apps/web/app/routes · flagon-io/g1t

notifyMerge branch 'worktree-agent-a5c94df323642630e'3d ago

repoAgents in any harness coordinate through one inbox, the merge queue lands only what an attempt itself tested, and workspaces have Insights. Each session keeps the coordination updates that concern it (session_updates, migration 0038): claims, releases, hand-offs and expiries, overlaps, dependency changes, decisions, integration results and sessions starting and ending, about the issues and pull requests it is on or tied to, or every one while it is on nothing yet; never its own start, end or claims. An update is written in the same batch as the change it announces, guarded so it exists only once the change is made, with an id derived from the change, so a retry or two requests at once deliver it once; a blocker clearing and queue results follow their change under a key that names it. get_session's `updates` lists up to 100, oldest first, and reading never clears them; record_session_entries' `acknowledge` clears exact IDs for that session only and says how many were its (`acknowledged`). The CLI has `g1t session updates` and `g1t session acknowledge ID --note` (the decision note and the acknowledgement in one idempotent call, `--session` over G1T_SESSION), and those and `heartbeat` say which files the working copy changed (git status; G1T_TOUCH=0 turns it off), so overlapping edits are noticed whichever harness makes them; a pair of sessions is told again when another file in common joins. The Claude Code hooks fetch the inbox in the background, show it at every prompt and before tools when it changes or every two minutes, refresh after an acknowledgement, and never acknowledge. The AGENTS.md snippet, the skills, MCP's instructions and llms.txt say the same steps for every harness: scope claims (Scope, Interfaces, Depends on, Checks), proceed on complementary work, agree ownership before overlapping edits, record public summaries and evidence, never private reasoning. Claims resolve ownership in one statement, so simultaneous claims by one session converge. The merge queue: every attempt has its own id and branch (0037); a claimed build, an accepted build, a report and a callback each check their attempt; a dispatch registers its runs first and Actions fails the dispatch when it cannot; an attempt is decided only by its own runs (and other tools' statuses set after it was claimed), never an earlier attempt's or the pull request's own on the same commit (0040 keeps what it built and how many runs it registered); landing re-reads the rules, honours a bypass asked for when queued (0039), checks no predecessor remains, carries the exact tested commit to Git's compare-and-swap, records publication intent that fences removal, closing, drafting and changing base, resumes after a crash, and a publisher that lost a race no longer undoes the winner's landing; a retried attempt's branch is deleted; an entry whose branch or pull request is gone leaves the queue with a note instead of blocking those behind it; diagnosis rebuilds exactly what was tested and names a failing combination, not a proven cause. A session's page shows what awaits its agent as the coordination feed does. Workspace Insights (/:owner/-/insights): delivery metrics across a workspace's readable repositories (work service delivery_insights). Deploy Work migrations 0037 to 0040 first (the pipeline does), then Repos and Actions before Work, and the site with Work. Checked: cargo test for g1t-work (143), g1t-repos (311), g1t-actions-service (108), g1t-api (201), g1t (149), g1t-rules (72), g1t-contracts (306) and wasm32 builds; cargo check --workspace; the conformance suite against freshly built API and Work Workers (5, none skipped); the Claude Code hooks (49); the site's typecheck, tests (919) and a production build; the deploy tool's 92 tests; the docs build; and two unscripted local rehearsals in which two concurrent agents, given only a task and AGENTS.md, found each other, agreed a split and made complementary edits.yesterday

settingsPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.yesterday

workspaceAsk names people by their g1t username, knows what shipped means, and picks its model by itself. Asked "What shipped today?", Ask made "@chasepierce" out of a commit's git author name, corrected itself mid-answer, and said nothing had reached production though the repository's own Deploy run had: commit listings carried only the git name, the prompt never said which field is a username, and activity counted only g1t.page deployments as production. Commits from list_commits now say `author: { name, username }`, the username from identity's address owners (a confirmed or noreply address; g1t's own are g1t), never the address, and activity's landed commits carry `username` too; the prompt mentions only usernames tools returned, never turns a git name or address into one, and answers once, without "wait" or corrections. Shipping, to Ask, is reaching the default branch and then production: a successful run of a repository's deploy workflow on its default branch (a workflow whose name or file says deploy, not preview) now counts as a production deployment beside g1t.page's, each landed commit says whether it is live (and by which deploy), deploying, failed or not deployed (a deploy carries everything before it on the branch), summary.shipped counts them, and list_runs takes since and until; releases and tags are one more signal, and today is the start of your day in your time zone. Ask's model is Auto by default (migration 0010 turns it on for every Ask route nobody chose a model for: the old picker started on the provider's first model, Haiku for Anthropic). Auto sends each question to a model of the workspace's provider without asking another model: a short lookup to a fast one, a question about why, how, what shipped, changes, failures, a time range, or a long conversation to a standard one; tiers come from the models' names, so it works for every provider, the largest only when nothing else is there, and an Azure deployment or an endpoint without a list keeps its own model. The answer says which ("Anthropic · Auto · claude-sonnet-5-5"); an explicit pick still wins. The Ask guide has Auto and what Ask means by shipped. Checked on this change alone (a worktree of the commit before it): cargo test for g1t-integrations (70, new: Auto's routing for each provider, prompt rules), g1t-api (204, new: commit authors with and without an account, shipped states), g1t-actions-service (108), g1t-contracts (306) and the CLI (149); cargo check --workspace; wasm32 builds of api, integrations and actions; the site's typecheck (tsc -b --force), its Ask tests and a production build; chat's tests and typecheck; the deploy tool's tests.yesterday

auth-github-callback.tsxMerge main (membership, two-factor, GitHub repo roles) into tokens1w ago

auth-github-username.tsxMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.2d ago

auth-github.tsstatus.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1w ago

avatar-user.tsPeople wear their own avatars wherever g1t knows them only by name, and a workspace is never shown as a person. The activity feeds, recent changes, home's most active faces, issue and pull request authors, assignees, comments and the audit log drew a person from their username alone, so everyone got their letter avatar instead of the picture they uploaded. An avatar given no picture now draws the letter at once and lays the person's own picture over it once it loads, from /-/avatar/user/<username> (routes/avatar-user.ts): a redirect to the picture on the usercontent origin, or not found, read from identity's people only, so a workspace's icon can never stand in for someone. Kept five minutes, public like the profile. Agents, the product tour's people, "someone" and workspaces' square avatars are never looked up (image null), so an account with the same name never lends them its face.2d ago

confirm-email.tsxPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.yesterday

desktop-runner.tsMerge the desktop app's runner: it starts with the app for the signed-in person, sandboxed by default and running nothing where no sandbox is available yet, registers through the site, keeps itself up to date, and says everywhere what it is doing, why it is not, and how to fix it.3d ago

device.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

download.tsxThe download page says every build is unsigned while g1t is in alpha. A notice under the platform switcher says the desktop app, the Android app, the runner and the CLI aren't code-signed yet, so the system warns before opening them, with what to choose on the platform shown (Windows: More info, Run anyway; macOS: System Settings, Privacy & Security, Open Anyway; Linux: an unsigned package, an AppImage made executable; Android: Play Protect's More details, Install anyway). The macOS-only question becomes "Why does my system warn me before opening it?" covering all four, and the Android app is no longer said to be signed by g1t. The desktop guide gains "Unsigned during the alpha" in place of the old right-click-Open note, and the phone app guide says what to do when Play Protect warns.2d ago

downloads-runner.tsThe phone app with your own g1t, on g1t.sh/download until Google Play, and Node 24 (#5 )4d ago

explore.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

forgot.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

github-install.tsConnecting GitHub to a workspace is one click and one trip to GitHub. A workspace owner's Connect GitHub on Import from GitHub links their GitHub account on the way if it is not linked yet and comes straight back to carry on: an installation they already have on GitHub and the workspace lacks is added rather than installed again (with several, they choose), and only with none are they sent to install the app; GitHub then returns them to the import page with the account connected. Before, linking and installing were separate chores (link, come back, install), Settings -> GitHub stopped at "Linked" with nowhere to go, and an app already on the account was "installed" again through GitHub's settings page. When GitHub returns after an installation that did not start from g1t, an unlinked account is linked on the way instead of showing an error with a button, and someone who owns one workspace has it added there without being asked which. Choose repositories on GitHub opens in the same tab, since GitHub brings you back after saving; Add a GitHub account still always installs on another account; Settings -> GitHub points to Import from GitHub once linked. A link that does not take shows the page instead of going round again. The GitHub guide describes the one-step flow. (The app's Setup URL was empty on GitHub, which left people there after installing; it is now set to /integrations/github/setup.) Checked: the site's typecheck (tsc -b --force), its 911 tests (new: what Connect GitHub does next), a production build and the deploy tool's 92 tests.yesterday

github-setup.tsxConnecting GitHub to a workspace is one click and one trip to GitHub. A workspace owner's Connect GitHub on Import from GitHub links their GitHub account on the way if it is not linked yet and comes straight back to carry on: an installation they already have on GitHub and the workspace lacks is added rather than installed again (with several, they choose), and only with none are they sent to install the app; GitHub then returns them to the import page with the account connected. Before, linking and installing were separate chores (link, come back, install), Settings -> GitHub stopped at "Linked" with nowhere to go, and an app already on the account was "installed" again through GitHub's settings page. When GitHub returns after an installation that did not start from g1t, an unlinked account is linked on the way instead of showing an error with a button, and someone who owns one workspace has it added there without being asked which. Choose repositories on GitHub opens in the same tab, since GitHub brings you back after saving; Add a GitHub account still always installs on another account; Settings -> GitHub points to Import from GitHub once linked. A link that does not take shows the page instead of going round again. The GitHub guide describes the one-step flow. (The app's Setup URL was empty on GitHub, which left people there after installing; it is now set to /integrations/github/setup.) Checked: the site's typecheck (tsc -b --force), its 911 tests (new: what Connect GitHub does next), a production build and the deploy tool's 92 tests.yesterday

home.tsxThe site no longer has g1t's own agents. g1t is where the coding agents you already use do their work, so the Agents mode is gone from the rail, with every page under /<workspace>/-/agents: personas, faces, skills, abilities, routines, computers, sessions and agent spend. Customize (skills, connectors, plugins, marketplaces), the context hub, model providers, the AI Gateway page, the Spend page and pill, Ask g1t, and the repository's Agents, Plans and agent settings pages go too, and their addresses now answer 404.2d ago

hovercard-user.tsMerge commit authors and hovercards: commits show their accounts, every name opens a card (repos 0016)6d ago

inbox-json.tsInbox: a bell in the top bar opens it beside the page, and /inbox holds it all1w ago

inbox-moved.tsg1t is described as the product it is in alpha, and its shell takes the new shape: the README, the docs home and docs/PLAN.md label every feature Live, Preview or Coming; a floating dock with the g1t mark, Today, Chat, Notifications, Agents, Code, Artifacts, your pinned apps and the Apps launcher, with People, Workspace and the account menu (now holding help) at its foot; the workspace's logo and switcher heading a flat sidebar that folds away with Ctrl B, or leading the header's breadcrumbs where there is none; the page in a rounded panel with a full-width header; Today as the front page, with first-time acceptance of agents' pull requests, what needs you and what's at stake, spend today and one item to start with, every number from a service; Notifications in place of the Inbox at /notifications; a bottom bar and More sheet on phones; and sign-in, sign-up, two-factor, reset, invites and choosing a workspace on standalone pages with no app around them.5d ago

install-script.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.2d ago

invitations.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

invite.tsxMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.2d ago

login-two-factor.tsxPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.yesterday

login.tsxg1t is described as the product it is in alpha, and its shell takes the new shape: the README, the docs home and docs/PLAN.md label every feature Live, Preview or Coming; a floating dock with the g1t mark, Today, Chat, Notifications, Agents, Code, Artifacts, your pinned apps and the Apps launcher, with People, Workspace and the account menu (now holding help) at its foot; the workspace's logo and switcher heading a flat sidebar that folds away with Ctrl B, or leading the header's breadcrumbs where there is none; the page in a rounded panel with a full-width header; Today as the front page, with first-time acceptance of agents' pull requests, what needs you and what's at stake, spend today and one item to start with, every number from a service; Notifications in place of the Inbox at /notifications; a bottom bar and More sheet on phones; and sign-in, sign-up, two-factor, reset, invites and choosing a workspace on standalone pages with no app around them.5d ago

logout.tsxTeam plan, an open-source pool, monthly trials and honest metering; the sidebar for everyone; a workspace that stays put1w ago

new-github.tsxConnecting GitHub to a workspace is one click and one trip to GitHub. A workspace owner's Connect GitHub on Import from GitHub links their GitHub account on the way if it is not linked yet and comes straight back to carry on: an installation they already have on GitHub and the workspace lacks is added rather than installed again (with several, they choose), and only with none are they sent to install the app; GitHub then returns them to the import page with the account connected. Before, linking and installing were separate chores (link, come back, install), Settings -> GitHub stopped at "Linked" with nowhere to go, and an app already on the account was "installed" again through GitHub's settings page. When GitHub returns after an installation that did not start from g1t, an unlinked account is linked on the way instead of showing an error with a button, and someone who owns one workspace has it added there without being asked which. Choose repositories on GitHub opens in the same tab, since GitHub brings you back after saving; Add a GitHub account still always installs on another account; Settings -> GitHub points to Import from GitHub once linked. A link that does not take shows the page instead of going round again. The GitHub guide describes the one-step flow. (The app's Setup URL was empty on GitHub, which left people there after installing; it is now set to /integrations/github/setup.) Checked: the site's typecheck (tsc -b --force), its 911 tests (new: what Connect GitHub does next), a production build and the deploy tool's 92 tests.yesterday

new.tsxMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.2d ago

not-found.tsxMerge branch 'worktree-agent-a8385d293d42c913a'1w ago

notifications.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

oauth-authorize.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

people-json.tsMerge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)6d ago

policies.tsxThe policies say they are drafts: the policies index and every policy page open with a note that they are still being written and may change before g1t's general launch, with the address for questions. One flag in legal.ts, POLICIES_DRAFT, takes the note down everywhere.2d ago

policy.tsxThe policies say they are drafts: the policies index and every policy page open with a note that they are still being written and may change before g1t's general launch, with the address for questions. One flag in legal.ts, POLICIES_DRAFT, takes the note down everywhere.2d ago

pricing.tsxThe policies are published, and g1t is written to at support@g1t.sh. Terms, Privacy, Refunds, Acceptable use and Subprocessors lose the draft banner (POLICIES_DRAFT is false, updated 2026-10-14, with the change in the policies' history): the terms name Delaware as governing law, say plainly that the plan renews each month until cancelled, and leave statutory consumer rights (an EU or UK consumer's 14 days to withdraw, how to ask, refunds within the legal deadline) above the no-refund and no-proration rules; writing to us before disputing a charge is a request, never a condition. Privacy clarifies analytics consent and what credential redaction can and cannot catch, and drops assurances about provider contracts and transfers that were not verified. Every contact (support, security, privacy, billing, abuse, legal) is support@g1t.sh, an alias for support@flagon.io, in the policies, SECURITY.md, the security page, pricing's enterprise link, the spike banner, a suspended account's sign-in message and the guides that named hey@flagon.io. Email sign-up is protected by Cloudflare Turnstile: the site's public key is set (the challenge still turns on only with both keys present), and Privacy and Subprocessors say so. Cloudflare Web Analytics' beacon is out of the site's script policy, as it no longer loads.yesterday

register.tsxMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.2d ago

reset.tsxMerge branch 'worktree-agent-a985c01f43538af01'1w ago

robots-txt.tsMerge site-audit: SEO routes, analytics with consent first in Europe, security page, founder and X account, docs header; the tour opens on the pull request and leads with Code, on the real shell, with Agents and Docs working today6d ago

search-json.tsSearch across all of g1t, Explore, and a command palette1w ago

search.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

security-txt.tsInvite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1w ago

security.tsxThe site no longer has g1t's own agents. g1t is where the coding agents you already use do their work, so the Agents mode is gone from the rail, with every page under /<workspace>/-/agents: personas, faces, skills, abilities, routines, computers, sessions and agent spend. Customize (skills, connectors, plugins, marketplaces), the context hub, model providers, the AI Gateway page, the Spend page and pill, Ask g1t, and the repository's Agents, Plans and agent settings pages go too, and their addresses now answer 404.2d ago

settings-menu-json.tsMerge branch 'worktree-agent-a6da31375506fc440'2d ago

sitemap-xml.tsMerge site-audit: SEO routes, analytics with consent first in Europe, security page, founder and X account, docs header; the tour opens on the pull request and leads with Code, on the real shell, with Agents and Docs working today6d ago

status-json.tsstatus.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1w ago

status.tsxstatus.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1w ago

support.tsxThe site no longer has g1t's own agents. g1t is where the coding agents you already use do their work, so the Agents mode is gone from the rail, with every page under /<workspace>/-/agents: personas, faces, skills, abilities, routines, computers, sessions and agent spend. Customize (skills, connectors, plugins, marketplaces), the context hub, model providers, the AI Gateway page, the Spend page and pill, Ask g1t, and the repository's Agents, Plans and agent settings pages go too, and their addresses now answer 404.2d ago

user.tsxPeople wear their own avatars wherever g1t knows them only by name, and a workspace is never shown as a person. The activity feeds, recent changes, home's most active faces, issue and pull request authors, assignees, comments and the audit log drew a person from their username alone, so everyone got their letter avatar instead of the picture they uploaded. An avatar given no picture now draws the letter at once and lays the person's own picture over it once it loads, from /-/avatar/user/<username> (routes/avatar-user.ts): a redirect to the picture on the usercontent origin, or not found, read from identity's people only, so a workspace's icon can never stand in for someone. Kept five minutes, public like the profile. Agents, the product tour's people, "someone" and workspaces' square avatars are never looked up (image null), so an account with the same name never lends them its face.2d ago

verify.tsxThe site is built from its shared components: one Button with its variants and sizes, one Badge, Card for every panel, Alert for notices, Kbd for keys, Table for the security tables, and Avatar, Command, Progress, ScrollArea, ToggleGroup, Collapsible and Accordion in the kit; raw buttons, hand-drawn cards and pills and per-file button class lists are gone, outline buttons stand the same height as filled ones, and the phone's Ask g1t loses its tile. Every page was compared pixel by pixel before and after.5d ago

well-known-g1t.tsThe phone app with your own g1t, on g1t.sh/download until Google Play, and Node 24 (#5 )4d ago