sideby 0.12.0 → 0.13.0

package/dist/src/desktop/app.js

@@ -39,7 +39,7 @@ export function launcherScript(s) {
         : `command -v notify-send >/dev/null 2>&1 && notify-send "sideby could not start" "Run sideby app install again in a terminal. Details: $LOG"`;
     const lines = [
         '#!/bin/sh',
-        `# ${APP_MARKER}: written by \`sideby app install\`. Run that again after upgrading sideby or Node.`,
+        `# ${APP_MARKER}: written by \`sideby app install\` (\`sideby update\` runs it again). Run it yourself after upgrading Node.`,
         `NODE=${shq(s.node)}`,
         `ENTRY=${shq(s.entry)}`,
         `URL=${shq(s.url ?? '')}`,
@@ -185,6 +185,38 @@ async function ownership(entry) {
     }
     return markerTest(entry)(data) ? { state: 'ours' } : foreign(entry, NOT_OURS);
 }
+/** The launcher script inside what install writes: the bundle's executable on macOS, the launcher file on Linux. */
+function launcherPath(l, platform) {
+    return platform === 'darwin' ? join(l.primary, 'Contents', 'MacOS', APP_NAME) : l.linux.launcher;
+}
+/** The `URL='…'` an earlier install wrote into the launcher, when it is a valid http(s) address; never follows a link. */
+async function recordedUrl(launcher) {
+    let text;
+    try {
+        text = (await readNoFollow(launcher)).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    if (text.split('\n', 2)[1]?.startsWith(`# ${APP_MARKER}: `) !== true)
+        return undefined;
+    const m = /^URL='((?:[^']|'\\'')*)'$/m.exec(text);
+    const value = m?.[1]?.replace(/'\\''/g, "'");
+    if (!value)
+        return undefined;
+    try {
+        return checkAppUrl(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether a sideby desktop app is installed for this home: its main file exists and carries APP_MARKER. */
+export async function appInstalled(ctx) {
+    if (ctx.platform !== 'darwin' && ctx.platform !== 'linux')
+        return false;
+    return (await ownership(layout(ctx, ctx.platform).primary)).state === 'ours';
+}
 /** Refuses to replace anything at `entry` that `sideby app install` did not write; true when it is ours. */
 async function assertOwned(entry, verb) {
     const o = await ownership(entry);
@@ -199,12 +231,14 @@ export async function installApp(ctx, opts) {
     const run = ctx.run ?? defaultRunner;
     if (!isAbsolute(opts.node) || !isAbsolute(opts.entry))
         throw new UserError('node and the sideby entry must be absolute paths');
-    const url = opts.url === undefined ? undefined : checkAppUrl(opts.url);
     const l = layout(ctx, platform);
     let updated = false;
     for (const e of l.entries)
         if (await assertOwned(e, 'install'))
             updated = true;
+    // Without --url, a reinstall (by hand or after `sideby update`) keeps the address an earlier --url recorded.
+    const kept = opts.url === undefined && updated ? await recordedUrl(launcherPath(l, platform)) : undefined;
+    const url = opts.url === undefined ? kept : checkAppUrl(opts.url);
     const xdg = {};
     for (const k of ['XDG_CONFIG_HOME', 'XDG_STATE_HOME']) {
         const v = ctx.env[k];
@@ -274,8 +308,10 @@ export async function installApp(ctx, opts) {
     }
     if (url)
         hints.push(`The app opens ${url}.`);
+    if (kept)
+        hints.push('Kept the address from the earlier install; to start the panel instead, run `sideby app uninstall`, then `sideby app install`.');
     else
-        hints.push('The app starts the panel in the background and opens it; stop the panel with `sideby ui --stop`.', 'Run `sideby app install` again after upgrading sideby or Node, so the app starts the new version.');
+        hints.push('The app starts the panel in the background and opens it; stop the panel with `sideby ui --stop`.', '`sideby update` refreshes the app; run `sideby app install` again after upgrading Node or installing sideby another way.');
     if (/[/\\]_npx[/\\]/.test(opts.entry))
         hints.push('sideby runs from the npx cache, which npm may clear; install it with `npm i -g sideby` and run this again.');
     return {

package/dist/src/families/browser.d.ts

@@ -0,0 +1,20 @@
+import type { Account } from '../types.ts';
+export interface WebsiteDef {
+    /** The Family id. */
+    family: string;
+    /** Where "Open in browser" goes. */
+    url: string;
+    /**
+     * The Local Storage origin whose key names may hold `signInId`, and the reader of that id from the Host's login
+     * file. The id is compared in memory only; it is never shown, returned, logged or cached. Missing when the website
+     * keeps no id the Host also has (grok.com), so the Account can only be opened in a Browser Profile the user picks.
+     */
+    match?: {
+        origin: string;
+        signInId(account: Account): Promise<string | undefined>;
+    };
+}
+/** The website of a built-in Family id, if it has one. */
+export declare function websiteDef(familyId: string): WebsiteDef | undefined;
+/** Every website that can be matched, for the origins to read. */
+export declare function matchedOrigins(): string[];

package/dist/src/families/browser.js

@@ -0,0 +1,23 @@
+import { claudeSignInId } from './claude/browser.js';
+import { codexSignInId } from './codex/browser.js';
+const WEBSITES = new Map([
+    {
+        family: 'claude',
+        url: 'https://claude.ai',
+        match: { origin: 'https://claude.ai', signInId: claudeSignInId },
+    },
+    {
+        family: 'codex',
+        url: 'https://chatgpt.com',
+        match: { origin: 'https://chatgpt.com', signInId: codexSignInId },
+    },
+    { family: 'grok', url: 'https://grok.com' },
+].map((w) => [w.family, w]));
+/** The website of a built-in Family id, if it has one. */
+export function websiteDef(familyId) {
+    return WEBSITES.get(familyId);
+}
+/** Every website that can be matched, for the origins to read. */
+export function matchedOrigins() {
+    return [...WEBSITES.values()].flatMap((w) => (w.match ? [w.match.origin] : []));
+}

package/dist/src/families/claude/browser.d.ts

@@ -0,0 +1,3 @@
+import type { Account } from '../../types.ts';
+/** `oauthAccount.accountUuid` of `.claude.json`, only for matching; every other field is dropped at once. */
+export declare function claudeSignInId(account: Account): Promise<string | undefined>;

package/dist/src/families/claude/browser.js

@@ -0,0 +1,14 @@
+// The Claude account id that claude.ai's Local Storage key names also carry (spec §3.24, ADR-0023).
+import { readFile } from 'node:fs/promises';
+import { claudeJsonOf } from './index.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** `oauthAccount.accountUuid` of `.claude.json`, only for matching; every other field is dropped at once. */
+export async function claudeSignInId(account) {
+    try {
+        const id = JSON.parse(await readFile(claudeJsonOf(account), 'utf8'))?.oauthAccount?.accountUuid;
+        return typeof id === 'string' && UUID.test(id) ? id.toLowerCase() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/families/claude/desktop.js

@@ -23,6 +23,7 @@ export const claudeDesktop = {
         {
             path: 'claude_desktop_config.json',
             mainPath: 'Library/Application Support/Claude/claude_desktop_config.json',
+            key: 'mcpServers',
         },
     ],
 };

package/dist/src/families/codex/browser.d.ts

@@ -0,0 +1,7 @@
+import type { Account } from '../../types.ts';
+/**
+ * `chatgpt_user_id` (else `user_id`, as Codex itself falls back: codex-rs/login/src/token_data.rs) under the auth
+ * claim of `tokens.id_token`, only for matching. The payload is decoded as for the email (core/identity.ts); the
+ * token and every other claim are dropped at once. `tokens.account_id` is the workspace and is not used.
+ */
+export declare function codexSignInId(account: Account): Promise<string | undefined>;

package/dist/src/families/codex/browser.js

@@ -0,0 +1,26 @@
+// The ChatGPT user id that chatgpt.com's Local Storage key names also carry (spec §3.24, ADR-0023).
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const USER_ID = /^user-[A-Za-z0-9]{8,64}$/;
+const AUTH_CLAIM = 'https://api.openai.com/auth';
+/**
+ * `chatgpt_user_id` (else `user_id`, as Codex itself falls back: codex-rs/login/src/token_data.rs) under the auth
+ * claim of `tokens.id_token`, only for matching. The payload is decoded as for the email (core/identity.ts); the
+ * token and every other claim are dropped at once. `tokens.account_id` is the workspace and is not used.
+ */
+export async function codexSignInId(account) {
+    try {
+        const token = JSON.parse(await readFile(join(account.dir, 'auth.json'), 'utf8'))?.tokens?.id_token;
+        if (typeof token !== 'string')
+            return undefined;
+        const payload = token.split('.')[1];
+        if (!payload)
+            return undefined;
+        const auth = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))?.[AUTH_CLAIM];
+        const id = auth?.chatgpt_user_id ?? auth?.user_id;
+        return typeof id === 'string' && USER_ID.test(id) ? id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/families/desktop.d.ts

@@ -17,10 +17,14 @@ export interface DesktopAppDef {
     clearVars: readonly string[];
     /** The first sign-in happens inside the app, through a URL callback another running instance may catch. */
     signInInApp: boolean;
-    /** Files of the App Data shared from the Main Account's default App Data as links (`mainPath` relative to HOME). */
+    /**
+     * Files of the App Data shared from the Main Account's default App Data as links (`mainPath` relative to HOME).
+     * With `key`, a real file the app made in place of the link is fine while that JSON key matches the main one.
+     */
     sharedFiles: readonly {
         path: string;
         mainPath: string;
+        key?: string;
     }[];
 }
 /** The Desktop App of a built-in Family id, if it has one. */

package/dist/src/families/pi/index.js

@@ -28,6 +28,8 @@ export const piFamily = {
     logo: BUILTIN_LOGOS.pi,
     bin: 'pi',
     installUrl: 'https://github.com/earendil-works/pi',
+    // The managed install stages and smoke-tests each release before switching to it; npm upgrades in place.
+    installCommand: 'curl -fsSL https://pi.dev/install.sh | sh',
     selectVar: 'PI_CODING_AGENT_DIR',
     secretFileMeansApi: false,
     layout: { main: '.pi/agent', account: '.pi-<name>/agent' },

package/dist/src/panel/handler.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type AppProfileStatus } from '../core/app-profiles.ts';
+import { type BrowserReport } from '../core/browser-profiles.ts';
 import { type HandoffSettings } from '../core/config.ts';
 import { type AccountModel } from '../core/model-choice.ts';
 import type { RemoteControlGroup } from '../core/remote-control.ts';
@@ -132,6 +133,11 @@ export interface PanelState {
     appProfiles?: AppProfileStatus[];
     /** Update Check result and Auto Update setting (spec §3.23); absent with `updates: false`. */
     update?: PanelUpdate;
+    /**
+     * Browser Sign-ins (spec §3.24): which Chrome browser user signed in to which Account, read on this computer only.
+     * Absent without Claude, Codex or Grok subscription Accounts. Nothing of the browser is read while `enabled` is false.
+     */
+    browser?: BrowserReport;
 }
 /** The `handoff` map of the Panel state, from the statuses and Quota already read for the page. */
 export declare function handoffByFamily(rt: Runtime, accounts: readonly PanelAccount[], now: Date): Record<string, string>;

package/dist/src/panel/handler.js

@@ -3,6 +3,7 @@ import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { aliasesByAccount } from '../core/accounts.js';
 import { listAppProfiles, openAppProfile, removeAppProfile, } from '../core/app-profiles.js';
 import { FAVICON_SVG, ICON_SVG } from '../core/brand-mark.js';
+import { browserReport, openInBrowser, setBrowserSignIns, } from '../core/browser-profiles.js';
 import { aliasArgs, aliasRefs, editConfigUpdate } from '../core/config.js';
 import { openDesktopApp, withDesktopApps } from '../core/desktop-app.js';
 import { UserError } from '../core/errors.js';
@@ -15,7 +16,7 @@ import { tildify } from '../core/paths.js';
 import { SKILL_INSTALL } from '../core/skill-check.js';
 import { MIN_CALLS } from '../core/tuning.js';
 import * as update from '../core/update.js';
-import { buildId, packageVersion } from '../core/version.js';
+import { buildId, localBuild, packageVersion } from '../core/version.js';
 import { HOOK_FAMILIES } from '../handoff/hook.js';
 import { renderPage } from './page.js';
 import { resolveTheme } from './theme.js';
@@ -265,6 +266,8 @@ async function buildState(rt, opts) {
         };
     });
     const handoff = handoffByFamily(rt, list, ctx.now);
+    const browser = await browserReport(rt, accounts).catch(() => undefined);
+    const showBrowser = browser && (browser.families.matched.length || browser.families.openOnly.length);
     return {
         schemaVersion: 1,
         version: opts.version,
@@ -273,7 +276,8 @@ async function buildState(rt, opts) {
         generatedAt: ctx.now.toISOString(),
         families: families.map((f) => {
             const logo = rt.families.get(f.id)?.logo;
-            return logo ? { ...f, logo } : f;
+            const g = f.brokenBin ? { ...f, brokenBin: tildify(f.brokenBin, ctx.home) } : f;
+            return logo ? { ...g, logo } : g;
         }),
         accounts: list,
         pluginErrors: rt.pluginErrors.map((e) => ({ where: e.where, message: e.message })),
@@ -294,6 +298,7 @@ async function buildState(rt, opts) {
                 .map((f) => f.id),
         },
         ...(upd ? { update: upd } : {}),
+        ...(showBrowser ? { browser } : {}),
     };
 }
 /** The `change` of a /api/handoff/configure body, with every field checked; unknown fields are refused. */
@@ -351,6 +356,7 @@ export function createPanelHandler(opts) {
     const readOnly = Boolean(opts.readOnly);
     const version = opts.version ?? PANEL_VERSION;
     const build = buildId();
+    const local = localBuild();
     const theme = resolveTheme(opts.theme);
     const lang = resolveLang(opts.lang);
     const updates = opts.updates !== false;
@@ -450,8 +456,8 @@ export function createPanelHandler(opts) {
                 return { ref: found.ref, undone: r.ok, message: r.message };
             },
         },
-        // Remote Control off by default (spec §3.22, ADR-0017): writes `remoteControlAtStartup: false` into each Claude
-        // settings file that turns it on or leaves it to the default; the page shows the files first, from the state.
+        // Remote Control at startup (spec §3.22, ADR-0017): writes `remoteControlAtStartup` (false for off, true for on)
+        // into each Claude settings file that does not hold it yet; the page shows the files first, from the state.
         '/api/remote-control/off': {
             async run() {
                 const rt = await getRuntime();
@@ -460,6 +466,14 @@ export function createPanelHandler(opts) {
                 return { ...r, results: r.results.map((x) => ({ ...x, file: tildify(x.file, home) })) };
             },
         },
+        '/api/remote-control/on': {
+            async run() {
+                const rt = await getRuntime();
+                const r = await rt.remoteControlOn();
+                const home = rt.paths.home;
+                return { ...r, results: r.results.map((x) => ({ ...x, file: tildify(x.file, home) })) };
+            },
+        },
         '/api/remote-control/undo': {
             async run() {
                 const rt = await getRuntime();
@@ -524,6 +538,29 @@ export function createPanelHandler(opts) {
                 };
             },
         },
+        // Browser Sign-ins on or off (spec §3.24): config `browser.signIns`, shown first like every config change.
+        '/api/browser/settings': {
+            writes: (body) => body.confirm === true,
+            async run(body) {
+                if (typeof body.enabled !== 'boolean')
+                    throw new HttpError(400, '"enabled" must be true or false');
+                const rt = await getRuntime();
+                const r = await setBrowserSignIns(rt, body.enabled, { apply: optBool(body, 'confirm') });
+                return { ...r, file: tildify(r.file, rt.paths.home) };
+            },
+        },
+        // Opens the Account's website in one Chrome browser user (spec §3.24). It starts a program, so a read-only Panel
+        // refuses it (writes defaults to true).
+        '/api/browser/open': {
+            async run(body) {
+                const account = optString(body, 'account');
+                if (!account)
+                    throw new HttpError(400, '"account" is required');
+                const rt = await getRuntime();
+                const profile = optString(body, 'profile');
+                return openInBrowser(rt, await rt.resolve(account), profile);
+            },
+        },
         // Opens a Grok Bot window, creating it when the name is new, or brings it to the front (ADR-0019).
         '/api/app-profile/open': {
             async run(body) {
@@ -600,7 +637,13 @@ export function createPanelHandler(opts) {
                 });
                 if (!r.ok)
                     throw new UserError(r.message);
-                return { ...shown, updated: true, message: r.message, restartedPanel: r.restartedPanel };
+                return {
+                    ...shown,
+                    updated: true,
+                    message: r.message,
+                    restartedPanel: r.restartedPanel,
+                    refreshedApp: r.refreshedApp,
+                };
             },
         },
         // The Auto Update switch: config `update.auto`, shown as a diff first like every config change.
@@ -671,7 +714,7 @@ export function createPanelHandler(opts) {
                     });
                     res.end(method === 'HEAD'
                         ? undefined
-                        : renderPage({ basePath, token, nonce, version, build, readOnly, theme, lang, updates }));
+                        : renderPage({ basePath, token, nonce, version, build, local, readOnly, theme, lang, updates }));
                     return true;
                 }
                 // The mark, for a Portal's tab and for this page's favicon (ADR-0006 amendment).

package/dist/src/panel/i18n.d.ts

@@ -6,7 +6,7 @@ declare const en: {
     'top.refreshing': string;
     'top.updated': string;
     'top.updatedTitle': string;
-    'top.language': string;
+    'top.stale': string;
     'foot.text': string;
     'foot.textChecks': string;
     'upd.label': string;
@@ -22,6 +22,16 @@ declare const en: {
     'upd.skill': string;
     'upd.checksOff': string;
     'upd.latest': string;
+    'upd.latestNow': string;
+    'upd.check': string;
+    'upd.checking': string;
+    'upd.verTitle': string;
+    'upd.local': string;
+    'upd.localDirty': string;
+    'upd.open': string;
+    'upd.autoIsOn': string;
+    'upd.autoIsOff': string;
+    'upd.settings': string;
     'upd.checked': string;
     'upd.notYet': string;
     'upd.auto': string;
@@ -38,9 +48,6 @@ declare const en: {
     'upd.reloading': string;
     'upd.restartHint': string;
     'acct.title': string;
-    'theme.system': string;
-    'theme.light': string;
-    'theme.dark': string;
     'err.noAnswer': string;
     'err.session': string;
     'err.expired': string;
@@ -120,6 +127,7 @@ declare const en: {
     'why.health-fail': string;
     'why.signed-out': string;
     'why.not-installed': string;
+    'why.broken': string;
     'why.quota-high': string;
     'why.health-warn': string;
     'tb.search': string;
@@ -134,6 +142,7 @@ declare const en: {
     'tb.used': string;
     'tb.left': string;
     'tb.view': string;
+    'tb.display': string;
     'tb.list': string;
     'tb.cards': string;
     'tb.hideEmails': string;
@@ -151,6 +160,7 @@ declare const en: {
     'group.collapse': string;
     'row.collapse': string;
     'row.expand': string;
+    'row.runs': string;
     'group.toggle': string;
     'group.attention.one': string;
     'group.attention.other': string;
@@ -172,6 +182,10 @@ declare const en: {
     'acct.installHost': string;
     'acct.nearLimit': string;
     'acct.installIt': string;
+    'acct.installHostCmd': string;
+    'acct.brokenHost': string;
+    'acct.installDocs': string;
+    'acct.broken': string;
     'quota.pctUsed': string;
     'quota.pctLeft': string;
     'quota.meterUsed': string;
@@ -182,6 +196,13 @@ declare const en: {
     'quota.dataFrom': string;
     'quota.asOf': string;
     'quota.sharedFrom': string;
+    'quota.readFrom': string;
+    'login.count': string;
+    'login.label': string;
+    'login.hint': string;
+    'login.sharedAbove': string;
+    'login.collapse': string;
+    'login.expand': string;
     'quota.noWindows': string;
     'quota.off': string;
     'quota.turnOnFamily': string;
@@ -276,6 +297,32 @@ declare const en: {
     'desk.started': string;
     'desk.focused': string;
     'desk.failed': string;
+    'br.open': string;
+    'br.signedIn': string;
+    'br.signedInMore': string;
+    'br.hint': string;
+    'br.title': string;
+    'br.offIntro': string;
+    'br.reads': string;
+    'br.read1': string;
+    'br.read2': string;
+    'br.read3': string;
+    'br.never': string;
+    'br.enable': string;
+    'br.enabled': string;
+    'br.disable': string;
+    'br.disabled': string;
+    'br.local': string;
+    'br.found': string;
+    'br.none': string;
+    'br.noMatch': string;
+    'br.others': string;
+    'br.all': string;
+    'br.noChrome': string;
+    'br.openIt': string;
+    'br.opened': string;
+    'br.failed': string;
+    'br.changed': string;
     'app.apart': string;
     'app.apartTip': string;
     'app.mainName': string;
@@ -431,6 +478,7 @@ declare const en: {
     'nf.accounts.other': string;
     'nf.runOnce': string;
     'nf.notInstalled': string;
+    'nf.broken': string;
     'nf.name': string;
     'nf.namePh': string;
     'nf.api': string;
@@ -531,6 +579,29 @@ declare const en: {
     'rc.confirm': string;
     'rc.done': string;
     'rc.failed': string;
+    'set.button': string;
+    'set.lang': string;
+    'set.theme': string;
+    'set.theme.system': string;
+    'set.theme.light': string;
+    'set.theme.dark': string;
+    'set.rcOn': string;
+    'rc.button': string;
+    'rc.state.on': string;
+    'rc.state.default': string;
+    'rc.state.off': string;
+    'rc.state.missing': string;
+    'rc.state.blocked': string;
+    'rc.dialogTitle': string;
+    'rc.explain': string;
+    'rc.allOff': string;
+    'rc.undo': string;
+    'rc.switch': string;
+    'rc.confirmOn': string;
+    'rc.onWarn': string;
+    'rc.doneOn': string;
+    'rc.failedOn': string;
+    'rc.readOnlyBoth': string;
     'rc.undone': string;
     'banner.readOnly': string;
     'banner.plugins.one': string;