CHANGE.log

# CHANGE.log

Running record of what shipped and who sent it, newest first, with a verified,
linkable X profile per contributor. Public thanks without the @ means the person
never sees it, and a wrong @ tags a stranger, so every handle here was verified
rather than guessed. Where nothing verified, this file says so outright instead
of leaving a blank.

Verification order used per person: `gh api users/<login> --jq .twitter_username`,
`gh api users/<login>/social_accounts`, then their own site or blog. A live
personal site beats a GitHub profile field when the two disagree, because the
field is written once at signup and never revisited.

Started 2026-09-18 at the #36 merge. Entries before that are listed under
Backfill pending; the release history itself is in CHANGELOG.md.

---

## 2026-10-04

### Disk mounts containing whitespace reach the DISK card (#41)

**Greyforge Labs** · GitHub [@GreyforgeLabs](https://github.com/GreyforgeLabs) · X [@GreyforgeLabs](https://x.com/GreyforgeLabs)

`parseDfRows()` split each `df` row on whitespace, so a mount path containing
a space never reached the disk card. Collection still queries only `/` and the
home directory; a removable drive mounted somewhere else is not listed. Among
the filesystems already queried, the row is now matched as a path plus three
trailing numeric columns. The header is still skipped. The first valid row for
a full path is kept, a rejected row does not block a later valid row for that
mount, and that later row does not replace a different mount already kept.
Same-size, same-used pools still show once.

Reviewed here before merge: the old and new functions run over live
`df -B1 --output=target,size,used,avail` text return identical rows for every
mount without a space. 578 tests pass. X profile verified from the GitHub
profile field and social accounts; already credited in the blip CHANGE.log.

## 2026-09-30

### Web Mode: the desk in a browser over Tailscale or manual HTTPS (#25)

**TechLuddite** · GitHub [@TechLuddite](https://github.com/TechLuddite) · X [@gh_TechLuddite](https://x.com/gh_TechLuddite)

The desk renders as a page for a phone or a second machine. Two access modes
only, both encrypted: Tailscale Serve, and manual HTTPS with an existing
certificate. Off by default, and turning it on takes an explicit, persisted
true.

**LAN HTTP is gone, as asked at review.** It bound 0.0.0.0:8787 with no TLS and
carried the bearer token in the URL path, so the desk and a live credential
crossed the network in cleartext. The backend is loopback-only behind Tailscale
Serve; manual HTTPS serves its own pinned certificate; a saved "lan" mode loads
with WEB off and starts nothing, and there is no plain-HTTP fallback anywhere.

Also fixed from the review, each as its own commit:
- viewer links minted while LAN HTTP existed are replaced once, under a lock,
  on the grounds they may already have crossed the wire (CONFIG_VERSION 2).
- `url` prints the token id and last four characters; the full link needs
  `--reveal`, so a status check cannot leave a live credential in scrollback.
- token-revoke now tells "no such id" from "that is the last token".
- privacy default matches #17: only a saved literal true masks.
- the SETTINGS drawer fits 1600x1000 in three columns with no page scroll,
  and the test prints the measurement: content 755 against a 755 viewport.

Merged on top of #16. Two conflicts, both taken as unions: the InfoView resolve
ceiling (#16's +6 and this PR's +3 over the same base, so 602 with both reasons
kept) and the InfoModel line in Infomarchy.qml, which now carries #16's
usageVisible and this PR's webEnabled in `active`.

555 tests pass on the merged tree. Fifth contribution from this author.

### REMOTE: an optional roster file becomes a read-only card (#13)

**Wulf Kaal** · GitHub [@wulfkaal](https://github.com/wulfkaal) · X [@WulfKaal](https://x.com/WulfKaal)

Agents running somewhere this machine cannot see (a VPS, a colleague's box, a
CI runner) get a card, as long as something over there drops a JSON roster file
and `INFOMARCHY_REMOTE_ROSTER` points at it. No roster variable means no card,
no file read, no network. The collector reads that file on its own tick: nothing
reaches across a network to build a card, which is the promise the README makes.

Read-only on purpose. A remote agent has no pid here, nothing to focus and
nothing to stop, so the card has no per-row actions at all. Its single action is
an optional workspace number to jump to.

Rebased by me, not by the author, after eight days with no reply and 82 commits
of drift. Fred's call. His authorship is kept; the conflicts were entirely
master moving underneath:
- the right-column order gained FLEET (#35) and CONTAINERS (#19) since this was
  written, so `remoteRoster` joins the full list rather than replacing it, and
  sits after LOCAL AI where the review asked for it. His own migration function
  needed no change: it appends whatever is missing and then inserts remoteRoster
  after localAi, so the seven-card list migrates correctly.
- `collector.ts` kept gitea, fleet and the roster in the snapshot.
- `InfoModel.qml` kept both the fleet-session jump (#37) and his focusWorkspace.
- the InfoView resolve ceiling went 602 to 609 for the card's delegate.
- his layout differential test evaluated bindings that have since become
  multi-line and gained a `dense` flag; the helper now reads both from source,
  so the test still compares what the desk actually computes.

Verified live rather than only in tests: with no variable set the snapshot has
no roster at all; pointed at a file it produced the counts and the NEEDS YOU row;
and a roster line carrying `GITHUB_TOKEN=ghp_...` came out as `[redacted]`.

576 tests pass on the merged tree. Second contribution from this author (after #12).

### Local usage collection, an optional billing meter, and HARD REFRESH (#16)

**TechLuddite** · GitHub [@TechLuddite](https://github.com/TechLuddite) · X [@gh_TechLuddite](https://x.com/gh_TechLuddite)

HARD REFRESH is the first chip in the module strip, with IPC for the desk and
the overlay; it bypasses the GitHub, external-IP and Grok billing caches. Grok
token totals now come from Grok's own local session files when Omarchy has no
record for it, and USAGE renders each provider as its own tinted block.

The whole 09-18 review came back as one commit per item, and all of it checks out
here:
- Both outbound paths are opt-in now, enable flags instead of skip flags:
  `INFOMARCHY_ALLOW_GROK_BILLING=1` and `INFOMARCHY_ALLOW_CLAUDE_REFRESH=1`.
  Nothing spends against an AI account unless asked.
- Both are gated on the USAGE card being on screen, passed as the `--usage-visible`
  argv flag rather than an environment variable, so an inherited environment cannot
  claim the card is visible. Proven live: flag alone is false, card alone is false,
  both together is true.
- HARD REFRESH no longer bypasses the Claude spend throttle. Forcing skips caches,
  never the limiter, and a forced Grok billing fetch still waits 10 seconds.
- The declarative collector command is back, so a future `collector.running = true`
  cannot silently drop `--demo`, and the unreachable return in
  `grokCliAccessToken()` is gone.

477 tests pass on the merged tree. Fourth contribution from this author.

## 2026-09-22

### Event-driven refresh on top of the poll (#39)

**Reverb** · GitHub [@reverb256](https://github.com/reverb256) · X: none found (checked 2026-09-18, see Backfill)

The follow-up Fred invited on #11, built to the constraints he set there: the
repeating timer stays as the floor, and paths come from HOME, HERMES_HOME and
XDG_STATE_HOME with no literal home directory. A change to Hermes's state.db or
WAL, or to dashboard.json, pulls the next refresh forward after 250 ms.

Fixed in the merge: FileView preloads by default, which would have read gus's
12 MB state.db and 1 MB WAL into memory in every desk instance only to watch
them. Adding `preload: false` keeps them as pure watches. A throwaway quickshell
confirmed the change signal still fires on append and atomic replace without
loading the file. Dropped `atomicWrites` from the dashboard.json watcher,
since it only affects writes and this FileView never writes.

435 tests pass on the merged tree. Second contribution (after #11).

### Pin the desk to one workspace, keeping the wallpaper on all of them (#38)

**Casey Shields** · GitHub [@shieldsworks](https://github.com/shieldsworks) · X: none found (checked 2026-09-22)

`omarchy-shell infomarchy setDeskWorkspace 5` shows the cards only while
workspace 5 is on screen. The wallpaper still draws everywhere, because the gate
sits on the cards and not the background surface. `0` (the default) means every
workspace, so an install that never sets it behaves exactly as before. Values
out of range are refused, not clamped.

Merged on top of #37 and #40. The Infomarchy.qml resolve ceiling conflict with
#40 was taken as a union (26 + 4 + 2 = 32). 435 tests pass on the merged tree.
First contribution from this author.

Note on the handle: GitHub has no X field and no social accounts, and
shieldsworks.com links no X profile. Ask before tagging.

### FLEET sessions: which remote agent needs you, and one click to get there (#37)

**RidgetopAi (Brian)** · GitHub [@RidgetopAi](https://github.com/RidgetopAi) · X [@RidgetopAI](https://x.com/RidgetopAI) · ridgetopai.net

Builds on #35. A fleet host running Infomarchy now expands its FLEET row into
one line per remote session: project, working or idle, and a NEEDS YOU tag, with
the card glowing when any remote agent is waiting. Clicking a row opens a
terminal, ssh's over and lands in that exact tmux window and pane. A host
without bun or Infomarchy keeps its plain ps row and is asked again only every
10 minutes.

Privacy boundary: only provider, project basename, attention state, busy, stale,
uptime and the tmux address leave the remote machine. Window titles, prompt
text, paths and git state do not. The remote builds the row in one function and
the receiver validates it again. Checked live on gus: the payload carried exactly
those fields and nothing else.

Merged on top of #40. 430 tests pass on the merged tree. First contribution from
this author.

Note on the handle: on 2026-09-22 GitHub carried no X field and no social
accounts. Re-checked 2026-09-26 and both now declare @RidgetopAI, with
ridgetopai.net as the site; the account exists. Verified, not guessed.

### The desk keeps clear of the bar on whichever edge it occupies (#40)

**Danny Welch** · GitHub [@dannyowelch](https://github.com/dannyowelch) · X [@dannyowelch](https://x.com/dannyowelch)

The cards used to reserve a fixed 40px strip at the top, because the background
layer ignores exclusion zones. A bottom or side bar covered the desk, and hiding
the bar left the gap behind. The desk now reads the live bar from the shell API
and clears only the edge the bar is on, by the bar's real thickness. Moving,
resizing or hiding the bar moves the cards immediately, with no reload.

Merged 9a47cce. 390 tests pass on the merged tree. First contribution from this
author.

Note on the handle: GitHub carries no X link and no social accounts. The X
account @dannyowelch has the same display name (Danny Welch), replies to
@NixFred directly, and posts about running Omarchy, so it counts as verified,
not guessed.

---

## 2026-09-18

### Optional APPS module: local dev servers as systemd user services (#36)

**Augie Bralley** · GitHub [@auggernaut](https://github.com/auggernaut) · X [@augman](https://x.com/augman) · www.auggernaut.com

Registers a checkout with the start command it already has and a fixed port,
installs it as a systemd **user** service, and puts readiness, checkout, branch,
changed-file count, logs and Open/Start/Stop/Restart/Edit on the desk. Ships an
`infomarchy-apps` CLI so any terminal or agent gets the same `ensure` operation:
reuse the running service, or start it and wait for HTTP readiness.

The problem it solves: a dev server started in a terminal outlives that terminal,
the next task cannot find it, so it starts a second one on another port. Handing
the process to systemd means the desk only asks for actions and reads status, so
hiding the desk or closing an agent task cannot stop an app.

First thing in the plugin that writes outside its own config (unit files in
`~/.config/systemd/user`, a symlink in `~/.local/bin`), which is why the refusals
matter: it will not replace a unit lacking its own `# Managed by Infomarchy Apps`
marker, will not replace a `~/.local/bin` entry that is not its own symlink, and
reports a busy port with the owning PID and directory rather than killing,
adopting, or silently swapping it. Ownership is proven through the service cgroup
rather than inferred from the port. The module starts **disabled** and is the one
entry in the module strip needing an explicit `true`.

Merged f96507e. 329 tests pass on the merged tree. Scope accepted by Fred.

Note on the handle: Augie's GitHub declares `augustinbralley` in both the profile
field and social_accounts, but his own site says **@augman** twice and his
commits in this very PR are authored `Augustin Bralley <augman@gmail.com>`.
@augman is correct, confirmed by Fred, who knows him in person.

---

## Backfill pending

Contributors already credited in CHANGELOG.md, recorded here so the handle work
is not lost. Verified 2026-09-18.

| Contributor | GitHub | X | PRs |
|---|---|---|---|
| TechLuddite | [@TechLuddite](https://github.com/TechLuddite) | [@gh_TechLuddite](https://x.com/gh_TechLuddite) | #15, #16, #17, #19, #20, #25 |
| Wulf Kaal | [@wulfkaal](https://github.com/wulfkaal) | [@WulfKaal](https://x.com/WulfKaal) | #12, #13 |
| Eric Stegemann | [@TRIBUSeric](https://github.com/TRIBUSeric) | [@EricStegemann](https://x.com/EricStegemann) | #26 |
| Augie Bralley | [@auggernaut](https://github.com/auggernaut) | [@augman](https://x.com/augman) | #29, #36 |
| jttraino | [@jttraino](https://github.com/jttraino) | none found (checked 2026-09-18) | #33, #34 |
| Tech0001 | [@Tech0001](https://github.com/Tech0001) | none found (checked 2026-09-18) | #28 |
| Reverb | [@reverb256](https://github.com/reverb256) | none found (checked 2026-09-18) | #11 |
| Adam | [@alinuxfan](https://github.com/alinuxfan) | none found (checked 2026-09-18) | #23, #24 |

**Do not tag [@TechLuddite](https://x.com/TechLuddite) on X.** That account is a
different person (a dormant 2009 account named "technology luddite"). The
contributor points at `gh_TechLuddite` himself.

"none found" means the lookup ran and returned nothing, not that it was skipped.
Ask those four directly before tagging any of them; do not guess from the login.