toolroll 0.9.103 → 0.9.105

package/dist/deploy-lock.js

@@ -6,9 +6,6 @@ export function acquireDeploymentLock(journalFile, waitMs = 5000) {
     if (!Number.isInteger(waitMs) || waitMs < 0 || waitMs > 5000)
         throw Error("Invalid deployment lock wait.");
     const journal = canonical(journalFile), file = `${journal}.lock.sqlite`;
-    // Only create a missing file. On POSIX, closing ANY independently opened descriptor
-    // for an existing inode can drop this process's fcntl lock, even another connection's.
-    // Let SQLite manage all descriptors for an existing coordination file.
     try {
         const fd = openSync(file, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
         closeSync(fd);
@@ -19,7 +16,6 @@ export function acquireDeploymentLock(journalFile, waitMs = 5000) {
     }
     if (!lstatSync(file).isFile())
         throw Error(`Unexpected deployment lock: ${file}`);
-    // Lazy, as elsewhere in the CLI: merely importing the help must not load SQLite.
     const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
     const db = new DatabaseSync(file);
     try {

package/dist/deploy-phase.js

@@ -1,16 +1,7 @@
-/**
- * The phases of a browser deployment's journal, and what a stopped deployment at each one calls for.
- *
- * The rows are data: deploy-phase-data.json beside this file, the one authored list (the build copies it into dist,
- * scripts/postbuild.mjs). The deploy scripts read the same file through scripts/deploy-phase-table.mjs, where each
- * column is described. Both sides check its shape the same way; deploy-phase.test.ts holds them to each other and to
- * its own hand-written expectations.
- */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 const ACTIONS = ["none", "lift-pause", "forward", "roll-back"];
 const FLAGS = ["beforeSwap", "beforePause", "migrationStarted", "restartable", "deployed"];
-/** The rows of a parsed data file, or an Error naming what is wrong with it. Never a partial table. */
 export function deployPhaseRows(data) {
     const rows = data?.phases;
     if (!Array.isArray(rows) || rows.length === 0)
@@ -28,37 +19,24 @@ export function deployPhaseRows(data) {
         return Object.freeze({ phase, action: action, flags: Object.freeze([...flags]) });
     }));
 }
-// By path, not by URL: a test environment that stands in for a browser replaces the global URL.
 const ROWS = deployPhaseRows(JSON.parse(readFileSync(join(import.meta.dirname, "deploy-phase-data.json"), "utf8")));
 const rowOf = (phase) => typeof phase === "string" ? ROWS.find(row => row.phase === phase) : undefined;
 const withFlag = (flag) => Object.freeze(ROWS.filter(row => row.flags.includes(flag)).map(row => row.phase));
 const withAction = (action) => Object.freeze(ROWS.filter(row => row.action === action).map(row => row.phase));
-/** Every phase, in journal order. */
 export const DEPLOY_PHASES = Object.freeze(ROWS.map(row => row.phase));
 export const isDeployPhase = (phase) => rowOf(phase) !== undefined;
-/** The one action a journal's phase calls for; "refuse" for anything that is not a phase. */
 export const deployActionOf = (phase) => rowOf(phase)?.action ?? "refuse";
-/** The word itself, or an Error: a journal is never written with a word the table does not hold. */
 export function assertDeployPhase(phase) {
     if (!isDeployPhase(phase))
         throw new Error(`"${String(phase)}" is not a deployment phase; the journal was not written.`);
     return phase;
 }
-/** The service was never stopped. */
 export const BEFORE_SWAP = withFlag("beforeSwap");
-/** Before the swap, with the pause in place. */
 export const PAUSED_BEFORE_SWAP = Object.freeze(ROWS.filter(row => row.flags.includes("beforeSwap") && !row.flags.includes("beforePause")).map(row => row.phase));
-/** The candidate's store opened the live database, or the new service ran on it. */
 export const MIGRATION_STARTED = withFlag("migrationStarted");
-/** The old service is proved stopped: the previous definition may be started again. */
 export const RESTARTABLE = withFlag("restartable");
-/** The new service may be running: never rolled back by a journal alone. */
 export const FORWARD_ONLY = withAction("forward");
-/** Nothing is left to recover. Not the same as deployed: a released deployment never installed its runtime. */
 export const NEEDS_NO_RECOVERY = withAction("none");
-/** The deployment finished and its runtime is the installed one. */
 export const isDeployed = (phase) => rowOf(phase)?.flags.includes("deployed") === true;
-/** Stopped where nothing was changed (before its pause), or with nothing left to do. */
 export const stoppedWhereNothingChanged = (phase) => { const row = rowOf(phase); return row !== undefined && (row.flags.includes("beforePause") || row.action === "none"); };
-/** The phase a lifted pause leaves behind (release-gate.ts). */
 export const RELEASED = assertDeployPhase("released");

package/dist/deploy-rescue.js

@@ -1,25 +1,6 @@
-/**
- * `toolroll release --recover-deploy [--stage <dir>] [--yes]`: one command for a browser deployment that stopped half
- * way and could not put itself back (the 2026-10-29 deploy stuck at "stopping": an `up` left running under launchd
- * that ignored SIGTERM, a restart refused while its stale heartbeat lapsed, and every resume refusing "not proved
- * stopped"). It does what was done by hand, through the deployment's own recovery (scripts/deploy-browser.mjs
- * --phase recover, run from the recorded commit's pristine extraction exactly as `toolroll release` resumes one):
- *
- *   - the journal is verified (one unfinished deployment of this database, its run recorded) under the deployment lock
- *   - when the journal says the old service must be stopped, recovery requires proof it already exited; historical
- *     PIDs and argv never authorize signals or booting out a currently loaded service. Remaining processes must be
- *     stopped through their owner before recovery can resume.
- *   - the previous service is started again (the verified backup first when the database was migrated past it) and
- *     waited for past a stale worker heartbeat's window, then the deployment's update pause is lifted
- *
- * A journal at or past the new service's start is never touched here: the new service may be running, and the
- * release resumes it forward. Finished journals need nothing. Run again after a refusal or a failure: every step
- * re-proves itself, so a rerun does only what is still left.
- */
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
 import { BEFORE_SWAP, FORWARD_ONLY, MIGRATION_STARTED, NEEDS_NO_RECOVERY, RESTARTABLE } from "./deploy-phase.js";
-/** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
 export { FORWARD_ONLY };
 const real = (path) => { try {
     return realpathSync(path);
@@ -27,7 +8,6 @@ const real = (path) => { try {
 catch {
     return path;
 } };
-/** What recovery will do from a phase, in a few words. */
 export function rescuePlan(phase, journal) {
     const id = String(journal["id"] ?? "?"), prior = String(journal["priorRuntime"] ?? "?");
     if (BEFORE_SWAP.includes(phase))
@@ -45,7 +25,6 @@ export function rescuePlan(phase, journal) {
     }
     return words.length > 0 ? words : [`Journal phase ${phase}: the deployment's own recovery decides; it refuses anything it can't prove.`];
 }
-/** Find the one unfinished deployment (or the named stage), verify its journal, and recover it (with `yes`). */
 export async function rescueDeployment(stageArg, yes, world) {
     const all = world.journals();
     let chosen;

package/dist/deprecations.js

@@ -1,27 +1,16 @@
-/**
- * D5 (schema v117): one AI concept, the lead. The central team service's CLI (the central `lead list|create|update|
- * member|transfer`, `conversation …`, and `chat`/`brief` with --lead, --conversation or a saved profile) and native
- * coding sessions (`session …`) were deprecated in 0.9.56 and are removed now: each answers with one line naming what
- * to use instead, changing nothing. `connect` stays — remote commands and `toolroll health` use the profile it saves.
- */
 const NEXT_STEP = {
     team: "Talk to your lead with `toolroll chat`.",
     session: "Queue work with `toolroll task add`.",
 };
-/** The one line a deprecated command prints on stderr: what it is, when it goes, and what to use instead. */
 export function deprecationWarning(command, kind) {
     return `Warning: \`toolroll ${command}\` is deprecated and will be removed in the next minor release. ${NEXT_STEP[kind]}`;
 }
-/** What a deprecated console page or API says about itself. */
 export const DEPRECATED_PAGE = {
     team: "Team chat is deprecated and will be removed in the next minor release. Your lead in Chat does the same work.",
     session: "Coding sessions are deprecated and will be removed in the next minor release. Queue work as a task instead.",
 };
 const CENTRAL_LEAD_ACTIONS = ["list", "create", "update", "member", "transfer"];
 const CENTRAL_CHAT_FLAGS = ["--profile", "--lead", "--conversation", "--authorize", "--terms-digest", "--request-id"];
-/** The removed command an invocation names, as `{ named, kind }`; null when it is a live command. `chat`/`brief`
- * without --local went to the central service whenever a profile was saved (`savedProfile`, asked only then): that
- * invocation is removed too, never quietly run against this computer's lead instead. */
 export function removedCommand(argv, savedProfile = () => false) {
     const [first, second] = argv;
     const verb = () => argv.slice(1).find(arg => !arg.startsWith("-")) ?? "";
@@ -37,7 +26,6 @@ export function removedCommand(argv, savedProfile = () => false) {
         return { named: `${first} --conversation`, kind: "team" };
     return null;
 }
-/** The one line a removed command answers with. */
 export function removedMessage(named, kind) {
     return `\`toolroll ${named}\` was removed. ${NEXT_STEP[kind]}`;
 }

package/dist/design/kit.css

@@ -30,6 +30,8 @@
 }
 
 /* ---------- Text, icons, helpers ---------- */
+/* A short command or path that must read as one piece: it moves to the next line whole, never breaks mid-token. */
+.k-nowrap { white-space: nowrap; }
 .k-sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; margin: 0; padding: 0; border: 0; }
 .k-mono { font-family: var(--so-font-mono); font-size: 12px; font-weight: 400; }
 .k-num { font-variant-numeric: tabular-nums; }
@@ -89,13 +91,13 @@
 .k-tabs .k-count { margin-left: 2px; }
 
 /* ---------- Fields: one family (KIT.md "Fields") ----------
-   Every text field, select and secondary text box is one filled surface (--so-field), no outline, radius 12px; the
-   label above names it, the hint and the error sit below it, focus draws the 2px ink ring. A transparent 1px border
-   keeps the box's edge in forced colours. Textareas grow with their words (field-sizing), no resize grip. */
+   Every text field, select and secondary text box is one filled surface (--so-field), radius 12px, with a 1px
+   --so-field-line boundary (3:1 on paper, so a person can see where to type); the label above names it, the hint and
+   the error sit below it, focus draws the 2px ink ring. Textareas grow with their words (field-sizing), no resize grip. */
 .k-field { display: grid; gap: 6px; margin: 0; min-width: 0; }
 .k-label { display: block; margin: 0; font: 500 12.5px/1.35 var(--so-font-sans); color: var(--so-muted); }
 .k-hint { margin: 0; font-size: 12px; color: var(--so-muted); line-height: 1.45; }
-.k-input.k-input, .k-textarea.k-textarea, .k-sel.k-sel { box-sizing: border-box; width: 100%; margin: 0; border: 1px solid transparent; border-radius: 12px; background: var(--so-field); color: var(--so-ink); font: 400 13.5px/1.4 var(--so-font-sans); box-shadow: none; transition: background-color var(--m-quick) var(--m-ease); }
+.k-input.k-input, .k-textarea.k-textarea, .k-sel.k-sel { box-sizing: border-box; width: 100%; margin: 0; border: 1px solid var(--so-field-line); border-radius: 12px; background: var(--so-field); color: var(--so-ink); font: 400 13.5px/1.4 var(--so-font-sans); box-shadow: none; transition: background-color var(--m-quick) var(--m-ease); }
 .k-input.k-input { height: 36px; min-height: 0; padding: 0 12px; }
 .k-textarea.k-textarea { min-height: 76px; max-height: 360px; padding: 10px 12px; resize: none; field-sizing: content; overflow-y: auto; max-width: 640px; line-height: 1.5; }
 .k-input::placeholder, .k-textarea::placeholder { color: var(--so-muted); opacity: 1; }
@@ -174,7 +176,7 @@
 
 /* ---------- Lists: rows between hairlines under group headings ---------- */
 .k-grp { display: flex; align-items: center; gap: 8px; height: 36px; margin: 8px 0 0; padding: 0 24px; font: 600 12.5px/1 var(--so-font-sans); border-bottom: 1px solid var(--so-line); color: var(--so-ink); }
-.k-row { display: grid; grid-template-columns: 96px minmax(160px, 30%) minmax(0, 1fr) auto 124px; align-items: center; gap: 16px; min-height: 48px; padding: 6px 24px; border-bottom: 1px solid var(--so-line); position: relative; }
+.k-row { display: grid; grid-template-columns: 96px minmax(160px, 30%) minmax(0, 1fr) auto minmax(124px, max-content); align-items: center; gap: 16px; min-height: 48px; padding: 6px 24px; border-bottom: 1px solid var(--so-line); position: relative; }
 .k-row-t { font-weight: 500; font-size: 13px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; color: var(--so-ink); text-decoration: none; }
 .k-row.wait .k-row-t { font-weight: 600; }
 /* The title link stretches over the row, so the whole row is one target; the action sits above it. */
@@ -372,7 +374,7 @@ button.k-steprow-head[aria-expanded="true"]::after { transform: rotate(45deg); }
 .k-pop.k-pop-menu { width: 240px; }
 .k-drawer { position: fixed; top: 8px; right: 8px; bottom: 8px; width: 400px; max-width: calc(100vw - 16px); z-index: 30; background: var(--so-paper); color: var(--so-ink); border-radius: 12px; border: 1px solid var(--so-overlay-line); overflow: auto; display: flex; flex-direction: column; }
 .k-drawer-h { display: flex; align-items: center; gap: 6px; padding: 10px 10px 10px 20px; border-bottom: 1px solid var(--so-line); position: sticky; top: 0; background: var(--so-paper); }
-.k-drawer-h h2 { margin: 0; font: 600 14px/1.3 var(--so-font-sans); flex: 1; }
+.k-drawer-h h2 { margin: 0; font: 600 14px/1.3 var(--so-font-sans); flex: 1; color: var(--so-ink); }
 .k-drawer-b { padding: 18px 20px 28px; display: grid; gap: 22px; align-content: start; }
 .k-sheet { position: fixed; left: 8px; right: 8px; bottom: calc(8px + env(safe-area-inset-bottom)); z-index: 45; max-height: calc(100dvh - 16px); display: flex; flex-direction: column; background: var(--so-paper); color: var(--so-ink); border-radius: 14px; border: 1px solid var(--so-overlay-line); }
 .k-sheet-h { display: flex; align-items: center; gap: 8px; padding: 6px 6px 8px 16px; border-bottom: 1px solid var(--so-line); flex: none; }
@@ -561,6 +563,7 @@ html:not(.k-js) .k-composer:focus-within, html.k-kbd .k-composer:focus-within {
   .k-input.k-input, .k-pop .k-input.k-input, .k-sel.k-sel, .k-selw.sm .k-sel { height: 44px; }
   .k-selw::after { right: 13px; }
   .k-seg > a, .k-seg > button { height: 44px; font-size: 13.5px; }
+  .k-seg.k-seg-icons > a, .k-seg.k-seg-icons > button { min-width: 44px; justify-content: center; }
   .k-tabs > button, .k-tabs > a { min-height: 44px; }
   .k-disclose > summary { min-height: 44px; }
   .k-facts a { display: inline-flex; align-items: center; min-height: 44px; }

package/dist/design/kit.js

@@ -1,12 +1,3 @@
-/**
- * The revamp kit's words and rules, shared by the server's HTML kit (src/server/kit.ts) and the React kit
- * (src/browser/kit/), so both draw the same thing from the same facts. No DOM, no server state: the rules
- * are in src/design/KIT.md, the look in src/design/kit.css.
- *
- * The approval helpers here decide only what a page SHOWS (a password field, one click, or no button). The server
- * still proves every act at the moment it happens (scope.ts freshness, passwordless.ts, people-tokens.ts); a page
- * that shows one click for an act the server then refuses says so in place.
- */
 import { HEADLINE_TONE } from "../task-status.js";
 export const STATUS = {
     needs: { word: "Needs you", tone: "needs" },
@@ -15,13 +6,10 @@ export const STATUS = {
     finished: { word: "Finished", tone: "done" },
     failed: { word: "Failed", tone: "failed" },
 };
-/** A task's headline (task-status.ts) as the kit's chip: its own word, in the tone of the status it belongs to. A
- * row that waits on a person never shows a failure tone; something that waits on someone else never carries the needs-you mark. */
 export function chipOfHeadline(headline) {
     const status = statusOfHeadline(headline);
     return { word: headline === "Needs you" ? STATUS.needs.word : headline, tone: STATUS[status].tone, status };
 }
-/** Which of the five a headline is. */
 export function statusOfHeadline(headline) {
     switch (HEADLINE_TONE[headline]) {
         case "attention":
@@ -32,7 +20,6 @@ export function statusOfHeadline(headline) {
         case "neutral": return "queued";
     }
 }
-/** Resource states (a computer that builds, not work): never the needs-you mark. */
 export const RESOURCE = {
     idle: { word: "Idle", tone: "" },
     building: { word: "Building", tone: "live" },
@@ -52,7 +39,6 @@ export function approvalAsk(kind, facts) {
         return "click";
     return "password";
 }
-/** How a click without a password is justified, for the record line after an approval. */
 export function approvalHow(kind, facts) {
     const ask = approvalAsk(kind, facts);
     if (ask === "password")
@@ -63,7 +49,6 @@ export function approvalHow(kind, facts) {
         return "none";
     return facts.passwordless ? "passwordless" : "remembered";
 }
-/** The terms line under an approval: which rule applies, in words. Empty for a one-click act. */
 export function termsOf(kind, facts) {
     if (kind === "way-in") {
         if (facts.passwordless)
@@ -82,8 +67,6 @@ export function termsOf(kind, facts) {
         return facts.rememberedUntil ? `No password needed: remembered on this computer until ${facts.rememberedUntil}.` : "No password needed: remembered on this computer.";
     return "Asks for your password.";
 }
-// ---- time and counts --------------------------------------------------------------------------------------------
-/** A duration in seconds as the timing rows say it: "38s", "6m 12s", "1h 25m". */
 export function dur(seconds) {
     const n = Math.max(0, Math.round(seconds));
     if (n < 60)
@@ -92,23 +75,17 @@ export function dur(seconds) {
         return `${Math.floor(n / 60)}m ${String(n % 60).padStart(2, "0")}s`;
     return `${Math.floor(n / 3600)}h ${String(Math.floor((n % 3600) / 60)).padStart(2, "0")}m`;
 }
-/** "3 flows", "1 flow". */
 export const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
 export const TIMING_WORDS = { ok: "Done", run: "Now", q: "Queued", bad: "Failed", wait: "Needs you" };
-/** Each row's bar as percentages of one shared axis; a queued row has no bar until it starts. */
 export function timingBars(rows, scale) {
     const sc = scale ?? Math.max(1, ...rows.map(row => row.start + (row.st === "q" ? 0 : row.dur))) * 1.02;
     return rows.map(row => row.st === "q" ? null : { left: (Math.max(0, row.start) / sc) * 100, width: (Math.max(row.dur, sc / 400) / sc) * 100 });
 }
-/** The words a screen reader hears for a step row's marker. */
 export const STEP_ROW_WORDS = {
     done: "done", needs: "waiting on you", live: "in progress", wait: "waiting", stuck: "stopped here", skipped: "skipped", todo: "not started",
 };
-/** The id of a step row's body, for its disclosure's aria-controls. */
 export const stepRowBodyId = (key) => `steprow-${key}`;
-/** The words a screen reader hears for a step's state. */
 export const STEP_WORDS = { done: "done", now: "waiting on you", live: "in progress", failed: "failed", todo: "not started" };
-/** How far the line is filled, 0–1: up to the current step (the first that isn't done), or all of it. */
 export function stepsFill(steps) {
     if (steps.length < 2)
         return steps.length === 1 && steps[0].state === "done" ? 1 : 0;
@@ -117,9 +94,7 @@ export function stepsFill(steps) {
 }
 const path = (d) => ["path", { d }];
 const circle = (cx, cy, r) => ["circle", { cx, cy, r }];
-/** The icons the kit draws (lucide shapes). */
 export const KIT_ICONS = {
-    // The app shell's destinations (the rail and the phone menu) and its New task pen.
     home: [path("m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"), path("M9 22V12h6v10")],
     tasks: [path("m3 17 2 2 4-4"), path("m3 7 2 2 4-4"), path("M13 6h8"), path("M13 12h8"), path("M13 18h8")],
     flows: [["rect", { x: 3, y: 3, width: 8, height: 8, rx: 2 }], path("M7 11v4a2 2 0 0 0 2 2h4"), ["rect", { x: 13, y: 13, width: 8, height: 8, rx: 2 }]],
@@ -140,12 +115,10 @@ export const KIT_ICONS = {
     alert: [circle(12, 12, 9), path("M12 8v4"), path("M12 16h.01")],
     more: [circle(5, 12, 1), circle(12, 12, 1), circle(19, 12, 1)],
     file: [path("M14 3H7a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V8z"), path("M14 3v5h5")],
-    // Wave C (flows): the canvas's zoom bar and the flow page's tools.
     minus: [path("M5 12h14")],
     fit: [path("M15 3h6v6"), path("M9 21H3v-6"), path("M21 3l-7 7"), path("M3 21l7-7")],
     bolt: [path("M13 2 4 14h7l-1 8 9-12h-7z")],
     code: [path("m16 18 6-6-6-6"), path("m8 6-6 6 6 6")],
-    // The Settings groups' icons (wave D; SETTINGS_GROUP_ICONS).
     sun: [circle(12, 12, 4), path("M12 2v2"), path("M12 20v2"), path("m4.93 4.93 1.41 1.41"), path("m17.66 17.66 1.41 1.41"), path("M2 12h2"), path("M20 12h2"), path("m6.34 17.66-1.41 1.41"), path("m19.07 4.93-1.41 1.41")],
     cpu: [["rect", { x: 4, y: 4, width: 16, height: 16, rx: 2 }], ["rect", { x: 9, y: 9, width: 6, height: 6, rx: 1 }], path("M15 2v2"), path("M15 20v2"), path("M2 15h2"), path("M2 9h2"), path("M20 15h2"), path("M20 9h2"), path("M9 2v2"), path("M9 20v2")],
     bell: [path("M10.27 21a2 2 0 0 0 3.46 0"), path("M3.26 15.33A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.67C19.41 13.96 18 12.5 18 8A6 6 0 0 0 6 8c0 4.5-1.41 5.96-2.74 7.33")],
@@ -158,8 +131,6 @@ export const KIT_ICONS = {
     board: [["rect", { x: 3, y: 3, width: 18, height: 18, rx: 2 }], path("M9 3v18"), path("M15 3v18")],
     panel: [["rect", { x: 3, y: 3, width: 18, height: 18, rx: 2 }], path("M15 3v18")],
 };
-// ---- settings frame ---------------------------------------------------------------------------------------------
-/** The eight Settings groups, in order: [label, slug, href]. */
 export const SETTINGS_GROUPS = [
     ["General", "general", "/settings/general"],
     ["Agents and models", "agents", "/settings/agents"],
@@ -169,14 +140,12 @@ export const SETTINGS_GROUPS = [
     ["People and sign-in", "access", "/settings/access"],
     ["Spend", "spend", "/spend"],
     ["System", "system", "/settings/system"],
+    ["Advanced", "advanced", "/settings/advanced"],
 ];
-/** Each group's icon on the Settings overview (wave D). */
 export const SETTINGS_GROUP_ICONS = {
-    general: "sun", agents: "cpu", alerts: "bell", approval: "shield", projects: "folder", access: "people", spend: "coin", system: "monitor",
+    general: "sun", agents: "cpu", alerts: "bell", approval: "shield", projects: "folder", access: "people", spend: "coin", system: "monitor", advanced: "settings",
 };
-/** How a Settings row says what waits on this person: "1 item needs you", "2 items need you". */
 export const needsWords = (n) => n === 1 ? "1 item needs you" : `${n} items need you`;
-/** The not-found page's default words. */
 export const NOT_FOUND = {
     title: (path) => `There’s no page at ${path}.`,
     text: "It may have moved. Home has what needs you; Tasks has every task.",

package/dist/desktop-access.js

@@ -1,4 +1,3 @@
-/** Local desktop readiness, not a permission grant or task execution. */
 import { mkdtempSync, readFileSync, writeFileSync, unlinkSync, rmdirSync, opendirSync, realpathSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -15,15 +14,12 @@ export function accessFailure(repo, code) {
         return { repo, state: "missing", message: "This folder is missing or its drive is disconnected. Reconnect it or choose the project's new location." };
     return { repo, state: "unavailable", message: "The worker could not check this Git project. Check that Git is installed and the folder is available, then check again." };
 }
-/** Probe only unique files we created, inside Git metadata, never tracked files.
- * Run in a bounded child of the real service, not the foreground shell. */
 export function probeDesktopProject(repo) {
     let scratch;
     try {
         const directory = opendirSync(repo);
         directory.readSync();
         directory.closeSync();
-        // The project's own repository, read through a frozen view: a build's include naming a FIFO can't hang the probe.
         const top = checkoutTop(repo, 4000);
         if (top === null)
             throw Error("Not a readable Git checkout");
@@ -42,7 +38,6 @@ export function probeDesktopProject(repo) {
         return accessFailure(repo, error.code);
     }
     finally {
-        // No recursive deletion: only our own exact file and empty directory.
         if (scratch) {
             try {
                 unlinkSync(join(scratch, "check"));
@@ -68,21 +63,17 @@ export function interpretAccessProbe(repo, result) {
 }
 export async function checkDesktopProjects(repos) {
     const checked = [];
-    // Bound concurrency and each diagnostic; these are not task runtime caps.
     for (let offset = 0; offset < repos.length; offset += 4) {
         checked.push(...await Promise.all(repos.slice(offset, offset + 4).map(async (repo) => interpretAccessProbe(repo, await run(process.execPath, [fileURLToPath(import.meta.url), "probe", repo], { timeoutMs: 6500, maxBuffer: 8192 })))));
     }
     return checked;
 }
-/** A receipt from an old worker or old project selection is never readiness. */
 export function currentDesktopAccess(report, supervisor, repos, request) {
     const matching = report?.version === 1 && Number.isFinite(Date.parse(report.checkedAt)) && report.request === request &&
         Array.isArray(report.projects) && report.projects.every(one => one && typeof one.repo === "string" && typeof one.message === "string" && ["ready", "permission-needed", "missing", "unavailable"].includes(one.state)) &&
         report.projects.length === repos.length && repos.every(repo => report.projects.some(one => one.repo === repo));
     const current = matching && supervisor?.phase === "running" && report.controllerPid === supervisor.controllerPid && report.checkedAt >= (supervisor.updatedAt ?? "~");
     const pending = (repo) => ({ repo, state: "checking", message: "Waiting for this background worker to check access." });
-    // Retain an actionable failure while the controller backs off, but never
-    // treat a stopped worker's successful probe as current readiness.
     const failed = matching && ["backoff", "stopped"].includes(supervisor?.phase ?? "") && report.projects.some(one => one.state !== "ready");
     const projects = current ? report.projects : failed ? report.projects.map(one => one.state === "ready" ? pending(one.repo) : one) : repos.map(pending);
     return { verified: projects.length > 0 && projects.every(one => one.state === "ready"), projects };

package/dist/desktop-bundle.js

@@ -2,8 +2,6 @@ import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { run } from "./exec.js";
-/** Hash the exact bundle, including executable modes; reject aliases inside
- * it so a checked file cannot secretly refer to mutable external code. */
 export function bundleHash(path) {
     const hash = createHash("sha256");
     const walk = (file, relative) => {
@@ -61,7 +59,7 @@ export async function verifyDesktopUpdateBundles(previous, candidate) {
             throw Error("The manifest and signed app identity disagree.");
     }
     if (candidate.development)
-        return; // Explicitly separate preview identity only.
+        return;
     const team = (text) => /^TeamIdentifier=(?!not set$)(.+)$/m.exec(text)?.[1];
     if (!team(old) || team(old) !== team(next) || !/^Authority=Developer ID Application:/m.test(next))
         throw Error("A release update must preserve the installed Developer ID signing team.");

package/dist/desktop-host.js

@@ -1,4 +1,3 @@
-/** Entry point for the macOS shell. No account credential enters argv or logs. */
 import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, realpathSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -35,8 +34,6 @@ export function readDesktopConfig(stateDir) {
                 return realpathSync(repo);
             }
             catch (error) {
-                // An unplugged volume or moved checkout must never reset the account,
-                // database selection, or service identity. Keep it visible for recovery.
                 if (["ENOENT", "EACCES", "EPERM"].includes(error.code ?? ""))
                     return resolve(repo);
                 throw error;
@@ -59,8 +56,6 @@ export async function addDesktopProjects(stateDir, store, paths, exact = false)
     const enrolled = await updateRepos(join(dirname(current.databaseFile), "repos.json"), existing => addRepos(existing, repos));
     if (!enrolled.ok)
         throw new Error(enrolled.message);
-    // Native helpers and the browser share this database lock. Read/merge/write
-    // synchronously under it so simultaneous selections cannot lose a project.
     return store.transact(() => {
         const latest = readDesktopConfig(stateDir);
         latest.repos = [...new Set([...latest.repos, ...repos])];
@@ -85,8 +80,6 @@ export function openDesktopStore(file) {
 }
 export function openConfiguredDesktopStore(stateDir) {
     const config = readDesktopConfig(stateDir);
-    // Only a recorded first-time setup may create a queue. An established or
-    // legacy installation whose database disappeared must fail closed.
     let store;
     if (config.databaseInitialized === false)
         store = openDesktopStore(config.databaseFile);
@@ -112,12 +105,10 @@ export function openConfiguredDesktopStore(stateDir) {
         throw error;
     }
 }
-/** Recovery controls must not depend on opening or migrating the task store. */
 export function desktopDatabaseStatus(file) {
     let db;
     const result = (ready, message) => ({ ready, message, expectedSchema: SCHEMA_VERSION });
     try {
-        // Read-only open: a missing/unreadable file must never become a new queue.
         db = new createRequire(import.meta.url)("node:sqlite").DatabaseSync(file, { readOnly: true });
         db.exec("PRAGMA busy_timeout = 1000");
         const schema = readSchemaVersion(db);
@@ -160,7 +151,6 @@ function legacyLogin(file) {
         return null;
     }
 }
-/** Share `up`'s existing durable credential, without replacing another login. */
 export function pairDesktopLogin(store, file, login) {
     if (!/^[A-Za-z0-9_.-]{1,64}$/.test(login.name) || login.password.length < 8 || login.password.trim() !== login.password || /[\r\n\u0000]/.test(login.password))
         throw new Error("Use a valid username and a password of at least eight characters without surrounding whitespace or line breaks.");
@@ -169,7 +159,6 @@ export function pairDesktopLogin(store, file, login) {
         throw new Error("This username and password do not match an active operator.");
     const remembered = legacyLogin(file);
     if (remembered === null) {
-        // File before row, as in `up`: a crashed bootstrap can adopt the same intent.
         writeLoginFileDurably(file, login.name, login.password);
     }
     else if (!(first && remembered.name === login.name && remembered.password === login.password) && !authenticateApprover(store, remembered.name, remembered.password).ok) {
@@ -180,7 +169,6 @@ export function pairDesktopLogin(store, file, login) {
     if (!authenticateApprover(store, login.name, login.password).ok)
         throw new Error("Another operator was created during setup. Sign in again.");
 }
-/** The desktop service definition the shell asks for: the shared launchd contract, labelled by the shell. */
 export function desktopServiceDefinition(stateDir, args) {
     const runtimeDir = dirname(args.node);
     const home = args.home ?? homedir();
@@ -195,7 +183,6 @@ export function desktopServiceDefinition(stateDir, args) {
         pathEnv: [runtimeDir, ...(args.providerBin ? [args.providerBin] : []), join(home, ".local", "bin"), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"].join(":"),
     });
 }
-/** The fresh-liveness check: the controller answers its identity challenge on the configured port. */
 export async function verifyDesktopLiveness(config, fetchImpl = fetch) {
     const challenge = randomBytes(32).toString("hex");
     try {
@@ -212,7 +199,6 @@ export async function verifyDesktopLiveness(config, fetchImpl = fetch) {
         return { alive: false, port: config.port, problem: `no controller answered on port ${config.port} (${error instanceof Error ? error.message : String(error)})` };
     }
 }
-/** `service-start | service-stop | service-status --node <path> --helper <path> --label <label>`: the shell's service verbs, on the shared lifecycle. */
 export async function desktopServiceCommand(verb, stateDir, config, argv, supervise = execRun) {
     const read = (name) => {
         const at = argv.indexOf(`--${name}`);
@@ -237,8 +223,6 @@ export async function desktopServiceCommand(verb, stateDir, config, argv, superv
         }
         if (config.repos.length === 0)
             throw new Error("Choose a repository in the desktop app first.");
-        // Fail before installing/reloading launchd. Stop and Status deliberately
-        // skip this gate, including when an incompatible update was installed.
         const database = desktopDatabaseStatus(config.databaseFile);
         if (!database.ready)
             throw new Error(database.message);
@@ -253,7 +237,6 @@ export async function desktopServiceCommand(verb, stateDir, config, argv, superv
         finally {
             opened.store.close();
         }
-        // The log stays private: the service writes into the state directory only.
         if (!existsSync(definition.logPath))
             writeFileSync(definition.logPath, "", { mode: 0o600 });
         const started = await installLaunchdService(definition, supervise);
@@ -263,14 +246,10 @@ export async function desktopServiceCommand(verb, stateDir, config, argv, superv
     }
     if (verb === "service-stop") {
         if (!argv.includes("--update-id") && existsSync(join(stateDir, "desktop-update.json"))) {
-            // An operator stop is durable and wins over later automatic recovery.
-            // A broken update record must not take away the ordinary Stop control.
             try {
                 await (await import("./desktop-update.js")).requestUpdateStop(stateDir);
             }
             catch {
-                // If disk/receipt damage prevents a durable stop intent, disabling
-                // the exact recovery job is the independent fail-closed boundary.
                 const recoveryLabel = `${definition.label}.update`;
                 const recoveryStopped = await stopLaunchdService({ ...definition, label: recoveryLabel, unitPath: join(dirname(definition.unitPath), `${recoveryLabel}.plist`) }, supervise);
                 console.error(recoveryStopped.ok ? "The update stop request could not be recorded, so automatic update recovery was disabled. Preserve the update files and check Update status before restarting." : "The update stop request and recovery-service stop could not be confirmed. Check Update status and service logs before leaving this installation unattended.");
@@ -338,7 +317,6 @@ export async function desktopMain(argv, supervise = execRun) {
         return;
     }
     if (argv[0] === "database-status") {
-        // Candidate-build preflight: no setup, login, supervisor, or project probe.
         console.log(JSON.stringify(desktopDatabaseStatus(readDesktopConfig(stateDir).databaseFile)));
         return;
     }
@@ -370,9 +348,7 @@ export async function desktopMain(argv, supervise = execRun) {
         }
         return;
     }
-    // Inspection and launch must never migrate another running controller.
     const store = openConfiguredDesktopStore(stateDir);
-    // The saved login: in the reserved folder every agent fence denies (login-secrets.ts), else where older versions kept it.
     const legacyFile = savedLoginFile(dirname(config.databaseFile));
     if (argv[0] !== "serve-controller") {
         try {
@@ -381,7 +357,6 @@ export async function desktopMain(argv, supervise = execRun) {
                 console.log(JSON.stringify({ ...config, names: store.listApprovers().map(one => one.name), importable: legacy !== null && authenticateApprover(store, legacy.name, legacy.password).ok }));
             }
             else if (argv[0] === "import-login") {
-                // Only the native helper's private stdout pipe receives this value.
                 const legacy = legacyLogin(legacyFile);
                 if (legacy === null || !authenticateApprover(store, legacy.name, legacy.password).ok)
                     throw new Error("No valid remembered login is available.");
@@ -389,7 +364,6 @@ export async function desktopMain(argv, supervise = execRun) {
             }
             else if (argv[0] === "pair") {
                 const login = await readInput();
-                // A login saved here goes into the reserved folder, made and proven first; an older one moves in.
                 migrateLegacyLogin(dirname(config.databaseFile));
                 ensureSecretsDir(dirname(config.databaseFile));
                 pairDesktopLogin(store, savedLoginFile(dirname(config.databaseFile)), login);
@@ -435,9 +409,6 @@ export async function desktopMain(argv, supervise = execRun) {
         store.close();
         throw new Error("Choose a repository in the desktop app first.");
     }
-    // Persist the legacy default once, under the same lock as project edits.
-    // Explicit identity makes a restart await its predecessor's real liveness
-    // fences instead of creating hostname-2 and stranding the old worker's work.
     if (config.runnerName === undefined || config.containment === undefined) {
         config = store.transact(() => {
             const latest = readDesktopConfig(stateDir);
@@ -454,8 +425,6 @@ export async function desktopMain(argv, supervise = execRun) {
         });
     }
     store.close();
-    // Only the real controller writes these receipts. A foreground helper's
-    // successful read would not establish launchd/TCC access for the worker.
     let checking = false, lastSelection = "", lastRequest = "";
     const checkAccess = async () => {
         if (checking)
@@ -480,9 +449,6 @@ export async function desktopMain(argv, supervise = execRun) {
     await checkAccess();
     const accessTimer = setInterval(() => { void checkAccess().catch(() => { }); }, 2000);
     accessTimer.unref();
-    // Reuse the same registry supervisor, worker, custody, and recovery paths as
-    // the CLI. The service parent owns this controller; closing the web view
-    // owns nothing here. `serve-controller` is its child entry, never a new engine.
     const remembered = legacyLogin(legacyFile);
     let exit;
     try {

package/dist/desktop-update-gate.js

@@ -10,16 +10,11 @@ const statements = (id, frozen = false) => {
         `CREATE TRIGGER ${prefix}claim BEFORE INSERT ON claim BEGIN SELECT RAISE(ABORT, '${UPDATE_PAUSED} [${id}]'); END`,
         `CREATE TRIGGER ${prefix}mate BEFORE INSERT ON mate_turn BEGIN SELECT RAISE(ABORT, '${UPDATE_PAUSED} [${id}]'); END`,
         `CREATE TRIGGER ${prefix}run BEFORE INSERT ON run ${frozen ? "" : "WHEN NEW.parent_run IS NULL AND NOT EXISTS (SELECT 1 FROM claim WHERE lease_id=NEW.lease_id AND released_at IS NULL) "}BEGIN SELECT RAISE(ABORT, '${UPDATE_PAUSED} [${id}]'); END`,
-        // An already-owned lead turn may finish its remaining provider steps.
         `CREATE TRIGGER ${prefix}chat BEFORE INSERT ON chat_turn ${frozen ? "" : "WHEN NEW.mate_turn IS NULL "}BEGIN SELECT RAISE(ABORT, '${UPDATE_PAUSED} [${id}]'); END`,
     ];
 };
-/** A gate statement as SQLite may keep it: a table RENAME re-quotes names, and a later build may name the lead's turns
- * lead_turn (D5). This build's updater lifts a gate it made under either name. */
 const same = (sql) => sql.replace(/"([A-Za-z_][A-Za-z0-9_]*)"/g, "$1").replace(/\b(?:mate|lead)_turn\b/g, "mate_turn");
 const owns = (wanted, sql) => wanted.map(same).includes(same(String(sql)));
-/** SQLite enforces the gate even for a CLI racing an old in-memory snapshot.
- * Existing leases, replies, heartbeats and task data remain writable. */
 export function installUpdateGate(db, id) {
     const wanted = statements(id);
     db.exec("BEGIN IMMEDIATE");
@@ -70,12 +65,9 @@ export function activeUpdateWork(db) {
         conversations: count("SELECT count(*) n FROM mate_turn WHERE state IN ('queued','running')") + count("SELECT count(*) n FROM chat_turn WHERE state IN ('queued','running')"),
         stopping: count("SELECT count(*) n FROM run_stop WHERE settled_at IS NULL"),
         ...activeCodingUpdateWork(db),
-        // Live terminals in a console that is still running (terminal-catalog.ts).
         ...activeTerminalUpdateWork(db),
     };
 }
-/** Last admission race closes in the same SQLite write transaction as the
- * empty-work check. Existing work is never killed to satisfy an update. */
 export function freezeUpdateGate(db, id) {
     db.exec("BEGIN IMMEDIATE");
     try {