@openrig/cli 0.6.11 → 0.6.12

package/README.md

@@ -22,11 +22,11 @@ Not setting this up today? Get the next walkthrough and occasional OpenRig updat
 
 Requires Node.js 22 or 24 and tmux, on macOS or Linux. On Linux, the distribution's own Node.js can be older (Ubuntu 24.04's is 18); install a supported version with [nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource. On a Mac with Apple silicon, use Node.js 22 ([compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation)). On Windows, use WSL2, the Windows route OpenRig supports; native Windows isn't supported. OpenRig's automated tests don't run on WSL2 yet; see [one user's working setup](docs/reference/getting-started.md#wsl2-a-reported-working-setup). Launching a rig writes provider hooks and workspace trust settings. Before running the commands below, read [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine) and back up the relevant files.
 
-**One command.** This runs OpenRig's install script from the `v0.6.8` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
+**One command.** This runs OpenRig's install script from the `v0.6.12` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.8/scripts/install.sh | sh -s -- --dry-run
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.8/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.12/scripts/install.sh | sh
 ```
 
 If a provider isn't signed in yet, the last step reports `FAILED [4/4]`, and `rig setup` lists the sign-in under "Some steps need attention". If the only remaining failures are provider sign-ins, the install steps finished; sign in to each selected provider as below and continue.
@@ -144,6 +144,7 @@ Not setting this up today? Get the next walkthrough and occasional OpenRig updat
 - **Questions:** [Discussions › Q&A](https://github.com/mvschwarz/openrig/discussions/categories/q-a)
 - **Bugs and feature requests:** [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose)
 - **Contributing:** [CONTRIBUTING.md](CONTRIBUTING.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Security policy](SECURITY.md) · [Getting help](.github/SUPPORT.md)
+- **Working on OpenRig with a coding agent?** Start with the `developing-openrig` skill in `.agents/skills/` (Claude Code: `.claude/skills/`) and [CONTRIBUTING.md](CONTRIBUTING.md).
 - **Videos:** [youtube.com/@openrig](https://www.youtube.com/@openrig)
 - **Releases:** [GitHub Releases](https://github.com/mvschwarz/openrig/releases) and npm `@openrig/cli`
 
@@ -181,6 +182,8 @@ user's home; changing `OPENRIG_HOME` alone does not isolate provider configurati
   selected MCP resources configure those external services. Built-in bootstrap
   no longer writes a command allowlist to `~/.claude/settings.json` or removes
   older allowances. `CLAUDE_CONFIG_DIR` does not relocate the project-local writes.
+  To keep your own status line alongside the collector, see
+  [Custom Claude status line](docs/reference/claude-status-line.md).
 - **Codex:** writes the daemon's `CODEX_HOME/config.toml` (normally
   `~/.codex/config.toml`). Startup enables hooks, adds the OpenRig activity relay
   commands and pre-writes trust hashes for those commands. Seat startup adds
@@ -297,7 +300,7 @@ rig specs ls
 
 ## How It Works
 
-OpenRig is a local daemon + CLI + terminal UI + MCP server, built on tmux. The older React web UI remains in maintenance mode with best-effort support.
+OpenRig is a local daemon + CLI + terminal UI + MCP server, built on tmux. OpenRig itself is under active development; only the older React web UI is in maintenance mode, with best-effort support.
 
 ```
 CLI / TUI / MCP

package/daemon/assets/claude-statusline-context.cjs

@@ -44,6 +44,8 @@ process.stdin.on("end", () => {
       session_name: raw.session_name ?? null,
       occupant_generation: process.env.OPENRIG_OCCUPANT_GENERATION || process.env.RIGGED_OCCUPANT_GENERATION || null,
       transcript_path: raw.transcript_path ?? null,
+      // Claude's own client-side cost estimate for this session (cumulative; not an invoice).
+      cost: raw.cost && typeof raw.cost.total_cost_usd === "number" ? { total_cost_usd: raw.cost.total_cost_usd } : null,
       sampled_at: new Date().toISOString(),
     };
 

package/daemon/assets/guidance/openrig-start.md

@@ -12,7 +12,8 @@ orientation, and it cannot tell you what your rig is for or what you are suppose
 rig whoami --json
 ```
 
-Returns your rig, pod, member, peers, edges, and transcript path. **Treat it as ground truth.**
+Returns your rig, pod, member, peers, edges, and transcript path. If `peersNote` says some peers
+are not shown, `rig whoami --json --all-peers` lists them all. **Treat it as ground truth.**
 A startup overlay can be stale; this one is small precisely so it has less room to be wrong.
 
 Run it again after any compaction, restart or restore — **before** concluding anything about

package/daemon/assets/plugins/openrig-core/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig-core",
-  "version": "0.1.9",
+  "version": "0.1.13",
   "description": "OpenRig canonical skills and hooks for cross-runtime agent topology coordination, continuity, and operating discipline.",
   "author": {
     "name": "Mike Schwarz",

package/daemon/assets/plugins/openrig-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig-core",
-  "version": "0.1.9",
+  "version": "0.1.13",
   "description": "OpenRig canonical skills and hooks for cross-runtime agent topology coordination, continuity, and operating discipline.",
   "author": {
     "name": "Mike Schwarz",

package/daemon/assets/plugins/openrig-core/README.md

@@ -13,10 +13,35 @@ off, and never runs at fresh session start.
 
 ## Runtimes
 
-This plugin ships dual-manifest packaging — both `.claude-plugin/` and `.codex-plugin/`. Use it with:
-
-- **Claude Code** — install via `/plugin` after the OpenRig daemon vendors `openrig-core/` to `~/.openrig/plugins/openrig-core/` on first run, or install the plugin directly through Claude Code's own plugin commands when remote distribution is available
-- **Codex CLI** — install via `/plugins` after the same vendoring step, or directly through Codex's own plugin commands
+This plugin ships dual-manifest packaging — both `.claude-plugin/` and `.codex-plugin/`.
+
+- **Claude Code** — the OpenRig daemon vendors `openrig-core/` to `$OPENRIG_HOME/plugins/openrig-core/` at startup and starts
+  each Claude seat whose resolved plugin selection includes it (for example `plugins: [shared:openrig-core]`) with
+  `CLAUDE_CODE_PLUGIN_DIRS` pointing at that copy, so the plugin's hooks (refocus, compaction restore) load with no setup
+  step. A seat that didn't select the plugin is launched as before. This applies to fresh launches, restores, handover
+  successors and launches with a permission mode; a seat that was already running picks it up at its next launch. A
+  `CLAUDE_CODE_PLUGIN_DIRS` list a seat declares itself (its spec's `env:` or a one-off `rig up --env`) keeps working: the
+  vendored plugin is added after it. Claude Code reads the variable from v2.1.280; an older Claude ignores it, starts
+  normally, and doesn't load the hooks (OpenRig doesn't check the version or refuse the launch).
+  A seat that has OpenRig's activity relay in its own `settings.local.json` (the `claude-activity-hooks` runtime resource)
+  already reports activity from there, so the plugin's `activity-relay.cjs` (which the manifest starts with `--from-plugin`)
+  exits for an event the seat's settings register it for. It does so only when the entry is exactly the one OpenRig writes
+  (`node` and one quoted path to `state/claude-activity-hooks/activity-relay.cjs`) and the script at that path is this same
+  script, so a missing script, a different one at that path, or a wrapper around it never silences the plugin. A seat without
+  that resource, and a plugin installed outside OpenRig, report through the plugin's relay, so each event is reported once.
+  A relay entry written by an older install (a different path or quoting) doesn't match, so until the seat is relaunched and
+  its entry refreshed, both relays report and its events come twice. The plugin is not a Claude marketplace entry, so
+  `/plugin` has nothing to install.
+  **A Claude started inside a seat** (from its shell or its Bash tool) inherits the seat's environment, so it loads the
+  plugin too. OpenRig gives such a seat `OPENRIG_SEAT_PROJECT_DIR`, its launch project, and the plugin's seat effects (the
+  activity and session-identity posts, the compaction hooks, refocus, and the first-launch marker) run only when the Claude's
+  own `CLAUDE_PROJECT_DIR` is that folder (compared by real path). So a Claude in another project, or in a subfolder of the
+  seat's project, doesn't act as the seat, and a `cd` inside the seat's own session doesn't switch it off, because
+  `CLAUDE_PROJECT_DIR` doesn't follow a `cd`. A Claude started in the seat's own project folder is the same project and
+  still acts as the seat. A seat launched before this change has no `OPENRIG_SEAT_PROJECT_DIR` until its next launch, restore
+  or handover, and behaves as before until then.
+- **Codex CLI** — Codex has no directory option for plugins, so it does not load this plugin. A Codex seat gets only the hooks
+  the daemon writes into Codex's `config.toml` (the activity relay); `hooks/codex.json` is not read.
 
 One skill targets Claude Code's compaction behavior specifically:
 - `claude-compaction-restore` — used to rebuild a Claude Code agent's working mental model after `/compact`, from JSONL transcripts and touched files
@@ -30,7 +55,7 @@ All other skills are cross-runtime by design.
 The npm package includes an offline baseline under the daemon's
 `assets/plugins/openrig-core/`. The daemon resolves local plugin authority before
 attempting a network fetch, using the configured OpenRig home (normally
-`~/.openrig/plugins/openrig-core/` for the installed copy):
+`$OPENRIG_HOME/plugins/openrig-core/` for the installed copy):
 
 | Installed state | Local vendoring behavior |
 | --- | --- |
@@ -52,8 +77,6 @@ resolved local copy in place. A successful fetch also leaves it unchanged.
 This describes the fetch implementation, not a claim that a release artifact is
 currently available at the external repository.
 
-You can also install directly via Claude Code or Codex's own plugin commands if you prefer to manage plugins outside OpenRig.
-
 ## License
 
 Apache License 2.0. See `LICENSE`.

package/daemon/assets/plugins/openrig-core/hooks/claude.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\" --from-plugin",
             "timeout": 5
           }
         ]
@@ -26,7 +26,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\" --from-plugin",
             "timeout": 5
           }
         ]
@@ -45,7 +45,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/refocus.cjs\" --runtime claude",
-            "timeout": 5
+            "timeout": 60
           }
         ]
       }
@@ -76,7 +76,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/refocus.cjs\" --runtime claude",
-            "timeout": 5
+            "timeout": 60
           }
         ]
       }
@@ -86,7 +86,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\" --from-plugin",
             "timeout": 5
           }
         ]
@@ -96,7 +96,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/refocus.cjs\" --runtime claude",
-            "timeout": 5
+            "timeout": 60
           }
         ]
       }
@@ -106,7 +106,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/activity-relay.cjs\" --from-plugin",
             "timeout": 5
           }
         ]

package/daemon/assets/plugins/openrig-core/hooks/codex.json

@@ -26,7 +26,7 @@
           {
             "type": "command",
             "command": "node \"${PLUGIN_ROOT}/hooks/scripts/refocus.cjs\" --runtime codex",
-            "timeout": 5
+            "timeout": 60
           }
         ]
       }
@@ -48,7 +48,7 @@
           {
             "type": "command",
             "command": "node \"${PLUGIN_ROOT}/hooks/scripts/refocus.cjs\" --runtime codex",
-            "timeout": 5
+            "timeout": 60
           }
         ]
       }

package/daemon/assets/plugins/openrig-core/hooks/scripts/activity-relay.cjs

@@ -78,6 +78,7 @@ function buildOpenRigPayload(providerPayload, env = process.env, now = () => new
     generation,
     hookEvent,
     subtype,
+    turnId: firstString(providerPayload.turn_id, providerPayload.turnId),
     occurredAt: now().toISOString(),
   };
 }
@@ -205,8 +206,82 @@ function uid() {
   try { return typeof process.getuid === "function" ? String(process.getuid()) : "user"; } catch { return "user"; }
 }
 
+// OpenRig also copies this script into a seat's own settings.local.json hooks (the claude_activity_hooks resource), so a
+// seat that loads this plugin as well would post every event twice. The plugin's manifest starts the plugin's run with
+// --from-plugin; that run looks at the seat's project settings.local.json and exits only when the OpenRig copy is
+// registered there for this very event. The settings copy is started without that argument and always reports, and so does
+// a seat whose settings have no such entry (the resource is optional) or a plugin installed on its own, so a seat reports
+// each event once either way. Anything unreadable, missing or different counts as "not registered": a seat is never silent.
+const SETTINGS_RELAY_TAIL = "state/claude-activity-hooks/activity-relay.cjs";
+
+// The adapter's own test for the entry it writes (isOwnedRelayCommand): `node` and one single-quoted token, in the form
+// shellQuote produces, naming the relay copy. A wrapper that only mentions the path is not that entry. Returns the path.
+function settingsRelayPath(command) {
+  const m = /^node\s+(.+)$/.exec(command.trim());
+  const arg = m && m[1];
+  if (!arg || arg.length < 2 || !arg.startsWith("'") || !arg.endsWith("'")) return null;
+  const decoded = arg.slice(1, -1).split(`'"'"'`).join("'");
+  if ("'" + decoded.replace(/'/g, `'"'"'`) + "'" !== arg) return null;
+  return path.isAbsolute(decoded) && decoded.endsWith(`/${SETTINGS_RELAY_TAIL}`) ? decoded : null;
+}
+
+// A settings entry only silences this run if it would really report: the file it names is there and is this very script.
+// A missing script, or a different one at that path (a no-op, a stale copy from an older install), reports from the plugin.
+function isThisScript(file) {
+  try { return Buffer.compare(fs.readFileSync(file), fs.readFileSync(__filename)) === 0; } catch { return false; }
+}
+
+function settingsRelayReports(hookEvent, providerPayload, env = process.env) {
+  const projectDir = firstString(env.CLAUDE_PROJECT_DIR, providerPayload && providerPayload.cwd);
+  if (!projectDir || !hookEvent) return false;
+  try {
+    const settings = JSON.parse(fs.readFileSync(path.join(projectDir, ".claude", "settings.local.json"), "utf8"));
+    const groups = settings && settings.hooks && settings.hooks[hookEvent];
+    // A group with a matcher may not run for this event, so only an unrestricted group (no matcher, "" or "*") counts;
+    // OpenRig writes its group without one. Anything else reports, at worst twice, never not at all.
+    const unrestricted = (group) => group.matcher === undefined || group.matcher === "" || group.matcher === "*";
+    return Array.isArray(groups) && groups.some((group) => group && unrestricted(group) && Array.isArray(group.hooks)
+      && group.hooks.some((hook) => {
+        const relay = hook && typeof hook.command === "string" ? settingsRelayPath(hook.command) : null;
+        return relay !== null && isThisScript(relay);
+      }));
+  } catch {
+    return false;
+  }
+}
+
+function pluginRunIsRedundant(providerPayload, argv = process.argv, env = process.env) {
+  if (!argv.includes("--from-plugin")) return false;
+  const hookEvent = firstString(providerPayload.hookEvent, providerPayload.hookEventName, providerPayload.hook_event_name, providerPayload.event, providerPayload.eventName);
+  return settingsRelayReports(hookEvent, providerPayload, env);
+}
+
+// --- seat project boundary: keep this block identical in every script that has it ---
+// A Claude started from inside a seat (its shell, its Bash tool) inherits the seat's environment, so it loads this plugin
+// and its hooks would act as the seat. OpenRig tells the plugin the seat's launch project in OPENRIG_SEAT_PROJECT_DIR;
+// Claude's own CLAUDE_PROJECT_DIR is fixed for the life of a Claude and names the project it was started in (unlike the
+// hook payload's cwd, which follows a `cd`). The seat's effects run only when the two name the same folder. Spellings of
+// one folder (a symlink, a trailing slash, letter case on a case-insensitive disk) count as the same, and a missing
+// variable (an older or manual launch, a runtime without CLAUDE_PROJECT_DIR) leaves the hook doing what it always did.
+function runsForThisSeatsProject(env = process.env) {
+  const launch = env.OPENRIG_SEAT_PROJECT_DIR;
+  const project = env.CLAUDE_PROJECT_DIR;
+  if (!launch || !project) return true;
+  const canonical = (dir) => {
+    const absolute = path.resolve(dir);
+    // .native gives the case the disk has (plain realpathSync keeps the case the path was typed in), which is what Claude's
+    // CLAUDE_PROJECT_DIR carries on a case-insensitive filesystem such as macOS's default.
+    try { return fs.realpathSync.native(absolute); } catch { return absolute; }
+  };
+  return canonical(launch) === canonical(project);
+}
+// --- end seat project boundary ---
+
 async function main() {
+  // Before anything is read, posted or recorded: a Claude started elsewhere inside this seat is not the seat.
+  if (!runsForThisSeatsProject()) return;
   const providerPayload = parseJson(await readStdin());
+  if (pluginRunIsRedundant(providerPayload)) return;
   const payload = buildOpenRigPayload(providerPayload);
   const identityPayload = buildSessionIdentityPayload(providerPayload, process.env);
   if (identityPayload && identityPayload.resumeLaunch) {
@@ -229,4 +304,6 @@ module.exports = {
   parseJson,
   postHookPayload,
   resolveEndpoint,
+  pluginRunIsRedundant,
+  settingsRelayReports,
 };

package/daemon/assets/plugins/openrig-core/hooks/scripts/compaction-restore-bridge.cjs

@@ -177,7 +177,30 @@ function hookEventName(payload) {
   ) || "UserPromptSubmit";
 }
 
+// --- seat project boundary: keep this block identical in every script that has it ---
+// A Claude started from inside a seat (its shell, its Bash tool) inherits the seat's environment, so it loads this plugin
+// and its hooks would act as the seat. OpenRig tells the plugin the seat's launch project in OPENRIG_SEAT_PROJECT_DIR;
+// Claude's own CLAUDE_PROJECT_DIR is fixed for the life of a Claude and names the project it was started in (unlike the
+// hook payload's cwd, which follows a `cd`). The seat's effects run only when the two name the same folder. Spellings of
+// one folder (a symlink, a trailing slash, letter case on a case-insensitive disk) count as the same, and a missing
+// variable (an older or manual launch, a runtime without CLAUDE_PROJECT_DIR) leaves the hook doing what it always did.
+function runsForThisSeatsProject(env = process.env) {
+  const launch = env.OPENRIG_SEAT_PROJECT_DIR;
+  const project = env.CLAUDE_PROJECT_DIR;
+  if (!launch || !project) return true;
+  const canonical = (dir) => {
+    const absolute = path.resolve(dir);
+    // .native gives the case the disk has (plain realpathSync keeps the case the path was typed in), which is what Claude's
+    // CLAUDE_PROJECT_DIR carries on a case-insensitive filesystem such as macOS's default.
+    try { return fs.realpathSync.native(absolute); } catch { return absolute; }
+  };
+  return canonical(launch) === canonical(project);
+}
+// --- end seat project boundary ---
+
 async function main() {
+  // A Claude started elsewhere inside this seat is not the seat: leave its markers alone.
+  if (!runsForThisSeatsProject()) return;
   const payload = parseJson(await readStdin());
   const eventName = hookEventName(payload);
   const marker = findMarker(payload);

package/daemon/assets/plugins/openrig-core/hooks/scripts/refocus-health.cjs

@@ -6,7 +6,9 @@ const { spawnSync } = require("node:child_process");
 
 // One issue per failure episode, after three unsuccessful attempts. Retrying an
 // uncertain stream write uses the same id; a successful delivery starts afresh.
-function recordRefocusResult({ home, seat, identity, failed }) {
+// `deadlineMs` is when the caller must be done, counted from process start: the
+// report gets up to 1.5 s of what is left before it.
+function recordRefocusResult({ home, seat, identity, failed, deadlineMs = 4_500 }) {
   if (!seat || !identity) return;
   const key = crypto.createHash("sha256").update(JSON.stringify([seat, identity])).digest("hex");
   const file = path.join(home, "refocus", `${key}.health.json`);
@@ -26,7 +28,7 @@ function recordRefocusResult({ home, seat, identity, failed }) {
       "--hint-type", "issue", "--hint-tags", "issue,refocus",
       "--body", `Refocus failed on ${state.failures} consecutive attempts for ${seat}. Orientation remains unverified; inspect this seat's refocus hook diagnostics.`,
       "--json",
-    ], { encoding: "utf8", timeout: Math.max(1, Math.min(1_500, 4_500 - Math.floor(process.uptime() * 1_000))), maxBuffer: 64 * 1024, env: process.env });
+    ], { encoding: "utf8", timeout: Math.max(1, Math.min(1_500, deadlineMs - Math.floor(process.uptime() * 1_000))), maxBuffer: 64 * 1024, env: process.env });
     if (!result.error && result.status === 0) {
       state.reportedAt = new Date().toISOString();
       fs.writeFileSync(file, JSON.stringify(state), { mode: 0o600 });

package/daemon/assets/plugins/openrig-core/hooks/scripts/refocus.cjs

@@ -15,7 +15,28 @@ const { recordRefocusResult } = require("./refocus-health.cjs");
 
 const DEFAULT_THRESHOLD = 2_600_000;
 const FALSE_VALUES = new Set(["0", "false", "off", "no"]);
-const CONTENT_LOOKUP_TIMEOUT_MS = 2_000;
+// The issue report after a failed attempt gets this long once the attempt's lookups are done.
+const REPORT_MS = 1_500;
+// The hook's time budget. Both registrations allow this hook 60 s (hooks/claude.json, hooks/codex.json). With no budget
+// selected, every lookup keeps its fixed 2 s cap exactly as before. OPENRIG_REFOCUS_BUDGET_MS selects a longer one, up
+// to 52 s: each lookup's cap then scales with it and every lookup is also clipped to what's left of it, so a slow lookup
+// leaves an honest gap and the hook still ends well inside the outer bound.
+const DEFAULT_BUDGET_MS = 4_500;
+const MAX_BUDGET_MS = 52_000;
+const BUDGET_MS = (() => {
+  const value = Number(process.env.OPENRIG_REFOCUS_BUDGET_MS);
+  return Number.isFinite(value) && value > DEFAULT_BUDGET_MS ? Math.min(value, MAX_BUDGET_MS) : DEFAULT_BUDGET_MS;
+})();
+const SELECTED_BUDGET = BUDGET_MS !== DEFAULT_BUDGET_MS;
+const LOOKUP_CAP_MS = Math.round(2_000 * BUDGET_MS / DEFAULT_BUDGET_MS);
+const CONTENT_LOOKUP_TIMEOUT_MS = LOOKUP_CAP_MS;
+// With a selected budget, a lookup with less than this left is skipped and reported as a gap rather than started.
+const MIN_LOOKUP_MS = 250;
+const budgetLeftMs = () => Math.floor(BUDGET_MS - process.uptime() * 1_000);
+const contentReserveMs = () => (process.env.OPENRIG_REFOCUS_CONTENT_REF ? CONTENT_LOOKUP_TIMEOUT_MS : 0);
+// A lookup's timeout: its fixed cap by default; with a selected budget, its cap or what's left of the budget after the
+// later lookups' reserve, whichever is less.
+const lookupTimeout = (reserve = 0) => SELECTED_BUDGET ? Math.min(LOOKUP_CAP_MS, budgetLeftMs() - reserve) : LOOKUP_CAP_MS;
 // Normal managed restore advances on ~30 s polls with a 10 s idle wait.
 // A lost daemon stage must not suppress this occupant's refocus indefinitely.
 const MANAGED_RESTORE_HOLD_MS = 10 * 60_000;
@@ -46,10 +67,12 @@ const readStdin = () => new Promise((resolve) => {
 function readConfiguredContent(home) {
   const contentRef = process.env.OPENRIG_REFOCUS_CONTENT_REF || "";
   if (contentRef) {
+    const timeout = lookupTimeout();
+    if (timeout <= MIN_LOOKUP_MS) return { content: null, contentRef, failure: "no time left in the refocus budget" };
     const result = spawnSync("rig", ["context", "get", contentRef], {
       encoding: "utf8",
       env: process.env,
-      timeout: CONTENT_LOOKUP_TIMEOUT_MS,
+      timeout,
       maxBuffer: 16 * 1024 * 1024,
     });
     if (!result.error && result.status === 0 && result.stdout.trim()) {
@@ -109,7 +132,8 @@ function workPacketEnabled() {
   return enabled(process.env.OPENRIG_REFOCUS_WORK_PACKET, false);
 }
 
-function readQueueWhoami(timeout = 2_000) {
+function readQueueWhoami(timeout = lookupTimeout()) {
+  if (timeout <= MIN_LOOKUP_MS) return { unknown: "no time left in the refocus budget" };
   const args = ["queue", "whoami", "--json", ...(workPacketEnabled() ? ["--work-candidates"] : [])];
   let result = spawnSync("rig", args, {
     encoding: "utf8", env: process.env, timeout, maxBuffer: 16 * 1024 * 1024,
@@ -147,7 +171,7 @@ function deriveWorkStart(lookup) {
 // retrying here would spend the same budget twice and cannot make absence trustworthy.
 function remainingLookupBudget() {
   const contentReserve = process.env.OPENRIG_REFOCUS_CONTENT_REF ? CONTENT_LOOKUP_TIMEOUT_MS : 0;
-  return Math.floor(Math.min(2_000, 4_500 - 2_000 - contentReserve - process.uptime() * 1_000));
+  return Math.floor(Math.min(LOOKUP_CAP_MS, BUDGET_MS - LOOKUP_CAP_MS - contentReserve - process.uptime() * 1_000));
 }
 
 function renderRole(result) {
@@ -175,10 +199,9 @@ function renderRole(result) {
 // read; a failed, malformed or skipped read sets nothing, so the script's own lookup runs
 // exactly as before. Only the two root fields are consumed and nothing from the config is logged.
 //
-// Both harnesses kill this hook at 5 s (hooks/claude.json, hooks/codex.json). The read gets only
-// what is left of a 4.5 s budget, counted from process start, after reserving python's 2 s and,
-// when a content ref is configured, the content lookup that runs after python; with 250 ms or
-// less left it is skipped, so the read never pushes a fire main would deliver past the kill.
+// The read gets only what is left of the hook's budget (4.5 s by default), counted from process
+// start, after reserving python's cap and, when a content ref is configured, the content lookup
+// that runs after python; with 250 ms or less left it is skipped.
 function traceEnv(trees) {
   const env = { ...process.env };
   const missing = [
@@ -249,13 +272,17 @@ function renderTrace() {
   else if (work.unknown) args.push("--work-unknown", work.unknown);
   // With an explicit start, the evidence supplies only held and next work.
   if (explicitStart && evidence) args.push("--work-candidates", "-");
-  const result = spawnSync(process.env.PYTHON || "python3", args, {
-    encoding: "utf8",
-    ...(evidence ? { input: evidence } : {}),
-    env: traceEnv(trees),
-    timeout: 2_000,
-    maxBuffer: 16 * 1024 * 1024,
-  });
+  const env = traceEnv(trees);
+  const timeout = lookupTimeout(contentReserveMs());
+  const result = timeout <= MIN_LOOKUP_MS
+    ? { error: new Error("no time left in the refocus budget"), status: null, stdout: "", stderr: "" }
+    : spawnSync(process.env.PYTHON || "python3", args, {
+      encoding: "utf8",
+      ...(evidence ? { input: evidence } : {}),
+      env,
+      timeout,
+      maxBuffer: 16 * 1024 * 1024,
+    });
   const reason = result.error?.message || result.stderr?.trim() || `trace exited ${result.status ?? "without a status"}`;
   const failed = Boolean(result.error) || result.status !== 0 || !result.stdout?.trim();
   const trace = [
@@ -268,8 +295,31 @@ function renderTrace() {
   };
 }
 
+// --- seat project boundary: keep this block identical in every script that has it ---
+// A Claude started from inside a seat (its shell, its Bash tool) inherits the seat's environment, so it loads this plugin
+// and its hooks would act as the seat. OpenRig tells the plugin the seat's launch project in OPENRIG_SEAT_PROJECT_DIR;
+// Claude's own CLAUDE_PROJECT_DIR is fixed for the life of a Claude and names the project it was started in (unlike the
+// hook payload's cwd, which follows a `cd`). The seat's effects run only when the two name the same folder. Spellings of
+// one folder (a symlink, a trailing slash, letter case on a case-insensitive disk) count as the same, and a missing
+// variable (an older or manual launch, a runtime without CLAUDE_PROJECT_DIR) leaves the hook doing what it always did.
+function runsForThisSeatsProject(env = process.env) {
+  const launch = env.OPENRIG_SEAT_PROJECT_DIR;
+  const project = env.CLAUDE_PROJECT_DIR;
+  if (!launch || !project) return true;
+  const canonical = (dir) => {
+    const absolute = path.resolve(dir);
+    // .native gives the case the disk has (plain realpathSync keeps the case the path was typed in), which is what Claude's
+    // CLAUDE_PROJECT_DIR carries on a case-insensitive filesystem such as macOS's default.
+    try { return fs.realpathSync.native(absolute); } catch { return absolute; }
+  };
+  return canonical(launch) === canonical(project);
+}
+// --- end seat project boundary ---
+
 (async () => {
   if (!enabled(process.env.OPENRIG_REFOCUS_ENABLED)) process.exit(0);
+  // A Claude started elsewhere inside this seat is not the seat: no state, no refocus.
+  if (!runsForThisSeatsProject()) process.exit(0);
 
   let input = {};
   try { input = JSON.parse((await readStdin()) || "{}") || {}; } catch {}
@@ -481,7 +531,10 @@ function renderTrace() {
     },
   });
   process.stdout.write(output, (error) => {
-    recordRefocusResult({ home, seat, identity, failed: failed || Boolean(error) });
+    // The report gets its own window after the attempt's lookups, however long they actually took (default lookups keep
+    // their fixed caps, so a default attempt can run past its 4.5 s budget).
+    recordRefocusResult({ home, seat, identity, failed: failed || Boolean(error),
+      deadlineMs: Math.max(BUDGET_MS, Math.floor(process.uptime() * 1_000)) + REPORT_MS });
     if (failed || error) {
       state.pendingOn ||= event;
       state.pendingAt ||= new Date().toISOString();

package/daemon/assets/plugins/openrig-core/skills/claude-compaction-restore/scripts/precompact-hook.mjs

@@ -222,6 +222,30 @@ function buildSystemMessage(restoreInstruction, customMessage) {
   return `${restoreInstruction}\n\n--- Operator-configured post-compaction restore instruction ---\n${customMessage}`;
 }
 
+// --- seat project boundary: keep this block identical in every script that has it ---
+// A Claude started from inside a seat (its shell, its Bash tool) inherits the seat's environment, so it loads this plugin
+// and its hooks would act as the seat. OpenRig tells the plugin the seat's launch project in OPENRIG_SEAT_PROJECT_DIR;
+// Claude's own CLAUDE_PROJECT_DIR is fixed for the life of a Claude and names the project it was started in (unlike the
+// hook payload's cwd, which follows a `cd`). The seat's effects run only when the two name the same folder. Spellings of
+// one folder (a symlink, a trailing slash, letter case on a case-insensitive disk) count as the same, and a missing
+// variable (an older or manual launch, a runtime without CLAUDE_PROJECT_DIR) leaves the hook doing what it always did.
+function runsForThisSeatsProject(env = process.env) {
+  const launch = env.OPENRIG_SEAT_PROJECT_DIR;
+  const project = env.CLAUDE_PROJECT_DIR;
+  if (!launch || !project) return true;
+  const canonical = (dir) => {
+    const absolute = path.resolve(dir);
+    // .native gives the case the disk has (plain realpathSync keeps the case the path was typed in), which is what Claude's
+    // CLAUDE_PROJECT_DIR carries on a case-insensitive filesystem such as macOS's default.
+    try { return fs.realpathSync.native(absolute); } catch { return absolute; }
+  };
+  return canonical(launch) === canonical(project);
+}
+// --- end seat project boundary ---
+
+// A Claude started elsewhere inside this seat is not the seat: no packet, no marker.
+if (!runsForThisSeatsProject()) process.exit(0);
+
 try {
   // Slice 51-01 RIDER (leak-visibility, review-r1 escalation): OPENRIG_TEST_CLOCK_NOW is
   // read by nowIso() to make createdAt deterministic in tests — but a LEAKED var in a

package/daemon/assets/plugins/openrig-core/skills/delegating-work/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: delegating-work
-description: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams abandon subagents."
+description: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams abandon subagents."
 metadata:
   openrig:
     stage: field-captured
@@ -36,11 +36,31 @@ Before delegating to a blank slate, ask: **would a wrong-but-plausible answer he
 ## It generalizes
 This is really **"route work to whoever holds the context,"** with subagents as the option for work that needs none. The audience is **every agent** — implementers and QA seats make this call as much as orchestrators do.
 
+## Check what kind of agent you're handing it to
+How to brief another agent depends on the model it runs, so check before you hand over anything open-ended.
+`rig ps --nodes --json` shows the model each seat's spec declares (`model`; `null` if none is declared). A declared
+model can differ from the one running, so if it's null, or you aren't sure, ask the seat which model it's running.
+
+- **Goal-oriented models** are built to take a goal and find the route themselves. Today that's Claude Opus 5.5 or
+  newer and any Fable model, and Codex models at the Sol level or above from GPT-5.6 on (GPT-5.6-Sol, GPT-6-Sol,
+  GPT-6.1-Sol, GPT-6-Astra). Give them the goal, why it matters, what good looks like, the requirements and the
+  context, then let them work. Spell out the route only where those details really matter.
+- **Every other model, and any model you can't identify,** does its best work on smaller, simpler pieces with clear
+  steps, clear boundaries and a result you can check. Split open-ended work before you hand it over, or keep the
+  open-ended part yourself.
+
+Describe the task, not the agent: don't tell a model which group it's in, or call it weaker. A model can take a
+label like that literally and work down to it. A newer model in a family above (a later Opus, Fable, or Codex Sol or
+Astra) belongs with the goal-oriented group. A model the lines above can't place, such as a new family or an unfamiliar
+tier, starts in the second group until you know where it sits; its maker's own description (frontier or workhorse,
+versus balanced, fast or affordable) is a good first signal.
+
 ## Hand over intent, not instructions
-Whoever does the work, give them the goal, why it matters, the context you hold and where to find more, then let
-them decide how. When you have the requester's own words, pass them on instead of compressing them into a list of
-steps. A capable agent with the goal builds better than one painting inside a narrow spec, which gets exactly what
-was written and not what was wanted. Keep exact instructions for the few things that must be exact, and say why.
+Whoever does the work, give them the goal, why it matters, the context you hold and where to find more. When you have
+the requester's own words, pass them on instead of compressing them into a list of steps. A goal-oriented model builds
+better from that than from a narrow spec, which gets exactly what was written and not what was wanted, so let it
+decide how; don't pre-do its research or fence what it may conclude. For other models, add the steps and boundaries
+the work needs, a piece at a time. Keep exact instructions for the few things that must be exact, and say why.
 
 ## Once you've decided
 - Decided on subagents for 2+ independent tasks → `dispatching-parallel-agents` (the fan-out mechanics).

package/daemon/assets/plugins/openrig-core/skills/forming-an-openrig-mental-model/SKILL.md

@@ -117,7 +117,9 @@ read only the pieces a task needs.
 
 The session-name format `{pod}-{member}@{rig}` is your address. When you
 run `rig whoami --json`, you get back your full topology context: rig name,
-pod, member, peers, edges, transcript path.
+pod, member, peers, edges, transcript path. With `output.compact` enabled,
+a large rig's peer list can be a bounded, edge-first selection: `peersNote`
+then says how many are not shown; `rig whoami --json --all-peers` lists them all.
 
 ---
 
@@ -232,7 +234,7 @@ OpenRig has a few load-bearing cultural principles. Internalize these:
 If you're booting into a new seat in an OpenRig rig:
 
 1. **`rig whoami --json`** — recover identity. Know your rig, pod, member,
-   peers.
+   peers (`--all-peers` when `peersNote` says some are not shown).
 2. **Read your role guidance** — typically delivered via startup files.
    `guidance/role.md` for your specific seat.
 3. **Read the rig's `CULTURE.md`** if it has one — the team operating