mulmoterminal 4.0.0 → 4.1.1

package/README.md

@@ -88,9 +88,9 @@ question — an amber dot; nothing proceeds until you answer) and which are **fi
 you haven't seen** (a green dot) — driven by Claude/Codex activity hooks the server injects per
 spawn. The horizontal tab bar carries the same two dots.
 
-![One agent enlarged, with the cockpit roster beside it](https://raw.githubusercontent.com/receptron/mulmoterminal/main/docs/guide/images/cockpit-roster.png)
+![One agent zoomed, with the GUI panel beside it](https://raw.githubusercontent.com/receptron/mulmoterminal/main/docs/guide/images/zoom-canvas.png)
 
-*To focus on one agent, **zoom its cell**: it takes the window, and a pane opens beside it — the **cockpit roster** above, or the **GUI panel** ("Canvas"), where that agent's tool calls render as documents, forms, charts, images, and HTML rather than printed text. **The app opens on the grid** (`/`, settling on `/terminals`), which is the only view; 3.x had a separate single view at `/chat` and 4.0.0 removed it, so that URL now lands on the grid like any other.*
+*To focus on one agent, **zoom its cell**: it takes the window, and the **GUI panel** ("Canvas") opens beside it, where that agent's tool calls render as documents, forms, charts, images, and HTML rather than printed text. **The app opens on the grid** (`/`, settling on `/terminals`), which is the only view; 3.x had a separate single view at `/chat` and 4.0.0 removed it, so that URL now lands on the grid like any other.*
 
 **Inserting a file path** — like a native terminal, you can put a file's absolute path into
 the prompt: **drag a file** onto the terminal, or click the **file button** in the terminal
@@ -204,11 +204,17 @@ more.
 
 Needs **Node ≥ 22.9**, plus these CLIs on your `PATH`:
 
+> **Never installed any of this before?** The guide walks it end to end, macOS and Windows,
+> assuming no command-line experience:
+> [Getting started](https://receptron.github.io/mulmoterminal/guide/en/getting-started.html) ·
+> [はじめに — 起動するまで](https://receptron.github.io/mulmoterminal/guide/ja/getting-started.html)
+
 | | Tool | What it gives you | Install |
 | --- | --- | --- | --- |
 | **Required** | [`claude`](https://claude.com/claude-code) | every Claude session — this app is a cockpit for it | `npm i -g @anthropic-ai/claude-code`, then run `claude` once to log in |
 | **Required** | `git` | [worktree isolation](#git-worktrees--pull-requests), each cell's branch / unsaved-dot / diff readout, the PR footer | `brew install git` · `sudo apt install git` · `sudo dnf install git` · Windows: [git-scm.com](https://git-scm.com/download/win) |
 | **Required** | `gh` | the cross-repo **PRs & Issues** view and one-click PR creation — it uses your `gh` login, so no token is stored | [cli.github.com](https://cli.github.com), then `gh auth login` |
+| Optional | `glab` | the same for **gitlab.com** projects (#981). Same arrangement: the CLI holds the credentials, this app stores no token | `brew install glab`, then `glab auth login` |
 | Recommended | `tmux` | [session persistence](#session-persistence-tmux) — terminals survive a server restart | `brew install tmux` · `sudo apt install tmux` · `sudo dnf install tmux` · no native Windows build (falls back to plain PTYs) |
 | Optional | `codex` | [Codex sessions](#agents-claude--codex) in a cell, alongside Claude | `npm i -g @openai/codex` |
 | Optional | `ffmpeg` | video rendering from the [mulmo-script panel](#wiki-collections--the-gui-panel) (its plugin ships enabled) | `brew install ffmpeg` · `sudo apt install ffmpeg` · `sudo dnf install ffmpeg` |
@@ -536,7 +542,7 @@ The Settings modal (⚙) persists per-user UI choices to `~/.mulmoterminal/confi
 | `soundFile`  | Absolute path to a custom **attention sound**, the fallback for every kind. Empty/unset uses the built-in synthesized chime. |
 | `soundKinds` | Which moments beep — see [Notification sounds](#notification-sounds). Defaults to `["finished","waiting"]`; the other kinds are opt-in. |
 | `sounds`     | Per-kind sound: `{ "waiting": "preset:coin" }`. A `preset:<id>` reference or an absolute path; a kind with no entry falls back to `soundFile`. |
-| `prRepos`    | `owner/repo` entries whose open PRs/issues the cross-repo **PRs & Issues** view aggregates (via your `gh` login). |
+| `prRepos`    | `owner/repo` entries whose open PRs/issues the cross-repo **PRs & Issues** view aggregates, using whichever CLI the host needs — your own `gh` or `glab` login, so no token is stored here. An entry may name its host — `gitlab.com/group/project` is read with `glab`, and work can be started on it, commented on and turned into a merge request. A host that is neither shows a row saying so. |
 | `repoDirs`   | `{ "owner/repo": "/abs/path" }` — which local clone work on a repo starts in, when you keep several side by side. Only the *choice* is stored; which clones exist is re-derived from `cwdPresets` on every read, and an entry that no longer names a clone of that repo is ignored. |
 | `launchers`  | `{ label, command }` entries offered in a grid cell's launcher besides the agents — any interactive command. A plain shell needs no entry: the launch form's **Shell** toggle opens `$SHELL` unconfigured. |
 | `quickCommands` | `{ label, text, agents? }` phrases the **phone** offers as chips on a session's terminal view. Tapping one puts `text` in the input box; it is not sent until you press send. `agents` (`"claude"` / `"codex"` / `"shell"`) scopes a chip to session kinds — omit it to offer the chip everywhere. Empty by default. |
@@ -962,7 +968,7 @@ Closing a worktree cell asks whether to **keep** the worktree or **discard & rem
 
 **PRs & Issues (cross-repo).** The toolbar's **Pull requests** button opens a full-screen
 view that aggregates open PRs **and** issues across the repos listed in Settings →
-**Pull request repos** (`prRepos`, `owner/repo` entries) via your server-side `gh` login.
+**Pull request repos** (`prRepos`, `owner/repo` entries, or `gitlab.com/group/project`) via your server-side `gh` / `glab` login.
 PRs show a CI-rollup / review-decision / draft badge; each repo lists its latest open
 issues. Rows are real links, per-repo errors don't sink the view, and the two lists load
 independently. Backed by `GET /api/prs` and `GET /api/issues`.
@@ -1167,7 +1173,7 @@ quietly answering about the **default workspace** (#1151):
 | --- | --- |
 | `/ws`, `/ws/codex`, `/ws/antigravity`, `/ws/launch`, `/ws/run` | The socket is closed with `{ type: "error", message }`, which the terminal shows as a red banner and does not retry. |
 | A session that is still running (`?session=` names a live PTY or a surviving tmux session) | **Attaches anyway**, with a warning in the server log. Moving or renaming a directory must not shut you out of an agent that is still working in it — and the cwd reported back comes from the running PTY, not from the request. |
-| `GET /api/scripts`, `/api/skills`, `/api/dir-config`, `/api/dir-sound`, `/api/git-status`, `/api/pr-phase`, `/api/header`, `/api/sessions`, `/api/codex/sessions`, `/api/session/:id`, `/api/transcript/*`, `/api/cost` | `404 { error, cwd }` — a directory that is not there. |
+| `GET /api/scripts`, `/api/skills`, `/api/dir-config`, `/api/dir-sound`, `/api/git-status`, `/api/pr-phase`, `/api/header`, `/api/sessions`, `/api/codex/sessions`, `/api/antigravity/sessions`, `/api/session/:id`, `/api/transcript/*`, `/api/cost` | `404 { error, cwd }` — a directory that is not there. |
 | A `?cwd=` that cannot name a directory at all (relative, or repeated as `?cwd=a&cwd=b`) | `400 { error, cwd }`. |
 
 A request that names **no** directory is unaffected: `CLAUDE_CWD` is then the answer it
@@ -1288,6 +1294,7 @@ same-origin-guarded.
 | -------- | ------- |
 | `GET /api/session/:id?cwd=` | One session's summary — cumulative `usage` and `context` (model + last-turn context tokens). Backs the cell token & ctx% badges. |
 | `GET /api/codex/sessions?cwd=` | Codex sessions for the project (from `~/.codex` rollouts), newest first. |
+| `GET /api/antigravity/sessions?cwd=` | Antigravity conversations for the project, newest first. agy does record a workspace, but never as a complete conversation-to-workspace map (`cache/last_conversations.json` keeps one conversation per directory and is written at exit; `history.jsonl` carries no conversation id), so the project comes from MulmoTerminal's own `~/.mulmoterminal/antigravity-conversations.jsonl`; agy's transcript supplies the title. |
 | `GET /api/cost?cwd=&session=` | Estimated $ cost — session / today / month. |
 | `GET /api/transcript/timeline?session=&cwd=` | Per-session activity timeline (tools run). |
 | `GET /api/transcript/last-turn?session=&cwd=&agent=` | A session's last completed exchange (`prompt`, `reply`) plus the `text` to paste into another terminal. `agent=codex` reads the codex rollout instead of the Claude transcript. |
@@ -1302,7 +1309,7 @@ same-origin-guarded.
 | `POST /api/git-remote` | The dir's GitHub repo URL (for the header GitHub menu). |
 | `GET /api/worktrees?cwd=` · `GET /api/worktrees/diff?cwd=` | List managed worktrees / diff one vs its base. |
 | `POST /api/worktrees/create` · `/remove` · `/push` · `/pr` | Create on `agent/<slug>` — or, with `issue: <N>`, on `issue/<N>-<slug>` forked from a freshly fetched `origin/<base>`; remove (managed root only), push, open a PR (`gh`, else compare URL). |
-| `GET /api/prs` · `GET /api/issues` | Open PRs / issues across the configured `prRepos` (via `gh`). |
+| `GET /api/prs` · `GET /api/issues` | Open PRs / issues across the configured `prRepos` — `gh` for github.com entries, `glab` for `gitlab.com/...` ones. |
 | `GET /api/repo-dirs` | Which saved directories clone which GitHub repo, ordered, with the recorded choice per repo. |
 | `POST /api/issues/start` | Cut an issue's worktree in one of that repo's known clones and spawn a session there, seeded with the issue as a draft. |
 | `GET /api/github/star` · `POST /api/github/star` | Whether you have starred MulmoTerminal, and star it (via `gh`). `starred: null` means `gh` could not answer, and hides the button. |
@@ -1651,7 +1658,7 @@ server/
   session/        per-session transcript/activity/cost: transcript.ts,
                   session-resolve.ts, activity-*.ts, cost.ts,
                   command-summary.ts, terminal-replay.ts, file-cache.ts
-  git/            git & GitHub (via gh) + worktrees: git-status.ts, gitRemote.ts,
+  git/            git, GitHub (gh) and GitLab (glab) + worktrees: git-status.ts, gitRemote.ts,
                   gh.ts, prs.ts, issues.ts, pr-for-branch.ts, worktrees.ts, worktree-*.ts
   files/          files-browse.ts (contained tree read/write), pick-file.ts,
                   open-dir.ts, scripts.ts (Run-menu script.json loader)

package/bin/mulmoterminal.js

@@ -85,6 +85,15 @@ function claudeInstalled() {
 const PATH_TOOLS = [
   { cmd: "git", versionArg: "--version", required: true, why: "worktrees, per-cell branch/diff, PR footer", hint: "brew install git  ·  apt install git" },
   { cmd: "gh", versionArg: "--version", required: true, why: "PRs & Issues view + one-click PRs", hint: "https://cli.github.com  (then: gh auth login)" },
+  // Optional rather than a second required tool: github.com is what the app is built around, and a
+  // user with no GitLab project should not be told they are missing something (#981).
+  {
+    cmd: "glab",
+    versionArg: "--version",
+    required: false,
+    why: "the PRs & Issues view for gitlab.com projects",
+    hint: "brew install glab  (then: glab auth login)",
+  },
   { cmd: "tmux", versionArg: "-V", required: false, why: "sessions survive a restart", hint: "brew install tmux  ·  apt install tmux" },
   { cmd: "codex", versionArg: "--version", required: false, why: "run OpenAI Codex as an agent", hint: "npm install -g @openai/codex" },
   {

package/common/dirConfigSource.ts

@@ -82,7 +82,7 @@ export const EMPTY_DIR_CONFIG_EXTRAS: DirConfigExtras = {
 function isEmptyValue(value: unknown): boolean {
   if (value === null || value === undefined) return true;
   if (Array.isArray(value)) return value.length === 0;
-  if (typeof value === "object") return Object.keys(value as Record<string, unknown>).length === 0;
+  if (typeof value === "object") return Object.keys(value).length === 0;
   return false;
 }
 

package/common/issueStartPlan.ts

@@ -0,0 +1,58 @@
+// Whether work on one repo can start here, decided from the repo -> clone answer alone (#1173).
+// Pure, because the three outcomes are the whole behaviour: on the desktop they are a button, a
+// menu, or a disabled button that says why (IssueStartButton.vue).
+//
+// In `common/` because BOTH hosts decide from it: the phone asks the same question over the remote
+// command channel (#1184) and must reach the same answer — with one difference it makes itself,
+// not one encoded here. It cannot offer the menu (the phone never picks a directory, see
+// docs/remote-host-protocol.md), so it refuses `choose` where the desktop opens it.
+import type { RepoDirs } from "./repoDirs";
+import { GITHUB_HOST, GITLAB_HOST, parseRepoEntry } from "./repoEntry";
+
+// Where work can be STARTED — the issue is read and a worktree cut. A host that is merely listable
+// still refuses, and says which host it is rather than blaming a missing clone (#981).
+const STARTABLE_HOSTS: ReadonlySet<string> = new Set([GITHUB_HOST, GITLAB_HOST]);
+
+/** The hosts named in a refusal, read off the set rather than written out beside it — a hardcoded
+ *  "github.com only" survived GitLab becoming startable and told users the opposite of the truth
+ *  (Codex review). Exported so the phone's refusal says the same thing. */
+export const startableHosts = (): string => [...STARTABLE_HOSTS].join(" and ");
+
+export type IssueStartPlan =
+  /** No clone of this repo on this machine, so there is nowhere for the work to happen. */
+  | { kind: "no-clone" }
+  /** The repo is on a forge whose issues can be LISTED but not started from (#981). Distinct from
+   *  `no-clone`, which would send the reader off to add a clone that would not help. */
+  | { kind: "unsupported-forge"; host: string }
+  /** Exactly one answer — either recorded, or the only candidate. One click starts. */
+  | { kind: "ready"; dir: string }
+  /** Several clones and nothing recorded yet: the user picks, and the pick is remembered. */
+  | { kind: "choose"; dirs: RepoDirs["dirs"] };
+
+/** A plan that cannot start work as it stands. Named so a caller that has already narrowed to it
+ *  can be given a sentence rather than a nullable one — see the phone's refusal (#1184). */
+export type BlockedIssueStartPlan = Exclude<IssueStartPlan, { kind: "ready" }>;
+
+// `repo` is REQUIRED, not optional, even though only one branch reads it: a caller that omitted it
+// would get `no-clone` for a GitLab repo, which is the exact wrong answer this parameter was added
+// to fix. Making the compiler ask for it is what stops that coming back.
+export function issueStartPlan(entry: RepoDirs | undefined, repo: string): IssueStartPlan {
+  // Checked before the clone list, because a GitLab repo has no entry there and would otherwise
+  // read as "no clone" — a reason that is not true and points at the wrong fix.
+  const parsed = parseRepoEntry(repo);
+  if (parsed && !STARTABLE_HOSTS.has(parsed.host)) return { kind: "unsupported-forge", host: parsed.host };
+  const dirs = entry?.dirs ?? [];
+  if (dirs.length === 0) return { kind: "no-clone" };
+  // A recording wins even when the repo has one clone: it is still the same answer, and treating
+  // the two cases the same keeps "recorded" from being a state the UI has to distinguish.
+  const recorded = entry?.primary;
+  if (recorded) return { kind: "ready", dir: recorded };
+  if (dirs.length === 1) return { kind: "ready", dir: dirs[0].path };
+  return { kind: "choose", dirs };
+}
+
+/** Why the control is disabled, for the row's title text. Null when it is not disabled. */
+export function issueStartBlockedReason(plan: IssueStartPlan, repo: string): string | null {
+  if (plan.kind === "unsupported-forge") return `Starting work supports ${startableHosts()} — ${plan.host} issues are listed here, not started from`;
+  return plan.kind === "no-clone" ? `No local clone of ${repo} — add one to your directory presets to start work here` : null;
+}

package/common/keymap.ts

@@ -10,6 +10,8 @@
 //   "keymap": { "zoom-next": "PageDown", "zoom-prev": "Shift+PageUp" }
 
 // Actions a key can be bound to. Adding one here is all it takes for the config to accept it.
+import { isRecord } from "./isRecord.js";
+
 export const KEYMAP_ACTIONS = [
   "zoom-toggle",
   "zoom-next",
@@ -23,7 +25,7 @@ export const KEYMAP_ACTIONS = [
 ] as const;
 export type KeymapAction = (typeof KEYMAP_ACTIONS)[number];
 
-export const isKeymapAction = (value: unknown): value is KeymapAction => typeof value === "string" && (KEYMAP_ACTIONS as readonly string[]).includes(value);
+export const isKeymapAction = (value: unknown): value is KeymapAction => typeof value === "string" && KEYMAP_ACTIONS.some((action) => action === value);
 
 // action -> binding string. Absent action = unbound = that shortcut does nothing.
 // Actions the GRID's key handler must never claim, because they are decided inside the terminal
@@ -122,8 +124,7 @@ export function actionForKey(keymap: Keymap, e: KeymapKeyEvent): KeymapAction |
   return null;
 }
 
-const isSendBinding = (value: unknown): value is SendBinding =>
-  typeof value === "object" && value !== null && typeof (value as SendBinding).key === "string" && typeof (value as SendBinding).bytes === "string";
+const isSendBinding = (value: unknown): value is SendBinding => isRecord(value) && typeof value.key === "string" && typeof value.bytes === "string";
 
 // The bytes this keydown should put into the terminal, or null when it is not a send binding.
 //
@@ -160,7 +161,7 @@ export function validateKeymap(input: unknown): KeymapProblem[] {
   if (typeof input !== "object" || Array.isArray(input)) {
     return [{ action: "keymap", binding: input, reason: "`keymap` must be an object of action -> key binding", fatal: true }];
   }
-  const entries = Object.entries(input as Record<string, unknown>);
+  const entries = Object.entries(input);
   // A claim on one keystroke. `rank` is DISPATCH order, so the winner can be named: every action
   // outranks every send binding, because the grid's handler runs in the capture phase and stops
   // the event before the terminal — see sendBytesFor.
@@ -241,12 +242,11 @@ const canonicalBinding = (b: KeyBinding): string => `${b.shift ? "S" : ""}${b.al
 // malformed bindings are dropped rather than rejecting the whole map, matching how the
 // rest of the config treats one bad entry.
 export function sanitizeKeymap(input: unknown): Keymap {
-  if (typeof input !== "object" || input === null || Array.isArray(input)) return {};
-  const raw = input as Record<string, unknown>;
-  const entries = Object.entries(raw).filter(
+  if (!isRecord(input)) return {};
+  const entries = Object.entries(input).filter(
     (entry): entry is [KeymapAction, string] => isKeymapAction(entry[0]) && typeof entry[1] === "string" && parseKeyBinding(entry[1]) !== null,
   );
-  const send = sanitizeSendBindings(raw.send);
+  const send = sanitizeSendBindings(input.send);
   return { ...Object.fromEntries(entries), ...(send.length ? { send } : {}) };
 }
 

package/common/prPhase.ts

@@ -10,7 +10,7 @@ export type PrPhase = "none" | "draft" | "ci-failing" | "changes-requested" | "c
 
 export const PR_PHASES: readonly PrPhase[] = ["none", "draft", "ci-failing", "changes-requested", "ci-running", "ready", "merged", "closed"];
 
-export const isPrPhase = (v: unknown): v is PrPhase => typeof v === "string" && (PR_PHASES as readonly string[]).includes(v);
+export const isPrPhase = (v: unknown): v is PrPhase => typeof v === "string" && PR_PHASES.some((phase) => phase === v);
 
 // The /api/pr-phase response. `phase` and `prUrl` predate the rest and the roster reads them;
 // the numbers are what lets a cell say WHICH work it is on rather than just how far along it is.
@@ -24,9 +24,26 @@ export interface WorkItem {
   // list above all, where "#987" alone says nothing about which request is running (#1014).
   prTitle: string | null;
   issueTitle: string | null;
+  // WHY a request that is open and not obviously failing still cannot merge. GitLab collapses into
+  // one `detailed_merge_status` what GitHub splits across `isDraft`, `reviewDecision` and the check
+  // rollup, and three of its values — approvals outstanding, unresolved discussions, blocked by
+  // another request — have no home in `PrPhase`. Forcing them into `ready` would call something
+  // unmergeable ready, and into `changes-requested` would invent a review nobody left.
+  //
+  // Always null on GitHub, whose phases say everything there is to say (#981).
+  blockedReason: string | null;
 }
 
-export const EMPTY_WORK_ITEM: Readonly<WorkItem> = { phase: "none", pr: null, prUrl: null, issue: null, issueUrl: null, prTitle: null, issueTitle: null };
+export const EMPTY_WORK_ITEM: Readonly<WorkItem> = {
+  phase: "none",
+  pr: null,
+  prUrl: null,
+  issue: null,
+  issueUrl: null,
+  prTitle: null,
+  issueTitle: null,
+  blockedReason: null,
+};
 
 // One line for a surface with room for one: what the work is FOR beats what was done about it, so
 // the issue's title wins when there is one. Null when neither side has a title to show.

package/common/repoEntry.ts

@@ -0,0 +1,77 @@
+// Reading a configured repository entry — `owner/repo`, or `host/owner/repo` for one that is not
+// on GitHub (#981).
+//
+// In `common/` because BOTH sides decide from it: the server turns an entry into a forge to know
+// which CLI to run, and the browser needs the same answer to say why a control is off. Written
+// twice it would drift, and the two answers disagreeing is precisely the failure this abstraction
+// is undoing.
+
+export const GITHUB_HOST = "github.com";
+export const GITLAB_HOST = "gitlab.com";
+
+// A leading segment containing a DOT is the host. GitHub user and organisation names may hold only
+// alphanumerics and hyphens, so `owner/repo` and `host/owner/repo` cannot be confused.
+const HOST_SEGMENT = /\./;
+
+export interface RepoEntry {
+  host: string;
+  /** The segments after the host — how many of them name a project is the HOST's rule, not this. */
+  path: string[];
+  /** True when the entry spelled the host out. `owner/repo` implies github.com without saying it. */
+  declared: boolean;
+}
+
+/** Split an entry into host and path, or null when it is not one.
+ *
+ *  Null for an empty segment — a doubled, leading or trailing slash. Forgiving those would let
+ *  `owner//repo` parse as `owner/repo` while the entry is STORED verbatim and handed to a CLI with
+ *  the extra slash still in it, which is a parse error there.
+ */
+export function parseRepoEntry(entry: string): RepoEntry | null {
+  const segments = entry.trim().split("/");
+  if (segments.some((segment) => segment === "")) return null;
+  const declared = segments.length > 1 && HOST_SEGMENT.test(segments[0]);
+  return declared ? { host: segments[0].toLowerCase(), path: segments.slice(1), declared } : { host: GITHUB_HOST, path: segments, declared };
+}
+
+/** The identity a repository is known by ON ITS OWN HOST — `owner/repo` for GitHub, the group path
+ *  for GitLab — with any declared host stripped.
+ *
+ *  `/api/repo-dirs` keys by this, because it derives the name from a clone's remote URL where the
+ *  host is not part of the path. A configured entry may spell the host out (`github.com/owner/repo`
+ *  became storable in #981 step 2a), so comparing the raw entry against those keys finds nothing
+ *  and reports "no local clone" for a repo that has one (Codex review).
+ */
+export const canonicalRepo = (entry: string): string => parseRepoEntry(entry)?.path.join("/") ?? entry.trim();
+
+/** The identity used to MATCH a configured entry against a resolved clone: always host-qualified.
+ *
+ *  Distinct from `canonicalRepo`, which strips the host because that is what a CLI's `--repo`
+ *  wants. Matching needs the opposite: without the host, `github.com/a/b` and `gitlab.com/a/b`
+ *  collapse to the same key, and a clone of one would answer for the other (#981).
+ */
+export const repoIdentity = (entry: string): string => {
+  const parsed = parseRepoEntry(entry);
+  return parsed ? `${parsed.host}/${parsed.path.join("/")}`.toLowerCase() : entry.trim().toLowerCase();
+};
+
+// The value reaches a CLI's `--repo`, so no spaces and nothing readable as a flag.
+const REPO_CHARS_RE = /^[A-Za-z0-9._/-]+$/;
+// Every forge names a project as namespace + name, so one segment is never a repository.
+const NAMESPACED = 2;
+
+/** Whether a string may be stored and used as a repository entry.
+ *
+ *  The ONE rule. It was written out four times — the config sanitizer, both issue-start endpoints
+ *  and the Settings field — and widening only the first meant an entry the user could save was
+ *  rejected by everything downstream, including the form that was supposed to accept it (#981).
+ *
+ *  A hostless entry must be exactly `owner/repo`: `gh --repo` reads `a/b/c` as host `a`, so
+ *  accepting it would have this side and the CLI aiming at different servers. A declared host may
+ *  be followed by a nested GitLab group.
+ */
+export function isRepoEntry(entry: string): boolean {
+  const parsed = REPO_CHARS_RE.test(entry.trim()) ? parseRepoEntry(entry) : null;
+  if (!parsed) return false;
+  return parsed.declared ? parsed.path.length >= NAMESPACED : parsed.path.length === NAMESPACED;
+}

package/common/sessionAgent.ts

@@ -16,7 +16,7 @@ export type TerminalAgent = (typeof TERMINAL_AGENTS)[number];
 // A remembered agent — a persisted grid cell, a localStorage toggle, a query param — read back.
 // Validated rather than cast: anything unrecognised is Claude, which is also what an older
 // persisted cell (written before the field existed) means.
-export const asTerminalAgent = (value: unknown): TerminalAgent => (TERMINAL_AGENTS.some((agent) => agent === value) ? (value as TerminalAgent) : "claude");
+export const asTerminalAgent = (value: unknown): TerminalAgent => (typeof value === "string" && isTerminalAgent(value) ? value : "claude");
 
 // Narrowing rather than coercing, for the callers that must be able to say "this is not an agent
 // at all": a shell is a session kind but not something a cell can be relaunched AS, and reading

package/common/terminalSubmit.ts

@@ -13,7 +13,7 @@ export type TerminalSubmitMode = (typeof TERMINAL_SUBMIT_MODES)[number];
 export const DEFAULT_TERMINAL_SUBMIT_MODE: TerminalSubmitMode = "cr";
 
 export const isTerminalSubmitMode = (value: unknown): value is TerminalSubmitMode =>
-  typeof value === "string" && (TERMINAL_SUBMIT_MODES as readonly string[]).includes(value);
+  typeof value === "string" && TERMINAL_SUBMIT_MODES.some((mode) => mode === value);
 
 // CR on its own. ESC+CR is what a terminal emits for Alt/Meta+Enter.
 const CR = "\r";

package/common/themeVars.ts

@@ -50,7 +50,7 @@ export function isThemeIdLike(value: unknown): value is string {
 }
 
 export function isBuiltinThemeId(id: string): id is ThemeId {
-  return (THEME_IDS as readonly string[]).includes(id);
+  return THEME_IDS.some((builtin) => builtin === id);
 }
 
 /** Whether an id may be used for a CUSTOM theme. Built-in ids are refused rather than merged
@@ -69,14 +69,22 @@ export interface CustomThemeInput {
 
 /** The full variable set for a theme: the base it extends, with its own colours on top.
  *  `builtins` supplies the base sets so this stays pure — the client reads them from the
- *  stylesheet's source of truth, the specs from a fixture. */
-export function resolveThemeVars(theme: CustomThemeInput, builtins: Record<ThemeId, ThemeVars>): ThemeVars | null {
+ *  stylesheet's source of truth, the specs from a fixture. PARTIAL because a base can genuinely be
+ *  missing (a stylesheet read that found no block for that id), and the `?? {}` below has always
+ *  handled that — the map only ever needed one key, never all of them. */
+// Every variable present, which is what separates a set we can paint with from one we cannot.
+// A guard rather than a length check on the missing keys: both ask the same question, but only
+// this one hands the answer to the compiler.
+function isCompleteThemeVars(vars: Partial<ThemeVars>): vars is ThemeVars {
+  return THEME_VAR_KEYS.every((key) => !!vars[key]);
+}
+
+export function resolveThemeVars(theme: CustomThemeInput, builtins: Partial<Record<ThemeId, ThemeVars>>): ThemeVars | null {
   const base = theme.extends ? builtins[theme.extends] : null;
-  const merged = { ...(base ?? {}), ...theme.colors } as Partial<ThemeVars>;
-  const missing = THEME_VAR_KEYS.filter((key) => !merged[key]);
+  const merged: Partial<ThemeVars> = { ...(base ?? {}), ...theme.colors };
   // No base and an incomplete list is the one case we cannot paint: report it rather than
   // leaving the gaps to whatever the previously applied theme put on the element.
-  return missing.length ? null : (merged as ThemeVars);
+  return isCompleteThemeVars(merged) ? merged : null;
 }
 
 function channel(hex: string, at: number): number {

package/common/voiceInputStatus.ts

@@ -6,6 +6,8 @@
 // package implements transcription behind it is not the UI's business. The server's
 // `getVoiceInputStatus(): VoiceInputStatus` annotation is what keeps the two in step.
 
+import { isRecord } from "./isRecord.js";
+
 export type VoiceModelState = "idle" | "downloading" | "ready" | "error";
 
 export interface VoiceInputStatus {
@@ -19,3 +21,15 @@ export interface VoiceInputStatus {
     error?: string;
   };
 }
+
+export const VOICE_MODEL_STATES: readonly VoiceModelState[] = ["idle", "downloading", "ready", "error"];
+
+/** The wire response as it arrives from `GET /api/transcribe/model`. Lives beside the type so the
+ *  guard and the shape it checks cannot drift; the UI treats anything else as "no status". */
+export function isVoiceInputStatus(value: unknown): value is VoiceInputStatus {
+  if (!isRecord(value) || typeof value.capable !== "boolean" || !isRecord(value.model)) return false;
+  const { name, state, progress, error } = value.model;
+  if (typeof name !== "string" || !VOICE_MODEL_STATES.some((known) => known === state)) return false;
+  if (progress !== undefined && typeof progress !== "number") return false;
+  return error === undefined || typeof error === "string";
+}

package/dist/assets/{abnfDiagram-VRR7QNED-RjiYivmv-Ds795mMl.js → abnfDiagram-VRR7QNED-RjiYivmv-CuUAI5MR.js}

@@ -1 +1 @@
-import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-Brzfja-q-ch1VcTiG.js";import{_ as n,g as r}from"./mermaid-parser.core-DxEa8E3F-nhwF9Zmw.js";import"./chunk-WYO6CB5R-BlzOfotS-CIUpBpsn.js";import"./chunk-VAUOI2AC-CS9QJ4yz-6Fqcztnb.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-CMZRaeqt-CuddDdck.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};
+import{n as e}from"./chunk-Y2CYZVJY-Bdt8pFDJ-DsF7k-Jl.js";import{f as t}from"./src-Brzfja-q-ch1VcTiG.js";import{_ as n,g as r}from"./mermaid-parser.core-DxEa8E3F-akMN_vOP.js";import"./chunk-WYO6CB5R-BlzOfotS-CeZxJxL0.js";import"./chunk-VAUOI2AC-CS9QJ4yz-BZe0Q9XX.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-CMZRaeqt-DcPt_trW.js";import{t as s}from"./chunk-JWPE2WC7-BQ3zXr2k-DSd3Ct95.js";var c=r().RailroadAbnf.parser.LangiumParser,l=e(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=e(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=e(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=e(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=e(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=e(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=e(e=>{s(e,a),e.title&&a.setTitle(e.title),e.rules.map(e=>a.addRule(m(e)))},`populateDb`),g={parser:{parse:e(e=>{a.clear(),t.debug(`[ABNF Parser] Starting Langium parse`);let r=c.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new n(r);let i=r.value;t.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),t.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:a}},db:a,renderer:o,styles:i};export{g as diagram};

package/dist/assets/architecture-TIHT7OUA-0NsD2xW1-B89nYL-T.js

@@ -0,0 +1 @@
+import{f as e}from"./mermaid-parser.core-DxEa8E3F-akMN_vOP.js";export{e as createArchitectureServices};