The README still said nobody had watched this app blink the logo under a
closed lid. The owner ran release candidate 6 of 1.50.1 on a MacBook Pro
and reported that it works. It also names what the LogoLight handover was
checked against.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
LogoLight drives the lid logo with the same DisplayLogicalState fades,
so Codeman used to leave the logo to it whenever it ran: the owner had
LogoLight open and the release candidate never breathed.
LogoLight steps aside instead since its 1.3.0 ("LogoLight steps aside
while Codeman shows its agents on the logo, and takes the logo back
afterwards"). This is Codeman's side of that contract, which lives in the
marker the blinker already keeps for crash recovery:
- it now holds the blinker's process ID;
- it goes down right before the first write rather than when the blink
starts, so a blink waiting for the display does not pause LogoLight for
nothing; under a closed lid the first write is telling the logo the lid
is open, so the marker and the wait come before that;
- with a LogoLight that says LogoLightStepsAsideForCodeman in its
Info.plist, the blinker waits two seconds after writing it, since
LogoLight looks every second. A blink that starts within a second of
the last one's end (work, then a permission) skips the wait: LogoLight
takes the logo back only after the marker has been gone for 1.5 s.
The key is read from the running LogoLight's bundle by process ID
(proc_pidpath, then the plist file, never NSBundle, which would keep a
stale copy across a LogoLight update). An older LogoLight is still left
the logo, and the warning when the switch is turned on now says to update
it. At launch, a logo a killed child left is put back as before, but with
any LogoLight running the lid state is left to it.
Tests: 229 pass on the Mac mini, and six deliberate breaks of the
handover each fail one. The Info.plist lookup was run against a stand-in
process carrying the Info.plist of the released LogoLight 1.3.1: it reads
"steps aside". Not seen with a real LogoLight on a real logo yet.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
LogoLight 1.3.1 lights the logo behind a closed lid on a real MacBook kept
awake with no display attached, and its research notes say why the earlier
tries here stayed dark and what must not be written:
- Kept awake like that, the built-in display stays online and
CGDisplayIsAsleep says 0, so the lid path was never taken ("not tried
yet"). The lid sensor decides now (in since the last commit).
- DisplayPowerStateEvent is gone. A client's DidSleep keeps the logo dark,
lid open too, until a DidWake is written; the last commit wrote DidSleep
when a blink ended, and at launch with a marker and the lid closed.
- After ClamshellUpdate 0, each display in CBDisplayList is told the lid
is closed again (setProperty:withKey:andDisplay:), as each keyboard is:
told it is open, True Tone tints an external display warm and dim.
- The logo is told once, when the daemon has handled the lid
(CBClamshellState, bounded to two seconds of waiting), not at every
cycle, which would toggle those display modules with every beat. It is
told again when it is found dark at the start of a beat, or when a rise
did not move it: three times in a row, then every half minute, with
"stayed dark" in the menu line.
- Unplugging under the lid tells the logo the lid is closed again.
- "The Mac went to sleep" is only said while the lid is closed.
The keep-awake side needs nothing new: pmset disablesleep holds the Mac at
full wake, which is the state LogoLight measured; an assertion against
system sleep alone gives a dark wake, where the logo stays dark.
221 tests pass on the Mac mini, and 13 deliberate breaks of the lid rules
each fail one. Not seen from this app on a real lid yet.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
On RC4 the owner closed the lid with LogoLight not running and the menu
line still said "not tried yet": the child never wrote anything. Three
ways that could happen left no trace: the display list still showing the
built-in display awake under the closed lid (the blink then never took
the lid path), no blink running because no agent was at work, and the
Mac going to sleep at the lid close.
The lid sensor now wins: a closed lid counts as closed whatever the
display list says. While no blink runs and the lid is closed, the line
says why (nothing to show, no agent at work; the logo switched off;
LogoLight has the logo; a refused change). The child notices a sleep as
wall-clock time that passed while Instant stood still, and the line then
says "the Mac went to sleep". With no child at all (switch off, no
server open) the app says nothing watches the lid.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RC3's lid path went dark on the real MacBook without a word: it waited for
CBClamshellState, gave up after two tries, and wrote ClamshellUpdate 1
back on every failed proof, and none of its silent paths left a trace
without a Terminal launch.
Now, while the lid sensor (AppleClamshellState) says closed, the built-in
display is off and the Mac is on its power adapter, the logo is told the
lid is open (and each keyboard that it is closed) at the start of every
cycle, with no tries and no give-up: monotone, so nothing is toggled in
between. With no other display on the display sleeps, which also keeps
the logo dark, so if the first rise does not move it the logo is told the
display woke (DisplayPowerStateEvent 2); DidSleep is written back at the
end only if that was sent. The end of a blink, and the marker recovery,
still put the logo back to dark as a closed lid has it.
What the closed lid did last is a line in the View menu, under Apple Logo
Blink Styles: "Lid Closed: blinking", "blinking (display told awake)",
"stayed dark, macOS keeps the logo off", or why it was not tried (on
battery, no keyboard to keep dark, no lid sensor), with the time. The
child writes it to logo-lid next to desktop.json, with the readings on a
second line; the app reads it every two seconds.
The battery and keyboard gates stay: the lid helper only holds on the
adapter, and a keyboard told the lid is open would light under it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The proof that the logo moves under the closed lid now needs a fade level
above 0.01, not just above 0, so no drift of a fade held at 0 passes for a
rise; the slowest rise (the breath's) is past it in about 80 ms. The note
on stderr is a writeln! whose error is dropped: eprintln! panics on a
failed write, and the blink child has panic = "abort".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With the lid closed, corebrightnessd tells every module so and keeps the
logo dark, so the blink stopped as soon as the lid came down, which is
exactly when the logo on the lid is the one thing in view.
While the Mac stays awake with the lid closed on its power adapter (Keep
This Mac Awake's lid helper, or an external display), the blink child now
does what LogoLight's Lit with Lid Closed measured on the real MacBook:
once the daemon has handled the lid (CBClamshellState), it tells the logo
the lid is open (ClamshellUpdate 0) and each keyboard alone that it is
closed, so the keyboard stays dark and is never relit after a Blank.
The first rise after that has to move the logo within 1.5 s. If it does
not (with no display on, the daemon may still hold the logo dark), the
lid is told closed again, tried once more, then left dark until the lid
opens, a display comes on or the agents' state changes. A logo the daemon
takes back (it resends the lid state when a display or keyboard comes up)
is told again. Ending a blink under the closed lid hands the logo back to
normal and then writes ClamshellUpdate 1, since normal there is dark; the
marker recovery does the same for a killed child. Never on battery (a
dark wake must not light the logo in a bag), never without the keyboard
IDs, and nothing is written when the lid opens. Every step is a line on
stderr so a real-Mac run shows which one stopped it.
Not seen on a real MacBook yet; the README says so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From the review of #800: the window hid the app whenever a keep-awake mode
was chosen, also with no server open (the connect page) or with a Codeman
on another machine, where keep-awake holds nothing. Closing the window then
left a hidden app in the Dock for nothing, and it never quit on close again
until Cmd+Q.
close_hides_app() now decides from the open server as well: it hides only
while keep-awake watches a Codeman on this Mac, the same server and the same
is_this_mac() rule the worker uses. It still hides while keep-awake is only
paused (on battery with Only When Plugged In, no agent at work, no answer),
since it carries on by itself once that changes.
The test now covers loopback, this Mac's own address, another machine's
address and no server, and fails with the old rule. The frame is recorded
and the config saved once, before the hide or quit choice, and the Reopen
comment says how a hidden app comes back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Folds the carried changesets of #732 (minor), #791 and #705 into one
patch changeset for the whole release, so the bump is 1.50.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- docs/api-reference.md and the voice-stream.ts overview now say a
transcript frame is the current utterance so far and a final frame
ends it, as the relay's own comment and the invariants doc do.
- VoiceInput.cleanup() hides the Send button before stop(true), so the
button stays up for the words stop(true) salvaged and inserted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
_onWebSpeechEnd counted every run that ended without a result toward the
two-retry cap, however long the run lasted. Under 30 s or Manual, each
no-speech window of the engine is one silent run, so the third ended the
recording at about 18 s of silence, before the deadline, and Manual
stopped on its own. Both recognition.start() sites now stamp the run start;
an empty run counts toward the cap only when it ended within a second of
starting (a recognizer that cannot listen), and any other run resets it.
The 250 ms backoff is unchanged.
The vm harness in test/voice-silence-timeout.test.ts now passes the test's
Date into the context, whose own Date ignores fake timers.
Also from review: the VoiceInput stubs of the four settings-ui.js tests
carry SILENCE_TIMEOUT_SECONDS; Settings-Reference lists Stop after silence;
the touchscreen Linux fallback leaves out ChromeOS and says a touch Linux
laptop still matches; the dead _webSpeechStream teardown is gone; the two
voice tests use vitest expect instead of node:assert.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The floating log viewer reconnected every few seconds when its tail-file
stream ended with a startup error (path refused, file missing, too large,
stream limit, tail spawn failure). It now closes the EventSource on an
`error` message that arrives before `connected`; an established stream
keeps its reconnect.
Squashed from #720 (johoja12). Maintainer edits while landing, as the
review said: the onerror close is dropped (it stopped the browser's own
retry after a transport failure, leaving the window on "Connecting"),
the test's check for a button nothing renders is gone, and the stubbed
stream sets `retry: 200` so a reconnect, if one came, shows within the
shorter wait.
Co-authored-by: Codeman maintainer <kay@stutz.science>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep This Mac Awake lives in the app and ends when the app quits, and
closing the main window quit the app. So with a mode on, the red button
(or Cmd+W) followed by closing the lid let the MacBook sleep: the lid
request file was cleared and the helper released disablesleep at its
next run.
While a mode is on, closing the main window now hides the app the way
Cmd+H does (hide_application), so full screen and pop-outs come back as
they were on a click on the Dock icon. Cmd+Q and Quit from the Dock
still end it, through LoopDestroyed as before. With keep-awake off,
closing the window quits as it always did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner found the options confusing after the first test build. The
menu now reads Off / While Agents Work / Always, then on a MacBook
Only When Plugged In and With the Lid Closed…, then one status line.
- "Always While Codeman Is Open" is now "Always"; the status line says
"Awake: Codeman is open".
- "Only on Power Adapter" is now "Only When Plugged In".
- "Remove the Lid Helper…" is gone: the lid item is the helper.
Ticking it installs the helper behind the administrator prompt,
unticking it removes it behind another. The setting changes only
once the prompt's command ran, so a cancelled prompt leaves the item
as it was.
- Shorter status lines ("Awake: agents working, lid closed too",
"Paused: on battery", "Sleeps as usual: no agent working").
Config keys and values are unchanged, so a saved choice carries over.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- session-ui.js: drop the answer when the case-sync chain moved during the read; settings-ui.js calls _applyServerCaseSettings with ?.
- i18n.js: zh-CN for the failed case-options save toast, case name passed through
- tests: regression for the stale read, zh-CN toast row
- sync-case-state browser and stale-refresh tests use lastPickedCase (the stale test now fails without its guard)
- saveLastUsedCase runs on the case-sync chain, and the follow is skipped while this device's own pick was not stored
- _caseStateSyncOn tolerates a harness without loadAppSettingsFromStorage
- lastPickedCase added to the config-backup volatile-key test and docs; rename rollback tests cover caseSettings and lastPickedCase
- wiki row moved to System
Codeman > Keep This Mac Awake in the macOS app: While Agents Work (an
agent at work, plus 5 minutes after the last one stops) or Always While
Codeman Is Open. Off by default, and only for a Codeman on this Mac.
- Idle sleep needs no password: the app holds an NSProcessInfo activity
with IdleSystemSleepDisabled, which the kernel drops with the process.
While it only watches for work, an activity that still allows sleep
keeps App Nap from slowing its look at the server.
- On a MacBook, Only on Power Adapter (on by default) pauses it on
battery, and Also With the Lid Closed installs a small LaunchDaemon
behind macOS's administrator prompt. It sets pmset disablesleep only
while the app keeps a fresh request file with its live pid, only on
the power adapter, and undoes only what it set itself. The app writes
the script and plist as root from the copies built into it.
- A status line at the bottom of the submenu says what it does now.
This brings the macOS part of the keep-awake idea from PR #595 into the
app; the server-side setting and the Linux route are left out for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- follow lastPickedCase (written by saveLastUsedCase while sync is on), not lastUsedCase, so a quick-start or an agent's spawned worker no longer moves other devices
- close the open case-options popover when the follow or an import changes what it shows; follow through selectQuickStartCase(save:false)
- failed save reuses _noteSettingsWriteResult and says the choice lasts until the next sync
- rename undo renames the shared entry back instead of restoring the whole map; lastPickedCase follows a rename
- caseSettings and lastPickedCase added to the redaction, rename and backup-volatile lists and the docs
The 1.50.0 blink switched LEBacklightMode on and off. Every style was a lit
logo with short dark blips that differed only in how many there were, and
Working (Heartbeat) looked busier than Waiting for you (Wink), so urgency
read backwards. Each change was also a write to a setting corebrightnessd
keeps in root's preferences, and new users had to pick a style in three
submenus before anything happened.
Now one rule: the more the logo moves, the more it needs you.
- View > Blink Apple Logo is one switch, off until turned on. It shows
Breathe while agents work, Calm for a yellow tab and Alarm for a red one.
Each state can take another style under View > Apple Logo Blink Styles.
Picking a style turns the switch on, and turning it on with every state
off brings back those three.
- Breathe is new: a slow fade out and back in, every 6.3 s.
- The logo moves on the LED's own hardware fades (LEPWMFactorFadeDuration,
then DisplayLogicalState Blank or Unblank), as LogoLight measured them on
the real logo (MIT, reimplemented in Rust, not copied). A blink writes no
setting and leaves nothing behind a restart. LEBacklightMode is only read,
so a logo the user switched off stays off.
- The direction of a fade is tracked, because the daemon ignores a write in
the direction it already heads and the state can't be read back. When the
direction is unknown, the logo is turned round with a 1e9 s fade first.
- After every Blank the keyboards alone are told Unblank, and only while
the built-in display is awake (CGDisplayIsAsleep). They are told Blank when
it sleeps and Unblank when it wakes. When it sleeps, the fade duration
also goes back to automatic, as LogoLight does.
- A rise from exactly dark waits for a display frame, up to 0.5 s. Short
dark beats (up to 0.35 s) turn round before their fall ends, so they never
reach 0. Long ones time their light from when the rise starts.
- Every end puts the logo back: lit, with the automatic fade duration. A
new marker file (logo-fade) covers a killed child. 1.50.0's marker
(logo-blink) still switches back on a logo that version left off.
- While LogoLight runs, Codeman leaves the logo to it (process-name check),
and the app says so when the switch is turned on.
- Settings from 1.50.0 keep their styles, with the switch on if any was
chosen. All three off was that version's default, so it reads as
untouched.
The tests run the blink against a fake corebrightnessd that moves in
17.5 ms frames on the measured spring curve. It starts each fade 19 ms
after the write, ignores a write in the direction it already heads, and
holds a rise from exactly dark back by a configurable delay. They pin these
cases:
- dips never reach 0
- long dark beats keep their light
- no keyboard is told to light while the display sleeps
- every end leaves the automatic duration and a lit logo
- a logo switched off or driven by LogoLight is left alone
- old settings are migrated
An ignored probe (what_this_mac_answers) reads a Mac's displays,
processes, keyboards and logo without writing anything.
Not measured on the real logo, since there was no MacBook to test on:
- how the 0.12 to 0.36 s fades of the hard styles look
- whether a rise from a dip (about 7%) really skips the frame wait
- the keyboard during Alarm
- the keyboards through a real display sleep
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fixes#529's review asked for, each with a test.
- No inline handler. The button quoted the path inside
onclick="...decodeURIComponent('<path>')", and encodeURIComponent leaves
' alone, so a file named x'-alert(1)-'.txt ran script in Codeman's
origin and it's.txt was a syntax error. It is now bound in the existing
.file-tree-item loops from the row's escaped data-path.
- Symbolic links are refused, never followed. validateSessionFilePath()
returns the realpath, so deleting AGENTS.md -> CLAUDE.md deleted
CLAUDE.md and left the link dangling. The path as named is lstat'ed,
a link answers 400, and the inode is compared again before the unlink.
- The edit route's confinement whole: validateLocalSessionFilePath()
behind withGuardedOutsideWorktree(), so an absolute path in a followed
outside worktree obeys the same rules, and the sensitive, blocked and
.git checks run on both the realpath and the path as named.
- Adopted sessions are refused like remote ones (the /tmp exception of
the older file surfaces is not copied to a new one); Docker workspaces
are allowed, as on the edit route. The workspace is probed bounded
first (#516). Errors are thrown with their status.
- Deleting from search results re-runs the search, the row buttons stay
visible on touch screens, the confirm and toasts have zh-CN text, and
no button is drawn for remote or adopted sessions.
- Docs: CLAUDE.md, architecture-invariants, api-reference and the
Working With Files wiki page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A delete button on each file row of the Files panel (tree and search
results) and a DELETE /api/sessions/:id/files?path= route that removes one
regular file from the session workspace, refused for remote (SSH)
sessions and behind the same sensitive-path, attachment-guard and .git
checks as the edit route.
Salvaged from #529.
The review items offered on #608, applied on top of the contributor's
zoom:
- `object-fit: scale-down` instead of `contain`, so a small image keeps
its own size instead of being stretched to fill the preview. The pan
clamp now uses the size the image is actually drawn at (natural size
fitted with scale-down) rather than the image box, which let a small
or letterboxed image be panned entirely out of view.
- Wheel zoom is proportional to deltaY (d3-zoom's scale: about 15% per
100px notch, lines and ctrl+wheel trackpad pinches scaled up), capped
at sqrt(2) per event, and a wheel event with no vertical delta zooms
nothing. A trackpad scroll no longer jumps to 600%.
- The zoom controls show only once the image has loaded; on an error
they are hidden and the gesture listeners are dropped with the image.
Both handlers now check the request sequence like the text branch, so
a late load or error from a replaced preview no longer resets the
current preview's zoom or paints its error over the current image.
- test/path-picker-image-zoom.test.ts drives the real listeners in
jsdom (focal point under the cursor and the pinch centre, pan clamp,
wheel scaling, error, close and stale events) in place of the
source-string checks in test/path-picker-ui.test.ts. 7 of its 10
tests fail against the contributor's commit alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The path picker's image preview gets zoom controls (out, fit/percentage,
in), a two-finger pinch that keeps the pinch centre in place, one-finger
pan while zoomed (clamped to the image bounds), double-click to toggle
2x, and wheel zoom on desktop. closePreview() removes every listener and
drops the zoom state.
Salvaged from #608.
- session-ui.js: no GET /api/settings on a tab return unless this device's cached syncCaseState is true
- system-routes.ts: caseSettings is merged only while syncCaseState is true (as stored or set by the same PUT)
- sync-case-state tests cover both; wiki notes the stored options stay when sync is turned off
The install window polls GET /api/local-model every second. A read of the
state file that was still out while the job wrote its last state and let
go of this.job came back with the old `installing`, and settling that with
no job in the process read it as an interrupted job: `paused` with Resume
for one tick before `failed`. Under CI load this made
test/local-model-install-e2e.test.ts fail on a different failure case per
run (master 86502b69, PR #790).
currentState() now reads again when the job ended during the read. The job
writes before it lets go, so the second read has the final state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Folding a phone on the home screen left the welcome screen up when the page
had loaded wide (#702): the phone overview's breakpoint listener was wired
from its first show, which a wide-loaded page never reaches. Both home
screens' breakpoint listeners are now installed once from init() and act
only while a home surface is up.
A rail render queued just before the fold could also unhide the desktop
rail behind the phone overview; the debounced refresh now asks again when
it fires.
Tests: test/home-breakpoint-listeners.test.ts (gate) and
test/home-breakpoint-swap.browser.test.ts (browser suite: wide-first and
narrow-first across 599/600 and 767/768, plus a height-only resize).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Redact caseSettings for non-admins and never apply a shared map on a read-only page (CASE-SYNC-001)
- Send one case per save and merge it inside mutateSettingsFile, so devices cannot discard each other's cases; rapid saves keep their order (CASE-SYNC-002)
- Check HTTP status and the response body, keep the local choice, report an unsynced save and reuse the forbidden-write handling (CASE-SYNC-003)
- Let the server decide whether sync is on: refresh the cached switch, discard stale refreshes (CASE-SYNC-004)
- Carry shared options through case rename and drop them on delete or unlink
- Give the switch an accessible name; add server, client and two-browser tests
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
5.3 MB for the universal app and 3.5 MB for the DMG, measured on the Mac
mini from this branch; the README still had the first build's 4.6 and 3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No behavior change: the connect page renders pixel-identical in eight
states (Chromium, before and after), posts the same messages, and passes
its jsdom and browser tests.
- policy.rs: the connect commands' camelCase fields come from serde's
rename_all_fields instead of three per-field renames; parse_ipc's
length and id checks are match guards like its other arms, with the
message cap named (MAX_MESSAGE_LEN); new_window reads its URL through
external_url, which is the same parse-and-http(s) check.
- logo.rs: the stubs for other platforms are one module, and Logo,
Marker and recover are private to the file.
- connect.html: answers() is the one test for a server that answers
(six copies), the running and needs-login rows of This Mac share their
branch, prepareWizard, needsAgent, newWait and openTerminal each
replace two or three copies, a finished install and a finished agent
share their path, host() is displayAddress(), state.clock is in the
state literal, three CSS rules that matched nothing are gone, and the
state comments say what wait and gui hold now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codeman maintainer