@manyoars/oars 0.5.3 → 0.5.4

package/README.md

@@ -207,8 +207,9 @@ Replay is local and read-only on your transcripts; it writes `crossings.jsonl` a
 
 ### pool
 
-`oars pool` uses the Many Oars pool, `https://pool.manyoars.com`, which is live (deposits there are closed until its covenant is published), or a pool server you name with `--server <url>` or `OARS_POOL_URL`. Every other command works without it.
+`oars pool` uses the Many Oars pool, `https://pool.manyoars.com`, which is live and open for deposits, or a pool server you name with `--server <url>` or `OARS_POOL_URL`. Every other command works without it.
 
+- `oars pool join --provider github|google --harness-version <version> [--harness <name>]` is the first way in: it signs you in, prepares your deposit, prints what would be sent with each field's rule, sends it, and fetches your first bundle, in one run. It is the five commands below in order, with the same prompts and the same checks, and one plain line says what each step is doing. If a step stops, it prints that step's own error and names the command to run again; running `oars pool join` again skips what already stands (a held sign-in, a prepared batch, a batch already sent). The commands below do the same step by step.
 - `oars pool login --provider github|google` asks the pool to start the provider's device flow, prints the user code and link, and polls the pool until you approve (a failed poll is retried with a longer wait until the code expires; the output names the exclusion-terms file when there is none, and the first `pool deposit` needs it); with `--verbose`, every request prints before it is sent. The pool holds the OAuth client and its secret, so the CLI needs no client ID or secret, and the provider's tokens never reach this machine.
 - `oars pool logout` revokes this machine's credential at the pool, then removes the local sign-in. If the pool cannot be reached it still removes the local sign-in and says the credential was not revoked there.
 - `oars pool deposit` writes a batch of session skeletons (a closed list of fields, each value redacted first; a host is hashed by the pool on arrival) to an outbox for each session that passes your folder allowlist and the exclusion check and whose last line is over 6 hours old, and stops: no session data is sent. `--send <hash>` sends one batch that `outbox` printed and that is unchanged on disk, once this account has accepted the pool covenant (a person types the phrase the covenant screen states, at a terminal; `--accept-covenant <version>` only names the version expected and accepts nothing; the screen then asks "Are you in the EU, the EEA, or the UK? (yes/no)" and sends the answer, and `--in-eu-eea-uk <yes|no>` answers it without asking; while the pool is closed to those regions a yes, or a request from them, is refused with `region_closed` and nothing is accepted); before that it reads the covenant, sends no batch, and exits 3 with `covenant_not_accepted`. A hash that was never shown, or a batch that changed, is refused before any request. The detached sender is the other sender: after the pool says your account accepted its covenant, it sends new batches, and raw copies only if you said yes to the raw prompt (`oars pool raw --consent yes`, answered by typing the phrase `I consent to sending raw copies` at a terminal; a yes also tells the pool, and `--consent no` tells it to stop accepting raw copies, whatever a later request states (a machine that held a yes and is signed out exits nonzero: the pool was not told), and the pool's nightly job then erases the raw copies it already holds, starting that night; a large account can take more than one night). With no sign-in, no acceptance, or an unreachable server it sends nothing.
@@ -217,6 +218,7 @@ Replay is local and read-only on your transcripts; it writes `crossings.jsonl` a
 - `oars pool export --out <folder> [--raw]` saves a copy of what the pool holds about your account (GDPR Articles 15(3) and 20), as JSON, one file a page, readable by you only. It covers your account row (with your raw consent record), when your sign-ins end (never the credential), your covenant acceptances, your machines (without their keys, with the day of each one's last deposit and its key days), your repository keys, your deposit hours, your deposits as they now read (with the machine, host class, and launcher each came from, and the host class and launcher the batch claimed), your raw ledger, your staged deposit parts, your erasure audit rows, and your telemetry days. `--raw` also saves each raw transcript you deposited that has not been erased, checked against its hash. It needs `oars pool login`, writes nothing to the pool, prints what it saved, and exits nonzero naming any page or object that failed; a rerun overwrites the same files. Totals the pool derives from many accounts are not yours to export and are not in it.
 - On an enrolled machine the hook child activates its key before its first deposit, rotates it where the disk is durable (`vps`, `ci`; the key lives in `<store>/machine-key`, owner-only), deposits under it, sends the batches its outbox held once the covenant is accepted, and tells you at the next Stop when the key expires within 14 days, has expired, or was revoked (`oars pool machines` lists it). A `cloud` machine's key is held by the network proxy and the child sends no credential of its own. Details: `docs/pool.md`, "Machine keys".
 - `oars pool outbox` prints each batch exactly as it would be sent, with its SHA-256, and `--explain` adds each field's rule.
+- `oars pool remove <hash>` removes one batch from the outbox on this machine, with the queued raw copies of the same session, and says what it removed; nothing is sent and nothing at the pool changes. The session stays out of every later deposit, the background sender's included, until `oars pool remove <hash> --restore`, whichever account you sign in with. It refuses while a send holds the lock.
 - `oars pool fetch --harness-version <version>` fetches that version's signed bundle, verifies it against the key pinned at login, and keeps it locally. It prints the public and disclosure floors the bundle states (and any read family on a floor of its own) and holds no floor of its own: the pool sets them, so a change is a deploy and never a new release of oars.
 
 ### club
@@ -258,6 +260,7 @@ Exit codes:
 | 7 | rate limited |
 | 8 | the server could not be reached (the platform, the issuer, or a pool server) |
 | 10 | `pool fetch` hit the pool's weekly fetch cap; the bundle on disk is untouched, and the message says when to try again |
+| 130 | `pool deposit --send` was ended with Ctrl-C (SIGINT); the batch stays queued |
 
 ## Source
 

package/dist/cli.d.ts

@@ -32,6 +32,8 @@ export interface RunDeps {
 export interface Outcome {
     document: object;
     text: string;
+    /** `streamed`: the handler already wrote `text` as it went, so nothing is printed from it. `chunked`: `--json` falls back to writing the document one array element at a time when it is past V8's string length. */
+    output?: 'streamed' | 'chunked';
 }
 /** Runs one invocation (`argv` without the node and script entries) and returns the exit code. Telemetry records it afterward and cannot change it. */
 export declare const run: (argv: string[], deps: RunDeps) => Promise<ExitCode>;

package/dist/cli.js

@@ -19,7 +19,7 @@ import { githubVisibility, poolEnroll, poolMachineRevoke, poolMachines } from '.
 import { runNetGit } from './sessions/machine-hold.js';
 import { holdPull } from './sessions/machine-pull.js';
 import { runGit } from './sessions/survival.js';
-import { poolCoverage, poolDeposit, poolExport, poolFetch, poolLogin, poolLogout, poolOutbox, poolProve, poolRaw } from './sessions/pool-command.js';
+import { poolCoverage, poolDeposit, poolExport, poolFetch, poolJoin, poolLogin, poolLogout, poolOutbox, poolProve, poolRaw, poolRemove } from './sessions/pool-command.js';
 import { telemetryOff, telemetryOn, telemetryReport, telemetryShow, telemetryStatus } from './telemetry/command.js';
 import { cardLine } from './sessions/card-line.js';
 import { recordCrash } from './telemetry/crash.js';
@@ -52,7 +52,44 @@ const isoTime = (value) => {
         throw new InvalidArgumentError('it must be an ISO time such as 2026-11-01T16:00:00Z.');
     return new Date(parsed).toISOString();
 };
+/** The document as one string, or `undefined` when it is past V8's string length (`RangeError: Invalid string length`). */
+const stringified = (document) => {
+    try {
+        return JSON.stringify(document);
+    }
+    catch (error) {
+        if (error instanceof RangeError)
+            return undefined;
+        throw error;
+    }
+};
+/** `JSON.stringify(document)` plus a newline, in pieces: each top-level array goes out one element at a time, so no piece is longer than its largest element. */
+const jsonPieces = function* (document) {
+    yield '{';
+    for (const [at, [key, value]] of Object.entries(document).entries()) {
+        const head = `${at === 0 ? '' : ','}${JSON.stringify(key)}:`;
+        if (!Array.isArray(value)) {
+            yield `${head}${JSON.stringify(value)}`;
+            continue;
+        }
+        yield `${head}[`;
+        for (const [index, item] of value.entries())
+            yield `${index === 0 ? '' : ','}${JSON.stringify(item)}`;
+        yield ']';
+    }
+    yield '}\n';
+};
 const emit = (deps, json, outcome) => {
+    if (json && outcome.output === 'chunked') {
+        // One write when the document fits in a string, as every other command; past V8's string length, the pieces.
+        const whole = stringified(outcome.document);
+        for (const piece of whole === undefined ? jsonPieces(outcome.document) : [`${whole}
+`])
+            deps.io.stdout(piece);
+        return;
+    }
+    if (!json && outcome.output === 'streamed')
+        return;
     deps.io.stdout(`${json ? JSON.stringify(outcome.document) : outcome.text}\n`);
 };
 /**
@@ -462,9 +499,24 @@ const buildProgram = (deps, observed) => {
         .action(async (_options, command) => {
         emit(deps, flag(command.optsWithGlobals(), 'json'), await gateReport(sessionDeps(deps)));
     });
-    const pool = program.command('pool').description('sign in to a pool server, deposit session skeletons (a closed list of fields, each value redacted first) and, after a yes to the raw prompt, redacted raw copies, and fetch signed reads; local capture, recall, and reads need none of it. The covenant screen, where you type its phrase to accept, appears when you send a batch with oars pool deposit --send <hash> and have not accepted the covenant in force, not at sign-in');
+    const pool = program.command('pool').description('sign in to a pool server, deposit session skeletons (a closed list of fields, each value redacted first) and, after a yes to the raw prompt, redacted raw copies, and fetch signed reads; local capture, recall, and reads need none of it. The covenant screen, where you type its phrase to accept, appears when you send a batch with oars pool deposit --send <hash> or oars pool join and have not accepted the covenant in force, not at sign-in');
     const serverOption = '--server <url>';
     const serverHelp = 'the pool server, https or plain http to localhost (default: OARS_POOL_URL, else https://pool.manyoars.com)';
+    pool
+        .command('join')
+        .description('run login, deposit, outbox --explain, deposit --send, and fetch in one command. Run it again after a stop to continue from there')
+        .option('--provider <name>', 'github or google, for the sign-in step (not needed once signed in)')
+        .option('--verbose', 'print each sign-in request, headers and body, to stderr before it is sent (a credential shows as its size)')
+        .option('--accept-covenant <version>', 'name the covenant version you expect, as deposit --send takes it: on a terminal the screen is shown and you type its phrase yourself, and off a terminal this is refused')
+        .option('--in-eu-eea-uk <yes|no>', 'answer "Are you in the EU, the EEA, or the UK?" when you accept, as deposit --send takes it')
+        .option('--harness <name>', 'the harness whose bundle to fetch (default: the one your local store holds the most sessions of, claude-code when none leads)')
+        .requiredOption('--harness-version <version>', 'the public harness version whose bundle to fetch, as fetch takes it')
+        .option(serverOption, serverHelp)
+        .action(async (_options, command) => {
+        const options = command.optsWithGlobals();
+        const json = flag(options, 'json');
+        emit(deps, json, await poolJoin(deps, { server: text(options, 'server'), provider: text(options, 'provider'), verbose: flag(options, 'verbose'), acceptCovenant: text(options, 'acceptCovenant'), inEuEeaUk: text(options, 'inEuEeaUk'), harness: text(options, 'harness'), harnessVersion: text(options, 'harnessVersion') ?? '', json }));
+    });
     pool
         .command('logout')
         .description('revoke the credential held for this pool and remove it here; if the pool cannot be reached the local entry is still removed')
@@ -564,7 +616,17 @@ const buildProgram = (deps, observed) => {
         .option(serverOption, serverHelp)
         .action(async (_options, command) => {
         const options = command.optsWithGlobals();
-        emit(deps, flag(options, 'json'), await poolOutbox(deps, { server: text(options, 'server'), explain: flag(options, 'explain') }));
+        emit(deps, flag(options, 'json'), await poolOutbox(deps, { server: text(options, 'server'), explain: flag(options, 'explain'), ...(flag(options, 'json') ? {} : { print: deps.io.stdout }) }));
+    });
+    pool
+        .command('remove')
+        .argument('<hash>', 'the SHA-256 of a batch, as oars pool outbox prints it')
+        .description('remove one batch and its queued raw copies from the outbox on this machine; nothing is sent, and nothing at the pool changes. Its session stays out of every later oars pool deposit, the background sender included, until --restore. It refuses while a send holds the outbox lock')
+        .option('--restore', 'take the session of an earlier removal off the list, so a later oars pool deposit builds it again (the hash is the one remove printed)')
+        .option(serverOption, serverHelp)
+        .action(async (hash, _options, command) => {
+        const options = command.optsWithGlobals();
+        emit(deps, flag(options, 'json'), await poolRemove(deps, hash, { server: text(options, 'server'), restore: flag(options, 'restore') }));
     });
     pool
         .command('prove')

package/dist/errors.d.ts

@@ -12,6 +12,8 @@ export declare const ExitCode: {
     readonly UNREACHABLE: 8;
     /** `pool fetch` hit the pool's weekly cap: nothing is wrong, and the bundle on disk is untouched. */
     readonly CAPPED: 10;
+    /** A send the person ended with Ctrl-C (SIGINT): the shell convention, 128 plus the signal number. */
+    readonly INTERRUPTED: 130;
 };
 export type ExitCode = (typeof ExitCode)[keyof typeof ExitCode];
 /** The exit code for a failed response. The problem's code (then its type) decides; the status covers what has none. Text is never read. */

package/dist/errors.js

@@ -10,6 +10,8 @@ export const ExitCode = {
     UNREACHABLE: 8,
     /** `pool fetch` hit the pool's weekly cap: nothing is wrong, and the bundle on disk is untouched. */
     CAPPED: 10,
+    /** A send the person ended with Ctrl-C (SIGINT): the shell convention, 128 plus the signal number. */
+    INTERRUPTED: 130,
 };
 const codes = (exit, ...names) => names.map((name) => [name, exit]);
 // Problem codes (or types) from spec 1 §13, T87 and T92. EXPIRED_TOKEN and ACCESS_DENIED are the device flow's own, raised locally.

package/dist/sessions/pool-command.d.ts

@@ -131,6 +131,15 @@ export declare const waitingLine: ({ holder, ageMs, waitMs }: Waiting) => string
  * retry is certain once the lock has gone untouched for staleMs.
  */
 export declare const busyLine: ({ holder, local, ageMs, untouchedMs, waitedMs, staleMs }: BusyDetail) => string;
+/**
+ * `oars pool remove <hash>`: takes one batch out of this machine's outbox, the batch `oars pool outbox` printed under that hash. It takes the send lock without waiting, because a send in progress may be reading the very file, and refuses while another run holds it.
+ * It reads nothing from the pool and sends nothing, so it needs no sign-in, and it changes only files here. The session of a local batch goes on `removed.json`, which `poolDeposit` (and so the background sender) honors: nothing of it is built, queued, or sent until `--restore <hash>` takes it off. One a cloud session held is admitted again only by `oars pool hold pull`.
+ */
+export declare const poolRemove: (deps: RunDeps, hash: string, options: {
+    server?: string | undefined;
+    restore?: boolean | undefined;
+    lock?: SendLock | undefined;
+}) => Promise<Outcome>;
 /** The outbox key, and the skeleton `id`, of a machine's session: from the environment's session salt (per account, not per machine), else its own name standing in for the account, which a machine has none of. The holding route names its branch by the same key. */
 export declare const machineKeyOf: (machine: MachineConfig, session: string) => string;
 /**
@@ -149,10 +158,14 @@ export declare const poolDeposit: (deps: RunDeps, options: {
     covenant?: string | undefined;
     lock?: SendLock | undefined;
 }) => Promise<Outcome>;
-/** `oars pool outbox`: prints each batch as it would be sent (a batch past one request prints each part's request, in order), the request line and every header included, with the bearer credential as its size and nothing else masked, then its SHA-256, and records that it was shown. `--explain` adds each field's rule. */
+/**
+ * `oars pool outbox`: prints each batch as it would be sent (a batch past one request prints each part's request, in order), the request line and every header included, with the bearer credential as its size and nothing else masked, then its SHA-256, and records that it was shown. `--explain` adds each field's rule.
+ * With `print` each batch is written as soon as it is built and marked shown right after, and the outcome carries no text: an outbox of thousands of sessions is far past V8's string length as one string. Without it (`--json`) the document carries each batch's request, and `--json` writes it element by element.
+ */
 export declare const poolOutbox: (deps: RunDeps, options: {
     server?: string | undefined;
     explain?: boolean | undefined;
+    print?: ((chunk: string) => void) | undefined;
 }) => Promise<Outcome>;
 /** `oars pool fetch`: one harness's signed bundle at one version, kept only once the key pinned at login has verified it. It keeps the signed form, so the replica can be checked again later, and the ETag, so the next fetch asks only whether it changed. The request prints before it is sent. */
 export declare const poolFetch: (deps: RunDeps, options: {
@@ -160,6 +173,21 @@ export declare const poolFetch: (deps: RunDeps, options: {
     harness?: string | undefined;
     harnessVersion: string;
 }) => Promise<Outcome>;
+/**
+ * `oars pool join`: the five commands of a first deposit in one run, each by the handler the command itself uses: `login`, `deposit`, `outbox --explain`, `deposit --send <hash>` for each batch not yet sent, then `fetch`. It asks and checks
+ * nothing they do not, and a step that stops ends the run with that step's own error. Run again it skips what stands: a held sign-in, a prepared batch not yet sent, a batch in `sent.log`.
+ * Each step's text prints as it finishes, so the explanation is on screen before the send asks anything: on stdout, or with `json` on stderr, so stdout holds the one document.
+ */
+export declare const poolJoin: (deps: RunDeps, options: {
+    server?: string | undefined;
+    provider?: string | undefined;
+    verbose?: boolean;
+    acceptCovenant?: string | undefined;
+    inEuEeaUk?: string | undefined;
+    harness?: string | undefined;
+    harnessVersion: string;
+    json?: boolean;
+}) => Promise<Outcome>;
 /** The raw prompt, in plain words: shown by `oars pool raw` until it is answered, and what the detached sender relies on. Redaction is best effort and the text says so. */
 export declare const RAW_PROMPT: string;
 /** What a person types to say yes to the raw prompt: consent is a statement made at a terminal (GDPR Articles 7 and 9(2)(a)), not a flag a script can pass. */

package/dist/sessions/pool-command.js

@@ -11,7 +11,7 @@ import { makeCoverage, readCoverageSetting, writeCoverageSetting } from './cover
 import { checkSession, exclusionPaths, lastWritten, loadTerms, transcriptFilesOf } from './exclusion.js';
 import { localNames, makeRedactor, REDACTION_VERSION, redactTranscript } from './redact.js';
 import { recordSend, recordWire, newTally, tallyBatch } from '../telemetry/wire.js';
-import { discardStale, FIELD_ROWS, fieldsOf, heldAcross, lockedAcross, rescanPulled, machineKeys, markShown, noteMachineKey, outboxFolder, partsOf, pulledAt, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch } from './pool-outbox.js';
+import { discardStale, FIELD_ROWS, fieldsOf, heldAcross, lockedAcross, rescanPulled, machineKeys, markShown, noteMachineKey, outboxFolder, partsOf, pulledAt, readPulled, readRemoved, removeBatchesExcept, removeBatchOf, staleBatches, unchangedBytes, writeBatch, writePulled, writeRemoved } from './pool-outbox.js';
 import { deriveConsequences } from './recall-consequence.js';
 import { readRecalls } from './recall-object.js';
 import { HARNESSES, hasEnded, ORG_SIZES, REPO_VISIBILITIES, SESSION_IDLE_HOURS, isBundleVersion, isHarness, parseSkeleton, recommendationsOf, sessionsOf, skeletonOf, unpinnedKid, VOCAB_VERSION, verifyBundle } from './pool-wire.js';
@@ -37,6 +37,7 @@ const LOGIN = 'pool-login';
 const LOGOUT = 'pool-logout';
 export const DEPOSIT = 'pool-deposit';
 const OUTBOX = 'pool-outbox';
+const REMOVE = 'pool-remove';
 const POOL_DEPOSITS = '/v1/deposits';
 const FETCH = 'pool-fetch';
 const EXPORT = 'pool-export';
@@ -74,9 +75,14 @@ export const runtimeOf = (deps) => {
         throw new CliError('The session store is not configured in this run.', ExitCode.UNEXPECTED, 'unexpected');
     return deps.sessions;
 };
-export const signedIn = async (deps, storeDir, server, step) => {
+/** The sign-in held for this server that has not expired, or undefined. */
+const heldSignIn = async (deps, storeDir, server, step) => {
     const found = (await loadSignIns(storeDir, step)).find((entry) => entry.server === server);
-    if (found === undefined || found.expiresAt <= deps.now())
+    return found === undefined || found.expiresAt <= deps.now() ? undefined : found;
+};
+export const signedIn = async (deps, storeDir, server, step) => {
+    const found = await heldSignIn(deps, storeDir, server, step);
+    if (found === undefined)
         throw new CliError(`Not signed in to ${server}. Run oars pool login first.`, ExitCode.AUTH, step);
     return found;
 };
@@ -105,13 +111,14 @@ export const ask = (deps, step, server, path, init, via) => {
 /** The pool took the request and then said nothing for `Guard.stallMs`. */
 class PoolStalled extends Error {
 }
-/** A newcomer's words for the network failures a stalled or restarted pool produces; the raw reason follows the sentence in parentheses. */
+/** A newcomer's words for the network failures a stalled or restarted pool produces; the raw reason follows the sentence in parentheses. The flag marks a failure that comes after the request began to go out, where the pool may hold the batch: a refused, unresolved, or connect-timed-out connection fails before any of it was sent, while ETIMEDOUT can also come from a retransmit timeout on an open socket after the body was written. */
 const PLAIN_REASONS = [
-    [/ECONNRESET|socket hang up|UND_ERR_SOCKET/, 'the connection was dropped before the pool answered'],
-    [/ECONNREFUSED/, 'nothing is listening there'],
-    [/ENOTFOUND|EAI_AGAIN/, 'that name did not resolve'],
-    [/ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT/, 'the connection timed out'],
-    [/EPIPE/, 'the connection closed while the batch was going out'],
+    [/ECONNRESET|socket hang up|UND_ERR_SOCKET/, 'the connection was dropped before the pool answered', true],
+    [/ECONNREFUSED/, 'nothing is listening there', false],
+    [/ENOTFOUND|EAI_AGAIN/, 'that name did not resolve', false],
+    [/UND_ERR_CONNECT_TIMEOUT/, 'the connection timed out', false],
+    [/ETIMEDOUT/, 'the connection timed out', true],
+    [/EPIPE/, 'the connection closed while the batch was going out', true],
 ];
 const NOT_MARKED = 'Nothing was marked sent.';
 const TRY_AGAIN = 'Run the same command to try again.';
@@ -131,16 +138,18 @@ export const stoppedText = (received) => [
     'To keep a folder out, run oars pool raw --folder <folder> --mode off.',
     'To stop this machine sending, run oars pool logout.',
 ].join('\n');
+/** The failure for a send the person or the launcher ended: Ctrl-C (SIGINT) exits 130, the shell convention, and any other way of stopping keeps the unexpected code. The text is the same for all of them. */
+const stopped = (step, cause, received) => new CliError(stoppedText(received), cause.signal === 'SIGINT' ? ExitCode.INTERRUPTED : ExitCode.UNEXPECTED, step);
 /** Why a guarded request ended without an answer, in plain words: a stall, an interrupt, or a network failure whose raw reason is kept after the sentence. The exit code is the unreachable one, as before. */
 const guardedFailure = (step, cause, origin, guard, received) => {
     if (cause instanceof PoolStalled)
         return new CliError(`The pool at ${origin} did not answer within ${String(guard.stallMs / 1000)} seconds. ${received ? `${NOT_MARKED} ${MAY_HAVE_RECEIVED} ${TRY_AGAIN}` : RETRY}`, ExitCode.UNREACHABLE, step);
     if (cause instanceof SendInterrupted)
-        return new CliError(stoppedText(received), ExitCode.UNEXPECTED, step);
+        return stopped(step, cause, received);
     const unreachable = unreachableError(step, cause, origin);
     const raw = unreachable.message.slice(`Cannot reach the server at ${origin}: `.length);
     const plain = PLAIN_REASONS.find(([pattern]) => pattern.test(raw));
-    return plain === undefined ? unreachable : new CliError(`Cannot reach the pool at ${origin}: ${plain[1]} (${raw}). ${RETRY}`, ExitCode.UNREACHABLE, step);
+    return plain === undefined ? unreachable : new CliError(`Cannot reach the pool at ${origin}: ${plain[1]} (${raw}). ${received && plain[2] ? `${NOT_MARKED} ${MAY_HAVE_RECEIVED} ${TRY_AGAIN}` : RETRY}`, ExitCode.UNREACHABLE, step);
 };
 /** Prints the request when asked to, then sends exactly those headers and that body. A guarded request also ends when its stall time passes or its signal aborts, and fails in plain words. */
 const send = async (deps, step, request, show, binary = false, guard) => {
@@ -570,7 +579,7 @@ const sendBatch = async (deps, options) => {
         if (error instanceof SendLockBusy)
             throw refuse('send_locked', busyLine(error.detail));
         if (error instanceof SendInterrupted)
-            throw new CliError(stoppedText(false), ExitCode.UNEXPECTED, DEPOSIT);
+            throw stopped(DEPOSIT, error, false);
         throw error;
     }
     finally {
@@ -604,6 +613,68 @@ export const busyLine = ({ holder, local, ageMs, untouchedMs, waitedMs, staleMs
         return `${held} A retry succeeds as soon as pid ${String(holder.pid)} ends.`;
     return `${held} Run the same command again once it ends. If it has hung, oars takes the lock over about ${span(Math.max(1, staleMs - untouchedMs))} from now.`;
 };
+/** The session id behind an outbox key, found by deriving the key of each session in the store the way `poolDeposit` does: under every account signed in to this server, or under the machine's environment. `undefined` when the store no longer holds the session. */
+const sessionOfKey = async (deps, storeDir, server, key) => {
+    const machine = machineOf(deps.env);
+    const accounts = machine === undefined ? (await loadSignIns(storeDir, REMOVE)).filter((entry) => entry.server === server).map((entry) => entry.account) : [];
+    const keysOf = (session) => (machine === undefined ? accounts.map((account) => contentHash([account, session])) : [machineKeyOf(machine, session)]);
+    return (await loadStore(storeDir)).sessions.map((observed) => observed.session).find((session) => keysOf(session).includes(key));
+};
+/**
+ * `oars pool remove <hash>`: takes one batch out of this machine's outbox, the batch `oars pool outbox` printed under that hash. It takes the send lock without waiting, because a send in progress may be reading the very file, and refuses while another run holds it.
+ * It reads nothing from the pool and sends nothing, so it needs no sign-in, and it changes only files here. The session of a local batch goes on `removed.json`, which `poolDeposit` (and so the background sender) honors: nothing of it is built, queued, or sent until `--restore <hash>` takes it off. One a cloud session held is admitted again only by `oars pool hold pull`.
+ */
+export const poolRemove = async (deps, hash, options) => {
+    const runtime = runtimeOf(deps);
+    const server = poolServer(deps.env, REMOVE, options.server);
+    if (!/^[0-9a-f]{64}$/.test(hash))
+        throw usage('remove takes the SHA-256 that oars pool outbox printed: 64 hexadecimal characters.', REMOVE);
+    const outbox = outboxFolder(runtime.storeDir, server);
+    const refuse = (code, title) => new CliError(title, ExitCode.CONFLICT, REMOVE, { code, title, status: 409 });
+    try {
+        return await withSendLock(outbox, async () => {
+            if (options.restore === true) {
+                const removed = await readRemoved(outbox, REMOVE);
+                const key = Object.keys(removed).find((candidate) => removed[candidate]?.hash === hash);
+                if (key === undefined)
+                    throw refuse('removal_unknown', 'No removed batch has that hash, so nothing was restored. The hash is the one oars pool remove printed when it removed the batch.');
+                Reflect.deleteProperty(removed, key);
+                await writeRemoved(outbox, removed);
+                return { document: { ok: true, server, hash, restored: true }, text: `Restored the session of batch ${hash} for ${server}. Nothing was sent. A later oars pool deposit builds it again while the session passes the gates.` };
+            }
+            const removed = await readRemoved(outbox, REMOVE);
+            const found = (await heldAcross(outbox)).batches.find((batch) => batch.hash === hash);
+            if (found === undefined)
+                throw refuse('batch_unknown', 'No batch with that hash is in the outbox, so nothing was removed. Run oars pool outbox to list them.');
+            // The session goes on the list first: the build pass would otherwise rebuild it on its next run, the background sender's included, and send what the person withdrew (GDPR Article 7(3)). A list that cannot be read has already failed above, with the batch untouched.
+            const session = found.pulled ? undefined : await sessionOfKey(deps, runtime.storeDir, server, found.key);
+            if (!found.pulled)
+                await writeRemoved(outbox, { ...removed, [found.key]: session === undefined ? { hash } : { hash, session } });
+            await rm(found.file, { force: true });
+            // The session's queued raw copies go in the same lock: the background sender posts every raw copy it holds without looking for its batch, and a batch the person withdrew must take the session's transcript with it (GDPR Article 7(3)). A pulled batch never had one here.
+            const rawGone = await removeRawExcept(outbox, new Set(), found.key);
+            if (found.pulled) {
+                const pulled = await readPulled(outbox, REMOVE);
+                Reflect.deleteProperty(pulled, found.key);
+                await writePulled(outbox, pulled);
+            }
+            const sentAt = (await sentLog(outbox)).get(hash);
+            const text = [
+                `Removed batch ${hash} from the outbox for ${server}. Nothing was sent, and nothing at the pool changed.`,
+                ...(rawGone === 0 ? [] : [`${String(rawGone)} queued raw ${rawGone === 1 ? 'copy' : 'copies'} of the same session went with it.`]),
+                ...(sentAt === undefined ? [] : [`It was already sent at ${sentAt}; removing it here does not take it back from the pool.`]),
+                ...(found.pulled ? ['It came from a cloud session: only oars pool hold pull admits it again.'] : [`Its session stays out of every later oars pool deposit, the background sender's included, until you run oars pool remove ${hash} --restore.`]),
+                ...(found.pulled || session !== undefined ? [] : ['No session in the store matches it, so the exclusion holds for this account and machine settings only.']),
+            ].join('\n');
+            return { document: { ok: true, server, hash, removed: true }, text };
+        }, { ...options.lock?.times, waitMs: 0 }, options.lock?.fs);
+    }
+    catch (error) {
+        if (error instanceof SendLockBusy)
+            throw refuse('send_locked', `Another oars run${error.detail.holder === undefined ? '' : ` (pid ${String(error.detail.holder.pid)})`} holds this outbox's send lock, so nothing was removed. Run the same command again once it ends.`);
+        throw error;
+    }
+};
 /** The covenant version the pool names, or `undefined` when it cannot be asked or names none. The route is public, so no credential goes with it. */
 const covenantOrUndefined = async (deps, server) => {
     try {
@@ -655,7 +726,7 @@ export const poolDeposit = async (deps, options) => {
     const injectedKey = `injected-block:${(await localSalt(runtime.storeDir)).salt}`;
     const allow = compileAllow(saved.allow);
     const discarded = await discardStale(outbox);
-    const counts = { sessions: 0, batched: 0, excluded: { folder: 0, term: 0, noRaw: 0, noTerms: 0, unreadable: 0 }, off: 0, raw: { copies: 0, bytes: 0, masked: 0 }, uncaptured: 0, notEnded: 0, refused: 0, refusedFields: [], discarded, withdrawn: 0 };
+    const counts = { sessions: 0, batched: 0, excluded: { folder: 0, term: 0, noRaw: 0, noTerms: 0, unreadable: 0 }, off: 0, raw: { copies: 0, bytes: 0, masked: 0 }, uncaptured: 0, removedByPerson: 0, notEnded: 0, refused: 0, refusedFields: [], discarded, withdrawn: 0 };
     // The one gate on a name: the operator's redactor and exclusion terms (t881). Everything else the pool classes itself.
     const termList = await loadTerms(terms);
     const gate = { redact: makeRedactor(await readRedactDomains(runtime.storeDir)), terms: termList };
@@ -678,6 +749,11 @@ export const poolDeposit = async (deps, options) => {
     // The sessions a Stop does not name that still pass the read-only gates: they only fill the windows of a delta, and are never counted, withdrawn, or built.
     const history = [];
     const localStore = await loadStore(runtime.storeDir);
+    // A damaged list stops the pass before anything is built: it must never read as "nothing was removed".
+    const removedList = await readRemoved(outbox, DEPOSIT);
+    const removedKeys = new Set(Object.keys(removedList));
+    // By session id too: the key follows the account and the machine's environment, so a login under another account would otherwise build the same session again.
+    const removedSessions = new Set(Object.values(removedList).flatMap((entry) => (entry.session === undefined ? [] : [entry.session])));
     for (const records of sessionsOf(localStore, roots)) {
         // The Stop of a machine builds the one session that stopped: the others in the store belong to Stops of their own, so their batches stay as they are. They run the three read-only gates below and no more.
         const named = options.session === undefined || records.main.session === options.session;
@@ -685,6 +761,12 @@ export const poolDeposit = async (deps, options) => {
             counts.sessions += 1;
         // Hashed with the account, so a redeposit replaces its own batch and two accounts' copies of one session cannot be joined.
         const key = machine === undefined ? contentHash([account, records.main.session]) : machineKeyOf(machine, records.main.session);
+        // Withdrawn by the person with `oars pool remove`: nothing of the session is built, queued, or read for a window, and its batch and raw copies are already gone.
+        if (removedKeys.has(key) || removedSessions.has(records.main.session)) {
+            if (named)
+                counts.removedByPerson += 1;
+            continue;
+        }
         if (!allow.allows(records.main.project)) {
             if (named) {
                 counts.excluded.folder += 1;
@@ -793,6 +875,7 @@ export const poolDeposit = async (deps, options) => {
         ...(discarded === 0 ? [] : [`Discarded ${String(discarded)} ${discarded === 1 ? 'batch' : 'batches'} built under an older vocabulary, field list, or skeleton format.`]),
         `Raw copies queued: ${String(counts.raw.copies)} (${String(counts.raw.bytes)} bytes, ${String(counts.raw.masked)} values masked). ${rawNote(saved.pool.rawConsent)}`.trim(),
         ...(rawStale(saved.pool, covenant) ? [`Your yes to the raw prompt was given under covenant ${saved.pool.rawConsentVersion ?? 'none'}, not ${covenant ?? ''}, so no raw copy is queued. Run oars pool raw --consent yes to answer for the covenant now in force.`] : []),
+        ...(counts.removedByPerson === 0 ? [] : [`${String(counts.removedByPerson)} ${counts.removedByPerson === 1 ? 'session' : 'sessions'} you removed with oars pool remove: nothing of them is built, queued, or sent. oars pool remove <hash> --restore brings one back.`]),
         ...(counts.off === 0 ? [] : [`${String(counts.off)} ${counts.off === 1 ? 'session' : 'sessions'} in a folder switched off: nothing of them is queued.`]),
         ...(termList.length === 0 ? [termsHint(terms)] : []),
         'Run oars pool outbox to print exactly what would be sent.',
@@ -812,7 +895,10 @@ const explained = (bytes) => {
     }
     return rows;
 };
-/** `oars pool outbox`: prints each batch as it would be sent (a batch past one request prints each part's request, in order), the request line and every header included, with the bearer credential as its size and nothing else masked, then its SHA-256, and records that it was shown. `--explain` adds each field's rule. */
+/**
+ * `oars pool outbox`: prints each batch as it would be sent (a batch past one request prints each part's request, in order), the request line and every header included, with the bearer credential as its size and nothing else masked, then its SHA-256, and records that it was shown. `--explain` adds each field's rule.
+ * With `print` each batch is written as soon as it is built and marked shown right after, and the outcome carries no text: an outbox of thousands of sessions is far past V8's string length as one string. Without it (`--json`) the document carries each batch's request, and `--json` writes it element by element.
+ */
 export const poolOutbox = async (deps, options) => {
     const runtime = runtimeOf(deps);
     const server = poolServer(deps.env, OUTBOX, options.server);
@@ -822,25 +908,41 @@ export const poolOutbox = async (deps, options) => {
     const masker = new Masker();
     masker.add(token);
     const sent = await sentLog(outbox);
+    const { print } = options;
     const shown = [];
+    // Blocks are separated by a blank line; each is written alone, so no string holds more than one batch.
+    const state = { wrote: false };
+    const put = (block) => {
+        print?.(`${state.wrote ? '\n\n' : ''}${block}`);
+        state.wrote = true;
+    };
     for (const batch of batches) {
         const fields = options.explain === true ? explained(batch.bytes) : undefined;
         // A batch past one request prints every part's request, in the order they are sent.
         const request = callsOf(token, batch.bytes, batch.hash).map((call) => printed(outgoing(deps, server, POOL_DEPOSITS, call), masker)).join('\n');
-        shown.push({ hash: batch.hash, request, ...(sent.has(batch.hash) ? { sent: sent.get(batch.hash) ?? '' } : {}), ...(fields === undefined ? {} : { fields }) });
+        const at = sent.get(batch.hash);
+        put([request, `sha256: ${batch.hash}`, ...(at === undefined ? [] : [`sent: ${at}`]), ...Object.entries(fields ?? {}).map(([field, row]) => `  ${field}: ${row}`)].join('\n'));
+        shown.push({ hash: batch.hash, ...(print === undefined ? { request } : {}), ...(at === undefined ? {} : { sent: at }), ...(fields === undefined ? {} : { fields }) });
+        await markShown(outbox, batch.hash, deps.now());
     }
     const { copies } = await heldRaw(outbox);
-    const rawBlocks = copies.flatMap((copy) => rawParts(copy.body).map((part, at, all) => [`raw part ${String(at + 1)}/${String(all.length)} sha256: ${copy.hash} bytes: ${String(Buffer.byteLength(part))}${sent.has(copy.hash) ? ` sent: ${sent.get(copy.hash) ?? ''}` : ''}`, ...(options.explain === true ? [part] : [])].join('\n')));
-    for (const { hash } of shown)
-        await markShown(outbox, hash, deps.now());
+    for (const copy of copies) {
+        const parts = rawParts(copy.body);
+        for (const [at, part] of parts.entries())
+            put([`raw part ${String(at + 1)}/${String(parts.length)} sha256: ${copy.hash} bytes: ${String(Buffer.byteLength(part))}${sent.has(copy.hash) ? ` sent: ${sent.get(copy.hash) ?? ''}` : ''}`, ...(options.explain === true ? [part] : [])].join('\n'));
+    }
     const stale = await staleBatches(outbox);
-    const blocks = shown.map(({ hash, request, sent: at, fields }) => [request, `sha256: ${hash}`, ...(at === undefined ? [] : [`sent: ${at}`]), ...Object.entries(fields ?? {}).map(([field, row]) => `  ${field}: ${row}`)].join('\n'));
     const notes = [
         ...(edited === 0 ? [] : [`${String(edited)} ${edited === 1 ? 'batch was' : 'batches were'} edited on disk since ${edited === 1 ? 'it was' : 'they were'} written and ${edited === 1 ? 'is' : 'are'} not printed or sent. Run oars pool deposit to build ${edited === 1 ? 'it' : 'them'} again.`]),
         ...(stale === 0 ? [] : [`${String(stale)} ${stale === 1 ? 'batch was' : 'batches were'} built under an older vocabulary, field list, or skeleton format and will never be sent.`]),
     ];
-    const text = shown.length === 0 && rawBlocks.length === 0 ? ['The outbox is empty. Run oars pool deposit first.', ...notes].join('\n') : [...blocks, ...rawBlocks, ...notes].join('\n\n');
-    return { document: { ok: true, server, batches: shown, raw: copies.map(({ hash, bytes }) => ({ hash, bytes, ...(sent.has(hash) ? { sent: sent.get(hash) ?? '' } : {}) })), edited, stale }, text };
+    if (!state.wrote)
+        put(['The outbox is empty. Run oars pool deposit first.', ...notes].join('\n'));
+    else
+        for (const note of notes)
+            put(note);
+    print?.('\n');
+    return { document: { ok: true, server, batches: shown, raw: copies.map(({ hash, bytes }) => ({ hash, bytes, ...(sent.has(hash) ? { sent: sent.get(hash) ?? '' } : {}) })), edited, stale }, text: '', output: print === undefined ? 'chunked' : 'streamed' };
 };
 /**
  * What the pool says it served a bundle at, printed as the bundle states it: the client holds no floor of its own and applies none (a floor is the pool's deploy setting), so a bundle that states none prints nothing.
@@ -949,6 +1051,74 @@ export const poolFetch = async (deps, options) => {
         text: `Fetched ${harness} ${harnessVersion}: ${String(reads.length)} reads, ${String(cells.length)} cells, and ${String(motifs.length)} motifs, verified against the pinned key and kept at ${file}.${floorSentence(floors)}`,
     };
 };
+const JOIN = 'pool-join';
+const JOIN_AGAIN = 'Run oars pool join again to continue from here.';
+/**
+ * `oars pool join`: the five commands of a first deposit in one run, each by the handler the command itself uses: `login`, `deposit`, `outbox --explain`, `deposit --send <hash>` for each batch not yet sent, then `fetch`. It asks and checks
+ * nothing they do not, and a step that stops ends the run with that step's own error. Run again it skips what stands: a held sign-in, a prepared batch not yet sent, a batch in `sent.log`.
+ * Each step's text prints as it finishes, so the explanation is on screen before the send asks anything: on stdout, or with `json` on stderr, so stdout holds the one document.
+ */
+export const poolJoin = async (deps, options) => {
+    const { storeDir } = runtimeOf(deps);
+    const server = poolServer(deps.env, JOIN, options.server);
+    const say = (line) => {
+        deps.io.stderr(`${line}
+`);
+    };
+    const screen = options.json === true ? deps.io.stderr : deps.io.stdout;
+    const show = (outcome) => {
+        if (outcome.output !== 'streamed')
+            screen(`${outcome.text}
+`);
+        return outcome;
+    };
+    const outbox = outboxFolder(storeDir, server);
+    const unsent = async () => {
+        const sent = await sentLog(outbox);
+        return (await heldAcross(outbox)).batches.flatMap(({ hash }) => (sent.has(hash) ? [] : [hash]));
+    };
+    try {
+        const held = await heldSignIn(deps, storeDir, server, LOGIN);
+        let login = { skipped: true, account: held?.account };
+        if (held === undefined) {
+            say(`Signing in to ${server}.`);
+            login = show(await poolLogin(deps, { server, provider: options.provider, verbose: options.verbose })).document;
+        }
+        else {
+            say(`Already signed in to ${server} as ${held.account}.`);
+        }
+        let prepared = { skipped: true };
+        if ((await unsent()).length > 0) {
+            say('Your outbox already holds a prepared batch; not preparing it again.');
+        }
+        else {
+            say('Preparing your deposit in the outbox.');
+            prepared = show(await poolDeposit(deps, { server })).document;
+        }
+        say('Showing what will be sent, field by field.');
+        const shown = show(await poolOutbox(deps, { server, explain: true, print: screen })).document;
+        const hashes = await unsent();
+        const sends = [];
+        if (hashes.length === 0) {
+            say((await heldAcross(outbox)).batches.length === 0 ? 'No session is ready to deposit yet; sending nothing.' : 'Everything prepared is already sent; sending nothing.');
+        }
+        else {
+            say(`Sending ${plural(hashes.length, 'batch', 'batches')} to ${server}.`);
+            for (const hash of hashes)
+                sends.push(show(await poolDeposit(deps, { server, send: hash, acceptCovenant: options.acceptCovenant, inEuEeaUk: options.inEuEeaUk })).document);
+        }
+        say(`Fetching the bundle for ${options.harness ?? 'your most used harness'} ${options.harnessVersion}.`);
+        const fetched = show(await poolFetch(deps, { server, harness: options.harness, harnessVersion: options.harnessVersion }));
+        return {
+            document: { ok: true, server, login, deposit: prepared, outbox: shown, sends, fetch: fetched.document },
+            text: `Joined ${server}: ${plural(sends.length, 'batch', 'batches')} sent this run, and the ${options.harnessVersion} bundle is kept.`,
+        };
+    }
+    catch (error) {
+        say(JOIN_AGAIN);
+        throw error;
+    }
+};
 const RAW = 'pool-raw';
 /** The raw prompt, in plain words: shown by `oars pool raw` until it is answered, and what the detached sender relies on. Redaction is best effort and the text says so. */
 export const RAW_PROMPT = [

package/dist/sessions/pool-outbox.d.ts

@@ -94,6 +94,19 @@ export interface Pulled {
 export declare const readPulled: (outbox: string, step: string) => Promise<Pulled>;
 /** Staged and renamed, so a crash leaves the whole old file or the whole new one. */
 export declare const writePulled: (outbox: string, pulled: Pulled) => Promise<void>;
+/** One session a person took out with `oars pool remove`: the hash of the batch that was removed, which is how `--restore` names the way back, and the session id when it could be resolved. The outbox key derives from the account or the machine's environment, so only the session id keeps the session out after either changes; an entry with no id (the session was gone from the store, or the file is older) skips by key alone. */
+export interface RemovedEntry {
+    hash: string;
+    session?: string;
+}
+/** The sessions a person took out of the outbox with `oars pool remove`, by outbox key. Local only; nothing in it goes to the pool. */
+export interface Removed {
+    [key: string]: RemovedEntry;
+}
+/** `removed.json` as it stands; none when the file is missing. A file that is not a list of keys and entries fails the command that reads it, so a damaged list never becomes "send everything". A bare string is an entry with only a hash, the form before session ids were kept. */
+export declare const readRemoved: (outbox: string, step: string) => Promise<Removed>;
+/** Staged and renamed, like `pulled.json`: a crash leaves the whole old list or the whole new one. */
+export declare const writeRemoved: (outbox: string, removed: Removed) => Promise<void>;
 /** Whether any string or key in `value` holds one of `terms`, compared lowercased the way the local gate compares a transcript. */
 export declare const holdsTerm: (value: unknown, terms: readonly string[]) => boolean;
 /**

package/dist/sessions/pool-outbox.js

@@ -385,6 +385,52 @@ export const writePulled = async (outbox, pulled) => {
     await writeOwnerOnly(staged, `${JSON.stringify(Object.fromEntries(Object.entries(pulled).sort(([a], [b]) => (a < b ? -1 : 1))), null, 2)}\n`);
     await rename(staged, join(outbox, PULLED));
 };
+const REMOVED = 'removed.json';
+const removedEntryOf = (value) => {
+    if (typeof value === 'string')
+        return { hash: value };
+    if (typeof value !== 'object' || value === null || Array.isArray(value) || !('hash' in value) || typeof value.hash !== 'string')
+        return undefined;
+    if (!('session' in value))
+        return { hash: value.hash };
+    return typeof value.session === 'string' ? { hash: value.hash, session: value.session } : undefined;
+};
+/** `removed.json` as it stands; none when the file is missing. A file that is not a list of keys and entries fails the command that reads it, so a damaged list never becomes "send everything". A bare string is an entry with only a hash, the form before session ids were kept. */
+export const readRemoved = async (outbox, step) => {
+    let text;
+    try {
+        text = await readFile(join(outbox, REMOVED), 'utf8');
+    }
+    catch (error) {
+        if (isMissing(error))
+            return {};
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        value = undefined;
+    }
+    const entries = typeof value !== 'object' || value === null || Array.isArray(value) ? undefined : Object.entries(value).map(([key, entry]) => [key, removedEntryOf(entry)]);
+    const kept = [];
+    for (const [key, entry] of entries ?? [])
+        if (entry !== undefined)
+            kept.push([key, entry]);
+    if (entries === undefined || kept.length !== entries.length) {
+        throw new CliError(`${join(outbox, REMOVED)} is not a list of removed sessions. Move it aside and run the command again; nothing was changed, built, or sent.`, ExitCode.INVALID, step);
+    }
+    return Object.fromEntries(kept);
+};
+/** Staged and renamed, like `pulled.json`: a crash leaves the whole old list or the whole new one. */
+export const writeRemoved = async (outbox, removed) => {
+    await mkdirOwnerOnly(outbox);
+    const staged = join(outbox, `${REMOVED}.tmp`);
+    await writeOwnerOnly(staged, `${JSON.stringify(Object.fromEntries(Object.entries(removed).sort(([a], [b]) => (a < b ? -1 : 1))), null, 2)}
+`);
+    await rename(staged, join(outbox, REMOVED));
+};
 const POOL_STEP = 'pool-outbox';
 /** Whether any string or key in `value` holds one of `terms`, compared lowercased the way the local gate compares a transcript. */
 export const holdsTerm = (value, terms) => {

package/dist/sessions/pool-send-lock.d.ts

@@ -68,7 +68,8 @@ export declare const withSendLock: <T>(outbox: string, run: () => Promise<T>, ti
 /** Why an interactive send ended before it finished: a signal reached it, or the process that launched it is gone. */
 export declare class SendInterrupted extends Error {
     readonly kind: 'signal' | 'launcher';
-    constructor(kind: 'signal' | 'launcher', message: string);
+    readonly signal?: NodeJS.Signals | undefined;
+    constructor(kind: 'signal' | 'launcher', message: string, signal?: NodeJS.Signals | undefined);
 }
 /** What a test replaces: the process's signal hooks, its launcher, and how that launcher's liveness is read. */
 export interface InterruptHost {

package/dist/sessions/pool-send-lock.js

@@ -147,9 +147,11 @@ export const withSendLock = async (outbox, run, times = {}, fs = { stat }, wait
 /** Why an interactive send ended before it finished: a signal reached it, or the process that launched it is gone. */
 export class SendInterrupted extends Error {
     kind;
-    constructor(kind, message) {
+    signal;
+    constructor(kind, message, signal) {
         super(message);
         this.kind = kind;
+        this.signal = signal;
         this.name = 'SendInterrupted';
     }
 }
@@ -164,7 +166,7 @@ export const watchInterrupt = (host = { on: (event, listener) => process.on(even
     const listeners = SIGNALS.map((name) => [
         name,
         () => {
-            controller.abort(new SendInterrupted('signal', `Interrupted by ${name}.`));
+            controller.abort(new SendInterrupted('signal', `Interrupted by ${name}.`, name));
         },
     ]);
     for (const [name, listener] of listeners)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manyoars/oars",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "mcpName": "io.github.manyoars/oars",
   "description": "A local, searchable record of your coding agent sessions. Reads Claude Code, Cursor, Codex, Copilot CLI, Gemini CLI, and more, and keeps the record on your machine.",
   "homepage": "https://manyoars.com/",