Merge site-audit: SEO routes, analytics with consent first in Europe, security page, founder and X account, docs header; the tour opens on the pull request and leads with Code, on the real shell, with Agents and Docs working today · 6dae266 · flagon-io/g1t

4667	4667		"expires_at": "2026-10-12T17:00:00.000Z"
4668	4668		}
4669	4669		},
4670		−	"notes": "`invitee` is a username or an email address. A member of the workspace answers `{\"result\": \"granted\", \"collaborator\": {…}}` with the role already given, shown as list_collaborators shows a person. Anyone else answers `{\"result\": \"invited\", \"invitation\": {…}}`: the invitation is emailed and waits 7 days, and the role is theirs once they accept it. An email address without an account gets an invitation with `email` set and `invitee` null, and an invite that makes the account and accepts in one step. Refused with `404` when no account has that username, `409` when they already have a role of their own or a pending invitation (change it with update_collaborator), and `403` without the Admin role, from an agent's or a workspace's token, or when the person does not meet what the workspace asks of everyone with access. collaborator_added` webhook event is sent once they have the role. See [Access and roles](/guides/access-and-roles/). On a free workspace, inviting anyone who is not a member answers `402` with `payment_required` until it starts the g1t plan."
	4670	+	"notes": "`invitee` is a username or an email address. A member of the workspace answers `{\"result\": \"granted\", \"collaborator\": {…}}` with the role already given, shown as list_collaborators shows a person. Anyone else answers `{\"result\": \"invited\", \"invitation\": {…}}`: the invitation is emailed and waits 7 days, and the role is theirs once they accept it. An email address without an account gets an invitation with `email` set and `invitee` null, and an invite that makes the account and accepts in one step. Refused with `404` when no account has that username, `409` when they already have a role of their own or a pending invitation (change it with update_collaborator), and `403` without the Admin role, from an agent's or a workspace's token, or when the person does not meet what the workspace asks of everyone with access. A `collaborator_added` webhook event is sent once they have the role. See [Access and roles](/guides/access-and-roles/). On a free workspace, inviting anyone who is not a member answers `402` with `payment_required` until it starts the g1t plan."
4671	4671		},
4672	4672		"update_collaborator": {
4673	4673		"params": {

1	1		---
2		−	// Starlight's header, with the tabs that divide the docs beneath it.
3		−	import Default from '@astrojs/starlight/components/Header.astro';
	2	+	// The docs header: the wordmark, search in the middle and links on the
	3	+	// right, with the tabs that divide the docs beneath it.
	4	+	//
	5	+	// Its own layout, not Starlight's: Starlight lines the search up with the
	6	+	// page's text column, which moves when a page has an "On this page" list
	7	+	// and when it does not. Here the row is three columns, the outer two always
	8	+	// the same width, so the search sits at the header's centre on every page.
	9	+	import Search from '@astrojs/starlight/components/Search.astro';
4	10
5	11		import { TABS, tabFor } from '../tabs';
	12	+	import SiteTitle from './SiteTitle.astro';
	13	+	import SocialIcons from './SocialIcons.astro';
6	14
7	15		const current = tabFor(Astro.locals.starlightRoute.id);
8	16		---
9	17
10	18		<div class="g1t-header">
11		−	<div class="g1t-header-top"><Default /></div>
	19	+	<div class="g1t-header-top">
	20	+	<div class="g1t-header-title"><SiteTitle /></div>
	21	+	<div class="g1t-header-search print:hidden"><Search /></div>
	22	+	<div class="g1t-header-links print:hidden"><SocialIcons /></div>
	23	+	</div>
12	24		<nav class="g1t-tabs" aria-label="Sections">
13	25		{
14	26		TABS.map((tab) => (
⋯
28	40		}
29	41		/* The same bar as the app's: 3.5rem, and a line under it. */
30	42		.g1t-header-top {
	43	+	/* Each side column is at least as wide as the widest thing that goes
	44	+	in either, so the two stay equal and the search stays centred. */
	45	+	--g1t-header-side: 13.5rem;
31	46		box-sizing: border-box;
	47	+	display: grid;
	48	+	grid-template-columns:
	49	+	minmax(var(--g1t-header-side), 1fr)
	50	+	minmax(0, 26rem)
	51	+	minmax(var(--g1t-header-side), 1fr);
	52	+	align-items: center;
	53	+	gap: 1rem;
32	54		height: 3.5rem;
33	55		flex-shrink: 0;
34	56		padding: 0 var(--sl-nav-pad-x);
35	57		border-bottom: 1px solid var(--g1t-line);
36	58		}
37		−	/* On phones the menu button sits at the top row's end: leave it room. */
	59	+	.g1t-header-title {
	60	+	display: flex;
	61	+	min-width: 0;
	62	+	/* Room for the link's focus ring. */
	63	+	padding: 0.25rem;
	64	+	margin: -0.25rem;
	65	+	}
	66	+	.g1t-header-search {
	67	+	display: flex;
	68	+	justify-content: center;
	69	+	min-width: 0;
	70	+	}
	71	+	.g1t-header-links {
	72	+	display: flex;
	73	+	justify-content: flex-end;
	74	+	min-width: 0;
	75	+	}
	76	+	/* Tablets: the sidebar is a menu, and its button (fixed in place by
	77	+	Starlight) takes the row's end. The right column makes room for it
	78	+	inside itself, so the two columns stay equal and the search centred. */
38	79		@media (max-width: 49.99rem) {
39		−	:global([data-has-sidebar]) .g1t-header-top {
40		−	padding-inline-end: calc(var(--sl-nav-pad-x) + var(--sl-menu-button-size) + var(--sl-nav-gap));
	80	+	.g1t-header-top {
	81	+	--g1t-header-side: 13rem;
	82	+	}
	83	+	:global([data-has-sidebar]) .g1t-header-links {
	84	+	padding-inline-end: calc(var(--sl-menu-button-size) + 0.5rem);
41	85		}
42	86		}
	87	+	/* Phones: the wordmark on the left; search, the links and the menu
	88	+	button together on the right. */
	89	+	@media (max-width: 44.99rem) {
	90	+	.g1t-header-top {
	91	+	grid-template-columns: minmax(0, 1fr) auto auto;
	92	+	gap: 0.25rem;
	93	+	}
	94	+	}
43	95		.g1t-tabs {
44	96		display: flex;
45	97		gap: 1.5rem;
46	98		height: 2.75rem;
47	99		padding: 0 var(--sl-nav-pad-x);
48	100		overflow-x: auto;
	101	+	overscroll-behavior-x: contain;
49	102		scrollbar-width: none;
50	103		}
	104	+	.g1t-tabs::-webkit-scrollbar {
	105	+	display: none;
	106	+	}
51	107		.g1t-tabs a {
52	108		display: flex;
	109	+	flex-shrink: 0;
53	110		align-items: center;
54	111		border-bottom: 1.5px solid transparent;
55	112		font-size: 0.875rem;

14	14		<div class="g1t-page-title">
15	15		<div class="g1t-page-title-row">
16	16		<h1 id="_top">{title}</h1>
17		−	<div class="g1t-copy not-content">
	17	+	<div class="g1t-copy not-content" data-pagefind-ignore>
18	18		<button type="button" class="g1t-copy-main" data-markdown={markdown}>
19	19		<Copy />
20	20		<span>Copy page</span>
⋯
224	224		font-size: 0.75rem;
225	225		color: var(--g1t-faint);
226	226		}
	227	+	/* Phones: the group keeps its place beside the title, as two square
	228	+	buttons a finger can hit; the copy button shows only its icon, and
	229	+	its label stays for screen readers. */
227	230		@media (max-width: 40rem) {
	231	+	.g1t-page-title-row {
	232	+	gap: 0.75rem;
	233	+	}
	234	+	h1 {
	235	+	min-width: 0;
	236	+	font-size: 1.75rem;
	237	+	overflow-wrap: anywhere;
	238	+	}
228	239		.g1t-copy {
229		−	display: none;
	240	+	height: 2.5rem;
	241	+	margin-top: 0;
	242	+	}
	243	+	.g1t-copy-main span {
	244	+	position: absolute;
	245	+	width: 1px;
	246	+	height: 1px;
	247	+	overflow: hidden;
	248	+	clip-path: inset(50%);
	249	+	white-space: nowrap;
	250	+	}
	251	+	.g1t-copy-main,
	252	+	.g1t-copy-more summary {
	253	+	width: 2.5rem;
	254	+	padding: 0;
	255	+	}
	256	+	.g1t-copy :global(svg) {
	257	+	width: 1rem;
	258	+	height: 1rem;
	259	+	}
	260	+	.g1t-copy-menu {
	261	+	width: min(16.5rem, calc(100vw - 2rem));
	262	+	}
	263	+	.g1t-copy-menu a {
	264	+	padding-block: 0.65rem;
230	265		}
231	266		}
232	267		</style>

1	1		---
2		−	// The header's right side: where people go from the docs, then the source.
	2	+	// The header's right side: where people go from the docs, then g1t on X and the source.
3	3		import { GitBranch } from '@lucide/astro';
4	4		---
5	5
6	6		<nav class="g1t-nav" aria-label="g1t">
7	7		<a href="https://g1t.sh/">g1t.sh</a>
8	8		<a href="https://g1t.sh/register" class="g1t-nav-cta">Sign up</a>
	9	+	<a href="https://x.com/g1t_sh" aria-label="g1t on X" title="g1t on X" class="g1t-nav-icon">
	10	+	<svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M14.234 10.162 22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299-.929-1.329L3.076 1.56h3.182l5.965 8.532.929 1.329 7.754 11.09h-3.182z" /></svg>
	11	+	</a>
9	12		<a href="https://g1t.sh/flagon-io/g1t" aria-label="Source on g1t" title="Source on g1t" class="g1t-nav-icon">
10	13		<GitBranch />
11	14		</a>
⋯
17	20		align-items: center;
18	21		gap: 0.25rem;
19	22		}
20		−	a {
	23	+	/* nav.g1t-nav: the menu's own link rule must not win where these sit
	24	+	at the foot of the phone menu. */
	25	+	nav.g1t-nav a {
	26	+	display: inline-flex;
	27	+	align-items: center;
	28	+	height: 2rem;
21	29		border-radius: 0.4rem;
22		−	padding: 0.3rem 0.6rem;
	30	+	padding: 0 0.6rem;
23	31		font-size: 0.85rem;
	32	+	white-space: nowrap;
24	33		color: var(--g1t-muted);
25	34		text-decoration: none;
26	35		transition: color 0.15s, background 0.15s;
27	36		}
28		−	a:hover {
	37	+	nav.g1t-nav a:hover {
29	38		background: var(--g1t-raised);
30	39		color: var(--g1t-fg);
31	40		}
32		−	.g1t-nav-cta {
	41	+	nav.g1t-nav .g1t-nav-cta {
33	42		margin-left: 0.25rem;
34	43		background: var(--g1t-fg);
35	44		color: var(--g1t-bg);
36	45		font-weight: 500;
37	46		}
38		−	.g1t-nav-cta:hover {
	47	+	nav.g1t-nav .g1t-nav-cta:hover {
39	48		background: #fff;
40	49		color: var(--g1t-bg);
41	50		}
42		−	.g1t-nav-icon {
43		−	display: inline-flex;
44		−	padding: 0.4rem;
	51	+	nav.g1t-nav .g1t-nav-icon {
	52	+	justify-content: center;
	53	+	width: 2rem;
	54	+	padding: 0;
45	55		}
46	56		.g1t-nav-icon :global(svg) {
47	57		width: 1rem;
48	58		height: 1rem;
49	59		}
50		−	@media (max-width: 50rem) {
51		−	a:not(.g1t-nav-icon):not(.g1t-nav-cta) {
	60	+	/* Tablets and phones: in the header g1t.sh's link gives way (the menu
	61	+	keeps it), and the icons grow to a size a finger can hit. */
	62	+	@media (max-width: 49.99rem) {
	63	+	:global(.g1t-header) nav.g1t-nav a:not(.g1t-nav-icon):not(.g1t-nav-cta) {
	64	+	display: none;
	65	+	}
	66	+	nav.g1t-nav .g1t-nav-icon {
	67	+	width: 2.5rem;
	68	+	height: 2.5rem;
	69	+	}
	70	+	:global(.sidebar-content) nav.g1t-nav a {
	71	+	height: 2.5rem;
	72	+	}
	73	+	}
	74	+	/* Phones: Sign up leaves the header for the menu, where it has room. */
	75	+	@media (max-width: 44.99rem) {
	76	+	:global(.g1t-header) .g1t-nav {
	77	+	gap: 0;
	78	+	}
	79	+	:global(.g1t-header) nav.g1t-nav .g1t-nav-cta {
52	80		display: none;
53	81		}
54	82		}

31	31		\| Context hub search \| Off \|
32	32		\| Deployments on `g1t.page` \| Off \|
33	33		\| Billing \| Off. Nothing is charged, and no usage limit stops work. \|
	34	+	\| Site analytics \| Off. Only g1t.sh sends page analytics (to HeyCatch, as its [privacy policy](https://g1t.sh/policies/privacy#how-the-site-is-used) describes); your installation sends none. \|
34	35		\| Git over SSH and the `g1t` CLI \| Not available yet \|
35	36		\| Scheduled jobs \| Run on their schedules inside the g1t container: webhook retries, purging deleted repositories, the packages sweep, security sweeps, audit log retention and access request summaries. Actions schedules (`on: schedule`) are not run. \|
36	37

Binary or large file; its contents are not shown.

41	41		beneath it. */
42	42		--sl-nav-height: 6.25rem;
43	43		--sl-sidebar-width: 17rem;
	44	+	/* Big enough to tap. */
	45	+	--sl-menu-button-size: 2.5rem;
44	46
45	47		color-scheme: dark;
46	48		}
⋯
62	64		backdrop-filter: blur(10px);
63	65		border-bottom: 1px solid var(--g1t-line);
64	66		}
	67	+	/* The search box fills the header's middle column; Header.astro centres
	68	+	that column in the header, the same on every page. */
65	69		site-search {
	70	+	display: flex;
	71	+	justify-content: center;
66	72		width: 100%;
67		−	max-width: 30rem;
68		−	}
69		−	/* On phones the menu button sits in the header's top row, not its middle. */
70		−	.sl-menu-button {
71		−	top: calc((3.5rem - var(--sl-menu-button-size)) / 2) !important;
72	73		}
73	74		site-search button[data-open-modal] {
74	75		border-radius: 0.5rem;
⋯
80	81		border-color: var(--g1t-line-strong);
81	82		color: var(--g1t-muted);
82	83		}
	84	+	@media (min-width: 50rem) {
	85	+	site-search button[data-open-modal] {
	86	+	max-width: none;
	87	+	}
	88	+	}
	89	+	/* Tablets: the full search box, as on desktop, since there is room. */
	90	+	@media (min-width: 45rem) and (max-width: 49.99rem) {
	91	+	site-search button[data-open-modal] {
	92	+	width: 100%;
	93	+	border: 1px solid var(--g1t-line);
	94	+	padding-inline: 0.75rem 0.5rem;
	95	+	font-size: var(--sl-text-sm);
	96	+	}
	97	+	site-search button[data-open-modal] > span.sl-hidden {
	98	+	display: block;
	99	+	}
	100	+	site-search button[data-open-modal] > kbd.sl-hidden {
	101	+	display: flex;
	102	+	margin-inline-start: auto;
	103	+	}
	104	+	}
	105	+	/* Phones: a search icon, as big as a fingertip. */
	106	+	@media (max-width: 44.99rem) {
	107	+	site-search button[data-open-modal] {
	108	+	justify-content: center;
	109	+	width: 2.5rem;
	110	+	height: 2.5rem;
	111	+	padding: 0;
	112	+	border: 0;
	113	+	background: transparent;
	114	+	color: var(--g1t-muted);
	115	+	font-size: 1.125rem;
	116	+	}
	117	+	}
	118	+	/* The menu button sits in the header's top row, at the end, drawn like
	119	+	the header's other icon buttons rather than as a floating disc. */
	120	+	.sl-menu-button {
	121	+	top: calc((3.5rem - var(--sl-menu-button-size)) / 2) !important;
	122	+	align-items: center;
	123	+	justify-content: center;
	124	+	border-radius: 0.5rem;
	125	+	padding: 0;
	126	+	background: transparent;
	127	+	box-shadow: none;
	128	+	color: var(--g1t-fg-soft);
	129	+	font-size: 1.25rem;
	130	+	}
	131	+	.sl-menu-button:hover,
	132	+	.sl-menu-button:has(~ :popover-open) {
	133	+	background: var(--g1t-raised);
	134	+	color: var(--g1t-fg);
	135	+	}
83	136
84	137		/* --- Sidebar -------------------------------------------------------------- */
85	138
⋯
217	270		overflow-wrap: normal;
218	271		word-break: normal;
219	272		}
	273	+	/* The last column usually holds the sentences. Kept readable, it
	274	+	scrolls the table sideways instead of folding to a word a line. */
	275	+	.sl-markdown-content :is(td, th):last-child:not(:first-child) {
	276	+	min-width: 12rem;
	277	+	}
220	278		}
221	279		.sl-markdown-content th {
222	280		border-bottom: 1px solid var(--g1t-line-strong);
⋯
397	455		white-space: nowrap;
398	456		color: var(--g1t-fg);
399	457		}
	458	+	/* On a phone a long path wraps onto a second line rather than hiding its end. */
	459	+	@media (max-width: 40rem) {
	460	+	.sl-markdown-content .g1t-endpoint {
	461	+	align-items: flex-start;
	462	+	}
	463	+	.sl-markdown-content .g1t-endpoint code {
	464	+	white-space: normal;
	465	+	overflow-wrap: anywhere;
	466	+	}
	467	+	}
400	468		/* Methods: the same small mono tag in the sidebar and on the page. */
401	469		.g1t-method {
402	470		--method: var(--g1t-muted);

1	+	/**
2	+	* Asking a visitor from the EU, EEA, UK or Switzerland before site
3	+	* analytics runs (lib/analytics-consent.ts): both answers are one click,
4	+	* and nothing is fetched or stored for analytics until they agree. The
5	+	* footer's "Cookie choices" asks again (components/footer.tsx).
6	+	*/
7	+	import { useEffect, useState, useSyncExternalStore } from "react";
8	+	import { Link } from "react-router";
9	+
10	+	import { analyticsHere, choice, choose, consentRequired, onChoice } from "../lib/analytics-consent";
11	+
12	+	/** Whether this visitor is asked at all, known only once the page is in the browser. */
13	+	export function useAsksFirst(): boolean {
14	+	const [asks, setAsks] = useState(false);
15	+	useEffect(() => setAsks(analyticsHere() && consentRequired()), []);
16	+	return asks;
17	+	}
18	+
19	+	export function AnalyticsConsent() {
20	+	const asks = useAsksFirst();
21	+	const chosen = useSyncExternalStore(onChoice, choice, () => null);
22	+	if (!asks \|\| chosen) return null;
23	+	return (
24	+	<section
25	+	aria-label="Analytics cookie"
26	+	className="fixed inset-x-3 bottom-3 z-[60] mx-auto max-w-lg rounded-2xl bg-surface p-4 text-sm shadow-2xl shadow-black/50 ring-1 ring-line-strong sm:inset-x-auto sm:right-4 sm:bottom-4"
27	+	>
28	+	<p className="leading-6 text-fg-soft">
29	+	May g1t count how its pages are used? It sets one analytics cookie, and names inside your workspaces are
30	+	removed before anything is sent.{" "}
31	+	<Link to="/policies/privacy#how-the-site-is-used" className="text-accent hover:underline">
32	+	What is sent
33	+	</Link>
34	+	</p>
35	+	<div className="mt-3 flex gap-2">
36	+	<button
37	+	type="button"
38	+	onClick={() => choose("yes")}
39	+	className="flex-1 rounded-lg bg-fg px-3 py-2 font-medium text-bg transition-colors hover:bg-white"
40	+	>
41	+	Allow
42	+	</button>
43	+	<button
44	+	type="button"
45	+	onClick={() => choose("no")}
46	+	className="flex-1 rounded-lg px-3 py-2 font-medium text-fg ring-1 ring-line-strong transition-colors hover:bg-raised"
47	+	>
48	+	No thanks
49	+	</button>
50	+	</div>
51	+	</section>
52	+	);
53	+	}

9	9
10	10		import type { User } from "@g1t/contracts";
11	11
	12	+	import { useAsksFirst } from "./analytics-consent";
12	13		import { Mark } from "./logo";
13		−	import { COMPANY, MAKER_PRODUCTS, copyright, listed } from "../lib/legal";
	14	+	import { choose } from "../lib/analytics-consent";
	15	+	import { COMPANY, MAKER_PRODUCTS, SOCIAL, copyright, listed } from "../lib/legal";
14	16		import { type OverallState, STATUS_JSON_URL, STATUS_URL, STATUS_WORDS, type StatusReport, dotClass } from "../lib/status";
15	17
16	18		/** How long one fetched report is reused across the pages of one visit. */
⋯
94	96		title: "Company",
95	97		links: [
96	98		["Flagon, Inc.", COMPANY.url],
	99	+	...SOCIAL.map((account): [string, string] => [account.label, account.url]),
97	100		["Support", "/support"],
98	101		["Security", "/security"],
99	102		["Status", STATUS_URL],
⋯
167	170		<FlagonMark className="mr-1 inline-block size-[0.95em] -translate-y-px align-middle" />
168	171		{COMPANY.name}
169	172		</a>
170		−	{products.length > 0 ? `, the people behind ${listed(products)}.` : `, ${COMPANY.about}.`}
	173	+	{products.length > 0 ? `, the people behind ${listed(products)}.` : `, ${COMPANY.about} founded by ${COMPANY.founder}.`}
171	174		</p>
172	175		);
173	176		}
⋯
180	183		*/
181	184		export function LegalRow({ user }: { user: User \| null \| undefined }) {
182	185		const status = useSiteStatus();
	186	+	const asksFirst = useAsksFirst();
183	187		const links = [
184	188		<a key="status" href={STATUS_URL} className={`inline-flex items-center gap-1.5 ${ROW_LINK}`}>
185	189		<StatusDot state={status?.overall.state ?? null} />
⋯
190	194		{label}
191	195		</Link>
192	196		)),
	197	+	// Where the visitor was asked about the analytics cookie: ask again.
	198	+	...(asksFirst
	199	+	? [
	200	+	<button key="consent" type="button" onClick={() => choose(null)} className={ROW_LINK}>
	201	+	Cookie choices
	202	+	</button>,
	203	+	]
	204	+	: []),
193	205		];
194	206		const account = [
195	207		user ? (

163	163		/** The four modes of a workspace. */
164	164		const MODES: { icon: ReactNode; name: string; about: string; soon?: boolean; to: string }[] = [
165	165		{
	166	+	icon: <Code2 size={18} />,
	167	+	name: "Code",
	168	+	about: "Repositories, issues, pull requests, checks, a merge queue and deployments. For the people who build.",
	169	+	to: `${DOCS}/concepts/overview/`,
	170	+	},
	171	+	{
166	172		icon: <MessagesSquare size={18} />,
167	173		name: "Chat",
168	174		about: "Channels, direct messages and threads, live. People and agents are members alike.",
⋯
180	186		about: "Specs, runbooks and decisions, written together. Agents read them and keep them current.",
181	187		soon: true,
182	188		to: `${DOCS}/guides/docs/`,
183		−	},
184		−	{
185		−	icon: <Code2 size={18} />,
186		−	name: "Code",
187		−	about: "Repositories, issues, pull requests, checks, a merge queue and deployments. For the people who build.",
188		−	to: `${DOCS}/concepts/overview/`,
189	189		},
190	190		];
191	191
⋯
353	353		to={`${DOCS}/guides/chat/`}
354	354		className="inline-flex animate-fade-up items-center gap-2 rounded-full bg-bg/50 px-3 py-1 text-xs text-fg-soft ring-1 ring-white/10 backdrop-blur transition-colors hover:bg-bg/70"
355	355		>
356		−	<span className="size-1.5 rounded-full bg-accent" />
357		−	Chat, agents, docs and code in one workspace
358		−	<ArrowRight size={12} />
	356	+	<span className="size-1.5 shrink-0 rounded-full bg-accent" />
	357	+	For engineering teams running AI coding agents: chat, agents, docs and code in one workspace
	358	+	<ArrowRight size={12} className="shrink-0" />
359	359		</Link>
360	360		<h1 className="mx-auto mt-7 max-w-4xl animate-fade-up text-[2.75rem] leading-[1.04] font-semibold tracking-tight text-balance sm:text-7xl">
361	361		Your team and its agents,{" "}
⋯
433	433		</div>
434	434		</section>
435	435
436		−	{/* Chat first. */}
437		−	<section className="mx-auto grid max-w-6xl items-start gap-12 px-4 pt-24 lg:grid-cols-[1.1fr_1fr] lg:gap-16">
	436	+	{/* Code. */}
	437	+	<section className="mx-auto max-w-6xl px-4 pt-24">
	438	+	<div className="max-w-3xl">
	439	+	<Eyebrow>Code</Eyebrow>
	440	+	<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance sm:text-5xl">
	441	+	A forge built for many agents at once.
	442	+	</h2>
	443	+	<p className="mt-5 max-w-2xl text-lg leading-8 text-muted">
	444	+	Underneath the conversation is plain git. Every change an agent makes is a pull request in its own fork,
	445	+	checked by g1t, reviewed, and landed through a queue that keeps main passing.
	446	+	</p>
	447	+	</div>
	448	+
	449	+	<div className="mt-6 divide-y divide-line">
	450	+	<Pillar
	451	+	eyebrow="Outcomes"
	452	+	title="Hand off an outcome, not just a task"
	453	+	art={<PlanArt className="w-full" />}
	454	+	points={[
	455	+	"A brief planned into issues with dependencies",
	456	+	"Your workflows' required checks on every change",
	457	+	"Work starts as each dependency lands",
	458	+	"The plan as a live graph, with its cost",
	459	+	]}
	460	+	more={["Hand off an outcome", `${DOCS}/guides/outcomes/`]}
	461	+	>
	462	+	Write what should be true. A planner turns it into issues, each saying what done looks like, and the order
	463	+	they depend on. Agents take each issue as it unblocks, and you watch the whole outcome converge.
	464	+	</Pillar>
	465	+
	466	+	<Pillar
	467	+	flip
	468	+	eyebrow="Ship safely"
	469	+	title="Main only moves to what passed"
	470	+	art={<QueueArt className="w-full" />}
	471	+	points={[
	472	+	"Checks run by g1t in a clean sandbox",
	473	+	"Workflows from .g1t/workflows",
	474	+	"A merge queue that tests changes together",
	475	+	"Conflicts found on every push, before a merge",
	476	+	"Catch up with main in seconds",
	477	+	"Reviews by people and by agents",
	478	+	]}
	479	+	more={["The merge queue", `${DOCS}/guides/merge-queue/`]}
	480	+	>
	481	+	Checks are run by g1t, never by the agent being checked. The queue tests each change together with what
	482	+	lands ahead of it; one that breaks goes back to its author with what failed, and main never sees it.
	483	+	</Pillar>
	484	+
	485	+	<Pillar
	486	+	eyebrow="Context"
	487	+	title="Every line knows why it is there"
	488	+	art={<WhyArt className="w-full" />}
	489	+	points={[
	490	+	"Sessions recorded onto pull requests",
	491	+	"Why-blame on any line",
	492	+	"A context hub agents search before they start",
	493	+	"Search across code, issues and people",
	494	+	]}
	495	+	more={["Sessions and why-blame", `${DOCS}/guides/why-blame/`]}
	496	+	>
	497	+	Pick any line. g1t shows the commit that changed it, the pull request and issue it came from, and the
	498	+	agent's own session: what it read, ran and decided. The reasoning stays with the code, for people and
	499	+	for the next agent.
	500	+	</Pillar>
	501	+
	502	+	<Pillar
	503	+	flip
	504	+	eyebrow="Run it"
	505	+	title="Every change, live on the edge"
	506	+	art={<DeployArt className="w-full" />}
	507	+	points={[
	508	+	"A live preview for every pull request",
	509	+	"Production on every merge to main",
	510	+	"Custom domains, with certificates",
	511	+	"Projects that depend on each other",
	512	+	]}
	513	+	more={["Deployments", `${DOCS}/guides/deployments/`]}
	514	+	>
	515	+	Turn on deployments and every pull request gets its own address on g1t.page; merging ships production.
	516	+	Reviewers, and the agents reviewing for you, click through a change instead of reading a diff. An app nobody
	517	+	visits runs nothing and costs nothing.
	518	+	</Pillar>
	519	+	</div>
	520	+	</section>
	521	+
	522	+	{/* The forge, for people. */}
	523	+	<section className="mx-auto max-w-6xl px-4 py-24">
	524	+	<div className="grid gap-10 lg:grid-cols-[1fr_1.2fr] lg:gap-16">
	525	+	<div>
	526	+	<Eyebrow>Collaborate</Eyebrow>
	527	+	<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance">
	528	+	A complete forge for the people who build
	529	+	</h2>
	530	+	<p className="mt-4 max-w-md leading-7 text-muted">
	531	+	Issues, branches, pull requests and reviews, the way your team already works, with agents as members
	532	+	alongside you. Work by hand, hand work off, or both on the same issue.
	533	+	</p>
	534	+	<More to={`${DOCS}/concepts/overview/`}>How g1t works</More>
	535	+	</div>
	536	+	<div className="rounded-3xl bg-surface p-7 ring-1 ring-line">
	537	+	<p className="text-sm font-medium">Included in every workspace</p>
	538	+	<Tags items={FORGE} />
	539	+	</div>
	540	+	</div>
	541	+	</section>
	542	+
	543	+	{/* Chat, where work is asked for. */}
	544	+	<section className="mx-auto grid max-w-6xl items-start gap-12 px-4 lg:grid-cols-[1.1fr_1fr] lg:gap-16">
438	545		<div>
439	546		<Eyebrow>Chat</Eyebrow>
440	547		<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance sm:text-4xl">
⋯
613	720		</div>
614	721		</section>
615	722
616		−	{/* Coming next: coordination and Docs. */}
	723	+	{/* Switching: what moving in costs, and what holds if g1t goes away. */}
	724	+	<section id="switching" className="mx-auto max-w-6xl scroll-mt-20 px-4 pb-24">
	725	+	<div className="grid gap-10 rounded-3xl bg-surface p-8 ring-1 ring-line sm:p-10 lg:grid-cols-[1fr_1.1fr] lg:gap-16">
	726	+	<div>
	727	+	<Eyebrow>Switching</Eyebrow>
	728	+	<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance">
	729	+	Moving in is an import. Leaving is a git clone.
	730	+	</h2>
	731	+	<p className="mt-4 max-w-xl leading-7 text-muted">
	732	+	Bring repositories across from GitHub in a few clicks: every branch and tag with full history, and their
	733	+	issues if you want them. Import a copy, keep a mirror that follows GitHub while you try g1t, or move and
	734	+	let g1t push back to GitHub so people still working there see every change.
	735	+	</p>
	736	+	<p className="mt-4 max-w-xl leading-7 text-muted">
	737	+	If g1t went away tomorrow, your code is plain git, the source is MIT licensed, and the core forge runs on
	738	+	your own machine with Docker Compose.
	739	+	</p>
	740	+	<More to={`${DOCS}/guides/github/#import-mirror-or-move-a-repository`}>Import from GitHub</More>
	741	+	</div>
	742	+	<div className="space-y-6">
	743	+	<div>
	744	+	<p className="text-sm font-medium">What keeps working</p>
	745	+	<Points
	746	+	columns={false}
	747	+	points={[
	748	+	"git over HTTPS, with your history as it is",
	749	+	"GitHub Actions workflows: rename .github to .g1t and push",
	750	+	"The coding agents you use today, through MCP",
	751	+	"Leaving: git clone, and the REST API for the rest",
	752	+	]}
	753	+	/>
	754	+	</div>
	755	+	<div className="rounded-xl border border-dashed border-line-strong px-4 py-3.5 text-sm leading-6 text-muted">
	756	+	<p className="font-medium text-fg-soft">Not a fit yet if you need</p>
	757	+	<p className="mt-1.5">
	758	+	Single sign-on, git over SSH, or agents, chat and deployments on your own machines: those run only on
	759	+	g1t.sh today. Open pull requests, issue comments, releases and wikis stay behind on import.{" "}
	760	+	<Link to={`${DOCS}/about/limitations/`} className="text-fg-soft underline-offset-4 hover:text-accent hover:underline">
	761	+	What g1t can't do yet
	762	+	</Link>
	763	+	</p>
	764	+	</div>
	765	+	</div>
	766	+	</div>
	767	+	</section>
	768	+
	769	+	{/* Coordination, as it works today; and Docs, coming next. */}
617	770		<section className="mx-auto grid max-w-6xl gap-4 px-4 pb-24 lg:grid-cols-2">
618	771		<div className="rounded-3xl bg-surface p-8 ring-1 ring-line">
619		−	<div className="flex items-center gap-3">
620		−	<Eyebrow>Coordination</Eyebrow>
621		−	<Soon />
622		−	</div>
	772	+	<Eyebrow>Coordination</Eyebrow>
623	773		<h3 className="mt-3 text-2xl font-semibold tracking-tight text-balance">Many agents, no collisions</h3>
624	774		<p className="mt-3 text-sm leading-6 text-muted">
625		−	Before an agent touches an issue, a branch, an environment or a set of paths, it claims it. When two
626		−	agents' work would overlap, they agree who goes first in a thread you can read. Chains of agents stop
627		−	and ask a person after a few hops, and work done for another agent is charged to the task that asked.
	775	+	Every agent already sees what the others are changing and can ask them, through the forge. Each change is a
	776	+	pull request in the agent's own fork, conflicts are found on every push, and the merge queue tests
	777	+	changes together with what lands ahead of them. Five agents can open pull requests the same afternoon and
	778	+	main still only moves to what passed.
628	779		</p>
629		−	<p className="mt-3 text-sm leading-6 text-muted">
630		−	Today, every agent already sees what the others are changing and can ask them, through the forge.
	780	+	<p className="mt-4 flex flex-wrap items-center gap-x-2.5 gap-y-1.5 text-sm leading-6 text-muted">
	781	+	<Soon />
	782	+	<span>
	783	+	Claims and handoffs: an agent claims an issue, branch or set of paths before it starts, and overlapping
	784	+	agents agree who goes first in a thread you can read.
	785	+	</span>
631	786		</p>
	787	+	<More to={`${DOCS}/guides/merge-queue/`}>The merge queue</More>
632	788		</div>
633	789		<div className="rounded-3xl bg-surface p-8 ring-1 ring-line">
634	790		<div className="flex items-center gap-3">
⋯
689	845		</div>
690	846		</section>
691	847
692		−	{/* Code. */}
693		−	<section className="mx-auto max-w-6xl px-4 pt-24">
694		−	<div className="max-w-3xl">
695		−	<Eyebrow>Code</Eyebrow>
696		−	<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance sm:text-5xl">
697		−	A forge built for many agents at once.
698		−	</h2>
699		−	<p className="mt-5 max-w-2xl text-lg leading-8 text-muted">
700		−	Underneath the conversation is plain git. Every change an agent makes is a pull request in its own fork,
701		−	checked by g1t, reviewed, and landed through a queue that keeps main passing.
702		−	</p>
703		−	</div>
704		−
705		−	<div className="mt-6 divide-y divide-line">
706		−	<Pillar
707		−	eyebrow="Outcomes"
708		−	title="Hand off an outcome, not just a task"
709		−	art={<PlanArt className="w-full" />}
710		−	points={[
711		−	"A brief planned into issues with dependencies",
712		−	"Your workflows' required checks on every change",
713		−	"Work starts as each dependency lands",
714		−	"The plan as a live graph, with its cost",
715		−	]}
716		−	more={["Hand off an outcome", `${DOCS}/guides/outcomes/`]}
717		−	>
718		−	Write what should be true. A planner turns it into issues, each saying what done looks like, and the order
719		−	they depend on. Agents take each issue as it unblocks, and you watch the whole outcome converge.
720		−	</Pillar>
721		−
722		−	<Pillar
723		−	flip
724		−	eyebrow="Ship safely"
725		−	title="Main only moves to what passed"
726		−	art={<QueueArt className="w-full" />}
727		−	points={[
728		−	"Checks run by g1t in a clean sandbox",
729		−	"Workflows from .g1t/workflows",
730		−	"A merge queue that tests changes together",
731		−	"Conflicts found on every push, before a merge",
732		−	"Catch up with main in seconds",
733		−	"Reviews by people and by agents",
734		−	]}
735		−	more={["The merge queue", `${DOCS}/guides/merge-queue/`]}
736		−	>
737		−	Checks are run by g1t, never by the agent being checked. The queue tests each change together with what
738		−	lands ahead of it; one that breaks goes back to its author with what failed, and main never sees it.
739		−	</Pillar>
740		−
741		−	<Pillar
742		−	eyebrow="Context"
743		−	title="Every line knows why it is there"
744		−	art={<WhyArt className="w-full" />}
745		−	points={[
746		−	"Sessions recorded onto pull requests",
747		−	"Why-blame on any line",
748		−	"A context hub agents search before they start",
749		−	"Search across code, issues and people",
750		−	]}
751		−	more={["Sessions and why-blame", `${DOCS}/guides/why-blame/`]}
752		−	>
753		−	Pick any line. g1t shows the commit that changed it, the pull request and issue it came from, and the
754		−	agent's own session: what it read, ran and decided. The reasoning stays with the code, for people and
755		−	for the next agent.
756		−	</Pillar>
757		−
758		−	<Pillar
759		−	flip
760		−	eyebrow="Run it"
761		−	title="Every change, live on the edge"
762		−	art={<DeployArt className="w-full" />}
763		−	points={[
764		−	"A live preview for every pull request",
765		−	"Production on every merge to main",
766		−	"Custom domains, with certificates",
767		−	"Projects that depend on each other",
768		−	]}
769		−	more={["Deployments", `${DOCS}/guides/deployments/`]}
770		−	>
771		−	Turn on deployments and every pull request gets its own address on g1t.page; merging ships production.
772		−	Reviewers, and the agents reviewing for you, click through a change instead of reading a diff. An app nobody
773		−	visits runs nothing and costs nothing.
774		−	</Pillar>
775		−	</div>
776		−	</section>
777		−
778		−	{/* The forge, for people. */}
	848	+	{/* Secure by default */}
779	849		<section className="mx-auto max-w-6xl px-4 py-24">
780		−	<div className="grid gap-10 lg:grid-cols-[1fr_1.2fr] lg:gap-16">
781		−	<div>
782		−	<Eyebrow>Collaborate</Eyebrow>
783		−	<h2 className="mt-3 text-3xl font-semibold tracking-tight text-balance">
784		−	A complete forge for the people who build
785		−	</h2>
786		−	<p className="mt-4 max-w-md leading-7 text-muted">
787		−	Issues, branches, pull requests and reviews, the way your team already works, with agents as members
788		−	alongside you. Work by hand, hand work off, or both on the same issue.
789		−	</p>
790		−	<More to={`${DOCS}/concepts/overview/`}>How g1t works</More>
791		−	</div>
792		−	<div className="rounded-3xl bg-surface p-7 ring-1 ring-line">
793		−	<p className="text-sm font-medium">Included in every workspace</p>
794		−	<Tags items={FORGE} />
795		−	</div>
796		−	</div>
797		−	</section>
798		−
799		−	{/* Secure by default */}
800		−	<section className="mx-auto max-w-6xl px-4 pb-24">
801	850		<Eyebrow>Secure by default</Eyebrow>
802	851		<h2 className="mt-3 max-w-2xl text-3xl font-semibold tracking-tight text-balance">
803	852		Safe to hand the work to, and healthy without anyone watching
⋯
915	964		</li>
916	965		))}
917	966		</ul>
918		−	<p className="text-sm leading-6 text-muted">g1t is made by Flagon, Inc., a small, independent software company.</p>
	967	+	<p className="text-sm leading-6 text-muted">g1t is made by Flagon, Inc., a small, independent software company founded by Chase Pierce.</p>
919	968		</div>
920	969		</div>
921	970		</section>

1	1		/**
2	2		* The landing page's product tour: g1t browsing itself. A faithful app
3	3		* frame (rail, sidebars, the real colours) plays one story on a loop, with
4		−	* a soft cursor that moves, clicks and types: a request in #web, an agent's
5		−	* desk, the pull request going green, the ship note, the docs page.
	4	+	* a soft cursor that moves and clicks: the pull request going green and
	5	+	* merging, the request in #web it came from and the ship note, the agent's
	6	+	* sessions, the docs page.
6	7		*
7	8		* The frame is a pure function of time (lib/tour.ts). One rAF loop drives
8	9		* the clock and re-renders only when the frame changes; the step pills'
⋯
182	183
183	184		/** The pill a frame belongs to, from what it shows (the clock's time is not React state). */
184	185		function pillOf(frame: Frame): number {
185		−	if (frame.scene === "docs") return 3;
186		−	if (frame.scene === "code" \|\| frame.merged) return 2;
187		−	if (frame.scene === "agents") return 1;
188		−	return 0;
	186	+	return Math.max(0, PILLS.findIndex((pill) => pill.scene === frame.scene));
189	187		}
190	188
191	189		/** What the line under the frame says about the moment: working today, or a preview. */
⋯
1221	1219		observer.observe(element);
1222	1220		return () => observer.disconnect();
1223	1221		}, []);
1224		−	const scenes: Scene[] = ["chat", "agents", "code", "docs"];
	1222	+	const scenes: Scene[] = ["code", "chat", "agents", "docs"];
1225	1223		const mains: Record<Scene, ReactNode> = {
1226	1224		chat: <ChatMain frame={frame} />,
1227	1225		agents: <AgentsMain frame={frame} />,
⋯
1286	1284		];
1287	1285
1288	1286		function Phone({ frame }: { frame: Frame }) {
1289		−	const scenes: Scene[] = ["chat", "agents", "code", "docs"];
	1287	+	const scenes: Scene[] = ["code", "chat", "agents", "docs"];
1290	1288		return (
1291	1289		<div className="relative flex h-[34rem] w-full flex-col overflow-hidden rounded-2xl bg-bg text-left shadow-2xl shadow-black/50 ring-1 ring-line">
1292	1290		<div className="flex h-12 shrink-0 items-center gap-2 border-b border-line px-3">
⋯
1410	1408		<p className="flex items-center gap-2 text-sm font-semibold text-fg">
1411	1409		Otto <AgentTag />
1412	1410		</p>
1413		−	<p className="text-[11px] text-muted">Working · ${cost.toFixed(2)} of $5</p>
	1411	+	<p className="text-[11px] text-muted">{frame.merged ? "Shipped #431" : "Working"} · ${cost.toFixed(2)} of $5</p>
1414	1412		</div>
1415	1413		</div>
1416	1414		<div className="rounded-xl border border-line bg-surface">

1	1		This policy explains what information g1t collects, why, where it goes, how long we keep it, and what you can do about it. It covers g1t.sh, api.g1t.sh, mcp.g1t.sh, docs.g1t.sh, g1t.page and the agents and sandboxes g1t runs. g1t is run by Flagon, Inc. ("Flagon", "we"), which is responsible for your information.
2	2
3		−	The short version: we collect what we need to run a git platform for you and your agents, we don't sell it, we don't advertise, we don't use your private content to train AI models, and there are no third-party trackers on g1t.
	3	+	The short version: we collect what we need to run a git platform for you and your agents, we don't sell it, we don't advertise, we don't use your private content to train AI models, and the only analytics on g1t.sh counts how pages are used without reading what is in your workspaces.
4	4
5	5		## What we collect
6	6
⋯
38	38
39	39		Payments are handled by Stripe. Card numbers never reach g1t. From Stripe we keep the workspace's customer reference, the card's brand, last four digits and expiry date, whether it is a prepaid card, and a fingerprint of the card that Stripe gives us, so that each card gets only one trial. Your billing email, address and tax ID are held by Stripe. We keep the workspace's statement: usage, charges, credits, payments and invoices.
40	40
	41	+	### How the site is used
	42	+
	43	+	On g1t.sh, our analytics provider HeyCatch, Inc. records page views, clicks and the page each happened on, with your browser and device type, your IP address (which it uses to estimate your country and city) and the site that sent you. We use it to learn which pages help people and where they get stuck.
	44	+
	45	+	- On the public pages (the home page, pricing, Explore, signing up and signing in, support, security and these policies) it receives the page's address and the text of what you click.
	46	+	- Everywhere else your browser removes names before anything is sent: an address such as `g1t.sh/acme/web/pull/12` is sent as `/:name/:name/pull/:n`, and page titles and the text, links and attributes of what you click are left out. Nothing from your repositories, issues, pull requests or chat is sent.
	47	+	- If you're signed in, it receives your account's internal id, so your visits count as one person. Not your username, email address or name.
	48	+	- Never: recordings of your screen or session, what you type, or error reports.
	49	+	- Query strings are removed, except campaign tags (`utm_…`).
	50	+
	51	+	If you're in the EU, the EEA, the UK or Switzerland, we ask first. Until you choose Allow, nothing is loaded from HeyCatch, no analytics cookie is set and nothing is sent. Your answer is kept in your browser's local storage (`g1t_analytics`), and Cookie choices at the foot of any page asks again. Elsewhere, analytics runs without asking. If your browser sends Do Not Track, nothing is recorded anywhere. A g1t you run yourself sends nothing to HeyCatch.
	52	+
	53	+	HeyCatch stores these events with PostHog in the United States, under its [data processing addendum](https://heycatch.ai/dpa), which includes the EU Standard Contractual Clauses.
	54	+
41	55		### When you write to us
42	56
43	57		If you email support, security, privacy or billing, we keep the conversation, so we can help you and remember what we said.
⋯
48	62
49	63		## Cookies and browser storage
50	64
51		−	g1t uses only the cookies it needs to work. There are no analytics, advertising or third-party tracking cookies.
	65	+	g1t uses the cookies it needs to work, and one analytics cookie. There are no advertising or cross-site tracking cookies.
52	66
53	67		\| Cookie \| What it's for \| How long \|
54	68		\| --- \| --- \| --- \|
⋯
56	70		\| `g1t_ws` \| Remembers which workspace you last chose, so the sidebar opens on it. \| 1 year \|
57	71		\| `g1t_seen` \| Remembers when you last looked at mission control, so it can show what's new since. \| 1 year \|
58	72		\| `g1t_tz` \| Your browser's time zone, so mission control's greeting and days fit your day. \| 1 year \|
	73	+	\| `ph_…_posthog` \| Set by HeyCatch's analytics on g1t.sh: a random id for your browser, so its visits count as one visitor ([above](#how-the-site-is-used)). In the EU, the EEA, the UK and Switzerland, only after you allow it. \| 1 year \|
59	74
60	75		Cloudflare may set its own security cookies (such as `__cf_bm`) to tell people from bots when g1t is under attack.
61	76
62		−	The site also keeps a few preferences in your browser's local storage, which never leave your device: which coding agent you set up with, how you like diffs shown, and checklist items you've dismissed.
	77	+	The site also keeps a few preferences in your browser's local storage, which never leave your device: which coding agent you set up with, how you like diffs shown, and checklist items you've dismissed. HeyCatch keeps a copy of its analytics id there too, which is sent with each analytics event.
63	78
64	79		Fonts. g1t.sh and docs.g1t.sh serve their typefaces themselves, so loading a page asks no one else for them.
65	80
⋯
72	87		- bill workspaces and keep the records the law requires;
73	88		- send you the email g1t needs to: confirming your address, resetting your password, billing alerts and receipts, answers to requests you made, and important changes to g1t or these policies. We don't send marketing email;
74	89		- answer you when you write to us;
75		−	- improve g1t, using our own records of how it is used. We don't use your private content to train AI models.
	90	+	- improve g1t, using our own records of how it is used and the site analytics [above](#how-the-site-is-used). We don't use your private content to train AI models.
76	91
77	92		If you're in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (running the service you signed up for), our legitimate interests (keeping g1t secure, preventing abuse, and improving it, balanced against your rights), and legal obligations (such as keeping tax records).
78	93
⋯
82	97
83	98		We share information only to run g1t, at your direction, or when the law requires it.
84	99
85		−	- Service providers ("subprocessors") that run parts of g1t for us, under contracts that limit them to doing so: Cloudflare (hosting, storage, databases, sandboxes, email, search and the AI gateway), Stripe (payments) and Anthropic (the model behind hosted agents). The [subprocessors](/policies/subprocessors) page lists them and what each receives.
	100	+	- Service providers ("subprocessors") that run parts of g1t for us, under contracts that limit them to doing so: Cloudflare (hosting, storage, databases, sandboxes, email, search and the AI gateway), Stripe (payments), Anthropic (the model behind hosted agents) and HeyCatch (site analytics). The [subprocessors](/policies/subprocessors) page lists them and what each receives.
86	101		- Services you connect. When you connect your own model provider, an issue tracker, error tracking or a webhook, or let your sandboxes reach a host, we send them what that connection needs, because you asked us to.
87	102		- Other people on g1t, as your settings allow: your workspace's members, and everyone for public projects and your public profile.
88	103		- Vulnerability databases. To find vulnerable dependencies, we send the names and versions of packages in your lockfiles to OSV.dev, an open database run by Google. Nothing else about you or your repository is sent.

6	6		\| --- \| --- \| --- \| --- \|
7	7		\| Cloudflare, Inc. \| Hosting and the network g1t runs on (Workers), databases (D1), storage for repositories, avatars and screenshots (Artifacts, KV and R2), queues, the sandboxes agents and checks run in (Containers), sending email (Email Service), search embeddings (Workers AI and Vectorize), the gateway hosted agents reach their model through (AI Gateway), and screenshots of deployed apps (Browser Rendering) \| Everything stored on g1t, and every request to it \| Global \|
8	8		\| Stripe, Inc. \| Payments, cards, invoices and receipts \| Workspace owners' billing details, card details (entered on Stripe's page, never on g1t), and what each invoice charges \| United States \|
	9	+	\| HeyCatch, Inc. \| Product analytics on g1t.sh: page views and clicks. Visitors in the EU, EEA, UK and Switzerland are asked first \| The page's address (names replaced outside the public pages), the text of what is clicked on the public pages, browser and device type, IP address, the referring site, an analytics id, and a signed-in person's internal account id. Never repository content, chat, page titles inside the app, what you type, or recordings of your session \| United States \|
9	10		\| Anthropic, PBC \| The AI model behind g1t's hosted agents \| What an agent run needs: the issue or request, the relevant code and files, the conversation so far, and tool results. Not your account details. Only when a hosted agent runs \| United States \|
10	11
11	12		AI Gateway logs. Each hosted agent's model request passes through Cloudflare AI Gateway, which records it with the workspace, repository and pull request it was for, so we can bill it accurately.
12	13
13	14		Training. Anthropic does not train its models on what g1t sends through its commercial API.
14	15
	16	+	HeyCatch stores analytics events with PostHog (United States) and lists its own subprocessors at [heycatch.ai/subprocessors](https://heycatch.ai/subprocessors). Its [data processing addendum](https://heycatch.ai/dpa) covers what it does for g1t, including the EU Standard Contractual Clauses for transfers to the United States.
	17	+
15	18		## Other services g1t calls
16	19
17	20		- OSV.dev, run by Google: the names and versions of packages in your lockfiles, to look up known vulnerabilities. Nothing that identifies you or your repository.

61	61
62	62		## Not built yet
63	63
64		−	We'd rather tell you than have you assume. Two-factor authentication and single sign-on are not available yet. Until they are, use a long, unique password, and review your access tokens and authorized apps in your settings from time to time.
	64	+	We'd rather tell you than have you assume. Single sign-on is not available yet. Until it is, turn on [two-factor authentication](/settings/two-factor), and review your access tokens and authorized apps in your settings from time to time.
65	65
66	66		## Responsible disclosure
67	67
⋯
100	100		- We'll aim to fix critical problems within 30 days.
101	101		- We'll credit you when we publish the fix, if you'd like.
102	102
103		−	g1t doesn't have a paid bug bounty yet.
	103	+	### No bug bounty, yet
	104	+
	105	+	g1t doesn't pay bug bounties right now. We want to, and we will once g1t is making money to pay them from. Until then, we can offer the credit above and our thanks.
	106	+
	107	+	### Fixing it yourself
	108	+
	109	+	g1t is open source, so you can also send the fix. [Its source](/flagon-io/g1t) is on g1t, and changes land through pull requests like anyone else's: see [contributing](/flagon-io/g1t/blob/main/CONTRIBUTING.md).
	110	+
	111	+	For a vulnerability that isn't fixed yet, write to us first: a public pull request shows the problem to everyone before the fix is live. We'll agree with you when to open it. Hardening that doesn't point at an open hole, such as stricter headers, tighter checks or better tests, is welcome as a pull request straight away.
104	112
105	113		### Safe harbour
106	114

2	2		import { hydrateRoot } from "react-dom/client";
3	3		import { HydratedRouter } from "react-router/dom";
4	4
	5	+	// Product analytics, started before the app (lib/analytics.client.ts).
	6	+	import "./lib/analytics.client";
	7	+
5	8		startTransition(() => {
6	9		hydrateRoot(
7	10		document,

1	+	import assert from "node:assert/strict";
2	+	import { test } from "node:test";
3	+
4	+	import { asksFirst, choice, consentRequired } from "./analytics-consent.ts";
5	+
6	+	test("visitors from the EU, EEA, UK and Switzerland are asked first", () => {
7	+	for (const country of ["DE", "fr", "IE", "NO", "IS", "GB", "CH"]) assert.equal(asksFirst(country), true, country);
8	+	});
9	+
10	+	test("others are not, nor is a visitor whose country is unknown", () => {
11	+	for (const country of ["US", "CA", "AU", "JP", "BR"]) assert.equal(asksFirst(country), false, country);
12	+	assert.equal(asksFirst(null), false);
13	+	assert.equal(asksFirst(""), false);
14	+	});
15	+
16	+	test("on the server nothing is chosen or required", () => {
17	+	assert.equal(choice(), null);
18	+	assert.equal(consentRequired(), false);
19	+	});

1	+	/**
2	+	* Whether a visitor has agreed to site analytics, where the law asks
3	+	* first: the EU and EEA, the UK and Switzerland. The server decides from
4	+	* the visitor's country and marks the page (`<meta name="g1t-analytics"
5	+	* content="consent">`); the choice is kept in this browser's local
6	+	* storage. Safe to import on the server, where nothing is chosen.
7	+	*/
8	+
9	+	/** Countries whose visitors are asked before analytics runs. */
10	+	const ASK_FIRST = new Set([
11	+	// The EU.
12	+	"AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE", "GR", "HU", "IE", "IT", "LV", "LT", "LU",
13	+	"MT", "NL", "PL", "PT", "RO", "SK", "SI", "ES", "SE",
14	+	// The rest of the EEA, the UK and Switzerland.
15	+	"IS", "LI", "NO", "GB", "CH",
16	+	]);
17	+
18	+	/** Whether a visitor from `country` (ISO 3166 alpha-2, as Cloudflare gives it) is asked first. */
19	+	export function asksFirst(country: string \| null \| undefined): boolean {
20	+	return !!country && ASK_FIRST.has(country.toUpperCase());
21	+	}
22	+
23	+	/**
24	+	* Whether the visitor making `request` is asked first. Cloudflare sets the
25	+	* country header (replacing any the visitor sent); `cf` is the same answer.
26	+	*/
27	+	export function visitorAsksFirst(request: Request): boolean {
28	+	return asksFirst(request.headers.get("cf-ipcountry") ?? (request as Request & { cf?: { country?: string } }).cf?.country);
29	+	}
30	+
31	+	/** The installation analytics runs on; anywhere else nothing is sent or asked. */
32	+	export const ANALYTICS_HOST = "g1t.sh";
33	+
34	+	export function analyticsHere(): boolean {
35	+	return typeof window !== "undefined" && window.location.hostname === ANALYTICS_HOST;
36	+	}
37	+
38	+	/** Whether this page was marked as one whose visitor is asked first. */
39	+	export function consentRequired(): boolean {
40	+	return typeof document !== "undefined" && document.querySelector('meta[name="g1t-analytics"][content="consent"]') !== null;
41	+	}
42	+
43	+	export type Choice = "yes" \| "no" \| null;
44	+
45	+	const KEY = "g1t_analytics";
46	+	let current: Choice \| undefined;
47	+	const listeners = new Set<() => void>();
48	+
49	+	/** What this browser chose; null until it has. */
50	+	export function choice(): Choice {
51	+	if (typeof window === "undefined") return null;
52	+	if (current === undefined) {
53	+	try {
54	+	const stored = window.localStorage.getItem(KEY);
55	+	current = stored === "yes" \|\| stored === "no" ? stored : null;
56	+	} catch {
57	+	current = null;
58	+	}
59	+	}
60	+	return current;
61	+	}
62	+
63	+	/** Record a choice, or null to ask again. */
64	+	export function choose(next: Choice) {
65	+	current = next;
66	+	try {
67	+	if (next) window.localStorage.setItem(KEY, next);
68	+	else window.localStorage.removeItem(KEY);
69	+	} catch {
70	+	// No storage: the choice holds for this page only.
71	+	}
72	+	for (const listener of listeners) listener();
73	+	}
74	+
75	+	export function onChoice(listener: () => void): () => void {
76	+	listeners.add(listener);
77	+	return () => listeners.delete(listener);
78	+	}
79	+
80	+	/** Whether analytics may run in this browser now. */
81	+	export function allowed(): boolean {
82	+	return analyticsHere() && (!consentRequired() \|\| choice() === "yes");
83	+	}

1	+	import assert from "node:assert/strict";
2	+	import { test } from "node:test";
3	+
4	+	import { isPublicPath, scrubEvent, scrubPath, scrubUrl } from "./analytics-scrub.ts";
5	+
6	+	const ORIGIN = "https://g1t.sh";
7	+
8	+	test("the front door is sent as it is", () => {
9	+	for (const path of ["/", "/pricing", "/explore", "/register", "/policies/privacy", "/pricing/"]) {
10	+	assert.equal(isPublicPath(path), true, path);
11	+	assert.equal(scrubPath(path), path);
12	+	}
13	+	});
14	+
15	+	test("names in other addresses are replaced, and g1t's own words kept", () => {
16	+	assert.equal(scrubPath("/acme/web/pull/12/files"), "/:name/:name/pull/:n/files");
17	+	assert.equal(scrubPath("/acme/-/chat/secret-launch"), "/:name/-/chat/:name");
18	+	assert.equal(scrubPath("/u/sam"), "/u/:name");
19	+	assert.equal(scrubPath("/invite/abc123"), "/invite/:name");
20	+	assert.equal(scrubPath("/acme/web/blob/main/src/keys.ts"), "/:name/:name/blob/:name/:name/:name");
21	+	});
22	+
23	+	test("a URL on the site keeps only campaign parameters; another site's is left alone", () => {
24	+	assert.equal(scrubUrl("https://g1t.sh/reset?token=s3cret&utm_source=x", ORIGIN), "https://g1t.sh/reset?utm_source=x");
25	+	assert.equal(scrubUrl("https://g1t.sh/search?q=private", ORIGIN), "https://g1t.sh/search");
26	+	assert.equal(scrubUrl("https://g1t.sh/acme/web#L4", ORIGIN), "https://g1t.sh/:name/:name");
27	+	assert.equal(scrubUrl("https://news.example/acme?x=1", ORIGIN), "https://news.example/acme?x=1");
28	+	});
29	+
30	+	test("a click inside the app goes without its text, link, attributes or title", () => {
31	+	const event = scrubEvent(
32	+	{
33	+	event: "$autocapture",
34	+	properties: {
35	+	$current_url: "https://g1t.sh/acme/secret/issues/3",
36	+	$pathname: "/acme/secret/issues/3",
37	+	$title: "Rotate the prod key · acme/secret · g1t",
38	+	$el_text: "Rotate the prod key",
39	+	$elements_chain: 'a.link:text="Rotate the prod key"href="/acme/secret/issues/3"nth-child="1"attr__class="link"',
40	+	$elements: [{ tag_name: "a", $el_text: "Rotate", href: "/acme/secret", attr__title: "x", nth_child: 1 }],
41	+	$set_once: { $initial_current_url: "https://g1t.sh/acme/secret" },
42	+	},
43	+	},
44	+	"/acme/secret/issues/3",
45	+	ORIGIN,
46	+	);
47	+	assert.deepEqual(event?.properties, {
48	+	$current_url: "https://g1t.sh/:name/:name/issues/:n",
49	+	$pathname: "/:name/:name/issues/:n",
50	+	$title: "g1t",
51	+	$elements_chain: 'a.link:nth-child="1"',
52	+	$elements: [{ tag_name: "a", nth_child: 1 }],
53	+	$set_once: { $initial_current_url: "https://g1t.sh/:name/:name" },
54	+	});
55	+	});
56	+
57	+	test("on the front door a click keeps its text", () => {
58	+	const event = scrubEvent(
59	+	{ event: "$autocapture", properties: { $el_text: "Start for free", $title: "g1t · Your team", $pathname: "/" } },
60	+	"/",
61	+	ORIGIN,
62	+	);
63	+	assert.deepEqual(event?.properties, { $el_text: "Start for free", $title: "g1t · Your team", $pathname: "/" });
64	+	});
65	+
66	+	test("recordings and error reports are never sent, and heatmaps only from the front door", () => {
67	+	assert.equal(scrubEvent({ event: "$snapshot", properties: {} }, "/", ORIGIN), null);
68	+	assert.equal(scrubEvent({ event: "$exception", properties: {} }, "/", ORIGIN), null);
69	+	assert.equal(scrubEvent({ event: "$$heatmap", properties: {} }, "/acme/web", ORIGIN), null);
70	+	const heatmap = scrubEvent({ event: "$$heatmap", properties: { $heatmap_data: { "https://g1t.sh/pricing?ref=mail": [1] } } }, "/pricing", ORIGIN);
71	+	assert.deepEqual(heatmap?.properties, { $heatmap_data: { "https://g1t.sh/pricing": [1] } });
72	+	});
73	+
74	+	test("pages after signing in keep their address but not their text, which can show an email address", () => {
75	+	assert.equal(scrubPath("/confirm-email"), "/confirm-email");
76	+	assert.equal(scrubPath("/login/two-factor"), "/login/two-factor");
77	+	const event = scrubEvent({ event: "$autocapture", properties: { $el_text: "Resend to sam@example.com" } }, "/confirm-email", ORIGIN);
78	+	assert.deepEqual(event?.properties, {});
79	+	});

1	+	/**
2	+	* What product analytics may learn from a page, decided before an event
3	+	* leaves the browser (lib/analytics.client.ts).
4	+	*
5	+	* The public front door (the home page, pricing, Explore, signing up and
6	+	* in, support, security and the policies) is sent as it is. Everywhere else, names are replaced
7	+	* with placeholders: `/acme/web/pull/12` is sent as
8	+	* `/:name/:name/pull/:n`, the page title as "g1t", and a clicked element
9	+	* without its text, link or attributes. Query strings keep only `utm_*`.
10	+	* Session recordings and error reports are never sent, and click heatmaps
11	+	* only from the front door. No Workers or browser imports, so it is tested
12	+	* under Node.
13	+	*/
14	+
15	+	/** Paths sent as they are. */
16	+	const PUBLIC = new Set([
17	+	"/",
18	+	"/pricing",
19	+	"/explore",
20	+	"/register",
21	+	"/login",
22	+	"/security",
23	+	"/support",
24	+	"/status",
25	+	"/policies",
26	+	]);
27	+
28	+	/**
29	+	* Words of g1t's own addresses, kept in a scrubbed path so it still says
30	+	* which kind of page it was. Anything else is a name, and is replaced.
31	+	*/
32	+	const ROUTE_WORDS = new Set([
33	+	"-", "about.json", "account", "actions", "activity", "agents", "applications", "archive", "audit", "billing",
34	+	"blob", "branches", "browse", "bypass-requests", "chat", "checks", "code", "code-access", "commit", "commits",
35	+	"compare", "confirm-email", "context", "deployments", "dm", "docs", "emails", "emoji", "entries", "explore", "files", "forgot", "gateway",
36	+	"github", "guardrails", "home", "inbox", "insights", "integrations", "invitations", "invite", "invites", "issues",
37	+	"jobs", "keys", "labels", "login", "members", "memory", "merge-queue", "milestones", "new", "notifications", "overview",
38	+	"packages", "patterns", "people", "personal-access-tokens", "pins", "policies", "profile", "projects", "pull",
39	+	"pulls", "queue", "releases", "repositories", "reset", "rules", "runners", "runs", "search", "secrets", "security",
40	+	"security-log", "settings", "soon", "spend", "tags", "teams", "tokens", "tree", "two-factor", "u", "usage",
41	+	"verify", "webhooks", "workspace", "workspaces",
42	+	]);
43	+
44	+	export function isPublicPath(pathname: string): boolean {
45	+	const path = pathname.replace(/\/+$/, "") \|\| "/";
46	+	return PUBLIC.has(path) \|\| path.startsWith("/policies/");
47	+	}
48	+
49	+	/** A path as analytics may see it. */
50	+	export function scrubPath(pathname: string): string {
51	+	if (isPublicPath(pathname)) return pathname;
52	+	return pathname
53	+	.split("/")
54	+	.map((segment) => {
55	+	if (segment === "" \|\| ROUTE_WORDS.has(segment)) return segment;
56	+	return /^\d+$/.test(segment) ? ":n" : ":name";
57	+	})
58	+	.join("/");
59	+	}
60	+
61	+	/** Only campaign parameters survive; everything else in a query can name something. */
62	+	function scrubSearch(search: URLSearchParams): string {
63	+	const kept = new URLSearchParams();
64	+	for (const [key, value] of search) if (key.startsWith("utm_")) kept.append(key, value);
65	+	const query = kept.toString();
66	+	return query ? `?${query}` : "";
67	+	}
68	+
69	+	/** A URL on this site as analytics may see it; another site's is left alone. */
70	+	export function scrubUrl(value: string, origin: string): string {
71	+	let url: URL;
72	+	try {
73	+	url = new URL(value);
74	+	} catch {
75	+	return value;
76	+	}
77	+	if (url.origin !== origin) return value;
78	+	return `${url.origin}${scrubPath(url.pathname)}${scrubSearch(url.searchParams)}`;
79	+	}
80	+
81	+	/** Element text, links and attributes in autocapture's chain string. */
82	+	const CHAIN_DETAIL = /(?:text\|href\|attr__[\w-]+)="(?:[^"\\]\|\\.)*"/g;
83	+
84	+	function scrubValue(key: string, value: unknown, origin: string, publicPage: boolean): unknown {
85	+	if (typeof value === "string") {
86	+	if (!publicPage && (key === "$title" \|\| key === "title")) return "g1t";
87	+	if (!publicPage && key === "$el_text") return undefined;
88	+	if (!publicPage && key === "$elements_chain") return value.replace(CHAIN_DETAIL, "");
89	+	if (/pathname$/i.test(key) && value.startsWith("/")) return scrubPath(value);
90	+	return value.startsWith(origin) ? scrubUrl(value, origin) : value;
91	+	}
92	+	if (Array.isArray(value)) return value.map((item) => scrubValue(key, item, origin, publicPage));
93	+	if (value && typeof value === "object") {
94	+	const out: Record<string, unknown> = {};
95	+	for (const [inner, innerValue] of Object.entries(value)) {
96	+	if (!publicPage && (inner === "$el_text" \|\| inner === "href" \|\| inner.startsWith("attr__"))) continue;
97	+	const scrubbed = scrubValue(inner, innerValue, origin, publicPage);
98	+	// Some objects are keyed by address, such as a heatmap's pages.
99	+	if (scrubbed !== undefined) out[inner.startsWith(origin) ? scrubUrl(inner, origin) : inner] = scrubbed;
100	+	}
101	+	return out;
102	+	}
103	+	return value;
104	+	}
105	+
106	+	/** Events that are never sent: session recordings and error reports, which carry page content. */
107	+	const NEVER = new Set(["$snapshot", "$snapshot_items", "$exception"]);
108	+
109	+	export type CapturedEvent = { event: string; properties: Record<string, unknown>; [key: string]: unknown };
110	+
111	+	/**
112	+	* The event as analytics may see it, or null to drop it. `pathname` is the
113	+	* page the event happened on; `origin` is this site's.
114	+	*/
115	+	export function scrubEvent<T extends CapturedEvent>(event: T \| null, pathname: string, origin: string): T \| null {
116	+	if (!event \|\| NEVER.has(event.event)) return null;
117	+	const publicPage = isPublicPath(pathname);
118	+	// A heatmap is keyed by the page's address, and holds where on it people clicked.
119	+	if (event.event === "$$heatmap" && !publicPage) return null;
120	+	const properties = scrubValue("", event.properties ?? {}, origin, publicPage) as Record<string, unknown>;
121	+	return { ...event, properties };
122	+	}

1	+	/**
2	+	* Product analytics (HeyCatch), on g1t.sh only: pageviews, clicks and
3	+	* route changes. Every event passes through lib/analytics-scrub.ts first,
4	+	* so inside the app names, text and titles never leave the browser, and
5	+	* recordings are never sent. A signed-in person is known by their account
6	+	* id alone (`identify` below).
7	+	*
8	+	* The SDK is fetched once the page has loaded and the browser is idle, so
9	+	* it never slows a page down; where a visitor is asked first
10	+	* (lib/analytics-consent.ts) it is not fetched at all until they agree.
11	+	* Imported by entry.client.tsx. A self-hosted g1t sends nothing.
12	+	*/
13	+	import type { analytics as Analytics } from "@heycatch/sdk";
14	+
15	+	import { allowed, analyticsHere, choice, consentRequired, onChoice } from "./analytics-consent";
16	+	import { scrubEvent } from "./analytics-scrub";
17	+
18	+	let sdk: Promise<typeof Analytics> \| null = null;
19	+	/** Who is signed in, kept for when the SDK arrives. */
20	+	let signedIn: string \| null = null;
21	+
22	+	function load(): Promise<typeof Analytics> {
23	+	sdk ??= import("@heycatch/sdk").then(({ analytics }) => {
24	+	analytics.init({
25	+	projectKey: "hck_pk_EsF6nrWNZ0tOM4cmDKA6tKBzdTr-GEW3",
26	+	install: { framework: "react", frameworkVersion: "19", agent: "claude-code" },
27	+	respectDnt: true,
28	+	beforeSend: (event) => scrubEvent(event, window.location.pathname, window.location.origin),
29	+	});
30	+	if (signedIn) analytics.setIdentity(signedIn);
31	+	return analytics;
32	+	});
33	+	return sdk;
34	+	}
35	+
36	+	/** After the page has loaded, when the browser has a moment. */
37	+	function whenIdle(run: () => void) {
38	+	// Safari has no requestIdleCallback.
39	+	const idle = () => (typeof window.requestIdleCallback === "function" ? window.requestIdleCallback(run, { timeout: 4000 }) : setTimeout(run, 1500));
40	+	if (document.readyState === "complete") idle();
41	+	else window.addEventListener("load", idle, { once: true });
42	+	}
43	+
44	+	if (analyticsHere()) {
45	+	if (allowed()) whenIdle(() => void load());
46	+	// A choice made on the banner, or changed from the footer.
47	+	onChoice(() => {
48	+	if (!consentRequired()) return;
49	+	if (choice() === "yes") void load().then((analytics) => analytics.optInCapturing());
50	+	else if (sdk) void sdk.then((analytics) => analytics.optOutCapturing());
51	+	});
52	+	}
53	+
54	+	/** Who is signed in, by account id only; null after signing out. */
55	+	export function identify(userId: string \| null, previous: string \| null) {
56	+	signedIn = userId;
57	+	if (!sdk) return;
58	+	void sdk.then((analytics) => {
59	+	if (userId) analytics.setIdentity(userId);
60	+	else if (previous) analytics.resetIdentity();
61	+	});
62	+	}

10	10		url: "https://www.flagon.io",
11	11		/** How the footer describes it. */
12	12		about: "a small, independent software company",
	13	+	/** Who founded it, named wherever the company is described. */
	14	+	founder: "Chase Pierce",
13	15		};
14	16
	17	+	/** g1t's own accounts elsewhere. */
	18	+	export const SOCIAL: { label: string; url: string }[] = [{ label: "X", url: "https://x.com/g1t_sh" }];
	19	+
15	20		/**
16	21		* Flagon's other launched products, which the footer's maker line names
17	22		* ("…, the people behind X and Y"). None yet: add each here when it ships.
⋯
84	89		];
85	90
86	91		/** When any policy last changed, `YYYY-MM-DD`. */
87		−	export const POLICIES_UPDATED = "2026-10-06";
	92	+	export const POLICIES_UPDATED = "2026-10-09";
88	93
89	94		/** Every change to the policies, newest first. */
90	95		export const POLICY_HISTORY: { date: string; change: string }[] = [
91	96		{
	97	+	date: "2026-10-09",
	98	+	change:
	99	+	"Privacy Policy: g1t.sh uses HeyCatch for site analytics, with names removed outside the public pages, and one analytics cookie, set in the EU, EEA, UK and Switzerland only after you allow it. Subprocessors: HeyCatch, Inc. added.",
	100	+	},
	101	+	{
92	102		date: "2026-10-06",
93	103		change:
94	104		"Privacy Policy: request logs are kept 7 days, and database history 30 days. Subprocessors: GitHub listed among the integrations you choose, in place of Slack, which g1t does not connect to.",

7	7		* - No other site may put g1t's pages in a frame.
8	8		* - A page runs only the scripts the site served it: its own files, and the
9	9		* inline scripts React and React Router write, each carrying the page's
10		−	* nonce. Styles may be inline (highlighting and layout set them); images
11		−	* may come from any HTTPS address (pictures in a README); requests may go
12		−	* to any HTTPS address (the status page's summary).
	10	+	* nonce, plus Cloudflare's and HeyCatch's analytics scripts. Styles may
	11	+	* be inline (highlighting and layout set them); images may come from any
	12	+	* HTTPS address (pictures in a README); requests may go to any HTTPS
	13	+	* address (the status page's summary, analytics events).
13	14		*/
14	15
15	16		/** A fresh nonce for one page: 128 random bits, base64. */
⋯
27	28		const files = usercontent && /^http:/.test(usercontent) ? ` ${new URL(usercontent).origin}` : "";
28	29		return [
29	30		"default-src 'self'",
30		−	// Cloudflare's Web Analytics beacon, when the zone turns it on.
31		−	`script-src 'self' 'nonce-${nonce}' https://static.cloudflareinsights.com`,
	31	+	// Cloudflare's Web Analytics beacon, when the zone turns it on, and
	32	+	// HeyCatch's helper for product analytics (lib/analytics.client.ts).
	33	+	`script-src 'self' 'nonce-${nonce}' https://static.cloudflareinsights.com https://in.heycatch.ai`,
32	34		"style-src 'self' 'unsafe-inline'",
33	35		`img-src 'self' https: data: blob:${files}`,
34	36		`media-src 'self' https:${files}`,

1	+	/**
2	+	* Schema.org JSON-LD for the pages that say what g1t is and what it costs,
3	+	* so search engines and AI assistants read it without parsing the prose.
4	+	* Each is a `script:ld+json` meta descriptor, added after `page(…)`.
5	+	*/
6	+	import type { MetaDescriptor } from "react-router";
7	+
8	+	import { COMPANY, SOCIAL } from "./legal";
9	+	import { DESCRIPTION, SITE } from "./meta";
10	+
11	+	export function organization(): MetaDescriptor {
12	+	return {
13	+	"script:ld+json": {
14	+	"@context": "https://schema.org",
15	+	"@type": "Organization",
16	+	name: COMPANY.name,
17	+	url: COMPANY.url,
18	+	founder: { "@type": "Person", name: COMPANY.founder },
19	+	brand: { "@type": "Brand", name: "g1t", url: SITE, sameAs: SOCIAL.map((account) => account.url) },
20	+	},
21	+	};
22	+	}
23	+
24	+	/** g1t as an application, with the plan's monthly price per workspace. */
25	+	export function application(monthlyDollars: number): MetaDescriptor {
26	+	return {
27	+	"script:ld+json": {
28	+	"@context": "https://schema.org",
29	+	"@type": "SoftwareApplication",
30	+	name: "g1t",
31	+	url: SITE,
32	+	applicationCategory: "DeveloperApplication",
33	+	operatingSystem: "Web",
34	+	description: DESCRIPTION,
35	+	publisher: { "@type": "Organization", name: COMPANY.name, url: COMPANY.url },
36	+	license: "https://opensource.org/licenses/MIT",
37	+	offers: [
38	+	{
39	+	"@type": "Offer",
40	+	name: "Free",
41	+	price: "0",
42	+	priceCurrency: "USD",
43	+	description: "Chat and the forge, with no card.",
44	+	},
45	+	{
46	+	"@type": "Offer",
47	+	name: "The g1t plan",
48	+	price: String(monthlyDollars),
49	+	priceCurrency: "USD",
50	+	description: "A month per workspace, never per seat, with $10 of usage included.",
51	+	priceSpecification: {
52	+	"@type": "UnitPriceSpecification",
53	+	price: String(monthlyDollars),
54	+	priceCurrency: "USD",
55	+	unitText: "month per workspace",
56	+	},
57	+	},
58	+	],
59	+	},
60	+	};
61	+	}
62	+
63	+	export function faqPage(questions: { q: string; a: string }[]): MetaDescriptor {
64	+	return {
65	+	"script:ld+json": {
66	+	"@context": "https://schema.org",
67	+	"@type": "FAQPage",
68	+	mainEntity: questions.map((item) => ({
69	+	"@type": "Question",
70	+	name: item.q,
71	+	acceptedAnswer: { "@type": "Answer", text: item.a },
72	+	})),
73	+	},
74	+	};
75	+	}

1	1		import assert from "node:assert/strict";
2	2		import { test } from "node:test";
3	3
4		−	import { ASK, BEAT, CHECKS, LOOP_MS, PILLS, STEPS, STILLS, frameAt, pillAt, pillProgress, sameFrame } from "./tour.ts";
	4	+	import { BEAT, CHECKS, LOOP_MS, PILLS, STEPS, STILLS, frameAt, pillAt, pillProgress, sameFrame } from "./tour.ts";
5	5
6		−	test("the first frame is the empty channel, the same on the server and the client", () => {
	6	+	test("the first frame is the pull request before its checks, the same on the server and the client", () => {
7	7		const frame = frameAt(0);
8		−	assert.equal(frame.scene, "chat");
9		−	assert.equal(frame.typed, 0);
10		−	assert.equal(frame.sent, false);
	8	+	assert.equal(frame.scene, "code");
	9	+	assert.equal(frame.checks, 0);
	10	+	assert.equal(frame.merged, false);
11	11		assert.equal(frame.cursorShown, false);
12	12		assert.ok(sameFrame(frame, frameAt(0)));
13	13		});
14	14
15		−	test("the message is typed in full before it is sent, then the composer empties", () => {
16		−	assert.equal(frameAt(BEAT.typed).typed, ASK.length);
17		−	assert.equal(frameAt(BEAT.typed - 1).typed, ASK.length - 1);
18		−	const sent = frameAt(BEAT.sent);
19		−	assert.equal(sent.sent, true);
20		−	assert.equal(sent.typed, 0);
21		−	});
22		−
23		−	test("typing only ever moves forward", () => {
24		−	let last = 0;
25		−	for (let t = 0; t <= BEAT.typed; t += 17) {
26		−	const typed = frameAt(t).typed;
27		−	assert.ok(typed >= last);
28		−	last = typed;
29		−	}
30		−	});
31		−
32		−	test("the scenes come in the story's order", () => {
	15	+	test("the scenes come in the story's order: Code first", () => {
33	16		const order: string[] = [];
34	17		for (let t = 0; t < LOOP_MS; t += 100) {
35	18		const scene = frameAt(t).scene;
36	19		if (order[order.length - 1] !== scene) order.push(scene);
37	20		}
38		−	assert.deepEqual(order, ["chat", "agents", "code", "chat", "docs"]);
	21	+	assert.deepEqual(order, ["code", "chat", "agents", "docs"]);
39	22		});
40	23
41		−	test("steps and checks finish before the cursor leaves them", () => {
42		−	assert.equal(frameAt(BEAT.pullClick).steps, STEPS.length);
	24	+	test("checks pass before review, and the queue merges only after approval", () => {
43	25		assert.equal(frameAt(BEAT.approved).checks, CHECKS.length);
44		−	assert.equal(frameAt(BEAT.pullClick).cursor, "task-pull");
	26	+	assert.equal(frameAt(BEAT.merged - 1).merged, false);
	27	+	assert.equal(frameAt(BEAT.merged).approved, true);
	28	+	});
	29	+
	30	+	test("the cursor leaves the code only once it has merged", () => {
	31	+	assert.equal(frameAt(BEAT.merged - 1).cursorShown, false);
	32	+	assert.equal(frameAt(BEAT.railChatClick).cursor, "rail-chat");
	33	+	assert.equal(frameAt(BEAT.railChatClick).click, true);
	34	+	});
	35	+
	36	+	test("Otto's work is done before the story opens", () => {
	37	+	for (const t of [0, BEAT.chat, BEAT.agents]) assert.equal(frameAt(t).steps, STEPS.length);
45	38		});
46	39
47	40		test("the loop wraps", () => {
⋯
50	43		});
51	44
52	45		test("pills start where their scene does, and progress runs 0 to 1", () => {
	46	+	assert.equal(PILLS[0].scene, "code");
53	47		PILLS.forEach((pill, index) => {
54	48		assert.equal(frameAt(pill.start + 1).scene, pill.scene);
55	49		assert.equal(pillAt(pill.start + 1), index);
56	50		});
57		−	assert.equal(pillAt(BEAT.chatAgain + 10), 2);
58	51		assert.ok(pillProgress(PILLS[1].start) < 0.01);
59	52		assert.ok(pillProgress(PILLS[2].start - 1) > 0.99);
60	53		});
61	54
62	55		test("each still shows its step's point", () => {
63		−	assert.equal(frameAt(STILLS.chat).handoff, true);
64		−	assert.equal(frameAt(STILLS.agents).steps, STEPS.length);
65	56		assert.equal(frameAt(STILLS.code).approved, true);
	57	+	assert.equal(frameAt(STILLS.chat).izzy, true);
	58	+	assert.equal(frameAt(STILLS.agents).scene, "agents");
66	59		assert.equal(frameAt(STILLS.docs).docUpdated, true);
67	60		});
68	61
69		−	test("Izzy tells #support after g1t says it shipped, and the consult shows while Otto works", () => {
	62	+	test("Izzy tells #support after g1t says it shipped", () => {
70	63		assert.equal(frameAt(BEAT.izzy - 1).izzy, false);
71	64		assert.equal(frameAt(BEAT.izzy).shipped, true);
72		−	assert.equal(frameAt(BEAT.agents).consult, false);
73		−	assert.equal(frameAt(BEAT.pullClick).consult, true);
74	65		});

4	4		* paused, resumed, jumped to a step, or shown still, and the server and
5	5		* the first client render agree (t = 0).
6	6		*
7		−	* The story: a person asks g1t in #web to fix the CSV export; g1t hands it
8		−	* to @otto and the review to @margo (agents the workspace hired from role
9		−	* templates; only g1t is built in); Otto works it in a session, bringing
10		−	* Margo in on the way; the pull request goes green and merges; g1t says
11		−	* it shipped and Izzy tells #support; Inky updates the docs page.
	7	+	* The story opens on the code: Otto's pull request #431 runs its checks,
	8	+	* is approved and is merged by the queue. Then where it came from: the
	9	+	* ask in #web, handed to @otto by g1t, now merged, and Izzy telling
	10	+	* #support. Then Otto's sessions, the record of what he did and spent, and
	11	+	* last Inky's docs page picking up the change. Otto, Margo, Izzy and Inky
	12	+	* are agents this workspace hired from role templates; only g1t is built in.
12	13		*/
13	14
14	15		export type Scene = "chat" \| "agents" \| "code" \| "docs";
⋯
73	74		];
74	75
75	76		export const CHECKS = ["build", "test", "lint", "preview"];
76		−
77		−	/** When the person starts typing, and how long each character takes, in ms. */
78		−	const TYPE_START = 1500;
79		−
80		−	/**
81		−	* A human typing pace: about 45 ms a character, a little longer after a
82		−	* space, and a short hesitation after punctuation. Seeded, so every loop
83		−	* and every render types the same way.
84		−	*/
85		−	function typingTimes(text: string): number[] {
86		−	let seed = 7;
87		−	const random = () => {
88		−	seed = (seed * 16807) % 2147483647;
89		−	return (seed - 1) / 2147483646;
90		−	};
91		−	const times: number[] = [];
92		−	let at = TYPE_START;
93		−	for (const char of text) {
94		−	at += 32 + random() * 34;
95		−	if (char === " ") at += random() * 30;
96		−	times.push(Math.round(at));
97		−	if (char === "." \|\| char === "?" \|\| char === ",") at += 220 + random() * 160;
98		−	}
99		−	return times;
100		−	}
101	77
102		−	const TYPED_AT = typingTimes(ASK);
103		−	const TYPED_END = TYPED_AT[TYPED_AT.length - 1];
104		−
105	78		/** The beats of the story, in ms from the start of the loop. */
106	79		export const BEAT = {
107		−	composerClick: 1100,
108		−	typed: TYPED_END,
109		−	sendClick: TYPED_END + 700,
110		−	sent: TYPED_END + 800,
111		−	g1tTyping: TYPED_END + 1300,
112		−	handoff: TYPED_END + 2500,
113		−	railAgentsClick: TYPED_END + 4300,
114		−	agents: TYPED_END + 4450,
115		−	step0: TYPED_END + 5400,
116		−	stepGap: 1150,
117		−	pullClick: TYPED_END + 11900,
118		−	code: TYPED_END + 12050,
119		−	check0: TYPED_END + 12900,
	80	+	code: 0,
	81	+	check0: 900,
120	82		checkGap: 650,
121		−	diff: TYPED_END + 13300,
122		−	approved: TYPED_END + 15900,
123		−	merged: TYPED_END + 17000,
124		−	railChatClick: TYPED_END + 18300,
125		−	chatAgain: TYPED_END + 18450,
126		−	cardMerged: TYPED_END + 19100,
127		−	shipped: TYPED_END + 20400,
128		−	izzy: TYPED_END + 21600,
129		−	railDocsClick: TYPED_END + 23000,
130		−	docs: TYPED_END + 23150,
131		−	docUpdated: TYPED_END + 24300,
132		−	end: TYPED_END + 29000,
	83	+	diff: 1300,
	84	+	approved: 3900,
	85	+	merged: 5000,
	86	+	railChatClick: 6300,
	87	+	chat: 6450,
	88	+	cardMerged: 7100,
	89	+	shipped: 8400,
	90	+	izzy: 9600,
	91	+	railAgentsClick: 11000,
	92	+	agents: 11150,
	93	+	railDocsClick: 15000,
	94	+	docs: 15150,
	95	+	docUpdated: 16300,
	96	+	end: 21000,
133	97		} as const;
134	98
135	99		/** The whole loop, in ms. */
⋯
137	101
138	102		/** The step pills under the frame: where each starts, for jumping to it. */
139	103		export const PILLS: { scene: Scene; label: string; start: number; soon: boolean }[] = [
140		−	{ scene: "chat", label: "Chat", start: 0, soon: false },
	104	+	{ scene: "code", label: "Code", start: 0, soon: false },
	105	+	{ scene: "chat", label: "Chat", start: BEAT.chat, soon: false },
141	106		// Sessions, colleagues brought in, spend against a cap: built.
142	107		{ scene: "agents", label: "Agents", start: BEAT.agents, soon: false },
143		−	{ scene: "code", label: "Code", start: BEAT.code, soon: false },
144	108		// Docs is built; an agent keeping a page current after a merge on its
145	109		// own is not yet, and the line under the frame says so.
146	110		{ scene: "docs", label: "Docs", start: BEAT.docs, soon: false },
147	111		];
148	112
149		−	/** Which pill a time falls under. Back in chat after the merge is still Code's story. */
	113	+	/** Which pill a time falls under. */
150	114		export function pillAt(t: number): number {
151	115		let index = 0;
152	116		PILLS.forEach((pill, i) => {
⋯
172	136		function cursorAt(t: number): { cursor: CursorTarget; click: boolean } {
173	137		const press = (at: number) => t >= at && t < at + 180;
174	138		const moves: [number, CursorTarget][] = [
175		−	[300, "composer"],
176		−	[TYPED_END + 150, "send"],
177		−	[BEAT.handoff + 700, "rail-agents"],
178		−	[BEAT.step0 + 4 * BEAT.stepGap + 500, "task-pull"],
179	139		[BEAT.merged + 300, "rail-chat"],
180		−	[BEAT.izzy + 500, "rail-docs"],
	140	+	[BEAT.izzy + 500, "rail-agents"],
	141	+	[BEAT.agents + 2600, "rail-docs"],
181	142		[BEAT.docs + 500, "idle"],
182	143		];
183	144		let cursor: CursorTarget = "idle";
184	145		for (const [at, target] of moves) if (t >= at) cursor = target;
185		−	const click =
186		−	press(BEAT.composerClick) \|\|
187		−	press(BEAT.sendClick) \|\|
188		−	press(BEAT.railAgentsClick) \|\|
189		−	press(BEAT.pullClick) \|\|
190		−	press(BEAT.railChatClick) \|\|
191		−	press(BEAT.railDocsClick);
	146	+	const click = press(BEAT.railChatClick) \|\| press(BEAT.railAgentsClick) \|\| press(BEAT.railDocsClick);
192	147		return { cursor, click };
193	148		}
194	149
195		−	/** The frame at time t (ms into the loop). */
	150	+	/**
	151	+	* The frame at time t (ms into the loop). The ask, g1t's handoff and
	152	+	* Otto's work all happened before the pull request the story opens on, so
	153	+	* they are shown done throughout.
	154	+	*/
196	155		export function frameAt(time: number): Frame {
197	156		const t = ((time % LOOP_MS) + LOOP_MS) % LOOP_MS;
198		−	const scene: Scene =
199		−	t >= BEAT.docs ? "docs" : t >= BEAT.chatAgain ? "chat" : t >= BEAT.code ? "code" : t >= BEAT.agents ? "agents" : "chat";
200		−	let typed = 0;
201		−	while (typed < TYPED_AT.length && TYPED_AT[typed] <= t) typed++;
202		−	const sent = t >= BEAT.sent;
	157	+	const scene: Scene = t >= BEAT.docs ? "docs" : t >= BEAT.agents ? "agents" : t >= BEAT.chat ? "chat" : "code";
203	158		const { cursor, click } = cursorAt(t);
204	159		return {
205	160		scene,
206		−	typed: sent ? 0 : typed,
207		−	sent,
208		−	g1tTyping: t >= BEAT.g1tTyping && t < BEAT.handoff,
209		−	handoff: t >= BEAT.handoff,
210		−	steps: count(t, BEAT.step0, BEAT.stepGap, STEPS.length),
	161	+	typed: 0,
	162	+	sent: true,
	163	+	g1tTyping: false,
	164	+	handoff: true,
	165	+	steps: STEPS.length,
211	166		checks: count(t, BEAT.check0, BEAT.checkGap, CHECKS.length),
212	167		diff: t >= BEAT.diff,
213	168		approved: t >= BEAT.approved,
⋯
215	170		cardMerged: t >= BEAT.cardMerged,
216	171		shipped: t >= BEAT.shipped,
217	172		izzy: t >= BEAT.izzy,
218		−	consult: t >= BEAT.step0 + 2 * BEAT.stepGap + 500,
	173	+	consult: true,
219	174		docUpdated: t >= BEAT.docUpdated,
220	175		cursor,
221	176		click,
222		−	cursorShown: t >= 200 && t < BEAT.end - 600,
	177	+	cursorShown: t >= BEAT.merged && t < BEAT.end - 600,
223	178		};
224	179		}
225	180
226	181		/** A still frame for each pill, for reduced motion: the moment the step makes its point. */
227	182		export const STILLS: Record<Scene, number> = {
228		−	chat: BEAT.handoff + 400,
229		−	agents: BEAT.step0 + 4 * BEAT.stepGap + 200,
230	183		code: BEAT.approved + 200,
	184	+	chat: BEAT.izzy + 400,
	185	+	agents: BEAT.agents + 400,
231	186		docs: BEAT.docUpdated + 400,
232	187		};
233	188

11	11		Search,
12	12		Settings,
13	13		} from "lucide-react";
14		−	import { useEffect, useState } from "react";
	14	+	import { useEffect, useRef, useState } from "react";
15	15		import {
16	16		Form,
17	17		isRouteErrorResponse,
⋯
51	51		import { SiteFooter } from "./components/footer";
52	52		import { SpikeBanner } from "./components/spike-banner";
53	53		import { PolicyNotice } from "./components/policy-notice";
	54	+	import { identify } from "./lib/analytics.client";
	55	+	import { visitorAsksFirst } from "./lib/analytics-consent";
	56	+	import { AnalyticsConsent } from "./components/analytics-consent";
54	57		import { readCookie } from "./lib/mission";
55	58		import { WORKSPACE_COOKIE, workspaceFor } from "./lib/workspace-choice";
56	59		import { PageMain } from "./components/landmark";
⋯
109	112		registrationMode(),
110	113		]);
111	114		// Where this g1t lives, for clone lines, agent setup and link previews.
112		−	return { user, shell, inviteOnly: mode !== "open", addresses: addresses() };
	115	+	return {
	116	+	user,
	117	+	shell,
	118	+	inviteOnly: mode !== "open",
	119	+	addresses: addresses(),
	120	+	// Visitors from where the law asks first are asked before analytics runs.
	121	+	analyticsConsent: visitorAsksFirst(request),
	122	+	};
113	123		}
114	124
115	125		/**
⋯
593	603		{/* The stylesheet before everything React Router preloads, so a slow
594	604		connection paints sooner (docs/research/css-shipping.md). */}
595	605		<link rel="stylesheet" href={appCss} precedence="default" />
	606	+	{root?.analyticsConsent && <meta name="g1t-analytics" content="consent" />}
596	607		<Meta />
597	608		<Links nonce={nonce} />
598	609		</head>
⋯
623	634		{user && !awaitsConfirmation(user) && (
624	635		<LiveNotifications workspace={root?.shell?.workspace?.slug ?? null} inbox={root?.shell?.inbox?.unread ?? null} />
625	636		)}
	637	+	<AnalyticsConsent />
626	638		<ScrollRestoration nonce={nonce} />
627	639		<Scripts nonce={nonce} />
628	640		</body>
⋯
631	643		}
632	644
633	645		export default function App() {
	646	+	const userId = useRouteLoaderData<typeof loader>("root")?.user?.id ?? null;
	647	+	// Tell analytics who is signed in, once per change; signing out forgets them.
	648	+	const lastUserId = useRef<string \| null>(null);
	649	+	useEffect(() => {
	650	+	identify(userId, lastUserId.current);
	651	+	lastUserId.current = userId;
	652	+	}, [userId]);
634	653		return <Outlet />;
635	654		}
636	655

78	78		route("status", "routes/status.tsx"),
79	79		route("status.json", "routes/status-json.ts"),
80	80		route(".well-known/security.txt", "routes/security-txt.ts"),
	81	+	// For search engines: what may be crawled, and a map of the public pages.
	82	+	route("robots.txt", "routes/robots-txt.ts"),
	83	+	route("sitemap.xml", "routes/sitemap-xml.ts"),
81	84		// Releases of the self-hosted runner and the g1t CLI, from R2.
82	85		route("downloads/:tool/*", "routes/downloads-runner.ts"),
83	86		// A workspace's own pages sit under `-`, which no repository can be named.

3	3
4	4		import type { Route } from "./+types/home";
5	5		import { page } from "../lib/meta";
	6	+	import { application, organization } from "../lib/structured-data";
6	7		import { WORKSPACE_COOKIE, chosenWorkspace } from "../lib/workspace-choice";
7	8		import { readCookie } from "../lib/mission";
8	9		import { type NotStarted, chosenRepo, delegateForm, issuePath, notStarted } from "../lib/delegate";
⋯
12	13		import { homePath } from "../lib/workspace-nav";
13	14
14	15		export function meta(args: Route.MetaArgs) {
15		−	return page(args, {
16		−	title: "g1t · Your team and its agents, working in one place",
17		−	description:
18		−	"Chat with your team and your agents in channels and DMs. Agents are teammates with a role, a personality and a budget, and their code lands through pull requests, checks and a merge queue. Chat is free on every plan, never per seat.",
19		−	});
	16	+	return [
	17	+	...page(args, {
	18	+	title: "g1t · Your team and its agents, working in one place",
	19	+	description:
	20	+	"Chat with your team and your agents in channels and DMs. Agents are teammates with a role, a personality and a budget, and their code lands through pull requests, checks and a merge queue. Chat is free on every plan, never per seat.",
	21	+	}),
	22	+	organization(),
	23	+	application(20),
	24	+	];
20	25		}
21	26
22	27		/**

5	5		import type { Route } from "./+types/pricing";
6	6		import { wholeDollars } from "../lib/billing";
7	7		import { page } from "../lib/meta";
	8	+	import { application, faqPage } from "../lib/structured-data";
8	9		import { TimeAgo } from "../components/ui";
9	10		import { billing } from "../lib/services.server";
10	11
11	12		export function meta(args: Route.MetaArgs) {
12		−	return page(args, {
13		−	title: "Pricing · g1t",
14		−	description:
15		−	"People chat free on every plan, and the forge is free. One plan, $20 a month per workspace with $10 of usage included. Agents pay the model's price plus a flat agent rate, from each agent's budget. No seats, ever.",
16		−	});
	13	+	const plan = args.loaderData?.book?.plans?.find((p) => p.feature === "plan") ?? DEFAULT_PLAN;
	14	+	return [
	15	+	...page(args, {
	16	+	title: `g1t pricing - $${plan.monthlyCents / 100} per workspace, never per seat, cost-plus AI`,
	17	+	description:
	18	+	"People chat free on every plan, and the forge is free. One plan, $20 a month per workspace with $10 of usage included. Agents pay the model's price plus a flat agent rate, from each agent's budget. No seats, ever.",
	19	+	}),
	20	+	application(plan.monthlyCents / 100),
	21	+	faqPage(FAQ),
	22	+	];
17	23		}
18	24
19	25		export async function loader() {
⋯
148	154		a: "No. There are no seats. People who only chat, and ask agents questions, cost nothing until their questions use an agent; then the agent's reply is charged like any other.",
149	155		},
150	156		{
	157	+	q: "What does moving from GitHub cost, and can we leave again?",
	158	+	a: "Moving in is an import: bring repositories across from GitHub with every branch, tag and their issues, or keep a mirror that follows GitHub while you try g1t. Your code is plain git and g1t is MIT licensed, so leaving is a git clone, and the core forge runs on your own machine with Docker Compose.",
	159	+	},
	160	+	{
151	161		q: "Is Docs included?",
152	162		a: "Docs is coming soon. When it ships, pages, editing and history are included on every plan, like chat. Files are on the storage meter.",
153	163		},
⋯
312	322
313	323		<section className="mt-10 rounded-xl border border-accent/40 bg-surface p-6">
314	324		<div className="flex flex-wrap items-baseline justify-between gap-3">
315		−	<h2 className="text-xl font-semibold tracking-tight">{plan.title}</h2>
	325	+	<h2 className="flex flex-wrap items-center gap-2 text-xl font-semibold tracking-tight">
	326	+	{plan.title}
	327	+	<span className="rounded-full bg-accent/15 px-2 py-0.5 text-xs font-medium tracking-normal text-accent">Recommended</span>
	328	+	</h2>
316	329		<p>
317	330		<span className="text-3xl font-semibold tabular-nums">${price}</span>{" "}
318	331		<span className="text-sm text-muted">a month per workspace</span>
⋯
321	334		</span>
322	335		</p>
323	336		</div>
	337	+	<p className="mt-2 text-sm text-muted">
	338	+	The plan for a team whose agents do real work: unlimited members, agents, checks, the merge queue and
	339	+	deployments.
	340	+	</p>
	341	+	<p className="mt-3 text-sm text-fg-soft">
	342	+	One price for the whole team: a 10-person team pays ${price} a month, not ${price} a person.
	343	+	</p>
324	344		<ul className="mt-4 space-y-1.5 text-sm text-muted">
325	345		{plan.includes.map((line) => (
326	346		<li key={line} className="flex gap-2">

1	+	/**
2	+	* /robots.txt: everything may be crawled, and where the site's maps are.
3	+	* Served from the request's own origin, so a self-hosted g1t names itself.
4	+	*/
5	+	import type { Route } from "./+types/robots-txt";
6	+
7	+	/** g1t.sh's docs keep their own map; a self-hosted g1t has no docs site. */
8	+	const DOCS_SITEMAP = "https://docs.g1t.sh/sitemap-index.xml";
9	+
10	+	export function loader({ request }: Route.LoaderArgs) {
11	+	const site = new URL(request.url).origin;
12	+	const lines = ["User-agent: *", "Allow: /", "", `Sitemap: ${site}/sitemap.xml`];
13	+	if (site === "https://g1t.sh") lines.push(`Sitemap: ${DOCS_SITEMAP}`);
14	+	return new Response(`${lines.join("\n")}\n`, {
15	+	headers: {
16	+	"content-type": "text/plain; charset=utf-8",
17	+	"cache-control": "public, max-age=86400",
18	+	},
19	+	});
20	+	}

1	+	/**
2	+	* /sitemap.xml: the public pages, then the public projects Explore lists,
3	+	* newest first. Explore being unreachable leaves just the pages.
4	+	*/
5	+	import type { Route } from "./+types/sitemap-xml";
6	+	import { search } from "../lib/services.server";
7	+
8	+	/** Pages anyone can read, signed in or not. */
9	+	const PAGES = ["/", "/pricing", "/explore", "/support", "/security", "/policies", "/policies/privacy"];
10	+
11	+	/** How many of Explore's pages to list; each holds one page of projects. */
12	+	const EXPLORE_PAGES = 10;
13	+
14	+	function escape(text: string): string {
15	+	return text.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">");
16	+	}
17	+
18	+	export async function loader({ request }: Route.LoaderArgs) {
19	+	const site = new URL(request.url).origin;
20	+	const entries: { loc: string; lastmod?: string }[] = PAGES.map((path) => ({ loc: `${site}${path}` }));
21	+	for (let pageNumber = 1; pageNumber <= EXPLORE_PAGES; pageNumber++) {
22	+	const explore = await search.explore(null, { sort: "new", page: pageNumber }).catch(() => null);
23	+	if (!explore) break;
24	+	for (const repo of explore.repos) {
25	+	const lastmod = (repo.pushedAt ?? repo.createdAt)?.slice(0, 10);
26	+	entries.push({ loc: `${site}/${repo.namespace}/${repo.name}`, lastmod });
27	+	}
28	+	if (!explore.more) break;
29	+	}
30	+	const body = [
31	+	'<?xml version="1.0" encoding="UTF-8"?>',
32	+	'<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
33	+	...entries.map(
34	+	(entry) => ` <url><loc>${escape(entry.loc)}</loc>${entry.lastmod ? `<lastmod>${entry.lastmod}</lastmod>` : ""}</url>`,
35	+	),
36	+	"</urlset>",
37	+	"",
38	+	].join("\n");
39	+	return new Response(body, {
40	+	headers: {
41	+	"content-type": "application/xml; charset=utf-8",
42	+	"cache-control": "public, max-age=3600",
43	+	},
44	+	});
45	+	}

19	19		"@blocknote/shadcn": "^0.55.0",
20	20		"@g1t/contracts": "*",
21	21		"@g1t/theme": "*",
	22	+	"@heycatch/sdk": "0.8.3",
22	23		"class-variance-authority": "^0.7.1",
23	24		"clsx": "^2.1.1",
24	25		"cmdk": "^1.1.1",

1		−	User-agent: *
2		−	Allow: /

3	3		import { identityClient, isNamespaceShaped } from "@g1t/contracts";
4	4
5	5		import { addressesFor } from "../app/lib/addresses";
	6	+	import { visitorAsksFirst } from "../app/lib/analytics-consent";
6	7		import { hardenRegistryHeaders } from "../app/lib/content-safety";
7	8		import { withSiteHeaders } from "../app/lib/page-headers";
8	9		import { finishResponse, withRequestPerf } from "../app/lib/perf.server";
⋯
128	129
129	130		async function servePublic(env: Env, request: Request, ctx: ExecutionContext, render: () => Promise<Response>): Promise<Response> {
130	131		const cache = (caches as unknown as { default: Cache }).default;
131		−	const key = new Request(request.url, { method: "GET" });
	132	+	// Visitors asked about analytics first get a page that says so, kept apart.
	133	+	const keyUrl = new URL(request.url);
	134	+	if (visitorAsksFirst(request)) keyUrl.searchParams.set("_g1t_consent", "1");
	135	+	const key = new Request(keyUrl, { method: "GET" });
132	136		const repository = PUBLIC_PROJECT.test(new URL(request.url).pathname) ? repositoryOfPage(new URL(request.url).pathname) : null;
133	137		// Asked alongside the cache, so a hit waits for one indexed read at most.
134	138		const [cached, visible] = await Promise.all([cache.match(key), repository ? isStillPublic(env, repository) : Promise.resolve(true)]);

185	185		\| --- \| --- \| --- \| --- \|
186	186		\| Static assets (`/assets/*`) \| browser and edge \| a year, immutable \| hashed file names \|
187	187		\| Avatars \| edge cache \| a year, immutable \| by content hash \|
188		−	\| Public pages for people signed out \| the data centre's cache (`workers/app.ts`, `servePublic`) \| fresh 30 s, then served once more while a new copy is made, up to 5 min \| GET, no `g1t_session` cookie, an allowlisted path (home, pricing, explore, policies, a project's pages), status 200 or 404, no `Set-Cookie`, nothing private. Reserved first segments and workspace pages (`-`) are never kept. A project's kept page is served only after repos' `visibility` says the repository is still there and public (one indexed read, alongside the cache lookup); a repository made private or deleted is never served from any data centre's copy, and the copy is dropped. The answer says `server-timing: cache;desc="hit, Ns old"`. \|
	188	+	\| Public pages for people signed out \| the data centre's cache (`workers/app.ts`, `servePublic`) \| fresh 30 s, then served once more while a new copy is made, up to 5 min \| GET, no `g1t_session` cookie, an allowlisted path (home, pricing, explore, policies, a project's pages), status 200 or 404, no `Set-Cookie`, nothing private. Reserved first segments and workspace pages (`-`) are never kept. A project's kept page is served only after repos' `visibility` says the repository is still there and public (one indexed read, alongside the cache lookup); a repository made private or deleted is never served from any data centre's copy, and the copy is dropped. Visitors from the EU, EEA, UK and Switzerland, whose page asks about the analytics cookie, get a copy of their own (the cache key gains `_g1t_consent=1`, `lib/analytics-consent.ts`). The answer says `server-timing: cache;desc="hit, Ns old"`. \|
189	189		\| Sidebar data (projects, spend, limit, entitlements) \| per isolate (`lib/cache.server.ts`) \| 15 s, per person and workspace \| skipped during a write and for 30 s after the person's last one; failures not kept; only settled answers kept \|
190	190		\| Registration mode \| per isolate \| 60 s \| \|
191	191		\| A commit's log by hash \| repos' data-centre cache \| for good \| history from a commit never changes. One of 100 commits or more is put together from a 16-commit read and the history kept from any of those commits, when there is one (`store.rs` `spliced_log`): a default branch that moved by a merge costs 16 commits, not 120 or 1,000 \|

79	79		"@blocknote/shadcn": "^0.55.0",
80	80		"@g1t/contracts": "*",
81	81		"@g1t/theme": "*",
	82	+	"@heycatch/sdk": "0.8.3",
82	83		"class-variance-authority": "^0.7.1",
83	84		"clsx": "^2.1.1",
84	85		"cmdk": "^1.1.1",
⋯
2037	2038		"prosemirror-view": "^1.0.0"
2038	2039		}
2039	2040		},
	2041	+	"node_modules/@heycatch/sdk": {
	2042	+	"version": "0.8.3",
	2043	+	"resolved": "https://registry.npmjs.org/@heycatch/sdk/-/sdk-0.8.3.tgz",
	2044	+	"integrity": "sha512-7knqXfptgctAIHu5IXwd/WnivY+wwYAws2Xr0ZuARottBnbQteFbxZP7TyEDWCyz6A5+PcGlzlPxeTdq5uyGoA==",
	2045	+	"license": "MIT",
	2046	+	"dependencies": {
	2047	+	"posthog-react-native": "^4.61.1"
	2048	+	},
	2049	+	"engines": {
	2050	+	"node": ">=22"
	2051	+	},
	2052	+	"peerDependencies": {
	2053	+	"expo-router": "*",
	2054	+	"react": "^18.2.0 \|\| ^19.0.0"
	2055	+	},
	2056	+	"peerDependenciesMeta": {
	2057	+	"expo-router": {
	2058	+	"optional": true
	2059	+	},
	2060	+	"react": {
	2061	+	"optional": true
	2062	+	}
	2063	+	}
	2064	+	},
2040	2065		"node_modules/@iconify/types": {
2041	2066		"version": "2.0.0",
2042	2067		"resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
⋯
2856	2881		"dev": true,
2857	2882		"license": "MIT"
2858	2883		},
	2884	+	"node_modules/@posthog/core": {
	2885	+	"version": "1.57.3",
	2886	+	"resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.57.3.tgz",
	2887	+	"integrity": "sha512-lag+QZE61kcYSjYN9lKwri6P4/DACOtyRsA41MSI6tdKHbSIyrPfQPkDQiPbq413AMbTXFjcN/N6bqxPhei93Q==",
	2888	+	"license": "MIT",
	2889	+	"dependencies": {
	2890	+	"@posthog/types": "^1.415.2"
	2891	+	}
	2892	+	},
	2893	+	"node_modules/@posthog/types": {
	2894	+	"version": "1.415.2",
	2895	+	"resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.415.2.tgz",
	2896	+	"integrity": "sha512-BIIHPyXcPZuNTImrR1qLqLKFw7j9o8co6LG/9OpLtpWJ3RT0y89Lx6VCtd37N9/dkr/qW7y0uPjJxAxjsALHtw==",
	2897	+	"license": "MIT"
	2898	+	},
2859	2899		"node_modules/@puppeteer/browsers": {
2860	2900		"version": "2.2.4",
2861	2901		"resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-2.2.4.tgz",
⋯
10639	10679		"integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
10640	10680		"license": "MIT"
10641	10681		},
	10682	+	"node_modules/posthog-react-native": {
	10683	+	"version": "4.80.0",
	10684	+	"resolved": "https://registry.npmjs.org/posthog-react-native/-/posthog-react-native-4.80.0.tgz",
	10685	+	"integrity": "sha512-aSCTguolb/6R01czT8MVW/lHSSdGoHHVomUE2MjQUub/+pIdw64ScwzNLUSZ9x5TU2sLAD7C1RqpGwnB6RidRw==",
	10686	+	"license": "MIT",
	10687	+	"dependencies": {
	10688	+	"@posthog/core": "^1.57.3",
	10689	+	"@posthog/types": "^1.415.2"
	10690	+	},
	10691	+	"bin": {
	10692	+	"posthog-react-native-xcode": "tooling/posthog-xcode.sh"
	10693	+	},
	10694	+	"peerDependencies": {
	10695	+	"@posthog/react-native-plugin": ">= 2.9.3",
	10696	+	"@react-native-async-storage/async-storage": ">=1.0.0",
	10697	+	"@react-navigation/native": ">= 5.0.0",
	10698	+	"expo-application": ">= 4.0.0",
	10699	+	"expo-device": ">= 4.0.0",
	10700	+	"expo-file-system": ">= 13.0.0",
	10701	+	"expo-localization": ">= 11.0.0",
	10702	+	"expo-updates": ">= 0.25.0",
	10703	+	"posthog-react-native-session-replay": ">= 1.6.0",
	10704	+	"react-native-device-info": ">= 10.0.0",
	10705	+	"react-native-localize": ">= 3.0.0",
	10706	+	"react-native-navigation": ">= 6.0.0",
	10707	+	"react-native-safe-area-context": ">= 4.0.0",
	10708	+	"react-native-svg": ">= 15.0.0"
	10709	+	},
	10710	+	"peerDependenciesMeta": {
	10711	+	"@posthog/react-native-plugin": {
	10712	+	"optional": true
	10713	+	},
	10714	+	"@react-native-async-storage/async-storage": {
	10715	+	"optional": true
	10716	+	},
	10717	+	"@react-navigation/native": {
	10718	+	"optional": true
	10719	+	},
	10720	+	"expo-application": {
	10721	+	"optional": true
	10722	+	},
	10723	+	"expo-device": {
	10724	+	"optional": true
	10725	+	},
	10726	+	"expo-file-system": {
	10727	+	"optional": true
	10728	+	},
	10729	+	"expo-localization": {
	10730	+	"optional": true
	10731	+	},
	10732	+	"expo-updates": {
	10733	+	"optional": true
	10734	+	},
	10735	+	"posthog-react-native-session-replay": {
	10736	+	"optional": true
	10737	+	},
	10738	+	"react-native-device-info": {
	10739	+	"optional": true
	10740	+	},
	10741	+	"react-native-localize": {
	10742	+	"optional": true
	10743	+	},
	10744	+	"react-native-navigation": {
	10745	+	"optional": true
	10746	+	},
	10747	+	"react-native-safe-area-context": {
	10748	+	"optional": true
	10749	+	},
	10750	+	"react-native-svg": {
	10751	+	"optional": true
	10752	+	}
	10753	+	}
	10754	+	},
10642	10755		"node_modules/prismjs": {
10643	10756		"version": "1.30.0",
10644	10757		"resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.30.0.tgz",