viewable-one 0.0.0-stage → 0.12.2

package/lib/writePolicy.mjs

@@ -0,0 +1,45 @@
+// GENERATED - DO NOT EDIT. Edit src/integrations/writePolicy.ts and run
+// `node scripts/build-digest-copies.mjs`; src/digest/boardDigest.copy.test.ts
+// fails the suite while the two disagree.
+//
+// A copy rather than an import for the reason every copy in this directory is:
+// an Edge Function deploys as the files in its own directory. The source has
+// no value imports of its own, so this is its transpile and nothing else: the
+// rule is written once, where it belongs, and both the app and this function
+// read the same one.
+export function writeRisk(provider, name, args = {}) {
+    const words = `${name.replace(/([a-z])([A-Z])/g, "$1_$2")} ${String(args.method ?? args.action ?? args.command ?? "")}`.toLowerCase();
+    if (provider === "stripe" || /refund|payment|charge|transfer|payout|invoice|subscription/.test(words))
+        return "money";
+    if (/send|email|message|slack.*post/.test(words))
+        return "sending";
+    if (args.archived === true || args.in_trash === true || /delet|remov|destroy|archive|cancel|\breplace_content\b/.test(words))
+        return "deleting";
+    if (/publish|release/.test(words))
+        return "publishing";
+    if (/merge/.test(words))
+        return "merging";
+    if (/deploy/.test(words))
+        return "deploying";
+    // An explicit, small allowlist. A new tool is open-ended until reviewed.
+    if (provider === "linear" && ["create_issue", "update_issue", "save_issue"].includes(name))
+        return null;
+    if (provider === "notion" && ["notion-create-pages", "create_pages"].includes(name))
+        return null;
+    if (provider === "notion" && ["notion-update-page", "update_page"].includes(name)
+        && [undefined, "insert_content", "update_properties", "replace_content_range"].includes(args.command))
+        return null;
+    if (provider === "github" && (name === "add_issue_comment" || (name === "issue_write" && ["create", "update"].includes(String(args.method)))))
+        return null;
+    if (["jira", "atlassian"].includes(provider) && ["createJiraIssue", "editJiraIssue"].includes(name))
+        return null;
+    return "open-ended";
+}
+export function riskReason(risk) {
+    if (risk === "money")
+        return "Money moves, so this asks every time.";
+    return `${risk === "open-ended" ? "Open-ended tools ask" : risk[0].toUpperCase() + risk.slice(1) + " asks"} every time.`;
+}
+export function writesSupported(provider) {
+    return ["notion", "linear", "github", "jira", "atlassian", "sentry", "stripe"].includes(provider);
+}

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "viewable-one",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.12.2",
+  "description": "Run coding agents from the Viewable board. Connects your machine to app.viewable.one, launches a session in its own worktree when you press Run, and streams what it does back to the canvas.",
+  "keywords": [
+    "mcp",
+    "claude",
+    "claude-code",
+    "canvas",
+    "board",
+    "agent",
+    "viewable"
+  ],
+  "homepage": "https://github.com/glytch-ai/viewable/tree/main/bridge#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/glytch-ai/viewable.git",
+    "directory": "bridge"
+  },
+  "bugs": {
+    "url": "https://github.com/glytch-ai/viewable/issues"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "//bin": "viewable is the primary command; glytch and pm-spawn-runner remain compatible aliases (#2196, #2201).",
+  "bin": {
+    "viewable": "glytch.mjs",
+    "glytch": "glytch.mjs",
+    "pm-spawn-runner": "spawn-runner.mjs",
+    "viewable-one": "glytch.mjs"
+  },
+  "files": [
+    "glytch.mjs",
+    "spawn-runner.mjs",
+    "lib/",
+    "README.md",
+    "SPAWN.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "//dependencies": "ACP packages load only for the acp-claude engine. smol-toml validates Codex config before appending a board table; jsonc-parser edits OpenCode config while preserving comments. @supabase/realtime-js holds the runner's push channel (#813), reached only through lib/runnerRealtime.mjs and loaded on first use; it uses the WebSocket built into Node 22.",
+  "dependencies": {
+    "@agentclientprotocol/claude-agent-acp": "0.73.0",
+    "@agentclientprotocol/sdk": "1.4.0",
+    "@supabase/realtime-js": "2.112.3",
+    "jsonc-parser": "3.3.1",
+    "smol-toml": "1.8.0"
+  },
+  "//scripts": "NO postinstall since 2026-09-14. It ran lib/installCloudflared.mjs to pre-fetch the cloudflared binary, which is only ever needed by a SHARED PREVIEW - so every install of the runner paid for a download most machines never use, and printed a warning line when it failed (reported through the app's feedback as an npm warning on install). lib/previewTunnel.mjs already calls ensureCloudflared lazily and reports its own failure in words a person can act on, so the fetch happens the first time a preview is actually shared and not before. prepublishOnly is NOT the test suite, on purpose: it used to be `node --test`, and a filesystem-race test that only misbehaves in one shell blocked about ten releases without ever catching a real defect in one. The suite runs in `npm run verify` and as its own step in the release workflow, both of which stop a publish. scripts/prepublish.mjs checks what is only true of the artifact and cannot answer differently twice.",
+  "scripts": {
+    "test": "node ../scripts/test-bridge.mjs",
+    "prepublishOnly": "node scripts/prepublish.mjs"
+  }
+}

package/spawn-runner.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// The spawn runner's command line. bridge/SPAWN.md is the contract.
+//
+// This file exists so that turning the runner on is a THING A PERSON TYPES.
+// Nothing imports it, nothing starts it, and no other part of the bridge can
+// reach it: no session's board tools can start a runner however it is
+// prompted. That is deliberate and it is the outermost of the money gates.
+//
+//   PM_SPAWN_RUNNER=on node bridge/spawn-runner.mjs watch # actually spend
+//   node bridge/spawn-runner.mjs once                     # one pass
+//   node bridge/spawn-runner.mjs merge <worktree-path>
+//   node bridge/spawn-runner.mjs delete-worktree <worktree-path>
+//
+
+import { newRunnerId, pollOnce, settingsFromEnv, watch } from "./lib/runner.mjs";
+import { AGENTS } from "./lib/agents.mjs";
+import { makeAgentProbe } from "./lib/detect.mjs";
+import { platformMark } from "./lib/platform.mjs";
+import { mergeWorktree, deleteWorktree } from "./lib/worktree.mjs";
+
+const root = process.env.PM_BOARD_ROOT?.trim() || process.cwd();
+const say = (line = "") => process.stdout.write(`${line}\n`);
+const die = (line) => {
+  process.stderr.write(`${line}\n`);
+  process.exit(1);
+};
+
+const [command, ...rest] = process.argv.slice(2);
+
+const USAGE = `pm spawn runner: runs Claude Code sessions the board asked for.
+
+  watch
+      Poll and run what is approved. Requires PM_SPAWN_RUNNER=on as well as
+      this command: an absent variable is not consent.
+
+  once
+      One pass instead of a loop. Same gate.
+
+  merge <worktree-path>
+      Merge a session's worktree branch into main and clean up.
+
+  delete-worktree <worktree-path>
+      Delete a worktree and its branch without merging.
+
+RETIRED (brief 30 Move 2b, 2026-09-11): the mailbox these spoke is a row
+now; reach supabase/functions/board-runner/ directly with a viewable login (or
+VIEWABLE_BOARD_TOKEN) bearer instead:
+
+  request, approve, status, show, release
+
+Environment:
+  PM_BOARD_ROOT             the linked folder (default: cwd)
+  PM_SPAWN_RUNNER=on        the switch; nothing runs without it
+  PM_CLAUDE_BIN             the binary (default "claude"); point it at a fake
+                            script to exercise every path for free
+  PM_CLAUDE_ARGS            JSON array, "{prompt}" is substituted
+  PM_SPAWN_MAX_CONCURRENT   how many sessions run at once; any number by default
+`;
+
+const RETIRED_COMMANDS = ["request", "approve", "status", "show", "release"];
+
+async function main() {
+  if (RETIRED_COMMANDS.includes(command)) {
+    die(
+      `\`${command}\` is retired (brief 30 Move 2b, 2026-09-11): the file mailbox it spoke is gone, a run\n` +
+        `is a row now. Reach supabase/functions/board-runner/ directly with a viewable login (or\n` +
+        `VIEWABLE_BOARD_TOKEN) bearer for what this command used to do by hand.`,
+    );
+  }
+
+  switch (command) {
+    case "watch":
+    case "once": {
+      const settings = { ...settingsFromEnv(), runnerId: newRunnerId() };
+      if (!settings.enabled) {
+        die(
+          "The runner is off.\n\n" +
+            "It has no default-on path and it does not start itself: spawning a session\n" +
+            "uses your own Claude Code or Codex plan, so an absent variable is not consent. Turn it on\n" +
+            "for one command, deliberately:\n\n" +
+            "  PM_SPAWN_RUNNER=on node bridge/spawn-runner.mjs watch\n\n" +
+            "To try it without spending anything, point PM_CLAUDE_BIN at a fake binary\n" +
+            "first (bridge/test/fixtures/fake-claude.mjs is exactly that).",
+        );
+      }
+      // THE WARNING MUST SURVIVE THE ENGINES BECOMING PLURAL. It used to be
+      // keyed on claudeBin === "claude", and when settings stopped prefilling
+      // that field - so a request could choose its own engine - the whole
+      // warning silently stopped firing. A safety notice that quietly turns
+      // itself off is worse than not having written one.
+      //
+      // So it asks the same question the runner will: what would actually be
+      // spawned. Overridden means a fake binary and no spend; not overridden
+      // means whatever real engine a request names.
+      if (settings.claudeBin === undefined) {
+        const names = Object.values(AGENTS)
+          .map((a) => `${a.label} (${a.binEnv})`)
+          .join(", ");
+        say(
+          `! This uses your own Claude Code or Codex plan: no binary override is set, so a request runs the real engine it asks for: ${names}.`,
+        );
+      } else {
+        say(
+          `Using ${settings.claudeBin} for every request - nothing comes out of your plan unless that is the real engine.`,
+        );
+      }
+      if (command === "once") {
+        const pass = await pollOnce(root, settings, say);
+        for (const r of pass.ran) say(`[${r.id}] ${r.state}`);
+        for (const s of pass.skipped) say(`waiting: ${s.reason}`);
+        if (pass.ran.length === 0 && pass.skipped.length === 0) say("Nothing approved and pending.");
+        return;
+      }
+      const controller = new AbortController();
+      process.on("SIGINT", () => {
+        say("\nStopping. Any session already running keeps running, it is a separate process.");
+        controller.abort();
+      });
+      // WHAT THIS MACHINE HAS, in the presence a registered project carries
+      // (brief 19 stage 2, moved onto rows in brief 30 Move 1/2). The
+      // multi-root daemon does this in lib/multiwatch.mjs; a runner started
+      // here - by hand, or by `glytch runner watch` with PM_BOARD_ROOT set -
+      // has to say the same thing, or the app's presence would depend on
+      // WHICH way the runner was started. Probed once before the first beat
+      // and then on the probe's own five-minute clock; the beat itself only
+      // ever reads memory.
+      const probe = makeAgentProbe({ log: say });
+      await probe.once();
+      // AND WHAT MACHINE IT IS, for the same reason (brief 21 session 5, his
+      // ruling 3A): the app picks the detached-dev-server words from the
+      // platform the RUNNER reports, never from the browser's own, so a
+      // hand-started runner has to say it too or a session started this way
+      // would be handed the wrong shell.
+      const platform = platformMark();
+      await watch(
+        root,
+        { ...settings, markExtra: () => ({ ...platform, ...probe.mark() }), refreshAgents: () => probe.once() },
+        { signal: controller.signal, log: say },
+      );
+      return;
+    }
+
+    case "merge": {
+      const worktreePath = rest[0];
+      if (!worktreePath) die("Which worktree path?\n\n" + USAGE);
+      const result = await mergeWorktree(root, worktreePath, say);
+      if (!result.ok) die(result.detail);
+      say(result.detail);
+      return;
+    }
+
+    case "delete-worktree": {
+      const worktreePath = rest[0];
+      if (!worktreePath) die("Which worktree path?\n\n" + USAGE);
+      const result = await deleteWorktree(root, worktreePath, say);
+      if (!result.ok) die(result.detail);
+      say(result.detail);
+      return;
+    }
+
+    default:
+      say(USAGE);
+      if (command !== undefined && command !== "help" && command !== "--help") process.exit(1);
+  }
+}
+
+main().catch((error) => die(error instanceof Error ? error.message : String(error)));