release: 0.18.0

.gitignore

@@ -19,4 +19,4 @@ packages/cli/README.md
 
 # filled-in deploy templates: real secrets, never the .example versioned above
 packages/cli/assets/deploy/*.local.yaml
-packages/cli/assets/deploy/brain.env
+packages/cli/assets/deploy/runner.env

.prettierignore

@@ -5,7 +5,7 @@ coverage
 bun.lock
 CHANGELOG.md
 
-# Committed copies of the brain repo's own generated JSON Schemas
-# (packages/contract/scripts/sync-brain-schemas.mjs). Left in the brain's own
+# Committed copies of the hub repo's own generated JSON Schemas
+# (packages/contract/scripts/sync-hub-schemas.mjs). Left in the hub's own
 # export format so a sync is a plain copy, never a copy plus a reformat.
-packages/contract/fixtures/cerveau-schemas
+packages/contract/fixtures/hub-schemas

CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to `codesema` (the npm package in `packages/cli`) are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning: [SemVer](https://semver.org).
 
+## [0.18.0] - 2026-08-27
+
+### Added
+
+- **A server can now receive its GitHub token and Claude Code credentials through the hub without the hub itself ever being able to read them.** `codesema runner connect --url <url> --token <token>` mints this machine's own identity and prints a fingerprint for it; the new `codesema runner await-secrets --env-file <path> [--timeout <s>]` then blocks until a human runs the new `codesema runner autoconfig` from their own workstation and delivers the repository URL and the two runtime secrets over a sealed channel (X25519 key agreement, AES-256-GCM), writing the env file itself (mode `0600`) and printing the repository URL on stdout, empty if the wait times out, so the caller never has to parse the file back out. The hub only ever relays sealed bytes it cannot read. The one manual step this exchange still asks for, comparing the fingerprint `runner connect` printed against the one `runner autoconfig` shows, is the whole defense against a hub that lied about which machine it was handing the secrets to: the same trust-on-first-use doctrine SSH host keys use. `codesema runner list` shows the identities a workspace has minted this way. `packages/cli/assets/deploy/install.sh` needs only `CODESEMA_HUB_TOKEN` to boot now: leaving `REPO_URL`, `GH_TOKEN` or `CLAUDE_CODE_OAUTH_TOKEN` unset switches it from direct mode into this exchange automatically, re-run-safe the same way the rest of the script already is. It also now checks that a detected `docker` is actually usable (`docker info` as the invoking user), not merely installed, and fails with the missing-group fix rather than at the first ticket's container run; rootless podman needs no such check.
+
+### Changed
+
+- **The "brain" vocabulary is gone from the CLI: a runner is the local daemon working tickets, a hub is the remote store that owns them (codesema.com or self-hosted).** `codesema brain <action>` is now `codesema runner <action>` across the board (`connect`, `status`, `ticket`, `serve`, `stop`, `install-service`, `uninstall-service`), and `codesema workspace --brain` is `codesema workspace --runner`. `install-service` now writes and enables `codesema-runner.service`, generated from the template shipped at `assets/systemd/codesema-runner.service`, and removes a previously installed `codesema-brain.service` unit automatically. The daemon's env file is `runner.env` (`~/.config/codesema/runner.env`), and the two identifiers it reads changed from `CODESEMA_BRAIN_URL`/`CODESEMA_BRAIN_TOKEN` to `CODESEMA_HUB_URL`/`CODESEMA_HUB_TOKEN`. The web settings panel's auto-merge field is `runnerAutoMerge`; the old `brainAutoMerge` key is still read from an existing config file, so nothing already saved breaks. `@codesema/contract` 0.9.0 renames the wire field `brain_ticket` to `hub_ticket`, with the old name still accepted on read. On boot, this repository's outbox and pidfile migrate in place to their new names, `.codesema/hub-outbox.jsonl` and `.codesema/runner.pid`.
+
 ## [0.17.0] - 2026-08-27
 
 ### Added

README.md

@@ -64,23 +64,23 @@ From the page you can also:
 
 **Merging.** The workspace does not merge on its own unless you ask it to: `mergePolicy` defaults to `human`. Task state lives under `.codesema/tasks/<id>/` in the repository it belongs to.
 
-## Brain mode
+## Runner mode
 
-A brain is a small local service that owns a backlog of tickets for a repository. Pointed at one, the workspace runs a hands-off loop: the brain publishes tickets, the workspace codes them, ships them, reviews them and reports every transition back.
+A runner is a background process that connects the workspace to the codesema hub (codesema.com, or your own instance) and works hands-off through its backlog of tickets for a repository: the hub publishes tickets, the runner codes them, ships them, reviews them and reports every transition back.
 
 ```bash
-codesema brain connect --url http://localhost:3000 --token csk_<workspaceId>.<secret>
-codesema brain status                            # brain, account, this repo, ready ticket count
-codesema brain ticket --issue 42                 # draft and publish a ticket from a forge issue
-codesema brain ticket --title "…" --prompt "…"   # same, from a free-form prompt
-codesema workspace --brain                       # workspace plus the brain daemon, same process
-codesema brain serve [--detach]                  # alias for the line above
-codesema brain stop                              # stops a detached daemon for this repo
+codesema runner connect --url http://localhost:3000 --token csk_<workspaceId>.<secret>
+codesema runner status                            # hub, account, this repo, ready ticket count
+codesema runner ticket --issue 42                 # draft and publish a ticket from a forge issue
+codesema runner ticket --title "…" --prompt "…"   # same, from a free-form prompt
+codesema workspace --runner                       # workspace plus the runner daemon, same process
+codesema runner serve [--detach]                  # alias for the line above
+codesema runner stop                              # stops a detached daemon for this repo
 ```
 
-A brain and a sync workspace are the same account: `brain connect` stores its token next to the `codesema sync` credentials. `brain ticket` runs the configured agent once, outside the workspace, to write the ticket body in the grammar the brain requires; a body the lint rejects gets one retry with the lint's reasons folded into the prompt.
+A runner and a sync workspace are the same account: `runner connect` stores its token next to the `codesema sync` credentials. `runner ticket` runs the configured agent once, outside the workspace, to write the ticket body in the grammar the hub requires; a body the lint rejects gets one retry with the lint's reasons folded into the prompt.
 
-With `--brain`, the workspace polls the brain in the background, drafts the ticket requests waiting on this repository and, when no task is already running here, claims the next published ticket and hands it to the same task manager the UI drives. Reports the brain could not receive are queued and replayed. Auto-merging a brain ticket's task once it ships clean is controlled by `brainAutoMerge` (on by default), independently of `mergePolicy`.
+With `--runner`, the workspace polls the hub in the background, drafts the ticket requests waiting on this repository and, when no task is already running here, claims the next published ticket and hands it to the same task manager the UI drives. Reports the hub could not receive are queued and replayed. Auto-merging a hub ticket's task once it ships clean is controlled by `runnerAutoMerge` (on by default), independently of `mergePolicy`.
 
 ## Working without a forge
 
@@ -98,7 +98,7 @@ Without an `origin` remote, without `gh`/`glab`, or offline, codesema keeps work
 | Command                                                               | What it does                                                                       |
 | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
 | `codesema`                                                            | Opens the workspace in an interactive terminal; behaves like `review` otherwise    |
-| `codesema workspace [--brain]`                                        | The workspace, explicitly                                                          |
+| `codesema workspace [--runner]`                                       | The workspace, explicitly                                                          |
 | `codesema review [--branch] [--target] [--full] [--dual] [--fail-on]` | Reviews a local branch                                                             |
 | `codesema menu`                                                       | Terminal menu: workspace, review, dual review, show, cloud (sync and link), config |
 | `codesema config`                                                     | Language, agent, model, effort, auto-sync and the other settings                   |
@@ -107,7 +107,7 @@ Without an `origin` remote, without `gh`/`glab`, or offline, codesema keeps work
 | `codesema export [--review] [--out]`                                  | Exports the review as Markdown (`--out -` for stdout)                              |
 | `codesema sync` / `codesema sync delete`                              | Pushes the latest review to a codesema.com workspace, or erases everything synced  |
 | `codesema link [code]`                                                | Links this workspace to a codesema.com account                                     |
-| `codesema brain <action>`                                             | See [Brain mode](#brain-mode)                                                      |
+| `codesema runner <action>`                                            | See [Runner mode](#runner-mode)                                                    |
 
 Shared flags: `--agent <cmd>`, `--port <n>` (default 4400, 20 ports scanned from there), `--timeout <s>` (default 900), `--no-open`, `--force` (sync), `-h`, `-v`. `codesema --help` lists them all.
 
@@ -145,7 +145,7 @@ Some keys are global only: they govern the machine (its load, its disk) or give
 | `mergeStrategy`                                            | unset (`merge`, `squash`, `rebase`) | global only     |
 | `deleteBranchAfterMerge`                                   | `false`                             | global only     |
 | `allowMergeWithoutChecks`                                  | `false`                             | global only     |
-| `brainAutoMerge`                                           | `true`                              | global only     |
+| `runnerAutoMerge`                                          | `true`                              | global only     |
 | `syncUrl`, `syncWorkspaceId`, `syncSecret`, `syncAutoPush` | unset                               | global only     |
 
 `maxParallelTasks` is the former name of `maxConcurrentAgents`. It is still honoured, with a warning at startup.
@@ -204,7 +204,7 @@ Workspace tasks are the opposite case, since they exist to edit code: they are c
 | `XDG_CONFIG_HOME`               | Base of that default when `CODESEMA_CONFIG_DIR` is unset |
 | `CODESEMA_NO_UPDATE_CHECK`      | Any non-empty value skips the startup npm version check  |
 | `CODESEMA_SYNC_URL`             | Points `sync`/`link` at another codesema.com host        |
-| `CODESEMA_BRAIN_MODE`           | Set by `workspace --brain`; starts the brain daemon      |
+| `CODESEMA_RUNNER_MODE`          | Set by `workspace --runner`; starts the runner daemon    |
 | `NO_COLOR`, `TERM=dumb`         | Turn coloured terminal output off                        |
 | `LC_ALL`, `LC_MESSAGES`, `LANG` | Preselect the wizard's language question                 |