@assuredloop/orca-bot-kit 0.25.3 → 0.25.6

package/README.md

@@ -643,13 +643,14 @@ npm run mutate                # the mutation audit, on what your branch changed
 
 The tests come in two layers, and every test file belongs to one of them.
 
-`npm test` is `test/*.test.js`: unit tests and end-to-end runs of the CLI in a
-throwaway folder, with a fake `orca` on PATH. It needs nothing but Node, so
-[GitHub Actions](.github/workflows/ci.yml) runs it on every pull request, split
-into shards that run side by side, on Node 25.8.0, the current line. A release
-runs every shard on 25.8.0 and again on 24.21.0, the floor `engines.node`
-promises users, with only the kit's own dependencies installed, before anything
-is published.
+`npm test` is `test/*.test.js` and `test/dev/*.test.js`: unit tests and
+end-to-end runs of the CLI in a throwaway folder, with a fake `orca` on PATH. It
+needs nothing but Node, so [GitHub Actions](.github/workflows/ci.yml) runs it on
+every pull request, split into shards that run side by side, on Node 25.8.0, the
+current line. A release runs every shard on 25.8.0 and again on 24.21.0, the
+floor `engines.node` promises users, with only the kit's own dependencies
+installed, before anything is published. The floor leaves out `test/dev/`, the
+tests that need a development tool.
 
 `npm run test:system` is `test/system/*.test.js`: the real `obk` against the
 real Orca and the real harnesses on your own machine. No CI runner can do that,

package/SETUP.md

@@ -201,7 +201,7 @@ waiting for:
 | Claude Code's folder trust list | `\x1b[B\r` | down, then return: its selection starts on **No, exit** | Claude Code 2.1.283 |
 | Codex's directory trust, `1. Trust and continue` (older: `1. Yes, continue`) | `\r` | return: its selection starts on **Trust and continue** | Codex 0.160.0 |
 | Codex's `Hooks need review` | `\x1b[B\r` | down, then return, to **Trust all and continue**; if the selection already starts there, return alone | Codex 0.160.0 |
-| Codex's `/new`: `Where should the new conversation run?` | `\r` | return: its selection starts on **Current checkout** (bot home) | Codex 0.160.0 |
+| Codex's `/new`: `Where should the new conversation run?` | `\r` | return: its selection starts on **Current checkout** (bot home); on 0.162.0 it is called **1. Use current Git worktree** (Keep using the current working directory). Never **Create new Git worktree** | Codex 0.160.0; Codex 0.162.0 (#516) |
 | Codex's update offer, `1. Update now` | `\r` | return: its selection starts on **Update now**, which accepts it | Codex 0.156.1; seen on 0.157.1 (offering 0.158.0) with the selection on **Update now**, not pressed; 0.158.0 offered 0.160.0, taken on 2026-10-02 by Bot Father's restarts |
 | `[oh-my-zsh] Would you like to update?` | `n` | they update their own shell | oh-my-zsh bf77e35 |
 | Claude Code's `Teach auto mode about your environment?` | `\x1b` | Esc, which cancels it (**Not now**). On 2.1.283 it is a form, not a list: `How you use Claude here`, `Also scan shell history`, `Also scan your other repos`, `Continue`, and `Enter to continue · Esc to cancel`. **Never send a return**: Enter is **Continue**, which starts a scan of the project, recent Claude sessions and, by default, the machine's shell history | Not yet proven: Esc cancels in Claude Code 2.1.283's code, not yet seen live (#370); the form was seen live twice on 2.1.283, in #261's live test and #239's live run 1 (#416); 2.1.278 showed a numbered list, answered with 2. Not now |
@@ -248,6 +248,26 @@ Bash(<kit> temp answer:*)
 Ask the user, and only after their yes run
 `obk bot change --bots <their path> --bot <bot> --allow 'Bash(<kit> temp answer:*)'`.
 
+A long-lived session's two screens go through the kit as well, not through the
+keys. On Codex's hooks review, run
+`obk session trust-hooks --bots <their path> --bot <bot> --session <session>`.
+On Claude Code's `Teach auto mode` screen, run
+`obk session answer --bots <their path> --bot <bot> --session <session>`.
+A long-lived session is Bot Father's, so run them from outside the fleet's tabs,
+as you do here, or from a Bot Father session. A session of any other bot is
+refused. They make the same checks as the temp commands. Before either
+trust-hooks command trusts hooks, the kit checks that the hooks on the review
+are its own: the bot's `.codex/hooks.json` holds only the kit's hooks, and the
+count on the screen is the number of the kit's hooks that Codex does not trust
+yet. When it refuses, it says what it saw: type nothing, and tell them what it
+said. Use the keys in the table for the screens the kit does not answer.
+The kit reads Codex's trust from the caller's `CODEX_HOME`, else `~/.codex`;
+a bot run under another `CODEX_HOME` is outside what the kit can see.
+The kit also records the extra arguments it launched each session with, and
+refuses when they mention hooks, or when there is no record. A Codex that
+someone started again by hand in that tab, with other flags, is outside what
+the kit records.
+
 **Anything you do not recognise: type nothing.** Tell them what is on the
 screen and which tab it is in, and wait. A keypress into a menu you have not read
 is how a harness quits back to the shell.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assuredloop/orca-bot-kit",
-  "version": "0.25.3",
+  "version": "0.25.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -23,8 +23,9 @@
     "SETUP.md"
   ],
   "scripts": {
-    "test": "node --test test/*.test.js",
-    "test:shard": "node --test --test-shard=$SHARD test/*.test.js",
+    "test": "node --test test/*.test.js test/dev/*.test.js",
+    "test:shard": "node --test --test-shard=$SHARD test/*.test.js test/dev/*.test.js",
+    "test:floor": "node --test --test-shard=$SHARD test/*.test.js",
     "test:system": "node scripts/test-system.js",
     "mutate": "node scripts/mutate.js"
   },

package/rules/mail.md

@@ -8,6 +8,10 @@ To reach another session, ask the kit for the road rather than guessing an
 address: `"${OBK_CLI:-obk}" message to --bots <bots> --to <bot>/<session>`. It
 answers with the address and the command that carries it.
 
+If your harness refuses a message, do not send it again by another road. Tell
+your maker or your user, with the harness's reason. A refusal can mean a missing
+permission rule, which they can add through the kit after the user's yes.
+
 Mail is queued, not an interruption. Read it when you finish what you are on.
 
 Ask for a reply when you need one, and send one when you were asked for one.

package/skills/obk-bot-building/SKILL.md

@@ -335,6 +335,19 @@ only after a second look), refuses any other screen, and checks that it went. It
 rule is `Bash(<kit> temp answer:*)`, `<kit>` the kit's CLI path as the
 command prints it; ask the user before `obk bot change --allow` adds it.
 
+A long-lived session's two screens go through the kit too: Codex's hooks
+review with `obk session trust-hooks --bots <bots> --bot <bot> --session
+<session>`, and Claude Code's `Teach auto mode` screen with `obk session
+answer --bots <bots> --bot <bot> --session <session>`. A long-lived session is
+Bot Father's: the caller is a Bot Father session or the user, from outside the
+fleet's tabs, and a session of any other bot is refused. They make the same
+checks as the temp commands. Before either trust-hooks command trusts hooks,
+it checks that the hooks on the review are the kit's own: the bot's
+`.codex/hooks.json` holds only the kit's, and the count on the screen is the
+number of the kit's hooks Codex does not trust yet. A refusal says what it
+saw; then type nothing and take it to the user. The keys in the table are for
+the screens the kit does not answer.
+
 Where the kit says no session came up, the shell swallowed the launch line,
 usually while it was asking its own question. Answer the shell, then close
 that one tab (`<orca> terminal close --terminal <handle> --tab`) and run

package/src/book.js

@@ -28,6 +28,9 @@ const HEADER = `# What Orca calls this bot on this machine, and where each of it
 # \`rules\` is a stamp of the bot's AGENTS.md as the session last read it, so a
 # change to it after the session started can be told apart.
 #
+# \`launched_with\` is the extra arguments the kit typed on the session's last
+# launch line, as bot.yaml's extra_args gave them then.
+#
 # \`retired\` holds what the book knew about each session \`obk retire\` took off
 # the bot, with when, so the conversations it had are still accounted for.
 #

package/src/clear.js

@@ -38,9 +38,13 @@ const POINTER = { claude: '❯', codex: '›' };
  */
 const RECORD_LINE = 'obk: this conversation was started by obk session clear, and this line is only so the kit can record it. Reply "ok"; nothing else is asked.';
 
-/** What Codex asks after `/new`, and the one answer the kit gives it: the bot home it runs in. */
+/**
+ * What Codex asks after `/new`, and the one answer the kit gives it: the bot
+ * home it runs in. Codex 0.162.0 calls it by another name, and its whole row
+ * has to be as captured, but for the padding before its description (#516).
+ */
 const WHERE_TO_RUN = 'Where should the new conversation run?';
-const CURRENT_CHECKOUT = /^ *› +1\. Current checkout\b/;
+const CURRENT_CHECKOUT = /^ *› +1\. Current checkout\b|^ *› 1\. Use current Git worktree\s+Keep using the current working directory *$/;
 
 /** Codex's empty input line: its pointer alone, or with its placeholder. */
 const CODEX_EMPTY = ['›', '› Ask Codex to do anything'];
@@ -51,7 +55,8 @@ const CODEX_EMPTY = ['›', '› Ask Codex to do anything'];
  * selected row stands for what Return will run: with the menu open, Return
  * runs the selected command, and the menu is narrowed to what was typed
  * (codex-rs/tui/src/bottom_pane/chat_composer.rs, rust-v0.160.0). The
- * architect's ruling on #391, after live run 4.
+ * architect's ruling on #391, after live run 4. Only where Orca gives no
+ * draft: a draft is the line's text, and has to be the command (#516).
  */
 const CODEX_BARE_LINE = '0.160.0';
 
@@ -221,14 +226,13 @@ async function enter(it, verb, before = () => {}) {
  * when it was typed.
  */
 export async function typeCommand(it, command, { before = () => {}, check = menuWrong, cannot = () => '', deadline = Infinity } = {}) {
-  // On Codex, what is typed cannot be read back once its menu is open, so
-  // nothing may be in its input line before: no draft for the command to join.
-  // On Claude Code, Orca gives a draft in the line beside the screen (#510).
+  // Nothing may be in the input line before: no draft for the command to join.
+  // Orca gives a draft in the line beside the screen, and the screen's line
+  // then reads the pointer alone (#510, #516). Where it gives none, Codex's
+  // line on the screen has to be empty.
   const emptyLine = ({ rows, draft }) => {
-    if (it.harness !== 'codex') {
-      if (draft !== undefined) throw new Error(`${it.name}: nothing was typed, because its input line holds a draft: it reads "${draft}".${shownEnd(rows)}`);
-      return;
-    }
+    if (draft !== undefined) throw new Error(`${it.name}: nothing was typed, because its input line holds a draft: it reads "${draft}".${shownEnd(rows)}`);
+    if (it.harness !== 'codex') return;
     const line = rows.findLast((row) => /^ *›/.test(row))?.trim();
     if (!CODEX_EMPTY.includes(line)) {
       throw new Error(`${it.name}: nothing was typed, because its input line is not empty: it reads "${line ?? 'nothing'}".${shownEnd(rows)}`);
@@ -415,10 +419,11 @@ function menuWrong(rows, harness, command, version, draft) {
   if (at < 0) return { why: 'its screen shows no input line' };
   // Claude Code 2.1.288 puts a non-breaking space after its pointer (live run 4).
   const line = rows[at].replaceAll('\u00a0', ' ').trim();
-  if (harness === 'codex') return codexMenuWrong(rows, at, line, command, version);
-  // Orca 1.4.223 gives the line's text as the draft, and Claude Code 2.1.296's
-  // line on the screen then reads its pointer alone (#510, probe 4).
+  // Orca 1.4.223 gives the line's text as the draft, and the line on the
+  // screen then reads the pointer alone: Claude Code 2.1.296's (#510, probe 4)
+  // and Codex 0.162.0's (#516).
   const text = draft === undefined ? line : `${POINTER[harness]} ${draft}`;
+  if (harness === 'codex') return codexMenuWrong(rows, at, text, command, version);
   if (text !== `${POINTER[harness]} ${command}`) return { why: `its input line reads "${text}"` };
   return claudeMenuWrong(rows, at, command);
 }
@@ -445,11 +450,12 @@ function claudeMenuWrong(rows, at, command) {
 
 /**
  * Codex draws its slash menu above the input line: a row per command, the
- * selected one starting with its pointer, then a blank row, then the input
- * line (its own snapshot tests, chat_composer slash_popup_*.snap,
- * rust-v0.160.0; live run 4). The menu has to hold one command row, the
- * selected one, naming the command. The input line reads the command, or, on
- * the Codex whose line Orca shows bare, its pointer alone.
+ * selected one starting with its pointer, then a blank row on 0.160.0 and none
+ * on 0.162.0, then the input line (its own snapshot tests, chat_composer
+ * slash_popup_*.snap, rust-v0.160.0; live run 4; #516's probe). The menu has
+ * to hold one command row, the selected one, naming the command. The input
+ * line, Orca's draft where it gives one, reads the command, or, with no draft
+ * on the Codex whose line Orca shows bare, its pointer alone.
  */
 function codexMenuWrong(rows, at, line, command, version) {
   const bare = line === '›' && version === CODEX_BARE_LINE;
@@ -494,7 +500,7 @@ async function answerWhereToRun(it, handle, command) {
       const pointer = rows.findLast((row) => /^ *›/.test(row));
       if (pointer === undefined || !CURRENT_CHECKOUT.test(pointer)) {
         send(handle, '\x1b');
-        throw new Error(`${it.name}: after ${command}, Codex asked "${WHERE_TO_RUN}" with its selection on "${pointer?.trim() ?? 'nothing'}" rather than "1. Current checkout", so it was backed out of with Esc and nothing else was typed. Look at its tab.`);
+        throw new Error(`${it.name}: after ${command}, Codex asked "${WHERE_TO_RUN}" with its selection on "${pointer?.trim() ?? 'nothing'}" rather than "1. Current checkout" (on Codex 0.162.0, "1. Use current Git worktree"), so it was backed out of with Esc and nothing else was typed. Look at its tab.`);
       }
       send(handle, '\r');
       return;

package/src/cli.js

@@ -31,7 +31,7 @@ import { readRoster } from './roster.js';
 import { buildAgents, buildRules, CODEX_CAP } from './rules.js';
 import { addSkill, buildSkills, linkSkills, removeSkill } from './skills.js';
 import { addSource, fetchSources } from './sources.js';
-import { answerTemp, listRoles, makeTemp, optionsLine, retireTemp, trustHooks } from './temp.js';
+import { answerSession, answerTemp, listRoles, makeTemp, optionsLine, retireTemp, trustHooks, trustSessionHooks } from './temp.js';
 import { readUsage } from './usage.js';
 import { BOT_FATHER, bringUp, ownMailbox } from './up.js';
 
@@ -139,7 +139,8 @@ Usage:
                             of a Codex temporary session it made with "Trust
                             all and continue", and check the review went. It
                             refuses anything else on that screen, and types
-                            nothing then.
+                            nothing then. It refuses, as obk session
+                            trust-hooks does, hooks that are not the kit's.
   obk temp answer --bots <path> --name <session>
                             Run in the maker's own tab: answer Claude Code's
                             "Teach auto mode" screen on a temporary session it
@@ -266,6 +267,19 @@ Usage:
                             next starts where it stopped, so no call is counted
                             twice. It counts tokens and never money: what a
                             token costs is looked up live by whoever is asking.
+  obk session trust-hooks --bots <path> --bot <bot> --session <name>
+                            Run by Bot Father or the user: answer the hooks
+                            review of a long-lived Codex session with "Trust
+                            all and continue", as obk temp trust-hooks does,
+                            and check the review went. It refuses when the
+                            bot's .codex/hooks.json holds a hook that is not
+                            the kit's, or when the review counts other hooks
+                            than the kit's own that Codex does not trust yet.
+  obk session answer --bots <path> --bot <bot> --session <name>
+                            Run by Bot Father or the user: answer Claude Code's
+                            "Teach auto mode" screen on a long-lived session
+                            with Not now, as obk temp answer does, and check
+                            the screen went.
   obk session record --bots <path> --bot <bot>
                             For the kit's own hook, not for typing: it reads
                             what the harness says about a session starting on
@@ -337,6 +351,8 @@ const COMMANDS = {
   'session mail': ['bots', 'bot'],
   'session name': ['bots', 'bot'],
   'session mailbox': ['bots', 'bot', 'session'],
+  'session trust-hooks': ['bots', 'bot', 'session'],
+  'session answer': ['bots', 'bot', 'session'],
   'temp make': ['bots', 'name'],
   'temp roles': ['bots'],
   'temp retire': ['bots', 'name'],
@@ -845,6 +861,26 @@ const commands = {
     };
   },
 
+  async 'session trust-hooks'(bots, values) {
+    const tab = callerTab(bots, true);
+    refuseWhenOrcaIsDown();
+    const trusted = await trustSessionHooks(bots, { tab, bot: values.bot, session: values.session });
+    return {
+      answer: { bots, ...trusted },
+      lines: [`trusted    ${trusted.bot} ${trusted.session}'s hooks: chose "Trust all and continue" on its hooks review, and the review has gone`],
+    };
+  },
+
+  async 'session answer'(bots, values) {
+    const tab = callerTab(bots, true);
+    refuseWhenOrcaIsDown();
+    const answered = await answerSession(bots, { tab, bot: values.bot, session: values.session });
+    return {
+      answer: { bots, ...answered },
+      lines: [`answered   ${answered.bot} ${answered.session}: sent ${answered.sent} to its "Teach auto mode about your environment?" screen, and the screen has gone`],
+    };
+  },
+
   'bot create'(bots, values) {
     const made = createBot(bots, { name: values.name, harness: values.harness, charter: values.charter });
     // The bot's AGENTS.md is the rules build's, here as everywhere else, so
@@ -1203,6 +1239,7 @@ const commands = {
     const said = {
       made: `${who} has its mailbox ${answer.mailbox}, made in this tab.`,
       bound: `${who}'s mailbox ${answer.mailbox} is bound to this tab.`,
+      replaced: `${who}'s mailbox ${answer.replaced} is not one this Orca has, as when the book was written on another machine, so it has a new one, ${answer.mailbox}, made in this tab and written into the book.`,
       none: `${who} gets no mailbox: it is a Codex session with its sandbox switch off, which could not read one.`,
     };
     return { answer, lines: [said[answer.change]] };
@@ -1261,7 +1298,12 @@ const commands = {
 function toLines(answer, bots, where) {
   if (answer.trouble !== undefined) return [`             ${answer.trouble}`];
   if (answer.transport === 'native') {
-    return [`             Write to ${answer.address} with your own harness's messaging. The kit does not carry that road.`];
+    // A refused call is not re-sent by another road (PRD 6.9), so the answer
+    // says what to do instead, before the bot needs it (#521).
+    return [
+      `             Write to ${answer.address} with your own harness's messaging. The kit does not carry that road.`,
+      "             If your harness refuses that call, do not send the message again by another road. Tell your maker or your user that it was refused, with the harness's reason. A refusal can mean a missing permission rule, which they can add through the kit after the user's yes.",
+    ];
   }
   return [
     ...(answer.unnamed === true

package/src/health.js

@@ -26,7 +26,7 @@ import { botDir, botNames, botsDir, readBot, tempRoles, unknownKeys } from './bo
 import { transcriptsIn } from './conversations.js';
 import { hookTrouble } from './hooks.js';
 import { bypassFlags, harnessOf, HARNESSES, isAddressOf, ownCli, sessionTrouble, SHELL_ENV, shellWord } from './launch.js';
-import { frontOfTab, orcaDefaultArgs, projects, tabs, wordsOfProcess } from './orca.js';
+import { frontOfTab, orcaDefaultArgs, projects, runMissing, tabs, wordsOfProcess } from './orca.js';
 import { permissionsTrouble } from './permissions.js';
 import { TAB_ENV } from './record.js';
 import { agentsTrouble, rulesStamp } from './rules.js';
@@ -387,6 +387,21 @@ function inOrca(bots, home, bot, setups, sessions) {
       found.push(finding('session', entry.tab, `${bot.name}'s session ${name} is in the book with tab ${entry.tab}, and Orca has no tab of that id: the tab was closed, or the machine was restarted. The conversation is in the book, and obk up opens a tab and brings it back.`, bot.name));
     }
 
+    // A Run Orca does not have, as when the book was written on another
+    // machine: mail sent to it is refused. The session's next start makes it
+    // a new one (#508).
+    if (typeof entry?.mailbox === 'string' && runMissing(entry.mailbox)) {
+      // The bot's unpause leaves a session paused on its own as it is, so a
+      // session under both marks needs both commands.
+      const unpause = `${shellWord(ownCli())} unpause --bots ${shellWord(bots)} --bot ${bot.name}`;
+      const steps = [
+        ...(bot.paused === true ? [unpause] : []),
+        ...(bot.sessions.some((session) => session.name === name && session.paused === true) ? [`${unpause} --session ${name}`] : []),
+      ];
+      const fix = steps.length > 0 ? steps.join(', then ') : `${shellWord(ownCli())} restart --bots ${shellWord(bots)} --bot ${bot.name} --session ${name}`;
+      found.push(finding('session', bookFile(home), `${bot.name}'s session ${name} has the mailbox ${entry.mailbox} in the book, and Orca has no Run of that id: it was made by another Orca, as on another machine, so mail sent to it is refused. The session's next start makes it a new one: ${fix}`, bot.name));
+    }
+
     const unclaimed = (Array.isArray(entry?.unclaimed) ? entry.unclaimed : []).filter((id) => !helpers.has(id));
     if (unclaimed.length > 0) {
       found.push(finding('leftover', bookFile(home), `The book notes conversations under ${bot.name}'s session ${name} that no session of this bot claims: ${unclaimed.join(', ')}. They ran in this bot's folder, and the kit will not say whose they were. To give one back, write it into ${bookFile(home)} under ${name} as  session: <id>  and run obk up again.`, bot.name));

package/src/hook-trust.js

@@ -0,0 +1,179 @@
+// Which of a Codex bot's hooks Codex does not trust yet, so that the kit
+// trusts only its own (#506).
+//
+// "Trust all and continue" on Codex's hooks review trusts every hook the
+// review counts, from every source Codex reads: the user's own files, Orca's
+// hooks among them, `-c` flags, plugins, and each `.codex/` folder from the git
+// root down (tech notes, section 3). So the kit answers a review only when the
+// bot's `.codex/hooks.json` holds the kit's hooks and nothing else, and the
+// count on the screen is the number of those that Codex does not trust yet.
+//
+// Codex keeps its trust in the user's config.toml, one table a hook, keyed by
+// the file, the event and the hook's place in it, with a hash of the hook. The
+// kit reads only those tables' headers and their `trusted_hash` lines: the
+// rest of the file can hold the user's secrets, and nothing of it is kept or
+// said. A file it cannot read that way for one of its hooks is one where it
+// cannot tell, and it refuses (the architect's ruling on #506).
+
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { hooksFileOf, readSettings, runsThisKit } from './hooks.js';
+
+/** The events whose hooks Codex hashes with no matcher, whatever the group says. */
+const NO_MATCHER = new Set(['user_prompt_submit', 'stop', 'interrupt']);
+
+/** A hook's timeout when its entry gives none, in seconds, as Codex takes it. */
+const DEFAULT_TIMEOUT = 600;
+
+/**
+ * How many of the hooks in the bot at `home`'s `.codex/hooks.json` Codex does
+ * not trust yet: `{ untrusted, file }`. It throws, with `nothing` at the end,
+ * when the file holds a hook that is not the kit's own as this kit writes it,
+ * or when the kit cannot tell whether Codex trusts one.
+ */
+export function untrustedKitHooks(home, run, nothing) {
+  const file = hooksFileOf(home, 'codex');
+  const settings = readSettings(file, "the kit's hooks");
+  const hooks = settings.hooks ?? {};
+  if (hooks === null || typeof hooks !== 'object' || Array.isArray(hooks)) {
+    throw new Error(`${run}: ${file} has a hooks entry that is not a mapping of events, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const ours = [];
+  const foreign = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) {
+      foreign.push(`${event}: ${JSON.stringify(groups)}`);
+      continue;
+    }
+    groups.forEach((group, at) => {
+      if (!Array.isArray(group?.hooks)) {
+        foreign.push(`${event}: ${JSON.stringify(group)}`);
+        return;
+      }
+      group.hooks.forEach((hook, handler) => {
+        if (runsThisKit(hook)) ours.push({ event: snake(event), at, handler, hash: hashOf(snake(event), group.matcher, hook) });
+        else foreign.push(`${event}: ${typeof hook?.command === 'string' ? hook.command : JSON.stringify(hook)}`);
+      });
+    });
+  }
+  if (foreign.length > 0) {
+    throw new Error(`${run}: ${file} holds hooks that are not the kit's own as this kit writes them, and "Trust all and continue" would let them run outside the sandbox: ${foreign.join('; ')}. ${nothing}`);
+  }
+
+  // Codex names the file by the path it found it at; the kit knows the bot
+  // home by its real path, and looks under both.
+  const files = [...new Set([file, realOr(file)])];
+  const keysOf = (hook) => files.map((one) => `${one}:${hook.event}:${hook.at}:${hook.handler}`);
+  const trusted = trustedHashes(ours.flatMap(keysOf), run, nothing);
+  const untrusted = ours.filter((hook) => !keysOf(hook).some((key) => trusted.get(key) === hook.hash)).length;
+  return { untrusted, file };
+}
+
+/** An event's name as Codex writes it in a key and a hash: `SessionStart` is `session_start`. */
+const snake = (event) => event.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+
+/**
+ * The hash Codex trusts a command hook at: SHA-256, in hex, of its event, its
+ * group's matcher and the hook as Codex reads it, as JSON with every key
+ * sorted (Codex 0.162.0, tech notes, section 3).
+ */
+function hashOf(event, matcher, hook) {
+  const handler = {
+    type: 'command',
+    command: hook.command,
+    timeout: hook.timeout ?? DEFAULT_TIMEOUT,
+    async: hook.async === true,
+    ...(hook.statusMessage === undefined ? {} : { statusMessage: hook.statusMessage }),
+  };
+  const identity = {
+    event_name: event,
+    ...(matcher === undefined || matcher === null || NO_MATCHER.has(event) ? {} : { matcher }),
+    hooks: [handler],
+  };
+  return `sha256:${createHash('sha256').update(sorted(identity)).digest('hex')}`;
+}
+
+/** A value as JSON with every object's keys sorted, and no spaces. */
+const sorted = (value) => {
+  if (Array.isArray(value)) return `[${value.map(sorted).join(',')}]`;
+  if (value !== null && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${sorted(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+};
+
+const realOr = (file) => {
+  try {
+    return realpathSync(file);
+  } catch {
+    return file;
+  }
+};
+
+const HEADER = /^\s*\[\s*hooks\.state\."((?:[^"\\]|\\.)*)"\s*\]\s*(?:#.*)?$/;
+const TRUSTED = /^\s*trusted_hash\s*=\s*"(sha256:[0-9a-f]{64})"\s*(?:#.*)?$/;
+const ANY_TABLE = /^\s*\[/;
+
+/** The short escapes of a TOML basic string. */
+const SHORT = { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', e: '\x1b', '"': '"', '\\': '\\' };
+
+/**
+ * Text with a TOML basic string's escapes decoded, as Codex reads them: a key
+ * written `\u002f` is the key with a `/` in it (the review of PR #517). An
+ * escape TOML does not have is left as it is.
+ */
+const unescaped = (text) => text.replace(/\\(?:u([0-9A-Fa-f]{4})|U([0-9A-Fa-f]{8})|x([0-9A-Fa-f]{2})|(.))/g, (all, u4, u8, x2, one) => {
+  const code = u4 ?? u8 ?? x2;
+  if (code === undefined) return SHORT[one] ?? all;
+  const point = parseInt(code, 16);
+  return point <= 0x10ffff ? String.fromCodePoint(point) : all;
+});
+
+/**
+ * The `trusted_hash` for each of `keys` that has one, by key, from the
+ * config.toml the session's Codex uses: `$CODEX_HOME`'s, or else
+ * `~/.codex`'s. No file is no trust. A key the file holds in any other form
+ * than a `[hooks.state."<key>"]` table with a `trusted_hash` line, or holds
+ * twice, is one the kit cannot tell, and it throws.
+ */
+function trustedHashes(keys, run, nothing) {
+  const file = path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'config.toml');
+  if (!existsSync(file)) return new Map();
+  const wanted = new Set(keys);
+  const text = readFileSync(file, 'utf8');
+  const cannotTell = (key, how) =>
+    new Error(`${run}: ${file} holds Codex's trust for the kit's hook ${key} ${how}, so the kit cannot tell whether Codex trusts it. ${nothing}`);
+
+  const found = new Map();
+  const headers = new Set();
+  let table;
+  for (const line of text.split(/\r?\n/)) {
+    const header = HEADER.exec(line);
+    if (header !== null) {
+      table = unescaped(header[1]);
+      if (wanted.has(table)) {
+        if (headers.has(table)) throw cannotTell(table, 'twice');
+        headers.add(table);
+      }
+      continue;
+    }
+    if (ANY_TABLE.test(line)) {
+      table = undefined;
+      continue;
+    }
+    const hash = TRUSTED.exec(line);
+    if (hash !== null && wanted.has(table)) found.set(table, hash[1]);
+  }
+  // A key in any other form is one the kit cannot read: as it stands, which
+  // a literal string keeps, backslashes and all, or with a basic string's
+  // escapes decoded (the review of PR #517).
+  const decoded = unescaped(text);
+  for (const key of wanted) {
+    if (headers.has(key) && !found.has(key)) throw cannotTell(key, 'in a table with no trusted_hash line the kit reads');
+    if (!headers.has(key) && (text.includes(key) || decoded.includes(key))) throw cannotTell(key, 'in a form the kit does not read');
+  }
+  return found;
+}

package/src/hooks.js

@@ -20,6 +20,9 @@ import { ownCli, shellWord } from './launch.js';
 /** Where each harness reads a project's hooks, inside the bot home. */
 const HOOK_FILE = { claude: '.claude/settings.json', codex: '.codex/hooks.json' };
 
+/** The hooks file `harness` reads in the bot at `home`. */
+export const hooksFileOf = (home, harness) => path.join(home, HOOK_FILE[harness]);
+
 /**
  * The one thing the kit asks to be told: a session beginning. Both harnesses
  * report it whenever a session starts, resumes or is begun again by the user —
@@ -381,6 +384,14 @@ const KIT_NUDGE = new RegExp(String.raw`^(${WORD}) session nudge --bots ${WORD}
 const KIT_MAIL = new RegExp(String.raw`^(${WORD}) session mail --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
 const KIT_NAME = new RegExp(String.raw`^(${WORD}) session name --bots ${WORD} --bot ${WORD} 2>/dev/null \|\| true$`);
 
+/**
+ * Whether a hook entry is one of the kit's own as this kit writes it: a
+ * command of exactly a shape the kit writes, run by `cli`, the kit running now
+ * (#506). One that runs some other program, even another `obk`, is not.
+ */
+export const runsThisKit = (hook, cli = ownCli()) =>
+  hook?.type === 'command' && [KIT_HOOK, KIT_SENT, KIT_NUDGE, KIT_NAME].some((pattern) => programOf(hook.command, pattern) === cli);
+
 /** The program a bot made before the kit named itself by path runs. */
 const BARE = 'obk';
 

package/src/name.js

@@ -125,12 +125,13 @@ function nameOf(thread) {
  * pointer and the command exactly, and no row of its slash menu stands above
  * it. With words after the command Codex has closed its menu (chat_composer.rs
  * `sync_command_popup`, rust-v0.160.0), so a menu still open means the line is
- * not what it seems.
+ * not what it seems. Where Orca gives a draft, the draft is the line's text:
+ * Codex 0.162.0's line on the screen then reads its pointer alone (#516).
  */
-function renameWrong(rows, _harness, command) {
+function renameWrong(rows, _harness, command, _version, draft) {
   const at = rows.findLastIndex((row) => /^ *›/.test(row));
   if (at < 0) return { why: 'its screen shows no input line' };
-  const line = rows[at].replaceAll(' ', ' ').trim();
+  const line = draft === undefined ? rows[at].replaceAll(' ', ' ').trim() : `› ${draft}`;
   if (line !== `› ${command}`) return { why: `its input line reads "${line}"` };
   const above = rows.slice(0, at).findLast((row) => row.trim() !== '');
   if (above !== undefined && /^ *(?:› +)?\/\S/.test(above)) return { why: `a menu of commands stands above its input line: "${above.trim()}"` };

package/src/orca.js

@@ -284,8 +284,22 @@ export function asFolderProject(setupId, title) {
  * Take a bot's Orca project away: the setup, the project and the repo record,
  * in one call (tech notes, section 1). Only after its tabs are closed: a
  * project taken away first leaves tabs no command line can reach.
+ *
+ * With `--force`, because the caller has made those checks itself: Orca's next
+ * release refuses a plain delete of a project with saved workspace details,
+ * which a bot's project keeps after its tabs close (#528). Orca 1.4.223 does
+ * not know the flag and refuses it before it changes anything, so then the
+ * plain delete is sent, which it takes with no such guard.
  */
-export const deleteProject = (setupId) => orca(['project', 'setup-delete', '--setup', setupId]);
+export function deleteProject(setupId) {
+  const plain = ['project', 'setup-delete', '--setup', setupId];
+  try {
+    return orca([...plain, '--force']);
+  } catch (error) {
+    if (error.code !== 'invalid_argument' || !error.reason?.includes('Unknown flag --force')) throw error;
+    return orca(plain);
+  }
+}
 
 /** Said after a run that made or renamed a project, whatever `tellWindow` answered, and after a removal `reloadWindow` could not follow. */
 export const RELOAD_LINE = "If Orca's sidebar does not show it, reload the window with Cmd+Shift+R.";
@@ -1017,6 +1031,22 @@ export const useMailbox = (id, handle, options) =>
 export const coordinatorOf = (id, options) =>
   orca(['orchestration', 'run-show', '--id', id], options).run.coordinator_handle ?? undefined;
 
+/**
+ * Whether this Orca has no Run of that id at all, as when the book was written
+ * on another machine (#508). Only `run-show` refused `run_not_found` says so:
+ * `run-use` gives a legacy Run the same code and words, and a Run shown, a
+ * time-out or any other refusal is not a Run known to be missing (tech notes,
+ * section 1).
+ */
+export function runMissing(id, options) {
+  try {
+    orca(['orchestration', 'run-show', '--id', id], options);
+    return false;
+  } catch (error) {
+    return error.code === 'run_not_found';
+  }
+}
+
 /** Queue one message. `to` and `from` are mailboxes, written `run:<id>`. */
 export function postMessage({ to, from, subject, body, type = 'status', thread }) {
   const args = ['orchestration', 'send', '--to', to, '--subject', subject, '--body', body, '--type', type];

package/src/temp.js

@@ -1,7 +1,9 @@
 // `obk temp make` and `obk temp retire`: a session's own temporary sessions
 // (PRD 6.4, #227). And `obk temp trust-hooks` and `obk temp answer`, the
 // answers a maker gives its Codex run's hooks review (#238) and its Claude
-// session's Teach auto mode form (#489).
+// session's Teach auto mode form (#489). And `obk session trust-hooks` and
+// `obk session answer`, the same answers to a long-lived session's screens,
+// given by Bot Father or the user (#506), on the same code.
 //
 // Any long-lived session can make a temporary session of its own bot for a
 // piece of work, and retire it when the work is done, without Bot Father, who
@@ -31,11 +33,12 @@ import { setTimeout as pause } from 'node:timers/promises';
 
 import { readBook, takeLineTurn, TYPING_HELD, TYPING_WAIT_MS, updateBook } from './book.js';
 import { addSession, dropSession, NAME, readBot, tempRoles } from './bot.js';
+import { untrustedKitHooks } from './hook-trust.js';
 import { DEFAULT_APPROVAL, harnessOf, isShortPrompt, ownCli, shellWord, startPrompt, workDirOf } from './launch.js';
-import { sessionInTab } from './message.js';
+import { findSession, sessionInTab } from './message.js';
 import { orca, screenRows, tabs } from './orca.js';
 import { retireSession } from './retire.js';
-import { bringUp, promptPath } from './up.js';
+import { BOT_FATHER, bringUp, promptPath } from './up.js';
 
 /** The settings a temporary session takes from its maker unless told otherwise. */
 const INHERITED = ['model', 'effort', 'context', 'approval'];
@@ -342,26 +345,72 @@ const REVIEW_GONE_MS = 5000;
  */
 export async function trustHooks(bots, { tab, name }) {
   const caller = callerIn(bots, tab, 'trust-hooks', "answer a run's hooks review");
+  const { bot, session } = ownTemp(caller, name, 'answer for', 'Nothing was typed.');
+  await trustAll({ bots, run: `${caller.bot}/${name}`, bot: caller.bot, home: caller.home, session: name, harness: harnessOf(session, bot.harness) }, 'temp');
+  return { bot: caller.bot, session: name, maker: caller.session };
+}
+
+/** Shell text the shell passes on as it is, split at its spaces: what the kit's own launch line leaves unquoted, and spaces. */
+const SHELL_PLAIN = /^[A-Za-z0-9,._+:@%/= -]*$/;
+
+/** A count row of Codex's hooks review: `1 hook is new or changed.`, `3 hooks are new or changed.` */
+const HOOKS_COUNT = /^ *(\d+) hooks? (?:is|are) new or changed\. *$/;
+
+/**
+ * Answer `target`'s hooks review with "Trust all and continue", for `temp
+ * trust-hooks` or `session trust-hooks` (`kind`). "Trust all" lets every hook
+ * the review counts run outside the sandbox, so first the bot's
+ * `.codex/hooks.json` must hold the kit's own hooks alone, and the review's
+ * count row must be the number of them Codex does not trust yet (#506, R4).
+ * Codex also takes hook trust, and hooks, from the session's own `-c` flags,
+ * which its extra_args can carry. What it was started with is the book's
+ * `launched_with`, which the kit writes at each launch: when that names hooks
+ * at all, or there is none, the kit cannot tell the count, and refuses (the
+ * review of PR #517). The arguments are not quoted: they can hold a secret.
+ */
+async function trustAll(target, kind) {
   const nothing = 'Nothing was typed.';
-  const { bot, session } = ownTemp(caller, name, 'answer for', nothing);
-  const run = `${caller.bot}/${name}`;
-  const harness = harnessOf(session, bot.harness);
-  if (harness !== 'codex') {
-    throw new Error(`${run} runs on ${harness}, and temp trust-hooks answers a Codex run's "${HOOKS_REVIEW}" alone. ${nothing}`);
+  if (target.harness !== 'codex') {
+    throw new Error(`${target.run} runs on ${target.harness}, and ${kind} trust-hooks answers a Codex session's "${HOOKS_REVIEW}" alone. ${nothing}`);
+  }
+  const launchedWith = readBook(target.home).sessions[target.session]?.launched_with;
+  if (launchedWith === undefined) {
+    throw new Error(`${target.run}'s book entry does not say what extra arguments it was launched with: it was started before the kit kept that record, or not by the kit. Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. Start it again with the kit, then run this again: ${shellWord(ownCli())} restart --bots ${shellWord(target.bots)} --bot ${target.bot} --session ${target.session}. ${nothing}`);
+  }
+  // A list is the arguments themselves. A string is shell text, which the
+  // shell reads before Codex does (`'h''ooks'` is `hooks`), so it is read only
+  // when it holds nothing the shell would change (the review of PR #517).
+  if (typeof launchedWith === 'string' && !SHELL_PLAIN.test(launchedWith)) {
+    throw new Error(`${target.run} was launched with extra arguments written as shell text the kit does not read, and Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const words = typeof launchedWith === 'string' ? launchedWith.split(' ') : [launchedWith].flat().map(String);
+  if (words.some((word) => /hooks/i.test(word))) {
+    throw new Error(`${target.run} was launched with extra arguments that mention hooks, and Codex takes hooks and their trust from a session's own -c flags as well, so the kit cannot tell which hooks its review covers. ${nothing}`);
   }
-  await answerScreen(caller, name, {
+  // `--profile <name>` (`-p`) adds `<name>.config.toml` from Codex's home as a
+  // second user layer, and Codex reads hook trust from it too (codex-rs
+  // 0.162.0, cli/src/main.rs:1954-1962, config/src/loader/mod.rs:290-332).
+  if (words.some((word) => /profile/i.test(word) || /^-[^-]*p/.test(word))) {
+    throw new Error(`${target.run} was launched with a Codex profile, whose own config file can hold hook trust the kit does not read, so the kit cannot tell which hooks its review covers. ${nothing}`);
+  }
+  const { untrusted, file } = untrustedKitHooks(target.home, target.run, nothing);
+  await answerScreen(target, {
     what: 'hooks review',
     mark: HOOKS_REVIEW,
     done: `"${TRUST_ALL}" was chosen on its hooks review`,
     answer(rows, { send }) {
       const keys = keysToTrustAll(rows);
       if (keys === undefined) {
-        throw new Error(`${run}'s screen shows no "${HOOKS_REVIEW}" with its choices, so there is nothing for this to answer. It shows: ${shown(rows)}. ${nothing}`);
+        throw new Error(`${target.run}'s screen shows no "${HOOKS_REVIEW}" with its choices, so there is nothing for this to answer. It shows: ${shown(rows)}. ${nothing}`);
+      }
+      const counts = rows.filter((row) => HOOKS_COUNT.test(row));
+      if (counts.length !== 1 || Number(HOOKS_COUNT.exec(counts[0])[1]) !== untrusted) {
+        const saw = counts.length === 0 ? 'shows no row that says how many hooks it covers' : `says "${counts.map((row) => row.trim()).join('" and "')}"`;
+        throw new Error(`${target.run}'s hooks review ${saw}, but ${untrusted} of the kit's own hooks in ${file} are not trusted by Codex yet, so the review may cover hooks that are not the kit's, and "${TRUST_ALL}" would let them run outside the sandbox. ${nothing}`);
       }
       send(keys);
     },
   });
-  return { bot: caller.bot, session: name, maker: caller.session };
 }
 
 /**
@@ -386,23 +435,22 @@ function shown(rows) {
 }
 
 /**
- * Answer a screen of `name`, a temporary session the caller made: under the
- * session's turn for a line (#482), read its screen and hand it to
- * `answer(rows, { send, look })`, which sends keys with `send`, may read the
- * screen again with `look`, and throws when the screen is not its to answer.
- * Then wait for `mark` to leave the screen. `what` names the screen and `done`
- * says what was sent, for the sentences that refuse or fail; `done` may be a
- * function of what `answer` returned.
+ * Answer a screen of the session `target`, `{ run, home, session }`, `run`
+ * being its `<bot>/<session>`: under the session's turn for a line (#482),
+ * read its screen and hand it to `answer(rows, { send, look })`, which sends
+ * keys with `send`, may read the screen again with `look`, and throws when the
+ * screen is not its to answer. Then wait for `mark` to leave the screen.
+ * `what` names the screen and `done` says what was sent, for the sentences
+ * that refuse or fail; `done` may be a function of what `answer` returned.
  */
-async function answerScreen(caller, name, { what, mark, done, answer }) {
-  const run = `${caller.bot}/${name}`;
+async function answerScreen({ run, home, session }, { what, mark, done, answer }) {
   const nothing = 'Nothing was typed.';
-  const tabId = readBook(caller.home).sessions[name]?.tab;
-  const handle = tabId === undefined ? undefined : tabs(caller.home).find((one) => one.tabId === tabId)?.handle;
+  const tabId = readBook(home).sessions[session]?.tab;
+  const handle = tabId === undefined ? undefined : tabs(home).find((one) => one.tabId === tabId)?.handle;
   if (handle === undefined) {
     throw new Error(`${run} has no tab open in Orca, so there is no ${what} of its to answer. ${nothing}`);
   }
-  const turn = takeLineTurn(caller.home, name, TYPING_WAIT_MS);
+  const turn = takeLineTurn(home, session, TYPING_WAIT_MS);
   if (turn === undefined) throw new Error(`${run}: ${TYPING_HELD}.`);
   let answered;
   try {
@@ -540,18 +588,27 @@ const wholeScreen = (rows) => rows.filter((row) => row.trim() !== '').map((row)
  */
 export async function answerTemp(bots, { tab, name }) {
   const caller = callerIn(bots, tab, 'answer', "answer a session's first-run screen");
+  ownTemp(caller, name, 'answer for', 'Nothing was typed.');
+  const sent = await answerTeach({ run: `${caller.bot}/${name}`, home: caller.home, session: name }, 'temp');
+  return { bot: caller.bot, session: name, maker: caller.session, sent };
+}
+
+/**
+ * Answer `target`'s Teach auto mode screen with Not now, for `temp answer` or
+ * `session answer` (`kind`). Returns what answered it.
+ */
+function answerTeach(target, kind) {
+  const { run } = target;
   const nothing = 'Nothing was typed.';
-  ownTemp(caller, name, 'answer for', nothing);
-  const run = `${caller.bot}/${name}`;
-  const sent = await answerScreen(caller, name, {
+  return answerScreen(target, {
     what: `"${TEACH_TITLE}"`,
     mark: TEACH_TITLE,
     done: (said) => `${said} was sent to its Teach auto mode screen`,
     answer(rows, { send, look }) {
       const seen = teachScreen(rows);
       if (seen.misfit !== undefined) {
-        const hooks = rows.some((row) => row.includes(HOOKS_REVIEW)) ? ` A Codex run's "${HOOKS_REVIEW}" is answered with temp trust-hooks.` : '';
-        throw new Error(`${run}'s screen is not one temp answer answers: ${seen.misfit}.${hooks} ${nothing} It shows:\n${wholeScreen(rows)}`);
+        const hooks = rows.some((row) => row.includes(HOOKS_REVIEW)) ? ` A Codex session's "${HOOKS_REVIEW}" is answered with ${kind} trust-hooks.` : '';
+        throw new Error(`${run}'s screen is not one ${kind} answer answers: ${seen.misfit}.${hooks} ${nothing} It shows:\n${wholeScreen(rows)}`);
       }
       if (seen.shape === TEACH_SHAPES[0]) {
         send('\x1b');
@@ -574,7 +631,55 @@ export async function answerTemp(bots, { tab, name }) {
       return `"${NOT_NOW_CHOICE}"`;
     },
   });
-  return { bot: caller.bot, session: name, maker: caller.session, sent };
+}
+
+/**
+ * `obk session trust-hooks`: answer the hooks review of `bot`/`session`, a
+ * long-lived Codex session, as `temp trust-hooks` answers a temporary one's
+ * (#506). Returns `{ bot, session }`.
+ */
+export async function trustSessionHooks(bots, { tab, bot, session }) {
+  const target = longLivedTarget(bots, { tab, bot, session }, 'trust-hooks');
+  await trustAll(target, 'session');
+  return { bot: target.bot, session: target.session };
+}
+
+/**
+ * `obk session answer`: answer the Teach auto mode screen of `bot`/`session`,
+ * a long-lived Claude Code session, as `temp answer` answers a temporary
+ * one's (#506). Returns `{ bot, session, sent }`.
+ */
+export async function answerSession(bots, { tab, bot, session }) {
+  const target = longLivedTarget(bots, { tab, bot, session }, 'answer');
+  const sent = await answerTeach(target, 'session');
+  return { bot: target.bot, session: target.session, sent };
+}
+
+/**
+ * The long-lived session `bot`/`session`, whose first-run screen `session
+ * <verb>` answers, or a refusal. A long-lived session is Bot Father's, so the
+ * caller is a session of Bot Father's, or no session of this fleet: the user,
+ * or an assistant of theirs (#506, R2). A temporary session's screen is its
+ * maker's to answer, with the temp command.
+ */
+function longLivedTarget(bots, { tab, bot, session }, verb) {
+  const nothing = 'Nothing was typed.';
+  const caller = tab === undefined ? undefined : sessionInTab(bots, tab);
+  if (caller !== undefined && caller.bot !== BOT_FATHER) {
+    throw new Error(`session ${verb} runs in ${caller.bot}/${caller.session}'s tab, but a long-lived session is Bot Father's: Bot Father (${BOT_FATHER}) or the user answers its first-run screen. ${nothing}`);
+  }
+  let found;
+  try {
+    found = findSession(bots, `${bot}/${session}`);
+  } catch (error) {
+    throw new Error(`${error.message} ${nothing}`);
+  }
+  const run = `${found.bot}/${found.session}`;
+  const temporary = readBook(found.home).sessions[found.session]?.temporary;
+  if (temporary !== undefined) {
+    throw new Error(`${run} is a temporary session ${temporary.maker} made, so its first-run screen is ${temporary.maker}'s to answer, with temp ${verb} run in ${temporary.maker}'s tab. ${nothing}`);
+  }
+  return { bots, run, bot: found.bot, session: found.session, home: found.home, harness: found.harness };
 }
 
 /**

package/src/up.js

@@ -14,7 +14,7 @@ import { conversationsIn, hasConversation, heldAsUserTurn, transcriptsIn } from
 import { installHook } from './hooks.js';
 import { writePermissions } from './permissions.js';
 import { addressOf, harnessOf, isAddressOf, isShortPrompt, launchCommand, mailboxStep, reachesMail, sessionTrouble, startPrompt, workDirOf } from './launch.js';
-import { asFolderProject, coordinatorOf, findProject, harnessInTab, makeMailbox, makeProject, openTab, QUESTION_ON_SCREEN, retitleTab, screenRows, shellInTab, tabs, tabToTypeInto, TERMINAL_ENV, TIMED_OUT, tellWindow, typeIntoTab, useMailbox } from './orca.js';
+import { asFolderProject, coordinatorOf, findProject, harnessInTab, makeMailbox, makeProject, openTab, QUESTION_ON_SCREEN, retitleTab, runMissing, screenRows, shellInTab, tabs, tabToTypeInto, TERMINAL_ENV, TIMED_OUT, tellWindow, typeIntoTab, useMailbox } from './orca.js';
 import { TAB_ENV } from './record.js';
 import { buildAgents, rulesStamp } from './rules.js';
 import { linkSkills } from './skills.js';
@@ -309,7 +309,10 @@ async function bringUpSession(bots, home, live, session, bot, title) {
       // for a person or Bot Father to settle — added to whatever was already noted,
       // because this run's scan cannot see what an earlier one found. The kit never
       // settles it itself.
-      let entry = { ...current.sessions[session.name], tab: made.tabId, launched, rules };
+      // The extra arguments typed on this line, as the kit's own record of what
+      // this harness was started with: bot.yaml says only what the next launch
+      // gets, and trust-hooks asks what this one got (#506).
+      let entry = { ...current.sessions[session.name], tab: made.tabId, launched, launched_with: session.extra_args ?? [], rules };
       if (rules === undefined) delete entry.rules;
       held = entry.session;
       // Before the line is typed, so the hook finds no id here and takes the one
@@ -648,7 +651,8 @@ async function writeAddress(home, session, address) {
  * a restart (tech notes, section 1). Orca offers no way to delete one, so this
  * makes one for a session whose book names none, and otherwise binds the one
  * the book names to this tab: after a restart, or a closed tab brought back,
- * it would stay with the tab that is gone (review of PR #248, finding 1).
+ * it would stay with the tab that is gone (review of PR #248, finding 1). A
+ * Run the book names and this Orca does not have at all is replaced (#508).
  *
  * Only inside an Orca tab. Asked from anywhere else, Orca picks a terminal
  * itself, and seen live that was not the asker's (tech notes, section 1), so
@@ -705,20 +709,34 @@ async function mailboxInTurn(home, botName, sessionName, who) {
       if (error.code === TIMED_OUT) {
         throw new Error(`${error.message}\n${who}'s mailbox ${held} may now be bound to this tab, or may still be bound where it was: Orca did not say which.`);
       }
-      throw new Error(`${error.message}\n${who}'s mailbox ${held} is unchanged: it is still bound to ${boundTo(held)}.`);
+      // A Run this Orca has never had, as when the book was written on another
+      // machine, can never be bound, so every start would fail the same way.
+      // It is replaced as a session with none would be given one (#508).
+      if (!runMissing(held, STEP_WAIT)) {
+        throw new Error(`${error.message}\n${who}'s mailbox ${held} is unchanged: it is still bound to ${boundTo(held)}.`);
+      }
+      return newMailbox(home, botName, sessionName, who, here, held);
     }
     return { bot: botName, session: sessionName, mailbox: held, change: 'bound' };
   }
+  return newMailbox(home, botName, sessionName, who, here);
+}
 
+/**
+ * Make a mailbox in this tab and write it into the book, for a session whose
+ * book names none, or names `stale`, a Run this Orca does not have.
+ */
+async function newMailbox(home, botName, sessionName, who, here, stale) {
   // Made outside the book's lock, which is held for one read and one write
   // (book.js).
   let made;
   try {
     made = makeMailbox(who, STEP_WAIT);
   } catch (error) {
+    const written = stale === undefined ? 'none is written down' : `the book still names ${stale}, which this Orca does not have`;
     const left = error.code === TIMED_OUT
-      ? `None is written down for ${who}; a Run Orca made after the kit stopped waiting is left unused.`
-      : `No mailbox was made for ${who}, and none is written down.`;
+      ? `For ${who}, ${written}; a Run Orca made after the kit stopped waiting is left unused.`
+      : `No mailbox was made for ${who}, and ${written}.`;
     throw new Error(`${error.message}\n${left} It gets one the next time the kit starts it.`);
   }
 
@@ -734,10 +752,11 @@ async function mailboxInTurn(home, botName, sessionName, who) {
         movedTo = now.tab ?? 'none';
         return undefined;
       }
-      // Under the lock, and only if the book still has none: two runs at once
-      // would each have made one, and a session with two mailboxes is a session
-      // half its mail never reaches. The loser's Run is left unused.
-      if (typeof now.mailbox !== 'string') now.mailbox = made;
+      // Under the lock, and only if the book still has none, or still the
+      // stale one: two runs at once would each have made one, and a session
+      // with two mailboxes is a session half its mail never reaches. The
+      // loser's Run is left unused.
+      if (typeof now.mailbox !== 'string' || now.mailbox === stale) now.mailbox = made;
       kept = now.mailbox;
       current.sessions[sessionName] = now;
       return undefined;
@@ -750,8 +769,13 @@ async function mailboxInTurn(home, botName, sessionName, who) {
   }
   // One terminal holds one Run, so making the loser took this tab off the one
   // the book kept. It goes back.
-  if (kept !== made) useMailbox(kept, undefined, STEP_WAIT);
-  return { bot: botName, session: sessionName, mailbox: kept, change: kept === made ? 'made' : 'bound' };
+  if (kept !== made) {
+    useMailbox(kept, undefined, STEP_WAIT);
+    return { bot: botName, session: sessionName, mailbox: kept, change: 'bound' };
+  }
+  return stale === undefined
+    ? { bot: botName, session: sessionName, mailbox: made, change: 'made' }
+    : { bot: botName, session: sessionName, mailbox: made, change: 'replaced', replaced: stale };
 }
 
 /**