palmier 0.8.0 → 0.8.3

package/dist/task.js

@@ -1,9 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-/**
- * Parse a TASK.md file from the given task directory.
- */
 export function parseTaskFile(taskDir) {
     const filePath = path.join(taskDir, "TASK.md");
     if (!fs.existsSync(filePath)) {
@@ -12,9 +9,6 @@ export function parseTaskFile(taskDir) {
     const content = fs.readFileSync(filePath, "utf-8");
     return parseTaskContent(content);
 }
-/**
- * Parse TASK.md content string into frontmatter + body.
- */
 export function parseTaskContent(content) {
     const fmRegex = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
     const match = content.match(fmRegex);
@@ -30,10 +24,6 @@ export function parseTaskContent(content) {
     frontmatter.schedule_enabled ??= true;
     return { frontmatter };
 }
-/**
- * Write a TASK.md file to the given task directory.
- * Creates the directory if it doesn't exist.
- */
 export function writeTaskFile(taskDir, task) {
     fs.mkdirSync(taskDir, { recursive: true });
     const yamlStr = stringifyYaml(task.frontmatter).trim();
@@ -41,17 +31,10 @@ export function writeTaskFile(taskDir, task) {
     const filePath = path.join(taskDir, "TASK.md");
     fs.writeFileSync(filePath, content, "utf-8");
 }
-/**
- * Append a task ID to the project-level tasks.jsonl file.
- */
 export function appendTaskList(projectRoot, taskId) {
     const listPath = path.join(projectRoot, "tasks.jsonl");
     fs.appendFileSync(listPath, JSON.stringify({ task_id: taskId }) + "\n", "utf-8");
 }
-/**
- * Remove a task ID from the project-level tasks.jsonl file.
- * Returns true if the entry was found and removed.
- */
 export function removeFromTaskList(projectRoot, taskId) {
     const listPath = path.join(projectRoot, "tasks.jsonl");
     if (!fs.existsSync(listPath))
@@ -75,9 +58,6 @@ export function removeFromTaskList(projectRoot, taskId) {
     fs.writeFileSync(listPath, remaining.length > 0 ? remaining.join("\n") + "\n" : "", "utf-8");
     return true;
 }
-/**
- * List all tasks referenced in tasks.jsonl.
- */
 export function listTasks(projectRoot) {
     const listPath = path.join(projectRoot, "tasks.jsonl");
     if (!fs.existsSync(listPath))
@@ -102,23 +82,13 @@ export function listTasks(projectRoot) {
     }
     return tasks.reverse();
 }
-/**
- * Get the directory path for a task by its ID.
- */
 export function getTaskDir(projectRoot, taskId) {
     return path.join(projectRoot, "tasks", taskId);
 }
-/**
- * Write task status to status.json in the task directory.
- */
 export function writeTaskStatus(taskDir, status) {
     const filePath = path.join(taskDir, "status.json");
     fs.writeFileSync(filePath, JSON.stringify(status), "utf-8");
 }
-/**
- * Read task status from status.json in the task directory.
- * Returns undefined if the file doesn't exist.
- */
 export function readTaskStatus(taskDir) {
     const filePath = path.join(taskDir, "status.json");
     try {
@@ -128,10 +98,7 @@ export function readTaskStatus(taskDir) {
         return undefined;
     }
 }
-/**
- * Create a run directory with an initial TASKRUN.md file.
- * Returns the run ID (timestamp string used as directory name).
- */
+/** Returns the run ID (timestamp string used as directory name). */
 export function createRunDir(taskDir, taskName, startTime, agent) {
     const runId = String(startTime);
     const runDir = path.join(taskDir, runId);
@@ -141,15 +108,9 @@ export function createRunDir(taskDir, taskName, startTime, agent) {
     fs.writeFileSync(path.join(runDir, "TASKRUN.md"), content, "utf-8");
     return runId;
 }
-/**
- * Get the path to a run directory.
- */
 export function getRunDir(taskDir, runId) {
     return path.join(taskDir, runId);
 }
-/**
- * Append a conversation message to a run's TASKRUN.md file.
- */
 export function appendRunMessage(taskDir, runId, msg) {
     const attrs = [`role="${msg.role}"`, `time="${msg.time}"`];
     if (msg.type)
@@ -160,10 +121,6 @@ export function appendRunMessage(taskDir, runId, msg) {
     const entry = `${delimiter}\n\n${msg.content}\n\n`;
     fs.appendFileSync(path.join(taskDir, runId, "TASKRUN.md"), entry, "utf-8");
 }
-/**
- * Begin a streaming assistant message — writes the delimiter only.
- * Returns a writer that appends content chunks and finalizes the message.
- */
 export function beginStreamingMessage(taskDir, runId, time) {
     const filePath = path.join(taskDir, runId, "TASKRUN.md");
     const delimiter = `<!-- palmier:message role="assistant" time="${time}" -->`;
@@ -184,7 +141,7 @@ export class StreamingMessageWriter {
         fs.appendFileSync(this.filePath, "\n\n", "utf-8");
         if (attachments?.length) {
             const raw = fs.readFileSync(this.filePath, "utf-8");
-            // Find the last assistant delimiter (may differ from the original if spliceUserMessage created a new one)
+            // spliceUserMessage may have created a newer assistant delimiter.
             const pattern = /<!-- palmier:message role="assistant" time="\d+" -->/g;
             let lastMatch = null;
             let m;
@@ -200,32 +157,23 @@ export class StreamingMessageWriter {
     }
 }
 /**
- * Splice a user message into a running assistant stream.
- * Ends the current assistant block, writes the user message,
- * then opens a new assistant block — all as direct file appends.
- * The existing StreamingMessageWriter keeps working because its
- * write() is just appendFileSync, so subsequent chunks land in
- * the new assistant block.
+ * Splice a user message into a running assistant stream: close the current
+ * assistant block, write the user message, open a new assistant block. Direct
+ * appends only, so an existing StreamingMessageWriter keeps working — its
+ * subsequent chunks land in the new block.
  */
 export function spliceUserMessage(taskDir, runId, userMsg, 
 /** Optional text to append to the current assistant block before ending it. */
 assistantAppend) {
     const filePath = path.join(taskDir, runId, "TASKRUN.md");
-    // 1. Optionally append to the current assistant block (e.g. the input questions)
     if (assistantAppend) {
         fs.appendFileSync(filePath, assistantAppend, "utf-8");
     }
-    // 2. End the current assistant block
     fs.appendFileSync(filePath, "\n\n", "utf-8");
-    // 3. Write the user message
     appendRunMessage(taskDir, runId, userMsg);
-    // 4. Open a new assistant block for subsequent agent output
     const delimiter = `<!-- palmier:message role="assistant" time="${Date.now()}" -->`;
     fs.appendFileSync(filePath, `${delimiter}\n\n`, "utf-8");
 }
-/**
- * Read conversation messages from a run's TASKRUN.md file.
- */
 export function readRunMessages(taskDir, runId) {
     const raw = fs.readFileSync(path.join(taskDir, runId, "TASKRUN.md"), "utf-8");
     const fmMatch = raw.match(/^---\n[\s\S]*?\n---\n([\s\S]*)$/);
@@ -257,17 +205,10 @@ export function readRunMessages(taskDir, runId) {
     }
     return messages;
 }
-/**
- * Append a history entry to the project-level history.jsonl file.
- */
 export function appendHistory(projectRoot, entry) {
     const historyPath = path.join(projectRoot, "history.jsonl");
     fs.appendFileSync(historyPath, JSON.stringify(entry) + "\n", "utf-8");
 }
-/**
- * Delete a history entry and its associated run directory.
- * Returns true if the entry was found and removed.
- */
 export function deleteHistoryEntry(projectRoot, taskId, runId) {
     const historyPath = path.join(projectRoot, "history.jsonl");
     if (!fs.existsSync(historyPath))
@@ -289,17 +230,13 @@ export function deleteHistoryEntry(projectRoot, taskId, runId) {
     if (!found)
         return false;
     fs.writeFileSync(historyPath, remaining.length > 0 ? remaining.join("\n") + "\n" : "", "utf-8");
-    // Delete the run directory
     const runDir = path.join(projectRoot, "tasks", taskId, runId);
     if (fs.existsSync(runDir)) {
         fs.rmSync(runDir, { recursive: true, force: true });
     }
     return true;
 }
-/**
- * Read history entries from history.jsonl with pagination.
- * Returns entries sorted most-recent-first.
- */
+/** Returns entries most-recent-first. */
 export function readHistory(projectRoot, opts) {
     const historyPath = path.join(projectRoot, "history.jsonl");
     if (!fs.existsSync(historyPath))

package/dist/transports/http-transport.d.ts

@@ -1,9 +1,5 @@
 import { type NatsConnection } from "nats";
 import type { HostConfig, RpcMessage } from "../types.js";
 export declare function detectLanIp(): string;
-/**
- * Start the HTTP transport: server with RPC, SSE, PWA proxy, pairing, and
- * localhost-only agent endpoints (notify, request-input, confirmation, permission).
- */
 export declare function startHttpTransport(config: HostConfig, handleRpc: (req: RpcMessage) => Promise<unknown>, port: number, nc: NatsConnection | undefined, pairingCode?: string, onReady?: () => void): Promise<void>;
 //# sourceMappingURL=http-transport.d.ts.map

package/dist/transports/http-transport.js

@@ -29,21 +29,17 @@ function guessContentType(urlPath) {
     const ext = urlPath.match(/\.[^.]+$/)?.[0] ?? "";
     return CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
-/**
- * Read a PWA asset from the bundled pwa/ directory, caching in memory.
- * Returns null if the file does not exist.
- */
 function getAsset(urlPath) {
     const cached = assetCache.get(urlPath);
     if (cached)
         return cached;
     const filePath = path.join(PWA_DIR, urlPath === "/" ? "index.html" : urlPath);
-    // Prevent path traversal
+    // Prevent path traversal.
     if (!filePath.startsWith(PWA_DIR))
         return null;
     try {
         let data = fs.readFileSync(filePath);
-        // Inject marker into index HTML so the PWA can detect it's served by palmier
+        // Marker lets the PWA detect it's served by palmier.
         if (urlPath === "/") {
             const html = data.toString("utf-8").replace("</head>", "<script>window.__PALMIER_SERVE__=true</script></head>");
             data = Buffer.from(html, "utf-8");
@@ -68,10 +64,6 @@ export function detectLanIp() {
     }
     return "127.0.0.1";
 }
-/**
- * Start the HTTP transport: server with RPC, SSE, PWA proxy, pairing, and
- * localhost-only agent endpoints (notify, request-input, confirmation, permission).
- */
 export async function startHttpTransport(config, handleRpc, port, nc, pairingCode, onReady) {
     const sseClients = new Set();
     const mcpStreams = new Map();
@@ -96,7 +88,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
     for (const resource of agentResources) {
         resource.subscribe(() => broadcastResourceUpdated(resource.uri));
     }
-    // If a pairing code is provided, pre-register it
     if (pairingCode) {
         const EXPIRY_MS = 24 * 60 * 60 * 1000;
         const timer = setTimeout(() => { pendingPairs.delete(pairingCode); }, EXPIRY_MS);
@@ -136,9 +127,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
         const addr = req.socket.remoteAddress;
         return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
     }
-    /**
-     * Publish an event via NATS and SSE.
-     */
     async function publishEvent(taskId, payload) {
         const sc = StringCodec();
         const subject = `host-event.${config.hostId}.${taskId}`;
@@ -153,7 +141,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
     const server = http.createServer(async (req, res) => {
         const url = new URL(req.url ?? "/", `http://localhost:${port}`);
         const pathname = url.pathname;
-        // ── MCP streamable HTTP endpoint ──────────────────────────────────
         if (req.method === "POST" && pathname === "/mcp") {
             if (!isLocalhost(req)) {
                 sendJson(res, 403, { error: "localhost only" });
@@ -168,7 +155,7 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
                     res.setHeader("Mcp-Session-Id", result.sessionId);
                 }
                 if (result.stream && sessionId) {
-                    // Keep response open as SSE stream for server-initiated notifications
+                    // Keep the response open as SSE for server-initiated notifications.
                     res.writeHead(200, {
                         "Content-Type": "text/event-stream",
                         "Cache-Control": "no-cache",
@@ -192,7 +179,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── Auto-generated REST endpoints from MCP tool registry ──────────
         if (req.method === "POST" && agentToolMap.has(pathname.slice(1))) {
             if (!isLocalhost(req)) {
                 sendJson(res, 403, { error: "localhost only" });
@@ -225,7 +211,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── Auto-generated REST endpoints from MCP resource registry ────
         const matchedResource = req.method === "GET" && agentResources.find((r) => r.restPath === pathname);
         if (matchedResource) {
             if (!isLocalhost(req)) {
@@ -248,7 +233,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             sendJson(res, 200, result);
             return;
         }
-        // ── Event queue pop (used by event-triggered palmier run) ─────────
         if (req.method === "POST" && pathname === "/task-event/pop") {
             if (!isLocalhost(req)) {
                 sendJson(res, 403, { error: "localhost only" });
@@ -262,7 +246,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             sendJson(res, 200, popEvent(taskId));
             return;
         }
-        // ── Localhost-only endpoints (no auth) ─────────────────────────────
         if (req.method === "POST" && pathname === "/event") {
             if (!isLocalhost(req)) {
                 sendJson(res, 403, { error: "localhost only" });
@@ -315,7 +298,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── POST /request-permission — held connection ──────────────────────
         if (req.method === "POST" && pathname === "/request-permission") {
             if (!isLocalhost(req)) {
                 sendJson(res, 403, { error: "localhost only" });
@@ -352,7 +334,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── Public pair endpoint — no auth, PWA posts pairing code here ────────
         if (req.method === "POST" && pathname === "/pair") {
             try {
                 const body = await readBody(req);
@@ -383,8 +364,7 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── PWA assets (on-the-fly, cached) ────────────────────────────────
-        // Skip service worker and manifest — they require HTTPS which LAN mode doesn't use
+        // Service worker and manifest require HTTPS, which LAN mode doesn't use.
         const SKIP = new Set(["/registerSW.js", "/service-worker.js", "/manifest.webmanifest"]);
         const isApiRoute = pathname === "/events" || pathname.startsWith("/rpc/");
         if (!isApiRoute) {
@@ -392,7 +372,7 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
                 sendJson(res, 404, { error: "Not found" });
                 return;
             }
-            // Try exact path, then fall back to index.html (SPA routing)
+            // Fall back to index.html for SPA routing.
             let asset = getAsset(pathname);
             if (!asset && pathname !== "/") {
                 asset = getAsset("/");
@@ -406,12 +386,11 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             }
             return;
         }
-        // ── API endpoints require auth (localhost is trusted) ───────────────
+        // Localhost is trusted; all other API callers require a client token.
         if (!isLocalhost(req) && !checkAuth(req)) {
             sendJson(res, 401, { error: "Unauthorized" });
             return;
         }
-        // SSE event stream
         if (req.method === "GET" && pathname === "/events") {
             res.writeHead(200, {
                 "Content-Type": "text/event-stream",
@@ -429,7 +408,6 @@ export async function startHttpTransport(config, handleRpc, port, nc, pairingCod
             });
             return;
         }
-        // RPC endpoint: POST /rpc/<method>
         if (req.method === "POST" && pathname.startsWith("/rpc/")) {
             const method = pathname.slice("/rpc/".length);
             if (!method) {

package/dist/transports/nats-transport.d.ts

@@ -1,8 +1,4 @@
 import { type NatsConnection } from "nats";
 import type { HostConfig, RpcMessage } from "../types.js";
-/**
- * Start the NATS transport using an existing connection.
- * Subscribe to RPC subjects and dispatch to handler.
- */
 export declare function startNatsTransport(config: HostConfig, handleRpc: (req: RpcMessage) => Promise<unknown>, nc: NatsConnection): Promise<void>;
 //# sourceMappingURL=nats-transport.d.ts.map

package/dist/transports/nats-transport.js

@@ -1,14 +1,9 @@
 import { StringCodec } from "nats";
-/**
- * Start the NATS transport using an existing connection.
- * Subscribe to RPC subjects and dispatch to handler.
- */
 export async function startNatsTransport(config, handleRpc, nc) {
     const sc = StringCodec();
     const subject = `host.${config.hostId}.rpc.>`;
     console.log(`[nats] Subscribing to: ${subject}`);
     const sub = nc.subscribe(subject);
-    // Graceful shutdown
     const shutdown = async () => {
         console.log("[nats] Shutting down...");
         sub.unsubscribe();
@@ -18,11 +13,10 @@ export async function startNatsTransport(config, handleRpc, nc) {
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
     async function processMessage(msg) {
-        // Derive RPC method from subject: ...rpc.<method parts>
+        // Subject format: ...rpc.<method parts>
         const subjectTokens = msg.subject.split(".");
         const rpcIdx = subjectTokens.indexOf("rpc");
         const method = rpcIdx >= 0 ? subjectTokens.slice(rpcIdx + 1).join(".") : "";
-        // Parse params from message body
         let params = {};
         if (msg.data && msg.data.length > 0) {
             const raw = sc.decode(msg.data).trim();
@@ -39,7 +33,7 @@ export async function startNatsTransport(config, handleRpc, nc) {
                 }
             }
         }
-        // Extract clientToken from params (PWA includes it in the payload)
+        // PWA includes the client token in the payload.
         const clientToken = typeof params.clientToken === "string" ? params.clientToken : undefined;
         delete params.clientToken;
         console.log(`[nats] RPC: ${method}`);
@@ -58,7 +52,7 @@ export async function startNatsTransport(config, handleRpc, nc) {
     }
     async function consumeSubscription(subscription) {
         for await (const msg of subscription) {
-            // Handle RPC without blocking the message loop so heartbeats keep flowing
+            // Don't await — heartbeats must keep flowing while RPC runs.
             processMessage(msg);
         }
     }

package/dist/types.d.ts

@@ -12,6 +12,7 @@ export interface HostConfig {
         supportsYolo: boolean;
     }>;
     httpPort?: number;
+    /** Whether to accept non-localhost HTTP connections. */
     lanEnabled?: boolean;
 }
 export interface TaskFrontmatter {
@@ -23,8 +24,8 @@ export interface TaskFrontmatter {
      * Task schedule.
      * - `crons`: `schedule_values` holds cron expressions (e.g. "0 9 * * *")
      * - `specific_times`: `schedule_values` holds local datetime strings (e.g. "2026-04-20T09:00")
-     * - `on_new_notification`: fires on each new Android notification from NATS; no `schedule_values`
-     * - `on_new_sms`: fires on each new SMS from NATS; no `schedule_values`
+     * - `on_new_notification`: fires on each new Android notification from NATS. Optional `schedule_values` holds a single-entry packageName filter; empty/unset matches any app.
+     * - `on_new_sms`: fires on each new SMS from NATS. Optional `schedule_values` holds a single-entry sender filter; compared after normalization (strip spaces/dashes/parens/plus, lowercase). Empty/unset matches any sender.
      */
     schedule_type?: "crons" | "specific_times" | "on_new_notification" | "on_new_sms";
     schedule_values?: string[];
@@ -45,11 +46,6 @@ export interface ParsedTask {
  * - `failed`: agent exited with an error
  */
 export type TaskRunningState = "started" | "finished" | "aborted" | "failed";
-/**
- * Persisted to `status.json` in the task directory. Used for crash detection
- * (checkStaleTasks) and abort signalling. Interactive request flows (confirmation,
- * permission, input) are handled via held HTTP connections on the serve daemon.
- */
 export interface TaskStatus {
     running_state: TaskRunningState;
     time_stamp: number;

package/dist/update-checker.d.ts

@@ -1,9 +1,6 @@
 /** True when running from a source checkout (has .git) rather than a global npm install. */
 export declare const isDevBuild: boolean;
 export declare const currentVersion: string;
-/**
- * Run the update and restart the daemon.
- * Returns an error message if the update fails.
- */
+/** Returns an error message if the update fails. */
 export declare function performUpdate(): Promise<string | null>;
 //# sourceMappingURL=update-checker.d.ts.map

package/dist/update-checker.js

@@ -9,10 +9,7 @@ const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "
 /** True when running from a source checkout (has .git) rather than a global npm install. */
 export const isDevBuild = fs.existsSync(path.join(packageRoot, ".git"));
 export const currentVersion = isDevBuild ? `${pkg.version}-dev` : pkg.version;
-/**
- * Run the update and restart the daemon.
- * Returns an error message if the update fails.
- */
+/** Returns an error message if the update fails. */
 export async function performUpdate() {
     try {
         const { output, exitCode } = await spawnCommand("npm", ["update", "-g", "palmier"], {
@@ -25,7 +22,7 @@ export async function performUpdate() {
             return `Update failed. Please run manually:\nnpm update -g palmier`;
         }
         console.log("[update] Update installed, restarting daemon...");
-        // Small delay to allow the RPC response to be sent
+        // Delay so the RPC response finishes sending first.
         setTimeout(() => {
             getPlatform().restartDaemon().catch((err) => {
                 console.error("[update] Restart failed:", err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "0.8.0",
+  "version": "0.8.3",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "Apache-2.0",
   "author": "Hongxu Cai",

package/palmier-server/README.md

@@ -183,7 +183,7 @@ All endpoints are prefixed with `/api`. No user authentication is required.
 - **NATS RPC** — the RPC method is derived from the NATS subject (e.g., `...rpc.task.list` → `task.list`), not the message body. The body contains request parameters plus `clientToken`. All NATS requests go through a centralized `request()` helper in `HostConnectionContext` that handles encoding/decoding and logging.
 - **Pairing** — `palmier pair` (or auto-pair after `palmier init`) generates a 6-char pairing code. The PWA enters the code, which routes to the host via NATS (`pair.<CODE>`) or HTTP (`POST /pair`). The host validates the code and returns a client token.
 - **Task IDs** are generated by the host as UUIDs.
-- **Schedule can be enabled/disabled** — the `schedule_enabled` frontmatter field (default `true`) controls whether systemd timers are installed. When disabled, timers are removed but the task can still be run manually. The schedule lives in two flat fields: `schedule_type` (`"crons"` or `"specific_times"`) and `schedule_values` (array of cron expressions or local datetime strings). Both are present together or absent together.
+- **Schedule can be enabled/disabled** — the `schedule_enabled` frontmatter field (default `true`) controls whether the schedule is active. When disabled, timers are removed and device events are ignored for that task, but it can still be run manually. The schedule lives in two flat fields: `schedule_type` (`"crons"`, `"specific_times"`, `"on_new_notification"`, or `"on_new_sms"`) and `schedule_values` (array of cron expressions or local datetime strings — only used by `"crons"` and `"specific_times"`). The two `on_new_*` types have no `schedule_values`; they fire in response to device notifications/SMS relayed over NATS, with the daemon owning a per-task FIFO queue that `palmier run` drains via `POST /task-event/pop`.
 - **Host responses** return flat task objects (frontmatter fields at the top level, not nested) for `task.list`, `task.create`, and `task.update`.
 - **NATS "503"** means "no responders" — the dashboard silently handles this when no host is connected, showing an empty task list instead of an error.
 - **Helmet CSP** is disabled (`contentSecurityPolicy: false`) to allow NATS WebSocket connections and inline Vite scripts during dev.