interlatch 0.28.7__tar.gz → 0.28.8__tar.gz

{interlatch-0.28.7 → interlatch-0.28.8}/CHANGELOG.md

@@ -3,6 +3,30 @@
 <!-- Don't add lines here: a pull request puts its line in a new file in changelog.d/ (see changelog.d/README.md),
      and each release moves the files it took into a dated section below. -->
 
+## 0.28.7 (2026-10-21)
+
+- **Feedback:** report a problem or suggest an idea from wherever you use Interlatch: `interlatch feedback` (or
+  `interlatch bug`), **Settings › Feedback** and the **Feedback** link in the dashboard's status bar, or **Interlatch:
+  Send Feedback** in VS Code (extension 0.4.0). Each opens a new GitHub issue, or a discussion in Ideas, with your
+  install's details filled in (versions, system, how it was installed), never your paths, addresses or sessions.
+  Nothing is sent until you post it there ([Command line](docs/cli.md)).
+- **`interlatch status` checks every agent:** it has a line for each coding agent found on this computer (Claude Code,
+  Codex, Copilot, Bob, Antigravity, OpenCode, Cursor and the other MCP clients) saying whether Interlatch's MCP server
+  is in it, and flags one whose command is gone or runs another install, such as an old `chronicle` or a checkout's
+  `.venv`; `interlatch connect <name>` points it back ([Troubleshooting](docs/troubleshooting.md)).
+- **New sessions get whole notes, never a cut-off one:** the knowledge digest a new session receives
+  (`interlatch install --inject-context`) now fits its length limit by leaving out the least useful notes and the
+  oldest sessions whole, and its last line says how many it left out so the agent knows to search for them. It is also
+  checked for secrets once more on its way out ([Configuration](docs/configuration.md#synthesis-export-server-inject-updates)).
+- **Agents can pick up where the last session left off:** the new `resume` MCP tool tells an agent starting in a project
+  what the last session set out to do, how it went and what it left open, what waits on you, and what other agents did
+  and learned since its own previous session there, all from the archive and within a length limit
+  ([MCP server](docs/mcp.md#tools)).
+- **Lessons say when their code has changed:** a lesson now records the files it was learned from (those the session
+  read or changed), and when one of them changes, the SessionStart digest and the MCP search mark it *may be out of
+  date* and name the file, so an agent checks it before relying on it
+  ([When a lesson may be out of date](docs/analysis.md#when-a-lesson-may-be-out-of-date)).
+
 ## 0.28.6 (2026-10-20)
 
 - **Hubs page, tidier:** **Settings › Hubs** has a tab for each hub and one to add a hub. A hub's tab fits on one

{interlatch-0.28.7 → interlatch-0.28.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: interlatch
-Version: 0.28.7
+Version: 0.28.8
 Summary: Shared memory for your coding agents: records every session (Claude Code, Codex, Copilot, Bob, Antigravity, OpenCode) locally and keeps what they learned, each lesson linked to the session it came from.
 Project-URL: Homepage, https://interlatch.com
 Project-URL: Documentation, https://interlatch.com/docs/

interlatch-0.28.8/changelog.d/signin-page-design.md

@@ -0,0 +1,3 @@
+- **A sign-in page that looks like Interlatch:** opening a hub's sign-in or invite link now shows the dashboard's own
+  card, with the person you'll sign in as, a full-width **Sign in as …** button, and the light/dark and language
+  buttons, in place of a bare unstyled page. The page still asks before it signs anyone in.

{interlatch-0.28.7 → interlatch-0.28.8}/src/interlatch/core/i18n/ja.py

@@ -409,10 +409,10 @@ JA: dict[str, str] = {
         "このハブの管理者に新しい招待を頼むか、自分の Interlatch（「設定」›「デバイス」）からハブのダッシュボードを開き直してください。",
     "Open the dashboard": "ダッシュボードを開く",
     "Sign in to this hub": "このハブにサインイン",
-    "Sign in as {who}?": "{who} としてサインインしますか？",
+    "Sign in as {name}": "{name} としてサインイン",
     "Go on only if you opened this link from your own Interlatch or an admin of this hub sent it to you.":
         "このリンクを自分の Interlatch から開いた場合か、このハブの管理者から送られてきた場合だけ続けてください。",
-    "Sign in": "サインイン",
+    "Toggle theme": "テーマを切り替え",
     "open the sign-in link again": "サインインのリンクをもう一度開いてください",
     "bad form": "フォームが正しくありません",
     "no such computer or browser session": "そのコンピューターまたはブラウザーのセッションはありません",

{interlatch-0.28.7 → interlatch-0.28.8}/src/interlatch/interfaces/web/handler.py

@@ -79,6 +79,17 @@ SIGNIN_HELP = ("Ask an admin of this hub for a new invite, or open the hub's das
                "(Settings › Devices).")
 SIGNIN_CHECK = "Go on only if you opened this link from your own Interlatch or an admin of this hub sent it to you."
 TOO_MANY_CODES = "too many wrong codes from this address; try again in {seconds} s"  # people.CodeAttempts
+# The /signin page's policy: the dashboard's own stylesheet, fonts, logo and signin.js, nothing inline, and its form
+# posts only here. It may not be framed: a page that shows it in a frame can't trick a click on Sign in.
+SIGNIN_CSP = ("default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; "
+              "form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
+# line icons, drawn as app.js's icon() draws them
+_ICON = '<svg class="icon{cls}" viewBox="0 0 24 24" aria-hidden="true">{paths}</svg>'
+SUN = _ICON.format(cls=" ic-sun", paths='<circle cx="12" cy="12" r="4"/>' + "".join(
+    f'<path d="{d}"/>' for d in ("M12 2v2", "M12 20v2", "m4.93 4.93 1.41 1.41", "m17.66 17.66 1.41 1.41", "M2 12h2",
+                                 "M20 12h2", "m6.34 17.66-1.41 1.41", "m19.07 4.93-1.41 1.41")))
+MOON = _ICON.format(cls=" ic-moon", paths='<path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9z"/>')
+SHIELD = _ICON.format(cls="", paths='<path d="M12 3l7 3v5c0 4.5-3 8-7 10-4-2-7-5.5-7-10V6z"/><path d="m9 12 2 2 4-4"/>')
 
 
 def make_handler(app: App, port: int):
@@ -280,16 +291,33 @@ def make_handler(app: App, port: int):
             origin = (self.headers.get("Origin") or "").strip().lower()
             return origin not in ("", "null") and urlparse(origin).netloc == self._host()
 
-        def _signin_page(self, status: int, title: str, body: str, retry: int = 0):
-            """The small page /signin answers with: asking before a sign-in, or why one didn't happen."""
+        def _signin_page(self, status: int, title: str, body: str, retry: int = 0, switch_lang: bool = False):
+            """The small page /signin answers with: asking before a sign-in, or why one didn't happen. The dashboard's
+            own sign-in card (app.css), with its theme and language buttons (signin.js), under a policy that lets in
+            the dashboard's own files and nothing inline."""
             import html
+            from urllib.parse import urlencode
 
             title = html.escape(title)
-            page = (f'<!doctype html><html lang="{i18n.lang.get()}"><meta charset="utf-8">'
+            hub = app.cfg.hub_name or self._host()
+            switch = ""
+            if switch_lang:  # the same link in the other language; not on a refusal, where it would try the code again
+                other = "en" if i18n.lang.get() == "ja" else "ja"
+                q = {k: v[-1] for k, v in parse_qs(urlparse(self.path).query).items()} | {"lang": other}
+                switch = (f'<a class="btn small" id="signin-lang" lang="{other}" href="/signin?{html.escape(urlencode(q))}">'
+                          f'{"日本語" if other == "ja" else "English"}</a>')
+            theme = html.escape(tr("Toggle theme"))
+            page = (f'<!doctype html><html lang="{i18n.lang.get()}"><head><meta charset="utf-8">'
                     '<meta name="viewport" content="width=device-width, initial-scale=1">'
                     f'<meta name="color-scheme" content="light dark"><title>{title} · Interlatch</title>'
-                    '<body style="font: 16px/1.5 system-ui, sans-serif; max-width: 36rem; margin: 12vh auto; '
-                    f'padding: 0 16px"><h1 style="font-size: 1.3rem">{title}</h1>{body}</body></html>').encode()
+                    '<link rel="icon" href="/favicon.png" type="image/png"><link rel="stylesheet" href="/app.css">'
+                    '<script src="/signin.js"></script></head><body><main class="signin-screen">'
+                    '<div class="card signin-card"><div class="signin-brand">'
+                    '<img src="/icon.png" width="26" height="26" alt="">Interlatch'
+                    f'{f"<span class=signin-hub>{html.escape(hub)}</span>" if hub else ""}</div>'
+                    f'<h1>{title}</h1>{body}<div class="signin-foot">{switch}'
+                    f'<button class="btn small" id="signin-theme" type="button" aria-label="{theme}" title="{theme}">'
+                    f'{SUN}{MOON}</button></div></div></main></body></html>').encode()
             self.send_response(status)
             self.send_header("Content-Type", "text/html; charset=utf-8")
             self.send_header("Content-Length", str(len(page)))
@@ -298,8 +326,7 @@ def make_handler(app: App, port: int):
                 self.send_header("Retry-After", str(retry))
             self.send_header("X-Content-Type-Options", "nosniff")
             self.send_header("Referrer-Policy", "no-referrer")  # the code is in this page's address
-            self.send_header("Content-Security-Policy",
-                             "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'")
+            self.send_header("Content-Security-Policy", SIGNIN_CSP)
             self.end_headers()
             self.wfile.write(page)
 
@@ -307,8 +334,8 @@ def make_handler(app: App, port: int):
             import html
 
             self._signin_page(429 if wait else status, tr("Could not sign in"),
-                              f"<p>{html.escape(exc.shown())}</p><p>{html.escape(tr(SIGNIN_HELP))}</p>"
-                              f'<p><a href="/">{html.escape(tr("Open the dashboard"))}</a></p>', wait)
+                              f'<p class="signin-note">{html.escape(exc.shown())}</p><p>{html.escape(tr(SIGNIN_HELP))}</p>'
+                              f'<a class="btn primary signin-go" href="/">{html.escape(tr("Open the dashboard"))}</a>', wait)
 
         def _signin_code(self, code: str, take):
             """take(code) for a sign-in, after the wrong-code wait (people.CodeAttempts): its answer, or None once the
@@ -316,7 +343,9 @@ def make_handler(app: App, port: int):
             from ...sharing import people
 
             accept = (self.headers.get("Accept-Language") or "").strip().lower()
-            i18n.lang.set("ja" if accept.startswith("ja") else "en")  # a link opened by hand sends no X-Interlatch-Lang
+            asked = parse_qs(urlparse(self.path).query).get("lang", [""])[-1]  # the page's language button
+            # a link opened by hand sends no X-Interlatch-Lang
+            i18n.lang.set(asked if asked in i18n.LANGS else "ja" if accept.startswith("ja") else "en")
             who = self._client()
             wait = app.code_attempts.wait(who)
             try:
@@ -340,15 +369,16 @@ def make_handler(app: App, port: int):
             person = self._signin_code(code, lambda c: people.code_person(app.conn, c))
             if person is None:
                 return
-            who = person["name"] + (f" ({person['email']})" if person.get("email") else "")
+            name, email = person["name"], person.get("email") or ""
             hidden = "".join(f'<input type="hidden" name="{k}" value="{html.escape(v)}">'
                              for k, v in (("code", code), ("next", page)) if v)
             self._signin_page(200, tr("Sign in to this hub"),
-                              f"<p>{html.escape(tr('Sign in as {who}?', who=who))}</p>"
-                              f"<p>{html.escape(tr(SIGNIN_CHECK))}</p>"
-                              f'<form method="post" action="/signin">{hidden}'
-                              f'<button type="submit" style="font: inherit; padding: 6px 16px">'
-                              f"{html.escape(tr('Sign in'))}</button></form>")
+                              f'<div class="signin-who"><span class="signin-avatar" aria-hidden="true">'
+                              f"{html.escape(name[:1].upper())}</span><div><b>{html.escape(name)}</b>"
+                              f'{f"<span>{html.escape(email)}</span>" if email else ""}</div></div>'
+                              f'<p class="signin-check">{SHIELD}<span>{html.escape(tr(SIGNIN_CHECK))}</span></p>'
+                              f'<form method="post" action="/signin">{hidden}<button class="btn primary signin-go" '
+                              f'type="submit">{html.escape(tr("Sign in as {name}", name=name))}</button></form>', switch_lang=True)
 
         def _signin(self, code: str, page: str | None = None):
             """POST /signin, from the page above or the dashboard's own sign-in form: opens a browser session, on the

{interlatch-0.28.7 → interlatch-0.28.8}/src/interlatch/web/app.css

@@ -2143,6 +2143,18 @@ a.ar-tile-media.empty:hover { background: var(--accent-wash); }
 .signin-form .input { flex: 1; min-width: 0; font-family: var(--mono); letter-spacing: 0.04em; }
 .signin-foot { display: flex; justify-content: flex-end; gap: 6px; margin-top: 14px; padding-top: 12px; border-top: 1px solid var(--grid); }
 .signin-foot .icon { width: 14px; height: 14px; }
+/* the /signin page (handler.py): the same card, asking before a link signs this browser in */
+.signin-hub { margin-left: auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font: 500 11px/1.4 var(--mono); letter-spacing: 0.08em; color: var(--muted); padding: 2px 8px; border: 1px solid var(--border); border-radius: 999px; }
+.signin-who { display: flex; align-items: center; gap: 12px; margin: 16px 0 14px; padding: 12px 14px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface-2); }
+.signin-who > div { display: flex; flex-direction: column; min-width: 0; }
+.signin-who b { font-size: 15px; overflow-wrap: anywhere; }
+.signin-who > div > span { color: var(--muted); font-size: 13px; overflow-wrap: anywhere; }
+.signin-avatar { flex: none; display: grid; place-items: center; width: 38px; height: 38px; border-radius: 50%; background: var(--cta); color: var(--cta-ink); font-weight: 700; font-size: 16px; }
+.signin-check { display: flex; gap: 8px; align-items: flex-start; color: var(--muted); font-size: 13px; }
+.signin-check .icon { flex: none; width: 16px; height: 16px; margin-top: 2px; }
+.signin-go { display: block; width: 100%; padding: 9px 14px; text-align: center; font-size: 14.5px; }
+a.signin-go:hover { text-decoration: none; }
+.signin-card .signin-note + p { margin-bottom: 18px; }
 .pp-table td { vertical-align: top; }
 .pp-table td:first-child { min-width: 170px; }
 .pp-table select { max-width: 150px; }

interlatch-0.28.8/src/interlatch/web/signin.js

@@ -0,0 +1,28 @@
+// The /signin page's one script (handler.py, _signin_page): the theme this browser chose, before the first paint, and
+// the page's theme and language buttons. Its own file, not inline, so the page's policy can allow scripts from 'self' only.
+(function () {
+  var root = document.documentElement;
+  try { var t = localStorage.getItem("interlatch-theme"); if (t) root.dataset.theme = t; } catch (e) {}
+  var dark = function () {
+    return root.dataset.theme ? root.dataset.theme === "dark" : matchMedia("(prefers-color-scheme: dark)").matches;
+  };
+  document.addEventListener("DOMContentLoaded", function () {
+    var btn = document.getElementById("signin-theme");
+    if (btn) {
+      var show = function () { // the sun in the dark, the moon in the light: what a press switches to
+        btn.querySelector(".ic-sun").toggleAttribute("hidden", !dark());
+        btn.querySelector(".ic-moon").toggleAttribute("hidden", dark());
+      };
+      show();
+      btn.addEventListener("click", function () {
+        root.dataset.theme = dark() ? "light" : "dark";
+        try { localStorage.setItem("interlatch-theme", root.dataset.theme); } catch (e) {}
+        show();
+      });
+    }
+    var lang = document.getElementById("signin-lang");
+    if (lang) lang.addEventListener("click", function () { // the dashboard opens in it too, once signed in
+      try { localStorage.setItem("interlatch-lang", lang.getAttribute("lang")); } catch (e) {}
+    });
+  });
+})();

{interlatch-0.28.7 → interlatch-0.28.8}/tests/test_i18n_web.py

@@ -220,7 +220,7 @@ NODE = shutil.which("node")
 
 
 @pytest.mark.skipif(not NODE, reason="node is not installed")
-@pytest.mark.parametrize("name", ["app.js", "i18n.js", "ja.js", "sprites.js", "scene.js", "innerlatch.js", "adventure.js", "field.js", "battle.js"])
+@pytest.mark.parametrize("name", ["app.js", "i18n.js", "ja.js", "sprites.js", "scene.js", "innerlatch.js", "adventure.js", "field.js", "battle.js", "signin.js"])
 def test_scripts_parse(name):
     proc = subprocess.run([NODE, "--check", str(WEB / name)], capture_output=True, text=True)
     assert proc.returncode == 0, proc.stderr

{interlatch-0.28.7 → interlatch-0.28.8}/tests/test_mcp_resume.py

@@ -100,6 +100,10 @@ def test_an_empty_project_says_so(synced):
 def test_the_mcp_tool_knows_the_client_from_initialize(synced):
     conn = synced["conn"]
     _story(conn)
+    # the server reads the real clock: the running session moved just now, not at NOW
+    conn.execute("UPDATE sessions SET ended_at = ? WHERE id = 'claude-now'",
+                 (datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.000Z"),))
+    conn.commit()
     msgs = [{"jsonrpc": "2.0", "id": 1, "method": "initialize",
              "params": {"protocolVersion": "2025-06-18", "clientInfo": {"name": "claude-code", "version": "2"}}},
             {"jsonrpc": "2.0", "id": 2, "method": "tools/list"},

{interlatch-0.28.7 → interlatch-0.28.8}/tests/test_people_web.py

@@ -115,6 +115,7 @@ def test_a_hub_without_people_answers_as_before(hubweb):
     assert _call(url, "/api/learning/interests") == (200, {"interests": []})
     status, headers, page = _raw(url, "/signin?code=AAAA-BBBB-CCCC")
     assert status == 400 and b"known on this hub" in page and headers["Content-Type"].startswith("text/html")
+    assert b'id="signin-lang"' not in page  # switching language here would try the wrong code again
 
 
 def test_who_may_look_and_who_may_change(team):
@@ -204,13 +205,17 @@ def test_a_link_alone_signs_nobody_in(team):
     url, conn = team["url"], team["conn"]
     code = people.invite(conn, team["vic"]["id"])
     status, headers, page = _raw(url, f"/signin?code={code}&next={quote('/project?path=%2Fx', safe='')}", headers=REMOTE)
-    assert status == 200 and "Set-Cookie" not in headers and b"Sign in as Vic (vic@example.com)?" in page
+    assert status == 200 and "Set-Cookie" not in headers and b"<b>Vic</b><span>vic@example.com</span>" in page
+    assert b">Sign in as Vic</button>" in page
     assert f'name="code" value="{code}"'.encode() in page and b'name="next" value="/project?path=%2Fx"' in page
-    csp = headers["Content-Security-Policy"]
-    assert "form-action 'self'" in csp and "frame-ancestors 'none'" in csp and "script-src" not in csp
+    csp = dict(d.strip().split(" ", 1) for d in headers["Content-Security-Policy"].split(";"))
+    assert csp["form-action"] == csp["script-src"] == csp["style-src"] == "'self'" and csp["frame-ancestors"] == "'none'"
+    assert b"<script>" not in page and b" style=" not in page  # the page's own files only: nothing inline
     assert people.peek_invite(conn, code)  # asking used nothing up
     page = _raw(url, f"/signin?code={code}", headers={**REMOTE, "Accept-Language": "ja"})[2]
-    assert "Vic (vic@example.com) としてサインインしますか？".encode() in page
+    assert "Vic としてサインイン</button>".encode() in page and b'id="signin-lang" lang="en"' in page
+    page = _raw(url, f"/signin?code={code}&lang=ja", headers=REMOTE)[2]  # the page's language button
+    assert "Vic としてサインイン</button>".encode() in page and f"code={code}&amp;lang=en".encode() in page
 
     for other in ({}, {"Origin": "https://evil.example"}, {"Origin": "null"}, {"Origin": "http://127.0.0.1.evil.example"},
                   {"Sec-Fetch-Site": "cross-site", "Origin": "https://evil.example"}, {"Sec-Fetch-Site": "same-site"}):

interlatch-0.28.7/changelog.d/doctor-agents.md

@@ -1,4 +0,0 @@
-- **`interlatch status` checks every agent:** it has a line for each coding agent found on this computer (Claude Code,
-  Codex, Copilot, Bob, Antigravity, OpenCode, Cursor and the other MCP clients) saying whether Interlatch's MCP server
-  is in it, and flags one whose command is gone or runs another install, such as an old `chronicle` or a checkout's
-  `.venv`; `interlatch connect <name>` points it back ([Troubleshooting](docs/troubleshooting.md)).

interlatch-0.28.7/changelog.d/feedback.md

@@ -1,5 +0,0 @@
-- **Feedback:** report a problem or suggest an idea from wherever you use Interlatch: `interlatch feedback` (or
-  `interlatch bug`), **Settings › Feedback** and the **Feedback** link in the dashboard's status bar, or **Interlatch:
-  Send Feedback** in VS Code (extension 0.4.0). Each opens a new GitHub issue, or a discussion in Ideas, with your
-  install's details filled in (versions, system, how it was installed), never your paths, addresses or sessions.
-  Nothing is sent until you post it there ([Command line](docs/cli.md)).

interlatch-0.28.7/changelog.d/knowledge-freshness.md

@@ -1,4 +0,0 @@
-- **Lessons say when their code has changed:** a lesson now records the files it was learned from (those the session
-  read or changed), and when one of them changes, the SessionStart digest and the MCP search mark it *may be out of
-  date* and name the file, so an agent checks it before relying on it
-  ([When a lesson may be out of date](docs/analysis.md#when-a-lesson-may-be-out-of-date)).

interlatch-0.28.7/changelog.d/mcp-resume.md

@@ -1,4 +0,0 @@
-- **Agents can pick up where the last session left off:** the new `resume` MCP tool tells an agent starting in a project
-  what the last session set out to do, how it went and what it left open, what waits on you, and what other agents did
-  and learned since its own previous session there, all from the archive and within a length limit
-  ([MCP server](docs/mcp.md#tools)).

interlatch-0.28.7/changelog.d/session-start-budget.md

@@ -1,4 +0,0 @@
-- **New sessions get whole notes, never a cut-off one:** the knowledge digest a new session receives
-  (`interlatch install --inject-context`) now fits its length limit by leaving out the least useful notes and the
-  oldest sessions whole, and its last line says how many it left out so the agent knows to search for them. It is also
-  checked for secrets once more on its way out ([Configuration](docs/configuration.md#synthesis-export-server-inject-updates)).