internal/

Package boundedwait holds the one piece of a background-loop shutdown that crosses package boundaries: bounded-wait-with-warn — "cancel (or close), wait for the goroutine to exit, but give up and warn once ctx is done", needed by internal/session's liveness poll and by internal/server's ingest queue, update apply and background loop (bgloop.go, which every poller runs on).

Package claudecode is the adapter boundary for everything Claude-Code-specific: hook payloads, the status-line payload, CLI invocation and version pinning.

Package commentpass strips every comment a plan branch added to production code, hands them to a judge as text, and reconstructs each file from its snapshot minus the drops.

Package evict holds the one generic map-eviction rule two packages need on opposite sides of a layering boundary: internal/server's captureStore and internal/reader's WriteLog each cap a map at a size limit by dropping its single oldest entry per insert.

Package ghissue is a minimal GitHub Issues client: obtaining a bearer token and filing one issue.

Package gitutil shells out to the `git` CLI (docs/conventions.md: "Git/GitHub: never go-git") to answer the small set of questions the daemon needs about a launch directory: is it a git checkout, where is its top level, what branch is it on, is it a linked worktree, and (for the reader) which files does git see there.

Package keyedlock holds one small primitive internal/session's Manager and internal/server's shellRegistry and terminalRegistry each need: a lazily-created, per-key mutex that serialises one key's whole check-then-act without blocking any other key's (kb:adr/actions-serialized-per-session).

Package locate resolves a dropped file's original on-disk path from its bytes alone (kb:spec/drop): a browser hands a page a dropped file's name and bytes, never its path, so the daemon locates the original by asking a sequence of Finders for basename+size candidates and verifying each one byte-for-byte before it counts.

Package reader holds the reader feature's filesystem scope and confinement rules — which paths a session's reader may list and serve — independent of HTTP handling (kb:spec/reader).

Package selfupdate is to GitHub Releases what internal/claudecode is to Claude Code: the one place that knows the redirect shape of {base}/latest, GoReleaser's asset naming and checksums.txt format, and the minisign signature file format.

Package server wires up musterd's HTTP+WS surface.

Package session holds the state machine (kb:anchor/state) and the in-memory session registry that feeds it.

Package store owns Muster's SQLite database: opening it in WAL mode, applying migrations, and the hand-written SQL for the kv and event tables.

Package termbridge owns the daemon-side PTY lifecycle for one terminal socket (kb:anchor/terminal.ws): spawning `tmux attach-session` under a `creack/pty`-managed pseudo-terminal, streaming raw bytes both directions, and resizing with pty.Setsize then tmux resize-window, never the pane-level primitive (kb:adr/surfaces-shared-attach-single-pty).

Package tmux wraps the `tmux` CLI operations Muster needs, always against a dedicated socket (CLAUDE.md hard rule: never the user's default server).

Package triage reduces public GitHub issue bodies to validated, enumerated data before any model holding tools can act on them.

Package tty answers one narrow question about a controlling terminal: is its line discipline canonical (line-buffered, "cooked") or raw.

Package usage holds the account-level usage aggregator: a neutral Sample shape plus one in-memory Aggregator, the kb:adr/usage-no-source-interface seam for a second usage source down the line.

Package webui embeds the built dashboard (web/vite.config.ts's outDir) into the musterd binary, so a copy of the binary moved away from the checkout still serves its own frontend (kb:adr/connection-dashboard-embedded-in-binary).