viewable-one 0.0.0-stage → 0.12.1

package/CHANGELOG.md

@@ -0,0 +1,1460 @@
+# Changelog
+
+`glytch`. Dates are the publish date, newest first.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and the versions follow [semver](https://semver.org/spec/v2.0.0.html). For
+this package the public surface is **the commands, their flags, and what the
+runner does with a run**, not the internals: renaming a command, dropping a
+flag, or changing what the runner promises a session is a breaking change;
+rewriting how one of them does its job is not. The board tools themselves are
+served from the hosted endpoint and ship on their own schedule, not with this
+package.
+
+## [Unreleased]
+
+## [0.12.1] - 2026-10-25
+
+- Install Viewable with `npm install -g viewable-one` and use `viewable`. The old `glytch` command, settings and sign-in keep working.
+
+### Fixed
+
+- `glytch update` finds Homebrew's Volta even when Homebrew is absent from
+  PATH, and accepts a symlinked Volta bin directory (#727).
+## [0.12.0] - 2026-10-17
+
+### Changed
+
+- The runner now hears about new work the moment it happens. A run you
+  approve starts within a few seconds, and Stop reaches a running session
+  within a few seconds, without the runner asking the board every 10 seconds.
+  While it is connected it checks in every 5 minutes; if the connection drops
+  it goes back to checking every 10 seconds until it is back.
+- A runner watching several folders now shows as one runner, with one id for
+  all of its folders.
+- The runner talks to the board's server directly instead of through the
+  app's website.
+- `glytch doctor` counts the runner as beating for 6 minutes after its last
+  check-in, to match the 5-minute check-in.
+## [0.11.4] - 2026-10-16
+
+### Fixed
+
+- `glytch update` follows Volta's shared launcher with `volta which glytch`
+  in a fresh shell and restarts its package image even when `npm root -g`
+  points at the separate Node image. Another install is still refused (#707).
+## [0.11.3] - 2026-10-16
+
+### Changed
+
+- The board server given to Codex now allows a tool call up to 120 seconds,
+  so a question can wait for the person's answer instead of being cut off
+  after a minute. A board entry already in your Codex config keeps its own
+  settings.
+
+### Fixed
+
+- Codex computer-app approvals now ask on the board and return the selected
+  answer instead of rejecting supported requests without a question. Stopped,
+  timed-out and resolved requests cannot receive a later approval. Unsupported
+  forms and sensitive input remain blocked.
+- The runner calls the board far less, so a machine watching several folders
+  no longer trips the board's rate limit. One heartbeat covers every folder,
+  an idle folder asks for work only when the board says a run is waiting,
+  and folder registration repeats every 5 minutes instead of every beat. With
+  five idle folders that is about 6 calls a minute instead of about 45. When
+  the board is busy and says how long to wait, the runner waits that long,
+  and the log names the request so it can be looked up. Older boards keep
+  working: there each folder polls on its own, slowing to every 30 seconds
+  when nothing is waiting.
+- Codex tool approvals in every form mode Codex sends are now asked, and a
+  tool whose name mentions keys or tokens is asked too; a message or field
+  that carries a password, token or code is still refused. Every refused request
+  writes its reason and field names (never values) to the runner log. Each
+  question offers one Cancel.
+- The runner no longer exits by itself when it is idle or when no folders are
+  registered.
+## [0.11.2] - 2026-10-15
+
+### Fixed
+
+- Codex runs preserve configured, plugin and built-in app tools with scoped
+  approval policies. Tool exposure is checked before a run starts; apps OFF
+  and plan drafts keep their restrictions. MCP discovery cleanup is bounded.
+## [0.11.1] - 2026-10-15
+
+### Added
+
+- A coding run asks in the idea when it needs something outside its list
+  (#478): Allow, Not this, or Always allow in <folder>. Always allow is
+  remembered per folder under `~/.glytch/permissions/` and not asked again
+  there. Claude Code and Codex both ask; a plan draft never does.
+- `webSearch` on a request lets the run search and read the web without
+  asking first (#478).
+### Changed
+
+- Keep changes (was the merge op) is one gesture (#483): it commits what
+  the agent left in the copy, sets the person's own uncommitted changes in
+  the folder aside and puts them back, merges into the default branch, and
+  deletes the copy and its branch. Nothing is pushed. A clash changes nothing
+  in the folder and names the files, so the app can send Coding back to fit
+  its changes around the person's. Throw away (was delete-branch) deletes
+  the copy and its branch. A run in a folder that is not git says Throw away
+  cannot undo it.
+## [0.11.0] - 2026-10-14
+
+### Removed
+
+- Every run and agent limit (#364): no 2 dollar wall on a run, no 400,000
+  token context wall, no 4,000,000 token running total, and no
+  `--max-budget-usd` passed to Claude Code. A run is bounded by the wall
+  clock alone. `PM_SPAWN_MAX_PER_DAY` is gone; a value still set is ignored.
+  `PM_SPAWN_MAX_CONCURRENT` and the wall clock stay. Cost and tokens are
+  still recorded with the run.
+- A Codex run no longer stands down when its plan window passes a
+  percentage (80 by default). It always starts. The window is still read for
+  the run's info line. The runner's status no longer carries the last window
+  it read.
+
+### Changed
+
+- No receipt or closing reply shows a cost any more: no dollar figure, no
+  estimate, no "cost unavailable" or "on your Codex plan". They show turns and
+  time. The cost is still recorded with the run.
+- The board digest's flags section is read under its new name, `BOARD FLAGS`,
+  and the old `SUBCONSCIOUS FLAGS` still works.
+- `GOAL` is no longer read as a fact on a card's line in the digest; the board
+  stopped writing it.
+- `glytch init` exits 1, and does not say a runner is watching, when your
+  computer could not sign in or skipped sign-in for want of a terminal.
+  `--no-login` still exits 0, but no longer says a runner is watching.
+
+### Security
+
+- Relaunching a dev server runs the recorded command as one program and its
+  arguments, with no shell and only a plain environment (no model keys, cloud
+  credentials or runner settings). A recorded command with pipes, `&&`,
+  quotes or `$` is refused, and so is a recorded directory outside the linked
+  folder.
+- A run whose request names a directory outside the linked folder is refused
+  before anything starts, the same way a chat turn already was.
+- A message from another session can no longer be read as an answered
+  question, whatever its sender label says.
+## [0.10.0] - 2026-10-04
+
+### Changed
+
+- The board has one kind of card now, the **idea**, and the runner speaks of
+  ideas everywhere. A run belongs to an idea, its outcome is written as a note
+  on that idea, and a session that asks for a decision with `ask_user` lands a
+  question on the idea it was started from, which you answer in the idea's
+  conversation. Nothing about how you start, stop or approve a run changed.
+- The text a coding session is told before it starts says "idea" where it spoke of
+  circles, and `get_board` reads the new board
+  digest: one `[idea]` line per card and one row per question, naming the idea
+  it sits on.
+- The board's write requests are `addIdea` (title, content, pictures) and
+  `addQuestion` (an idea, the question, why, options). A session that still
+  sends `addThought` or `addPrompt` gets one plain line telling it to use
+  `addIdea`; those two names go in the release after this one.
+
+### Added
+
+- A note you write to the Coding agent can start a session, and the session
+  answers on the same idea: when it finishes it leaves one reply with its
+  closing words, a line of figures and links to the branch, the files, a
+  preview and a report. Pictures in your notes reach a running session, and a
+  session can attach pictures to its replies and questions. A note written
+  while the session works reaches it, and counts as delivered only once the
+  session has taken it; one it never took reads "did not reach the session"
+  with Try again. After your computer restarts, a session that was working
+  carries on by itself once, in its own worktree; one that cannot says so in
+  a reply and keeps its branch. A follow-up note to a Codex or opencode
+  session runs in the branch the earlier session kept.
+
+### Fixed
+
+- Messages queued for a running session were never collected: the board read
+  the queue before it knew the session's row. Steering from the idea or the
+  session screen works now.
+
+## [0.9.1] - 2026-10-03
+
+### Changed
+
+- The runner calls the board less. While nothing is queued it checks for new
+  runs less often, slowing from every 5 seconds to every 20, and goes back to
+  every 5 as soon as it picks one up. When the board is down or unreachable it
+  waits longer between tries, up to a minute, and goes back to normal on the
+  first answer. With several folders it registers them once per beat instead
+  of once per folder.
+## [0.9.0] - 2026-10-03
+
+### Changed
+
+- The board moved to `https://app.glytch.ai`; `prompt.glytch.ai` no longer
+  answers. Your saved sign-in carries over without signing in again, and
+  `glytch init` moves the `glytch` entries it wrote for your agents to the
+  new address. An agent you connected by hand (claude.ai, for example)
+  needs reconnecting at `https://app.glytch.ai/mcp`.
+
+### Added
+
+- A `Glytch` folder in your home folder. The runner makes it (a git
+  repository with one commit) and adds it to your folders when it starts
+  watching, so a board has somewhere to work before you link a folder. A chat
+  on a board with no folder picked works in its own subfolder there, named
+  after the board. `GLYTCH_FOLDER=off` turns it off.
+- The runner now times its own steps for each run (time spent queued,
+  setting up, launching, reaching first output, running, and settling) and
+  records them with the run and in its own log, so a slow run can be
+  diagnosed from data instead of a guess. It never looks at prompt text,
+  file paths, or identity, only timestamps.
+- A run's final result is now kept as a local receipt and retried until the
+  board acknowledges it, instead of being sent once and dropped if that one
+  attempt failed. A network blip right as a run finishes no longer loses
+  the run's outcome; it is delivered as soon as the connection comes back.
+
+### Changed
+
+- `glytch init` no longer ends by telling you to link the project folder in
+  the app. A coding run needs only the project `init` registers; linking the
+  folder only shows its files on the board, and `init` now says so. The
+  README's quick start says the same, and its engines table has a Codex row.
+- CLI and API messages that said "Prompting Machine" now say "Glytch" (the
+  sign-in prompt, the not-signed-in hint, and the package description).
+
+### Fixed
+
+- `bin` paths written without `./`: npm 11.8 warned on the 0.8.2 publish
+  that it had "removed" both bins, which read as a broken package until the
+  registry record showed it had only stripped the prefix. The plain form is
+  what npm stores anyway, and it publishes without the warning.
+- README said Codex sessions could not be launched from the board yet. The
+  runner has started Codex sessions since the app-server engine landed; the
+  table and intro sentence now say so.
+- A Codex session launched from the board could not read the board, ask a
+  question, or file a report, and finished with nothing drawn on the
+  canvas: codex-cli requires each board tool call to be approved, and
+  nothing was approving them. Codex sessions now set the one approval mode
+  that lets those calls through, and turn on Codex's own plan tool so its
+  planning steps draw as step discs on the canvas.
+- A Codex session's first line in the transcript was the whole spawn
+  preamble and repo primer above what the person actually asked. It now
+  echoes just what the person typed.
+- A persistent session running in place, in a folder that is not its own
+  Git worktree (for example, a folder that is not a Git repo at all), could
+  still show the merge and delete-branch buttons on its run card. That
+  option is now recorded only for an isolated worktree or a chat turn.
+- A run that lost its claim on the board, for example because another
+  runner picked it up after a restart, kept executing locally instead of
+  stopping. The runner now renews its claim every 30 seconds and stops
+  local execution as soon as it learns the claim is gone.
+- A run's final metadata (including the worktree path a run card uses to
+  decide whether to offer Merge or Delete) could be overwritten by an
+  earlier, stale snapshot taken before cleanup ran. Completion now always
+  writes the final metadata, so a cleaned-up path is not shown as still
+  live.
+- Under sustained load, a lock file's owner record could be read in the
+  brief gap between another process creating the lock and writing that
+  record, which made a lock just taken look old enough to clear as stale
+  out from under its still-running holder. The lock's own age is now used
+  as a fallback when its owner record cannot be read yet, so a lock just
+  taken is never wrongly cleared.
+- The coding-agent preamble's blocked-ask rule was written in capitals,
+  which current models tended to over-apply. It is now written at normal
+  case with the same instruction and the same meaning.
+
+### Security
+
+- Windows no longer runs an npm `.cmd`/`.bat` shim through `cmd.exe`. The
+  runner resolves it directly to the Node or native program it points to,
+  and refuses to run anything it cannot parse safely, closing a path where
+  data in a request or session could have reached a shell.
+- Worktree cleanup, merge, and delete now confirm with Git that a directory
+  is actually a worktree of this project before acting on it, and refuse a
+  path that reaches outside the project through a symbolic link. None of
+  them fall back to a raw recursive delete when Git cannot confirm this, so
+  a worktree operation that cannot be verified is kept on disk rather than
+  removed blind.
+- Sign-in now asks for the runner's own access scope by name and names the
+  runner's own endpoint as the token's resource, instead of a general board
+  grant against the board's URL. A computer already signed in keeps
+  working; the next sign-in picks up the narrower grant.
+
+## [0.8.2] - 2026-09-21
+
+### Fixed
+
+- A run's worktree based on whatever the main checkout happened to have
+  checked out, not the repo's default branch: `makeWorktreeImpl` and the
+  chat-worktree path both branched off `git rev-parse HEAD`, so a run cut
+  while the checkout sat on a side branch inherited that branch's commits,
+  and the merge button (which checked out literal `main`) could have dragged
+  the whole side branch into main. Both paths now base on a new
+  `defaultBranchOf(root)` helper - local `main`, else local `master`, else a
+  HEAD fallback that says so - and the merge op uses the same helper to
+  decide what "main" means, so a `master`-only repo merges into `master`
+  rather than refusing or checking out a branch that repo does not have. The
+  completion text now reads "off main at &lt;sha&gt;" (or "off HEAD at
+  &lt;sha&gt;, no main or master branch" on the fallback) instead of a bare
+  sha, so which branch a run started from is visible without a `git log`.
+## [0.8.1] - 2026-09-21
+
+### Fixed
+
+- Proven live on spawn-qa3-fable-02 (Claude Code 2.1.270), 2026-09-21: with
+  the per-message counting above fixed, a trivial, healthy 14-turn run was
+  still stopped - "404k tokens against a 400k tokens cap" - because every
+  turn of a Claude Code session re-reads its ~55k system context from cache,
+  so the running total `computeTurnTokens` sums climbs roughly 60k a turn:
+  `DEFAULT_RUN_TOKEN_CAP` of 400,000 was only about seven turns. It had been
+  set to the same figure as `RUN_TOKEN_CEILING`, but that reads ONE turn's
+  context fill while this is a RUNNING TOTAL across every turn - the same
+  number was wrong by an order of magnitude for the second meaning. The
+  default is now 4,000,000 (about sixty turns) everywhere it is set:
+  `src/components/run/runLimits.ts` (and its generated copy
+  `bridge/lib/runLimits.mjs`), `src/agent/agentRow.ts`'s `DEFAULT_CAPS` (and
+  `supabase/functions/board-agent/agentRow.mjs`), and the "Most tokens in a
+  run" field's fallback in `CapsSection.tsx`, whose stepper now moves by
+  500,000 instead of 50,000 so the new default is reachable in a reasonable
+  number of clicks. The $2 `DEFAULT_RUN_COST_CAP` is still the wall that
+  actually bounds money; this one only bounds runaway token volume.
+
+- Proven live on spawn-qa3-fable-01, 2026-09-21: Claude Code's stream-json
+  emits one `assistant` event PER CONTENT BLOCK of a turn (thinking, text,
+  each tool_use), and every one carries the SAME `message.usage` - same
+  `message.id`. `bridge/lib/child.mjs` was summing it on every event, so
+  three real turns of ~52-58k tokens each were counted eight times over
+  (444,842), crossed `DEFAULT_RUN_TOKEN_CAP` (400,000) in 27 seconds, and the
+  run was killed with exit 143. `child.mjs` now counts a message's usage
+  ONCE per `message.id` - a repeat of the same id adds only the growth since
+  the last chunk - and exposes the running total as `outcome.totalTokens`.
+  `bridge/lib/runnerCompletion.mjs`'s completion text now names the wall a
+  run was stopped at (cost, tokens or the fixed context ceiling), the figure
+  it hit against its cap, and whether the child was told to wrap up or had
+  no channel left and was stopped - where it used to say only "The session
+  exited 143." with no reason. `bridge/lib/runner.mjs` passes the run's
+  `limits` through so the cap figure can be named.
+## [0.8.0] - 2026-09-21
+
+### Fixed
+
+- 2026-09-21: the runner's completion flush wrote a run's ENTIRE streamed
+  log a second time into `run_events` - proven live on spawn-mub65omw-52eb3e,
+  where a four-step plan's TaskCreate/TaskUpdate calls were each counted
+  twice and the expanded run drew "eight of eleven done" instead of "four of
+  four". `rowsEvents.mjs`'s `settle` now tracks how much of the live stream
+  it has already sent and writes only the tail `outcome.log` had not already
+  delivered - nothing, on an ordinary run, since the live stream already
+  carries it all; the whole log, on a run whose stream never started.
+  `bridge/lib/rowsEvents.mjs`. `src/folder/sessionLog/plan.ts`'s `derivePlan`
+  is now defensive against an older run whose log is already doubled on
+  disk: a second `TaskCreate` reporting a task id already seen is read as
+  the same task rather than an extra step. Also rewrote three strings in
+  `bridge/lib/runnerCompletion.mjs` that still said "him"/"his" in words a
+  person reads, to "them"/"theirs".
+
+- QA pass, 2026-09-21: the binary-not-found refusal told a person to
+  "restart the runner (`glytch restart`)", a verb `glytch` has never had.
+  It now gives the real recipe (`glytch stop`, then `glytch init --yes` in
+  the project folder) and says why installing the missing agent alone does
+  not fix it - the lookup is cached for the life of the runner process, so
+  nothing changes until it restarts. `bridge/lib/runner.mjs`.
+
+- QA pass, 2026-09-21: an error the board-runner function sent back as an
+  OBJECT (the shape a Supabase gateway error carries) printed as
+  `[object Object]` in `runner.log` - seen all night as `board-runner
+  answered 502: [object Object]`. The detail is now read from `.message`
+  when that is a string, or stringified when it is not, and the same
+  applies to `payload.message` when there is no `payload.error` at all.
+  `bridge/lib/runnerApi.mjs`.
+
+- QA pass, 2026-09-21: every runner.log line under the launchd/systemd
+  daemon was written TWICE - once by this package's own `appendFile`, once
+  because the plist already redirects the daemon's stdout into that same
+  file. The logger now echoes to stdout only when stdout is a real
+  terminal, so a person running `glytch runner watch` by hand still sees
+  it while the daemon writes each line once; `GLYTCH_LOG_ECHO=1` forces the
+  echo back on either way. `bridge/lib/logs.mjs`.
+
+- QA pass, 2026-09-21: on a Mac where `opencode` lives only in its own
+  installer's `~/.opencode/bin` and an nvm bin directory, a daemon running
+  under bash - or with no `$SHELL` set at all, so the login-shell lookup
+  never even tries - could not find it. `~/.opencode/bin` is now one of the
+  known install directories the runner checks before giving up.
+  `bridge/lib/detect.mjs`.
+- 2026-09-21: Claude Code 2.1.270 ships no `TodoWrite` tool at all - verified
+  live with `claude -p --allowedTools "... TodoWrite Task"`, which lists
+  `TaskCreate`/`TaskUpdate`/`TaskList`/`TaskGet` and no `TodoWrite` - so every
+  board-spawned session on that build reported "TodoWrite was not available
+  in this session" and drew no plan discs. `CLAUDE_TOOLS` now allowlists the
+  four Task tools alongside `TodoWrite` (kept for an older CLI that still has
+  it), the `claude` and `acp-claude` preambles tell a session to plan with
+  `TaskCreate`/`TaskUpdate` and name `TodoWrite` only as the fallback, and
+  `src/folder/sessionLog/plan.ts` derives the same plan from a `TaskCreate`
+  (one step per call, in tree order) plus `TaskUpdate` (status by task id,
+  read off the create call's own tool_result) as it already did from
+  `TodoWrite`. `runWords.ts`'s verb table no longer mislabels either call as
+  "Took another step". codex's `update_plan` and opencode's `todowrite` are
+  unrelated and untouched.
+
+- 2026-09-21, the runner feedback batch: a runner whose daemon PATH lacked the
+  agent binary died with `spawn claude ENOENT` AFTER minting a worktree, the
+  empty worktree then held the prompt's lock, and the Delete clicked on the
+  card was never served because the server only handed out ops for runs
+  still marked running. The runner now resolves the agent binary before it
+  touches git (known install dirs, then the login shell with `-lc` and, when
+  that finds nothing because zsh skips `.zshrc` there, `-ilc`; the LAST line
+  of stdout that is an absolute path that exists, so a banner in an rc file
+  does not win), refuses in plain words with the technical detail in a
+  separate paragraph when it finds none, removes the worktree of a run that
+  never started, keeps the lock only while a failed run's tree has commits,
+  files or uncommitted work, and checks and retries an op result that did
+  not land. The server side ships separately: ops are served for a run in
+  any status and a claim older than five minutes with no result is served
+  again.
+
+- 2026-09-19: `login()`'s own merge (the B7 fix above) moved a merged
+  record's `refreshToken` forward but left the still-valid OAuth ACCESS
+  token with nowhere to go - `{...existing, accessToken: scripted}`
+  overwrote it outright with the personal token, and the OLD
+  `accessExpiresAt` stayed on the record describing a credential no longer
+  in that field. `hostedToken`'s `personal: true` fallback reads
+  `oauthAccessToken`/`oauthAccessExpiresAt` (added the same day by the fix
+  above), which the merge never wrote, so a personal-token rejection right
+  after a `GLYTCH_BOARD_TOKEN` merge always spent one refresh it did not
+  need on a credential that still had hours left. Fixed by moving the
+  existing OAuth access token and its expiry into their own fields at merge
+  time and clearing the personal record's own (inapplicable)
+  `accessExpiresAt`; the reverse direction (`glytch login` over an existing
+  personal record) now keeps the personal token and writes the fresh OAuth
+  pair into the same shape, and no longer clears a live personal-token dead
+  mark it did not fix. `bridge/lib/auth.mjs`.
+
+- 2026-09-19: a merged auth record (a `pmb_` personal token persisted
+  alongside an existing OAuth pair, brief 43 review B7) marked its dead
+  credential under the REFRESH TOKEN's fingerprint even when the PERSONAL
+  token was the one the endpoint rejected, because `fingerprintSubject`
+  always preferred the refresh token when one was on file. `hostedToken`
+  read that same mark, fell through to a forced OAuth refresh on every call
+  - not just the first - and a successful refresh cleared the mark outright,
+  so the next poll offered the revoked personal token again, got rejected
+  again, and the cycle repeated at poll cadence forever, rotating the
+  refresh token every time. Fixed with two independent dead marks (one per
+  credential, `auth.json.dead` for the OAuth pair and the new
+  `auth.json.dead.personal` for the personal token), callers now telling
+  `noteCredentialRejected` which bearer was actually sent, an ordinary
+  (non-forced) refresh once the OAuth fallback is engaged, and the OAuth
+  access token living in its own `oauthAccessToken`/`oauthAccessExpiresAt`
+  fields on a merged record rather than sharing `accessToken`/
+  `accessExpiresAt` with the personal token. `bridge/lib/auth.mjs`,
+  `bridge/lib/hosted.mjs`, `bridge/lib/runnerApi.mjs`.
+
+- 2026-09-19, persona walk on the one-paste prompt (`setupPromptText`, four
+  findings): the pasting agent runs `glytch init --yes` with no TTY, and
+  `glytch init` previously left it with no way to reach the board and no
+  clear signal it was ever going to. Claude Code now gets the board server
+  registered directly - LOCAL scope (private, wins over the project entry), a bearer header, never the project's
+  `.mcp.json` - from a personal token already on this machine when there is
+  no terminal to run its own OAuth verb in; codex and opencode, whose CLIs
+  were not available to verify a header-add against, instead get one
+  actionable last line (`Type /mcp in this tab and sign in to glytch.` or
+  the agent's own equivalent) rather than a warn row buried mid-output.
+  `glytch init`'s own final line now literally reads "A runner is watching
+  this folder." once every check lands, which is the exact phrase the
+  pasted prompt's stop condition already named and had never actually seen
+  printed. `glytch init --yes` with no agent binary on PATH and no saved
+  selection no longer throws before the folder is even registered - it
+  finishes, with a warn row naming what to install, and the runner still
+  connects to the board. The prompt itself now tells the pasting agent to
+  install a missing Node without `sudo` (Homebrew, or `fnm`/`nvm` for one
+  user) and to stop and ask rather than run one, so a Mac with no Node
+  cannot leave the agent hung on a password prompt nobody can answer.
+
+- Brief 43 review, 2026-09-19: three findings on the stored `personal: true`
+  token. A revoked personal token no longer bypasses the dead gate forever -
+  it now gets its own mark, backoff and `glytch doctor` wording ("rejected",
+  pointing at Settings rather than `glytch login`). `glytch login`, run with
+  `GLYTCH_BOARD_TOKEN` over an existing OAuth credential, now keeps that
+  credential's refresh token in the same record instead of overwriting it
+  whole, and `hostedToken()` falls back to it once the personal token has a
+  live dead mark. `glytch init --no-login`, run with `GLYTCH_BOARD_TOKEN`
+  set, no longer writes the token to `~/.glytch/auth.json` - the variable
+  still authenticates that one process, but a CI box that asked not to leave
+  a long-lived token on a shared runner's disk is now honoured.
+
+- 2026-09-21, board reporting: a coding agent spawned from a prompt
+  on one board called `report` (or `propose`/`ask_user`/`mark`) and the
+  circles landed on whichever board the account had touched most recently,
+  not the board the prompt lived on - board-mcp's `boardFor` falls back to
+  `lastBoardId`, unset until the first `get_board`. The run's own row always
+  carried `board_id` (`src/runs/api.ts`'s `RunRequestRow`); the runner now
+  reads it off the claimed row and sends it on as an `X-Glytch-Board`
+  header, next to the existing `X-Glytch-Session`, on every engine's board
+  MCP config (`acpServersFor`, the headless `claude` engine's
+  `--mcp-config`, `prepareWorkspace` for opencode, `codexBoardArgs` for
+  codex). `supabase/functions/board-mcp/index.ts` reads the header the same
+  way it already reads `X-Glytch-Session` and seeds `boardTools`'s
+  `lastBoardId` with it before any tool call runs, so a session whose FIRST
+  call is `report` lands on the run's own board. No header behaves exactly
+  as before; a header naming a board this token cannot read fails the same
+  way an unknown `board_id` argument already does. `bridge/lib/runner.mjs`,
+  `bridge/lib/agents.mjs`, `bridge/lib/codex.mjs`,
+  `supabase/functions/board-mcp/index.ts`,
+  `supabase/functions/board-mcp/boardHeader.mjs` (new),
+  `supabase/functions/board-mcp/tools.mjs`.
+
+### Added
+
+- 2026-09-21, brief 46 follow-up C: a Claude Code agent's Limits pane was
+  missing the row the design asked for - `AgentCaps` had no per-run token
+  cap, so "Most tokens in a run" was left out rather than faked. Added
+  `maxTokensPerRun` (optional, defaulting to 400,000 - the same figure
+  `RUN_TOKEN_CEILING` already fixes, but a different wall: that one is the
+  LAST turn's context fill and never moves, this one is the RUNNING TOTAL
+  of every turn's input, output and cache tokens, which an agent may raise
+  or lower). It travels on the request the same way `maxSpendPerRun`
+  already does, and `runLimitHit` (`runLimits.mjs`) now checks it - after
+  cost, before the fixed context ceiling - and latches `limitHit: "tokens"`
+  with its own wrap-up message when it fires. `bridge/lib/child.mjs` sums
+  input+output+cache off every assistant usage event for the running
+  total, where it previously only kept the LAST event for the context
+  snapshot.
+
+- 2026-09-21, brief 46 (triggers) Move 4: a Codex run now reads its own
+  5-hour and weekly plan windows (`account/rateLimits/read`, one extra call
+  on the same app-server connection, right after `initialize`) before
+  spending anything. A run whose request names a cap
+  (`request.planWindowPercent`, default 80) and whose 5-hour window is
+  already past it never reaches `thread/start`: it settles with a receipt -
+  "Its plan's 5-hour window is at N%, past the M% it stands down at; it
+  will try again after HH:MM" - and nothing is charged (0 turns, cost
+  still "unavailable"). An older Codex with no such method reads as "no
+  window": the run starts, and the log says so in plain words. The info
+  line a person reads in place of a dollar figure now names both windows
+  ("Codex reports its plan window, not dollars: 5-hour at N%, week at M%.")
+  once a read succeeds, and the runner project's presence carries the same
+  reading under `plan` after every Codex run, for the Limits pane to draw
+  as two bars. `lib/codexPlanWindow.mjs` is the whole parser/decision/
+  message module, deliberately pure and tested on its own; `lib/codex.mjs`
+  and `lib/runner.mjs` only wire it in.
+
+- `glytch init --yes` and `glytch login`, run with `GLYTCH_BOARD_TOKEN` set,
+  now persist it to `~/.glytch/auth.json` as a non-expiring personal token and
+  open no browser - so a daemon started from a shell with no such variable of
+  its own still has a bearer for the board. `glytch doctor`'s sign-in row
+  reports it as "a personal access token is stored in ~/.glytch/auth.json".
+
+### Removed
+
+- The `postinstall` script. It pre-fetched the cloudflared binary on every
+  install of the package, and cloudflared is only ever used by a SHARED
+  PREVIEW - so most machines paid for a download they never used, and a
+  machine that could not reach the download printed a warning line during
+  `npm install` (reported through the app's feedback). `lib/previewTunnel.mjs`
+  already calls `ensureCloudflared` lazily and says in plain words what to do
+  when it fails, so the fetch now happens the first time a preview is actually
+  shared. `lib/installCloudflared.mjs` went with it; nothing else imported it.
+
+## [0.7.0] - 2026-09-14
+
+The published 0.6.0 predates the hosted endpoint and the rows runner. Against
+the app deployed since 2026-09-11 it cannot work: the app no longer writes the
+`.glytch/canvas/` mirror 0.6.0's local MCP server read, and a session launched
+from the board is a row 0.6.0's runner never looks at. Install this one.
+
+### Added
+
+- `glytch login` / `glytch logout`: sign this machine in to the hosted board
+  endpoint over OAuth once; the credential lands in `~/.glytch/auth.json` and
+  every agent session the runner starts uses it.
+- The runner claims, streams and settles runs as rows over the hosted
+  `board-runner` endpoint: replies, stops, worktree ops, previews and the
+  runner's own presence are rows too. Nothing under `.glytch/inbox/` is read or
+  written any more.
+- Read-only plan-mode drafts for Codex sessions.
+- Images attached to a prompt or a reply ride the run rows to the session.
+
+- `glytch uninstall [--project] [--keep-login] [--dry-run] [--yes]`: removing
+  glytch, its board grant and everything it wrote is one command instead of
+  `forget`, `stop` and `logout` run by hand. Confirms once with a printed plan
+  before touching anything (`--yes` skips the prompt; a non-TTY without it
+  prints the plan and refuses). Without `--project` it walks every registered
+  folder (delegating to `uninstallProject`), then stops the login daemon and
+  removes its file, revokes this machine's board sign-in at the board and
+  forgets the credential (a network failure is a warning, not a failure - the
+  credential is still deleted locally), and deletes `~/.glytch` outright.
+  `--project` narrows the whole run to the current folder, with no
+  machine-wide step. `--keep-login` leaves the machine signed in and its
+  credential on disk. `--dry-run` reports what every step would do and
+  changes nothing. `forget`, `stop` and `logout` remain as the three partial
+  verbs it runs together.
+- `glytch init` signs this machine in when it is not already, running the same
+  OAuth flow `glytch login` runs instead of printing "now run `glytch login`".
+  `glytch login` stays as its own command for re-auth.
+- `glytch init` runs each selected and installed agent's own sign-in:
+  `claude mcp login`, `codex mcp login`, `opencode mcp auth`. Each agent keeps
+  its own token under its own account - there is no shared credential written
+  into a config file. Claude Code's verb needs 2.1.186 or newer; below that
+  floor `init` prints the `/mcp` step, as it did before. An agent that already
+  reports holding a token is skipped; Codex does not report one either way, so
+  its sign-in runs every time and short-circuits itself.
+- `glytch init --no-login` skips signing this machine in, and
+  `glytch init --no-agent-login` skips every agent's sign-in. Both print the
+  command they did not run. Without a terminal, `init` prints the commands
+  rather than opening a browser, with or without the flags.
+
+- A run stops at its own two walls: a spend cap (2 dollars by default, or the
+  agent's own `maxSpendPerRun`) and a fixed 200,000-token context ceiling.
+  Either wall ends the run the same way - it is told to finish the turn it is
+  on, commit whatever is green, report and stop - and the session's report
+  carries an extra line naming which wall it was. The runner counts, off the
+  engine's own usage events and result envelopes, so nothing depends on a
+  session noticing its own size. The two do not land at the same moment and
+  the code says so: a context wall fires mid-turn while stdin is still open, a
+  cost wall as the turn ends. A one-shot child, which has no stdin to talk to,
+  falls back to the existing kill path. The ceiling is a fixed number and
+  never a share of the model's window.
+
+### Changed
+
+- **`npm publish` no longer runs the test suite.** `prepublishOnly` was
+  `node --test`, so every publish re-ran 1,070 tests, two of which race real
+  concurrent filesystem operations and assert an exact winner count. On one
+  machine, in one shell, those two intermittently answer 0 or 2 instead of 1,
+  and a person trying to ship met that instead of a release roughly ten times.
+  It never caught a real defect in a release. `prepublishOnly` is now
+  `scripts/prepublish.mjs`: it checks that every file `files` promises exists,
+  that both bins carry a shebang, that all 63 shipped modules parse, and that
+  the version is still free on npm. It takes about a second and cannot answer
+  differently twice. The suite still runs in `npm run verify` and as its own
+  step in the release workflow, where a failure still stops the publish.
+- The package description on npm. It advertised "a stdio MCP server that
+  speaks the app's folder contract (canvas/ mirror out, inbox/ ops in)" - a
+  server that was deleted and a contract that is gone. It now says what the
+  package does: run coding agents from the board, in a worktree, streamed back
+  to the canvas.
+- Admission's winner-count tests print why a count is wrong - the refusals,
+  the lock's bytes, the directory listing - because the directory is deleted
+  before anyone can look at it. One real gap closed alongside: the lock's
+  bytes and the inode filed as their generation were two separate reads of a
+  path another caller could replace in between, so they come off one open
+  handle now.
+
+- `glytch init` writes the hosted endpoint URL (`https://prompt.glytch.ai/mcp`)
+  into each selected agent's configuration instead of a local server command;
+  the agent's own OAuth flow finishes connecting it, and `glytch doctor` names
+  that step when it is missing.
+- On Windows the login daemon is registered from an XML task definition
+  (`~/.glytch/ai.glytch.runner.xml`) naming your own account on the trigger and
+  the principal, which a standard user may register. The old `schtasks /sc
+  onlogon` command line registered an all-users task and was refused with
+  "Access is denied" outside an elevated shell; it stays only as a fallback.
+- `glytch doctor` rows can carry their own next step; a refused Windows
+  registration names the elevated re-run or the by-hand runner command instead
+  of sending you back to `glytch init`. A refused `schtasks /query` is no longer
+  read as "task missing", and a row whose load failed no longer says "loaded now".
+
+- `glytch doctor`'s `board sign-in` row reports whether the credential WORKS,
+  not just whether `auth.json` exists. It used to read green on exactly the
+  machine that could not authenticate. It reads the dead-credential mark the
+  daemon leaves beside the credential, so it still costs no network call.
+
+- `glytch init` step 1 is an arrow-key checkbox picker instead of a numbered
+  list and a typed comma-separated answer: Up/Down (`j`/`k`) move, Enter or
+  Space toggles the row under the cursor, `a` toggles all, and a "Continue"
+  row below the agents is where Enter finishes - Escape/Ctrl-C cancels the
+  same way the old prompt did on Ctrl-C. Piped or non-TTY stdin, `--agents`
+  and `--yes` are unchanged - there is no picker to open without a terminal.
+  No new dependency (`bridge/lib/picker.mjs`).
+- The MCP server key is `glytch` (was `board`). `glytch init` and `glytch
+  doctor` rename an existing entry on the hosted URL in place, the same
+  upgrade path a legacy spawned-command entry already took. Per this
+  package's own definition this is a breaking change to the folder contract
+  - renaming what a tool is called - made survivable by the in-place upgrade.
+- The terminal output is one presentation: `init` is a numbered four-step
+  walk, browser hand-offs name which agent is asking and show the URL dimmed,
+  results are green, warnings yellow, failures red, and the first line of an
+  error is red with the rest left plain so a pasted error stays readable.
+  `NO_COLOR`, `TERM=dumb` and a pipe still get plain text, and everything
+  wraps to the terminal width. No new dependency.
+
+- `glytch doctor`'s `board sign-in` row names WHICH account the credential
+  reaches: the email, or the first segment of the account id when the board can
+  name the id but not the address. "Signed in" was the whole reason before, and
+  a credential left on a previous account reads exactly like one on the right
+  account - which is how two days of session reports landed on a board nobody
+  was looking at. The name comes from the board's `presence` op, which
+  resolved that very token, and the row already made that call, so it costs no
+  extra round trip.
+
+### Removed
+
+- Unused mirror reader, mirror-based board-root discovery, file-tool ID
+  validator, and generated bridge board-digest output. The canonical digest
+  source and the live hosted copies remain.
+- Unused file heartbeat writers, receipt/grace defaults, file-based per-prompt
+  worktree check, and the macOS `launchagent.mjs` adapter. Row-backed
+  presence, admission, and historical scratch cleanup are unchanged. The
+  macOS tests now use the current login-daemon API directly, and the atomic
+  replacement tests exercise the live folder registry.
+- `pm-agent`, the local stdio MCP server, and its `pm-agent` bin. `glytch mcp`
+  prints where the hosted endpoint is instead.
+- The `.glytch/` mailbox (spawn requests, claims, receipts, logs, sidecars and
+  the merge/delete/relaunch/preview signals as files). Folder linking stays for
+  project files only.
+- `GLYTCH_BOARD_SOURCE` and the `.glytch/config.json` row source added in
+  0.6.0: every board read is over the hosted endpoint now. `glytch login`'s
+  credential is the normal way in; `GLYTCH_BOARD_TOKEN` with a personal access
+  token still works for a script.
+
+- The `board mirror` row is gone from `glytch doctor`. It read `.glytch/canvas/`,
+  a mirror nothing has written since the `.glytch/` mailbox contract was
+  deleted, so on every correctly installed machine it reported FAIL, made
+  `allGreen` false and gave `glytch doctor` exit 1, while telling the person to
+  "open the board and link this folder" on a folder that was already linked.
+  Whether a folder is linked is what the `daemon beating` row answers now.
+
+### Fixed
+
+- A credential the board has REFUSED is now presented once and then backed
+  off, instead of being re-presented at the watch loops' poll cadence for as
+  long as the machine is on. Five folders at `pollMs` 5s meant five posts of a
+  revoked refresh token every five seconds, and presenting a spent refresh
+  token is itself what makes board-oauth revoke the family, so the loops kept
+  re-arming the alarm that had killed them. `hostedToken` now tells a DEAD
+  credential (`invalid_grant`, `invalid_client`, or a 401 that survived the
+  forced-refresh retry) from a merely stale one, and backs off 60s doubling to
+  30 minutes; a 5xx, a timeout or an unreadable body is still treated as a
+  blip and retried as before. The backoff clears itself the moment the
+  credential changes, so `glytch login` needs no other step, and a successful
+  refresh deletes it outright. The mark lives beside `auth.json` as a SHA-256
+  fingerprint of the refresh token, never the token, so a second process sees
+  it too.
+- A person whose runner cannot authenticate is told in one sentence what to do
+  ("Your Prompting Machine sign-in has expired and cannot be renewed: run
+  `glytch login` to sign in again"), once, rather than being left to read a
+  log. It replaces the "Not signed in to the hosted board" wording on this
+  path, which was inaccurate and sent people to `glytch init`: they ARE signed
+  in, with a credential the board will not take.
+
+- `glytch login` against a local app (`GLYTCH_APP_URL` pointed at a dev server
+  mirroring vercel.json's rewrites) derived the RFC 8707 `resource` as
+  `${appUrl}/mcp` and was refused by the real authorize endpoint ("This server
+  issues tokens for https://prompt.glytch.ai/mcp only") - the resource a token
+  is for is whatever the app's `/.well-known/oauth-protected-resource/mcp`
+  document names, not the app origin, and board-oauth's configured resource is
+  production regardless of which origin a person pasted. `login()` now reads
+  that document first and uses its `resource` (and the authorization server it
+  names) throughout, storing the real endpoint as `mcpUrl` while `appUrl`
+  stays the configured app; an older deploy with no such document falls back
+  to the previous guess and says so.
+- `glytch doctor`'s "daemon beating" row reported a live daemon as stopped
+  forever: it read a local mark file nothing over rows has written since
+  brief 30 replaced runner presence with `runner_projects.last_seen_at`, so
+  the row's mtime froze at whatever an earlier, file-based daemon last wrote.
+  The row now asks the board directly, through a new read-only `presence` op.
+
+- The money figure on a Claude Code run was always empty. The runner read
+  `costUSD`; Claude Code emits `total_cost_usd`. It now reads
+  `total_cost_usd` first and falls back to the two older spellings, and takes
+  the LAST envelope rather than adding them up, because the figure is the
+  session total so far and summing it bills a long run several times over.
+
+## [0.6.0] - 2026-09-11
+
+### Added
+
+- A board with no `canvas/` mirror can now be read and written over the hosted
+  board endpoint, so a folder that has never had the app open on it still has
+  a board. Turn it on with `GLYTCH_BOARD_SOURCE=rows` and a personal access
+  token in `GLYTCH_BOARD_TOKEN`; `get_board`, `get_node` and `propose` answer
+  from the cloud, and everything else still needs the folder. A mirror on this
+  disk always wins where there is one.
+- The row source can be configured in `.glytch/config.json` in the board root
+  (`boardSource`, `boardToken`, `boardUrl`) instead of the environment, for a
+  bridge started by a launch agent that has no environment to read.
+
+### Changed
+
+- The "no canvas/ mirror found" refusal now names the row source as the second
+  way to read the board, rather than saying only that the app must be open.
+  An endpoint that answers 401 says the access token was revoked and where to
+  mint a new one, instead of reporting a generic refusal.
+- Three unused internal exports are gone: `forgetServerRecord`,
+  `tellFileExists` and `ACP_PRICES_CHECKED`. No tool and no file in the folder
+  contract changes.
+
+### Fixed
+
+- An admission lock whose bytes do not parse, including the 0-byte one an
+  unclean shutdown can leave, is recovered instead of refusing every caller
+  forever. A lock that cannot be read is still never stolen, and both
+  refusals now name the cause: the errno, or the pid and host holding it.
+- `glytch init`/`glytch doctor` rewrite and reload the login daemon file when
+  it names a different script than the one running the command (resolved
+  with `realpath`, so an npm-linked symlink still counts as the checkout),
+  instead of reporting "PATH captured" and leaving a stale package running -
+  previously the only fix was deleting the file by hand and reinstalling.
+## [0.5.0] - 2026-09-10
+
+### Added
+
+- `get_node` returns images attached to a circle as native MCP image blocks,
+  each labelled with the node and field it came from. A stored image the
+  mirror does not hold is reported as unavailable instead of being omitted.
+- Reference images on a run are validated before an agent starts: PNG, JPEG,
+  GIF and WebP are delivered whole, and an unsupported format or damaged data
+  refuses the run naming the attachment, with nothing spawned and nothing
+  billed.
+- Sessions are instructed to inspect every reference image and record what
+  they see before planning or editing, and to compare finished visual work
+  against the references.
+- An ACP adapter must advertise image prompt support before an image-bearing
+  turn is sent; without it the turn is refused rather than sent as text alone.
+
+### Changed
+
+- A planning draft researches read-only in the project checkout instead of
+  being given its own git worktree.
+- A planning draft is asked for a structured report: findings in their own
+  sections and the work under an `## Implementation plan` heading with one
+  `### Step N: ...` heading per item.
+- Engines without an image channel receive every validated image as a file
+  written beside the run; a write that fails aborts the run instead of
+  continuing with fewer images.
+
+### Fixed
+
+- Runs delivered the prompt without the appended image file paths on every
+  path except stdin, so file-based engines were told nothing about the images
+  written for them.
+- Reference images in a reply to a running session are validated on arrival;
+  a malformed one ends the turn with an error instead of being dropped
+  silently mid-session.
+
+## [0.4.2] - 2026-09-09
+
+### Added
+
+- Questions created through MCP can include an optional recommended answer and
+  explanation. Recommendations are advisory; the human still chooses an answer.
+
+### Fixed
+
+- Automatic worktree cleanup preserves the worktree when Git cannot inspect
+  its changes or establish a comparison base.
+## [0.4.1] - 2026-09-09
+
+### Changed
+
+- `glytch init` and `glytch doctor` now use readable grouped status sections,
+  wrapped details, terminal colors with `NO_COLOR` support, actionable failure
+  summaries, and a home-folder warning. Doctor distinguishes a loaded daemon
+  from a fresh or stale folder heartbeat.
+- README setup and troubleshooting guidance now keeps project-folder commands,
+  restart/update steps, and shared-preview requirements together.
+## [0.4.0] - 2026-09-09
+
+### Added
+
+- Automatic member-only local previews for shared boards, with scoped short-lived
+  authorization grants and verified dev-server ownership. The preview issuer and
+  public verifier configuration are required; missing configuration fails closed.
+- Automatic checksum-verified Cloudflare tunnel installation on macOS x64/ARM64,
+  Linux x64/ARM64 and Windows x64, with first-preview retry and a local cache.
+
+- `glytch init` lets users choose one or more coding agents per project,
+  with `--agents claude,codex` for scripts and `--yes` for saved/detected
+  defaults. Project choices are remembered and respected by doctor and
+  background repair.
+- Codex board MCP registration in project `.codex/config.toml`, preserving
+  existing settings and board entries. No global Codex config is changed.
+
+### Fixed
+
+- Preview requests reject unrelated processes that take over a dev-server port.
+  Ownership is checked again before forwarding member requests and WebSockets.
+- Preview shutdown cancels pending startup and closes remaining tunnels even if
+  writing an offline receipt fails. Public gateways bound slow clients and filter
+  reserved credentials and connection-specific headers.
+
+- Project config updates retain private file permissions.
+- Release version bumps update and commit the package lockfile alongside
+  package metadata and the changelog; non-increasing versions are rejected.
+
+### Changed
+
+- Node.js 22 or newer is now required, matching the bundled Claude ACP
+  adapter's existing runtime requirement.
+
+- Selected opencode installations receive project JSON/JSONC configuration
+  directly, preserving comments and avoiding a second interactive setup.
+- First-time non-interactive init requires explicit choices or `--yes`;
+  later runs reuse saved choices. Legacy installs retain their existing
+  repair behavior until a selection is saved.
+## [0.3.1] - 2026-09-07
+
+### Changed
+
+- **The `session-end` op says when a run was stopped, and why a start was
+  refused.** 2026-09-07, the runner QA sweep. `endSession` carries
+  `stopped: true` when the session ended because of a stop request (the
+  `.stop` file, which the runner now consumes only after the end op is
+  written), and `reason` when the start-receipt gate gave up. Both absent
+  unless set, so every earlier end op reads the same. The app's record read
+  "Finished" for a stopped run before this.
+- **The start-receipt gate waits 120 s and polls every 500 ms.** It was 30 s,
+  sized for an app whose inbox tick was 10 s; measured receipts that day ran
+  1 to 64 s and two real runs were refused as never spawned. A refusal now
+  files the end op with its reason instead of leaving a record whose end
+  came before its start.
+- **The spawn preamble asks for a plan.** Before the first edit, 3 to 8 steps
+  through the engine's own todo tool, kept current as items finish, plus
+  `Decided:` lines for choices worth seeing. opencode's tool is `todowrite`,
+  lower case, and was listed as absent; no opencode run had ever drawn a
+  step disc.
+- **The runner's words after brief 26.** The preamble, `ask_user`'s
+  description, `release` and the stop receipt spoke of a session frame, a
+  DONE badge and a terminal; a run is a record on the prompt now, its
+  card shows it, questions land as circles, and a report goes through the
+  Glytch Agent.
+- **A prompt accepts a comment.** `report.mjs` no longer refuses the
+  run's outcome line on the prompt it is about; the app accepts it since the
+  same day.
+
+### Added
+
+- **A chat turn's `cwd` is resolved against the watched folder, and
+  `mintIfMissing: true` cuts the agent's chat worktree.** Brief 25 session 1b,
+  2026-09-07: the two halves of the brief's section 3 meeting, after session 2
+  fixed what the app can actually send. The app writes `cwd` RELATIVE to the
+  folder root, because a browser directory handle has a name and not a path,
+  and it cannot create a worktree at all. So the runner resolves a relative
+  `cwd` against the folder whose `.glytch/inbox/spawn` it is watching, uses an
+  absolute one as it stands, and REFUSES anything that escapes the folder
+  (`..`, an absolute path outside it) with the resolved path in the receipt.
+  When `mintIfMissing: true` and the directory is not there, it cuts it once as
+  a git worktree on `glytch/chat-<agentId>` off the checked-out commit - the
+  same base `makeWorktree` picks, and the branch name read off the directory
+  name - with `node_modules` symlinked the way a session's tree gets it, and
+  logs one line. Without the flag session 1's refusal stands unchanged, and the
+  mint refuses both a folder that is not a git repository (a chat needs one for
+  its own worktree; there is no unisolated fallback to offer) and any path that
+  is not `<root>/.claude/worktrees/chat-*`, so a request file cannot turn "mint
+  if missing" into "make a directory anywhere in my folder". The sidecar's
+  `worktreePath` is the RESOLVED ABSOLUTE path, which is what makes the second
+  turn resume: the app hands it straight back as the next turn's `cwd`.
+  Ruling 1 (one long-lived chat worktree per agent per folder, made once and
+  kept) is now held on three sides: `cleanWorktree` refuses a chat path, the
+  sweep's never-touch list says in words that it removes no worktree and that a
+  later stale-worktree rule must skip `chat-*`, and the orphan reaper steps
+  over a `chat-` name. A chat worktree is removed when the AGENT is deleted,
+  which is not built. 12 more tests in `test/chatturn.test.mjs` (39 there,
+  688 in the bridge suite).
+
+- **`kind: "chat-turn"` on a spawn request: a DM with a coding agent answered
+  by the daemon.** Brief 25 session 1, on the rulings of 2026-09-07. Ruling 1A
+  is that a coding agent's chat turn runs THROUGH the daemon, as a persistent
+  Claude Code conversation on his subscription, rather than as the OpenRouter
+  API call every chat turn was until now - so an agent whose engine said
+  `claude-code` had never once run on Claude Code when you talked to it. This
+  is the bridge half. **A request file gains one field and every request
+  written before today is untouched: absent `kind` means `"session"`.** A
+  chat-turn request names `cwd` (the room's own long-lived chat worktree,
+  ruling 1) and `roomId`, and differs from a session in five ways and no
+  others: no frame on the board and so no wait for the app's receipt (ruling
+  3, chat bubble only); no worktree minted, and a `cwd` that is not a
+  directory is refused rather than fallen back from; no repo primer, no
+  attempts log and no runner preamble, all three of which are about a frame it
+  does not have; a per-ROOM lock (`activeChatTurnForRoom`) in place of the
+  per-prompt one, so one live turn per room; and `chat` on line one of the
+  receipt, after the `OK`/`ERROR` both sides of the contract parse by. Stop
+  cancels the turn and KEEPS the conversation (ruling 5): the sidecar carries
+  the conversation id with no `expired` mark, and the sidecar is now written
+  for every chat turn rather than only a persistent one, because a first
+  message has no session id to resume and that file is how the room learns
+  which conversation it opened. No caps are checked here (ruling 2, "no need
+  for caps with coding agents"); an empty `model` passes no `--model` (ruling
+  7). An engine name this bridge does not have is REFUSED for a chat turn
+  where a session falls back to the default - answering as `claude` would be
+  the exact confusion the feature exists to end (`isCodingCli`,
+  `lib/agents.mjs`). `SPAWN.md` gains a "Chat turns" section; 27 tests in the
+  new `test/chatturn.test.mjs`, three compatibility pins in
+  `test/runner.test.mjs`, and `chat-envelope` / `chat-hang` modes in the fake
+  binary. The app half - room routing, the streamed bubble, the ledger - is
+  sessions 2, 3 and 4 of the brief and is not in this release.
+
+### Fixed
+
+- **A resume ran in the wrong directory and never started.** Claude Code keeps
+  conversations per working directory, and `runRequest` built the command line
+  - `--resume <id>` included - a hundred lines BEFORE it chose the working
+  directory. So a "run again" whose recorded worktree had been merged away got
+  the fallback's fresh tree with the resume flag still attached, and the child
+  answered `{"subtype":"error_during_execution","num_turns":0,
+  "total_cost_usd":0,"errors":["No conversation found with session ID: ..."]}`.
+  The receipt said "ended with an error result" and the frame read DONE with
+  nothing in it (spawn-mtqay776-f76882, 2026-09-06 21:06 UTC). The worktree is
+  chosen FIRST now and the resume is decided from the tree actually obtained.
+  Three behaviours follow: a resume whose `worktreePath` is on disk runs IN it,
+  on its existing branch, with no new tree; a resume whose tree is gone starts
+  a FRESH session in a fresh tree, is told in one line of prompt that its
+  history could not come with it, says so in plain words at the top of the
+  receipt, and records the NEW session id in the sidecar so the next run
+  resumes something that exists; and a `No conversation found` envelope at 0
+  turns and $0.00 - the tree was there and Claude Code still had no record -
+  retries ONCE as a fresh session in that same worktree. That retry does not
+  break "Exactly once": the envelope says on its face that nothing was billed
+  and nothing was done, so it is the first attempt happening rather than a
+  second one being paid for, and a second failure is terminal. `SPAWN.md` gains
+  a "Resume - the worktree IS the session's life" section; five tests in
+  `test/runner.test.mjs` and a `no-conversation` mode in the fake binary.
+
+### Added
+
+- **Windows, session 5 of brief 21: the words, and the app half.** Two things
+  a Windows user meets that are text rather than process control, and the one
+  fact both of them need. Ruling 2A: `.mcp.json` names the board server
+  `{"command":"cmd","args":["/c","glytch","mcp"]}` when the WRITER is on
+  Windows, and keeps `{"command":"glytch","args":["mcp"]}` everywhere else -
+  npm installs the bin as `glytch.cmd` there, and an MCP client spawning
+  `glytch` with no shell hits the same Node 18.20.2 / 20.12.2 refusal every
+  other binary in this package hits. Both writers take the platform as an
+  argument (`lib/mcpjson.mjs` defaults to `process.platform`, because `glytch
+  init` IS that machine; the app is handed the runner's), and
+  `test/fixtures/mcp-json-cases.json` grew nine Windows cases that both sides'
+  tests read, so the two copies still cannot drift. A file already carrying
+  EITHER shape is left exactly as it is, which is the presence rule this file
+  has always had and is what stops a folder shared between a Mac and a
+  Windows box being rewritten back and forth. Ruling 3A: the sentence a
+  spawn prompt carries when the Browser switch is on - how to start a dev
+  server that outlives the session - is PowerShell's `Start-Process
+  -WindowStyle Hidden` with `-PassThru` for the pid on Windows, and the
+  `setsid` / `nohup` words unchanged to the byte everywhere else; option B,
+  `start /b`, was rejected because it does not reliably leave the console and
+  the child dies with it. The `.glytch-server.json` record is identical on
+  both - only the words changed. THE MACHINE IS THE RUNNER'S, NOT THE
+  BROWSER'S: the liveness mark gains an optional `platform` key beside `at`,
+  `version`, `updateAvailable` and `agents` (`lib/platform.mjs`, written by
+  both `lib/multiwatch.mjs` and `spawn-runner.mjs`), which is
+  `process.platform` or `wsl` when `/proc/version` names Microsoft - naming
+  WSL rather than folding it in, per ruling 6C, because WSL is the Linux
+  that has `setsid`. A runner from before this brief writes no platform and
+  the app reads that as the POSIX shape rather than as an error. `README.md`
+  and `SPAWN.md` gained a Windows section.
+
+- **Windows, session 1 of brief 21.** A `windows-latest` CI job
+  (`.github/workflows/bridge-tests.yml`) now runs the bridge test suite
+  alongside `ubuntu-latest` on every change under `bridge/`, and per
+  ruling 7A it BLOCKS - no `continue-on-error`, so a Windows regression fails
+  the same way a macOS one does rather than reporting green next to a red
+  platform nobody looks at. Expected to be red for now: brief 19 scoped
+  install to macOS, and the daemon, spawning through `.cmd` shims, and
+  killing a process tree are later sessions' jobs. This session only fixed
+  the seams that were pure bugs on any platform - none of them behavior
+  changes on macOS, all of them proven with Windows-shaped strings rather
+  than a Windows machine: `sync.mjs`'s `pathEntries`/`mergePaths` split PATH
+  on `path.delimiter` instead of a hardcoded `":"`; `worktree.mjs`'s
+  `ensureIgnored` recognizes an absolute `git rev-parse --git-common-dir`
+  path with `path.isAbsolute` instead of `startsWith("/")`;
+  `procs.mjs`'s `parseProcessTable` and `reapableWorktreeName` take an
+  argv0's basename with `path.win32.basename` (a strict superset of the old
+  `lastIndexOf("/")` slice, since it also treats `\` as a separator) instead
+  of missing every backslash path; `reapableWorktreeName`'s worktree-path
+  pattern now matches on whichever separator built `wtRoot`, not a hardcoded
+  `/`; `messaging.mjs`'s session-list display name uses the same
+  `path.win32.basename` instead of `.split("/").pop()`.
+
+- **Windows, session 3 of brief 21: what stops a process, and what proves it is
+  the right one.** Every kill in the package was a POSIX signal, and on Windows
+  Node maps both SIGTERM and SIGKILL to TerminateProcess - so the grace before
+  the hard kill was a fiction, and it ended one pid while `claude.cmd` runs the
+  real agent as a grandchild that survives and keeps billing. Ruling 4A
+  (2026-09-07): `taskkill /pid <pid> /t` then `/t /f` after the same grace,
+  behind the SAME verification guard. One seam, `lib/kill.mjs`, now holds both
+  spellings and is used by the session kill closure, the worktree reaper and
+  the dev-server stop; the macOS path is the same two signals sent by the same
+  caller, unchanged to the byte. `verifyRecordedServer` gained the two Windows
+  evidence sources that guard makes it need - `netstat -ano` for the pid
+  listening on the recorded port, `Get-CimInstance Win32_Process` for the start
+  time and command line - injected exactly where `ps` and `lsof` were, with
+  pure parsers pinned against sample output. Option B of the same ruling, kill
+  with no verification, was rejected on its face: it kills whatever inherited a
+  reused pid.
+
+- **Windows, session 2 of brief 21: spawning at all.** The three worst things
+  brief 21's audit found - the `.cmd`-shim refusal (Node's own security fix
+  since 18.20.2 / 20.12.2) and the `Path`-casing bug in the child's env
+  allowlist - are fixed together, since either one alone still stops every
+  session. A new `runnableCommand(bin, args, {platform, env})` in
+  `bridge/lib/windows-command.mjs` resolves a binary to its `.cmd`/`.exe`/
+  `.bat` through `PATHEXT` and `Path` (or hands it unresolved to a shell,
+  which does its own search), pure and injectable so the whole thing is
+  proven on macOS with a fake platform, env and file-existence check. It is
+  used by `detect.mjs`'s agent probes (and, through the same default `exec`,
+  `sync.mjs`'s opencode registration), `update.mjs`'s npm version check, and
+  `child.mjs`'s session spawn - both `claude` and `opencode`, per ruling
+  5B that both engines run on Windows in v1, codex staying grey. `childEnv`'s
+  allowlist lookup is case-insensitive on Windows only (`Path` now matches
+  `PATH`) and gains the Windows names a child needs to run at all:
+  `SystemRoot`, `windir`, `COMSPEC`, `PATHEXT`, `USERPROFILE`, `HOMEDRIVE`,
+  `HOMEPATH`, `APPDATA`, `LOCALAPPDATA`, `ProgramData`, `ProgramFiles`,
+  `NUMBER_OF_PROCESSORS`, `OS` - without `SystemRoot` a Windows child cannot
+  resolve DNS at all. Both session spawns now set `windowsHide: true`,
+  harmless on POSIX. Detection and killing/cleanup (sessions 1, 3 and 4) are
+  separate sessions and are not in this change.
+
+- **A login daemon on Windows and on WSL, not only on macOS** (2026-09-07,
+  Windows, session 4 of brief 21). `glytch init` installs a Task Scheduler
+  per-user `onlogon` task on Windows (ruling 1A: Task Scheduler was chosen
+  over a Startup shortcut and over a service because it can be QUERIED, which
+  is what keeps `glytch doctor`'s two halves - is the daemon installed, and is
+  it actually beating - working there) and a systemd user unit on WSL and
+  Linux (ruling 6C: both native Windows and WSL count). One interface with
+  three implementations, `lib/logindaemon.mjs`; `lib/launchagent.mjs` is now a
+  thin re-export of the launchd one. `glytch doctor`'s first row names the
+  machine - `macOS`, `Windows`, `WSL (Linux)` or `Linux` - and the daemon row
+  is labelled in that platform's own words. An older WSL with no `systemctl
+  --user` is told so in the row, with the fallback to type instead, rather
+  than being reported as a daemon that merely is not running. Folder contract
+  and install surface, so it belongs in this file.
+- **A `git` row in `glytch doctor`, as a warning** (ruling 8B). No git means
+  no worktree, so sessions run unisolated in the linked folder - and on
+  Windows it also means no Bash tool, which comes from Git for Windows. The
+  row says what is lost and prints `warn`; it is not a FAIL and doctor still
+  exits 0.
+- `GLYTCH_NO_DAEMON_INSTALL=1` writes the daemon's file and registers nothing,
+  on all three platforms. `GLYTCH_NO_LAUNCHCTL=1` is its older name and keeps
+  working.
+
+- **A browser frame's dev server outlives the session that started it.** The
+  second thing "a finished session exits" ended, caught by the 2026-09-06 test
+  pass: a session with the Browser switch on ran `npx serve -l 8765`, filed the
+  frame, finished, and the server died with the child - the frame on the board
+  pointing at a port with no listener. Ruling A the same day: the session
+  starts the server DETACHED and the cleanup sweep stops it later. The session
+  records `{pid, port, cmd, startedAt}` in `.glytch-server.json` in its
+  worktree; the runner mirrors that to `<id>.server` in the spawn channel at
+  teardown so the record outlives the tree. `<id>.server` does not end in
+  `.json` on purpose - the request scan would have read it as a spawn request.
+  Folder contract, so it belongs in this file rather than in the internals.
+- **A fourth signal file, `<id>.relaunch`: start that dev server again.** The
+  ask the same day - "When a dev server gets detached, add a button in terminal
+  to relaunch dev server in this branch. Allows me to test browser." Because
+  the sweep above stops the server later, a session frame outlives its port. The
+  app files `<id>.relaunch` (an optional `{worktreePath}` and nothing else); the
+  runner re-runs the `cmd` in the session's own record, detached, in the
+  recorded worktree, writes a fresh record for both copies, and answers in
+  `<id>.relaunch.result.txt` - its own file, so a relaunch can never overwrite
+  the session's `.result.txt`. It costs no session and no credits. It refuses,
+  by name, when there is no record, when the record has no `cmd`, when the
+  worktree is gone, when the recorded port is held by something else, and when
+  the command exits within 700ms of starting; a server that is still running is
+  answered with the pid and port it is already on rather than started twice.
+  The signal NEVER carries a command: the runner runs what a session recorded,
+  so this is not a way to run arbitrary shell from the canvas.
+
+### Changed
+
+- **The daily sweep stops processes as well as removing files.** It stops the
+  dev server recorded for a request when that request is swept at 14 days, and
+  as soon as the worktree the server was serving is gone. It never kills on a
+  bare pid: the process has to be listening on the recorded port or carrying
+  the recorded command line, with a start time within ten minutes of the
+  record's, or the sweep logs one line and leaves it alone. Pids are reused,
+  and a wrong SIGTERM here is a SIGTERM to whatever the machine handed that
+  number next.
+
+### Fixed
+
+- **Brief 21: CI green on ubuntu and windows, and what being red said.** The
+  first run of `.github/workflows/bridge-tests.yml` (2026-09-07, on main
+  `9a42d17`) failed both jobs - ubuntu 613 of 625, windows 572 of 613 with a
+  file cancelled - while macOS was 625 of 625, which is the whole reason none
+  of it was known. Four of the failures were REAL WINDOWS BUGS in shipped
+  code, and this is the list a stranger installing the package would have met:
+  `glytch runner` and `glytch mcp` both died before reaching their script,
+  because `glytch.mjs` handed `import()` an absolute path and Windows reads
+  `D:\...` as the URL scheme `d:` (it takes a `file://` URL now);
+  `PM_CLAUDE_BIN` pointing at a file that is not there was reported as a
+  session that ran and crashed, because an unresolved PATH was handed to
+  cmd.exe, which exits 1 with a message rather than raising ENOENT (a path is
+  never shelled now, a bare name still is); every receipt and refusal printed a
+  mixed-separator `.glytch\inbox\spawn/spawn-....json`, because the words were
+  built from the `join`ed constant (the contract's spelling is used for words,
+  the joined one for opening files); and a real detached dev server was left
+  running, because `commandsAgree` could not see through the quotes
+  `Win32_Process` puts round an executable and its spaced arguments. The other
+  36 were tests asserting the HOST rather than what they meant - a launchd
+  plist suite inheriting a systemd runner, `"/"`-shaped literals compared
+  against `join`ed paths, a `RegExp` built out of a backslashed temp directory,
+  a rename awaited while the test still held the destination open (Windows
+  refuses that, which is what session 3's retry loop is for), and a fixture
+  that wrote its marker only from a signal handler on a platform with no
+  signals. Two assertions were simply untrue and were replaced rather than
+  relaxed: `lstat` cannot tell a junction from a directory symlink, and the
+  proof of the junction is the file read through the link on a runner with no
+  Developer Mode. `--test-timeout` went 60s to 180s because `node --test`
+  applies it to the file entry as well: `runner.test.mjs` is 86 tests that each
+  spawn a child and it does not fit in a minute on a Windows runner.
+
+  A SECOND ROUND, because a failing test hides what is behind it. With those
+  out of the way the runner found four more shipped Windows bugs: `taskkill
+  /pid <pid> /t` without `/f` asks by posting WM_CLOSE, so the polite pass
+  ALWAYS fails for a console-less process and `killTree` threw that - which
+  `stopRecordedServer` reads as "gone", so a verified detached dev server was
+  never stopped there at all (the grace declined is now not a throw, and
+  everything else taskkill can say still is); Windows has no signals, so
+  `process.abort()` closes with code 134 and no signal, `classifyExit` called
+  that a plain exit, and both halves of the crash-retry ruling were wrong on
+  that platform (a 128+N table, gated on win32); the ACP Stop path sent
+  `session/cancel` and killed, which gave the adapter a moment to act on it
+  only by accident of asynchronous POSIX signal delivery, so on Windows it died
+  with the cancel unread (it now waits for the turn to come back cancelled,
+  bounded at 2s); and the repo primer handed to a session spelled its paths
+  `src\index.js`, matching neither the imports in the files nor git nor a brief.
+  No test was deleted; eight were added. Both jobs green at
+  [34064042188](https://github.com/glytch-ai/prompting-machine/actions/runs/34064042188).
+
+- **Two more Windows seams, from the same session.** A worktree's
+  `node_modules` is linked with a `"junction"` on Windows rather than a
+  directory symlink, which needs Developer Mode or admin there and otherwise
+  throws EPERM - leaving the session unable to run the project's own tests,
+  which is most of what a brief asks it to do. And `writeFileAtomic` retries a
+  rename that fails EPERM or EBUSY, bounded at five tries over about 420ms:
+  Windows file locking is mandatory, so a poller, an antivirus scanner or the
+  search indexer holding the destination open loses a mark file, a registry
+  write or an ops file outright. Neither code is ever produced on a Mac, so
+  both paths are proven with injection.
+
+- **`glytch init` in a second project is watched without a restart.** The
+  daemon read `~/.glytch/folders.json` once at start, so the first test pass
+  of brief 19 (2026-09-06) found a second project registered, reported green
+  by `glytch doctor`, and watched by nothing until `launchctl kickstart -k
+  ai.glytch.runner` was run by hand - the install-once promise held for the
+  first folder only. It now watches the registry file itself (fs.watch on the
+  file and on its directory, because an atomic write replaces the inode, plus
+  a once-a-minute poll as the floor) and starts the new folder's sync and
+  watcher live. The ruling: restarting the daemon from `init` was rejected,
+  because a restart kills whatever session is running in another project. A
+  folder that leaves the registry has its watcher stopped through its own
+  AbortSignal, which drains the sessions it started; a registry that cannot
+  be parsed is one log line and the last good list, never a stop and never an
+  exit.
+
+## [0.3.0] - 2026-09-06
+
+NOTE FOR WHOEVER RELEASES THIS. `package.json` already reads **0.3.0**: brief
+19 set it by hand so the daemon's own version check has a real number to
+compare against npm. `scripts/release-pm-agent.mjs` bumps from what it finds,
+so cut this release as the manual path with the version left alone, or expect
+0.4.0 and say so here.
+
+### Changed
+
+- **The package is renamed to `glytch`**, the bare name, before its first
+  publish - the morning's "add a bin now, rename after release" was reversed
+  the same afternoon because the install line had not shipped anywhere yet,
+  and the scoped `@glytch-ai/glytch` that reversal chose was itself replaced
+  within the hour: the bare name is free on npm, it is what a tester types,
+  and owning it is the stronger protection. The three bins (`glytch`,
+  `pm-agent`, `pm-spawn-runner`) are unchanged, so every `.mcp.json` and
+  opencode registration already written keeps working.
+- **A finished session exits.** The result envelope closes the child's stdin
+  at once, so a `claude --input-format stream-json` session ends when its work
+  does instead of holding an idle process open as a reply window until the
+  90-minute wall clock. The exit settles exactly as before - finished, not a
+  timeout, OK receipt, sidecar written, worktree kept - and the wall clock is
+  unchanged for a session mid-turn. A reply that lands after the session ended
+  becomes a new spawn request that resumes it in the same worktree, so nothing
+  typed is lost. The ruling, 2026-09-06.
+
+### Added
+
+- **A third bin, `glytch`**, beside `pm-agent` and `pm-spawn-runner`. The two
+  older ones are unchanged aliases, not deprecations, so nothing already
+  wired into someone's `.mcp.json` has to move.
+  `glytch init | doctor | forget | stop | runner ... | mcp | --version`;
+  `runner` and `mcp` hand straight over to the existing scripts.
+- **`glytch init`**: registers the folder in `~/.glytch/folders.json`, writes
+  `.mcp.json` by the same rules the app uses, runs `opencode mcp add board --
+  glytch mcp` when opencode is on PATH, installs a macOS login agent so the
+  spawn runner watches without a terminal open, prints which of `claude`,
+  `opencode` and `codex` this machine has, and says to open the board. Safe to
+  run twice: it puts back what is missing and touches nothing that is there.
+- **`glytch doctor`**: ten rows and an exit code - folder registered,
+  `.mcp.json`, opencode registration, login agent and its captured PATH,
+  daemon loaded, daemon beating, board mirror, agents found, Claude Code
+  logged in, version against npm. Exits 0 when every row is green.
+- **A multi-root watch.** `glytch runner watch` with no `PM_BOARD_ROOT` reads
+  the registry and watches every folder in it, each with its own runner id and
+  its own `.runner.json` mark. A folder that has disappeared is one log line,
+  never an exit. With `PM_BOARD_ROOT` set, behaviour is exactly as before.
+- **A cleanup sweep**, on daemon start and once a day: finished spawn requests
+  whose receipt is over 14 days old, rotated logs past the keep count, and
+  registry entries whose folder no longer exists. The mark file, the mirror,
+  un-ingested ops and any unfinished request are never touched.
+- **Logs** at `~/.glytch/logs/runner.log`, rotated at 5 MB, three kept.
+- `GLYTCH_HOME` (moves the registry, the logs and the plist) and
+  `GLYTCH_NO_LAUNCHCTL` (write the plist, load nothing).
+
+- **The runner writes what the machine has into the mark file**, as an
+  `agents` block: `{ claude: {found, version, loggedIn}, opencode: {found,
+  version}, codex: {found} }`. Probed at daemon start and every five minutes,
+  from a cache the liveness beat reads without waiting - a beat that blocks on
+  three `--version` children is a beat the app calls stopped. A probe that
+  fails is `found: false`, never a missing key and never a crash; a probe that
+  has not answered yet writes no `agents` key at all, because "not asked yet"
+  and "not installed" are different facts. Login is asked about Claude Code
+  only, by the presence of `~/.claude/.credentials.json` - the file is never
+  read.
+
+### Changed
+
+- **The runner mark file gains three optional keys**, `version`,
+  `updateAvailable` and `agents`. This is NOT a change to the folder contract:
+  `runnerId`, `pid` and `at` are exactly what they were, so an app built
+  before these keys reads a new runner unchanged, and a new app reads a runner
+  that writes none of them. Both directions are pinned by
+  `test/fixtures/runner-mark-cases.json`, read by a test on each side of the
+  import ban - `test/runnermark.test.mjs` here and
+  `src/folder/spawnRequest.contract.test.ts` in the app.
+
+### What the app does with it
+
+Not this package's surface, and listed only because these keys exist FOR it -
+a reader wondering why a daemon probes anything should not have to go looking.
+The app (brief 19 stages 2 and 3, same day, not on main):
+
+- draws a filled dot and the version for a found engine and a hollow one for a
+  missing engine on the agent editor's engine row, the prompt card's Runs-on
+  row and a new toolbar pill; a mark with no `agents` block draws no dots at
+  all, because "nothing has looked" is not "you have none of these";
+- shows a setup card - `npm i -g glytch`, `cd <your project> && glytch init`,
+  a Copy button - when a coding engine is picked with no runner
+  watching, whose status row goes green by itself when the mark appears;
+- adds a guide step, "Connect your coding agent", done when the mark says a
+  runner is watching.
+## [0.2.0] - 2026-09-02
+
+### Changed
+
+- `get_board` returns a **slim** digest by default, and takes filters:
+  `tag`, `group`, `kind`, `since_days`, `match`, `limit`, plus `view`,
+  `geometry` and `detail` to get the old shape back. Not a breaking change to
+  the tool list, but it IS a change to what a call returns: geometry, the
+  150-char body preview under each title, group member lists and the `AGES`
+  block are omitted unless asked for, and every reply ends with a line naming
+  what it left out. Measured on the live board: 12,014 tokens to 4,788, and
+  1,401 with `tag:"next"`. The reason is a spend audit over 201 transcripts
+  and 26,841 API requests on 2026-08-31 - one `get_board` cost about $0.50
+  once you count it riding in context for the rest of the session, which was
+  roughly 60% of everything the board bridge cost. Call frequency was already
+  fine (107 of 137 board-using sessions called it exactly once), so the fix
+  was to return less, not to call it less.
+- `report`'s tool description is shorter. It was 3,497 characters sitting in
+  every request's system prompt, the largest of the twelve schemas. Rules are
+  unchanged - the evidence rule is still on `flags`, where it is enforced -
+  and the cut rationale is retired in a comment beside it, not deleted.
+- **A finished stream is finished.** A persistent streaming session emits its
+  final result envelope and then holds its reply window open, so the runner's
+  old process-exit reading killed done work at the wall clock and receipted it
+  as ERROR: 26 of 28 ninety-minute kills had their envelope in the log, about
+  $151 of finished work called a failure. The runner reads the envelope and
+  settles the receipt as success; the wall clock stays exactly what it was for
+  a child that never emits one (2adf56b).
+- **A session's verdict and cost land on the frame and in the receipt**, one
+  line: "finished; $7.52, 41 turns, 38m, context 212k". Context fill is the
+  LAST assistant step's input plus cache-read plus cache-creation tokens, never
+  the cumulative total, and events carrying `parent_tool_use_id` are skipped so
+  a subagent's small turn cannot overwrite the lead's number. The session
+  sidecar gains `costUsd`, `numTurns` and `contextFill` (8ba824f, 168a485).
+- **A crash before any output is retried once**, inside the same wall clock.
+  SIGSEGV, SIGABRT, SIGBUS, SIGILL and the Windows access-violation and
+  stack-overflow codes count as crashes; SIGKILL never retries, and a crash
+  AFTER any assistant event is not retried either, because the partial work
+  would be duplicated. The receipt names the class (848fac8, 12f67c4).
+- **Worktree git mutations run one at a time per repo root.** Create, clean,
+  reuse, merge and delete take an in-process lock; reads stay unlocked. Two
+  sessions finishing together could both run checkout-main, pull and merge
+  (565758e).
+- **The merge button keeps the branch and the worktree alive**, and does NOT
+  push. Merging and deleting in one gesture had made the delete control
+  meaningless (6579269, fa31197).
+
+  Corrected 2026-09-02: this entry said "and pushes the merged main to
+  origin", naming the two commits that between them prove the opposite.
+  `fa31197` (23:04) added `git push` after a merge; `6579269` (23:11) took it
+  out again seven minutes later, replacing it with the comment that still
+  stands - "No push: the user pushes when they are ready". The entry was
+  written across both and kept the half that was reverted. `git log -S` over
+  `bridge/lib/worktree.mjs` returns exactly those two commits and no others.
+
+  `git pull --ff-only` went the same way on 2026-09-02, for the same reason
+  stated out loud: a merge is local work on local branches, and a network
+  operation on his main branch that nobody asked for can move main under him,
+  prompt for credentials with nobody watching, or hang on an absent remote
+  while a button on his board spins.
+- **A prompt keeps its worktree and its session across runs**, so a re-run
+  continues work rather than starting over (8eb136c).
+- **The propose vocabulary stops refusing nine ops the app has always
+  accepted** (cffd809).
+
+### Added
+
+- `hooks/board-budget.mjs`, a PreToolUse cap: it shapes the digest exactly as
+  the pending `get_board` would, measures it, and refuses only when the real
+  number is over `PM_BOARD_MAX_TOKENS` (default 6,000), naming the filters
+  that would fit. A cap rather than a confirmation prompt because MCP cannot
+  prompt, the permission dialog cannot show a price, and these sessions run
+  unattended - a dialog would stall an overnight run at the first board read.
+  Wired in `.claude/settings.json` behind an existence check; it exits 0 on
+  every ambiguous case, so it can never break a session.
+- **Two MCP tools, `list_sessions` and `send_message`**, so a session can
+  discover the other sessions running in this project folder and deliver a
+  message to one. Discovery scans `inbox/spawn/` for requests without
+  receipts; delivery writes a from-stamped reply file the target's runner
+  already polls. Twelve tools now, where 0.1.0 shipped ten (85e9e06).
+- **`PM_SPAWN_STALL_MS`** (default 15 minutes): a stall watchdog on a
+  streaming session, armed only when the MODEL should be producing output -
+  a turn open and no tool still running. A hung tool remains the wall clock's
+  job. The receipt says "stopped responding", which is neither a success nor a
+  timeout (848fac8, 12f67c4).
+- **A repository primer on a fresh session's prompt**: the file tree plus
+  exported symbols per source file, deterministic, no model call, cached
+  keyed to the HEAD sha and capped at ~10KB. A fresh session was spending its
+  first turns rediscovering the tree (40061ad).
+- **An attempts log for a re-run.** A prompt that failed before is given
+  bounded summaries of what earlier attempts tried and why they failed, built
+  from receipts and log tails on disk with no model call, and the section says
+  so when something was dropped (709a3c1).
+- **Images reach a coding session**, and a reply file can carry them
+  (547f27d).
+
+### Fixed
+
+- The request scan skips the runner's own `*.session.json` sidecars and
+  dotfiles instead of refusing them as malformed requests - 47 refusal
+  receipts against its own bookkeeping, each one counting against the daily
+  spend bound (2adf56b).
+- A session running in a worktree writes to the real board rather than into
+  its own copy of the folder (2caedb1).
+- A headless session can no longer park itself in plan mode, where nothing
+  would ever answer it (915b9d1).
+- A dead pipe, a duplicated reply, and an orphan reaper that killed processes
+  merely mentioning a worktree path (49093ab).
+## [0.1.0] - 2026-08-28
+
+First published version. Everything below already existed; this is the point
+it became installable by someone who does not have the repo.
+
+### Added
+
+- Ten MCP tools over stdio: `get_board`, `get_node`, `propose`, `ask_user`,
+  `check_answer`, `report`, `open_session`, `close_session`,
+  `collect_session`, `set_brief_status`.
+- `pm-agent` and `pm-spawn-runner` on PATH.
+- MIT licence, so the package can actually be used.
+- An install written for someone who has never seen the repo.