, including ones from "Load earlier", and your place in it; only the messages you missed are added. It used to reload the newest 500. (#178)
+- On a phone a question in Waiting for you has Send answer in a bar pinned at the bottom, showing the option you picked; the opinions come before the options, text boxes no longer zoom the page, and a touch screen shows no keyboard hints. Withdraw sits on its own row away from Send and asks first, on the question, review and screenshot pages and in the chat's question card. (#173)
+- On a phone the screen shows one thing at a time: the list is the start screen, with Waiting for you first; a session, Waiting for you or Settings fills the screen, and ← (or the phone's Back) returns to the list. A session's header is one line, its details a tap on the title away. Wider windows are unchanged. (#171)
+- On a phone a chat opens at its newest message with the message box at the bottom, and scrolling moves the messages instead of the whole page; Waiting for you, a question, Settings, Usage and Overview scroll inside their own area too, with the sidebar staying put. (#169)
+
+## 2026-10-17
+- "Allow for this session" on a permission prompt now allows that request and its repeats for the rest of the session; it was saved and applied as Allow once, so the same request asked again. (#170)
+- Ledung connects out to the relay set in its config's `"remote"` block (relay, name, public name, secret), so a paired phone can reach it through its public name with no open port on the computer. Settings → Remote shows connected, reconnecting (with the reason) or off. A relay that is down never holds up Ledung's start or the local page, and Ledung reconnects by itself. Anything that comes through the relay counts as the public name, whatever address it claims. The relay itself is in `relay/`, with its own Dockerfile. (#160)
+- Ledung can answer to a public name through a relay (config `"remote"`, its `"publicName"`): only paired phones get in there, never the sign-in link. A paired phone can only look until its passkey unlocks it for changes, for 30 minutes (Settings → Devices shows the lock and has Unlock; a change while locked asks to unlock). Settings → Devices pairs a phone with a one-time link and QR code (10 minutes, used once) and lists paired devices with Revoke, which locks one out at once. On the phone, a passkey (Face ID or fingerprint) set up right after pairing is asked for before allowing a sensitive call or writing to a manager; on this computer nothing changes. (#160)
+- On Windows, stopping a session or a timed-out update step no longer ends other sessions' hosts: after a Restart Ledung, the hosts started before it could be taken for another process's children and cut off ("The session's host stopped unexpectedly"), notably while `npm run check` ran. (#162)
+
+## 2026-10-16
+- Settings → Sidebar has a Show "Archived" in the sidebar switch, on by default and kept per browser. Off: no Archived (N) entry under the projects; switch it back on to reach their archived sessions. (#157)
+- The Compact sidebar slider's handle is a small ASCII ship (5 px): it sails along a strip of water to the step you pick, with a buoy and a label at each step; click a label to pick it. (#155)
+- Settings → Sidebar has a Compact sidebar slider, kept per browser, that changes the session cards as you drag it: None (as before), Less padding with no time row, Name + ship (no usage line either, and "+ Session" becomes a small "+"), and Tightest (28 px rows). The ship always stays; hover a card for its time, usage and branch. (#153)
+- Settings has a Status dot switch (under Sidebar), on by default and kept per browser. Off: no dot on the session rows; hovering a row shows its status, and an ended session's name is faded. (#151)
+- Sidebar: a ▸/▾ caret on each manager, or session, that runs sessions folds those sessions away, and one on each project folds all its sessions and its Archived link. What's hidden is counted on the row that stays ("+3", with a blue dot while one of them works), and its questions and permissions are added to that row's badge. The open session always stays in view. Folds are kept in that browser. (#149)
+- The browser no longer autocorrects what you type in the page (message box, answers, notes and every text field in the settings). Settings has an Autocorrect switch, off by default and kept per browser, to bring it back. Spell checking and automatic capitals stay as the browser has them. (#147)
+- Reviews: a manager can ask you to sign off a finished change. It opens in "Waiting for you" on a page of its own: what we were solving, what was done, notes, and evidence (screenshots that open large, logs folded to their first lines), with Accept and Changes needed. In the queue it carries a "Review" label, in the manager's chat a card with a button to open it. A review without its context is refused; a review received over the board comes to you the same way. (#145)
+- A question with screenshots shows its issue, evidence and options next to the shots instead of folding them away. (#145)
+- Screenshot verdicts are no longer lost without a word. After a verdict the view goes to the next shot without one, going back round to the start, so every shot can be judged with 1/2/3 alone. Send with shots still unjudged first shows them and turns into "Send with N without a verdict" (a double-click doesn't get past it). The count turns red while any are missing. A question withdrawn while you judge it says your verdicts were not sent; in that tab they fill the unjudged shots of a question in the same project with the same pictures, ringed on the strip for a second look. (#138)
+- The empty chat area (nothing open) has buttons for the next step: Add a project (when there are no projects) and Settings, instead of only pointing at the gear at the bottom left. (#142)
+- The config can hold several named workflows (a `"workflows"` list; the single `"workflow"` block keeps working as the first, named "default"). Add project and a project's settings have a Workflow list, None or one by name, and its sessions and manager are told to read that workflow's files; managers' add_project and create_project can name it too. Existing projects keep the workflow they had. (#132)
+- In "Waiting for you", an old question with no tier from a session Ledung no longer knows is labelled "Question" instead of an empty label on its border. (#135)
+- The message box takes the name colour of the manager or session you write to: a faint tint and a coloured left edge always, and while typing a border in that colour with a soft glow instead of the browser's ring; the drag grip takes it too. With no colour set it keeps the page's blue and no tint. (#133)
+- In "Waiting for you" each question, open or answered, is tinted with a coloured left edge in the name colour of whoever asked it, and its border carries "<tier> - <project>"; answered and withdrawn questions are no longer faded. (#135)
+- Sessions and managers are told every question must stand on its own: the issue field carries the context and the evidence field what was checked, so a question in Waiting for you reads without the conversation. (no issue)
+- A locked project shows it: an ASCII vault border round its entry in the sidebar and round the whole chat of its manager and each of its sessions, with a Lockdown chip in the chat's header. Level A is a single riveted frame with a » slot on the right; level B a heavy double frame with the lock in red. It follows the level as soon as the settings are saved; unlocked projects look as before. (#129)
+- The message box can no longer be dragged smaller than its standard height (three lines, never shorter than Stop and Send beside it); a smaller height saved by this morning's release is raised to it. (#125)
+- The message box can be made taller by dragging the grip on its top edge up (down makes it smaller again, double-click resets), up to three quarters of the chat; the height is kept in that browser for every session and after a reload. The box's own corner grip is gone. (#123)
+- A project can be renamed in its settings in the page (only there, never by a manager): its sessions, manager, questions, board setting and usage move with it, running sessions keep running, and its folder stays where it is. A name another project has, or one the name rules refuse, is refused and nothing changes. (#116)
+- A running session's ⚙ menu lists its MCP servers with their status and a Reconnect button, which restarts that server (to pick up an update) while the session keeps its conversation. Managers can do the same for their sessions and themselves (`mcp_status`, `reconnect_mcp_server`); only servers a session already has. Works for sessions already running. (#118)
+- A release no longer deletes an old release that the running Ledung or a running session runs from, so on a Mac several releases in a row without a restart no longer stop Ledung from starting sessions; those folders go in a later release once nothing uses them. (#117)
+- Settings has Appearance: System (follows the computer's light or dark setting, the default), Light or Dark. The whole page switches at once, and the choice is kept in that browser. (#113)
+- Board posts can carry evidence: a manager attaches up to 5 screenshots (PNG, JPEG) or logs (.txt, .log, .md, at most 4,000 characters) from its project folder, and you see and pass every file before the post leaves, exactly as it is sent (a copy taken when the post is held, so later changes to the file don't leave); they are kept on a branch of the board repo that keeps no history (removed files can stay reachable through unreachable commits and cached views until GitHub Support removes them), the receiving Ledung keeps a checked copy in its own data folder, its manager can show the screenshots to you in a question, and the Board view shows them. A level B project, or a locked project whose board wasn't let in, sends and gets none; a level A project with the board let in sends and gets files through the same approval. Evidence is dropped when its thread is closed or after 30 days (`board.evidenceDays`), and the copy held for a question nobody answers goes the same way. (no issue)
+- A manager's chat no longer shows its sessions' questions to it; "Show tool calls" brings them back. Questions to you show as before. (#112)
+
+## 2026-10-15
+- Lockdown level B, nearly air-gapped, can be chosen (not on Windows yet): its manager can't reach other managers, projects or the board; its sessions get no MCP servers, plugins, connectors, your own settings or web tools, can't read outside their folders, and run shell commands in the sandbox with no network but the hosts you let in; they get only a short list of Ledung's environment variables; a container project's container must mount only the project folder, no Docker socket, and sit only on the network you mark; it needs Claude Code 2.1.295 or newer. Away mode stays. (#109)
+- Project lockdown, off unless set: other projects' managers see only a locked project's name and can't message (beyond one reply per message), start or stop it, or use its folders; its board and Remote Control are off; other sessions are kept out of its folders; only you can turn it off or down, from the page. Level B isn't available yet. (#109)
+- Sessions can no longer read or change Ledung's data folder (sign-in token, database, hosts' records and logs, other accounts' tokens) or the hosts' sockets; with Claude Code's sandbox on, their shell commands can't read it either. A session host only answers Ledung. Deciding a sensitive prompt or a question about one, turning on away mode, and anything you write or answer to a manager need the open page's key, not just a request with the sign-in cookie. Sessions already running keep working after Restart. (#104)
+- Ledung can be built as an npm package (`npm run pack`, not published yet): installed with `npm install -g`, the `ledung` command creates its data folder and a default config, starts Ledung and opens the page, `ledung --no-open` doesn't, and Restart keeps sessions running as with a release; its Update panel shows the installed version and says updates come from npm. (#105)
+- Settings has Update Ledung: Check for updates says "Up to date" or how many changes are new on main with their changelog lines; Update Ledung pulls, installs, builds a release and restarts, showing each step, and refuses with the reason (uncommitted changes, not on main, not a fast-forward, a step failing) without touching the running Ledung. Each release now records the commit it was built from. (#100)
+- Every question to you now goes through ask_user, however small: sessions and managers are told never to end a reply with a question in the chat, where it would not notify you or show in Waiting for you. (no issue)
+- Every question now needs a tier from its project's list, which starts as the five standard tiers (Blocks a finished PR, Blocks a card from Ready, Process, Housekeeping, Record only) and can be edited but never left empty; a question without one is refused. Questions carry any number of opinions: 2–5 split each option's green border into that many parts, more are named in writing. Waiting for you no longer lists what a manager is handling. (#96)
+- A session just started, waiting for its first message, shows as Ready with a grey boat and the idle (green) dot, like an idle session, instead of a busy "Starting". (#97)
+- In a chat, "Delivered by Ledung" messages with none of your words in them (a session ended, finished a turn, another manager wrote) are hidden; "Show tool calls" brings them back. Your answers, board posts and a session's task and messages from its manager still show. (#94)
+- A Board view shows the managers' messages with other Ledungs, read-only: a thread list with filters (project, board, unread, not delivered) and each thread like a chat with who really sent every post, where it went and links to GitHub and the manager chat; open it from "Board" at the top of the sidebar. (no issue)
+
+## 2026-10-14
+- A project's board repository is picked from a list (boards your other projects use, then every repository your GitHub login can reach, with search), or typed as before, or created: "Create a new private board repo…" asks for owner and name and creates it on GitHub only after you confirm. (no issue)
+- In the screenshot view, a verdict by key or click moves straight to the next shot not yet judged, and sending takes you back to where you opened it from. (#92)
+- The message board is set per project: each project picks its board repository, who may post to its manager, its channels and whether it is the front desk; its settings show who can read that repository and can copy another project's setting. Your current board setup moves to the projects that use it. (no issue)
+- A manager can start a session in its own folder: inside the project, or under the project's new "Extra folders" setting (e.g. its git worktrees). The session header and file panel follow that folder. (no issue)
+- Drag projects, and sessions within a project, into the order you want in the sidebar; on a phone, press and hold first. The order is kept. (#88)
+- Interrupt has moved from a session's header to a small red STOP hexagon above Send, faded out when there is nothing to interrupt. (#89)
+- The message board has its page: a Board section in Settings (state, who may post to your managers with pictures to tick, front desk), a board switch and channels in each project's settings, a Board chip in the sidebar, and board posts marked with who sent them in a manager's chat. (no issue)
+- Managers can talk to managers in other people's Ledungs through a GitHub board (off until a `board` block is in the config and the project turns it on; the page part follows). (no issue)
+- PNG and JPEG images open in the file panel, and show inside Markdown files. (no issue)
+- A project's manager and its sessions can have a name colour, set in the manager's ⚙ menu. (#83)
+- A session's header has a ⚙ menu for its settings, and Ctrl+O shows or hides tool calls. (#81)
+- Notifications are a row in Settings, "Send notifications when an agent is waiting for you", no longer a switch in the sidebar. (#80)
+- Escape, or a second press on the ⚙, takes you back from Settings to the screen you came from. (#78)
+- A manager's header no longer turns into a tall column of single words on a narrow window. (#74)
+- Text you type in a session's message box is kept when you change view, switch session or reload. (#73)
+- Settings holds Accounts, Add project and Restart Ledung; Overview and Usage are at the top of the sidebar; Away sits in a manager's header. (#69)
+- Limit meters lose their "5-hour" / "7-day" headings and show the forecast beside the reset time, for both windows. (#70)
+- Sessions and managers are told when to give a question's full page and when to attach screenshots. (#67)
+- Chat no longer shows Ledung's fixed "has delivered messages for you" sentence, only what was delivered. (#64)
+- Waiting for you can jump to a question in its manager's conversation, and Back returns to where you were. (#61)
+- A question can carry screenshots, which you judge one by one with Pass, Fail or Unsure. (#60)
+- Waiting for you is a question desk: questions grouped by tier, one per page, with title, evidence, options and a recommendation. (#59)
+- The file viewer shows PNG and JPEG images, including those in a Markdown file. (no issue)
+- A project can let its manager use the project tools (add projects, start and stop managers) without asking you; off by default. (no issue)
+- Safari's Add to Dock shows the boat icon instead of a letter. (no issue)
+- Browsers drop the old cached icon and show the new one. (no issue)

package/COMMERCIAL.md

@@ -0,0 +1,10 @@
+# Commercial license
+
+Ledung is dual-licensed. You can use it under either license:
+
+- **The GNU Affero General Public License, version 3 only** ([LICENSE](LICENSE)), with an additional permission for Anthropic's Claude Agent SDK and Claude Code. It costs nothing. In short: if you change Ledung and let other people use your changed version, including over a network, you must offer them its source code under the same license.
+- **A commercial license** from the copyright holders, on terms agreed with them. It is for anyone who wants to use, change or ship Ledung without the AGPL's conditions, for example inside a product or service whose source you don't want to publish.
+
+The copyright holders are Martin Strålenhielm and Simon Rasmussen. For a commercial license, write to [hello@ffbcoop.com](mailto:hello@ffbcoop.com).
+
+Neither license covers Anthropic's Claude Agent SDK or Claude Code. Ledung uses them, installed from npm under [Anthropic's own terms](https://code.claude.com/docs/en/legal-and-compliance), whichever license you have for Ledung.