chore: Bump version to 2.3.0

chore(l10n): Xcode auto-extracted new Tool Gateway strings
docs(v2.3): add Tool Gateway + Nous Portal sign-in to release notes + README
2026-05-10 18:44:45 +00:00 · 2026-04-24 03:16:36 +02:00 · 2026-04-24 03:15:06 +02:00 · 2026-04-24 03:08:57 +02:00 · 2026-04-24 02:54:22 +02:00 · 2026-04-24 02:49:08 +02:00
108 changed files with 6271 additions and 929 deletions
@@ -84,7 +84,17 @@ Public documentation lives in the GitHub wiki at https://github.com/awizemann/sc
 ## Hermes Version
-Targets Hermes v0.9.0 (v2026.4.13). Log lines may carry an optional `[session_id]` tag between the level and logger name — `HermesLogService.parseLine` treats the session tag as an optional capture group, so older untagged lines still parse.
+Targets Hermes v0.10.0 (v2026.4.16). Log lines may carry an optional `[session_id]` tag between the level and logger name — `HermesLogService.parseLine` treats the session tag as an optional capture group, so older untagged lines still parse.
 v0.10.0 introduced the **Tool Gateway** — paid Nous Portal subscribers route web search, image generation, TTS, and browser automation through their subscription without separate API keys. In Scarf:
 - **Provider picker** ([ModelCatalogService.swift](scarf/scarf/Core/Services/ModelCatalogService.swift)) merges Hermes's `HERMES_OVERLAYS` so Nous Portal and other overlay-only providers (OpenAI Codex, Qwen OAuth, Google Gemini CLI, GitHub Copilot ACP, Arcee) appear alongside the models.dev catalog. Subscription-gated providers sort first and render a "Subscription" pill.
 - **Subscription detection** ([NousSubscriptionService.swift](scarf/scarf/Core/Services/NousSubscriptionService.swift)) reads `~/.hermes/auth.json` → `providers.nous`. Read-only; Hermes owns the write path.
 - **Per-task routing** (Auxiliary tab) toggles `auxiliary.<task>.provider` between `nous` and `auto`. Hermes derives gateway routing from provider selection — there is no separate `use_gateway` key.
 - **Health surface** ([HealthViewModel.swift](scarf/scarf/Features/Health/ViewModels/HealthViewModel.swift)) adds a synthetic "Tool Gateway" section showing subscription state + `platform_toolsets` mappings + which aux tasks are routed through Nous.
 - **Scarf's existing `Gateway` feature is renamed to "Messaging Gateway"** everywhere user-facing to disambiguate from the new Tool Gateway. The `SidebarSection.gateway` enum case and `gateway_state.json` / `gateway.log` paths are unchanged (not user-facing strings).
 **Keep `ModelCatalogService.overlayOnlyProviders` in sync** with `HERMES_OVERLAYS` in `~/.hermes/hermes-agent/hermes_cli/providers.py`. When Hermes adds a new overlay-only provider, mirror the entry (display name, base URL, auth type, subscription-gated flag, doc URL) or the picker won't reach it.
 ## Project Templates
@@ -142,6 +152,42 @@ Key services: [TemplateConfig.swift](scarf/scarf/Core/Models/TemplateConfig.swif
 **Schema is Swift-primary.** If `TemplateConfigField.FieldType` gains a new case, update in order: `TemplateConfig.swift` (model + validation), `tools/build-catalog.py` (`SUPPORTED_CONFIG_FIELD_TYPES` + type-specific rules), `widgets.js` (`summariseConstraint`), `TemplateConfigSheet.swift` (new control subview), tests on both sides. Schema drift between validator + installer is the kind of bug users only notice after shipping.
 ### Project-scoped chat + Scarf-managed AGENTS.md context (v2.3)
 v2.3 adds a per-project Sessions tab and a "New Chat" button that spawns `hermes acp` with `cwd = project.path`. Session-to-project attribution is persisted in a Scarf-owned sidecar at `~/.hermes/scarf/session_project_map.json` — the ACP wire protocol has no project-metadata hook (extra params are silently dropped), and `state.db` has no cwd column, so the sidecar is Scarf's source of truth for "which project does this session belong to?" Managed by [SessionAttributionService.swift](scarf/scarf/Core/Services/SessionAttributionService.swift); read by the per-project [ProjectSessionsView.swift](scarf/scarf/Features/Projects/Views/ProjectSessionsView.swift).
 **Giving the agent project awareness.** Hermes auto-reads a context file from the session's cwd at startup — priority order `.hermes.md` → `HERMES.md` → `AGENTS.md` → `CLAUDE.md` → `.cursorrules`, first match wins, 20KB cap. We lean on that by writing a Scarf-managed block into `<project>/AGENTS.md` before opening the session. Service: [ProjectAgentContextService.swift](scarf/scarf/Core/Services/ProjectAgentContextService.swift). Block shape:
 ```
 <!-- scarf-project:begin -->
 ## Scarf project context
 _Auto-generated by Scarf — do not edit between the begin/end markers._
 You are operating inside a Scarf project named **"<Project Name>"**. …
 - **Project directory:** `<absolute path>`
 - **Dashboard:** `<path>/.scarf/dashboard.json`
 - **Template:** `<author/id>` v<version>    <!-- template-installed only -->
 - **Configuration fields:** `field_a`, `field_b (secret — name only, value stored in Keychain)`
 - **Registered cron jobs:** `[tmpl:<id>] <name>` — schedule …, currently paused|enabled
 - **Uninstall manifest:** `<path>/.scarf/template.lock.json`  <!-- when present -->
 Any content below this block is template- or user-authored; preserve and defer to it.
 <!-- scarf-project:end -->
 ```
 **Invariants.**
 - **Secret-safe.** Block surfaces field NAMES, never VALUES. A project with a Keychain-stored secret shows `api_token (secret — name only, …)`; the Keychain ref URI and any plaintext value never appear. Auditable by `refreshListsFieldNamesNotValues` in `ProjectAgentContextServiceTests`.
 - **Idempotent.** Two refreshes with unchanged state produce byte-identical output. The write is skipped entirely when no delta, avoiding file-watcher churn.
 - **Bounded.** Everything outside the markers is preserved on every refresh. Template-author AGENTS.md content lives safely below the block.
 - **Non-fatal.** `ChatViewModel.startACPSession` calls refresh with `try?` + log — a failed write doesn't block the chat from starting; worst case is the session loses project awareness.
 - **Refresh timing.** Called BEFORE `client.start()` so the block lands before Hermes's session-boot context scan. Skipping this ordering = the agent sees stale context from the previous refresh (or nothing, on fresh projects).
 **Template-author contract.** A template shipped via the catalog should include an `AGENTS.md` with the template's operational instructions. Authors leave the `<!-- scarf-project -->` region alone — Scarf populates it at chat-start time. Everything below is template-owned and preserved.
 **Known caveat.** If any parent directory of the project contains `.hermes.md` or `HERMES.md`, those shadow the project's `AGENTS.md` (higher in Hermes's priority order). No fix in v2.3 — deferred to v2.4 pending user input on how to handle authored `.hermes.md` files.
 ## Template Catalog
 Shipped community templates live at `templates/<author>/<name>/` (one level down — `templates/CONTRIBUTING.md` explains the submission flow for authors). The catalog site is generated from this directory and served at `awizemann.github.io/scarf/templates/` alongside the Sparkle appcast — the two coexist on the `gh-pages` branch but touch completely disjoint paths.
@@ -19,13 +19,25 @@
  <a href="https://www.buymeacoffee.com/awizemann"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me a Coffee" height="28"></a>
 </p>
-## What's New in 2.2
+## What's New in 2.3
- **Project Templates** — Scarf projects can now travel. Package a project's dashboard, agent instructions, skills, and cron jobs into a `.scarftemplate` bundle, hand it to anyone, and they install it in one click. Every bundle ships with a cross-agent `AGENTS.md` ([agents.md](https://agents.md/) standard) so the instructions work in Claude Code, Cursor, Codex, Aider, and the 20+ other agents that read it natively. Browser-based one-click install via `scarf://install?url=…` deep links. Export / Install from File / Install from URL live under the new **Templates** menu in the Projects toolbar.
+- **Projects sidebar grows up** — group projects into folders, rename / archive / unarchive in place, filter the list with ⌘F, jump to the first nine with ⌘1–⌘9. Archived projects hide by default; a toggle in the bottom bar surfaces them. Non-destructive on the v2.2 registry file — downgrade stays clean.
- **Preview-before-apply** — Every install shows a preview sheet listing the exact project directory that will be created, every file inside it, every skill that will be namespaced, every cron job that will be registered (paused by default), and a live diff of any memory appendix. Nothing writes until you click Install.
+- **Per-project Sessions tab** — alongside Dashboard and Site. Shows chats attributed to the project, with a **New Chat** button that spawns `hermes acp` with the project's directory as the session cwd and attributes the result via a Scarf-owned sidecar (`~/.hermes/scarf/session_project_map.json`). Click any listed session to resume it with project context automatically restored.
- **Safe-by-design** — Skills install into `~/.hermes/skills/templates/<slug>/` so they never collide with your own. Cron jobs carry a `[tmpl:<id>]` tag and start paused. A `template.lock.json` records everything written for easy uninstall. Templates **never** touch `config.yaml`, `auth.json`, sessions, or credentials.
+- **Agent actually knows what project it's in** — the architectural headline. Every project-scoped chat gets a Scarf-managed block auto-injected into the project's `AGENTS.md` before the session starts. Hermes reads AGENTS.md from the session's cwd at startup and picks up the block as part of its system prompt. Ask the agent *"what project am I in?"* and it answers with the project name, directory, template id + version, configuration field names, and registered cron jobs — pulled from the injected block. Secret-safe (field names only, never values), idempotent, bounded to `<!-- scarf-project:begin/end -->` markers so template-author content outside the block is preserved across refreshes.
 - **Project indicator in Chat** — folder chip in `SessionInfoBar` and `Chat · <ProjectName>` in the nav title when you're in a project-scoped chat. Resumed sessions keep the indicator by looking up the attribution sidecar at resume time.
 - **Tool Gateway — Nous Portal support** — Hermes v0.10.0 introduced subscription-routed tools (web search, image gen, TTS, browser automation). Scarf 2.3 merges Hermes's provider-overlay table into the model picker so **Nous Portal + 5 other previously-invisible providers** now appear, and ships a dedicated **Sign in to Nous Portal** sheet that runs the device-code flow end-to-end in-app — no terminal. Each of the 8 auxiliary sub-model tasks gets a per-task Nous toggle, a Tool Gateway card lands in Health, and Credential Pools' silent-fail dead-end for device-code providers is closed. Scarf's existing messaging-gateway section is renamed **Messaging Gateway** to disambiguate from the new Tool Gateway.
 - **Window-layout cleanup** — switching to Chat or a Sessions tab no longer grows the window past the screen. `.windowResizability(.contentMinSize)` + targeted `idealHeight` caps keep the window's floor at a sensible content minimum while letting users freely drag larger or smaller.
-See the full [v2.2.0 release notes](https://github.com/awizemann/scarf/releases/tag/v2.2.0).
+See the full [v2.3.0 release notes](https://github.com/awizemann/scarf/releases/tag/v2.3.0), the [Project Templates wiki page](https://github.com/awizemann/scarf/wiki/Project-Templates), and the [Hermes Version Compatibility page](https://github.com/awizemann/scarf/wiki/Hermes-Version-Compatibility) for the Tool Gateway's Hermes v0.10.0 requirement.
 ### Previously, in 2.2
 - **Project Templates** — Scarf projects can now travel. Package a project's dashboard, agent instructions, skills, cron jobs, and a typed configuration schema into a `.scarftemplate` bundle, hand it to anyone, and they install it in one click. Every bundle ships with a cross-agent `AGENTS.md` ([agents.md](https://agents.md/) standard) so the instructions work in Claude Code, Cursor, Codex, Aider, and the 20+ other agents that read it natively. Browser-based one-click install via `scarf://install?url=…` deep links. Export / Install from File / Install from URL live under the **Templates** menu in the Projects toolbar.
 - **Typed configuration with Keychain-backed secrets** — templates declare a schema with seven field types (`string`, `text`, `number`, `bool`, `enum`, `list`, `secret`). A **Configure** step in the install flow renders the form, routes secrets to the macOS Keychain, and drops non-secret values into `<project>/.scarf/config.json`.
 - **Public template catalog** — [awizemann.github.io/scarf/templates/](https://awizemann.github.io/scarf/templates/) with live dashboard previews + schema rendering. CI-enforced Python validator mirrors the Swift-side invariants on every PR.
 - **Safe-by-design** — skills namespaced, cron jobs tagged and paused-on-install, lock-file-driven uninstall, exports carry schema but never values.
 See the [v2.2.0 release notes](https://github.com/awizemann/scarf/releases/tag/v2.2.0) for the full 2.2 series.
 ### Previously, in 2.1
@@ -1,15 +1,50 @@
 ## What's New in 2.2.0
-Scarf projects can now travel. This release introduces **Project Templates** — a shareable `.scarftemplate` bundle format that packages a project's dashboard, agent instructions, skills, and cron jobs into a single file anyone can install with one click from a local file or an `scarf://install?url=…` deep link.
+Scarf projects can now travel. This release introduces **Project Templates** — a shareable `.scarftemplate` bundle format that packages a project's dashboard, agent instructions, skills, cron jobs, and a typed configuration schema into a single file anyone can install with one click. Bundles are agent-portable by design: every template ships with a cross-agent [`AGENTS.md`](https://agents.md/) so the instructions work natively in Claude Code, Cursor, Codex, Aider, Jules, Copilot, Zed, and every other agent that reads the Linux Foundation standard.
 This is also the first release to ship a public **template catalog website** — a static site generated from `templates/<author>/<name>/` in this repo, previewed at [awizemann.github.io/scarf/templates/](https://awizemann.github.io/scarf/templates/), with a CI-enforced validator for community submissions.
 ### Project Templates
- **Bundle format: `.scarftemplate`.** A zip archive carrying a `template.json` manifest, the project's dashboard, a required `AGENTS.md` (the [Linux Foundation cross-agent instructions standard](https://agents.md/) — reads natively in Claude Code, Cursor, Codex, Aider, Jules, Copilot, Zed, and more), a README shown in the installer, optional per-agent instruction shims (`CLAUDE.md`, `GEMINI.md`, `.cursorrules`, `.github/copilot-instructions.md`), optional namespaced skills, optional cron job definitions, and an optional memory appendix. Every bundle is agent-portable out of the box.
+- **Bundle format: `.scarftemplate`.** A zip carrying a `template.json` manifest, the project's dashboard, a required `AGENTS.md` (the [Linux Foundation cross-agent instructions standard](https://agents.md/) — reads natively in Claude Code, Cursor, Codex, Aider, Jules, Copilot, Zed, and more), a README shown in the installer, optional per-agent instruction shims (`CLAUDE.md`, `GEMINI.md`, `.cursorrules`, `.github/copilot-instructions.md`), optional namespaced skills, optional cron job definitions, and an optional memory appendix.
- **Install preview sheet.** Before anything touches disk, Scarf shows you the exact project directory that will be created, every file inside it, every skill that will be namespaced under `~/.hermes/skills/templates/<slug>/`, every cron job that will be registered (always paused — you enable each one manually), and a live diff of the memory appendix against your existing `MEMORY.md`. The manifest's content claim is cross-checked against the actual zip entries so a bundle can't hide files from the preview.
+- **Install preview sheet.** Before anything touches disk, Scarf shows you the exact project directory that will be created, every file inside it, every skill that will be namespaced under `~/.hermes/skills/templates/<slug>/`, every cron job that will be registered (always paused — you enable each one manually), and a live diff of the memory appendix against your existing `MEMORY.md`. Markdown fields — the README, field descriptions, cron prompts — render inline. The manifest's content claim is cross-checked against the actual zip entries so a bundle can't hide files from the preview.
 - **`scarf://install?url=…` deep links.** Register Scarf as the handler for the `scarf` URL scheme so a future catalog site can link one-click installs straight into the app. Only `https://` payloads are accepted; `file://`, `javascript:`, and `http://` are refused on principle. A 50 MB size cap keeps a malicious link from exhausting disk. The URL never auto-installs — the preview sheet is always user-confirmed.
- **Export any project as a template.** Select a project, open the new Templates menu in the Projects toolbar, fill in a handful of fields (id, name, version, description, optional author + category + tags), tick the skills and cron jobs you want to include, optionally drop in a memory snippet, and save. The exporter builds the bundle and you can hand it to anyone.
+- **Install-time token substitution.** Template authors use `{{PROJECT_DIR}}`, `{{TEMPLATE_ID}}`, and `{{TEMPLATE_SLUG}}` placeholders in cron prompts; the installer resolves them to absolute paths at install time so the registered cron job works regardless of where Hermes sets CWD.
- **No-overwrite, reversible by design.** Installed templates drop a `<project>/.scarf/template.lock.json` recording exactly what they wrote — every project file, skill path, cron job name, and memory block id. Installing the same template id twice is refused at the preview step so you don't accidentally double-append to `MEMORY.md`. Uninstalling by hand is a matter of deleting the project directory, the skills namespace folder, and any `[tmpl:<id>] …` cron jobs — no hidden state.
+- **Export any project as a template.** Select a project, open the new Templates menu in the Projects toolbar, fill in a handful of fields (id, name, version, description, optional author + category + tags), tick the skills and cron jobs you want to include, optionally drop in a memory snippet, and save. The exporter carries the authored configuration schema forward but **never** the user's values — exports are safe on projects with live config.
- **Safe globals.** Skills install to `~/.hermes/skills/templates/<slug>/<skill-name>/` so they never collide with your own skills. Cron jobs are prefixed with `[tmpl:<id>]` and start paused so nothing unexpected kicks off on install. The installer **never** touches `~/.hermes/config.yaml`, `auth.json`, sessions, or any credential-bearing path.
+- **No-overwrite, reversible by design.** Installed templates drop a `<project>/.scarf/template.lock.json` recording exactly what they wrote — every project file, skill path, cron job name, memory block id, and Keychain reference. Installing the same template id twice is refused at the preview step so you don't accidentally double-append to `MEMORY.md`.
 - **Safe globals.** Skills install to `~/.hermes/skills/templates/<slug>/<skill-name>/` so they never collide with your own skills. Cron jobs are prefixed with `[tmpl:<id>]` and start paused. The installer **never** touches `~/.hermes/config.yaml`, `auth.json`, sessions, or any credential-bearing path.
 ### Template Configuration (schemaVersion 2)
 Templates can now declare a typed configuration schema that drives a form step during install — no more "edit a `sites.txt` file to get started."
 - **Typed field vocabulary.** Seven field types: `string`, `text` (multiline), `number` (with `min`/`max`), `bool`, `enum` (with `{value, label}` options), `list` (of strings, with `minItems`/`maxItems`), and `secret` (routed to the macOS Keychain). Constraints per type — `pattern` for regex, `minLength`/`maxLength` for text, etc. — are enforced at install and at edit time.
 - **Configure step in the install flow.** If the template declares a schema, a **Configure** screen is inserted between "pick parent directory" and the preview sheet. Non-secret values land in `<project>/.scarf/config.json`; secrets land in the macOS Keychain with a service name of `com.scarf.template.<slug>` and an account keyed to the project-directory hash (so two installs of the same template in different dirs don't collide on Keychain entries).
 - **Post-install Configuration editor.** A slider icon in the dashboard header opens the same form pre-filled with the current values. Change a site, rotate a token, toggle a feature — the cron job picks up the new values on its next run. Secrets are never echoed back ("Saved in Keychain — leave empty to keep the stored value").
 - **Model recommendations.** Templates can suggest a preferred model (`claude-sonnet-4.5`, `claude-haiku-4`, `gpt-4.1`, etc.) with a rationale. Scarf surfaces the recommendation in the configure sheet without auto-switching your active model — always your call.
 - **Secrets are tracked in the lock file.** Uninstalling a template runs `SecItemDelete` on every Keychain ref recorded at install, so a full clean-up leaves nothing behind. Absent entries (user already cleaned them) are no-ops.
 ### Template Catalog
 A Sparkle-style pipeline for community-contributed templates, living on the same `gh-pages` branch as the auto-update feed.
 - **Static site.** [awizemann.github.io/scarf/templates/](https://awizemann.github.io/scarf/templates/) — generated from every `templates/<author>/<name>/` directory. Each template gets a detail page showing the README, a live preview of the post-install dashboard, and the configuration schema rendered with human-readable constraint summaries. One-click install via the `scarf://install?url=…` button.
 - **Stdlib-only Python validator.** `tools/build-catalog.py` is a no-external-dependencies Python script that mirrors the Swift-side schema and validation invariants (supported widget types, supported field types, `contents` claim verification, secret-with-default rejection, bundle-size cap, high-confidence secret patterns). Run it locally with `./scripts/catalog.sh check` before submitting a PR.
 - **CI gate on PRs.** [`.github/workflows/validate-template-pr.yml`](https://github.com/awizemann/scarf/blob/main/.github/workflows/validate-template-pr.yml) runs the validator + its 24-test suite on every PR touching `templates/`, the validator itself, or its tests. Failing PRs get an inline comment with the last 3 KB of the validator output; passing PRs get a tailored checklist naming the specific template directory being changed.
 - **Install-URL hosting.** Bundles are raw-served from `main` at `https://raw.githubusercontent.com/awizemann/scarf/main/templates/<author>/<name>/<name>.scarftemplate`. No per-template GitHub Releases ceremony.
 - **Dogfood: the site uses Scarf's dashboard format.** `site/widgets.js` is ~300 lines of vanilla JS that renders a `ProjectDashboard` JSON using the same widget vocabulary the app uses, so each detail page's "live preview" is the actual dashboard the user will get.
 ### Example template: `awizemann/site-status-checker`
 Ships as the first catalog entry and exercises every v2.2 surface. [See it in the catalog →](https://awizemann.github.io/scarf/templates/awizemann-site-status-checker/)
 - Configure step asks for a list of URLs and a per-URL timeout.
 - A paused cron job runs daily at 09:00 (editable from the Cron sidebar), does HTTP GETs with 3-redirect follow, writes a timestamped results table to `status-log.md`, updates the dashboard's Sites Up / Sites Down / Last Checked stat widgets plus the Watched Sites list, and rewrites the Site tab's webview URL to the first configured site.
 - Works in any agent — the `AGENTS.md` is the single source of truth; no per-agent shim needed.
 ### Site tab
 A dashboard with at least one `webview` widget now exposes a **Site** tab next to Dashboard. Useful for templates that watch something renderable (a site, a preview endpoint, a Grafana panel). The `site-status-checker` example rewrites the webview URL to the first configured site on every cron run, so the tab stays in sync with live config.
 ### Using templates
@@ -17,29 +52,43 @@ Scarf projects can now travel. This release introduces **Project Templates** —
 - **Install from URL:** Projects → Templates → *Install from URL…*, paste an https URL.
 - **Install from the web:** click any `scarf://install?url=…` link in a browser.
 - **Export:** select a project → Projects → Templates → *Export "&lt;name&gt;" as Template…*, fill the form, save.
 - **Edit config post-install:** slider icon in the dashboard header.
 - **Uninstall:** right-click the project in the sidebar → *Uninstall Template (remove installed files)…*, or click the uninstall icon in the dashboard header. The preview sheet lists every file, cron job, Keychain secret, and memory block that will be removed, plus every user-created file that will be preserved.
-### Under the hood
+### UX clarifications
- New models in `Core/Models/ProjectTemplate.swift` (manifest, inspection, install plan, lock, errors).
+- **Remove from List vs. Uninstall Template.** Sidebar context-menu labels clarified so you can see at a glance whether a click is destructive. *Remove from List (keep files)…* is registry-only — nothing on disk is touched, cron jobs stay, Keychain secrets stay. A confirmation dialog spells this out before the click lands. *Uninstall Template (remove installed files)…* is the full, lock-driven cleanup.
- `Core/Services/ProjectTemplateService.swift` unzips, parses, and validates; `ProjectTemplateInstaller.swift` executes the plan atomically-enough (pre-flights conflicts, then writes); `ProjectTemplateExporter.swift` builds bundles from a live project + selections.
+- **Post-uninstall "folder kept" banner.** When the uninstaller preserves the project directory because the cron wrote a `status-log.md` (or the user dropped files in there), the success view now explicitly lists the preserved paths with a pointer to delete the folder from Finder if desired.
- `Core/Services/TemplateURLRouter.swift` is the process-wide landing pad for `scarf://` URLs so a cold-launch browser click still reaches the install sheet.
+- **Run Now no longer blocks on agent runs.** The Cron sidebar's Run Now button used to show a "Run failed" toast whenever an agent job ran longer than 60 s — even when the job was finishing correctly in the background. Run Now now shows "Agent started — dashboard will update when it finishes" immediately and the dashboard watcher picks up the completed state when it lands (timeout bumped to 300 s for the catch-stuck-process case).
 - Installer dispatches cron creation via `hermes cron create` (there's no direct Scarf write path for `cron/jobs.json`), then diffs before/after to pause the newly-registered jobs.
 - New Swift Testing suites: `ProjectTemplateServiceTests`, `TemplateURLRouterTests`, `ProjectTemplateExportTests`.
 ### Uninstall
- **One-click uninstall** driven by `template.lock.json`. Right-click any template-installed project in the sidebar → **Uninstall Template…**, or click the uninstall button in the dashboard header. A preview sheet lists every file, cron job, and memory block that will be removed, and every user-created file that will be preserved.
+- **One-click uninstall** driven by `template.lock.json`. The preview sheet lists every file, cron job, Keychain ref, and memory block that will be removed, and every user-created file that will be preserved.
 - **User content is never removed.** Files you (or the agent) added to the project dir after install — like a `sites.txt` or `status-log.md` — are detected and listed as "keep" in the preview. The project directory itself is removed only if nothing user-owned is left inside.
- **Clean global state.** The isolated `~/.hermes/skills/templates/<slug>/` namespace is removed wholesale. Tagged cron jobs are removed via `hermes cron remove`. The memory block between the `<!-- scarf-template:<id>:begin/end -->` markers is stripped, leaving the rest of MEMORY.md intact. The project registry entry is removed last.
+- **Clean global state.** The isolated `~/.hermes/skills/templates/<slug>/` namespace is removed wholesale. Tagged cron jobs are removed via `hermes cron remove`. Every recorded Keychain ref is cleared via `SecItemDelete`. The memory block between the `<!-- scarf-template:<id>:begin/end -->` markers is stripped, leaving the rest of MEMORY.md intact. The project registry entry is removed last.
- **No undo.** v1 uninstall is destructive — to reinstall, run the install flow again.
+- **No undo.** Uninstall is destructive — to reinstall, run the install flow again.
-### Not in this release (planned for v2.3)
+### Under the hood
- In-app catalog browser backed by a GitHub Pages `templates.json`.
+- New models in `Core/Models/ProjectTemplate.swift` (manifest, inspection, install plan, lock file v2) and `Core/Models/TemplateConfig.swift` (schema + typed values + Keychain ref model).
- EdDSA-signed bundles reusing the Sparkle key.
+- `Core/Services/ProjectTemplateService.swift` unzips, parses, and validates; `ProjectTemplateInstaller.swift` executes the plan with preflight + fail-fast semantics; `ProjectTemplateUninstaller.swift` reverses an install driven by the lock file; `ProjectTemplateExporter.swift` builds bundles from a live project + selections.
- Template updates (compare installed lock against a newer bundle's version, offer a diff).
+- `Core/Services/ProjectConfigService.swift` owns load/save/validation of `<project>/.scarf/config.json` + secret resolution; `Core/Services/ProjectConfigKeychain.swift` is the thin `SecItemAdd`/`Copy`/`Delete` wrapper (the only Keychain consumer in Scarf today).
- Installing into remote `ServerContext`s (v1 is local-only).
+- `Core/Services/TemplateURLRouter.swift` is the process-wide landing pad for `scarf://` URLs so a cold-launch browser click still reaches the install sheet.
 - New Swift Testing suites covering 57 tests across the service / installer / uninstaller / exporter / config / Keychain / URL-router paths.
 - New Python validator (`tools/build-catalog.py`) + test suite (`tools/test_build_catalog.py`, 24 tests) mirrors the Swift invariants for the CI gate and the site generator. Schema is Swift-primary — additions go to Swift first, Python mirrors.
 - `scripts/catalog.sh` wraps the validator with `check / build / preview / serve / publish` subcommands that parallel the `scripts/release.sh` shape.
 ### Migrating from 2.1.x
-Sparkle will offer the update automatically. No config migration needed. Existing projects are untouched — templates are additive.
+Sparkle will offer the update automatically. No config migration needed. Existing projects are untouched — templates are additive. If you had a v2.2.0-dev install of the earlier `project-templates` branch, uninstall and reinstall any previously-installed templates to pick up the schema-version-2 lock file.
 ### Documentation
 - [Project Templates wiki page](https://github.com/awizemann/scarf/wiki/Project-Templates) — installing, exporting, configuring, authoring, uninstalling.
 - [Catalog site](https://awizemann.github.io/scarf/templates/) — the public catalog with live dashboard previews.
 - [`templates/CONTRIBUTING.md`](https://github.com/awizemann/scarf/blob/main/templates/CONTRIBUTING.md) — how to submit a template via PR.
 - [Architecture notes in root `CLAUDE.md`](https://github.com/awizemann/scarf/blob/main/CLAUDE.md#project-templates) — service-layer map, Keychain scheme, schema-drift discipline.
 ### Thanks
 Thanks to everyone who tested drafts of the install flow, caught the "Run Now blocks on agent" bug, and pushed on the Remove-vs-Uninstall UX until it was clear. A 2.3 follow-up will extend the catalog validator to enforce per-field-type constraints at PR-time (currently enforced on install but not at submission).
@@ -0,0 +1,38 @@
 ## What's New in 2.2.1
 A patch release covering Template Configuration rendering fixes reported against v2.2.0, plus a new catalog template that packages a Hermes skill for scaffolding new Scarf projects.
 ### Configuration sheet — no more clipping
 Two independent rendering fixes to the post-install Configuration editor and the install-flow Configure step:
 - **Enum fields with long option labels.** An enum with three or four options whose labels exceeded ~20 characters — e.g. a Claude-model picker with labels like *"Claude Opus 4 (Recommended - Most Capable)"* — rendered as a segmented picker that sized to the intrinsic width of all labels concatenated. On macOS, `.pickerStyle(.segmented)` refuses to respect offered width, refuses to wrap, refuses to truncate. The result was a ~650pt picker that overflowed the sheet's 560pt viewport and clipped the entire form on both sides. Enum fields now always render as a dropdown Menu picker, which surfaces long labels in the popup list and respects the parent's offered width regardless of option count or label length.
 - **Descriptions with unbreakable content.** Field descriptions rendered via inline AttributedString markdown can contain tokens SwiftUI's `Text` refuses to break mid-token (raw URLs, long paths). Added `.frame(maxWidth: .infinity, alignment: .leading)` on the sheet's inner VStack and on each field row as a secondary constraint, so description text wraps at whitespace boundaries instead of expanding the sheet width. Applied the same modifier to `TemplateInstallSheet`'s main preview VStack for symmetry — installs with README blocks or cron prompts containing long URLs now wrap cleanly too.
 ### New catalog entry — `awizemann/template-author`
 A `.scarftemplate` whose only content is a Hermes skill (`scarf-template-author`) plus a minimal dashboard that points users at it. Installing the template drops the skill at `~/.hermes/skills/templates/awizemann-template-author/scarf-template-author/SKILL.md`, discoverable by Claude Code, Cursor, Codex, Aider, and every other agent that reads the standard `~/.hermes/skills/` directory.
 The skill teaches agents how to scaffold a new Scarf-compatible project through a short interview — purpose, data source, cadence, widgets, config, secrets — then write `<project>/.scarf/dashboard.json`, `<project>/.scarf/manifest.json`, `<project>/AGENTS.md`, and `<project>/README.md`. Scaffolded projects are usable locally and cleanly exportable as `.scarftemplate` bundles via Scarf's Export flow later. [Catalog detail page →](https://awizemann.github.io/scarf/templates/awizemann-template-author/)
 v1 is fully conversational / blank-slate. Pre-baked archetypes (monitor, dev-dashboard, personal-log) are deferred to a future release pending real usage data.
 ### Authoring guidance — SKILL.md
 The `scarf-template-author` skill now tells scaffolding agents to prefer markdown link syntax (`[label](https://…)`) over raw URLs in schema field descriptions. Raw URLs work now (v2.2.1's description wrap fix above handles them gracefully), but `[Anthropic console](https://console.anthropic.com)` reads cleaner in the form than a dumped URL. Same rule extended to long paths or other unbreakable strings — wrap in inline code if they have to appear verbatim, prefer markdown links otherwise.
 ### Under the hood
 - **`scripts/catalog.sh publish` fix.** The pre-flight `need_ghpages` check tested `[[ -d "$GHPAGES_DIR/.git" ]]` — "is `.git` a directory?" — which is true for a regular clone but false for a `git worktree add` worktree (where `.git` is a pointer file). `release.sh` creates and leaves the gh-pages worktree around, so after any release the subsequent catalog-publish call was rejected with a misleading "run `git worktree add`" error on a worktree that was already there and valid. Switched to `-e` (exists, either file or directory). Unblocks publishing the catalog immediately after a release.
 ### Migrating from 2.2.0
 Sparkle will offer the update automatically. No config migration needed. Existing template installs are untouched.
 If you've already installed `awizemann/template-author` from a pre-release build, no action needed — the catalog and bundle content are forward-compatible.
 ### Documentation
 - [Project Templates wiki page](https://github.com/awizemann/scarf/wiki/Project-Templates) — installing, exporting, configuring, authoring, uninstalling.
 - [Catalog site](https://awizemann.github.io/scarf/templates/) — two templates live: `awizemann/site-status-checker` and `awizemann/template-author`.
 - [`templates/CONTRIBUTING.md`](https://github.com/awizemann/scarf/blob/main/templates/CONTRIBUTING.md) — how to submit a template via PR.
@@ -0,0 +1,124 @@
 ## What's New in 2.3.0
 Two themes land together in this release. The projects sidebar stops being a flat list and becomes a workspace — folders, rename + archive + search + keyboard jumps, a per-project Sessions tab, and every project-scoped chat now automatically carries Scarf-managed context into the agent itself. And Scarf catches up to **Hermes v0.10.0's Tool Gateway**: paid Nous Portal subscribers can now route web search, image generation, TTS, and browser automation through their subscription without separate API keys — and they can sign in entirely from Scarf, no terminal needed.
 ### Projects sidebar grows up
 - **Folders.** Group related projects with folders. Right-click any project → *Move to Folder…* — pick an existing folder or create a new one on the fly. Folders are soft: any folder name that isn't referenced by at least one project just disappears, so there's no "empty folder" state to clean up.
 - **Rename** a project from the context menu. Preserves everything else — the path, folder assignment, archive flag, and any running cron attribution stay intact. Rejects duplicate names + empty input with an inline warning.
 - **Archive / Unarchive.** Hide projects you don't actively use without deleting anything. The sidebar's bottom bar gains a Show Archived toggle so they're one click away when you need them.
 - **Search.** ⌘F focuses a filter field at the top of the sidebar. Fuzzy-matches on name, path, and folder label, live as you type.
 - **Keyboard jumps.** ⌘1 through ⌘9 jump to the first nine top-level projects. Pairs cleanly with Scarf's existing window-level shortcuts.
 Registry migration is non-destructive — `~/.hermes/scarf/projects.json` gains two optional fields (`folder`, `archived`), and a file written by v2.3 is still parseable by v2.2.1 (unknown-keys are ignored), so downgrade works if you ever need it.
 ### Per-project Sessions tab
 Every project now has a **Sessions** tab alongside Dashboard and Site. It shows chats attributed to this specific project — the sidecar at `~/.hermes/scarf/session_project_map.json` maintains the session-to-project mapping (Hermes's `state.db` has no column for this, so Scarf owns the record).
 - **New Chat** — spawns `hermes acp` with the project's directory as the session's working directory, attributes the resulting session to the project, and takes you straight into the chat view.
 - **Click any listed session to resume it** in the Chat tab; the project indicator comes along automatically.
 - Forward-only attribution: sessions you've already started via the CLI or via the global Chat sidebar section continue to live in the global Sessions view unchanged; they simply aren't attributed to any project.
 File descriptors are released cleanly on tab-disappear, matching Scarf's other Hermes-DB-reading VMs.
 ### Agent context injection via AGENTS.md
 The architectural headline of this release. Hermes has no native "project" concept and ACP's wire protocol drops extra session params. But Hermes DOES auto-read `AGENTS.md` from the session's cwd at startup (priority: `.hermes.md` → `HERMES.md` → `AGENTS.md` → `CLAUDE.md` → `.cursorrules`, first match wins, 20KB cap). So Scarf leans on that.
 Every time you start a project-scoped chat, Scarf writes a managed block into `<project>/AGENTS.md`:
 ```
 <!-- scarf-project:begin -->
 ## Scarf project context
 You are operating inside a Scarf project named "<Project Name>". …
 - Project directory: …
 - Dashboard: …
 - Template: <id> v<version>
 - Configuration fields: field_a, api_token (secret — name only, value stored in Keychain)
 - Registered cron jobs: [tmpl:<id>] <name> — schedule …
 …
 <!-- scarf-project:end -->
 ```
 Ask a fresh chat *"what project am I in?"* and the agent answers with the project name, dashboard path, template id, and current cron schedule — pulled from the block Hermes injected into its system prompt automatically.
 **Invariants the block guarantees:**
 - **Secret-safe.** Surfaces config field *names* with type hints; never values. A project whose config.json has Keychain-ref URIs renders the fields as `api_token (secret — name only, value stored in Keychain)`. Keychain URIs and plaintext values never appear in the block. Locked in by an explicit test (`refreshListsFieldNamesNotValues`).
 - **Idempotent.** Two consecutive refreshes with unchanged state produce byte-identical output. The write is skipped entirely when no delta — no unnecessary file-watcher churn.
 - **Bounded.** Everything outside the `<!-- scarf-project -->` markers is preserved across every refresh. Template-author AGENTS.md content lives safely below the block; hand-edits are never clobbered.
 - **Non-fatal.** A failed block refresh doesn't block the chat from starting — logged + the session proceeds without the extra context.
 - **Bare-project friendly.** Projects without an AGENTS.md (plain directories added via the + button) get one created with just the block. Agent awareness works even without template scaffolding.
 **Template-author contract:** leave the `<!-- scarf-project -->` region alone in your bundled `AGENTS.md`. Put template-specific instructions below it so they're preserved across refreshes. The `scarf-template-author` scaffolding skill already teaches this pattern to future agents doing project scaffolding.
 **Known caveat:** if any parent directory of your project contains a `.hermes.md` or `HERMES.md`, that file takes priority over the project's AGENTS.md in Hermes's discovery order — the Scarf block gets shadowed. No fix in 2.3 — planned for 2.4 pending design input on handling authored `.hermes.md` files.
 ### Chat UI — project awareness everywhere
 Once the cwd, attribution, and AGENTS.md pieces land, the UI follows:
 - **Folder chip in `SessionInfoBar`** at the start of the bar (before the working dot + title) shows the active project name with a folder icon.
 - **Navigation title** reads `Chat · <ProjectName>` when scoped, plain `Chat` otherwise — macOS `Subject — Detail` convention.
 - **Resumed sessions keep the indicator.** Whether you click a session in the project's Sessions tab or come in from a future deep-link, the attribution is looked up at resume time and the chip renders from the same state.
 ### Window-layout fixes
 A pre-existing issue — untracked until v2.3's heavier Chat/Sessions content exposed it — where the window grew past the screen when you switched to content-heavy sections. Fixed by:
 - Setting `WindowGroup.windowResizability(.contentMinSize)` so the window's floor (not ceiling) is derived from content.
 - Capping `idealHeight` on `RichChatView` and `ProjectSessionsView` so their plain-VStack children (deliberate choice to dodge a LazyVStack whitespace bug) don't report screen-exceeding ideals upward through `NavigationSplitView.detail`.
 Window now stays at a user-draggable size and persists across section switches.
 ### Under the hood
 - New models: `SessionProjectMap` — `~/.hermes/scarf/session_project_map.json` serialization (`SessionAttributionService` manages it).
 - New services: `SessionAttributionService` (reads + writes the sidecar), `ProjectAgentContextService` (writes the AGENTS.md marker block, tests cover prepend/replace/idempotency/secret-redaction).
 - New view models: `ProjectSessionsViewModel` (per-project session list with attribution filter), `ChatViewModel` gains `currentProjectPath` + `currentProjectName`.
 - `HermesFileWatcher` now watches the attribution sidecar — file-system events propagate through the VMs as they do for every other Scarf-written file.
 - `ProjectsViewModel` gains `moveProject / renameProject / archiveProject / unarchiveProject / folders` — rename preserves selection; archive clears it; reorders driven by `localizedCaseInsensitiveCompare` for locale-aware ordering.
 - **Tool Gateway services.** `NousSubscriptionService` reads `~/.hermes/auth.json` to detect the subscription state. `NousAuthFlow` spawns `hermes auth add nous --no-browser` (with `PYTHONUNBUFFERED=1` so the device-code block surfaces immediately — Python block-buffers otherwise), parses the verification URL + user code with two line-anchored regexes, auto-opens the approval page via `NSWorkspace`, and confirms success by re-reading `auth.json`. `NousSignInSheet` drives the four-state UI (starting / waiting-for-approval / success / failure-with-billing-link). `CredentialPoolsOAuthGate` is the testable helper that routes providers to the right OAuth flow based on their overlay auth-type.
 - **Catalog overlay merge.** `ModelCatalogService` gains a static `overlayOnlyProviders` table mirroring the 6 entries from `HERMES_OVERLAYS` in `hermes-agent/hermes_cli/providers.py`. `HermesProviderInfo` carries `isOverlay` and `subscriptionGated` flags so the picker can render them distinctly.
 - **Config parsing.** `HermesConfig` gains `platformToolsets: [String: [String]]`; `HermesFileService` parses the `platform_toolsets.<platform>` block from `config.yaml` as written by `hermes setup tools`.
 - **36 new Swift tests** across `ProjectRegistryMigrationTests`, `ProjectsViewModelTests`, `SessionAttributionServiceTests`, `ProjectAgentContextServiceTests` (22 for v2.3 projects work) + `ToolGatewayTests`, `NousAuthFlowParserTests`, `CredentialPoolsGatingTests` (14 for Tool Gateway). Total: 120 tests, all green against v2.3-projects + Tool Gateway combined.
 ### Icon tweak
 App icon files renamed from iOS-template suffixes to macOS-native filenames + paired `Contents.json` update. Pure naming; no visual change at any rendered size.
 ### Tool Gateway — Nous Portal support
 Hermes v0.10.0 introduced a **Tool Gateway**: paid [Nous Portal](https://portal.nousresearch.com) subscribers route web search (Firecrawl), image generation (FAL / FLUX 2 Pro), text-to-speech (OpenAI TTS), and browser automation (Browser Use) through their subscription. No separate API keys, no credential pool juggling. Scarf 2.3 surfaces the whole flow natively.
 - **Nous Portal appears in the model picker.** Our picker used to read only the models.dev cache, which doesn't list Nous — so it was invisible. Scarf now merges Hermes's `HERMES_OVERLAYS` table on top of the cache, surfacing **six previously-hidden providers**: Nous Portal, OpenAI Codex, Qwen OAuth, Google Gemini CLI, GitHub Copilot ACP, and Arcee. Subscription-gated providers sort first, with a **Subscription** pill so they're visually distinct from BYO-key providers.
 - **In-app sign-in.** Click *Sign in to Nous Portal* in the picker (or in the Auxiliary tab's fallback, or Credential Pools for the `nous` provider) and Scarf runs the device-code flow: opens the approval page in your browser, shows the device code in a large monospaced badge you can copy, and auto-detects success by re-reading `~/.hermes/auth.json`. No six-step terminal dance. Subscription-required failures surface a **Subscribe** button that opens the portal's billing page directly.
 - **Per-task gateway routing.** The Auxiliary tab's 8 sub-model tasks (vision, web_extract, compression, session_search, skills_hub, approval, mcp, flush_memories) each gain a "Nous Portal" toggle. Enabling it flips `auxiliary.<task>.provider` to `nous` — Hermes derives gateway routing from that, no separate `use_gateway` key needed.
 - **Health surface.** A new **Tool Gateway** card in Health shows subscription state, `platform_toolsets` wiring, and which aux tasks are currently routed through Nous.
 - **Credential Pools dead-end fixed.** Before: selecting `nous` in the Add Credential sheet and clicking *Start OAuth* silently stalled (the PKCE URL regex never matched the device-code output). Now the sheet detects Nous and routes to the dedicated sign-in flow. For the other non-PKCE providers (OpenAI Codex, Qwen OAuth, Google Gemini CLI, GitHub Copilot ACP), the button disables with an inline hint pointing to `hermes auth add <provider>` — no more silent failures. PKCE providers (Anthropic, etc.) behave exactly as before.
 - **Messaging Gateway rename.** Scarf's pre-existing "Gateway" section (Slack / Discord / inbound messaging) is renamed throughout to **Messaging Gateway** to disambiguate from the new Tool Gateway. Same feature, clearer name. Sidebar, dashboard card, menu-bar status, log-source filter, and Settings → Agent section header all updated. Internal enum cases and file paths (`gateway_state.json`, `gateway.log`) are unchanged.
 If you don't use Hermes v0.10.0 or don't have a Nous subscription, nothing in your flow changes — the Tool Gateway surface only activates when it's relevant. Sign-in state reads `~/.hermes/auth.json` in read-only mode; Scarf never writes to the credential file.
 ### Migrating from 2.2.x
 Sparkle will offer the update automatically. No config migration needed. Existing template installs are untouched — the v2.3 additions (folders, archive, sidecar) are purely additive; a v2.2.1 projects.json loads cleanly.
 If you had any chat sessions attributed to projects in a pre-release v2.3 build, the forward-only attribution model means those sidecar entries surface correctly in the new Sessions tab on first launch.
 **Hermes version.** The Tool Gateway features target [Hermes v0.10.0](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.4.16) or newer. If you're on v0.9.0 the rest of Scarf 2.3 works, but Nous Portal won't appear in the picker (it's sourced from `HERMES_OVERLAYS` in v0.10.0+) and the Tool Gateway card won't have subscription data to show. Updating Hermes is `pipx upgrade hermes-agent` or the equivalent for your install method.
 ### Documentation
 - **[Project Templates wiki page](https://github.com/awizemann/scarf/wiki/Project-Templates)** — gained a "How the agent sees the project" section covering the AGENTS.md injection pattern.
 - **[Hermes Version Compatibility](https://github.com/awizemann/scarf/wiki/Hermes-Version-Compatibility)** — bumped recommended minimum to v0.10.0, new subsection covering Tool Gateway feature gating.
 - **[Core Services](https://github.com/awizemann/scarf/wiki/Core-Services)** — new rows for `NousSubscriptionService` and `NousAuthFlow`, updated `ModelCatalogService` entry noting overlay merge.
 - **Root `CLAUDE.md`** — new subsection "Project-scoped chat + Scarf-managed AGENTS.md context (v2.3)" under Project Templates, plus the Tool Gateway subsection under Hermes Version covering the overlay table and per-task gateway contract.
 - **`scarf-template-author` skill** — pitfall bullet added so future scaffolding agents preserve the marker region when authoring new templates.
 ### Thanks
 Thanks to the users who exercised this release through several layout iterations, caught the `fetchSessions` short-circuit on a fresh VM, and pushed on the "agent doesn't know what project it's in" question until the AGENTS.md mechanism clicked. Several of these fixes are small on their own but add up to a much tighter per-project workflow.
@@ -1,11 +0,0 @@
 {
  "colors" : [
    {
      "idiom" : "universal"
    }
  ],
  "info" : {
    "author" : "xcode",
    "version" : 1
  }
 }
@@ -1,35 +0,0 @@
 {
  "images" : [
    {
      "idiom" : "universal",
      "platform" : "ios",
      "size" : "1024x1024"
    },
    {
      "appearances" : [
        {
          "appearance" : "luminosity",
          "value" : "dark"
        }
      ],
      "idiom" : "universal",
      "platform" : "ios",
      "size" : "1024x1024"
    },
    {
      "appearances" : [
        {
          "appearance" : "luminosity",
          "value" : "tinted"
        }
      ],
      "idiom" : "universal",
      "platform" : "ios",
      "size" : "1024x1024"
    }
  ],
  "info" : {
    "author" : "xcode",
    "version" : 1
  }
 }
@@ -1,6 +0,0 @@
 {
  "info" : {
    "author" : "xcode",
    "version" : 1
  }
 }
@@ -1,61 +0,0 @@
 //
 //  ContentView.swift
 //  Scarf iOS
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import SwiftUI
 import SwiftData
 struct ContentView: View {
    @Environment(\.modelContext) private var modelContext
    @Query private var items: [Item]
    var body: some View {
        NavigationSplitView {
            List {
                ForEach(items) { item in
                    NavigationLink {
                        Text("Item at \(item.timestamp, format: Date.FormatStyle(date: .numeric, time: .standard))")
                    } label: {
                        Text(item.timestamp, format: Date.FormatStyle(date: .numeric, time: .standard))
                    }
                }
                .onDelete(perform: deleteItems)
            }
            .toolbar {
                ToolbarItem(placement: .navigationBarTrailing) {
                    EditButton()
                }
                ToolbarItem {
                    Button(action: addItem) {
                        Label("Add Item", systemImage: "plus")
                    }
                }
            }
        } detail: {
            Text("Select an item")
        }
    }
    private func addItem() {
        withAnimation {
            let newItem = Item(timestamp: Date())
            modelContext.insert(newItem)
        }
    }
    private func deleteItems(offsets: IndexSet) {
        withAnimation {
            for index in offsets {
                modelContext.delete(items[index])
            }
        }
    }
 }
 #Preview {
    ContentView()
        .modelContainer(for: Item.self, inMemory: true)
 }
@@ -1,10 +0,0 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>UIBackgroundModes</key>
 	<array>
 		<string>remote-notification</string>
 	</array>
 </dict>
 </plist>
@@ -1,18 +0,0 @@
 //
 //  Item.swift
 //  Scarf iOS
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import Foundation
 import SwiftData
@Model
 final class Item {
    var timestamp: Date
    init(timestamp: Date) {
        self.timestamp = timestamp
    }
 }
@@ -1,14 +0,0 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
 	<key>aps-environment</key>
 	<string>development</string>
 	<key>com.apple.developer.icloud-container-identifiers</key>
 	<array/>
 	<key>com.apple.developer.icloud-services</key>
 	<array>
 		<string>CloudKit</string>
 	</array>
 </dict>
 </plist>
@@ -1,32 +0,0 @@
 //
 //  Scarf_iOSApp.swift
 //  Scarf iOS
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import SwiftUI
 import SwiftData
@main
 struct Scarf_iOSApp: App {
    var sharedModelContainer: ModelContainer = {
        let schema = Schema([
            Item.self,
        ])
        let modelConfiguration = ModelConfiguration(schema: schema, isStoredInMemoryOnly: false)
        do {
            return try ModelContainer(for: schema, configurations: [modelConfiguration])
        } catch {
            fatalError("Could not create ModelContainer: \(error)")
        }
    }()
    var body: some Scene {
        WindowGroup {
            ContentView()
        }
        .modelContainer(sharedModelContainer)
    }
 }
@@ -1,17 +0,0 @@
 //
 //  Scarf_iOSTests.swift
 //  Scarf iOSTests
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import Testing
@testable import Scarf_iOS
 struct Scarf_iOSTests {
    @Test func example() async throws {
        // Write your test here and use APIs like `#expect(...)` to check expected conditions.
    }
 }
@@ -1,41 +0,0 @@
 //
 //  Scarf_iOSUITests.swift
 //  Scarf iOSUITests
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import XCTest
 final class Scarf_iOSUITests: XCTestCase {
    override func setUpWithError() throws {
        // Put setup code here. This method is called before the invocation of each test method in the class.
        // In UI tests it is usually best to stop immediately when a failure occurs.
        continueAfterFailure = false
        // In UI tests it’s important to set the initial state - such as interface orientation - required for your tests before they run. The setUp method is a good place to do this.
    }
    override func tearDownWithError() throws {
        // Put teardown code here. This method is called after the invocation of each test method in the class.
    }
    @MainActor
    func testExample() throws {
        // UI tests must launch the application that they test.
        let app = XCUIApplication()
        app.launch()
        // Use XCTAssert and related functions to verify your tests produce the correct results.
    }
    @MainActor
    func testLaunchPerformance() throws {
        // This measures how long it takes to launch your application.
        measure(metrics: [XCTApplicationLaunchMetric()]) {
            XCUIApplication().launch()
        }
    }
 }
@@ -1,33 +0,0 @@
 //
 //  Scarf_iOSUITestsLaunchTests.swift
 //  Scarf iOSUITests
 //
 //  Created by Alan Wizemann on 4/23/26.
 //
 import XCTest
 final class Scarf_iOSUITestsLaunchTests: XCTestCase {
    override class var runsForEachTargetApplicationUIConfiguration: Bool {
        true
    }
    override func setUpWithError() throws {
        continueAfterFailure = false
    }
    @MainActor
    func testLaunch() throws {
        let app = XCUIApplication()
        app.launch()
        // Insert steps here to perform after app launch but before taking a screenshot,
        // such as logging into a test account or navigating somewhere in the app
        let attachment = XCTAttachment(screenshot: app.screenshot())
        attachment.name = "Launch Screen"
        attachment.lifetime = .keepAlways
        add(attachment)
    }
 }
@@ -56,3 +56,56 @@ Rich usage analytics pulled from the sessions and messages SQLite tables:
 ### 10. Config Editor
 - Structured form editor for config.yaml with validation
 ---
 ## Projects System Evolution (post-v2.2.1)
 A parallel backlog specific to the Projects feature. Ordered by dependency: organization first, then per-project attribution via sidecar, then observability built on that attribution, then polish, then platform bets.
 ### Shipping in v2.3 (planned — plan file at `~/.claude/plans/`)
 - **Folder hierarchy in the sidebar.** `ProjectEntry` gains optional `folder: String?`. `DisclosureGroup`-based sidebar.
 - **Rename + archive + search.** Registry verbs + a fuzzy ⌘F search + soft-archive (`archived: Bool?`) with Show/Hide toggle.
 - **⌘1–⌘9 project jumps.**
 - **Per-project Sessions tab** alongside Dashboard / Site. Filters the global sessions list by a new `~/.hermes/scarf/session_project_map.json` sidecar that Scarf populates when it starts a chat with a project context.
 - **New Chat button** on the Sessions tab — spawns `hermes acp` with `cwd = project.path` and attributes the resulting session in the sidecar.
 ### v2.4+ — per-project observability
 Depends on v2.3's sidecar being stable. All features below are "filter the existing data by the sidecar's project mapping."
 - **Per-project activity feed.** Extend `ActivityViewModel` with a `projectPath` filter that maps through the sidecar. Dashboard widget type `recent-activity`.
 - **Per-project token / cost rollup.** `InsightsViewModel.computeAggregates()` already sums over sessions; add a project filter. Widget binding `project.tokens` exposes it to agent-driven dashboards.
 - **Per-project cron-job filter.** Cron sidebar gains a project dropdown. Template-installed jobs already carry `[tmpl:<id>]` prefixes; match against installed template manifests to attribute.
 - **Desktop notifications for cron completion.** When a project-attributed cron job finishes (success or failure), fire a `UNUserNotification`. Per-project mute.
 ### v2.5+ — platform bets
 Bigger investments with longer arcs.
 - **Hermes upstream: `sessions.cwd` column.** Propose adding a nullable `cwd` (or `workspace_id`) column to Hermes's sessions table, populated on session create. Scarf would prefer the canonical column when available and fall back to the sidecar for pre-upgrade sessions. Requires coordinated Hermes release; filed under platform bets because it cuts the sidecar's blind spot (CLI-started sessions never enter the sidecar today).
 - **Per-project memory slice.** Hermes reads `MEMORY.md` from a known path. Explore whether Scarf can spawn `hermes acp` with an overridden memory path (per-project `<project>/.scarf/MEMORY.md`) so projects get isolated context. Needs a Hermes-side env var or flag.
 - **Per-project skills namespace.** Today user-authored skills are flat under `~/.hermes/skills/`. A `~/.hermes/skills/project/<slug>/` namespace parallel to the existing `templates/` namespace would let users install skills *into* a project without a template. Uninstall = drop the folder.
 - **Cross-project meta-dashboards.** A portfolio view that aggregates widgets from multiple projects — total token spend, combined activity feed, project-health matrix. Useful at 20+ projects.
 - **Project backup / restore.** One-click zip of `<project>/` + sidecar entries + related Keychain secrets, restorable on another machine. Richer than the existing Export flow (which carries the template shape only).
 ### Continuous — UX polish
 Small, shippable at any time. Each is a half-day-to-one-day item.
 - **Drag-and-drop to reorder** projects within a folder and between folders. Would be the first use of `.onDrag`/`.onDrop` in the codebase; establishes the pattern.
 - **Tags as a secondary axis.** Keep folders as primary, add multi-valued string tags + filter chips at the sidebar top. Decide only if folders feel insufficient after v2.3 lands.
 - **Favorites / pin** — bubble a project to the top of its folder.
 - **Recent projects collection** — auto-populated "Recents" row at the top of the sidebar.
 - **Color labels or SF Symbol icons** per project (Finder-tag-style).
 - **Project dashboard starter templates** — "blank", "monitor", "feed", "timeline" shapes when creating a bare project (distinct from `.scarftemplate` sharing flow).
 - **Opportunistic session backfill.** When Scarf loads any session that isn't in the sidecar, peek at first tool call's `working_directory` or `cwd` hint; if it matches a registered project path, write a sidecar entry. Heuristic, not perfect — useful as an "it just works" improvement after v2.3 ships.
 ### Research / verification gaps
 Noted during v2.3 planning; chase when relevant:
 - `DisclosureGroup` inside `List(.sidebar)` on macOS — occasional animation glitches with many-rows-expanding. Early prototype will confirm before full commit.
 - Concurrent sidecar writers from multiple Scarf windows on the same `~/.hermes` — atomic replace handles per-write; reload behavior may lag. Acceptable; revisit if users report stale attribution.
 - Do Hermes sessions ever persist `cwd` anywhere in `state.db` today that we've missed? If so, we can skip the sidecar and use it directly. Worth a one-hour investigation before starting v2.4 observability work.
@@ -12,20 +12,6 @@
 /* End PBXBuildFile section */
 /* Begin PBXContainerItemProxy section */
 		4EAC233A2F99930100654F42 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 534959382F7B83B600BD31AD /* Project object */;
 			proxyType = 1;
 			remoteGlobalIDString = 4EAC23282F99930000654F42;
 			remoteInfo = "Scarf iOS";
 		};
 		4EAC23442F99930100654F42 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 534959382F7B83B600BD31AD /* Project object */;
 			proxyType = 1;
 			remoteGlobalIDString = 4EAC23282F99930000654F42;
 			remoteInfo = "Scarf iOS";
 		};
 		534959502F7B83B700BD31AD /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 534959382F7B83B600BD31AD /* Project object */;
@@ -43,22 +29,12 @@
 /* End PBXContainerItemProxy section */
 /* Begin PBXFileReference section */
 		4EAC23292F99930000654F42 /* scarf mobile.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "scarf mobile.app"; sourceTree = BUILT_PRODUCTS_DIR; };
 		4EAC23392F99930100654F42 /* Scarf iOSTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "Scarf iOSTests.xctest"; sourceTree = BUILT_PRODUCTS_DIR; };
 		4EAC23432F99930100654F42 /* Scarf iOSUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "Scarf iOSUITests.xctest"; sourceTree = BUILT_PRODUCTS_DIR; };
 		534959402F7B83B600BD31AD /* scarf.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = scarf.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		5349594F2F7B83B700BD31AD /* scarfTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = scarfTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		534959592F7B83B700BD31AD /* scarfUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = scarfUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 /* End PBXFileReference section */
 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
 		4EAC234B2F99930100654F42 /* Exceptions for "Scarf iOS" folder in "scarf mobile" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
 				Info.plist,
 			);
 			target = 4EAC23282F99930000654F42 /* scarf mobile */;
 		};
 		534959AA2F7B83B600BD31AD /* Exceptions for "scarf" folder in "scarf" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
@@ -69,24 +45,6 @@
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 /* Begin PBXFileSystemSynchronizedRootGroup section */
 		4EAC232A2F99930000654F42 /* Scarf iOS */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			exceptions = (
 				4EAC234B2F99930100654F42 /* Exceptions for "Scarf iOS" folder in "scarf mobile" target */,
 			);
 			path = "Scarf iOS";
 			sourceTree = "<group>";
 		};
 		4EAC233C2F99930100654F42 /* Scarf iOSTests */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			path = "Scarf iOSTests";
 			sourceTree = "<group>";
 		};
 		4EAC23462F99930100654F42 /* Scarf iOSUITests */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			path = "Scarf iOSUITests";
 			sourceTree = "<group>";
 		};
 		534959422F7B83B600BD31AD /* scarf */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			exceptions = (
@@ -108,27 +66,6 @@
 /* End PBXFileSystemSynchronizedRootGroup section */
 /* Begin PBXFrameworksBuildPhase section */
 		4EAC23262F99930000654F42 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC23362F99930100654F42 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC23402F99930100654F42 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		5349593D2F7B83B600BD31AD /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -161,9 +98,6 @@
 				534959422F7B83B600BD31AD /* scarf */,
 				534959522F7B83B700BD31AD /* scarfTests */,
 				5349595C2F7B83B700BD31AD /* scarfUITests */,
 				4EAC232A2F99930000654F42 /* Scarf iOS */,
 				4EAC233C2F99930100654F42 /* Scarf iOSTests */,
 				4EAC23462F99930100654F42 /* Scarf iOSUITests */,
 				534959412F7B83B600BD31AD /* Products */,
 			);
 			sourceTree = "<group>";
@@ -174,9 +108,6 @@
 				534959402F7B83B600BD31AD /* scarf.app */,
 				5349594F2F7B83B700BD31AD /* scarfTests.xctest */,
 				534959592F7B83B700BD31AD /* scarfUITests.xctest */,
 				4EAC23292F99930000654F42 /* scarf mobile.app */,
 				4EAC23392F99930100654F42 /* Scarf iOSTests.xctest */,
 				4EAC23432F99930100654F42 /* Scarf iOSUITests.xctest */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -184,74 +115,6 @@
 /* End PBXGroup section */
 /* Begin PBXNativeTarget section */
 		4EAC23282F99930000654F42 /* scarf mobile */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 4EAC234C2F99930100654F42 /* Build configuration list for PBXNativeTarget "scarf mobile" */;
 			buildPhases = (
 				4EAC23252F99930000654F42 /* Sources */,
 				4EAC23262F99930000654F42 /* Frameworks */,
 				4EAC23272F99930000654F42 /* Resources */,
 			);
 			buildRules = (
 			);
 			dependencies = (
 			);
 			fileSystemSynchronizedGroups = (
 				4EAC232A2F99930000654F42 /* Scarf iOS */,
 			);
 			name = "scarf mobile";
 			packageProductDependencies = (
 			);
 			productName = "Scarf iOS";
 			productReference = 4EAC23292F99930000654F42 /* scarf mobile.app */;
 			productType = "com.apple.product-type.application";
 		};
 		4EAC23382F99930100654F42 /* Scarf iOSTests */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 4EAC234F2F99930100654F42 /* Build configuration list for PBXNativeTarget "Scarf iOSTests" */;
 			buildPhases = (
 				4EAC23352F99930100654F42 /* Sources */,
 				4EAC23362F99930100654F42 /* Frameworks */,
 				4EAC23372F99930100654F42 /* Resources */,
 			);
 			buildRules = (
 			);
 			dependencies = (
 				4EAC233B2F99930100654F42 /* PBXTargetDependency */,
 			);
 			fileSystemSynchronizedGroups = (
 				4EAC233C2F99930100654F42 /* Scarf iOSTests */,
 			);
 			name = "Scarf iOSTests";
 			packageProductDependencies = (
 			);
 			productName = "Scarf iOSTests";
 			productReference = 4EAC23392F99930100654F42 /* Scarf iOSTests.xctest */;
 			productType = "com.apple.product-type.bundle.unit-test";
 		};
 		4EAC23422F99930100654F42 /* Scarf iOSUITests */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 4EAC23522F99930100654F42 /* Build configuration list for PBXNativeTarget "Scarf iOSUITests" */;
 			buildPhases = (
 				4EAC233F2F99930100654F42 /* Sources */,
 				4EAC23402F99930100654F42 /* Frameworks */,
 				4EAC23412F99930100654F42 /* Resources */,
 			);
 			buildRules = (
 			);
 			dependencies = (
 				4EAC23452F99930100654F42 /* PBXTargetDependency */,
 			);
 			fileSystemSynchronizedGroups = (
 				4EAC23462F99930100654F42 /* Scarf iOSUITests */,
 			);
 			name = "Scarf iOSUITests";
 			packageProductDependencies = (
 			);
 			productName = "Scarf iOSUITests";
 			productReference = 4EAC23432F99930100654F42 /* Scarf iOSUITests.xctest */;
 			productType = "com.apple.product-type.bundle.ui-testing";
 		};
 		5349593F2F7B83B600BD31AD /* scarf */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 534959632F7B83B700BD31AD /* Build configuration list for PBXNativeTarget "scarf" */;
@@ -329,20 +192,9 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = 1;
-				LastSwiftUpdateCheck = 2620;
+				LastSwiftUpdateCheck = 2630;
 				LastUpgradeCheck = 2630;
 				TargetAttributes = {
 					4EAC23282F99930000654F42 = {
 						CreatedOnToolsVersion = 26.2;
 					};
 					4EAC23382F99930100654F42 = {
 						CreatedOnToolsVersion = 26.2;
 						TestTargetID = 4EAC23282F99930000654F42;
 					};
 					4EAC23422F99930100654F42 = {
 						CreatedOnToolsVersion = 26.2;
 						TestTargetID = 4EAC23282F99930000654F42;
 					};
 					5349593F2F7B83B600BD31AD = {
 						CreatedOnToolsVersion = 26.3;
 					};
@@ -383,35 +235,11 @@
 				5349593F2F7B83B600BD31AD /* scarf */,
 				5349594E2F7B83B700BD31AD /* scarfTests */,
 				534959582F7B83B700BD31AD /* scarfUITests */,
 				4EAC23282F99930000654F42 /* scarf mobile */,
 				4EAC23382F99930100654F42 /* Scarf iOSTests */,
 				4EAC23422F99930100654F42 /* Scarf iOSUITests */,
 			);
 		};
 /* End PBXProject section */
 /* Begin PBXResourcesBuildPhase section */
 		4EAC23272F99930000654F42 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC23372F99930100654F42 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC23412F99930100654F42 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		5349593E2F7B83B600BD31AD /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -436,27 +264,6 @@
 /* End PBXResourcesBuildPhase section */
 /* Begin PBXSourcesBuildPhase section */
 		4EAC23252F99930000654F42 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC23352F99930100654F42 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		4EAC233F2F99930100654F42 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		5349593C2F7B83B600BD31AD /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -481,16 +288,6 @@
 /* End PBXSourcesBuildPhase section */
 /* Begin PBXTargetDependency section */
 		4EAC233B2F99930100654F42 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 4EAC23282F99930000654F42 /* scarf mobile */;
 			targetProxy = 4EAC233A2F99930100654F42 /* PBXContainerItemProxy */;
 		};
 		4EAC23452F99930100654F42 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 4EAC23282F99930000654F42 /* scarf mobile */;
 			targetProxy = 4EAC23442F99930100654F42 /* PBXContainerItemProxy */;
 		};
 		534959512F7B83B700BD31AD /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 5349593F2F7B83B600BD31AD /* scarf */;
@@ -504,175 +301,6 @@
 /* End PBXTargetDependency section */
 /* Begin XCBuildConfiguration section */
 		4EAC234D2F99930100654F42 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_ENTITLEMENTS = "Scarf iOS/Scarf_iOS.entitlements";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "Scarf iOS/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = "Scarf Mobile";
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
 				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
 				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
 				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.6;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.scarf-mobile.app";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 			};
 			name = Debug;
 		};
 		4EAC234E2F99930100654F42 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_ENTITLEMENTS = "Scarf iOS/Scarf_iOS.entitlements";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = "Scarf iOS/Info.plist";
 				INFOPLIST_KEY_CFBundleDisplayName = "Scarf Mobile";
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
 				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
 				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
 				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
 				IPHONEOS_DEPLOYMENT_TARGET = 18.6;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "com.scarf-mobile.app";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				VALIDATE_PRODUCT = YES;
 			};
 			name = Release;
 		};
 		4EAC23502F99930100654F42 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "alanwizemann.Scarf-iOSTests";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_EMIT_LOC_STRINGS = NO;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Scarf iOS.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Scarf iOS";
 			};
 			name = Debug;
 		};
 		4EAC23512F99930100654F42 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "alanwizemann.Scarf-iOSTests";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_EMIT_LOC_STRINGS = NO;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Scarf iOS.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Scarf iOS";
 				VALIDATE_PRODUCT = YES;
 			};
 			name = Release;
 		};
 		4EAC23532F99930100654F42 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "alanwizemann.Scarf-iOSUITests";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_EMIT_LOC_STRINGS = NO;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_TARGET_NAME = "Scarf iOS";
 			};
 			name = Debug;
 		};
 		4EAC23542F99930100654F42 /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = "alanwizemann.Scarf-iOSUITests";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
 				SWIFT_EMIT_LOC_STRINGS = NO;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_TARGET_NAME = "Scarf iOS";
 				VALIDATE_PRODUCT = YES;
 			};
 			name = Release;
 		};
 		534959612F7B83B700BD31AD /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
@@ -808,7 +436,7 @@
 				CODE_SIGN_ENTITLEMENTS = scarf/scarf.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				ENABLE_APP_SANDBOX = NO;
@@ -816,13 +444,12 @@
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = scarf/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Scarf;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 14.6;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarf.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -844,7 +471,7 @@
 				CODE_SIGN_ENTITLEMENTS = scarf/scarf.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				ENABLE_APP_SANDBOX = NO;
@@ -852,13 +479,12 @@
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = scarf/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Scarf;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 14.6;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarf.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -876,12 +502,12 @@
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 26.2;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarfTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -898,12 +524,12 @@
 			buildSettings = {
 				BUNDLE_LOADER = "$(TEST_HOST)";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
 				MACOSX_DEPLOYMENT_TARGET = 26.2;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarfTests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -919,11 +545,11 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarfUITests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -939,11 +565,11 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 22;
+				CURRENT_PROJECT_VERSION = 25;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 3Q6X2L86C4;
 				GENERATE_INFOPLIST_FILE = YES;
-				MARKETING_VERSION = 2.1.0;
+				MARKETING_VERSION = 2.3.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.scarfUITests;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRING_CATALOG_GENERATE_SYMBOLS = NO;
@@ -958,33 +584,6 @@
 /* End XCBuildConfiguration section */
 /* Begin XCConfigurationList section */
 		4EAC234C2F99930100654F42 /* Build configuration list for PBXNativeTarget "scarf mobile" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
 				4EAC234D2F99930100654F42 /* Debug */,
 				4EAC234E2F99930100654F42 /* Release */,
 			);
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
 		4EAC234F2F99930100654F42 /* Build configuration list for PBXNativeTarget "Scarf iOSTests" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
 				4EAC23502F99930100654F42 /* Debug */,
 				4EAC23512F99930100654F42 /* Release */,
 			);
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
 		4EAC23522F99930100654F42 /* Build configuration list for PBXNativeTarget "Scarf iOSUITests" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
 				4EAC23532F99930100654F42 /* Debug */,
 				4EAC23542F99930100654F42 /* Release */,
 			);
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
 		5349593B2F7B83B600BD31AD /* Build configuration list for PBXProject "scarf" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
@@ -1,61 +1,61 @@
 {
  "images" : [
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-16x16@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-16x16@1x.png",
      "idiom" : "mac",
      "scale" : "1x",
      "size" : "16x16"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-16x16@2x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-16x16@2x.png",
      "idiom" : "mac",
      "scale" : "2x",
      "size" : "16x16"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-32x32@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-32x32@1x.png",
      "idiom" : "mac",
      "scale" : "1x",
      "size" : "32x32"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-32x32@2x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-32x32@2x.png",
      "idiom" : "mac",
      "scale" : "2x",
      "size" : "32x32"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-128x128@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-128x128@1x.png",
      "idiom" : "mac",
      "scale" : "1x",
      "size" : "128x128"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-128x128@2x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-128x128@2x.png",
      "idiom" : "mac",
      "scale" : "2x",
      "size" : "128x128"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-256x256@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-256x256@1x.png",
      "idiom" : "mac",
      "scale" : "1x",
      "size" : "256x256"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-512x512@1x 1.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-256x256@2x 1.png",
      "idiom" : "mac",
      "scale" : "2x",
      "size" : "256x256"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-512x512@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-512x512@1x.png",
      "idiom" : "mac",
      "scale" : "1x",
      "size" : "512x512"
    },
    {
-      "filename" : "AW Mac OS Applications-iOS-Default-1024x1024@1x.png",
+      "filename" : "AW Mac OS Applications-macOS-Default-1024x1024@1x.png",
      "idiom" : "mac",
      "scale" : "2x",
      "size" : "512x512"
@@ -339,6 +339,15 @@ struct HermesConfig: Sendable {
    var prefillMessagesFile: String
    var skillsExternalDirs: [String]
    /// Per-platform toolset allowlists as written by `hermes setup tools` /
    /// `hermes tools`. Keyed by platform (`cli`, `slack`, `discord`, …) to a
    /// list of enabled toolset identifiers (`browser`, `messaging`,
    /// `nous-tools`, …). Hermes v0.10.0 introduced the Tool Gateway; enabling
    /// the `nous-tools` toolset here is how subscribers opt-in per-platform.
    /// Scarf reads this for display; edits go through `hermes setup tools`
    /// rather than direct YAML writes to preserve Hermes-side validation.
    var platformToolsets: [String: [String]]
    // Grouped blocks
    var display: DisplaySettings
    var terminal: TerminalSettings
@@ -397,6 +406,7 @@ struct HermesConfig: Sendable {
        cronWrapResponse: true,
        prefillMessagesFile: "",
        skillsExternalDirs: [],
        platformToolsets: [:],
        display: .empty,
        terminal: .empty,
        browser: .empty,
@@ -55,6 +55,18 @@ struct HermesPathSet: Sendable, Hashable {
    nonisolated var gatewayLog: String { home + "/logs/gateway.log" }
    nonisolated var scarfDir: String { home + "/scarf" }
    nonisolated var projectsRegistry: String { scarfDir + "/projects.json" }
    /// Maps Hermes session IDs to the Scarf project path a chat was
    /// started for. Written by `SessionAttributionService` when
    /// Scarf spawns `hermes acp` with a project-scoped cwd; read by
    /// the per-project Sessions tab (v2.3) to filter the session list
    /// to just those attributed to a given project.
    ///
    /// Scarf-owned — Hermes never touches this file. Forward-only:
    /// we only attribute sessions Scarf creates in a project context;
    /// older / CLI-started sessions stay unattributed and surface in
    /// the global Sessions sidebar unchanged.
    nonisolated var sessionProjectMap: String { scarfDir + "/session_project_map.json" }
    nonisolated var mcpTokensDir: String { home + "/mcp-tokens" }
    // MARK: - Binary resolution
@@ -11,7 +11,63 @@ struct ProjectEntry: Codable, Sendable, Identifiable, Hashable {
    let name: String
    let path: String
    /// Folder path for sidebar grouping. `nil` means top-level (no
    /// folder). Introduced in v2.3 — v2.2 registry files have no
    /// `folder` key, which decodes cleanly as `nil` via
    /// `decodeIfPresent` below.
    ///
    /// We leave shape flexible: today this is treated as an opaque
    /// single-level label (e.g. "Clients"), and the sidebar renders
    /// one DisclosureGroup per distinct value. If nesting becomes a
    /// requirement later, we can interpret the string as a slash-
    /// separated path without a migration (old single-label values
    /// still mean a top-level folder with that name).
    var folder: String?
    /// Soft-archive flag. Archived projects are hidden from the
    /// sidebar by default; a Show Archived toggle surfaces them.
    /// Non-destructive — nothing is deleted on disk. Introduced in
    /// v2.3; v2.2 registry files default to `false` via the custom
    /// decoder below.
    var archived: Bool
    var dashboardPath: String { path + "/.scarf/dashboard.json" }
    init(name: String, path: String, folder: String? = nil, archived: Bool = false) {
        self.name = name
        self.path = path
        self.folder = folder
        self.archived = archived
    }
    // MARK: - Codable (custom for backward compat)
    private enum CodingKeys: String, CodingKey {
        case name, path, folder, archived
    }
    init(from decoder: Decoder) throws {
        let c = try decoder.container(keyedBy: CodingKeys.self)
        self.name = try c.decode(String.self, forKey: .name)
        self.path = try c.decode(String.self, forKey: .path)
        // Both new fields: tolerate absence for v2.2-era registries.
        self.folder = try c.decodeIfPresent(String.self, forKey: .folder)
        self.archived = try c.decodeIfPresent(Bool.self, forKey: .archived) ?? false
    }
    func encode(to encoder: Encoder) throws {
        var c = encoder.container(keyedBy: CodingKeys.self)
        try c.encode(name, forKey: .name)
        try c.encode(path, forKey: .path)
        // Only emit optional fields when they carry meaning — keeps
        // registry files clean for the common (top-level, unarchived)
        // case and means v2.2 Scarf can still load a v2.3-written
        // registry of projects that never used the new features.
        try c.encodeIfPresent(folder, forKey: .folder)
        if archived {
            try c.encode(archived, forKey: .archived)
        }
    }
 }
 // MARK: - Dashboard
@@ -0,0 +1,43 @@
 import Foundation
 /// Scarf-owned sidecar mapping Hermes session IDs to the Scarf
 /// project path a chat was started for. Written on session create
 /// when Scarf spawns `hermes acp` with a project-scoped cwd; read
 /// by the per-project Sessions tab.
 ///
 /// Hermes's own `state.db` has no `cwd` column on the sessions
 /// table — the cwd is passed at runtime via ACP but not persisted
 /// on its side. This sidecar is how we recover the attribution
 /// without requiring an upstream schema change.
 ///
 /// Stored at `~/.hermes/scarf/session_project_map.json`. Forward-
 /// compatible: if Hermes ever gains a canonical `cwd` column, Scarf
 /// can prefer that and fall back to this file for pre-upgrade
 /// sessions. Missing file → empty map (nothing attributed yet).
 struct SessionProjectMap: Codable, Sendable {
    /// session-id → absolute-project-path. Both strings are opaque
    /// from this file's perspective; the service validates project
    /// paths against the live registry when building the reverse
    /// lookup used by the Sessions tab, so stale entries for
    /// removed projects are ignored at read time without needing a
    /// write-side cleanup.
    var mappings: [String: String]
    /// ISO-8601 timestamp of the most recent write. Informational
    /// only — not used for any decision logic. Useful when debugging
    /// a stale sidecar ("when was this last updated?").
    var updatedAt: String?
    init(mappings: [String: String] = [:], updatedAt: String? = nil) {
        self.mappings = mappings
        self.updatedAt = updatedAt
    }
    /// Current time in ISO-8601 format, suitable for the
    /// `updatedAt` field. Matches the format used elsewhere in
    /// Scarf (e.g. `TemplateLock.installedAt`) so tooling that
    /// greps across .json files sees consistent timestamps.
    static func nowISO8601() -> String {
        ISO8601DateFormatter().string(from: Date())
    }
 }
@@ -82,6 +82,11 @@ final class ServerRegistry {
    /// Flip the default server to `id`. Passing `ServerContext.local.id`
    /// clears the flag on every remote entry, making Local the implicit
    /// default. Passing an unknown ID is a no-op. Persisted on return.
    ///
    /// Intentionally doesn't fire `onEntriesChanged` — that hook means "the
    /// set of servers changed" and drives the menu-bar fanout rebuild. A
    /// default-flag flip doesn't change the set; SwiftUI views reading
    /// `defaultServerID` redraw via `@Observable`'s tracking of `entries`.
    func setDefaultServer(_ id: ServerID) {
        var changed = false
        for idx in entries.indices {
@@ -93,7 +98,6 @@ final class ServerRegistry {
        }
        if changed {
            save()
            onEntriesChanged?()
        }
    }
@@ -211,6 +211,16 @@ struct HermesFileService: Sendable {
            replyPrefix: str("whatsapp.reply_prefix")
        )
        // `platform_toolsets.<platform>` is a dict of lists in config.yaml —
        // parseNestedYAML flattens nested lists into dotted-path keys. Pull
        // every key under the prefix and strip it.
        var platformToolsets: [String: [String]] = [:]
        for (key, items) in lists where key.hasPrefix("platform_toolsets.") {
            let platform = String(key.dropFirst("platform_toolsets.".count))
            guard !platform.isEmpty else { continue }
            platformToolsets[platform] = items
        }
        // Home Assistant lives under `platforms.homeassistant.extra.*`.
        let homeAssistant = HomeAssistantSettings(
            watchDomains: lists["platforms.homeassistant.extra.watch_domains"] ?? [],
@@ -258,6 +268,7 @@ struct HermesFileService: Sendable {
            cronWrapResponse: bool("cron.wrap_response", default: true),
            prefillMessagesFile: str("prefill_messages_file"),
            skillsExternalDirs: lists["skills.external_dirs"] ?? [],
            platformToolsets: platformToolsets,
            display: display,
            terminal: terminal,
            browser: browser,
@@ -35,6 +35,16 @@ final class HermesFileWatcher {
            paths.errorsLog,
            paths.gatewayLog,
            paths.projectsRegistry,
            // v2.3: sidecar attributing Hermes session IDs to Scarf project
            // paths. Written by SessionAttributionService when a chat
            // starts with a project context; read by
            // ProjectSessionsViewModel to filter the session list. Without
            // watching this file, the per-project Sessions tab would only
            // pick up new sessions when the user re-entered the tab
            // (triggering .task(id:) re-fire) — switching directly back
            // to the project's Sessions tab after a chat left the tab
            // stale.
            paths.sessionProjectMap,
            paths.mcpTokensDir
        ]
    }
@@ -42,6 +42,15 @@ struct HermesProviderInfo: Sendable, Identifiable, Hashable {
    let envVars: [String]       // e.g. ["ANTHROPIC_API_KEY"]
    let docURL: String?
    let modelCount: Int
    /// True when this provider is surfaced only by the Hermes overlay list —
    /// i.e. it has no entry in `models_dev_cache.json` and therefore no model
    /// list from models.dev. The picker renders a different right-column
    /// affordance in this case (subscription CTA or free-form model entry).
    let isOverlay: Bool
    /// True for providers whose tool access is gated on an active subscription
    /// rather than a BYO API key. Nous Portal is the only such provider as of
    /// hermes-agent v0.10.0.
    let subscriptionGated: Bool
 }
 /// Reads the models.dev catalog that hermes caches at
@@ -67,20 +76,53 @@ struct ModelCatalogService: Sendable {
        self.transport = LocalTransport()
    }
-    /// All providers, sorted by display name.
+    /// All providers, sorted with subscription-gated providers first (Nous
    /// Portal), then alphabetical by display name.
    ///
    /// Merges two data sources:
    /// 1. `~/.hermes/models_dev_cache.json` — the models.dev mirror.
    /// 2. ``Self/overlayOnlyProviders`` — Hermes-injected providers that
    ///    aren't in the models.dev catalog (e.g. Nous Portal, OpenAI Codex).
    ///    Without this merge, those providers are invisible in Scarf's picker
    ///    even though `hermes model` on the CLI can reach them.
    func loadProviders() -> [HermesProviderInfo] {
-        guard let catalog = loadCatalog() else { return [] }
+        let catalog = loadCatalog() ?? [:]
-        return catalog
+        var byID: [String: HermesProviderInfo] = [:]
-            .map { (id, p) in
+        for (id, p) in catalog {
-                HermesProviderInfo(
+            byID[id] = HermesProviderInfo(
                providerID: id,
                providerName: p.name ?? id,
                envVars: p.env ?? [],
                docURL: p.doc,
-                    modelCount: p.models?.count ?? 0
+                modelCount: p.models?.count ?? 0,
                isOverlay: false,
                subscriptionGated: false
            )
        }
-            .sorted { $0.providerName.localizedCaseInsensitiveCompare($1.providerName) == .orderedAscending }
+        for (id, overlay) in Self.overlayOnlyProviders where byID[id] == nil {
            byID[id] = HermesProviderInfo(
                providerID: id,
                providerName: overlay.displayName,
                envVars: [],
                docURL: overlay.docURL,
                modelCount: 0,
                isOverlay: true,
                subscriptionGated: overlay.subscriptionGated
            )
        }
        return byID.values.sorted { lhs, rhs in
            if lhs.subscriptionGated != rhs.subscriptionGated {
                return lhs.subscriptionGated
            }
            return lhs.providerName.localizedCaseInsensitiveCompare(rhs.providerName) == .orderedAscending
        }
    }
    /// Overlay metadata for a provider that isn't in the models.dev catalog —
    /// Scarf needs to surface these so the picker matches `hermes model` on
    /// the CLI.
    func overlayMetadata(for providerID: String) -> HermesProviderOverlay? {
        Self.overlayOnlyProviders[providerID]
    }
    /// Models for one provider, sorted by release date (newest first), then name.
@@ -123,7 +165,9 @@ struct ModelCatalogService: Sendable {
                    providerName: p.name ?? providerID,
                    envVars: p.env ?? [],
                    docURL: p.doc,
-                    modelCount: p.models?.count ?? 0
+                    modelCount: p.models?.count ?? 0,
                    isOverlay: false,
                    subscriptionGated: false
                )
            }
        }
@@ -137,13 +181,45 @@ struct ModelCatalogService: Sendable {
                    providerName: p.name ?? prefix,
                    envVars: p.env ?? [],
                    docURL: p.doc,
-                    modelCount: p.models?.count ?? 0
+                    modelCount: p.models?.count ?? 0,
                    isOverlay: false,
                    subscriptionGated: false
                )
            }
        }
        return nil
    }
    /// Look up a provider by ID, falling back to overlays when the cache has
    /// no entry. Use this when resolving a stored `model.provider` to display
    /// metadata — `nous` and other overlay-only IDs never appear in the
    /// cache, so a plain catalog lookup returns nil for them.
    func providerByID(_ providerID: String) -> HermesProviderInfo? {
        if let catalog = loadCatalog(), let p = catalog[providerID] {
            return HermesProviderInfo(
                providerID: providerID,
                providerName: p.name ?? providerID,
                envVars: p.env ?? [],
                docURL: p.doc,
                modelCount: p.models?.count ?? 0,
                isOverlay: false,
                subscriptionGated: false
            )
        }
        if let overlay = Self.overlayOnlyProviders[providerID] {
            return HermesProviderInfo(
                providerID: providerID,
                providerName: overlay.displayName,
                envVars: [],
                docURL: overlay.docURL,
                modelCount: 0,
                isOverlay: true,
                subscriptionGated: overlay.subscriptionGated
            )
        }
        return nil
    }
    /// Look up a specific model by provider + ID. Returns nil if not in the
    /// catalog (e.g., free-typed custom model).
    func model(providerID: String, modelID: String) -> HermesModelInfo? {
@@ -207,4 +283,79 @@ struct ModelCatalogService: Sendable {
        let context: Int?
        let output: Int?
    }
    // MARK: - Hermes overlay providers
    /// The six providers Hermes surfaces via `hermes model` that have no
    /// entry in `models_dev_cache.json` (models.dev doesn't mirror them).
    /// Mirrors the overlay-only subset of `HERMES_OVERLAYS` in
    /// `hermes-agent/hermes_cli/providers.py`. The other ~19 overlay entries
    /// already ship in the cache and only add augmentation (base-URL
    /// override, extra env vars) that Scarf doesn't currently display.
    ///
    /// Keep this in sync with the Python side on Hermes version bumps.
    static let overlayOnlyProviders: [String: HermesProviderOverlay] = [
        "nous": HermesProviderOverlay(
            displayName: "Nous Portal",
            baseURL: "https://inference-api.nousresearch.com/v1",
            authType: .oauthDeviceCode,
            subscriptionGated: true,
            docURL: "https://hermes-agent.nousresearch.com/docs/user-guide/setup/nous-portal"
        ),
        "openai-codex": HermesProviderOverlay(
            displayName: "OpenAI Codex",
            baseURL: "https://chatgpt.com/backend-api/codex",
            authType: .oauthExternal,
            subscriptionGated: false,
            docURL: nil
        ),
        "qwen-oauth": HermesProviderOverlay(
            displayName: "Qwen (OAuth)",
            baseURL: "https://portal.qwen.ai/v1",
            authType: .oauthExternal,
            subscriptionGated: false,
            docURL: nil
        ),
        "google-gemini-cli": HermesProviderOverlay(
            displayName: "Google Gemini CLI",
            baseURL: "cloudcode-pa://google",
            authType: .oauthExternal,
            subscriptionGated: false,
            docURL: nil
        ),
        "copilot-acp": HermesProviderOverlay(
            displayName: "GitHub Copilot ACP",
            baseURL: "acp://copilot",
            authType: .externalProcess,
            subscriptionGated: false,
            docURL: nil
        ),
        "arcee": HermesProviderOverlay(
            displayName: "Arcee",
            baseURL: "https://api.arcee.ai/api/v1",
            authType: .apiKey,
            subscriptionGated: false,
            docURL: nil
        ),
    ]
 }
 /// Scarf-side mirror of `HermesOverlay` from hermes-agent's
 /// `hermes_cli/providers.py`. Describes a provider that isn't in the
 /// models.dev catalog.
 struct HermesProviderOverlay: Sendable {
    let displayName: String
    let baseURL: String?
    let authType: AuthType
    /// True for providers whose tool access is subscription-gated rather than
    /// BYO-API-key. Nous Portal is the only `true` entry today.
    let subscriptionGated: Bool
    let docURL: String?
    enum AuthType: String, Sendable {
        case apiKey
        case oauthDeviceCode
        case oauthExternal
        case externalProcess
    }
 }
@@ -0,0 +1,264 @@
 import Foundation
 import AppKit
 import os
 /// Drives `hermes auth add nous --no-browser` for Nous Portal sign-in.
 ///
 /// Nous uses OAuth 2.0 device-code flow, not PKCE. Hermes prints the
 /// verification URL + user code to stdout, then long-polls the token
 /// endpoint every ~1s until the user approves in their browser (or the
 /// device code expires, currently 15 minutes).
 ///
 /// The controller:
 ///
 /// 1. Spawns hermes via `context.makeTransport().makeProcess(...)`.
 /// 2. Streams stdout, regex-extracts the `verification_uri_complete` and
 ///    `user_code` from the lines hermes prints (auth.py:3282-3286).
 /// 3. Auto-opens the verification URL in the default browser and
 ///    transitions to `.waitingForApproval` so the sheet can show the code.
 /// 4. On subprocess exit, confirms success by re-reading `auth.json` via
 ///    `NousSubscriptionService` — hermes exit 0 alone isn't enough, we want
 ///    to see `providers.nous.access_token` actually landed.
 /// 5. Detects the `subscription_required` failure (auth.py:3347-3356) and
 ///    surfaces the billing URL so the sheet can offer a Subscribe link.
 ///
 /// The parser functions are `nonisolated static` so tests can feed fixture
 /// buffers without standing up a real subprocess.
@Observable
@MainActor
 final class NousAuthFlow {
    enum State: Equatable {
        case idle
        case starting
        case waitingForApproval(userCode: String, verificationURL: URL)
        case success
        case failure(reason: String, billingURL: URL?)
    }
    private(set) var state: State = .idle
    /// Accumulated subprocess output. Surfaced in the failure UI so the user
    /// can copy the tail for bug reports.
    private(set) var output: String = ""
    let context: ServerContext
    private let subscriptionService: NousSubscriptionService
    private let logger = Logger(subsystem: "com.scarf", category: "NousAuthFlow")
    private var process: Process?
    private var stdoutPipe: Pipe?
    init(context: ServerContext = .local) {
        self.context = context
        self.subscriptionService = NousSubscriptionService(context: context)
    }
    // MARK: - Lifecycle
    /// Start the sign-in flow. Any in-flight subprocess is terminated first.
    /// Safe to call repeatedly (e.g. user hits "Try again").
    func start() {
        cancel()
        output = ""
        state = .starting
        let proc = context.makeTransport().makeProcess(
            executable: context.paths.hermesBinary,
            args: ["auth", "add", "nous", "--no-browser"]
        )
        if !context.isRemote {
            // Only enrich env locally — remote ssh gets the remote login env
            // naturally, and exporting our local keys into it would be wrong.
            var env = HermesFileService.enrichedEnvironment()
            // Python block-buffers stdout when it's a pipe (not a TTY). The
            // device-code flow prints the verification URL + user code, then
            // enters a ~15-minute polling loop that never hits `input()` —
            // so nothing flushes and our readability handler never sees the
            // output. Users see the sheet spinning forever while hermes is
            // actually waiting for approval.
            //
            // PKCE doesn't have this problem because `input("Authorization
            // code: ")` flushes stdout before blocking, which is why
            // OAuthFlowController works without this setting.
            //
            // PYTHONUNBUFFERED forces line-buffered stdout for the whole
            // subprocess — tiny perf cost, huge UX win for device-code.
            env["PYTHONUNBUFFERED"] = "1"
            proc.environment = env
        }
        let outPipe = Pipe()
        // Merge stderr into stdout — hermes prints the device-code block to
        // stdout but may emit diagnostics on stderr; we want them interleaved
        // in display order so the failure-tail UI reads naturally.
        proc.standardOutput = outPipe
        proc.standardError = outPipe
        outPipe.fileHandleForReading.readabilityHandler = { [weak self] handle in
            let data = handle.availableData
            if data.isEmpty {
                handle.readabilityHandler = nil
                return
            }
            let chunk = String(data: data, encoding: .utf8) ?? ""
            Task { @MainActor [weak self] in
                self?.handleOutputChunk(chunk)
            }
        }
        proc.terminationHandler = { [weak self] p in
            let code = p.terminationStatus
            Task { @MainActor [weak self] in
                outPipe.fileHandleForReading.readabilityHandler = nil
                self?.handleTermination(exitCode: code)
            }
        }
        do {
            try proc.run()
            process = proc
            stdoutPipe = outPipe
        } catch {
            logger.error("failed to spawn hermes: \(error.localizedDescription, privacy: .public)")
            state = .failure(
                reason: "Failed to start hermes: \(error.localizedDescription)",
                billingURL: nil
            )
        }
    }
    /// Terminate the in-flight subprocess. Idempotent. Does NOT clear state —
    /// the sheet dismisses on cancel via its own binding, and re-opening
    /// calls `start()` which does a fresh reset.
    func cancel() {
        stdoutPipe?.fileHandleForReading.readabilityHandler = nil
        process?.terminate()
        process = nil
        stdoutPipe = nil
    }
    // MARK: - Output handling
    private func handleOutputChunk(_ chunk: String) {
        output += chunk
        // Only transition into waiting while we're still in .starting — once
        // we've already emitted the URL + code, subsequent "Waiting for
        // approval..." noise shouldn't re-fire NSWorkspace.open.
        guard case .starting = state else { return }
        if let result = Self.parseDeviceCode(from: output) {
            state = .waitingForApproval(
                userCode: result.userCode,
                verificationURL: result.verificationURL
            )
            NSWorkspace.shared.open(result.verificationURL)
        }
    }
    private func handleTermination(exitCode: Int32) {
        // Subscription-required is a specific failure path that hermes
        // signals both via an exit code and a unique billing-URL message.
        // It overrides other checks because we want the Subscribe affordance
        // in the UI regardless of exit code.
        if let billing = Self.parseSubscriptionRequired(from: output) {
            state = .failure(
                reason: "Your Nous Portal account does not have an active subscription.",
                billingURL: billing
            )
            return
        }
        if exitCode == 0 {
            // Hermes claims success. Confirm by reading auth.json — the
            // authoritative signal is that providers.nous has an access token
            // AND active_provider flipped to nous. Anything short of that is
            // a silent failure on the hermes side.
            let sub = subscriptionService.loadState()
            if sub.subscribed {
                state = .success
            } else if sub.present {
                state = .failure(
                    reason: "Signed in, but Nous isn't the active provider yet. Run `hermes model` and pick Nous Portal.",
                    billingURL: nil
                )
            } else {
                state = .failure(
                    reason: "Sign-in finished without writing credentials. Try again, or run `hermes auth add nous` in a terminal to see full diagnostics.",
                    billingURL: nil
                )
            }
        } else {
            let tail = Self.lastLines(of: output, count: 8)
            state = .failure(
                reason: tail.isEmpty
                    ? "hermes exited with code \(exitCode)"
                    : tail,
                billingURL: nil
            )
        }
    }
    // MARK: - Parsers (pure, testable)
    struct DeviceCodeResult: Equatable {
        let verificationURL: URL
        let userCode: String
    }
    /// Extract the device-code verification URL and user code from hermes's
    /// output. Anchored on the exact shape hermes prints (auth.py:3282-3286):
    ///
    ///     To continue:
    ///       1. Open: https://portal.nousresearch.com/device/XXXX-XXXX
    ///       2. If prompted, enter code: XXXX-XXXX
    ///
    /// Returns nil when either line is missing — the sheet stays on the
    /// `.starting` spinner until both are captured.
    nonisolated static func parseDeviceCode(from text: String) -> DeviceCodeResult? {
        let urlPattern = #"^\s*1\.\s*Open:\s*(https?://\S+)\s*$"#
        let codePattern = #"^\s*2\.\s*If prompted, enter code:\s*(\S+)\s*$"#
        guard
            let urlString = firstCapture(in: text, pattern: urlPattern),
            let userCode = firstCapture(in: text, pattern: codePattern),
            let url = URL(string: urlString)
        else {
            return nil
        }
        return DeviceCodeResult(verificationURL: url, userCode: userCode)
    }
    /// Detect the subscription-required failure and extract the billing URL
    /// hermes prints (auth.py:3347-3356). Scarf shows a "Subscribe" button
    /// linking to this URL so the user can resolve the blocker without
    /// hunting through logs.
    nonisolated static func parseSubscriptionRequired(from text: String) -> URL? {
        guard text.contains("Your Nous Portal account does not have an active subscription") else {
            return nil
        }
        guard
            let raw = firstCapture(in: text, pattern: #"Subscribe here:\s*(https?://\S+)"#),
            let url = URL(string: raw)
        else {
            return nil
        }
        return url
    }
    private nonisolated static func firstCapture(in text: String, pattern: String) -> String? {
        guard let regex = try? NSRegularExpression(pattern: pattern, options: [.anchorsMatchLines]) else {
            return nil
        }
        let range = NSRange(text.startIndex..., in: text)
        guard
            let match = regex.firstMatch(in: text, range: range),
            match.numberOfRanges >= 2,
            let r = Range(match.range(at: 1), in: text)
        else {
            return nil
        }
        return String(text[r])
    }
    private nonisolated static func lastLines(of text: String, count: Int) -> String {
        let lines = text.split(separator: "\n", omittingEmptySubsequences: false)
        return lines.suffix(count).joined(separator: "\n")
            .trimmingCharacters(in: .whitespacesAndNewlines)
    }
 }
@@ -0,0 +1,85 @@
 import Foundation
 import os
 /// Snapshot of the user's Nous Portal subscription state, derived from the
 /// `providers.nous` entry in `~/.hermes/auth.json`. Read-only — Scarf never
 /// writes the subscription record; `hermes model` + `hermes auth` own that
 /// path.
 struct NousSubscriptionState: Sendable, Hashable {
    /// True when `providers.nous` exists and has a usable access token.
    /// Mirrors the `nous_auth_present` field on
    /// `NousSubscriptionFeatures` in `hermes_cli/nous_subscription.py`.
    let present: Bool
    /// True when the user's **active provider** is `nous`, i.e. they've not
    /// just authed but selected it as the primary model provider. The Tool
    /// Gateway only routes tools when this is true — auth alone isn't enough.
    let providerIsNous: Bool
    /// Last update time for the auth record, if known. Useful in the Health
    /// view to tell the user when their subscription state was last refreshed.
    let updatedAt: Date?
    static let absent = NousSubscriptionState(present: false, providerIsNous: false, updatedAt: nil)
    /// Overall subscription active for Tool Gateway routing. Both halves have
    /// to line up: auth record present *and* `nous` is the active provider.
    /// Mirrors `NousSubscriptionFeatures.subscribed` on the Python side.
    var subscribed: Bool { present && providerIsNous }
 }
 /// Reads `auth.json` to detect Nous Portal subscription state. Delegates file
 /// I/O to the active `ServerTransport`, so remote installations work the same
 /// as local ones.
 ///
 /// The auth-record shape is defined by hermes-agent and is load-bearing. This
 /// service parses a small, stable subset and tolerates anything new Hermes
 /// adds — we only rely on `providers.nous` being a dict with `access_token`
 /// and `active_provider` being either `"nous"` or not.
 struct NousSubscriptionService: Sendable {
    private let logger = Logger(subsystem: "com.scarf", category: "NousSubscriptionService")
    let authJSONPath: String
    let transport: any ServerTransport
    nonisolated init(context: ServerContext = .local) {
        self.authJSONPath = context.paths.authJSON
        self.transport = context.makeTransport()
    }
    /// Escape hatch for tests — point at a fixture `auth.json` without
    /// constructing a full `ServerContext`. Uses `LocalTransport` so the
    /// fixture must live on the local filesystem.
    init(path: String) {
        self.authJSONPath = path
        self.transport = LocalTransport()
    }
    /// Load the current subscription state. Returns ``NousSubscriptionState/absent``
    /// on any read or parse failure — callers treat "absent" and "can't
    /// read" the same in UI (show a "not subscribed" CTA).
    nonisolated func loadState() -> NousSubscriptionState {
        guard let data = try? transport.readFile(authJSONPath) else {
            return .absent
        }
        guard let root = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
            logger.warning("auth.json is not a JSON object; assuming no Nous subscription")
            return .absent
        }
        let providers = root["providers"] as? [String: Any] ?? [:]
        let nous = providers["nous"] as? [String: Any]
        let token = nous?["access_token"] as? String
        let present = (token?.isEmpty == false)
        let activeProvider = root["active_provider"] as? String
        let providerIsNous = (activeProvider == "nous")
        let updatedAt: Date? = {
            guard let raw = root["updated_at"] as? String else { return nil }
            return ISO8601DateFormatter().date(from: raw)
        }()
        return NousSubscriptionState(
            present: present,
            providerIsNous: providerIsNous,
            updatedAt: updatedAt
        )
    }
 }
@@ -0,0 +1,293 @@
 import Foundation
 import os
 /// Writes a Scarf-managed marker block into `<project>/AGENTS.md` so
 /// that Hermes — which auto-reads `AGENTS.md` from the session's cwd
 /// at startup — has consistent project identity and metadata in every
 /// project-scoped chat.
 ///
 /// **Why this exists.** Hermes has no native "project" concept and ACP
 /// passes only `(cwd, mcpServers)` at session create — extra params
 /// are silently dropped on Hermes's side. The documented hook for
 /// giving the agent context when cwd is set programmatically is the
 /// auto-load of `AGENTS.md` (or `.hermes.md` / `CLAUDE.md` /
 /// `.cursorrules`, in that priority) from the cwd. Scarf owns a
 /// managed region of the project's AGENTS.md; template-author content
 /// lives outside that region and is preserved.
 ///
 /// **Marker contract.** The region sits between:
 ///
 /// ```
 /// <!-- scarf-project:begin -->
 /// …Scarf-managed content…
 /// <!-- scarf-project:end -->
 /// ```
 ///
 /// Same pattern as the v2.2 memory-block appendix — bounded, self-
 /// declaring, safe to re-generate. Everything outside the markers is
 /// left byte-identical across refreshes.
 ///
 /// **Secret-safe.** The block surfaces field NAMES from `config.json`
 /// (via the cached manifest's schema) but never VALUES. A rendered
 /// block contains no secrets even for a project whose config.json
 /// has Keychain-ref URIs.
 ///
 /// **Refresh timing.** `ChatViewModel.startACPSession(resume:projectPath:)`
 /// calls `refresh(for:)` immediately before Hermes opens the session.
 /// Hermes reads AGENTS.md during session boot, so the marker block
 /// must have landed on disk first. Non-blocking on failure — a
 /// failed refresh logs and the chat proceeds without the block.
 struct ProjectAgentContextService: Sendable {
    private static let logger = Logger(subsystem: "com.scarf", category: "ProjectAgentContextService")
    /// Marker strings. Load-bearing: the format must stay stable
    /// across releases so existing project AGENTS.md files continue
    /// to be recognized and rewritten cleanly.
    static let beginMarker = "<!-- scarf-project:begin -->"
    static let endMarker = "<!-- scarf-project:end -->"
    let context: ServerContext
    nonisolated init(context: ServerContext = .local) {
        self.context = context
    }
    // MARK: - Public
    /// Refresh (or create) the Scarf-managed block in the project's
    /// AGENTS.md. Reads current project state — template manifest,
    /// config schema, registered cron jobs — and produces a block
    /// reflecting today's truth. Idempotent: two consecutive calls
    /// with no intervening state change produce byte-identical
    /// output.
    nonisolated func refresh(for project: ProjectEntry) throws {
        let block = renderBlock(for: project)
        let path = agentsMdPath(for: project)
        let transport = context.makeTransport()
        // Ensure the project directory exists — this service is the
        // first thing that touches the project dir when the user
        // scaffolds a bare project via `+` + starts a chat. Normally
        // the dir exists (registered project = dir exists); belt-
        // and-suspenders for edge cases.
        if !transport.fileExists(project.path) {
            try transport.createDirectory(project.path)
        }
        if !transport.fileExists(path) {
            // Fresh AGENTS.md with just our block + a trailing
            // newline so editors render it cleanly.
            let data = (block + "\n").data(using: .utf8) ?? Data()
            try transport.writeFile(path, data: data)
            Self.logger.info("created AGENTS.md with Scarf block for \(project.name, privacy: .public)")
            return
        }
        // Read existing, splice in the new block.
        let existingData = try transport.readFile(path)
        let existing = String(data: existingData, encoding: .utf8) ?? ""
        let rewritten = Self.applyBlock(block: block, to: existing)
        guard let outData = rewritten.data(using: .utf8) else {
            throw ProjectAgentContextError.encodingFailed
        }
        // Skip the write when nothing changed — avoids unnecessary
        // file-watcher churn. Matches what disk snapshot shows.
        guard outData != existingData else { return }
        try transport.writeFile(path, data: outData)
        Self.logger.info("refreshed Scarf block in AGENTS.md for \(project.name, privacy: .public)")
    }
    // MARK: - Marker splice (testable in isolation)
    /// Core text transform: given an existing file and a freshly-
    /// rendered block, return the file with the block spliced in.
    ///
    /// Three cases handled:
    /// 1. Existing file has both markers → replace the inclusive
    ///    region, preserve everything outside untouched.
    /// 2. Existing file has no markers → prepend the block followed
    ///    by a two-newline separator so it reads as its own section.
    /// 3. Existing file has a begin marker but no end → we DON'T try
    ///    to be clever; treat as "no markers present" and prepend.
    ///    User intervention or a later refresh can restore shape.
    ///    The stray begin-marker is left in the file; we don't
    ///    truncate to EOF (as the memory-block installer does)
    ///    because an orphaned begin on this file is more likely
    ///    hand-typed than a corrupt Scarf write.
    nonisolated static func applyBlock(block: String, to existing: String) -> String {
        guard let beginRange = existing.range(of: beginMarker),
              let endRange = existing.range(
                of: endMarker,
                range: beginRange.upperBound..<existing.endIndex
              )
        else {
            // No well-formed Scarf block present — prepend.
            let trimmedExisting = existing.trimmingCharacters(in: .whitespacesAndNewlines)
            if trimmedExisting.isEmpty {
                return block + "\n"
            }
            return block + "\n\n" + existing
        }
        // Full span: from the begin marker through the end marker
        // (inclusive). Consumes any trailing whitespace/newlines
        // immediately following the end marker so a re-render of a
        // shorter block doesn't leave a dangling blank line.
        var upperBound = endRange.upperBound
        while upperBound < existing.endIndex,
              existing[upperBound].isNewline {
            upperBound = existing.index(after: upperBound)
        }
        let before = String(existing[existing.startIndex..<beginRange.lowerBound])
        let after = String(existing[upperBound..<existing.endIndex])
        // Preserve the leading whitespace / content structure of
        // `before` but ensure exactly one blank line separates it
        // from the new block when there IS prior content.
        let prefix = before.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
            ? ""
            : before.trimmingRightNewlines() + "\n\n"
        // Suffix: a blank line BEFORE the remaining content, ensuring
        // the template/user content is visually separated from the
        // Scarf block.
        let suffix = after.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
            ? "\n"
            : "\n\n" + after.trimmingLeftNewlines()
        return prefix + block + suffix
    }
    // MARK: - Block rendering
    /// Build the Markdown block for a given project. Pure function of
    /// project state — exposed for tests that want to assert on
    /// rendered content without touching disk.
    nonisolated func renderBlock(for project: ProjectEntry) -> String {
        let templateInfo = readTemplateInfo(for: project)
        let configFieldsLine = renderConfigFieldsLine(for: project)
        let cronLines = renderCronLines(for: project, templateId: templateInfo?.id)
        let lockFilePresent = context.makeTransport().fileExists(
            project.path + "/.scarf/template.lock.json"
        )
        var lines: [String] = []
        lines.append(Self.beginMarker)
        lines.append("## Scarf project context")
        lines.append("")
        lines.append("_Auto-generated by Scarf — do not edit between the begin/end markers._")
        lines.append("")
        lines.append("You are operating inside a Scarf project named **\"\(project.name)\"**. Scarf is a macOS GUI for Hermes; the user is working with this project through it. This chat session's working directory is the project's directory — path-relative tool calls resolve inside the project.")
        lines.append("")
        lines.append("- **Project directory:** `\(project.path)`")
        lines.append("- **Dashboard:** `\(project.path)/.scarf/dashboard.json`")
        if let tpl = templateInfo {
            lines.append("- **Template:** `\(tpl.id)` v\(tpl.version)")
        }
        lines.append("- **Configuration fields:** \(configFieldsLine)")
        if cronLines.isEmpty {
            lines.append("- **Registered cron jobs:** (none attributed to this project)")
        } else {
            lines.append("- **Registered cron jobs:**")
            for line in cronLines {
                lines.append("  - \(line)")
            }
        }
        if lockFilePresent {
            lines.append("- **Uninstall manifest:** `\(project.path)/.scarf/template.lock.json` (tracks files written by template install)")
        }
        lines.append("")
        lines.append("Any content below this block is template- or user-authored; preserve and defer to it for project-specific behavior. Do NOT modify content inside these markers — Scarf rewrites this block on every project-scoped chat start.")
        lines.append(Self.endMarker)
        return lines.joined(separator: "\n")
    }
    // MARK: - Helpers
    nonisolated private func agentsMdPath(for project: ProjectEntry) -> String {
        project.path + "/AGENTS.md"
    }
    /// Read `<project>/.scarf/manifest.json` for template id + version.
    /// Nil when not present (bare project) or when the file is
    /// unparseable — the block still renders cleanly without the
    /// template line.
    nonisolated private func readTemplateInfo(for project: ProjectEntry) -> (id: String, version: String)? {
        let manifestPath = project.path + "/.scarf/manifest.json"
        let transport = context.makeTransport()
        guard transport.fileExists(manifestPath) else { return nil }
        guard let data = try? transport.readFile(manifestPath) else { return nil }
        guard let manifest = try? JSONDecoder().decode(ProjectTemplateManifest.self, from: data) else { return nil }
        return (id: manifest.id, version: manifest.version)
    }
    /// Build the "Configuration fields" bullet's tail. Returns a
    /// comma-joined list of backticked field names with inline type
    /// hints (`(secret)`), or the literal string "(none)" when the
    /// project has no config schema. **Never** includes values.
    nonisolated private func renderConfigFieldsLine(for project: ProjectEntry) -> String {
        let manifestPath = project.path + "/.scarf/manifest.json"
        let transport = context.makeTransport()
        guard transport.fileExists(manifestPath),
              let data = try? transport.readFile(manifestPath),
              let manifest = try? JSONDecoder().decode(ProjectTemplateManifest.self, from: data),
              let schema = manifest.config,
              !schema.fields.isEmpty
        else {
            return "(none)"
        }
        let fieldList = schema.fields.map { field -> String in
            let secretTag = field.type == .secret ? " (secret — name only, value stored in Keychain)" : ""
            return "`\(field.key)`\(secretTag)"
        }
        return fieldList.joined(separator: ", ")
    }
    /// Return a list of human-readable cron-job descriptions for jobs
    /// attributed to this project via the `[tmpl:<id>] …` name prefix.
    /// Empty array when no jobs match (either the project has no
    /// template or no jobs carry the tag).
    nonisolated private func renderCronLines(for project: ProjectEntry, templateId: String?) -> [String] {
        guard let templateId else { return [] }
        let prefix = "[tmpl:\(templateId)]"
        let jobs = HermesFileService(context: context).loadCronJobs()
        return jobs
            .filter { $0.name.hasPrefix(prefix) }
            .map { job in
                let scheduleDesc = job.schedule.display
                    ?? job.schedule.expression
                    ?? job.schedule.kind
                let pausedDesc = job.enabled ? "enabled" : "paused"
                return "`\(job.name)` — schedule `\(scheduleDesc)`, currently \(pausedDesc)"
            }
    }
 }
 enum ProjectAgentContextError: Error {
    case encodingFailed
 }
 // MARK: - String helpers (file-scoped)
 private extension String {
    /// Drop trailing newlines + CRs but preserve other trailing
    /// whitespace (tabs, non-breaking spaces) that might be
    /// meaningful in some edge case.
    func trimmingRightNewlines() -> String {
        var result = self
        while let last = result.last, last.isNewline {
            result.removeLast()
        }
        return result
    }
    /// Symmetric counterpart: strip leading newlines / CRs.
    func trimmingLeftNewlines() -> String {
        var result = self
        while let first = result.first, first.isNewline {
            result.removeFirst()
        }
        return result
    }
 }
@@ -1,6 +1,8 @@
 import Foundation
 import os
 struct ProjectDashboardService: Sendable {
    private static let logger = Logger(subsystem: "com.scarf", category: "ProjectDashboardService")
    let context: ServerContext
    let transport: any ServerTransport
@@ -19,23 +21,28 @@ struct ProjectDashboardService: Sendable {
        do {
            return try JSONDecoder().decode(ProjectRegistry.self, from: data)
        } catch {
-            print("[Scarf] Failed to decode project registry: \(error.localizedDescription)")
+            Self.logger.error("Failed to decode project registry: \(error.localizedDescription, privacy: .public)")
            return ProjectRegistry(projects: [])
        }
    }
-    func saveRegistry(_ registry: ProjectRegistry) {
+    /// Persist the project registry to `~/.hermes/scarf/projects.json`.
    ///
    /// **Throws** on every non-success path — the previous version of
    /// this method silently swallowed `createDirectory` and `writeFile`
    /// failures with `try?`, which meant the installer could return a
    /// valid-looking `ProjectEntry` while the registry on disk never
    /// received the new row (project would complete install, show a
    /// success screen, then be invisible in the sidebar). Callers that
    /// want fire-and-forget behaviour can still use `try?`, but the
    /// choice is now theirs.
    func saveRegistry(_ registry: ProjectRegistry) throws {
        let dir = context.paths.scarfDir
        if !transport.fileExists(dir) {
            do {
            try transport.createDirectory(dir)
            } catch {
                print("[Scarf] Failed to create scarf directory: \(error.localizedDescription)")
                return
        }
-        }
+        let data = try JSONEncoder().encode(registry)
-        guard let data = try? JSONEncoder().encode(registry) else { return }
+        // Pretty-print for readability (agents may read this file).
        // Pretty-print for readability (agents may read this file)
        let writeData: Data
        if let pretty = try? JSONSerialization.jsonObject(with: data),
           let formatted = try? JSONSerialization.data(withJSONObject: pretty, options: [.prettyPrinted, .sortedKeys]) {
@@ -43,7 +50,7 @@ struct ProjectDashboardService: Sendable {
        } else {
            writeData = data
        }
-        try? transport.writeFile(context.paths.projectsRegistry, data: writeData)
+        try transport.writeFile(context.paths.projectsRegistry, data: writeData)
    }
    // MARK: - Dashboard
@@ -179,7 +179,17 @@ struct ProjectTemplateInstaller: Sendable {
            }
            args.append(job.schedule)
            if let prompt = job.prompt, !prompt.isEmpty {
-                args.append(prompt)
+                // Substitute template-author tokens with install-time
                // values. Hermes doesn't set a CWD for cron runs — when
                // the agent fires the prompt, any relative path
                // (`.scarf/config.json`, `status-log.md`, etc.) resolves
                // against the agent's own dir, not the project. Templates
                // use `{{PROJECT_DIR}}` as a placeholder for the absolute
                // path; we swap in the real project dir here so the
                // registered cron job carries a fully-qualified prompt
                // that works regardless of CWD.
                let resolvedPrompt = Self.substituteCronTokens(prompt, plan: plan)
                args.append(resolvedPrompt)
            }
            let (output, exit) = context.runHermes(args)
@@ -211,10 +221,45 @@ struct ProjectTemplateInstaller: Sendable {
        var registry = service.loadRegistry()
        let entry = ProjectEntry(name: plan.projectRegistryName, path: plan.projectDir)
        registry.projects.append(entry)
-        service.saveRegistry(registry)
+        // Must throw on failure — silent failure here used to make the
        // installer return a valid entry while the registry on disk
        // never got updated, producing the "install completed but the
        // project doesn't show up in the sidebar" bug. If the registry
        // write fails, the whole install is surfaced as failed so the
        // user can see + address the underlying problem.
        try service.saveRegistry(registry)
        return entry
    }
    // MARK: - Token substitution (install-time placeholder resolution)
    /// Supported placeholders for template-author prompts. Keep the set
    /// intentionally small — every token here becomes a load-bearing
    /// part of the template format that we can't rename without
    /// breaking existing bundles.
    ///
    /// - `{{PROJECT_DIR}}`: absolute path of the newly-created project
    ///   directory. Required for cron prompts because Hermes doesn't
    ///   establish a CWD when firing cron jobs; relative paths would
    ///   resolve against whatever dir Hermes happens to be in.
    ///
    /// - `{{TEMPLATE_ID}}`: the `owner/name` id from the manifest.
    ///   Less load-bearing; occasionally useful for tagging or
    ///   delivery targets that reference the template.
    ///
    /// - `{{TEMPLATE_SLUG}}`: the sanitised slug the installer used
    ///   for the skills namespace and project dir name.
    nonisolated static func substituteCronTokens(
        _ prompt: String,
        plan: TemplateInstallPlan
    ) -> String {
        var out = prompt
        out = out.replacingOccurrences(of: "{{PROJECT_DIR}}", with: plan.projectDir)
        out = out.replacingOccurrences(of: "{{TEMPLATE_ID}}", with: plan.manifest.id)
        out = out.replacingOccurrences(of: "{{TEMPLATE_SLUG}}", with: plan.manifest.slug)
        return out
    }
    // MARK: - Lock file
    nonisolated private func writeLockFile(
@@ -206,7 +206,17 @@ struct ProjectTemplateUninstaller: Sendable {
        let dashboardService = ProjectDashboardService(context: context)
        var registry = dashboardService.loadRegistry()
        registry.projects.removeAll { $0.path == plan.project.path }
-        dashboardService.saveRegistry(registry)
+        // saveRegistry throws now — log a write failure but don't abort
        // the uninstall. Every earlier step already completed (files
        // removed, skills removed, cron jobs removed, memory stripped,
        // Keychain cleared); failing here leaves a stale registry row
        // pointing at a deleted project — cosmetic and easy to fix
        // from the sidebar.
        do {
            try dashboardService.saveRegistry(registry)
        } catch {
            Self.logger.warning("uninstall couldn't rewrite projects registry: \(error.localizedDescription, privacy: .public)")
        }
        Self.logger.info("uninstalled template \(plan.lock.templateId, privacy: .public) from \(plan.project.path, privacy: .public)")
    }
@@ -0,0 +1,115 @@
 import Foundation
 import os
 /// Owns the sidecar that attributes Hermes session IDs to Scarf
 /// project paths. The `cwd` passed to `hermes acp` at session
 /// creation is ephemeral from Hermes's perspective (not written to
 /// `state.db`), so Scarf keeps this Scarf-owned record parallel to
 /// Hermes's session store.
 ///
 /// File: `~/.hermes/scarf/session_project_map.json` (resolved via
 /// `HermesPathSet.sessionProjectMap`).
 ///
 /// Thread safety: all public methods are `nonisolated` and each
 /// performs a single read-modify-write cycle that's atomic on
 /// disk. Concurrent writers (two Scarf windows on the same
 /// `~/.hermes`) are safe at the file level — last write wins —
 /// but the in-memory read in one window may lag until that window
 /// reloads. Acceptable for v2.3's scale; revisit if multi-window
 /// cross-talk becomes a problem.
 struct SessionAttributionService: Sendable {
    private static let logger = Logger(subsystem: "com.scarf", category: "SessionAttributionService")
    let context: ServerContext
    nonisolated init(context: ServerContext = .local) {
        self.context = context
    }
    // MARK: - Read
    /// Load the current sidecar contents. Missing file or unparseable
    /// JSON returns an empty map — the sidecar is a convenience
    /// index, not a source of truth for anything load-bearing.
    nonisolated func load() -> SessionProjectMap {
        let path = context.paths.sessionProjectMap
        let transport = context.makeTransport()
        guard transport.fileExists(path) else {
            return SessionProjectMap()
        }
        do {
            let data = try transport.readFile(path)
            return try JSONDecoder().decode(SessionProjectMap.self, from: data)
        } catch {
            Self.logger.warning("session-project-map parse failed at \(path, privacy: .public): \(error.localizedDescription, privacy: .public); returning empty map")
            return SessionProjectMap()
        }
    }
    /// Look up the project path a given session was attributed to.
    /// Returns nil for unattributed sessions (CLI-started, or
    /// started before v2.3) — those surface in the global Sessions
    /// sidebar unchanged and don't appear in any project's Sessions
    /// tab.
    nonisolated func projectPath(for sessionID: String) -> String? {
        load().mappings[sessionID]
    }
    /// Reverse lookup: every session ID attributed to the given
    /// project path. Used by the per-project Sessions tab to filter
    /// the global session list. Comparison is exact-string; the
    /// registry stores absolute paths and we write absolute paths,
    /// so no normalisation is needed in practice.
    nonisolated func sessionIDs(forProject projectPath: String) -> Set<String> {
        let map = load()
        return Set(map.mappings.filter { $0.value == projectPath }.keys)
    }
    // MARK: - Write
    /// Record that `sessionID` was created under the given project
    /// path. Idempotent — repeated calls for the same pair are no-
    /// ops. Replacing an existing mapping (session moved to a
    /// different project) is legal but expected to be rare; the
    /// caller decides when that's correct.
    nonisolated func attribute(sessionID: String, toProjectPath projectPath: String) {
        var map = load()
        if map.mappings[sessionID] == projectPath {
            return
        }
        map.mappings[sessionID] = projectPath
        map.updatedAt = SessionProjectMap.nowISO8601()
        persist(map)
    }
    /// Remove a mapping. Called in v2.3's Sessions-tab code path is
    /// minimal — we don't currently prune on session delete because
    /// Hermes owns session lifecycle and we don't observe deletes.
    /// Exposed for future roadmap items (e.g. explicit "detach
    /// from project" action) and tests.
    nonisolated func forget(sessionID: String) {
        var map = load()
        guard map.mappings.removeValue(forKey: sessionID) != nil else { return }
        map.updatedAt = SessionProjectMap.nowISO8601()
        persist(map)
    }
    // MARK: - Private
    private func persist(_ map: SessionProjectMap) {
        let path = context.paths.sessionProjectMap
        let transport = context.makeTransport()
        let dir = context.paths.scarfDir
        do {
            if !transport.fileExists(dir) {
                try transport.createDirectory(dir)
            }
            let encoder = JSONEncoder()
            encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
            let data = try encoder.encode(map)
            try transport.writeFile(path, data: data)
        } catch {
            Self.logger.error("failed to persist session-project-map at \(path, privacy: .public): \(error.localizedDescription, privacy: .public)")
        }
    }
 }
@@ -41,6 +41,20 @@ final class ChatViewModel {
    let richChatViewModel: RichChatViewModel
    private var coordinator: Coordinator?
    /// Absolute project path for the current session, when the chat is
    /// project-scoped (either started via a project's "New Chat" button
    /// or resumed from a session that was previously attributed via the
    /// v2.3 sidecar). Nil for plain global chats. Drives the project
    /// indicator in SessionInfoBar + the `Chat · <Name>` nav title.
    private(set) var currentProjectPath: String?
    /// Human-readable name of the active project, resolved from the
    /// projects registry at session-start time. Stored alongside the
    /// path so the view renders without hitting disk on every update.
    /// Nil when `currentProjectPath` is nil OR the path isn't in the
    /// registry (project was removed after the session was attributed).
    private(set) var currentProjectName: String?
    // ACP state
    private var acpClient: ACPClient?
    private var acpEventTask: Task<Void, Never>?
@@ -118,15 +132,20 @@ final class ChatViewModel {
    // MARK: - Session Lifecycle
-    func startNewSession() {
+    func startNewSession(projectPath: String? = nil) {
        voiceEnabled = false
        ttsEnabled = false
        isRecording = false
        richChatViewModel.reset()
        if displayMode == .richChat {
-            startACPSession(resume: nil)
+            startACPSession(resume: nil, projectPath: projectPath)
        } else {
            // Terminal mode doesn't surface project attribution today —
            // `hermes chat` uses the shell's cwd, so starting a terminal
            // chat from a project button would require changing the
            // shell's cwd too. Out of scope for v2.3 — Rich Chat is
            // the primary surface for project-scoped sessions.
            launchTerminal(arguments: ["chat"])
        }
    }
@@ -289,13 +308,33 @@ final class ChatViewModel {
    // MARK: - ACP Session Management
-    private func startACPSession(resume sessionId: String?) {
+    private func startACPSession(resume sessionId: String?, projectPath: String? = nil) {
        stopACP()
        clearACPErrorState()
        acpStatus = "Starting..."
        let client = ACPClient(context: context)
        self.acpClient = client
        let attribution = SessionAttributionService(context: context)
        // If the caller passed a project path, refresh the Scarf-
        // managed block in the project's AGENTS.md BEFORE starting
        // ACP — Hermes auto-reads AGENTS.md at session boot, so the
        // block has to land on disk first. Non-blocking on failure:
        // we log and proceed without the block. Safe on bare
        // projects (creates AGENTS.md with just the block); safe on
        // template-installed projects (splices the block into
        // existing AGENTS.md without touching template content).
        if let projectPath {
            let registry = ProjectDashboardService(context: context).loadRegistry()
            if let project = registry.projects.first(where: { $0.path == projectPath }) {
                do {
                    try ProjectAgentContextService(context: context).refresh(for: project)
                } catch {
                    logger.warning("couldn't refresh project context block for \(project.name): \(error.localizedDescription)")
                }
            }
        }
        Task { @MainActor in
            do {
@@ -305,7 +344,19 @@ final class ChatViewModel {
                startACPEventLoop(client: client)
                startHealthMonitor(client: client)
-                let cwd = await context.resolvedUserHome()
+                // Project-scoped chats pass the project's absolute path
                // as cwd so Hermes tool calls and subsequent ACP ops
                // resolve relative paths against the project's files.
                // Falls back to the user's home (existing v2.2 behavior)
                // when the caller didn't request a project scope.
                // `??` can't wrap an async autoclosure, so we
                // materialize the fallback with an if-let.
                let cwd: String
                if let projectPath {
                    cwd = projectPath
                } else {
                    cwd = await context.resolvedUserHome()
                }
                // Mark active BEFORE setting session ID so .task(id:) sees isACPMode=true
                // and doesn't wipe messages with a DB refresh
@@ -334,6 +385,48 @@ final class ChatViewModel {
                richChatViewModel.setSessionId(resolvedSessionId)
                acpStatus = "Connected (\(resolvedSessionId.prefix(12)))"
                // Attribute this session to the project it was started
                // under, so the per-project Sessions tab can surface it
                // without a user action. No-op when projectPath is nil.
                // Idempotent: re-attribution of the same pair is free.
                if let projectPath {
                    attribution.attribute(
                        sessionID: resolvedSessionId,
                        toProjectPath: projectPath
                    )
                }
                // Resolve which project (if any) this session belongs
                // to, so SessionInfoBar + nav title can surface it.
                // Two inputs — use whichever is non-nil:
                //   * `projectPath` — the caller asked for a project
                //     scope (fresh project chat). Just-attributed;
                //     definitely in the sidecar.
                //   * `attribution.projectPath(for: resolvedSessionId)`
                //     — the resumed session was previously attributed.
                //     Covers "click an old project-attributed session
                //     from the global Sessions sidebar / Resume menu"
                //     where projectPath isn't known at the call site.
                let attributedPath = projectPath
                    ?? attribution.projectPath(for: resolvedSessionId)
                if let path = attributedPath {
                    // Look up a human-readable name from the projects
                    // registry. Missing project (path in the sidecar,
                    // project since removed) → show the path as a
                    // fallback label so the chip still renders and the
                    // user sees *something* rather than silently losing
                    // the indicator.
                    let registry = ProjectDashboardService(context: context).loadRegistry()
                    let name = registry.projects.first(where: { $0.path == path })?.name
                    self.currentProjectPath = path
                    self.currentProjectName = name ?? path
                } else {
                    // Explicit clear on non-project sessions so the
                    // indicator doesn't leak from a previous chat.
                    self.currentProjectPath = nil
                    self.currentProjectName = nil
                }
                // Refresh session list so the new ACP session appears in the Resume menu
                await loadRecentSessions()
@@ -3,25 +3,83 @@ import SwiftUI
 struct ChatView: View {
    @Environment(ChatViewModel.self) private var viewModel
    @Environment(HermesFileWatcher.self) private var fileWatcher
    @Environment(AppCoordinator.self) private var coordinator
    @State private var showErrorDetails = false
    var body: some View {
        @Bindable var vm = viewModel
        @Bindable var coord = coordinator
        VStack(spacing: 0) {
            toolbar
            Divider()
            errorBanner
            chatArea
        }
-        .navigationTitle("Chat")
+        // Clamp the outer VStack to the detail column's offered
        // space. Without this, the chat area's intrinsic height (a
        // RichChatView whose message list grows with content) can
        // bubble up through NavigationSplitView's detail slot and
        // push the whole window past the screen. Same pattern as
        // the Sessions tab fix in the v2.3 branch.
        .frame(maxWidth: .infinity, maxHeight: .infinity)
        // v2.3: reflect the active Scarf project in the nav title
        // so the user can see at a glance that the chat is scoped
        // (complements the folder chip in SessionInfoBar). Falls
        // back to the plain "Chat" label for global chats.
        .navigationTitle(
            viewModel.currentProjectName.map { "Chat · \($0)" } ?? "Chat"
        )
        .task {
            await viewModel.loadRecentSessions()
            viewModel.refreshCredentialPreflight()
            // Cold-launch handoff: if the user clicked "New Chat" on
            // a project before ChatView had a chance to render, the
            // coordinator was already populated. Consume the request
            // here. The onChange below handles the live case.
            if let pending = coordinator.pendingProjectChat {
                coordinator.pendingProjectChat = nil
                viewModel.startNewSession(projectPath: pending)
            }
            // Same story for resume-session handoff: the user clicked
            // a session in the Projects Sessions tab (routes to `.chat`
            // rather than `.sessions` so the chat actually reopens).
            // SessionsView consumes `selectedSessionId` for its own
            // routing; Chat now consumes it too. Mutually exclusive at
            // any given render because only one section is active per
            // `coordinator.selectedSection`. `else if` makes precedence
            // explicit — pendingProjectChat (new) outranks
            // selectedSessionId (resume) when both are somehow set.
            else if let pendingId = coordinator.selectedSessionId {
                coordinator.selectedSessionId = nil
                viewModel.resumeSession(pendingId)
            }
        }
        .onChange(of: fileWatcher.lastChangeDate) {
            Task { await viewModel.loadRecentSessions() }
            viewModel.refreshCredentialPreflight()
        }
        // Live handoff from the per-project Sessions tab: the tab
        // sets `pendingProjectChat` + flips `selectedSection` to
        // `.chat`; this view consumes the path and starts a fresh
        // session with cwd=projectPath. Attribution happens inside
        // ChatViewModel on successful session creation.
        .onChange(of: coord.pendingProjectChat) { _, new in
            if let projectPath = new {
                coordinator.pendingProjectChat = nil
                viewModel.startNewSession(projectPath: projectPath)
            }
        }
        // Live handoff for resume: user clicked an existing session in
        // the Projects Sessions tab while already in the Chat section
        // (or switched back to Chat after). Project-chip rendering
        // happens automatically inside ChatViewModel.resumeSession ->
        // startACPSession via the attribution.projectPath(for:) lookup.
        .onChange(of: coord.selectedSessionId) { _, new in
            if let sessionId = new {
                coordinator.selectedSessionId = nil
                viewModel.resumeSession(sessionId)
            }
        }
    }
    /// Banner rendered between the toolbar and the chat area when either
@@ -17,7 +17,13 @@ struct RichChatView: View {
                isWorking: richChat.isAgentWorking,
                acpInputTokens: richChat.acpInputTokens,
                acpOutputTokens: richChat.acpOutputTokens,
-                acpThoughtTokens: richChat.acpThoughtTokens
+                acpThoughtTokens: richChat.acpThoughtTokens,
                // v2.3: surface the active Scarf project (if any) as
                // a folder chip at the start of the bar. Driven by
                // ChatViewModel.currentProjectName which is set in
                // startACPSession on both new project chats and
                // resumed project-attributed sessions.
                projectName: chatViewModel.currentProjectName
            )
            Divider()
@@ -42,6 +48,19 @@ struct RichChatView: View {
                showCompressButton: richChat.supportsCompress && !richChat.hasBroaderCommandMenu
            )
        }
        // `idealHeight: 500` caps what this subtree REPORTS as its ideal
        // height. Load-bearing: RichChatMessageList uses a plain VStack
        // (not LazyVStack — see RichChatMessageList.swift:13-24 for the
        // rationale) inside a ScrollView, so its natural ideal grows
        // with message count. Under the WindowGroup's
        // `.windowResizability(.contentMinSize)` policy, that uncapped
        // ideal would open the window at a height that exceeds the
        // screen on long conversations, pushing the input bar below
        // the visible desktop. `maxHeight: .infinity` still lets the
        // view fill any larger offered space, and `minHeight: 0`
        // allows it to shrink freely — the ideal cap only affects the
        // initial-size hint reported up to the window.
        .frame(minHeight: 0, idealHeight: 500, maxHeight: .infinity)
        // DB polling fallback for terminal mode only — never overwrite ACP messages
        .onChange(of: fileWatcher.lastChangeDate) {
            if !isACPMode, !richChat.hasMessages, richChat.sessionId != nil {
@@ -7,10 +7,28 @@ struct SessionInfoBar: View {
    var acpInputTokens: Int = 0
    var acpOutputTokens: Int = 0
    var acpThoughtTokens: Int = 0
    /// Name of the Scarf project this session is attributed to, when
    /// applicable. Nil for plain global chats. Drives the folder-chip
    /// indicator rendered before the session title. Resolved by
    /// `ChatViewModel.currentProjectName` — the view just passes it
    /// through.
    var projectName: String? = nil
    var body: some View {
        HStack(spacing: 16) {
            if let session {
                // Project indicator first — visually anchors the session
                // as "scoped to project X" before the working dot and
                // title. Hidden for non-project chats so the bar looks
                // identical to v2.2.1 behavior.
                if let projectName {
                    Label(projectName, systemImage: "folder.fill")
                        .font(.caption)
                        .foregroundStyle(.tint)
                        .lineLimit(1)
                        .help("Chat is scoped to Scarf project \"\(projectName)\"")
                }
                HStack(spacing: 4) {
                    Circle()
                        .fill(isWorking ? .green : .secondary)
@@ -0,0 +1,52 @@
 import Foundation
 /// Describes whether Credential Pools' generic OAuth flow
 /// (``OAuthFlowController``) can handle a given provider.
 ///
 /// Hermes supports four OAuth styles, and only **PKCE** is driven by the
 /// generic controller:
 ///
 /// | Style | Works via `OAuthFlowController`? | Example providers |
 /// |---|---|---|
 /// | PKCE | ✅ Yes | anthropic, github-copilot |
 /// | Device-code | ❌ No — stalls silently | nous |
 /// | External OAuth | ❌ No — needs a terminal | openai-codex, qwen-oauth, google-gemini-cli |
 /// | External process | ❌ No — uses an agent bridge | copilot-acp |
 ///
 /// Routing a non-PKCE provider through the generic controller silently
 /// fails: the PKCE URL regex in ``OAuthFlowController/extractAuthURL`` only
 /// matches `client_id=…&redirect_uri=…` -shaped strings, and nothing else
 /// hermes prints for the other styles matches that. This gate closes the
 /// dead end by steering the user to the right flow for each style.
 ///
 /// `.ok` is the default for unknown providers so existing PKCE-based
 /// flows (anthropic, etc.) keep working — this gate is strictly additive.
 enum CredentialPoolsOAuthGate: Equatable {
    /// The standard PKCE flow works for this provider — show the normal
    /// "Start OAuth" button and let ``OAuthFlowController`` handle it.
    case ok
    /// User hasn't typed a provider ID yet. Disable the button.
    case providerEmpty
    /// Route Nous Portal through ``NousSignInSheet`` instead of the
    /// generic flow, since Nous uses device-code.
    case useNousSignIn
    /// Hermes knows how to sign in to this provider but Scarf doesn't yet
    /// have a dedicated UI for it. Point the user to `hermes auth add
    /// <provider>` in a terminal.
    case useCLI(provider: String)
    /// Compute the gate for a typed provider ID. Consults the Hermes
    /// overlay table via ``ModelCatalogService/overlayMetadata(for:)`` to
    /// decide which OAuth style applies.
    static func resolve(providerID rawID: String, catalog: ModelCatalogService) -> CredentialPoolsOAuthGate {
        let id = rawID.trimmingCharacters(in: .whitespaces).lowercased()
        guard !id.isEmpty else { return .providerEmpty }
        if id == "nous" { return .useNousSignIn }
        switch catalog.overlayMetadata(for: id)?.authType {
        case .oauthDeviceCode, .oauthExternal, .externalProcess:
            return .useCLI(provider: id)
        default:
            return .ok
        }
    }
 }
@@ -210,9 +210,18 @@ private struct AddCredentialSheet: View {
    @State private var providers: [HermesProviderInfo] = []
    @State private var oauthStarted: Bool = false
    @State private var authCode: String = ""
    /// Drives presentation of the dedicated Nous sign-in sheet from inside
    /// this add-credential sheet. Nous uses device-code, not PKCE — the
    /// regular `OAuthFlowController` silently stalls, so we route Nous
    /// through ``NousSignInSheet`` instead.
    @State private var showNousSignIn: Bool = false
    private var catalog: ModelCatalogService { ModelCatalogService(context: viewModel.context) }
    private func oauthGate(for rawID: String) -> CredentialPoolsOAuthGate {
        CredentialPoolsOAuthGate.resolve(providerID: rawID, catalog: catalog)
    }
    var body: some View {
        VStack(alignment: .leading, spacing: 16) {
            Text("Add Credential")
@@ -240,6 +249,17 @@ private struct AddCredentialSheet: View {
                onDismiss()
            }
        }
        // Nous sign-in is a parallel flow that bypasses OAuthFlowController.
        // When it completes, the parent list refreshes from auth.json just
        // like it does after a regular OAuth add — so we dismiss the
        // AddCredentialSheet after a short delay.
        .sheet(isPresented: $showNousSignIn) {
            NousSignInSheet {
                DispatchQueue.main.asyncAfter(deadline: .now() + 0.8) {
                    onDismiss()
                }
            }
        }
    }
    // MARK: - Step 1: provider + type + label + optional API key
@@ -290,11 +310,57 @@ private struct AddCredentialSheet: View {
                        .font(.system(.caption, design: .monospaced))
                }
            } else {
-                oauthPreamble
+                oauthGuidance
            }
        }
    }
    /// Renders either the standard PKCE preamble, the Nous-specific
    /// "sign in with the dedicated sheet" affordance, or a CLI fallback —
    /// whichever matches the provider the user has typed.
    @ViewBuilder
    private var oauthGuidance: some View {
        switch oauthGate(for: providerID) {
        case .ok, .providerEmpty:
            oauthPreamble
        case .useNousSignIn:
            nousSignInPreamble
        case .useCLI(let provider):
            cliFallbackPreamble(for: provider)
        }
    }
    private var nousSignInPreamble: some View {
        VStack(alignment: .leading, spacing: 8) {
            HStack(spacing: 6) {
                Image(systemName: "sparkles")
                    .foregroundStyle(.tint)
                Text("Nous Portal uses a dedicated sign-in flow.")
                    .font(.caption)
            }
            Text("We'll open the Nous Portal approval page in your browser and show the device code here. No code-paste step.")
                .font(.caption2)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
        }
    }
    private func cliFallbackPreamble(for provider: String) -> some View {
        VStack(alignment: .leading, spacing: 6) {
            HStack(spacing: 6) {
                Image(systemName: "terminal")
                    .foregroundStyle(.secondary)
                Text("`\(provider)` uses a different sign-in flow.")
                    .font(.caption)
            }
            Text("Run `hermes auth add \(provider)` in a terminal to finish sign-in. In-app support for this provider is coming in a follow-up.")
                .font(.caption2)
                .foregroundStyle(.secondary)
                .textSelection(.enabled)
                .fixedSize(horizontal: false, vertical: true)
        }
    }
    /// Brief explanation shown before the user clicks "Start OAuth". Sets
    /// expectations about the embedded-terminal flow so the browser window
    /// and code-paste step aren't surprises.
@@ -476,14 +542,38 @@ private struct AddCredentialSheet: View {
                    .buttonStyle(.borderedProminent)
                    .disabled(providerID.trimmingCharacters(in: .whitespaces).isEmpty || apiKey.trimmingCharacters(in: .whitespaces).isEmpty)
                } else {
                    oauthActionButton
                }
            }
        }
    }
    /// Gate-aware OAuth primary action. For PKCE providers it's the
    /// unchanged "Start OAuth" button; for Nous it's "Sign in to Nous
    /// Portal" (opens ``NousSignInSheet``); for other device-code /
    /// external providers it's a disabled button with a CLI hint inline.
    @ViewBuilder
    private var oauthActionButton: some View {
        switch oauthGate(for: providerID) {
        case .providerEmpty:
            Button("Start OAuth") {}
                .buttonStyle(.borderedProminent)
                .disabled(true)
        case .ok:
            Button("Start OAuth") {
                viewModel.startOAuth(provider: providerID, label: label)
                oauthStarted = true
            }
            .buttonStyle(.borderedProminent)
-                    .disabled(providerID.trimmingCharacters(in: .whitespaces).isEmpty)
+        case .useNousSignIn:
-                }
+            Button("Sign in to Nous Portal") {
                showNousSignIn = true
            }
            .buttonStyle(.borderedProminent)
        case .useCLI:
            Button("Start OAuth") {}
                .buttonStyle(.borderedProminent)
                .disabled(true)
        }
    }
 }
@@ -65,7 +65,61 @@ final class CronViewModel {
    }
    func runNow(_ job: HermesCronJob) {
-        runAndReload(["cron", "run", job.id], success: "Scheduled for next tick")
+        // `hermes cron run <id>` only marks the job as due on the next
        // scheduler tick — it doesn't actually execute. If the Hermes
        // gateway's scheduler isn't running (common during dev + right
        // after install), the user's "Run now" click results in zero
        // visible effect because the tick never comes. We follow up
        // with `hermes cron tick` which runs all due jobs once and
        // exits. Redundant-but-harmless when the gateway is running;
        // the actual trigger when it isn't.
        //
        // Feedback model: show a "Agent started" toast as soon as
        // `cron run` succeeds, WITHOUT waiting for `cron tick` to
        // return. Agent jobs routinely run past a minute (network IO +
        // an LLM call + a file rewrite), and earlier versions with a
        // 60s tick timeout surfaced a misleading "Run failed" toast
        // every time while the job kept running in the background.
        // The app's HermesFileWatcher picks up the dashboard.json
        // rewrite that the agent lands at the end — that's what the
        // user actually watches for, not this toast.
        let svc = fileService
        let jobID = job.id
        Task.detached { [weak self] in
            let runResult = svc.runHermesCLI(args: ["cron", "run", jobID], timeout: 30)
            await MainActor.run { [weak self] in
                guard let self else { return }
                if runResult.exitCode != 0 {
                    self.message = "Run failed to queue: \(runResult.output.prefix(200))"
                    self.logger.warning("cron run failed: \(runResult.output)")
                    self.load()
                    DispatchQueue.main.asyncAfter(deadline: .now() + 3) { [weak self] in
                        self?.message = nil
                    }
                    return
                }
                self.message = "Agent started — dashboard will update when it finishes"
                self.load()
            }
            // `cron run` is queued; now force the tick. The 300s
            // timeout catches truly stuck processes without killing
            // the long-but-valid agent case that blew up the 60s
            // version. A timeout here is survivable — the Hermes
            // scheduler re-runs due jobs on its own cadence — so we
            // log but don't surface it as a failure toast.
            try? await Task.sleep(for: .milliseconds(250))
            let tickResult = svc.runHermesCLI(args: ["cron", "tick"], timeout: 300)
            await MainActor.run { [weak self] in
                guard let self else { return }
                if tickResult.exitCode != 0 {
                    self.logger.warning("cron tick exited non-zero (job may still complete via scheduler): \(tickResult.output)")
                }
                self.load()
                DispatchQueue.main.asyncAfter(deadline: .now() + 3) { [weak self] in
                    self?.message = nil
                }
            }
        }
    }
    func deleteJob(_ job: HermesCronJob) {
@@ -95,7 +95,7 @@ struct DashboardView: View {
                color: .purple
            )
            StatusCard(
-                title: "Gateway",
+                title: "Messaging Gateway",
                value: viewModel.gatewayState?.statusText ?? "unknown",
                icon: "network",
                color: viewModel.gatewayState?.isRunning == true ? .green : .secondary
@@ -19,7 +19,7 @@ struct GatewayView: View {
            .padding()
            .frame(maxWidth: .infinity, alignment: .topLeading)
        }
-        .navigationTitle("Gateway")
+        .navigationTitle("Messaging Gateway")
        .onAppear { viewModel.load() }
        .onChange(of: fileWatcher.lastChangeDate) { viewModel.load() }
    }
@@ -24,10 +24,12 @@ struct HealthSection: Identifiable {
 final class HealthViewModel {
    let context: ServerContext
    private let fileService: HermesFileService
    private let subscriptionService: NousSubscriptionService
    init(context: ServerContext = .local) {
        self.context = context
        self.fileService = HermesFileService(context: context)
        self.subscriptionService = NousSubscriptionService(context: context)
    }
@@ -52,6 +54,7 @@ final class HealthViewModel {
        isLoading = true
        let ctx = context
        let svc = fileService
        let subSvc = subscriptionService
        // Health runs four sync transport-mediated commands plus a process
        // probe — that's 4-5 ssh round-trips on remote, easily 1-2s. Detach
        // the whole load.
@@ -60,6 +63,8 @@ final class HealthViewModel {
            let versionOutput = ctx.runHermes(["version"]).output
            let statusOutput = ctx.runHermes(["status"]).output
            let doctorOutput = ctx.runHermes(["doctor"]).output
            let subscription = subSvc.loadState()
            let config = svc.loadConfig()
            let lines = versionOutput.components(separatedBy: "\n")
            let version = lines.first ?? ""
@@ -68,6 +73,7 @@ final class HealthViewModel {
            let updateInfo = updateLine?.trimmingCharacters(in: .whitespaces) ?? ""
            let statusSections = Self.parseOutputStatic(statusOutput)
                + [Self.toolGatewaySection(subscription: subscription, config: config)]
            let doctorSections = Self.parseOutputStatic(doctorOutput)
            await MainActor.run { [weak self] in
@@ -85,6 +91,80 @@ final class HealthViewModel {
        }
    }
    /// Synthesize a Tool Gateway health section from the subscription state +
    /// `platform_toolsets` table. Runs alongside the other status sections so
    /// the user sees at a glance whether their Nous Portal subscription is
    /// wired up.
    ///
    /// This is distinct from the "Messaging Gateway" (inbound Slack/Discord/…
    /// requests) — the two are unrelated systems that unfortunately share the
    /// "gateway" name in Hermes's CLI output.
    ///
    /// `nonisolated` so `load()` can call it from `Task.detached` alongside
    /// `parseOutputStatic` without hopping back to MainActor.
    nonisolated private static func toolGatewaySection(subscription: NousSubscriptionState, config: HermesConfig) -> HealthSection {
        var checks: [HealthCheck] = []
        let subscriptionCheck: HealthCheck = {
            if subscription.subscribed {
                return HealthCheck(
                    label: "Nous Portal subscription active",
                    status: .ok,
                    detail: "Tool requests route through the Nous Portal gateway."
                )
            }
            if subscription.present {
                return HealthCheck(
                    label: "Signed in, but Nous isn't the active provider",
                    status: .warning,
                    detail: "Open Settings → General and pick Nous Portal to route tools through the gateway."
                )
            }
            return HealthCheck(
                label: "Not subscribed",
                status: .warning,
                detail: "Run `hermes auth` and pick Nous Portal to enable subscription-gated tools."
            )
        }()
        checks.append(subscriptionCheck)
        if !config.platformToolsets.isEmpty {
            let platforms = config.platformToolsets.keys.sorted()
            for platform in platforms {
                let toolsets = config.platformToolsets[platform] ?? []
                checks.append(HealthCheck(
                    label: "\(platform): \(toolsets.count) toolset\(toolsets.count == 1 ? "" : "s")",
                    status: .ok,
                    detail: toolsets.joined(separator: ", ")
                ))
            }
        }
        let auxOnNous = [
            ("vision", config.auxiliary.vision.provider),
            ("web_extract", config.auxiliary.webExtract.provider),
            ("compression", config.auxiliary.compression.provider),
            ("session_search", config.auxiliary.sessionSearch.provider),
            ("skills_hub", config.auxiliary.skillsHub.provider),
            ("approval", config.auxiliary.approval.provider),
            ("mcp", config.auxiliary.mcp.provider),
            ("flush_memories", config.auxiliary.flushMemories.provider),
        ].filter { $0.1 == "nous" }.map(\.0)
        if !auxOnNous.isEmpty {
            checks.append(HealthCheck(
                label: "Auxiliary tasks routed through Nous",
                status: subscription.subscribed ? .ok : .warning,
                detail: auxOnNous.joined(separator: ", ")
            ))
        }
        return HealthSection(
            title: "Tool Gateway",
            icon: "arrow.triangle.branch",
            checks: checks
        )
    }
    func refreshProcessStatus() {
        let svc = fileService
        Task.detached { [weak self] in
@@ -28,7 +28,7 @@ final class LogsViewModel {
            switch self {
            case .agent: return "Agent"
            case .errors: return "Errors"
-            case .gateway: return "Gateway"
+            case .gateway: return "Messaging Gateway"
            }
        }
    }
@@ -54,7 +54,7 @@ final class LogsViewModel {
        var displayName: LocalizedStringResource {
            switch self {
            case .all: return "All"
-            case .gateway: return "Gateway"
+            case .gateway: return "Messaging Gateway"
            case .agent: return "Agent"
            case .tools: return "Tools"
            case .cli: return "CLI"
@@ -0,0 +1,96 @@
 import Foundation
 import os
 /// Drives the per-project Sessions tab introduced in v2.3. Pulls the
 /// global session list from `HermesDataService`, filters by the
 /// attribution sidecar, and exposes a minimal surface for the view:
 /// the filtered sessions array, loading state, and a refresh entry
 /// point that the view can call on appearance + on file-watcher
 /// change.
@Observable
@MainActor
 final class ProjectSessionsViewModel {
    private static let logger = Logger(subsystem: "com.scarf", category: "ProjectSessionsViewModel")
    private let dataService: HermesDataService
    private let attribution: SessionAttributionService
    private let project: ProjectEntry
    init(context: ServerContext, project: ProjectEntry) {
        self.dataService = HermesDataService(context: context)
        self.attribution = SessionAttributionService(context: context)
        self.project = project
    }
    /// Sessions attributed to the owning project, in the order
    /// `HermesDataService.fetchSessions` returns them (newest first).
    var sessions: [HermesSession] = []
    /// True from `load()` start to its completion. The view renders
    /// a ProgressView during the first fetch; afterwards, re-fetches
    /// triggered by file-watcher changes happen silently.
    var isLoading: Bool = false
    /// Short diagnostic string for an empty list — nil when sessions
    /// are loaded and populated, otherwise explains the empty state
    /// (no sessions ever created in this project, vs. no sessions
    /// matched the project's attribution map).
    var emptyStateHint: String?
    /// Refresh the session list. Safe to call repeatedly; the data
    /// service reconnects to state.db on demand and the attribution
    /// service reads the sidecar afresh each call.
    func load() async {
        isLoading = true
        defer { isLoading = false }
        let attributed = attribution.sessionIDs(forProject: project.path)
        if attributed.isEmpty {
            sessions = []
            emptyStateHint = "No chats have been started in this project yet. Click New Chat to begin."
            return
        }
        // Open (or re-open for remote) the DB handle before querying.
        // `HermesDataService` is an actor with a lazily-initialised
        // SQLite pointer; every query method short-circuits to `[]`
        // when `db == nil`. This VM constructs its own service
        // instance (separate from ChatViewModel / InsightsVM /
        // ActivityVM), so we have to open it ourselves. Same
        // pattern used by those other VMs (`refresh()` rather than
        // `open()` because refresh also re-pulls the remote-server
        // snapshot on each call — local is a cheap no-op).
        _ = await dataService.refresh()
        // Fetch a generous page; we filter client-side by attribution
        // map membership. The 200 ceiling matches other feature VMs
        // (ActivityViewModel, InsightsViewModel). HermesDataService
        // is an actor so this crosses the isolation boundary — the
        // SQLite read happens off the MainActor. If a single project
        // accumulates more than 200 attributed sessions, we'll need
        // a paged query; roadmap item, not a v2.3 problem.
        let all = await dataService.fetchSessions(limit: 200)
        let filtered = all.filter { attributed.contains($0.id) }
        sessions = filtered
        if filtered.isEmpty {
            // Attribution map has entries but none appear in the
            // recent session fetch — likely stale sidecar entries
            // for sessions Hermes has since deleted. The view shows
            // an informational empty state; pruning stale entries
            // is a roadmap follow-up, not a blocker.
            emptyStateHint = "This project has \(attributed.count) attributed session\(attributed.count == 1 ? "" : "s"), but none are in the recent history. They may have been deleted from Hermes."
        } else {
            emptyStateHint = nil
        }
    }
    /// Release the underlying DB handle. Safe to call repeatedly; the
    /// service re-opens on the next `load()`. Mirrors the pattern in
    /// ActivityViewModel.swift:80 — view calls this on `.onDisappear`
    /// so file descriptors and the SQLite cache don't dangle once
    /// the tab isn't visible.
    func close() async {
        await dataService.close()
    }
 }
@@ -1,7 +1,9 @@
 import Foundation
 import os
@Observable
 final class ProjectsViewModel {
    private let logger = Logger(subsystem: "com.scarf", category: "ProjectsViewModel")
    let context: ServerContext
    private let service: ProjectDashboardService
@@ -39,7 +41,19 @@ final class ProjectsViewModel {
        guard !registry.projects.contains(where: { $0.name == name }) else { return }
        let entry = ProjectEntry(name: name, path: path)
        registry.projects.append(entry)
-        service.saveRegistry(registry)
+        // saveRegistry throws now. The VM doesn't currently have a
        // surface for user-visible errors (there's no alert/toast in
        // the Projects view), so log at error level to the unified
        // log and keep the in-memory state consistent with whatever
        // landed on disk. If the write fails, the added entry won't
        // persist across launches — the user sees it appear + work
        // this session, then it's gone at relaunch. Not ideal, but
        // matches today's UX and flagged for a proper alert later.
        do {
            try service.saveRegistry(registry)
        } catch {
            logger.error("addProject couldn't persist registry: \(error.localizedDescription, privacy: .public)")
        }
        projects = registry.projects
        selectProject(entry)
    }
@@ -47,7 +61,11 @@ final class ProjectsViewModel {
    func removeProject(_ project: ProjectEntry) {
        var registry = service.loadRegistry()
        registry.projects.removeAll { $0.name == project.name }
-        service.saveRegistry(registry)
+        do {
            try service.saveRegistry(registry)
        } catch {
            logger.error("removeProject couldn't persist registry: \(error.localizedDescription, privacy: .public)")
        }
        projects = registry.projects
        if selectedProject?.name == project.name {
            selectedProject = nil
@@ -55,6 +73,101 @@ final class ProjectsViewModel {
        }
    }
    // MARK: - v2.3 registry verbs (folder / archive / rename)
    /// Move a project into a folder. `nil` folder returns the project
    /// to the top level. No-op when the target already matches.
    func moveProject(_ project: ProjectEntry, toFolder folder: String?) {
        mutateEntry(project) { $0.folder = folder }
    }
    /// Rename a project. `name` is the registry's unique key + the
    /// Identifiable id; we reject renames that would collide with
    /// another project's name. Returns true on success.
    @discardableResult
    func renameProject(_ project: ProjectEntry, to newName: String) -> Bool {
        let trimmed = newName.trimmingCharacters(in: .whitespacesAndNewlines)
        guard !trimmed.isEmpty else { return false }
        guard trimmed != project.name else { return true }
        var registry = service.loadRegistry()
        // Reject collisions — a second project already owns that name.
        guard !registry.projects.contains(where: { $0.name == trimmed }) else { return false }
        guard let index = registry.projects.firstIndex(where: { $0.name == project.name }) else { return false }
        let old = registry.projects[index]
        registry.projects[index] = ProjectEntry(
            name: trimmed,
            path: old.path,
            folder: old.folder,
            archived: old.archived
        )
        do {
            try service.saveRegistry(registry)
        } catch {
            logger.error("renameProject couldn't persist registry: \(error.localizedDescription, privacy: .public)")
            return false
        }
        projects = registry.projects
        // Preserve selection across the rename — the selected project
        // still exists, it just has a new id.
        if selectedProject?.name == project.name {
            selectedProject = registry.projects[index]
        }
        return true
    }
    /// Soft-archive a project. It stays on disk and in the registry;
    /// the sidebar just hides it unless `showArchived` is on.
    func archiveProject(_ project: ProjectEntry) {
        mutateEntry(project) { $0.archived = true }
        // If the archived project was selected, clear selection so
        // the dashboard doesn't linger on a hidden project.
        if selectedProject?.name == project.name {
            selectedProject = nil
            dashboard = nil
        }
    }
    /// Restore an archived project to the default view.
    func unarchiveProject(_ project: ProjectEntry) {
        mutateEntry(project) { $0.archived = false }
    }
    /// Distinct folder labels across the current project set, sorted
    /// alphabetically. Drives the sidebar's DisclosureGroups (commit
    /// 2) and the Move-to-Folder sheet's existing-folder list. An
    /// "empty" folder (folder with zero projects) can't exist under
    /// this model — folders are implicit in the data — which is
    /// intentional: v2.3 doesn't need first-class empty folders.
    var folders: [String] {
        let set = Set(projects.compactMap(\.folder).filter { !$0.isEmpty })
        return set.sorted()
    }
    // MARK: - Helpers
    /// Fetch the registry, apply `mutation` to the matched entry,
    /// persist, update in-memory state. Centralises the save +
    /// re-publish dance shared by `moveProject`, `archiveProject`,
    /// and `unarchiveProject`. Callers that need different matching
    /// semantics (rename, remove) handle their own registry mutation.
    private func mutateEntry(_ project: ProjectEntry, _ mutation: (inout ProjectEntry) -> Void) {
        var registry = service.loadRegistry()
        guard let index = registry.projects.firstIndex(where: { $0.name == project.name }) else { return }
        var entry = registry.projects[index]
        mutation(&entry)
        registry.projects[index] = entry
        do {
            try service.saveRegistry(registry)
        } catch {
            logger.error("mutateEntry couldn't persist registry for \(project.name, privacy: .public): \(error.localizedDescription, privacy: .public)")
            return
        }
        projects = registry.projects
        if selectedProject?.name == project.name {
            selectedProject = entry
        }
    }
    func refreshDashboard() {
        guard let project = selectedProject else { return }
        loadDashboard(for: project)
@@ -0,0 +1,113 @@
 import SwiftUI
 /// Sheet for assigning a project to a folder in the sidebar. Folders
 /// are implicit — they exist because at least one project references
 /// them via its `folder` field. The "create" action here just seeds
 /// a new label the user types; it becomes real once any project is
 /// assigned to it.
 struct MoveToFolderSheet: View {
    @Environment(\.dismiss) private var dismiss
    let project: ProjectEntry
    /// Existing folder labels in the registry, sorted. Computed by
    /// the caller via `ProjectsViewModel.folders`.
    let existingFolders: [String]
    /// Called with the chosen folder. `nil` means "move back to top
    /// level". Caller wires this through
    /// `ProjectsViewModel.moveProject(_:toFolder:)`.
    let onMove: (String?) -> Void
    @State private var mode: Mode
    @State private var newFolderName: String = ""
    private enum Mode: Hashable {
        case topLevel
        case existing(String)
        case new
    }
    init(
        project: ProjectEntry,
        existingFolders: [String],
        onMove: @escaping (String?) -> Void
    ) {
        self.project = project
        self.existingFolders = existingFolders
        self.onMove = onMove
        // Start selection on the project's current folder if any,
        // otherwise "Top Level". Feels right — Move sheet should
        // reflect where the project currently lives.
        if let current = project.folder, existingFolders.contains(current) {
            _mode = State(initialValue: .existing(current))
        } else {
            _mode = State(initialValue: .topLevel)
        }
    }
    private var canMove: Bool {
        switch mode {
        case .topLevel, .existing:
            return true
        case .new:
            return !newFolderName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
        }
    }
    var body: some View {
        VStack(alignment: .leading, spacing: 12) {
            Text("Move \"\(project.name)\" to folder").font(.headline)
            Text("Folders only affect how projects are grouped in Scarf's sidebar. Nothing on disk changes.")
                .font(.caption)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
            Picker("Destination", selection: $mode) {
                Text("Top Level").tag(Mode.topLevel)
                if !existingFolders.isEmpty {
                    Section {
                        ForEach(existingFolders, id: \.self) { folder in
                            Text(folder).tag(Mode.existing(folder))
                        }
                    }
                }
                Text("New folder…").tag(Mode.new)
            }
            .labelsHidden()
            .pickerStyle(.inline)
            if case .new = mode {
                TextField("New folder name", text: $newFolderName)
                    .textFieldStyle(.roundedBorder)
                    .onSubmit {
                        if canMove { commit() }
                    }
            }
            HStack {
                Button("Cancel") { dismiss() }
                    .keyboardShortcut(.cancelAction)
                Spacer()
                Button("Move") { commit() }
                    .keyboardShortcut(.defaultAction)
                    .buttonStyle(.borderedProminent)
                    .disabled(!canMove)
            }
        }
        .padding()
        .frame(minWidth: 420, minHeight: 320)
    }
    private func commit() {
        switch mode {
        case .topLevel:
            onMove(nil)
        case .existing(let folder):
            onMove(folder)
        case .new:
            let trimmed = newFolderName.trimmingCharacters(in: .whitespacesAndNewlines)
            guard !trimmed.isEmpty else { return }
            onMove(trimmed)
        }
        dismiss()
    }
 }
@@ -0,0 +1,198 @@
 import SwiftUI
 /// Per-project Sessions tab (v2.3). Lives beside the Dashboard and
 /// Site tabs in the project view; populated from the session
 /// attribution sidecar maintained by ChatViewModel. A "New Chat"
 /// button spawns a fresh ACP session at cwd = project.path and
 /// routes the user into the Chat feature via AppCoordinator.
 struct ProjectSessionsView: View {
    let project: ProjectEntry
    @Environment(AppCoordinator.self) private var coordinator
    @Environment(HermesFileWatcher.self) private var fileWatcher
    @Environment(\.serverContext) private var serverContext
    @State private var viewModel: ProjectSessionsViewModel?
    var body: some View {
        VStack(spacing: 0) {
            header
            Divider()
            content
        }
        // `idealHeight: 400` caps what this subtree reports as its
        // ideal height. Without it, the inner List's row-materialised
        // intrinsic height bubbles up through NavigationSplitView's
        // detail slot and, under `.windowResizability(.contentMinSize)`,
        // opens the window at a height that exceeds the screen on
        // busy projects — the Sessions tab header + "New Chat" button
        // end up below the visible desktop edge. `maxHeight: .infinity`
        // still lets the List fill any taller offered space, and
        // `minHeight: 0` allows it to shrink. Mirrors the same pattern
        // applied in RichChatView.
        .frame(minHeight: 0, idealHeight: 400, maxHeight: .infinity)
        .task(id: project.id) {
            // Rebuild the VM when the project changes so stale state
            // from a previously-selected project doesn't bleed
            // through.
            viewModel = ProjectSessionsViewModel(
                context: serverContext,
                project: project
            )
            await viewModel?.load()
        }
        .onChange(of: fileWatcher.lastChangeDate) {
            Task { await viewModel?.load() }
        }
        .onDisappear {
            // Release the SQLite handle so it doesn't dangle once
            // the user leaves this tab. `load()` will re-open next
            // time. Mirrors ActivityView's disappear cleanup.
            Task { await viewModel?.close() }
        }
    }
    // MARK: - Header
    private var header: some View {
        HStack(spacing: 12) {
            VStack(alignment: .leading, spacing: 2) {
                Text("Sessions in this project")
                    .font(.headline)
                Text("Chats you start here get attributed automatically. Older CLI-started sessions live in the global Sessions sidebar.")
                    .font(.caption)
                    .foregroundStyle(.secondary)
                    .fixedSize(horizontal: false, vertical: true)
            }
            Spacer()
            Button {
                // Route into the Chat feature with a cwd override.
                // ChatView observes this via its onChange and starts
                // a fresh session with projectPath = our project.
                coordinator.pendingProjectChat = project.path
                coordinator.selectedSection = .chat
            } label: {
                Label("New Chat", systemImage: "message.badge.filled.fill")
            }
            .buttonStyle(.borderedProminent)
        }
        .padding()
    }
    // MARK: - Content
    @ViewBuilder
    private var content: some View {
        if let vm = viewModel {
            if vm.isLoading && vm.sessions.isEmpty {
                ProgressView()
                    .frame(maxWidth: .infinity, maxHeight: .infinity)
            } else if vm.sessions.isEmpty {
                emptyState(hint: vm.emptyStateHint)
            } else {
                sessionList(vm.sessions)
            }
        } else {
            ProgressView()
                .frame(maxWidth: .infinity, maxHeight: .infinity)
        }
    }
    private func emptyState(hint: String?) -> some View {
        VStack(spacing: 10) {
            Image(systemName: "bubble.left.and.bubble.right")
                .font(.system(size: 36))
                .foregroundStyle(.tertiary)
            Text(hint ?? "No sessions yet.")
                .font(.callout)
                .foregroundStyle(.secondary)
                .multilineTextAlignment(.center)
                .fixedSize(horizontal: false, vertical: true)
                .padding(.horizontal, 40)
        }
        .frame(maxWidth: .infinity, maxHeight: .infinity)
    }
    private func sessionList(_ sessions: [HermesSession]) -> some View {
        List(sessions) { session in
            ProjectSessionRow(session: session)
                .contentShape(Rectangle())
                .onTapGesture {
                    // Route into the Chat feature with this session
                    // as a resume target. Existing ChatView logic
                    // handles ACP reconnect.
                    coordinator.selectedSessionId = session.id
                    coordinator.selectedSection = .chat
                }
        }
        .listStyle(.plain)
    }
 }
 /// Single row in the per-project Sessions list. Intentionally small
 /// and self-contained so it can evolve independently of the global
 /// Sessions sidebar's row UI — if the two visualisations diverge
 /// (e.g. the project tab wants to hide the `source` badge that's
 /// useful in the global list), they don't pull each other along.
 private struct ProjectSessionRow: View {
    let session: HermesSession
    var body: some View {
        HStack(spacing: 10) {
            Image(systemName: iconForSource(session.source))
                .foregroundStyle(.secondary)
                .frame(width: 22)
            VStack(alignment: .leading, spacing: 2) {
                Text(displayTitle)
                    .font(.callout)
                    .lineLimit(1)
                HStack(spacing: 6) {
                    Text(session.id.prefix(12))
                        .font(.caption2.monospaced())
                        .foregroundStyle(.tertiary)
                    if let started = formattedStart {
                        Text("·")
                            .foregroundStyle(.tertiary)
                        Text(started)
                            .font(.caption2)
                            .foregroundStyle(.secondary)
                    }
                }
            }
            Spacer(minLength: 12)
            VStack(alignment: .trailing, spacing: 2) {
                Text("\(session.messageCount)")
                    .font(.caption.monospaced())
                Text("msgs")
                    .font(.caption2)
                    .foregroundStyle(.secondary)
            }
        }
        .padding(.vertical, 4)
    }
    private var displayTitle: String {
        if let t = session.title, !t.isEmpty { return t }
        return "Untitled session"
    }
    private var formattedStart: String? {
        // `startedAt` is `Date?` — the DB column can be null for
        // sessions in unusual states. Locale-aware short form keeps
        // us consistent with Insights + Activity.
        guard let date = session.startedAt else { return nil }
        let formatter = DateFormatter()
        formatter.dateStyle = .short
        formatter.timeStyle = .short
        return formatter.string(from: date)
    }
    private func iconForSource(_ source: String) -> String {
        switch source.lowercased() {
        case "cli", "acp": return "terminal"
        case "telegram": return "paperplane"
        case "discord": return "bubble.left.and.bubble.right"
        default: return "message"
        }
    }
 }
@@ -0,0 +1,274 @@
 import SwiftUI
 /// Sidebar view for the Projects feature. Renders the registry as:
 /// - A search field at the top (⌘F focus).
 /// - Top-level (folder-less) projects.
 /// - Collapsible DisclosureGroups, one per folder.
 /// - An "Archived" DisclosureGroup at the bottom, hidden unless the
 ///   Show Archived toggle is on.
 ///
 /// Selection is bound to `viewModel.selectedProject` so the
 /// dashboard area stays in sync with clicks anywhere in the hierarchy.
 /// Context-menu actions delegate back to the parent view via closures
 /// so the sheets / confirmation dialogs stay co-located with the rest
 /// of ProjectsView's state.
 struct ProjectsSidebar: View {
    @Bindable var viewModel: ProjectsViewModel
    // Predicates hoisted from the parent — avoid reaching down into
    // service objects from this view.
    let canConfigureProject: (ProjectEntry) -> Bool
    let isTemplateInstalled: (ProjectEntry) -> Bool
    // Context-menu + bottom-bar callbacks. Parent owns sheet state
    // (install, uninstall, rename, move-to-folder, remove-from-list
    // confirmation dialog) — this view just routes user intent.
    let onConfigure: (ProjectEntry) -> Void
    let onUninstallTemplate: (ProjectEntry) -> Void
    let onRemoveFromList: (ProjectEntry) -> Void
    let onRename: (ProjectEntry) -> Void
    let onMoveToFolder: (ProjectEntry) -> Void
    let onAddProject: () -> Void
    /// Per-view UI state — filter text, show-archived toggle, and
    /// which folders are expanded. Folder expansion defaults to all
    /// open so a new user sees everything; they can collapse what
    /// they don't want.
    @State private var filterText: String = ""
    @State private var showArchived: Bool = false
    @State private var expandedFolders: Set<String> = []
    @FocusState private var searchFocused: Bool
    var body: some View {
        VStack(spacing: 0) {
            searchField
            Divider()
            list
            Divider()
            bottomBar
        }
        .onAppear {
            // Start with every folder expanded on first render. If
            // users collapse, that choice persists for the lifetime
            // of the view instance (window open).
            expandedFolders = Set(viewModel.folders)
        }
        .onChange(of: viewModel.folders) { _, newFolders in
            // When a new folder appears (user just moved a project
            // into one), start it expanded so the move is visibly
            // reflected.
            expandedFolders.formUnion(newFolders)
        }
    }
    // MARK: - Search
    private var searchField: some View {
        HStack {
            Image(systemName: "magnifyingglass")
                .foregroundStyle(.secondary)
                .font(.caption)
            TextField("Filter projects", text: $filterText)
                .textFieldStyle(.plain)
                .focused($searchFocused)
                .font(.caption)
            if !filterText.isEmpty {
                Button {
                    filterText = ""
                } label: {
                    Image(systemName: "xmark.circle.fill")
                        .foregroundStyle(.tertiary)
                        .font(.caption)
                }
                .buttonStyle(.borderless)
            }
        }
        .padding(.horizontal, 10)
        .padding(.vertical, 6)
    }
    // MARK: - List
    private var list: some View {
        List(selection: Binding(
            get: { viewModel.selectedProject },
            set: { if let p = $0 { viewModel.selectProject(p) } }
        )) {
            // Top-level projects first — matches the Finder-like
            // mental model where top-level items sit above folders.
            ForEach(topLevelVisible) { project in
                projectRow(project)
            }
            // Per-folder collapsible sections.
            ForEach(visibleFolders, id: \.self) { folder in
                let children = folderProjects(folder)
                if !children.isEmpty {
                    DisclosureGroup(
                        isExpanded: Binding(
                            get: { expandedFolders.contains(folder) },
                            set: { expanded in
                                if expanded {
                                    expandedFolders.insert(folder)
                                } else {
                                    expandedFolders.remove(folder)
                                }
                            }
                        )
                    ) {
                        ForEach(children) { project in
                            projectRow(project)
                        }
                    } label: {
                        Label(folder, systemImage: "folder")
                            .font(.caption)
                            .foregroundStyle(.secondary)
                    }
                }
            }
            // Archived section — only surfaces under the toggle.
            if showArchived, !archivedVisible.isEmpty {
                DisclosureGroup {
                    ForEach(archivedVisible) { project in
                        projectRow(project)
                            .opacity(0.7)
                    }
                } label: {
                    Label("Archived (\(archivedVisible.count))", systemImage: "archivebox")
                        .font(.caption)
                        .foregroundStyle(.secondary)
                }
            }
        }
        .listStyle(.sidebar)
    }
    @ViewBuilder
    private func projectRow(_ project: ProjectEntry) -> some View {
        HStack {
            Image(
                systemName: viewModel.dashboard != nil
                    && viewModel.selectedProject == project
                    ? "square.grid.2x2.fill"
                    : "square.grid.2x2"
            )
            .foregroundStyle(.secondary)
            Text(project.name)
                .lineLimit(1)
                .truncationMode(.tail)
        }
        .tag(project)
        .contextMenu {
            projectContextMenu(project)
        }
    }
    @ViewBuilder
    private func projectContextMenu(_ project: ProjectEntry) -> some View {
        if canConfigureProject(project) {
            Button("Configuration…", systemImage: "slider.horizontal.3") {
                onConfigure(project)
            }
            Divider()
        }
        Button("Rename…", systemImage: "pencil") { onRename(project) }
        Button("Move to Folder…", systemImage: "folder") { onMoveToFolder(project) }
        if project.archived {
            Button("Unarchive", systemImage: "tray.and.arrow.up") {
                viewModel.unarchiveProject(project)
            }
        } else {
            Button("Archive", systemImage: "archivebox") {
                viewModel.archiveProject(project)
            }
        }
        Divider()
        if isTemplateInstalled(project) {
            Button("Uninstall Template (remove installed files)…", systemImage: "trash") {
                onUninstallTemplate(project)
            }
            Divider()
        }
        Button("Remove from List (keep files)…", systemImage: "minus.circle") {
            onRemoveFromList(project)
        }
    }
    // MARK: - Bottom bar
    private var bottomBar: some View {
        HStack {
            Button(action: onAddProject) {
                Image(systemName: "plus")
            }
            .buttonStyle(.borderless)
            .help("Add a project")
            Toggle(isOn: $showArchived) {
                Image(systemName: showArchived ? "archivebox.fill" : "archivebox")
                    .font(.caption)
            }
            .toggleStyle(.button)
            .buttonStyle(.borderless)
            .help(showArchived ? "Hide archived projects" : "Show archived projects")
            Spacer()
            if let selected = viewModel.selectedProject {
                Button(action: { onRemoveFromList(selected) }) {
                    Image(systemName: "minus")
                }
                .buttonStyle(.borderless)
                .help("Remove \(selected.name) from Scarf's project list (files are kept on disk)")
            }
        }
        .padding(8)
    }
    // MARK: - Derived data
    /// Fuzzy-match on name + path + folder label. Case-insensitive,
    /// substring — not a true fuzzy search, but matches the project
    /// count scale (tens, not thousands). Upgradable to a Levenshtein
    /// scorer later without changing the call sites.
    private func matches(_ project: ProjectEntry) -> Bool {
        let needle = filterText
            .trimmingCharacters(in: .whitespacesAndNewlines)
            .lowercased()
        guard !needle.isEmpty else { return true }
        if project.name.lowercased().contains(needle) { return true }
        if project.path.lowercased().contains(needle) { return true }
        if let folder = project.folder, folder.lowercased().contains(needle) { return true }
        return false
    }
    /// Visible top-level projects (no folder, not archived, passes
    /// the current filter). Sort is stable by name — the registry
    /// already preserves insertion order, but showing a sorted list
    /// of homogeneous top-level entries feels cleaner.
    private var topLevelVisible: [ProjectEntry] {
        viewModel.projects
            .filter { ($0.folder ?? "").isEmpty && !$0.archived && matches($0) }
            .sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
    }
    /// Folders that currently have at least one matching, non-
    /// archived project. Folders with only archived projects move
    /// into the Archived section's items; empty folders disappear.
    private var visibleFolders: [String] {
        viewModel.folders.filter { !folderProjects($0).isEmpty }
    }
    private func folderProjects(_ folder: String) -> [ProjectEntry] {
        viewModel.projects
            .filter { $0.folder == folder && !$0.archived && matches($0) }
            .sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
    }
    private var archivedVisible: [ProjectEntry] {
        viewModel.projects
            .filter { $0.archived && matches($0) }
            .sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
    }
 }
@@ -4,11 +4,21 @@ import UniformTypeIdentifiers
 private enum DashboardTab: String, CaseIterable {
    case dashboard = "Dashboard"
    case site = "Site"
    case sessions = "Sessions"
    var displayName: LocalizedStringResource {
        switch self {
        case .dashboard: return "Dashboard"
        case .site: return "Site"
        case .sessions: return "Sessions"
        }
    }
    var systemImage: String {
        switch self {
        case .dashboard: return "square.grid.2x2"
        case .site: return "globe"
        case .sessions: return "bubble.left.and.bubble.right"
        }
    }
 }
@@ -27,6 +37,22 @@ struct ProjectsView: View {
    @State private var installURLInput = ""
    @State private var showingUninstallSheet = false
    @State private var configEditorProject: ProjectEntry?
    /// Project queued for the "remove from list" confirmation dialog.
    /// Non-nil while the dialog is up; the `confirmationDialog` binding
    /// flips based on presence. We store the full entry (not just a
    /// flag) so the dialog's action closure knows which project to
    /// drop from the registry.
    @State private var pendingRemoveFromList: ProjectEntry?
    /// Project queued for the rename sheet (v2.3). Sheet state lives
    /// on the parent view so the sidebar stays a pure presentation
    /// layer; rename logic routes through `ProjectsViewModel.renameProject`.
    @State private var renameTarget: ProjectEntry?
    /// Project queued for the move-to-folder sheet (v2.3). Same
    /// pattern as renameTarget: parent owns sheet state, sidebar
    /// delegates up.
    @State private var moveTarget: ProjectEntry?
    private let uninstaller: ProjectTemplateUninstaller
@@ -121,6 +147,44 @@ struct ProjectsView: View {
                project: project
            )
        }
        // Confirmation dialog for the sidebar's "Remove from List" action.
        // The action is registry-only (doesn't touch disk), but the name
        // historically confused users into thinking it was a full delete.
        // A confirmation with explicit wording clarifies scope before the
        // click is destructive-looking but actually harmless.
        .confirmationDialog(
            removeFromListDialogTitle,
            isPresented: Binding(
                get: { pendingRemoveFromList != nil },
                set: { if !$0 { pendingRemoveFromList = nil } }
            ),
            titleVisibility: .visible,
            presenting: pendingRemoveFromList
        ) { project in
            Button("Remove from List") {
                viewModel.removeProject(project)
                if coordinator.selectedProjectName == project.name {
                    coordinator.selectedProjectName = nil
                }
                pendingRemoveFromList = nil
            }
            Button("Cancel", role: .cancel) {
                pendingRemoveFromList = nil
            }
        } message: { project in
            Text(
                "\(project.name) will be removed from Scarf's project list. " +
                "Nothing on disk is touched — the folder, cron job, skills, and memory block all stay. " +
                "To actually remove installed files, use \"Uninstall Template…\" instead."
            )
        }
    }
    /// Title string for the remove-from-list confirmation dialog. Kept
    /// as a computed property so the dialog and any future reuse share
    /// the exact same copy.
    private var removeFromListDialogTitle: LocalizedStringKey {
        "Remove from Scarf's project list?"
    }
    // MARK: - Toolbar
@@ -219,64 +283,47 @@ struct ProjectsView: View {
    // MARK: - Project List
    private var projectList: some View {
-        VStack(spacing: 0) {
+        // Sidebar is an extracted view; this view stays the owner of
-            List(viewModel.projects, selection: Binding(
+        // sheet state (add / rename / move / uninstall / remove-from-
-                get: { viewModel.selectedProject },
+        // list confirmation) and routes intents down as closures.
-                set: { project in
+        ProjectsSidebar(
-                    if let project {
+            viewModel: viewModel,
-                        viewModel.selectProject(project)
+            canConfigureProject: { isConfigurable($0) },
-                    }
+            isTemplateInstalled: { uninstaller.isTemplateInstalled(project: $0) },
-                }
+            onConfigure: { configEditorProject = $0 },
-            )) { project in
+            onUninstallTemplate: { project in
                HStack {
                    Image(systemName: viewModel.dashboard != nil && viewModel.selectedProject == project
                          ? "square.grid.2x2.fill" : "square.grid.2x2")
                        .foregroundStyle(.secondary)
                    Text(project.name)
                }
                .tag(project)
                .contextMenu {
                    if isConfigurable(project) {
                        Button("Configuration…", systemImage: "slider.horizontal.3") {
                            configEditorProject = project
                        }
                    }
                    if uninstaller.isTemplateInstalled(project: project) {
                        Button("Uninstall Template…", systemImage: "trash") {
                uninstallerViewModel.begin(project: project)
                showingUninstallSheet = true
-                        }
+            },
-                        Divider()
+            onRemoveFromList: { pendingRemoveFromList = $0 },
-                    }
+            onRename: { renameTarget = $0 },
-                    Button("Remove from Scarf", systemImage: "minus.circle") {
+            onMoveToFolder: { moveTarget = $0 },
-                        viewModel.removeProject(project)
+            onAddProject: { showingAddSheet = true }
-                    }
+        )
                }
            }
            .listStyle(.sidebar)
            Divider()
            HStack {
                Button(action: { showingAddSheet = true }) {
                    Image(systemName: "plus")
                }
                .buttonStyle(.borderless)
                Spacer()
                if let selected = viewModel.selectedProject {
                    Button(action: { viewModel.removeProject(selected) }) {
                        Image(systemName: "minus")
                    }
                    .buttonStyle(.borderless)
                }
            }
            .padding(8)
        }
        .sheet(isPresented: $showingAddSheet) {
            AddProjectSheet { name, path in
                viewModel.addProject(name: name, path: path)
                fileWatcher.updateProjectWatches(viewModel.dashboardPaths)
            }
        }
        .sheet(item: $renameTarget) { target in
            RenameProjectSheet(
                project: target,
                existingNames: viewModel.projects
                    .filter { $0.name != target.name }
                    .map(\.name)
            ) { newName in
                viewModel.renameProject(target, to: newName)
            }
        }
        .sheet(item: $moveTarget) { target in
            MoveToFolderSheet(
                project: target,
                existingFolders: viewModel.folders
            ) { newFolder in
                viewModel.moveProject(target, toFolder: newFolder)
            }
        }
    }
    // MARK: - Dashboard Area
@@ -296,11 +343,13 @@ struct ProjectsView: View {
                    .padding(.horizontal)
                    .padding(.top)
                    .padding(.bottom, 8)
-                if siteWidget != nil {
+                // Sessions tab is always present in v2.3, so the tab
                // bar always renders when a dashboard is loaded.
                // Site tab filters out when there's no webview widget
                // (existing v2.2 behavior preserved).
                tabBar
                    .padding(.horizontal)
                    .padding(.bottom, 8)
                }
                switch selectedTab {
                case .dashboard:
                    widgetsTab(dashboard)
@@ -310,8 +359,24 @@ struct ProjectsView: View {
                    } else {
                        widgetsTab(dashboard)
                    }
                case .sessions:
                    if let project = viewModel.selectedProject {
                        ProjectSessionsView(project: project)
                    } else {
                        ContentUnavailableView("No project selected", systemImage: "bubble.left.and.bubble.right")
                    }
                }
            }
            // Clamp the container VStack to the detail column's
            // offered space. Without it, any tab whose content is
            // taller than the window (long Sessions list, tall
            // README block in a dashboard's text widget, etc.) can
            // bubble its intrinsic height up through
            // NavigationSplitView's detail slot and push the whole
            // window past the screen. widgetsTab's own ScrollView
            // and siteTab's explicit maxHeight both cooperate; the
            // sessions tab needs this as well.
            .frame(maxWidth: .infinity, maxHeight: .infinity)
        } else if let error = viewModel.dashboardError {
            ContentUnavailableView {
                Label("No Dashboard", systemImage: "square.grid.2x2")
@@ -335,14 +400,23 @@ struct ProjectsView: View {
        }
    }
    /// Tabs that should appear for the current project. `.site` is
    /// gated on the dashboard actually containing a webview widget,
    /// per v2.2 behavior — the Site tab is meaningless without one.
    private var visibleTabs: [DashboardTab] {
        DashboardTab.allCases.filter { tab in
            tab != .site || siteWidget != nil
        }
    }
    private var tabBar: some View {
        HStack(spacing: 0) {
-            ForEach(DashboardTab.allCases, id: \.self) { tab in
+            ForEach(visibleTabs, id: \.self) { tab in
                Button {
                    selectedTab = tab
                } label: {
                    HStack(spacing: 4) {
-                        Image(systemName: tab == .dashboard ? "square.grid.2x2" : "globe")
+                        Image(systemName: tab.systemImage)
                            .font(.caption)
                        Text(tab.displayName)
                            .font(.subheadline)
@@ -0,0 +1,87 @@
 import SwiftUI
 /// Sheet for renaming a project in the registry. Preserves the
 /// project's `path`, `folder`, and `archived` fields — the rename
 /// only changes the user-visible name (and therefore the Identifiable
 /// id). Duplicate-name / empty-name rejection lives in the VM.
 struct RenameProjectSheet: View {
    @Environment(\.dismiss) private var dismiss
    let project: ProjectEntry
    /// Current set of project names in the registry, used to flag
    /// duplicates before the user tries to Save. Excludes the
    /// project being renamed so same-name is a no-op (accepted).
    let existingNames: [String]
    /// Called with the trimmed new name. Caller is responsible for
    /// calling `ProjectsViewModel.renameProject(_:to:)`; this sheet
    /// just gathers input + validates inline.
    let onSave: (String) -> Void
    @State private var newName: String
    init(
        project: ProjectEntry,
        existingNames: [String],
        onSave: @escaping (String) -> Void
    ) {
        self.project = project
        self.existingNames = existingNames
        self.onSave = onSave
        _newName = State(initialValue: project.name)
    }
    /// Validation for the live input. Empty / whitespace-only / a
    /// collision with another project's name all disable Save.
    private var validation: (isValid: Bool, message: String?) {
        let trimmed = newName.trimmingCharacters(in: .whitespacesAndNewlines)
        if trimmed.isEmpty {
            return (false, nil) // no error message — just disabled
        }
        if trimmed != project.name && existingNames.contains(trimmed) {
            return (false, String(localized: "A project named \"\(trimmed)\" already exists."))
        }
        return (true, nil)
    }
    var body: some View {
        VStack(alignment: .leading, spacing: 12) {
            Text("Rename project").font(.headline)
            Text("The project directory on disk isn't changed — only the label Scarf shows in the sidebar.")
                .font(.caption)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
            TextField("Project name", text: $newName)
                .textFieldStyle(.roundedBorder)
                .onSubmit {
                    if validation.isValid {
                        save()
                    }
                }
            if let message = validation.message {
                Label(message, systemImage: "exclamationmark.triangle.fill")
                    .font(.caption)
                    .foregroundStyle(.red)
            }
            HStack {
                Button("Cancel") { dismiss() }
                    .keyboardShortcut(.cancelAction)
                Spacer()
                Button("Save") { save() }
                    .keyboardShortcut(.defaultAction)
                    .buttonStyle(.borderedProminent)
                    .disabled(!validation.isValid)
            }
        }
        .padding()
        .frame(minWidth: 420)
    }
    private func save() {
        let trimmed = newName.trimmingCharacters(in: .whitespacesAndNewlines)
        onSave(trimmed)
        dismiss()
    }
 }
@@ -143,19 +143,20 @@ struct ManageServersView: View {
    }
    /// A star button that marks the open-on-launch default. Filled + yellow
-    /// on the current default row (and non-interactive — clicking it is a
+    /// on the current default row (disabled, since clicking would be a
-    /// no-op since the flag is already set); outline + secondary elsewhere,
+    /// no-op); outline + secondary elsewhere, clicking promotes that row
-    /// clicking promotes that row to default.
+    /// to default.
    @ViewBuilder
    private func defaultStar(for id: ServerID, currentDefault: ServerID) -> some View {
        let isDefault = id == currentDefault
        Button {
-            if !isDefault { registry.setDefaultServer(id) }
+            registry.setDefaultServer(id)
        } label: {
            Image(systemName: isDefault ? "star.fill" : "star")
                .foregroundStyle(isDefault ? .yellow : .secondary)
        }
        .buttonStyle(.borderless)
        .disabled(isDefault)
        .help(isDefault ? "Opens on launch" : "Set as default — open this server when Scarf launches.")
    }
@@ -20,7 +20,6 @@ final class SettingsViewModel {
    var hermesRunning = false
    var rawConfigYAML = ""
    var personalities: [String] = []
    var providers = ["anthropic", "openrouter", "nous", "openai-codex", "google-ai-studio", "xai", "ollama-cloud", "zai", "kimi-coding", "minimax"]
    var terminalBackends = ["local", "docker", "singularity", "modal", "daytona", "ssh"]
    var browserBackends = ["browseruse", "firecrawl", "local"]
    var ttsProviders = ["edge", "elevenlabs", "openai", "minimax", "mistral", "neutts"]
@@ -3,6 +3,12 @@ import SwiftUI
 /// Two-column model browser sheet. Left column lists providers, right column
 /// lists models for the selected provider. Supports filtering and a "Custom…"
 /// option for free-form model IDs not in the catalog.
 ///
 /// Overlay-only providers (Nous Portal, OpenAI Codex, Qwen OAuth, …) have no
 /// models.dev catalog entry, so their right column renders an overlay detail
 /// view: subscription state for Nous, plus a free-form model-ID field for
 /// users who know what they want. This is how the picker keeps parity with
 /// `hermes model` on the CLI, which can reach these providers natively.
 struct ModelPickerSheet: View {
    let initialProvider: String
    let initialModel: String
@@ -21,8 +27,21 @@ struct ModelPickerSheet: View {
    @State private var customModelID: String = ""
    @State private var customProviderID: String = ""
    // Overlay-provider model entry — distinct from `customMode` because the
    // provider is pinned; only the model ID is user-editable.
    @State private var overlayModelID: String = ""
    // Subscription state for the Nous Portal row / detail view. Loaded on
    // appear; stays in-memory for the life of the sheet.
    @State private var subscription: NousSubscriptionState = .absent
    /// Drives presentation of the Nous sign-in sheet. Bound to the
    /// "Sign in to Nous Portal" button in the subscription summary.
    @State private var showNousSignIn: Bool = false
    @Environment(\.serverContext) private var serverContext
    private var catalog: ModelCatalogService { ModelCatalogService(context: serverContext) }
    private var subscriptionService: NousSubscriptionService { NousSubscriptionService(context: serverContext) }
    var body: some View {
        VStack(spacing: 0) {
@@ -44,8 +63,18 @@ struct ModelPickerSheet: View {
            providers = catalog.loadProviders()
            selectedProviderID = initialProvider.isEmpty ? (providers.first?.providerID ?? "") : initialProvider
            selectedModelID = initialModel
            overlayModelID = initialModel
            subscription = subscriptionService.loadState()
            loadModelsForSelection()
        }
        .sheet(isPresented: $showNousSignIn) {
            NousSignInSheet {
                // Refresh subscription immediately so the right-column
                // status row flips to "active" without waiting for the
                // picker to be re-opened.
                subscription = subscriptionService.loadState()
            }
        }
    }
    private var header: some View {
@@ -80,20 +109,39 @@ struct ModelPickerSheet: View {
            }
        )) {
            ForEach(filteredProviders) { provider in
-                HStack {
+                providerRow(provider)
                    Text(provider.providerName)
                    Spacer()
                    Text("\(provider.modelCount)")
                        .font(.caption2.monospaced())
                        .foregroundStyle(.secondary)
                }
                    .tag(provider.providerID)
            }
        }
        .listStyle(.inset)
    }
    @ViewBuilder
    private func providerRow(_ provider: HermesProviderInfo) -> some View {
        HStack(spacing: 6) {
            Text(provider.providerName)
            if provider.subscriptionGated {
                capsuleTag("Subscription", tint: .accentColor)
            }
            Spacer()
            if !provider.isOverlay {
                Text("\(provider.modelCount)")
                    .font(.caption2.monospaced())
                    .foregroundStyle(.secondary)
            }
        }
    }
    @ViewBuilder
    private var modelColumn: some View {
        if let selected = providers.first(where: { $0.providerID == selectedProviderID }), selected.isOverlay {
            overlayProviderDetail(selected)
        } else {
            cachedModelList
        }
    }
    private var cachedModelList: some View {
        List(selection: $selectedModelID) {
            ForEach(filteredModels) { model in
                VStack(alignment: .leading, spacing: 2) {
@@ -138,6 +186,114 @@ struct ModelPickerSheet: View {
        }
    }
    /// Right-column detail for overlay-only providers (Nous Portal, OpenAI
    /// Codex, Qwen OAuth, …). models.dev has no catalog for them, so the user
    /// either trusts Hermes's default (subscription providers) or types a
    /// model ID they know is valid for the provider's API.
    @ViewBuilder
    private func overlayProviderDetail(_ provider: HermesProviderInfo) -> some View {
        let overlay = catalog.overlayMetadata(for: provider.providerID)
        ScrollView {
            VStack(alignment: .leading, spacing: 14) {
                HStack(alignment: .firstTextBaseline, spacing: 8) {
                    Text(provider.providerName).font(.title3.bold())
                    if provider.subscriptionGated {
                        capsuleTag("Subscription", tint: .accentColor)
                    }
                }
                if provider.subscriptionGated {
                    subscriptionSummary(provider: provider, overlay: overlay)
                } else {
                    Text(overlayInstruction(for: overlay?.authType))
                        .font(.callout)
                        .foregroundStyle(.secondary)
                        .fixedSize(horizontal: false, vertical: true)
                }
                Divider()
                VStack(alignment: .leading, spacing: 4) {
                    Text("Model ID").font(.caption).foregroundStyle(.secondary)
                    TextField(modelIDPlaceholder(for: provider), text: $overlayModelID)
                        .textFieldStyle(.roundedBorder)
                        .font(.system(.caption, design: .monospaced))
                    if provider.subscriptionGated {
                        Text("Leave blank to use Hermes's default Nous model.")
                            .font(.caption2)
                            .foregroundStyle(.tertiary)
                    }
                }
                if let docURL = overlay?.docURL, let url = URL(string: docURL) {
                    Link(destination: url) {
                        Label("Setup documentation", systemImage: "book")
                            .font(.caption)
                    }
                }
                Spacer(minLength: 0)
            }
            .padding()
        }
    }
    @ViewBuilder
    private func subscriptionSummary(provider: HermesProviderInfo, overlay: HermesProviderOverlay?) -> some View {
        VStack(alignment: .leading, spacing: 8) {
            Text("Paid Nous Portal subscribers route web search, image generation, TTS, and browser automation through their subscription — no separate API keys needed.")
                .font(.callout)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
            HStack(spacing: 6) {
                Image(systemName: subscription.subscribed ? "checkmark.circle.fill" : "exclamationmark.circle")
                    .foregroundStyle(subscription.subscribed ? Color.green : Color.secondary)
                if subscription.subscribed {
                    Text("Subscription active — active provider is Nous.")
                } else if subscription.present {
                    Text("Signed in to Nous, but another provider is active.")
                        .foregroundStyle(.secondary)
                } else {
                    Text("Not signed in yet.")
                        .foregroundStyle(.secondary)
                }
            }
            .font(.callout)
            if !subscription.subscribed {
                Button {
                    showNousSignIn = true
                } label: {
                    Label("Sign in to Nous Portal", systemImage: "person.badge.key.fill")
                }
                .buttonStyle(.borderedProminent)
                .controlSize(.regular)
            }
        }
    }
    private func overlayInstruction(for authType: HermesProviderOverlay.AuthType?) -> String {
        switch authType {
        case .oauthExternal:
            return "Sign in through the provider's OAuth flow — run `hermes auth` from a terminal, then pick the provider to complete sign-in. Back here, set the model ID you want to use."
        case .externalProcess:
            return "Uses an external process (e.g. a local agent bridge). Run `hermes auth` from a terminal to complete the link, then set the model ID you want to use."
        case .oauthDeviceCode:
            return "Sign in via device-code flow — run `hermes auth` from a terminal and follow the printed URL."
        default:
            return "This provider isn't in the models.dev catalog. Enter the model ID you want to use — Hermes will pass it through to the provider verbatim."
        }
    }
    private func modelIDPlaceholder(for provider: HermesProviderInfo) -> String {
        switch provider.providerID {
        case "nous":          return "e.g. hermes-3"
        case "openai-codex":  return "e.g. gpt-5-codex"
        case "qwen-oauth":    return "e.g. qwen3-coder-plus"
        default:              return "e.g. model-name"
        }
    }
    private var customEntry: some View {
        VStack(alignment: .leading, spacing: 12) {
            Text("Use a model not in the catalog. Hermes accepts any string the provider recognizes, including provider-prefixed forms like \"openrouter/anthropic/claude-opus-4.6\".")
@@ -201,14 +357,35 @@ struct ModelPickerSheet: View {
        }
    }
    private var isSelectedProviderOverlay: Bool {
        providers.first(where: { $0.providerID == selectedProviderID })?.isOverlay ?? false
    }
    private var isSelectedProviderSubscriptionGated: Bool {
        providers.first(where: { $0.providerID == selectedProviderID })?.subscriptionGated ?? false
    }
    private var canSubmit: Bool {
        if customMode {
            return !customModelID.trimmingCharacters(in: .whitespaces).isEmpty
        }
        if isSelectedProviderOverlay {
            // Subscription-gated providers can submit with an empty model ID
            // (Hermes picks its default). Other overlays require a model ID.
            if isSelectedProviderSubscriptionGated { return true }
            return !overlayModelID.trimmingCharacters(in: .whitespaces).isEmpty
        }
        return !selectedModelID.isEmpty
    }
    private var selectedPreview: String? {
        if isSelectedProviderOverlay {
            let trimmed = overlayModelID.trimmingCharacters(in: .whitespaces)
            if trimmed.isEmpty {
                return selectedProviderID.isEmpty ? nil : "\(selectedProviderID) / (default)"
            }
            return "\(selectedProviderID) / \(trimmed)"
        }
        guard !selectedModelID.isEmpty, !selectedProviderID.isEmpty else { return nil }
        return "\(selectedProviderID) / \(selectedModelID)"
    }
@@ -249,18 +426,21 @@ struct ModelPickerSheet: View {
            let model = customModelID.trimmingCharacters(in: .whitespaces)
            let provider = resolvedCustomProvider()
            onSelect(model, provider)
        } else if isSelectedProviderOverlay {
            let model = overlayModelID.trimmingCharacters(in: .whitespaces)
            onSelect(model, selectedProviderID)
        } else {
            onSelect(selectedModelID, selectedProviderID)
        }
    }
-    private func capsuleTag(_ text: String) -> some View {
+    private func capsuleTag(_ text: String, tint: Color = .secondary) -> some View {
        Text(text)
            .font(.caption2)
-            .foregroundStyle(.secondary)
+            .foregroundStyle(tint == .secondary ? AnyShapeStyle(.secondary) : AnyShapeStyle(tint))
            .padding(.horizontal, 5)
            .padding(.vertical, 1)
-            .background(.quaternary)
+            .background(tint == .secondary ? AnyShapeStyle(.quaternary) : AnyShapeStyle(tint.opacity(0.15)))
            .clipShape(Capsule())
    }
 }
@@ -0,0 +1,237 @@
 import SwiftUI
 import AppKit
 /// In-app sign-in sheet for Nous Portal — hosts a ``NousAuthFlow`` and
 /// renders one of four sub-views keyed on `flow.state`. Reached from the
 /// model picker's Nous Portal row, the Auxiliary tab's per-task toggle,
 /// and Credential Pools when the selected provider is `nous`.
 ///
 /// UX contract with the caller:
 ///
 /// - Sheet is presented via `.sheet(isPresented:)` from the caller.
 /// - Parent owns the `isPresented` binding and a `@State var` for the
 ///   dismiss trigger.
 /// - `onSignedIn` fires on success so the caller can refresh subscription
 ///   state (e.g. re-query ``NousSubscriptionService``) before the sheet
 ///   auto-dismisses ~1.2s later.
 struct NousSignInSheet: View {
    @Environment(\.serverContext) private var serverContext
    @Environment(\.dismiss) private var dismiss
    /// Fires on `.success`. Callers use this to refresh their cached
    /// ``NousSubscriptionState`` so the new "Subscription active" chip
    /// shows immediately without waiting for a full view reload.
    var onSignedIn: () -> Void = {}
    @State private var flow: NousAuthFlow?
    @State private var successDismissTask: Task<Void, Never>?
    var body: some View {
        VStack(spacing: 16) {
            header
            Divider()
            content
                .frame(maxWidth: .infinity, maxHeight: .infinity)
        }
        .padding(20)
        .frame(minWidth: 440, idealWidth: 440, minHeight: 340)
        .onAppear {
            if flow == nil {
                let f = NousAuthFlow(context: serverContext)
                flow = f
                f.start()
            }
        }
        .onDisappear {
            successDismissTask?.cancel()
            flow?.cancel()
        }
        .onChange(of: flowState) { _, newValue in
            if case .success = newValue {
                onSignedIn()
                successDismissTask?.cancel()
                successDismissTask = Task { @MainActor in
                    try? await Task.sleep(nanoseconds: 1_200_000_000)
                    if !Task.isCancelled { dismiss() }
                }
            }
        }
    }
    private var flowState: NousAuthFlow.State {
        flow?.state ?? .idle
    }
    // MARK: - Header
    private var header: some View {
        HStack(spacing: 8) {
            Image(systemName: "person.badge.key.fill")
                .foregroundStyle(.tint)
            Text("Sign in to Nous Portal")
                .font(.headline)
            Spacer()
            if case .waitingForApproval = flowState {
                Button("Cancel") { dismiss() }
                    .controlSize(.small)
            } else if case .starting = flowState {
                Button("Cancel") { dismiss() }
                    .controlSize(.small)
            } else {
                Button("Close") { dismiss() }
                    .controlSize(.small)
            }
        }
    }
    // MARK: - State-keyed content
    @ViewBuilder
    private var content: some View {
        switch flowState {
        case .idle, .starting:
            startingView
        case .waitingForApproval(let code, let url):
            waitingView(userCode: code, verificationURL: url)
        case .success:
            successView
        case .failure(let reason, let billingURL):
            failureView(reason: reason, billingURL: billingURL)
        }
    }
    // MARK: - .starting
    private var startingView: some View {
        VStack(spacing: 12) {
            ProgressView()
                .controlSize(.large)
            Text("Contacting Nous Portal…")
                .font(.callout)
                .foregroundStyle(.secondary)
            Text("This may take a few seconds.")
                .font(.caption2)
                .foregroundStyle(.tertiary)
        }
        .frame(maxWidth: .infinity, maxHeight: .infinity)
    }
    // MARK: - .waitingForApproval
    @ViewBuilder
    private func waitingView(userCode: String, verificationURL: URL) -> some View {
        VStack(alignment: .leading, spacing: 14) {
            VStack(alignment: .leading, spacing: 4) {
                Text("Approve in your browser")
                    .font(.headline)
                Text("We opened the Nous Portal approval page. Confirm this code matches what it shows, then approve.")
                    .font(.callout)
                    .foregroundStyle(.secondary)
                    .fixedSize(horizontal: false, vertical: true)
            }
            userCodeBadge(userCode)
            HStack(spacing: 12) {
                Button {
                    NSWorkspace.shared.open(verificationURL)
                } label: {
                    Label("Open approval page again", systemImage: "safari")
                }
                .controlSize(.small)
                Spacer()
                HStack(spacing: 6) {
                    ProgressView().controlSize(.small)
                    Text("Waiting for approval…")
                        .font(.caption)
                        .foregroundStyle(.secondary)
                }
            }
        }
        .padding(.vertical, 4)
    }
    private func userCodeBadge(_ code: String) -> some View {
        HStack(spacing: 10) {
            Text(code)
                .font(.system(size: 28, weight: .semibold, design: .monospaced))
                .textSelection(.enabled)
                .padding(.horizontal, 14)
                .padding(.vertical, 10)
                .background(.quaternary.opacity(0.5), in: RoundedRectangle(cornerRadius: 8))
            Button {
                copyToPasteboard(code)
            } label: {
                Label("Copy", systemImage: "doc.on.doc")
            }
            .controlSize(.small)
        }
    }
    // MARK: - .success
    private var successView: some View {
        VStack(spacing: 12) {
            Image(systemName: "checkmark.circle.fill")
                .foregroundStyle(.green)
                .font(.system(size: 48))
            Text("Signed in to Nous Portal")
                .font(.headline)
            Text("Your tools will now route through your subscription.")
                .font(.callout)
                .foregroundStyle(.secondary)
        }
        .frame(maxWidth: .infinity, maxHeight: .infinity)
    }
    // MARK: - .failure
    @ViewBuilder
    private func failureView(reason: String, billingURL: URL?) -> some View {
        VStack(alignment: .leading, spacing: 14) {
            HStack(spacing: 8) {
                Image(systemName: "exclamationmark.triangle.fill")
                    .foregroundStyle(.orange)
                Text(billingURL == nil ? "Sign-in didn't complete" : "Subscription required")
                    .font(.headline)
            }
            Text(reason)
                .font(.callout)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
                .textSelection(.enabled)
            if let billingURL {
                Button {
                    NSWorkspace.shared.open(billingURL)
                } label: {
                    Label("Subscribe", systemImage: "creditcard")
                        .frame(maxWidth: .infinity)
                }
                .buttonStyle(.borderedProminent)
                .controlSize(.large)
            }
            HStack(spacing: 10) {
                Button("Try again") { flow?.start() }
                    .buttonStyle(.bordered)
                Button("Copy error") {
                    let payload = (flow?.output.isEmpty == false) ? flow!.output : reason
                    copyToPasteboard(payload)
                }
                .buttonStyle(.bordered)
                Spacer()
                Button("Close") { dismiss() }
            }
        }
    }
    // MARK: - Helpers
    private func copyToPasteboard(_ value: String) {
        let pb = NSPasteboard.general
        pb.clearContents()
        pb.setString(value, forType: .string)
    }
 }
@@ -16,7 +16,7 @@ struct AgentTab: View {
            StepperRow(label: "Approval Timeout (s)", value: viewModel.config.approvalTimeout, range: 5...600, step: 5) { viewModel.setApprovalTimeout($0) }
        }
-        SettingsSection(title: "Gateway", icon: "antenna.radiowaves.left.and.right") {
+        SettingsSection(title: "Messaging Gateway", icon: "antenna.radiowaves.left.and.right") {
            ToggleRow(label: "Fast Mode", isOn: viewModel.config.serviceTier == "fast") { on in
                viewModel.setServiceTier(on ? "fast" : "normal")
            }
@@ -2,9 +2,19 @@ import SwiftUI
 /// Auxiliary tab — the 8 sub-model tasks hermes delegates to cheaper models.
 /// Each follows the same provider/model/base_url/api_key/timeout pattern.
 ///
 /// Adds a per-task **Route through Nous Portal** toggle for Hermes v0.10.0+
 /// subscribers. The toggle flips `auxiliary.<task>.provider` between `nous`
 /// (subscription-routed) and `auto` (inherit main provider) — Hermes derives
 /// the gateway routing from that single field; there is no separate
 /// `use_gateway` key to write.
 struct AuxiliaryTab: View {
    @Bindable var viewModel: SettingsViewModel
    @Environment(\.serverContext) private var serverContext
    @State private var subscription: NousSubscriptionState = .absent
    @State private var showNousSignIn: Bool = false
    // Keyed by the config path name — matches `auxiliary.<task>.*` in config.yaml.
    private let tasks: [(key: String, title: LocalizedStringKey, icon: String)] = [
        ("vision", "Vision", "eye"),
@@ -28,11 +38,21 @@ struct AuxiliaryTab: View {
                auxRows(for: task.key)
            }
        }
        Color.clear.frame(height: 0)
            .onAppear {
                subscription = NousSubscriptionService(context: serverContext).loadState()
            }
            .sheet(isPresented: $showNousSignIn) {
                NousSignInSheet {
                    subscription = NousSubscriptionService(context: serverContext).loadState()
                }
            }
    }
    @ViewBuilder
    private func auxRows(for key: String) -> some View {
        let model = auxModel(for: key)
        nousGatewayToggle(for: key, currentProvider: model.provider)
        EditableTextField(label: "Provider", value: model.provider) { viewModel.setAuxiliary(key, field: "provider", value: $0) }
        EditableTextField(label: "Model", value: model.model) { viewModel.setAuxiliary(key, field: "model", value: $0) }
        EditableTextField(label: "Base URL", value: model.baseURL) { viewModel.setAuxiliary(key, field: "base_url", value: $0) }
@@ -40,6 +60,30 @@ struct AuxiliaryTab: View {
        StepperRow(label: "Timeout (s)", value: model.timeout, range: 5...3600, step: 5) { viewModel.setAuxiliaryTimeout(key, value: $0) }
    }
    @ViewBuilder
    private func nousGatewayToggle(for key: String, currentProvider: String) -> some View {
        let isOn = (currentProvider == "nous")
        ToggleRow(label: "Nous Portal", isOn: isOn) { wantsOn in
            // "nous" enables subscription routing; "auto" reverts to the
            // inherit-main-provider default. We never touch model/base/key
            // fields here — Hermes reuses them if the user switches back.
            viewModel.setAuxiliary(key, field: "provider", value: wantsOn ? "nous" : "auto")
        }
        if !subscription.present && !isOn {
            HStack(spacing: 8) {
                Text("Requires an active Nous Portal subscription.")
                    .font(.caption2)
                    .foregroundStyle(.tertiary)
                Button("Sign in first") { showNousSignIn = true }
                    .controlSize(.mini)
                    .buttonStyle(.borderedProminent)
                Spacer()
            }
            .padding(.horizontal, 12)
            .padding(.bottom, 4)
        }
    }
    private func auxModel(for key: String) -> AuxiliaryModel {
        switch key {
        case "vision": return viewModel.config.auxiliary.vision
@@ -17,6 +17,26 @@ final class TemplateUninstallerViewModel {
        case failed(String)
    }
    /// Snapshot of "what survived the uninstall" — surfaced in the
    /// success screen so the user understands why the project directory
    /// is or isn't gone from disk. Computed from the plan right before
    /// executing it (`plan` itself is nil'd on success, so we can't
    /// reach back for this info after the fact).
    struct PreservedOutcome: Sendable {
        /// True when the uninstaller removed the project dir (nothing
        /// user-owned was left inside). In this case `preservedPaths`
        /// is empty and the success view skips the banner entirely.
        let projectDirRemoved: Bool
        /// Absolute paths of files the uninstaller refused to touch
        /// because they weren't installed by the template (typically
        /// `status-log.md` after the cron ran, or anything the user
        /// dropped into the project dir manually).
        let preservedPaths: [String]
        /// Project dir — echoed back so the success view can show the
        /// user where the orphan files now live.
        let projectDir: String
    }
    let context: ServerContext
    private let uninstaller: ProjectTemplateUninstaller
@@ -27,11 +47,15 @@ final class TemplateUninstallerViewModel {
    var stage: Stage = .idle
    var plan: TemplateUninstallPlan?
    /// Populated on transition to `.succeeded`. Nil whenever the user
    /// re-enters the flow (cancel/begin both clear it).
    var preservedOutcome: PreservedOutcome?
    /// Load the `template.lock.json` for the given project and build a
    /// removal plan. Moves stage to `.planned` on success.
    func begin(project: ProjectEntry) {
        stage = .loading
        preservedOutcome = nil
        let uninstaller = uninstaller
        Task.detached { [weak self] in
            do {
@@ -53,11 +77,20 @@ final class TemplateUninstallerViewModel {
        guard let plan else { return }
        stage = .uninstalling
        let uninstaller = uninstaller
        // Capture the preservation shape before executing — the plan
        // itself gets nil'd on success and we want the banner to show
        // whatever was true at the moment of removal.
        let outcome = PreservedOutcome(
            projectDirRemoved: plan.projectDirBecomesEmpty,
            preservedPaths: plan.extraProjectEntries,
            projectDir: plan.project.path
        )
        Task.detached { [weak self] in
            do {
                try uninstaller.uninstall(plan: plan)
                await MainActor.run { [weak self] in
                    guard let self else { return }
                    self.preservedOutcome = outcome
                    self.stage = .succeeded(removed: plan.project)
                    self.plan = nil
                }
@@ -71,6 +104,7 @@ final class TemplateUninstallerViewModel {
    func cancel() {
        plan = nil
        preservedOutcome = nil
        stage = .idle
    }
 }
@@ -23,6 +23,20 @@ struct TemplateConfigSheet: View {
            header
            Divider()
            ScrollView {
                // `.frame(maxWidth: .infinity, alignment: .leading)` is
                // load-bearing: without it, SwiftUI resolves width
                // bottom-up and an unbreakable token in a child (e.g. a
                // raw URL inside a field description rendered via
                // AttributedString markdown) sets the whole VStack's
                // ideal width to that token's length. ScrollView's
                // content then exceeds the sheet's viewport, the outer
                // `.frame(minWidth: 560)` grows to content width, and
                // the window clips the result with labels cut off on
                // the left + URL spilling off the right. With the
                // explicit maxWidth, the ScrollView's offered width
                // propagates down and the description Text's
                // `.fixedSize(horizontal: false, vertical: true)`
                // wraps at whitespace boundaries as intended.
                VStack(alignment: .leading, spacing: 18) {
                    if viewModel.schema.fields.isEmpty {
                        ContentUnavailableView(
@@ -40,6 +54,7 @@ struct TemplateConfigSheet: View {
                        modelRecommendation(rec)
                    }
                }
                .frame(maxWidth: .infinity, alignment: .leading)
                .padding(20)
            }
            Divider()
@@ -68,16 +83,26 @@ struct TemplateConfigSheet: View {
    private var footer: some View {
        HStack {
            Button("Cancel") {
                // Caller owns dismissal — this view is used both as a
                // standalone sheet (ConfigEditorSheet, where the caller
                // wants dismissal) AND inlined inside the install sheet
                // (TemplateInstallSheet.configureView, where calling
                // .dismiss here would tear down the OUTER install sheet
                // and abort the flow before .planned is reached).
                onCancel()
                dismiss()
            }
            .keyboardShortcut(.cancelAction)
            Spacer()
            Button(commitLabel) {
                if let finalized = viewModel.commit(project: project) {
                    onCommit(finalized)
                    dismiss()
                }
                // Same dismissal-is-caller's-responsibility rule as
                // Cancel — inside the install sheet, onCommit transitions
                // stage to .planned and the outer view re-renders to
                // show the preview. In the edit sheet, onCommit
                // transitions the editor VM and its state machine
                // handles dismissal via the success view's Done button.
            }
            .keyboardShortcut(.defaultAction)
            .buttonStyle(.borderedProminent)
@@ -103,7 +128,15 @@ struct TemplateConfigSheet: View {
                    .foregroundStyle(.secondary)
            }
            if let description = field.description, !description.isEmpty {
-                Text(description)
+                // Inline markdown so descriptions can include
                // `[Create one](https://…)`-style links to token
                // generation pages, **bold** emphasis on important
                // prerequisites, etc. Raw URLs (not wrapped in
                // markdown link syntax) will still render but can't
                // word-break mid-token — keep the parent maxWidth
                // constraint below so a rogue raw URL wraps cleanly
                // instead of expanding the entire sheet.
                TemplateMarkdown.inlineText(description)
                    .font(.caption)
                    .foregroundStyle(.secondary)
                    .fixedSize(horizontal: false, vertical: true)
@@ -115,6 +148,12 @@ struct TemplateConfigSheet: View {
                    .foregroundStyle(.red)
            }
        }
        // maxWidth: .infinity forces this row to span the column's
        // full width so its internal description Text wraps instead
        // of expanding the outer VStack when a description contains
        // a long unbreakable token (raw URL, path, etc.). See the
        // comment on the parent ScrollView's inner VStack.
        .frame(maxWidth: .infinity, alignment: .leading)
        .padding(12)
        .background(
            RoundedRectangle(cornerRadius: 8)
@@ -273,17 +312,17 @@ private struct EnumControl: View {
    let options: [TemplateConfigField.EnumOption]
    @Binding var value: String
    var body: some View {
-        // Segmented for ≤ 4 options, dropdown otherwise — fits Scarf's
+        // Always use the default Menu picker (dropdown). An earlier
-        // existing settings UI.
+        // version switched to `.pickerStyle(.segmented)` when
-        if options.count <= 4 {
+        // `options.count ≤ 4` for a more compact look, but on macOS
-            Picker("", selection: $value) {
+        // segmented pickers size to the intrinsic width of all their
-                ForEach(options) { opt in
+        // labels concatenated — they refuse offered width constraints
-                    Text(opt.label).tag(opt.value)
+        // and refuse to wrap. A schema with three long labels like
-                }
+        // "Claude Opus 4 (Recommended - Most Capable)" produced a
-            }
+        // ~650pt picker that overflowed the 560pt sheet viewport,
-            .pickerStyle(.segmented)
+        // clipping the entire form. Menu pickers respect the fieldRow's
-            .labelsHidden()
+        // offered width and show long labels in the popup list, so the
-        } else {
+        // sheet can't overflow regardless of label length.
        Picker("", selection: $value) {
            ForEach(options) { opt in
                Text(opt.label).tag(opt.value)
@@ -291,7 +330,6 @@ private struct EnumControl: View {
        }
        .labelsHidden()
    }
    }
 }
 /// Variable-length list of string values. Each row is a text field
@@ -126,6 +126,16 @@ struct TemplateInstallSheet: View {
                .padding(.bottom, 8)
            Divider()
            ScrollView {
                // `.frame(maxWidth: .infinity, alignment: .leading)` —
                // without it, a subsection containing an unbreakable
                // token (raw URL in a cron prompt or README block, a
                // long file path in the project-files list, a schema
                // description with a bare URL, etc.) sets the VStack's
                // ideal width to that token's length; the sheet grows
                // past its `.frame(minWidth: 620)` and gets clipped by
                // the window. Same fix as `TemplateConfigSheet`'s
                // inner VStack — propagate the ScrollView's width down
                // so inner Text wraps instead of expanding outward.
                VStack(alignment: .leading, spacing: 16) {
                    projectFilesSection(plan: plan)
                    if plan.skillsNamespaceDir != nil {
@@ -142,6 +152,7 @@ struct TemplateInstallSheet: View {
                    }
                    readmeSection
                }
                .frame(maxWidth: .infinity, alignment: .leading)
                .padding(.vertical)
            }
            Divider()
@@ -175,7 +186,10 @@ struct TemplateInstallSheet: View {
                    .font(.caption.monospaced())
                    .foregroundStyle(.secondary)
            }
-            Text(manifest.description)
+            // Inline-only markdown — descriptions are a sentence or two;
            // bold/italic/code/links are all that reasonable template
            // authors use there.
            TemplateMarkdown.inlineText(manifest.description)
                .font(.subheadline)
                .foregroundStyle(.secondary)
            if let author = manifest.author {
@@ -220,8 +234,9 @@ struct TemplateInstallSheet: View {
    private func cronSection(plan: TemplateInstallPlan) -> some View {
        section(title: "Cron jobs (created disabled — you can enable each one manually)", subtitle: nil) {
-            VStack(alignment: .leading, spacing: 4) {
+            VStack(alignment: .leading, spacing: 10) {
                ForEach(plan.cronJobs, id: \.name) { job in
                    VStack(alignment: .leading, spacing: 4) {
                        HStack(alignment: .firstTextBaseline, spacing: 8) {
                            Image(systemName: "clock.arrow.circlepath")
                                .foregroundStyle(.secondary)
@@ -232,6 +247,29 @@ struct TemplateInstallSheet: View {
                                    .foregroundStyle(.secondary)
                            }
                        }
                        // Prompt preview — disclosed in an expandable
                        // group so the preview stays compact when the
                        // user doesn't care to read it. Markdown-rendered
                        // so prompts that include `code`, **bold**, or
                        // enumerated steps look right. Tokens like
                        // {{PROJECT_DIR}} are still visible here — they
                        // get substituted when the installer calls
                        // `hermes cron create`.
                        if let prompt = job.prompt, !prompt.isEmpty {
                            DisclosureGroup("Prompt") {
                                ScrollView {
                                    TemplateMarkdown.render(prompt)
                                        .frame(maxWidth: .infinity, alignment: .leading)
                                }
                                .frame(maxHeight: 140)
                                .padding(8)
                                .background(.quaternary.opacity(0.4))
                                .clipShape(RoundedRectangle(cornerRadius: 6))
                            }
                            .font(.caption)
                            .padding(.leading, 26)
                        }
                    }
                }
            }
        }
@@ -302,11 +340,10 @@ struct TemplateInstallSheet: View {
            if let readme = viewModel.readmeBody {
                section(title: "README", subtitle: nil) {
                    ScrollView {
-                        Text(readme)
+                        TemplateMarkdown.render(readme)
                            .font(.callout)
                            .frame(maxWidth: .infinity, alignment: .leading)
                    }
-                    .frame(maxHeight: 200)
+                    .frame(maxHeight: 260)
                }
            }
        }
@@ -0,0 +1,192 @@
 import SwiftUI
 import Foundation
 /// Minimal markdown renderer used by the template install/config UIs.
 ///
 /// SwiftUI `Text` has built-in inline-markdown support via
 /// `AttributedString(markdown:)` — bold, italic, inline code, links.
 /// That's enough for field descriptions + template taglines. For
 /// longer content (README preview, full doc blocks), this helper adds
 /// block-level handling: lines starting with `#`/`##`/`###` render
 /// as bigger bold text; lines starting with `-`/`*`/`1.` render as
 /// list items with a hanging indent; fenced ``` ``` blocks render as
 /// monospaced; blank lines become paragraph breaks.
 ///
 /// Scope is intentionally small. This isn't a full CommonMark
 /// renderer — it's "enough markdown to make template READMEs look
 /// right in the install sheet without pulling in a dependency." If
 /// the set of templates needs more over time, evolve this file or
 /// graduate to a proper library.
 enum TemplateMarkdown {
    /// Render a markdown source string as a SwiftUI view. Preserves
    /// reading order and approximate visual hierarchy. Safe with
    /// untrusted input — we never execute HTML or scripts.
    @ViewBuilder
    static func render(_ source: String) -> some View {
        VStack(alignment: .leading, spacing: 6) {
            let blocks = parse(source)
            ForEach(blocks.indices, id: \.self) { i in
                block(blocks[i])
            }
        }
    }
    /// Inline-only markdown (bold/italic/code/links) as a single
    /// `Text`. Use for short strings where block structure doesn't
    /// apply — field labels, one-line descriptions.
    static func inlineText(_ source: String) -> Text {
        if let attr = try? AttributedString(
            markdown: source,
            options: .init(interpretedSyntax: .inlineOnlyPreservingWhitespace)
        ) {
            return Text(attr)
        }
        return Text(source)
    }
    // MARK: - Block model
    fileprivate enum Block {
        case paragraph(AttributedString)
        case heading(level: Int, text: AttributedString)
        case bullet(AttributedString)
        case numbered(index: Int, text: AttributedString)
        case code(String)
    }
    // MARK: - Parser
    fileprivate static func parse(_ source: String) -> [Block] {
        var blocks: [Block] = []
        var lines = source.components(separatedBy: "\n")
        var i = 0
        while i < lines.count {
            let line = lines[i]
            let trimmed = line.trimmingCharacters(in: .whitespaces)
            // Fenced code block.
            if trimmed.hasPrefix("```") {
                var body: [String] = []
                i += 1
                while i < lines.count {
                    let inner = lines[i]
                    if inner.trimmingCharacters(in: .whitespaces).hasPrefix("```") {
                        i += 1
                        break
                    }
                    body.append(inner)
                    i += 1
                }
                blocks.append(.code(body.joined(separator: "\n")))
                continue
            }
            // Heading.
            if let headingMatch = trimmed.firstMatch(of: /^(#{1,6})\s+(.*)$/) {
                let level = (headingMatch.1).count
                let text = String(headingMatch.2)
                blocks.append(.heading(level: level, text: renderInline(text)))
                i += 1
                continue
            }
            // Bullet list.
            if let bulletMatch = line.firstMatch(of: /^\s*[-*]\s+(.*)$/) {
                let text = String(bulletMatch.1)
                blocks.append(.bullet(renderInline(text)))
                i += 1
                continue
            }
            // Numbered list.
            if let numMatch = line.firstMatch(of: /^\s*(\d+)\.\s+(.*)$/) {
                let index = Int(String(numMatch.1)) ?? 1
                let text = String(numMatch.2)
                blocks.append(.numbered(index: index, text: renderInline(text)))
                i += 1
                continue
            }
            // Blank line — skip.
            if trimmed.isEmpty {
                i += 1
                continue
            }
            // Paragraph — collect contiguous non-blank lines that
            // aren't headings/lists/fences into one paragraph block.
            var paragraphLines: [String] = [line]
            i += 1
            while i < lines.count {
                let next = lines[i]
                let nextTrim = next.trimmingCharacters(in: .whitespaces)
                if nextTrim.isEmpty { break }
                if nextTrim.hasPrefix("```") { break }
                if nextTrim.firstMatch(of: /^#{1,6}\s/) != nil { break }
                if next.firstMatch(of: /^\s*[-*]\s+/) != nil { break }
                if next.firstMatch(of: /^\s*\d+\.\s+/) != nil { break }
                paragraphLines.append(next)
                i += 1
            }
            let joined = paragraphLines.joined(separator: " ")
            blocks.append(.paragraph(renderInline(joined)))
        }
        return blocks
    }
    /// Parse inline markdown (bold, italic, inline code, links) into
    /// an AttributedString. Falls back to plain text on parse failure.
    fileprivate static func renderInline(_ source: String) -> AttributedString {
        if let attr = try? AttributedString(
            markdown: source,
            options: .init(interpretedSyntax: .inlineOnlyPreservingWhitespace)
        ) {
            return attr
        }
        return AttributedString(source)
    }
    // MARK: - Rendering
    @ViewBuilder
    fileprivate static func block(_ b: Block) -> some View {
        switch b {
        case .paragraph(let text):
            Text(text)
                .font(.callout)
                .fixedSize(horizontal: false, vertical: true)
        case .heading(let level, let text):
            headingText(text: text, level: level)
        case .bullet(let text):
            HStack(alignment: .firstTextBaseline, spacing: 6) {
                Text("•").font(.callout)
                Text(text).font(.callout)
                    .fixedSize(horizontal: false, vertical: true)
            }
        case .numbered(let index, let text):
            HStack(alignment: .firstTextBaseline, spacing: 6) {
                Text("\(index).").font(.callout.monospacedDigit())
                Text(text).font(.callout)
                    .fixedSize(horizontal: false, vertical: true)
            }
        case .code(let src):
            Text(src)
                .font(.caption.monospaced())
                .padding(8)
                .frame(maxWidth: .infinity, alignment: .leading)
                .background(.quaternary.opacity(0.5))
                .clipShape(RoundedRectangle(cornerRadius: 6))
        }
    }
    @ViewBuilder
    fileprivate static func headingText(text: AttributedString, level: Int) -> some View {
        switch level {
        case 1: Text(text).font(.title2.bold()).padding(.top, 8)
        case 2: Text(text).font(.title3.bold()).padding(.top, 6)
        case 3: Text(text).font(.headline).padding(.top, 4)
        default: Text(text).font(.subheadline.bold()).padding(.top, 2)
        }
    }
 }
@@ -277,6 +277,19 @@ struct TemplateUninstallSheet: View {
                .foregroundStyle(.green)
            Text("Removed \(removed.name)")
                .font(.title2.bold())
            // Preserved-files banner. Only renders when the project dir
            // stayed and at least one file was left behind — that's the
            // case the user keeps getting surprised by ("I uninstalled
            // but my project folder is still there?"). Explicit
            // explanation + file list makes it obvious the files the
            // user (or the cron job) created are intentionally kept.
            if let outcome = viewModel.preservedOutcome,
               outcome.projectDirRemoved == false,
               outcome.preservedPaths.isEmpty == false {
                preservedFilesBanner(outcome: outcome)
            }
            Button("Done") {
                onCompleted(removed)
                dismiss()
@@ -285,6 +298,53 @@ struct TemplateUninstallSheet: View {
            .buttonStyle(.borderedProminent)
        }
        .frame(maxWidth: .infinity, maxHeight: .infinity)
        .padding()
    }
    /// Orange informational banner listing the files the uninstaller
    /// left in the project directory. Caps the visible list at 8 rows
    /// with a "+N more…" tail so a long log (many runs = many status
    /// file entries) doesn't blow out the sheet height.
    private func preservedFilesBanner(
        outcome: TemplateUninstallerViewModel.PreservedOutcome
    ) -> some View {
        let visible = Array(outcome.preservedPaths.prefix(8))
        let overflow = outcome.preservedPaths.count - visible.count
        return VStack(alignment: .leading, spacing: 8) {
            HStack(spacing: 6) {
                Image(systemName: "folder.badge.questionmark")
                    .foregroundStyle(.orange)
                Text("Project folder kept")
                    .font(.headline)
            }
            Text("These files weren't installed by the template (the agent or you created them after install), so Scarf left them in place along with the folder itself.")
                .font(.caption)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
            VStack(alignment: .leading, spacing: 2) {
                ForEach(visible, id: \.self) { path in
                    Text(path)
                        .font(.caption.monospaced())
                        .lineLimit(1)
                        .truncationMode(.head)
                }
                if overflow > 0 {
                    Text("+ \(overflow) more…")
                        .font(.caption2)
                        .foregroundStyle(.secondary)
                }
            }
            Text("Delete \(outcome.projectDir) from Finder if you don't need these files anymore.")
                .font(.caption2)
                .foregroundStyle(.secondary)
                .fixedSize(horizontal: false, vertical: true)
        }
        .frame(maxWidth: 520, alignment: .leading)
        .padding(12)
        .background(
            RoundedRectangle(cornerRadius: 8)
                .fill(Color.orange.opacity(0.10))
        )
    }
    private func failureView(message: String) -> some View {
@@ -49,6 +49,10 @@
    },
    "(%lld tokens)" : {
    },
    "*" : {
      "comment" : "A required asterisk.",
      "isCommentAutoGenerated" : true
    },
    "/%@" : {
@@ -885,6 +889,14 @@
    },
    "••••••••••" : {
    },
    "`%@` uses a different sign-in flow." : {
      "comment" : "A description of the sign-in flow for a given provider.",
      "isCommentAutoGenerated" : true
    },
    "+ %lld more…" : {
      "comment" : "A button that shows the number of files that were left behind by the template uninstaller.",
      "isCommentAutoGenerated" : true
    },
    "<%@>" : {
@@ -1020,6 +1032,10 @@
      "comment" : "A message that appears when a memory block is no longer present in MEMORY.md.",
      "isCommentAutoGenerated" : true
    },
    "A project named \"%@\" already exists." : {
      "comment" : "A warning message that appears in a Rename Project sheet if the user-provided name is a duplicate of an existing project. The argument is the name of the duplicate project.",
      "isCommentAutoGenerated" : true
    },
    "A QR code will appear below. Scan it with WhatsApp on your phone. The session is saved to ~/.hermes/platforms/whatsapp/ so you won't need to scan again after restarts." : {
      "localizations" : {
        "de" : {
@@ -1383,6 +1399,10 @@
        }
      }
    },
    "Add a project" : {
      "comment" : "A button that adds a new project.",
      "isCommentAutoGenerated" : true
    },
    "Add a project folder to get started. Create a .scarf/dashboard.json file in your project to define widgets." : {
      "localizations" : {
        "de" : {
@@ -2229,6 +2249,9 @@
    "already gone" : {
      "comment" : "A tag for a file that is already gone (no longer in the template).",
      "isCommentAutoGenerated" : true
    },
    "Also works: %@" : {
    },
    "API Key" : {
      "localizations" : {
@@ -2469,6 +2492,9 @@
          }
        }
      }
    },
    "Approve in your browser" : {
    },
    "Archive" : {
      "localizations" : {
@@ -2510,6 +2536,10 @@
        }
      }
    },
    "Archived (%lld)" : {
      "comment" : "A label that opens a group of archived projects.",
      "isCommentAutoGenerated" : true
    },
    "Args (one per line)" : {
      "localizations" : {
        "de" : {
@@ -3734,6 +3764,14 @@
        }
      }
    },
    "Chat · %@" : {
      "comment" : "A label that shows the name of the active Scarf project, followed by \"Chat\".",
      "isCommentAutoGenerated" : true
    },
    "Chat is scoped to Scarf project \"%@\"" : {
      "comment" : "Tooltip for the folder-chip indicator.",
      "isCommentAutoGenerated" : true
    },
    "Chat Messages" : {
      "localizations" : {
        "de" : {
@@ -3774,6 +3812,10 @@
        }
      }
    },
    "Chats you start here get attributed automatically. Older CLI-started sessions live in the global Sessions sidebar." : {
      "comment" : "A description of the purpose of the Sessions tab.",
      "isCommentAutoGenerated" : true
    },
    "Check" : {
      "localizations" : {
        "de" : {
@@ -5024,6 +5066,14 @@
        }
      }
    },
    "Configuration saved" : {
      "comment" : "A title displayed when a configuration is saved.",
      "isCommentAutoGenerated" : true
    },
    "Configuration…" : {
      "comment" : "A contextual menu item that opens a configuration editor for a project.",
      "isCommentAutoGenerated" : true
    },
    "Configure" : {
      "localizations" : {
        "de" : {
@@ -5064,6 +5114,10 @@
        }
      }
    },
    "Configure %@" : {
      "comment" : "The title of the configuration sheet. The argument is the name of the template.",
      "isCommentAutoGenerated" : true
    },
    "Connect timeout" : {
      "localizations" : {
        "de" : {
@@ -5223,6 +5277,9 @@
          }
        }
      }
    },
    "Contacting Nous Portal…" : {
    },
    "Container Limits" : {
      "localizations" : {
@@ -5304,6 +5361,10 @@
        }
      }
    },
    "Continue" : {
      "comment" : "Button label for continuing with the template configuration.",
      "isCommentAutoGenerated" : true
    },
    "Continue Last Session" : {
      "localizations" : {
        "de" : {
@@ -5503,6 +5564,9 @@
          }
        }
      }
    },
    "Copy error" : {
    },
    "Copy error details" : {
      "localizations" : {
@@ -5584,6 +5648,10 @@
        }
      }
    },
    "Couldn't save" : {
      "comment" : "A title displayed when a configuration save fails.",
      "isCommentAutoGenerated" : true
    },
    "Create" : {
      "localizations" : {
        "de" : {
@@ -6637,6 +6705,10 @@
        }
      }
    },
    "Delete %@ from Finder if you don't need these files anymore." : {
      "comment" : "A note that lets the user delete",
      "isCommentAutoGenerated" : true
    },
    "Delete %@?" : {
      "localizations" : {
        "de" : {
@@ -6839,6 +6911,10 @@
    },
    "Description" : {
    },
    "Destination" : {
      "comment" : "A label for the folder picker in the move-to-folder sheet.",
      "isCommentAutoGenerated" : true
    },
    "Details" : {
      "localizations" : {
@@ -7657,6 +7733,10 @@
        }
      }
    },
    "Edit configuration" : {
      "comment" : "A button that opens a configuration editor for a project.",
      "isCommentAutoGenerated" : true
    },
    "Edit User Profile" : {
      "localizations" : {
        "de" : {
@@ -8763,6 +8843,10 @@
        }
      }
    },
    "Filter projects" : {
      "comment" : "A label for a search field in the sidebar.",
      "isCommentAutoGenerated" : true
    },
    "Filter servers..." : {
      "localizations" : {
        "de" : {
@@ -8967,6 +9051,10 @@
      "comment" : "A placeholder for a comma-separated list of tags.",
      "isCommentAutoGenerated" : true
    },
    "Folders only affect how projects are grouped in Scarf's sidebar. Nothing on disk changes." : {
      "comment" : "A description of how folders affect project grouping.",
      "isCommentAutoGenerated" : true
    },
    "Full copy of active profile (all state)" : {
      "localizations" : {
        "de" : {
@@ -9008,6 +9096,7 @@
      }
    },
    "Gateway" : {
      "extractionState" : "stale",
      "localizations" : {
        "de" : {
          "stringUnit" : {
@@ -9088,6 +9177,7 @@
      }
    },
    "Gateway Running" : {
      "extractionState" : "stale",
      "localizations" : {
        "de" : {
          "stringUnit" : {
@@ -9128,6 +9218,7 @@
      }
    },
    "Gateway Stopped" : {
      "extractionState" : "stale",
      "localizations" : {
        "de" : {
          "stringUnit" : {
@@ -9659,6 +9750,10 @@
        }
      }
    },
    "Hide archived projects" : {
      "comment" : "A toggle that hides archived projects.",
      "isCommentAutoGenerated" : true
    },
    "Hide details" : {
      "localizations" : {
        "de" : {
@@ -10548,6 +10643,9 @@
          }
        }
      }
    },
    "Internal state inconsistency — please close and re-open." : {
    },
    "Invalid URL" : {
      "localizations" : {
@@ -10916,6 +11014,10 @@
        }
      }
    },
    "Leave blank to use Hermes's default Nous model." : {
      "comment" : "A description of the default Nous model.",
      "isCommentAutoGenerated" : true
    },
    "Leave blank unless Hermes is installed at a non-default path (systemd services often live at /var/lib/hermes/.hermes; Docker sidecars vary). Test Connection auto-suggests a value when it detects one of the known alternates." : {
      "localizations" : {
        "de" : {
@@ -11156,6 +11258,10 @@
        }
      }
    },
    "Loading configuration…" : {
      "comment" : "A message displayed while loading the configuration.",
      "isCommentAutoGenerated" : true
    },
    "Loading session…" : {
      "localizations" : {
        "de" : {
@@ -11856,6 +11962,18 @@
        }
      }
    },
    "Messaging Gateway" : {
      "comment" : "The title of the messaging gateway view.",
      "isCommentAutoGenerated" : true
    },
    "Messaging Gateway Running" : {
      "comment" : "A label that indicates that the messaging gateway is running.",
      "isCommentAutoGenerated" : true
    },
    "Messaging Gateway Stopped" : {
      "comment" : "A label that describes the messaging gateway as stopped.",
      "isCommentAutoGenerated" : true
    },
    "Metadata" : {
      "comment" : "A heading for the metadata section of the template export sheet.",
      "isCommentAutoGenerated" : true
@@ -12140,6 +12258,22 @@
        }
      }
    },
    "Move" : {
      "comment" : "A button that moves a project to a folder.",
      "isCommentAutoGenerated" : true
    },
    "Move \"%@\" to folder" : {
      "comment" : "A heading for a dialog that lets the user move a project to a folder.",
      "isCommentAutoGenerated" : true
    },
    "Move to Folder…" : {
      "comment" : "A context menu action that moves a project to a folder.",
      "isCommentAutoGenerated" : true
    },
    "msgs" : {
      "comment" : "A label for the number of messages in a session.",
      "isCommentAutoGenerated" : true
    },
    "my_server" : {
    },
@@ -12263,6 +12397,17 @@
        }
      }
    },
    "New Chat" : {
      "comment" : "A button that starts a new chat session.",
      "isCommentAutoGenerated" : true
    },
    "New folder name" : {
    },
    "New folder…" : {
      "comment" : "A label for a new folder name.",
      "isCommentAutoGenerated" : true
    },
    "New name for '%@'" : {
      "localizations" : {
        "de" : {
@@ -12665,6 +12810,9 @@
          }
        }
      }
    },
    "No configuration" : {
    },
    "No credential pools configured" : {
      "localizations" : {
@@ -12910,6 +13058,10 @@
        }
      }
    },
    "No fields" : {
      "comment" : "A label that describes a template with no configuration fields.",
      "isCommentAutoGenerated" : true
    },
    "No headers configured." : {
      "localizations" : {
        "de" : {
@@ -13274,6 +13426,10 @@
        }
      }
    },
    "No project selected" : {
      "comment" : "A label that indicates that no project is selected.",
      "isCommentAutoGenerated" : true
    },
    "No Projects" : {
      "localizations" : {
        "de" : {
@@ -13681,6 +13837,10 @@
        }
      }
    },
    "Not signed in yet." : {
      "comment" : "A description of a model picker sheet's subscription",
      "isCommentAutoGenerated" : true
    },
    "Notable Sessions" : {
      "localizations" : {
        "de" : {
@@ -13721,6 +13881,10 @@
        }
      }
    },
    "Nous Portal uses a dedicated sign-in flow." : {
      "comment" : "A description of the process of using the Nous Portal.",
      "isCommentAutoGenerated" : true
    },
    "npx" : {
    },
@@ -13814,6 +13978,10 @@
      "comment" : "A placeholder for a template's description.",
      "isCommentAutoGenerated" : true
    },
    "Open approval page again" : {
      "comment" : "A button that opens a web page.",
      "isCommentAutoGenerated" : true
    },
    "Open BotFather" : {
      "localizations" : {
        "de" : {
@@ -14258,6 +14426,10 @@
        }
      }
    },
    "Opens on launch" : {
      "comment" : "A tooltip for the star button in the Manage Servers view.",
      "isCommentAutoGenerated" : true
    },
    "Optional" : {
      "localizations" : {
        "de" : {
@@ -14502,6 +14674,10 @@
      "comment" : "A label for the template's owner and name.",
      "isCommentAutoGenerated" : true
    },
    "Paid Nous Portal subscribers route web search, image generation, TTS, and browser automation through their subscription — no separate API keys needed." : {
      "comment" : "A description of the benefits of using a Nous",
      "isCommentAutoGenerated" : true
    },
    "Pair Device" : {
      "localizations" : {
        "de" : {
@@ -15398,6 +15574,13 @@
    },
    "Project directory will also be removed (nothing user-owned left inside)." : {
    },
    "Project folder kept" : {
    },
    "Project name" : {
      "comment" : "A label for a text field that lets the user enter a project name.",
      "isCommentAutoGenerated" : true
    },
    "Project Name" : {
      "localizations" : {
@@ -16127,6 +16310,10 @@
        }
      }
    },
    "Recommended model" : {
      "comment" : "A label that indicates a recommended model.",
      "isCommentAutoGenerated" : true
    },
    "Reconnect" : {
      "localizations" : {
        "de" : {
@@ -16458,6 +16645,10 @@
      "comment" : "A label that instructs the user to remove a project from Scarf's list of installed projects.",
      "isCommentAutoGenerated" : true
    },
    "Remove %@ from Scarf's project list (files are kept on disk)" : {
      "comment" : "A confirmation dialog that",
      "isCommentAutoGenerated" : true
    },
    "Remove %@?" : {
      "localizations" : {
        "de" : {
@@ -16538,8 +16729,16 @@
        }
      }
    },
-    "Remove from Scarf" : {
+    "Remove from List" : {
-      "comment" : "A context menu option to remove a project from Scarf.",
+      "comment" : "A confirmation dialog that asks whether a user is sure they want to remove a project from Scarf's list.",
      "isCommentAutoGenerated" : true
    },
    "Remove from List (keep files)…" : {
      "comment" : "A button that removes a project from Scarf's list, but not from disk.",
      "isCommentAutoGenerated" : true
    },
    "Remove from Scarf's project list?" : {
      "comment" : "Title of a dialog that asks the user to confirm removing a project from Scarf's project list.",
      "isCommentAutoGenerated" : true
    },
    "Remove the entire namespace dir recursively" : {
@@ -16794,6 +16993,10 @@
        }
      }
    },
    "Rename project" : {
      "comment" : "A title for a sheet that renames a project.",
      "isCommentAutoGenerated" : true
    },
    "Rename Session" : {
      "localizations" : {
        "de" : {
@@ -16873,6 +17076,9 @@
          }
        }
      }
    },
    "Rename…" : {
    },
    "required" : {
@@ -16960,6 +17166,10 @@
        }
      }
    },
    "Requires an active Nous Portal subscription." : {
      "comment" : "A message that appears when the Nous Portal subscription is not active.",
      "isCommentAutoGenerated" : true
    },
    "Requires: %@" : {
      "localizations" : {
        "de" : {
@@ -17640,6 +17850,10 @@
        }
      }
    },
    "Run `hermes auth add %@` in a terminal to finish sign-in. In-app support for this provider is coming in a follow-up." : {
      "comment" : "A description of the CLI fallback for a given provider.",
      "isCommentAutoGenerated" : true
    },
    "Run `hermes memory setup` in Terminal for full provider configuration." : {
      "localizations" : {
        "de" : {
@@ -18000,6 +18214,14 @@
        }
      }
    },
    "Saved in Keychain — leave empty to keep the stored value." : {
      "comment" : "A message that appears when a user has filled in a secret but has not yet saved it.",
      "isCommentAutoGenerated" : true
    },
    "Saving…" : {
      "comment" : "A label displayed while the configuration is being saved.",
      "isCommentAutoGenerated" : true
    },
    "Scarf" : {
    },
@@ -18043,6 +18265,10 @@
        }
      }
    },
    "Scarf doesn't auto-switch your active model. Change it in Settings if you'd like." : {
      "comment" : "A description of the warning about not switching models.",
      "isCommentAutoGenerated" : true
    },
    "Scarf never prompts for passphrases. Add your key to ssh-agent in Terminal, then click Retry. If your key isn't `id_ed25519`, swap the path:" : {
      "localizations" : {
        "de" : {
@@ -19291,6 +19517,14 @@
        }
      }
    },
    "Sessions in this project" : {
      "comment" : "A heading for the list of sessions in a project.",
      "isCommentAutoGenerated" : true
    },
    "Set as default — open this server when Scarf launches." : {
      "comment" : "A tooltip for the star button in the Manage Servers view.",
      "isCommentAutoGenerated" : true
    },
    "Settings" : {
      "localizations" : {
        "de" : {
@@ -19371,6 +19605,10 @@
        }
      }
    },
    "Setup documentation" : {
      "comment" : "A link to a documentation page for setting up a",
      "isCommentAutoGenerated" : true
    },
    "Share Debug Report…" : {
      "localizations" : {
        "de" : {
@@ -19531,6 +19769,10 @@
        }
      }
    },
    "Show archived projects" : {
      "comment" : "A toggle that shows/hides archived projects.",
      "isCommentAutoGenerated" : true
    },
    "Show details" : {
      "localizations" : {
        "de" : {
@@ -19694,6 +19936,21 @@
        }
      }
    },
    "Show while typing" : {
      "comment" : "A hint for the user on how to show/hide the secret.",
      "isCommentAutoGenerated" : true
    },
    "Sign in first" : {
      "comment" : "A button that opens a sheet for signing in to a Nous Portal subscription.",
      "isCommentAutoGenerated" : true
    },
    "Sign in to Nous Portal" : {
    },
    "Sign-in didn't complete" : {
      "comment" : "A title for a failed sign-in attempt.",
      "isCommentAutoGenerated" : true
    },
    "Signal integration requires signal-cli (Java-based) installed locally. Link this Mac as a Signal device, then keep the daemon running so hermes can send/receive messages." : {
      "localizations" : {
        "de" : {
@@ -19819,6 +20076,13 @@
    },
    "signal-cli Terminal" : {
    },
    "Signed in to Nous Portal" : {
    },
    "Signed in to Nous, but another provider is active." : {
      "comment" : "A description of a user's subscription to Nous, but",
      "isCommentAutoGenerated" : true
    },
    "SILENT" : {
@@ -20884,6 +21148,13 @@
          }
        }
      }
    },
    "Subscription active — active provider is Nous." : {
      "comment" : "A description of a user's active subscription to",
      "isCommentAutoGenerated" : true
    },
    "Subscription required" : {
    },
    "Succeeded" : {
      "localizations" : {
@@ -21339,6 +21610,10 @@
        }
      }
    },
    "The project directory on disk isn't changed — only the label Scarf shows in the sidebar." : {
      "comment" : "A description of the project name field.",
      "isCommentAutoGenerated" : true
    },
    "The remote's SSH fingerprint no longer matches what your `~/.ssh/known_hosts` file expected. This usually means the remote was reinstalled — or, less commonly, that someone is intercepting the connection." : {
      "localizations" : {
        "de" : {
@@ -21499,6 +21774,10 @@
        }
      }
    },
    "These files weren't installed by the template (the agent or you created them after install), so Scarf left them in place along with the folder itself." : {
      "comment" : "A description of the files Scarf left in place when uninstalling a template.",
      "isCommentAutoGenerated" : true
    },
    "These list fields must be edited directly in config.yaml." : {
      "localizations" : {
        "de" : {
@@ -21538,6 +21817,17 @@
          }
        }
      }
    },
    "This Mac" : {
      "comment" : "A description of the local machine.",
      "isCommentAutoGenerated" : true
    },
    "This may take a few seconds." : {
      "comment" : "A description of the time it takes to connect to Nous Portal.",
      "isCommentAutoGenerated" : true
    },
    "This project wasn't installed from a schemaful template." : {
    },
    "This provider has no catalogued models." : {
      "localizations" : {
@@ -21739,6 +22029,10 @@
        }
      }
    },
    "This template has no configuration fields." : {
      "comment" : "A description of a template with no configuration fields.",
      "isCommentAutoGenerated" : true
    },
    "This uploads logs, config (with secrets redacted), and system info to Nous Research support infrastructure. Review the output below before sharing the returned URL." : {
      "localizations" : {
        "de" : {
@@ -22311,6 +22605,10 @@
        }
      }
    },
    "Top Level" : {
      "comment" : "A folder in the sidebar.",
      "isCommentAutoGenerated" : true
    },
    "Top Tools" : {
      "localizations" : {
        "de" : {
@@ -22351,6 +22649,10 @@
        }
      }
    },
    "Try again" : {
      "comment" : "A button that triggers a re-attempt to sign in to Nous Portal.",
      "isCommentAutoGenerated" : true
    },
    "TTS Off" : {
      "localizations" : {
        "de" : {
@@ -22471,6 +22773,10 @@
        }
      }
    },
    "Unarchive" : {
      "comment" : "A button that unarchives a project.",
      "isCommentAutoGenerated" : true
    },
    "Uninstall" : {
      "localizations" : {
        "de" : {
@@ -22518,8 +22824,8 @@
      "comment" : "A button that uninstalls a template.",
      "isCommentAutoGenerated" : true
    },
-    "Uninstall Template…" : {
+    "Uninstall Template (remove installed files)…" : {
-      "comment" : "A contextual menu item that uninstalls a template.",
+      "comment" : "A button that removes a project's files from the system.",
      "isCommentAutoGenerated" : true
    },
    "Unknown: %@" : {
@@ -23298,6 +23604,10 @@
        }
      }
    },
    "Waiting for approval…" : {
      "comment" : "A label displayed in the `.waitingForApproval` state of the",
      "isCommentAutoGenerated" : true
    },
    "Waiting for authorization URL…" : {
      "localizations" : {
        "de" : {
@@ -23418,6 +23728,14 @@
        }
      }
    },
    "We opened the Nous Portal approval page. Confirm this code matches what it shows, then approve." : {
      "comment" : "A description of the user's task to approve a",
      "isCommentAutoGenerated" : true
    },
    "We'll open the Nous Portal approval page in your browser and show the device code here. No code-paste step." : {
      "comment" : "A description of the process of adding a credential via the Nous Portal.",
      "isCommentAutoGenerated" : true
    },
    "Web Extract" : {
      "localizations" : {
        "de" : {
@@ -23786,6 +24104,10 @@
    },
    "Where should this project live?" : {
    },
    "Will be saved to the Keychain on commit." : {
      "comment" : "A description of a secret field that will be saved to the Keychain on commit.",
      "isCommentAutoGenerated" : true
    },
    "Working" : {
      "localizations" : {
@@ -23836,6 +24158,10 @@
    "Your name" : {
      "comment" : "A label for the user's name.",
      "isCommentAutoGenerated" : true
    },
    "Your tools will now route through your subscription." : {
      "comment" : "A description of the success state of the",
      "isCommentAutoGenerated" : true
    }
  },
  "version" : "1.1"
@@ -50,7 +50,7 @@ enum SidebarSection: String, CaseIterable, Identifiable {
        case .profiles: return "Profiles"
        case .tools: return "Tools"
        case .mcpServers: return "MCP Servers"
-        case .gateway: return "Gateway"
+        case .gateway: return "Messaging Gateway"
        case .cron: return "Cron"
        case .health: return "Health"
        case .logs: return "Logs"
@@ -91,4 +91,15 @@ final class AppCoordinator {
    var selectedSection: SidebarSection = .dashboard
    var selectedSessionId: String?
    var selectedProjectName: String?
    /// When non-nil, ChatView should start a fresh ACP session with
    /// this absolute project path as cwd and then clear the value.
    /// Wired from the per-project Sessions tab's "New Chat" button
    /// (v2.3): the tab sets this, switches `selectedSection` to
    /// `.chat`, and ChatView reacts on its next render.
    ///
    /// Separate from `selectedSessionId` (which resumes an existing
    /// session) — a new session needs a cwd override Scarf doesn't
    /// yet have an id for.
    var pendingProjectChat: String?
 }
@@ -2,6 +2,7 @@ import SwiftUI
 struct SidebarView: View {
    @Environment(AppCoordinator.self) private var coordinator
    @Environment(\.serverContext) private var serverContext
    var body: some View {
        @Bindable var coordinator = coordinator
@@ -59,6 +60,6 @@ struct SidebarView: View {
        }
        .listStyle(.sidebar)
        .navigationTitle("Scarf")
-        .splitViewAutosaveName("ScarfMainSidebar")
+        .splitViewAutosaveName("ScarfMainSidebar.\(serverContext.id)")
    }
 }
@@ -86,6 +86,19 @@ struct ScarfApp: App {
            registry.defaultServerID
        }
        .defaultSize(width: 1100, height: 700)
        // Without an explicit resizability, `WindowGroup` defaults to
        // `.automatic` which on macOS evaluates to `.contentSize` —
        // meaning the window is BOUND to its content's ideal size
        // rather than bounded-below by it. Any section whose content's
        // intrinsic height changes (Chat's message list, the v2.3
        // per-project Sessions tab, Insights charts) would resize the
        // window on every section switch, snap back against user
        // resize, and sometimes push the whole window past the
        // screen. `.contentMinSize` turns the content's ideal height
        // into a minimum floor: user resize works freely, the window
        // stays put across section switches, and it still can't shrink
        // smaller than a section's minimum render.
        .windowResizability(.contentMinSize)
        .commands {
            CommandGroup(after: .appInfo) {
                Button("Check for Updates…") { updater.checkForUpdates() }
@@ -365,7 +378,7 @@ struct MenuBarMenu: View {
                systemImage: status.hermesRunning ? "circle.fill" : "circle"
            )
            Label(
-                status.gatewayRunning ? "Gateway Running" : "Gateway Stopped",
+                status.gatewayRunning ? "Messaging Gateway Running" : "Messaging Gateway Stopped",
                systemImage: status.gatewayRunning ? "circle.fill" : "circle"
            )
            Button("Start Hermes") { status.startHermes() }
@@ -0,0 +1,84 @@
 import Testing
 import Foundation
@testable import scarf
 /// Tests that ``CredentialPoolsOAuthGate`` steers each known provider to
 /// the right OAuth flow. The regression this prevents: a user hitting the
 /// "Start OAuth" button for nous / openai-codex / qwen-oauth /
 /// google-gemini-cli / copilot-acp and watching the UI stall silently.
@Suite struct CredentialPoolsGatingTests {
    /// Synthesize a ModelCatalogService over a minimal fixture cache so
    /// tests don't depend on the live `~/.hermes/models_dev_cache.json`.
    private func makeCatalog() throws -> ModelCatalogService {
        let dir = FileManager.default.temporaryDirectory.appendingPathComponent("scarf-cpgate-\(UUID().uuidString)")
        try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
        let path = dir.appendingPathComponent("models_dev_cache.json").path
        // Include anthropic so the .ok path has a recognizable provider.
        let json = """
        {
          "anthropic": {
            "name": "Anthropic",
            "models": { "claude-sonnet-4-5": { "name": "Claude Sonnet 4.5" } }
          }
        }
        """
        try json.write(toFile: path, atomically: true, encoding: .utf8)
        return ModelCatalogService(path: path)
    }
    @Test func nousRoutesToDedicatedSignInFlow() throws {
        let catalog = try makeCatalog()
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "nous", catalog: catalog) == .useNousSignIn)
        // Whitespace + case insensitivity should also work — users who type
        // "Nous " shouldn't fall through to the generic flow.
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "  Nous  ", catalog: catalog) == .useNousSignIn)
    }
    @Test func deviceCodeAndExternalProvidersRouteToCLI() throws {
        let catalog = try makeCatalog()
        // `openai-codex` is .oauthExternal in the overlay table.
        if case .useCLI(let provider) = CredentialPoolsOAuthGate.resolve(providerID: "openai-codex", catalog: catalog) {
            #expect(provider == "openai-codex")
        } else {
            Issue.record("openai-codex should route to .useCLI")
        }
        // `qwen-oauth` is .oauthExternal.
        if case .useCLI = CredentialPoolsOAuthGate.resolve(providerID: "qwen-oauth", catalog: catalog) {
            // ok
        } else {
            Issue.record("qwen-oauth should route to .useCLI")
        }
        // `google-gemini-cli` is .oauthExternal.
        if case .useCLI = CredentialPoolsOAuthGate.resolve(providerID: "google-gemini-cli", catalog: catalog) {
            // ok
        } else {
            Issue.record("google-gemini-cli should route to .useCLI")
        }
        // `copilot-acp` is .externalProcess.
        if case .useCLI = CredentialPoolsOAuthGate.resolve(providerID: "copilot-acp", catalog: catalog) {
            // ok
        } else {
            Issue.record("copilot-acp should route to .useCLI")
        }
    }
    @Test func pkceProvidersPassThroughAsOK() throws {
        let catalog = try makeCatalog()
        // Anthropic is a standard PKCE provider in Hermes — must not be gated.
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "anthropic", catalog: catalog) == .ok)
    }
    @Test func unknownProvidersDefaultToOK() throws {
        let catalog = try makeCatalog()
        // Providers we don't know about shouldn't be blocked — users with
        // custom setups need the escape hatch.
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "custom-provider-xyz", catalog: catalog) == .ok)
    }
    @Test func emptyProviderReturnsProviderEmpty() throws {
        let catalog = try makeCatalog()
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "", catalog: catalog) == .providerEmpty)
        #expect(CredentialPoolsOAuthGate.resolve(providerID: "   ", catalog: catalog) == .providerEmpty)
    }
 }
@@ -0,0 +1,109 @@
 import Testing
 import Foundation
@testable import scarf
 /// Unit tests for the pure parsers in ``NousAuthFlow``. The subprocess side
 /// of the flow is covered by manual end-to-end testing against a live
 /// hermes install — parser behavior is what we can pin here.
@Suite struct NousAuthFlowParserTests {
    // MARK: - Device-code block
    @Test func parsesVerificationURLAndUserCode() throws {
        let text = """
        Requesting device code from Nous Portal...
        To continue:
          1. Open: https://portal.nousresearch.com/device/ABCD-EFGH
          2. If prompted, enter code: ABCD-EFGH
        Waiting for approval (polling every 1s)...
        """
        let result = try #require(NousAuthFlow.parseDeviceCode(from: text))
        #expect(result.verificationURL.absoluteString == "https://portal.nousresearch.com/device/ABCD-EFGH")
        #expect(result.userCode == "ABCD-EFGH")
    }
    @Test func ignoresNoiseBetweenExpectedLines() throws {
        // Hermes may log unrelated diagnostics between or after the two
        // expected lines. The parser anchors on line-start regex so noise
        // above, below, or even intermixed shouldn't block it.
        let text = """
        [DEBUG] some internal log line
        To continue:
          1. Open: https://portal.nousresearch.com/device/WXYZ-1234
        [DEBUG] another log line
          2. If prompted, enter code: WXYZ-1234
        extra trailing noise
        """
        let result = try #require(NousAuthFlow.parseDeviceCode(from: text))
        #expect(result.userCode == "WXYZ-1234")
    }
    @Test func returnsNilWhenUserCodeLineMissing() {
        let text = """
        To continue:
          1. Open: https://portal.nousresearch.com/device/AAAA-AAAA
        Waiting for approval...
        """
        #expect(NousAuthFlow.parseDeviceCode(from: text) == nil)
    }
    @Test func returnsNilWhenURLLineMissing() {
        let text = """
        To continue:
          2. If prompted, enter code: BBBB-BBBB
        """
        #expect(NousAuthFlow.parseDeviceCode(from: text) == nil)
    }
    @Test func returnsNilOnEmptyInput() {
        #expect(NousAuthFlow.parseDeviceCode(from: "") == nil)
    }
    // MARK: - Subscription-required failure
    @Test func parsesSubscriptionRequiredBillingURL() throws {
        let text = """
        Login successful!
        Your Nous Portal account does not have an active subscription.
          Subscribe here: https://portal.nousresearch.com/billing
        After subscribing, run `hermes model` again to finish setup.
        """
        let url = try #require(NousAuthFlow.parseSubscriptionRequired(from: text))
        #expect(url.absoluteString == "https://portal.nousresearch.com/billing")
    }
    @Test func subscriptionRequiredReturnsNilWithoutMarker() {
        let text = """
        hermes: something else went wrong
        Subscribe here: https://example.com/billing
        """
        // The "Subscribe here:" URL alone isn't enough — we require the
        // specific subscription-required sentinel so we don't misclassify
        // unrelated errors as subscription failures.
        #expect(NousAuthFlow.parseSubscriptionRequired(from: text) == nil)
    }
    @Test func subscriptionRequiredReturnsNilWhenBillingURLMissing() {
        let text = """
        Your Nous Portal account does not have an active subscription.
        (no subscribe here line)
        """
        #expect(NousAuthFlow.parseSubscriptionRequired(from: text) == nil)
    }
    // MARK: - State equality
    @Test func stateEnumEquatableDistinguishesCases() {
        let u = URL(string: "https://example.com")!
        let a: NousAuthFlow.State = .waitingForApproval(userCode: "X", verificationURL: u)
        let b: NousAuthFlow.State = .waitingForApproval(userCode: "X", verificationURL: u)
        let c: NousAuthFlow.State = .waitingForApproval(userCode: "Y", verificationURL: u)
        #expect(a == b)
        #expect(a != c)
        #expect(NousAuthFlow.State.idle != NousAuthFlow.State.starting)
        #expect(NousAuthFlow.State.success != NousAuthFlow.State.failure(reason: "", billingURL: nil))
    }
 }
@@ -0,0 +1,260 @@
 import Testing
 import Foundation
@testable import scarf
 /// Exercises the Scarf-managed AGENTS.md marker block logic added in
 /// v2.3. Tests operate on isolated temp directories — no dependency
 /// on ~/.hermes contents, no cross-suite lock needed.
@Suite struct ProjectAgentContextServiceTests {
    // MARK: - applyBlock pure-text transform
    @Test func applyBlockPrependsWhenNoMarkersPresent() {
        let existing = "# My Template\n\nSome instructions.\n"
        let block = "<!-- scarf-project:begin -->\nhello\n<!-- scarf-project:end -->"
        let result = ProjectAgentContextService.applyBlock(block: block, to: existing)
        #expect(result.hasPrefix("<!-- scarf-project:begin -->"))
        #expect(result.contains("<!-- scarf-project:end -->"))
        #expect(result.contains("# My Template"))
        #expect(result.contains("Some instructions."))
        // Exactly one blank line between block and original content.
        #expect(result.contains("<!-- scarf-project:end -->\n\n# My Template"))
    }
    @Test func applyBlockWritesFreshFileWhenEmpty() {
        let block = "<!-- scarf-project:begin -->\nhello\n<!-- scarf-project:end -->"
        let result = ProjectAgentContextService.applyBlock(block: block, to: "")
        // Empty input → just the block + trailing newline; no weird
        // leading whitespace.
        #expect(result == block + "\n")
    }
    @Test func applyBlockReplacesExistingMarkerRegion() {
        let existing = """
        <!-- scarf-project:begin -->
        old content line 1
        old content line 2
        <!-- scarf-project:end -->
        # Template docs preserved
        Template behavior.
        """
        let newBlock = "<!-- scarf-project:begin -->\nfresh content\n<!-- scarf-project:end -->"
        let result = ProjectAgentContextService.applyBlock(block: newBlock, to: existing)
        #expect(result.contains("fresh content"))
        // Old content is gone.
        #expect(!result.contains("old content line 1"))
        #expect(!result.contains("old content line 2"))
        // Template content outside markers is preserved.
        #expect(result.contains("# Template docs preserved"))
        #expect(result.contains("Template behavior."))
    }
    @Test func applyBlockIsIdempotent() {
        let existing = "# Project\n\nContent.\n"
        let block = "<!-- scarf-project:begin -->\nv1\n<!-- scarf-project:end -->"
        let once = ProjectAgentContextService.applyBlock(block: block, to: existing)
        let twice = ProjectAgentContextService.applyBlock(block: block, to: once)
        #expect(once == twice)
    }
    @Test func applyBlockOrphanedBeginMarkerFallsBackToPrepend() {
        // Stray begin with no end: treat as "no well-formed block,"
        // prepend. Leaves the orphan in place — it was probably
        // hand-typed, not a corrupt Scarf write. Conservative.
        let existing = "<!-- scarf-project:begin -->\nstray text with no end marker\n"
        let block = "<!-- scarf-project:begin -->\nnew\n<!-- scarf-project:end -->"
        let result = ProjectAgentContextService.applyBlock(block: block, to: existing)
        #expect(result.hasPrefix("<!-- scarf-project:begin -->\nnew\n<!-- scarf-project:end -->"))
        #expect(result.contains("stray text with no end marker"))
    }
    // MARK: - renderBlock content
    @Test func renderBlockIncludesProjectIdentity() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let project = ProjectEntry(name: "My Project", path: dir)
        let svc = ProjectAgentContextService(context: .local)
        let block = svc.renderBlock(for: project)
        #expect(block.contains(ProjectAgentContextService.beginMarker))
        #expect(block.contains(ProjectAgentContextService.endMarker))
        #expect(block.contains("\"My Project\""))
        #expect(block.contains(dir))
        #expect(block.contains("dashboard.json"))
    }
    @Test func renderBlockOmitsTemplateSectionForBareProject() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let project = ProjectEntry(name: "Bare", path: dir)
        let svc = ProjectAgentContextService(context: .local)
        let block = svc.renderBlock(for: project)
        #expect(!block.contains("**Template:**"))
        #expect(block.contains("**Configuration fields:** (none)"))
    }
    @Test func renderBlockIncludesTemplateWhenManifestPresent() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let scarfDir = dir + "/.scarf"
        try FileManager.default.createDirectory(atPath: scarfDir, withIntermediateDirectories: true)
        // Minimal valid v1 manifest — no config schema.
        let manifest = """
        {
          "schemaVersion": 1,
          "id": "author/example",
          "name": "Example",
          "version": "1.2.3",
          "description": "…",
          "contents": { "dashboard": true, "agentsMd": true }
        }
        """
        try manifest.data(using: .utf8)!.write(to: URL(fileURLWithPath: scarfDir + "/manifest.json"))
        let project = ProjectEntry(name: "Example", path: dir)
        let svc = ProjectAgentContextService(context: .local)
        let block = svc.renderBlock(for: project)
        #expect(block.contains("**Template:** `author/example` v1.2.3"))
    }
    @Test func renderBlockListsConfigFieldNamesNotValues() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let scarfDir = dir + "/.scarf"
        try FileManager.default.createDirectory(atPath: scarfDir, withIntermediateDirectories: true)
        // Schema-bearing manifest with one string field and one secret.
        let manifest = """
        {
          "schemaVersion": 2,
          "id": "x/y",
          "name": "Y",
          "version": "1.0.0",
          "description": "…",
          "contents": { "dashboard": true, "agentsMd": true, "config": 2 },
          "config": {
            "schema": [
              { "key": "site_url", "type": "string", "label": "Site URL", "required": true },
              { "key": "api_token", "type": "secret", "label": "API Token", "required": true }
            ]
          }
        }
        """
        try manifest.data(using: .utf8)!.write(to: URL(fileURLWithPath: scarfDir + "/manifest.json"))
        // A config.json with a "secret" VALUE — the block must NOT
        // echo this value. If it does, secrets leak into an agent-
        // readable file, which is exactly the thing to avoid.
        let configJSON = """
        {
          "schemaVersion": 2,
          "templateId": "x/y",
          "values": {
            "site_url": { "type": "string", "value": "https://example.com" },
            "api_token": { "type": "keychainRef", "uri": "keychain://com.scarf.template.x-y/api_token:abc123" }
          },
          "updatedAt": "2026-04-24T00:00:00Z"
        }
        """
        try configJSON.data(using: .utf8)!.write(to: URL(fileURLWithPath: scarfDir + "/config.json"))
        let project = ProjectEntry(name: "Y", path: dir)
        let svc = ProjectAgentContextService(context: .local)
        let block = svc.renderBlock(for: project)
        // Field names present with type hints.
        #expect(block.contains("`site_url`"))
        #expect(block.contains("`api_token`"))
        #expect(block.contains("(secret — name only, value stored in Keychain)"))
        // CRITICAL: no VALUES appear — not the site URL, not the
        // keychain ref. The block is safe to drop into an agent
        // context.
        #expect(!block.contains("https://example.com"))
        #expect(!block.contains("keychain://"))
        #expect(!block.contains("abc123"))
    }
    // MARK: - refresh end-to-end (temp dir on local filesystem)
    @Test func refreshCreatesAGENTSMdWhenMissing() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let project = ProjectEntry(name: "Fresh", path: dir)
        try ProjectAgentContextService(context: .local).refresh(for: project)
        let agentsMd = dir + "/AGENTS.md"
        #expect(FileManager.default.fileExists(atPath: agentsMd))
        let contents = try String(contentsOf: URL(fileURLWithPath: agentsMd))
        #expect(contents.contains(ProjectAgentContextService.beginMarker))
        #expect(contents.contains(ProjectAgentContextService.endMarker))
        #expect(contents.contains("\"Fresh\""))
    }
    @Test func refreshPreservesUserContentBelow() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let agentsMd = dir + "/AGENTS.md"
        let userContent = "# Template\n\nDo the thing.\n"
        try userContent.data(using: .utf8)!.write(to: URL(fileURLWithPath: agentsMd))
        let project = ProjectEntry(name: "Preserved", path: dir)
        try ProjectAgentContextService(context: .local).refresh(for: project)
        let after = try String(contentsOf: URL(fileURLWithPath: agentsMd))
        #expect(after.contains(ProjectAgentContextService.beginMarker))
        #expect(after.contains("# Template"))
        #expect(after.contains("Do the thing."))
        // Block goes FIRST; user content follows.
        let beginIdx = after.range(of: ProjectAgentContextService.beginMarker)!.lowerBound
        let userIdx = after.range(of: "# Template")!.lowerBound
        #expect(beginIdx < userIdx)
    }
    @Test func refreshIsFullyIdempotent() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let project = ProjectEntry(name: "Twice", path: dir)
        let svc = ProjectAgentContextService(context: .local)
        try svc.refresh(for: project)
        let first = try Data(contentsOf: URL(fileURLWithPath: dir + "/AGENTS.md"))
        try svc.refresh(for: project)
        let second = try Data(contentsOf: URL(fileURLWithPath: dir + "/AGENTS.md"))
        #expect(first == second)
    }
    @Test func refreshRewritesStaleBlock() throws {
        let dir = try Self.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: dir) }
        let agentsMd = dir + "/AGENTS.md"
        // Pre-seed a stale Scarf block with a different project name
        // and a user section below.
        let seed = """
        <!-- scarf-project:begin -->
        Old stale content — project was called "Something Else".
        <!-- scarf-project:end -->
        # Template
        """
        try seed.data(using: .utf8)!.write(to: URL(fileURLWithPath: agentsMd))
        let project = ProjectEntry(name: "Current Name", path: dir)
        try ProjectAgentContextService(context: .local).refresh(for: project)
        let after = try String(contentsOf: URL(fileURLWithPath: agentsMd))
        #expect(after.contains("\"Current Name\""))
        #expect(!after.contains("Something Else"))
        #expect(after.contains("# Template"))
    }
    // MARK: - Helpers
    nonisolated static func makeTempDir() throws -> String {
        let dir = NSTemporaryDirectory() + "scarf-project-context-test-" + UUID().uuidString
        try FileManager.default.createDirectory(atPath: dir, withIntermediateDirectories: true)
        return dir
    }
 }
@@ -0,0 +1,129 @@
 import Testing
 import Foundation
@testable import scarf
 /// v2.3 grew `ProjectEntry` with `folder` and `archived` fields.
 /// Both are optional/defaulted at the decoder so v2.2-era
 /// `~/.hermes/scarf/projects.json` files still parse cleanly, and
 /// v2.3-written files are forward-compatible with v2.2 readers
 /// (which ignore unknown keys). These tests lock in both ends of
 /// that contract.
 ///
 /// No disk or Hermes dependency — we work entirely with in-memory
 /// `Data`, so the `TestRegistryLock` from `ProjectTemplateTests` isn't
 /// needed. Safe to run in parallel with every other test suite.
@Suite struct ProjectRegistryMigrationTests {
    @Test func decodesV22RegistryWithoutNewFields() throws {
        // v2.2-era file: just name + path. No folder, no archived.
        let json = """
        {
          "projects": [
            { "name": "Legacy", "path": "/Users/x/legacy" },
            { "name": "Another", "path": "/Users/x/another" }
          ]
        }
        """.data(using: .utf8)!
        let registry = try JSONDecoder().decode(ProjectRegistry.self, from: json)
        #expect(registry.projects.count == 2)
        #expect(registry.projects[0].name == "Legacy")
        #expect(registry.projects[0].path == "/Users/x/legacy")
        // Defaults hydrate for absent v2.3 fields.
        #expect(registry.projects[0].folder == nil)
        #expect(registry.projects[0].archived == false)
    }
    @Test func decodesV23RegistryWithFolderAndArchived() throws {
        let json = """
        {
          "projects": [
            { "name": "Client A", "path": "/Users/x/a", "folder": "Clients" },
            { "name": "Client B", "path": "/Users/x/b", "folder": "Clients", "archived": true },
            { "name": "Personal", "path": "/Users/x/p" }
          ]
        }
        """.data(using: .utf8)!
        let registry = try JSONDecoder().decode(ProjectRegistry.self, from: json)
        #expect(registry.projects.count == 3)
        #expect(registry.projects[0].folder == "Clients")
        #expect(registry.projects[0].archived == false)
        #expect(registry.projects[1].folder == "Clients")
        #expect(registry.projects[1].archived == true)
        #expect(registry.projects[2].folder == nil)
        #expect(registry.projects[2].archived == false)
    }
    @Test func encodeOmitsDefaultedFields() throws {
        // A top-level, non-archived project should encode with ONLY
        // name + path keys. This keeps v2.3-written registries
        // loadable by v2.2 Scarf (which ignores unknown keys), and
        // keeps the file clean for the common case.
        let entry = ProjectEntry(name: "Plain", path: "/Users/x/plain")
        let encoder = JSONEncoder()
        encoder.outputFormatting = [.sortedKeys]
        let data = try encoder.encode(entry)
        let s = try #require(String(data: data, encoding: .utf8))
        #expect(s == #"{"name":"Plain","path":"\/Users\/x\/plain"}"#)
    }
    @Test func encodeIncludesFolderWhenPresent() throws {
        let entry = ProjectEntry(name: "Acme", path: "/a", folder: "Clients")
        let encoder = JSONEncoder()
        encoder.outputFormatting = [.sortedKeys]
        let data = try encoder.encode(entry)
        let s = try #require(String(data: data, encoding: .utf8))
        #expect(s.contains(#""folder":"Clients""#))
        // archived still omitted when false — cleanliness matters.
        #expect(!s.contains(#""archived""#))
    }
    @Test func encodeIncludesArchivedOnlyWhenTrue() throws {
        let archived = ProjectEntry(name: "Old", path: "/o", archived: true)
        let encoder = JSONEncoder()
        encoder.outputFormatting = [.sortedKeys]
        let data = try encoder.encode(archived)
        let s = try #require(String(data: data, encoding: .utf8))
        #expect(s.contains(#""archived":true"#))
        let active = ProjectEntry(name: "New", path: "/n", archived: false)
        let data2 = try encoder.encode(active)
        let s2 = try #require(String(data: data2, encoding: .utf8))
        #expect(!s2.contains(#""archived""#))
    }
    @Test func roundTripPreservesAllFields() throws {
        let original = ProjectRegistry(projects: [
            ProjectEntry(name: "Top", path: "/t"),
            ProjectEntry(name: "InFolder", path: "/f", folder: "Work"),
            ProjectEntry(name: "ArchivedTop", path: "/a", archived: true),
            ProjectEntry(name: "ArchivedInFolder", path: "/af", folder: "Work", archived: true)
        ])
        let encoded = try JSONEncoder().encode(original)
        let decoded = try JSONDecoder().decode(ProjectRegistry.self, from: encoded)
        #expect(decoded.projects.count == 4)
        #expect(decoded.projects[0].folder == nil && decoded.projects[0].archived == false)
        #expect(decoded.projects[1].folder == "Work" && decoded.projects[1].archived == false)
        #expect(decoded.projects[2].folder == nil && decoded.projects[2].archived == true)
        #expect(decoded.projects[3].folder == "Work" && decoded.projects[3].archived == true)
    }
    @Test func identityStaysKeyedOnName() throws {
        // ProjectEntry.id should remain `name`, so selecting by id
        // across a folder-move or archive-flip still works without
        // a reselection step.
        let a = ProjectEntry(name: "Foo", path: "/p")
        let b = ProjectEntry(name: "Foo", path: "/p", folder: "Clients")
        let c = ProjectEntry(name: "Foo", path: "/p", archived: true)
        #expect(a.id == "Foo")
        #expect(b.id == "Foo")
        #expect(c.id == "Foo")
        #expect(a.id == b.id)
        #expect(a.id == c.id)
    }
 }
@@ -2,6 +2,42 @@ import Testing
 import Foundation
@testable import scarf
 /// Cross-suite serialization lock for tests that touch the real
 /// `~/.hermes/scarf/projects.json`. Swift Testing's `.serialized` trait
 /// only serializes tests WITHIN a suite — multiple suites still run in
 /// parallel. Three suites in this file write to the same file and
 /// previously raced each other silently (saveRegistry used to swallow
 /// write failures); now that saveRegistry throws, the race surfaces.
 ///
 /// The lock is acquired by `acquireAndSnapshot()` at the top of each
 /// registry-touching test and released by `restore(_:)` via the test's
 /// `defer`. Asymmetric acquire-in-one-fn / release-in-another looks
 /// unusual but the snapshot/restore pairing is so tight (every test
 /// defers the restore) that it's reliable in practice.
 final class TestRegistryLock: @unchecked Sendable {
    static let shared = TestRegistryLock()
    private let lock = NSLock()
    /// Acquire the cross-suite lock and snapshot the registry. Pair
    /// every call with a `defer { TestRegistryLock.restore(snapshot) }`.
    static func acquireAndSnapshot() -> Data? {
        shared.lock.lock()
        let path = ServerContext.local.paths.projectsRegistry
        return try? Data(contentsOf: URL(fileURLWithPath: path))
    }
    /// Restore the registry from snapshot and release the lock.
    static func restore(_ snapshot: Data?) {
        defer { shared.lock.unlock() }
        let path = ServerContext.local.paths.projectsRegistry
        if let snapshot {
            try? snapshot.write(to: URL(fileURLWithPath: path))
        } else {
            try? FileManager.default.removeItem(atPath: path)
        }
    }
 }
 /// Exercises the service's ability to unpack, parse, and validate bundles.
 /// Doesn't touch the installer — see `ProjectTemplateInstallerTests` — so
 /// these don't need write access to ~/.hermes.
@@ -346,23 +382,69 @@ import Foundation
        }
    }
    // MARK: - Cron prompt token substitution
    @Test func substituteCronTokensResolvesProjectDir() throws {
        let plan = try TemplateInstallerViewModelTests.makePlanWithConfigSchema()
        let raw = "Read {{PROJECT_DIR}}/.scarf/config.json"
        let resolved = ProjectTemplateInstaller.substituteCronTokens(raw, plan: plan)
        #expect(resolved == "Read \(plan.projectDir)/.scarf/config.json")
        // Original placeholder must be fully replaced — a lingering
        // {{PROJECT_DIR}} would leave the cron job trying to read a
        // literal file named `{{PROJECT_DIR}}` which doesn't exist.
        #expect(resolved.contains("{{PROJECT_DIR}}") == false)
    }
    @Test func substituteCronTokensResolvesIdAndSlug() throws {
        let plan = try TemplateInstallerViewModelTests.makePlanWithConfigSchema()
        let raw = "Log as {{TEMPLATE_ID}} (slug {{TEMPLATE_SLUG}})"
        let resolved = ProjectTemplateInstaller.substituteCronTokens(raw, plan: plan)
        #expect(resolved.contains(plan.manifest.id))
        #expect(resolved.contains(plan.manifest.slug))
        #expect(resolved.contains("{{TEMPLATE_ID}}") == false)
        #expect(resolved.contains("{{TEMPLATE_SLUG}}") == false)
    }
    @Test func substituteCronTokensLeavesUnknownTokensUntouched() throws {
        let plan = try TemplateInstallerViewModelTests.makePlanWithConfigSchema()
        let raw = "{{PROJECT_DIR}} but keep {{UNSUPPORTED}} literal"
        let resolved = ProjectTemplateInstaller.substituteCronTokens(raw, plan: plan)
        #expect(resolved.contains(plan.projectDir))
        // Unsupported placeholders pass through verbatim — template
        // authors will notice in testing that their token didn't get
        // replaced and either use a supported one or request a new one.
        #expect(resolved.contains("{{UNSUPPORTED}}"))
    }
    @Test func substituteCronTokensRepeatsWithinString() throws {
        let plan = try TemplateInstallerViewModelTests.makePlanWithConfigSchema()
        let raw = "Read {{PROJECT_DIR}}/a and write {{PROJECT_DIR}}/b"
        let resolved = ProjectTemplateInstaller.substituteCronTokens(raw, plan: plan)
        // Both occurrences should be replaced — not just the first.
        // A single-replace bug here would leave the second relative,
        // causing the same CWD issue this whole feature was meant to
        // fix.
        let count = resolved.components(separatedBy: plan.projectDir).count - 1
        #expect(count == 2)
    }
    // MARK: - Registry snapshot helpers
    /// Read the raw bytes of the current projects.json so we can restore
    /// it byte-for-byte after the test. `nil` means the file didn't exist
    /// — restore by deleting whatever got created.
    // Delegates to TestRegistryLock so tests across this suite + the
    // two other registry-touching suites share one lock. Every
    // `snapshotRegistry()` call acquires; the paired
    // `restoreRegistry(_:)` defer releases. Without this, parallel
    // test runs race on `~/.hermes/scarf/projects.json` writes and
    // the saveRegistry throw surfaces the collision as a test failure.
    nonisolated private static func snapshotRegistry() -> Data? {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.acquireAndSnapshot()
        return try? Data(contentsOf: URL(fileURLWithPath: path))
    }
    nonisolated private static func restoreRegistry(_ snapshot: Data?) {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.restore(snapshot)
        if let snapshot {
            try? snapshot.write(to: URL(fileURLWithPath: path))
        } else {
            try? FileManager.default.removeItem(atPath: path)
        }
    }
 }
@@ -476,18 +558,18 @@ import Foundation
    // ProjectTemplateInstallerTests — small helper, not worth a shared
    // fixture file for one more suite).
    // Delegates to TestRegistryLock so tests across this suite + the
    // two other registry-touching suites share one lock. Every
    // `snapshotRegistry()` call acquires; the paired
    // `restoreRegistry(_:)` defer releases. Without this, parallel
    // test runs race on `~/.hermes/scarf/projects.json` writes and
    // the saveRegistry throw surfaces the collision as a test failure.
    nonisolated private static func snapshotRegistry() -> Data? {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.acquireAndSnapshot()
        return try? Data(contentsOf: URL(fileURLWithPath: path))
    }
    nonisolated private static func restoreRegistry(_ snapshot: Data?) {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.restore(snapshot)
        if let snapshot {
            try? snapshot.write(to: URL(fileURLWithPath: path))
        } else {
            try? FileManager.default.removeItem(atPath: path)
        }
    }
 }
@@ -753,18 +835,123 @@ import Foundation
    // MARK: - Registry snapshot helpers (dup'd from ProjectTemplateInstallerTests)
    // Delegates to TestRegistryLock so tests across this suite + the
    // two other registry-touching suites share one lock. Every
    // `snapshotRegistry()` call acquires; the paired
    // `restoreRegistry(_:)` defer releases. Without this, parallel
    // test runs race on `~/.hermes/scarf/projects.json` writes and
    // the saveRegistry throw surfaces the collision as a test failure.
    nonisolated private static func snapshotRegistry() -> Data? {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.acquireAndSnapshot()
        return try? Data(contentsOf: URL(fileURLWithPath: path))
    }
    nonisolated private static func restoreRegistry(_ snapshot: Data?) {
-        let path = ServerContext.local.paths.projectsRegistry
+        TestRegistryLock.restore(snapshot)
        if let snapshot {
            try? snapshot.write(to: URL(fileURLWithPath: path))
        } else {
            try? FileManager.default.removeItem(atPath: path)
    }
 }
 /// State-machine tests for `TemplateInstallerViewModel`. The install
 /// flow's configure step is driven entirely through the VM — the view
 /// transitions `.awaitingParentDirectory → .awaitingConfig → .planned`
 /// based on `submitConfig(values:)` / `cancelConfig()` calls. If those
 /// transitions break, the user lands on the wrong sheet stage (or no
 /// sheet at all, as in the v1.1.0 regression where the config sheet's
 /// internal `dismiss()` tore down the outer install sheet before
 /// submitConfig had a chance to fire).
@Suite(.serialized) @MainActor struct TemplateInstallerViewModelTests {
    @Test func submitConfigStashesValuesAndTransitionsToPlanned() throws {
        let vm = TemplateInstallerViewModel(context: .local)
        // Seed the VM with an awaiting-config plan (schema-ful).
        let plan = try Self.makePlanWithConfigSchema()
        vm.plan = plan
        vm.stage = .awaitingConfig
        let values: [String: TemplateConfigValue] = [
            "site_url": .string("https://example.com")
        ]
        vm.submitConfig(values: values)
        // Stage must advance past the configure step, values must land
        // on the plan where install() will pick them up.
        if case .planned = vm.stage {
            // ok
        } else {
            Issue.record("expected .planned, got \(vm.stage)")
        }
        #expect(vm.plan?.configValues["site_url"] == .string("https://example.com"))
    }
    @Test func cancelConfigReturnsToAwaitingParentDirectory() throws {
        let vm = TemplateInstallerViewModel(context: .local)
        vm.plan = try Self.makePlanWithConfigSchema()
        vm.stage = .awaitingConfig
        vm.cancelConfig()
        if case .awaitingParentDirectory = vm.stage {
            // ok — user can re-pick the parent dir or fully cancel
        } else {
            Issue.record("expected .awaitingParentDirectory, got \(vm.stage)")
        }
        // Plan is preserved so re-entering the configure step doesn't
        // re-run buildPlan.
        #expect(vm.plan != nil)
    }
    @Test func submitConfigNoOpWhenPlanIsNil() {
        let vm = TemplateInstallerViewModel(context: .local)
        vm.plan = nil
        vm.stage = .awaitingConfig
        vm.submitConfig(values: ["k": .string("v")])
        // With no plan, the call should be silent — no crash, stage
        // stays where it was. (Defensive guard in submitConfig.)
        if case .awaitingConfig = vm.stage {
            // ok
        } else {
            Issue.record("expected stage to remain .awaitingConfig when plan is nil; got \(vm.stage)")
        }
    }
    // MARK: - Fixture
    /// Build a `TemplateInstallPlan` carrying a single-field config
    /// schema. Exists as a local helper rather than a shared one
    /// because no other suite needs it.
    nonisolated static func makePlanWithConfigSchema() throws -> TemplateInstallPlan {
        let schema = TemplateConfigSchema(
            fields: [
                .init(key: "site_url", type: .string, label: "Site URL",
                      description: nil, required: true, placeholder: nil,
                      defaultValue: nil, options: nil, minLength: nil,
                      maxLength: nil, pattern: nil, minNumber: nil,
                      maxNumber: nil, step: nil, itemType: nil,
                      minItems: nil, maxItems: nil)
            ],
            modelRecommendation: nil
        )
        let manifest = ProjectTemplateServiceTests.sampleManifest(
            id: "tester/vm-transitions",
            configSchema: schema
        )
        let tmp = try ProjectTemplateServiceTests.makeTempDir()
        // Not a real bundle dir — we never unzip or install from this
        // plan, we only test state transitions that don't touch disk.
        return TemplateInstallPlan(
            manifest: manifest,
            unpackedDir: tmp,
            projectDir: tmp + "/project",
            projectFiles: [],
            skillsNamespaceDir: nil,
            skillsFiles: [],
            cronJobs: [],
            memoryAppendix: nil,
            memoryPath: ServerContext.local.paths.memoryMD,
            projectRegistryName: "VM Transitions",
            configSchema: schema,
            configValues: [:],
            manifestCachePath: tmp + "/project/.scarf/manifest.json"
        )
    }
 }
@@ -832,7 +1019,9 @@ import Foundation
        let dashboardData = try Data(contentsOf: URL(fileURLWithPath: dashboardPath))
        let dashboard = try JSONDecoder().decode(ProjectDashboard.self, from: dashboardData)
        #expect(dashboard.title == "Site Status")
-        #expect(dashboard.sections.count == 3)
+        // Four sections: Current Status (stats), Watched Sites (list),
        // Live Site Preview (webview — drives the Site tab), How to Use (text).
        #expect(dashboard.sections.count == 4)
        // First section should have three stat widgets that the cron job
        // updates by value. Assert titles + types so the AGENTS.md contract
@@ -844,15 +1033,96 @@ import Foundation
        #expect(statTitles.contains("Sites Down"))
        #expect(statTitles.contains("Last Checked"))
        // Live Site Preview section must contain exactly one webview
        // widget. The presence of any webview widget is what makes Scarf
        // expose the Site tab next to Dashboard, so losing this section
        // would silently drop a user-visible feature. The cron job
        // rewrites this widget's `url` to the first configured site on
        // every run — AGENTS.md documents the contract.
        let previewSection = dashboard.sections[2]
        #expect(previewSection.title == "Live Site Preview")
        let webviews = previewSection.widgets.filter { $0.type == "webview" }
        #expect(webviews.count == 1)
        #expect(webviews.first?.title == "First Watched Site")
        #expect((webviews.first?.url ?? "").isEmpty == false)
        // Cron prompt references .scarf/config.json (where values.sites
-        // + values.timeout_seconds live) and the dashboard/log it writes.
+        // + values.timeout_seconds live), the dashboard/log it writes,
-        // If either stops being referenced, the cron wouldn't know which
+        // and the {{PROJECT_DIR}} placeholder the installer resolves
-        // data to read or where to write results.
+        // at install time. If either stops being referenced, the cron
        // wouldn't know which data to read or where to write results.
        let cronPrompt = inspection.cronJobs.first?.prompt ?? ""
        #expect(cronPrompt.contains("config.json"))
        #expect(cronPrompt.contains("values.sites"))
        #expect(cronPrompt.contains("dashboard.json"))
        #expect(cronPrompt.contains("status-log.md"))
        // {{PROJECT_DIR}} must remain UNRESOLVED in the bundle — the
        // installer substitutes it at install time. If someone
        // accidentally baked an absolute path into the template, that
        // path would follow every install to every user's machine.
        #expect(cronPrompt.contains("{{PROJECT_DIR}}"))
    }
    /// Exercises the second shipped template — `awizemann/template-author` —
    /// which is a skill-only bundle (no config, no cron, no memory). The
    /// shape is deliberately different from site-status-checker so a
    /// regression in the installer's "no config, no cron" path can't hide
    /// behind the richer example template. Also asserts the skill lands
    /// under the expected namespaced path so Hermes's recursive skill
    /// discovery finds it.
    @Test func templateAuthorParsesAndPlans() throws {
        let bundle = try Self.locateExample(author: "awizemann", name: "template-author")
        let service = ProjectTemplateService(context: .local)
        let inspection = try service.inspect(zipPath: bundle)
        defer { service.cleanupTempDir(inspection.unpackedDir) }
        // Manifest shape: schemaVersion 2 (contains `skills` claim, which
        // wasn't part of v1), no config, no cron, one skill.
        #expect(inspection.manifest.id == "awizemann/template-author")
        #expect(inspection.manifest.name == "Scarf Template Author")
        #expect(inspection.manifest.version == "1.0.0")
        #expect(inspection.manifest.schemaVersion == 2)
        #expect(inspection.manifest.contents.dashboard)
        #expect(inspection.manifest.contents.agentsMd)
        #expect(inspection.manifest.contents.cron == nil)
        #expect(inspection.manifest.contents.config == nil)
        #expect(inspection.manifest.contents.memory == nil)
        #expect(inspection.manifest.contents.skills == ["scarf-template-author"])
        #expect(inspection.manifest.config == nil)
        #expect(inspection.cronJobs.isEmpty)
        // Plan: empty config, empty cron, but one skill queued for install
        // under the template's namespaced dir. The namespace path has to
        // match what the uninstaller wipes — `skills/templates/<slug>` —
        // or uninstall leaves orphan skill files.
        let scratch = try ProjectTemplateServiceTests.makeTempDir()
        defer { try? FileManager.default.removeItem(atPath: scratch) }
        let plan = try service.buildPlan(inspection: inspection, parentDir: scratch)
        #expect(plan.projectDir.hasSuffix("awizemann-template-author"))
        #expect(plan.cronJobs.isEmpty)
        #expect(plan.configSchema == nil)
        #expect(plan.configValues.isEmpty)
        #expect(plan.memoryAppendix == nil)
        // The skill should land at
        // `~/.hermes/skills/templates/awizemann-template-author/scarf-template-author/SKILL.md`
        // — namespace dir + skill folder + SKILL.md. Anything else
        // breaks Hermes's recursive discovery or the uninstaller's
        // `rm -rf` on the namespace dir.
        let namespaceDir = try #require(plan.skillsNamespaceDir)
        #expect(namespaceDir.hasSuffix("/skills/templates/awizemann-template-author"))
        #expect(plan.skillsFiles.count == 1)
        let skillDest = try #require(plan.skillsFiles.first?.destinationPath)
        #expect(skillDest.hasSuffix("/scarf-template-author/SKILL.md"))
        #expect(skillDest.hasPrefix(namespaceDir))
        // No-config templates deliberately skip the manifest cache —
        // the dashboard's Configuration button only shows up when
        // `.scarf/manifest.json` exists, so a skill-only template
        // like this one correctly doesn't surface that button.
        // (See ProjectTemplateService.buildPlan lines 198–227.)
        #expect(plan.manifestCachePath == nil)
    }
    /// Resolve the example bundle path robustly. Unit-test working dirs
@@ -0,0 +1,173 @@
 import Testing
 import Foundation
@testable import scarf
 /// Exercises the v2.3 registry verbs added to ProjectsViewModel:
 /// moveProject, renameProject, archiveProject, unarchiveProject,
 /// + the derived `folders` list. All verbs write through to
 /// `~/.hermes/scarf/projects.json` via ProjectDashboardService, so
 /// each test uses TestRegistryLock to snapshot + restore the real
 /// file. Cross-suite serialization ensures we don't race with other
 /// registry-touching tests.
@MainActor @Suite(.serialized) struct ProjectsViewModelTests {
    @Test func moveProjectSetsFolder() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "Alpha", path: "/a"),
            ProjectEntry(name: "Beta", path: "/b")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        #expect(vm.projects.count == 2)
        vm.moveProject(vm.projects[0], toFolder: "Clients")
        #expect(vm.projects.count == 2)
        #expect(vm.projects.first(where: { $0.name == "Alpha" })?.folder == "Clients")
        #expect(vm.projects.first(where: { $0.name == "Beta" })?.folder == nil)
        // Round-trip: reload from disk and confirm the move persisted.
        let fresh = ProjectDashboardService(context: .local).loadRegistry()
        #expect(fresh.projects.first(where: { $0.name == "Alpha" })?.folder == "Clients")
    }
    @Test func moveProjectToNilReturnsToTopLevel() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "Nested", path: "/n", folder: "Clients")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        vm.moveProject(vm.projects[0], toFolder: nil)
        #expect(vm.projects[0].folder == nil)
        let fresh = ProjectDashboardService(context: .local).loadRegistry()
        #expect(fresh.projects[0].folder == nil)
    }
    @Test func renameProjectUpdatesNameAndPreservesOtherFields() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "OldName", path: "/p", folder: "Work", archived: false)
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        vm.selectProject(vm.projects[0])
        let ok = vm.renameProject(vm.projects[0], to: "NewName")
        #expect(ok == true)
        #expect(vm.projects.count == 1)
        #expect(vm.projects[0].name == "NewName")
        #expect(vm.projects[0].folder == "Work")
        #expect(vm.projects[0].archived == false)
        // Selection follows the rename — the user stays on the same
        // project they were on.
        #expect(vm.selectedProject?.name == "NewName")
    }
    @Test func renameProjectRejectsDuplicateName() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "A", path: "/a"),
            ProjectEntry(name: "B", path: "/b")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        // Renaming A to B should be refused — B already exists.
        let ok = vm.renameProject(vm.projects[0], to: "B")
        #expect(ok == false)
        // Registry unchanged.
        #expect(vm.projects.map(\.name) == ["A", "B"])
    }
    @Test func renameProjectRejectsEmptyName() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "Foo", path: "/f")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        #expect(vm.renameProject(vm.projects[0], to: "") == false)
        #expect(vm.renameProject(vm.projects[0], to: "   ") == false)
        #expect(vm.projects[0].name == "Foo")
    }
    @Test func renameProjectToSameNameIsNoOpSuccess() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "Foo", path: "/f")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        #expect(vm.renameProject(vm.projects[0], to: "Foo") == true)
        // Whitespace around matching name also no-ops.
        #expect(vm.renameProject(vm.projects[0], to: " Foo ") == true)
        #expect(vm.projects[0].name == "Foo")
    }
    @Test func archiveAndUnarchiveProject() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "Target", path: "/t")
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        vm.selectProject(vm.projects[0])
        #expect(vm.projects[0].archived == false)
        #expect(vm.selectedProject != nil)
        vm.archiveProject(vm.projects[0])
        #expect(vm.projects[0].archived == true)
        // Archiving clears the selection so the dashboard doesn't
        // linger on a project the sidebar will hide.
        #expect(vm.selectedProject == nil)
        vm.unarchiveProject(vm.projects[0])
        #expect(vm.projects[0].archived == false)
        // Unarchive doesn't re-select — the user chose to hide it,
        // surfacing it doesn't mean they want focus back.
        #expect(vm.selectedProject == nil)
    }
    @Test func foldersListIsSortedAndDeduped() async throws {
        let snapshot = TestRegistryLock.acquireAndSnapshot()
        defer { TestRegistryLock.restore(snapshot) }
        try seedRegistry(.init(projects: [
            ProjectEntry(name: "A", path: "/a", folder: "Work"),
            ProjectEntry(name: "B", path: "/b", folder: "Personal"),
            ProjectEntry(name: "C", path: "/c", folder: "Work"),
            ProjectEntry(name: "D", path: "/d"),   // top-level
            ProjectEntry(name: "E", path: "/e", folder: "")  // empty string treated as nil
        ]))
        let vm = ProjectsViewModel(context: .local)
        vm.load()
        #expect(vm.folders == ["Personal", "Work"])
    }
    // MARK: - Helpers
    @MainActor
    private func seedRegistry(_ registry: ProjectRegistry) throws {
        try ProjectDashboardService(context: .local).saveRegistry(registry)
    }
 }
@@ -0,0 +1,153 @@
 import Testing
 import Foundation
@testable import scarf
 /// Exercises the v2.3 sidecar at `~/.hermes/scarf/session_project_map.json`
 /// via the real `ServerContext.local`. Each test snapshots + restores
 /// the file through `TestRegistryLock` (reused — the sidecar lives
 /// in the same scarf/ dir as projects.json, so serialising on one
 /// lock prevents both cross-suite races).
 ///
 /// We scope the shared lock to this file's registry helper so tests
 /// here don't step on the real registry either.
@Suite(.serialized) struct SessionAttributionServiceTests {
    @Test func loadOnMissingFileReturnsEmptyMap() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        let map = svc.load()
        #expect(map.mappings.isEmpty)
        #expect(svc.projectPath(for: "anything") == nil)
        #expect(svc.sessionIDs(forProject: "/anything").isEmpty)
    }
    @Test func attributeWritesMappingAndPersists() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        svc.attribute(sessionID: "sess-1", toProjectPath: "/proj/a")
        // Read back via a fresh service instance — confirms the
        // write actually landed on disk, not just the in-memory map.
        let fresh = SessionAttributionService(context: .local)
        #expect(fresh.projectPath(for: "sess-1") == "/proj/a")
        // updatedAt populated on write.
        let map = fresh.load()
        let ts = try #require(map.updatedAt)
        #expect(!ts.isEmpty)
    }
    @Test func attributeIsIdempotent() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        svc.attribute(sessionID: "s", toProjectPath: "/p")
        let firstStamp = svc.load().updatedAt
        // Call again with the same pair — should short-circuit, NOT
        // bump updatedAt. We check that the timestamp didn't change
        // even if the file would have been rewritten.
        svc.attribute(sessionID: "s", toProjectPath: "/p")
        let secondStamp = svc.load().updatedAt
        #expect(firstStamp == secondStamp)
    }
    @Test func reattributeChangesMapping() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        svc.attribute(sessionID: "s", toProjectPath: "/a")
        svc.attribute(sessionID: "s", toProjectPath: "/b")
        #expect(svc.projectPath(for: "s") == "/b")
        #expect(svc.sessionIDs(forProject: "/a").isEmpty)
        #expect(svc.sessionIDs(forProject: "/b") == ["s"])
    }
    @Test func reverseLookupReturnsAllAttributedSessions() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        svc.attribute(sessionID: "s1", toProjectPath: "/proj")
        svc.attribute(sessionID: "s2", toProjectPath: "/proj")
        svc.attribute(sessionID: "s3", toProjectPath: "/other")
        #expect(svc.sessionIDs(forProject: "/proj") == ["s1", "s2"])
        #expect(svc.sessionIDs(forProject: "/other") == ["s3"])
        #expect(svc.sessionIDs(forProject: "/nobody").isEmpty)
    }
    @Test func forgetRemovesMapping() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        Self.deleteSidecar()
        let svc = SessionAttributionService(context: .local)
        svc.attribute(sessionID: "s", toProjectPath: "/p")
        #expect(svc.projectPath(for: "s") == "/p")
        svc.forget(sessionID: "s")
        #expect(svc.projectPath(for: "s") == nil)
        // Forget on a missing session is a no-op, not an error.
        svc.forget(sessionID: "s")
        #expect(svc.projectPath(for: "s") == nil)
    }
    @Test func corruptedFileReturnsEmptyMap() throws {
        let snapshot = Self.snapshot()
        defer { Self.restore(snapshot) }
        // Write garbage to the sidecar path and confirm the service
        // treats it as "no attributions" rather than crashing. Users
        // hand-editing the JSON shouldn't soft-brick the Sessions tab.
        let path = ServerContext.local.paths.sessionProjectMap
        try FileManager.default.createDirectory(
            atPath: (path as NSString).deletingLastPathComponent,
            withIntermediateDirectories: true
        )
        try "not json at all".data(using: .utf8)!.write(to: URL(fileURLWithPath: path))
        let svc = SessionAttributionService(context: .local)
        let map = svc.load()
        #expect(map.mappings.isEmpty)
    }
    // MARK: - Helpers
    /// Snapshot + restore the sidecar file (and delete if missing).
    /// Uses the shared TestRegistryLock so this suite serialises
    /// with any other registry-writing suite — both touch scarfDir.
    static func snapshot() -> (lockToken: Any, data: Data?) {
        // Re-use the ProjectTemplateTests lock implementation —
        // same NSLock gates all scarfDir writes across suites.
        let projectSnapshot = TestRegistryLock.acquireAndSnapshot()
        let path = ServerContext.local.paths.sessionProjectMap
        let sidecarData = try? Data(contentsOf: URL(fileURLWithPath: path))
        return (lockToken: projectSnapshot as Any, data: sidecarData)
    }
    static func restore(_ snapshot: (lockToken: Any, data: Data?)) {
        let path = ServerContext.local.paths.sessionProjectMap
        if let data = snapshot.data {
            try? data.write(to: URL(fileURLWithPath: path))
        } else {
            try? FileManager.default.removeItem(atPath: path)
        }
        // Release the shared lock via the existing helper.
        TestRegistryLock.restore(snapshot.lockToken as? Data)
    }
    static func deleteSidecar() {
        let path = ServerContext.local.paths.sessionProjectMap
        try? FileManager.default.removeItem(atPath: path)
    }
 }
@@ -0,0 +1,199 @@
 import Testing
 import Foundation
@testable import scarf
 /// Invariants around Hermes v0.10.0 Tool Gateway integration:
 /// overlay-provider merge, Nous Portal subscription detection, and
 /// `platform_toolsets` YAML parsing.
@Suite struct ToolGatewayTests {
    // MARK: - Fixtures
    /// Minimal models.dev cache with exactly two providers so the overlay
    /// merge is easy to reason about — none of them are overlays.
    private func writeCacheFixture() throws -> String {
        let dir = FileManager.default.temporaryDirectory.appendingPathComponent("scarf-catalog-\(UUID().uuidString)")
        try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
        let path = dir.appendingPathComponent("models_dev_cache.json").path
        let json = """
        {
          "anthropic": {
            "name": "Anthropic",
            "models": {
              "claude-sonnet-4-5-20250929": { "name": "Claude Sonnet 4.5" }
            }
          },
          "openai": {
            "name": "OpenAI",
            "models": {
              "gpt-4o": { "name": "GPT-4o" }
            }
          }
        }
        """
        try json.write(toFile: path, atomically: true, encoding: .utf8)
        return path
    }
    private func writeAuthFixture(_ body: String) throws -> String {
        let dir = FileManager.default.temporaryDirectory.appendingPathComponent("scarf-auth-\(UUID().uuidString)")
        try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
        let path = dir.appendingPathComponent("auth.json").path
        try body.write(toFile: path, atomically: true, encoding: .utf8)
        return path
    }
    // MARK: - ModelCatalogService overlay merge
    @Test func overlayOnlyProvidersAppearInPicker() throws {
        let path = try writeCacheFixture()
        let service = ModelCatalogService(path: path)
        let providers = service.loadProviders()
        let ids = providers.map(\.providerID)
        #expect(ids.contains("nous"), "Nous Portal must appear after overlay merge")
        #expect(ids.contains("openai-codex"), "OpenAI Codex overlay must appear")
        #expect(ids.contains("qwen-oauth"), "Qwen OAuth overlay must appear")
        // Cached providers still present.
        #expect(ids.contains("anthropic"))
        #expect(ids.contains("openai"))
    }
    @Test func nousPortalSortsFirst() throws {
        let path = try writeCacheFixture()
        let service = ModelCatalogService(path: path)
        let providers = service.loadProviders()
        #expect(providers.first?.providerID == "nous",
                "Subscription-gated providers must sort before the alphabetical block")
    }
    @Test func overlayProvidersCarryMetadata() throws {
        let path = try writeCacheFixture()
        let service = ModelCatalogService(path: path)
        let providers = service.loadProviders()
        let nous = providers.first { $0.providerID == "nous" }
        #expect(nous?.isOverlay == true)
        #expect(nous?.subscriptionGated == true)
        #expect(nous?.providerName == "Nous Portal")
        #expect(nous?.modelCount == 0, "Overlay-only providers have no models in the cache")
        let codex = providers.first { $0.providerID == "openai-codex" }
        #expect(codex?.isOverlay == true)
        #expect(codex?.subscriptionGated == false,
                "Only Nous is subscription-gated today")
    }
    @Test func cachedProvidersAreNotMarkedOverlay() throws {
        let path = try writeCacheFixture()
        let service = ModelCatalogService(path: path)
        let providers = service.loadProviders()
        let anthropic = providers.first { $0.providerID == "anthropic" }
        #expect(anthropic?.isOverlay == false)
        #expect(anthropic?.subscriptionGated == false)
    }
    @Test func providerByIDReturnsOverlayWhenCacheMisses() throws {
        let path = try writeCacheFixture()
        let service = ModelCatalogService(path: path)
        let nous = service.providerByID("nous")
        #expect(nous?.providerName == "Nous Portal")
        #expect(nous?.isOverlay == true)
        let missing = service.providerByID("definitely-not-a-provider")
        #expect(missing == nil)
    }
    // MARK: - NousSubscriptionService
    @Test func subscriptionAbsentWhenAuthFileMissing() throws {
        let path = "/tmp/this-file-should-not-exist-\(UUID().uuidString).json"
        let service = NousSubscriptionService(path: path)
        let state = service.loadState()
        #expect(state == .absent)
    }
    @Test func subscriptionAbsentWhenProvidersEmpty() throws {
        let path = try writeAuthFixture("""
        { "version": 1, "providers": {}, "active_provider": null }
        """)
        let state = NousSubscriptionService(path: path).loadState()
        #expect(state.present == false)
        #expect(state.subscribed == false)
    }
    @Test func subscriptionPresentButInactiveWhenOtherProviderActive() throws {
        let path = try writeAuthFixture("""
        {
          "version": 1,
          "providers": { "nous": { "access_token": "tok-12345" } },
          "active_provider": "anthropic"
        }
        """)
        let state = NousSubscriptionService(path: path).loadState()
        #expect(state.present == true)
        #expect(state.providerIsNous == false)
        #expect(state.subscribed == false,
                "Auth alone isn't enough — the Tool Gateway only routes when Nous is the active provider")
    }
    @Test func subscriptionActiveWhenAuthAndActiveProviderLineUp() throws {
        let path = try writeAuthFixture("""
        {
          "version": 1,
          "providers": { "nous": { "access_token": "tok-12345" } },
          "active_provider": "nous"
        }
        """)
        let state = NousSubscriptionService(path: path).loadState()
        #expect(state.present == true)
        #expect(state.providerIsNous == true)
        #expect(state.subscribed == true)
    }
    @Test func subscriptionAbsentWhenTokenEmpty() throws {
        let path = try writeAuthFixture("""
        {
          "version": 1,
          "providers": { "nous": { "access_token": "" } },
          "active_provider": "nous"
        }
        """)
        let state = NousSubscriptionService(path: path).loadState()
        #expect(state.present == false,
                "Empty token is as good as no token — don't claim subscription")
    }
    @Test func subscriptionAbsentOnMalformedJSON() throws {
        let path = try writeAuthFixture("{ this is not valid json")
        let state = NousSubscriptionService(path: path).loadState()
        #expect(state == .absent)
    }
    // MARK: - platform_toolsets YAML parse
    @Test func platformToolsetsParsed() throws {
        let yaml = """
        model:
          default: claude-sonnet-4.5
          provider: anthropic
        platform_toolsets:
          cli:
          - browser
          - messaging
          slack:
          - messaging
        """
        let parsed = HermesFileService.parseNestedYAML(yaml)
        #expect(parsed.lists["platform_toolsets.cli"] == ["browser", "messaging"])
        #expect(parsed.lists["platform_toolsets.slack"] == ["messaging"])
    }
    @Test func platformToolsetsEmptyWhenMissing() throws {
        // HermesConfig.empty should have no platform toolsets.
        let config = HermesConfig.empty
        #expect(config.platformToolsets.isEmpty)
    }
 }
@@ -45,7 +45,12 @@ need_builder() {
 }
 need_ghpages() {
-  [[ -d "$GHPAGES_DIR/.git" ]] || die "no gh-pages worktree at $GHPAGES_DIR
+  # `.git` is a directory in a regular clone but a pointer FILE in a
  # `git worktree add` worktree — `-e` covers both. The earlier `-d`
  # check falsely rejected worktrees, so the script's own error
  # message told users to re-run `git worktree add` on a worktree
  # that was already there and valid.
  [[ -e "$GHPAGES_DIR/.git" ]] || die "no gh-pages worktree at $GHPAGES_DIR
  Run: git worktree add .gh-pages-worktree gh-pages"
 }
@@ -73,7 +73,10 @@ Optional:
 - `instructions/CLAUDE.md`, `instructions/GEMINI.md`, `instructions/.cursorrules`, `instructions/.github/copilot-instructions.md` — agent-specific shims beyond `AGENTS.md`.
 - `skills/<skill-name>/SKILL.md` — shipped skills, installed into `~/.hermes/skills/templates/<slug>/` on the user's side.
- `cron/jobs.json` — an array of cron job specs. Each has `name`, `schedule` (e.g. `0 9 * * *` or `every 2h`), `prompt`, optional `deliver`, `skills[]`, `repeat`.
+- `cron/jobs.json` — an array of cron job specs. Each has `name`, `schedule` (e.g. `0 9 * * *` or `every 2h`), `prompt`, optional `deliver`, `skills[]`, `repeat`. The prompt may use these install-time placeholders — the installer substitutes them before registering the cron job with Hermes:
  - `{{PROJECT_DIR}}` — absolute path of the newly-installed project dir. **Required for any cron prompt that reads or writes project files** — Hermes doesn't set a CWD when firing cron jobs, so relative paths (`.scarf/config.json`) won't resolve. Write `{{PROJECT_DIR}}/.scarf/config.json` instead.
  - `{{TEMPLATE_ID}}` — the `owner/name` id from your manifest.
  - `{{TEMPLATE_SLUG}}` — the sanitised slug used for the project dir name + skills namespace.
 - `memory/append.md` — markdown appended to the user's `MEMORY.md` between template-specific markers. Use sparingly — most templates don't need this.
 ### 4. Build the bundle
@@ -37,7 +37,7 @@ No `sites.txt` anymore — sites come from `.scarf/config.json`.
 ## What to do when the cron job fires
-The cron job runs this project's "Check site status" prompt. When invoked:
+The cron prompt Scarf registers for this project carries **absolute paths** (the installer substitutes `{{PROJECT_DIR}}` at install time) — you don't need to figure out the project's location yourself. Use whatever absolute paths appear in the prompt you received; if you're working in the project's interactive chat instead, the paths below are relative to the project root.
 1. Read `.scarf/config.json`. Extract `values.sites` (array of URLs) and `values.timeout_seconds` (number). If `sites` is empty or missing, write a `status-log.md` entry noting "no sites configured — open Configuration to add some" and leave the dashboard untouched.
 2. For each URL in `sites`, make an HTTP GET request with the configured timeout. Follow up to 3 redirects. Treat any 2xx or 3xx response as **up**, anything else (including timeouts and DNS failures) as **down**.
@@ -56,6 +56,7 @@ The cron job runs this project's "Check site status" prompt. When invoked:
   - `Sites Down` stat widget: `value` = count of down results.
   - `Last Checked` stat widget: `value` = the ISO-8601 timestamp you just wrote.
   - `Watched Sites` list widget `items`: one entry per URL with `text` = URL and `status` = `"up"` or `"down"` (lowercase).
   - `First Watched Site` **webview widget** (in the "Live Site Preview" section): set its `url` field to the **first** URL from `values.sites`. This is what the user sees rendered in the Scarf **Site** tab. If `values.sites` is empty, leave the webview's existing `url` alone.
 6. If the cron job has a `deliver` target set, emit a one-line summary (`3 up, 1 down — example.com timed out`) as the agent's final response so the delivery mechanism picks it up.
 ## What not to do
@@ -2,6 +2,6 @@
  {
    "name": "Check site status",
    "schedule": "0 9 * * *",
-    "prompt": "Run the site status check for this project. Follow the instructions in AGENTS.md: read .scarf/config.json to get values.sites (the URL list) and values.timeout_seconds, HTTP GET each URL with the configured timeout, prepend a results section to status-log.md (creating it with the stub header if it doesn't exist yet), and update the three stat widgets plus the Watched Sites list items in .scarf/dashboard.json. When done, reply with a one-line summary like '3 up, 1 down — example.com timed out'."
+    "prompt": "Run the site status check for the Scarf project at {{PROJECT_DIR}}. Read {{PROJECT_DIR}}/.scarf/config.json to get `values.sites` (the URL list) and `values.timeout_seconds` (the per-URL HTTP timeout). HTTP GET each URL with that timeout, following up to 3 redirects; treat 2xx/3xx as up and anything else (including timeouts and DNS failures) as down. Prepend a new timestamped results section to {{PROJECT_DIR}}/status-log.md — create the file with a one-line header if it doesn't exist yet. Update {{PROJECT_DIR}}/.scarf/dashboard.json: set the Sites Up / Sites Down / Last Checked stat widgets' `value` fields; replace the 'Watched Sites' list widget's `items` array with one entry per URL (text = URL, status = \"up\" or \"down\"); and if `values.sites` is non-empty, set the 'First Watched Site' webview widget's `url` field to the FIRST URL from `values.sites` (otherwise leave the webview's existing url alone). Preserve every other field in dashboard.json as-is. Reply with a one-line summary like '3 up, 1 down — example.com timed out'."
  }
 ]
--- a/Show More
+++ b/Show More