@openrig/cli 0.6.13 → 0.6.14

package/README.md

@@ -8,25 +8,71 @@ OpenRig is open-source software for building and running your own network of age
 
 It's the open-source system behind my AI civilization experiments.
 
-**Guide:** [Getting started](docs/reference/getting-started.md) · **Stuck?** [Help](docs/reference/help.md) · **Questions:** [Q&A](https://github.com/mvschwarz/openrig/discussions/92) · **Updates and demos:** [@_feralmachine on X](https://x.com/_feralmachine)
+**Guide:** [Getting started](docs/reference/quickstart.md) · **Stuck?** [Help](docs/reference/help.md) · **Questions:** [Q&A](https://github.com/mvschwarz/openrig/discussions/92) · **Updates and demos:** [@_feralmachine on X](https://x.com/_feralmachine)
 
 ## See it running
 
 ![The OpenRig TUI: the build rig as a graph, then as a table of seats with runtime, model, context and state, then one seat in detail (real recording, 10 seconds)](assets/readme/openrig-agents-working.gif)
 
-**Start here:** [the guided first-use path](docs/reference/getting-started.md): install, talk to the kernel operator, then choose a team for your first useful change.
+**Start here:** [the guided first-use path](docs/reference/quickstart.md): install, talk to the kernel operator, then choose a team for your first useful change.
 
 Not setting this up today? Get the next walkthrough and occasional OpenRig updates → https://openrig.dev/follow
 
 ## Install and first run
 
-Requires Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude Code or Codex account: one is enough, since the kernel operator adapts the shipped `starter` team to whichever you have. On Linux, the distribution's own Node.js can be older (Ubuntu 24.04's is 18); install a supported version with [nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource. On a Mac with Apple silicon, use Node.js 22 ([compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation)). On a Mac where you aren't an administrator, or where Homebrew belongs to another account (its `brew install` is refused), install Node.js in your own home folder with [nvm](https://github.com/nvm-sh/nvm): run `touch ~/.zshrc` (a new Mac account has none, and nvm's installer only adds itself to a profile file that already exists), then the install command on nvm's page, open a new terminal, and run `nvm install 22`. That needs no administrator password, and `npm install -g` then installs into your nvm folder. On Windows, use WSL2, the Windows route OpenRig supports; native Windows isn't supported. OpenRig's automated tests don't run on WSL2 yet; see [one user's working setup](docs/reference/getting-started.md#wsl2-a-reported-working-setup). Launching a rig writes provider hooks and workspace trust settings. Before running the commands below, read [what OpenRig changes on your machine](#what-openrig-changes-on-your-machine) and back up the relevant files.
+**Let your coding agent set it up.** First check that `node --version` shows 22 or 24: the command below needs
+Node.js and the `npx` that comes with it. Then, in your project folder, add OpenRig's `rigs` skill to the agent you
+use:
 
-**One command.** This runs OpenRig's install script from the `v0.6.13` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
+```sh
+# Claude Code
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.6.14/skills/rigs --skill rigs --agent claude-code
+# Codex
+npx skills add https://github.com/mvschwarz/openrig/tree/v0.6.14/skills/rigs --skill rigs --agent codex
+```
+
+Then type `/rigs` in Claude Code, or `$rigs` in Codex, and say what you want built. The skill has your agent tell
+you what it will run and change before it does, install OpenRig, open the OpenRig view and pass your goal to
+OpenRig's operator.
+
+You need Node.js 22 or 24 (22 on Apple silicon), tmux, macOS or Linux (WSL2 on Windows), and Claude Code or Codex
+signed in. One provider is enough to start.
+
+Already have OpenRig? Use the tag that matches `rig --version`, or upgrade first.
+
+Prefer to type the commands yourself? [Install it yourself ↓](#install-it-yourself)
+
+Requires Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude Code or Codex account: one is enough, since the kernel operator adapts the shipped `starter` team to whichever you have. On Linux, the distribution's own Node.js can be older (Ubuntu 24.04's is 18); install a supported version with [nvm](https://github.com/nvm-sh/nvm) (`nvm install 22`) or NodeSource. On a Mac with Apple silicon, use Node.js 22 ([compatibility history](docs/releases/v0.5.15.md#known-compatibility-limitation)). On a Mac where you aren't an administrator, or where Homebrew belongs to another account (its `brew install` is refused), install Node.js in your own home folder with [nvm](https://github.com/nvm-sh/nvm): run `touch ~/.zshrc` (a new Mac account has none, and nvm's installer only adds itself to a profile file that already exists), then the install command on nvm's page, open a new terminal, and run `nvm install 22`. That needs no administrator password, and `npm install -g` then installs into your nvm folder. On Windows, use WSL2, the Windows route OpenRig supports; native Windows isn't supported. OpenRig's automated tests don't run on WSL2 yet; see [one user's working setup](docs/reference/getting-started.md#wsl2-a-reported-working-setup).
+
+> **What OpenRig changes on your machine**
+> - **Install:** `@openrig/cli` goes in globally with npm.
+> - **Setup:** `rig setup` adds an OpenRig block to `~/.tmux.conf`. It can install tmux (with Homebrew on macOS), and
+>   Herdr unless you pass `--no-herdr`. Plain `rig setup`, which is what the one-command install runs, checks both
+>   Claude Code and Codex and may install a missing one; `rig setup --providers claude` (or `codex`) limits it to
+>   yours.
+> - **Starting OpenRig, for the coding agent you use** (paths are the usual defaults):
+>   - Codex: hooks and trust in `~/.codex/config.toml`.
+>   - Claude Code: workspace trust in `~/.claude.json`, and activity hooks in the project's
+>     `.claude/settings.local.json`, plus a status line unless you already have your own.
+>   - Discovery skills go in `~/.claude/skills` and `~/.agents/skills`.
+> - **Starting a team in your project:** adds managed guidance to `AGENTS.md` or `CLAUDE.md`, plus the team's skills
+>   and plugins.
+> - **Permissions:** by default, OpenRig's own kernel gets broader permissions than a project team gets by default.
+>   On Codex that's full access with no approval prompts (`-s danger-full-access -a never`). On Claude Code, its file
+>   tools, web fetches and operational commands, including reads under your home folder, run without asking. A
+>   permission policy, per-agent choice or Codex profile changes that. What your team can do depends on the team you
+>   choose and your settings; `workshop`, for example, ships with broad access.
+> - **Backups:** OpenRig doesn't guarantee it can preserve or roll back these files, so back them up first.
+>
+> [Everything OpenRig writes, and why →](https://github.com/mvschwarz/openrig#what-openrig-changes-on-your-machine)
+
+### Install it yourself
+
+This runs OpenRig's install script from the `v0.6.14` release. It checks Node.js and npm, installs the latest published `@openrig/cli` with `npm install -g`, runs the Node.js and SQLite check, then runs `rig setup --dry-run` and `rig setup`. The first line prints that plan and changes nothing:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh -s -- --dry-run
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.14/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.14/scripts/install.sh | sh
 ```
 
 If `rig setup` doesn't finish ready, for example because a provider isn't signed in yet, the script ends with `INSTALLED, SETUP NOT COMPLETE`: the CLI is installed, and `rig setup` lists what's left under "Some steps need attention". If the only items left are provider sign-ins, sign in to each selected provider as below and continue; run `rig setup` again rather than reinstalling the CLI.
@@ -342,6 +388,8 @@ For cmux, use `--provider cmux`. In the TUI, a rig's detail view has an `Open te
 
 ## Key Concepts
 
+The first words you meet, in plain language: [What these words mean](docs/reference/quickstart.md#what-these-words-mean).
+
 - **RigSpec**: Declarative multi-agent harness definition in YAML. Pods, members, edges, continuity policies, culture file.
 - **AgentSpec**: Reusable agent blueprint with skills, guidance, hooks, profiles, and startup contracts.
 - **Seat**: A stable role and address in a rig, such as `dev-build@starter`. The conversation occupying it can change while its identity and authored context remain.

package/daemon/assets/plugins/openrig-core/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig-core",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "OpenRig canonical skills and hooks for cross-runtime agent topology coordination, continuity, and operating discipline.",
   "author": {
     "name": "Mike Schwarz",

package/daemon/assets/plugins/openrig-core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig-core",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "OpenRig canonical skills and hooks for cross-runtime agent topology coordination, continuity, and operating discipline.",
   "author": {
     "name": "Mike Schwarz",

package/daemon/assets/plugins/openrig-core/skills/openrig-user/SKILL.md

@@ -384,11 +384,19 @@ rig reconcile-session <session>
 rig reconcile-session <session> --rig <rigId> --node <logicalId>
 rig reconcile-session <session> --no-launch
 rig reconcile-session <session> --json
+rig reconcile-session <session> --repair-missing-pane --no-launch
 ```
 
-This is a no-launch, no-input adopt. `--rig`/`--node` disambiguate when the
-canonical session name does not uniquely resolve. `--no-launch` is accepted
-for explicitness (it is the only mode this command has).
+This is a no-launch, no-input adopt: it records a new claimed session row for
+the seat (any running row is superseded); it re-captures the resume token if
+it can, and conversation continuity stays unverified. `--rig`/`--node`
+disambiguate when the canonical session name does not uniquely resolve.
+`--no-launch` is accepted for explicitness.
+
+`--repair-missing-pane --no-launch` is different: for a running launched seat
+whose tmux pane was never recorded, it fills in the pane and keeps the
+session, resume token and generation. It never adopts. Both forms refuse
+while the seat's typing protection is on.
 
 ### Five-term restore status vocabulary
 

package/daemon/assets/plugins/openrig-core/skills/refocusing/scripts/trace-to-root.py

@@ -75,39 +75,19 @@ def read(path):
         return None
 
 
+# Contract twin of CLI scope-fs.ts and daemon scope/node-file.ts; parity is tested.
+NOTES_FILE_PRECEDENCE = ("NOTES.md", "MISSION_NOTES.md")
+
+
 def resolve_notes(node):
-    try:
-        result = subprocess.run(
-            ["rig", "scope", "resolve-notes", str(node), "--json"],
-            capture_output=True,
-            text=True,
-            timeout=10,
-            check=False,
-        )
-    except subprocess.TimeoutExpired:
-        return None, "resolver command timed out"
-    except OSError as error:
-        return None, f"resolver command could not start: {error}"
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip().splitlines()
-        suffix = f": {detail[0]}" if detail else ""
-        return None, f"resolver command exited {result.returncode}{suffix}"
-    try:
-        payload = json.loads(result.stdout)
-    except (json.JSONDecodeError, TypeError):
-        return None, "resolver command returned malformed JSON"
-    if not isinstance(payload, dict) or payload.get("ok") is not True or "resolution" not in payload:
-        return None, "resolver command returned an invalid success shape"
-    resolution = payload["resolution"]
-    if resolution is None:
-        return None, None
-    if not isinstance(resolution, dict):
-        return None, "resolver command returned an invalid resolution shape"
-    resolved_path = resolution.get("path")
-    resolved_name = resolution.get("name")
-    if not isinstance(resolved_path, str) or not isinstance(resolved_name, str):
-        return None, "resolver command returned an invalid resolution shape"
-    return (Path(resolved_path), resolved_name), None
+    for name in NOTES_FILE_PRECEDENCE:
+        candidate = node / name
+        try:
+            if candidate.is_file() and os.access(candidate, os.R_OK):
+                return (candidate, name), None
+        except OSError:
+            pass
+    return None, None
 
 
 def intent(text):

package/daemon/context-packs/help/manifest.yaml

@@ -1,6 +1,6 @@
 # Agent help: the single troubleshooting and escalation guide (docs/reference/help.md).
 name: help
-version: "0.6.13"
+version: "0.6.14"
 taxonomy: world
 purpose: "What an agent does when its user says OpenRig isn't working: diagnose, fix within permissions, verify, and escalate to OpenRig support."
 files:

package/daemon/context-packs/onboarding-width/manifest.yaml

@@ -1,6 +1,6 @@
 # Public capability and source-map width for the default onboarding walk.
 name: onboarding-width
-version: "0.6.13"
+version: "0.6.14"
 taxonomy: world
 purpose: "The public capability map and source map referenced by the default onboarding walk."
 files:

package/daemon/context-packs/onboarding-width/public-what-you-can-do.md

@@ -11,7 +11,7 @@ not know exists.** So the point of what follows is not skill. It is recognition:
 lands, something rhymes, and you go check instead of building.
 
 Eighty-eight top-level verbs ship (capability canon refreshed through
-`capability-delta-v0.6.13`). This marker describes the pack's teaching, not publication or live
+`capability-delta-v0.6.14`). This marker describes the pack's teaching, not publication or live
 adoption. Read this once for shape, and let it make you suspicious that a thing already exists.
 Model-divergence proclamations are live product (trust them; pins use canonical
 model IDs).
@@ -135,7 +135,8 @@ unseen — which makes messages the one delivery channel that never gets skipped
   read something, do not ask it. Look.**
 - **`rig ask`** — search what was said or decided, across *every generation that ever sat in a
   seat*. It reaches back past a handover that erased your predecessor's context, and costs no
-  runtime tokens.
+  runtime tokens. `--wake` asks a Claude or Codex seat itself; any other runtime (Pi, custom, or
+  none recorded) is refused before a wake starts.
 - **`rig chatroom wait`** — block until a peer actually says something, instead of polling
   `capture` in a loop. Also `history`, `watch`, `topic` for a named thread that stays retrievable.
   Its `--timeout` is in seconds and ignores a suffix, so `2m` means 2 seconds. Poll timeouts,
@@ -460,7 +461,12 @@ not have to tear one down to change it, and you rarely have to start from nothin
   to a node. **`rig adopt`** does the whole thing at once: create the structure and bind the
   running sessions into it.
 - **`rig reconcile-session`** — you resumed a seat by hand and the daemon still shows it down; make
-  the system see the live process **without launching anything**.
+  the system see the live process **without launching anything**. A running seat that refuses every
+  send because its tmux pane was never recorded (one launched by an older OpenRig) takes
+  `rig reconcile-session <seat> --repair-missing-pane --no-launch`: it fills only the missing pane,
+  keeps the session and resume token, never adopts, and refuses while typing protection is on.
+  Plain reconcile adopts the seat into a new session without its resume token; use the repair even
+  where a protected seat's compaction refusal still suggests plain reconcile.
 - **`rig unclaim` / `rig release`** — stop managing one adopted session, or all of them,
   **without killing the process or the agent inside it**. Handing something back to its human is a
   first-class move, not an abandonment.
@@ -487,6 +493,7 @@ version, from checking the environment to a useful report to the OpenRig team.
   Stop distinguishes process/listener exit from a clean asynchronous drain: inspect the matching
   `daemon-shutdown.json` and log when completion is incomplete or unverified. No target is a
   distinct no-op, and a timeout never proves down. Use command help for exact limits and recovery.
+  `/healthz` reports the daemon's effective UID as `euid`, beside `pid`.
 - **`rig doctor`** — is the *installation* wired up correctly, or are you chasing a bug that is
   really a broken install. It checks Claude and Codex installs, and a login or configured provider
   credential, the way setup does; it fails for a harness the person doesn't use, which they can
@@ -590,7 +597,9 @@ version, from checking the environment to a useful report to the OpenRig team.
 - **`rig compact-plan`** → **`rig compact`** — who is near the context wall, then act on it.
   **Ordering matters: running `compact` without the plan is guessing which seat needed it.**
   Managed compaction waits for the seat's restore map before compacting; `rig compact --state`,
-  `--cancel` and `--skip-map` inspect, stop or skip that wait. The `claude-compaction-restore`
+  `--cancel` and `--skip-map` inspect, stop or skip that wait. If preparation stops at an ordinary
+  approval, a manual `rig compact` keeps waiting for someone to answer it, within its 180-second
+  budget; OpenRig never answers it, and the request times out after 240 seconds. The `claude-compaction-restore`
   skill covers writing and reading the map; `claude-compact-in-place` no longer ships. After a
   managed compaction, refocus waits for the restore request, which names the `refocusing` skill
   (the daemon installs it globally); three failed refocus attempts in a row for one occupant post
@@ -840,7 +849,10 @@ your circumstances is configuration, and the ones that are not, another agent ca
 - **`rig config get` / `reset` / `init-workspace`** — read one value, change a system-wide setting
   and put it back exactly as it was, or additively lay down the canonical project scaffold on a
   box that has none. Instance startup uses the same additive initializer for the surrounding
-  `state`, `context`, `skills`, `topology`, and operational roots.
+  `state`, `context`, `skills`, `topology`, and operational roots. With `transport.local_user_guard`
+  on (off by default; `rig config set transport.local_user_guard true`), a Mac's local `rig` requests
+  stop only when the daemon's reported, `ps`-corroborated user differs from yours; unknown evidence
+  lets the call through. It isn't authentication or isolation.
 - **`rig policy permissions list` / `show` / `current` / `apply`** — what permission policy is
   actually in effect: discovers custom policy specs, validates refs (malformed can never read as
   valid OR absent), shows what would apply. The older `rig policy list|show|current|apply` forms

package/daemon/context-packs/reference/getting-started.md

@@ -1,20 +1,66 @@
-# Getting started: meet the kernel, then make one useful change
-
-Install OpenRig, use a working provider login, and meet the kernel operator with
-the advisor and TUI beside it. No starter team is needed to reach that view.
-Tell the operator what you want to do, then choose a project team for a bounded
-change you can exercise. Reuse the accounts and terminal tools you already have.
-
-After installation and sign-in, your agent opens the **OpenRig TUI and operator** for you. The path is `rig daemon start` (if stopped),
-then `rig terminal open saved:kernel --window`. The second command opens the
-desktop window itself. An agent can run it from its shell on the daemon's
-desktop; it does not need to type into your current terminal. See
-[Open the kernel conversations](#open-the-kernel-conversations).
-`rig tui` is the team dashboard; installation ends when you are talking to the
-operator in the OpenRig view.
+# OpenRig setup reference
+
+This is the full reference for installing and running OpenRig, written for the agent doing the setup and for anyone
+who wants the detail. The short version for people is [Getting started](quickstart.md).
+
+## For the agent doing the setup
+
+The `rigs` skill is the procedure: follow it in order. This page is what it looks things up in.
+
+- **Done** means the person is talking to the operator in a visible OpenRig view. A healthy daemon, a started kernel
+  or an opened window isn't done on its own. If they'd rather talk later, the handoff is still pending: say so, and
+  leave them the exact command.
+- **Read readiness; don't assume it:**
+  - **The kernel:** the `Kernel:` line in `rig status`, and `rig ps --nodes --rig kernel`.
+  - **A team:** `rig ps --nodes --rig <team>`.
+  - A missing or unknown signal isn't ready.
+  - `rig up` exiting 1 with `Status: partial` and `Startup attention` means a seat is waiting at a prompt. Answer it,
+    or ask the person to, then run the `rig seat continue <seat>` it names.
+- **Prerequisites:** check the person's existing toolchain first (mise, nvm, Homebrew or the nodejs.org installer)
+  and the PATH. Use what's there. Don't change a shared Homebrew's ownership, and don't make a local workaround the
+  standard route. If Node.js is installed after your session started, check that new shells and the session's hooks
+  can find it. In one published-0.6.11 Mac run, OpenRig's Claude hooks reported `node: command not found` until the
+  PATH was fixed.
+- **Ask once, then reuse the answer:** the provider (Claude Code, Codex or both), Herdr, Ghostty on macOS,
+  remembered command allowances, and the team.
+- **Before changing their machine:** say what applies to their route, then wait for a yes. See
+  [what OpenRig changes on your machine](../../README.md#what-openrig-changes-on-your-machine).
+- **When something stops:**
+  - [Incomplete setup and restart](#incomplete-setup-and-restart) maps what you see to the next action.
+  - [What can interrupt installation and the OpenRig view](#what-can-interrupt-installation-and-the-openrig-view)
+    covers the view.
+  - [Headless or SSH handoff](#headless-or-ssh-handoff) covers no-display cases.
+  - A timed-out command may still have taken effect. Read `rig ps` or `rig seat status <seat>` before you run it
+    again.
+- **Don't:**
+  - relaunch a team to reopen its view;
+  - start another seat to clear a prompt;
+  - build the person's project yourself. Give the goal to the operator.
 
 ## Before you start
 
+> **What OpenRig changes on your machine**
+> - **Install:** `@openrig/cli` goes in globally with npm.
+> - **Setup:** `rig setup` adds an OpenRig block to `~/.tmux.conf`. It can install tmux (with Homebrew on macOS), and
+>   Herdr unless you pass `--no-herdr`. Plain `rig setup`, which is what the one-command install runs, checks both
+>   Claude Code and Codex and may install a missing one; `rig setup --providers claude` (or `codex`) limits it to
+>   yours.
+> - **Starting OpenRig, for the coding agent you use** (paths are the usual defaults):
+>   - Codex: hooks and trust in `~/.codex/config.toml`.
+>   - Claude Code: workspace trust in `~/.claude.json`, and activity hooks in the project's
+>     `.claude/settings.local.json`, plus a status line unless you already have your own.
+>   - Discovery skills go in `~/.claude/skills` and `~/.agents/skills`.
+> - **Starting a team in your project:** adds managed guidance to `AGENTS.md` or `CLAUDE.md`, plus the team's skills
+>   and plugins.
+> - **Permissions:** by default, OpenRig's own kernel gets broader permissions than a project team gets by default.
+>   On Codex that's full access with no approval prompts (`-s danger-full-access -a never`). On Claude Code, its file
+>   tools, web fetches and operational commands, including reads under your home folder, run without asking. A
+>   permission policy, per-agent choice or Codex profile changes that. What your team can do depends on the team you
+>   choose and your settings; `workshop`, for example, ships with broad access.
+> - **Backups:** OpenRig doesn't guarantee it can preserve or roll back these files, so back them up first.
+>
+> [Everything OpenRig writes, and why →](https://github.com/mvschwarz/openrig#what-openrig-changes-on-your-machine)
+
 You need Node.js 22 or 24 and tmux, on macOS or Linux, and one working Claude
 Code or Codex account: one is enough, since the kernel operator adapts the
 shipped `starter` team to whichever you have. On Linux, the distribution's own
@@ -131,11 +177,11 @@ You can also read [`skills/rigs/SKILL.md`](../../skills/rigs/SKILL.md) directly.
 script will do and changes nothing:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh -s -- --dry-run
+curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.14/scripts/install.sh | sh -s -- --dry-run
 ```
 
 The same command without `--dry-run`,
-`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.13/scripts/install.sh | sh`, installs the
+`curl -fsSL https://raw.githubusercontent.com/mvschwarz/openrig/v0.6.14/scripts/install.sh | sh`, installs the
 latest published `@openrig/cli` with `npm install -g`,
 runs the Node.js and SQLite check, then `rig setup --dry-run` and `rig setup`. `rig setup` checks both Claude Code and
 Codex and may install a missing one, as described below. A failed step among the first three prints
@@ -995,6 +1041,37 @@ same-seat stop/resume path after checking its retained policy; do not erase the
 rig or start a duplicate to reset permissions. A resume can reapply the stored
 launch mode, so verify the native mode again before continuing work.
 
+## Optional Mac local-user check
+
+On a Mac shared by multiple OS accounts, `transport.local_user_guard` can reduce
+accidental CLI routing to another account's local daemon. It is **off by default**.
+Enable it with `rig config set transport.local_user_guard true`, or set
+`OPENRIG_TRANSPORT_LOCAL_USER_GUARD=true` in the CLI's environment. Set it to
+`false` to turn it off; no daemon restart is needed for the CLI check.
+
+When enabled, automatic local CLI data requests compare the daemon's reported
+`/healthz` PID and effective UID (`euid`) with two `ps` UID/start observations and
+a second health response, with at most one second of observation per check.
+Only stable agreement on a foreign effective UID stops the request. This does
+not require visibility into another user's socket descriptors. It does not
+stop the daemon, choose another port or retry. Diagnostic health/status checks
+remain available. Older daemons without `euid` remain unknown and are permitted.
+`sudo rig …` uses the caller's **effective** UID, so an enabled check against a
+user-owned daemon refuses when its reported/observed UID differs from root.
+
+Explicit `OPENRIG_URL`/`RIGGED_URL` targets and registered remote hosts retain
+their selected routing, including tunnels. An internally resolved local URL is
+still checked. Default UI and TUI openings are checked before launch; this does
+not police later browser or TUI connections.
+
+Missing, disagreeing, restricted or timed-out evidence **continues today's
+behavior**. This is a partial accidental-routing check, not authenticated user
+isolation: it trusts the daemon's PID/UID report and corroborates that process;
+it does not establish the socket's owner. Identity can change between observation
+and connection, and equal UIDs do not distinguish separate instances belonging
+to one account. The check
+does not add authentication to the daemon or protect direct HTTP clients.
+
 ## Custom settings and precedence
 
 - **OpenRig:** member `permission_policy` overrides rig `permission_policy`.

package/daemon/context-packs/reference/manifest.yaml

@@ -1,7 +1,7 @@
 # Reference guides the help pack links to, loaded one file or section at a time by address
 # (rig context get reference/<file>#<section>). Each file is a symlink to docs/reference/.
 name: reference
-version: "0.6.13"
+version: "0.6.14"
 taxonomy: world
 purpose: "Version-matched reference guides the help guide links to. Load a single file or section by address; don't load the whole pack."
 files:

package/daemon/context-packs/reference/whats-new.md

@@ -1,116 +1,87 @@
-# What changed in OpenRig 0.6.13
+# What changed in OpenRig 0.6.14
 
-This note is for an agent on an install that was just upgraded to 0.6.13. It lists only what behaves differently from
-0.6.12 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.14. It lists only what behaves differently from
+0.6.13 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
-after an upgrade it can still hold the previous version's note.
+after an upgrade it can still hold the previous version's note. Coming from 0.6.12 or earlier, also read 0.6.13's
+release notes: its changes and migration `117` arrive with this upgrade.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Migration `117` runs on every upgrade: it adds
-  an empty, Codex-only `provider_account_readings` table. It fills only with `provider.usage_windows` on (off by
-  default), and then keeps each resolved Codex account's readings across a restart. There's no migration `116`.
-  Coming from 0.6.11 or earlier, 0.6.12's twelve migrations run first.
-- **The bundled openrig-core plugin goes from 0.1.13 to 0.1.14.** Generated Claude hook commands in a project's
-  `.claude/settings.local.json` call the daemon's Node by its absolute path; existing bare-`node` entries refresh on
-  their own, and a person's wrapper is kept. The plugin's own manifest hooks still call bare `node`.
-- **Seats pick up some changes only at their next launch:** a Pi seat's `effort` (sent as `--thinking`), a managed
-  Claude seat's `EDITOR`, `VISUAL`, `DISPLAY`, `XAUTHORITY` and `WAYLAND_DISPLAY`, and the shipped agent specs' role
-  file as the seat's role. Use `rig seat launch <seat> --fresh --stop --reason "<why>"` only when the person wants it
-  now; don't relaunch a working team just to pick these up.
-- **Slack recovery's first pass after the upgrade** scans tracked threads inside the seven-day window once from their
-  root. Replies that already landed aren't delivered twice; recovered ones land as late rows that never answer a
-  decision.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). No migration runs. One setting is added,
+  `transport.local_user_guard`, off by default (see below).
+- **The bundled openrig-core plugin goes from 0.1.14 to 0.1.15.** Installed copies are replaced and carry refocus's own
+  notes lookup.
 
 ## Output that changed shape
 
-- **`rig ps --nodes`** prints one line per seat after the table: `Model (<session>): configured <m>; last observed
-  <model> (<source>; native record <time>)`, or `UNKNOWN (<reason>)`. JSON carries `modelObservation`; compact output
-  is `[model, source, time]`, `{status: "unknown", reason}`, or `null` from an older daemon. Roster
-  `live.observedModel` is now filled in.
-- **`rig capture`** writes `[rig capture: <seat>: input box: <hint>]` to stderr for a Claude Code or Codex seat; stdout
-  is unchanged. `--json` and the MCP tool carry `inputBox` (`status`, `confidence`, `cursor`, regions, `evidence`,
-  `hint`). It's a heuristic: `unknown` means unknown.
-- **`rig provider status`** rows carry a sign-in fact (`usable`, `needs sign-in`, `unknown`; JSON `signIn`). A
-  signed-in Claude login never reads better than `unknown`. A signed-out Codex login reports `not_signed_in`, not
-  `rpc_error`.
-- **`rig provider status`** (with `provider.usage_windows` on) Codex rows keep their last reading across a daemon
-  restart as history (`retained: "before_restart"`), labelled "kept from before the daemon restarted; not a current
-  reading", with availability unknown until a fresh read. Rows add `accountHistory` (`linked`, or `unknown`; every
-  Claude row is `unknown`), `lastObservedExhausted`, `retained` and, on an inactive account, `savedProfile: "not
-  linked"`. A window whose reset has passed gains `expectation`: planning, not a reading. Run `rig provider status
-  --refresh` before telling anyone an account has room.
-- **`rig send`** can refuse with `caller_cancelled` (HTTP 409, `sent: false`, `inputPhase: "not_reached"`) when its
-  caller went away before input started.
-- **`rig seat restart --keep-conversation`** reports name a Codex startup screen: `Codex startup gate (<kind>): …`, and
-  JSON gains `codexNoDaemonFlag`, `processMode` (always `unknown` for now) and `account.startupGateKind`.
-- **`rig restore-check`**'s hook check can read `ready_with_caveats` where it read green; the exit code is still 0.
-- **`GET /api/attention`** adds `queue-update:<qitemId>` items and a `"queue updates"` source.
-- **The node-detail API's `targetPath`** names the file a guidance block is really in, or `""`; `declaredTarget` and
-  `effectiveTarget` are new.
-- **`rig grow --json`'s `rigId`** is the resolved id, and `rig grow` and `rig remove` can return `rig_ambiguous`.
-- **The one-line installer** ends with `INSTALLED, SETUP NOT COMPLETE (exit N)` when `rig setup` isn't ready.
+- **`rig ask --wake`** on a seat whose runtime isn't Claude or Codex prints `Wake runtime '<runtime>' … is not
+  supported. Supported runtimes are claude and codex.` A `member@rig` target exits 2 (the daemon refuses it); a raw-id
+  `--runtime` value exits 1 (the CLI refuses it). No wake starts.
+- **`/healthz`** gains `euid`, the daemon's effective user ID, beside `pid`, whether or not the Mac check is on.
+- **`rig compact`** (manual) waits up to 240 seconds for its result, up from 180, because preparation now has 180
+  seconds, up from 120.
 
 ## Seats and restore
 
-- **A fresh in-place Claude handover** checks a ready result from the old pane's history against the current screen,
-  so the packet waits for the successor. It can still admit early when the screen, pane or process can't be read or
-  proven: check that the successor read its packet.
-- **A Claude launched through a wrapper script** is proven by its executable path; a restored auto-mode seat resumes
-  ready.
-- **After a failed restore, a ready `rig seat launch --fresh`** clears the old restore warning, and `rig seat
-  clear-attention` no longer refuses for it.
-- **A complete idle Claude Code or Codex screen** reads `idle` through terminal repaints.
-- **Claude Code's MCP-server approval menu** reads `mcp_gate` and needs input; a restore doesn't call it ready, and an
-  ordinary send is refused instead of pasted. A fresh running hook still sends into it.
-- **Codex's "Trust this folder?" panel** reads `trust_gate` during launch, resume and restore.
-- **A rig name with a dot** is refused at launch, at adding a member and at a first-start retry.
-
-## Sends, wakes and the queue
-
-- **A send whose caller went away** types nothing, then or later, if no input had started.
-- **An old numbered menu in a Codex pane's scrollback** no longer blocks a send when a complete empty input box sits
-  below the status row.
-- **An OMP seat** whose turn ended with a typed transient provider failure (408, 429, 500, 502, 503, 504 or 529) can
-  take an ordinary `rig send` retry; nothing retries on its own.
-- **Parked rows for one seat that fall due in the same pass** arrive as one message naming each row.
-- **A stuck-item finding on a person's item that an agent closed** goes to that agent, not the person.
-- **`rig queue list --state "pending, in-progress"`** matches both states.
+- **A seat that refuses every send with "Managed pane identity unavailable or changed; no input written."** because an
+  older OpenRig never recorded its tmux pane can be repaired in place: `rig reconcile-session <seat>
+  --repair-missing-pane --no-launch`. It fills only the missing pane and keeps the session, resume token and occupant
+  generation; the result names the same session, with continuity unverified. It refuses, writing nothing, with
+  `repair_not_applicable` (the binding already has a pane), `pane_ambiguous` (more than one pane or window),
+  `pane_missing` (no PID), `guard_target_changed`, `guard_operation_in_progress`, `typing_guard_enabled` or
+  `repair_timed_out`. Against an older daemon it reads `repair_missing_pane_unsupported` and never adopts. It records no
+  event.
+- **A manual `rig compact` whose preparation stops at an ordinary approval** keeps waiting within its deadline instead
+  of giving up. OpenRig never answers the approval: the person, or an agent allowed to, answers it.
+- **Refocus resolves each ancestor's notes file itself** (`NOTES.md`, then `MISSION_NOTES.md`) instead of starting `rig
+  scope resolve-notes` per ancestor. Its output, budgets and settings are unchanged.
 
 ## New things you can do
 
-- **Move a seat to a new working folder:** `rig seat set-cwd <seat> --cwd <absolute-path> --reason <text>` saves it
-  for the next fresh launch or rebuild handover; the running agent doesn't move. Switch promptly with `rig seat launch
-  <seat> --fresh --stop --reason "<why>"` or a rebuild handover, and not after a `rig down`/`rig up` or fork handover.
-- **Set a Pi seat's effort:** `rig seat set-effort <seat> --effort <level> --reason "<why>"` and `rig seat effort
-  <seat>` now work for Pi.
-- **See which model a seat was using:** `rig ps --nodes`, `rig roster show`, `rig roster find`.
-- **Use a rig name in `rig grow` and `rig remove`.**
-- **Slack:** missed messages in mapped channels, recent threads and relayed channels are recovered; `rig slack status`
-  shows a line per channel and a thread line.
+- **Repair a missing pane without adopting:** `rig reconcile-session <seat> --repair-missing-pane --no-launch`.
+- **Point a person at a page written for them:** `docs/reference/quickstart.md` ("Getting started") is the first-use
+  page, with a glossary. `docs/reference/getting-started.md` is now titled "OpenRig setup reference" and opens with what
+  the agent doing the setup needs; its sections and anchors are unchanged, so `rig context get
+  reference/getting-started.md#…` lookups still work.
 
 ## Off by default
 
-- **The refocus work packet** stays off for Claude Code and Codex. With `OPENRIG_REFOCUS_WORK_PACKET=1`, its fields
-  are bounded (about 160 characters per summary, 20 held and 10 next rows, about 1,500 characters per section).
+- **A Mac local-user check.** On a Mac shared by several accounts, `rig config set transport.local_user_guard true` (or
+  `OPENRIG_TRANSPORT_LOCAL_USER_GUARD=true` in the CLI's environment) makes the CLI refuse a local daemon another account
+  runs. It compares the PID and effective UID the daemon reports in `/healthz` with two `ps` readings and a second
+  health response, and refuses only when they agree on another account; the refusal names `rig daemon start --port
+  <unused-port>`. Missing, disagreeing or timed-out evidence, and an older daemon without `euid`, keep today's
+  behaviour. No daemon restart is needed. Explicit `OPENRIG_URL` targets and registered remote hosts keep their routing,
+  later browser or TUI connections aren't checked, and with it on `sudo rig …` against a user-owned daemon refuses. It
+  isn't authentication: it trusts the daemon's own report. Details: `rig context get
+  reference/getting-started.md#optional-mac-local-user-check`.
 
 ## What to stop doing
 
-- **Don't read `FAILED [4/4]` from the installer as a failed install:** the script now says `INSTALLED, SETUP NOT
-  COMPLETE`, and the fix is `rig setup` again, not a reinstall.
-- **Don't rely on Slack recovery for older open threads:** only threads whose root or close is within seven days are
-  caught up.
-
-## Known gaps in 0.6.13
-
+- **Don't use plain `rig reconcile-session` to fix a launched seat's missing pane.** It adopts the seat into a new
+  session with no resume token; use `--repair-missing-pane --no-launch`.
+- **Don't abandon a manual `rig compact` because preparation hit an approval.** Answer it, or ask the person to, within
+  the 180 seconds.
+- **Don't try `rig ask --wake` on a Pi or custom seat.** Use `rig ask` without `--wake` to search what it said, or send
+  to the live seat.
+
+## Known gaps in 0.6.14
+
+- **The compaction and refocus fixes** are tested without a native compaction or a loaded machine: confirm a
+  compaction by its restore request or the drop in context, and check that a restored seat is really working.
+- **The pane repair refuses while typing protection is on.** The compaction refusal for a protected seat whose pane
+  isn't recorded still suggests plain `rig reconcile-session <seat> --no-launch`, which adopts. For a running launched
+  seat whose pane was never recorded, use `rig reconcile-session <seat> --repair-missing-pane --no-launch` instead;
+  it needs typing protection off, so turn protection off only if the person agrees. A delivery held from before the
+  repair can still refuse.
+- **`rig context get reference/quickstart.md` doesn't resolve:** the page isn't in the reference context pack. Read it
+  from the package's `docs/reference/` or the repository.
 - **On a Mac with more than one user account,** a second user's `rig` commands can reach the first user's daemon on
-  its default port (7433). Running each user's daemon on its own port lets both work but doesn't keep them apart.
-- **Managed compaction, refocus after a compaction and snapshot restore** behave as in 0.6.12: confirm a compaction by
-  its restore request or the drop in context, and check that a restored seat is really working.
-- **A fresh in-place Claude handover** can still report ready early when the screen, pane or process can't be read or
-  proven.
-- **One Slack app across machines** hasn't run on two real machines, and Slack recovery doesn't catch up older open
-  threads.
-- **`rig seat set-cwd`** checks the new folder once; switch promptly.
+  its default port (7433) unless `transport.local_user_guard` is on. The check trusts the daemon's own report, identity
+  can change between the check and the connection, and direct HTTP clients aren't covered.
+- **0.6.13's other known gaps still apply:** a fresh in-place Claude handover can report ready early when the screen,
+  pane or process can't be read or proven; one Slack app across machines hasn't run on two real machines, and Slack
+  recovery doesn't catch up older open threads; `rig seat set-cwd` checks the new folder once.