workbite 0.1.13 → 0.1.15

package/README.md

@@ -3,15 +3,20 @@
 WorkBite installs and opens **Work Stack** (organizes the work) and
 **StackBite** (gets it moving) as one native suite.
 
-Launcher 0.1.11 (native bundle 0.1.11) supports **Windows x64 and Linux x64**
-(glibc 2.28+). It opens the familiar TypeScript Work Stack UI by default, which
+Launcher 0.1.15 pins the verified **Windows x64** native bundle. Install it
+with `npm install -g workbite@0.1.15` or use the `windows` dist-tag. The
+`latest` tag remains at 0.1.12 for its earlier Windows/Linux x64 (glibc 2.28+)
+artifacts; no 0.1.15 Linux binary is included. Archive size, SHA-256 and the
+bundle digest are sealed in `release.json` and checked before execution.
+See the [release notes](https://github.com/Shinick-Han/WorkBite-releases/releases/tag/v0.1.15).
+It opens the familiar TypeScript Work Stack UI by default, which
 has one Tasks workbench: switch Focus/Table/Board without losing your selected
 Task, deploy its agent, and control the native terminal beside or below the Tasks.
 Use F6 to move focus, Ctrl+B to hide the sidebar, Alt+Shift+L to switch layouts,
 Alt+Shift+arrows to resize, and Alt+Shift+Z to expand the active pane. Existing
-Runs and Seats remain available while navigating. Cursor CLI remains a raw
-native provider in opted-in Rooms (you approve its trust; its lifecycle/resume
-is not verified yet). The unified Rust UI stays
+Runs and Seats remain available while navigating. Cursor and Grok remain raw
+native providers in opted-in Rooms (you approve their trust; native lifecycle,
+completion and resume remain unsupported/unqualified). The unified Rust UI stays
 an explicit alternative per open: `workbite open --frontend rust` (or bare
 `workbite --frontend rust`). Either frontend reuses the same owner and
 StackBite backend; the choice is not saved. Leaving the view or closing the UI
@@ -24,7 +29,7 @@ operator handover of existing backend processes; the launcher does not stop
 them or clear startup records automatically.
 
 ```sh
-npm install -g workbite
+npm install -g workbite@0.1.15                             # Windows x64
 workbite install
 workbite open --workspace /abs/path/new-folder --init      # first time, once
 workbite                                                   # afterwards (TypeScript UI)
@@ -67,9 +72,8 @@ with absolute `WORKBITE_HOME` / `WORKBITE_STATE_DIR`) and never touches
 separately installed Work Stack or StackBite apps, their state or ports. It
 never approves provider trust or starts paid agents by itself.
 
-Startup diagnostics in the **unreleased source** add `workbite status [--json]`,
-`workbite doctor [--json]` and `workbite recover --dry-run [--json]`. Check your
-installed launcher's `--help` before using them. They inspect evidence and plan
+Startup diagnostics include `workbite status [--json]`,
+`workbite doctor [--json]` and `workbite recover --dry-run [--json]`. They inspect evidence and plan
 only: no process starts/stops, record reset, native intent repair or migration.
 `open --no-ui` does start/reuse the backend stack (including native selection for
 v2) and prints JSON, but never launches or validates the foreground UI. Startup
@@ -103,5 +107,19 @@ it starts. The `workbite-native` agent skill shipped in this package
 (`skills/workbite-native/`) describes the commands, packets and recovery
 rules.
 
+Windows 0.1.15 retains the read-only phone companion pilot from 0.1.14.
+Phone actions preserve their selected target during status reads, show pending
+work and reuse the managed Windows helper within actions. Pairing links retain
+their complete URL; QR opening has an explicit Edge alternative. A successful
+system handoff does not establish that a browser or viewer rendered the target. Open Settings
+with `,`, select Phone, enable it, then pair using the expiring QR and compare
+the complete fingerprint before approving on the PC. Remembered browsers can
+reconnect; devices can be revoked. Initial PC enrollment requires an operator
+invitation through the supported embedding/bootstrap surface; this release
+does not include a public invitation-entry UI. The hosted relay needs no user
+domain or Cloudflare client. CurrentUser DPAPI on local NTFS is required.
+Mobile Task writes, deployment, terminal input, replies, notifications and
+background connectivity are not supported. The PC must remain online.
+
 This package is `UNLICENSED` (all rights reserved). Third-party licenses ship
 in each bundle's `licenses/` folder.

package/lib/cli.js

@@ -317,7 +317,8 @@ async function main(argv = process.argv.slice(2), options = {}) {
     return { code: 0, signal: null };
   }
   return openSuite({ installed, commands: options.commands, workspace: parsed.workspace, init: parsed.init, ui: parsed.ui,
-    frontend: parsed.frontend, stateRoot, environment, spawnImpl: options.spawnImpl, execImpl: options.execImpl, stdout, stderr, timeouts: options.timeouts });
+    frontend: parsed.frontend, stateRoot, environment, spawnImpl: options.spawnImpl, execImpl: options.execImpl, stdout, stderr, timeouts: options.timeouts,
+    mobileBootstrap: options.mobileBootstrap });
 }
 
 module.exports = { main, parseArguments, HELP };

package/lib/diagnostics.js

@@ -200,6 +200,10 @@ async function inspectStartup(options = {}) {
       'Install presence is not integrity verification; use workbite check for the existing integrity check.',
     ],
     guidance: [NO_DELETE, 'workbite open --no-ui starts or reuses backends only; it does not prove that a terminal UI can open.',
+      'doctor/status inspect saved startup records passively. inspection-required means provenance needs review; it is not an authenticated agent admission failure.',
+      'workbite agent status ready means authenticated workspace command admission at that observation, not provider readiness, turn completion or Task completion.',
+      'To check workspace admission, explicitly run workbite agent status in the intended workspace. To inspect an assigned execution seat, refresh stackbite-room context; compare its current generation and runtime evidence.',
+      'Configured provider labels, installed binaries and saved ready records do not verify the running provider or its lifecycle hooks. A Taskless standalone Room is normal; an unassigned seat must wait for assignment.',
       'Inspect the selected record paths and private logs locally with credentials redacted; do not publish raw files.',
       'For native daemon logs, consult log_file and stderr_log_file in the retained native intent locally; untrusted saved paths are not followed here.',
       'For foreign-host records, inspect the recorded host. If ownership remains unknown, retain the state and seek operator review.',

package/lib/install.js

@@ -105,6 +105,11 @@ async function validateBundle(directory, spec) {
   try { bundle = JSON.parse(bundleBytes.toString('utf8')); } catch { fail('bundle.json is not valid JSON'); }
   if (!plainObject(bundle) || !Object.hasOwn(ROSTERS, bundle.schema)) fail('bundle.json identity or executable layout mismatch');
   const executables = expectedExecutables(spec, bundle.schema);
+  // Optional reviewed Windows mobile assembly. Older v1/v2 bundles keep their exact roster.
+  // A mobile entry is accepted only at this fixed path and receives the same full hash/magic proof.
+  if (bundle.schema === BUNDLE_V2 && spec.platform === 'win32' && Object.hasOwn(bundle.executables || {}, 'workbite_mobile')) {
+    executables.workbite_mobile = 'workstack/workbite-mobile.exe';
+  }
   if (bundle.product !== 'WorkBite'
       || bundle.version !== spec.version || bundle.target !== spec.target || !plainObject(bundle.components)
       || !sameKeys(bundle.executables, Object.keys(executables))

package/lib/runtime.js

@@ -605,14 +605,16 @@ function typescriptExecutionEnvironment(layout, bridge) {
 }
 const verifiedPath = value => typeof value === 'string' && path.isAbsolute(value) && !/[\x00-\x1f]/.test(value);
 
-function uiEnvironment(base, { executables, layout, endpoint, uid, backendId, execution = null, bridge = null }) {
+function uiEnvironment(base, { executables, layout, endpoint, uid, backendId, execution = null, bridge = null, mobile = null }) {
   const home = path.dirname(executables.stackbite);
   return withPath({ ...base, WORKSTACK_TRANSPORT: 'native', WORKSTACK_NATIVE_CLIENT: executables.workstack_client,
     WORKSTACK_ENDPOINT: endpoint, WORKSTACK_WORKSPACE_UID: uid, WORKSTACK_STATE_DIR: layout.tuiState,
     WORKSTACK_EXECUTION_DOCK_CONFIG: layout.dock, WORKSTACK_EXECUTION_DOCK_BACKEND_ID: backendId,
     WORKSTACK_DEPLOY_JOURNAL_DIR: layout.journal, WORKSTACK_STACKBITE_EXECUTABLE: executables.stackbite,
     ...(execution ? { WORKSTACK_TUI_STATE: layout.tuiIntent, WORKSTACK_TUI_SETTINGS: layout.tuiSettings } : {}),
-    ...(bridge ? typescriptExecutionEnvironment(layout, bridge) : {}) }, home);
+    ...(bridge ? typescriptExecutionEnvironment(layout, bridge) : {}),
+    ...(mobile ? { WORKBITE_MOBILE_EXECUTABLE: executables.workbite_mobile,
+      WORKBITE_MOBILE_HOST: JSON.stringify(mobile) } : {}) }, home);
 }
 
 function runForeground(command, args, environment, { spawnImpl = spawn, signalSource = process,
@@ -646,7 +648,7 @@ function runForeground(command, args, environment, { spawnImpl = spawn, signalSo
 // commands maps each bundle executable to its argv prefix; tests substitute fixtures.
 async function openSuite({ installed, commands, workspace, init = false, stateRoot, environment = process.env,
   ui = true, frontend = 'typescript', spawnImpl = spawn, execImpl = execFile, platform = process.platform,
-  stdout = process.stdout, stderr = process.stderr, timeouts = {}, bootImpl = bootIdentity }) {
+  stdout = process.stdout, stderr = process.stderr, timeouts = {}, bootImpl = bootIdentity, mobileBootstrap = undefined }) {
   if (!FRONTENDS.includes(frontend)) fail(`--frontend must be one of: ${FRONTENDS.join(', ')}`);
   if (workspace !== undefined) workspace = checkedWorkspace(workspace);
   else if (init) fail('--init needs --workspace ABS naming the new or empty folder');
@@ -738,6 +740,23 @@ async function openSuite({ installed, commands, workspace, init = false, stateRo
   const environmentForUi = uiEnvironment(base, { executables: installed.executables, layout, endpoint: session.engine.endpoint,
     uid: session.uid, backendId: session.backendId, execution: frontend === 'rust' ? execution : null,
     bridge: bridge && ['enabled', 'initialized'].includes(session.executionUi) ? bridge : null });
+  if (frontend === 'typescript' && platform === 'win32' && verifiedPath(installed.executables?.workbite_mobile)) {
+    const mobileRoot = path.join(layout.root, 'mobile');
+    await stage('private phone state', async () => {
+      await safeDirectory(mobileRoot);
+      await protectPrivateDirectories([mobileRoot], { platform, environment: base, execImpl: startupExec,
+        timeout: finiteTimeout(timeouts.privateState, 60000) });
+    });
+    environmentForUi.WORKBITE_MOBILE_EXECUTABLE = installed.executables.workbite_mobile;
+    environmentForUi.WORKBITE_MOBILE_HOST = JSON.stringify({
+      directory: path.join(mobileRoot, workspaceKey(workspace)), executable: installed.executables.workbite_mobile,
+      scope: { host_id: session.backendId, workspace_uid: session.uid },
+      native: { executable: installed.executables.workstack_client, cwd: workspace, endpoint: session.engine.endpoint,
+        workspaceUid: session.uid, deployment: { connection: layout.dock, backendId: session.backendId, journalDir: layout.journal } },
+      // Embedding hosts may supply the private operator invitation at first setup; never a token.
+      ...(mobileBootstrap ? { initialInput: mobileBootstrap } : {}),
+    });
+  }
   // Exactly one foreground child in this terminal (inherited stdio, never detached or a new console).
   // The TypeScript UI gets the v1 environment (keeping its own familiar settings file) plus, when the
   // v2 opt-in is enabled, only the WORKBITE_EXECUTION_* names above.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workbite",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "WorkBite (Work Stack + StackBite) verified native suite installer and launcher",
   "license": "UNLICENSED",
   "engines": {

package/release.json

@@ -1,17 +1,17 @@
 {
-  "launcherVersion": "0.1.13",
+  "launcherVersion": "0.1.15",
   "platforms": {
     "windows-x64": {
-      "asset": "workbite-0.1.13-windows-x64.zip",
-      "bundleSha256": "61886b62c848d3342580b27eb6ca76acac4bd2c608b67684139434893602d7d1",
-      "sha256": "061fb2b08470c9f39afc5d109abb2521e4ba137455aaebd75a7b2b1b8ccc36f5",
-      "size": 97782408,
-      "url": "https://github.com/Shinick-Han/WorkBite-releases/releases/download/v0.1.13/workbite-0.1.13-windows-x64.zip"
+      "asset": "workbite-0.1.15-windows-x64.zip",
+      "bundleSha256": "339663c540f456010a52e47d808528e44e8d5976e278fa8fc8a44b725f9db134",
+      "sha256": "e34c3f3cca30b448cdefa0cb567ffb856c0ca058ff46175fdf8140a432a5262e",
+      "size": 136162431,
+      "url": "https://github.com/Shinick-Han/WorkBite-releases/releases/download/v0.1.15/workbite-0.1.15-windows-x64.zip"
     }
   },
   "product": "WorkBite",
   "repository": "Shinick-Han/WorkBite-releases",
   "schema": "workbite.release.v1",
-  "tag": "v0.1.13",
-  "version": "0.1.13"
+  "tag": "v0.1.15",
+  "version": "0.1.15"
 }