[llima]

Summary

• Version bumped to 0.37.0. Merging publishes craftar@0.37.0 to npm after approval in the npm environment.
• Spec 40 Part C: craftar ui --allow-writes. Typing the flag is the consent. The page then offers Sync for a workspace and Discard edit for one hand-edited file (drift / orphan-drift, offered only from its open diff), each confirmed in the page. Sync never passes --overwrite-drift, and a discard is a drift discard of that one path. Neither is offered for .claude/settings.craftar.example.json, nor for a workspace whose Forge is remote. A write is refused when the workspace changed since the page showed it (a status digest).
• Two writing routes, POST /api/workspaces/<id>/sync {digest} and …/discard {digest, path}.
  • Requests are checked in spec §6.3's order: method → length → Host → Origin and Sec-Fetch-Site (both required for a POST) → route (405 with Allow) → token → Content-Type (415) → body ≤ 4096 bytes counted as it arrives (413), parsed strictly (400) → a queue of one.
  • Writes then run in §6.4's order: the remote Forge is refused from the configuration, before anything is fetched → load / plan / status → digest (409) → discard row (409 not a hand-edited file, the path never echoed) → unset parameter (409) → syncWorkspace. The answer has the shape of the MCP sync tool's result.
• Without the flag craftar ui is unchanged, with one exception. The page, its script and stylesheet (pinned by sha256), the 405s and the three terminal lines are byte for byte 0.36.0's, and so is every answer except GET /api/workspaces, which gains writes: false.
• Shared core, no second copy:
  • syncToolResult (src/core/write-actions.ts) is the one builder of the sync result, for craftar mcp and craftar ui. A discarded orphan-drift reads hand-edited orphan: discarded (DISCARDED_ORPHAN, the words drift discard prints). Every other removal keeps spec 41's orphanReason.
  • orphanDriftBody (src/core/report.ts) is the one reader of an orphan-drift body, used by drift show and the page. drift show's bytes were pinned before the change.
• Two checks deferred from 0.35.0's review (test-only): an unreadable registry in mcp allow-writes / revoke-writes, and openWorldHint on the writing tools.

Ship notes

• No run in a real browser. The page was driven in a stub DOM (Sync and Discard edit clicked, with fail-first evidence). Before the rebase onto 0.36.0, curl was run against a real craftar ui --port 0 --allow-writes on a synthetic workspace: 403 with no Origin, 415, 409 with no echo, a drift discard, a stale digest refused, a sync, and SIGINT exiting 0. Windows was not run by hand.
• The Discard confirmation says only that the file's edit is lost (spec §6.5's wording). The same click also syncs the other pending files, as craftar drift discard does.
• A body over 4096 bytes keeps nothing past the limit and is drained to its end (up to 1 MiB) before the 413 is sent and the connection closed. Destroying it at once reset the connection on Windows before the answer was read; the first CI run failed there. A test asserts the order (end before the response) and fails against the old server on Linux too.
• A write that fails inside apply() after its first write answers 500 internal error, as every failure of ours does; the page is not told which files were written (the terminal gets the first line).
• Content-Type is compared case-insensitively (a media type is), where spec §6.3 says "exactly".
• The result line of a write is appended at the end of the view and may be below the fold. A 409 for a stale digest offers no Refresh button of its own; the frame's Refresh is on screen.
• The page's diff route keeps its words for an orphan that agents-md.primary made (spec 41 §4.8), now pinned by a test.
• Owed in the workspace after ship: spec 40 §19 / At ship, and the node-cli rule and reviewer's craftar ui bullet (POST under --allow-writes, the §6.3 order) together with the statusDigest sentence.

Test plan

• npm run typecheck: pass
• npm run build: pass
• npx vitest run --exclude test/ci.test.ts --maxWorkers=6: 154 files passed (1 skipped), 3633 tests passed, 11 skipped. The oracle was skipped (no fixture in the worktree); no emitter, plan(), status() or apply() code changes.
• node-cli-reviewer (opus), six rounds over the full range: R3 clean, R4 confirmation clean; R5–R6 over the Windows CI fixes, R6 clean; R7 full range at 1653ae9 clean.
• Pins: test/ui-writes-pins.test.ts (the read-only page and answers), test/write-pins.test.ts, the drift show pins.
• CI green on this PR (8/8 at 1653ae9)