rexdeck 0.1.0__tar.gz

rexdeck-0.1.0/.gitignore

@@ -0,0 +1,7 @@
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/

rexdeck-0.1.0/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 0.1.0 — prepared, unpublished
+
+- Add manual-only selected dependency validation: setup/status never install; enable reuses qualified preinstalled Yazi/lazygit (and requires Git for Git integration), or returns actionable nonzero manual-install/version-check/rerun guidance without registration. RexDeck never runs Homebrew or installs, upgrades, removes or supervises upstream package transactions. Preserve qualified executable metadata identity, frozen-target checks, siblings and upstream settings; owner-run Homebrew is optional only when its selected version qualifies and the owner accepts its effects, otherwise use the qualified upstream release.
+- Accept both upstream and Homebrew's multiline Yazi version reports. Ignore empty/relative executable-search paths during qualification and lifecycle binding. Restrict the source distribution to product source, tests, metadata, and public documentation; globally ignored local evidence is not packaged.
+- Prepare Python 3.12+ metadata, packaged MIT license and project URLs. Document macOS arm64/Rex API 10 baseline, upstream unbundled licenses, installed-package checks and private-versus-owner visual proof limits.
+- Retain exact CI-built 0.1.0 wheel/sdist for owner-reviewed release. Manual Trusted Publishing requires owner-only protected environment approval bound to exact commit, immutable artifact ID, file hashes and evidence; no push/PR/tag publication or release-time rebuild. Publication and public-index native-use proof remain gated, not claimed complete.
+
+- Add independently selectable local Git through unmodified lazygit, preserving the invoking repository/worktree and exact return origin. Reject inherited Git repository/discovery overrides rather than silently redirecting work. Reuse native hosting and lifecycle ownership for Files/Git; serialize shared configuration and data-root changes, preserve siblings/open panes, and restore exact config bytes in either disable order without changing existing settings or Files receipt schemas.
+- Resolve Git validation through absolute PATH directories and preserve discovery errors. Retain healthy integration status when a sibling receipt is invalid; validate only deployment/sibling artifacts needed by the selected operation. Clarify cleanup of applied-but-disabled integrations before package removal.
+- Pin applied Lua/Python launch behavior together with isolated Python imports; avoid DNS for local cwd URIs, report symlink loops, and retain acknowledgement on interrupted focus restoration. Freeze socket/config selection without lexical symlink retargeting, verify the running server's config before writes, preserve saved approval across default-server changes, reject redirected app roots and oversized planned writes before mutation, preserve later installations on repeated disable, and recover owned changes on SIGTERM/SIGHUP while collecting rollback conflicts.
+
+- Deploy Files' generated Lua module under the setup-frozen `$XDG_DATA_HOME/rexdeck/plugins/files` app data root, leaving only the tracked-require loader in Rex config. Keep package, preferences, and receipt/lock roles separate; use settings v2 and receipt v3, refusing old/foreign formats without automatic adoption. Preserve exact native source identity for relative or absolute paths, serialize shared-root mutations across workspaces, and refuse modules appearing during ownership checks.
+- Package the native Files Lua action and Python launcher so installed RexDeck works outside a checkout. Replace manual workspace flags and shell wrappers with one-time `setup`, `enable files`, `status`, and `disable files`; persist the explicitly approved Rex target and derive Files state paths automatically.
+- Remove unused internal stop lifecycle code and stale lifecycle documentation; public Files usage remains setup/enable/status/disable. Require verified ownership and rollback safety before explicitly migrating existing state or removing obsolete owned artifacts; no automatic migration command is added.
+- Replace the custom Files browser with a native **RexDeck Files** action launching unmodified Yazi in the invoking terminal's captured working directory, preserving its normal UI, configuration, navigation, previews, and file operations.
+- Remove Files' LazyRex hub/SDK dependency, renderer/navigation patches, Go runtime preparation, lock/build receipts, and obsolete browser/preview commands and tests. Yazi remains write-capable; the launch directory is not a root jail.
+- Return Yazi quit to the exact captured terminal through the explicit Rex endpoint, with visible launch/exit/focus errors and no replacement-pane adoption. Independent Yazi panes survive disable.
+- Preserve tracked native registration, source integrity, conservative conflicts, atomic rollback, config symlink/mode preservation, and cancellation diagnostics. Package location is update provenance rather than ownership identity, so re-enabling refreshes an unchanged owned integration after reinstall. Refuse legacy receipts; old LazyRex installations require explicit prior-code cleanup.
+- Make LazyRex optional for future integrations that actually need an existing capability; defer the broader collection. No hooks, fonts, autostart, automatic Rex/manager installation, or live migration command is included.

rexdeck-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tom Mathews
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

rexdeck-0.1.0/PKG-INFO

@@ -0,0 +1,127 @@
+Metadata-Version: 2.5
+Name: rexdeck
+Version: 0.1.0
+Summary: Native Rex integrations for independently selectable existing tools
+Project-URL: Homepage, https://github.com/Mathews-Tom/RexDeck
+Project-URL: Repository, https://github.com/Mathews-Tom/RexDeck
+Project-URL: Issues, https://github.com/Mathews-Tom/RexDeck/issues
+Project-URL: Changelog, https://github.com/Mathews-Tom/RexDeck/blob/main/CHANGELOG.md
+Author: Tom Mathews
+License-Expression: MIT
+License-File: LICENSE
+Keywords: lazygit,rex,terminal,yazi
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+
+# RexDeck
+
+A collection of independently selectable plugins and extensions that bring existing tools into your own Rex application.
+
+Files and local Git bring unmodified Yazi and lazygit into native Rex terminals. GitHub workflows, rich viewers, agent/subagent views, and task-provider integrations remain planned. Select the tools you need without installing an unrelated default suite.
+
+## Plugins and extensions
+
+| Integration | Purpose | Status |
+| --- | --- | --- |
+| [Files](plugins/files/README.md) | Browse, preview, and manage files using unmodified Yazi in a native Rex terminal | Available |
+| [Git](plugins/git/README.md) | Inspect, stage, and commit in the invoking repository/worktree using unmodified lazygit | Available |
+| GitHub | Pull-request/issue workflows with explicit repository/host/account | Planned |
+| Rich viewers | Rendered Markdown, PDF, and image viewing | Planned |
+| Agents and subagents | Attention, observed state, and navigation to agent work | Planned |
+| Tasks | Independently selectable Linear and ClickUp workflows | Planned |
+
+Planned integrations are not implemented or installable yet. RexDeck is not published on PyPI; install the current source package as described below.
+
+## Getting started
+
+The qualified platform is **macOS arm64, Rex API revision 10 baseline, and Python 3.12+**. Revision 10 is not an exact-version compatibility gate. Rex must already be installed and running; RexDeck does not bootstrap Rex, Homebrew, Python, or uv. Other platforms, remote hosts, and multi-device operation are not qualified.
+
+Until the approved PyPI release is published, install the pinned public source baseline (Files and Git; before S1 dependency onboarding):
+
+```sh
+uv tool install 'git+https://github.com/Mathews-Tom/RexDeck.git@d7f934e31d2becf53bc435ac931fa6e1b984bbd0'
+```
+
+For the S1 candidate, use its reviewed checkout and record the exact commit:
+
+```sh
+uv tool install .
+rexdeck setup
+rexdeck enable files
+rexdeck status
+```
+
+The installed command works from any directory; the package includes the shared native action and Python launcher for Files and Git. No shell wrapper, `RD_*` variables, or developer checkout is needed at runtime. Ensure the tool executable directory reported by `uv` is on `PATH`.
+
+`setup` remembers the selected Rex configuration and running server without changing Rex configuration. Interactive setup asks for approval before saving a personal-server target. Use `enable files` or `enable git` independently, `status [files|git]` to inspect ownership/registration, and `disable <id>` to remove only that integration. Unqualified `status` reports both integrations, retaining healthy results alongside an integration-specific fault if its sibling cannot be inspected. See the plugin READMEs for prerequisites, capabilities, updates, and removal.
+
+The uv-managed package remains the runtime source. Setup freezes the app data root from `$XDG_DATA_HOME/rexdeck` (default `~/.local/share/rexdeck`); each integration deploys `plugins/<id>/rexdeck_<id>.lua` there with an independently owned tracked loader in Rex's `init.lua`. Approved preferences remain in `$XDG_CONFIG_HOME/rexdeck/config.json`. Files receipt/lock paths remain in the saved `$XDG_STATE_HOME/rexdeck/files` workspace; Git uses its `git/` subdirectory. Later `XDG_DATA_HOME` changes do not retarget the saved installation. Run `disable` for every applied integration before uninstalling RexDeck or deliberately resetting a saved target, including integrations reported as disabled after a failed enable.
+
+### Selected dependencies
+
+`setup` and `status` never install packages. `enable files` validates preinstalled Yazi; `enable git` validates preinstalled Git/lazygit. Qualified versions are **Yazi 26.9.1, lazygit 0.66.2 or 0.66.3**. Missing or unqualified selected tools produce actionable nonzero manual-install/version-check/rerun guidance without registration or installation prompts. RexDeck never installs, upgrades, downloads, cancels package transactions, or removes upstream tools, and never probes or executes Homebrew.
+
+Executable discovery ignores empty and relative `PATH` entries. Absolute entries, including checkout directories and symlinks to them, remain eligible for version probes and lifecycle lookup. Put only trusted tools in absolute `PATH` directories. RexDeck captures followed-target device/inode/mode/size/nanosecond timestamps/owner before the version probe and rechecks that identity afterward and under its operation locks immediately before applying or enabling an integration. Replacement or modification requires rerunning enable. This is metadata-based detection, not pinned execution or protection against an executable changed after the final check.
+
+Install dependencies yourself using qualified upstream releases: [Yazi 26.9.1](https://github.com/sxyazi/yazi/releases/tag/v26.9.1), [lazygit 0.66.2](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.2) or [0.66.3](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.3). Follow [Yazi installation](https://yazi-rs.github.io/docs/installation/) or [lazygit installation](https://github.com/jesseduffield/lazygit#installation); Git must also already be installed for Git integration.
+
+If you choose Homebrew, first run `brew info yazi` or `brew info lazygit` yourself and inspect the selected version and dependency/source-build/upgrade effects. **Skip Homebrew if its selected version is not qualified**; use the qualified upstream release instead. Only if the version qualifies and you accept the package effects, run the selected `brew install yazi` or `brew install lazygit` yourself. RexDeck does not qualify a Homebrew version, prefix or transaction; all package effects remain owner-controlled.
+
+Check `yazi --version` or `lazygit --version` (and `git --version` for Git), then rerun `rexdeck enable files` or `rexdeck enable git`. The pinned pre-S1 source baseline above requires manual dependency provisioning too, but does not contain S1's selected-tool qualification/guidance behavior.
+
+Rex, Yazi, lazygit, Git, Homebrew, Python and uv remain externally managed prerequisites. No install-all, sudo, silent upgrade, tool configuration change, or upstream package removal is performed. `disable` and Python package uninstall leave upstream tools installed.
+
+## Design principles
+
+- **Reuse tools, do not rebuild them.** Preserve their normal interfaces, configuration, authentication, and capabilities.
+- **Prefer native Rex integration.** Use native actions and panes where sufficient. LazyRex is optional only where a particular integration needs an existing capability; it is not a collection-wide dependency.
+- **Keep features independently selectable.** Install only the dependencies needed by the chosen integration; no implicit default suite, hooks, or autostart.
+- **Preserve user context and ownership.** Pass explicit launch context and structured arguments, keep unrelated work intact, and make removal reversible.
+- **Disclose capabilities accurately.** External tools run as your OS account and can be write-capable; they are not sandboxed or automatically read-only.
+
+## Development
+
+Install LuaJIT before running the suite: native Lua behavior tests require `lua` or `luajit` and otherwise skip. On macOS:
+
+```sh
+brew install luajit
+uv sync --locked
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy --strict
+uv run pytest
+```
+
+Plugin-specific syntax checks and real interaction verification belong in each plugin's README. Keep plugin documentation under `plugins/<name>/README.md` and packaged runtime assets under `src/rexdeck/plugins/<name>/`. Link available integrations from the table above. Do not create empty plugin folders for planned features.
+
+## Release preparation and owner gate
+
+Version **0.1.0 is prepared, not evidence of publication**. Do not use a PyPI install command until the release's public registry files and hashes have been verified. A PyPI name lookup returning 404 does not establish ownership, name eligibility, or publishing access.
+
+The manual [`publish.yml`](.github/workflows/publish.yml) workflow supports [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) using [uv](https://docs.astral.sh/uv/guides/package/#publishing-your-package). No ordinary push, PR, or tag publishes anything; no release-time rebuild occurs.
+
+Before dispatch, the owner must configure a PyPI project or pending publisher for `rexdeck`: GitHub owner `Mathews-Tom`, repository `RexDeck`, workflow `publish.yml`, environment `pypi`. Configure that GitHub environment with `Mathews-Tom` as its **sole required reviewer** and restrict deployment to `main`; GitHub permits any listed reviewer to approve, so additional reviewers do not enforce owner approval. Leave self-review prevention disabled for owner-dispatched runs so the sole owner can approve an assistant-dispatched run under the owner's GitHub identity. These account/environment changes require owner participation and are not performed by setup or this repository. Missing protection or publisher access holds publication.
+
+The S1 publication boundary assumes this remains a personal-account repository with Mathews-Tom as its sole administrator. Owner-controlled bypass/configuration is trusted; transfer to an organization requires re-evaluating that gate.
+
+1. Merge only the reviewed candidate. A successful **push on main** `checks.yml` run builds wheel/sdist once and retains the exact pair as `rexdeck-0.1.0`; download and inspect them, record both SHA-256 hashes, immutable artifact ID, full commit SHA, run URL, and runtime/security/review evidence. Artifacts expire; a rebuild requires fresh hashes and approval.
+2. Obtain explicit owner approval naming that exact commit, artifact ID, both filenames/hashes, and reviewed evidence. Any changed input requires renewed approval. After this approval only, create/verify the annotated `v0.1.0` tag and GitHub Release at that commit, attaching the same files; never rebuild for a tag.
+3. Dispatch `publish.yml` **from main at that approved commit**, entering the exact SHA, artifact ID, hashes and approval-evidence URL. The protected-environment reviewer must compare the dispatch inputs/run summary against the approval before approving the deployment. The workflow verifies repository/run provenance, tag target and hashes, then publishes only `approved/rexdeck-0.1.0.tar.gz` and `approved/rexdeck-0.1.0-py3-none-any.whl` with `uv publish --trusted-publishing always` (no token secret or broad `dist/*` upload).
+4. Verify [PyPI JSON](https://pypi.org/pypi/rexdeck/0.1.0/json) exposes both approved hashes. Then run an isolated no-cache public-index install, allowing index propagation, and repeat actual private Rex use/quit/refresh/disable. Only then document `uv tool install 'rexdeck==0.1.0'` as available:
+
+   ```sh
+   uv --no-cache run --isolated --no-project --index https://pypi.org/simple \
+     --with rexdeck==0.1.0 rexdeck --help
+   ```
+
+CI and private endpoint/TUI captures do not prove owner-app palette, glyph, or desktop visual approval. Successful package installation does not prove native interaction; successful local builds do not prove registry publication. Keep those evidence claims separate.
+
+## License
+
+RexDeck is [MIT licensed](LICENSE), included in wheel/sdist metadata. External executables are **not bundled**: [Yazi is MIT](https://github.com/sxyazi/yazi/blob/main/LICENSE) and [lazygit is MIT](https://github.com/jesseduffield/lazygit/blob/master/LICENSE), retaining upstream notices and terms. Git retains its own upstream license. Rex is an externally installed, separately licensed application prerequisite; RexDeck's MIT license does not grant rights to Rex or redistribute it.

rexdeck-0.1.0/README.md

@@ -0,0 +1,106 @@
+# RexDeck
+
+A collection of independently selectable plugins and extensions that bring existing tools into your own Rex application.
+
+Files and local Git bring unmodified Yazi and lazygit into native Rex terminals. GitHub workflows, rich viewers, agent/subagent views, and task-provider integrations remain planned. Select the tools you need without installing an unrelated default suite.
+
+## Plugins and extensions
+
+| Integration | Purpose | Status |
+| --- | --- | --- |
+| [Files](plugins/files/README.md) | Browse, preview, and manage files using unmodified Yazi in a native Rex terminal | Available |
+| [Git](plugins/git/README.md) | Inspect, stage, and commit in the invoking repository/worktree using unmodified lazygit | Available |
+| GitHub | Pull-request/issue workflows with explicit repository/host/account | Planned |
+| Rich viewers | Rendered Markdown, PDF, and image viewing | Planned |
+| Agents and subagents | Attention, observed state, and navigation to agent work | Planned |
+| Tasks | Independently selectable Linear and ClickUp workflows | Planned |
+
+Planned integrations are not implemented or installable yet. RexDeck is not published on PyPI; install the current source package as described below.
+
+## Getting started
+
+The qualified platform is **macOS arm64, Rex API revision 10 baseline, and Python 3.12+**. Revision 10 is not an exact-version compatibility gate. Rex must already be installed and running; RexDeck does not bootstrap Rex, Homebrew, Python, or uv. Other platforms, remote hosts, and multi-device operation are not qualified.
+
+Until the approved PyPI release is published, install the pinned public source baseline (Files and Git; before S1 dependency onboarding):
+
+```sh
+uv tool install 'git+https://github.com/Mathews-Tom/RexDeck.git@d7f934e31d2becf53bc435ac931fa6e1b984bbd0'
+```
+
+For the S1 candidate, use its reviewed checkout and record the exact commit:
+
+```sh
+uv tool install .
+rexdeck setup
+rexdeck enable files
+rexdeck status
+```
+
+The installed command works from any directory; the package includes the shared native action and Python launcher for Files and Git. No shell wrapper, `RD_*` variables, or developer checkout is needed at runtime. Ensure the tool executable directory reported by `uv` is on `PATH`.
+
+`setup` remembers the selected Rex configuration and running server without changing Rex configuration. Interactive setup asks for approval before saving a personal-server target. Use `enable files` or `enable git` independently, `status [files|git]` to inspect ownership/registration, and `disable <id>` to remove only that integration. Unqualified `status` reports both integrations, retaining healthy results alongside an integration-specific fault if its sibling cannot be inspected. See the plugin READMEs for prerequisites, capabilities, updates, and removal.
+
+The uv-managed package remains the runtime source. Setup freezes the app data root from `$XDG_DATA_HOME/rexdeck` (default `~/.local/share/rexdeck`); each integration deploys `plugins/<id>/rexdeck_<id>.lua` there with an independently owned tracked loader in Rex's `init.lua`. Approved preferences remain in `$XDG_CONFIG_HOME/rexdeck/config.json`. Files receipt/lock paths remain in the saved `$XDG_STATE_HOME/rexdeck/files` workspace; Git uses its `git/` subdirectory. Later `XDG_DATA_HOME` changes do not retarget the saved installation. Run `disable` for every applied integration before uninstalling RexDeck or deliberately resetting a saved target, including integrations reported as disabled after a failed enable.
+
+### Selected dependencies
+
+`setup` and `status` never install packages. `enable files` validates preinstalled Yazi; `enable git` validates preinstalled Git/lazygit. Qualified versions are **Yazi 26.9.1, lazygit 0.66.2 or 0.66.3**. Missing or unqualified selected tools produce actionable nonzero manual-install/version-check/rerun guidance without registration or installation prompts. RexDeck never installs, upgrades, downloads, cancels package transactions, or removes upstream tools, and never probes or executes Homebrew.
+
+Executable discovery ignores empty and relative `PATH` entries. Absolute entries, including checkout directories and symlinks to them, remain eligible for version probes and lifecycle lookup. Put only trusted tools in absolute `PATH` directories. RexDeck captures followed-target device/inode/mode/size/nanosecond timestamps/owner before the version probe and rechecks that identity afterward and under its operation locks immediately before applying or enabling an integration. Replacement or modification requires rerunning enable. This is metadata-based detection, not pinned execution or protection against an executable changed after the final check.
+
+Install dependencies yourself using qualified upstream releases: [Yazi 26.9.1](https://github.com/sxyazi/yazi/releases/tag/v26.9.1), [lazygit 0.66.2](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.2) or [0.66.3](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.3). Follow [Yazi installation](https://yazi-rs.github.io/docs/installation/) or [lazygit installation](https://github.com/jesseduffield/lazygit#installation); Git must also already be installed for Git integration.
+
+If you choose Homebrew, first run `brew info yazi` or `brew info lazygit` yourself and inspect the selected version and dependency/source-build/upgrade effects. **Skip Homebrew if its selected version is not qualified**; use the qualified upstream release instead. Only if the version qualifies and you accept the package effects, run the selected `brew install yazi` or `brew install lazygit` yourself. RexDeck does not qualify a Homebrew version, prefix or transaction; all package effects remain owner-controlled.
+
+Check `yazi --version` or `lazygit --version` (and `git --version` for Git), then rerun `rexdeck enable files` or `rexdeck enable git`. The pinned pre-S1 source baseline above requires manual dependency provisioning too, but does not contain S1's selected-tool qualification/guidance behavior.
+
+Rex, Yazi, lazygit, Git, Homebrew, Python and uv remain externally managed prerequisites. No install-all, sudo, silent upgrade, tool configuration change, or upstream package removal is performed. `disable` and Python package uninstall leave upstream tools installed.
+
+## Design principles
+
+- **Reuse tools, do not rebuild them.** Preserve their normal interfaces, configuration, authentication, and capabilities.
+- **Prefer native Rex integration.** Use native actions and panes where sufficient. LazyRex is optional only where a particular integration needs an existing capability; it is not a collection-wide dependency.
+- **Keep features independently selectable.** Install only the dependencies needed by the chosen integration; no implicit default suite, hooks, or autostart.
+- **Preserve user context and ownership.** Pass explicit launch context and structured arguments, keep unrelated work intact, and make removal reversible.
+- **Disclose capabilities accurately.** External tools run as your OS account and can be write-capable; they are not sandboxed or automatically read-only.
+
+## Development
+
+Install LuaJIT before running the suite: native Lua behavior tests require `lua` or `luajit` and otherwise skip. On macOS:
+
+```sh
+brew install luajit
+uv sync --locked
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy --strict
+uv run pytest
+```
+
+Plugin-specific syntax checks and real interaction verification belong in each plugin's README. Keep plugin documentation under `plugins/<name>/README.md` and packaged runtime assets under `src/rexdeck/plugins/<name>/`. Link available integrations from the table above. Do not create empty plugin folders for planned features.
+
+## Release preparation and owner gate
+
+Version **0.1.0 is prepared, not evidence of publication**. Do not use a PyPI install command until the release's public registry files and hashes have been verified. A PyPI name lookup returning 404 does not establish ownership, name eligibility, or publishing access.
+
+The manual [`publish.yml`](.github/workflows/publish.yml) workflow supports [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) using [uv](https://docs.astral.sh/uv/guides/package/#publishing-your-package). No ordinary push, PR, or tag publishes anything; no release-time rebuild occurs.
+
+Before dispatch, the owner must configure a PyPI project or pending publisher for `rexdeck`: GitHub owner `Mathews-Tom`, repository `RexDeck`, workflow `publish.yml`, environment `pypi`. Configure that GitHub environment with `Mathews-Tom` as its **sole required reviewer** and restrict deployment to `main`; GitHub permits any listed reviewer to approve, so additional reviewers do not enforce owner approval. Leave self-review prevention disabled for owner-dispatched runs so the sole owner can approve an assistant-dispatched run under the owner's GitHub identity. These account/environment changes require owner participation and are not performed by setup or this repository. Missing protection or publisher access holds publication.
+
+The S1 publication boundary assumes this remains a personal-account repository with Mathews-Tom as its sole administrator. Owner-controlled bypass/configuration is trusted; transfer to an organization requires re-evaluating that gate.
+
+1. Merge only the reviewed candidate. A successful **push on main** `checks.yml` run builds wheel/sdist once and retains the exact pair as `rexdeck-0.1.0`; download and inspect them, record both SHA-256 hashes, immutable artifact ID, full commit SHA, run URL, and runtime/security/review evidence. Artifacts expire; a rebuild requires fresh hashes and approval.
+2. Obtain explicit owner approval naming that exact commit, artifact ID, both filenames/hashes, and reviewed evidence. Any changed input requires renewed approval. After this approval only, create/verify the annotated `v0.1.0` tag and GitHub Release at that commit, attaching the same files; never rebuild for a tag.
+3. Dispatch `publish.yml` **from main at that approved commit**, entering the exact SHA, artifact ID, hashes and approval-evidence URL. The protected-environment reviewer must compare the dispatch inputs/run summary against the approval before approving the deployment. The workflow verifies repository/run provenance, tag target and hashes, then publishes only `approved/rexdeck-0.1.0.tar.gz` and `approved/rexdeck-0.1.0-py3-none-any.whl` with `uv publish --trusted-publishing always` (no token secret or broad `dist/*` upload).
+4. Verify [PyPI JSON](https://pypi.org/pypi/rexdeck/0.1.0/json) exposes both approved hashes. Then run an isolated no-cache public-index install, allowing index propagation, and repeat actual private Rex use/quit/refresh/disable. Only then document `uv tool install 'rexdeck==0.1.0'` as available:
+
+   ```sh
+   uv --no-cache run --isolated --no-project --index https://pypi.org/simple \
+     --with rexdeck==0.1.0 rexdeck --help
+   ```
+
+CI and private endpoint/TUI captures do not prove owner-app palette, glyph, or desktop visual approval. Successful package installation does not prove native interaction; successful local builds do not prove registry publication. Keep those evidence claims separate.
+
+## License
+
+RexDeck is [MIT licensed](LICENSE), included in wheel/sdist metadata. External executables are **not bundled**: [Yazi is MIT](https://github.com/sxyazi/yazi/blob/main/LICENSE) and [lazygit is MIT](https://github.com/jesseduffield/lazygit/blob/master/LICENSE), retaining upstream notices and terms. Git retains its own upstream license. Rex is an externally installed, separately licensed application prerequisite; RexDeck's MIT license does not grant rights to Rex or redistribute it.

rexdeck-0.1.0/plugins/files/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tom Mathews
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

rexdeck-0.1.0/plugins/files/README.md

@@ -0,0 +1,113 @@
+# Files
+
+Launch unmodified [Yazi](https://yazi-rs.github.io/) from Rex's native palette in the invoking terminal's working directory. Files requires no LazyRex hub, SDK, renderer patch, Go build, or background service.
+
+[Back to RexDeck](../../README.md)
+
+## Requirements
+
+- macOS arm64 and an existing Rex CLI/server; API revision 10 is the established baseline, not an exact-version compatibility gate.
+- Python 3.12+, `uv`, and Yazi on `PATH` at qualified version **26.9.1**. Other installed versions require manual resolution, not an implicit upgrade.
+- Terminal/font support required by your Yazi configuration. RexDeck does not install fonts or change tool settings.
+
+Other platforms, remote hosts, and multi-device use are not qualified. RexDeck is not published on PyPI; install from the source checkout.
+
+## Install and set up once
+
+From the RexDeck checkout:
+
+```sh
+uv tool install .
+```
+
+Ensure the tool executable directory reported by `uv` is on `PATH`. The installed package includes the Files action and launcher; subsequent commands work from any directory and do not require the checkout.
+
+With your Rex application already running:
+
+```sh
+rexdeck setup
+rexdeck enable files
+rexdeck status
+```
+
+`setup` discovers the current Rex endpoint and uses `REX_CONFIG`, or the standard `$XDG_CONFIG_HOME/rex/init.lua` / `~/.config/rex/init.lua` configuration. It displays the target and requests approval before remembering a personal-server selection. It does not install an action, change Rex configuration, or start a missing server. `enable files` performs the owned installation and enables the native action; no separate apply/start commands or shell wrapper are needed.
+
+Setup/status never install tools. `enable files` validates preinstalled Yazi **26.9.1**, reuses its qualified executable and revalidates metadata identity and the saved target before registration. Missing or unqualified Yazi returns actionable nonzero manual-install/version-check/rerun guidance without a prompt or partial registration. RexDeck never installs, upgrades or removes Yazi, or probes/executes Homebrew.
+
+Install [Yazi 26.9.1](https://github.com/sxyazi/yazi/releases/tag/v26.9.1) yourself following [upstream installation](https://yazi-rs.github.io/docs/installation/). If choosing Homebrew, inspect `brew info yazi` yourself first; skip Homebrew if its selected version is not 26.9.1 and use that upstream release instead. Only run `brew install yazi` yourself if the selected version qualifies and you accept its dependency/source-build/upgrade effects. Check `yazi --version`, then rerun `rexdeck enable files`. RexDeck qualifies neither Homebrew's version nor its prefix and never owns package transactions. Rex, Homebrew, Python and uv also remain externally managed; disable/uninstall leaves Yazi and its settings intact.
+
+For a custom target or noninteractive setup, select and approve it explicitly once:
+
+```sh
+rexdeck setup \
+  --config "$HOME/.config/rex/init.lua" \
+  --server "unix://$HOME/Library/Application%20Support/rex/server.sock" \
+  --real-server
+rexdeck enable files
+```
+
+The `--real-server` flag authorizes the personal target for subsequent explicit enable/disable commands. For an isolated server, pass its existing config and Unix socket with `--config` and `--server`, omit `--real-server`, and isolate RexDeck's XDG directories. Isolated sockets must resolve under `/tmp` or `/private/tmp`; they are not interchangeable with your application's endpoint.
+
+Settings are stored in `$XDG_CONFIG_HOME/rexdeck/config.json` (default `~/.config/rexdeck/config.json`). Files ownership records use `$XDG_STATE_HOME/rexdeck/files` (default `~/.local/state/rexdeck/files`), remembered at setup time. Git uses a separate `git/` subdirectory of that saved workspace. There is no required `-native` suffix. Later commands use the saved target, not ambient `REX_SERVER` or changing shell variables. Malformed settings, changed config symlink targets, and replacing an existing saved target are refused rather than silently adopted. To select a different target, disable every integration first, deliberately remove the saved RexDeck `config.json`, then run setup for the new target with a fresh ownership location. Keep old receipts until removal and rollback safety are verified; never reuse them for another target. XDG settings here do not relocate `uv` or Rex's own configuration.
+
+The generated module is `$XDG_DATA_HOME/rexdeck/plugins/files/rexdeck_files.lua` (default `~/.local/share/rexdeck/plugins/files/rexdeck_files.lua`). Setup resolves, validates, and saves the app data root (`…/rexdeck`) once; later commands reuse it even if ambient `XDG_DATA_HOME` changes. The uv-managed package remains the action/launcher source. Only the owned tracked `require` loader is added to the canonical Rex config target, including when the selected config is a symlink; it restores module search path/cache state and lets Rex detect action changes. The module data directory—not the config parent—cannot contain `;` or `?`, which have special module-search meanings. Symlinked or redirecting deployment subdirectories, conflicting files, and changed owned bytes are refused rather than overwritten or silently redirected to config-adjacent storage.
+
+Setup freezes the resolved Unix socket as well as the config target; redirecting an input socket alias cannot retarget later commands. The generated module embeds the applied Lua action and Python launcher together. Updating package files does not change an already applied launcher; `rexdeck enable files` explicitly refreshes both.
+
+The selected config must resolve to the running server's startup config, as reported by its read-only `client.keymap` API. Setting the CLI's `REX_CONFIG` alone cannot change what that server reloads. Setup and later lifecycle commands reject a mismatch or missing server config identity before owned writes; restart the intended server with the correct config before selecting it.
+
+### Existing native Files setup
+
+Current settings schema **2** and Files receipt schema **3** remain compatible when adding Git. Retain the saved target and explicitly run `rexdeck enable files` after reinstalling to refresh packaged source/interpreter paths; no disable/reset is required for this upgrade. Git enable/disable preserves Files and open Yazi panes. Unqualified `status` reports both integrations; `status files` reports Files alone.
+
+Old/unknown schemas, foreign receipts, config-adjacent deployments, and previous LazyRex installations are not automatically adopted. For those older layouts only, retain the old package and ownership evidence, use that implementation's disable against its verified target, and deliberately establish a fresh supported setup after removal. Do not blindly delete, rename, or reuse applied ownership.
+
+### Previous LazyRex-based Files
+
+Do not reuse its workspace with native Files. Close the identified old Files/previews and use the **previous implementation's** disable command or approved frozen cleanup helper with its original target and required approval. If cleanup already returned `"state": "disabled"` with `"conflicts": []`, do not repeat it. Keep ownership evidence until disabled state and rollback safety are verified; obsolete owned workspace/runtime artifacts may then be removed under explicit cleanup authority. Continue with a fresh native setup, not an adopted legacy receipt.
+
+The native CLI refuses legacy receipts; it does not stop or adopt an old hub automatically.
+
+## Use Files
+
+From a project terminal, open Rex's native palette and choose **RexDeck Files**. A native terminal split opens Yazi in that terminal's reported working directory. Missing or invalid context fails explicitly; the installer directory, home, and later focus are never substitutes.
+
+Use Yazi's normal navigation, previews, opening, configuration, and file operations. Up/Down already wrap from first to last entry and back in the verified upstream version. RexDeck does not replace Yazi's UI, keys, theme, plugins, previewers, or configuration. The initial directory is not a jail, and Yazi is **write-capable**, not read-only.
+
+Quit Yazi with its normal `q` binding to return focus to the exact captured project terminal. Each deliberate launch has its own origin; no replacement-pane registry or process sweeper is involved. A missing origin, failed launch, nonzero Yazi exit, or focus failure stays visible for acknowledgement instead of silently selecting another pane. User-defined Yazi bindings retain their own behavior.
+
+Tools run as your OS account, not in a sandbox. Tool-native opening/previewing can invoke programs configured by the user. RexDeck supplies structured argv and cwd, not a shell-interpolated command.
+
+## Disable and update
+
+```sh
+rexdeck disable files
+```
+
+Disable removes only unchanged owned loader/module state and reloads the selected config. It preserves config symlinks/modes, unrelated edits, user tool configuration, existing Yazi panes, and data. Changed artifacts produce conflicts for judgment. Failed operations recover owned state without overwriting concurrent edits. Disable never enables the historical Files POC or touches unrelated LazyRex instances. Saved target settings remain available for the next `rexdeck enable files`.
+
+Ctrl-C, SIGTERM, and SIGHUP during a lifecycle mutation run the same rollback path; further cancellation is deferred until recovery finishes. SIGKILL, power loss, and OS crashes cannot run Python recovery, and there is no durable crash-recovery journal. Retain ownership records and inspect artifacts before manual recovery after an uncatchable interruption.
+
+After updating the source checkout, reinstall and refresh the integration before launching Files again:
+
+```sh
+uv tool install --reinstall .
+rexdeck enable files
+rexdeck status
+```
+
+This refresh sequence applies to the current schemas. For a pre-cutover installation, follow **Existing native Files setup** before replacing the old package.
+
+Re-enabling verifies recorded ownership before refreshing the packaged action, launcher, and interpreter paths. Before `uv tool uninstall rexdeck`, run `disable` for every applied integration (`rexdeck disable files` and, when selected, `rexdeck disable git`), including integrations reported as disabled after a failed enable. A disabled action can still have an applied loader and module. Uninstalling the Python tool alone does not remove Rex configuration.
+
+## Development verification
+
+Run the shared checks from the [root README](../../README.md#development), plus this plugin's Lua syntax screen:
+
+```sh
+luajit -b src/rexdeck/plugins/files/main.lua /tmp/rexdeck-files-syntax.out
+```
+
+Lua compilation is not runtime proof. Build and install the wheel outside the checkout, then exercise setup/enable/status, native action/Yazi navigation and quit focus, reinstall/refresh, and disable on a private Rex server. Owner-app palette, glyphs, and visual behavior require owner-led checking rather than a CLI-only GUI claim.
+
+Yazi is an unbundled [MIT-licensed upstream tool](https://github.com/sxyazi/yazi/blob/main/LICENSE); Rex remains an external, separately licensed prerequisite. See the root [release owner gate](../../README.md#release-preparation-and-owner-gate) for pinned source installation and publication/evidence limits.

rexdeck-0.1.0/plugins/git/README.md

@@ -0,0 +1,63 @@
+# Git
+
+Launch unmodified [lazygit](https://github.com/jesseduffield/lazygit) in a native Rex terminal, using the invoking terminal's repository/worktree and returning to its captured origin.
+
+[Back to RexDeck](../../README.md)
+
+## Requirements and capabilities
+
+- macOS arm64, existing Rex CLI/server (API revision 10 baseline, not an exact-version gate), Python 3.12+, and `uv`.
+- `git` and `lazygit` on `PATH`. Lazygit **0.66.2 and 0.66.3** are qualified versions; other installed versions require manual resolution, never implicit upgrade. Private runtime qualification used Git 2.56.0; other platforms are not qualified.
+- An invoking terminal that reports its current local directory to Rex. A normal repository subdirectory or linked worktree is supported; a bare repository, missing directory, or unavailable cwd is rejected.
+
+Lazygit is **write-capable**, runs as your OS account, and retains its normal keys, settings, editor, custom commands, authentication, and network operations. RexDeck neither sandboxes it nor makes it read-only. Upstream Git hooks and configured commands retain their effects. Enable does not fetch, stage, commit, push, log in, or change Git settings. The initial directory is not a filesystem jail.
+
+## Enable and use
+
+Install RexDeck as described in the root README, then select one target once:
+
+```sh
+rexdeck setup
+rexdeck enable git
+rexdeck status git
+```
+
+Setup/status never install packages. `enable git` validates preinstalled Git and qualified lazygit **0.66.2 or 0.66.3**, reusing the qualified executable and revalidating metadata identity plus the saved target before registration. Missing or unqualified selected tools return actionable nonzero manual-install/version-check/rerun guidance without prompts or partial registration. RexDeck never installs, upgrades or removes Git/lazygit, or probes/executes Homebrew.
+
+Install [lazygit 0.66.2](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.2) or [0.66.3](https://github.com/jesseduffield/lazygit/releases/tag/v0.66.3) yourself using [upstream instructions](https://github.com/jesseduffield/lazygit#installation); provision Git separately. If choosing Homebrew, inspect `brew info lazygit` yourself first; skip Homebrew if its selected version is not qualified and use a qualified upstream release instead. Only run `brew install lazygit` yourself when its version qualifies and you accept its dependency/source-build/upgrade effects. Check `lazygit --version` and `git --version`, then rerun `rexdeck enable git`. RexDeck qualifies neither Homebrew's version nor its prefix; the owner controls all package effects. Disable/uninstall leaves Git/lazygit and their configuration intact.
+
+From the intended repository terminal, choose **RexDeck Git** in Rex's native palette. The terminal split runs lazygit with structured argv and the validated invoking cwd. Git performs its normal repository discovery; RexDeck does not manufacture a `.git` directory or collapse linked worktrees to their common repository.
+
+Use upstream lazygit controls to inspect diffs, stage, commit, and perform other Git operations. Normal `q` returns to the exact captured terminal. Each deliberate launch is independent. If the origin has closed, focus restoration fails visibly for acknowledgement instead of selecting a replacement pane. Launch failures and nonzero tool exits are also visible.
+
+Inherited repository/config-injection/discovery variables such as `GIT_DIR`, `GIT_WORK_TREE`, `GIT_COMMON_DIR`, `GIT_INDEX_FILE`, `GIT_OBJECT_DIRECTORY`, `GIT_ALTERNATE_OBJECT_DIRECTORIES`, `GIT_NAMESPACE`, `GIT_CONFIG`, `GIT_CONFIG_COUNT`, `GIT_CONFIG_PARAMETERS`, `GIT_CONFIG_KEY_*`, `GIT_CONFIG_VALUE_*`, `GIT_CEILING_DIRECTORIES`, and `GIT_DISCOVERY_ACROSS_FILESYSTEM` are rejected, including empty values. Resolve the ambiguous environment before launching; RexDeck does not unset it silently or change your configuration. Normal upstream settings homes and supported authentication stores remain unchanged.
+
+Git validation searches only absolute `PATH` directories and invokes the resolved executable explicitly; relative and empty entries cannot select a Git binary from the invoking repository. Git discovery failures retain upstream diagnostics, including ownership recovery guidance; RexDeck does not change `safe.directory`.
+
+## Independent ownership, update, and removal
+
+`enable files` and `enable git` share one saved target but own separate actions, modules, loaders, and receipts. `status` reports both; `status files` and `status git` inspect one. Ready means owned configuration/action registration matches the current package, not that a tool process is running.
+
+Git deploys `plugins/git/rexdeck_git.lua` under the saved RexDeck data root. Its receipt/lock directory is `git/` beneath the saved Files-compatible ownership workspace. Files' existing settings schema 2, receipt schema 3, paths, and loader identity remain valid. Shared config/data-root locks prevent overlapping lifecycle mutations; a competing operation fails explicitly and can be retried after the other finishes.
+
+After reinstalling the updated package, explicitly refresh every integration you use:
+
+```sh
+rexdeck enable git
+rexdeck enable files
+rexdeck status
+```
+
+Only unchanged owned artifacts are refreshed. Disable is independent and preserves siblings, existing tool panes, unrelated config edits, symlinks/modes, Git settings, repositories, and credentials:
+
+```sh
+rexdeck disable git
+```
+
+Run `disable` for **every applied** integration before uninstalling RexDeck or deliberately replacing its saved target, including integrations reported as disabled after a failed enable. A disabled action can still have an applied loader and module; Python package removal alone does not remove Rex loaders. Changed artifacts produce an ownership conflict for manual judgment; they are not silently deleted. Cancellation recovery has the same limits as Files: SIGKILL/power loss cannot run rollback.
+
+## Verification
+
+Run the root Ruff/format/strict-mypy/full-pytest chain and compile the shared packaged `src/rexdeck/plugins/files/main.lua` asset. Build/install the wheel outside the checkout and use a private native Rex endpoint with disposable repositories. Exercise actual diff/stage/commit, normal subdirectory and linked-worktree origins, independent quits after focus changes, closed-origin failure, missing tools, both sibling enable/disable orders, and open-pane survival. Native terminal captures prove the private TUI interaction; they do not claim owner-app palette/font/desktop visual approval.
+
+Lazygit is an unbundled [MIT-licensed upstream tool](https://github.com/jesseduffield/lazygit/blob/master/LICENSE). Rex is external and separately licensed. Publication is held until the root [release owner gate](../../README.md#release-preparation-and-owner-gate) is satisfied; source install remains supported while unpublished.

rexdeck-0.1.0/pyproject.toml

@@ -0,0 +1,60 @@
+[build-system]
+requires = ["hatchling>=1.27,<2"]
+build-backend = "hatchling.build"
+
+[project]
+name = "rexdeck"
+version = "0.1.0"
+description = "Native Rex integrations for independently selectable existing tools"
+readme = "README.md"
+requires-python = ">=3.12"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Tom Mathews" }]
+keywords = ["rex", "terminal", "yazi", "lazygit"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Operating System :: MacOS :: MacOS X",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.12",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/Mathews-Tom/RexDeck"
+Repository = "https://github.com/Mathews-Tom/RexDeck"
+Issues = "https://github.com/Mathews-Tom/RexDeck/issues"
+Changelog = "https://github.com/Mathews-Tom/RexDeck/blob/main/CHANGELOG.md"
+
+[project.scripts]
+rexdeck = "rexdeck.cli:main"
+
+[dependency-groups]
+dev = ["mypy>=1.15,<2", "pytest>=8,<10", "ruff>=0.11,<1"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/rexdeck"]
+
+[tool.hatch.build.targets.sdist]
+only-include = [
+  "src/rexdeck", "tests", "plugins", "README.md", "CHANGELOG.md",
+  "LICENSE", "pyproject.toml", "uv.lock",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.mypy]
+strict = true
+files = ["src", "tests"]
+mypy_path = ["src"]
+
+[tool.ruff]
+target-version = "py312"
+line-length = 88
+
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "I", "UP"]

rexdeck-0.1.0/src/rexdeck/__init__.py

@@ -0,0 +1 @@
+"""RexDeck's explicit repository-local setup tools."""