@paigy/harness 0.2.8 → 0.3.0

package/dist/cli.js

@@ -23112,6 +23112,14 @@ var CATALOG = [
     loginHint: "Run `codex login` to authenticate.",
     installCli: "curl -fsSL https://chatgpt.com/codex/install.sh | sh",
     installAdapter: "npm install -g @agentclientprotocol/codex-acp"
+  },
+  {
+    name: "agy",
+    label: "Antigravity",
+    cli: "agy",
+    authProbe: ["agy", "help"],
+    loginHint: "Install and set up Antigravity (`agy`).",
+    installCli: "curl -fsSL https://antigravity.dev/install.sh | bash"
   }
 ];
 function probeDirs(home = homedir()) {
@@ -23169,6 +23177,7 @@ function detectAll(deps = {}) {
 
 // ../../packages/sdk/dist/index.js
 import { createRequire as __sdkCreateRequire } from "module";
+import { randomUUID } from "crypto";
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -27212,7 +27221,8 @@ var coerce = {
 var NEVER = INVALID;
 
 // ../../packages/sdk/dist/index.js
-import { existsSync as existsSync2, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 var require2 = __sdkCreateRequire(import.meta.url);
@@ -29478,16 +29488,25 @@ async function proxy() {
   if (!PROXY_ENV.some((k) => process.env[k])) return void 0;
   return agent ??= new (await Promise.resolve().then(() => __toESM(require_undici(), 1))).EnvHttpProxyAgent();
 }
+var INSTANCE_ID = randomUUID();
+var SESSION_ID = process.env.PAIGY_SESSION_ID ?? process.env.CLAUDE_CODE_SESSION_ID ?? INSTANCE_ID;
 async function reach(url, init) {
   try {
-    return await fetch(url, { ...init, dispatcher: await proxy() });
+    const headers = {
+      ...init?.headers,
+      "x-paigy-instance": INSTANCE_ID,
+      "x-paigy-session": SESSION_ID
+    };
+    return await fetch(url, { ...init, headers, dispatcher: await proxy() });
   } catch (e) {
     throw new Error(`${NETWORK_MSG} (${e?.message ?? String(e)})`);
   }
 }
 var ContextSchema = external_exports.object({
   title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
-  description: external_exports.array(external_exports.string().min(1)).min(1).describe("Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand.")
+  description: external_exports.array(external_exports.string().min(1)).describe(
+    "Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand. MAY BE EMPTY: a claim whose whole content is its heading \u2014 a single sentence \u2014 has no body, and saying so beats repeating the heading underneath itself. That repeat is what `min(1)` used to force, at 2x the storage, with every reader subtracting it back out at render time."
+  )
 });
 var ParticipantSchema = external_exports.object({
   kind: external_exports.enum(["human", "agent"]),
@@ -29634,6 +29653,14 @@ var NotifyRequestSchema = external_exports.object({
   waiting: external_exports.enum(["none", "soft", "hard"]).optional().describe(
     "With `ask`: what happens to your work while you wait. 'none' = you're just informing the user. 'soft' = you'd like an answer but can keep working. 'hard' = you are stopped until they answer (reaches them urgently and escalates to a real phone call if unanswered). Replaces urgencyHint + blocking \u2014 send this one field."
   ),
+  /** Δ9b (#895): HOLD this claim so the sender can correct the plan before anyone is
+   *  interrupted. Opt-in per claim, because the fail-open is a minute-granularity cron —
+   *  holding by default would charge every quiet claim that minute before any agent could
+   *  correct anything. Ignored for `waiting: 'hard'`: a blocking ask rings on what we have,
+   *  and the enrichment can still land mid-call (#781 re-plans the unspoken tail). */
+  confirm: external_exports.boolean().optional().describe(
+    "Hold this one so you can correct the plan before the user is interrupted. The response comes back with `held: true` and the plan; POST the confirm route to release it (with options/visuals/urgency corrections, or nothing at all). If you never do, it is announced anyway a couple of minutes later. Ignored when waiting is 'hard'."
+  ),
   /** #575: a RELAY of the user's explicitly stated preference, never the agent's
    *  choice. Outranks waiting in both directions: 'call' rings even for a
    *  waiting:'none' "call me when it's done"; 'message' never rings even for
@@ -29692,35 +29719,45 @@ function normalizeWaiting(req) {
     blocking: req.blocking || waiting === "hard"
   };
 }
-var DERIVE_CHUNKS_MAX = 8;
-var DERIVE_CHUNK_MAX = 300;
-function chunkAsk(text, max = DERIVE_CHUNK_MAX, cap = DERIVE_CHUNKS_MAX) {
+function unitsOf(text) {
+  const spans = [];
+  const re = /\n\s*\n+/g;
+  let cursor = 0;
+  const push = (from, to) => {
+    const slice = text.slice(from, to);
+    const lead = slice.length - slice.trimStart().length;
+    const tail = slice.length - slice.trimEnd().length;
+    if (from + lead < to - tail) spans.push({ start: from + lead, end: to - tail });
+  };
+  for (let m = re.exec(text); m; m = re.exec(text)) {
+    push(cursor, m.index);
+    cursor = m.index + m[0].length;
+  }
+  push(cursor, text.length);
+  return spans;
+}
+function headline(text) {
+  const line = text.split("\n").map((l) => l.trim()).filter((l) => l && !/^`{3,}/.test(l)).map((l) => l.replace(/^(?:#{1,6}|[-*>]|\d{1,3}\.)\s+/, "")).find(Boolean) ?? "";
+  return (/^[^.!?\n]+[.!?]?/.exec(line)?.[0] ?? line).trim();
+}
+function bodyAfterHeadline(text) {
   const body = text.trim();
-  if (!body) return [];
-  const sentences = body.match(/[^.!?]+[.!?]*\s*/g) ?? [body];
-  const chunks = [];
-  for (const raw of sentences) {
-    const s = raw.trim();
-    if (!s) continue;
-    const last = chunks[chunks.length - 1];
-    if (last !== void 0 && `${last} ${s}`.length <= max) chunks[chunks.length - 1] = `${last} ${s}`;
-    else chunks.push(s);
-  }
-  if (chunks.length <= cap) return chunks;
-  return [...chunks.slice(0, cap - 1), chunks.slice(cap - 1).join(" ")];
+  const title = headline(body);
+  const rest = body.slice(title.length).replace(/^[\s.!?—–-]+/, "").trim();
+  if (!rest) return { title, description: [] };
+  const chunks = unitsOf(rest).map((u) => rest.slice(u.start, u.end)).filter(Boolean);
+  return { title, description: chunks.length ? chunks : [rest] };
 }
 function deriveAsk(req) {
   req = normalizeWaiting(req);
   if (!req.ask) return req;
   const text = req.ask.trim();
-  const firstSentence = (/^[^.!?\n]+[.!?]?/.exec(text)?.[0] ?? text).trim();
-  const title = firstSentence.length > 90 ? `${firstSentence.slice(0, 87).trimEnd()}\u2026` : firstSentence;
   const hinted = req.urgencyHint === "now" ? "call" : req.urgencyHint === "soon" ? "banner" : req.urgencyHint === "whenever" ? "inbox" : req.urgency;
   const urgency = req.channel === "call" ? "call" : req.channel === "message" && hinted === "call" ? "banner" : hinted;
   const { ask: _ask, needs, urgencyHint: _hint, channel: _channel, ...rest } = req;
   return {
     ...rest,
-    context: { title, description: chunkAsk(text) },
+    context: bodyAfterHeadline(text),
     // Options riding alongside the ask (#575: pixels can't be prose) floor to a
     // single pick — the model broker may upgrade to many/rank from the wording.
     select: req.options?.length ? "one" : "text",
@@ -29910,6 +29947,34 @@ var NotifyResponseSchema = external_exports.object({
   answer: UserAnswerSchema.optional(),
   answeredAt: external_exports.string().datetime().optional()
 });
+var NotifyPlanUnitSchema = external_exports.object({
+  notificationId: external_exports.string(),
+  /** The unit's own heading, so the agent can tell which of its paragraphs this became. */
+  title: external_exports.string(),
+  /** How loudly this unit was arbitrated to arrive — per unit, which is the point of units. */
+  level: NotifyLevelSchema,
+  /** Answered from something the user already decided: nobody is interrupted, and a trail card
+   *  says so. The agent should not wait on this one. */
+  settled: external_exports.literal(true).optional(),
+  /** What this unit would need to be answerable and does not carry (#894). A PROPOSAL to the
+   *  agent — nothing here changed the ask, and ignoring it costs nothing. */
+  needs: external_exports.array(external_exports.enum(["options", "visuals"])).optional(),
+  /** The SHAPE the broker would give this unit, for the agent to ratify (#886/#894). The
+   *  split layer reads prose and can see that a paragraph is a yes/no or a pick-one — but a
+   *  broker that DECIDES that destroys the only fact separating a statement from a real ask
+   *  (#731), so it is offered, never applied: the unit is stored `text` until the agent
+   *  confirms the shape (POST /notify/:id/confirm). Ignoring it costs nothing. */
+  proposal: external_exports.object({
+    select: SelectShapeSchema,
+    options: external_exports.array(external_exports.object({ label: external_exports.string().min(1) })).optional()
+  }).optional()
+});
+var NotifyPlanSchema = external_exports.object({
+  units: external_exports.array(NotifyPlanUnitSchema),
+  /** Which unit is this arrival's ONE interruption (units-design.md D23). Absent means nobody
+   *  was interrupted — every unit was either settled or quiet enough to sit in the inbox. */
+  speaks: external_exports.string().optional()
+});
 var UserResponseSchema = external_exports.object({
   requestId: external_exports.string(),
   answer: UserAnswerSchema,
@@ -29964,6 +30029,20 @@ var InboxItemSchema = external_exports.object({
   /** The conversation thread + connection this item lives on. Present on the replied
    *  detail — they power History's "Continue" / "New session from this" (#57/#251). */
   parentId: external_exports.string().optional(),
+  /** THE ARRIVAL this row is one unit of (`notifications.ask_id` → `asks`). A claim is one
+   *  arrival and its units are N rows of it, so this — not `parentId` — is what makes a
+   *  multi-part notification one thing on screen. The thread is the whole CONVERSATION: it
+   *  accumulates every message an agent ever sent, so grouping by it renders a day of
+   *  unrelated updates as a single "12-part request". Absent on rows written before the
+   *  `asks` table, and on anything that never went through `notify` — both fall back to the
+   *  thread, which is what the client did for all rows until now. */
+  askId: external_exports.string().optional(),
+  /** WHERE this unit sat in the message it was cut from (`notifications.seq`). The batch
+   *  shares one `created_at` to the microsecond, so without it the author's order is
+   *  unrecoverable client-side — a four-paragraph briefing rendered opening-paragraph-last
+   *  (live 2026-08-10, D35). The API already orders by it; this lets a reader that
+   *  re-sorts (grouping, filtering) put an arrival back in the order it was written. */
+  seq: external_exports.number().int().optional(),
   tokenId: external_exports.string().optional(),
   status: NotifyStatusSchema,
   context: ContextSchema,
@@ -29974,6 +30053,16 @@ var InboxItemSchema = external_exports.object({
    *  ring/enqueue time. Replaces the condensed line + index-aligned phrased points, which
    *  between them could not express a call as a sequence. `question: null` is a real turn —
    *  a status update stays a statement instead of being shaped into a yes/no. */
+  /** Does this claim want an ANSWER, or is it telling you something? Written per row from
+   *  `requestAsks` — the agent's own declaration, not a guess. `false` is what earns a card
+   *  its acknowledge affordance: without it a status update offers a text box and a dismiss,
+   *  and neither of those is "got it" (owner, 2026-08-10). */
+  asks: external_exports.boolean().optional(),
+  /** When a live process last pulsed for this row's agent — the liveness input for
+   *  "working requires a pulse" (#928): the list said "Working…" from agent_state alone
+   *  while the party called the same dead claim stalled. Absent = no token/no data,
+   *  which must never CLAIM stalled. */
+  lastSeenAt: external_exports.string().optional(),
   agenda: external_exports.array(AgendaTurnSchema).optional(),
   /** On a replied detail (#397): the next steps the user attached to the answer
    *  ("call back after lunch") — shown so they can see the commitment was captured. */
@@ -29998,6 +30087,23 @@ var InboxItemSchema = external_exports.object({
    *  client may still flag a stall by age. Drives the inbox error badge + Retry. */
   error: external_exports.string().optional(),
   clarifies: external_exports.string().optional(),
+  /** The ring ladder ran out while this was still pending — we tried to reach you and
+   *  STOPPED trying (`arbitration/arbitrate.ts` `nextRing` → `stop`). Distinct from an
+   *  agent with nothing to say, which the roster drew identically until now: "nothing to
+   *  say" and "gave up saying it" are opposite situations wearing the same face
+   *  (navigation-design.md, gap 1). False for anything that never rang. */
+  gaveUp: external_exports.boolean().default(false),
+  /** Why this arrived the way it did, read back off the delivery receipt (`notify/why.ts`).
+   *  Absent for anything never delivered through a push, and for older rows written before
+   *  the reason was recorded. Deliberately a debug affordance, shown small (owner,
+   *  2026-08-07) — its real job is to give "this didn't need a call" something to be
+   *  feedback ABOUT. */
+  why: external_exports.object({
+    asked: NotifyLevelSchema,
+    got: NotifyLevelSchema,
+    because: external_exports.enum(["unresponsive", "dismissed", "not_permitted", "silent", "coalesced", "agent_capped", "unplanned", "learned_raise"]).optional(),
+    line: external_exports.string()
+  }).optional(),
   select: external_exports.enum(["one", "many", "rank", "confirm", "text"]).default("one"),
   confirmStyle: external_exports.enum(["yesno", "approve"]).default("yesno").describe(
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
@@ -30119,6 +30225,14 @@ var ConnectionSummarySchema = external_exports.object({
   provider: external_exports.string().nullable(),
   /** The pairing's assigned voice (#462); null = the default voice. */
   voice: VoiceKeySchema.nullable(),
+  /** The LOUDEST this agent may ever reach you — a ceiling on `NOTIFY_LADDER`, set by the
+   *  user on the agent's own page. null = no ceiling (today's behaviour for every
+   *  connection). Android binds importance to a relationship rather than to each message,
+   *  and that is the thing our roster could not say: "Marlow may always call me; Otto
+   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
+   *  set once must not overrule a rule they set about one agent. */
+  reach: NotifyLevelSchema.nullable().optional(),
   createdAt: external_exports.string().datetime(),
   /** Most recent notification on this connection, either direction. Null = no contact yet.
    *  Drives the agents-page recency grouping (Today / This week / …). */
@@ -30137,6 +30251,40 @@ var ConnectionSummarySchema = external_exports.object({
    *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
   managed: external_exports.boolean()
 });
+var MoveRingSchema = external_exports.enum(["home", "travels", "retired", "quarantined"]);
+var MoveSchema = external_exports.object({
+  id: external_exports.string(),
+  /** The reusable question, as distill normalized it. */
+  question: external_exports.string(),
+  /** The operative ruling. Editable by the user (PATCH) — which resets the ledger. */
+  answer: external_exports.string(),
+  /** The user's stated reason, when they gave one. Null = inherently narrow: the judge is
+   *  told so, and the ruling only derives essentially the same question in the same scope. */
+  rationale: external_exports.string().nullable(),
+  /** Where the ruling lives: a repo/workspace, or 'global'. */
+  scope: external_exports.string(),
+  ring: MoveRingSchema,
+  /** True = the user pinned it with `always` (travel granted by hand, not by evidence). */
+  pinned: external_exports.boolean(),
+  /** True = a pin the user placed was BROKEN by later counter-evidence. Surfaced so the
+   *  break is visible instead of a pin silently disappearing. */
+  pinBroken: external_exports.boolean(),
+  /** When the ruling was distilled. */
+  learnedAt: external_exports.string(),
+  /** Last time it answered an ask. Null = never fired. */
+  lastUsedAt: external_exports.string().nullable(),
+  /** How many asks it has answered. Instrumentation — deliberately NOT an input to the
+   *  evidence curve: firing says the question keeps arising, not that the ruling is right. */
+  usedCount: external_exports.number(),
+  /** Ledger: outcomes that said it held up. Saturating — the tenth is worth almost nothing. */
+  confirms: external_exports.number(),
+  /** Ledger: contradictions, in signal units (a full override = 1, weaker signals less).
+   *  Linear and priced above the entire confirmation budget, so any full counter wins. */
+  counters: external_exports.number(),
+  /** The agent that asked the question this move came from, when known. Null for a move
+   *  distilled from a clarify ruling (those carry no agent) or one whose source rows are gone. */
+  learnedFrom: external_exports.object({ id: external_exports.string(), name: external_exports.string() }).nullable()
+});
 var CreateRequestSchema = external_exports.object({
   /** The connection (token id) to send to, from GET /api/tokens. */
   tokenId: external_exports.string(),
@@ -30343,6 +30491,17 @@ var DeviceTokenSchema = external_exports.object({
    *  a default silly name). */
   name: external_exports.string(),
   device: external_exports.string().nullable(),
+  /** The pairing's assigned voice, cached so the desktop can seed the SAME face the phone
+   *  draws — voice is the third ingredient of a hatchling's build (party/traits.ts). */
+  voice: external_exports.string().nullable().optional(),
+  /** The token's server-side id — the face's COLOUR anchor, and the only seed ingredient
+   *  that survives a rename. Cached by the host's identity beat. */
+  token_id: external_exports.string().nullable().optional(),
+  /** WHERE this identity works — the folder a wake should land it in. Written by the host
+   *  at spawn and by `paigy-harness handoff` from a live terminal. Without it every wake
+   *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
+   *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
+  workspace: external_exports.string().nullable().optional(),
   phone_reveal: PairingRevealSchema.nullable().optional(),
   // present once the phone reveals
   uik_pub: external_exports.string().nullable().optional()
@@ -30369,6 +30528,8 @@ var NotificationFeedbackKindSchema = external_exports.enum([
   // "There should be a picture or design here."
   "should_have_called",
   // "Don't put this in a banner — ring me for something like this."
+  "should_have_messaged",
+  // the inverse: "that didn't deserve a ring — a message would do."
   "other"
   // anything else — the note carries it.
 ]);
@@ -30665,7 +30826,11 @@ function open(envelope, myKeyId, mySecretKeyB64) {
   if (!eqCt(sealedCanon, expected)) throw new Error("header mismatch (tampered metadata)");
   return { header: envelope.hdr, body };
 }
-var AGENT_NAME = process.env.PAIGY_AGENT ?? "mcp-agent";
+function sessionSlot(sessionId) {
+  const id = sessionId ?? process.env.PAIGY_SESSION_ID ?? process.env.CLAUDE_CODE_SESSION_ID ?? randomUUID2();
+  return `session:${id.slice(0, 8)}`;
+}
+var AGENT_NAME = process.env.PAIGY_AGENT || sessionSlot();
 var TOKEN_PATH = join2(homedir2(), ".paigy", "token.json");
 var KEY_PATH = join2(homedir2(), ".paigy", "key.json");
 function readTokenFile() {
@@ -30680,10 +30845,45 @@ function readTokenFile() {
     return {};
   }
 }
-function saveToken(token, agent2 = AGENT_NAME) {
-  const slots = { ...readTokenFile(), [agent2]: token };
+function withTokenLock(mutate) {
+  const lock = TOKEN_PATH + ".lock";
+  const spin = new Int32Array(new SharedArrayBuffer(4));
   mkdirSync(join2(homedir2(), ".paigy"), { recursive: true });
-  writeFileSync(TOKEN_PATH, JSON.stringify(slots, null, 2) + "\n", { mode: 384 });
+  for (const deadline = Date.now() + 5e3; Date.now() < deadline; ) {
+    try {
+      closeSync(openSync(lock, "wx"));
+      break;
+    } catch {
+      const held = statSync(lock, { throwIfNoEntry: false })?.mtimeMs ?? Date.now();
+      if (Date.now() - held > 5e3) rmSync(lock, { force: true });
+      else Atomics.wait(spin, 0, 0, 25);
+    }
+  }
+  try {
+    return mutate();
+  } finally {
+    rmSync(lock, { force: true });
+  }
+}
+function saveToken(token, agent2 = AGENT_NAME) {
+  withTokenLock(() => {
+    const slots = { ...readTokenFile(), [agent2]: token };
+    writeFileSync(TOKEN_PATH, JSON.stringify(slots, null, 2) + "\n", { mode: 384 });
+  });
+}
+function updateSlot(agent2, patch) {
+  return withTokenLock(() => {
+    const slots = readTokenFile();
+    const existing = slots[agent2];
+    if (!existing) return false;
+    slots[agent2] = { ...existing, ...patch };
+    writeFileSync(TOKEN_PATH, JSON.stringify(slots, null, 2) + "\n", { mode: 384 });
+    return true;
+  });
+}
+function slotIdentity(agent2) {
+  const t = readTokenFile()[agent2];
+  return { name: t?.name ?? null, voice: t?.voice ?? null, tokenId: t?.token_id ?? null, workspace: t?.workspace ?? null };
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function readToken(agent2 = AGENT_NAME) {
@@ -30693,6 +30893,9 @@ function readToken(agent2 = AGENT_NAME) {
 function listSlots() {
   return Object.keys(readTokenFile());
 }
+function slotName(agent2) {
+  return readTokenFile()[agent2]?.name ?? null;
+}
 async function requestCode(suggestedName = AGENT_NAME, e2ee) {
   const res = await reach(`${BACKEND_URL}/api/device/code`, {
     method: "POST",
@@ -30859,6 +31062,16 @@ async function hatch(name, voice = null) {
   if (!res.ok) throw new Error(`hatch failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
+async function whoAmI(opts = {}) {
+  try {
+    const res = await reach(`${BACKEND_URL}/api/identity`, {
+      headers: { authorization: `Bearer ${authToken(opts.token)}` }
+    });
+    return res.ok ? await res.json() : null;
+  } catch {
+    return null;
+  }
+}
 async function claimSessions(opts = {}) {
   const res = ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/claim`, {
     headers: { authorization: `Bearer ${authToken(opts.token)}` }
@@ -30888,15 +31101,17 @@ async function setTaskState(notificationId, state, opts = {}) {
 // src/cli.ts
 var import_qrcode = __toESM(require_lib(), 1);
 import { hostname } from "os";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { execSync } from "child_process";
-import { homedir as homedir5 } from "os";
-import { join as join4 } from "path";
+import { homedir as homedir6 } from "os";
+import { join as join5 } from "path";
 
 // ../../packages/schema/dist/index.js
 var ContextSchema2 = external_exports.object({
   title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
-  description: external_exports.array(external_exports.string().min(1)).min(1).describe("Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand.")
+  description: external_exports.array(external_exports.string().min(1)).describe(
+    "Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand. MAY BE EMPTY: a claim whose whole content is its heading \u2014 a single sentence \u2014 has no body, and saying so beats repeating the heading underneath itself. That repeat is what `min(1)` used to force, at 2x the storage, with every reader subtracting it back out at render time."
+  )
 });
 var ParticipantSchema2 = external_exports.object({
   kind: external_exports.enum(["human", "agent"]),
@@ -31043,6 +31258,14 @@ var NotifyRequestSchema2 = external_exports.object({
   waiting: external_exports.enum(["none", "soft", "hard"]).optional().describe(
     "With `ask`: what happens to your work while you wait. 'none' = you're just informing the user. 'soft' = you'd like an answer but can keep working. 'hard' = you are stopped until they answer (reaches them urgently and escalates to a real phone call if unanswered). Replaces urgencyHint + blocking \u2014 send this one field."
   ),
+  /** Δ9b (#895): HOLD this claim so the sender can correct the plan before anyone is
+   *  interrupted. Opt-in per claim, because the fail-open is a minute-granularity cron —
+   *  holding by default would charge every quiet claim that minute before any agent could
+   *  correct anything. Ignored for `waiting: 'hard'`: a blocking ask rings on what we have,
+   *  and the enrichment can still land mid-call (#781 re-plans the unspoken tail). */
+  confirm: external_exports.boolean().optional().describe(
+    "Hold this one so you can correct the plan before the user is interrupted. The response comes back with `held: true` and the plan; POST the confirm route to release it (with options/visuals/urgency corrections, or nothing at all). If you never do, it is announced anyway a couple of minutes later. Ignored when waiting is 'hard'."
+  ),
   /** #575: a RELAY of the user's explicitly stated preference, never the agent's
    *  choice. Outranks waiting in both directions: 'call' rings even for a
    *  waiting:'none' "call me when it's done"; 'message' never rings even for
@@ -31092,6 +31315,23 @@ var NotifyRequestSchema2 = external_exports.object({
   if (!needsOptions && r.options?.length)
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' takes no options` });
 });
+function unitsOf2(text) {
+  const spans = [];
+  const re = /\n\s*\n+/g;
+  let cursor = 0;
+  const push = (from, to) => {
+    const slice = text.slice(from, to);
+    const lead = slice.length - slice.trimStart().length;
+    const tail = slice.length - slice.trimEnd().length;
+    if (from + lead < to - tail) spans.push({ start: from + lead, end: to - tail });
+  };
+  for (let m = re.exec(text); m; m = re.exec(text)) {
+    push(cursor, m.index);
+    cursor = m.index + m[0].length;
+  }
+  push(cursor, text.length);
+  return spans;
+}
 var NotifyStatusSchema2 = external_exports.enum(["pending", "answered", "ignored"]);
 var AgentStateSchema2 = external_exports.enum(["idle", "in_progress", "completed", "needs_input"]);
 var SetTaskStateSchema2 = external_exports.object({
@@ -31274,6 +31514,34 @@ var NotifyResponseSchema2 = external_exports.object({
   answer: UserAnswerSchema2.optional(),
   answeredAt: external_exports.string().datetime().optional()
 });
+var NotifyPlanUnitSchema2 = external_exports.object({
+  notificationId: external_exports.string(),
+  /** The unit's own heading, so the agent can tell which of its paragraphs this became. */
+  title: external_exports.string(),
+  /** How loudly this unit was arbitrated to arrive — per unit, which is the point of units. */
+  level: NotifyLevelSchema2,
+  /** Answered from something the user already decided: nobody is interrupted, and a trail card
+   *  says so. The agent should not wait on this one. */
+  settled: external_exports.literal(true).optional(),
+  /** What this unit would need to be answerable and does not carry (#894). A PROPOSAL to the
+   *  agent — nothing here changed the ask, and ignoring it costs nothing. */
+  needs: external_exports.array(external_exports.enum(["options", "visuals"])).optional(),
+  /** The SHAPE the broker would give this unit, for the agent to ratify (#886/#894). The
+   *  split layer reads prose and can see that a paragraph is a yes/no or a pick-one — but a
+   *  broker that DECIDES that destroys the only fact separating a statement from a real ask
+   *  (#731), so it is offered, never applied: the unit is stored `text` until the agent
+   *  confirms the shape (POST /notify/:id/confirm). Ignoring it costs nothing. */
+  proposal: external_exports.object({
+    select: SelectShapeSchema2,
+    options: external_exports.array(external_exports.object({ label: external_exports.string().min(1) })).optional()
+  }).optional()
+});
+var NotifyPlanSchema2 = external_exports.object({
+  units: external_exports.array(NotifyPlanUnitSchema2),
+  /** Which unit is this arrival's ONE interruption (units-design.md D23). Absent means nobody
+   *  was interrupted — every unit was either settled or quiet enough to sit in the inbox. */
+  speaks: external_exports.string().optional()
+});
 var UserResponseSchema2 = external_exports.object({
   requestId: external_exports.string(),
   answer: UserAnswerSchema2,
@@ -31328,6 +31596,20 @@ var InboxItemSchema2 = external_exports.object({
   /** The conversation thread + connection this item lives on. Present on the replied
    *  detail — they power History's "Continue" / "New session from this" (#57/#251). */
   parentId: external_exports.string().optional(),
+  /** THE ARRIVAL this row is one unit of (`notifications.ask_id` → `asks`). A claim is one
+   *  arrival and its units are N rows of it, so this — not `parentId` — is what makes a
+   *  multi-part notification one thing on screen. The thread is the whole CONVERSATION: it
+   *  accumulates every message an agent ever sent, so grouping by it renders a day of
+   *  unrelated updates as a single "12-part request". Absent on rows written before the
+   *  `asks` table, and on anything that never went through `notify` — both fall back to the
+   *  thread, which is what the client did for all rows until now. */
+  askId: external_exports.string().optional(),
+  /** WHERE this unit sat in the message it was cut from (`notifications.seq`). The batch
+   *  shares one `created_at` to the microsecond, so without it the author's order is
+   *  unrecoverable client-side — a four-paragraph briefing rendered opening-paragraph-last
+   *  (live 2026-08-10, D35). The API already orders by it; this lets a reader that
+   *  re-sorts (grouping, filtering) put an arrival back in the order it was written. */
+  seq: external_exports.number().int().optional(),
   tokenId: external_exports.string().optional(),
   status: NotifyStatusSchema2,
   context: ContextSchema2,
@@ -31338,6 +31620,16 @@ var InboxItemSchema2 = external_exports.object({
    *  ring/enqueue time. Replaces the condensed line + index-aligned phrased points, which
    *  between them could not express a call as a sequence. `question: null` is a real turn —
    *  a status update stays a statement instead of being shaped into a yes/no. */
+  /** Does this claim want an ANSWER, or is it telling you something? Written per row from
+   *  `requestAsks` — the agent's own declaration, not a guess. `false` is what earns a card
+   *  its acknowledge affordance: without it a status update offers a text box and a dismiss,
+   *  and neither of those is "got it" (owner, 2026-08-10). */
+  asks: external_exports.boolean().optional(),
+  /** When a live process last pulsed for this row's agent — the liveness input for
+   *  "working requires a pulse" (#928): the list said "Working…" from agent_state alone
+   *  while the party called the same dead claim stalled. Absent = no token/no data,
+   *  which must never CLAIM stalled. */
+  lastSeenAt: external_exports.string().optional(),
   agenda: external_exports.array(AgendaTurnSchema2).optional(),
   /** On a replied detail (#397): the next steps the user attached to the answer
    *  ("call back after lunch") — shown so they can see the commitment was captured. */
@@ -31362,6 +31654,23 @@ var InboxItemSchema2 = external_exports.object({
    *  client may still flag a stall by age. Drives the inbox error badge + Retry. */
   error: external_exports.string().optional(),
   clarifies: external_exports.string().optional(),
+  /** The ring ladder ran out while this was still pending — we tried to reach you and
+   *  STOPPED trying (`arbitration/arbitrate.ts` `nextRing` → `stop`). Distinct from an
+   *  agent with nothing to say, which the roster drew identically until now: "nothing to
+   *  say" and "gave up saying it" are opposite situations wearing the same face
+   *  (navigation-design.md, gap 1). False for anything that never rang. */
+  gaveUp: external_exports.boolean().default(false),
+  /** Why this arrived the way it did, read back off the delivery receipt (`notify/why.ts`).
+   *  Absent for anything never delivered through a push, and for older rows written before
+   *  the reason was recorded. Deliberately a debug affordance, shown small (owner,
+   *  2026-08-07) — its real job is to give "this didn't need a call" something to be
+   *  feedback ABOUT. */
+  why: external_exports.object({
+    asked: NotifyLevelSchema2,
+    got: NotifyLevelSchema2,
+    because: external_exports.enum(["unresponsive", "dismissed", "not_permitted", "silent", "coalesced", "agent_capped", "unplanned", "learned_raise"]).optional(),
+    line: external_exports.string()
+  }).optional(),
   select: external_exports.enum(["one", "many", "rank", "confirm", "text"]).default("one"),
   confirmStyle: external_exports.enum(["yesno", "approve"]).default("yesno").describe(
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
@@ -31483,6 +31792,14 @@ var ConnectionSummarySchema2 = external_exports.object({
   provider: external_exports.string().nullable(),
   /** The pairing's assigned voice (#462); null = the default voice. */
   voice: VoiceKeySchema2.nullable(),
+  /** The LOUDEST this agent may ever reach you — a ceiling on `NOTIFY_LADDER`, set by the
+   *  user on the agent's own page. null = no ceiling (today's behaviour for every
+   *  connection). Android binds importance to a relationship rather than to each message,
+   *  and that is the thing our roster could not say: "Marlow may always call me; Otto
+   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
+   *  set once must not overrule a rule they set about one agent. */
+  reach: NotifyLevelSchema2.nullable().optional(),
   createdAt: external_exports.string().datetime(),
   /** Most recent notification on this connection, either direction. Null = no contact yet.
    *  Drives the agents-page recency grouping (Today / This week / …). */
@@ -31501,6 +31818,40 @@ var ConnectionSummarySchema2 = external_exports.object({
    *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
   managed: external_exports.boolean()
 });
+var MoveRingSchema2 = external_exports.enum(["home", "travels", "retired", "quarantined"]);
+var MoveSchema2 = external_exports.object({
+  id: external_exports.string(),
+  /** The reusable question, as distill normalized it. */
+  question: external_exports.string(),
+  /** The operative ruling. Editable by the user (PATCH) — which resets the ledger. */
+  answer: external_exports.string(),
+  /** The user's stated reason, when they gave one. Null = inherently narrow: the judge is
+   *  told so, and the ruling only derives essentially the same question in the same scope. */
+  rationale: external_exports.string().nullable(),
+  /** Where the ruling lives: a repo/workspace, or 'global'. */
+  scope: external_exports.string(),
+  ring: MoveRingSchema2,
+  /** True = the user pinned it with `always` (travel granted by hand, not by evidence). */
+  pinned: external_exports.boolean(),
+  /** True = a pin the user placed was BROKEN by later counter-evidence. Surfaced so the
+   *  break is visible instead of a pin silently disappearing. */
+  pinBroken: external_exports.boolean(),
+  /** When the ruling was distilled. */
+  learnedAt: external_exports.string(),
+  /** Last time it answered an ask. Null = never fired. */
+  lastUsedAt: external_exports.string().nullable(),
+  /** How many asks it has answered. Instrumentation — deliberately NOT an input to the
+   *  evidence curve: firing says the question keeps arising, not that the ruling is right. */
+  usedCount: external_exports.number(),
+  /** Ledger: outcomes that said it held up. Saturating — the tenth is worth almost nothing. */
+  confirms: external_exports.number(),
+  /** Ledger: contradictions, in signal units (a full override = 1, weaker signals less).
+   *  Linear and priced above the entire confirmation budget, so any full counter wins. */
+  counters: external_exports.number(),
+  /** The agent that asked the question this move came from, when known. Null for a move
+   *  distilled from a clarify ruling (those carry no agent) or one whose source rows are gone. */
+  learnedFrom: external_exports.object({ id: external_exports.string(), name: external_exports.string() }).nullable()
+});
 var CreateRequestSchema2 = external_exports.object({
   /** The connection (token id) to send to, from GET /api/tokens. */
   tokenId: external_exports.string(),
@@ -31707,6 +32058,17 @@ var DeviceTokenSchema2 = external_exports.object({
    *  a default silly name). */
   name: external_exports.string(),
   device: external_exports.string().nullable(),
+  /** The pairing's assigned voice, cached so the desktop can seed the SAME face the phone
+   *  draws — voice is the third ingredient of a hatchling's build (party/traits.ts). */
+  voice: external_exports.string().nullable().optional(),
+  /** The token's server-side id — the face's COLOUR anchor, and the only seed ingredient
+   *  that survives a rename. Cached by the host's identity beat. */
+  token_id: external_exports.string().nullable().optional(),
+  /** WHERE this identity works — the folder a wake should land it in. Written by the host
+   *  at spawn and by `paigy-harness handoff` from a live terminal. Without it every wake
+   *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
+   *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
+  workspace: external_exports.string().nullable().optional(),
   phone_reveal: PairingRevealSchema2.nullable().optional(),
   // present once the phone reveals
   uik_pub: external_exports.string().nullable().optional()
@@ -31733,6 +32095,8 @@ var NotificationFeedbackKindSchema2 = external_exports.enum([
   // "There should be a picture or design here."
   "should_have_called",
   // "Don't put this in a banner — ring me for something like this."
+  "should_have_messaged",
+  // the inverse: "that didn't deserve a ring — a message would do."
   "other"
   // anything else — the note carries it.
 ]);
@@ -31847,6 +32211,9 @@ function levelFor(event) {
     case "idle":
       if (endsWithQuestion(event.result)) return "banner";
       return event.failed ? "push" : "inbox";
+    case "work":
+      return "inbox";
+    // moot — entryFor drops work before a level ever matters
     case "error":
       return "inbox";
   }
@@ -31867,16 +32234,14 @@ function entryFor(event, state = {}) {
   switch (event.kind) {
     case "turn": {
       const who = event.role === "agent" ? "Agent" : "You";
-      const title = event.text ? `${who}: ${firstLine(event.text)}` : `${who} ran ${(event.tools ?? []).join(", ")}`;
-      const description = [event.text, event.tools?.length ? `Tools: ${event.tools.join(", ")}` : null].filter((c) => Boolean(c));
+      const body = event.text ? event.role === "agent" ? event.text : `${who}: ${event.text}` : `${who} ran ${(event.tools ?? []).join(", ")}.`;
       return {
         ...common,
-        context: { title: clip(title), description: description.length ? description : [title] },
-        // The shaped form always carries an answer shape — the contract's rule, and the
-        // right one: any inbox row can be replied to, and a reply to history is just
-        // the user initiating (the pump feeds it back in). Non-blocking, so it never
-        // reads as a question.
-        select: "text"
+        ask: body
+        // No `select`: the contract refuses it on the `ask` form ("the broker derives it"),
+        // and with no options it derives "text" anyway — the shape this wants, since any
+        // inbox row can be replied to and a reply to history is just the user initiating
+        // (the pump feeds it back in).
       };
     }
     case "permission":
@@ -31898,16 +32263,24 @@ function entryFor(event, state = {}) {
       };
     case "idle": {
       const asking = endsWithQuestion(event.result);
+      const result = event.result?.trim();
+      const norm = (t) => (t ?? "").replace(/\s+/g, " ").trim();
+      if (result && !event.failed && norm(result) === norm(state.lastAgentText)) {
+        if (!asking) return null;
+        const spans = unitsOf2(result);
+        const tail = spans.map((sp) => result.slice(sp.start, sp.end)).reverse().find((t) => t.includes("?"));
+        return { ...common, ask: tail ?? result, blocking: true };
+      }
+      const lead = asking ? "" : event.failed ? "The agent stopped without finishing. " : "Turn complete. ";
       return {
         ...common,
-        context: {
-          title: asking ? clip(firstLine(event.result ?? "")) : event.failed ? "The agent stopped without finishing" : "Turn complete",
-          description: [event.result || (event.failed ? "No result reported." : "Done.")]
-        },
-        select: "text",
+        ask: `${lead}${result || (event.failed ? "No result reported." : "Done.")}`,
         ...asking ? { blocking: true } : {}
       };
     }
+    case "work":
+      return null;
+    // log-only by contract — the live texture of the working log
     case "error":
       return null;
   }
@@ -31929,9 +32302,16 @@ function decisionFrom(answer) {
 }
 async function mirror(event, state, deps = {}) {
   const entry = entryFor(event, state);
+  if (event.kind === "turn" && event.role === "agent" && event.text) state.lastAgentText = event.text;
   if (!entry) return {};
+  let req;
+  try {
+    req = NotifyRequestSchema2.parse(entry);
+  } catch (e) {
+    console.error(`paigy: mirror entry failed the contract \u2014 a bridge bug, not the network: ${e instanceof Error ? e.message.slice(0, 300) : String(e)}`);
+    return {};
+  }
   try {
-    const req = NotifyRequestSchema2.parse(entry);
     const { notificationId, parentId } = await (deps.submit ?? submitNotification)(req);
     (state.mine ??= /* @__PURE__ */ new Set()).add(notificationId);
     return { parentId, notificationId };
@@ -31960,8 +32340,9 @@ async function askQuestion(question, state, deps = {}) {
     ...state.parentId ? { parentId: state.parentId } : {},
     ...state.repo ? { repo: state.repo } : {},
     ...state.branch ? { branch: state.branch } : {},
-    context: { title: clip(firstLine(question)), description: [question] },
-    select: "text",
+    // Prose in — see `entryFor`'s `turn` case. An agent's question is the case most likely
+    // to run long, and its title was a clipped prefix of itself.
+    ask: question,
     blocking: true,
     urgency: "banner"
   };
@@ -31975,6 +32356,9 @@ async function askQuestion(question, state, deps = {}) {
 }
 async function nudgeSetup(label, hint, deps = {}) {
   const entry = {
+    // Keeps `context`: the title here SUMMARISES rather than repeating — "<label> needs
+    // setup" is not a prefix of the hint — which is exactly the case a hand-written context
+    // is for. `ask` would derive a title from the hint's first sentence and lose the label.
     context: { title: clip(`${label} needs setup`), description: [hint] },
     select: "text",
     urgency: "push"
@@ -32007,7 +32391,6 @@ function spokenText(answer) {
       return null;
   }
 }
-var firstLine = (s) => s.split("\n")[0] ?? s;
 var clip = (s) => (s.length > 120 ? `${s.slice(0, 117)}\u2026` : s) || "(no text)";
 
 // src/harness/session.ts
@@ -32042,6 +32425,14 @@ var AcpDriver = class {
   queued = [];
   /** Options of each unanswered permission request, keyed by its JSON-RPC id. */
   pending = /* @__PURE__ */ new Map();
+  /** Where the REPORT starts in `text` — everything before the LAST tool call is working
+   *  narration ("Now the API endpoints." → runs a tool), and it used to ship: the chunks
+   *  concatenate with no separator, so the owner's phone got "…find the repo.Now I have
+   *  the full picture. Writing the migration.Now…" as the opening paragraph of a finished
+   *  task (live, 2026-08-11 — "looks like a working log"). The narration's audience is the
+   *  terminal and host.log; what the agent composed AFTER its last tool call is the part
+   *  addressed to a human, and that is what leaves the machine. */
+  reportFrom = 0;
   /** The turn being streamed: text accumulates, tools append, both flush on stopReason. */
   text = "";
   tools = [];
@@ -32137,18 +32528,20 @@ var AcpDriver = class {
     if (msg.id === this.promptId) {
       this.promptId = void 0;
       const events = [];
-      if (this.text.trim() || this.tools.length) {
+      const report = this.text.slice(this.reportFrom).trim() || this.text.trim();
+      if (report || this.tools.length) {
         events.push({
           kind: "turn",
           role: "agent",
-          text: this.text.trim(),
+          text: report,
           ...this.tools.length ? { tools: [...this.tools] } : {}
         });
       }
-      const result = this.text.trim();
+      const result = report;
       const failed = msg.error !== void 0 || msg.result?.stopReason === "refusal";
       this.text = "";
       this.tools = [];
+      this.reportFrom = 0;
       const writes = this.flush();
       if (!writes.length) {
         events.push({
@@ -32172,7 +32565,9 @@ var AcpDriver = class {
       case "tool_call": {
         const title = update.title?.trim() || update.kind || "tool";
         this.tools.push(title);
-        return none;
+        const note = this.text.slice(this.reportFrom).trim();
+        this.reportFrom = this.text.length;
+        return { events: [{ kind: "work", tool: title, ...note ? { note } : {} }], writes: [] };
       }
       default:
         return none;
@@ -32226,7 +32621,8 @@ var frame = (body) => JSON.stringify({ jsonrpc: "2.0", ...body });
 // src/harness/session.ts
 var ADAPTER_BIN = {
   claude: "claude-agent-acp",
-  codex: "codex-acp"
+  codex: "codex-acp",
+  agy: "agy"
 };
 function splitLines(buffer, chunk) {
   const combined = buffer + chunk;
@@ -32324,6 +32720,10 @@ function runHarness(opts) {
       opts.log(decision.allow ? `\u2713 approved: ${event.summary}` : `\u2717 denied: ${event.summary}`);
       return;
     }
+    if (event.kind === "work") {
+      opts.log(`\u2699 ${event.tool}${event.note ? ` \u2014 ${event.note.split("\n")[0] ?? ""}` : ""}`);
+      return;
+    }
     const { parentId } = await mirror(event, state, deps);
     state.parentId ??= parentId;
     if (event.kind === "turn") opts.log(`${event.role}: ${event.text.split("\n")[0] ?? ""}`);
@@ -32365,6 +32765,7 @@ function runHarness(opts) {
     send(text) {
       session?.send(text);
     },
+    working: () => running && state.resting !== true,
     stop() {
       running = false;
       cancelAsks(state);
@@ -32375,6 +32776,11 @@ function runHarness(opts) {
   };
 }
 
+// src/host.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join4 } from "path";
+
 // src/workspaces.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
@@ -32400,12 +32806,39 @@ function addWorkspace(dir, deps) {
   }
   return all;
 }
+function allowed(cwd, deps) {
+  const target = resolve2(cwd.replace(/^~(?=$|\/)/, homedir4()));
+  return listWorkspaces(deps).some((w) => target === w || target.startsWith(`${w}/`));
+}
+function resolveWakeDir(pinned, deps) {
+  if (pinned && allowed(pinned, deps)) {
+    const dir = resolve2(pinned.replace(/^~(?=$|\/)/, homedir4()));
+    if ((deps.exists ?? existsSync4)(dir)) return dir;
+  }
+  return listWorkspaces(deps)[0];
+}
 
 // src/host.ts
+var HOST_FILE = join4(homedir5(), ".paigy", "host.json");
 function startHost(opts) {
   const runs = /* @__PURE__ */ new Map();
   const asHost = { token: opts.token };
+  const refreshIdentities = async () => {
+    for (const slot of listSlots()) {
+      const token = readToken(slot);
+      if (!token) continue;
+      const me = await whoAmI({ token }).catch(() => null);
+      if (!me) continue;
+      const have = slotIdentity(slot);
+      if (me.name !== have.name || (me.voice ?? null) !== have.voice || (me.tokenId ?? null) !== have.tokenId) {
+        updateSlot(slot, { ...me.name ? { name: me.name } : {}, voice: me.voice ?? null, token_id: me.tokenId ?? null });
+      }
+    }
+  };
   const beat = () => {
+    void refreshIdentities();
+    for (const r of runs.values()) if (r.token) void heartbeat(void 0, { token: r.token }).catch(() => {
+    });
     void heartbeat({
       harnesses: detectAll().map((a) => ({ name: a.name, label: a.label, status: a.status })),
       workspaces: listWorkspaces(opts.wsDeps)
@@ -32430,28 +32863,32 @@ function startHost(opts) {
         },
         log
       });
-      runs.set(spec.sessionId, { run, label });
+      runs.set(spec.sessionId, { run, label, token: spec.token });
+      void heartbeat(void 0, { token: spec.token }).catch(() => {
+      });
+      void refreshIdentities();
       try {
-        saveToken({ access_token: spec.token, name: label, device: null }, `session:${spec.sessionId.slice(0, 8)}`);
+        saveToken({ access_token: spec.token, name: label, device: null, workspace: spec.workspace }, sessionSlot(spec.sessionId));
       } catch {
       }
       opts.log(`\u25B6 phone-launched ${label} (${spec.harness}) in ${spec.workspace}`);
     }
   }
-  const SLOT_HARNESS = { "mcp-agent": "claude", codex: "codex" };
-  const WAKE_PROMPT = "You were woken because Paigy work is waiting for you. Call check_replies now and handle everything it returns, then follow your paigy instructions to stay in the loop.";
+  const SLOT_HARNESS = { "mcp-agent": "claude", codex: "codex", antigravity: "agy" };
+  const WAKE_PROMPT = "You were woken because Paigy work is waiting for you. This is a fresh session with your existing identity, so you may already have work in flight that you can't remember. Call check_replies FIRST, then get_thread on each conversation it returns and read it before you touch anything: it holds what you were doing, where (a repo or worktree may not be this folder), and what the owner already decided. Then handle what's waiting and follow your paigy instructions to stay in the loop. Speak to the owner at exactly TWO moments: when you are BLOCKED on a decision only they can make (contact with waiting:'hard', the decision as the ask, options if you have real ones), and when you are DONE (one short report: what shipped, how you verified it, anything you flagged). Progress is never a contact \u2014 call set_task_state('in_progress') when you pick work up and the app shows you working; narrate to the terminal, not to the human.";
   async function sweepSlots() {
-    const workspace = listWorkspaces(opts.wsDeps)[0];
-    if (!workspace) return;
     for (const slot of listSlots()) {
       const harness = SLOT_HARNESS[slot] ?? (slot === "Desktop" ? void 0 : "claude");
       const key = `slot:${slot}`;
       if (!harness || runs.has(key)) continue;
       const token = readToken(slot);
       if (!token) continue;
+      const workspace = resolveWakeDir(slotIdentity(slot).workspace, opts.wsDeps);
+      if (!workspace) continue;
       const work = await checkReplies({ token }).catch(() => null);
       if (!work || work.requests.length === 0 && work.replies.length === 0) continue;
-      const log = (line) => opts.log(`[${slot}] ${line}`);
+      const label = slotName(slot) ?? slot;
+      const log = (line) => opts.log(`[${label}] ${line}`);
       const run = runHarness({
         harness,
         cwd: workspace,
@@ -32462,19 +32899,28 @@ function startHost(opts) {
         // A dead run must not squat the slot — evict so the next wake can respawn.
         onExit: () => {
           runs.delete(key);
-          opts.log(`\u2716 ${slot} ended`);
+          opts.log(`\u2716 ${label} ended`);
         },
         log
       });
-      runs.set(key, { run, label: slot });
-      opts.log(`\u25B6 woke ${slot} (${harness}) \u2014 work was waiting in ${workspace}`);
+      runs.set(key, { run, label, token });
+      void heartbeat(void 0, { token }).catch(() => {
+      });
+      opts.log(`\u25B6 woke ${label} (${harness}) \u2014 work was waiting in ${workspace}`);
     }
   }
+  const publish = () => {
+    try {
+      writeFileSync3(HOST_FILE, JSON.stringify({ pid: process.pid, at: Date.now(), roster: api.roster() }));
+    } catch {
+    }
+  };
   beat();
   const pulse = setInterval(beat, 6e4);
   const spawnPoll = setInterval(() => {
     void claimAndSpawn();
     void sweepSlots();
+    publish();
   }, 5e3);
   const stopSessions = () => {
     for (const { run, label } of runs.values()) {
@@ -32483,27 +32929,56 @@ function startHost(opts) {
     }
     runs.clear();
   };
-  return {
+  const api = {
     sessions: () => [...runs.entries()].map(([id, r]) => [id, r.label]),
+    // Every identity this machine holds, plus what it's doing right now. Slots are the
+    // roster (hatched agents, the terminal tools, claimed sessions); a run makes one of
+    // them live, and a run mid-turn makes it working.
+    roster: () => {
+      const live = new Map([...runs.values()].map((r) => [r.label, r.run]));
+      const names = /* @__PURE__ */ new Map();
+      for (const key of listSlots()) if (key !== "Desktop") names.set(slotName(key) ?? key, key);
+      for (const label of live.keys()) if (!names.has(label)) names.set(label, null);
+      return [...names.entries()].map(([name, slot]) => {
+        const id = slot ? slotIdentity(slot) : { voice: null, tokenId: null };
+        return {
+          name,
+          // The slot key rides along so the window's agent page can speak AS this agent —
+          // its pending reads (`checkReplies`, the same pure read the sweep does) need the
+          // slot's own token, and the display name is not a key.
+          slot,
+          tokenId: id.tokenId,
+          voice: id.voice,
+          running: live.has(name),
+          working: live.get(name)?.working() ?? false
+        };
+      });
+    },
     stopSessions,
     stop() {
       clearInterval(pulse);
       clearInterval(spawnPoll);
       stopSessions();
+      try {
+        writeFileSync3(HOST_FILE, JSON.stringify({ pid: process.pid, at: 0, roster: [] }));
+      } catch {
+      }
     }
   };
+  publish();
+  return api;
 }
 
 // src/cli.ts
 function parseArgs(argv) {
-  const args = { harness: "claude", mode: "bypass", cwd: process.cwd(), doctor: false, host: false, pair: false, service: false, setup: false, grant: [], hatch: null, voice: null, slot: null, identity: null, graceSeconds: 90, prompt: "" };
+  const args = { harness: "claude", mode: "bypass", cwd: process.cwd(), doctor: false, host: false, pair: false, service: false, setup: false, grant: [], hatch: null, voice: null, slot: null, identity: null, graceSeconds: 90, prompt: "", handoff: false };
   const words = [];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const next = () => argv[++i];
     if (arg === "--harness") {
       const v = next();
-      if (v !== "claude" && v !== "codex") return { error: `--harness must be claude or codex, got ${v ?? "nothing"}` };
+      if (v !== "claude" && v !== "codex" && v !== "agy") return { error: `--harness must be claude, codex, or agy, got ${v ?? "nothing"}` };
       args.harness = v;
     } else if (arg === "--mode") {
       const v = next();
@@ -32531,6 +33006,8 @@ function parseArgs(argv) {
       const v = next();
       if (!v) return { error: "--grant needs a folder to allow" };
       args.grant.push(v);
+    } else if (arg === "handoff") {
+      args.handoff = true;
     } else if (arg === "hatch") {
       const v = next();
       if (!v) return { error: 'hatch needs a name: paigy-harness hatch "Voice bug hunter"' };
@@ -32550,7 +33027,7 @@ function parseArgs(argv) {
     }
   }
   args.prompt = words.join(" ");
-  if (!args.doctor && !args.hatch && !args.host && !args.pair && !args.service && !args.setup && !args.prompt) return { error: "a prompt is required (or setup / --doctor / pair / host / service / hatch NAME)" };
+  if (!args.doctor && !args.handoff && !args.hatch && !args.host && !args.pair && !args.service && !args.setup && !args.prompt) return { error: "a prompt is required (or setup / --doctor / pair / host / service / hatch NAME / handoff)" };
   return args;
 }
 var STATUS_MARK = { ready: "\u2713", login: "\u25D0", "adapter-missing": "\u25D0", missing: "\u2717" };
@@ -32558,7 +33035,7 @@ async function main() {
   const parsed = parseArgs(process.argv.slice(2));
   if ("error" in parsed) {
     console.error(`paigy-harness: ${parsed.error}`);
-    console.error("usage: paigy-harness setup | pair | host [--grant DIR]\u2026 | service | hatch NAME [--voice KEY] [--slot SLOT] | [--harness claude|codex] [--mode bypass|ask] [--cwd DIR] [--identity NAME] [--grace SECONDS] [--doctor] PROMPT\u2026");
+    console.error("usage: paigy-harness setup | pair | host [--grant DIR]\u2026 | service | hatch NAME [--voice KEY] [--slot SLOT] | handoff | [--harness claude|codex|agy] [--mode bypass|ask] [--cwd DIR] [--identity NAME] [--grace SECONDS] [--doctor] PROMPT\u2026");
     process.exit(2);
   }
   if (parsed.doctor) {
@@ -32603,7 +33080,7 @@ async function main() {
     const wsDeps = { file: workspacesFile() };
     for (const dir of parsed.grant) addWorkspace(dir, wsDeps);
     if (!listWorkspaces(wsDeps).length) {
-      const guess = join4(homedir5(), "projects");
+      const guess = join5(homedir6(), "projects");
       if (existsSync5(guess)) {
         addWorkspace(guess, wsDeps);
         console.log(`\u2713 workspace granted: ${guess} (change with --grant DIR)`);
@@ -32619,9 +33096,12 @@ async function main() {
     const TERMINAL_AGENTS = [
       // Wire = MCP registration + the plugin (skills, hooks, idle-escalation — the
       // piece that makes a LIVE session notice your requests without polling).
-      { cli: "claude", name: "Claude Code", slot: "mcp-agent", wire: "claude mcp add --scope user paigy -- npx -y @paigy/mcp@latest && claude plugin marketplace add paigy-ai/mcp; claude plugin install paigy@paigy" },
-      { cli: "codex", name: "Codex", slot: "codex", wire: "codex mcp add paigy -- npx -y @paigy/mcp@latest" },
-      { cli: "antigravity", name: "Antigravity", slot: "antigravity" }
+      // The slot goes in the MCP config as PAIGY_AGENT, always. A registration without it
+      // used to fall through to a shared default slot, so every unconfigured session on the
+      // machine spoke as whoever paired into it last (strict identity, 2026-08-07).
+      { cli: "claude", name: "Claude Code", slot: "mcp-agent", wire: "claude mcp add --scope user -e PAIGY_AGENT=mcp-agent paigy -- npx -y @paigy/mcp@latest && claude plugin marketplace add paigy-ai/mcp; claude plugin install paigy@paigy" },
+      { cli: "codex", name: "Codex", slot: "codex", wire: "codex mcp add paigy --env PAIGY_AGENT=codex -- npx -y @paigy/mcp@latest" },
+      { cli: "agy", name: "Antigravity", slot: "antigravity" }
     ];
     overrideToken(readToken("Desktop") || null);
     for (const t of TERMINAL_AGENTS) {
@@ -32641,12 +33121,12 @@ async function main() {
       }
     }
     try {
-      const settings = join4(homedir5(), ".claude", "settings.json");
+      const settings = join5(homedir6(), ".claude", "settings.json");
       if (which("claude") && existsSync5(settings)) {
-        const cfg = JSON.parse(readFileSync3(settings, "utf8"));
+        const cfg = JSON.parse(readFileSync4(settings, "utf8"));
         if (!cfg["statusLine"]) {
           cfg["statusLine"] = { type: "command", command: "npx -y -p @paigy/mcp@latest paigy-statusline" };
-          writeFileSync3(settings, JSON.stringify(cfg, null, 2));
+          writeFileSync4(settings, JSON.stringify(cfg, null, 2));
           console.log("\u2713 statusline wired");
         }
       }
@@ -32696,22 +33176,46 @@ async function main() {
   </array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${join4(homedir5(), ".paigy", "host.log")}</string>
-  <key>StandardErrorPath</key><string>${join4(homedir5(), ".paigy", "host.log")}</string>
+  <key>SoftResourceLimits</key><dict>
+    <key>NumberOfFiles</key><integer>65536</integer>
+  </dict>
+  <key>StandardOutPath</key><string>${join5(homedir6(), ".paigy", "host.log")}</string>
+  <key>StandardErrorPath</key><string>${join5(homedir6(), ".paigy", "host.log")}</string>
 </dict></plist>
 `;
-    const dir = join4(homedir5(), "Library", "LaunchAgents");
+    const dir = join5(homedir6(), "Library", "LaunchAgents");
     mkdirSync3(dir, { recursive: true });
-    const path = join4(dir, "ai.paigy.harness.plist");
-    writeFileSync3(path, plist);
+    const path = join5(dir, "ai.paigy.harness.plist");
+    writeFileSync4(path, plist);
     execSync(`launchctl unload ${path} 2>/dev/null; launchctl load ${path}`, { shell: "/bin/sh" });
     console.log(`\u2713 host installed as a login service (${path}) \u2014 logs at ~/.paigy/host.log`);
+    console.log("  file limit raised to 65536 for the host and every session it spawns");
     return;
   }
   if (!readToken("Desktop") && !readToken()) {
     console.error("Not paired. Run `paigy-harness pair` (or `npx -y -p @paigy/mcp paigy-mcp-onboard`), then retry.");
     process.exit(1);
   }
+  if (parsed.handoff) {
+    const slot = AGENT_NAME;
+    if (!readToken(slot)) {
+      console.error(`This terminal holds no Paigy identity (slot "${slot}" is empty) \u2014 pair or hatch first.`);
+      process.exit(1);
+    }
+    const cwd = process.cwd();
+    if (!updateSlot(slot, { workspace: cwd })) {
+      console.error(`Slot "${slot}" isn't in this machine's slot file \u2014 this session was spawned by the host, which already owns its wake dir. Run handoff from the terminal that hatched the identity.`);
+      process.exit(1);
+    }
+    const name = slotName(slot) ?? slot;
+    console.log(`\u2713 ${name} is handed off \u2014 wakes in ${cwd.replace(homedir6(), "~")}`);
+    if (!allowed(cwd, { file: workspacesFile() })) {
+      console.log(`  \u26A0 that folder isn't on the allow-list, so wakes will land in the first granted`);
+      console.log(`    workspace instead \u2014 add it in the desktop app, or: paigy-harness host --grant ${cwd}`);
+    }
+    console.log(`  Write to ${name} from your phone and the host resumes it there, thread as memory.`);
+    return;
+  }
   if (parsed.hatch) {
     overrideToken(readToken("Desktop") || null);
     const minted = await hatch(parsed.hatch, parsed.voice ?? null);