ci(desktop): a rebuild by hand takes only a Codeman release tag on master

A dispatch with -f tag=<any tag> built that tag, and sign then ran the tag's
sign-macos.sh with the Developer ID key unlocked and the notary login in its
environment. Nothing checked the tag: xterm-zerolag-input@0.1.7 would have put
Codeman.dmg on that package's release, and a tag on a commit that never
reached master would have run unreviewed scripts with the secrets.

build and sign now each check their own checkout before anything else runs:
the tag must read codeman@x.y.z (or aicodeman@x.y.z, which a failed rename
leaves) and GitHub's compare of master with the checked-out commit must say
behind or identical. The check is inline, since a script from the checkout
would be the tag's own code. Release's own call (a push, not a dispatch) and
the branch dry run are unchanged.

The header says why a master-only Environment would not close this path, and
release.yml's macos-app job now says that any permission a called job asks
for must be granted there too, or Release fails at startup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -80,35 +80,6 @@ jobs:
             CLI_DETECT_DONE=""; detect_all_clis
             offer_ai_cli_install >/dev/null 2>&1
             echo "bash $BASH_VERSION: skipping the AI CLI install menu continues"
-            # --ai-cli answers the same menu with no terminal: `none` carries on, and a
-            # name runs that one entry (bash 3.2 cannot expand an empty offer list under
-            # set -u, which is the guard the loop over it has to get right).
-            has_tty() { return 1; }
-            AI_CLI_CHOICE=none
-            offer_ai_cli_install >/dev/null 2>&1
-            AI_CLI_CHOICE=codex
-            k=0; while [[ $k -lt ${#CLI_INSTALL_CMD_TRUSTED[@]} ]]; do
-              CLI_INSTALL_CMD_TRUSTED[$k]=""
-              k=$((k + 1))
-            done
-            offer_ai_cli_install >/dev/null 2>&1
-            echo "bash $BASH_VERSION: --ai-cli answers the menu, also with nothing to offer"
-            # What the desktop app runs: preflight on stdout, and only JSON there. These
-            # child runs must not inherit CODEMAN_INSTALL_SH_LIB, or they stop at the
-            # sourcing guard and print nothing. Each check ends in `|| exit 1`, because
-            # bash 3.2 does not let a false [[ ]] trip set -e.
-            out=$(env -u CODEMAN_INSTALL_SH_LIB bash /w/install.sh preflight --no-admin)
-            [[ "$out" == "{\"schema\":1,"* && "$out" == *"]}" ]] || { echo "preflight printed: $out"; exit 1; }
-            json_string "a\"b\\c" >/tmp/json-out
-            [[ "$(cat /tmp/json-out)" == "\"a\\\"b\\\\c\"" ]] || { echo "json_string printed: $(cat /tmp/json-out)"; exit 1; }
-            echo "bash $BASH_VERSION: preflight prints JSON"
-            # How the desktop app adds an agent: a real run of the subcommand, which stops
-            # on the missing npm before it could install anything.
-            if out=$(env -u CODEMAN_INSTALL_SH_LIB bash /w/install.sh agent codex --no-admin --progress 2>&1); then
-              echo "agent ran with no npm to run"; exit 1
-            fi
-            [[ "$out" == *"@@codeman phase agent"* && "$out" != *"@@codeman phase done"* ]] || { echo "agent printed: $out"; exit 1; }
-            echo "bash $BASH_VERSION: agent stops without saying done"
           '
           # Issue #382: the dsh identity probe builds an OPTIONAL `timeout` prefix as an
           # array, and on stock macOS there is no `timeout`, so the array is empty and the
@@ -180,61 +151,6 @@ jobs:
             RECONFIGURE=0; parse_flags --port 4001; [[ "$RECONFIGURE" == "1" ]]
             echo "bash $BASH_VERSION: question phase (flags, launch default, occupied :443, rename opt-in, kept password, start line) ok"
           '
-          # No-admin route: the helpers that decide what gets downloaded and whether it is
-          # trusted (the Node.js checksum pick, the tmux digest table, the verify step), the
-          # stop-before-download check, and an archive install plus its replacement, all
-          # in bash 3.2. This image is Alpine, so it is also the one place the musl branch
-          # runs for real: a machine the route cannot serve must stop BEFORE a download.
-          docker run --rm -v "$PWD":/w -w /w -e CODEMAN_INSTALL_SH_LIB=1 -e HOME=/tmp/h bash:3.2 bash -c '
-            set -euo pipefail
-            mkdir -p /tmp/h /tmp/src/Codeman-1/src
-            . /w/install.sh
-            sha=$(printf "%064d" 7)
-            sums=$(printf "%s  node-v22.1.0-linux-x64.tar.gz\nnothex  node-v22.1.0-linux-arm64.tar.gz\n" "$sha")
-            [[ "$(printf "%s\n" "$sums" | pick_node_tarball linux-x64)" == "$sha node-v22.1.0-linux-x64.tar.gz" ]]
-            if printf "%s\n" "$sums" | pick_node_tarball linux-arm64 >/dev/null; then
-              echo "accepted a checksum that is not 64 hex digits" >&2; exit 1
-            fi
-            for p in linux-x86_64 linux-arm64 macos-arm64 macos-x86_64; do
-              d=$(tmux_build_sha256 "$p"); [[ ${#d} -eq 64 ]]
-            done
-            printf codeman > /tmp/f; good=$(sha256_file /tmp/f); [[ ${#good} -eq 64 ]]
-            verify_sha256 /tmp/f "$good"
-            if verify_sha256 /tmp/f "${good%?}x" || verify_sha256 /tmp/f ""; then
-              echo "accepted a wrong or empty checksum" >&2; exit 1
-            fi
-            is_musl_libc
-            NO_ADMIN=1; NONINTERACTIVE=1
-            download() { echo DOWNLOADED; }; download_to_stdout() { echo DOWNLOADED; }
-            check_node() { return 1; }; check_tmux() { return 1; }; check_git() { return 1; }
-            check_build_tools() { return 0; }
-            if out=$( (ask_dependencies_no_admin linux) 2>&1 ); then
-              echo "did not stop on a musl system" >&2; exit 1
-            fi
-            case "$out" in
-              *DOWNLOADED*) echo "downloaded before stopping: $out" >&2; exit 1 ;;
-              *musl*) ;;
-              *) echo "stopped for the wrong reason: $out" >&2; exit 1 ;;
-            esac
-            # An archive install, then its replacement beside it (busybox tar, bash 3.2).
-            printf "{ \"version\": \"1.0.0\" }\n" > /tmp/src/Codeman-1/package.json
-            tar -czf /tmp/one.tar.gz -C /tmp/src Codeman-1
-            printf "{ \"version\": \"2.0.0\" }\n" > /tmp/src/Codeman-1/package.json
-            tar -czf /tmp/two.tar.gz -C /tmp/src Codeman-1
-            INSTALL_DIR=/tmp/h/app; LOG_FILE=/dev/null
-            download() { cp "${1#file://}" "$2"; }; run_step() { shift; "$@"; }
-            CODEMAN_TARBALL_URL=file:///tmp/one.tar.gz; install_or_update_repo >/dev/null 2>&1; finish_source_swap
-            [[ -f "$INSTALL_DIR/$SOURCE_MARKER" && -z "$SOURCE_STAGING" ]]
-            grep -q 1.0.0 "$INSTALL_DIR/package.json"
-            touch "$INSTALL_DIR/from-the-old-build"
-            CODEMAN_TARBALL_URL=file:///tmp/two.tar.gz; install_or_update_repo >/dev/null 2>&1
-            [[ "$SOURCE_STAGING" == "$INSTALL_DIR.new" ]] && grep -q 1.0.0 "$INSTALL_DIR/package.json"
-            finish_source_swap
-            grep -q 2.0.0 "$INSTALL_DIR/package.json"
-            [[ ! -e "$INSTALL_DIR/from-the-old-build" && ! -e "$INSTALL_DIR.new" && ! -e "$INSTALL_DIR.old" ]]
-            NO_ADMIN=""; resolve_admin_mode; [[ "$NO_ADMIN" == "0" ]]
-            echo "bash $BASH_VERSION: no-admin route (checksums, stop before download, archive install and swap) ok"
-          '
 
       - name: CLI catalogue artifacts are in sync with stock.ts
         run: npm run generate:cli-catalog -- --check

.github/workflows/desktop-ci.yml

@@ -0,0 +1,72 @@
+name: Desktop app
+
+# Checks the native macOS app in packages/desktop on the pull requests and master
+# pushes that change it: formatting, clippy and the unit tests, on macOS. No
+# secret and a read-only token, because cargo runs the build script of every
+# crate in Cargo.lock. The release build, signing and notarization live in
+# desktop-dmg.yml.
+
+on:
+  pull_request:
+    paths:
+      - 'packages/desktop/**'
+      - '.github/workflows/desktop-ci.yml'
+  push:
+    branches: [master]
+    paths:
+      - 'packages/desktop/**'
+      - '.github/workflows/desktop-ci.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-ci-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+env:
+  # Keep in step with desktop-dmg.yml, which builds the release with it.
+  RUST_TOOLCHAIN: '1.99.1'
+
+jobs:
+  check:
+    name: fmt, clippy, test
+    runs-on: macos-26
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Rust toolchain
+        run: |
+          rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal --component clippy --component rustfmt
+          rustup default "$RUST_TOOLCHAIN"
+          rustc --version
+          cargo --version
+
+      - name: Format
+        run: cargo fmt --check
+
+      # A test build bakes another installer in at compile time (option_env! in
+      # setup.rs), so neither variable may reach cargo.
+      - name: Clippy
+        run: |
+          unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH
+          cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Unit tests
+        run: |
+          unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH
+          cargo test --locked
+
+      # /bin/bash on macOS is 3.2, the bash these scripts run under on a Mac.
+      - name: Scripts parse on bash 3.2
+        run: |
+          for script in scripts/*.sh; do
+            /bin/bash -n "$script"
+          done

.github/workflows/desktop-dmg.yml

@@ -0,0 +1,399 @@
+name: macOS app
+
+# Builds Codeman.app (Apple Silicon + Intel), signs it with the Developer ID,
+# has Apple notarize the app and the DMG, and attaches Codeman.dmg and
+# Codeman.dmg.sha256 to a Codeman release. The asset name never changes, so
+# https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg always
+# serves the newest app.
+#
+# Release calls this when npm took a Codeman release, with tag codeman@<version>,
+# and it builds the release commit. By hand, once this file is on master:
+#   gh workflow run desktop-dmg.yml                          # dry run of master: artifacts only
+#   gh workflow run desktop-dmg.yml --ref <branch>           # dry run of a branch that carries this file
+#   gh workflow run desktop-dmg.yml -f tag=codeman@1.50.0    # rebuild that tag, replace its Codeman.dmg
+# Only a run on master (or Release itself) attaches anything; every run leaves
+# the signed Codeman.dmg as an artifact on its run page. A rebuild takes only a
+# Codeman release tag whose commit is on master ("Check the tag", in build and
+# in sign).
+#
+# A dispatch runs its ref's copy of this file with the secrets, as every
+# repository secret reaches anyone with write access. A GitHub Environment
+# limited to master would not narrow the rebuild path (the job's ref is master
+# while it runs the tag's scripts) and would refuse the branch dry run above;
+# the tag check is what keeps a rebuild on master's history.
+#
+# Three jobs, so no job that holds a secret runs code from a crate:
+# - build runs cargo, and with it the build script of every crate in
+#   Cargo.lock. It has a read-only token and nothing else: no secret, no cache.
+# - sign gets the built app as an artifact and runs only Apple's tools and this
+#   repository's scripts on it. It alone holds the signing and notary secrets.
+# - attach has the one token that can write to a release, and no secret.
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Release to attach Codeman.dmg to (codeman@x.y.z); empty attaches nothing
+        type: string
+        required: false
+        default: ''
+    secrets:
+      MACOS_CERT_P12:
+        description: The Developer ID Application certificate with its private key, a base64 .p12
+        required: true
+      MACOS_CERT_PASSWORD:
+        description: The .p12's password
+        required: true
+      APPLE_ID:
+        description: Apple ID of the developer team, for the notary service
+        required: true
+      APPLE_APP_PASSWORD:
+        description: An app-specific password for that Apple ID
+        required: true
+      APPLE_TEAM_ID:
+        description: The team ID the certificate belongs to
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to rebuild and attach to, e.g. codeman@1.50.0. Empty: dry run, artifacts only'
+        type: string
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+env:
+  # What the macos-26 image and the Mac mini that built every tested DMG both ran
+  # on 2026-11-08. Move it deliberately, together with desktop-ci.yml; Cargo.toml's
+  # rust-version is the floor.
+  RUST_TOOLCHAIN: '1.99.1'
+  # The commit to build: a rebuild by hand builds the tag it attaches to; Release
+  # (a push to master) and a dry run build the commit they ran on.
+  BUILD_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.tag != '' && format('refs/tags/{0}', inputs.tag) || github.sha }}
+
+jobs:
+  build:
+    name: Build Codeman.app
+    runs-on: macos-26
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.BUILD_REF }}
+          persist-credentials: false
+
+      # A rebuild by hand builds the tag it names, and sign then runs that tag's
+      # scripts with the Developer ID key unlocked. So the tag must be a Codeman
+      # release (another package's tag would put Codeman.dmg on its release), and
+      # its commit must be on master's history, where those scripts were reviewed.
+      # aicodeman@ is the tag a failed rename leaves (Release's retag step).
+      # A tag can move between jobs, so build and sign each check their own
+      # checkout. Inline on purpose: a script from the checkout would be the
+      # tag's own code. Kept the same as the step in sign.
+      - name: Check the tag
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          TAG_RE='^(ai)?codeman@[0-9]+\.[0-9]+\.[0-9]+$'
+          if ! [[ $TAG =~ $TAG_RE ]]; then
+            echo "::error::The tag input is not a Codeman release tag (codeman@x.y.z)"
+            exit 1
+          fi
+          SHA=$(git rev-parse HEAD)
+          # behind: an ancestor of master's tip; identical: the tip itself.
+          STATUS=$(gh api "repos/$GITHUB_REPOSITORY/compare/master...$SHA" --jq .status)
+          case "$STATUS" in
+            behind | identical) echo "$TAG ($SHA) is on master's history" ;;
+            *)
+              echo "::error::$TAG ($SHA) is not on master's history (compare says $STATUS)"
+              exit 1
+              ;;
+          esac
+
+      - name: Rust toolchain
+        run: |
+          rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal \
+            --target aarch64-apple-darwin --target x86_64-apple-darwin
+          rustup default "$RUST_TOOLCHAIN"
+          rustc --version
+          cargo --version
+
+      # A release installs Codeman from getcodeman.com/install and master. A test
+      # build bakes another installer in at compile time (option_env! in setup.rs),
+      # so neither variable may reach cargo here, and setup.rs's tests pin the default.
+      - name: Unit tests
+        working-directory: packages/desktop
+        run: |
+          unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH
+          cargo test --locked
+
+      - name: Bundle Codeman.app (signed ad hoc)
+        working-directory: packages/desktop
+        run: |
+          unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH SIGN_IDENTITY
+          ./scripts/bundle-macos.sh --universal
+
+      - name: Check the build
+        working-directory: packages/desktop
+        run: |
+          BIN=dist/Codeman.app/Contents/MacOS/codeman-desktop
+          lipo "$BIN" -verify_arch arm64 x86_64
+          codesign --verify --strict dist/Codeman.app
+          strings -a "$BIN" > "$RUNNER_TEMP/strings.txt"
+          if grep -E 'raw\.githubusercontent\.com|test/desktop-' "$RUNNER_TEMP/strings.txt"; then
+            echo "::error::A test installer URL or branch is baked into the app"
+            exit 1
+          fi
+          grep -q 'https://getcodeman.com/install' "$RUNNER_TEMP/strings.txt"
+
+      # ditto keeps the bundle's modes, symlinks and extended attributes; an
+      # artifact of the bare folder would not (upload-artifact sets every file to
+      # 644). The artifact is a zip around this zip: download-artifact unpacks the
+      # outer one and leaves the ditto zip as it was.
+      - name: Archive Codeman.app
+        run: |
+          mkdir -p "$RUNNER_TEMP/unsigned"
+          ditto -c -k --sequesterRsrc --keepParent packages/desktop/dist/Codeman.app "$RUNNER_TEMP/unsigned/Codeman.app.zip"
+
+      - name: Upload the unsigned app
+        uses: actions/upload-artifact@v7
+        with:
+          name: codeman-app-unsigned
+          path: ${{ runner.temp }}/unsigned/Codeman.app.zip
+          if-no-files-found: error
+          retention-days: 7
+          overwrite: true
+
+  sign:
+    name: Sign and notarize
+    needs: build
+    runs-on: macos-26
+    # Two notary submissions; each usually takes minutes, and sign-macos.sh
+    # gives each at most 45.
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    steps:
+      # For sign-macos.sh, make-dmg.sh and macos/entitlements.plist only. Nothing
+      # here builds or runs code from the app or its crates.
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.BUILD_REF }}
+          persist-credentials: false
+
+      # The same check as in build, on this job's own checkout, before anything
+      # here touches a secret. Kept the same as the step in build.
+      - name: Check the tag
+        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          TAG_RE='^(ai)?codeman@[0-9]+\.[0-9]+\.[0-9]+$'
+          if ! [[ $TAG =~ $TAG_RE ]]; then
+            echo "::error::The tag input is not a Codeman release tag (codeman@x.y.z)"
+            exit 1
+          fi
+          SHA=$(git rev-parse HEAD)
+          # behind: an ancestor of master's tip; identical: the tip itself.
+          STATUS=$(gh api "repos/$GITHUB_REPOSITORY/compare/master...$SHA" --jq .status)
+          case "$STATUS" in
+            behind | identical) echo "$TAG ($SHA) is on master's history" ;;
+            *)
+              echo "::error::$TAG ($SHA) is not on master's history (compare says $STATUS)"
+              exit 1
+              ;;
+          esac
+
+      - name: Download the unsigned app
+        uses: actions/download-artifact@v8
+        with:
+          name: codeman-app-unsigned
+          path: ${{ runner.temp }}/unsigned
+
+      # The build job ran every crate's build script, so its zip is checked before
+      # this job, which holds the secrets, unpacks it: entries only under
+      # Codeman.app/ (and the __MACOSX/ folder where ditto keeps attributes), no
+      # "..", and no symlink, which the app never has and which could point an
+      # unpack or a later write outside the app.
+      - name: Unpack Codeman.app
+        run: |
+          ZIP="$RUNNER_TEMP/unsigned/Codeman.app.zip"
+          ENTRIES=$(zipinfo -1 "$ZIP")
+          LISTING=$(zipinfo "$ZIP")
+          if printf '%s\n' "$ENTRIES" | grep -vE '^(Codeman\.app|__MACOSX)/' \
+            || printf '%s\n' "$ENTRIES" | grep -E '(^|/)\.\.(/|$)' \
+            || printf '%s\n' "$LISTING" | grep '^l'; then
+            echo "::error::The build artifact holds an entry outside Codeman.app, a '..' or a symlink"
+            exit 1
+          fi
+          mkdir -p "$RUNNER_TEMP/app"
+          ditto -x -k "$ZIP" "$RUNNER_TEMP/app"
+          if [ -n "$(find "$RUNNER_TEMP/app" -type l)" ]; then
+            echo "::error::The unpacked app holds a symlink"
+            exit 1
+          fi
+          test -x "$RUNNER_TEMP/app/Codeman.app/Contents/MacOS/codeman-desktop"
+
+      # A keychain of its own under RUNNER_TEMP, with a random password, holds the
+      # Developer ID key for the length of this job. The last step deletes it and
+      # the decoded .p12, whatever happened before. All five secrets are checked
+      # here, so a missing one stops the job before any work.
+      - name: Signing keychain
+        env:
+          MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
+          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          for name in MACOS_CERT_P12 MACOS_CERT_PASSWORD APPLE_ID APPLE_APP_PASSWORD APPLE_TEAM_ID; do
+            if [ -z "${!name}" ]; then
+              echo "::error::The repository secret $name is empty or not set"
+              exit 1
+            fi
+          done
+          KEYCHAIN="$RUNNER_TEMP/codeman-signing.keychain-db"
+          P12="$RUNNER_TEMP/codeman-signing.p12"
+          trap 'rm -f "$P12"' EXIT
+          KEYCHAIN_PASSWORD=$(openssl rand -hex 32)
+          echo "::add-mask::$KEYCHAIN_PASSWORD"
+
+          # Line breaks out first: an encoder that wraps its output (GNU base64
+          # without -w0) leaves some that macOS's base64 refuses.
+          printf '%s' "$MACOS_CERT_P12" | tr -d '\r\n ' | base64 --decode > "$P12"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          # Locks after six hours, not after the default five idle minutes, which
+          # a notarization wait can outlast.
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security import "$P12" -k "$KEYCHAIN" -f pkcs12 -P "$MACOS_CERT_PASSWORD" -T /usr/bin/codesign
+          rm -f "$P12"
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" > /dev/null
+          # First on the search list, ahead of the runner's own keychains.
+          SEARCH=()
+          while IFS= read -r line; do
+            line=${line#*\"}
+            line=${line%\"*}
+            if [ -n "$line" ]; then SEARCH+=("$line"); fi
+          done < <(security list-keychains -d user)
+          security list-keychains -d user -s "$KEYCHAIN" "${SEARCH[@]}"
+
+          # The identity by its SHA-1 hash, which no other certificate can match.
+          IDENTITIES=$(security find-identity -v -p codesigning "$KEYCHAIN")
+          MATCHES=$(printf '%s\n' "$IDENTITIES" | grep '"Developer ID Application: ' || true)
+          COUNT=$(printf '%s' "$MATCHES" | grep -c . || true)
+          if [ "$COUNT" != 1 ]; then
+            printf '%s\n' "$IDENTITIES"
+            echo "::error::MACOS_CERT_P12 holds $COUNT valid Developer ID Application identities; it needs exactly one"
+            exit 1
+          fi
+          HASH=$(printf '%s\n' "$MATCHES" | awk '{ print $2 }')
+          IDENTITY=$(printf '%s\n' "$MATCHES" | sed 's/^[^"]*"\(.*\)"$/\1/')
+          case "$IDENTITY" in
+            *"($APPLE_TEAM_ID)") ;;
+            *)
+              echo "::error::The certificate in MACOS_CERT_P12 ($IDENTITY) is not one of team APPLE_TEAM_ID"
+              exit 1
+              ;;
+          esac
+          echo "Signing as $IDENTITY ($HASH)"
+          echo "SIGN_IDENTITY=$HASH" >> "$GITHUB_ENV"
+
+      # The notary login goes to notarytool on its command line (sign-macos.sh's
+      # APPLE_ID path), in this job only, which already holds the signing key.
+      - name: Sign, notarize and staple
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: packages/desktop/scripts/sign-macos.sh "$RUNNER_TEMP/app/Codeman.app" "$RUNNER_TEMP/out"
+
+      # A dry run's result: codeman-dmg on the run page (gh run download <run-id>
+      # -n codeman-dmg). attach takes it from here too.
+      - name: Upload Codeman.dmg
+        uses: actions/upload-artifact@v7
+        with:
+          name: codeman-dmg
+          path: |
+            ${{ runner.temp }}/out/Codeman.dmg
+            ${{ runner.temp }}/out/Codeman.dmg.sha256
+          if-no-files-found: error
+          retention-days: 30
+          overwrite: true
+
+      - name: Remove the signing keychain
+        if: always()
+        run: |
+          KEYCHAIN="$RUNNER_TEMP/codeman-signing.keychain-db"
+          if [ -e "$KEYCHAIN" ]; then
+            security delete-keychain "$KEYCHAIN" || true
+          fi
+          rm -f "$KEYCHAIN" "$RUNNER_TEMP/codeman-signing.p12"
+
+  attach:
+    name: Attach to the release
+    needs: sign
+    # Release runs on pushes to master, so github.ref is master both there and for
+    # a rebuild started by hand on master. A dry run from any other branch, or a
+    # fork, attaches nothing.
+    if: inputs.tag != '' && github.ref == 'refs/heads/master' && github.repository == 'Ark0N/Codeman'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+    steps:
+      - name: Download Codeman.dmg
+        uses: actions/download-artifact@v8
+        with:
+          name: codeman-dmg
+          path: out
+
+      - name: Upload to the release
+        id: upload
+        working-directory: out
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REQUESTED_TAG: ${{ inputs.tag }}
+        run: |
+          sha256sum -c Codeman.dmg.sha256
+          TAG=$REQUESTED_TAG
+          # Release's retag step ignores its own errors, so a release whose rename to
+          # codeman@ failed still carries the tag changesets gave it.
+          if ! gh release view "$TAG" -R "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            case "$TAG" in
+              codeman@*) TAG="aicodeman@${TAG#codeman@}" ;;
+            esac
+            gh release view "$TAG" -R "$GITHUB_REPOSITORY" > /dev/null
+            echo "::warning::Attaching to $TAG: there is no release $REQUESTED_TAG"
+          fi
+          gh release upload "$TAG" Codeman.dmg Codeman.dmg.sha256 --clobber -R "$GITHUB_REPOSITORY"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Check the download links
+        working-directory: out
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.upload.outputs.tag }}
+        run: |
+          EXPECTED=$(cut -d' ' -f1 Codeman.dmg.sha256)
+          check() {
+            curl -fsSL --retry 6 --retry-delay 10 --retry-all-errors -o "$RUNNER_TEMP/served.dmg" "$1"
+            echo "$EXPECTED  $RUNNER_TEMP/served.dmg" | sha256sum -c --quiet -
+            echo "$1 serves this build"
+          }
+          check "https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/Codeman.dmg"
+          LATEST=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)
+          if [ "$LATEST" = "$TAG" ]; then
+            check "https://github.com/$GITHUB_REPOSITORY/releases/latest/download/Codeman.dmg"
+          else
+            echo "::warning::Latest is $LATEST, so releases/latest/download/Codeman.dmg does not serve $TAG"
+          fi

.github/workflows/release.yml

@@ -14,6 +14,11 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    outputs:
+      published: ${{ steps.changesets.outputs.published }}
+      # Set only when aicodeman itself was published: `published` is also true for
+      # a release that moved only xterm-zerolag-input.
+      codeman_version: ${{ steps.codeman.outputs.version }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -60,15 +65,98 @@ jobs:
           # 1.9.4 lost it to xterm-zerolag-input@0.1.7 by two seconds. All package
           # releases already exist by the time this step runs, so setting it here
           # is deterministic.
+          #
+          # The title and body are the page people land on from the update toast.
+          # changesets copied the body from CHANGELOG.md as one long bullet, so it is
+          # reshaped here (scripts/lib/release-notes.mjs). npm has already published by
+          # now, so a failure in that must not stop the retag below: without the body
+          # field the release keeps the text changesets wrote.
           RELEASE_ID=$(gh release view "$OLD_TAG" --json databaseId -q .databaseId 2>/dev/null || true)
           if [ -n "$RELEASE_ID" ]; then
+            NOTES_FILE="$RUNNER_TEMP/release-notes.md"
+            BODY_ARGS=()
+            if node scripts/generate-release-notes.mjs "$VERSION" > "$NOTES_FILE"; then
+              BODY_ARGS=(-F "body=@$NOTES_FILE")
+            else
+              echo "::warning::Keeping the changesets release notes for $VERSION"
+            fi
             gh api -X PATCH "repos/${{ github.repository }}/releases/${RELEASE_ID}" \
               -f tag_name="$NEW_TAG" \
-              -f name="$NEW_TAG" \
-              -f make_latest=true
+              -f name="Codeman ${VERSION}" \
+              -f make_latest=true \
+              "${BODY_ARGS[@]}"
           fi
 
           # Retag
           git tag "$NEW_TAG" "$OLD_TAG" 2>/dev/null || true
           git tag -d "$OLD_TAG" 2>/dev/null || true
           git push origin "$NEW_TAG" ":refs/tags/$OLD_TAG" 2>/dev/null || true
+
+      # The macOS app job below runs only for a Codeman release, so it reads the
+      # version from the list of packages this run published. Never fails the job:
+      # npm has published by now, and a bad list only means no app build.
+      - name: Codeman version published by this run
+        id: codeman
+        if: steps.changesets.outputs.published == 'true'
+        env:
+          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
+        run: |
+          VERSION=$(printf '%s' "$PUBLISHED_PACKAGES" | jq -r '.[] | select(.name == "aicodeman") | .version' || true)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Codeman version published: ${VERSION:-none (no macOS app build)}"
+
+      # releases/latest/download/Codeman.dmg (the Mac app's stable link) serves
+      # whichever release holds Latest. GitHub gives Latest to the release created
+      # last, and a publish that moved only xterm-zerolag-input creates one the
+      # retag above never touches, so Latest goes back to the newest Codeman
+      # release after every publish. A failure warns and leaves npm, the tag and
+      # the MCP publish alone.
+      - name: Keep Latest on the Codeman release
+        if: steps.changesets.outputs.published == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          RELEASE_ID=$(gh release view "codeman@${VERSION}" --json databaseId -q .databaseId 2>/dev/null || true)
+          if [ -z "$RELEASE_ID" ]; then
+            echo "::warning::No codeman@${VERSION} release to mark Latest"
+          elif ! gh api -X PATCH "repos/${{ github.repository }}/releases/${RELEASE_ID}" -f make_latest=true > /dev/null; then
+            echo "::warning::Could not mark codeman@${VERSION} Latest"
+          fi
+
+  # Its own job: this one alone holds id-token, and a registry failure shows as itself
+  # without touching the npm publish or the tag above.
+  mcp-registry:
+    name: MCP registry
+    needs: release
+    if: needs.release.outputs.published == 'true'
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/publish-mcp.yml
+
+  # Builds, signs and notarizes the Mac app and attaches Codeman.dmg to the
+  # release (.github/workflows/desktop-dmg.yml), only when Codeman itself was
+  # published. Its own job, so a failed DMG shows as itself and never touches
+  # npm, the tag or the MCP publish; `gh workflow run desktop-dmg.yml -f
+  # tag=codeman@<version>` reruns it. It gets the five secrets it uses and no
+  # other: never `secrets: inherit`, which would hand it NPM_TOKEN.
+  macos-app:
+    name: macOS app
+    needs: release
+    if: needs.release.outputs.codeman_version != ''
+    # The ceiling for the called jobs; only its attach job asks for write. A job in
+    # desktop-dmg.yml that asks for a permission not granted here (id-token or
+    # attestations for a provenance attestation, say) makes GitHub refuse this
+    # whole Release run at startup, npm publish included: widen both together.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/desktop-dmg.yml
+    with:
+      tag: codeman@${{ needs.release.outputs.codeman_version }}
+    secrets:
+      MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
+      MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

CLAUDE.md

@@ -103,7 +103,7 @@ Codeman is a Claude Code session manager with web interface and autonomous Ralph
 - **Default bind is loopback-only; non-loopback without a password starts but warns** — the server defaults to `--host 127.0.0.1`. Binding non-loopback (`--host`/`-H`/`CODEMAN_HOST`) without `CODEMAN_PASSWORD` starts anyway but prints a loud warning; `--allow-unauthenticated-network` / `CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK=1` acknowledges it. ⚠️ The production systemd unit passes no `--host`, so prod binds **localhost only**: reach it via `tailscale serve`/tunnel to `127.0.0.1`. A loopback bind is reachable through a same-host tunnel but NOT by a browser hitting the box's LAN IP. `install.sh` is separate and prompts for the binding (defaulting to LAN + a password), and preserves the existing binding on re-runs. → [architecture-invariants#default-bind-and-the-non-loopback-warning-path](docs/architecture-invariants.md#default-bind-and-the-non-loopback-warning-path), `docs/security-architecture.md`
 - **Instance isolation / multi-instance attach danger** — the data dir (`~/.codeman`) and tmux socket (`tmux -L codeman`) are PROCESS-WIDE and shared by every Codeman on the machine, derived from `CODEMAN_INSTANCE` via `src/config/instance.ts`. ⚠️ A 2nd instance on the SAME socket **discovers and attaches PTYs to the first instance's live sessions**, resizing and mutating them. `$HOME` isolation is NOT enough because tmux is system-global. To run two instances, give each a distinct `CODEMAN_INSTANCE` (scopes dir + socket together), or set `CODEMAN_TMUX_SOCKET` + `CODEMAN_DATA_DIR` individually; `scripts/run-beta.sh` does this for a beta alongside prod. **Any new `~/.codeman/...` path MUST go through `dataPath()`**, never `join(homedir(), '.codeman', …)`, and **any new `tmux -L` caller through `resolveTmuxSocketName()`** (both in `config/instance.ts`): the TUI shells out to tmux from a second process, and a hardcoded `codeman` there would point a beta instance at prod's panes. → [architecture-invariants#instance-isolation-and-the-multi-instance-attach-danger](docs/architecture-invariants.md#instance-isolation-and-the-multi-instance-attach-danger)
 - **The prefix table on Codeman's socket holds only `<prefix> send-prefix`** — browser tabs are tmux attach clients, and tmux's stock bindings let Ctrl+B `)`/`s` move a tab onto another session. `createSession` resets the table, and `reconcileSessions()` at boot for sessions that survived an upgrade (`src/tmux-prefix-table.ts`); `root` and `C-<letter> detach-client` (the TUI attach's way out) are left alone, so F1 and that alias reach browser tabs for the length of an attach. Alt+1..9 are `if-shell` bindings that `switch-client` only for the TUI's own client (`client_tty` plus a one-shot pid hook), so a browser tab's Esc-then-digit does not move it. Docker and owned-remote nested servers get the same reduction (`C-q send-prefix` only) in their create chain. ⚠️ So `Ctrl+B d` does not exist there: anything attaching a user's terminal claims its own detach key (F1 in `root`, as `codeman tui` and `scripts/tmux-manager.sh` do). → [architecture-invariants#the-prefix-table-on-codemans-socket-holds-only-send-prefix](docs/architecture-invariants.md#the-prefix-table-on-codemans-socket-holds-only-send-prefix)
-- **node-pty's macOS `spawn-helper` ships without `+x`** (issues #6, #204): `node-pty@1.1.0` publishes `prebuilds/darwin-<arch>/spawn-helper` as mode 0644, and macOS launches every PTY through it, so a stock macOS install fails every session start with `Error: posix_spawnp failed.` **Linux can never reproduce it**: `spawn-helper` is an `OS=="mac"` gyp target and node-pty ships no Linux prebuild, so node-gyp always emits an executable helper there. ⚠️ The flip side of that: since Linux has no prebuild, `npm install` **needs a C/C++ toolchain there** (`make`, `g++`, `python3`), so `install.sh` checks for and installs one alongside Node/tmux/git — a stock Ubuntu 24 server has none and died inside node-gyp with `not found: make`. Do not drop that step. (The installer's no-admin route cannot install one, so there it stops before downloading anything and names what is missing.) ⚠️ Look in **`prebuilds/<platform>-<arch>/`**, not just `build/Release/`, which does not exist on macOS. Repair is a chmod, never a mandatory rebuild (that would require Xcode CLI tools and deletes `prebuilds/` before compiling): `npm run fix:node-pty` chmods every helper then proves it by really opening a PTY. `spawnPtyWithHelperRepair()` (`utils/node-pty-repair.ts`) wraps every `pty.spawn()` in `session.ts` and self-heals a broken install on the first failure. → [architecture-invariants#node-ptys-macos-spawn-helper-must-be-executable](docs/architecture-invariants.md#node-ptys-macos-spawn-helper-must-be-executable)
+- **node-pty's macOS `spawn-helper` ships without `+x`** (issues #6, #204): `node-pty@1.1.0` publishes `prebuilds/darwin-<arch>/spawn-helper` as mode 0644, and macOS launches every PTY through it, so a stock macOS install fails every session start with `Error: posix_spawnp failed.` **Linux can never reproduce it**: `spawn-helper` is an `OS=="mac"` gyp target and node-pty ships no Linux prebuild, so node-gyp always emits an executable helper there. ⚠️ The flip side of that: since Linux has no prebuild, `npm install` **needs a C/C++ toolchain there** (`make`, `g++`, `python3`), so `install.sh` checks for and installs one alongside Node/tmux/git — a stock Ubuntu 24 server has none and died inside node-gyp with `not found: make`. Do not drop that step. ⚠️ Look in **`prebuilds/<platform>-<arch>/`**, not just `build/Release/`, which does not exist on macOS. Repair is a chmod, never a mandatory rebuild (that would require Xcode CLI tools and deletes `prebuilds/` before compiling): `npm run fix:node-pty` chmods every helper then proves it by really opening a PTY. `spawnPtyWithHelperRepair()` (`utils/node-pty-repair.ts`) wraps every `pty.spawn()` in `session.ts` and self-heals a broken install on the first failure. → [architecture-invariants#node-ptys-macos-spawn-helper-must-be-executable](docs/architecture-invariants.md#node-ptys-macos-spawn-helper-must-be-executable)
 - **User-chosen paths are probed BOUNDED, never with `existsSync`/`statSync`** (#516): a linked case or a `workingDir` can sit on a network mount that stopped answering. A synchronous check there freezes the whole server, and an unbounded async `stat`/`lstat`/`readFile` holds one of libuv's threadpool workers (4 by default, shared with every `fs`, `dns.lookup` and `crypto` call) until the mount returns. On a request or spawn path use `probePath()`/`probePathKind()` (`utils/bounded-path-probe.ts`, read its `@fileoverview`). ⚠️ `unknown` is NEVER `absent`: nothing is created, scaffolded or 404'd on it. Bulk scans keep the stall cap; a request for ONE path the user named may pass `{ pastCap: true }`, which still stops at the ceiling that keeps one worker free; and a helper that would otherwise touch the path skips whatever is still `unknown`. User-facing errors for it go through `describeUnknownPath()`, so a refused probe is not reported as a broken folder.
 - **Headless screenshots: `deviceScaleFactor` MUST be 1, and write unique filenames** — under DSF=2 xterm's WebGL renderer draws glyphs at ~2× nominal size while still *reporting* nominal cell dims, so only the pixels reveal it and only the terminal font looks wrong. And overwriting a fixed output path leaves OS image viewers showing the old render, which reads as "the fix didn't work"; `scripts/capture-real-overview.mjs` mints a timestamped filename per run. Seed the per-device `localStorage` keys (`codeman:skin`, `codeman-font-size`, `codeman-app-settings`) so the capture matches a real device. → [architecture-invariants#headless-screenshot-capture](docs/architecture-invariants.md#headless-screenshot-capture)
 
@@ -220,7 +220,7 @@ Codeman is a Claude Code session manager with web interface and autonomous Ralph
 **Terminal scrollback strip + wheel/touch forwarding**: codex/claude/gemini get the FULL strip (alt-screen, `3J`, mouse DECSETs); tmux-backed opencode and copilot get the MIDDLE strip (alt-screen toggles + mouse DECSETs, `3J` kept); every other tmux-backed mode (shell/antigravity/pi/grok/deepseek/omp) gets the NARROW strip (alt-screen toggles only). Table: `CliCapabilities.altScreen` JSDoc, pinned in test/claude-scrollback-strip.test.ts. ⚠️ Gated on `useMux`: direct-PTY sessions must keep the alt screen. Wheel and touch forward only with observed `cliMouseTracking`: **Claude ≥ 2.1.187, tracked Codex, or tracked Copilot**. Codex 0.163.0 fullscreen was measured with `alternate_on=1`, `mouse_any_flag=1`: one SGR report moves one transcript row; see the fresh measurement in architecture-invariants. Inline/untracked Codex retains local history or the capability-gated paging fallback. Copilot has no version gate; a stale/false tracking flag falls back to PageUp/PageDown. Touch alone has one more branch (`_shouldForwardTouchToApp`): in any mode, a drag also forwards as SGR wheel reports while xterm ITSELF tracks the mouse with SGR encoding (an app in the pane asked for it; a tracking mode other than `x10` and `coreMouseService.activeEncoding === 'SGR'`, so DEFAULT, X10 and SGR-pixel apps fail closed), because xterm encodes a wheel there but the touch listeners consume the drag. ⚠️ `getClaudeCliVersion()` must never cache a FAILED probe. ⚠️ Hand-report clicks only while the CLI has mouse tracking on: `_shouldReportMouseToCli()` gates all three report sites on `cliMouseTracking` (from `_recordStrippedMouseMode()`, session.ts), or a plain shell prints the reports as literal text. ⚠️ A `TerminalTile` (grid tile, split Pane B) forwards the wheel as SGR reports, pages it and reports clicks through these SAME gates with itself as the target (its terminal, its session, never `activeSessionId`), and scrolls Shift+wheel itself (xterm makes it a horizontal no-op); never copy the mode lists into terminal-tile.js. ⚠️ The hollow-buffer PageUp/PageDown fallback (`_maybePageCliTranscript`) stands down when the last capture reported tmux scrollback (`paneHistoryLines` > 0: a tail replayed after a server restart carries only the attach repaint), so the gesture scrolls locally and the scroll-to-top pull loads `full=1`; 0 and unknown keep paging. Read `_logScrollRouting()` before diagnosing a scroll report. → [architecture-invariants#terminal-scrollback-strip-flavors-and-wheeltouch-forwarding](docs/architecture-invariants.md#terminal-scrollback-strip-flavors-and-wheeltouch-forwarding)
 **Detached start + service install**: `codeman web -d` relaunches the same entry script `detached:true` (setsid); `nohup` is not what makes it survive. ⚠️ Both `-d` and `service install` must REFUSE when a server is already up on this data dir (pidfile + `/api/status` probe), or a second instance attaches to the first one's live sessions. ⚠️ Never report success not observed: poll `/api/status` until the child answers or dies. `--stop` must verify the pid still looks like Codeman (`ps -o command=`) before signalling. Unit/label names live only in `config/service-names.ts`. `service install` bakes the installing shell's PATH into the unit and never writes `CODEMAN_PASSWORD` into it. → [architecture-invariants#detached-start-and-service-install](docs/architecture-invariants.md#detached-start-and-service-install)
 
-**Self-update** (App Settings → System → Updates): in-app updater for git-clone installs under a supervisor (`systemd`, `launchd`, `launchd-daemon`, `docker-compose`, else `none`). The work runs in a DETACHED `scripts/self-update.sh` writing `update-status.json`, polled across the restart; pure helpers in `src/web/self-update.ts`. ⚠️ Compose: the restart kills the script, so nothing may be appended after the `restarting` marker; the repo must stay a host bind mount over `/opt/codeman` and the image must keep devDependencies + toolchain. ⚠️ `evaluateEnvironmentGate()` refuses releases that change `server.Dockerfile`/`docker-compose.yaml` or add `.env.example` keys, re-evaluated on `POST /api/system/update`; unknowns fail OPEN, but the exit-to-restart needs `--restart-by-exit 1` (`CODEMAN_RESTART_BY_EXIT=1` only in the Compose file). ⚠️ An install with no git checkout (`install.sh` on a machine without a working git leaves the marker `.install-source`) is kind `archive`: it cannot update in place, and both the check and the UI tell it to re-run the installer, never the npm line. ⚠️ Keep the agent CLIs in `server.Dockerfile` pinned. → [docs/docker-self-update.md](docs/docker-self-update.md), [architecture-invariants#self-update](docs/architecture-invariants.md#self-update)
+**Self-update** (App Settings → System → Updates): in-app updater for git-clone installs under a supervisor (`systemd`, `launchd`, `launchd-daemon`, `docker-compose`, else `none`). The work runs in a DETACHED `scripts/self-update.sh` writing `update-status.json`, polled across the restart; pure helpers in `src/web/self-update.ts`. ⚠️ Compose: the restart kills the script, so nothing may be appended after the `restarting` marker; the repo must stay a host bind mount over `/opt/codeman` and the image must keep devDependencies + toolchain. ⚠️ `evaluateEnvironmentGate()` refuses releases that change `server.Dockerfile`/`docker-compose.yaml` or add `.env.example` keys, re-evaluated on `POST /api/system/update`; unknowns fail OPEN, but the exit-to-restart needs `--restart-by-exit 1` (`CODEMAN_RESTART_BY_EXIT=1` only in the Compose file). ⚠️ Keep the agent CLIs in `server.Dockerfile` pinned. → [docs/docker-self-update.md](docs/docker-self-update.md), [architecture-invariants#self-update](docs/architecture-invariants.md#self-update)
 
 **Reverse-proxy base path** (`--base-url` / `CODEMAN_BASE_URL`, default `/`; pure single source `src/config/base-path.ts`, normalized to `''` or `/foo`): mounts Codeman under a sub-path behind a proxy that forwards the prefix unchanged. Few choke points: `stripBasePath()` in Fastify's `rewriteUrl` (routes stay prefix-agnostic; unprefixed requests still answer), one `onSend` hook rebasing `Location`, `renderIndexHtml` rewriting `<base href>` + injecting `window.__CODEMAN_BASE__`, and `CodemanBase.url()` (constants.js) for runtime URLs. ⚠️ Keep template asset refs RELATIVE, and route every root-absolute frontend URL (EventSource/WebSocket/`window.open`/src) through `CodemanBase.url()`. ⚠️ Web-tab proxy egress goes through `proxyPrefixFor(cap, basePath)`; ingress parsers stay base-agnostic. ⚠️ `--base-url` must ride `buildWebArgs` and `resolveServicePlan`. Tests: `test/base-path.test.ts`. → [architecture-invariants#reverse-proxy-base-path](docs/architecture-invariants.md#reverse-proxy-base-path)
 
@@ -319,7 +319,7 @@ One module per domain in `src/web/routes/` (plus a barrel; `ls src/web/routes/`
 
 ## State Files
 
-All in `~/.codeman/`: `state.json` (sessions, settings, respawn, orchestrator, cron jobs/runs, owner tab layouts, case default groups), `mux-sessions.json` (tmux recovery), `settings.json` (user prefs), `push-keys.json` + `push-subscriptions.json`, `session-lifecycle.jsonl` (audit log), `update-status.json` (self-updater progress, polled across the service restart), `docker-env-applied.json` (Compose deployment only: sha256 of the Dockerfile + compose file the running container was built from, written by `Start-Codeman.sh`, read by the self-updater's environment gate), `docker-build-source.json` (Compose deployment only: the checkout's HEAD commit and `package-lock.json` hash the `codeman-node-modules`/`codeman-dist` volumes currently reflect, written by both `Start-Codeman.sh` and a successful in-place self-update, compared to detect and refresh a volume left stale by an externally-triggered rebuild), `linked-cases.json`, `webviews.json` (saved web-tab dashboard URLs), `remote-hosts.json` + `remote-cases.json`, `docker-hosts.json` + `docker-cases.json` + `docker-exports/`, `subagent-window-states.json` + `subagent-parents.json` (subagent window layout, GET/PUT `/api/subagent-window-states`/`-parents`), `hook-secret` (per-instance), `users.json` (multi-user, mode 0600) + `admin-audit.jsonl`, `intents.json` (Read My Mind intent profiles, mode 0600), `agent-inbox.json` (agent inbox snapshot, only while `agentInboxPersistEnabled` is on, mode 0600), `edit-history/<id>.json` (Edit history panel, one store per session, every diff an agent wrote, mode 0600), `webhook.json` (webhook notifications: enabled/service/scope plus the ntfy/Slack/Discord URL, a bearer secret, so mode 0600, kept out of `settings.json` and never returned by `/api/webhook`, which is admin-only in multi-user mode), `discord.json` (Discord bridge: bot token, a bearer secret, so mode 0600, never returned by `/api/discord`, admin-only in multi-user mode) + `discord-bridge.json` (sessionId to Discord thread id), `config-backup-id` (the random id config backups record as each manifest's `origin`, so instances sharing a backup folder keep to their own snapshots; mode 0600, never tracked or restored, and deleting it unlists this instance's earlier snapshots), `backups/config/` (the default config-backup folder, moved by `configBackupDir`: `cfg-YYYYMMDD-HHMMSS/` snapshots, 0700 with 0600 files, each with a `manifest.json` of SHA-256s, the origin and the retention in force (`keepCount`/`keepDays`), which a pass falls back to when `settings.json` lacks a retention key), `certs/` (self-signed TLS for `--https`), `.env` (CODEMAN_USERNAME/PASSWORD fallback for the `codeman attach` CLI), `install.log` (installer step output, written by `install.sh`'s `run_step`) `tailscale-rename` (the node name before `install.sh` renamed it, so uninstall can offer it back) and `runtime/` (the Node.js and tmux `install.sh` downloaded on its no-admin route, linked from `~/.local/bin`; all three installer-route only). Transient: `self-update-runner.sh`. Multi-user case spaces live OUTSIDE the data dir at `~/codeman-users/<username>/cases` (shared across instances like `~/codeman-cases`, override `CODEMAN_USER_SPACES_DIR`).
+All in `~/.codeman/`: `state.json` (sessions, settings, respawn, orchestrator, cron jobs/runs, owner tab layouts, case default groups), `mux-sessions.json` (tmux recovery), `settings.json` (user prefs), `push-keys.json` + `push-subscriptions.json`, `session-lifecycle.jsonl` (audit log), `update-status.json` (self-updater progress, polled across the service restart), `docker-env-applied.json` (Compose deployment only: sha256 of the Dockerfile + compose file the running container was built from, written by `Start-Codeman.sh`, read by the self-updater's environment gate), `docker-build-source.json` (Compose deployment only: the checkout's HEAD commit and `package-lock.json` hash the `codeman-node-modules`/`codeman-dist` volumes currently reflect, written by both `Start-Codeman.sh` and a successful in-place self-update, compared to detect and refresh a volume left stale by an externally-triggered rebuild), `linked-cases.json`, `webviews.json` (saved web-tab dashboard URLs), `remote-hosts.json` + `remote-cases.json`, `docker-hosts.json` + `docker-cases.json` + `docker-exports/`, `subagent-window-states.json` + `subagent-parents.json` (subagent window layout, GET/PUT `/api/subagent-window-states`/`-parents`), `hook-secret` (per-instance), `users.json` (multi-user, mode 0600) + `admin-audit.jsonl`, `intents.json` (Read My Mind intent profiles, mode 0600), `agent-inbox.json` (agent inbox snapshot, only while `agentInboxPersistEnabled` is on, mode 0600), `edit-history/<id>.json` (Edit history panel, one store per session, every diff an agent wrote, mode 0600), `webhook.json` (webhook notifications: enabled/service/scope plus the ntfy/Slack/Discord URL, a bearer secret, so mode 0600, kept out of `settings.json` and never returned by `/api/webhook`, which is admin-only in multi-user mode), `discord.json` (Discord bridge: bot token, a bearer secret, so mode 0600, never returned by `/api/discord`, admin-only in multi-user mode) + `discord-bridge.json` (sessionId to Discord thread id), `config-backup-id` (the random id config backups record as each manifest's `origin`, so instances sharing a backup folder keep to their own snapshots; mode 0600, never tracked or restored, and deleting it unlists this instance's earlier snapshots), `backups/config/` (the default config-backup folder, moved by `configBackupDir`: `cfg-YYYYMMDD-HHMMSS/` snapshots, 0700 with 0600 files, each with a `manifest.json` of SHA-256s, the origin and the retention in force (`keepCount`/`keepDays`), which a pass falls back to when `settings.json` lacks a retention key), `certs/` (self-signed TLS for `--https`), `.env` (CODEMAN_USERNAME/PASSWORD fallback for the `codeman attach` CLI), `install.log` (installer step output, written by `install.sh`'s `run_step`) and `tailscale-rename` (the node name before `install.sh` renamed it, so uninstall can offer it back; both installer-route only). Transient: `self-update-runner.sh`. Multi-user case spaces live OUTSIDE the data dir at `~/codeman-users/<username>/cases` (shared across instances like `~/codeman-cases`, override `CODEMAN_USER_SPACES_DIR`).
 
 **Generated top-level dirs** (all gitignored — don't edit or commit): `dist/` (esbuild output), `out/`, `coverage/`, `test-results/`, `tmp/`, `screenshots-echo-diag/`. The committed gesture bundle (`src/web/public/gesture/gesture-codeman.js`) IS tracked, but its runtime wasm/model assets (`src/web/public/gesture/wasm/`, `*.task`) are fetched and gitignored.
 
@@ -384,6 +384,6 @@ Two constraints worth knowing before you touch them: the env-derived PTY buffer
 
 ## Scripts & Tunnel
 
-**`install.sh`** (repo root) is the public `curl | bash` installer: it installs Node/tmux/git/build tools, clones to `~/.codeman/app`, builds, and offers a systemd/launchd service, asking every question BEFORE the unattended build (log in `~/.codeman/install.log`). Network access is Tailscale / LAN / local-only; re-runs preserve the existing binding AND password (`read_existing_binding()`). ⚠️ Compose the hand-start env only in `start_command_hint`/`export_bind_env`, and call `stop_background_helpers` before `exec`. ⚠️ Tailscale rename is opt-in (default NO, never under `--yes`/non-interactive); NEVER `tailscale serve reset`, touch a mapping it did not create, run `tailscale funnel` or advertise a Service (`test/install-sh-invariants.test.ts`). ⚠️ **No-admin route** (`--no-admin` / `CODEMAN_NO_ADMIN`, taken by itself when the account has no administrator rights): Node.js (nodejs.org, checked against `SHASUMS256.txt`) and tmux (`tmux/tmux-builds`, digests pinned in `tmux_build_sha256`: bump `TMUX_BUILD_VERSION` and all four together) go into `~/.codeman/runtime`, and without a working git the source is an archive that updates by a re-run (built beside the old tree, swapped in after the build). Nothing in that section may run `sudo`, Homebrew or `xcode-select --install`, a download is verified before it is unpacked, the route is never decided by `sudo -v`, `/usr/bin/git` on a Mac is never executed before `xcode-select -p` proves the developer tools, and `no_admin_blocker` stops BEFORE the first download for what it cannot supply (a Linux toolchain, macOS below 15). ⚠️ Stay **bash 3.2** clean (no `declare -A`, `mapfile`, namerefs, `${x,,}`, here-strings, empty-array expansion under `set -u`). ⚠️ Execute only commands from the generated CLI block (`CLI_INSTALL_CMD_TRUSTED`, `npm run generate:cli-catalog`). ⚠️ Codeman Desktop drives it with no terminal (`--no-admin --progress --ai-cli <id>|none`, `install.sh preflight`, `install.sh agent <id>` to add one agent next to a running Codeman, `packages/desktop/src/gui_install.rs`): `cli_offerable` is the one rule for what can be installed, `preflight` stdout is JSON only, `agent` says `done` only when THAT agent landed, and the `progress_phase` order is pinned against `connect.html`, with `done` last. → [architecture-invariants#installsh-the-public-installer](docs/architecture-invariants.md#installsh-the-public-installer)
+**`install.sh`** (repo root) is the public `curl | bash` installer: it installs Node/tmux/git/build tools, clones to `~/.codeman/app`, builds, and offers a systemd/launchd service, asking every question BEFORE the unattended build (log in `~/.codeman/install.log`). Network access is Tailscale / LAN / local-only; re-runs preserve the existing binding AND password (`read_existing_binding()`). ⚠️ Compose the hand-start env only in `start_command_hint`/`export_bind_env`, and call `stop_background_helpers` before `exec`. ⚠️ Tailscale rename is opt-in (default NO, never under `--yes`/non-interactive); NEVER `tailscale serve reset`, touch a mapping it did not create, run `tailscale funnel` or advertise a Service (`test/install-sh-invariants.test.ts`). ⚠️ Stay **bash 3.2** clean (no `declare -A`, `mapfile`, namerefs, `${x,,}`, here-strings, empty-array expansion under `set -u`). ⚠️ Execute only commands from the generated CLI block (`CLI_INSTALL_CMD_TRUSTED`, `npm run generate:cli-catalog`). → [architecture-invariants#installsh-the-public-installer](docs/architecture-invariants.md#installsh-the-public-installer)
 
 Other key scripts: `scripts/tmux-manager.sh` (safe tmux mgmt), `scripts/tunnel.sh [quick|named] start|stop|status|url` (quick = random trycloudflare URL, default; `named setup|enable` = fixed-hostname tunnel via `scripts/codeman-tunnel-named.service`; bare `start|stop|url` still means quick), `scripts/run-beta.sh` (isolated beta instance), `scripts/build-agent-image.mjs` (docker base image), `scripts/self-update.sh` (detached updater). Production services: `scripts/codeman-web.service`, `scripts/codeman-tunnel.service`. **Always set `CODEMAN_PASSWORD`** before exposing via tunnel.

README.md

@@ -69,7 +69,6 @@ This installs Node.js, tmux and a build toolchain if missing (node-pty ships no
 - **How it's reachable, your choice.** **Tailscale** (loopback bind fronted by `tailscale serve`, so you get `https://<machine>.<tailnet>.ts.net` with a real certificate and your tailnet as the login, no password needed), **any device on your network** (`0.0.0.0`, with a strongly recommended password prompt), or **this machine only** (`127.0.0.1`, safest). Skipping the password on a network bind requires an explicit confirmation and ends with a loud warning. The highlighted default reflects what is already on the machine (Tailscale when it is already connected, your existing binding on a re-run), and a bare Enter never pulls in new software. If another app already owns `:443` on your node, Codeman goes under `https://<machine>.<tailnet>.ts.net/codeman` or on a second port instead of replacing it. A bare `codeman web` started by hand still defaults to loopback.
 - **The name is yours to choose.** By default the URL uses the machine's existing tailnet name. Answering yes to the second question renames the machine to `codeman-<hostname>` (which also renames it for SSH, so the default is no); `install.sh name` does it later.
 - **Re-run to update.** The same one-liner updates a finished install in place: local changes in `~/.codeman/app` are stashed (never discarded), and a running service is restarted and verified. If a first install was interrupted, re-running resumes the full setup instead. `install.sh status` prints the URLs and the QR code again; `install.sh update`, `install.sh tailscale` and `install.sh uninstall` also exist.
-- **No administrator rights needed.** On an account without `sudo` (or a Mac account that is not an administrator), the installer downloads Node.js from nodejs.org and the tmux project's own build into `~/.codeman/runtime`, each checked against its SHA-256, and takes the source as an archive when there is no working git. `--no-admin` forces that route. Two limits: Linux needs make, a C++ compiler and python3 to be there already, and the tmux download needs macOS 15 or newer. Details in the [wiki](https://github.com/Ark0N/Codeman/wiki/Installation#without-administrator-rights).
 - **Flags for the impatient.** `curl -fsSL https://getcodeman.com/install | bash -s -- --tailscale --service` answers the questions from the command line (`--lan`, `--local`, `--run`, `--no-start`, `--name <n>`, `--port <n>`, `--yes` too). **CI / headless:** without a terminal attached, steps that would change your system abort with instructions instead of running silently; set `CODEMAN_NONINTERACTIVE=1` to approve them for automation.
 
 You'll need at least one AI coding CLI installed — [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [OpenCode](https://opencode.ai), [Codex](https://developers.openai.com/codex/cli), [Antigravity](https://antigravity.google), [Gemini CLI](https://github.com/google-gemini/gemini-cli), [Pi](https://pi.dev), [Grok Build](https://github.com/xai-org/grok-build), [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness), [OMP](https://github.com/can1357/oh-my-pi), or [GitHub Copilot CLI](https://github.com/github/copilot-cli) (any combination works; Gemini CLI is enterprise-only since Google's consumer cutover, and Antigravity is its successor). The installer detects whichever of the ten is present; if none is found, it offers to install any of them from a menu (DeepSeek excepted, since its npm package installs only a launcher with no runnable profile), or you can skip and install one yourself later. After install:

docs/architecture-invariants.md

@@ -1297,16 +1297,6 @@ Its CLI knowledge is a GENERATED block (`npm run generate:cli-catalog`, markers
 
 ⚠️ It executes ONLY commands from the embedded block (`CLI_INSTALL_CMD_TRUSTED`) — there is no network fetch of the catalogue at install time to worry about at all.
 
-**No-admin route** (`--no-admin` / `CODEMAN_NO_ADMIN`, 2026-11-05). Everything Codeman writes was always under `$HOME`; administrator rights were only ever spent on prerequisites. `resolve_admin_mode` decides once per run whether those rights may be asked for: root yes; a Mac account outside the `admin` group no (unless a Homebrew it can write to exists); on Linux no without a `sudo` binary, or when the account is outside `sudo`/`wheel`/`admin` AND `sudo -n true` fails. ⚠️ It is never decided by `sudo -v`: that prompts, and a refused password from an account outside sudoers is reported to the administrator. A refused password on the system route offers this route instead of ending the run (`sudo_session_try`).
-
-On this route Node.js comes from nodejs.org (`latest-v<major>.x/SHASUMS256.txt` names the tarball AND carries its checksum, one fetch, no JSON parsing) into `~/.codeman/runtime/node`, and tmux from the tmux project's `tmux-builds` release into `~/.codeman/runtime/bin`. ⚠️ `tmux-builds` publishes no checksum file, so `tmux_build_sha256` pins all four digests of `TMUX_BUILD_VERSION`; bump the version and the digests together (the GitHub release API returns them as `digest`). ⚠️ A download is verified BEFORE it is unpacked or run, and an empty expected digest never passes. `node`, `npm`, `npx` and `tmux` are linked from `~/.local/bin` (`link_into_local_bin` refuses to replace a file that does not already point into the runtime, and uninstall removes only such links): the `codeman` launcher is `#!/usr/bin/env node`, and a non-interactive shell never reads the PATH line written to an interactive profile. The runtime's `node/bin` also goes on PATH and on the LaunchAgent's `svc_path`, since `npm install -g` puts AI CLIs beside that Node.js.
-
-⚠️ `no_admin_blocker` runs before the first download and stops for what this route cannot supply: a C/C++ toolchain on Linux (node-pty 1.1.0 compiles there; a node-pty with Linux prebuilds is what would lift this, and it is a dependency decision, not an installer one), musl, a platform nodejs.org or tmux-builds has no build for, and macOS below 15 (the tmux build's deployment target). ⚠️ Nothing between the "No-admin route" header and "End of the no-admin route" may run `sudo`, `ensure_sudo`, `run_as_root`, Homebrew or `xcode-select --install`; `run_as_root` itself refuses while `NO_ADMIN=1`, so a missed call site fails instead of prompting.
-
-**Driving the installer from a program** (`--ai-cli`, `--progress`, `install.sh preflight`, 2026-11-06). Codeman Desktop installs with no terminal: it runs `install.sh --no-admin --service --progress --ai-cli <id>|none` with `CODEMAN_NONINTERACTIVE=1` and its stdin closed, and asks the two questions in its own window (`packages/desktop/src/gui_install.rs`). `--ai-cli` answers the agent menu, so the one thing `CODEMAN_NONINTERACTIVE` used to decide by itself (the first entry of the catalogue) is the user's. ⚠️ `cli_offerable` is the ONE rule for what can be installed here: the menu, `--ai-cli` and `preflight`'s `installable` all read it, so the app's list and the menu cannot disagree. A name that is not offerable here warns and carries on, and never falls back to another CLI; a typo dies in `parse_flags` before anything runs. `install.sh agent <id>` installs one CLI and nothing else, for Codeman Desktop's *Add a coding agent*: no service, no source, no build, so it may run next to a live server, and an agent already there is a success that runs nothing. ⚠️ It calls `run_offered_cli`, checks `CLI_FOUND_PATH` of that one entry itself and only then prints `done`: `install_offered_cli`'s gate is fatal only when NO CLI is left, which is right for a first install and would report success here, where another CLI is usually present. ⚠️ The app passes `--no-admin` to both `preflight` and `agent`, because that flag decides what `cli_offerable` allows; pinned in `gui_install.rs`. ⚠️ The app runs it from a folder of its own (`Run::Agent`), so `ps` never reads an agent run as "Codeman is being installed". A running server remembers a missing CLI for up to 5 minutes (`cliResolveRetryDelayMs`), and only the CLI management routes clear that, so the app says so on its last screen and never restarts the service for it. ⚠️ `preflight` prints only JSON on stdout and changes nothing; `schema` moves only when a field changes meaning, because the app ships on its own and refuses a number it does not know. Fields may be added freely. ⚠️ `progress_phase` writes to stderr, not stdout, because a function can run inside a `$( )` that captures stdout. The phases must stay in the order of `PHASES` in `connect.html` (pinned by test), `done` must stay the last thing `main()` reports, since a run that ends without it failed, and an unknown phase is ignored by the app, so a new phase needs no new app. ⚠️ `error()` carries the text as `@@codeman error`, and the app shows the FIRST one: the ones after it are consequences (`Installation failed. Partial...`).
-
-⚠️ **git is judged by whether it works, never by `command -v`.** On a Mac without the Xcode Command Line Tools `/usr/bin/git` is a stub that opens Apple's install dialog, so `check_git` judges that path by `xcode-select -p` and never executes it; any other git is asked for `--version`. `scripts/git-hooks.mjs` has the matching guard (no `.git`, no `git` call), because postinstall runs it on every `npm install`. Without a working git the source is an archive (`fetch_source_archive`, GitHub's `archive/<ref>.tar.gz` or `CODEMAN_TARBALL_URL`) and the install directory carries the marker `.install-source`, which `detectInstallKind` reads as `archive` (the name is pinned across both files by `test/install-sh-invariants.test.ts`). ⚠️ An archive install is replaced as a WHOLE, never patched in place: nothing says which files a newer version dropped, and a stale `src/*.ts` would be compiled. The new tree is fetched and built in `<install dir>.new` and `finish_source_swap` moves it into place only after `npm run build` succeeded, so a failed update leaves the running install untouched; a re-run on a machine that has gained a working git stages a clone instead, which turns the install back into a git one. ⚠️ `download`/`download_to_stdout` resolve `DOWNLOADER` themselves (`require_downloader`): only `main()` used to set it, so a subcommand that downloads died on `set -u` with the message swallowed by the step log.
-
 ## Agent inspection and guarded submission
 
 These three operations are experimental across both CLI and HTTP, including the

docs/releasing.md

@@ -19,19 +19,70 @@ When user says "COM":
 
    Replace `patch` with `minor` or `major` as needed. Include `"xterm-zerolag-input": patch` on a separate line if that package changed too.
 
+   **Write it in the shape the release page is built from.** `CHANGELOG.md` keeps changesets' format, and the `Release` workflow rebuilds the GitHub release from that section (`scripts/generate-release-notes.mjs`, which also titles it `Codeman <x.y.z>`). The in-app update toast reads the same bold lead-ins:
+
+   ```markdown
+   ### Thanks
+   - @someone for what they did (#123).
+
+   **What the change does for the user (#123).** Two or three plain sentences.
+
+   **Fixes.**
+   - **What works now (#124).** What was wrong. Behaviour change: what a user has to do differently.
+
+   **Fixes applied while landing.** One sentence each.
+
+   **Docs and tests.** One sentence.
+   ```
+
+   `### Thanks` stays first and opens the page. A bold lead-in that ends in punctuation becomes a heading under What's new, so make it a short headline. `**Fixes.**` and its list become a Fixes section, and the last two labels share an Also in this release section (the labels are `SECTION_LABELS` in `scripts/lib/whats-new.mjs`). `Behaviour change:` and `Breaking:` are put in bold wherever they appear, so use those words for anything a user has to act on. Keep each change short: how it works belongs in the docs, and a long paragraph is a wall of text even under a heading. Text the script does not recognise stays on the page as plain paragraphs. After step 3, `node scripts/generate-release-notes.mjs` prints the page. If the workflow warns that it kept the changesets notes, fix the changelog and run `gh release edit codeman@<x.y.z> --notes-file <file>`.
+
 3. **Consume the changeset**: `npm run version-packages` (auto-bumps `package.json` files, updates `CHANGELOG.md`, runs `npm install --package-lock-only`, and verifies lockfile sync via `scripts/check-lockfile-sync.mjs` — all in one command; never hand-edit `CHANGELOG.md` or `package-lock.json` versions. It also writes `src/web/public/whats-new.json` (`scripts/generate-whats-new.mjs`): the bold lead-in of each change in the new `CHANGELOG.md` section, which the browser announces once per version in a toast. Commit it with the release; `test/whats-new.test.ts` fails when its version differs from `package.json`, so a hand bump needs `node scripts/generate-whats-new.mjs && npx prettier --write src/web/public/whats-new.json` too. A release whose notes have no bold lead-ins ships an empty list and shows no toast)
 4. **Sync CLAUDE.md version**: Update the `**Version**` line in the root `CLAUDE.md` (under COM Shorthand) to match the new version from `package.json`
 5. **Commit and deploy**: verify the branch first (`git branch --show-current`), then stage EXPLICIT paths — never `git add -A`, which has swept another session's WIP into a release. `git status --short` and account for every line before committing:
    `git add <paths> && git commit -m "chore: version packages" && git push && npm run build && systemctl --user restart codeman-web`
 6. **Refresh the getcodeman.com version badge**: the landing page's status bar carries the release version (`v<x.y.z> · getcodeman.com · MIT`), so it goes stale on every release if nobody bumps it. The site source and its deploy script are maintained outside this repository, on the maintainer's machine only; follow the local site handbook there, which also covers the numbers strip and `sitemap.xml` refresh that belong in the same pass. Poll production (`curl -s https://getcodeman.com/ | grep v<x.y.z>`) before calling it done, since the edge lags a deploy by up to a minute. Not applicable to contributor clones — skip it and say so.
-7. **Wait for CI**: after `git push`, TWO workflows fire per master push — `CI` and `Release` (the npm publish + GitHub release). List both runs for the pushed commit with `gh run list --commit $(git rev-parse HEAD) --json databaseId,workflowName` and watch EACH with `gh run watch <id> --exit-status`. Confirm both pass before considering the release done (`gh run list -L 1` returns only one of the two).
 
-8. **Publish the new version to the MCP registry**: `codeman mcp` is listed in the official MCP registry as `io.github.Ark0N/codeman`, and the registry does not follow npm, so every release is published there by hand or the listing stays on the old version. `npm run version-packages` has already written the new version into `config/mcp-registry/server.json` (`scripts/sync-plugin.mjs`). Wait until npm serves it (`npm view aicodeman version`; it can lag the green `Release` run by several minutes), because the registry checks that the npm package exists and carries `mcpName: io.github.Ark0N/codeman`. Then run `cd config/mcp-registry && mcp-publisher publish`, preceded by `mcp-publisher login github` when the saved login has expired, signed in as the account that owns the `io.github.Ark0N/` namespace. Use mcp-publisher 1.8.1 or newer (`mcp-publisher --version`), the release binary from https://github.com/modelcontextprotocol/registry/releases: the Snap Store package is stuck at 1.1.0 and rejects the current `$schema` with a false "deprecated schema detected", so never edit `server.json` for that error. Older publishers also save their login as `.mcpregistry_github_token` and `.mcpregistry_registry_token` (live tokens) in the current directory; move those out of the repo, never commit them. Confirm with `curl -s 'https://registry.modelcontextprotocol.io/v0/servers?search=io.github.Ark0N/codeman' | jq -r '.servers[] | "\(.server.version) latest=\(._meta["io.modelcontextprotocol.registry/official"].isLatest)"'`: the new version must be the one with `latest=true`. Maintainer only (it needs that GitHub account); contributor clones skip it and say so.
+   A site change that links the Mac app (`Codeman.dmg`, `/mac`) deploys only after step 7 showed the `macOS app` job green and the [DMG check](#the-mac-app-codemandmg) answered 200: the DMG reaches the release well after the npm publish, and the download link answers 404 until then.
+
+7. **Wait for CI**: after `git push`, TWO workflows fire per master push: `CI` and `Release` (the npm publish, the GitHub release, the MCP registry publish and, when Codeman itself was published, the `macOS app` job that attaches `Codeman.dmg`). List both runs for the pushed commit with `gh run list --commit $(git rev-parse HEAD) --json databaseId,workflowName` and watch EACH with `gh run watch <id> --exit-status`. Confirm both pass before considering the release done (`gh run list -L 1` returns only one of the two).
+
+8. **Check the MCP registry**: `codeman mcp` is listed in the official MCP registry as `io.github.Ark0N/codeman`, and the registry does not follow npm, so every release is published there. The `Release` workflow does this itself in its `MCP registry` job (`.github/workflows/publish-mcp.yml`): it waits until npm serves the version, because the registry checks that the npm package exists and carries `mcpName: io.github.Ark0N/codeman`, signs in with the workflow's GitHub OIDC token (no secret, no browser) and publishes the `config/mcp-registry/server.json` that `npm run version-packages` wrote (`scripts/sync-plugin.mjs`). A version the registry already has is skipped. Confirm with `curl -s 'https://registry.modelcontextprotocol.io/v0/servers?search=io.github.Ark0N/codeman' | jq -r '.servers[] | "\(.server.version) latest=\(._meta["io.modelcontextprotocol.registry/official"].isLatest)"'`: the new version must be the one with `latest=true`. If the job failed, `gh workflow run publish-mcp.yml` publishes the version on master again. Its publisher is pinned: bump `MCP_PUBLISHER_VERSION` and `MCP_PUBLISHER_SHA256` together, the digest from the release's asset. The local fallback is `cd config/mcp-registry && ~/.local/bin/mcp-publisher login github && ~/.local/bin/mcp-publisher publish`, signed in as the account that owns the `io.github.Ark0N/` namespace, with mcp-publisher 1.8.1 or newer, the release binary from https://github.com/modelcontextprotocol/registry/releases: the Snap Store package is stuck at 1.1.0 and rejects the current `$schema` with a false "deprecated schema detected", so never edit `server.json` for that error. Older publishers also save their login as `.mcpregistry_github_token` and `.mcpregistry_registry_token` (live tokens) in the current directory; move those out of the repo, never commit them.
 
 9. **Announce it in Discussions**: every release gets a post in the [Announcements](https://github.com/Ark0N/Codeman/discussions/categories/announcements) category, shaped like #418 and #302: the short version first (one bold lead-in per theme, features before fixes, what it does for the user rather than how it works), contributor @-mentions inline where their work is described (a mention notifies them, and a contributor reposting is the cheapest reach this project has), a link to the release, and the Thanks names at the end. Casual first-person voice, no em-dashes, humanizer pass when the skill is available. A same-day follow-on patch (1.28.1 after 1.28.0) is folded into the previous post as an edit, never a second thread. Post it with `gh api graphql -F body=@<file> -f title='Codeman <x.y.z>: <hook>' -f repo=R_kgDOQ-SMDg -f cat=DIC_kwDOQ-SMDs4DCHZE -f query='mutation($repo:ID!,$cat:ID!,$title:String!,$body:String!){createDiscussion(input:{repositoryId:$repo,categoryId:$cat,title:$title,body:$body}){discussion{number url}}}'` (the repo's node id and its Announcements category id; `pinDiscussion` does not exist in the API, so pinning stays a click in the UI). This step exists because announcements stopped at 1.18 (#302) while ten releases shipped with nobody notified; #418 is the backfill covering 1.19.0 to 1.28.1, and release notes only count as content once they reach a surface people are subscribed to.
 
 CI runs `npm run check:lockfile` on every push/PR, so lockfile drift fails the build even if the `version-packages` script is bypassed.
 
+## The Mac app (Codeman.dmg)
+
+Every Codeman release carries the native macOS app (`packages/desktop`) as `Codeman.dmg` plus `Codeman.dmg.sha256`. The name never changes, so https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg always serves the newest app, while each release keeps its own copy at `https://github.com/Ark0N/Codeman/releases/download/codeman@<x.y.z>/Codeman.dmg` (link that one in release notes). The app keeps its own version (`packages/desktop/Cargo.toml`), so the DMG of Codeman 1.50.0 holds app 0.1.0.
+
+**How it gets there.** When npm took a Codeman release (not one that moved only xterm-zerolag-input), the `Release` run's `macOS app` job calls `.github/workflows/desktop-dmg.yml` with the tag `codeman@<x.y.z>`. It has three jobs, so no job that holds a secret runs code from a crate: `build` runs `cargo test --locked` and `bundle-macos.sh --universal` on the release commit with a read-only token and no secret; `sign` imports the Developer ID certificate into a throwaway keychain and runs `packages/desktop/scripts/sign-macos.sh`, which signs the app with the hardened runtime, has Apple notarize it, staples the ticket, builds the DMG around it and signs, notarizes and staples that too; `attach` uploads both files to the release (`--clobber`) and checks that the download links serve those bytes. The release job's `Keep Latest on the Codeman release` step puts the Latest badge back on the newest `codeman@` release after every publish, since the stable link follows that badge.
+
+**The secrets** are repository secrets, passed to the job by name (never `secrets: inherit`, which would hand it `NPM_TOKEN`): `MACOS_CERT_P12` (the Developer ID Application certificate WITH its private key, exported from Keychain Access as a .p12, then `base64 -i <file>.p12`), `MACOS_CERT_PASSWORD` (the export password), `APPLE_ID`, `APPLE_APP_PASSWORD` (an app-specific password for that Apple ID, made at account.apple.com) and `APPLE_TEAM_ID`. A Developer ID certificate lasts five years; its successor replaces the first two secrets and nothing else.
+
+**Check it before anything links to it.** The DMG lands after a universal build and two notary submissions, so well after the npm publish, and until then the stable link answers 404:
+
+```bash
+gh release view codeman@<x.y.z> --json assets -q '.assets[].name'   # Codeman.dmg and Codeman.dmg.sha256
+curl -sIL -o /dev/null -w '%{http_code}\n' https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg   # 200
+```
+
+**Dry run.** `gh workflow run desktop-dmg.yml` builds, signs and notarizes master and attaches nothing; `gh workflow run desktop-dmg.yml --ref <branch>` does the same for a branch that carries the workflow (GitHub starts a manual run only for a workflow file that is also on master). The signed DMG is the run's `codeman-dmg` artifact (`gh run download <run-id> -n codeman-dmg`). For a first-launch test, download it on a Mac through the browser from the run page instead, so the copy is quarantined like one from a release.
+
+**Rebuild a release's DMG.** `gh workflow run desktop-dmg.yml -f tag=codeman@<x.y.z>`, started from master (the only ref allowed to attach), builds that tag and replaces its `Codeman.dmg`. It works for any release that carries `packages/desktop/scripts/sign-macos.sh`. The tag must be a Codeman release tag (`codeman@x.y.z`, or the `aicodeman@x.y.z` a failed rename leaves) whose commit is on master's history: `build` and `sign` both refuse anything else before they run its scripts, since `sign` runs them with the signing key unlocked. A failed job is also retried in place with `gh run rerun <run-id> --failed`.
+
+**If notarization fails.** The `Sign and notarize` job's log names the submission and prints Apple's log for it (`xcrun notarytool log <id>` with the same login shows it again).
+
+- `HTTP status code: 401` (invalid credentials) or `403` (a required agreement is missing or has expired) at the first submission: a new Apple ID password revokes every app-specific password, so make a new one and update `APPLE_APP_PASSWORD`, or accept the new agreement at developer.apple.com, then `gh run rerun <run-id> --failed`.
+- `0 valid Developer ID Application identities` in the `Signing keychain` step: the .p12 lacks its private key or holds another certificate type. A team mismatch there means `APPLE_TEAM_ID` names another team than the certificate.
+- `In Progress` at the 45-minute limit, or a network error: Apple's service was slow. Rerun the failed job.
+- `Invalid`: Apple's log names the file and the reason (a binary without the hardened runtime or a secure timestamp, an entitlement it refuses). That is a code fix and a new release. Until then keep the stable link on the last app that passed, `gh release edit codeman@<previous> --latest`, and hold any site change that links the new one.
+
+**By hand on a Mac**, only when the workflow cannot be fixed in time: in a clean checkout of the tag, `env -u CODEMAN_DESKTOP_INSTALLER_URL -u CODEMAN_DESKTOP_INSTALL_BRANCH packages/desktop/scripts/bundle-macos.sh --universal`, then `SIGN_IDENTITY="Developer ID Application: ..." NOTARY_PROFILE=<profile> packages/desktop/scripts/sign-macos.sh packages/desktop/dist/Codeman.app <out-dir>` (a profile saved with `xcrun notarytool store-credentials`), then `gh release upload codeman@<x.y.z> <out-dir>/Codeman.dmg <out-dir>/Codeman.dmg.sha256 --clobber`. Never upload a build made with either of those two variables set: it installs Codeman from the test branch it names.
+
+**Toolchain and runner.** `desktop-dmg.yml` and the pull-request check `desktop-ci.yml` (`cargo fmt --check`, clippy with `-D warnings` and `cargo test --locked` on macOS, for changes under `packages/desktop`) both pin `RUST_TOOLCHAIN` and run on `macos-26`. Move them together.
+
 ## Security notices
 
 A security notice is a sticky warning card about something outside Codeman that its users should act on (the first: OpenCode's Console breach, October 2026). On a browser that gets the release's update toast it appears inside that toast instead, so nobody sees it twice. Notices live in `src/web/public/security-notices.json`, which is maintained BY HAND; never put one in `whats-new.json`, which `npm run version-packages` rewrites. A notice reaches users only with a release, so add it before the COM that should carry it.

docs/wiki/Installation.md

@@ -78,8 +78,6 @@ install.sh uninstall    # remove (offers to undo a rename it performed)
 install.sh tailscale    # retrofit Tailscale access onto an existing install
 install.sh name [<n>]   # rename this machine on your tailnet (default codeman-<hostname>)
 install.sh cloudflared  # install cloudflared for the in-app Cloudflare tunnel
-install.sh preflight    # print what is on this machine as JSON; changes nothing
-install.sh agent <id>   # install one agent CLI and nothing else, also next to a running Codeman
 ```
 
 **Flags** answer the questions from the command line and pipe through `bash -s --`:
@@ -96,65 +94,14 @@ the name, `--service` / `--run` / `--no-start` the last one. `--yes` takes every
 `--port <n>` moves Codeman off 3000; the service file and the serve mapping follow it. On an
 existing install, `--port` and `--password` re-run the setup so the service file picks them up,
 and a re-run with `--lan` or `--tailscale` keeps the password the service already has.
-`--ai-cli <id>` answers the agent menu that appears when no agent CLI is found, with no
-terminal needed (`--ai-cli claude`, `--ai-cli codex`, ...), and `--ai-cli none` skips it.
-To add an agent later, `install.sh agent codex` installs that one and changes nothing else:
-it does not touch Codeman or its service, and an agent that is already there is left alone.
-Codeman Desktop does the same from *Add a coding agent*. A running Codeman can take a few
-minutes to notice the new agent; reload the page if it does not show up.
 
 **Automation and CI**: with no terminal attached, any step that would change the system
 aborts with instructions instead of running silently. Set `CODEMAN_NONINTERACTIVE=1` to
-approve those steps. With nothing else said, that also installs the first agent CLI of the
-catalogue when none is found; `--ai-cli` (or `CODEMAN_AI_CLI`) says which one, or none.
-`CODEMAN_TAILSCALE=1` preselects the Tailscale answer, and never
+approve those steps. `CODEMAN_TAILSCALE=1` preselects the Tailscale answer, and never
 installs Tailscale itself non-interactively; a non-interactive run never renames the
 machine and never starts a service. Everything the unattended steps print goes to
 `~/.codeman/install.log`, and the last lines of it are shown when a step fails.
 
-### Without administrator rights
-
-Codeman itself always lived in your home directory. What used `sudo` (or Homebrew on a
-Mac) were the things it needs first. On an account that has no administrator rights the
-installer says so in its summary (`Admin  not used (...)`) and gets those another way:
-
-| Needed                  | With administrator rights    | Without                                                                                                                             |
-| ----------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| Node.js 22              | system package or Homebrew   | The official tarball from nodejs.org, checked against the `SHASUMS256.txt` published beside it, unpacked to `~/.codeman/runtime/node`. |
-| tmux                    | system package or Homebrew   | The tmux project's own build ([tmux-builds](https://github.com/tmux/tmux-builds)), checked against a SHA-256 pinned in the installer, in `~/.codeman/runtime/bin`. |
-| git                     | system package or Xcode tools | Not installed. Without a working git, the source is downloaded as an archive instead of cloned.                                     |
-| Build toolchain (Linux) | system package               | Cannot be supplied. See below.                                                                                                      |
-
-This route is taken by itself when `sudo` is not installed, when the account is outside the
-`sudo`, `wheel` and `admin` groups and `sudo` will not run without a password, when the
-`sudo` password is refused, and on a Mac for an account that is not an administrator.
-`--no-admin` (or `CODEMAN_NO_ADMIN=1`) forces it on an account that does have the rights;
-`CODEMAN_NO_ADMIN=0` switches the detection off. Nothing on this route runs `sudo`,
-Homebrew or the Xcode tools installer.
-
-What to know about it:
-
-- **Linux needs make, a C++ compiler and python3 to be there already.** node-pty compiles
-  from source on Linux, and a compiler is a system package. The installer checks this
-  before it downloads anything and names what is missing. macOS needs no compiler.
-- **The tmux download needs macOS 15 or newer** (and x86_64 or arm64 on either system).
-  On an older Mac an administrator has to install tmux once (`brew install tmux`); the
-  rest then works without one.
-- **An install without git updates by re-running the install line**, not from App
-  Settings. The re-run builds the new version beside the old one and swaps it in only
-  after the build succeeded, so a failed download or build leaves the install as it was.
-  Once the machine has a working git, the next re-run turns the install into a normal
-  clone and in-app updates work again. On a Mac, "a working git" means the Xcode Command
-  Line Tools are installed: without them `/usr/bin/git` only opens Apple's install dialog,
-  and the installer never runs it.
-- **Tailscale works where it is already installed and your account may configure it.** On
-  Linux, installing it, logging in and granting serve rights each need an administrator
-  (`sudo tailscale set --operator=$USER`, once). Local network and this-machine access
-  need nothing, and `install.sh cloudflared` puts `cloudflared` in `~/.local/bin`.
-- `node`, `npm`, `npx` and `tmux` are linked from `~/.local/bin`, and
-  `~/.codeman/runtime/node/bin` is added to your PATH, so a CLI installed with
-  `npm install -g` is found as well.
-
 ## Route B: npm
 
 ```bash
@@ -247,7 +194,6 @@ If the dashboard loads and **+ New Session** opens, you are done. Continue to
 | Path                    | What                                                                                             |
 | ----------------------- | ------------------------------------------------------------------------------------------------ |
 | `~/.codeman/app`        | The installed code (installer route only).                                                        |
-| `~/.codeman/runtime`    | Node.js and tmux, when the installer downloaded them instead of using system packages ([no administrator rights](#without-administrator-rights)). |
 | `~/.codeman/`           | All state: `state.json`, settings, session history, push keys, TLS certs. See [Core Concepts](Core-Concepts). |
 | `~/codeman-cases/`      | Cases created from scratch. Linked cases stay wherever they already are.                          |
 | `~/.codeman/web.log`    | Log for a detached (`-d`) server.                                                                 |
@@ -271,7 +217,6 @@ Full detail, including logs and the self-updater, is in
 | Install route | How to update                                                     |
 | ------------- | ----------------------------------------------------------------- |
 | Installer     | Re-run the one-liner, or **App Settings → System → Updates** in the UI. |
-| Installer, without git | Re-run the one-liner. The in-app updater says so instead of offering an update. |
 | npm           | `npm update -g aicodeman`                                          |
 | git clone     | `git pull && npm install && npm run build`, then restart.          |
 | Docker Compose | Re-run `Start-Codeman.sh`. The in-app updater works too, and refuses a release that changes the container definition until you re-run the script. |
@@ -287,9 +232,7 @@ install.sh uninstall            # installer route
 npm uninstall -g aicodeman      # npm route
 ```
 
-The installer route asks before it removes `~/.codeman/runtime` (the Node.js and tmux it
-downloaded, if any), and keeps it by default when you installed CLIs there with
-`npm install -g`. Neither removes `~/.codeman/` or `~/codeman-cases/`. Delete those by hand if you want the
+Neither removes `~/.codeman/` or `~/codeman-cases/`. Delete those by hand if you want the
 state and your case folders gone as well, and check `~/codeman-cases/` first: linked cases
 point at directories you already had, but cases created from scratch have their only copy
 there.

package-lock.json

@@ -63,7 +63,7 @@
         "exceljs": "4.4.0",
         "fflate": "0.8.3",
         "pixelmatch": "^6.0.0",
-        "playwright": "^1.64.1",
+        "playwright": "^1.58.0",
         "pngjs": "^7.0.0",
         "postcss": "^8.5.15",
         "prettier": "^3.4.0",
@@ -9736,32 +9736,50 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.64.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.1.tgz",
-      "integrity": "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==",
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
+      "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.64.1"
+        "playwright-core": "1.60.0"
       },
       "bin": {
         "playwright": "cli.js"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.64.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz",
-      "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==",
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
+      "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
     "node_modules/pngjs": {

package.json

@@ -133,7 +133,7 @@
     "exceljs": "4.4.0",
     "fflate": "0.8.3",
     "pixelmatch": "^6.0.0",
-    "playwright": "^1.64.1",
+    "playwright": "^1.58.0",
     "pngjs": "^7.0.0",
     "postcss": "^8.5.15",
     "prettier": "^3.4.0",

packages/desktop/README.md

@@ -28,9 +28,9 @@ cannot do.
 
 | | |
 | --- | --- |
-| **This Mac** | The connect screen's first tab looks for Codeman on this Mac and offers what fits: *Open Codeman* when it runs, *Start Codeman* when it is installed but stopped, *Install Codeman on this Mac* when it is not there. The address comes from Codeman's LaunchAgent (port, sub-path, HTTPS). The tab also finds every Codeman server of yours that already runs on this Mac (with `ps` and `lsof`: a `codeman web --port 4000` in a terminal, a beta instance beside the installed one) and recommends connecting to it. Each one's address is worked out from its listening socket and its command line (`127.0.0.1` for a bind to loopback or to every interface, its own address for a bind to one, `https` with `--https`, the path of `--base-url`), and each is asked once whether Codeman answers there. When nothing answers at the usual address (the LaunchAgent's, or `http://127.0.0.1:3000` without one), *Open Codeman* is for the first found server that does; when none of them can be opened, the tab says *Codeman is already running on this Mac* and lists them. Next to a Codeman that answers, the others are listed under *Also running on this Mac*. A row shows the address, the version, and a *Connect* button, or the reason the app cannot open that one (HTTPS with Codeman's own certificate, no answer). *Connect* is the connect of the Another machine tab with that address filled in: the same check, the login saved for it, the same entry under recent servers. Finding a server connects to nothing by itself. The tab never offers to start a second server, which would take over the first one's sessions, and Start refuses while one runs. A server that runs but listens nowhere yet (the first seconds after login, a restart) shows as *starting*: the tab looks again every second and, when a connect to this Mac had just been refused, opens Codeman once it is up. Start asks launchd to run the LaunchAgent (`kickstart`, or `bootstrap` when it is not loaded), so the server keeps its own settings and supervision; without a LaunchAgent it runs `codeman web -d`. The login comes from where Codeman keeps it: the LaunchAgent's `CODEMAN_USERNAME`/`CODEMAN_PASSWORD`, else `~/.codeman/.env` (what Codeman's command-line clients read), `admin` by default. It goes only to `127.0.0.1` on that Codeman's port, only while one of your own Codeman processes holds that port, is never saved to the Keychain, and never reaches the page. Whether Codeman is installed is looked up in its files and processes, then the login shell; the interactive profile (nvm in `.zshrc`, say) only on *Check again*. Install sets Codeman up from the app itself, with no Terminal and no password (see Decisions). It fetches the installer, asks it what is on this Mac, then asks two things: which coding agent to install, only when this Mac has none (the list comes from the installer, and *Skip for now* is there), and who can reach Codeman (this Mac only, or the local network with a password). A checklist follows the install, the installer's output is one click away, and Cancel stops it; installing again picks up where it stopped. Codeman runs as a LaunchAgent, so it keeps running when the app quits and starts at login. Port 3000 is used unless something else answers there, then the next free one. Closing the app does not stop an install: it runs on its own, and the app picks it up when it opens again. When it is done the app looks every 3 seconds and opens Codeman as soon as it answers; it stops looking after the first answer, after 30 minutes, or 90 seconds after a finished install whose server never answered (then it offers Start). *Install in Terminal instead* runs the installer in a Terminal window, for what the app cannot do (see Known limits): it may ask for the Mac password (Homebrew) and asks its own questions there. The app offers it by itself on a Mac where the graphical install cannot finish. An install still running in Terminal is recognized by its process, so the tab waits for it instead of offering Install twice. *Add a coding agent*, on this tab and in the app menu whenever Codeman is on this Mac, is the same chooser after the install: pick one agent, watch it install, open Codeman. It needs no password, leaves a running Codeman alone, and can be cancelled or left running like an install. After *Skip for now* the app says Codeman has no agent yet and offers this before it opens Codeman. |
+| **This Mac** | The connect screen's first tab looks for Codeman on this Mac and offers what fits: *Open Codeman* when it runs, *Start Codeman* when it is installed but stopped, *Install Codeman on this Mac* when it is not there. The address comes from Codeman's LaunchAgent (port, sub-path, HTTPS). When nothing answers there but one of your own Codeman servers runs (found with `ps` and `lsof`: a `codeman web --port 4000` in a terminal, say), the tab opens that one, or says where it listens; it never offers to start a second server, which would take over the first one's sessions, and Start refuses while one runs. A server that runs but listens nowhere yet (the first seconds after login, a restart) shows as *starting*: the tab looks again every second and, when a connect to this Mac had just been refused, opens Codeman once it is up. Start asks launchd to run the LaunchAgent (`kickstart`, or `bootstrap` when it is not loaded), so the server keeps its own settings and supervision; without a LaunchAgent it runs `codeman web -d`. The login comes from where Codeman keeps it: the LaunchAgent's `CODEMAN_USERNAME`/`CODEMAN_PASSWORD`, else `~/.codeman/.env` (what Codeman's command-line clients read), `admin` by default. It goes only to `127.0.0.1` on that Codeman's port, only while one of your own Codeman processes holds that port, is never saved to the Keychain, and never reaches the page. Whether Codeman is installed is looked up in its files and processes, then the login shell; the interactive profile (nvm in `.zshrc`, say) only on *Check again*. Install opens Terminal with Codeman's installer (`install.sh --local --service --port N`): it may ask for the Mac password (Homebrew, Node.js, tmux) and which AI coding tools to set up, then Codeman runs as a LaunchAgent, so it keeps running when the app quits and starts at login. *Also reach it from my phone and other computers* drops `--local`, and the installer asks how (Tailscale, or the local network with a password). Port 3000 is used unless something else answers there, then the next free one. While the installer runs, the app looks every 3 seconds and opens Codeman as soon as it answers; it stops looking after the first answer, after 30 minutes, or 90 seconds after a finished install whose server never answered (then it offers Start). An install still running in Terminal is recognized by its process, so the tab waits for it instead of offering Install twice. |
 | **Another machine** | The second tab connects to a server by address (below). *Codeman is not installed there yet?* opens Terminal, connects with `ssh -t` and runs Codeman's installer on that machine, which asks its questions there; the app then suggests `http://<host>:3000` and the installer prints the real address at the end. The SSH login is checked to the characters of a user and host name (no option can be slipped in) and may carry a `:port`. The remote command runs under `bash -o pipefail`, so a failed download fails the install instead of reporting success. The same tab shows the one-line install command, with a Copy button, to run on a machine by hand. |
-| **Connect screen** | Server address, recent servers, a login for password-protected servers (password kept in the macOS Keychain), auto-connect at launch. An address typed without `http://` or `https://` gets `http://`, except a tailnet name with no port (`machine.tailnet.ts.net`, which is `tailscale serve`), which gets `https://`. It explains each failure: nothing listening; wrong password; too many failed logins (the password field stays open, since a single-user Codeman accepts the right password even then); unknown host name; an address this Mac cannot reach (with a pointer to the Local Network setting); an `http://` address on a port that only speaks HTTPS; an untrusted certificate; a redirect, with a button for the suggested `https://` address; not a Codeman server. A multi-user account that must change its password connects, and Codeman's own dialog asks for the new one. If the server page has not started showing within 15 seconds, or you press Cancel while it opens, the connect screen comes back with a notice. A login that would cross the network over plain `http://` to another machine says so. Return opens or starts the Codeman on this Mac (or connects to the one found here, when that is the tab's main button) and Esc cancels a connect, as in a Mac dialog (Install always takes a click). On a Mac whose WebKit is too old for Codeman it says so and Connect stays off (see Known limits). |
+| **Connect screen** | Server address, recent servers, a login for password-protected servers (password kept in the macOS Keychain), auto-connect at launch. An address typed without `http://` or `https://` gets `http://`, except a tailnet name with no port (`machine.tailnet.ts.net`, which is `tailscale serve`), which gets `https://`. It explains each failure: nothing listening; wrong password; too many failed logins (the password field stays open, since a single-user Codeman accepts the right password even then); unknown host name; an address this Mac cannot reach (with a pointer to the Local Network setting); an `http://` address on a port that only speaks HTTPS; an untrusted certificate; a redirect, with a button for the suggested `https://` address; not a Codeman server. A multi-user account that must change its password connects, and Codeman's own dialog asks for the new one. If the server page has not started showing within 15 seconds, or you press Cancel while it opens, the connect screen comes back with a notice. A login that would cross the network over plain `http://` to another machine says so. Return opens or starts the Codeman on this Mac and Esc cancels a connect, as in a Mac dialog (Install always takes a click). On a Mac whose WebKit is too old for Codeman it says so and Connect stays off (see Known limits). |
 | **Start Codeman** | On the This Mac tab, and when `http://127.0.0.1:<port>` or `http://localhost:<port>` answers nothing, one click runs `codeman web -d` (or `~/.codeman/app`) with your login shell's environment, so the server gets your real PATH (Homebrew, nvm) for the agents it spawns. zsh, bash and other POSIX shells run the start themselves; fish, nu, xonsh, tcsh and other shells only report their environment, and the start runs under `/bin/sh` with it. Offered for those two addresses only: `codeman web -d` listens on 127.0.0.1. |
 | **Login** | The app answers the server's HTTP Basic login requests itself, with the login you connected with, so the page keeps working after the server restarts (a restart forgets every session cookie). It answers only for Codeman's own pages under the server's base path: a web tab or a rendered HTML file that asks for a Basic login of its own is left to WebKit and never gets your Codeman password. WebKit keeps no copy of the login, so every request for it gets the current one. Each connect first clears the app's cookies, so connecting to the same server as another user really switches users (local storage, where Codeman keeps its per-device settings, stays; a dashboard in a web tab that keeps its own login in a cookie may ask for it again). A page that still gets a 401 reloads once. If the server refuses the login (the password was changed, say), the app does not keep sending it: it checks it with a single probe, and only if the server refuses that too does the connect screen come back with a notice. That does not take focus from the app you are in: if Codeman is in the background, its Dock icon bounces. |
 | **Dialogs** | Codeman's `confirm()`, `prompt()` and `alert()` (Delete case, Kill all sessions, Update Codeman, discarding unsaved edits, ...) show as native macOS dialogs. wry implements none of them, and without them WKWebView answers Cancel without showing anything. Each dialog's first line names the page it comes from, and says so when that is an embedded frame (a web tab, a rendered HTML preview), so a frame cannot pass its text off as Codeman's. |
@@ -61,11 +61,6 @@ root, `npm run test:browser -- test/desktop-connect-page.browser.test.ts` drives
 Content-Security-Policy the app serves it with. It is part of the nightly
 browser suite, not of `npm test`.
 
-To try a change to `install.sh` before it is merged, build with
-`CODEMAN_DESKTOP_INSTALLER_URL` (where to get the installer) and
-`CODEMAN_DESKTOP_INSTALL_BRANCH` (the branch it installs from) set. Both are
-read at compile time: a shipped app cannot be pointed at another installer.
-
 The script builds with `--locked` against the committed `Cargo.lock`, targets
 the macOS version in `macos/Info.plist` (`LSMinimumSystemVersion`, 11.3), and
 takes the binary from where cargo says it wrote it, so `CARGO_TARGET_DIR` and a
@@ -145,52 +140,19 @@ classes of wry's own delegates, so wry stays an unmodified crates.io dependency.
 - `codeman web -d` gets the port and base path as separate arguments, never as
   shell text.
 
-**The app runs the installer itself; Terminal is the fallback.** `install.sh
---no-admin` puts Node.js and tmux in the home folder, so a This Mac install needs
-no password and therefore no terminal, and the two questions only a person can
-answer arrive as flags (`src/gui_install.rs`). The app downloads the installer
-once to a private folder, asks it what is on this Mac (`install.sh preflight`,
-which prints JSON and changes nothing) and draws its choices from that answer.
-So the app has no list of coding agents of its own: a new one appears without a
-new app, and the list always matches what the installer can really install
-here. The installer runs with the login shell's environment, so it finds what
-this person already has. The page sends only the agent's id, whether other
-devices may reach Codeman, and that password; the password reaches the
-installer through its environment, never its command line, where `ps` shows it.
-
-**The install outlives the app.** Its output goes to a file, never a pipe, and
-it runs in a process group of its own. With a pipe, quitting the app would kill
-the installer at its next write; in the app's group, launchd would kill it with
-the app. The file holds the whole run, so a page that was reloaded, or an app
-that was opened again, finds the process in `ps` and replays the file from the
-first line. That is why the app keeps no state about a run. A run that ends
-without the installer's last `done` line failed, and the first error it reported
-is the one shown: the ones after it are consequences.
-
-**Adding an agent is a run of its own.** `install.sh agent <id>` installs one
-agent and touches neither Codeman nor its service, so it may run next to a live
-server, which an install must refuse: the installer's service step would replace
-that server under its sessions. It has its own temporary folder, so `ps` tells the
-two apart: everything that reads a running install takes it to mean "Codeman is
-being installed", which an agent run does not. One run goes at a time, since both
-can write to the runtime folder. It asks `preflight` for the list like an install
-does, and both pass `--no-admin`: that flag decides which agents count as
-installable, so without it on both the page could offer one the run refuses. The
-menu item is on the connect page because that is where the app may run things:
-from a Codeman page it leaves the page the way *Switch Server* does.
-
-**Terminal stays for what the app cannot do.** The route with Homebrew asks for
-the administrator password on a terminal, the Xcode tools arrive as a system
-dialog, and ssh asks about host keys and passwords on a terminal too. The app
-writes a short script to the per-user temporary folder (mode 0700, created
-fresh, deleted by the script as it starts) and opens it with `open -b
-com.apple.Terminal`, which needs no permission; scripting Terminal with
-osascript would ask for Automation access. The script prints what it runs. A
-This Mac install downloads the installer to a temporary file and runs it from
-there, so the installer's input is the terminal. Everything in the scripts is
-built and unit-tested in `src/setup.rs`; the page sends only which install it
-wants, whether other devices should reach it, and the SSH login, which is
-checked before it is quoted.
+**The installer runs in Terminal, not inside the app.** `install.sh` asks for
+the administrator password on a terminal (Homebrew, its sudo keep-alive), the
+Xcode tools arrive as a system dialog, and ssh asks about host keys and
+passwords on a terminal too, so an install without one fails on the first
+fresh Mac. The app writes a short script to the per-user temporary folder
+(mode 0700, created fresh, deleted by the script as it starts) and opens it
+with `open -b com.apple.Terminal`, which needs no permission; scripting
+Terminal with osascript would ask for Automation access. The script prints
+what it runs. A This Mac install downloads the installer to a temporary file
+and runs it from there, so the installer's input is the terminal. Everything in
+the scripts is built and unit-tested in `src/setup.rs`; the page sends only
+which install it wants, whether other devices should reach it, and the SSH
+login, which is checked before it is quoted.
 
 **This Mac's own login comes from where Codeman keeps it.** A Codeman
 installed with a password keeps it in its LaunchAgent (`install.sh`) or in
@@ -206,8 +168,7 @@ with Codeman stopped, whatever else listens there never gets it.
 data directory and tmux socket attach to each other's live sessions, and
 `codeman web -d` only notices a server it started itself or one at the same
 address. So the app looks for running Codeman servers of this user (`ps`)
-before it offers or runs a start, and offers to connect to the ones it finds
-instead (`found_addresses` in `src/setup.rs`, unit-tested).
+before it offers or runs a start, and opens the one it finds instead.
 
 **Closing the main window quits the app.** Codeman's sessions keep running on
 the server, so nothing is lost, and reopening takes about a second.
@@ -215,9 +176,7 @@ the server, so nothing is lost, and reopening takes about a second.
 **One reachability probe per user action, and one to check a refused login.**
 Codeman counts a request without valid credentials against its login rate
 limit (10 per IP, 15 minutes; a successful login resets the count), so the app
-never retries in a loop. A look at this Mac asks each Codeman server found
-here once; the app has a login only for the one at the usual address, so the
-others are asked without one. Once the server refuses the login in a challenge, the
+never retries in a loop. Once the server refuses the login in a challenge, the
 app sends it only once more, in the single probe that checks the refusal. If
 that probe is refused or rate limited, the connect screen comes back; the
 app does not send the refused login again. Keeping no copy of the login in WebKit has a cost here: after a server
@@ -230,30 +189,6 @@ and the Dock icon bounces.
 
 ## Known limits
 
-- **A new agent can take a few minutes to show up in a running Codeman.** The
-  server remembers that a CLI is missing, for up to 5 minutes after it last looked
-  (`cliResolveRetryDelayMs`), so that a status poll never spawns a login shell. The
-  app cannot clear that from outside, so the screen after *Add a coding agent* says
-  so. An open Codeman page also needs a reload, because the list of installed
-  agents is part of the page.
-- **Agents the app can add are the ones `--no-admin` can install.** OMP's macOS
-  install is Homebrew, so it is not offered, also on a Mac that has Homebrew.
-- **Agents that install with npm use whichever Node.js the login shell finds.**
-  With the Node.js the installer downloaded, or Homebrew's, that folder is yours.
-  The nodejs.org installer leaves `/usr/local/lib/node_modules` to root, so those
-  agents would be expected to fail there, with npm's permission error shown, while
-  the ones with their own installer still work. This has not been tried.
-- **Only your own Codeman servers on this Mac are found, by their command
-  line.** A server another macOS user runs, or one in a container or a virtual
-  machine, is not listed: connect to it by address under Another machine. A
-  base path that a server started by hand has only in its environment
-  (`CODEMAN_BASE_URL`) is not visible either, so its row has the address
-  without the path; the LaunchAgent's base path is read from its job.
-- **A found server that is slow to answer shows as not answering.** Next to a
-  Codeman that answers, each other server gets two seconds (five when nothing
-  answers at the usual address). A password-protected one counts the
-  look as a failed login, like any look at a server the app has no login for.
-  *Check again* asks again.
 - **Self-signed HTTPS is refused.** A server started with `codeman web --https`
   uses a self-signed certificate, and WKWebView rejects it (wry has no trust
   override). Use `http://127.0.0.1:3000` for a server on this Mac. For another
@@ -278,10 +213,12 @@ and the Dock icon bounces.
   Anyway* in System Settings > Privacy & Security (it asks for an administrator
   password). On macOS 14 and earlier, right-click it and choose *Open* once.
   Either way, `xattr -dr com.apple.quarantine /Applications/Codeman.app` on the
-  copy in Applications works too. Shipping it to other people needs a Developer
-  ID signature and notarization:
-  `SIGN_IDENTITY="Developer ID Application: ..." ./scripts/bundle-macos.sh --dmg`,
-  then `xcrun notarytool submit` and `xcrun stapler staple`.
+  copy in Applications works too. The `Codeman.dmg` on each GitHub release is
+  signed with a Developer ID and notarized by CI
+  (`.github/workflows/desktop-dmg.yml`), so it skips all of this. To do the
+  same by hand:
+  `SIGN_IDENTITY="Developer ID Application: ..." NOTARY_PROFILE=<profile> ./scripts/bundle-macos.sh --universal --notarize`,
+  where `scripts/sign-macos.sh` lists what it needs.
 - **Local Network permission (macOS 15 and later).** The first connection to an
   address on the local network (a LAN IP, a `.local` name) makes macOS ask
   whether Codeman may use the local network, and that first attempt can fail
@@ -323,21 +260,6 @@ and the Dock icon bounces.
 - **No desktop notifications yet.** WKWebView has no Web Notification API.
   Native notifications are the first item on the list below.
 - **No service worker.** Codeman works without it; it is only an offline cache.
-- **The graphical install needs macOS 15, or a tmux that is already there.**
-  tmux comes from the tmux project's own builds, which need macOS 15. On an
-  older Mac without tmux the app says so and offers Terminal, where Homebrew
-  installs it (that takes an administrator once).
-- **Who can reach it stops at the local network.** Tailscale needs its own
-  login and setup, which the installer does at a terminal. Choose *Install in
-  Terminal instead*, or run `install.sh tailscale` later.
-- **An agent is chosen during the install, or added later.** With Codeman
-  already installed, or after *Skip for now*, *Add a coding agent* on the This
-  Mac tab (*Add a Coding Agent to This Mac…* in the app menu) installs one. The
-  commands are also in [Installing an agent CLI](../../docs/wiki/Installation.md#installing-an-agent-cli).
-- **An agent only your interactive profile finds counts as missing.** The app
-  reads the login shell's environment, without `.zshrc`, so a CLI on an nvm
-  PATH set up there is offered again as if it were not installed. Installing
-  it again is harmless; *Skip for now* leaves it as it is.
 - **Installing from the app is macOS only so far**, and installing on another
   machine needs ssh access to it and `curl` or `wget` there. The app does not
   know when a remote install is done or which address it chose: the installer
@@ -358,4 +280,4 @@ and the Dock icon bounces.
 - Trusting a self-signed server certificate by its fingerprint.
 - Asking before a download that a rendered HTML file or a web tab starts.
 - A way out of a page that keeps opening dialogs (a "block further dialogs" option).
-- Windows and Linux builds, a CI job that builds the `.dmg`, notarization, auto-update.
+- Windows and Linux builds, auto-update.

packages/desktop/scripts/bundle-macos.sh

@@ -4,6 +4,8 @@
 #   packages/desktop/scripts/bundle-macos.sh            # this Mac's architecture
 #   packages/desktop/scripts/bundle-macos.sh --universal --dmg
 #   SIGN_IDENTITY="Developer ID Application: ..." packages/desktop/scripts/bundle-macos.sh --dmg
+#   SIGN_IDENTITY="Developer ID Application: ..." NOTARY_PROFILE=<profile> \
+#     packages/desktop/scripts/bundle-macos.sh --universal --notarize
 #
 # Without SIGN_IDENTITY the app is signed ad hoc: it runs on the Mac that built
 # it, and a copy downloaded on another Mac is stopped by Gatekeeper. On macOS 15
@@ -11,6 +13,15 @@
 # Privacy & Security; on macOS 14 and earlier, right-click it and choose Open.
 # Or run `xattr -dr com.apple.quarantine /Applications/Codeman.app` on the copy
 # in /Applications. A Developer ID signature + notarization avoids all of this.
+#
+# --dmg writes dist/Codeman-<version>.dmg, signed with SIGN_IDENTITY when it is
+# set. --notarize hands the built app to scripts/sign-macos.sh, which signs it
+# with SIGN_IDENTITY, has Apple notarize it, staples the ticket to it and does
+# the same for dist/Codeman.dmg, the DMG built around it (so --dmg is implied).
+# sign-macos.sh's header lists what it needs: SIGN_IDENTITY, and NOTARY_PROFILE
+# or APPLE_ID, APPLE_APP_PASSWORD and APPLE_TEAM_ID. The release workflow
+# (.github/workflows/desktop-dmg.yml) runs this script ad hoc in one job and
+# sign-macos.sh in another, so the job that runs cargo holds no secret.
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
@@ -18,14 +29,21 @@ cd "$(dirname "$0")/.."
 
 UNIVERSAL=0
 DMG=0
+NOTARIZE=0
 for arg in "$@"; do
   case "$arg" in
     --universal) UNIVERSAL=1 ;;
     --dmg) DMG=1 ;;
+    --notarize) NOTARIZE=1 ;;
     *) echo "unknown option: $arg" >&2; exit 2 ;;
   esac
 done
 
+if [ "$NOTARIZE" = 1 ]; then
+  # Checked before the build, so a missing secret costs seconds, not a build.
+  ./scripts/sign-macos.sh --check
+fi
+
 VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -1)
 [ -n "$VERSION" ] || { echo "could not read the version from Cargo.toml" >&2; exit 1; }
 
@@ -98,13 +116,13 @@ codesign --verify --strict "$APP"
 
 echo "Built $(pwd)/$APP ($(du -sh "$APP" | cut -f1), version $VERSION, macOS $MACOSX_DEPLOYMENT_TARGET or later)"
 
-if [ "$DMG" = 1 ]; then
-  STAGE="$WORK/dmg"
-  mkdir -p "$STAGE"
-  cp -R "$APP" "$STAGE/"
-  ln -s /Applications "$STAGE/Applications"
+if [ "$NOTARIZE" = 1 ]; then
+  ./scripts/sign-macos.sh "$APP" dist
+elif [ "$DMG" = 1 ]; then
   DMG_PATH="dist/Codeman-$VERSION.dmg"
-  rm -f "$DMG_PATH"
-  hdiutil create -quiet -volname "Codeman" -srcfolder "$STAGE" -ov -format UDZO "$DMG_PATH"
+  ./scripts/make-dmg.sh "$APP" "$DMG_PATH"
+  if [ -n "${SIGN_IDENTITY:-}" ]; then
+    codesign --force --timestamp --sign "$SIGN_IDENTITY" "$DMG_PATH"
+  fi
   echo "Built $(pwd)/$DMG_PATH ($(du -sh "$DMG_PATH" | cut -f1))"
 fi

packages/desktop/scripts/make-dmg.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Put Codeman.app in a compressed disk image next to a link to /Applications,
+# so opening the image shows the app and the folder to drag it into.
+#
+#   packages/desktop/scripts/make-dmg.sh <Codeman.app> <out.dmg>
+#
+# bundle-macos.sh (--dmg) and sign-macos.sh both call it, so a local test DMG
+# and the release DMG are laid out the same way. It signs nothing.
+set -euo pipefail
+
+[ "$(uname -s)" = Darwin ] || { echo "make-dmg.sh runs on macOS only" >&2; exit 1; }
+[ $# -eq 2 ] || { echo "usage: $0 <Codeman.app> <out.dmg>" >&2; exit 2; }
+
+APP=$1
+DMG=$2
+[ -d "$APP/Contents/MacOS" ] || { echo "$APP is not an app bundle" >&2; exit 2; }
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+STAGE="$WORK/dmg"
+mkdir -p "$STAGE"
+# ditto keeps what cp -R can lose: extended attributes, and with them a
+# stapled notarization ticket.
+ditto "$APP" "$STAGE/$(basename "$APP")"
+ln -s /Applications "$STAGE/Applications"
+
+# Hosted macOS runners now and then fail hdiutil with "Resource busy"; the
+# same command a few seconds later passes.
+rm -f "$DMG"
+tries=1
+until hdiutil create -quiet -volname Codeman -srcfolder "$STAGE" -ov -format UDZO "$DMG"; do
+  if [ "$tries" -ge 3 ]; then
+    echo "hdiutil create failed $tries times" >&2
+    exit 1
+  fi
+  tries=$((tries + 1))
+  echo "hdiutil create failed, trying again in 10 seconds" >&2
+  rm -f "$DMG"
+  sleep 10
+done
+hdiutil verify -quiet "$DMG"

packages/desktop/scripts/sign-macos.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# Sign Codeman.app with a Developer ID, have Apple notarize it and staple the
+# ticket to it, then build Codeman.dmg around the stapled app and do the same
+# for the DMG. On macOS.
+#
+#   packages/desktop/scripts/sign-macos.sh <Codeman.app> <out-dir>
+#   packages/desktop/scripts/sign-macos.sh --check   # only check the environment below
+#
+# <Codeman.app> is re-signed and stapled in place. <out-dir> receives
+# Codeman.dmg and Codeman.dmg.sha256, the latter with the bare file name in it,
+# so `shasum -a 256 -c Codeman.dmg.sha256` works next to a downloaded copy. Both
+# appear only once every check passed; a failed run leaves neither, not even an
+# older pair, so nothing half-done can be uploaded by mistake.
+#
+# The environment names who signs:
+#   SIGN_IDENTITY       a "Developer ID Application: ..." identity in a keychain
+#                       on the search list, by name or by the SHA-1 hash that
+#                       `security find-identity -v -p codesigning` prints
+# and how to reach Apple's notary service, either through a profile saved with
+# `xcrun notarytool store-credentials <profile> --apple-id ... --team-id ...`:
+#   NOTARY_PROFILE      the profile's name
+#   NOTARY_KEYCHAIN     optional, the keychain that holds it (default: login)
+# or with the Apple ID itself:
+#   APPLE_ID, APPLE_APP_PASSWORD (an app-specific password), APPLE_TEAM_ID
+#
+# By hand, on a Mac with the certificate in the login keychain:
+#   SIGN_IDENTITY="Developer ID Application: ..." NOTARY_PROFILE=codeman-notary \
+#     packages/desktop/scripts/sign-macos.sh packages/desktop/dist/Codeman.app packages/desktop/dist
+#
+# The release workflow (.github/workflows/desktop-dmg.yml) runs it in a job that
+# builds nothing: the job that runs cargo, and with it the build script of every
+# crate in Cargo.lock, never holds a signing secret.
+set -euo pipefail
+
+[ "$(uname -s)" = Darwin ] || { echo "sign-macos.sh runs on macOS only" >&2; exit 1; }
+
+DESKTOP=$(cd "$(dirname "$0")/.." && pwd)
+ENTITLEMENTS="$DESKTOP/macos/entitlements.plist"
+
+# Fails with the name of what is missing, before any work, so a missing secret
+# costs seconds rather than a build.
+check_env() {
+  if [ -z "${SIGN_IDENTITY:-}" ]; then
+    echo "sign-macos.sh needs SIGN_IDENTITY" >&2
+    exit 2
+  fi
+  if [ -n "${NOTARY_PROFILE:-}" ]; then
+    return 0
+  fi
+  local name
+  for name in APPLE_ID APPLE_APP_PASSWORD APPLE_TEAM_ID; do
+    if [ -z "$(eval "printf '%s' \"\${$name:-}\"")" ]; then
+      echo "sign-macos.sh needs NOTARY_PROFILE, or APPLE_ID, APPLE_APP_PASSWORD and APPLE_TEAM_ID ($name is empty)" >&2
+      exit 2
+    fi
+  done
+}
+
+if [ "${1:-}" = --check ] && [ $# -eq 1 ]; then
+  check_env
+  exit 0
+fi
+[ $# -eq 2 ] || { echo "usage: $0 <Codeman.app> <out-dir> | --check" >&2; exit 2; }
+check_env
+
+APP=$1
+OUT=$2
+[ -d "$APP/Contents/MacOS" ] || { echo "$APP is not an app bundle" >&2; exit 2; }
+mkdir -p "$OUT"
+OUT=$(cd "$OUT" && pwd)
+rm -f "$OUT/Codeman.dmg" "$OUT/Codeman.dmg.sha256"
+NAME=$(basename "$APP" .app)
+
+if [ -n "${NOTARY_PROFILE:-}" ]; then
+  NOTARY_AUTH=(--keychain-profile "$NOTARY_PROFILE")
+  if [ -n "${NOTARY_KEYCHAIN:-}" ]; then
+    NOTARY_AUTH=("${NOTARY_AUTH[@]}" --keychain "$NOTARY_KEYCHAIN")
+  fi
+else
+  # On notarytool's command line, which the job's log never shows.
+  NOTARY_AUTH=(--apple-id "$APPLE_ID" --password "$APPLE_APP_PASSWORD" --team-id "$APPLE_TEAM_ID")
+fi
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+# Submit a file to the notary service and wait. Anything but Accepted stops the
+# script with the submission id and Apple's log, which names the file and the
+# reason (an unsigned binary, a missing timestamp, no hardened runtime...).
+notarize() {
+  local file=$1 result="$WORK/notary.plist" rc=0 status id
+  echo "Submitting $(basename "$file") to Apple's notary service"
+  xcrun notarytool submit "$file" "${NOTARY_AUTH[@]}" --wait --timeout 45m \
+    --output-format plist > "$result" || rc=$?
+  status=$(/usr/libexec/PlistBuddy -c 'Print :status' "$result" 2>/dev/null || true)
+  id=$(/usr/libexec/PlistBuddy -c 'Print :id' "$result" 2>/dev/null || true)
+  if [ "$status" != Accepted ]; then
+    echo "Notarization of $(basename "$file") ended as '${status:-unknown}' (submission ${id:-none}, notarytool exit $rc)" >&2
+    cat "$result" >&2 || true
+    if [ -n "$id" ]; then
+      xcrun notarytool log "$id" "${NOTARY_AUTH[@]}" >&2 || true
+    fi
+    exit 1
+  fi
+  echo "Notarized $(basename "$file") (submission $id)"
+}
+
+# The app: hardened runtime (which notarization requires), a secure timestamp,
+# and the entitlements the hardened runtime needs for microphone and camera.
+codesign --force --options runtime --timestamp --entitlements "$ENTITLEMENTS" \
+  --sign "$SIGN_IDENTITY" "$APP"
+codesign --verify --strict --verbose=2 "$APP"
+DETAILS=$(codesign --display --verbose=2 "$APP" 2>&1)
+printf '%s\n' "$DETAILS" | grep -E '^(Authority|TeamIdentifier|Timestamp)=' || true
+case "$DETAILS" in
+  *"Authority=Developer ID Application: "*) ;;
+  *) echo "$APP is not signed with a Developer ID Application certificate" >&2; exit 1 ;;
+esac
+case "$DETAILS" in
+  *"(runtime)"*) ;;
+  *) echo "$APP is signed without the hardened runtime" >&2; exit 1 ;;
+esac
+
+ditto -c -k --keepParent "$APP" "$WORK/$NAME.zip"
+notarize "$WORK/$NAME.zip"
+xcrun stapler staple "$APP"
+xcrun stapler validate "$APP"
+spctl --assess --type execute --verbose=2 "$APP"
+
+# The DMG around the stapled app, signed and notarized in its own right, so the
+# image opens without a warning and the app inside opens offline.
+DMG="$WORK/Codeman.dmg"
+"$DESKTOP/scripts/make-dmg.sh" "$APP" "$DMG"
+codesign --force --timestamp --sign "$SIGN_IDENTITY" "$DMG"
+codesign --verify --strict --verbose=2 "$DMG"
+notarize "$DMG"
+xcrun stapler staple "$DMG"
+xcrun stapler validate "$DMG"
+spctl --assess --type open --context context:primary-signature --verbose=2 "$DMG"
+
+(cd "$WORK" && shasum -a 256 Codeman.dmg > Codeman.dmg.sha256)
+mv "$DMG" "$WORK/Codeman.dmg.sha256" "$OUT/"
+echo "Signed and notarized $APP"
+echo "Built $OUT/Codeman.dmg ($(du -h "$OUT/Codeman.dmg" | cut -f1)), sha256 $(cut -d' ' -f1 "$OUT/Codeman.dmg.sha256")"

packages/desktop/src/local_server.rs

@@ -91,10 +91,10 @@ fn flavor(shell: &Path) -> Flavor {
 }
 
 /// What one process printed, stdout and stderr kept apart.
-pub struct Output {
-    pub code: Option<i32>,
-    pub stdout: String,
-    pub stderr: String,
+struct Output {
+    code: Option<i32>,
+    stdout: String,
+    stderr: String,
 }
 
 /// What `codeman` (or `SCRIPT` failing to find it) said, for the connect page.
@@ -143,18 +143,8 @@ fn pump<R: Read + Send + 'static>(pipe: Option<R>, stream: usize, tx: mpsc::Send
     });
 }
 
-/// `exec_bounded` for a start.
-fn exec(cmd: Command, deadline: Instant) -> Result<Output, String> {
-    exec_bounded(
-        cmd,
-        deadline,
-        "Starting Codeman took longer than a minute; it was stopped.",
-    )
-}
-
-/// Run `cmd` to completion with stdin closed, or kill it at `deadline` and
-/// answer `timed_out`.
-pub fn exec_bounded(mut cmd: Command, deadline: Instant, timed_out: &str) -> Result<Output, String> {
+/// Run `cmd` to completion with stdin closed, or kill it at `deadline`.
+fn exec(mut cmd: Command, deadline: Instant) -> Result<Output, String> {
     cmd.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
     let mut child = cmd
         .spawn()
@@ -178,7 +168,7 @@ pub fn exec_bounded(mut cmd: Command, deadline: Instant, timed_out: &str) -> Res
             Ok(None) => {
                 let _ = child.kill();
                 let _ = child.wait();
-                return Err(timed_out.to_string());
+                return Err("Starting Codeman took longer than a minute; it was stopped.".into());
             }
             Err(e) => return Err(e.to_string()),
         }
@@ -285,17 +275,6 @@ fn capture_env(
     }))
 }
 
-/// The login shell's environment, for a process the app runs without it (the
-/// graphical install). `None` when the shell reports none.
-pub fn login_environment() -> Option<Vec<(String, String)>> {
-    let shell = login_shell();
-    let flags: &[&str] = match flavor(&shell) {
-        Flavor::Posix => &["-l", "-c"],
-        Flavor::Capture(attempts) => attempts.first().copied().unwrap_or(&["-c"]),
-    };
-    capture_env(&shell, flags, Instant::now() + FIND_TIMEOUT).ok()?.ok()
-}
-
 /// Run `cmd` in the home folder, where a terminal and the LaunchAgent start
 /// Codeman too. The server keeps the directory it was started in and uses it
 /// as the default for a session that names none; an app opened from the Finder

packages/desktop/src/main.rs

@@ -22,7 +22,6 @@
 mod assets;
 mod config;
 mod credentials;
-mod gui_install;
 mod local_server;
 #[cfg(target_os = "macos")]
 mod macos;
@@ -35,8 +34,7 @@ use std::collections::{HashMap, VecDeque};
 use std::path::PathBuf;
 use std::process::Command;
 use std::rc::Rc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::sync::{Arc, Mutex};
+use std::sync::Mutex;
 use std::time::{Duration, Instant};
 
 use muda::accelerator::{Accelerator, Code, Modifiers};
@@ -102,7 +100,6 @@ const START_REFUSED: &str = "Codeman can only be started here for an http://127.
 
 mod menu_id {
     pub const SWITCH: &str = "switch-server";
-    pub const ADD_AGENT: &str = "add-agent";
     pub const RELOAD: &str = "reload";
     pub const START_FULLSCREEN: &str = "start-fullscreen";
     pub const DEVTOOLS: &str = "devtools";
@@ -289,11 +286,6 @@ struct App {
     menu: AppMenu,
     /// The one Keychain worker; every Keychain job goes through its queue.
     keychain: Keychain,
-    /// Which reader of the install's output is the current one.
-    install_reader: Arc<AtomicU64>,
-    /// The connect page opens the agent chooser when it next loads: the menu
-    /// asked for it from a Codeman page.
-    add_agent_on_load: bool,
     /// While the main window may still have to be put into the full screen it
     /// asked for at launch: when to look next, and how many retries were made.
     fullscreen_retry: Option<(Instant, u8)>,
@@ -378,8 +370,6 @@ fn main() {
         downloads: HashMap::new(),
         menu,
         keychain,
-        install_reader: Arc::new(AtomicU64::new(0)),
-        add_agent_on_load: false,
         fullscreen_retry: wants_fullscreen.then(|| (Instant::now() + FULLSCREEN_FIRST_CHECK, 0)),
     };
 
@@ -416,7 +406,6 @@ fn build_menu(config: &Config) -> muda::Result<AppMenu> {
             &about,
             &PredefinedMenuItem::separator(),
             &switch,
-            &MenuItem::with_id(menu_id::ADD_AGENT, "Add a Coding Agent to This Mac\u{2026}", true, None),
             &PredefinedMenuItem::separator(),
             &PredefinedMenuItem::services(None),
             &PredefinedMenuItem::separator(),
@@ -1116,7 +1105,6 @@ impl App {
     fn on_menu(&mut self, id: &str) {
         match id {
             menu_id::SWITCH => self.show_connect_page(None, true),
-            menu_id::ADD_AGENT => self.add_agent(),
             menu_id::RELOAD => self.reload_focused(),
             menu_id::START_FULLSCREEN => {
                 let value = self.menu.start_fullscreen.is_checked();
@@ -1254,76 +1242,6 @@ impl App {
                     });
                 }
             }
-            ConnectCmd::InstallPrepare => {
-                if choosing {
-                    self.in_background(|| match gui_install::prepare() {
-                        Ok(plan) => json!({ "type": "installPlan", "plan": plan }),
-                        Err(message) => json!({ "type": "installPrepareFailed", "message": message }),
-                    });
-                }
-            }
-            ConnectCmd::InstallStart {
-                network_password,
-                ai_cli,
-            } => {
-                if choosing {
-                    let proxy = self.proxy.clone();
-                    let stale = self.next_install_reader();
-                    std::thread::spawn(move || {
-                        let plan = gui_install::Plan {
-                            port: setup::pick_install_port(),
-                            network_password,
-                            ai_cli,
-                        };
-                        let send = |msg| {
-                            let _ = proxy.send_event(UserEvent::ToConnectPage(msg));
-                        };
-                        match gui_install::start(&plan) {
-                            Ok(()) => {
-                                send(json!({ "type": "installRunning", "port": plan.port }));
-                                gui_install::follow(gui_install::Run::Codeman, stale, send);
-                            }
-                            Err(message) => send(json!({ "type": "installStartFailed", "message": message })),
-                        }
-                    });
-                }
-            }
-            ConnectCmd::InstallAttach => {
-                if choosing {
-                    self.attach_to_run(gui_install::Run::Codeman);
-                }
-            }
-            ConnectCmd::InstallCancel => {
-                std::thread::spawn(gui_install::cancel);
-            }
-            ConnectCmd::AgentPrepare => {
-                if choosing {
-                    self.in_background(|| match gui_install::prepare_agent() {
-                        Ok(plan) => json!({ "type": "installPlan", "plan": plan }),
-                        Err(message) => json!({ "type": "installPrepareFailed", "message": message }),
-                    });
-                }
-            }
-            ConnectCmd::AgentStart { ai_cli } => {
-                if choosing {
-                    let proxy = self.proxy.clone();
-                    let stale = self.next_install_reader();
-                    std::thread::spawn(move || {
-                        let send = |msg| {
-                            let _ = proxy.send_event(UserEvent::ToConnectPage(msg));
-                        };
-                        match gui_install::start_agent(&ai_cli) {
-                            Ok(()) => gui_install::follow(gui_install::Run::Agent, stale, send),
-                            Err(message) => send(json!({ "type": "installStartFailed", "message": message })),
-                        }
-                    });
-                }
-            }
-            ConnectCmd::AgentAttach => {
-                if choosing {
-                    self.attach_to_run(gui_install::Run::Agent);
-                }
-            }
             ConnectCmd::InstallRemote { target } => {
                 if choosing {
                     match setup::SshTarget::parse(&target) {
@@ -1355,40 +1273,6 @@ impl App {
         }
     }
 
-    /// A new reader of the install's output replaces the one before it: the
-    /// answer is how that new reader learns it was replaced in turn.
-    /// Report a run that is going already to the page, from its first line.
-    fn attach_to_run(&self, run: gui_install::Run) {
-        let proxy = self.proxy.clone();
-        let stale = self.next_install_reader();
-        std::thread::spawn(move || {
-            gui_install::follow(run, stale, |msg| {
-                let _ = proxy.send_event(UserEvent::ToConnectPage(msg));
-            });
-        });
-    }
-
-    /// The agent chooser lives on the connect page: from a Codeman page, this
-    /// leaves it the way Switch Server does.
-    fn add_agent(&mut self) {
-        if matches!(*self.phase.borrow(), Phase::Connect) {
-            if let Some(main) = self.windows.get(&self.main_id) {
-                main.window.set_visible(true);
-                main.window.set_focus();
-            }
-            self.to_connect_page(json!({ "type": "addAgent" }));
-        } else {
-            self.add_agent_on_load = true;
-            self.show_connect_page(None, true);
-        }
-    }
-
-    fn next_install_reader(&self) -> impl Fn() -> bool + Send + 'static {
-        let generation = self.install_reader.clone();
-        let mine = generation.fetch_add(1, Ordering::SeqCst) + 1;
-        move || generation.load(Ordering::SeqCst) != mine
-    }
-
     /// Run `work` off the event loop (it may run a login shell, plutil,
     /// Terminal or a probe) and hand what it returns to the connect page.
     fn in_background(&self, work: impl FnOnce() -> serde_json::Value + Send + 'static) {
@@ -1400,7 +1284,6 @@ impl App {
 
     fn send_init(&mut self) {
         let notice = self.notice.take();
-        let add_agent = std::mem::take(&mut self.add_agent_on_load);
         self.to_connect_page(json!({
             "type": "init",
             "servers": self.config.servers,
@@ -1409,7 +1292,6 @@ impl App {
             "version": VERSION,
             "starting": self.start_running(),
             "notice": notice,
-            "addAgent": add_agent,
         }));
     }
 

packages/desktop/src/policy.rs

@@ -609,27 +609,6 @@ pub enum ConnectCmd {
     InstallLocal {
         network: bool,
     },
-    /// Fetch the installer and ask it what is on this Mac (gui_install).
-    InstallPrepare,
-    /// Run the graphical install. `network_password`: reachable from other
-    /// devices, with this password. `ai_cli`: an id in the shape of the
-    /// installer's catalogue, which checks it again.
-    InstallStart {
-        network_password: Option<String>,
-        ai_cli: Option<String>,
-    },
-    /// Show the graphical install that is running already.
-    InstallAttach,
-    /// Stop whichever graphical run is going.
-    InstallCancel,
-    /// Fetch the installer to add a coding agent to a Mac that has Codeman.
-    AgentPrepare,
-    /// Add this agent: an id in the shape of the installer's catalogue.
-    AgentStart {
-        ai_cli: String,
-    },
-    /// Show the agent install that is running already.
-    AgentAttach,
     /// Run the installer on another machine over SSH, in Terminal. `target`
     /// is what the user typed; setup::SshTarget::parse checks it.
     InstallRemote {
@@ -684,23 +663,6 @@ enum RawConnect {
         #[serde(default)]
         network: bool,
     },
-    InstallPrepare,
-    InstallStart {
-        // rename_all above reaches variant names only, and deny_unknown_fields
-        // would refuse the page's spelling of these.
-        #[serde(default, rename = "networkPassword")]
-        network_password: Option<String>,
-        #[serde(default, rename = "aiCli")]
-        ai_cli: Option<String>,
-    },
-    InstallAttach,
-    InstallCancel,
-    AgentPrepare,
-    AgentStart {
-        #[serde(rename = "aiCli")]
-        ai_cli: String,
-    },
-    AgentAttach,
     InstallRemote {
         target: String,
     },
@@ -717,17 +679,6 @@ enum RawHost {
     SessionExpired,
 }
 
-/// The shape of a CLI catalogue id. It becomes one argument of `install.sh`,
-/// so it could not be read as a flag even without this: it must start with a
-/// letter.
-fn is_cli_id(id: &str) -> bool {
-    id.len() <= 32
-        && id.starts_with(|c: char| c.is_ascii_lowercase())
-        && id
-            .chars()
-            .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-')
-}
-
 fn bounded(s: Option<String>, max: usize) -> Option<Option<String>> {
     match s {
         Some(v) if v.len() > max => None,
@@ -785,24 +736,6 @@ pub fn parse_ipc(frame_url: &str, body: &str, phase: &Phase, is_main_window: boo
             RawConnect::OpenExternal { url } if url.len() <= MAX_URL_LEN => ConnectCmd::OpenExternal(url),
             RawConnect::LocalStatus { quick, deep } => ConnectCmd::LocalStatus { quick, deep },
             RawConnect::InstallLocal { network } => ConnectCmd::InstallLocal { network },
-            RawConnect::InstallPrepare => ConnectCmd::InstallPrepare,
-            RawConnect::InstallStart {
-                network_password,
-                ai_cli,
-            } => {
-                if ai_cli.as_deref().is_some_and(|id| !is_cli_id(id)) {
-                    return None;
-                }
-                ConnectCmd::InstallStart {
-                    network_password: bounded(network_password, MAX_FIELD_LEN)?.filter(|p| !p.is_empty()),
-                    ai_cli,
-                }
-            }
-            RawConnect::InstallAttach => ConnectCmd::InstallAttach,
-            RawConnect::InstallCancel => ConnectCmd::InstallCancel,
-            RawConnect::AgentPrepare => ConnectCmd::AgentPrepare,
-            RawConnect::AgentStart { ai_cli } if is_cli_id(&ai_cli) => ConnectCmd::AgentStart { ai_cli },
-            RawConnect::AgentAttach => ConnectCmd::AgentAttach,
             RawConnect::InstallRemote { target } if target.len() <= MAX_FIELD_LEN => {
                 ConnectCmd::InstallRemote { target }
             }
@@ -1666,111 +1599,6 @@ mod tests {
         assert_eq!(parse_ipc(page, r#"{"cmd":"installLocal"}"#, &loaded, true), None);
     }
 
-    #[test]
-    fn ipc_graphical_install_commands() {
-        let page = "codemanapp://localhost/index.html";
-        let c = |body: &str| parse_ipc(page, body, &Phase::Connect, true);
-        assert_eq!(
-            c(r#"{"cmd":"installPrepare"}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallPrepare))
-        );
-        assert_eq!(
-            c(r#"{"cmd":"installAttach"}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallAttach))
-        );
-        assert_eq!(
-            c(r#"{"cmd":"installCancel"}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallCancel))
-        );
-        // The spelling connect.html sends (test/desktop-connect-install.test.ts
-        // pins the page's side).
-        assert_eq!(
-            c(r#"{"cmd":"installStart","networkPassword":"s3cret","aiCli":"claude"}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallStart {
-                network_password: Some("s3cret".into()),
-                ai_cli: Some("claude".into()),
-            }))
-        );
-        assert_eq!(
-            c(r#"{"cmd":"installStart"}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallStart {
-                network_password: None,
-                ai_cli: None,
-            }))
-        );
-        // An empty password is no password: never a network install without one.
-        assert_eq!(
-            c(r#"{"cmd":"installStart","networkPassword":""}"#),
-            Some(Ipc::Connect(ConnectCmd::InstallStart {
-                network_password: None,
-                ai_cli: None,
-            }))
-        );
-        // Only the shape of an id: nothing that could read as a flag or more.
-        for id in ["--yes", "-y", "Claude", "a b", "a;b", "", "a/b"] {
-            assert_eq!(c(&format!(r#"{{"cmd":"installStart","aiCli":"{id}"}}"#)), None, "{id}");
-        }
-        let long = "a".repeat(33);
-        assert_eq!(c(&format!(r#"{{"cmd":"installStart","aiCli":"{long}"}}"#)), None);
-        let long = "a".repeat(MAX_FIELD_LEN + 1);
-        assert_eq!(
-            c(&format!(r#"{{"cmd":"installStart","networkPassword":"{long}"}}"#)),
-            None
-        );
-        // Nothing else rides along.
-        assert_eq!(c(r#"{"cmd":"installStart","args":["--yes"]}"#), None);
-        assert_eq!(c(r#"{"cmd":"installStart","ai_cli":"claude"}"#), None);
-        // Only the connect page, only in the main window, never a server page.
-        assert_eq!(
-            parse_ipc(page, r#"{"cmd":"installStart"}"#, &Phase::Connect, false),
-            None
-        );
-        let loaded = Phase::Loaded(u("http://127.0.0.1:3000/"));
-        assert_eq!(
-            parse_ipc("http://127.0.0.1:3000/", r#"{"cmd":"installStart"}"#, &loaded, true),
-            None
-        );
-        assert_eq!(parse_ipc(page, r#"{"cmd":"installCancel"}"#, &loaded, true), None);
-    }
-
-    #[test]
-    fn ipc_adding_a_coding_agent() {
-        let page = "codemanapp://localhost/index.html";
-        let c = |body: &str| parse_ipc(page, body, &Phase::Connect, true);
-        assert_eq!(
-            c(r#"{"cmd":"agentPrepare"}"#),
-            Some(Ipc::Connect(ConnectCmd::AgentPrepare))
-        );
-        assert_eq!(
-            c(r#"{"cmd":"agentAttach"}"#),
-            Some(Ipc::Connect(ConnectCmd::AgentAttach))
-        );
-        assert_eq!(
-            c(r#"{"cmd":"agentStart","aiCli":"codex"}"#),
-            Some(Ipc::Connect(ConnectCmd::AgentStart { ai_cli: "codex".into() }))
-        );
-        // It names one agent, in the shape of an id, and nothing else.
-        assert_eq!(c(r#"{"cmd":"agentStart"}"#), None);
-        for id in ["--service", "-y", "Codex", "a b", "a;b", "", "a/b"] {
-            assert_eq!(c(&format!(r#"{{"cmd":"agentStart","aiCli":"{id}"}}"#)), None, "{id}");
-        }
-        assert_eq!(c(r#"{"cmd":"agentStart","aiCli":"codex","port":3000}"#), None);
-        assert_eq!(
-            parse_ipc(page, r#"{"cmd":"agentStart","aiCli":"codex"}"#, &Phase::Connect, false),
-            None
-        );
-        let loaded = Phase::Loaded(u("http://127.0.0.1:3000/"));
-        assert_eq!(
-            parse_ipc(
-                "http://127.0.0.1:3000/",
-                r#"{"cmd":"agentStart","aiCli":"codex"}"#,
-                &loaded,
-                true
-            ),
-            None
-        );
-    }
-
     #[test]
     fn ipc_from_connect_page() {
         let page = "codemanapp://localhost/index.html";

packages/desktop/src/probe.rs

@@ -9,7 +9,7 @@ use serde::Serialize;
 use std::time::Duration;
 use url::Url;
 
-pub const TIMEOUT: Duration = Duration::from_secs(5);
+const TIMEOUT: Duration = Duration::from_secs(5);
 const MAX_BODY: u64 = 8 * 1024 * 1024;
 
 /// The path the probe asks for, relative to the server's base URL.
@@ -232,7 +232,7 @@ pub fn probe(server: &Url, authorization: Option<&str>) -> ProbeOutcome {
 }
 
 /// `probe` with the time the whole exchange may take.
-pub fn probe_within(server: &Url, authorization: Option<&str>, timeout: Duration) -> ProbeOutcome {
+fn probe_within(server: &Url, authorization: Option<&str>, timeout: Duration) -> ProbeOutcome {
     let status_url = match server.join(STATUS_PATH) {
         Ok(u) => u,
         Err(e) => return ProbeOutcome::Failed { detail: e.to_string() },

packages/desktop/src/setup.rs

@@ -1,13 +1,12 @@
-//! The connect screen's "This Mac" tab and its Terminal installs: where the
-//! Codeman on this Mac listens, whether it is installed, its login, which
-//! other Codeman servers of this user run here, and the installer runs in
-//! Terminal for this Mac and for another machine over SSH.
-//! The install most people get runs in the app, in `gui_install.rs`.
+//! The connect screen's "This Mac" tab and its installs: where the Codeman on
+//! this Mac listens, whether it is installed, its login, and the installer runs
+//! for this Mac and for another machine over SSH.
 //!
-//! The Terminal route is for what that one cannot do. `install.sh` asks for
-//! the administrator password on a terminal (Homebrew, its sudo keep-alive),
-//! the Xcode tools arrive as a system dialog, and ssh asks about host keys and
-//! passwords on a terminal too. So the app writes a small script that deletes itself and
+//! The installer always runs in Terminal, never inside the app. `install.sh`
+//! asks for the administrator password on a terminal (Homebrew, its sudo
+//! keep-alive), the Xcode tools arrive as a system dialog, and ssh asks about
+//! host keys and passwords on a terminal too: a run without one fails on the
+//! first fresh Mac. So the app writes a small script that deletes itself and
 //! hands it to Terminal (`open -b com.apple.Terminal`), which needs no
 //! permission, unlike scripting Terminal through osascript (an Automation
 //! prompt). Everything the scripts contain is built here and unit-tested; the
@@ -25,22 +24,12 @@ use std::time::Duration;
 use serde::Serialize;
 use url::Url;
 
-use crate::gui_install;
 use crate::local_server;
 use crate::policy;
 use crate::probe::{self, ProbeOutcome};
 
-/// Codeman's published installer (a redirect to `install.sh` on master). A test
-/// build of an installer change sets `CODEMAN_DESKTOP_INSTALLER_URL` when it is
-/// compiled; a shipped app has no way to point this anywhere else, at runtime
-/// or otherwise.
-pub const INSTALLER_URL: &str = match option_env!("CODEMAN_DESKTOP_INSTALLER_URL") {
-    Some(url) => url,
-    None => "https://getcodeman.com/install",
-};
-
-/// The branch that test build installs Codeman from (`CODEMAN_BRANCH`).
-pub const INSTALL_BRANCH: Option<&str> = option_env!("CODEMAN_DESKTOP_INSTALL_BRANCH");
+/// Codeman's published installer (a redirect to `install.sh` on master).
+pub const INSTALLER_URL: &str = "https://getcodeman.com/install";
 
 /// What to paste into a terminal on another machine; the SSH install runs the
 /// same thing there.
@@ -94,62 +83,43 @@ pub fn parse_service(job: &serde_json::Value) -> ServiceConfig {
         .map(|a| a.iter().filter_map(|v| v.as_str()).collect())
         .unwrap_or_default();
 
+    let mut port = var("CODEMAN_PORT");
+    let mut base = var("CODEMAN_BASE_URL");
+    let mut https = false;
     // Only what follows the `web` subcommand: node's own flags come before it.
     let after_web = args
         .iter()
         .position(|a| *a == "web")
         .map_or(&[][..], |i| &args[i + 1..]);
-    let flags = WebFlags {
-        port: var("CODEMAN_PORT"),
-        base: var("CODEMAN_BASE_URL"),
-        https: false,
-    }
-    .read(after_web);
-    ServiceConfig {
-        port: flags
-            .port
-            .and_then(|p| p.trim().parse::<u16>().ok())
-            .filter(|p| *p > 0)
-            .unwrap_or(DEFAULT_PORT),
-        base_path: normalize_base_path(flags.base.as_deref().unwrap_or("")),
-        https: flags.https,
-        username: var("CODEMAN_USERNAME"),
-        password: var("CODEMAN_PASSWORD"),
-        daemon: false,
-    }
-}
-
-/// What Codeman's `web` command takes from the arguments after `web`
-/// (src/cli.ts). The fields start as what the environment says, or empty.
-#[derive(Debug, Default)]
-struct WebFlags {
-    port: Option<String>,
-    base: Option<String>,
-    https: bool,
-}
-
-impl WebFlags {
-    fn read(mut self, after_web: &[&str]) -> Self {
-        let mut it = after_web.iter();
-        while let Some(arg) = it.next() {
-            match *arg {
-                "-p" | "--port" => self.port = it.next().map(|s| s.to_string()),
-                "--base-url" => self.base = it.next().map(|s| s.to_string()),
-                "--https" => self.https = true,
-                // Options that take a value: skip it, so it is never read as a flag.
-                "-H" | "--host" | "--title-hostname" => {
-                    it.next();
-                }
-                other => {
-                    if let Some(v) = other.strip_prefix("--port=") {
-                        self.port = Some(v.to_string());
-                    } else if let Some(v) = other.strip_prefix("--base-url=") {
-                        self.base = Some(v.to_string());
-                    }
+    let mut it = after_web.iter();
+    while let Some(arg) = it.next() {
+        match *arg {
+            "-p" | "--port" => port = it.next().map(|s| s.to_string()),
+            "--base-url" => base = it.next().map(|s| s.to_string()),
+            "--https" => https = true,
+            // Options that take a value: skip it, so it is never read as a flag.
+            "-H" | "--host" | "--title-hostname" => {
+                it.next();
+            }
+            other => {
+                if let Some(v) = other.strip_prefix("--port=") {
+                    port = Some(v.to_string());
+                } else if let Some(v) = other.strip_prefix("--base-url=") {
+                    base = Some(v.to_string());
                 }
             }
         }
-        self
+    }
+    ServiceConfig {
+        port: port
+            .and_then(|p| p.trim().parse::<u16>().ok())
+            .filter(|p| *p > 0)
+            .unwrap_or(DEFAULT_PORT),
+        base_path: normalize_base_path(base.as_deref().unwrap_or("")),
+        https,
+        username: var("CODEMAN_USERNAME"),
+        password: var("CODEMAN_PASSWORD"),
+        daemon: false,
     }
 }
 
@@ -319,7 +289,7 @@ pub fn local_login(url: &Url) -> Option<(String, String)> {
 }
 
 /// This user's processes, as `ps` lists them: (pid, command line).
-pub fn list_processes() -> Vec<(u32, String)> {
+fn list_processes() -> Vec<(u32, String)> {
     let Ok(out) = Command::new("/bin/ps")
         .args(["-x", "-ww", "-o", "pid=", "-o", "command="])
         .stdin(Stdio::null())
@@ -345,12 +315,6 @@ fn parse_ps(text: &str) -> Vec<(u32, String)> {
 /// `install.sh` clone's `dist/index.js web`, a source checkout's
 /// `src/index.ts web`), not one of its short-lived control commands.
 pub fn is_codeman_server(command: &str) -> bool {
-    server_args(command).is_some()
-}
-
-/// What follows `web` on a Codeman server's command line, or None for any
-/// other command.
-fn server_args(command: &str) -> Option<Vec<&str>> {
     let words: Vec<&str> = command.split_whitespace().collect();
     let is_entry = |w: &str| {
         let name = w.rsplit('/').next().unwrap_or(w);
@@ -358,18 +322,16 @@ fn server_args(command: &str) -> Option<Vec<&str>> {
     };
     // Any entry word that `web` follows: an earlier word may only look like
     // one (a folder named codeman in `tsx watch --cwd ~/codeman src/index.ts web`).
-    (0..words.len())
-        .find(|&i| {
-            is_entry(words[i])
-                && words.get(i + 1) == Some(&"web")
-                && !words[i + 1..].iter().any(|w| matches!(*w, "--stop" | "--status"))
-        })
-        .map(|i| words[i + 2..].to_vec())
+    (0..words.len()).any(|i| {
+        is_entry(words[i])
+            && words.get(i + 1) == Some(&"web")
+            && !words[i + 1..].iter().any(|w| matches!(*w, "--stop" | "--status"))
+    })
 }
 
 /// Whether a command line is an install the app started on this Mac (the
-/// Terminal script, the installer it downloaded, or the graphical install), and
-/// the port it asked for once the installer runs.
+/// Terminal script, or the installer it downloaded), and the port it asked
+/// for once the installer runs.
 pub fn install_in_progress(command: &str) -> Option<Option<u16>> {
     let words: Vec<&str> = command.split_whitespace().collect();
     let name = |w: &&str| w.rsplit('/').next().unwrap_or(w).to_string();
@@ -379,7 +341,7 @@ pub fn install_in_progress(command: &str) -> Option<Option<u16>> {
     }) {
         return Some(None);
     }
-    if words.iter().any(|w| name(w).starts_with("codeman-install.")) || gui_install::Run::Codeman.matches(command) {
+    if words.iter().any(|w| name(w).starts_with("codeman-install.")) {
         let port = words
             .iter()
             .position(|w| *w == "--port")
@@ -466,138 +428,14 @@ fn serves_loopback_port(found: &[Listener], port: u16) -> bool {
         .any(|l| l.port == port && matches!(l.host.as_str(), "*" | "127.0.0.1" | "0.0.0.0"))
 }
 
-/// Where the app can try each of this user's Codeman servers, from their
-/// command lines (`procs`) and listening sockets. `default` is the address the
-/// app opens by default (local_url); it comes first, then the others by port.
-///
-/// One address per server and port: 127.0.0.1 when the server listens there
-/// or on every interface, `[::1]` when its only loopback socket is the IPv6
-/// one, else each address it is bound to. A socket beside a loopback one on
-/// the same port is left out (the Docker bridge listener, which serves hook
-/// endpoints only). `https` when the command line carries `--https`, and its
-/// `--base-url` is the path. `ps` does not show a base path kept in the
-/// environment, which is where install.sh's launchd job keeps it, so a server
-/// at the default address with no `--base-url` of its own is the default one.
-pub fn found_addresses(procs: &[(u32, String)], listeners: &[Listener], default: &Url) -> Vec<Url> {
-    let mut urls: Vec<Url> = Vec::new();
-    for (pid, command) in procs {
-        let Some(args) = server_args(command) else {
-            continue;
-        };
-        let flags = WebFlags::default().read(&args);
-        let scheme = if flags.https { "https" } else { "http" };
-        let base = flags.base.as_deref().map(normalize_base_path);
-        let own: Vec<&Listener> = listeners.iter().filter(|l| l.pid == *pid).collect();
-        for l in &own {
-            let beside = |hosts: &[&str]| own.iter().any(|o| o.port == l.port && hosts.contains(&o.host.as_str()));
-            let host = if beside(&["*", "0.0.0.0", "[::]", "127.0.0.1"]) {
-                "127.0.0.1"
-            } else if beside(&["[::1]"]) {
-                "[::1]"
-            } else {
-                l.host.as_str()
-            };
-            let path = base.as_deref().unwrap_or("");
-            let Ok(mut url) = Url::parse(&format!("{scheme}://{host}:{}{path}/", l.port)) else {
-                continue;
-            };
-            if base.is_none() && policy::same_origin(&url, default) {
-                url = default.clone();
-            }
-            if !urls.contains(&url) {
-                urls.push(url);
-            }
-        }
-    }
-    urls.sort_by_key(|u| (u != default, u.port_or_known_default(), u.to_string()));
-    urls
-}
-
-/// What the This Mac tab says about one found server.
-#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub enum FoundState {
-    /// Codeman answers there: Connect opens it.
-    Running,
-    /// Codeman answers there and wants a login.
-    NeedsLogin,
-    /// It serves HTTPS with a certificate the app refuses (Codeman's own
-    /// self-signed one, from `codeman web --https`).
-    Certificate,
-    /// Codeman does not answer there.
-    Unreachable,
-}
-
-/// One of this user's Codeman servers on this Mac, for the This Mac tab's
-/// rows.
-#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct FoundServer {
-    /// Where the app can try it (found_addresses).
-    pub url: String,
-    pub version: Option<String>,
-    pub state: FoundState,
-    /// It is at the address the app opens by default (local_url).
-    pub is_default: bool,
-}
-
-/// The row for the server at `url`, from what it answered.
-fn found_server(url: &Url, answer: &ProbeOutcome, default: &Url) -> FoundServer {
-    let state = match answer {
-        ProbeOutcome::Ok { .. } | ProbeOutcome::PasswordChangeRequired => FoundState::Running,
-        _ if answers(answer) => FoundState::NeedsLogin,
-        // A Codeman started with --https closes a plain http connection.
-        ProbeOutcome::TlsUntrusted { .. } | ProbeOutcome::MaybeHttps => FoundState::Certificate,
-        _ => FoundState::Unreachable,
+/// The address a listener is reached at: 127.0.0.1 for a loopback or
+/// all-interfaces bind, else its own address.
+fn listener_url(l: &Listener) -> Option<Url> {
+    let host = match l.host.as_str() {
+        "*" | "0.0.0.0" => "127.0.0.1",
+        h => h,
     };
-    FoundServer {
-        url: url.to_string(),
-        version: match answer {
-            ProbeOutcome::Ok { version } => Some(version.clone()),
-            _ => None,
-        },
-        state,
-        is_default: url == default,
-    }
-}
-
-/// How long a found server gets to answer when the tab only lists it.
-const FOUND_TIMEOUT: Duration = Duration::from_secs(2);
-
-/// Ask the servers at `urls`, all at the same time, so the look takes as long
-/// as the slowest answer and no longer. Without a login: the one the app can
-/// read belongs to the default address (login_for).
-fn ask_found(urls: &[Url], patience: Duration) -> Vec<ProbeOutcome> {
-    std::thread::scope(|scope| {
-        let asking: Vec<_> = urls
-            .iter()
-            .map(|url| scope.spawn(move || probe::probe_within(url, None, patience)))
-            .collect();
-        asking
-            .into_iter()
-            .map(|a| {
-                a.join().unwrap_or_else(|_| ProbeOutcome::Failed {
-                    detail: "The check stopped.".into(),
-                })
-            })
-            .collect()
-    })
-}
-
-/// The address the This Mac tab is about, with its answer: the default one,
-/// or, when nothing answers there, the first found server that does (a
-/// `codeman web --port 4000` in a terminal, a bind to one network address).
-fn shown<'a>(
-    default: &'a Url,
-    answer: &'a ProbeOutcome,
-    found: &'a [(Url, ProbeOutcome)],
-) -> (&'a Url, &'a ProbeOutcome) {
-    if *answer == ProbeOutcome::Refused {
-        if let Some((url, answer)) = found.iter().find(|(_, a)| answers(a)) {
-            return (url, answer);
-        }
-    }
-    (default, answer)
+    Url::parse(&format!("http://{host}:{}/", l.port)).ok()
 }
 
 /// What the This Mac tab shows.
@@ -611,8 +449,8 @@ pub enum LocalState {
     /// A Codeman server of this user runs but listens nowhere yet: it is
     /// still starting (the LaunchAgent at login, a restart).
     Starting,
-    /// A Codeman server of this user runs, but none answers at an address the
-    /// app can open (HTTPS with Codeman's own certificate, say): see `found`.
+    /// A Codeman server of this user runs, but not at an address the app can
+    /// open (bound to one network address, say): see `elsewhere`.
     RunningElsewhere,
     /// Nothing answers, and Codeman is installed.
     Stopped,
@@ -640,19 +478,12 @@ pub struct LocalStatus {
     pub installed: bool,
     /// `install.sh` finished its work (its `.install-complete` marker).
     pub install_complete: bool,
-    /// An install the app started is still running, and the port it asked
-    /// for once that is known.
+    /// An install the app started is still running in Terminal, and the
+    /// port it asked for once that is known.
     pub install_running: bool,
     pub install_port: Option<u16>,
-    /// That install is the graphical one, not a Terminal window: the page can
-    /// show it (gui_install::follow), also after the app was quit.
-    pub install_in_app: bool,
-    /// A coding agent is being added the same way. Not an install: it says
-    /// nothing about Codeman, which may well be running.
-    pub agent_install_in_app: bool,
-    /// Every Codeman server of this user that listens on this Mac, the one at
-    /// the default address first: the tab offers to connect to each.
-    pub found: Vec<FoundServer>,
+    /// For RunningElsewhere: the addresses that Codeman listens on.
+    pub elsewhere: Vec<String>,
     /// The probe's outcome, for the connect page's explanations.
     pub outcome: ProbeOutcome,
 }
@@ -699,44 +530,55 @@ pub enum Depth {
 pub fn inspect(depth: Depth) -> LocalStatus {
     let home = dirs::home_dir().unwrap_or_default();
     let service = read_service();
-    let default = local_url(service.as_ref());
+    let url = local_url(service.as_ref());
     let procs = list_processes();
     let servers = codeman_servers(&procs);
-    let listening = listeners(&servers);
+    let found = listeners(&servers);
     let install = running_install(&procs);
-    let install_in_app = procs.iter().any(|(_, c)| gui_install::Run::Codeman.matches(c));
-    let agent_install_in_app = procs.iter().any(|(_, c)| gui_install::Run::Agent.matches(c));
 
     // The login goes only to this user's own Codeman on that port.
-    let auth = if serves_loopback_port(&listening, default.port_or_known_default().unwrap_or(0)) {
-        login_for(&default, service.as_ref(), &read_env_file()).map(|(u, p)| policy::basic_auth_header(&u, &p))
+    let auth = if serves_loopback_port(&found, url.port_or_known_default().unwrap_or(0)) {
+        login_for(&url, service.as_ref(), &read_env_file()).map(|(u, p)| policy::basic_auth_header(&u, &p))
     } else {
         None
     };
-    let answer = probe::probe(&default, auth.as_deref());
+    let mut outcome = probe::probe(&url, auth.as_deref());
+    let mut url = url;
+    let mut elsewhere = Vec::new();
 
-    // Every address one of this user's Codeman servers listens at. The one at
-    // the default address has just answered; the others are asked now, once
-    // each. With nothing at the default address, the first of them that
-    // answers is what the tab opens, as it always was, so each gets the
-    // probe's usual time; otherwise they are only listed, and get less.
-    let patience = if answer == ProbeOutcome::Refused {
-        probe::TIMEOUT
-    } else {
-        FOUND_TIMEOUT
-    };
-    let addresses = found_addresses(&procs, &listening, &default);
-    let others: Vec<Url> = addresses.iter().filter(|u| **u != default).cloned().collect();
-    let mut answered: Vec<(Url, ProbeOutcome)> = others.iter().cloned().zip(ask_found(&others, patience)).collect();
-    // found_addresses puts the default address first.
-    if addresses.first() == Some(&default) {
-        answered.insert(0, (default.clone(), answer.clone()));
+    // Nothing at the usual address, but a Codeman server of this user runs:
+    // find where (a `codeman web --port 4000` in a terminal, a bind to one
+    // network address), so the tab never offers to start a second server on
+    // the same sessions.
+    if outcome == ProbeOutcome::Refused && !servers.is_empty() {
+        let mut ports_seen = Vec::new();
+        for l in &found {
+            if ports_seen.contains(&(l.host.clone(), l.port)) {
+                continue;
+            }
+            ports_seen.push((l.host.clone(), l.port));
+            let Some(candidate) = listener_url(l) else {
+                continue;
+            };
+            let answer = probe::probe(&candidate, None);
+            if matches!(
+                answer,
+                ProbeOutcome::Ok { .. }
+                    | ProbeOutcome::NeedsLogin
+                    | ProbeOutcome::BadCredentials
+                    | ProbeOutcome::RateLimited { .. }
+                    | ProbeOutcome::PasswordChangeRequired
+            ) {
+                url = candidate;
+                outcome = answer;
+                break;
+            }
+            elsewhere.push(format!("{}:{}", l.host, l.port));
+        }
+        if outcome == ProbeOutcome::Refused && elsewhere.is_empty() {
+            elsewhere = servers.iter().map(|pid| format!("process {pid}")).collect();
+        }
     }
-    let found: Vec<FoundServer> = answered.iter().map(|(u, a)| found_server(u, a, &default)).collect();
-    // The tab never offers to start a second server on the same sessions: it
-    // opens the one that answers, or lists where they listen.
-    let (url, outcome) = shown(&default, &answer, &answered);
-    let (url, outcome) = (url.clone(), outcome.clone());
 
     let app = home.join(".codeman/app");
     let install_complete = app.join(".install-complete").is_file();
@@ -754,7 +596,10 @@ pub fn inspect(depth: Depth) -> LocalStatus {
             Depth::Login => local_server::installed(false),
             Depth::Interactive => local_server::installed(true),
         };
-    let state = local_state(&outcome, !servers.is_empty(), !listening.is_empty(), installed);
+    let state = local_state(&outcome, !servers.is_empty(), !found.is_empty(), installed);
+    if state != LocalState::RunningElsewhere {
+        elsewhere.clear();
+    }
     let version = match &outcome {
         ProbeOutcome::Ok { version } => Some(version.clone()),
         _ => None,
@@ -769,9 +614,7 @@ pub fn inspect(depth: Depth) -> LocalStatus {
         install_complete,
         install_running: install.is_some(),
         install_port: install.flatten(),
-        install_in_app,
-        agent_install_in_app,
-        found,
+        elsewhere,
         outcome,
     }
 }
@@ -781,7 +624,7 @@ pub fn inspect(depth: Depth) -> LocalStatus {
 /// attach to the first one's live sessions (src/config/instance.ts), and
 /// `codeman web -d` only notices a server it started itself or one at the
 /// same address.
-pub fn already_running() -> Option<String> {
+fn already_running() -> Option<String> {
     let servers = codeman_servers(&list_processes());
     let pid = servers.first()?;
     let found = listeners(&servers);
@@ -1546,375 +1389,9 @@ mod tests {
         assert!(serves_loopback_port(&found, 4000));
         assert!(!serves_loopback_port(&found, 3999));
         assert!(!serves_loopback_port(&found, 5000));
-        // The same four sockets as the addresses the app can try, by port.
-        assert_eq!(
-            addresses(&procs, &found, "http://127.0.0.1:3000/"),
-            [
-                "http://127.0.0.1:3000/",
-                "http://172.17.0.1:3999/",
-                "http://127.0.0.1:4000/",
-                "http://[::1]:5000/"
-            ]
-        );
-    }
-
-    fn server(pid: u32, flags: &str) -> (u32, String) {
-        (pid, format!("node /opt/homebrew/bin/codeman web{flags}"))
-    }
-
-    fn listener(pid: u32, host: &str, port: u16) -> Listener {
-        Listener {
-            pid,
-            host: host.into(),
-            port,
-        }
-    }
-
-    /// found_addresses, as strings. The page sends one back in a `connect`,
-    /// so each must be an address the connect takes as it is: the app saves
-    /// a server, and finds its saved login, under that exact string.
-    fn addresses(procs: &[(u32, String)], listeners: &[Listener], default: &str) -> Vec<String> {
-        found_addresses(procs, listeners, &u(default))
-            .iter()
-            .map(|url| {
-                assert_eq!(policy::normalize_server_url(url.as_str()).as_ref(), Ok(url));
-                url.to_string()
-            })
-            .collect()
-    }
-
-    #[test]
-    fn a_found_server_becomes_an_address_the_app_can_try() {
-        let default = "http://127.0.0.1:3000/";
-        let one = |flags: &str, listeners: &[Listener]| addresses(&[server(1, flags)], listeners, default);
-
-        // Every interface and IPv4 loopback are reached at 127.0.0.1.
-        for host in ["*", "0.0.0.0", "[::]", "127.0.0.1"] {
-            assert_eq!(
-                one(" --port 4000", &[listener(1, host, 4000)]),
-                ["http://127.0.0.1:4000/"],
-                "{host}"
-            );
-        }
-        // IPv6 loopback keeps its own address only when it is the server's
-        // only loopback socket.
-        assert_eq!(one("", &[listener(1, "[::1]", 5000)]), ["http://[::1]:5000/"]);
-        assert_eq!(
-            one("", &[listener(1, "[::1]", 5000), listener(1, "127.0.0.1", 5000)]),
-            ["http://127.0.0.1:5000/"]
-        );
-        // A dual-stack bind shows as two sockets, both `*`: one address.
-        assert_eq!(
-            one("", &[listener(1, "*", 5000), listener(1, "*", 5000)]),
-            ["http://127.0.0.1:5000/"]
-        );
-        // A bind to one address stays that address.
-        assert_eq!(
-            one(" --host 192.168.1.5", &[listener(1, "192.168.1.5", 3000)]),
-            ["http://192.168.1.5:3000/"]
-        );
-
-        // --https and --base-url come from the command line, in both spellings.
-        assert_eq!(
-            one(" --https --port 4000 --base-url /codeman/", &[listener(1, "*", 4000)]),
-            ["https://127.0.0.1:4000/codeman/"]
-        );
-        assert_eq!(
-            one(" -p 4000 --base-url=cm", &[listener(1, "127.0.0.1", 4000)]),
-            ["http://127.0.0.1:4000/cm/"]
-        );
-        // The value of --host is never read as a flag, and a base path Codeman
-        // would refuse counts as none.
-        assert_eq!(
-            one(" --host --https -p 4000", &[listener(1, "127.0.0.1", 4000)]),
-            ["http://127.0.0.1:4000/"]
-        );
-        assert_eq!(
-            one(" -p 4000 --base-url /a?b", &[listener(1, "127.0.0.1", 4000)]),
-            ["http://127.0.0.1:4000/"]
-        );
-        // What comes before `web` is node's business.
-        assert_eq!(
-            addresses(
-                &[(1, "node --https /Users/k/.codeman/app/dist/index.js web".to_string())],
-                &[listener(1, "*", 4000)],
-                default
-            ),
-            ["http://127.0.0.1:4000/"]
-        );
-
-        // A server with two listeners. Beside a loopback socket on the same
-        // port, another one is the same server (the Docker bridge listener);
-        // on another port, or with no loopback socket, each is an address.
-        assert_eq!(
-            one("", &[listener(1, "127.0.0.1", 3001), listener(1, "172.17.0.1", 3001)]),
-            ["http://127.0.0.1:3001/"]
-        );
-        assert_eq!(
-            one("", &[listener(1, "172.17.0.1", 3999), listener(1, "127.0.0.1", 3001)]),
-            ["http://127.0.0.1:3001/", "http://172.17.0.1:3999/"]
-        );
-        assert_eq!(
-            one("", &[listener(1, "192.168.1.5", 3001), listener(1, "100.64.0.7", 3001)]),
-            ["http://100.64.0.7:3001/", "http://192.168.1.5:3001/"]
-        );
-
-        // Only the sockets of Codeman servers count: not a control command's,
-        // another program's, or one whose process `ps` did not list.
-        let procs = [
-            server(1, " --port 4000"),
-            (2, "node /opt/homebrew/bin/codeman attach w1".to_string()),
-            (3, "python3 -m http.server 8000".to_string()),
-        ];
-        let sockets = [
-            listener(2, "*", 4100),
-            listener(3, "*", 8000),
-            listener(9, "*", 9000),
-            listener(1, "*", 4000),
-        ];
-        assert_eq!(addresses(&procs, &sockets, default), ["http://127.0.0.1:4000/"]);
-        assert!(addresses(&procs, &sockets[..3], default).is_empty());
-        // An address that makes no URL is left out.
-        assert!(one("", &[listener(1, "not a host", 3001)]).is_empty());
-    }
-
-    #[test]
-    fn found_addresses_start_with_the_default_one_then_go_by_port() {
-        // install.sh's launchd job: a bare `web`, the base path in its environment.
-        let default = "http://127.0.0.1:3001/codeman/";
-        let procs = [
-            (
-                10,
-                "node /x/tsx/cli.mjs /Users/k/codeman/src/index.ts web --port 5000".to_string(),
-            ),
-            (
-                20,
-                "/opt/homebrew/bin/node /Users/k/.codeman/app/dist/index.js web".to_string(),
-            ),
-            server(30, " -p 4000 --https"),
-            // The same address twice: a second process on the port of the first.
-            server(40, " --port 5000"),
-        ];
-        let sockets = [
-            listener(10, "*", 5000),
-            listener(20, "*", 3001),
-            listener(30, "127.0.0.1", 4000),
-            listener(40, "127.0.0.1", 5000),
-        ];
-        assert_eq!(
-            addresses(&procs, &sockets, default),
-            [
-                "http://127.0.0.1:3001/codeman/",
-                "https://127.0.0.1:4000/",
-                "http://127.0.0.1:5000/"
-            ]
-        );
-        // The same list whatever order `ps` and `lsof` gave.
-        let mut reversed_procs = procs.to_vec();
-        reversed_procs.reverse();
-        let mut reversed_sockets = sockets.to_vec();
-        reversed_sockets.reverse();
-        assert_eq!(
-            addresses(&reversed_procs, &reversed_sockets, default),
-            addresses(&procs, &sockets, default)
-        );
-
-        // On the default port, a command line with its own base path or
-        // scheme is taken at its word: it may be another server than the job's.
-        let on_3001 = |flags: &str| addresses(&[server(1, flags)], &[listener(1, "*", 3001)], default);
-        assert_eq!(on_3001(" --port 3001"), [default]);
-        assert_eq!(on_3001(" --port 3001 --base-url /codeman"), [default]);
-        assert_eq!(
-            on_3001(" --port 3001 --base-url /other"),
-            ["http://127.0.0.1:3001/other/"]
-        );
-        assert_eq!(on_3001(" --port 3001 --base-url /"), ["http://127.0.0.1:3001/"]);
-        assert_eq!(on_3001(" --port 3001 --https"), ["https://127.0.0.1:3001/"]);
-        // 127.0.0.1 only: a bind to another address is not the default one.
-        assert_eq!(
-            addresses(&[server(1, "")], &[listener(1, "192.168.1.5", 3001)], default),
-            ["http://192.168.1.5:3001/"]
-        );
-    }
-
-    #[test]
-    fn a_found_server_row_says_what_answered() {
-        let default = u("http://127.0.0.1:3000/");
-        let at = u("http://127.0.0.1:4000/");
-        let row = |answer: ProbeOutcome| found_server(&at, &answer, &default);
-        assert_eq!(
-            row(ProbeOutcome::Ok {
-                version: "1.49.0".into()
-            }),
-            FoundServer {
-                url: "http://127.0.0.1:4000/".into(),
-                version: Some("1.49.0".into()),
-                state: FoundState::Running,
-                is_default: false,
-            }
-        );
-        let state = |answer: ProbeOutcome| {
-            let row = row(answer);
-            assert_eq!(row.version, None);
-            row.state
-        };
-        assert_eq!(state(ProbeOutcome::PasswordChangeRequired), FoundState::Running);
-        for login in [
-            ProbeOutcome::NeedsLogin,
-            ProbeOutcome::BadCredentials,
-            ProbeOutcome::RateLimited {
-                sent_credentials: false,
-                retry_after_secs: Some(60),
-            },
-        ] {
-            assert_eq!(state(login), FoundState::NeedsLogin);
-        }
-        for certificate in [
-            ProbeOutcome::TlsUntrusted {
-                detail: "invalid peer certificate: UnknownIssuer".into(),
-            },
-            ProbeOutcome::MaybeHttps,
-        ] {
-            assert_eq!(state(certificate), FoundState::Certificate);
-        }
-        for silent in [
-            ProbeOutcome::Refused,
-            ProbeOutcome::Timeout,
-            ProbeOutcome::Unreachable,
-            ProbeOutcome::HostNotAllowed,
-            ProbeOutcome::NotCodeman { status: 403 },
-            ProbeOutcome::Failed { detail: "x".into() },
-        ] {
-            assert_eq!(state(silent), FoundState::Unreachable);
-        }
-        assert!(found_server(&default, &ProbeOutcome::Refused, &default).is_default);
-
-        // As the connect page reads it.
-        assert_eq!(
-            serde_json::to_value(row(ProbeOutcome::Ok {
-                version: "1.49.0".into()
-            }))
-            .unwrap(),
-            json!({ "url": "http://127.0.0.1:4000/", "version": "1.49.0", "state": "running", "isDefault": false })
-        );
-        assert_eq!(
-            serde_json::to_value(found_server(&default, &ProbeOutcome::NeedsLogin, &default)).unwrap(),
-            json!({ "url": "http://127.0.0.1:3000/", "version": null, "state": "needsLogin", "isDefault": true })
-        );
-        assert_eq!(
-            serde_json::to_value([FoundState::Certificate, FoundState::Unreachable]).unwrap(),
-            json!(["certificate", "unreachable"])
-        );
-    }
-
-    #[test]
-    fn the_tab_is_about_the_default_address_unless_nothing_answers_there() {
-        let default = u("http://127.0.0.1:3000/");
-        let ok = ProbeOutcome::Ok {
-            version: "1.49.0".into(),
-        };
-        let refused = ProbeOutcome::Refused;
-        let found = vec![
-            (
-                u("https://127.0.0.1:4000/"),
-                ProbeOutcome::TlsUntrusted { detail: "x".into() },
-            ),
-            (u("http://127.0.0.1:5000/"), ProbeOutcome::NeedsLogin),
-            (u("http://127.0.0.1:6000/"), ok.clone()),
-        ];
-        // Nothing at the default address: the first found server that
-        // answers, one that wants a login included.
-        assert_eq!(
-            shown(&default, &refused, &found),
-            (&found[1].0, &ProbeOutcome::NeedsLogin)
-        );
-        assert_eq!(shown(&default, &refused, &found[2..]), (&found[2].0, &ok));
-        // None of them answers: the tab stays on the default address, and
-        // local_state makes that RunningElsewhere.
-        assert_eq!(shown(&default, &refused, &found[..1]), (&default, &refused));
-        assert_eq!(shown(&default, &refused, &[]), (&default, &refused));
-        // Whatever else the default address says is what the tab shows; the
-        // servers found elsewhere are only listed.
-        for answer in [
-            ok.clone(),
-            ProbeOutcome::NeedsLogin,
-            ProbeOutcome::NotCodeman { status: 404 },
-            ProbeOutcome::Timeout,
-            ProbeOutcome::MaybeHttps,
-        ] {
-            assert_eq!(shown(&default, &answer, &found), (&default, &answer));
-        }
-    }
-
-    /// Against real sockets: every address is asked, at the same time, and
-    /// the answers come back in the order of the addresses.
-    #[test]
-    fn found_servers_are_asked_together() {
-        use std::io::Read;
-        use std::net::TcpListener;
-        use std::sync::mpsc;
-
-        /// A server for one request: it reads it, and answers with `response`
-        /// if `ready` says so.
-        fn serve(response: String, ready: impl FnOnce() -> bool + Send + 'static) -> Url {
-            let l = TcpListener::bind("127.0.0.1:0").unwrap();
-            let port = l.local_addr().unwrap().port();
-            std::thread::spawn(move || {
-                if let Ok((mut s, _)) = l.accept() {
-                    let mut head = Vec::new();
-                    let mut buf = [0u8; 4096];
-                    while !head.windows(4).any(|w| w == b"\r\n\r\n") {
-                        match s.read(&mut buf) {
-                            Ok(0) | Err(_) => break,
-                            Ok(n) => head.extend_from_slice(&buf[..n]),
-                        }
-                    }
-                    if ready() {
-                        let _ = s.write_all(response.as_bytes());
-                    }
-                }
-            });
-            u(&format!("http://127.0.0.1:{port}/"))
-        }
-        fn response(status_line: &str, body: &str) -> String {
-            format!(
-                "HTTP/1.1 {status_line}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
-                body.len()
-            )
-        }
-
-        // The first server answers only once the second has been asked. Asked
-        // one after the other, it would hang up without an answer.
-        let (asked, was_asked) = mpsc::channel::<()>();
-        let first = serve(
-            response("200 OK", r#"{"success":true,"data":{"version":"9.9.9"}}"#),
-            move || was_asked.recv_timeout(Duration::from_secs(4)).is_ok(),
-        );
-        let second = serve(response("401 Unauthorized", "Unauthorized"), move || {
-            asked.send(()).is_ok()
-        });
-        let closed = {
-            let l = TcpListener::bind("127.0.0.1:0").unwrap();
-            u(&format!("http://127.0.0.1:{}/", l.local_addr().unwrap().port()))
-        };
-        assert_eq!(
-            ask_found(&[first, second, closed], probe::TIMEOUT),
-            [
-                ProbeOutcome::Ok {
-                    version: "9.9.9".into()
-                },
-                ProbeOutcome::NeedsLogin,
-                ProbeOutcome::Refused,
-            ]
-        );
-
-        // One that does not answer in the time it is given.
-        let slow = serve(String::new(), || {
-            std::thread::sleep(Duration::from_secs(2));
-            false
-        });
-        assert_eq!(ask_found(&[slow], Duration::from_millis(300)), [ProbeOutcome::Timeout]);
-        assert!(ask_found(&[], FOUND_TIMEOUT).is_empty());
+        assert_eq!(listener_url(&found[1]).unwrap().as_str(), "http://172.17.0.1:3999/");
+        assert_eq!(listener_url(&found[2]).unwrap().as_str(), "http://127.0.0.1:4000/");
+        assert_eq!(listener_url(&found[3]).unwrap().as_str(), "http://[::1]:5000/");
     }
 
     #[test]

scripts/git-hooks.mjs

@@ -218,11 +218,6 @@ function canonicalPath(path) {
  * @returns {string | null}
  */
 export function resolveGitHooksDir(repoRoot) {
-  // Not a checkout at all (a source-archive or npm install): answer without running
-  // git. On a Mac without the Xcode Command Line Tools `/usr/bin/git` is a stub that
-  // opens Apple's "install the developer tools" dialog, and this runs on every
-  // `npm install`. `.git` is a directory in a clone and a file in a worktree.
-  if (!existsSync(join(repoRoot, '.git'))) return null;
   try {
     const top = git(repoRoot, ['rev-parse', '--show-toplevel']);
     if (!top || realpathSync(top) !== realpathSync(repoRoot)) return null;

src/types/update.ts

@@ -31,11 +31,8 @@ export type SupervisorKind = 'systemd' | 'launchd' | 'launchd-daemon' | 'docker-
  * How Codeman was installed. `git` and `docker-compose` can self-update in
  * place; `docker-compose` is a git checkout bind-mounted into the container, so
  * the pull/build happen on the host filesystem and survive container recreation.
- * `archive` is what `install.sh` leaves on a machine with no working git (its
- * no-admin route): the source unpacked from an archive, with nothing for the
- * in-app updater to pull into, so it updates by re-running the installer.
  */
-export type InstallKind = 'git' | 'docker-compose' | 'npm' | 'archive' | 'unknown';
+export type InstallKind = 'git' | 'docker-compose' | 'npm' | 'unknown';
 
 /**
  * Why an in-place container update is refused. Each is derived mechanically from

src/web/public/settings-ui.js

@@ -1940,14 +1940,10 @@ Object.assign(CodemanApp.prototype, {
     // `docker-compose` self-updates in place like `git` does — the container
     // restarts itself. Anything else cannot.
     if (data.installKind && data.installKind !== 'git' && data.installKind !== 'docker-compose') {
-      // `archive` = installed by install.sh on a machine with no working git: the
-      // installer replaces it with a fresh build, so point there, not at npm.
       const hint =
         data.supervisor === 'docker-compose'
           ? 'Update from the Docker host with <code>docker/Start-Codeman.sh</code>.'
-          : data.installKind === 'archive'
-            ? 'It was installed without git. Re-run the installer to update: <code>curl -fsSL https://getcodeman.com/install | bash</code>'
-            : 'Update with <code>npm i -g aicodeman@latest</code>.';
+          : 'Update with <code>npm i -g aicodeman@latest</code>.';
       this._setUpdateResult(`This install can't update itself (${escapeHtml(data.installKind)}). ${hint}`);
       return;
     }

src/web/self-update.ts

@@ -462,26 +462,12 @@ export function isRunningInContainer(): boolean {
   return process.env.CODEMAN_IN_CONTAINER === '1' || existsSync('/.dockerenv');
 }
 
-/**
- * Marker `install.sh` writes into an install directory whose source came from an
- * archive instead of a git clone (`SOURCE_MARKER` there; the two names are pinned
- * to each other by `test/install-sh-invariants.test.ts`).
- */
-export const ARCHIVE_INSTALL_MARKER = '.install-source';
-
-/** How an `archive` install updates: the installer replaces it with a fresh build. */
-export const ARCHIVE_UPDATE_HINT =
-  'This install has no git checkout, so it cannot update in place. Re-run the installer to update: ' +
-  'curl -fsSL https://getcodeman.com/install | bash';
-
-export function detectInstallKind(dir: string): InstallKind {
+function detectInstallKind(dir: string): InstallKind {
   // A container whose code is a bind-mounted checkout updates in place (the pull
   // and build land on the host filesystem and survive container recreation). A
   // container WITHOUT that mount runs a baked image copy — a pull there would go
   // to the writable layer and vanish on the next `up`, so it is not updatable.
   if (existsSync(join(dir, '.git'))) return isRunningInContainer() ? 'docker-compose' : 'git';
-  // install.sh on a machine with no working git: the source from an archive.
-  if (existsSync(join(dir, ARCHIVE_INSTALL_MARKER))) return 'archive';
   // Global npm install ships only dist/ (no src/, no .git).
   if (!existsSync(join(dir, 'src'))) return 'npm';
   return 'unknown';
@@ -719,9 +705,7 @@ export async function checkForUpdate(): Promise<UpdateCheckResult> {
       error:
         info.installKind === 'unknown' && isRunningInContainer()
           ? 'This container runs a baked image copy with no repository mounted — self-update is unavailable. See docs/docker-self-update.md.'
-          : info.installKind === 'archive'
-            ? ARCHIVE_UPDATE_HINT
-            : 'Not a git install — self-update is unavailable.',
+          : 'Not a git install — self-update is unavailable.',
     };
   }
 
@@ -845,9 +829,7 @@ export async function startUpdate(): Promise<StartUpdateResult> {
       code: 'not-git',
       message: isRunningInContainer()
         ? 'This container has no repository mounted. Update from the host with docker/Start-Codeman.sh.'
-        : info.installKind === 'archive'
-          ? ARCHIVE_UPDATE_HINT
-          : 'This is not a git install. Update with: npm i -g aicodeman@latest',
+        : 'This is not a git install. Update with: npm i -g aicodeman@latest',
     };
   }
   const existing = readCurrentUpdateStatus();

test/desktop-connect-page.browser.test.ts

@@ -757,27 +757,20 @@ async function everyState(browser: Browser) {
 
   await native({ type: 'localStatus', status: st16('notInstalled') });
   check(
-    'not installed: Install, no Open/Start',
-    (await visible('#local-install')) && !(await visible('#local-open')) && !(await visible('#local-start'))
+    'not installed: Install and the network option, no Open/Start',
+    (await visible('#local-install')) &&
+      (await visible('#local-network-row')) &&
+      !(await visible('#local-open')) &&
+      !(await visible('#local-start')) &&
+      (await page.textContent('#local-detail')).includes('Terminal')
   );
-  // Install opens the graphical install (test/desktop-connect-install.test.ts walks its screens).
-  // The Terminal route is what it offers when it cannot go on, here after a failed preparation.
-  const installInTerminal = async () => {
-    await page.click('#local-install');
-    await native({ type: 'installPrepareFailed', message: 'Could not get the installer.' });
-    await page.click('#wiz-terminal');
-  };
+  await page.click('#local-network');
   n0 = (await all()).length;
   await page.dblclick('#local-install');
   p = (await all()).slice(n0);
-  check('a double click on Install asks for the install once', p.length === 1 && p[0].cmd === 'installPrepare', p);
-  await native({ type: 'installPrepareFailed', message: 'Could not get the installer.' });
-  n0 = (await all()).length;
-  await page.dblclick('#wiz-terminal');
-  p = (await all()).slice(n0);
   check(
-    'Install in Terminal instead posts installLocal once',
-    p.length === 1 && p[0].cmd === 'installLocal' && p[0].network === false,
+    'Install posts installLocal once, with the network choice',
+    p.length === 1 && p[0].cmd === 'installLocal' && p[0].network === true,
     p
   );
   check('Install disabled while Terminal opens', await page.isDisabled('#local-install'));
@@ -786,7 +779,7 @@ async function everyState(browser: Browser) {
     'install failure shown as text, Install enabled again',
     (await page.textContent('#status')).includes('<b>no</b>') && !(await page.isDisabled('#local-install'))
   );
-  await installInTerminal();
+  await page.click('#local-install');
   await page.clock.install();
   await native({ type: 'installStarted', port: 3001 });
   check(
@@ -832,7 +825,7 @@ async function everyState(browser: Browser) {
 
   // A finished install whose service never answers offers Start after 90 s.
   await native({ type: 'localStatus', status: st16('notInstalled') });
-  await installInTerminal();
+  await page.click('#local-install');
   await native({ type: 'installStarted', port: 3000 });
   await native({ type: 'localStatus', status: st16('stopped', { installComplete: true }) });
   await page.clock.runFor(60000);
@@ -848,7 +841,7 @@ async function everyState(browser: Browser) {
   );
   // Stop waiting by hand.
   await native({ type: 'localStatus', status: st16('notInstalled') });
-  await installInTerminal();
+  await page.click('#local-install');
   await native({ type: 'installStarted', port: 3000 });
   n0 = (await all()).length;
   await page.click('#local-stop');
@@ -874,85 +867,15 @@ async function everyState(browser: Browser) {
     p.length === 1 && p[0].cmd === 'localStatus' && p[0].deep === true && p[0].quick === false,
     p
   );
-  const elsewhere = [
-    { url: 'https://127.0.0.1:4000/', version: null, state: 'certificate', isDefault: false },
-    { url: 'http://192.168.1.5:3000/', version: '1.49.0', state: 'running', isDefault: false },
-  ];
-  await native({ type: 'localStatus', status: st16('runningElsewhere', { found: elsewhere }) });
+  await native({ type: 'localStatus', status: st16('runningElsewhere', { elsewhere: ['192.168.1.5:3000'] }) });
   check(
-    'a server running elsewhere: no Start, no Install, a row for each address',
+    'a server running elsewhere: no Start, no Install, says where',
     !(await visible('#local-start')) &&
       !(await visible('#local-install')) &&
       !(await visible('#local-open')) &&
-      (await page.textContent('#local-found')).includes('http://192.168.1.5:3000/') &&
-      (await page.locator('#local-found .found').count()) === 2 &&
+      (await page.textContent('#local-detail')).includes('192.168.1.5:3000') &&
       (await page.textContent('#local-title')).includes('already running')
   );
-  const foundBox = await page.evaluate(() => {
-    const r = (sel) => document.querySelector(sel).getBoundingClientRect();
-    const card = r('.card');
-    const rows = [...document.querySelectorAll('#local-found .found')].map((row) => row.getBoundingClientRect());
-    return {
-      order: [r('.local').bottom, rows[0].top, rows[1].bottom, r('#local-found-note').top, r('#local-check').top],
-      inside: rows.every((row) => row.left >= card.left && row.right <= card.right),
-      buttons: [...document.querySelectorAll('#local-found .found')].map((row) => {
-        const b = row.querySelector('button');
-        return b ? b.className : '';
-      }),
-    };
-  });
-  check(
-    'the rows sit under the title, then the sentence about a second server, then Check again',
-    foundBox.order.every((y, i) => i === 0 || y >= foundBox.order[i - 1]) && foundBox.inside,
-    foundBox
-  );
-  check(
-    'a server the app cannot open has no Connect; the first it can open is the main action',
-    foundBox.buttons[0] === '' && foundBox.buttons[1] === 'primary',
-    foundBox.buttons
-  );
-  n0 = (await all()).length;
-  await page.locator('#local-found .found button').dblclick();
-  p = (await all()).slice(n0);
-  check(
-    'Connect on a found server connects once, to its address',
-    p.length === 1 && p[0].cmd === 'connect' && p[0].url === 'http://192.168.1.5:3000/' && !('password' in p[0]),
-    p
-  );
-  await native({
-    type: 'probeResult',
-    url: 'http://192.168.1.5:3000/',
-    outcome: { kind: 'refused' },
-    canStart: false,
-  });
-  await native({
-    type: 'localStatus',
-    status: st16('running', {
-      version: '1.49.0',
-      outcome: { kind: 'ok', version: '1.49.0' },
-      found: [{ url: 'http://127.0.0.1:3000/', version: '1.49.0', state: 'running', isDefault: true }, elsewhere[1]],
-    }),
-  });
-  const alsoBox = await page.evaluate(() => {
-    const r = (sel) => document.querySelector(sel).getBoundingClientRect();
-    return {
-      open: r('#local-open').bottom,
-      also: r('#local-also').top,
-      rows: document.querySelectorAll('#local-also .found').length,
-      head: document.querySelector('#local-also-head').textContent,
-      button: document.querySelector('#local-also .found button').className,
-    };
-  });
-  check(
-    'running with another server on this Mac: it is listed under Open, as a secondary action',
-    (await visible('#local-open')) &&
-      alsoBox.also >= alsoBox.open &&
-      alsoBox.rows === 1 &&
-      alsoBox.head === 'Also running on this Mac' &&
-      alsoBox.button === 'secondary' &&
-      !(await visible('#local-found')),
-    alsoBox
-  );
   await native({ type: 'localStatus', status: st16('stopped', { url: 'https://127.0.0.1:3000/', service: true }) });
   check(
     'stopped with HTTPS: no Start (the app refuses its certificate), explained',
@@ -1128,7 +1051,7 @@ async function layoutAndLimits(browser: Browser) {
         installComplete: true,
         installRunning: false,
         installPort: null,
-        found: [],
+        elsewhere: [],
         outcome: { kind: 'ok', version: '1.48.0' },
       },
       s
@@ -1365,7 +1288,7 @@ async function clicksKeysAndStates(browser: Browser) {
         installComplete: true,
         installRunning: false,
         installPort: null,
-        found: [],
+        elsewhere: [],
         outcome: { kind: 'ok', version: '1.48.0' },
       },
       s
@@ -1495,24 +1418,6 @@ async function clicksKeysAndStates(browser: Browser) {
     'Return never starts an install',
     (await t.posted('installLocal')).length === 0 && (await t.page.locator('#local-install').isVisible())
   );
-  await t.native(
-    localStatus({
-      state: 'runningElsewhere',
-      version: null,
-      outcome: { kind: 'refused' },
-      found: [
-        { url: 'https://127.0.0.1:4000/', version: null, state: 'certificate', isDefault: false },
-        { url: 'http://127.0.0.1:5000/', version: '1.49.0', state: 'running', isDefault: false },
-      ],
-    })
-  );
-  await t.page.keyboard.press('Enter');
-  check(
-    'Return connects to the server found on this Mac when that is the main action',
-    (await t.posted('connect')).length === 2 && (await t.posted('connect'))[1].url === 'http://127.0.0.1:5000/',
-    await t.posted('connect')
-  );
-  await t.page.keyboard.press('Escape');
   await t.native(localStatus({ state: 'stopped', version: null, outcome: { kind: 'refused' } }));
   await t.page.focus('#local-check');
   await t.page.keyboard.press('Enter');

test/edit-history-sync.test.ts

@@ -428,20 +428,14 @@ describe('EditHistorySync', () => {
     host.append('main', editLine('t1', T0, '/w/a.ts'));
     const orig = host.read;
     let first = true;
-    let inRead!: () => void;
-    const reachedRead = new Promise<void>((r) => (inRead = r));
     host.read = async (...a) => {
       if (first) {
         first = false;
-        inRead();
         await gate;
       }
       return orig(...a);
     };
     const slow = sync.sync(local);
-    // Only once s1 holds the gate: the sessions load their stores independently, so a later one
-    // could reach the read first, take the gate and hang the loop below before `release()`.
-    await reachedRead;
     for (let i = 1; i <= MAX_LOADED_STORES + 1; i++) await sync.sync({ ...local, id: `s1-${i}` });
     release();
     expect(await slow).toEqual({ state: 'ok' });

test/git-hooks.test.ts

@@ -18,7 +18,6 @@ import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { execFileSync, spawnSync } from 'node:child_process';
 import {
   chmodSync,
-  existsSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -172,26 +171,6 @@ describe('resolveGitHooksDir (temp repos)', () => {
     expect(resolveGitHooksDir(dir)).toBeNull();
   });
 
-  it('never runs git for a directory that has no .git', () => {
-    // A source-archive or npm install. On a Mac without the Xcode Command Line Tools
-    // /usr/bin/git is a stub that opens Apple's install dialog, and postinstall calls this
-    // on every `npm install`, so "not a checkout" must be answered without spawning git.
-    const dir = join(scratch, `plain-${++counter}`);
-    const bin = join(scratch, `fakebin-${counter}`);
-    const ran = join(scratch, `git-ran-${counter}`);
-    mkdirSync(dir);
-    mkdirSync(bin);
-    writeFileSync(join(bin, 'git'), `#!/bin/sh\necho ran > "${ran}"\nexit 1\n`, { mode: 0o755 });
-    const path = process.env.PATH;
-    process.env.PATH = `${bin}:${path}`;
-    try {
-      expect(resolveGitHooksDir(dir)).toBeNull();
-    } finally {
-      process.env.PATH = path;
-    }
-    expect(existsSync(ran), 'git was executed for a directory with no .git').toBe(false);
-  });
-
   it('returns null when a repo-local core.hooksPath points outside the repo', () => {
     const repo = newRepo();
     const outside = join(scratch, `shared-hooks-${counter}`);

test/install-sh-invariants.test.ts

@@ -12,12 +12,9 @@
 
 import { describe, expect, it } from 'vitest';
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { STOCK_CLIS } from '../src/config/cli-registry/stock.js';
-import { ARCHIVE_INSTALL_MARKER } from '../src/web/self-update.js';
 
 const INSTALL_SH = fileURLToPath(new URL('../install.sh', import.meta.url));
 const SOURCE = readFileSync(INSTALL_SH, 'utf-8');
@@ -372,362 +369,6 @@ describe('install.sh AI CLI install menu', () => {
   });
 });
 
-describe('install.sh --ai-cli answers the menu up front', () => {
-  // The desktop app installs with no terminal, so the agent is chosen in its window and
-  // arrives as a flag. Everything here runs the real functions in a real bash, with
-  // detection pointed at nothing, every trusted command rewritten to record which entry
-  // ran, and no tty, which is what the app's child process has.
-  const DRIVER = `
-    set -euo pipefail
-    export CODEMAN_INSTALL_SH_LIB=1
-    . "$1"
-    set +e
-    parse_flags "\${@:2}" || exit 9
-    set -e
-    k=0; while [[ $k -lt \${#CLI_ALL_BINS[@]} ]]; do CLI_ALL_BINS[$k]="codeman-test-no-such-bin-$k"; k=$((k + 1)); done
-    k=0; while [[ $k -lt \${#CLI_ALL_PATHS[@]} ]]; do CLI_ALL_PATHS[$k]="/nonexistent/codeman-test/$k"; k=$((k + 1)); done
-    k=0; while [[ $k -lt \${#CLI_INSTALL_CMD_TRUSTED[@]} ]]; do
-      if [[ -n "\${CLI_INSTALL_CMD_TRUSTED[$k]}" ]]; then
-        if [[ "\${KEEP_BREW:-}" == "1" && "\${CLI_INSTALL_CMD_TRUSTED[$k]}" == brew\\ * ]]; then :; else
-          CLI_INSTALL_CMD_TRUSTED[$k]="echo RAN=\${CLI_IDS[$k]}"
-        fi
-      fi
-      k=$((k + 1))
-    done
-    CLI_DETECT_DONE=""
-    detect_all_clis
-    NONINTERACTIVE=\${FORCE_NONINTERACTIVE:-0}
-    DOWNLOADER=curl
-    has_tty() { return 1; }
-    offer_ai_cli_install
-    echo "REACHED THE STEP AFTER THE MENU"
-  `;
-
-  function drive(args: string[], env: Record<string, string> = {}) {
-    const result = spawnSync('bash', ['-c', DRIVER, 'bash', INSTALL_SH, ...args], {
-      encoding: 'utf-8',
-      timeout: 30_000,
-      env: { ...process.env, ...env },
-    });
-    const stdout = result.stdout ?? '';
-    // Anchored: the skip hints print each command's text, so `echo RAN=x` there ran nothing.
-    const ran = [...stdout.matchAll(/^RAN=(.+)$/gm)].map((m) => m[1]);
-    return { status: result.status, stdout, stderr: result.stderr ?? '', ran };
-  }
-
-  it('none installs nothing and carries on, even with CODEMAN_NONINTERACTIVE', () => {
-    const run = drive(['--ai-cli', 'none'], { FORCE_NONINTERACTIVE: '1' });
-    expect(run.stdout, run.stderr).toContain('REACHED THE STEP AFTER THE MENU');
-    expect(run.ran).toEqual([]);
-    expect(run.stderr).toContain('Skipping AI CLI install');
-  });
-
-  it('a named CLI runs that entry and no other, without the menu and without a terminal', () => {
-    const run = drive(['--ai-cli=codex']);
-    expect(run.ran).toEqual(['codex']);
-    expect(run.stdout).not.toContain('Which AI CLI');
-    expect(run.status).toBe(1); // The stand-in command leaves no binary: the gate below still holds.
-    expect(run.stderr).toContain('The selected AI CLI failed to install');
-  });
-
-  it('takes the same answer from CODEMAN_AI_CLI', () => {
-    expect(drive([], { CODEMAN_AI_CLI: 'gemini' }).ran).toEqual(['gemini']);
-  });
-
-  it('a CLI this host cannot install warns and carries on, never installing another', () => {
-    const run = drive(['--no-admin', '--ai-cli', 'omp'], { KEEP_BREW: '1' });
-    if (process.platform === 'darwin') {
-      expect(run.ran).toEqual([]);
-      expect(run.stderr).toContain('omp cannot be installed automatically here');
-      expect(run.stdout).toContain('REACHED THE STEP AFTER THE MENU');
-    } else {
-      expect(run.ran).toEqual(['omp']); // Linux installs omp with curl, not brew.
-    }
-  });
-
-  it('deepseek has no command to run, so it warns and carries on', () => {
-    const run = drive(['--ai-cli', 'deepseek']);
-    expect(run.ran).toEqual([]);
-    expect(run.stderr).toContain('deepseek cannot be installed automatically here');
-    expect(run.stdout).toContain('REACHED THE STEP AFTER THE MENU');
-  });
-
-  it.each([['cluade'], ['shell'], ['--yes']])('refuses %s before anything runs', (id) => {
-    const run = drive([`--ai-cli=${id}`]);
-    expect(run.status).not.toBe(0);
-    expect(run.stderr).toContain('Unknown AI CLI');
-    expect(run.ran).toEqual([]);
-  });
-
-  it('a bare run with no terminal and no answer is still refused by the guard', () => {
-    const run = drive([]);
-    expect(run.status).toBe(1);
-    expect(run.stderr).toContain('No interactive terminal');
-    expect(run.ran).toEqual([]);
-  });
-});
-
-describe('install.sh preflight', () => {
-  function preflight(args: string[], env: Record<string, string> = {}) {
-    const home = mkdtempSync(join(tmpdir(), 'codeman-preflight-'));
-    try {
-      const result = spawnSync('bash', [INSTALL_SH, 'preflight', ...args], {
-        encoding: 'utf-8',
-        timeout: 30_000,
-        env: { ...process.env, HOME: home, ...env },
-      });
-      expect(result.status, result.stderr).toBe(0);
-      return { stdout: result.stdout, home };
-    } finally {
-      rmSync(home, { recursive: true, force: true });
-    }
-  }
-
-  it('prints one JSON object in the shape the desktop app reads', () => {
-    const { stdout } = preflight(['--no-admin']);
-    const found = JSON.parse(stdout);
-    expect(found.schema).toBe(1);
-    expect(found.noAdmin).toBe(true);
-    expect(typeof found.blocker).toBe('string');
-    expect(Object.keys(found.needs).sort()).toEqual(['git', 'node', 'tmux']);
-    for (const key of ['node', 'tmux', 'git']) expect(typeof found.needs[key]).toBe('boolean');
-    // Exactly what src/gui_install.rs deserializes, or the app calls the answer unreadable.
-    for (const cli of found.clis) {
-      expect(Object.keys(cli).sort()).toEqual(['docs', 'id', 'installable', 'installed', 'label']);
-    }
-  });
-
-  it('lists every agent of the catalogue, in its order, and never the shell', () => {
-    const ids = JSON.parse(preflight(['--no-admin']).stdout).clis.map((c: { id: string }) => c.id);
-    const agents = STOCK_CLIS.filter((c) => c.discovery.binaries.length > 0).sort((a, b) => a.order - b.order);
-    expect(ids).toEqual(agents.map((c) => c.id));
-  });
-
-  it('never calls an installed CLI installable, and agrees with the menu on the rest', () => {
-    for (const cli of JSON.parse(preflight(['--no-admin']).stdout).clis) {
-      if (cli.installed) expect(cli.installable, cli.id).toBe(false);
-    }
-    const deepseek = JSON.parse(preflight(['--no-admin']).stdout).clis.find((c: { id: string }) => c.id === 'deepseek');
-    if (!deepseek.installed) expect(deepseek.installable).toBe(false); // A launcher alone cannot drive a pane.
-  });
-
-  it('writes nothing into the home folder', () => {
-    const home = mkdtempSync(join(tmpdir(), 'codeman-preflight-'));
-    try {
-      const result = spawnSync('bash', [INSTALL_SH, 'preflight', '--no-admin'], {
-        encoding: 'utf-8',
-        timeout: 30_000,
-        env: { ...process.env, HOME: home },
-      });
-      expect(result.status).toBe(0);
-      expect(readdirSync(home)).toEqual([]);
-    } finally {
-      rmSync(home, { recursive: true, force: true });
-    }
-  });
-
-  it('json_string survives what a path or a message can hold', () => {
-    const driver = `
-      export CODEMAN_INSTALL_SH_LIB=1
-      . "$1"
-      set +e
-      json_string "$2"
-    `;
-    const text = 'quote " back\\slash tab\t line\nfeed bell\u0007 é ✓';
-    const result = spawnSync('bash', ['-c', driver, 'bash', INSTALL_SH, text], { encoding: 'utf-8', timeout: 30_000 });
-    expect(JSON.parse(result.stdout)).toBe(text.replace('\u0007', ''));
-  });
-});
-
-describe('install.sh agent, one AI CLI and nothing else', () => {
-  // The real subcommand in a real bash, with detection pointed at nothing and every
-  // trusted command rewritten: LEAVES names the binary a stand-in install leaves
-  // behind (on PATH, in the run's own folder), FOUND is a CLI already here.
-  const DRIVER = `
-    set -euo pipefail
-    export CODEMAN_INSTALL_SH_LIB=1
-    . "$1"
-    set +e
-    parse_flags "\${@:2}" || exit 9
-    set -e
-    bin=$(mktemp -d); trap 'rm -rf "$bin"' EXIT; export PATH="$bin:$PATH"
-    k=0; while [[ $k -lt \${#CLI_ALL_BINS[@]} ]]; do CLI_ALL_BINS[$k]="codeman-test-no-such-bin-$k"; k=$((k + 1)); done
-    k=0; while [[ $k -lt \${#CLI_ALL_PATHS[@]} ]]; do CLI_ALL_PATHS[$k]="/nonexistent/codeman-test/$k"; k=$((k + 1)); done
-    k=0; while [[ $k -lt \${#CLI_INSTALL_CMD_TRUSTED[@]} ]]; do
-      if [[ "\${KEEP_COMMANDS:-}" != "1" && -n "\${CLI_INSTALL_CMD_TRUSTED[$k]}" ]]; then
-        CLI_INSTALL_CMD_TRUSTED[$k]="echo RAN=\${CLI_IDS[$k]}; if [[ \${CLI_IDS[$k]} == \\"\${LEAVES:-}\\" ]]; then printf '#!/bin/sh\\n' > $bin/codeman-test-left-$k; chmod +x $bin/codeman-test-left-$k; fi"
-      fi
-      if [[ "\${CLI_IDS[$k]}" == "\${FOUND:-}" ]]; then
-        printf '#!/bin/sh\n' > "$bin/codeman-test-found"; chmod +x "$bin/codeman-test-found"
-        off=\${CLI_BIN_OFF[$k]}; CLI_ALL_BINS[$off]=codeman-test-found
-      fi
-      if [[ "\${CLI_IDS[$k]}" == "\${LEAVES:-}" ]]; then
-        off=\${CLI_BIN_OFF[$k]}; CLI_ALL_BINS[$off]=codeman-test-left-$k
-      fi
-      k=$((k + 1))
-    done
-    if [[ -n "\${NO_NPM:-}" ]]; then check_npm() { return 1; }; fi
-    CLI_DETECT_DONE=""
-    agent_subcommand
-    echo "REACHED THE END"
-  `;
-
-  function agent(args: string[], env: Record<string, string> = {}) {
-    const result = spawnSync('bash', ['-c', DRIVER, 'bash', INSTALL_SH, ...args], {
-      encoding: 'utf-8',
-      timeout: 30_000,
-      env: { ...process.env, CODEMAN_PROGRESS: '', ...env },
-    });
-    const stdout = result.stdout ?? '';
-    const stderr = result.stderr ?? '';
-    return { status: result.status, stdout, stderr, ran: [...stdout.matchAll(/^RAN=(.+)$/gm)].map((m) => m[1]) };
-  }
-
-  it('installs the one it was told to, and says done', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'codex'], { LEAVES: 'codex' });
-    expect(run.status, run.stderr).toBe(0);
-    expect(run.ran).toEqual(['codex']);
-    expect(run.stderr).toContain('@@codeman phase agent');
-    expect(run.stderr).toContain('@@codeman phase done');
-  });
-
-  it('never says done when that agent did not land, even with another one here', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'codex'], { FOUND: 'copilot' });
-    expect(run.ran).toEqual(['codex']);
-    expect(run.status).toBe(1);
-    expect(run.stderr).toContain('@@codeman error Codex did not install.');
-    expect(run.stderr).not.toContain('@@codeman phase done');
-    expect(run.stdout).not.toContain('REACHED THE END');
-  });
-
-  it('says the same with no other agent here, the way a Mac is after Skip for now', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'codex']);
-    expect(run.ran).toEqual(['codex']);
-    expect(run.status).toBe(1);
-    expect(run.stderr).toContain('@@codeman error Codex did not install.');
-    expect(run.stderr).not.toContain('re-run the installer');
-    expect(run.stderr).not.toContain('@@codeman phase done');
-  });
-
-  it('installs nothing for an agent that is here already, and that is a success', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'codex'], { FOUND: 'codex' });
-    expect(run.status, run.stderr).toBe(0);
-    expect(run.ran).toEqual([]);
-    expect(run.stderr).toContain('@@codeman phase done');
-  });
-
-  it('names what is wrong when npm cannot be found, before running anything', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'codex'], { KEEP_COMMANDS: '1', NO_NPM: '1' });
-    expect(run.status).toBe(1);
-    expect(run.stderr).toContain('Codex installs with npm, and this run cannot find it');
-    expect(run.stderr).toContain('npm install -g @openai/codex');
-    expect(run.stderr).not.toContain('@@codeman phase done');
-  });
-
-  it('refuses an agent it cannot install, and installs no other in its place', () => {
-    const run = agent(['--no-admin', '--progress', '--ai-cli', 'deepseek'], { KEEP_COMMANDS: '1' });
-    expect(run.status).toBe(1);
-    expect(run.stderr).toContain('DeepSeek cannot be installed automatically here');
-    expect(run.stderr).not.toContain('@@codeman phase done');
-  });
-
-  it('it takes the name as a plain word, as a person would type it', () => {
-    const driver = `
-      export CODEMAN_INSTALL_SH_LIB=1
-      . "$1"
-      set +e
-      parse_flags "\${@:2}" || exit 9
-      echo "sub=$SUBCOMMAND cli=$AI_CLI_CHOICE"
-    `;
-    const parsed = (...args: string[]) =>
-      spawnSync('bash', ['-c', driver, 'bash', INSTALL_SH, ...args], { encoding: 'utf-8', timeout: 30_000 });
-    expect(parsed('agent', 'codex', '--no-admin').stdout).toContain('sub=agent cli=codex');
-    expect(parsed('agent', '--ai-cli', 'codex').stdout).toContain('sub=agent cli=codex');
-    expect(parsed('agent', 'codx').stderr).toContain('Unknown AI CLI: codx');
-    expect(parsed('agent', 'shell').stderr).toContain('Unknown AI CLI: shell');
-    expect(parsed('agent', 'codex', 'copilot').stderr).toContain('Unexpected argument: copilot');
-    expect(parsed('codex').stderr).toContain('Unexpected argument: codex');
-  });
-
-  it('wants a name, and none is not one', () => {
-    expect(agent([]).stderr).toContain('Name the AI CLI to install');
-    expect(agent(['--ai-cli', 'none']).stderr).toContain('Name the AI CLI to install');
-  });
-
-  it('leaves Codeman alone: nothing in it touches the service, the source or the build', () => {
-    const body = SOURCE.slice(
-      SOURCE.indexOf('\nagent_subcommand() {'),
-      SOURCE.indexOf('\n# Offer to install one AI CLI')
-    );
-    for (const word of ['launchctl', 'systemctl', 'setup_launchd', 'install_or_update_repo', 'npm run', 'sudo']) {
-      expect(body, word).not.toContain(word);
-    }
-    expect(body).toContain('run_offered_cli "$idx"');
-  });
-});
-
-describe('install.sh --progress, the protocol the desktop app reads', () => {
-  const CONNECT_HTML = readFileSync(
-    fileURLToPath(new URL('../packages/desktop/assets/connect.html', import.meta.url)),
-    'utf-8'
-  );
-
-  function mainBody() {
-    const start = SOURCE.indexOf('main() {');
-    const end = SOURCE.indexOf('# Phase 0: look', start);
-    return SOURCE.slice(start, end);
-  }
-
-  it('reports its phases in the order the app draws them, ending on done', () => {
-    const phases = [...mainBody().matchAll(/^\s*progress_phase (\w+)$/gm)].map((m) => m[1]);
-    const drawn = /var PHASES = \[([^\]]*)\]/.exec(CONNECT_HTML)?.[1].match(/\w+/g);
-    expect(phases).toEqual([...(drawn ?? []), 'done']);
-  });
-
-  it('reports done after the service step and before a foreground start replaces the shell', () => {
-    const main = mainBody();
-    expect(main.indexOf('progress_phase done')).toBeGreaterThan(main.indexOf('print_done_screen'));
-    expect(main.indexOf('progress_phase done')).toBeLessThan(main.indexOf('exec node'));
-  });
-
-  function driveProtocol(env: Record<string, string>) {
-    const driver = `
-      export CODEMAN_INSTALL_SH_LIB=1
-      . "$1"
-      set +e
-      progress_phase build
-      error "first
-second"
-    `;
-    return spawnSync('bash', ['-c', driver, 'bash', INSTALL_SH], {
-      encoding: 'utf-8',
-      timeout: 30_000,
-      env: { ...process.env, ...env },
-    });
-  }
-
-  it('prints protocol lines on stderr, one line each, so a $( ) capture stays clean', () => {
-    const run = driveProtocol({ CODEMAN_PROGRESS: '1' });
-    expect(run.stdout).toBe('');
-    expect(run.stderr).toContain('@@codeman phase build\n');
-    expect(run.stderr).toContain('@@codeman error first second\n');
-  });
-
-  it('says nothing of it to a person at a terminal', () => {
-    expect(driveProtocol({ CODEMAN_PROGRESS: '0' }).stderr).not.toContain('@@codeman');
-  });
-
-  it('never prints the password', () => {
-    expect(mainBody()).not.toMatch(/progress_phase.*PASSWORD/);
-    expect(fnBody('error')).not.toMatch(/PASSWORD/);
-  });
-
-  function fnBody(name: string) {
-    const start = SOURCE.indexOf(`${name}() {`);
-    return SOURCE.slice(start, SOURCE.indexOf('\n}\n', start));
-  }
-});
-
 describe('install.sh detect_all_clis and a disabled entry', () => {
   // No stock entry ships disabled today, so this is characterization rather than a regression
   // pin on real data: it drives the real function in a real bash with entry 0 fabricated
@@ -895,410 +536,3 @@ it('install.sh never contains the unauthenticated tunnel opt-in', () => {
   expect(SOURCE).not.toContain('CODEMAN_ALLOW_UNAUTHENTICATED_TUNNEL');
   expect(SOURCE).not.toContain('--allow-unauthenticated-tunnel');
 });
-
-describe('install.sh no-admin route', () => {
-  // The route that installs without administrator rights: Node.js and tmux are downloaded
-  // into the home folder, and a machine with no working git gets the source as an archive.
-  // What can go wrong here is quiet: a sudo prompt that cannot succeed, a binary unpacked
-  // before its checksum was checked, Apple's git stub opening a dialog. So each is pinned.
-  const fn = (name: string, until: string) => {
-    const start = SOURCE.indexOf(`${name}() {`);
-    expect(start, `${name}() missing`).toBeGreaterThan(-1);
-    const end = SOURCE.indexOf(until, start);
-    expect(end, `${until} missing after ${name}()`).toBeGreaterThan(start);
-    return SOURCE.slice(start, end);
-  };
-  const sectionStart = SOURCE.indexOf('# No-admin route: everything into the home folder');
-  const sectionEnd = SOURCE.indexOf('# ---- End of the no-admin route');
-  const section = SOURCE.slice(sectionStart, sectionEnd);
-  const sectionCode = section.split('\n').filter((line) => !/^\s*#/.test(line));
-
-  /** Run a snippet with install.sh sourced as a library, in a real bash. */
-  const drive = (script: string, env: NodeJS.ProcessEnv = {}) => {
-    const clean = { ...process.env, ...env };
-    for (const key of ['CODEMAN_NO_ADMIN', 'CODEMAN_TARBALL_URL', 'CODEMAN_REPO_URL', 'CODEMAN_BRANCH']) {
-      if (!(key in env)) delete clean[key];
-    }
-    const full = `set -euo pipefail\nexport CODEMAN_INSTALL_SH_LIB=1\n. "$1"\n${script}`;
-    return spawnSync('bash', ['-c', full, 'bash', INSTALL_SH], { encoding: 'utf-8', timeout: 30_000, env: clean });
-  };
-
-  it('has its section markers, in order', () => {
-    expect(sectionStart).toBeGreaterThan(-1);
-    expect(sectionEnd).toBeGreaterThan(sectionStart);
-    expect(sectionCode.length).toBeGreaterThan(100);
-  });
-
-  it('never runs sudo, Homebrew or the Xcode tools installer', () => {
-    // Command position only: the messages in this section name `brew install tmux` and
-    // `apt-get install` as things an administrator can run, which is prose.
-    const banned =
-      /(?:^|[;&|]|\b(?:if|then|else|do|while|until)\s|!\s)\s*(?:sudo|brew|ensure_sudo|run_as_root|ensure_homebrew|sudo_session_start|sudo_session_try)\b/;
-    const offenders = sectionCode.filter((line) => banned.test(line) || /xcode-select\s+--install/.test(line));
-    expect(offenders, `privileged call on the no-admin route:\n  ${offenders.join('\n  ')}`).toEqual([]);
-  });
-
-  it('pins a SHA-256 for every tmux build it can download', () => {
-    const digests = fn('tmux_build_sha256', '\n}\n');
-    for (const platform of ['linux-x86_64', 'linux-arm64', 'macos-arm64', 'macos-x86_64']) {
-      expect(digests, `no digest for ${platform}`).toMatch(new RegExp(`${platform}\\)\\s+printf '[0-9a-f]{64}'`));
-      // Every platform the name mapper can produce has a digest, and nothing else does.
-      expect(fn('userspace_tmux_platform', '\n}\n')).toContain(`printf '${platform}'`);
-    }
-    expect(digests.match(/[0-9a-f]{64}/g)?.length).toBe(4);
-    // The asset name and URL are built from the same version the digests were taken for.
-    const install = fn('install_tmux_userspace', '\n}\n');
-    expect(install).toContain('name="tmux-$TMUX_BUILD_VERSION-$platform.tar.gz"');
-    expect(install).toContain('tmux-builds/releases/download/v$TMUX_BUILD_VERSION/$name');
-  });
-
-  it('checks a download before unpacking or running it', () => {
-    for (const name of ['install_node_userspace', 'install_tmux_userspace']) {
-      const body = fn(name, '\n}\n');
-      const verify = body.indexOf('verify_sha256 "$tmp/$name" "$sha"');
-      expect(verify, `${name} never verifies its download`).toBeGreaterThan(-1);
-      expect(body.indexOf('tar -xzf'), `${name} unpacks before verifying`).toBeGreaterThan(verify);
-    }
-    // An empty expected digest must never pass (a lookup that came back with nothing).
-    expect(fn('verify_sha256', '\n}\n')).toContain('[[ -n "$want" ]] || return 1');
-  });
-
-  it('never executes /usr/bin/git on a Mac before the developer tools are proven', () => {
-    // Without the Command Line Tools that path is a stub that opens Apple's install dialog.
-    const body = fn('check_git', '\n}\n');
-    const apple = body.indexOf('"$git_bin" == "/usr/bin/git"');
-    const gate = body.indexOf('xcode-select -p');
-    const run = body.indexOf('"$git_bin" --version');
-    expect(apple).toBeGreaterThan(-1);
-    expect(gate).toBeGreaterThan(apple);
-    // The Apple branch returns on its own evidence; only other gits are executed.
-    expect(body.slice(gate, run)).toMatch(/\n\s+return 1\n\s+fi\n/);
-  });
-
-  it('judges git by whether it runs', () => {
-    const result = drive(`
-      bin=$(mktemp -d); trap 'rm -rf "$bin"' EXIT
-      printf '#!/bin/sh\\nexit 127\\n' > "$bin/git"; chmod +x "$bin/git"
-      PATH="$bin:$PATH"; hash -r
-      check_git && echo "broken=present" || echo "broken=missing"
-      printf '#!/bin/sh\\nexit 0\\n' > "$bin/git"
-      check_git && echo "working=present" || echo "working=missing"
-      # A Mac whose only git is Apple's stub, with and without the developer tools.
-      uname() { echo Darwin; }
-      command() { if [[ "$1" == "-v" && "$2" == "git" ]]; then echo /usr/bin/git; else builtin command "$@"; fi; }
-      xcode-select() { return 2; }
-      check_git && echo "stub=present" || echo "stub=missing"
-      mkdir -p "$bin/dev/usr/bin"; cp "$bin/git" "$bin/dev/usr/bin/git"
-      xcode-select() { echo "$bin/dev"; }
-      check_git && echo "tools=present" || echo "tools=missing"
-    `);
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain('broken=missing');
-    expect(result.stdout).toContain('working=present');
-    expect(result.stdout).toContain('stub=missing');
-    expect(result.stdout).toContain('tools=present');
-  });
-
-  it('decides the route from what the account may do, without asking for a password', () => {
-    // `sudo -v` would prompt, and a refused password is reported to the administrator.
-    expect(fn('resolve_admin_mode', '\n}\n')).not.toMatch(/sudo -v/);
-    const result = drive(`
-      [[ $EUID -ne 0 ]] || { echo "skipped=root"; exit 0; }
-      has_sudo=1
-      command() { if [[ "$1" == "-v" && "$2" == "sudo" ]]; then [[ "$has_sudo" == "1" ]]; elif [[ "$1" == "-v" && "$2" == "brew" ]]; then return 1; else builtin command "$@"; fi; }
-      groups="users"; id() { echo "$groups"; }
-      sudo_ok=1; sudo() { return "$sudo_ok"; }
-      probe() { NO_ADMIN="$1"; NO_ADMIN_REASON=""; resolve_admin_mode; echo "$2=$NO_ADMIN"; }
-      uname() { echo Linux; }
-      has_sudo=0; probe "" linux_no_sudo; has_sudo=1
-      probe "" linux_not_in_group
-      groups="users sudo"; probe "" linux_sudo_group
-      groups="users wheel"; probe "" linux_wheel_group
-      groups="users"; sudo_ok=0; probe "" linux_passwordless; sudo_ok=1
-      probe 0 forced_off
-      groups="users sudo"; probe 1 forced_on
-      uname() { echo Darwin; }
-      groups="staff everyone"; probe "" mac_standard
-      groups="staff admin"; probe "" mac_admin
-    `);
-    expect(result.status, result.stderr).toBe(0);
-    if (result.stdout.includes('skipped=root')) return;
-    for (const expected of [
-      'linux_no_sudo=1',
-      'linux_not_in_group=1',
-      'linux_sudo_group=0',
-      'linux_wheel_group=0',
-      'linux_passwordless=0',
-      'forced_off=0',
-      'forced_on=1',
-      'mac_standard=1',
-      'mac_admin=0',
-    ]) {
-      expect(result.stdout, result.stdout).toContain(expected);
-    }
-  });
-
-  it('stops before the first download when the machine cannot finish the install', () => {
-    // No compiler on Linux, or a Mac older than the tmux build supports: say so while it
-    // costs nothing, not after 50 MB of Node.js.
-    const stop = (env: Record<string, string>) => {
-      const r = drive(
-        `
-        NONINTERACTIVE=1; NO_ADMIN=1; NO_ADMIN_REASON=test
-        download() { echo "DOWNLOAD $1"; }
-        download_to_stdout() { echo "DOWNLOAD $1"; }
-        check_node() { return 1; }; check_tmux() { return 1; }; check_git() { return 0; }
-        detect_arch() { echo "$DRIVE_ARCH"; }
-        check_build_tools() { [[ "$DRIVE_TOOLS" == "1" ]]; }; missing_build_tools() { printf 'make, g++'; }
-        macos_major_version() { printf '%s' "$DRIVE_MACOS"; }
-        is_musl_libc() { [[ "$DRIVE_MUSL" == "1" ]]; }
-        ask_dependencies_no_admin "$DRIVE_OS"
-      `,
-        { DRIVE_ARCH: 'x64', DRIVE_TOOLS: '1', DRIVE_MACOS: '26', DRIVE_MUSL: '0', ...env }
-      );
-      expect(r.status, 'the installer must stop').toBe(1);
-      expect(r.stdout + r.stderr, 'something was downloaded before the stop').not.toContain('DOWNLOAD');
-      return r.stderr;
-    };
-    expect(stop({ DRIVE_OS: 'linux', DRIVE_TOOLS: '0' })).toMatch(/make, g\+\+[\s\S]*administrator/);
-    expect(stop({ DRIVE_OS: 'macos', DRIVE_ARCH: 'arm64', DRIVE_MACOS: '14' })).toMatch(/macOS 15 or newer/);
-    expect(stop({ DRIVE_OS: 'linux', DRIVE_MUSL: '1' })).toMatch(/musl/);
-    expect(stop({ DRIVE_OS: 'linux', DRIVE_ARCH: 'armv7' })).toMatch(/no Node\.js download/);
-  });
-
-  it('picks the right Node.js tarball out of SHASUMS256.txt', () => {
-    const sha = (c: string) => c.repeat(64);
-    const sums = [
-      `${sha('a')}  node-v22.23.4-aix-ppc64.tar.gz`,
-      `${sha('b')}  node-v22.23.4-darwin-arm64.tar.gz`,
-      `${sha('c')}  node-v22.23.4-darwin-arm64.tar.xz`,
-      `${sha('d')}  node-v22.23.4-linux-x64-musl.tar.gz`,
-      `${sha('e')}  node-v22.23.4-linux-x64.tar.gz`,
-      `nothex  node-v22.23.4-linux-arm64.tar.gz`,
-    ].join('\n');
-    const result = drive(
-      `
-      printf '%s\\n' "$SUMS" | pick_node_tarball linux-x64
-      printf '%s\\n' "$SUMS" | pick_node_tarball darwin-arm64
-      printf '%s\\n' "$SUMS" | pick_node_tarball linux-arm64 || echo "arm64=refused"
-      printf '%s\\n' "$SUMS" | pick_node_tarball linux-s390x || echo "s390x=none"
-    `,
-      { SUMS: sums }
-    );
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain(`${sha('e')} node-v22.23.4-linux-x64.tar.gz`);
-    expect(result.stdout).toContain(`${sha('b')} node-v22.23.4-darwin-arm64.tar.gz`);
-    expect(result.stdout).not.toContain('musl');
-    // A line whose checksum is not 64 hex digits is not a checksum to trust.
-    expect(result.stdout).toContain('arm64=refused');
-    expect(result.stdout).toContain('s390x=none');
-  });
-
-  it('refuses a download whose checksum does not match', () => {
-    const result = drive(`
-      f=$(mktemp); trap 'rm -f "$f"' EXIT
-      printf 'codeman' > "$f"
-      good=$(sha256_file "$f")
-      echo "len=\${#good}"
-      verify_sha256 "$f" "$good" && echo "match=ok"
-      verify_sha256 "$f" "\${good%?}x" && echo "tampered=accepted" || echo "tampered=refused"
-      verify_sha256 "$f" "" && echo "empty=accepted" || echo "empty=refused"
-    `);
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain('len=64');
-    expect(result.stdout).toContain('match=ok');
-    expect(result.stdout).toContain('empty=refused');
-    // The last digit swapped for a character no digest contains.
-    expect(result.stdout).toContain('tampered=refused');
-  });
-
-  it('installs from an archive without git, then replaces that install beside itself', () => {
-    const scratch = mkdtempSync(join(tmpdir(), 'codeman-archive-install-'));
-    try {
-      const make = (version: string) => {
-        const tree = join(scratch, `src-${version}`, `Codeman-${version}`);
-        mkdirSync(join(tree, 'src'), { recursive: true });
-        writeFileSync(join(tree, 'package.json'), `{ "version": "${version}" }\n`);
-        writeFileSync(join(tree, 'src', `only-in-${version}.ts`), '');
-        const tarball = join(scratch, `${version}.tar.gz`);
-        const tar = spawnSync('tar', ['-czf', tarball, '-C', join(scratch, `src-${version}`), `Codeman-${version}`]);
-        expect(tar.status, String(tar.stderr)).toBe(0);
-        return tarball;
-      };
-      const first = make('1.0.0');
-      const second = make('2.0.0');
-      const app = join(scratch, 'app');
-      const script = `
-        LOG_FILE=/dev/null
-        check_git() { return 1; }
-        download() { cp "\${1#file://}" "$2"; }
-        run_step() { shift; "$@"; }
-        install_or_update_repo
-        echo "staging=[$SOURCE_STAGING] cwd=$(pwd)"
-        finish_source_swap
-        echo "after=$(pwd)"
-      `;
-      const run = (tarball: string) =>
-        drive(script, { CODEMAN_INSTALL_DIR: app, CODEMAN_TARBALL_URL: `file://${tarball}`, HOME: scratch });
-
-      // First install: straight into the install directory, marked as an archive install.
-      const fresh = run(first);
-      expect(fresh.status, fresh.stderr).toBe(0);
-      expect(fresh.stdout).toContain('staging=[]');
-      expect(readFileSync(join(app, 'package.json'), 'utf-8')).toContain('1.0.0');
-      expect(existsSync(join(app, ARCHIVE_INSTALL_MARKER))).toBe(true);
-
-      // Second run: the new tree is built BESIDE the old one, which stays whole until the swap.
-      writeFileSync(join(app, 'built-by-1.0.0'), '');
-      const update = run(second);
-      expect(update.status, update.stderr).toBe(0);
-      expect(update.stdout).toContain(`staging=[${app}.new] cwd=${app}.new`);
-      expect(update.stdout).toContain(`after=${app}`);
-      expect(readFileSync(join(app, 'package.json'), 'utf-8')).toContain('2.0.0');
-      // A whole replacement: what the old version had and the new one dropped is gone.
-      expect(existsSync(join(app, 'src', 'only-in-1.0.0.ts'))).toBe(false);
-      expect(existsSync(join(app, 'built-by-1.0.0'))).toBe(false);
-      expect(existsSync(join(app, ARCHIVE_INSTALL_MARKER))).toBe(true);
-      expect(existsSync(`${app}.new`)).toBe(false);
-      expect(existsSync(`${app}.old`)).toBe(false);
-
-      // A folder that is neither a checkout nor one of ours is never written into.
-      const foreign = join(scratch, 'foreign');
-      mkdirSync(foreign);
-      writeFileSync(join(foreign, 'notes.txt'), 'mine');
-      const refused = drive(script, {
-        CODEMAN_INSTALL_DIR: foreign,
-        CODEMAN_TARBALL_URL: `file://${first}`,
-        HOME: scratch,
-      });
-      expect(refused.status).toBe(1);
-      expect(refused.stderr).toContain('is not a Codeman install');
-      expect(readFileSync(join(foreign, 'notes.txt'), 'utf-8')).toBe('mine');
-    } finally {
-      rmSync(scratch, { recursive: true, force: true });
-    }
-  });
-
-  it('downloads from a subcommand that never ran the full flow', () => {
-    // DOWNLOADER used to be set only by main(), so `install.sh cloudflared` (and now the
-    // update of an archive install) died inside download() on an unbound variable.
-    const result = drive(`
-      unset DOWNLOADER
-      curl() { echo "FETCH $*"; }
-      wget() { echo "FETCH $*"; }
-      download https://example.invalid/a /tmp/never-written
-      unset DOWNLOADER
-      download_to_stdout https://example.invalid/b
-    `);
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toMatch(/FETCH .*example\.invalid\/a/);
-    expect(result.stdout).toMatch(/FETCH .*example\.invalid\/b/);
-  });
-
-  it('builds the archive URL from the repository and branch, on GitHub only', () => {
-    const url = (env: NodeJS.ProcessEnv) => drive('source_tarball_url || echo REFUSED', env).stdout.trim();
-    expect(url({})).toBe('https://github.com/Ark0N/Codeman/archive/master.tar.gz');
-    expect(url({ CODEMAN_REPO_URL: 'https://github.com/someone/fork.git', CODEMAN_BRANCH: 'feat/x' })).toBe(
-      'https://github.com/someone/fork/archive/feat/x.tar.gz'
-    );
-    expect(url({ CODEMAN_REPO_URL: 'https://gitlab.com/someone/fork.git' })).toBe('REFUSED');
-    expect(url({ CODEMAN_REPO_URL: 'git@github.com:someone/fork.git' })).toBe('REFUSED');
-    expect(url({ CODEMAN_TARBALL_URL: 'https://mirror.example/codeman.tar.gz' })).toBe(
-      'https://mirror.example/codeman.tar.gz'
-    );
-  });
-
-  it('shares the archive marker name with the in-app updater', () => {
-    // install.sh writes it, src/web/self-update.ts reads it to tell such an install how to
-    // update. A rename on one side would send archive installs back to the npm advice.
-    expect(SOURCE).toContain(`SOURCE_MARKER="${ARCHIVE_INSTALL_MARKER}"`);
-  });
-
-  it('treats a completed archive install as an install: quiet update on a re-run', () => {
-    const dispatch = SOURCE.slice(SOURCE.indexOf('\nparse_flags "$@"'));
-    expect(dispatch).toMatch(
-      /-f "\$INSTALL_DIR\/\.install-complete" \]\] && \[\[ -d "\$INSTALL_DIR\/\.git" \|\| -f "\$INSTALL_DIR\/\$SOURCE_MARKER" \]\]/
-    );
-    const update = fn('update', '\nuninstall() {');
-    expect(update).toContain('! -f "$INSTALL_DIR/$SOURCE_MARKER"');
-    // The swap happens only after the build has succeeded.
-    expect(update.indexOf('finish_source_swap')).toBeGreaterThan(update.indexOf('npm run build'));
-    const main = fn(
-      'main',
-      '\n# ----------------------------------------------------------------------------\n# Phase 0'
-    );
-    expect(main.indexOf('finish_source_swap')).toBeGreaterThan(main.indexOf('npm run build'));
-    expect(main.indexOf('finish_source_swap')).toBeLessThan(main.indexOf('install_symlink'));
-  });
-
-  it('documents --no-admin where people look for flags, and resolves the route before any work', () => {
-    expect(fn('usage', '\n}\n')).toContain('--no-admin');
-    const dispatch = SOURCE.slice(SOURCE.indexOf('\nparse_flags "$@"'));
-    expect(dispatch.indexOf('resolve_admin_mode')).toBeGreaterThan(-1);
-    expect(dispatch.indexOf('resolve_admin_mode')).toBeLessThan(dispatch.lastIndexOf('case "$SUBCOMMAND" in'));
-    expect(dispatch.indexOf('adopt_userspace_runtime')).toBeLessThan(dispatch.indexOf('resolve_admin_mode'));
-  });
-
-  it('puts the downloaded runtime on the LaunchAgent PATH', () => {
-    // The agent's PATH is a fixed list (Homebrew, /usr/local, ~/.local/bin, the system). A
-    // Node.js in the home folder is outside it, and so is everything `npm install -g` puts
-    // beside that Node.js: the AI CLIs, whose launchers start with `#!/usr/bin/env node`.
-    // A machine with a real LaunchDaemon makes the function stand down, so skip there.
-    if (existsSync('/Library/LaunchDaemons/com.codeman.web.plist')) return;
-    const home = mkdtempSync(join(tmpdir(), 'codeman-agent-path-'));
-    const result = drive(
-      `
-      mkdir -p "$RUNTIME_DIR/node/bin" "$RUNTIME_DIR/bin" "$HOME/.local/bin"
-      printf '#!/bin/sh\n' > "$RUNTIME_DIR/node/bin/node"; chmod +x "$RUNTIME_DIR/node/bin/node"
-      printf '#!/bin/sh\n' > "$RUNTIME_DIR/bin/tmux"; chmod +x "$RUNTIME_DIR/bin/tmux"
-      ln -s "$RUNTIME_DIR/node/bin/node" "$HOME/.local/bin/node"
-      PATH="$HOME/.local/bin:$PATH"; hash -r
-      launchctl() { return 0; }
-      sleep() { :; }
-      BIND_HOST=127.0.0.1
-      setup_launchd_service >/dev/null 2>&1
-      cat "$HOME/Library/LaunchAgents/com.codeman.web.plist"
-    `,
-      { HOME: home }
-    );
-    rmSync(home, { recursive: true, force: true });
-    expect(result.status, result.stderr).toBe(0);
-    const path = /<key>PATH<\/key>\s*<string>([^<]*)<\/string>/.exec(result.stdout)?.[1] ?? '';
-    const dirs = path.split(':');
-    expect(dirs).toContain(`${home}/.codeman/runtime/node/bin`);
-    expect(dirs).toContain(`${home}/.codeman/runtime/bin`);
-    expect(dirs).toContain(`${home}/.local/bin`);
-    expect(dirs).toContain('/usr/bin');
-    expect(new Set(dirs).size, `duplicate PATH entries: ${path}`).toBe(dirs.length);
-    expect(result.stdout).toContain(`<string>${home}/.local/bin/node</string>`);
-  });
-
-  it('links only into its own runtime, and removes only its own links', () => {
-    // ~/.local/bin is the user's folder: a tmux or node they put there is never replaced on
-    // install and never deleted on uninstall.
-    const home = mkdtempSync(join(tmpdir(), 'codeman-links-'));
-    const result = drive(
-      `
-      mkdir -p "$HOME/.local/bin" "$RUNTIME_DIR/bin"
-      touch "$RUNTIME_DIR/bin/tmux" "$RUNTIME_DIR/bin/node"
-      printf 'mine' > "$HOME/.local/bin/tmux"
-      link_into_local_bin "$RUNTIME_DIR/bin/tmux" tmux && echo "foreign=replaced" || echo "foreign=kept"
-      link_into_local_bin "$RUNTIME_DIR/bin/node" node && echo "fresh=linked"
-      link_into_local_bin "$RUNTIME_DIR/bin/node" node && echo "ours=relinked"
-      echo "tmux=$(cat "$HOME/.local/bin/tmux") node=$(readlink "$HOME/.local/bin/node")"
-    `,
-      { HOME: home }
-    );
-    rmSync(home, { recursive: true, force: true });
-    expect(result.status, result.stderr).toBe(0);
-    expect(result.stdout).toContain('foreign=kept');
-    expect(result.stdout).toContain('fresh=linked');
-    expect(result.stdout).toContain('ours=relinked');
-    expect(result.stdout).toMatch(/tmux=mine node=.*\/\.codeman\/runtime\/bin\/node/);
-
-    const body = fn('uninstall', '\nusage() {');
-    const rm = body.indexOf('rm -f "$symlink_dir/$runtime_tool"');
-    expect(rm).toBeGreaterThan(-1);
-    expect(body.slice(body.lastIndexOf('if [[', rm), rm)).toContain('== "$RUNTIME_DIR/"*');
-  });
-});

test/self-update.test.ts

@@ -6,16 +6,8 @@
  *   npm test -- test/self-update.test.ts
  */
 
-import { describe, it, expect, afterAll } from 'vitest';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { describe, it, expect } from 'vitest';
 import {
-  ARCHIVE_INSTALL_MARKER,
-  ARCHIVE_UPDATE_HINT,
-  canSelfUpdateInPlace,
-  detectInstallKind,
-  isRunningInContainer,
   parseVersionFromTag,
   compareVersions,
   isNewerStableVersion,
@@ -213,39 +205,3 @@ describe('expireStalledStatus (runtime staleness backstop)', () => {
     expect(expireStalledStatus(base({ phase: 'failed', updatedAt: NOW - 60 * MIN }), NOW)).toBeNull();
   });
 });
-
-describe('detectInstallKind', () => {
-  const scratch = mkdtempSync(join(tmpdir(), 'codeman-install-kind-'));
-  afterAll(() => rmSync(scratch, { recursive: true, force: true }));
-  let n = 0;
-  const tree = (entries: string[]) => {
-    const dir = join(scratch, `install-${++n}`);
-    mkdirSync(dir);
-    for (const entry of entries) {
-      if (entry.endsWith('/')) mkdirSync(join(dir, entry));
-      else writeFileSync(join(dir, entry), 'archive\n');
-    }
-    return dir;
-  };
-
-  it('reads a source-archive install (install.sh without a working git) as archive', () => {
-    const dir = tree(['src/', 'dist/', ARCHIVE_INSTALL_MARKER]);
-    expect(detectInstallKind(dir)).toBe('archive');
-    // Nothing to pull into, so it never self-updates in place; the hint names the installer.
-    expect(canSelfUpdateInPlace('archive')).toBe(false);
-    expect(ARCHIVE_UPDATE_HINT).toContain('getcodeman.com/install');
-    expect(ARCHIVE_UPDATE_HINT).not.toContain('npm i -g');
-  });
-
-  it('lets a real checkout win over a leftover marker', () => {
-    // A re-run of the installer on a machine that gained git replaces the archive tree with
-    // a clone; were a marker ever left beside .git, the checkout is still what counts.
-    const dir = tree(['.git/', 'src/', ARCHIVE_INSTALL_MARKER]);
-    expect(detectInstallKind(dir)).toBe(isRunningInContainer() ? 'docker-compose' : 'git');
-  });
-
-  it('keeps npm and unknown as they were', () => {
-    expect(detectInstallKind(tree(['dist/']))).toBe('npm');
-    expect(detectInstallKind(tree(['dist/', 'src/']))).toBe('unknown');
-  });
-});