apps/sudo/app/lib · flagon-io/g1t

chart.test.tssudo's Overview adds up this month the way the Costs page does, so the two can't disagree. Before, the Overview kept its own count from the ledger. That count left usage paid with credit nowhere: neither revenue nor given. It also estimated what gifts cost as price less the margin. So a month of comped use read as a red margin on nothing sold. Now billing's Overview carries month_margin, the Costs model's figures for the month through its last rolled-up day (margin_through), and the Costs page and the Overview add up the same days with one function, overall_of. In the model, credits spent count as given (promotional, goodwill) or as sold (paid, refund), and so do the free tier, discounts and testing resets. Given is what it actually cost, and cost includes Cloudflare's bill. The Overview's revenue, margin on what was sold, Given by g1t, cost line (Cloudflare and models apart, with a link to Costs & margin) and the Given this month table (cost by why) read from it. The header says through which day. Before a day of the month is rolled up, it falls back to the ledger as before. The six-month chart and This month by kind still read the ledger. Checked: cargo test -p g1t-billing (292; new: the Overview and the Costs page add up the same days), apps/sudo tsc -b and npm test (159; new: marginApart, dayShort).yesterday

chart.tssudo's Overview adds up this month the way the Costs page does, so the two can't disagree. Before, the Overview kept its own count from the ledger. That count left usage paid with credit nowhere: neither revenue nor given. It also estimated what gifts cost as price less the margin. So a month of comped use read as a red margin on nothing sold. Now billing's Overview carries month_margin, the Costs model's figures for the month through its last rolled-up day (margin_through), and the Costs page and the Overview add up the same days with one function, overall_of. In the model, credits spent count as given (promotional, goodwill) or as sold (paid, refund), and so do the free tier, discounts and testing resets. Given is what it actually cost, and cost includes Cloudflare's bill. The Overview's revenue, margin on what was sold, Given by g1t, cost line (Cloudflare and models apart, with a link to Costs & margin) and the Given this month table (cost by why) read from it. The header says through which day. Before a day of the month is rolled up, it falls back to the ledger as before. The six-month chart and This month by kind still read the ledger. Checked: cargo test -p g1t-billing (292; new: the Overview and the Costs page add up the same days), apps/sudo tsc -b and npm test (159; new: marginApart, dayShort).yesterday

costs-route.server.tsThe site no longer has g1t's own agents. g1t is where the coding agents you already use do their work, so the Agents mode is gone from the rail, with every page under /<workspace>/-/agents: personas, faces, skills, abilities, routines, computers, sessions and agent spend. Customize (skills, connectors, plugins, marketplaces), the context hub, model providers, the AI Gateway page, the Spend page and pill, Ask g1t, and the repository's Agents, Plans and agent settings pages go too, and their addresses now answer 404.4d ago

costs.test.tsMerge Cloudflare's usage over its billing cycle: every page read, included amounts once a cycle, a projection, test-mode charges never money in (billing 0052)1w ago

costs.tsIn sudo, what complimentary allowances give is named for them: the given line billing counts them under reads 'promotional credit and complimentary allowances' on the Overview and Costs & margin, so a workspace's $100 a month shows where you'd look for it. Checked: apps/sudo npm test (159).yesterday

credits.test.tsBilling: credits with a kind and expiry, discounts instead of comped, and safer charging1w ago

credits.tsBilling: credits with a kind and expiry, discounts instead of comped, and safer charging1w ago

deleted-accounts.test.tsMerge sudo: delete an account with the workspaces it alone owns, purge each1w ago

deleted-accounts.tsMerge sudo: delete an account with the workspaces it alone owns, purge each1w ago

deleted-workspaces.test.tsPackages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1w ago

deleted-workspaces.tsPackages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1w ago

forms.test.tsMerge branch 'worktree-agent-ac950b9c891220ad3'3d ago

forms.tsMerge main into project-descriptions2d ago

guard.test.tssudo is a React app now, hydrated in the browser as the site is: pages are still rendered on the server, then React Router takes over, so a sidebar link opens the next page without reloading. A lavender bar across the top shows while the next page loads (it appears at once, creeps, then fills and fades, as on the site) and the page dims after a moment. The phone menu closes when a link is followed, and a <Form> that was sent goes back to what the page now says, its button letting go of the spinner. The pages run only sudo's own scripts: each page's content security policy names a nonce made for that page (script-src 'self' 'nonce-…', connect-src 'self', everything else as strict as before, still no inline style), entry.server.tsx hands it to React Router's inline scripts and preloads, and every answer that is not a page (data, redirects, files) still forbids every script. The <details> folds still open before any script loads. Comments and the README that said sudo ships no JavaScript now say what is true. Checked: npm run typecheck and npm test in apps/sudo (160, new: the page policy and its nonce), npm run build, and the built worker run locally with the Access check stubbed (not committed) in headless Chrome: no CSP violations or console errors, the page hydrates, a folded section opens on click, a sidebar link navigates client-side with the bar and the dimming, the phone menu closes on navigation, and .data answers keep script-src 'none'. Posting a form was not tried locally (the same-origin check wants https://sudo.g1t.sh).yesterday

guard.tssudo is a React app now, hydrated in the browser as the site is: pages are still rendered on the server, then React Router takes over, so a sidebar link opens the next page without reloading. A lavender bar across the top shows while the next page loads (it appears at once, creeps, then fills and fades, as on the site) and the page dims after a moment. The phone menu closes when a link is followed, and a <Form> that was sent goes back to what the page now says, its button letting go of the spinner. The pages run only sudo's own scripts: each page's content security policy names a nonce made for that page (script-src 'self' 'nonce-…', connect-src 'self', everything else as strict as before, still no inline style), entry.server.tsx hands it to React Router's inline scripts and preloads, and every answer that is not a page (data, redirects, files) still forbids every script. The <details> folds still open before any script loads. Comments and the README that said sudo ships no JavaScript now say what is true. Checked: npm run typecheck and npm test in apps/sudo (160, new: the page policy and its nonce), npm run build, and the built worker run locally with the Access check stubbed (not committed) in headless Chrome: no CSP violations or console errors, the page hydrates, a folded section opens on click, a sidebar link navigates client-side with the bar and the dimming, the phone menu closes on navigation, and .data answers keep script-src 'none'. Posting a form was not tried locally (the same-origin check wants https://sudo.g1t.sh).yesterday

incidents.test.tsstatus.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1w ago

incidents.tsFast pages, required checks on the branch, self-hosted runners, honest incidents1w ago

invites.test.tsMerge branch 'worktree-agent-a6da31375506fc440'3d ago

invites.tsMerge branch 'worktree-agent-a6da31375506fc440'3d ago

latency.test.tsMerge status detection: first-byte speed probe, deploy windows, 4 of 5 with a re-check, check history, reminders1w ago

latency.tsMerge status detection: first-byte speed probe, deploy windows, 4 of 5 with a re-check, check history, reminders1w ago

ledgers.test.tsMerge branch 'worktree-agent-ac950b9c891220ad3'3d ago

ledgers.tsMerge branch 'worktree-agent-ac950b9c891220ad3'3d ago

money.test.tsBilling accounts, terms and enterprises; g1t is no longer free1w ago

money.tssudo: the costs statement reads to the cent1w ago

nav.test.tsPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.2d ago

nav.tsPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.2d ago

postmortem.tsstatus.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1w ago

pricing.test.tssudo's Overview adds up this month the way the Costs page does, so the two can't disagree. Before, the Overview kept its own count from the ledger. That count left usage paid with credit nowhere: neither revenue nor given. It also estimated what gifts cost as price less the margin. So a month of comped use read as a red margin on nothing sold. Now billing's Overview carries month_margin, the Costs model's figures for the month through its last rolled-up day (margin_through), and the Costs page and the Overview add up the same days with one function, overall_of. In the model, credits spent count as given (promotional, goodwill) or as sold (paid, refund), and so do the free tier, discounts and testing resets. Given is what it actually cost, and cost includes Cloudflare's bill. The Overview's revenue, margin on what was sold, Given by g1t, cost line (Cloudflare and models apart, with a link to Costs & margin) and the Given this month table (cost by why) read from it. The header says through which day. Before a day of the month is rolled up, it falls back to the ledger as before. The six-month chart and This month by kind still read the ledger. Checked: cargo test -p g1t-billing (292; new: the Overview and the Costs page add up the same days), apps/sudo tsc -b and npm test (159; new: marginApart, dayShort).yesterday

pricing.tssudo's Overview adds up this month the way the Costs page does, so the two can't disagree. Before, the Overview kept its own count from the ledger. That count left usage paid with credit nowhere: neither revenue nor given. It also estimated what gifts cost as price less the margin. So a month of comped use read as a red margin on nothing sold. Now billing's Overview carries month_margin, the Costs model's figures for the month through its last rolled-up day (margin_through), and the Costs page and the Overview add up the same days with one function, overall_of. In the model, credits spent count as given (promotional, goodwill) or as sold (paid, refund), and so do the free tier, discounts and testing resets. Given is what it actually cost, and cost includes Cloudflare's bill. The Overview's revenue, margin on what was sold, Given by g1t, cost line (Cloudflare and models apart, with a link to Costs & margin) and the Given this month table (cost by why) read from it. The header says through which day. Before a day of the month is rolled up, it falls back to the ledger as before. The six-month chart and This month by kind still read the ledger. Checked: cargo test -p g1t-billing (292; new: the Overview and the Costs page add up the same days), apps/sudo tsc -b and npm test (159; new: marginApart, dayShort).yesterday

review.tsMerge main into project-descriptions2d ago

sales-actions.server.tsA menu shaped by how g1t works, Soon pages for every promise, and sudo for sales1w ago

services.server.tsPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.2d ago

settle.tsA menu shaped by how g1t works, Soon pages for every promise, and sudo for sales1w ago

signals.test.tssudo: Invoices, Audit log, and follow-ups due1w ago

signals.tsGit storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily1w ago

staff.tsFast pages, required checks on the branch, self-hosted runners, honest incidents1w ago

suspension.test.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

suspension.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

terms.test.tsBilling: credits with a kind and expiry, discounts instead of comped, and safer charging1w ago

terms.tsBilling: credits with a kind and expiry, discounts instead of comped, and safer charging1w ago

test-detach.server.tsBilling is ready to take real money, and stays on Stripe's test key until the switch. The g1t plan is $21 a month, all-in, with $10 of usage included: the card processing fee is part of the price, and no payment carries a fee line any more (old fee rows still read as they were). Card, billing address, tax IDs, invoices and cancelling are on Stripe's billing page (Manage billing), whose configuration billing keeps in step; Checkout asks for the billing address and a tax ID; g1t's Billing page keeps usage, the spend limit, budget alerts and prepaying. Members other than owners and billing managers no longer see billing details or invoices, from the page or the API.3d ago

test-detach.test.tsBilling is ready to take real money, and stays on Stripe's test key until the switch. The g1t plan is $21 a month, all-in, with $10 of usage included: the card processing fee is part of the price, and no payment carries a fee line any more (old fee rows still read as they were). Card, billing address, tax IDs, invoices and cancelling are on Stripe's billing page (Manage billing), whose configuration billing keeps in step; Checkout asks for the billing address and a tax ID; g1t's Billing page keeps usage, the spend limit, budget alerts and prepaying. Members other than owners and billing managers no longer see billing details or invoices, from the page or the API.3d ago

test-detach.tsBilling is ready to take real money, and stays on Stripe's test key until the switch. The g1t plan is $21 a month, all-in, with $10 of usage included: the card processing fee is part of the price, and no payment carries a fee line any more (old fee rows still read as they were). Card, billing address, tax IDs, invoices and cancelling are on Stripe's billing page (Manage billing), whose configuration billing keeps in step; Checkout asks for the billing address and a tax ID; g1t's Billing page keeps usage, the spend limit, budget alerts and prepaying. Members other than owners and billing managers no longer see billing details or invoices, from the page or the API.3d ago

theme.test.tssudo no longer blinks unstyled between pages, and has Appearance: Auto, Light or Dark, drawn in the chosen theme from the first byte. The stylesheet was imported for React Router's <Links />, which moved it among the head's links as pages changed. Each move took it off the page for a frame, so the page showed unstyled (in a headless run the body's background went transparent mid-navigation). It is a React 19 stylesheet resource now (precedence), as on g1t.sh: drawn once and never moved. The favicon and font preloads sit in the head beside it. Appearance works as on g1t.sh. The choice is a cookie (sudo_theme) the root loader reads, so <html> carries data-theme and the browser bar's colour from the server. Auto sets nothing and follows the system. Switching changes the page at once and keeps the cookie. Every colour token is a light-dark() pair, and the charts and bars that named the dark-only tokens use the paired ones. The switch sits in the panel at the foot of the menu, on phones too. Checked: apps/sudo tsc -b, npm test (163; new: the theme), and a built sudo run locally with sign-in stubbed (not committed) through ten pages in headless Chrome. The stylesheet was never removed and the background never blinked. A light cookie on a dark system drew light from the first byte, Dark switched at once and kept the cookie, and Auto followed the system.yesterday

theme.tssudo no longer blinks unstyled between pages, and has Appearance: Auto, Light or Dark, drawn in the chosen theme from the first byte. The stylesheet was imported for React Router's <Links />, which moved it among the head's links as pages changed. Each move took it off the page for a frame, so the page showed unstyled (in a headless run the body's background went transparent mid-navigation). It is a React 19 stylesheet resource now (precedence), as on g1t.sh: drawn once and never moved. The favicon and font preloads sit in the head beside it. Appearance works as on g1t.sh. The choice is a cookie (sudo_theme) the root loader reads, so <html> carries data-theme and the browser bar's colour from the server. Auto sets nothing and follows the system. Switching changes the page at once and keeps the cookie. Every colour token is a light-dark() pair, and the charts and bars that named the dark-only tokens use the paired ones. The switch sits in the panel at the foot of the menu, on phones too. Checked: apps/sudo tsc -b, npm test (163; new: the theme), and a built sudo run locally with sign-in stubbed (not committed) through ten pages in headless Chrome. The stylesheet was never removed and the background never blinked. A light cookie on a dark system drew light from the first byte, Dark switched at once and kept the cookie, and Auto followed the system.yesterday

time.test.tssudo's Overview opens with sign-ups: two headline cards, Customers (people signed up) and Workspaces, each with the total, how many are new this week against the week before (up, down or level), a 'N new today' badge when there are any, and the newest one by name with how long ago. Customers links to the newest person, Workspaces to the list. They come from identity's new staff-only admin_growth (crates/contracts GrowthCount, one statement; deleted accounts and workspaces are not counted); if identity does not answer, the cards give way to a notice and the money stays. Checked: cargo check -p g1t-identity (wasm32), apps/sudo typecheck, node --test app/lib/time.test.ts (new: ago).yesterday

time.tssudo is a React app now, hydrated in the browser as the site is: pages are still rendered on the server, then React Router takes over, so a sidebar link opens the next page without reloading. A lavender bar across the top shows while the next page loads (it appears at once, creeps, then fills and fades, as on the site) and the page dims after a moment. The phone menu closes when a link is followed, and a <Form> that was sent goes back to what the page now says, its button letting go of the spinner. The pages run only sudo's own scripts: each page's content security policy names a nonce made for that page (script-src 'self' 'nonce-…', connect-src 'self', everything else as strict as before, still no inline style), entry.server.tsx hands it to React Router's inline scripts and preloads, and every answer that is not a page (data, redirects, files) still forbids every script. The <details> folds still open before any script loads. Comments and the README that said sudo ships no JavaScript now say what is true. Checked: npm run typecheck and npm test in apps/sudo (160, new: the page policy and its nonce), npm run build, and the built worker run locally with the Access check stubbed (not committed) in headless Chrome: no CSP violations or console errors, the page hydrates, a folded section opens on click, a sidebar link navigates client-side with the bar and the dimming, the phone menu closes on navigation, and .data answers keep script-src 'none'. Posting a form was not tried locally (the same-origin check wants https://sudo.g1t.sh).yesterday

workspaces.test.tsStripe webhooks, enterprise invoices, and sudo for both1w ago

workspaces.tsStripe webhooks, enterprise invoices, and sudo for both1w ago