waterplane 0.1.19 → 0.1.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. package/CHANGELOG.md +17 -0
  2. package/NOTICES.md +0 -26
  3. package/README.md +19 -18
  4. package/SECURITY.md +575 -562
  5. package/node_modules/@waterplane/shared/dist/exposure.js +0 -1
  6. package/node_modules/@waterplane/shared/dist/exposure.js.map +1 -1
  7. package/node_modules/@waterplane/shared/dist/plugin/api.d.ts +2 -2
  8. package/npm-shrinkwrap.json +2 -177
  9. package/package.json +1 -2
  10. package/packages/host/dist/clisuggest.d.ts +2 -1
  11. package/packages/host/dist/clisuggest.js +22 -4
  12. package/packages/host/dist/clisuggest.js.map +1 -1
  13. package/packages/host/dist/plugins/pluginregistry.js +3 -1
  14. package/packages/host/dist/plugins/pluginregistry.js.map +1 -1
  15. package/packages/host/dist/push.d.ts +3 -2
  16. package/packages/host/dist/push.js +7 -6
  17. package/packages/host/dist/push.js.map +1 -1
  18. package/packages/host/dist/pushsend.d.ts +57 -0
  19. package/packages/host/dist/pushsend.js +146 -0
  20. package/packages/host/dist/pushsend.js.map +1 -0
  21. package/packages/host/dist/question.js +9 -0
  22. package/packages/host/dist/question.js.map +1 -1
  23. package/packages/host/dist/render.js +2 -1
  24. package/packages/host/dist/render.js.map +1 -1
  25. package/packages/host/dist/screenlog.d.ts +5 -0
  26. package/packages/host/dist/screenlog.js +7 -2
  27. package/packages/host/dist/screenlog.js.map +1 -1
  28. package/packages/host/dist/sessions/askwatch.js +1 -1
  29. package/packages/host/dist/sessions/askwatch.js.map +1 -1
  30. package/packages/host/package.json +0 -2
  31. package/packages/web/dist/assets/{demo-iVbE6mpm.js → demo-CbdAM5Ox.js} +1 -1
  32. package/packages/web/dist/assets/index-CF6HCu-P.js +170 -0
  33. package/packages/web/dist/assets/{index-DiZysQBa.css → index-D3OoNfGN.css} +1 -1
  34. package/packages/web/dist/assets/{sheets-CDv71Sfe.js → sheets-BwjSEjgB.js} +97 -97
  35. package/packages/web/dist/build-id.txt +1 -1
  36. package/packages/web/dist/buildstamp.json +1 -1
  37. package/packages/web/dist/index.html +4 -4
  38. package/packages/web/dist/sw.js +2 -2
  39. package/release.json +3 -3
  40. package/packages/web/dist/assets/index-NA--kuEl.js +0 -170
package/CHANGELOG.md CHANGED
@@ -5,6 +5,23 @@ version — so entries are grouped by the release they shipped in. A fixed secur
5
5
  vulnerability in what ships is listed under a **Security:** bullet of the release that
6
6
  fixed it, with its CVE or GHSA id when one exists.
7
7
 
8
+ ## 0.1.20
9
+
10
+ ### New
11
+
12
+ - **The Files browser reopens in the folder you left, per repo.** Each repo remembers its own place.
13
+ - **Every Questions card names the session's conversation beside its title.** Two sessions of one repo can now be told apart.
14
+ - **Each row in the tabs list shows its star, flag, prompt count and cost.** They match the launcher row.
15
+ - **The shift+tab chip sits at the very end of the key row, past CLI.**
16
+ - **The name fields on the New sheet open a lowercase keyboard.** Project, folder and branch names are not sentences.
17
+
18
+ ### Fixed
19
+
20
+ - **A cached list says the link is down only when it is.** The age line used to say so under a strip reading 185 ms. It now says checking, link down, no answer, or the host's refusal. A sheet opened during a reconnect reads the host when the link comes back instead of staying on its cache.
21
+ - **A session no longer reports "asked you" on a turn that asked nothing.** After a pane was narrowed, the leftover tail of an old wider frame ended up on the card. A "?" in the CLI's recap can no longer count as the question.
22
+ - **A torn closing rule no longer publishes the footer as Claude's proposal.** A proposal now needs a complete box and both reads from the same frame.
23
+ - **The Wi-Fi name is shown with Tailscale on.** The name was empty even with the permission granted, because the VPN was read instead of the Wi-Fi network. It is read again when the app resumes.
24
+
8
25
  ## 0.1.19
9
26
 
10
27
  ### New
package/NOTICES.md CHANGED
@@ -16,7 +16,6 @@ not a redistribution of Claude Code.
16
16
  | --- | --- | --- | --- |
17
17
  | `@xterm/headless` | 5.5.0 | MIT | https://github.com/xtermjs/xterm.js |
18
18
  | `node-pty` | 1.2.0-beta.15 | MIT | https://github.com/microsoft/node-pty |
19
- | `web-push` | 3.6.7 | **MPL-2.0** | https://github.com/web-push-libs/web-push |
20
19
  | `ws` | 8.22.0 | MIT | https://github.com/websockets/ws |
21
20
 
22
21
  ## `packages/web`
@@ -56,31 +55,6 @@ build time and downloaded to the phone only when the person switches the extensi
56
55
  No runtime dependencies — it's the wire-protocol type definitions shared by
57
56
  the other two workspaces.
58
57
 
59
- ## A note on `web-push` (MPL-2.0)
60
-
61
- Every other runtime dependency above is MIT or ISC — both short,
62
- permissive, attribution-only licenses fully compatible with this project's
63
- MIT license. `web-push` is the one exception: it's licensed under the
64
- **Mozilla Public License 2.0**, a weak-copyleft, *file-level* license.
65
-
66
- That matters less than it sounds. MPL-2.0's copyleft applies to the
67
- *licensed files themselves* — if you modify a file from the MPL-licensed
68
- library and distribute that modified file, you owe the source for that file
69
- under MPL-2.0. It does **not** propagate to code that merely imports the
70
- library and calls its API, the way `packages/host/src/push.ts` does here.
71
- This project:
72
-
73
- - uses `web-push` unmodified, straight from npm as an ordinary dependency
74
- (`packages/host/package.json`), and
75
- - never vendors, forks, or edits any of its source files.
76
-
77
- So using it here imposes no relicensing obligation on this project — the
78
- rest of the codebase stays MIT, and only `web-push`'s own files (which this
79
- project doesn't touch) remain under MPL-2.0. If you fork this project and
80
- start editing `web-push`'s own source directly, MPL-2.0's file-level
81
- copyleft would apply to *those* edited files — but that's a decision you'd
82
- be making, not something inherited from using the library as-is.
83
-
84
58
  ## Verifying this file
85
59
 
86
60
  Every license claim above was read directly from the installed package's own
package/README.md CHANGED
@@ -15,9 +15,9 @@ customized: a plugin adds the button, switch or status line your way of working
15
15
  [How it compares](#how-it-compares) · [Security](SECURITY.md) · [Open source (MIT)](LICENSE) ·
16
16
  macOS, Linux, Windows via WSL2 · Android app or web app, no iOS app yet
17
17
 
18
- <a href="https://waterplane-dev.github.io/media/first-look-9e3dc02a21.mp4"><img src="docs/media/first-look.gif" width="270" alt="A session starts from the phone; Claude Code on the desktop builds the app and screenshots it in the iOS simulator and the Android emulator; the two screenshots are combined, the clipped Android button circled and sent back; Claude fixes it, re-checks both, and the debug APK arrives as a download for the real phone"></a>
18
+ <a href="https://waterplane-dev.github.io/media/first-look-a706bf617d.mp4"><img src="docs/media/first-look.gif" width="270" alt="A session starts from the phone; Claude Code on the desktop builds the app and screenshots it in the iOS simulator and the Android emulator; the two screenshots are combined, the clipped Android button circled and sent back; Claude fixes it, re-checks both, and the debug APK arrives as a download for the real phone"></a>
19
19
 
20
- *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/first-look-9e3dc02a21.mp4), with pause and seek.*
20
+ *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/first-look-a706bf617d.mp4), with pause and seek.*
21
21
  <!-- /site:intro -->
22
22
 
23
23
  - **The real CLI, not a re-implementation.** Every slash command, plan and trust prompt and the
@@ -68,7 +68,7 @@ Two more things I was not at ease with:
68
68
  - **Remote desktop to a Mac from a phone is miserable.** Every solution I tried was. It was
69
69
  surprisingly easy to let Claude build an alternative into waterplane that is actually usable from
70
70
  a phone: the [live desktop view](packages/extensions/desktop/README.md), experimental, macOS and Windows,
71
- shipped off by default.
71
+ off by default.
72
72
  <!-- /site:why -->
73
73
 
74
74
  <!-- site:desk -->
@@ -80,9 +80,9 @@ elsewhere: the Mac Studio builds and runs the simulators while the notebook only
80
80
  The window gets a sidebar of repos, the session in the middle and a panel beside it, and it is
81
81
  the same sessions, queue and costs, so what you left on the laptop is waiting on the phone.
82
82
 
83
- <a href="https://waterplane-dev.github.io/media/desktop-7af0b11f01.mp4"><img src="docs/media/desktop.gif" width="720" alt="The same app in a laptop's browser: repos in a sidebar, todo-garden's session started in the main pane, the prompt sent with Cmd+Return, Claude Code builds and checks the iOS simulator and the Android emulator, and the gallery opens as a panel beside the session with both screenshots"></a>
83
+ <a href="https://waterplane-dev.github.io/media/desktop-abba5cda6f.mp4"><img src="docs/media/desktop.gif" width="720" alt="The same app in a laptop's browser: repos in a sidebar, todo-garden's session started in the main pane, the prompt sent with Cmd+Return, Claude Code builds and checks the iOS simulator and the Android emulator, and the gallery opens as a panel beside the session with both screenshots"></a>
84
84
 
85
- *A short loop. [The whole film as a video](https://waterplane-dev.github.io/media/desktop-7af0b11f01.mp4).*
85
+ *A short loop. [The whole film as a video](https://waterplane-dev.github.io/media/desktop-abba5cda6f.mp4).*
86
86
 
87
87
  Desktops can also work for each other. Pair two of them and an agent on one can hand a job to the
88
88
  other (run the Windows build, the tests on the bigger machine): the branch travels through your
@@ -194,9 +194,9 @@ npm run build
194
194
  npm start
195
195
  ```
196
196
 
197
- <a href="https://waterplane-dev.github.io/media/setup-30becef6cf.mp4"><img src="docs/media/setup.gif" width="270" alt="The desktop builds and starts the host; on the phone the app lists the repo, + now starts claude in it, and its trust question is answered with a tap"></a>
197
+ <a href="https://waterplane-dev.github.io/media/setup-3bc9b6dc2e.mp4"><img src="docs/media/setup.gif" width="270" alt="The desktop builds and starts the host; on the phone the app lists the repo, + now starts claude in it, and its trust question is answered with a tap"></a>
198
198
 
199
- *From `npm run build` on the desktop to claude running in your repo on the phone. [The whole setup as a video](https://waterplane-dev.github.io/media/setup-30becef6cf.mp4), with pause and seek.*
199
+ *From `npm run build` on the desktop to claude running in your repo on the phone. [The whole setup as a video](https://waterplane-dev.github.io/media/setup-3bc9b6dc2e.mp4), with pause and seek.*
200
200
 
201
201
  `npm run doctor` (or `waterplane doctor`) is the first thing to re-run when something misbehaves:
202
202
  it names what is wrong and what to type. The host lists the git repos under `~/dev` (or
@@ -221,9 +221,9 @@ updating and every environment variable: [docs/install.md](docs/install.md).
221
221
  <!-- site:outbox -->
222
222
  ### What Claude made, on your phone
223
223
 
224
- <a href="https://waterplane-dev.github.io/media/gallery-and-files-6250099dbb.mp4"><img src="docs/media/gallery-and-files.png" width="270" alt="The gallery lists what Claude left in the outbox: a markdown file, a live HTML page and a screenshot open on the phone"></a>
224
+ <a href="https://waterplane-dev.github.io/media/gallery-and-files-e1ccd7049c.mp4"><img src="docs/media/gallery-and-files.png" width="270" alt="The gallery lists what Claude left in the outbox: a markdown file, a live HTML page and a screenshot open on the phone"></a>
225
225
 
226
- *[The walkthrough as a video](https://waterplane-dev.github.io/media/gallery-and-files-6250099dbb.mp4).*
226
+ *[The walkthrough as a video](https://waterplane-dev.github.io/media/gallery-and-files-e1ccd7049c.mp4).*
227
227
 
228
228
  What Claude leaves in `.claude/outbox/` appears on the phone as a picture or a file, with a badge on
229
229
  the repo and a notification. Open it full size, draw a circle or a box on it, type what to change,
@@ -234,9 +234,9 @@ of text to point Claude at it.
234
234
  <!-- site:limit -->
235
235
  ### When the usage limit hits, it carries on
236
236
 
237
- <a href="https://waterplane-dev.github.io/media/limit-and-budget-49f91fd711.mp4"><img src="docs/media/limit-and-budget.gif" width="270" alt="Claude stops at the 5-hour usage wall; at the reset waterplane types continue and the turn finishes"></a>
237
+ <a href="https://waterplane-dev.github.io/media/limit-and-budget-228ef9996b.mp4"><img src="docs/media/limit-and-budget.gif" width="270" alt="Claude stops at the 5-hour usage wall; at the reset waterplane types continue and the turn finishes"></a>
238
238
 
239
- *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/limit-and-budget-49f91fd711.mp4), with pause and seek.*
239
+ *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/limit-and-budget-228ef9996b.mp4), with pause and seek.*
240
240
 
241
241
  When a session hits a Claude usage limit, the host notices, waits for the reset and continues it,
242
242
  reopening the conversation with `--continue` if the CLI exited. Bounded retries, and an off switch
@@ -248,9 +248,9 @@ your words kept and the reason said.
248
248
  <!-- site:queue -->
249
249
  ### Queue it now, or schedule it against the usage windows
250
250
 
251
- <a href="https://waterplane-dev.github.io/media/queue-and-schedule-1cb4c31dac.mp4"><img src="docs/media/queue-and-schedule.gif" width="270" alt="A prompt queued behind a running turn starts by itself when the turn ends; schedules wait for a time or for the weekly window"></a>
251
+ <a href="https://waterplane-dev.github.io/media/queue-and-schedule-159fd268d2.mp4"><img src="docs/media/queue-and-schedule.gif" width="270" alt="A prompt queued behind a running turn starts by itself when the turn ends; schedules wait for a time or for the weekly window"></a>
252
252
 
253
- *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/queue-and-schedule-1cb4c31dac.mp4), with pause and seek.*
253
+ *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/queue-and-schedule-159fd268d2.mp4), with pause and seek.*
254
254
 
255
255
  A prompt sent while you are offline or while the session is busy waits in a queue and is typed in
256
256
  exactly once. Or post a prompt for later: at a time, when the session goes quiet, after another one
@@ -261,9 +261,9 @@ before the reset, spend what is left"). The Backlog holds a repo's work that nob
261
261
  <!-- site:cost -->
262
262
  ### Know what it costs
263
263
 
264
- <a href="https://waterplane-dev.github.io/media/numbers-6b4a0ebc6b.mp4"><img src="docs/media/numbers.gif" width="270" alt="A week of heavy use priced at API list price, what drives the cost, and a ten-hour session whose subagents are most of its bill"></a>
264
+ <a href="https://waterplane-dev.github.io/media/numbers-8fcb01f5ef.mp4"><img src="docs/media/numbers.gif" width="270" alt="A week of heavy use priced at API list price, what drives the cost, and a ten-hour session whose subagents are most of its bill"></a>
265
265
 
266
- *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/numbers-6b4a0ebc6b.mp4), with pause and seek.*
266
+ *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/numbers-8fcb01f5ef.mp4), with pause and seek.*
267
267
 
268
268
  Every finished turn says what it cost: tokens in, out and cached, and dollars at list price, plus
269
269
  what the *next* turn will cost compared with a fresh session. The token ledger splits every total by
@@ -278,9 +278,9 @@ than a guess.
278
278
  <!-- site:health -->
279
279
  ### Repo health, so the vibe coding stays maintainable
280
280
 
281
- <a href="https://waterplane-dev.github.io/media/repo-health-a6076318e5.mp4"><img src="docs/media/repo-health.gif" width="270" alt="A repo vibe-coded for eight months scores 46 out of 100: one 8,397-line file caps the score, two severe warnings name it, and the trend slides from 100 in February"></a>
281
+ <a href="https://waterplane-dev.github.io/media/repo-health-c6dd35721b.mp4"><img src="docs/media/repo-health.gif" width="270" alt="A repo vibe-coded for eight months scores 46 out of 100: one 8,397-line file caps the score, two severe warnings name it, and the trend slides from 100 in February"></a>
282
282
 
283
- *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/repo-health-a6076318e5.mp4), with pause and seek.*
283
+ *A short loop. [The whole walkthrough as a video](https://waterplane-dev.github.io/media/repo-health-c6dd35721b.mp4), with pause and seek.*
284
284
 
285
285
  Vibe coding drifts into a mess quietly, and a steady number does not mean a healthy repo. Each repo
286
286
  gets one health score out of 100, measured against fixed good values: file length, files reworked
@@ -358,7 +358,7 @@ foremost (opencode support is experimental). The packages and the plugin mechani
358
358
  <!-- site:compare -->
359
359
  ## How it compares
360
360
 
361
- Anthropic's own Remote Control now drives a local Claude Code session from the Claude app, and Happy,
361
+ Anthropic's own Remote Control drives a local Claude Code session from the Claude app, and Happy,
362
362
  Paseo and Orca put coding agents on a phone too. Reaching your agent from a phone is not what is
363
363
  different here. What is: the real terminal plus a reader, no vendor or relay in the path, the build
364
364
  and artifact loop back to the phone (marked-up screenshots into the prompt, verified simulator and
@@ -446,6 +446,7 @@ All public repos: [waterplane](https://github.com/waterplane-dev/waterplane) ·
446
446
  service, updating, configuration.
447
447
  - [Architecture](docs/notes/architecture.md): what runs where, the packages, and the plugins.
448
448
  - [SECURITY.md](SECURITY.md): the threat model, and how to report a security problem.
449
+ - [GOVERNANCE.md](GOVERNANCE.md) and [ROADMAP.md](ROADMAP.md): who decides, and what the next year holds.
449
450
  - [DISCLAIMER.md](DISCLAIMER.md): what else you agree to by running it.
450
451
  - [The Android app](packages/app/README.md): building it, and every permission with its reason.
451
452
  - [CLAUDE.md](CLAUDE.md) and [docs/notes/](docs/notes/README.md): the rules an agent must know before