Compare main … draft-ready

# The CI profile (#307): every test runs, and a JUnit report is

# written to target/nextest/ci/junit.xml for the hub's test report

# (the job's `junit` artifact).

[profile.ci]

fail-fast = false

# A test still running after ten minutes is stopped and fails (#365):

# a hang in run #537 held its runner for an hour.

slow-timeout = { period = "60s", terminate-after = 10 }

[profile.ci.junit]

path = "junit.xml"

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    // Under cargo-nextest (#307): a JUnit report for the hub's Tests tab,

    // kept whether or not the tests pass.

    exec "sh" ".flow/warm-target.sh" "cargo" "nextest" "run" "--workspace" "--locked" "--profile" "ci"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

    }

}

// Line coverage (#307) for the Coverage tab: the tests again, instrumented,

// in a job of its own beside `test`, so neither waits for the other and the

// instrumented build keeps its own cached target. Not a required check.

job "coverage" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "48GiB"

        cache "coverage-target"

        key "Cargo.lock"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

        }

        artifact "oh-src.tar.gz" {

            path "/src/target/dist-flat/oh-src.tar.gz"

# Under nextest, as the test job: a test that hangs is stopped at the CI

# profile's limit and reported, not left holding the runner (#365).

exec sh .flow/warm-target.sh cargo nextest run -p oxygenhub --features postgres --locked --profile ci

# oxygen#145: two changes that each add a changelog entry in the same

# place keep both, without a conflict.

CHANGELOG.md merge=union

## 0.9.24 (2026-11-04)

- **A fresh New repository page (#360):** owner and name side by side with a live check that the name is free and valid and the address it will have; visibility as three described choices; **Start with** a README, a licence (MIT, BSD 2-Clause or ISC, with what each allows) and an `.oxyignore` for a language, committed as you with the hub signing as your delegate (it says what to do first when you have not delegated, before anything is made); and a **project board** with it: a new one (Backlog, Doing, Done, on by default for an organisation) or one of the owner's, which takes the repository's issues and proposals as they open. Storage moves under its own heading. The API's create takes the same (`project: {"new": TITLE} | {"number": N}`, `readme`, `licence`, `ignore`), and `oh repo create OWNER/NAME [--project new:TITLE|N] [--readme] [--licence MIT] [--ignore Rust]`.

- **oxygenhub.io links open the Android app (#370):** `/.well-known/assetlinks.json` vouches for the app (its package and release key's fingerprint, `[push] android_apps` to change), so Android opens the hub's links in it once the app claims them (oxygenhub-android#36).

- **The changelog is checked on the WASM tier:** a `changelog` job in the pipeline runs OxygenFlow's checks module (no image, no KVM; a phone or plex takes it) and fails when the changelog's sections are out of shape or Cargo.toml's version has none.

- **Board views (#361):** a board shows what matters now and other views of the same cards.

  - **Saved views** as tabs across the top: a layout with its filter, lanes and order, saved under a name and shared by its address (`?view=NAME`).

  - **One filter bar** for every view: words, `repo:`, `assignee:`, `label:`, `milestone:` (quote a title with spaces), `state:`, `is:open|closed`, `age:>14d` and `age:<7d`.

  - **Board**: swimlanes by repository, assignee, label or milestone; a **work-in-progress limit** per column, whose header turns to the warning colour past it; **Done shows this iteration's work** while one is open, saying how many cards finished before it; and **compact cards** (labels as dots).

  - **Table**: every card as a row (title, reference, state, column, assignees, labels, milestone, opened), sortable, grouped, a column changed in place, 50 rows a page.

  - **Keys**: `j`/`k` between cards, `Enter` opens one, `m` moves it, `/` filters.

  - **History**: every card's moves (added, moved, archived, restored, removed) are kept from now on, for the charts and forecasts of #357.

  - The API answers `GET /projects/{owner}/{n}?q=` or `?view=NAME` with the filter applied, and lists the board's views and each column's limit; `oh project view N --filter TEXT` or `--view NAME`.

- **A hung test no longer holds a runner (#365):** the PostgreSQL tests run under nextest like the rest, and CI stops any test still running after ten minutes; the history scan's tests have four worker threads and a two-minute bound of their own. Two of them once sat for an hour on plex-1.

- **Charts and forecasts from the board's own history (#357):** a **Charts** tab on every board, with no estimates to keep.

  - **Forecasts**: a Monte Carlo of the board's weekly throughput (the last 12 weeks, or its life if shorter) says when the open cards will be done, at 50% and 85%: for the open iteration or the whole board, for each milestone, and for any filter. It says how many weeks it rests on, and says plainly when there is nothing to go on. Seeded by the board and the day, so it does not change between page loads.

  - **Cycle time** (leaving the first column to reaching Done: median and 85th percentile), **throughput** (cards done each week), the open iteration's **burn-down** with its scope, and **cumulative flow** (cards per column per day over 60 days, a widening band showing where work waits).

  - **Timeline** (#361): iterations as spans and milestones with their due dates and forecast bands on one time axis, today marked.

  - Drawn server-side as SVG in the hub's chart style, readable in both themes, each with its numbers in a table. `GET /projects/{owner}/{n}/charts` (`?q=`) gives the series and forecasts; `oh project charts N [-q FILTER]`.

## 0.9.23 (2026-11-03)

- **A push no longer stops main's running run (#369):** a push cancels its bookmark's older push runs, and those already running too unless Settings › OxygenFlow keeps them; on the default bookmark, where releases are cut from the run of their commit, a running push run now always finishes, and only queued ones are cancelled. A release commit's run lost to the next push is what prompted it.

- **A board's columns from the API and `oh` (#366):** `POST /projects/{owner}/{n}/columns` adds one at the right, `PATCH …/columns/{column}` (by id or name) renames it or moves it to a `position`, and `DELETE` removes it, its cards going to the first remaining column; each answers the board. `oh project column add|rename|move|remove BOARD …` (`move --to N`, counting from 1 at the left, `--left`, `--right`), so a sprint column is renamed without the web page.

- **`oh run watch` and `oh run view` take the newest run (#367):** with no number they follow or show the newest run, or the newest of `--bookmark NAME`, so the run a push just started needs no lookup.

- **`oh issue close` and `reopen` say why (#368):** `-b`, `-F` and `--attach` post a comment first, in the same command.

## 0.9.22 (2026-11-02)

- **Pictures in issues and comments fit their box (#364):** an attached screenshot was shown at its own size, running out of the card on a phone and dwarfing the text on a desktop; pictures in all rendered Markdown now scale down to the width they have.

## 0.9.21 (2026-11-01)

- **Added: your phone as the second factor, and the sudo step (#356).** With two-factor sign-in on, the OxygenHub app can add the phone as a second factor (its Keystore key, opened by your fingerprint, face or PIN; adding it needs a current app code). Signing in then shows a two-digit number and waits: the phone offers three, you pick the one shown and confirm, and the browser carries on, with "Use a code instead" always there. A wrong number is a no. Before sensitive changes (password, two-factor settings, keys, tokens, secrets, webhooks, collaborators, deleting or transferring a repository, anything under Administration) a session that has not proved a second factor in 15 minutes is asked again at `/sudo`: the phone, a code, or the password for an account without two-factor. Settings › Security lists the phones; turning app codes off removes them. API: `/api/v1/user/authenticators`, `/api/v1/user/approvals`; migration 0104.

## 0.9.20 (2026-11-01)

- **Added: `GET /api/v1/user/issues` (#359).** The open issues assigned to you, in repositories you can see, newest-updated first, as the dashboard's "Assigned to you" lists them, each with its repository and address; for apps, first the Android widget's issue count (oxygenhub-android#31).

## 0.9.19 (2026-11-01)

- **Added: attachments on issues and comments (#350).** Screenshots and any other file: `POST /api/v1/repos/OWNER/NAME/attachments?name=FILE` with the file's bytes answers with its address and the Markdown to use, and `oh issue create` and `oh issue comment` take `--attach FILE` (repeatable), so a screenshot pasted into Claude Code can go onto the issue it files. An image (by its bytes: PNG, JPEG, GIF, WebP) shows in place; anything else, SVG included, is a download. Attachments are served under the repository's read rules and can run nothing (no sniffing, a policy that allows nothing, never in a shared cache). Pasting and dragging into the web editors come later.

## 0.9.18 (2026-10-31)

- **Added: `oh mcp`, OxygenHub for AI agents (#353).** An MCP server on stdio for the repository `oh` resolves: tools to read issues, proposals with their files and checks, OxygenFlow runs, job logs, reports, test results, releases, drops and the inbox; with `--allow-write`, to open, comment on and close issues, comment on proposals and re-run Flow runs. What people wrote on the hub comes back under `untrusted`, so an agent reads it as data, never as instructions. Built on oxy-core's MCP module (oxygen#159). See docs/oh.md.

- **Fixed: agents show on the website (#352).** A change a keyless agent sealed (Kimi, Antigravity, Claude: `author.signer = keyless` seals at push) showed as unsigned on change pages, history, proposals and the API, because the hub read only a change's own signature. It now reads seals too: the change says sealed, with "via agent:NAME@you" and "keyless, under your grant", and the Contributors panel names the agent under you. **Help › AI identities** now sets the agent's author (your name, email and the key you make its grant with, filled in when you are signed in) and copies your public identity into its home; without them an agent's changes were unattributed.

- **Kimi has its own avatar (#351).** Changes signed via an agent named Kimi (`agent:kimi@…`, or Moonshot) now show a Kimi mark, a white K with a blue dot on a dark disc, instead of an identicon, as Claude, Gemini and the others have theirs.

## 0.9.17 (2026-10-29)

- **Drops over the API: fork, star and comment (#349).** What a drop's page does, for the VS Code extension and other clients: `POST /api/v1/drops/{id}/fork`, `PUT`/`DELETE /api/v1/drops/{id}/star`, `GET`/`POST /api/v1/drops/{id}/comments` and `DELETE /api/v1/drops/{id}/comments/{n}`, by the web's rules (the owner told of a comment; its author, the owner or an administrator deletes it). A drop over the API now says its stars, whether you starred it, what it was forked from and its embed address. `oh drop fork|star|unstar|comments|comment`. The API's TypeScript types now include the dashboard's proposals, the starter and test reports.

## 0.9.16 (2026-10-29)

- **A release's asset at a fixed address (oxygen#157).** `/OWNER/NAME/releases/download/TAG/FILE` redirects to the asset, an address known before the release exists (as GitHub's), so a packager's recipe can name it.

- **Releases carry their source (oxygen#157).** Each release now has `oh-VERSION-src.tar.gz`: the oxygenhub tree with its subrepos inside, so oh builds from it alone, reproducible and listed in SHA256SUMS, for packagers (haikuports' oh recipe).

- **A phone's runner follows the app's releases (oxygenflow#84).** A runner on Android is part of the OxygenHub app, so the hub never offers it a runner build: with updates on, it is told it follows the app's releases (update the app to update it), and Admin › Runners › Updates says so.

## 0.9.15 (2026-10-28)

- **Run a pipeline's WASM jobs in your browser (oxygenflow#80, first part).** Flow › *run in this tab* (`/OWNER/NAME/flow/tab`) lists the jobs of a bookmark's pipeline whose sandbox is `runtime "wasm"` and runs them in this tab, as a runner's WASM tier does: a worker fetches the bookmark's files as a zip once, unpacks them in memory and runs each job's modules with a WASI preview 1 shim, the files at `/src` and as the current directory, the job's arguments and environment, its output shown as it comes, its exit code and time; Run all, Run and Stop per job. Nothing is claimed or reported: it shows the tier in a browser before a tab can take jobs as a runner.

- **Runner builds through the swarm (oxygenflow#84).** The first time the hub offers a runner build, it cuts the release asset into its image chunks, as an image named by the build's BLAKE3, so a runner in a swarm (OxygenFlow 0.5.2) fetches it from its site's peers and the hub together and the hub serves it about once per site; Admin › Runners › Images lists it as "runner build flow VERSION".

## 0.9.14 (2026-10-28)

- **Read a Flow job's report over the API and with `oh` (#348).** A report a job published could only be read on its web page. Now `GET /api/v1/repos/OWNER/NAME/flow/runs/N/jobs/JOB/report` gives it with its metrics, context and files, `…/report/PATH` one file as published (`data/frames.csv`), `…/jobs/JOB/reports` every report the job published, `GET …/reports` the newest run of each report (`?bookmark=`), and `GET …/reports/NAME` one run by `?id=` (the id the web page carries) or the newest on a bookmark, with `…/files/PATH`. Files come sandboxed, so a page in one runs nothing on the hub; errors name the jobs, reports and files there are. `oh run report RUN JOB` prints its `report.toml`, `--list` what it holds, `--file PATH [-o FILE]` one file; `oh report list` and `oh report show NAME` do the same by name.

- **A job's timings over the API (#348).** A run's jobs now say when each was queued and claimed, the phases its runner reported (image, prepare, run, finish, in milliseconds) and its peak disk and memory; `oh run view N --timings` prints them under each job ("waited 12.0 s · image 850 ms · run 2 min 5 s · peak disk 2.1 GiB, memory 900 MiB").

## 0.9.13 (2026-10-28)

- **An assistant drafts a new repository's starting files (#347).** Creating a repository can come with a description of what it is for: `POST /api/v1/repos/OWNER/NAME/starter {"description"}` asks the owner's assistant (the site's, or the organisation's) for a small working starting point (a README, the build files, a source layout and a first test), checks what comes back (relative paths, text, at most 40 files and 256 KiB), and commits it to the empty repository's default bookmark as the person who asked, signed by the hub as their delegate, the change naming the assistant and what was asked. It runs in the background, since a model may take longer than a proxied request may last; `GET …/starter` says how it went, and `GET /api/v1/user/starter?owner=X` which assistants may be asked. Never over files that are there. The Android app's New repository uses it.

- **Your Flow runs over the API (oxygenhub-android#26).** `GET /api/v1/user/flow/runs` gives the newest runs of the repositories you belong to, each with its repository and jobs (`?before=MS` pages back), for the Android app's Flow monitor.

## 0.9.12 (2026-10-28)

- **A repository's sky over the API (oxygenhub-android#23).** `GET /api/v1/repos/OWNER/NAME/sky` gives the backdrop a repository's pages draw (#196), its events of the last 30 days, in the shape of `/user/sky`, for the Android app's repository screen; read access, as the repository's pages.

- **Runner updates in waves (oxygenflow#84).** A test group can be given a wave (1 to 9) on Admin › Runners › Updates or an organisation's settings: a new version reaches wave 2's runners only once every runner of wave 1 that took it has finished a number of jobs on it (5 by default) with none ending in error, or a number of hours (24) has passed since its first job there; runners in no wave come last. A job that ends in `error` on a wave's runner (the runner's or the machine's fault; failed tests do not count) stops the version: the next runner to ask holds it for every runner, and the page names the job, until an administrator lifts the hold. Each job now keeps the runner build it was claimed by (migration 0102). A runner waiting says so: "flow 0.5.1 waits for wave 1 to prove it: 1 of 2 runners on it, 3 jobs". First slice: errors are not yet weighed against the version before, and a stopped wave's runners are not rolled back by the hub.

## 0.9.11 (2026-10-28)

- **Your sky over the API (oxygenhub-android#23).** `GET /api/v1/user/sky` gives what the dashboard's backdrop draws: the caller's repositories and their pushes, proposal and issue events, releases and Flow runs of the last 30 days, so the Android app draws the same sky from the same data.

- **Another repository's pass is taken only on its signed receipt (#296).** A pass from upstream or from any other repository on the hub now stands only if its runner's signed receipt was kept (the hub checks it against the runner's bound key when the job finishes) and, read again from that repository's store, still verifies and its key is not revoked; otherwise the job runs here. Only a pass that ran in the repository offering it is taken, so the receipt is where it is checked.

- **A pass on the same state is reused from any repository on the hub (#296).** After the repository's own runs and the line it was forked from, a push's job with no pass of its own on that state reuses one from any other repository holding the same state, public or with the same owner, newest first: a state is its changes, so whoever proved it, the proof holds. The run page and the check say whose pass it was.

## 0.9.10 (2026-10-27)

- **Approval gates and expedite for clients (oxygenhub-android#5).** A run's jobs over the API say `approval` (`waiting` while one waits for a person, `approved` or `rejected` after), and `POST /api/v1/repos/OWNER/NAME/flow/runs/N/expedite {"reason": …}` makes a run urgent as the run page's Expedite does (a maintainer, with a reason, within the owner's cap of urgent runs); the page and the API share it.

- **A proposal's diffs over the API (oxygenhub-android#4).** `GET /api/v1/repos/OWNER/NAME/proposals/N/diff` gives each file the proposal changes with its diff (three lines of context, in the shape a change's files have), as the proposal page shows them, for the Android app's proposal view.

- **Images that point at a file's page show (#346).** Markdown left an image's full or root-relative address alone, so `![…](https://oxygenhub.io/OWNER/NAME/file/main/x.png)` (the address a file's page shows, as the doomsdayone/tetriblox wiki's screenshots use) pointed an `<img>` at an HTML page and showed broken. An image of one of this hub's file pages now renders as that file's raw bytes (`…/raw/REF/PATH`), as GitHub does for `blob/` images; links keep the page, and other sites' addresses are untouched.

- **Phone alerts (oxygenhub-android#16, oxygenhub-gcp decision 0008).** A phone registers its Cloud Messaging token and an X25519 public key with `PUT /api/v1/user/push`, using the token it signed in with (`DELETE` unregisters; revoking the token ends it too, migration 0101). Each notification an account is told then also goes to its phones, its title and link sealed to each phone's key (`flow_core::alert`), as a data-only, high-priority message, so Google carries only ciphertext. The hub sends as the service account its VM runs as, with the metadata server's token: no key. Off until `[push] fcm_project` (`OXYHUB_PUSH_FCM_PROJECT`) is set; a registration Cloud Messaging no longer knows is forgotten. Pins OxygenFlow main (sealed alerts).

- **A fork starts green where upstream proved the same state (#296, first slice).** Pass reuse (#265) looked in the repository's own runs only. A push's job with no pass of its own on that state now reuses one from the repositories it was forked from, nearest first (up to five up): the same state is the same changes, so upstream's receipt stands for it. Only from an upstream that is public or has the fork's owner. The run page says whose pass it was and links to it, and its check reads "passed in OWNER/NAME run #N on this state, reused".

- **A proposal's conflicts are resolved on the web (#337).** A proposal whose landing would conflict has RESOLVE ON THE WEB for those who may push to its source: the hub brings the target into the source bookmark, as `oxy merge TARGET` would there (signed as the user's delegate, or unsigned where no trust policy asks for more), and opens the resolver on the first conflicted file. The resolution is committed to the source, so the proposal follows it and lands. A proposal from a fork is resolved in the fork.

- **A default bookmark must exist, and bookmarks are made on the web (#345).** Settings refused nothing, so a default named before it existed (doomsdayone/tetriblox's `develop`) left the repository's pages saying `"develop" is not a change`. Settings now refuse a new default that is not a bookmark (an empty repository may name any, for its first push) and list those that are; a missing default leaves the overview showing main, or the first bookmark, with a note; an unknown name is "not a bookmark, tag or change of this repository". Bookmarks › New bookmark makes one from a bookmark, tag or change, as the user's delegate or, without a trust policy, unsigned as a push would be, so a proposal can then target it.

- **Iterations on project boards (#343).** A board can run an iteration: a name and its first and last days. The board shows it above the columns, day N of M and the cards done so far, with a burn-up of cards done per day. Closing it archives the cards in the Done column (the one that takes finished work, or else the last) under it; its page, linked from "past iterations", lists them, restorable, with its burn-up. One iteration is open at a time. Migration 0100.

- **`oh` on Haiku (#344).** `oh` builds and runs on Haiku R1/beta6 (x86_64); `oh-VERSION-haiku-x86_64.tar.gz` is on the releases page from 0.9.9, with its own `SHA256SUMS-haiku`, and the README says how to install it.

## 0.9.9 (2026-10-27)

- **`oh` works in PowerShell (#319).** PowerShell has a built-in alias `oh` (for `Out-Host`), so `oh --version` ran that and failed. The Windows zip now carries `ohub.exe`, the same program under a name nothing hides, and `install.ps1`, which installs both for the current user and puts them on `PATH`. Where PowerShell runs scripts it also removes the alias in the profile; under Windows' default policy, where a profile cannot run and would only print an error, it says to use `ohub` and never changes the policy. Tried on the Windows VM under both policies.

- **Admin › Runners › Images tells a peer-held image from the hub's own (#342).** An image only runners hold shows as "manifest" (sent by which runner) rather than "hub", and one no runner holds now is marked nowhere, as an image the hub lacks is.

- **A queued job's reason names CPUs too.** A runner with a free slot but not the room for a job was said to lack "the memory or disk"; earth-1's limit is often its CPUs (5, with a 4-vCPU job running), so it says "the memory, CPUs or disk".

- **The Content Security Policy is enforced (#227).** The pages carry no inline scripts or handlers, and a week of reports showed it would block only Cloudflare's Web Analytics beacon, which the policy now allows (`static.cloudflareinsights.com`, reports to `cloudflareinsights.com`). Violations are still reported and logged.

- **Where a job's time went (oxygenflow#35).** A runner's finish report carries its phases (image, prepare, run, finish); the run page shows them under each job, and `/metrics` has `oxyhub_flow_job_phase_seconds` by phase. Migration 0099 (`flow_jobs.phases`).

## 0.9.8 (2026-10-27)

- **Images only runners hold (#342, oxygenflow#94).** A runner that serves its peers sends the manifest of each image it holds that the hub lacks (`POST /flow/images/held`, `PUT /flow/images/{hash}/held`, runner tokens only); the hub keeps it as held by runners and offers the image's jobs to runners of the same swarm site, which fetch it from their peers (the announce says the hub is no seed for it). A pushed image replaces such a record. On 2026-10-25 a re-pinned image that was never pushed kept every Rust job on one runner for a day. Migration 0098 (`jet_images.source`, `holder`).

## 0.9.7 (2026-10-27)

- **A push to a landed proposal's bookmark says so (#329).** The changes reach no target until a new proposal takes them, and the push was silent: now it is answered `its proposal #N has landed in TARGET, and these changes are not on TARGET: open a new proposal with oh proposal create --from BOOKMARK` (oxygen's `Backend::push_notes`). The landed proposal's page lists them as changes since it landed, with a link to a new proposal; it no longer shows them as its own, and no longer offers to delete a bookmark that holds them.

- **Creating a repository no longer stalls the hub on a busy disk (#335).** A bare init makes about sixteen fsyncs, and on Earth's shared disk each waited behind every other write: one create took 26 s and held an async worker the whole time. Creates from the API, the web and drops now run on a blocking thread, as forks and bucket creates already did.

- **A Diffusion bump pins the upstream's default bookmark (#332).** A bump kept the bookmark name of the pin it replaced, so a subrepo first pinned at an upstream proposal's bookmark still named it after the proposal landed and Diffusion moved the pin to the default bookmark's state; a checkout then counted the subrepo as on another bookmark. A bump now names the upstream's default bookmark, unless it keeps pinned changes that bookmark lacks.

- **Listing landed proposals is quick, and pages (#331).** `oh proposal list --state landed` on a repository with a few hundred proposals timed out: the API worked out every proposal's projected state again, landed and closed ones too. Those now come from what was recorded, and the list takes `limit` (`oh proposal list --limit N`, 30 by default), newest first.

- **A big image's push no longer fails at the last step (#341).** The hub reads a whole image before it accepts the manifest, which on a busy disk outlasted `flow rootfs push`'s wait. The image could then be kept but never offered, and a retry read it all again. The hub now finishes and records the image even if the sender gives up, and a manifest it already keeps is recorded without reading the image again.

- **The API refuses a field an edit does not take (#330).** `PATCH` on an issue, proposal, project, milestone, release or drop answered 200 to a field it does not know and changed nothing (`{"ready": true}` on a draft proposal, say), which looked like success. It now answers 422 naming the field and the ones it takes.

- **Mail reads `[OxygenHub]`, in a wider message (#334).** A notification's subject was tagged with the site's name (`[Oxygenhub on Earth]`); mail now goes by the From address's display name (`OxygenHub <noreply@…>`) in the subject and the footer, falling back to the site's name, so the site keeps its own name (which its apt repository is labelled with). The message card is 720px wide rather than 560.

- **An agent follows its owner's newest identity (oxygen#82).** A keyless certificate's answer now carries `author_chain`: the grant owner's newest linked identity and its predecessors back to the grant's key, so an agent home with `author.for` authors as the owner's current identity, not one several rotations old.

- **The profile page's actions are one tidy group (#328).** Edit profile, Projects and Drops sat on two rows, touching each other and the panel below; they are now one evenly spaced block, Edit profile across the top and the two pages side by side.

- **Copy buttons are a glyph joined to their field (#338).** Every copy button is now a clipboard glyph on the end of the box it copies, with the tooltip "Copy to clipboard"; pressed, it turns to a tick saying "Copied!" for two seconds. A drop's Embed and Clone boxes line up with each other.

- **Changelog entries no longer block a landing (oxygen#145).** Two proposals that each add a line at the same place in a file marked `merge=union` in `.oxyattributes` (`CHANGELOG.md merge=union`) used to leave the second unlandable where conflicts are refused. When a proposal's only conflicts are such adjacent insertions, landing it now adds the resolution, both sides kept, the earlier change's first, authored by whoever lands it and signed by the hub as their delegate. Any other conflict blocks as before.

## 0.9.6 (2026-10-26)

- **A highlighting test no longer fails a busy machine's gate (#327):** it timed a debug build against a release build's 500 ms; debug builds now have 3 s, still far below what highlighting the line would take.

- **`oh runner-updates` and its API (#322):** site administrators read every level's update settings, the test groups, each runner's policy and offer, and the held builds (`GET /api/v1/admin/runner-updates`); `oh runner-updates set group:canary --updates on --window 02-05` changes one level, keeping what is not given (`PUT …/settings`, 422 saying what is wrong); `oh runner-updates lift 0.4.0` offers a held build again (`POST …/holds/{version}/lift`).

- **A build that rolls back on one runner is held for the rest (#326):** when a runner reports it rolled back from flow X (it did not reach the hub after updating, or would not start), the hub offers X to no other runner, saying why, until an administrator lifts the hold on Admin › Runners › Updates, which lists each held build with the runner and the reason. One failed canary halts the rollout. Migration 0097.

- **Finished work moves to Done (#325):** a card whose issue closes (on its page, through the API, or by a change's `closes #N`), or whose proposal lands or closes, moves to its board's column for finished work. A new board's Done is that column, and so is each existing board's column named Done; a column's menu turns it on or off (one column of a board). Archived cards stay archived.

- **A WASM job's placement names no image (#323):** a job on the WASM tier was placed saying its runner "fetches the image from the hub"; it has none, so the line now starts with what the runner is doing (andymccall/windows-runner-demo run #1).

- **Runner updates: policy, test groups and the offer (#322):** Admin › Runners › Updates sets where runner builds come from (a repository whose releases carry `flow-linux-ARCH` files, and `flow-windows-x86_64.exe` for Windows runners) and who takes them. Updates are off unless chosen; the site, an owner, a test group and a runner may each set updates on or off, a channel (`stable`, `canary` or a version), a window of hours (UTC) and dry run, and the nearest setting wins, each setting on its own. A test group is chosen runners or a percentage of the site's (or an owner's) runners, by a stable hash of each runner's id, so a share is the same machines every rollout and 10% sits inside 50%. `GET /api/v1/flow/runner/update` tells a runner its policy, where each setting came from, and the build to install (its BLAKE3, to check the download against); `POST` takes what the runner did, shown on the page and in the audit log. An organisation's owners set the same for their own runners in the organisation's Settings › Runner updates: the organisation's setting, test groups of its runners (chosen, or a percentage), and each runner's own; nothing of the site's or another owner's. Pins OxygenFlow's main.

## 0.9.5 (2026-10-26)

- **No failed run every minute for a pipeline that does not parse (#321):** the scheduler asked each repository's pipeline every minute and, for one it could not read (a mistake, or no jobs yet), recorded a failed `schedule` run each time: oxygenhub-android had about 1,500. A scheduled tick now starts nothing for such a pipeline; its push's run still says what is wrong.

- **A change's diff through the API (#320):** `GET /api/v1/repos/{owner}/{name}/changes/{hash}` gives each file's diff lines too (`lines`: `kind` context, add, del or gap, `old` and `new` line numbers, `text`), with three lines of context, up to 2000 lines a file (`truncated` says when it stops short), so the Android app can show a diff itself.

- **JaCoCo coverage is read (#308):** Gradle's `jacocoTestReport` and Kover write JaCoCo XML, which a `coverage` artifact (or `POST /coverage`) may now be, beside LCOV and Cobertura: lines hit when an instruction ran, branches, methods. Its paths are relative to a source root (`io/oxygenhub/…/X.kt`), so a report's path not in the state is matched by its ending to the one file it can be.

## 0.9.4 (2026-10-25)

- **Checkpoints, so a handed-back job resumes (oxygenflow#77):** `POST /api/v1/flow/jobs/{id}/checkpoint` keeps the directories a job declares with `checkpoint "/src/…"` as its runner hands it back; the next attempt's claim names the blob (`checkpoint`) and its runner fetches it (`GET`) and restores it before running. A checkpoint is kept beside the job's artifacts but is none of them (no receipt names it). Pins OxygenFlow's main.

- **Boards keep the last fortnight of finished work (#293):** by default every column archives its finished cards (closed issues, closed or landed proposals) 14 days after they reached it, hourly, so a Done column stops growing however long a project runs; open work and notes stay. A column can instead archive every card after N days, or never ("Archive automatically" in its menu). Archived cards stay on the board's archive view, searchable and restorable. On the next hourly pass, boards with years of Done cards (Super Mario Land 2's 327) shrink to their last two weeks.

- **An issue's references: no line through the chips, each change once (#318):** an opened "referenced by N changes" box drew the proposal timeline's vertical rule through its first column (the events shared its class); and a change was recorded again for every bookmark it was pushed on, and for every mention in its message, so one change filled several chips. Now one reference per change per issue or proposal, and the page shows each change once, including those recorded before.

- **Claims say how long a job is expected to take (oxygenflow#76):** `expected_ms`, the median of the job's last five passing runs in the repository (reused passes left out), so a runner leaving with notice finishes a job that fits it and hands back the rest. Pins OxygenFlow's main.

- **The hub's CI writes a test report and coverage (#307):** `test` runs under cargo-nextest and keeps a JUnit report (whether or not the tests pass); a new `coverage` job runs the tests instrumented beside it, with its own cached target, and keeps LCOV coverage. `coverage` is not a required check.

- **The new proposal form lines up (#315):** as wide as the changes above it; Draft with Claude a secondary button under the editor (it fills the fields, it does not open the proposal); the draft checkbox and Open proposal on one row.

- **Draft with Claude proposes a title too (#316):** for a proposal not yet opened, the assistant begins its draft with a title in the style of the changes' own titles; it fills the title field unless you wrote one (the page's own suggestion does not count), and stays out of the description.

- **A waiting WASM job no longer says runners lack its image (#317):** a job with no image (the WASM tier) waited saying every runner "does not hold image" with an empty name; the explanation now skips the image check, as the claim always did.

version = "0.5.2"

 "curve25519-dalek",

 "ring",

version = "0.9.24"

version = "0.5.2"

version = "0.9.24"

version = "0.9.0"

version = "0.9.0"

version = "0.9.0"

version = "0.9.24"

version = "0.9.24"

Builds for Linux, macOS, Windows and Haiku are on the [releases page](https://oxygenhub.io/andymccall/oxygenhub/releases). These are early releases: the macOS and Windows builds are not signed and have had little testing.

- **Windows:** unzip `oh-VERSION-windows-x86_64.zip` and run `powershell -ExecutionPolicy Bypass -File .\install.ps1` in the folder: it installs for you alone, puts `oh` on your `PATH`, and removes PowerShell's built-in alias `oh` (for `Out-Host`) in your profile, which would otherwise run instead. `ohub` is the same program under a name nothing hides. SmartScreen may warn on first run, since the build is not signed.

- **Haiku** (R1/beta6, x86_64): unpack `oh-VERSION-haiku-x86_64.tar.gz` and copy `oh` to `~/config/non-packaged/bin`. It is built in a Haiku guest rather than by OxygenFlow, so it has its own `SHA256SUMS-haiku` and no build attestation.

Brand marks for AI agents' avatars (hub spec §6): the paths are from simple-icons (CC0), each set white on the brand's colour. `antigravity` uses the Gemini mark, Antigravity having none of its own there; Grok has no mark and falls back to the identicon. `kimi` is our own monogram (a K and a blue dot on a dark disc), simple-icons having no Kimi mark.

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" role="img" aria-label="Kimi"><title>Kimi</title><circle cx="12" cy="12" r="12" fill="#0B0D12"/><circle cx="12" cy="12" r="11.5" fill="none" stroke="#3A4256" stroke-width="1"/><g fill="none" stroke="#fff" stroke-width="2.6" stroke-linecap="round" stroke-linejoin="round"><path d="M8.6 6.2v11.6"/><path d="M15 6.8 9 12.4l6.6 5.4"/></g><circle cx="17.7" cy="6.4" r="1.7" fill="#2F8CFF"/></svg>

/* Copy buttons (#338) keep their glyph shape in this look. */

:root[data-look="github"] button.copy-btn { padding: 0; width: 32px; min-height: 30px; background: var(--gh-btn); color: var(--mute); box-shadow: none; text-transform: none; }

:root[data-look="github"] button.copy-btn:hover { background: var(--gh-btn-hover); color: var(--ink); }

:root[data-look="github"] button.copy-btn.copied { color: var(--ok); }

:root[data-look="github"] .clone > button.copy-btn, :root[data-look="github"] .drop-clone > button.copy-btn { border-radius: 0 6px 6px 0; }

:root[data-look="github"] .cmds > button.copy-btn { width: 28px; min-height: 28px; border-radius: 6px; }

:root[data-look="github"] :is(.clone, .drop-clone) > input { border-top-right-radius: 0; border-bottom-right-radius: 0; }

  /* Copy buttons. A glyph button (#338) says "Copy to clipboard", then

     shows a tick and "Copied!" for two seconds; a worded one says so. */

    var glyph = b.classList.contains("copy-btn"), timer;

    if (glyph) { b.setAttribute("data-tip", "Copy to clipboard"); b.title = ""; }

        clearTimeout(timer);

        if (glyph) {

          b.classList.add("copied"); b.setAttribute("data-tip", "Copied!"); b.setAttribute("aria-label", "Copied!");

          timer = setTimeout(function () { b.classList.remove("copied"); b.setAttribute("data-tip", "Copy to clipboard"); b.setAttribute("aria-label", "Copy to clipboard"); }, 2000);

        } else {

          var t = b.getAttribute("data-label") || b.textContent; b.setAttribute("data-label", t);

          b.textContent = "copied"; timer = setTimeout(function () { b.textContent = t; }, 1200);

        }

      // A new proposal's draft begins with its title line (#316): kept out

      // of the description, and put in the title unless the person wrote one.

      var titleField = form.querySelector('input[name="title"]');

      function untitled(t) { return t.replace(/^\s*title:[^\n]*(\n\s*|$)/i, ""); }

                if (kind === "part") { text += v; show(untitled(text)); }

                else if (kind === "title") {

                  if (titleField && (!titleField.value.trim() || titleField.value === titleField.defaultValue)) titleField.value = v;

                }

  })();

  /* Waiting for a phone's approval (oxygenhub#356): at sign-in the page

     posts its proof of the password and signs in once the phone approves;

     at the sudo step it asks with the session and goes back where it came

     from. A no, or too long a wait, says so and stops. */

  (function () {

    var box = document.querySelector("[data-approval-poll]");

    if (!box) return;

    var status = box.querySelector("[data-approval-status]");

    var form = box.closest("form");

    var url = box.getAttribute("data-approval-poll");

    var said = {

      denied: "Your phone said no, or a different number was picked. Sign in again, or use a code.",

      expired: "That took too long. Start again, or use a code.",

      unknown: "That approval is gone. Start again."

    };

    var tries = 0;

    function ask() {

      var req;

      if (form) {

        var body = new URLSearchParams();

        ["username", "pending", "approval"].forEach(function (n) {

          var el = form.querySelector('input[name="' + n + '"]');

          if (el) body.set(n, el.value);

        });

        req = fetch(url, { method: "POST", credentials: "same-origin", body: body });

      } else {

        req = fetch(url, { credentials: "same-origin", headers: { accept: "application/json" } });

      }

      req.then(function (r) { return r.json(); }).then(function (j) {

        var state = j && j.state;

        box.setAttribute("data-state", state || "");

        if (state === "approved") {

          if (status) status.textContent = "Approved. Carrying on…";

          if (form) form.submit(); else location.href = box.getAttribute("data-approval-next") || "/";

        } else if (said[state] || state === "used") {

          if (status) status.textContent = said[state] || said.unknown;

        } else if (++tries < 75) {

          setTimeout(ask, 2000);

        }

      }).catch(function () { if (++tries < 75) setTimeout(ask, 4000); });

    }

    setTimeout(ask, 1500);

})();

// Board keys (oxygenhub#361): j/k move between cards, Enter opens one, m

// moves it (focuses its column choice), / goes to the filter. Not while

// typing in a field.

(function () {

  var filter = document.querySelector("[data-board-filter]");

  if (!filter) return;

  function cards() {

    return Array.prototype.slice.call(document.querySelectorAll(".card-item[data-card]"));

  }

  function typing(el) {

    return el && (el.tagName === "INPUT" || el.tagName === "TEXTAREA" || el.tagName === "SELECT" || el.isContentEditable);

  }

  document.addEventListener("keydown", function (e) {

    if (e.ctrlKey || e.metaKey || e.altKey || typing(document.activeElement)) return;

    var list = cards();

    var at = list.indexOf(document.activeElement && document.activeElement.closest ? document.activeElement.closest(".card-item[data-card]") : null);

    if (e.key === "/") {

      e.preventDefault();

      filter.focus();

      filter.select();

    } else if (e.key === "j" || e.key === "k") {

      if (!list.length) return;

      e.preventDefault();

      var next = at < 0 ? 0 : Math.max(0, Math.min(list.length - 1, at + (e.key === "j" ? 1 : -1)));

      list[next].focus();

      list[next].scrollIntoView({ block: "nearest", inline: "nearest" });

    } else if (e.key === "Enter" && at >= 0) {

      var href = list[at].getAttribute("data-href");

      if (href) {

        e.preventDefault();

        window.location.href = href;

      }

    } else if (e.key === "m" && at >= 0) {

      var sel = list[at].querySelector("select[name=column]");

      if (sel) {

        e.preventDefault();

        if (list[at].closest(".compact")) list[at].querySelector(".card-actions").style.display = "flex";

        sel.focus();

      }

    }

  });

  // A table row's column choice moves the card when changed.

  document.querySelectorAll("select[data-autosubmit]").forEach(function (sel) {

    sel.addEventListener("change", function () {

      var form = sel.form;

      var btn = form && form.querySelector("button[name=action][value=move]");

      if (btn) btn.click();

    });

  });

})();

// The New repository page (oxygenhub#360): the name checked as it is

// typed, the board choices shown as they apply, an owner's own boards.

(function () {

  var form = document.querySelector("[data-new-repo]");

  if (!form) return;

  var owner = form.querySelector("#owner");

  var name = form.querySelector("#name");

  var out = form.querySelector("#name-check");

  var timer = null;

  function check() {

    var n = name.value.trim();

    if (!n) { out.textContent = ""; out.className = "small name-check"; return; }

    fetch("/new/check?owner=" + encodeURIComponent(owner.value) + "&name=" + encodeURIComponent(n), { credentials: "same-origin" })

      .then(function (r) { return r.json(); })

      .then(function (v) {

        out.textContent = v.ok ? v.message + " Its address: " + v.address : v.message;

        out.className = "small name-check " + (v.ok ? "ok-text" : "err-text");

      })

      .catch(function () {});

  }

  function later() { clearTimeout(timer); timer = setTimeout(check, 250); }

  name.addEventListener("input", later);

  var orgs = (owner.getAttribute("data-orgs") || "").split(" ").filter(Boolean);

  var list = form.querySelector("[data-board-list]");

  var title = form.querySelector(".board-title");

  var existing = form.querySelector(".board-existing");

  function boards() {

    var chosen = form.querySelector("input[name=board]:checked");

    var v = chosen ? chosen.value : "";

    if (title) title.hidden = v !== "new";

    if (existing) existing.hidden = v !== "existing";

    if (list) {

      var first = null;

      Array.prototype.forEach.call(list.options, function (o) {

        var mine = o.getAttribute("data-owner") === owner.value;

        o.hidden = !mine; o.disabled = !mine;

        if (mine && !first) first = o;

      });

      if (list.selectedOptions.length && list.selectedOptions[0].disabled && first) first.selected = true;

      var exRadio = form.querySelector("[data-board-existing]");

      if (exRadio) exRadio.parentElement.hidden = !first;

    }

  }

  owner.addEventListener("change", function () {

    // An organisation's repository has a board by default.

    var neu = form.querySelector("[data-board-new]");

    if (neu && orgs.indexOf(owner.value) >= 0) neu.checked = true;

    boards();

    later();

  });

  form.querySelectorAll("input[name=board]").forEach(function (r) { r.addEventListener("change", boards); });

  if (orgs.indexOf(owner.value) >= 0) { var n0 = form.querySelector("[data-board-new]"); if (n0) n0.checked = true; }

  boards();

// OxygenFlow's WASM tier in a browser tab (oxygenflow#80): this worker

// unpacks a repository's zip archive into memory and runs a job's WASI

// preview 1 modules over it, as `flow` runs them with wasmtime: the files at

// /src (and as the current directory), the job's arguments and environment,

// stdout and stderr streamed back line by line, and the exit code.

//

// Messages in: { archive: ArrayBuffer, exec: [module, ...args], env: {k: v} }.

// Messages out: { kind: "note"|"out"|"err", text }, then

// { kind: "done", code, ms } or { kind: "failed", text }.

"use strict";

const E = { SUCCESS: 0, ACCES: 2, BADF: 8, EXIST: 20, INVAL: 28, ISDIR: 31, NOENT: 44, NOSYS: 52, NOTDIR: 54, NOTEMPTY: 55, NOTSUP: 58 };

const FT = { UNKNOWN: 0, CHAR: 2, DIR: 3, FILE: 4 };

const O = { CREAT: 1, DIRECTORY: 2, EXCL: 4, TRUNC: 8 };

const FD_APPEND = 1;

const RIGHTS = 0x1fffffffn;

class Exit {

  constructor(code) { this.code = code; }

}

// --- The archive -----------------------------------------------------------

// A zip's files by path, the first directory (the archive's prefix) taken

// off. Read through the central directory, so sizes written after the data

// are known; stored and deflated entries; symbolic links are left out.

async function unzip(buf) {

  const b = new DataView(buf);

  const bytes = new Uint8Array(buf);

  let end = -1;

  for (let i = buf.byteLength - 22; i >= Math.max(0, buf.byteLength - 65557); i--) {

    if (b.getUint32(i, true) === 0x06054b50) { end = i; break; }

  }

  if (end < 0) throw new Error("the archive is not a zip file");

  const count = b.getUint16(end + 10, true);

  let at = b.getUint32(end + 16, true);

  if (at === 0xffffffff) throw new Error("the archive is too large for this page (zip64)");

  const files = new Map();

  const dec = new TextDecoder();

  for (let n = 0; n < count; n++) {

    if (b.getUint32(at, true) !== 0x02014b50) throw new Error("the archive's directory is damaged");

    const method = b.getUint16(at + 10, true);

    const csize = b.getUint32(at + 20, true);

    const nlen = b.getUint16(at + 28, true), xlen = b.getUint16(at + 30, true), clen = b.getUint16(at + 32, true);

    const mode = b.getUint32(at + 38, true) >>> 16;

    const local = b.getUint32(at + 42, true);

    const name = dec.decode(bytes.subarray(at + 46, at + 46 + nlen));

    at += 46 + nlen + xlen + clen;

    if (name.endsWith("/") || (mode & 0o170000) === 0o120000) continue;

    const data = local + 30 + b.getUint16(local + 26, true) + b.getUint16(local + 28, true);

    const raw = bytes.subarray(data, data + csize);

    let content;

    if (method === 0) content = raw.slice();

    else if (method === 8) content = new Uint8Array(await new Response(new Blob([raw]).stream().pipeThrough(new DecompressionStream("deflate-raw"))).arrayBuffer());

    else throw new Error(`${name}: compression method ${method} is not read here`);

    const slash = name.indexOf("/");

    files.set(slash < 0 ? name : name.slice(slash + 1), content);

  }

  return files;

}

// --- The file system ---------------------------------------------------------

class Fs {

  constructor(files) {

    this.files = files; // path -> Uint8Array

    this.dirs = new Set([""]);

    for (const p of files.keys()) this.addParents(p);

  }

  addParents(p) {

    const parts = p.split("/");

    for (let i = 1; i < parts.length; i++) this.dirs.add(parts.slice(0, i).join("/"));

  }

  // `rel` against directory `dir`, or null when it leaves the root.

  join(dir, rel) {

    const out = rel.startsWith("/") ? [] : dir ? dir.split("/") : [];

    for (const part of rel.split("/")) {

      if (part === "" || part === ".") continue;

      if (part === "..") { if (!out.length) return null; out.pop(); } else out.push(part);

    }

    return out.join("/");

  }

  kind(p) {

    if (this.files.has(p)) return FT.FILE;

    if (this.dirs.has(p)) return FT.DIR;

    return null;

  }

  list(dir) {

    const prefix = dir ? dir + "/" : "";

    const names = new Set();

    for (const p of [...this.files.keys(), ...this.dirs]) {

      if (p !== dir && p.startsWith(prefix)) names.add(p.slice(prefix.length).split("/")[0]);

    }

    return [...names].sort();

  }

}

// The modules a job's first `exec` word names: one path, or a `*` pattern

// in its file name, as `flow` resolves them.

function modules(fs, program) {

  const rel = program.replace(/^\/src\//, "").replace(/^\.\//, "");

  if (!rel || rel.startsWith("/") || rel.split("/").includes("..")) throw new Error(`module ${program}: give a path inside the job's files`);

  const cut = rel.lastIndexOf("/");

  const dir = cut < 0 ? "" : rel.slice(0, cut), last = rel.slice(cut + 1);

  if (dir.includes("*")) throw new Error(`module ${program}: only the file name may hold *`);

  if (!last.includes("*")) {

    if (!fs.files.has(rel)) throw new Error(`module ${rel} is not among the repository's files (a build makes it?)`);

    return [rel];

  }

  const re = new RegExp("^" + last.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$");

  const found = fs.list(dir).filter((n) => re.test(n) && fs.files.has(dir ? `${dir}/${n}` : n)).map((n) => (dir ? `${dir}/${n}` : n));

  if (!found.length) throw new Error(`no module matches ${program}`);

  return found;

}

// --- WASI preview 1 ------------------------------------------------------------

function wasi(fs, argv, env, say) {

  let memory;

  const view = () => new DataView(memory.buffer);

  const u8 = () => new Uint8Array(memory.buffer);

  const enc = new TextEncoder(), dec = new TextDecoder();

  const str = (ptr, len) => dec.decode(u8().subarray(ptr, ptr + len));

  // Open files and directories: 0-2 the streams, 3 /src, 4 ".".

  const fds = new Map([

    [0, { stream: "in" }],

    [1, { stream: "out", partial: "" }],

    [2, { stream: "err", partial: "" }],

    [3, { dir: "", preopen: "/src" }],

    [4, { dir: "", preopen: "." }],

  ]);

  let next = 5;

  const emit = (fd, text) => {

    const f = fds.get(fd);

    f.partial += text;

    let nl;

    while ((nl = f.partial.indexOf("\n")) >= 0) {

      say(f.stream, f.partial.slice(0, nl));

      f.partial = f.partial.slice(nl + 1);

    }

  };

  const flush = () => { for (const fd of [1, 2]) { const f = fds.get(fd); if (f.partial) { say(f.stream, f.partial); f.partial = ""; } } };

  const filestat = (ptr, kind, size) => {

    const v = view();

    for (let i = 0; i < 64; i += 8) v.setBigUint64(ptr + i, 0n, true);

    v.setUint8(ptr + 16, kind);

    v.setBigUint64(ptr + 24, 1n, true);

    v.setBigUint64(ptr + 32, BigInt(size), true);

  };

  const iovs = (ptr, n) => {

    const v = view(), out = [];

    for (let i = 0; i < n; i++) out.push([v.getUint32(ptr + i * 8, true), v.getUint32(ptr + i * 8 + 4, true)]);

    return out;

  };

  const strings = (list) => list.map((s) => enc.encode(s + "\0"));

  const sizes = (list, countPtr, sizePtr) => {

    const v = view(), all = strings(list);

    v.setUint32(countPtr, all.length, true);

    v.setUint32(sizePtr, all.reduce((n, s) => n + s.length, 0), true);

    return E.SUCCESS;

  };

  const fill = (list, ptrs, buf) => {

    const v = view(), m = u8();

    for (const s of strings(list)) { v.setUint32(ptrs, buf, true); ptrs += 4; m.set(s, buf); buf += s.length; }

    return E.SUCCESS;

  };

  const envList = Object.entries(env).map(([k, v]) => `${k}=${v}`);

  const imports = {

    args_sizes_get: (c, s) => sizes(argv, c, s),

    args_get: (p, b) => fill(argv, p, b),

    environ_sizes_get: (c, s) => sizes(envList, c, s),

    environ_get: (p, b) => fill(envList, p, b),

    clock_time_get: (_id, _precision, out) => { view().setBigUint64(out, BigInt(Math.round(performance.timeOrigin + performance.now())) * 1000000n, true); return E.SUCCESS; },

    clock_res_get: (_id, out) => { view().setBigUint64(out, 1000n, true); return E.SUCCESS; },

    random_get: (ptr, len) => { crypto.getRandomValues(u8().subarray(ptr, ptr + len)); return E.SUCCESS; },

    sched_yield: () => E.SUCCESS,

    proc_exit: (code) => { throw new Exit(code); },

    fd_prestat_get: (fd, ptr) => {

      const f = fds.get(fd);

      if (!f || !f.preopen) return E.BADF;

      const v = view();

      v.setUint8(ptr, 0);

      v.setUint32(ptr + 4, enc.encode(f.preopen).length, true);

      return E.SUCCESS;

    },

    fd_prestat_dir_name: (fd, ptr, len) => {

      const f = fds.get(fd);

      if (!f || !f.preopen) return E.BADF;

      u8().set(enc.encode(f.preopen).subarray(0, len), ptr);

      return E.SUCCESS;

    },

    fd_fdstat_get: (fd, ptr) => {

      const f = fds.get(fd);

      if (!f) return E.BADF;

      const v = view();

      v.setUint8(ptr, f.stream ? FT.CHAR : f.dir !== undefined ? FT.DIR : FT.FILE);

      v.setUint16(ptr + 2, f.append ? FD_APPEND : 0, true);

      v.setBigUint64(ptr + 8, RIGHTS, true);

      v.setBigUint64(ptr + 16, RIGHTS, true);

      return E.SUCCESS;

    },

    fd_fdstat_set_flags: () => E.SUCCESS,

    fd_filestat_get: (fd, ptr) => {

      const f = fds.get(fd);

      if (!f) return E.BADF;

      if (f.stream) filestat(ptr, FT.CHAR, 0);

      else if (f.dir !== undefined) filestat(ptr, FT.DIR, 0);

      else filestat(ptr, FT.FILE, fs.files.get(f.path).length);

      return E.SUCCESS;

    },

    path_filestat_get: (fd, _flags, p, len, ptr) => {

      const d = fds.get(fd);

      if (!d || d.dir === undefined) return E.BADF;

      const path = fs.join(d.dir, str(p, len));

      if (path === null) return E.ACCES;

      const kind = fs.kind(path);

      if (kind === null) return E.NOENT;

      filestat(ptr, kind, kind === FT.FILE ? fs.files.get(path).length : 0);

      return E.SUCCESS;

    },

    path_open: (fd, _dirflags, p, len, oflags, _rb, _ri, fdflags, out) => {

      const d = fds.get(fd);

      if (!d || d.dir === undefined) return E.BADF;

      const path = fs.join(d.dir, str(p, len));

      if (path === null) return E.ACCES;

      let kind = fs.kind(path);

      if (oflags & O.DIRECTORY) {

        if (kind === null) return E.NOENT;

        if (kind !== FT.DIR) return E.NOTDIR;

      }

      if (kind === null) {

        if (!(oflags & O.CREAT)) return E.NOENT;

        const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";

        if (fs.kind(parent) !== FT.DIR) return E.NOENT;

        fs.files.set(path, new Uint8Array(0));

        kind = FT.FILE;

      } else if (oflags & O.EXCL) return E.EXIST;

      if (kind === FT.DIR) fds.set(next, { dir: path, entries: null });

      else {

        if (oflags & O.TRUNC) fs.files.set(path, new Uint8Array(0));

        fds.set(next, { path, pos: 0, append: !!(fdflags & FD_APPEND) });

      }

      view().setUint32(out, next, true);

      next += 1;

      return E.SUCCESS;

    },

    path_create_directory: (fd, p, len) => {

      const d = fds.get(fd);

      if (!d || d.dir === undefined) return E.BADF;

      const path = fs.join(d.dir, str(p, len));

      if (path === null) return E.ACCES;

      if (fs.kind(path) !== null) return E.EXIST;

      fs.dirs.add(path);

      return E.SUCCESS;

    },

    path_unlink_file: (fd, p, len) => {

      const d = fds.get(fd);

      if (!d || d.dir === undefined) return E.BADF;

      const path = fs.join(d.dir, str(p, len));

      if (path === null || !fs.files.has(path)) return E.NOENT;

      fs.files.delete(path);

      return E.SUCCESS;

    },

    fd_close: (fd) => {

      if (!fds.has(fd) || fd < 3) return fds.has(fd) ? E.SUCCESS : E.BADF;

      fds.delete(fd);

      return E.SUCCESS;

    },

    fd_read: (fd, ptr, n, out) => {

      const f = fds.get(fd);

      if (!f) return E.BADF;

      if (f.dir !== undefined) return E.ISDIR;

      let total = 0;

      if (!f.stream) {

        const data = fs.files.get(f.path), m = u8();

        for (const [buf, len] of iovs(ptr, n)) {

          const k = Math.min(len, data.length - f.pos);

          if (k <= 0) break;

          m.set(data.subarray(f.pos, f.pos + k), buf);

          f.pos += k;

          total += k;

        }

      }

      view().setUint32(out, total, true);

      return E.SUCCESS;

    },

    fd_write: (fd, ptr, n, out) => {

      const f = fds.get(fd);

      if (!f) return E.BADF;

      if (f.dir !== undefined) return E.ISDIR;

      let total = 0;

      const m = u8();

      for (const [buf, len] of iovs(ptr, n)) {

        const chunk = m.slice(buf, buf + len);

        if (f.stream === "out" || f.stream === "err") emit(fd, dec.decode(chunk, { stream: true }));

        else if (!f.stream) {

          const old = fs.files.get(f.path);

          const at = f.append ? old.length : f.pos;

          const grown = new Uint8Array(Math.max(old.length, at + len));

          grown.set(old);

          grown.set(chunk, at);

          fs.files.set(f.path, grown);

          f.pos = at + len;

        }

        total += len;

      }

      view().setUint32(out, total, true);

      return E.SUCCESS;

    },

    fd_seek: (fd, offset, whence, out) => {

      const f = fds.get(fd);

      if (!f || f.stream || f.dir !== undefined) return E.BADF;

      const size = fs.files.get(f.path).length;

      const base = whence === 0 ? 0 : whence === 1 ? f.pos : size;

      const pos = base + Number(offset);

      if (pos < 0) return E.INVAL;

      f.pos = pos;

      view().setBigUint64(out, BigInt(pos), true);

      return E.SUCCESS;

    },

    fd_tell: (fd, out) => {

      const f = fds.get(fd);

      if (!f || f.stream || f.dir !== undefined) return E.BADF;

      view().setBigUint64(out, BigInt(f.pos), true);

      return E.SUCCESS;

    },

    fd_readdir: (fd, buf, len, cookie, out) => {

      const d = fds.get(fd);

      if (!d || d.dir === undefined) return E.BADF;

      if (!d.entries) d.entries = [".", "..", ...fs.list(d.dir)];

      const v = view(), m = u8();

      let used = 0;

      for (let i = Number(cookie); i < d.entries.length; i++) {

        const name = d.entries[i];

        const bytes = enc.encode(name);

        const child = name === "." || name === ".." ? d.dir : fs.join(d.dir, name);

        const head = new DataView(new ArrayBuffer(24));

        head.setBigUint64(0, BigInt(i + 1), true);

        head.setBigUint64(8, BigInt(i + 1), true);

        head.setUint32(16, bytes.length, true);

        head.setUint8(20, name === "." || name === ".." ? FT.DIR : fs.kind(child) ?? FT.UNKNOWN);

        const entry = new Uint8Array(24 + bytes.length);

        entry.set(new Uint8Array(head.buffer));

        entry.set(bytes, 24);

        const room = len - used;

        m.set(entry.subarray(0, Math.min(room, entry.length)), buf + used);

        used += Math.min(room, entry.length);

        if (used >= len) break;

      }

      v.setUint32(out, used, true);

      return E.SUCCESS;

    },

  };

  return { imports, flush, bind: (mem) => { memory = mem; } };

}

// --- A job -------------------------------------------------------------------------

async function run({ archive, exec, env }) {

  const say = (kind, text) => postMessage({ kind, text });

  const started = performance.now();

  const fs = new Fs(await unzip(archive));

  say("note", `${fs.files.size} files unpacked in ${Math.round(performance.now() - started)} ms`);

  const list = modules(fs, exec[0]);

  let first = 0;

  for (const path of list) {

    say("note", `running ${path}`);

    const name = path.slice(path.lastIndexOf("/") + 1);

    const w = wasi(fs, [name, ...exec.slice(1)], { ...env, PWD: "/src" }, say);

    const module = await WebAssembly.compile(fs.files.get(path));

    const imports = { wasi_snapshot_preview1: {} };

    // What the shim lacks answers ENOSYS rather than refusing the module.

    for (const imp of WebAssembly.Module.imports(module)) {

      if (imp.kind !== "function") continue;

      imports[imp.module] ??= {};

      if (imp.module === "wasi_snapshot_preview1" && w.imports[imp.name]) imports[imp.module][imp.name] = w.imports[imp.name];

      else imports[imp.module][imp.name] ??= () => E.NOSYS;

    }

    const instance = await WebAssembly.instantiate(module, imports);

    w.bind(instance.exports.memory);

    let code = 0;

    try {

      instance.exports._start();

    } catch (e) {

      if (e instanceof Exit) code = e.code;

      else {

        w.flush();

        say("err", `${path} trapped: ${e.message}`);

        code = 134;

      }

    }

    w.flush();

    if (code !== 0 && first === 0) first = code;

  }

  postMessage({ kind: "done", code: first, ms: Math.round(performance.now() - started) });

}

onmessage = (m) => {

  run(m.data).catch((e) => postMessage({ kind: "failed", text: e.message }));

};

// "Run in this tab" (oxygenflow#80): each WASM job of the pipeline in a

// worker of its own (wasi-worker.js), over the bookmark's files fetched once

// as a zip. A job shows its output as it comes, its exit code and its time.

"use strict";

(() => {

  const root = document.getElementById("tab-runner");

  if (!root) return;

  const jobs = JSON.parse(root.dataset.jobs);

  const status = document.getElementById("tab-status");

  const list = document.getElementById("tab-jobs");

  let archive = null;

  const fetchArchive = () => {

    archive ??= fetch(root.dataset.archive, { credentials: "same-origin" }).then((r) => {

      if (!r.ok) throw new Error(`the files did not come (HTTP ${r.status})`);

      return r.arrayBuffer();

    });

    return archive;

  };

  const el = (tag, props, ...kids) => {

    const e = Object.assign(document.createElement(tag), props);

    e.append(...kids);

    return e;

  };

  const rows = jobs.map((job) => {

    const state = el("span", { className: "small mute", textContent: "not run" });

    const out = el("pre", { className: "snippet", hidden: true });

    const run = el("button", { type: "button", textContent: "Run" });

    const stop = el("button", { type: "button", textContent: "Stop", hidden: true });

    const box = el(

      "div",

      { className: "tab-job" },

      el("h3", {}, job.name, " ", state),

      el("p", { className: "small mute" }, el("code", { textContent: job.exec.join(" ") })),

      el("p", {}, run, " ", stop),

      out,

    );

    list.append(box);

    let worker = null;

    const line = (cls, text) => {

      out.hidden = false;

      out.append(el("span", { className: cls, textContent: text + "\n" }));

      out.scrollTop = out.scrollHeight;

    };

    const go = () =>

      new Promise((resolve) => {

        out.replaceChildren();

        state.textContent = "fetching the files…";

        state.className = "small mute";

        run.disabled = true;

        stop.hidden = false;

        const finish = (text, cls, ok) => {

          state.textContent = text;

          state.className = "small " + cls;

          run.disabled = false;

          stop.hidden = true;

          worker?.terminate();

          worker = null;

          resolve(ok);

        };

        stop.onclick = () => finish("stopped", "bad", false);

        fetchArchive()

          .then((buf) => {

            state.textContent = "running…";

            worker = new Worker(root.dataset.worker);

            worker.onmessage = ({ data: m }) => {

              if (m.kind === "done") finish(m.code === 0 ? `passed in ${m.ms} ms` : `failed, exit ${m.code}, in ${m.ms} ms`, m.code === 0 ? "ok" : "bad", m.code === 0);

              else if (m.kind === "failed") finish(`could not run: ${m.text}`, "bad", false);

              else line(m.kind === "out" ? "" : m.kind === "err" ? "bad" : "mute", m.text);

            };

            worker.onerror = (e) => finish(`the worker stopped: ${e.message}`, "bad", false);

            worker.postMessage({ archive: buf.slice(0), exec: job.exec, env: job.env });

          })

          .catch((e) => finish(e.message, "bad", false));

      });

    run.onclick = () => go();

    return go;

  });

  document.getElementById("tab-run-all").onclick = async (e) => {

    e.target.disabled = true;

    let passed = 0;

    for (const go of rows) if (await go()) passed += 1;

    status.textContent = `${passed} of ${rows.length} passed`;

    e.target.disabled = false;

  };

})();

#[serde(deny_unknown_fields)]

    /// The diff with three lines of context, up to `DIFF_LINES` lines.

    #[serde(default)]

    pub lines: Vec<DiffLine>,

    /// Whether `lines` stops short of the whole diff.

    #[serde(default)]

    pub truncated: bool,

/// Lines of one file's diff the API sends at most.

pub const DIFF_LINES: usize = 2000;

pub struct DiffLine {

    /// `context`, `add`, `del`, or `gap` (lines left out between hunks).

    pub kind: String,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub old: Option<u32>,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub new: Option<u32>,

    #[serde(default)]

    pub text: String,

}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

    /// Its approval gate (oxygenflow#57): `waiting` while it waits for a

    /// person to approve or reject it, `approved` or `rejected` after;

    /// empty for a job with no gate.

    #[serde(default, skip_serializing_if = "String::is_empty")]

    pub approval: String,

    /// When it entered the queue (made, or run again), and when a runner

    /// claimed it: its wait is `started_ms - queued_ms` (oxygenhub#348).

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub queued_ms: Option<i64>,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub ready_ms: Option<i64>,

    /// Where its time went, as its runner reported (oxygenflow#35):

    /// `image`, `prepare`, `run` and `finish`, in that order.

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub phases: Vec<FlowPhase>,

    /// The most disk and memory it took, as its runner reported, in MiB.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub peak_disk_mib: Option<i64>,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub peak_memory_mib: Option<i64>,

}

/// A phase of a job and its milliseconds.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct FlowPhase {

    pub name: String,

    pub ms: u64,

}

/// A report: what a Flow job published (OxygenFlow `output { report … }`)

/// or an upload, as docs/reports.md describes (oxygenhub#348).

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, JsonSchema)]

pub struct Report {

    /// Its id, as the web page's `?id=` carries it.

    pub id: i64,

    /// The name the pipeline gave it (`report "frame-timing"`).

    pub name: String,

    /// `coverage`, `tests`, `performance` or `custom`.

    pub kind: String,

    pub title: String,

    pub summary: String,

    pub metrics: Vec<ReportMetric>,

    /// Its `[context]` table.

    pub context: serde_json::Value,

    /// The run and job that published it; none for an upload.

    pub run: Option<i64>,

    pub job: String,

    pub bookmark: String,

    /// The state it measured.

    pub state: String,

    /// How many files it has and their size together.

    pub files: i64,

    pub bytes: i64,

    pub created_ms: i64,

    /// When its files expired under retention (docs/reports.md §3.3): its

    /// metrics stay, its files are gone.

    pub files_expired_ms: Option<i64>,

    /// Its page on the hub.

    pub url: String,

    /// Its files, filled when one report is asked for.

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub manifest: Vec<ReportFile>,

}

/// A metric of a report.

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, JsonSchema)]

pub struct ReportMetric {

    pub key: String,

    pub value: f64,

    pub unit: String,

    /// `lower`, `higher`, or empty.

    pub better: String,

    pub fail_above: Option<f64>,

    pub fail_below: Option<f64>,

}

/// A file of a report.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct ReportFile {

    pub path: String,

    pub size: i64,

}

/// `GET /user/sky` (oxygenhub-android#23): Your sky's data, as the web

/// dashboard's backdrop reads it (docs/backgrounds.md §5): the caller's

/// repositories, newest-updated first, and their events of the last 30

/// days, newest first.

/// `GET /repos/{owner}/{name}/sky` gives one repository's in the same shape.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct UserSky {

    /// The hub's clock (milliseconds), to age the events by.

    pub now: i64,

    /// `owner/name` of each repository.

    pub repos: Vec<String>,

    /// `[repo, kind, at_ms, n]`: an index into `repos`; kind 0 a push of

    /// `n` changes, 1 a proposal event, 2 an issue event, 3 a release, 4 a

    /// Flow run.

    pub events: Vec<[i64; 4]>,

}

/// `GET /user/flow/runs` (oxygenhub-android#26): a run of one of the

/// caller's repositories, with its jobs, for a monitor across them all.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct UserFlowRun {

    /// `owner/name`.

    pub repository: String,

    #[serde(flatten)]

    pub run: FlowRun,

}

/// `GET /user/flow/runs` query: `before` (created before, ms) pages back.

#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]

pub struct UserFlowRunsQuery {

    #[serde(default)]

    pub limit: Option<i64>,

    #[serde(default)]

    pub before: Option<i64>,

}

/// `GET /user/starter?owner=X` (#347): the assistants a new repository

/// under `owner` may ask for its starting files; empty when none is set up

/// or the caller cannot create there.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct StarterAssistants {

    pub assistants: Vec<StarterAssistant>,

}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct StarterAssistant {

    pub name: String,

    pub model: String,

    /// `the site` or `the acme organisation`.

    pub from: String,

}

/// `POST /repos/{owner}/{name}/starter`: what to make, and which assistant

/// (the first available when not given).

#[derive(Clone, Debug, Default, Serialize, Deserialize, JsonSchema)]

pub struct StarterRequest {

    pub description: String,

    #[serde(default)]

    pub assistant: Option<String>,

}

/// Where a repository's starter stands: `running`, `done` (with the

/// change and its files), `failed` (with why), or `none`.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct StarterStatus {

    pub status: String,

    #[serde(default, skip_serializing_if = "String::is_empty")]

    pub assistant: String,