@ref0/cli 0.10.0 → 0.12.0

package/dist/main.mjs

@@ -798,7 +798,7 @@ const ScopeKind = Schema.Literals([
 	"session",
 	"agent"
 ]);
-const Scope$1 = Schema.Struct({
+const Scope$2 = Schema.Struct({
 	kind: ScopeKind,
 	id: Schema.String.check(Schema.isMinLength(1)),
 	action: ScopeAction
@@ -971,7 +971,7 @@ const SessionDepth = Schema.Int.check(Schema.isBetween({
 * attachment's authorization there and the agent's target there.
 */
 const AskingHeld = Schema.Struct({
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	pins: Schema.Struct({
 		agent: Generation,
 		attachment: Generation,
@@ -1010,7 +1010,7 @@ const CredentialFacts = Schema.Struct({
 	}),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
 	/** What it may do, and where. Rows a reader can't decode were left out: they grant nothing. */
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	/**
 	* For a session's token: its project's owner, which answers what its agent holds there; the
 	* session, whose lease its project's Project DO holds; and how deep it is in its chain, 1 for
@@ -5186,7 +5186,7 @@ const commandFields = {
 	* What the credential may do, and where, as its person's Owner DO said: the writer checks
 	* the command's action against it on what it holds, such as which thread a number is.
 	*/
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	/** For a command a person approved: their `approval.answered`, which its events name as their cause. */
 	cause: Schema.optionalKey(EventRef),
 	/**
@@ -5486,12 +5486,15 @@ const name$1 = ownerNamePattern.source.replace(/^\^|\$$/g, "");
 const projectPattern = new RegExp(`^(${name$1})/(${name$1})$`);
 const threadPattern = new RegExp(`^(${name$1})(?:/(${name$1}))?#([1-9][0-9]*)$`);
 const repoPattern = new RegExp(`^(${name$1})/(${repoNamePattern.source.replace(/^\^|\$$/g, "")})$`);
+const pullRequestPattern = new RegExp(`${repoPattern.source.replace(/\$$/, "")}#[1-9][0-9]*$`);
 /** A project, `owner/project`. */
 const WrittenProject = Schema.String.check(Schema.isPattern(projectPattern)).pipe(Schema.brand("WrittenProject"));
 /** A thread, `owner/project#number`, or an org thread, `owner#number`. */
 const WrittenThread = Schema.String.check(Schema.isPattern(threadPattern)).pipe(Schema.brand("WrittenThread"));
 /** A repo, `owner/repo`. */
 const WrittenRepo = Schema.String.check(Schema.isPattern(repoPattern)).pipe(Schema.brand("WrittenRepo"));
+/** A pull request, `owner/repo#number`. */
+const WrittenPullRequest = Schema.String.check(Schema.isPattern(pullRequestPattern)).pipe(Schema.brand("WrittenPullRequest"));
 /** A written repo's parts: its owner, as an endpoint's path takes it, and its name. */
 const repoParts = (written) => {
 	const [, owner = "", repo = ""] = repoPattern.exec(written) ?? [];
@@ -5702,7 +5705,7 @@ const Me = Schema.Struct({
 		session: SessionId,
 		depth: SessionDepth
 	})),
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis)
 });
 /**
@@ -6072,7 +6075,7 @@ const Reader = Schema.Struct({
 	agent: Schema.optionalKey(AgentRef),
 	/** The attachment an agent's credential was made under, which an organization asks after; null for a person. */
 	attachment: Schema.NullOr(CredentialRef),
-	scopes: Schema.Array(Scope$1)
+	scopes: Schema.Array(Scope$2)
 });
 Schema.Struct({
 	reader: Reader,
@@ -6586,14 +6589,13 @@ const ConnectOrganization = Schema.Struct({
 	organization: OrgId,
 	name: OwnerName
 });
-/** Whether admission replaced a live host grant, or skipped one that no longer belongs here. */
+/**
+* A folder's host grant from before: on and the person's, so the new grant's confirm turns it off,
+* or skipped, off already or not theirs, which a yes leaves as it is.
+*/
 const GrantReplacement = Schema.Struct({
 	grant: TokenId,
-	state: Schema.Literals([
-		"replaces",
-		"revoked",
-		"skipped"
-	]),
+	state: Schema.Literals(["replaces", "skipped"]),
 	attachedAt: Schema.optionalKey(Timestamp)
 });
 /**
@@ -6767,383 +6769,6 @@ Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
 	attachGrant: Schema.optionalKey(EventId)
 })]);
 //#endregion
-//#region ../contracts/src/approvals.ts
-/**
-* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
-* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
-* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
-* keeps or shows anything, so a command is exactly what the endpoint would take.
-*/
-/**
-* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
-* where the command is made canonical, since the table is typed from the API this is part of.
-*/
-const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
-/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
-const ApprovalCommand = Schema.Struct({
-	endpoint: CommandEndpoint,
-	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	query: Schema.optionalKey(Schema.JsonObject),
-	payload: Schema.optionalKey(Schema.Json)
-});
-/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
-var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
-/** A terminal asking: its command, and the hash of the secret it collects the result with. */
-const StartApproval = Schema.Struct({
-	command: ApprovalCommand,
-	secretHash: SecretHash
-});
-/** A terminal's approval, started: what to show its person, and until when. */
-const ApprovalStarted = Schema.Struct({
-	approval: ApprovalId,
-	code: ApprovalCode,
-	expiresAt: Timestamp
-});
-/**
-* An answer that waits for the person: the call only the person may make, or that agents ask
-* for, became an approval, which the person answers on their own page. A `202`, never a failure
-* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
-*/
-var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
-	approval: ApprovalId,
-	says: Schema.String,
-	expiresAt: Timestamp
-}, { httpApiStatus: 202 }) {};
-const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
-const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
-const agentAsker = Schema.Struct({
-	kind: Schema.Literal("agent"),
-	agent: AgentId,
-	handle: AgentHandle,
-	session: SessionId,
-	/** The attachment its credential was made under, for a person's agent in an organization. */
-	attachment: Schema.optionalKey(CredentialRef)
-});
-/**
-* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
-* asking to connect, by its ID and its own word for itself, and from where.
-*/
-const ApprovalAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	Schema.Struct({
-		kind: Schema.Literal("machine"),
-		machine: MachineId,
-		machineName: MachineName,
-		askedFrom: Schema.optionalKey(Schema.String)
-	}),
-	agentAsker
-]);
-/**
-* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
-* A machine's request is read as an `AttachmentRequestView`, never as a command.
-*/
-const ApprovalViewAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	agentAsker
-]);
-/** A request, as the person reads it before they answer. */
-const ApprovalView = Schema.Struct({
-	approval: ApprovalId,
-	/** The command as its CLI line. */
-	says: Schema.String,
-	/** Everything the command carries, each named, in order: nothing it would run is left out. */
-	fields: Schema.Array(Schema.Struct({
-		name: Schema.String,
-		value: Schema.String,
-		part: Schema.Literals([
-			"path",
-			"query",
-			"payload"
-		])
-	})),
-	command: ApprovalCommand,
-	asker: ApprovalViewAsker,
-	askedFrom: Schema.optionalKey(Schema.String),
-	askedAt: Timestamp,
-	expiresAt: Timestamp,
-	/**
-	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
-	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
-	*/
-	agentPermission: Schema.optionalKey(Schema.Struct({
-		action: ScopeAction,
-		mayAllow: Schema.Boolean
-	})),
-	/**
-	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
-	* endpoint names a preview. Without one the page can draw, it offers only no.
-	*/
-	preview: Schema.optionalKey(ApprovalPreview)
-});
-/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
-const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
-/**
-* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
-* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
-* the check run its statement is over.
-*/
-const StatementAsker = Schema.Union([Schema.Struct({
-	kind: Schema.Literal("workflow"),
-	workflow: WorkflowName,
-	run: WorkflowRunId
-}), Schema.Struct({
-	kind: Schema.Literal("gate"),
-	check: CheckKey,
-	pullRequest: PullRequestNumber,
-	version: VersionNumber,
-	run: CheckRunId
-})]);
-/**
-* A passkey request, as the person reads it before they answer: the statement, its words as its
-* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
-* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
-* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
-* name, or a permission's holders; and until when.
-*/
-const StatementView = Schema.Struct({
-	approval: ApprovalId,
-	statement: WorkflowText,
-	hash: StatementHash,
-	asker: StatementAsker,
-	home: Schema.String,
-	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
-	askedAt: Timestamp,
-	expiresAt: Timestamp
-});
-/**
-* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
-* them; and each machine's request this browser session is the answerer of, so a reload finds it
-* again without its code.
-*/
-const ApprovalsWaiting = Schema.Struct({
-	approvals: Schema.Array(ApprovalView),
-	statements: Schema.Array(StatementView),
-	requests: Schema.Array(AttachmentRequestView)
-});
-/** Finding a terminal's request by the code it showed. */
-const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
-/**
-* Asking for the passkey's options to answer a request: a terminal's request needs its code
-* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
-* request needs its answerer, and the agent it chooses to connect, before a yes has options.
-*/
-const ApprovalOptionsRequest = Schema.Struct({
-	code: Schema.optionalKey(TypedApprovalCode),
-	folders: Schema.optionalKey(ConnectFolderChoices)
-});
-/**
-* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
-* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
-* it without asking; no, and stop agents asking, with the passkey too.
-*/
-const AnswerApproval = Schema.Union([
-	Schema.Struct({
-		answer: Schema.Literal("yes"),
-		permission: Schema.optionalKey(Schema.Literal("allow")),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode),
-		/** The preview the page drew, where the command's endpoint names one. */
-		preview: Schema.optionalKey(PreviewEcho),
-		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
-		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		permission: Schema.Literal("deny"),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode)
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		code: Schema.optionalKey(TypedApprovalCode)
-	})
-]);
-/**
-* What running an approved command came to: its status, and its endpoint's answer or refusal,
-* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
-* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
-* so it can't be typed by them itself.
-*/
-const Ran = Schema.Struct({
-	status: Schema.Int,
-	result: Schema.Json
-});
-/**
-* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
-* before they changed: it ran, and what it came to can't be said.
-*/
-var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
-/**
-* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
-* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
-*/
-const ApprovalState = Schema.Union([
-	Schema.Struct({
-		state: Schema.Literal("waiting"),
-		expiresAt: Timestamp
-	}),
-	Schema.Struct({
-		state: Schema.Literal("approved"),
-		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
-		collected: Schema.optionalKey(Schema.Literal(true))
-	}),
-	Schema.Struct({ state: Schema.Literal("refused") }),
-	Schema.Struct({ state: Schema.Literal("expired") }),
-	Schema.Struct({
-		state: Schema.Literal("ran"),
-		endpoint: CommandEndpoint,
-		...Ran.fields
-	})
-]);
-/** Only the answering browser receives a machine's answer code; state reads never carry it. */
-const ApprovalAnswer = Schema.Union([
-	Schema.Struct({
-		...ApprovalState.members[1].fields,
-		answerCode: ApprovalCode
-	}),
-	Schema.Struct({
-		...ApprovalState.members[4].fields,
-		answerCode: ApprovalCode
-	}),
-	ApprovalState
-]);
-/** A request that isn't there, or isn't the caller's to see, answers the same. */
-var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
-/** Too many asked, or too many codes typed, from here in the last hour. */
-var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
-/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
-const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
-Schema.Struct({
-	approval: ApprovalId,
-	endpoint: CommandEndpoint,
-	/** The command's canonical JSON. */
-	command: Schema.String,
-	commandHash: CommandHash,
-	asker: ApprovalAsker,
-	/** The browser session the person answered in, for their log. */
-	credential: CredentialRef,
-	generation: Generation,
-	/** When the request expires, in epoch milliseconds. */
-	deadline: Schema.Int,
-	challenge: Schema.String,
-	/** A machine answer retries only from its answering session, with this key. */
-	answerKey: Schema.optionalKey(RequestId),
-	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
-	asking: Schema.optionalKey(TokenId),
-	/** The kind of action the person, answering, let agents take without asking from now on. */
-	allow: Schema.optionalKey(ScopeAction)
-});
-Schema.Struct({
-	approval: ApprovalId,
-	action: ScopeAction,
-	credential: CredentialRef,
-	generation: Generation
-});
-Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
-	denied: Schema.Literal(false),
-	reason: Schema.Literals(["generation moved", "not set up"])
-})]);
-Schema.Union([Schema.Struct({
-	admitted: Schema.Literal(true),
-	admittedAt: Schema.Int,
-	answerCode: Schema.optionalKey(ApprovalCode)
-}), Schema.Struct({
-	admitted: Schema.Literal(false),
-	reason: Schema.Literals([
-		"expired",
-		"generation moved",
-		"challenge used",
-		"not set up",
-		"asker gone"
-	])
-})]);
-Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
-	found: Schema.Literal(true),
-	endpoint: CommandEndpoint,
-	command: Schema.String,
-	commandHash: CommandHash,
-	generation: Generation,
-	generationNow: Generation,
-	/** The `approval.answered` its admission recorded in the person's log. */
-	answeredEvent: EventId,
-	/** Who asked, as that `approval.answered` says. */
-	asker: ApprovalAsker,
-	/** What running it came to, once it ran, as `KeptRan` keeps it. */
-	result: Schema.optionalKey(Schema.String)
-})]);
-/**
-* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
-* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
-* `keptRan`, which refuses one they don't take.
-*/
-const KeptRan = Schema.fromJsonString(Ran);
-Schema.Struct({
-	approval: ApprovalId,
-	result: Schema.String
-});
-Schema.Struct({ result: Schema.String });
-Schema.Struct({ approval: ApprovalId });
-Schema.Struct({ approval: ApprovalId });
-Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
-Schema.Struct({
-	person: PersonId,
-	approval: ApprovalId
-});
-//#endregion
-//#region ../contracts/src/browser-sessions.ts
-/**
-* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
-* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
-* only the token's SHA-256.
-*/
-const browserSessionCookie = "__Secure-ref0.session_token";
-Schema.Struct({
-	token: TokenId,
-	secretHash: SecretHash,
-	expiresAt: Schema.DateTimeUtcFromMillis
-});
-Schema.Struct({ registered: Schema.Boolean });
-/**
-* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
-* kept back, with that login as a suggestion; setting up, once their owner is made and before
-* it's ready with this session registered, which naming again finishes; or ready.
-*/
-const Welcome = Schema.Union([Schema.Struct({
-	state: Schema.Literals(["ready", "setting up"]),
-	person: PersonId,
-	owner: OwnerId,
-	name: OwnerName
-}), Schema.Struct({
-	state: Schema.Literal("naming"),
-	person: PersonId,
-	suggestion: Schema.optionalKey(Schema.String)
-})]);
-/**
-* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
-* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
-*/
-const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
-/**
-* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
-* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
-*/
-const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
-Schema.Struct({ url: NavigationUrl });
-/**
-* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
-* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
-*/
-const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
-Schema.Struct({
-	provider: Schema.Literal("github"),
-	callbackURL: SignInDestination,
-	errorCallbackURL: SignInDestination
-});
-/** The name a naming person chose for their owner. */
-const NameOwner = Schema.Struct({ name: OwnerName });
-//#endregion
 //#region ../contracts/src/plan-events.ts
 /**
 * A plan's events, in its thread's project's log, written by the Project DO. A version's
@@ -7282,6 +6907,21 @@ const DecisionView = Schema.Struct({
 	closedWhy: Schema.optionalKey(DecisionClosedWhy)
 });
 /**
+* Where a decision is, as people write it: its thread, `pip/default#3`, or an org thread's,
+* `acme#7`; and a gate's pull request, `pip/notes#1`. Its Project DO writes them as it answers,
+* from its own threads and repos and the owner's name the Worker gives it, so each reads as it's
+* called now.
+*/
+const DecisionNames = Schema.Struct({
+	thread: WrittenThread,
+	pullRequest: Schema.optionalKey(WrittenPullRequest)
+});
+/** A decision as `/v1` answers it: as it stands, and where it is, in words. */
+const NamedDecision = Schema.Struct({
+	...DecisionView.fields,
+	names: DecisionNames
+});
+/**
 * A version as it stands: its content, its state, and, once proposed, where its approval is: its
 * repos still being checked, or who accepted it.
 */
@@ -7435,7 +7075,7 @@ const GateAnswerRoute = Schema.TaggedStruct("GateAnswerRoute", {
 	reason: Schema.optionalKey(TextId)
 });
 Schema.Union([
-	DecisionView,
+	NamedDecision,
 	GateAnswerRoute,
 	DecisionNotFound,
 	AnswerRefused,
@@ -7467,14 +7107,29 @@ Schema.Union([
 	]) }),
 	DeliveryOutsideWindow
 ]);
-Schema.Struct({
+/** Someone decisions wait on: a person, or an agent, and the roles the Worker found they hold. */
+const Waiter = Schema.Struct({
 	decider: DeciderRef,
-	roles: Schema.optionalKey(Schema.Array(Schema.Struct({
+	roles: Schema.Array(Schema.Struct({
 		role: Schema.Literal("admin"),
 		owner: OwnerId
-	})))
+	}))
 });
-const WaitingPage = Schema.Struct({ decisions: Schema.Array(DecisionView) });
+Schema.Struct({
+	ownerName: OwnerName,
+	you: Waiter,
+	person: Schema.optionalKey(Waiter),
+	decisions: Schema.optionalKey(Schema.Array(DecisionId).check(Schema.isMaxLength(100)))
+});
+/**
+* An open decision that waits on the caller: on them, or, for an agent, on its person, who
+* answers it. A gate never takes an agent's answer, so an agent's gate always waits on its person.
+*/
+const WaitingDecision = Schema.Struct({
+	...NamedDecision.fields,
+	waitsOn: Schema.Literals(["you", "your person"])
+});
+const WaitingPage = Schema.Struct({ decisions: Schema.Array(WaitingDecision) });
 Schema.Struct({
 	ownerName: OwnerName,
 	number: ThreadNumber
@@ -7492,7 +7147,7 @@ Schema.Struct({
 	decision: DecisionId,
 	wait: Schema.optionalKey(DecisionWait)
 });
-Schema.Union([DecisionView, DecisionNotFound]);
+Schema.Union([NamedDecision, DecisionNotFound]);
 /**
 * `POST …/plans`: a version, as a draft unless it's proposed at once, and why it was written.
 * A first version needs no reason, and a later one may leave it out.
@@ -7541,6 +7196,385 @@ const ChildStageView = Schema.Struct({
 });
 Schema.Union([ChildStageView, ThreadNotFound]);
 //#endregion
+//#region ../contracts/src/approvals.ts
+/**
+* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
+* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
+* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
+* keeps or shows anything, so a command is exactly what the endpoint would take.
+*/
+/**
+* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
+* where the command is made canonical, since the table is typed from the API this is part of.
+*/
+const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
+/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
+const ApprovalCommand = Schema.Struct({
+	endpoint: CommandEndpoint,
+	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	query: Schema.optionalKey(Schema.JsonObject),
+	payload: Schema.optionalKey(Schema.Json)
+});
+/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
+var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/** A terminal asking: its command, and the hash of the secret it collects the result with. */
+const StartApproval = Schema.Struct({
+	command: ApprovalCommand,
+	secretHash: SecretHash
+});
+/** A terminal's approval, started: what to show its person, and until when. */
+const ApprovalStarted = Schema.Struct({
+	approval: ApprovalId,
+	code: ApprovalCode,
+	expiresAt: Timestamp
+});
+/**
+* An answer that waits for the person: the call only the person may make, or that agents ask
+* for, became an approval, which the person answers on their own page. A `202`, never a failure
+* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
+*/
+var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
+	approval: ApprovalId,
+	says: Schema.String,
+	expiresAt: Timestamp
+}, { httpApiStatus: 202 }) {};
+const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
+const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
+const agentAsker = Schema.Struct({
+	kind: Schema.Literal("agent"),
+	agent: AgentId,
+	handle: AgentHandle,
+	session: SessionId,
+	/** The attachment its credential was made under, for a person's agent in an organization. */
+	attachment: Schema.optionalKey(CredentialRef)
+});
+/**
+* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
+* asking to connect, by its ID and its own word for itself, and from where.
+*/
+const ApprovalAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	Schema.Struct({
+		kind: Schema.Literal("machine"),
+		machine: MachineId,
+		machineName: MachineName,
+		askedFrom: Schema.optionalKey(Schema.String)
+	}),
+	agentAsker
+]);
+/**
+* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
+* A machine's request is read as an `AttachmentRequestView`, never as a command.
+*/
+const ApprovalViewAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	agentAsker
+]);
+/** A request, as the person reads it before they answer. */
+const ApprovalView = Schema.Struct({
+	approval: ApprovalId,
+	/** The command as its CLI line. */
+	says: Schema.String,
+	/** Everything the command carries, each named, in order: nothing it would run is left out. */
+	fields: Schema.Array(Schema.Struct({
+		name: Schema.String,
+		value: Schema.String,
+		part: Schema.Literals([
+			"path",
+			"query",
+			"payload"
+		])
+	})),
+	command: ApprovalCommand,
+	asker: ApprovalViewAsker,
+	askedFrom: Schema.optionalKey(Schema.String),
+	askedAt: Timestamp,
+	expiresAt: Timestamp,
+	/**
+	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
+	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
+	*/
+	agentPermission: Schema.optionalKey(Schema.Struct({
+		action: ScopeAction,
+		mayAllow: Schema.Boolean
+	})),
+	/**
+	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
+	* endpoint names a preview. Without one the page can draw, it offers only no.
+	*/
+	preview: Schema.optionalKey(ApprovalPreview)
+});
+/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
+const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+/**
+* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
+* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
+* the check run its statement is over.
+*/
+const StatementAsker = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("workflow"),
+	workflow: WorkflowName,
+	run: WorkflowRunId
+}), Schema.Struct({
+	kind: Schema.Literal("gate"),
+	check: CheckKey,
+	pullRequest: PullRequestNumber,
+	version: VersionNumber,
+	run: CheckRunId
+})]);
+/**
+* A passkey request, as the person reads it before they answer: the statement, its words as its
+* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
+* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
+* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
+* name, or a permission's holders; and until when.
+*/
+const StatementView = Schema.Struct({
+	approval: ApprovalId,
+	statement: WorkflowText,
+	hash: StatementHash,
+	asker: StatementAsker,
+	home: Schema.String,
+	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
+	askedAt: Timestamp,
+	expiresAt: Timestamp
+});
+/**
+* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
+* them; each machine's request this browser session is the answerer of, so a reload finds it
+* again without its code; and the gates' decisions that wait on their yes or no, in every project
+* they see, oldest first.
+*/
+const ApprovalsWaiting = Schema.Struct({
+	approvals: Schema.Array(ApprovalView),
+	statements: Schema.Array(StatementView),
+	requests: Schema.Array(AttachmentRequestView),
+	decisions: Schema.Array(NamedDecision)
+});
+/** Finding a terminal's request by the code it showed. */
+const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
+/**
+* Asking for the passkey's options to answer a request: a terminal's request needs its code
+* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
+* request needs its answerer, and the agent it chooses to connect, before a yes has options.
+*/
+const ApprovalOptionsRequest = Schema.Struct({
+	code: Schema.optionalKey(TypedApprovalCode),
+	folders: Schema.optionalKey(ConnectFolderChoices)
+});
+/**
+* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
+* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
+* it without asking; no, and stop agents asking, with the passkey too.
+*/
+const AnswerApproval = Schema.Union([
+	Schema.Struct({
+		answer: Schema.Literal("yes"),
+		permission: Schema.optionalKey(Schema.Literal("allow")),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode),
+		/** The preview the page drew, where the command's endpoint names one. */
+		preview: Schema.optionalKey(PreviewEcho),
+		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
+		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		permission: Schema.Literal("deny"),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode)
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		code: Schema.optionalKey(TypedApprovalCode)
+	})
+]);
+/**
+* What running an approved command came to: its status, and its endpoint's answer or refusal,
+* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
+* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
+* so it can't be typed by them itself.
+*/
+const Ran = Schema.Struct({
+	status: Schema.Int,
+	result: Schema.Json
+});
+/**
+* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
+* before they changed: it ran, and what it came to can't be said.
+*/
+var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
+/**
+* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
+* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
+*/
+const ApprovalState = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		expiresAt: Timestamp
+	}),
+	Schema.Struct({
+		state: Schema.Literal("approved"),
+		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
+		collected: Schema.optionalKey(Schema.Literal(true))
+	}),
+	Schema.Struct({ state: Schema.Literal("refused") }),
+	Schema.Struct({ state: Schema.Literal("expired") }),
+	Schema.Struct({
+		state: Schema.Literal("ran"),
+		endpoint: CommandEndpoint,
+		...Ran.fields
+	})
+]);
+/** Only the answering browser receives a machine's answer code; state reads never carry it. */
+const ApprovalAnswer = Schema.Union([
+	Schema.Struct({
+		...ApprovalState.members[1].fields,
+		answerCode: ApprovalCode
+	}),
+	Schema.Struct({
+		...ApprovalState.members[4].fields,
+		answerCode: ApprovalCode
+	}),
+	ApprovalState
+]);
+/** A request that isn't there, or isn't the caller's to see, answers the same. */
+var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
+/** Too many asked, or too many codes typed, from here in the last hour. */
+var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
+/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
+const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+Schema.Struct({
+	approval: ApprovalId,
+	endpoint: CommandEndpoint,
+	/** The command's canonical JSON. */
+	command: Schema.String,
+	commandHash: CommandHash,
+	asker: ApprovalAsker,
+	/** The browser session the person answered in, for their log. */
+	credential: CredentialRef,
+	generation: Generation,
+	/** When the request expires, in epoch milliseconds. */
+	deadline: Schema.Int,
+	challenge: Schema.String,
+	/** A machine answer retries only from its answering session, with this key. */
+	answerKey: Schema.optionalKey(RequestId),
+	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
+	asking: Schema.optionalKey(TokenId),
+	/** The kind of action the person, answering, let agents take without asking from now on. */
+	allow: Schema.optionalKey(ScopeAction)
+});
+Schema.Struct({
+	approval: ApprovalId,
+	action: ScopeAction,
+	credential: CredentialRef,
+	generation: Generation
+});
+Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
+	denied: Schema.Literal(false),
+	reason: Schema.Literals(["generation moved", "not set up"])
+})]);
+Schema.Union([Schema.Struct({
+	admitted: Schema.Literal(true),
+	admittedAt: Schema.Int,
+	answerCode: Schema.optionalKey(ApprovalCode)
+}), Schema.Struct({
+	admitted: Schema.Literal(false),
+	reason: Schema.Literals([
+		"expired",
+		"generation moved",
+		"challenge used",
+		"not set up",
+		"asker gone"
+	])
+})]);
+Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
+	found: Schema.Literal(true),
+	endpoint: CommandEndpoint,
+	command: Schema.String,
+	commandHash: CommandHash,
+	generation: Generation,
+	generationNow: Generation,
+	/** The `approval.answered` its admission recorded in the person's log. */
+	answeredEvent: EventId,
+	/** Who asked, as that `approval.answered` says. */
+	asker: ApprovalAsker,
+	/** What running it came to, once it ran, as `KeptRan` keeps it. */
+	result: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
+* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
+* `keptRan`, which refuses one they don't take.
+*/
+const KeptRan = Schema.fromJsonString(Ran);
+Schema.Struct({
+	approval: ApprovalId,
+	result: Schema.String
+});
+Schema.Struct({ result: Schema.String });
+Schema.Struct({ approval: ApprovalId });
+Schema.Struct({ approval: ApprovalId });
+Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
+Schema.Struct({
+	person: PersonId,
+	approval: ApprovalId
+});
+//#endregion
+//#region ../contracts/src/browser-sessions.ts
+/**
+* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
+* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
+* only the token's SHA-256.
+*/
+const browserSessionCookie = "__Secure-ref0.session_token";
+Schema.Struct({
+	token: TokenId,
+	secretHash: SecretHash,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+Schema.Struct({ registered: Schema.Boolean });
+/**
+* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
+* kept back, with that login as a suggestion; setting up, once their owner is made and before
+* it's ready with this session registered, which naming again finishes; or ready.
+*/
+const Welcome = Schema.Union([Schema.Struct({
+	state: Schema.Literals(["ready", "setting up"]),
+	person: PersonId,
+	owner: OwnerId,
+	name: OwnerName
+}), Schema.Struct({
+	state: Schema.Literal("naming"),
+	person: PersonId,
+	suggestion: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
+* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
+*/
+const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
+/**
+* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
+* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
+*/
+const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
+Schema.Struct({ url: NavigationUrl });
+/**
+* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
+* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
+*/
+const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
+Schema.Struct({
+	provider: Schema.Literal("github"),
+	callbackURL: SignInDestination,
+	errorCallbackURL: SignInDestination
+});
+/** The name a naming person chose for their owner. */
+const NameOwner = Schema.Struct({ name: OwnerName });
+//#endregion
 //#region ../contracts/src/ask-calls.ts
 /**
 * Asks: a question that waits on an answer, from an agent's session or a person, on a thread,
@@ -11659,6 +11693,151 @@ Schema.Struct({
 		name: RepoName
 	}))
 });
+/** Where an agent's session asks for an identity token. */
+const identityTokenPath = "/v1/me/identity-token";
+/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
+const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
+const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
+/**
+* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
+* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
+* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
+*/
+const parsesAsWritten = (audience) => {
+	const parts = audiencePattern.exec(audience);
+	if (parts === null || !URL.canParse(audience)) return false;
+	const url = new URL(audience);
+	const port = parts[2] ?? "";
+	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
+};
+/**
+* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
+* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
+* case and any port too, so `https://verifier.example:443` is another audience than
+* `https://verifier.example`. ref0 never fetches or resolves it.
+*/
+const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
+/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
+const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
+/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
+const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
+/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
+const IssuedIdentityToken = Schema.Struct({
+	token: IdentityToken,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+/**
+* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
+* token, naming its issuance in ref0's log without naming any row or secret.
+*/
+const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
+/**
+* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
+* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
+* audience, different at every other, and carrying no time.
+*/
+const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
+/** A session, as one audience knows it, made as a person's is. */
+const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
+/** The accountable person, last in a token's chain: only their pairwise ID. */
+const PersonActor = Schema.Struct({ sub: PairwisePersonId });
+/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
+const sessionActing = (act) => Schema.Struct({
+	sub: PairwiseSessionId,
+	act
+});
+const oneSession = sessionActing(PersonActor);
+const twoSessions = sessionActing(oneSession);
+const threeSessions = sessionActing(twoSessions);
+/**
+* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
+* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
+* allows the agent in `sub`, never an actor.
+*/
+const IdentityActor = Schema.Union([
+	oneSession,
+	twoSessions,
+	threeSessions,
+	sessionActing(threeSessions)
+]);
+/** A time in a token, in whole UTC epoch seconds. */
+const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
+Schema.Struct({
+	iss: ApiOrigin,
+	sub: AgentId,
+	aud: IdentityAudience,
+	iat: EpochSeconds,
+	exp: EpochSeconds,
+	jti: IdentityTokenId,
+	act: IdentityActor
+}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
+/**
+* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
+* never names two keys.
+*/
+const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
+Schema.Struct({
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId,
+	typ: Schema.Literal("JWT")
+});
+/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
+const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+/** One public key in the JWKS: exactly these fields, and never a private one. */
+const PublicSigningKey = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Coordinate,
+	y: Coordinate,
+	use: Schema.Literal("sig"),
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId
+});
+Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
+Schema.Struct({
+	issuer: ApiOrigin,
+	jwks_uri: Schema.String,
+	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
+	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
+	claims_supported: Schema.Tuple([
+		Schema.Literal("iss"),
+		Schema.Literal("sub"),
+		Schema.Literal("aud"),
+		Schema.Literal("exp"),
+		Schema.Literal("iat"),
+		Schema.Literal("jti"),
+		Schema.Literal("act")
+	])
+});
+/**
+* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+* `IdentityAudience` says. The refused text is never echoed.
+*/
+var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/**
+* Less than a whole second is left before the session, a parent or the credential expires, or
+* the token would expire before it's recorded: the next prompt renews or replaces the session.
+*/
+var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
+/**
+* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
+* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
+* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
+* received or used it. A failed append discards the token, so every token has its event.
+*/
+const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
+	session: SessionId,
+	agent: AgentRef,
+	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
+	accountable: PersonId,
+	jti: IdentityTokenId,
+	audience: IdentityAudience,
+	issuer: ApiOrigin,
+	keyId: SigningKeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}));
 Schema.Literals([
 	"info/refs",
 	"git-upload-pack",
@@ -11911,6 +12090,71 @@ const GateAddition = Schema.Struct({
 	from: NeedFrom
 });
 /**
+* A yes that met a need: its decider's, given by the person `by` when one gave it, such as an
+* admin answering as the owner's admins; or, `overridden`, a check ref0 said no to, met by the
+* yes of each of its overrides.
+*/
+const NeedYes = Schema.Struct({
+	decider: DeciderRef,
+	by: Schema.optionalKey(PersonId),
+	overridden: Schema.optionalKey(Schema.Literal(true))
+});
+/**
+* An override left of a check ref0 said no to: of a part's failed run, or of the check not running,
+* and who answers it.
+*/
+const OverrideLeft = Schema.Struct({
+	of: Schema.Literals(["failed run", "not run"]),
+	by: OverrideAnswerer
+});
+/**
+* A decider a need waits on. For a check ref0 said no to, `overrides` lists each of its overrides
+* left, every one of whose yeses meets it in a pass's place, none when it has none: one yes to a
+* gate answers every decider its person may answer as, each override among them.
+*/
+const NeedWait = Schema.Struct({
+	decider: DeciderRef,
+	overrides: Schema.optionalKey(Schema.Array(OverrideLeft).check(Schema.isMaxLength(maxGateDeciders)))
+});
+/**
+* How one of a version's needs stands under its gate's answers now, as the gate is decided from
+* them: `met` by each yes in `by`; `met` with nothing to wait for, `as` `no checks`, for `checks`
+* when none of the repo's checks runs on the change, or `on the tip`, for a check only the merge
+* queue's tip runs, which judges it before `main` moves; `waiting` on each decider in `on`, when
+* `all`, or else on a yes from any one of them; `waiting` for ref0 to read which of `main`'s
+* checks run on the change; or `refused` by a person's no to one of its deciders, or to an
+* override of one, which decides the whole gate no.
+*/
+const NeedStanding = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		by: Schema.Array(NeedYes).check(Schema.isMaxLength(maxGateDeciders))
+	}),
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		as: Schema.Literals(["no checks", "on the tip"])
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		on: Schema.Array(NeedWait).check(Schema.isMaxLength(maxGateDeciders)),
+		all: Schema.Boolean
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		for: Schema.Literal("checks read")
+	}),
+	Schema.Struct({
+		state: Schema.Literal("refused"),
+		decider: DeciderRef,
+		by: PersonId
+	})
+]);
+/** A version's need, with every place it came from, and how it stands once its gate is open. */
+const GateNeedView = Schema.Struct({
+	...GateNeed.fields,
+	standing: Schema.optionalKey(NeedStanding)
+});
+/**
 * The version's gate decided again in place under `main`'s `.ref0/` now (Q7c): on which `main`
 * and under its tree, `pending` until `main`'s gate answers, then `held` or `grew`; the needs
 * it answered, joined to ref0's floor, absent while pending; what `main`'s gate read of the
@@ -12012,8 +12256,21 @@ const GateView = Schema.Struct({
 	state: GateState,
 	/** Why the gate failed; null otherwise. */
 	why: Schema.NullOr(Schema.String),
-	/** None while pending; once answered, the floor's too, sorted as they're spelled. */
-	needs: Schema.Array(GateNeed),
+	/**
+	* None while pending; once answered, the floor's too, sorted as they're spelled, each with how
+	* it stands once the version's gate is open.
+	*/
+	needs: Schema.Array(GateNeedView),
+	/** The repo's owner, whose admins answer its admins' needs: at home, its person alone. */
+	owner: OwnerId,
+	/**
+	* The names of the owner and of the people its needs' standings name, where the directory has
+	* them.
+	*/
+	names: Schema.optionalKey(Schema.Array(Schema.Struct({
+		owner: OwnerId,
+		name: OwnerName
+	})).check(Schema.isMaxLength(maxGateDeciders + 1))),
 	/** What the gate read of the change's trees, each read once, in order; none while pending. */
 	reads: GateReads,
 	/** The project gate revision the version was decided under; none for 0. */
@@ -12984,7 +13241,7 @@ Schema.Struct({
 	actor: ActorRef,
 	/** The attachment an agent's credential was made under, which an organization asks after; null for a person. */
 	attachment: Schema.NullOr(CredentialRef),
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	ownerName: OwnerName,
 	number: ThreadNumber
 });
@@ -14133,6 +14390,7 @@ const KnownEvent = Schema.Union([
 	ThreadListingChanged,
 	SessionStarted,
 	SessionEnded,
+	IdentityTokenIssued,
 	MemberRoleChanged,
 	MemberRemoved,
 	InvitationSent,
@@ -14994,6 +15252,11 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 * what to change. Any other part that fails its contract is answered with Effect's empty 400.
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
+/**
+* An identity token's request whose audience its contract refuses, missing or not an HTTPS
+* origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
+*/
+var IdentityAudienceRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/IdentityAudienceRefusal", { error: IdentityAudienceRefused }) {};
 const idempotency = { "idempotency-key": RequestId };
 const inProject$1 = {
 	owner: OwnerRef,
@@ -15216,7 +15479,18 @@ var MeGroup = class extends HttpApiGroup.make("me").add(HttpApiEndpoint.get("get
 		UsageRangeRefused,
 		AuthorityUnavailable
 	]
-})).middleware(Authorization) {};
+}), HttpApiEndpoint.post("identityToken", identityTokenPath, {
+	payload: IdentityTokenRequest,
+	success: IssuedIdentityToken,
+	error: [
+		IdentityAudienceRefused,
+		IdentityTokenNotReady,
+		NotPermitted,
+		SessionHasEnded,
+		SlowDown,
+		AuthorityUnavailable
+	]
+}).middleware(IdentityAudienceRefusal)).middleware(Authorization) {};
 /**
 * A thread's endpoints, as one of a project's threads and an org thread take them alike, by
 * where they are: `at` is a project's path parameters, or the owner's alone for its own scope.
@@ -16152,15 +16426,18 @@ const decisionEndpoints = (at) => {
 		HttpApiEndpoint.get("get", "/:decision", {
 			params: onDecision,
 			query: { wait: Schema.optionalKey(DecisionWait) },
-			success: DecisionView,
+			success: NamedDecision,
 			error: [...projectErrors, DecisionNotFound]
 		}),
 		HttpApiEndpoint.post("answer", "/:decision/answers", {
 			params: onDecision,
 			headers: idempotency,
 			payload: AnswerRequest,
-			success: DecisionView,
+			success: NamedDecision,
 			error: [
+				ApprovalNeeded,
+				CommandRefused,
+				SlowDown,
 				...projectErrors,
 				DecisionNotFound,
 				AnswerRefused,
@@ -17007,6 +17284,15 @@ const ownSurfaces = {
 		cli: "meters",
 		mcp: null
 	},
+	"me.identityToken": {
+		action: "session:change",
+		actors: "agent",
+		target: "session",
+		stepUp: "never",
+		asks: "never",
+		cli: "identity-token",
+		mcp: null
+	},
 	"threads.list": {
 		action: "project:read",
 		actors: "both",
@@ -18822,271 +19108,6 @@ const freshTokenSecret = Effect.suspend(() => hashed(encodeSecret(crypto.getRand
 /** A link carries 128 random bits in its fragment; ref0 receives only their hash at start. */
 const freshLinkSecret = Effect.suspend(() => hashed(Buffer.from(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16))).toString("base64url")));
 //#endregion
-//#region src/session.ts
-/**
-* An agent's command in a harness session that has no ref0 session, though an agent is connected
-* for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
-* person instead.
-*/
-var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
-/**
-* The token of the session this command runs in, if it runs in one: an agent's, which its
-* harness bound when the session started. Where it's found is the harness's to say. Outside a
-* session, there's none, and every command is the person's, asked by approval.
-*/
-var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
-	/** No session: until a harness binds one, the person asks, by approval. */
-	static none = Layer.succeed(SessionToken, SessionToken.of({ current: Effect.succeedNone }));
-};
-//#endregion
-//#region src/call.ts
-/**
-* Every command's one way to ref0: an endpoint's request, sent with the session's token when
-* the command runs in a session, or else asked of the person, by approval, from this terminal.
-* Either way the answer is the endpoint's own, as JSON.
-*/
-/** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
-var CallFailed = class extends Schema.TaggedError()("CallFailed", {
-	status: Schema.Int,
-	kind: Schema.String,
-	nextStep: Schema.String
-}) {};
-const decodeJson$1 = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
-const decodeSecretHash$2 = Schema.decodeUnknownEffect(SecretHash);
-const decodeNeeded = Schema.decodeUnknownOption(Schema.toCodecJson(ApprovalNeeded));
-const decodeRefusal = Schema.decodeUnknownOption(AnyError);
-/** How often a terminal asks whether its person has answered. */
-const pollMillis$1 = 2e3;
-/** How long one request may take before it's asked again, or the call gives up. */
-const requestTimeout$1 = Duration.seconds(15);
-/**
-* How long a session's request may take for the commands that read and compile before they
-* answer: starting check runs reads `.ref0/` from `main`, and from a thread's head when `main`
-* lacks the check, one paced read at a time, up to 256 files each.
-*/
-const timeoutOf = (endpoint) => endpoint === "runs.start" ? Duration.minutes(2) : requestTimeout$1;
-/** How long past the time to answer a terminal still asks, if ref0 hasn't said expired. */
-const giveUpAfterMillis$1 = 3e5;
-/** How long a terminal goes on asking while ref0 doesn't answer at all, before it says so. */
-const outageMillis = 3e5;
-/** What a change that failed partway says: ref0 may have made it all the same. */
-const mayHaveRun = "ref0 failed partway, so it may have run. Check before you run it again.";
-/**
-* An answer that isn't a success, as the command's failure. A change that ref0 failed on, a
-* 5xx, may have been made before it failed, so it isn't said to try again.
-*/
-const failedWith$15 = (status, body, change) => Option.match(decodeRefusal(body), {
-	onNone: () => new CallFailed({
-		status,
-		kind: "Unexpected",
-		nextStep: change && status >= 500 ? mayHaveRun : "ref0 answered oddly. Try again."
-	}),
-	onSome: (refusal) => new CallFailed({
-		status,
-		kind: refusal._tag,
-		nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
-	})
-});
-/**
-* A ran command's refusal, read as its endpoint's own error, or ref0's in its place, as the
-* command's failure: a change that failed at a 5xx may have been made all the same.
-*/
-const refusedBy = (status, refusal, change) => new CallFailed({
-	status,
-	kind: refusal._tag,
-	nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
-});
-/**
-* An answer none of its endpoint's schemas reads: another endpoint's, or one a bug in ref0 or
-* the CLI made. A change it answered may have run.
-*/
-const unreadable = (endpoint, change) => new CallFailed({
-	status: 0,
-	kind: "Unexpected",
-	nextStep: change ? `ref0’s answer to ${endpoint} isn’t one that endpoint gives, so it may have run. Check before you run it again.` : `ref0’s answer to ${endpoint} isn’t one that endpoint gives. Try again.`
-});
-const unreachable = new CallFailed({
-	status: 0,
-	kind: "Unreachable",
-	nextStep: "Couldn’t reach ref0. Try again."
-});
-/**
-* An ask ref0 doesn't know: a result kept past its day, or an ask never kept. Either way a
-* change may have run, and asking again could make it twice.
-*/
-const gone = (change, nextStep) => new CallFailed({
-	status: 404,
-	kind: "ApprovalNotFound",
-	nextStep: change ? "ref0 no longer knows how this ended, so it may have run. Check before you run it again." : nextStep
-});
-/** A change sent with no answer: ref0 may have made it, so running it again may make it twice. */
-const unanswered$1 = new CallFailed({
-	status: 0,
-	kind: "Unreachable",
-	nextStep: "ref0 didn’t answer, so it may have run. Check before you run it again."
-});
-/**
-* Waits for the person's answer to an ask, a terminal's or an agent's, by collecting where it
-* stands until it ran, was refused or expired: ref0's state, or none when it didn't answer.
-* What it ran to is read as the endpoint it asked for: its answer, as JSON, or its refusal.
-*/
-const waitForAnswer = Effect.fnUntraced(function* (collect, expiresAt, change, endpoint) {
-	const giveUpAt = DateTime.toEpochMillis(expiresAt) + giveUpAfterMillis$1;
-	let approved = false;
-	let heardAt = yield* Clock.currentTimeMillis;
-	while (true) {
-		const answered = yield* collect;
-		const now = yield* Clock.currentTimeMillis;
-		if (Option.isNone(answered)) {
-			if (now - heardAt > outageMillis) return yield* new CallFailed({
-				status: 0,
-				kind: "Unreachable",
-				nextStep: approved ? "It was approved, and ref0 stopped answering before it said it ran. Check whether it did before you run it again." : "ref0 stopped answering before it said how it ended. Check whether it ran before you run it again."
-			});
-			yield* Effect.sleep(pollMillis$1);
-			continue;
-		}
-		const state = answered.value;
-		heardAt = now;
-		if (state.state === "ran") return yield* Option.match(ranOf(endpoint, state), {
-			onNone: () => Effect.fail(unreadable(endpoint, change)),
-			onSome: Result.match({
-				onSuccess: () => Effect.succeed(state.result),
-				onFailure: (refusal) => Effect.fail(refusedBy(state.status, refusal, change))
-			})
-		});
-		if (state.state === "refused") return yield* new CallFailed({
-			status: 403,
-			kind: "Refused",
-			nextStep: "It was refused."
-		});
-		if (state.state === "approved") {
-			if (!approved) yield* Console.error("Approved. Waiting for it to run.");
-			approved = true;
-			yield* Effect.sleep(pollMillis$1);
-			continue;
-		}
-		if (state.state === "expired" || !approved && now > giveUpAt) return yield* new CallFailed({
-			status: 408,
-			kind: "Expired",
-			nextStep: "Nobody approved it in time. Run it again."
-		});
-		yield* Effect.sleep(pollMillis$1);
-	}
-});
-var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
-	static layer = Layer.effect(Ref0, Effect.gen(function* () {
-		const config = yield* Ref0Config;
-		const session = yield* SessionToken;
-		const http = yield* HttpClient.HttpClient;
-		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
-			const timeout = timeoutOf(request.command.endpoint);
-			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
-			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
-			const change = request.method !== "GET";
-			const lost = change ? unanswered$1 : unreachable;
-			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
-				response,
-				text
-			}))), Effect.timeoutOrElse({
-				duration: timeout,
-				orElse: () => Effect.fail(lost)
-			}), Effect.mapError(() => lost));
-			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
-			if (response.status === 202) {
-				const needed = decodeNeeded(body);
-				if (Option.isNone(needed)) return yield* failedWith$15(202, body, change);
-				yield* Console.error(`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`);
-				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
-			}
-			return response.status < 300 ? body : yield* failedWith$15(response.status, body, change);
-		});
-		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
-			const refused = (status) => (error) => Effect.fail(new CallFailed({
-				status,
-				kind: error._tag,
-				nextStep: error.nextStep
-			}));
-			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.succeedNone
-			}), Effect.catchTags({
-				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
-				Unauthenticated: refused(401),
-				SessionHasEnded: refused(410)
-			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
-		});
-		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
-			const { secret, hash } = yield* freshSecret;
-			const secretHash = yield* Effect.orDie(decodeSecretHash$2(hash));
-			const started = yield* client.terminalApprovals.start({
-				headers: { "idempotency-key": yield* newRequestId },
-				payload: {
-					command,
-					secretHash
-				}
-			}).pipe(Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.fail(unreachable)
-			}), Effect.catchTags({
-				CommandRefused: (refused) => Effect.fail(new CallFailed({
-					status: 400,
-					kind: refused._tag,
-					nextStep: refused.nextStep
-				})),
-				SlowDown: (slow) => Effect.fail(new CallFailed({
-					status: 429,
-					kind: slow._tag,
-					nextStep: slow.nextStep
-				}))
-			}), Effect.mapError((error) => error instanceof CallFailed ? error : unreachable));
-			yield* Console.error(`Approve this under Waiting on you, at ${config.api}${webPages.home}, with the code ${started.code}`);
-			const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, secret)));
-			const collect = (yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http))).terminalApprovals.result({ params: { approval: started.approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.succeedNone
-			}), Effect.catchTag("ApprovalNotFound", (missing) => Effect.fail(gone(change, missing.nextStep))), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
-			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
-		});
-		const call = Effect.fn("Ref0.call")(function* (command) {
-			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
-				status: 0,
-				kind: error._tag,
-				nextStep: error.nextStep
-			})));
-			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
-				status: 400,
-				kind: refused._tag,
-				nextStep: refused.nextStep
-			})));
-			const change = request.method !== "GET";
-			const answer = yield* Option.match(token, {
-				onNone: () => asPerson(request.command, change, command.endpoint),
-				onSome: (bearer) => asSession(bearer, request, command.endpoint)
-			});
-			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
-			return answer;
-		});
-		return Ref0.of({ call });
-	}));
-};
-/**
-* One endpoint's call, typed from the API: the compiler checks its command, and its answer is
-* read by the endpoint's own success schemas, so what a command shows of it is checked too.
-*/
-const callEndpoint = (command) => Effect.gen(function* () {
-	const json = yield* (yield* Ref0).call(command);
-	return {
-		json,
-		value: yield* Option.match(successOf(command.endpoint, json), {
-			onNone: () => Effect.fail(unreadable(command.endpoint, false)),
-			onSome: Effect.succeed
-		})
-	};
-});
-//#endregion
 //#region src/output.ts
 /**
 * What a command prints: words for a person, or, with `--json`, the endpoint's answer as JSON,
@@ -19112,12 +19133,88 @@ const renderLine = (line, terminal) => {
 	if (line.status === "unknown") return `? unknown  ${printable(line.text)}`;
 	return `${line.status === "yes" ? styled("✓", 32, terminal) : styled("✗", 31, terminal)} ${line.status}  ${printable(line.text)}`;
 };
-const renderBlocks = (blocks, stream) => {
+/** The most columns a printed line takes, however wide the terminal. */
+const mostColumns = 100;
+/** A printed text without the styles this printer adds. */
+const unstyled = (text) => text.replaceAll(/\u001b\[\d+m/g, "");
+const graphemes = new Intl.Segmenter();
+/** The columns a printed text takes, a character each as the person sees it: styles take none. */
+const columnsOf = (text) => [...graphemes.segment(unstyled(text))].length;
+/** A word that says an inline command follows: `run ref0 connect`, `Read a text: ref0 text …`. */
+const introducesCommand = (word) => word === "run" || word === "Run" || word.endsWith(":");
+/**
+* Inline `ref0` commands made single words while they fit in `room`: `ref0` and the word after it
+* always, and a command after `run` or a colon to its clause's end, so no line breaks inside one.
+*/
+const withCommandsWhole = (words, room) => {
+	const joined = [];
+	for (let at = 0; at < words.length; at += 1) {
+		const first = words[at];
+		if (first === void 0) continue;
+		if (unstyled(first.word) !== "ref0" || at + 1 >= words.length) {
+			joined.push(first);
+			continue;
+		}
+		const before = words[at - 1];
+		let end = at + 1;
+		if (before !== void 0 && introducesCommand(unstyled(before.word))) while (end + 1 < words.length && !/[.,;:]$/.test(unstyled(words[end]?.word ?? ""))) end += 1;
+		const word = words.slice(at, end + 1).map((each, index) => index === 0 ? each.word : `${each.space}${each.word}`).join("");
+		if (columnsOf(word) > room) {
+			joined.push(first);
+			continue;
+		}
+		joined.push({
+			space: first.space,
+			word
+		});
+		at = end;
+	}
+	return joined;
+};
+/**
+* A line broken between words to fit `width` columns, each line after the first indented as the
+* first is. A line that fits stays as it is, and a word wider than the width stays whole, on a
+* line of its own.
+*/
+const wrapLine = (line, width) => {
+	if (columnsOf(line) <= width) return line;
+	const indent = /^\s*/.exec(line)?.[0] ?? "";
+	const room = Math.max(1, width - columnsOf(indent));
+	const words = withCommandsWhole(Array.from(line.slice(indent.length).matchAll(/(\s*)(\S+)/g), ([, space = "", word = ""]) => ({
+		space,
+		word
+	})), room);
+	const lines = [];
+	let current = "";
+	for (const { space, word } of words) if (current !== "" && columnsOf(current) + columnsOf(space) + columnsOf(word) > room) {
+		lines.push(current);
+		current = word;
+	} else current += current === "" ? word : `${space}${word}`;
+	return [...lines, current].map((each) => `${indent}${each}`).join("\n");
+};
+/**
+* How wide a printed line may be: the terminal's width, at most 100 columns, or none when the
+* stream isn't a terminal, as for an agent or a script, whose own reader wraps.
+*/
+const widthOf = (stream) => {
+	if (process[stream].isTTY !== true) return void 0;
+	const columns = process[stream].columns;
+	return columns > 0 ? Math.min(columns, mostColumns) : mostColumns;
+};
+const renderBlocks = (blocks, stream, width) => {
 	const terminal = process[stream].isTTY === true && process.env["NO_COLOR"] === void 0;
-	return blocks.flatMap((block) => block.length === 0 ? [] : [block.map((line) => renderLine(line, terminal)).join("\n")]).join("\n\n");
+	const shown = (line) => {
+		const rendered = renderLine(line, terminal);
+		if (width === void 0 || !Predicate.isString(line) && "command" in line) return rendered;
+		return rendered.split("\n").map((each) => wrapLine(each, width)).join("\n");
+	};
+	return blocks.flatMap((block) => block.length === 0 ? [] : [block.map(shown).join("\n")]).join("\n\n");
 };
-/** Words go to stderr by default; a command's answer goes to stdout. */
-const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream)).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
+/**
+* Words go to stderr by default; a command's answer goes to stdout. In a terminal, each line but a
+* command's is broken between words to fit it.
+*/
+const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream, widthOf(stream))).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
 /**
 * A yes-or-no question as the terminal shows it, bold, then `(y/N)`: no unless the person says
 * yes. The cursor stays after it, for their answer.
@@ -19187,6 +19284,279 @@ var Said = class extends Schema.TaggedError()("Said", {}) {
 };
 /** Says what went wrong, once, on stderr, and fails the command. */
 const sayFailed = (words) => printBlocks(Predicate.isString(words) ? [[words]] : words).pipe(Effect.andThen(Effect.fail(new Said())));
+//#endregion
+//#region src/session.ts
+/**
+* An agent's command in a harness session that has no ref0 session, though an agent is connected
+* for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
+* person instead.
+*/
+var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
+/**
+* The token of the session this command runs in, if it runs in one: an agent's, which its
+* harness bound when the session started. Where it's found is the harness's to say. Outside a
+* session, there's none, and every command is the person's, asked by approval.
+*/
+var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
+	/** No session: until a harness binds one, the person asks, by approval. */
+	static none = Layer.succeed(SessionToken, SessionToken.of({ current: Effect.succeedNone }));
+};
+/**
+* The thread the session this command runs in is on, as its start kept it beside the session's
+* token. Outside a session there's none, and in one whose start kept none.
+*/
+var SessionThread = class SessionThread extends Context.Service()("ref0/cli/SessionThread") {
+	/** No session, so no thread. */
+	static none = Layer.succeed(SessionThread, SessionThread.of({ current: Effect.succeedNone }));
+};
+//#endregion
+//#region src/call.ts
+/**
+* Every command's one way to ref0: an endpoint's request, sent with the session's token when
+* the command runs in a session, or else asked of the person, by approval, from this terminal.
+* Either way the answer is the endpoint's own, as JSON.
+*/
+/** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
+var CallFailed = class extends Schema.TaggedError()("CallFailed", {
+	status: Schema.Int,
+	kind: Schema.String,
+	nextStep: Schema.String
+}) {};
+const decodeJson$1 = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
+const decodeSecretHash$2 = Schema.decodeUnknownEffect(SecretHash);
+const decodeNeeded = Schema.decodeUnknownOption(Schema.toCodecJson(ApprovalNeeded));
+const decodeRefusal = Schema.decodeUnknownOption(AnyError);
+/** How often a terminal asks whether its person has answered. */
+const pollMillis$1 = 2e3;
+/** How long one request may take before it's asked again, or the call gives up. */
+const requestTimeout$1 = Duration.seconds(15);
+/**
+* How long a session's request may take for the commands that read and compile before they
+* answer: starting check runs reads `.ref0/` from `main`, and from a thread's head when `main`
+* lacks the check, one paced read at a time, up to 256 files each.
+*/
+const timeoutOf = (endpoint) => endpoint === "runs.start" ? Duration.minutes(2) : requestTimeout$1;
+/** How long past the time to answer a terminal still asks, if ref0 hasn't said expired. */
+const giveUpAfterMillis$1 = 3e5;
+/** How long a terminal goes on asking while ref0 doesn't answer at all, before it says so. */
+const outageMillis = 3e5;
+/** What a change that failed partway says: ref0 may have made it all the same. */
+const mayHaveRun = "ref0 failed partway, so it may have run. Check before you run it again.";
+/**
+* An answer that isn't a success, as the command's failure. A change that ref0 failed on, a
+* 5xx, may have been made before it failed, so it isn't said to try again.
+*/
+const failedWith$16 = (status, body, change) => Option.match(decodeRefusal(body), {
+	onNone: () => new CallFailed({
+		status,
+		kind: "Unexpected",
+		nextStep: change && status >= 500 ? mayHaveRun : "ref0 answered oddly. Try again."
+	}),
+	onSome: (refusal) => new CallFailed({
+		status,
+		kind: refusal._tag,
+		nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
+	})
+});
+/**
+* A ran command's refusal, read as its endpoint's own error, or ref0's in its place, as the
+* command's failure: a change that failed at a 5xx may have been made all the same.
+*/
+const refusedBy = (status, refusal, change) => new CallFailed({
+	status,
+	kind: refusal._tag,
+	nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
+});
+/**
+* An answer none of its endpoint's schemas reads: another endpoint's, or one a bug in ref0 or
+* the CLI made. A change it answered may have run.
+*/
+const unreadable = (endpoint, change) => new CallFailed({
+	status: 0,
+	kind: "Unexpected",
+	nextStep: change ? `ref0’s answer to ${endpoint} isn’t one that endpoint gives, so it may have run. Check before you run it again.` : `ref0’s answer to ${endpoint} isn’t one that endpoint gives. Try again.`
+});
+const unreachable = new CallFailed({
+	status: 0,
+	kind: "Unreachable",
+	nextStep: "Couldn’t reach ref0. Try again."
+});
+/**
+* An ask ref0 doesn't know: a result kept past its day, or an ask never kept. Either way a
+* change may have run, and asking again could make it twice.
+*/
+const gone = (change, nextStep) => new CallFailed({
+	status: 404,
+	kind: "ApprovalNotFound",
+	nextStep: change ? "ref0 no longer knows how this ended, so it may have run. Check before you run it again." : nextStep
+});
+/** A change sent with no answer: ref0 may have made it, so running it again may make it twice. */
+const unanswered$1 = new CallFailed({
+	status: 0,
+	kind: "Unreachable",
+	nextStep: "ref0 didn’t answer, so it may have run. Check before you run it again."
+});
+/**
+* Waits for the person's answer to an ask, a terminal's or an agent's, by collecting where it
+* stands until it ran, was refused or expired: ref0's state, or none when it didn't answer.
+* What it ran to is read as the endpoint it asked for: its answer, as JSON, or its refusal.
+*/
+const waitForAnswer = Effect.fnUntraced(function* (collect, expiresAt, change, endpoint) {
+	const giveUpAt = DateTime.toEpochMillis(expiresAt) + giveUpAfterMillis$1;
+	let approved = false;
+	let heardAt = yield* Clock.currentTimeMillis;
+	while (true) {
+		const answered = yield* collect;
+		const now = yield* Clock.currentTimeMillis;
+		if (Option.isNone(answered)) {
+			if (now - heardAt > outageMillis) return yield* new CallFailed({
+				status: 0,
+				kind: "Unreachable",
+				nextStep: approved ? "It was approved, and ref0 stopped answering before it said it ran. Check whether it did before you run it again." : "ref0 stopped answering before it said how it ended. Check whether it ran before you run it again."
+			});
+			yield* Effect.sleep(pollMillis$1);
+			continue;
+		}
+		const state = answered.value;
+		heardAt = now;
+		if (state.state === "ran") return yield* Option.match(ranOf(endpoint, state), {
+			onNone: () => Effect.fail(unreadable(endpoint, change)),
+			onSome: Result.match({
+				onSuccess: () => Effect.succeed(state.result),
+				onFailure: (refusal) => Effect.fail(refusedBy(state.status, refusal, change))
+			})
+		});
+		if (state.state === "refused") return yield* new CallFailed({
+			status: 403,
+			kind: "Refused",
+			nextStep: "It was refused."
+		});
+		if (state.state === "approved") {
+			if (!approved) yield* printBlocks([["Approved. Waiting for it to run."]]);
+			approved = true;
+			yield* Effect.sleep(pollMillis$1);
+			continue;
+		}
+		if (state.state === "expired" || !approved && now > giveUpAt) return yield* new CallFailed({
+			status: 408,
+			kind: "Expired",
+			nextStep: "Nobody approved it in time. Run it again."
+		});
+		yield* Effect.sleep(pollMillis$1);
+	}
+});
+var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
+	static layer = Layer.effect(Ref0, Effect.gen(function* () {
+		const config = yield* Ref0Config;
+		const session = yield* SessionToken;
+		const http = yield* HttpClient.HttpClient;
+		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
+			const timeout = timeoutOf(request.command.endpoint);
+			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
+			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
+			const change = request.method !== "GET";
+			const lost = change ? unanswered$1 : unreachable;
+			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
+				response,
+				text
+			}))), Effect.timeoutOrElse({
+				duration: timeout,
+				orElse: () => Effect.fail(lost)
+			}), Effect.mapError(() => lost));
+			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
+			if (response.status === 202) {
+				const needed = decodeNeeded(body);
+				if (Option.isNone(needed)) return yield* failedWith$16(202, body, change);
+				yield* printBlocks([[`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`]]);
+				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
+			}
+			return response.status < 300 ? body : yield* failedWith$16(response.status, body, change);
+		});
+		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
+			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
+			const refused = (status) => (error) => Effect.fail(new CallFailed({
+				status,
+				kind: error._tag,
+				nextStep: error.nextStep
+			}));
+			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.succeedNone
+			}), Effect.catchTags({
+				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
+				Unauthenticated: refused(401),
+				SessionHasEnded: refused(410)
+			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
+		});
+		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
+			const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
+			const { secret, hash } = yield* freshSecret;
+			const secretHash = yield* Effect.orDie(decodeSecretHash$2(hash));
+			const started = yield* client.terminalApprovals.start({
+				headers: { "idempotency-key": yield* newRequestId },
+				payload: {
+					command,
+					secretHash
+				}
+			}).pipe(Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.fail(unreachable)
+			}), Effect.catchTags({
+				CommandRefused: (refused) => Effect.fail(new CallFailed({
+					status: 400,
+					kind: refused._tag,
+					nextStep: refused.nextStep
+				})),
+				SlowDown: (slow) => Effect.fail(new CallFailed({
+					status: 429,
+					kind: slow._tag,
+					nextStep: slow.nextStep
+				}))
+			}), Effect.mapError((error) => error instanceof CallFailed ? error : unreachable));
+			yield* printBlocks([[`Approve this under Waiting on you, at ${config.api}${webPages.home}, with the code ${started.code}`]]);
+			const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, secret)));
+			const collect = (yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http))).terminalApprovals.result({ params: { approval: started.approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.succeedNone
+			}), Effect.catchTag("ApprovalNotFound", (missing) => Effect.fail(gone(change, missing.nextStep))), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
+			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
+		});
+		const call = Effect.fn("Ref0.call")(function* (command) {
+			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
+				status: 0,
+				kind: error._tag,
+				nextStep: error.nextStep
+			})));
+			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
+				status: 400,
+				kind: refused._tag,
+				nextStep: refused.nextStep
+			})));
+			const change = request.method !== "GET";
+			const answer = yield* Option.match(token, {
+				onNone: () => asPerson(request.command, change, command.endpoint),
+				onSome: (bearer) => asSession(bearer, request, command.endpoint)
+			});
+			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
+			return answer;
+		});
+		return Ref0.of({ call });
+	}));
+};
+/**
+* One endpoint's call, typed from the API: the compiler checks its command, and its answer is
+* read by the endpoint's own success schemas, so what a command shows of it is checked too.
+*/
+const callEndpoint = (command) => Effect.gen(function* () {
+	const json = yield* (yield* Ref0).call(command);
+	return {
+		json,
+		value: yield* Option.match(successOf(command.endpoint, json), {
+			onNone: () => Effect.fail(unreadable(command.endpoint, false)),
+			onSome: Effect.succeed
+		})
+	};
+});
 /** The account's commands. */
 const accountCommands = [Command.make("whoami", { json }, ({ json: asJson }) => Effect.gen(function* () {
 	const answer = yield* callEndpoint({ endpoint: "me.get" });
@@ -20130,7 +20500,7 @@ const waitsFor = (each) => {
 * A thread a wait names, as a line says it: its number, written with its project, `acme/billing#3`,
 * when it's in another of `owner`'s, then its title and stage.
 */
-const threadWords = (thread, owner = "") => {
+const threadWords$1 = (thread, owner = "") => {
 	return `${thread.project === void 0 ? `#${thread.number}` : `${owner}/${thread.project}#${thread.number}`}${thread.title === void 0 ? "" : ` ${thread.title}`}, ${thread.stage}`;
 };
 /** What holds a stack back below the thread, as a line says it, to follow "and". */
@@ -20148,13 +20518,13 @@ const stackHeld = (stack) => {
 */
 const planLine = (wait, number, owner) => {
 	if (wait.kind === "stack") {
-		const line = `stacked on ${wait.on === void 0 ? "a thread you can’t see" : threadWords(wait.on)}: #${number} may merge once it may${stackHeld(wait)}`;
+		const line = `stacked on ${wait.on === void 0 ? "a thread you can’t see" : threadWords$1(wait.on)}: #${number} may merge once it may${stackHeld(wait)}`;
 		return wait.on === void 0 ? line : `${wait.on.thread}  ${line}`;
 	}
 	if (wait.child === void 0) return `required child ${wait.entry}, not started yet: #${number} is settled once it is`;
 	if (wait.child === null) return `required child, a thread you can’t see: #${number} is settled once it is`;
 	const holds = wait.child.project === void 0 || wait.child.stage !== "settled" ? `#${number} is settled once it is` : `#${number} is settled once a settle check reads it so`;
-	return `${wait.child.thread}  required child ${threadWords(wait.child, owner)}: ${holds}`;
+	return `${wait.child.thread}  required child ${threadWords$1(wait.child, owner)}: ${holds}`;
 };
 /** What blocks the thread, in words: so many of its own, and its stack, while it holds it. */
 const blockedBy$1 = (list) => {
@@ -20180,10 +20550,10 @@ const blockerLines = (list, address) => {
 	].join("\n");
 };
 /** How many blockers stand on the thread now, in words. */
-const standingWords = (changed) => changed.standing === 0 ? "None stands now, so ref0 merges it once it’s ready." : `${changed.standing} ${changed.standing === 1 ? "stands" : "stand"}, so ref0 won’t merge it yet.`;
+const standingWords$1 = (changed) => changed.standing === 0 ? "None stands now, so ref0 merges it once it’s ready." : `${changed.standing} ${changed.standing === 1 ? "stands" : "stand"}, so ref0 won’t merge it yet.`;
 /** A blocker added, in words: which, its ask, how many stand, and a publish it didn't stop. */
 const addedWords = (changed, address) => [
-	`Blocked ${address} by ${changed.blocker}. ${standingWords(changed)}`,
+	`Blocked ${address} by ${changed.blocker}. ${standingWords$1(changed)}`,
 	...changed.decision === void 0 ? [] : [`It waits on a person’s answer to the ask ${changed.decision}.`],
 	...changed.admitted === void 0 ? [] : [`A merge carrying it was already under way in ${changed.admitted.join(", ")}; the blocker doesn’t stop that one.`]
 ].join("\n");
@@ -20330,7 +20700,7 @@ const clearing = (name, description) => Command.make(name, {
 		payload
 	}));
 	const done = name === "remove" ? "Removed" : "Marked met";
-	yield* printAnswer(answer.json, asJson, `${done} ${answer.value.blocker} on ${address}. ${standingWords(answer.value)}`);
+	yield* printAnswer(answer.json, asJson, `${done} ${answer.value.blocker} on ${address}. ${standingWords$1(answer.value)}`);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription(description));
 /** `ref0 blocked` and its subcommands. */
 const blockedCommands = [Command.make("blocked").pipe(Command.withDescription("What a thread is blocked by, which stops ref0 merging it: list, add, hold, remove, and mark met"), Command.withShortDescription("List and manage a thread’s blockers"), Command.withSubcommands([
@@ -20359,7 +20729,7 @@ const browserOpener = Effect.gen(function* () {
 });
 /** Starts the browser independently; a missing or failing desktop never stops the paste. */
 const openBrowser = (program, link) => Effect.sync(() => {
-	const failed = () => Effect.runFork(Console.error("Couldn’t open the browser. Open the printed link yourself."));
+	const failed = () => Effect.runFork(printBlocks([["Couldn’t open the browser. Open the printed link yourself."]]));
 	try {
 		const child = spawn(program, [link], {
 			detached: true,
@@ -21030,7 +21400,7 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.10.0";
+const cliVersion = "0.12.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -21348,7 +21718,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const link = yield* freshLinkSecret;
 	const pasted = yield* Ref.make(void 0);
 	const opener = yield* browserOpener;
-	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(Console.error("Couldn’t listen for the browser. Paste the code instead."), void 0)));
+	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(printBlocks([["Couldn’t listen for the browser. Paste the code instead."]]), void 0)));
 	const machineId = yield* machine.id.pipe(Effect.catchTag("MachineError", said));
 	const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
 	const unreachable = () => sayFailed(`Couldn’t reach ref0 at ${config.api}. Try again.`);
@@ -21359,7 +21729,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			...folder,
 			shown: shownConfigFolder(home, folder.configFolder),
 			grant: yield* freshTokenSecret,
-			replaces: Option.isSome(held) ? grantOf(held.value) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said))
+			replaces: Option.isSome(held) ? grantOf(held.value) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said)),
+			before: Option.isSome(held) ? yield* hostGrant.get(folder.configFolder).pipe(Effect.catchTag("KeychainError", (error) => error.unreadable === true ? Effect.succeedNone : said(error))) : Option.none()
 		};
 	}));
 	const folders = yield* Effect.forEach(asking, Effect.fnUntraced(function* (folder) {
@@ -21408,9 +21779,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for each agent it connects.",
 		"Waiting for the answer. Ctrl-C stops it."
 	]]);
-	let typed = "";
-	const show = (text) => Effect.ignore(terminal.display(text));
-	const endWait = yield* Effect.cached(Effect.suspend(() => typed === "" ? Effect.void : show("\n")).pipe(Effect.andThen(Console.error(""))));
+	const endWait = yield* Effect.cached(Console.error(""));
 	const saidAfterWait = (refusal) => Effect.andThen(endWait, said(refusal));
 	if (opener !== void 0) yield* openBrowser(opener, `${config.api}/connect#${link.secret}`);
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
@@ -21441,17 +21810,10 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			yield* Effect.sleep(pollMillis);
 		}
 	});
-	const keepOne = Effect.fnUntraced(function* (folder, connection, keepBy) {
+	const keepTrying = Effect.fnUntraced(function* (configFolder, grant, keepBy, late) {
 		const left = keepBy - (yield* Clock.currentTimeMillis);
-		if (left <= 0) return Option.some("The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
-		const token = formatToken(connection.credential.person, connection.credential.id, folder.grant.secret);
-		const kept = yield* hostGrant.keep(folder.configFolder, {
-			harness: folder.harness,
-			owner: connection.owner,
-			agent: connection.handle,
-			agentId: connection.agent.id,
-			token: Redacted.make(token)
-		}).pipe(Effect.timeoutOrElse({
+		if (left <= 0) return Option.some(late);
+		const kept = yield* hostGrant.keep(configFolder, grant).pipe(Effect.timeoutOrElse({
 			duration: Duration.min(keepTimeout, Duration.millis(left)),
 			orElse: () => Effect.fail(new KeychainError({ nextStep: "The keychain didn’t answer within a minute. Check that it’s unlocked." }))
 		}), Effect.retry({
@@ -21460,10 +21822,18 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		}), Effect.result);
 		return Result.isSuccess(kept) ? Option.none() : Option.some(kept.failure.nextStep);
 	});
+	const keepOne = (folder, connection, keepBy) => keepTrying(folder.configFolder, {
+		harness: folder.harness,
+		owner: connection.owner,
+		agent: connection.handle,
+		agentId: connection.agent.id,
+		token: Redacted.make(formatToken(connection.credential.person, connection.credential.id, folder.grant.secret))
+	}, keepBy, "The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
 	const finish = Effect.fnUntraced(function* (state) {
 		if (state.state !== "connected") return yield* sayFailed(endedWords$1(state));
 		const keepBy = (yield* Clock.currentTimeMillis) + Duration.toMillis(keepBudget);
 		const kept = [];
+		const keptFrom = [];
 		const grants = [];
 		const notKept = [];
 		for (const folder of asking) {
@@ -21493,9 +21863,9 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 				handle: connection.handle,
 				organizations: connection.organizations
 			});
+			keptFrom.push(folder);
 			grants.push(connection.credential.id);
 		}
-		yield* oldGrants.retire(kept);
 		const [first, ...rest] = grants;
 		if (first === void 0) return yield* sayFailed([[
 			"It connected, but this machine couldn’t keep what it needs to act:",
@@ -21528,9 +21898,27 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			times: 2,
 			schedule: Schedule.spaced("1 second")
 		}), Effect.catchTag("Unanswered", unconfirmed))).confirmed) {
-			for (const folder of kept) yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
-			return yield* sayFailed(`ref0 revoked the grants, since this machine didn’t confirm in time that it kept them. They’re deleted here, and nothing is connected. To connect this machine, run: ${again$1}`);
+			const backBy = (yield* Clock.currentTimeMillis) + Duration.toMillis(keepBudget);
+			const notBack = [];
+			for (const folder of keptFrom) {
+				if (Option.isNone(folder.before)) {
+					yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
+					continue;
+				}
+				const failed = yield* keepTrying(folder.configFolder, folder.before.value, backBy, "The keychain took too long with the folders before it.");
+				if (Option.isSome(failed)) notBack.push(`${shownConfigFolder(home, folder.configFolder)}: ${failed.value}`);
+			}
+			return yield* sayFailed([[
+				"ref0 revoked the new grants, since this machine didn’t confirm in time that it kept them.",
+				...notBack.length === 0 ? ["Each folder has its connection from before back, if it had one. To connect this machine, run:"] : [
+					"These folders hold a grant that works nowhere, since the keychain didn’t take back their records:",
+					...notBack,
+					"Each other folder has its connection from before back, if it had one. To connect this machine, run:"
+				],
+				{ command: again$1 }
+			]]);
 		}
+		yield* oldGrants.retire(kept);
 		return {
 			owner: state.owner,
 			kept,
@@ -21542,7 +21930,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		};
 	});
 	const stopped = Effect.gen(function* () {
-		yield* Console.error("Stopping: aborting the request.");
+		yield* printBlocks([["Stopping: aborting the request."]]);
 		const abortId = yield* newRequestId;
 		const state = yield* collector.machineAttachments.abort({
 			params,
@@ -21561,46 +21949,41 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			times: 2
 		}), Effect.catchTag("Unanswered", () => sayFailed("Couldn’t reach ref0 to abort it. If it’s approved anyway, ref0 revokes its grants 10 minutes after they connect, since this machine never kept them.")));
 		if (!isEnded(state)) {
-			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed("It was already answered, but no code was pasted. Nothing was kept here; its unconfirmed grants expire.");
-			yield* Console.error("It was already answered, so this machine waits to hear how.");
+			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed([["It was already answered, but no code was pasted, so this machine kept nothing.", asking.some((folder) => Option.isSome(folder.replaces)) ? "Its new grants expire unconfirmed, and each folder’s connection from before still works." : "Its new grants expire unconfirmed."]]);
+			yield* printBlocks([["It was already answered, so this machine waits to hear how."]]);
 		}
 		const connected = yield* finish(isEnded(state) ? state : yield* answered);
 		yield* printBlocks([[{ label: `Connected as ${connected.owner}’s agents` }, ...connected.kept.map((folder) => `${shownConfigFolder(home, folder.configFolder)}  ${folder.handle}`)], ["Stopped, so nothing was installed. To install ref0’s plugin into each, run:", ...connected.kept.map((folder) => ({ command: installLine(folder.configFolder) }))]]);
 	});
-	const typedCode = Effect.gen(function* () {
+	const readAnswer = Effect.gen(function* () {
+		if (listener === void 0) yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
 		const keys = yield* terminal.readInput;
+		let typed = "";
 		while (true) {
 			const pressed = yield* Effect.option(Queue.take(keys));
 			if (Option.isNone(pressed) || quits(pressed.value.key)) return yield* Effect.interrupt;
+			if ((yield* Ref.get(pasted)) !== void 0) continue;
 			const { input, key } = pressed.value;
 			if (key.name === "backspace") {
-				if (typed === "") continue;
 				typed = takeBack(typed);
-				yield* show("\b \b");
 				continue;
 			}
 			if (key.name !== "return" && key.name !== "enter") {
 				const text = Option.getOrElse(input, () => "");
-				if (!typesText(text)) continue;
-				typed += text;
-				yield* show(text);
+				if (typesText(text)) typed += text;
 				continue;
 			}
 			const line = typed.trim();
-			if (typed !== "") yield* show("\n");
 			typed = "";
 			if (line === "") continue;
-			if (isAnswerCode(line)) return line;
-			yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
+			if (!isAnswerCode(line)) {
+				yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
+				continue;
+			}
+			yield* Ref.update(pasted, (first) => first ?? line);
+			if (listener !== void 0) yield* listener.stop;
 		}
 	}).pipe(Effect.scoped);
-	const readAnswer = Effect.gen(function* () {
-		yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
-		const code = yield* typedCode;
-		yield* Ref.update(pasted, (first) => first ?? code);
-		if (listener !== void 0) yield* listener.stop;
-		return yield* Effect.never;
-	});
 	const receiveAnswer = listener === void 0 ? readAnswer : Effect.raceFirst(readAnswer, listener.answer.pipe(Effect.flatMap((code) => Ref.update(pasted, (first) => first ?? code)), Effect.andThen(Effect.never)));
 	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.ensuring(endWait), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
 }, Effect.scoped);
@@ -22580,6 +22963,111 @@ function parse(toml, options = {}) {
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 //#endregion
+//#region src/harness/empty-folder.ts
+/**
+* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
+* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
+* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
+*
+* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
+* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
+* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
+* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
+* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
+* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
+*/
+const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
+//#endregion
+//#region src/harness/codex-app-server.ts
+/**
+* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
+* from an empty folder of its own, the requests written a line each, the answers read until each
+* request has one, then stopped. Each answer is matched to its request by ID, and read by that
+* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
+* didn't send, is passed over.
+*/
+/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
+var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
+/** Codex's app server answered a request with an error. */
+var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
+	method: Schema.String,
+	error: CodexError
+}) {};
+/** Codex's app server answered a request with a result its method's schema doesn't read. */
+var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
+	method: Schema.String,
+	issue: Schema.String
+}) {};
+const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
+const decodeAnswer$2 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
+/** The IDs of the exchange's two requests: the opening's, and the one asked. */
+const initializeId = "ref0-initialize";
+const askedId = "ref0-asked";
+/** The exchange's opening: who's asking, then that it's ready. */
+const opening = [{
+	jsonrpc: "2.0",
+	id: initializeId,
+	method: codexMethods.initialize.method,
+	params: { clientInfo: {
+		name: "ref0",
+		title: null,
+		version: cliVersion
+	} }
+}, {
+	jsonrpc: "2.0",
+	method: codexMethods.initialized.method
+}];
+/**
+* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
+* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
+*/
+const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const fs = yield* FileSystem.FileSystem;
+	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
+		cwd: yield* emptyFolder(fs),
+		env,
+		extendEnv: true,
+		forceKillAfter: "2 seconds",
+		stdin: {
+			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
+			endOnDone: false
+		}
+	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$2(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
+	return Option.filter(answered, (answers) => answers.size === ids.length);
+})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
+/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
+const resultOf = (method, answer) => {
+	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
+	if ("error" in answer) return Effect.fail(new CodexRefused({
+		method: method.method,
+		error: answer.error
+	}));
+	const { result } = method;
+	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
+		method: method.method,
+		issue: error.message
+	})));
+};
+/**
+* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
+* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
+* its request's ID, and its result is read by the method's result schema.
+*/
+const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
+	const asked = {
+		jsonrpc: "2.0",
+		id: askedId,
+		method: method.method,
+		params
+	};
+	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
+	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
+	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
+	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
+	return yield* resultOf(method, answers.value.get(askedId));
+});
+//#endregion
 //#region src/harness/codex-checkouts.ts
 const codexGitFolder = (configFolder, pluginId) => {
 	const at = pluginId.indexOf("@");
@@ -22696,111 +23184,6 @@ const codexSignOff = [
 	`perl -e ${shellWord(codexCheckoutWriter)} "$ref0_codex/checkouts" "$ref0_common" "$ref0_codex_hooks" 1 || exit 1`
 ];
 //#endregion
-//#region src/harness/empty-folder.ts
-/**
-* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
-* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
-* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
-*
-* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
-* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
-* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
-* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
-* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
-* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
-*/
-const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
-//#endregion
-//#region src/harness/codex-app-server.ts
-/**
-* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
-* from an empty folder of its own, the requests written a line each, the answers read until each
-* request has one, then stopped. Each answer is matched to its request by ID, and read by that
-* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
-* didn't send, is passed over.
-*/
-/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
-var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
-/** Codex's app server answered a request with an error. */
-var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
-	method: Schema.String,
-	error: CodexError
-}) {};
-/** Codex's app server answered a request with a result its method's schema doesn't read. */
-var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
-	method: Schema.String,
-	issue: Schema.String
-}) {};
-const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
-const decodeAnswer$2 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
-/** The IDs of the exchange's two requests: the opening's, and the one asked. */
-const initializeId = "ref0-initialize";
-const askedId = "ref0-asked";
-/** The exchange's opening: who's asking, then that it's ready. */
-const opening = [{
-	jsonrpc: "2.0",
-	id: initializeId,
-	method: codexMethods.initialize.method,
-	params: { clientInfo: {
-		name: "ref0",
-		title: null,
-		version: cliVersion
-	} }
-}, {
-	jsonrpc: "2.0",
-	method: codexMethods.initialized.method
-}];
-/**
-* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
-* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
-*/
-const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
-	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const fs = yield* FileSystem.FileSystem;
-	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
-		cwd: yield* emptyFolder(fs),
-		env,
-		extendEnv: true,
-		forceKillAfter: "2 seconds",
-		stdin: {
-			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
-			endOnDone: false
-		}
-	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$2(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
-	return Option.filter(answered, (answers) => answers.size === ids.length);
-})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
-const resultOf = (method, answer) => {
-	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
-	if ("error" in answer) return Effect.fail(new CodexRefused({
-		method: method.method,
-		error: answer.error
-	}));
-	const { result } = method;
-	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
-		method: method.method,
-		issue: error.message
-	})));
-};
-/**
-* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
-* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
-* its request's ID, and its result is read by the method's result schema.
-*/
-const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
-	const asked = {
-		jsonrpc: "2.0",
-		id: askedId,
-		method: method.method,
-		params
-	};
-	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
-	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
-	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
-	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
-	return yield* resultOf(method, answers.value.get(askedId));
-});
-//#endregion
 //#region src/harness/commit-hooks.ts
 /**
 * ref0's part of Git's `prepare-commit-msg` and `commit-msg` hooks, which their forwarders in
@@ -23110,21 +23493,75 @@ const codexAgentConfig = Effect.fnUntraced(function* (agent, root, home) {
 		parameters: shellWord(`include.path=${file}`)
 	};
 });
+/** Only the single ref0 include installed by this CLI belongs to ref0. */
+const selectedInclude = (set) => {
+	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
+	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
+	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+};
+const decodePolicy = Schema.decodeUnknownEffect(Schema.Struct({ shell_environment_policy: CodexConfigRead.fields.config.fields.shell_environment_policy }));
+/**
+* The agent's include a Codex config folder's `config.toml` selects, if it's ref0's: its file, read
+* as TOML for its `shell_environment_policy` alone.
+*/
+const selectedCodexInclude = Effect.fnUntraced(function* (configFolder) {
+	const fs = yield* FileSystem.FileSystem;
+	const configFile = `${configFolder}/config.toml`;
+	if (!(yield* fs.exists(configFile))) return Option.none();
+	const text = yield* fs.readFileString(configFile);
+	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
+	const read = yield* decodePolicy(document);
+	return Option.fromNullishOr(selectedInclude(read.shell_environment_policy?.set ?? {}));
+});
+/**
+* Takes the author out of `selected`, the include a folder's `config.toml` selects, unless it's
+* this origin's include for the folder's agent, so a folder switched to another agent never names
+* the one before. Its commits name the person until an install selects the agent's own. Whether it
+* took one out.
+*/
+const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, selected, options) {
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	if (selected === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return false;
+	const oldRoot = selected.slice(0, selected.lastIndexOf("/agents/"));
+	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home);
+	yield* writeCodexCheckout({
+		gitFolder: oldRoot,
+		common: "",
+		folder: "",
+		signsOff: false,
+		clearAuthor: selected,
+		author: fallback
+	});
+	return true;
+});
+/** What the agent reads at its session's start when its folder's `config.toml` names another. */
+const otherAgentWords = (configFolder) => `ref0: The config.toml of this Codex config folder, ${configFolder}, names another agent than the one this folder is connected as, so your commits name the person instead of you until they run, in their own terminal: ${installLine(configFolder)}`;
 /**
 * Codex has no environment file: its install selects a file; session start fills its checkout,
-* for the agent of the config folder `CODEX_HOME` names, or the default `~/.codex`.
+* for the agent of the config folder `CODEX_HOME` names, or the default `~/.codex`. An include
+* `config.toml` selects for another agent, after a switch whose install never finished or another
+* origin's install, has its author taken out first, and the agent hears so.
 */
 const setCodexCommitEnvironment = Effect.fnUntraced(function* (cwd, checkout) {
 	const folders = yield* ConfigFolders;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const agent = yield* (yield* HostGrant).get(yield* folders.folder("codex")).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
+	const configFolder = yield* folders.folder("codex");
+	const selected = yield* selectedCodexInclude(configFolder).pipe(Effect.mapError(() => new CodexCommitFailed({ detail: `Couldn’t read Codex’s config, ${configFolder}/config.toml.` })), Effect.result);
+	const agent = yield* (yield* HostGrant).get(configFolder).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
 	if (Option.isNone(agent)) return false;
+	const home = yield* Config.String("HOME");
+	if (yield* Option.match(yield* Effect.fromResult(selected), {
+		onNone: () => Effect.succeed(false),
+		onSome: (file) => clearOtherCodexAuthor(agent.value, file, {
+			configFolder,
+			home
+		})
+	})) yield* Console.log(otherAgentWords(configFolder));
 	const pluginRoot = yield* Config.String("CLAUDE_PLUGIN_ROOT").pipe(Config.withDefault(""));
 	if (pluginRoot === "") return yield* new CodexCommitFailed({ detail: "Codex gave the hook no plugin root." });
 	const gitFolder = path.join(path.dirname(pluginRoot), "@git");
-	const home = yield* Config.String("HOME");
 	const author = yield* codexAgentConfig(agent.value, gitFolder, home);
 	const common = (yield* spawner.string(ChildProcess.make("git", [
 		"-C",
@@ -23480,35 +23917,27 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 //#region src/harness/codex-install-commits.ts
 const decodeProfile = Schema.decodeUnknownEffect(CodexConfigRead);
 const sameJson = Schema.toEquivalence(Schema.Json);
-/** Only the single ref0 include installed by this CLI belongs to ref0. */
-const selectedInclude = (set) => {
-	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
-	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
-	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+/**
+* What the person reads when an install that never finished took the agent before out of a
+* folder's commits: what stopped it, in its own words, a conflict only when there is one, then
+* what to run.
+*/
+const unfinishedWords = (stopped, configFolder) => {
+	return `ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. ${Option.match(stopped, {
+		onNone: () => `The install stopped before it finished. To finish it, run: ${installLine(configFolder)}`,
+		onSome: (failed) => `${failed.says} Then run: ${repairOf(failed, configFolder)}`
+	})}`;
 };
-/** A changed grant must never leave the previous agent as author after a failed install. */
-const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, options) {
-	const fs = yield* FileSystem.FileSystem;
-	const configFile = `${options.configFolder}/config.toml`;
-	if (!(yield* fs.exists(configFile))) return;
-	const text = yield* fs.readFileString(configFile);
-	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
-	const read = yield* decodeProfile({ config: document });
-	const file = selectedInclude(read.config.shell_environment_policy?.set ?? {});
-	if (file === void 0) return;
-	const name = yield* originPluginName((yield* Ref0Config).api);
-	if (file === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return;
-	const oldRoot = file.slice(0, file.lastIndexOf("/agents/"));
-	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home ?? (yield* Config.String("HOME").pipe(Config.withDefault("."))));
-	yield* writeCodexCheckout({
-		gitFolder: oldRoot,
-		common: "",
-		folder: "",
-		signsOff: false,
-		clearAuthor: file,
-		author: fallback
-	});
-	yield* Console.error(`ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. Fix the shell_environment_policy conflict in Codex’s config or profile named above: remove conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded. Then run: ${installLine(options.configFolder)}`);
+/**
+* After an install into a Codex folder fails or is interrupted, the agent before is taken out of
+* the include `config.toml` still selects, so the folder's commits never name an agent other than
+* its grant's, and the person hears what stopped the install: `stopped`, or none when interrupted.
+*/
+const clearUnfinishedCodexInstall = Effect.fnUntraced(function* (agent, stopped, options) {
+	const selected = yield* selectedCodexInclude(options.configFolder);
+	if (Option.isNone(selected)) return;
+	if (!(yield* clearOtherCodexAuthor(agent, selected.value, options))) return;
+	yield* printBlocks([[unfinishedWords(stopped, options.configFolder)]]);
 });
 /** Install the connected agent's include and shell policy. */
 const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
@@ -23517,6 +23946,7 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 		CODEX_HOME: options.configFolder
 	};
 	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+	const conflicted = new InstallFailed({ says: "Codex’s shell_environment_policy conflicts with ref0’s commit environment, in the config or profile named above. Remove the conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded." });
 	return yield* Effect.gen(function* () {
 		const fs = yield* FileSystem.FileSystem;
 		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
@@ -23544,8 +23974,8 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 		].find((key) => Object.hasOwn(set, key) && !(own && (key === "GIT_CONFIG_PARAMETERS" || key === "REF0_HARNESS")));
 		const allowlist = policy?.include_only != null || Object.values(policy?.filters ?? {}).includes("include");
 		if (collision !== void 0 || allowlist) {
-			yield* Console.error(`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`);
-			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			yield* printBlocks([[`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`]]);
+			if (own) return yield* conflicted;
 			return;
 		}
 		const profiles = (yield* fs.readDirectory(options.configFolder)).filter((file) => file.endsWith(".config.toml"));
@@ -23570,8 +24000,8 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 			const losesAuthors = excluded !== void 0 && excluded !== null && ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].some((name) => !excluded.some((pattern) => pathMatchesWithin(pattern.toLowerCase(), name.toLowerCase(), { left: 1e4 })));
 			const allowlist = profilePolicy?.include_only != null || Object.values(filters ?? {}).includes("include");
 			if (key === void 0 && !losesAuthors && !allowlist) continue;
-			yield* Console.error(`ref0: Codex’s profile ${printable(file)} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`);
-			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			yield* printBlocks([[`ref0: Codex’s profile ${file} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`]]);
+			if (own) return yield* conflicted;
 			return;
 		}
 		if (!own && (options.approveCommits === void 0 || !(yield* options.approveCommits()))) return;
@@ -23659,9 +24089,9 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 			}, env)).status !== "ok") return yield* failed("set Codex’s commit environment because another config layer overrides it");
 		}).pipe(Effect.onError(() => Effect.gen(function* () {
 			if (!attemptedConfig || (yield* recover)) yield* restore(author.file, previousAuthor);
-			else yield* Console.error("ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again.");
+			else yield* printBlocks([["ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again."]]);
 		}).pipe(Effect.orDie)));
-	}).pipe(Effect.scoped, Effect.mapError(() => failed("set Codex’s commit environment")));
+	}).pipe(Effect.scoped, Effect.mapError((error) => error instanceof InstallFailed ? error : failed("set Codex’s commit environment")));
 }, Effect.scoped);
 //#endregion
 //#region src/harness/install-claude-code.ts
@@ -23825,7 +24255,7 @@ const installCodex = Effect.fnUntraced(function* (release, agent, options) {
 			trusted,
 			profile
 		};
-	}).pipe(Effect.onError(() => clearOtherCodexAuthor(agent, options).pipe(Effect.orDie)));
+	}).pipe(Effect.onError((cause) => clearUnfinishedCodexInstall(agent, Cause.findErrorOption(cause), options).pipe(Effect.orDie)));
 });
 //#endregion
 //#region src/harness/install.ts
@@ -23931,7 +24361,7 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 		for (const folder of into) answers.set(folder, Result.fail(failed));
 	};
 	const started = /* @__PURE__ */ new Set();
-	const clearUnstarted = (into) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearOtherCodexAuthor(agent, {
+	const clearUnstarted = (into, stopped) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearUnfinishedCodexInstall(agent, stopped, {
 		configFolder: folder.configFolder,
 		home
 	}).pipe(Effect.orDie)), Effect.catchTag("InstallFailed", () => Effect.void)), { discard: true });
@@ -23946,8 +24376,9 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 			if (into.length === 0) continue;
 			const command = yield* onPath(harness === "codex" ? "codex" : "claude");
 			if (Option.isNone(command)) {
-				failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
-				yield* clearUnstarted(into);
+				const missing = new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` });
+				failAll(into, missing);
+				yield* clearUnstarted(into, Option.some(missing));
 				continue;
 			}
 			yield* Effect.scoped(Effect.gen(function* () {
@@ -23968,9 +24399,9 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 					})).pipe(Effect.result);
 					answers.set(folder, installed);
 				}
-			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into))))));
+			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into, Option.some(failed)))))));
 		}
-	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders)));
+	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders, Option.none())));
 	return folders.map((folder) => ({
 		...folder,
 		installed: answers.get(folder) ?? Result.fail(new InstallFailed({ says: "ref0 didn’t install into this folder." }))
@@ -24062,7 +24493,12 @@ const mostFolders = 8;
 const isConfigFolderPath = Schema.is(ConfigFolderPath);
 /** The line that asks again. */
 const again = "ref0 connect";
-/** Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. */
+/**
+* Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. The
+* question is said first, and the chooser shows only the folders: once Enter chooses, it leaves
+* the ticked ones on one line after any question it was given, which the terminal would break
+* mid-word.
+*/
 const choose = Effect.fnUntraced(function* (found, home) {
 	const choices = found.map((folder) => {
 		const shown = shownConfigFolder(home, folder.configFolder);
@@ -24079,8 +24515,9 @@ const choose = Effect.fnUntraced(function* (found, home) {
 		};
 	});
 	const ticked = choices.filter((choice) => choice.selected).length;
+	const keys = "Space ticks or unticks one; Enter connects those ticked.";
+	yield* printBlocks([[{ label: "Connect which config folders?" }, ticked > mostFolders ? `One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. ${keys}` : keys]]);
 	return yield* Prompt.run(Prompt.MultiSelect({
-		message: ticked > mostFolders ? `Connect which config folders? One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. Space ticks or unticks one; Enter connects those ticked.` : "Connect which config folders? Space ticks or unticks one; Enter connects those ticked.",
 		choices,
 		max: mostFolders
 	}));
@@ -24197,6 +24634,7 @@ const connectCommands = [Command.make("connect", { json }, ({ json: asJson }) =>
 	if (found.length === 0) return yield* sayFailed(`ref0 found no Claude Code or Codex config folder in your home. Start Claude Code or Codex once, then run ${again} again.`);
 	const chosen = yield* choose(found, home).pipe(Effect.catchTag("QuitError", () => sayFailed("Stopped, and nothing was asked.")));
 	if (chosen.length === 0) return yield* sayFailed(`No config folder was ticked, so nothing was asked. To connect one, run ${again} again.`);
+	yield* Console.error("");
 	const connected = yield* requestAttachment(chosen);
 	const installed = yield* installInto(connected.kept, { asJson });
 	const others = yield* otherOwners(connected);
@@ -24271,7 +24709,7 @@ const signalLines = (answer) => {
 * credential, a Sentry token, is pasted on that page too, never in a terminal. Anyone who may start a
 * thread in the project sends a signal to one of its connections by name.
 */
-const failedWith$14 = (failed) => sayFailed(failed.nextStep);
+const failedWith$15 = (failed) => sayFailed(failed.nextStep);
 const project$5 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project"), Argument.withSchema(WrittenProject));
 const name = Argument.String("name").pipe(Argument.withDescription("The connection’s name in the project, such as deploys"), Argument.withSchema(ConnectionName));
 const list$5 = Command.make("list", {
@@ -24283,7 +24721,7 @@ const list$5 = Command.make("list", {
 		params: projectParts(address)
 	});
 	yield* printAnswer(answer.json, asJson, connectionLines(answer.value));
-}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("The project’s connections, their last signal and what they dropped"), Command.withShortDescription("List a project’s connections and their last signals"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$15))).pipe(Command.withDescription("The project’s connections, their last signal and what they dropped"), Command.withShortDescription("List a project’s connections and their last signals"));
 /** A change made on the project's page: its link, and what to do there. */
 const onThePage = (address, change) => Effect.gen(function* () {
 	const config = yield* Ref0Config;
@@ -24359,14 +24797,14 @@ const send = Command.make("send", {
 		})
 	});
 	yield* printAnswer(answer.json, asJson, signalLines(answer.value));
-}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Send a signal to one of the project’s connections"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$15))).pipe(Command.withDescription("Send a signal to one of the project’s connections"));
 /** A project's connections, and sending a signal by one. */
 const connectionCommands = [connectionCommand, Command.make("signal").pipe(Command.withDescription("A project’s signals: send one by a connection"), Command.withShortDescription("Send a signal to a project"), Command.withSubcommands([send]))];
 //#endregion
 //#region src/harness/checkout.ts
 const decodeRepoName$2 = Schema.decodeUnknownOption(RepoName);
 const decodePath$2 = Schema.decodeUnknownOption(RepoPath);
-const decodeThread$1 = Schema.decodeUnknownOption(WrittenThread);
+const decodeThread$2 = Schema.decodeUnknownOption(WrittenThread);
 const decodeWrittenRepo$1 = Schema.decodeUnknownOption(WrittenRepo);
 var Checkout = class Checkout extends Context.Service()("ref0/cli/Checkout") {
 	static layer = Layer.effect(Checkout, Effect.gen(function* () {
@@ -24405,7 +24843,7 @@ var Checkout = class Checkout extends Context.Service()("ref0/cli/Checkout") {
 			"config",
 			"--get",
 			"ref0.thread"
-		]), (written) => decodeThread$1(written.trim()));
+		]), (written) => decodeThread$2(written.trim()));
 		const repoAt = (folder) => Effect.map(git(folder, [
 			"config",
 			"--get",
@@ -24582,7 +25020,7 @@ const paramValues = (params) => {
 * its params, and when it ends; under it, each workflow's run, by its title and its file, and
 * how it stands; and under each, its newest asks and passkeys.
 */
-const waitingLines = (wait, now) => [`${wait.check}${paramValues(wait.params)} · waiting, until ${minute(wait.endsAt)} · ${wait.start}`, ...wait.runs.flatMap((run, index) => {
+const waitingLines$1 = (wait, now) => [`${wait.check}${paramValues(wait.params)} · waiting, until ${minute(wait.endsAt)} · ${wait.start}`, ...wait.runs.flatMap((run, index) => {
 	const last = index === wait.runs.length - 1;
 	const under = last ? "   " : "│  ";
 	return [`${last ? "└─" : "├─"} ${run.title ?? run.workflow} · ${waitedText[run.state]} · ${run.workflow}.ts`, ...run.leaves.map((leaf, at) => `${under}${at === run.leaves.length - 1 ? "└─" : "├─"} ${leafText(leaf, now)}`)];
@@ -25408,7 +25846,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 	})).value;
 	if (code.compiled.entry.reaches?.browser === true) return yield* sayFailed(`${code.check} browses, and only a run on ref0 browses: run it there, with ref0 run ${check} --thread ${thread.value}.`);
 	if (code.runs.length === 0) {
-		yield* Console.error(`${code.check} has no part left for a local run on version ${code.version}: each is met, or failed on ref0. See ref0 gate.`);
+		yield* printBlocks([[`${code.check} has no part left for a local run on version ${code.version}: each is met, or failed on ref0. See ref0 gate.`]]);
 		return;
 	}
 	yield* holdsVersion(root.value, code);
@@ -25417,7 +25855,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 		thread: `${thread.value}’s own .ref0/`,
 		project: "the project’s checks"
 	}[code.code.origin];
-	yield* Console.error(`Running ${code.check} from ${from}, as ref0 compiled it for version ${code.version}: its code and its sandboxes’ setup run on this machine, as you, outside any container.`);
+	yield* printBlocks([[`Running ${code.check} from ${from}, as ref0 compiled it for version ${code.version}: its code and its sandboxes’ setup run on this machine, as you, outside any container.`]]);
 	const own = yield* loadCheck(code.compiled).pipe(Effect.catchTag("LocalRunFailed", (failed) => sayFailed(failed.why)));
 	const sandboxes = code.compiled.entry.sandboxes ?? [];
 	const held = /* @__PURE__ */ new Set();
@@ -25429,7 +25867,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 			const run = yield* newRunId;
 			const deadline = (yield* Clock.currentTimeMillis) + code.timeoutSeconds * 1e3;
 			const sandbox = yield* localOpener(root.value, held, sandboxes, deadline);
-			yield* Console.error(`Running ${code.check} locally, part ${index + 1} of ${code.runs.length}, as ${run}.`);
+			yield* printBlocks([[`Running ${code.check} locally, part ${index + 1} of ${code.runs.length}, as ${run}.`]]);
 			const ran = yield* runPart(own, {
 				params,
 				host: treeHost(root.value, code.tree),
@@ -25492,7 +25930,7 @@ const nextStepsFor = (place, wait) => `Wait on it with ref0 runs waiting ${wait.
 /** Says a waiting start's tree on stderr, as it stands now. */
 const sayTree = Effect.fnUntraced(function* (wait) {
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* Console.error(printable(waitingLines(wait, now)));
+	yield* printBlocks([[waitingLines$1(wait, now)]]);
 });
 /**
 * Waits on a start that waits until it goes on or ends, or 9 minutes pass: what it got, printed
@@ -25538,7 +25976,7 @@ const waitOnStart = Effect.fnUntraced(function* (place, first, asJson, rerunComm
 * reports it. `ref0 runs trace` reads one run's trace, a check run's or a workflow run's, a page
 * at a time.
 */
-const failedWith$13 = (failed) => sayFailed(failed.nextStep);
+const failedWith$14 = (failed) => sayFailed(failed.nextStep);
 const decodeRunId = Schema.decodeUnknownOption(CheckRunId);
 const decodeTraced = Schema.decodeUnknownOption(TracedRun);
 /** A run named by a flag, or a failure that says how to name one. */
@@ -25639,8 +26077,8 @@ const run = Command.make("run", {
 		value
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* printAnswer(answer.json, asJson, `${waitingLines(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Run a check on main, or on a thread’s head: a run it ran already is answered, not run again, unless the check says reuse: false. A start its check’s start rule makes wait shows what it waits on, and waits up to 9 minutes for it, unless --no-wait. With --local, run a check of the thread’s open version on this machine, and report it"), Command.withShortDescription("Run a check on main or a thread’s head"));
+	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Run a check on main, or on a thread’s head: a run it ran already is answered, not run again, unless the check says reuse: false. A start its check’s start rule makes wait shows what it waits on, and waits up to 9 minutes for it, unless --no-wait. With --local, run a check of the thread’s open version on this machine, and report it"), Command.withShortDescription("Run a check on main or a thread’s head"));
 const trace = Command.make("trace", {
 	run: Argument.String("run").pipe(Argument.withDescription("The run, as checkrun_… or workflowrun_…")),
 	repo: repoFlag,
@@ -25683,7 +26121,7 @@ const trace = Command.make("trace", {
 		...narrowed,
 		`--cursor ${next}`
 	].join(" ")));
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A run’s trace, a check run’s or a workflow run’s: its steps and its log lines, a page at a time"), Command.withShortDescription("Show a run’s trace and log lines"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A run’s trace, a check run’s or a workflow run’s: its steps and its log lines, a page at a time"), Command.withShortDescription("Show a run’s trace and log lines"));
 const waiting$1 = Command.make("waiting", {
 	start: startArgument,
 	repo: repoFlag,
@@ -25717,8 +26155,8 @@ const waiting$1 = Command.make("waiting", {
 		value
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* printAnswer(answer.json, asJson, `${waitingLines(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A start of yours its check’s start rule made wait: what it waits on, as a tree, waiting up to 9 minutes for it to go on or end, unless --no-wait"), Command.withShortDescription("Show what a waiting start waits on"));
+	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A start of yours its check’s start rule made wait: what it waits on, as a tree, waiting up to 9 minutes for it to go on or end, unless --no-wait"), Command.withShortDescription("Show what a waiting start waits on"));
 /** What a cancel did, in words. */
 const cancelledText = {
 	start: "Cancelled: nothing started, and the workflow runs it waited on ended with it.",
@@ -25744,7 +26182,7 @@ const cancel = Command.make("cancel", {
 		})
 	});
 	yield* printAnswer(answer.json, asJson, cancelledText[answer.value.cancelled]);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Cancel a start of yours that waits: yours ends it and the workflow runs it waits on; one that joined another’s only leaves it"), Command.withShortDescription("Cancel a waiting start of yours"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Cancel a start of yours that waits: yours ends it and the workflow runs it waits on; one that joined another’s only leaves it"), Command.withShortDescription("Cancel a waiting start of yours"));
 /** Starting a check on `main` or a thread's head, listing one scope's runs, and reading a trace. */
 const runCommands = [run, Command.make("runs", {
 	repo: Argument.String("repo").pipe(Argument.withDescription("The repo, as owner/name"), Argument.withSchema(WrittenRepo)),
@@ -25786,14 +26224,14 @@ const runCommands = [run, Command.make("runs", {
 		...narrowed,
 		`--before ${next}`
 	].join(" ")));
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A repo’s check runs, main’s or a thread’s, the newest first, a page at a time"), Command.withShortDescription("List a repo’s check runs"), Command.withSubcommands([
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A repo’s check runs, main’s or a thread’s, the newest first, a page at a time"), Command.withShortDescription("List a repo’s check runs"), Command.withSubcommands([
 	trace,
 	waiting$1,
 	cancel
 ]))];
 //#endregion
 //#region src/commands/checks.ts
-const failedWith$12 = (failed) => sayFailed(failed.nextStep);
+const failedWith$13 = (failed) => sayFailed(failed.nextStep);
 const decodeCheck = Schema.decodeUnknownOption(CheckKey);
 const decodeToken = Schema.decodeUnknownOption(TokenId);
 const decodePerson = Schema.decodeUnknownOption(OwnerName);
@@ -25829,26 +26267,28 @@ const restore = Command.make("restore", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, restoredWords(answer.value, repo));
-}).pipe(Effect.catchTag("CallFailed", failedWith$12))).pipe(Command.withDescription("Restore a signer a miss revoked from answering a check, as an admin: its local runs, or their yes, count again"), Command.withShortDescription("Restore a revoked check signer"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Restore a signer a miss revoked from answering a check, as an admin: its local runs, or their yes, count again"), Command.withShortDescription("Restore a revoked check signer"));
 const signers = Command.make("signers").pipe(Command.withDescription("Who signs a check’s local runs or says yes over its runs: restore one a miss revoked"), Command.withShortDescription("Manage a check’s signers"), Command.withSubcommands([restore]));
 /** `ref0 checks`: a repo's checks. */
 const checksCommands = [Command.make("checks").pipe(Command.withDescription("A repo’s checks: the signers of their local runs and yeses"), Command.withShortDescription("Manage a repo’s check signers"), Command.withSubcommands([signers]))];
 //#endregion
 //#region src/gate-lines.ts
 /**
-* A pull request's gate as `ref0 gate` says it: its current version, whether its needs are
-* answered, the project gate's revision and whether it failed, and each need on its own line
-* with where it came from, ref0's floor or the line of `.ref0/gate.ts`, or of the project gate's,
-* that returned it, with that line's code. A need for one of the project's checks says the
-* project gate revision whose checks run for it, the version's own. Then what each gate read of
-* the change, each read's tree, path and the object it found, short. Then its gate decided again
-* in place under `main`'s `.ref0/`, with `main`'s commit: the needs it held, or those that grew,
-* and why. Then the additions standing on the pull request now, each with the ID `ref0 pr needs
-* remove` takes: the version's own say who added its needs when it was made, and one may have gone
-* since. Then the local runs of its parts' identities, each with its signer; each part that takes
-* local or needs a yes, with its wrappers, the run and the yeses that meet it or what it waits for;
-* and last, each signer revoked from answering one of their checks, an attachment or a person by
-* name, with how an admin restores them.
+* A pull request's gate as `ref0 gate` says it: its current version, whether its gate returned its
+* needs, and once it's open, how many still wait and whose one yes would meet them all; the project
+* gate's revision and whether it failed; and each need on its own line with where it came from,
+* ref0's floor or the line of `.ref0/gate.ts`, or of the project gate's, that returned it, with
+* that line's code, and under it whether it's met, by whose yes, or on whom or what it waits; in an
+* organization, what one yes gives its giver. A need for one of the project's checks says the
+* project gate revision whose checks run for it, the version's own. Then what each gate read of the
+* change, each read's tree, path and the object it found, short. Then its gate decided again in
+* place under `main`'s `.ref0/`, with `main`'s commit: the needs it held, or those that grew, and
+* why. Then the additions standing on the pull request now, each with the ID `ref0 pr needs remove`
+* takes: the version's own say who added its needs when it was made, and one may have gone since.
+* Then the local runs of its parts' identities, each with its signer; each part that takes local or
+* needs a yes, with its wrappers, the run and the yeses that meet it or what it waits for; and
+* last, each signer revoked from answering one of their checks, an attachment or a person by name,
+* with how an admin restores them.
 */
 const fromWords = (from) => {
 	switch (from.kind) {
@@ -25879,11 +26319,116 @@ const columns = (lines) => {
 * version was decided under, whose checks run for it, never `main`'s.
 */
 const noteOf = (need, view) => need.kind === "check" && need.source === "project" && view.projectRevision !== void 0 ? `  at gate revision ${view.projectRevision}` : "";
-const stateWords = (view) => {
+const isPerson = Schema.is(PersonId);
+/** An owner or a person, by name where it's known. */
+const nameOf = (id, named) => named.names.get(id) ?? id;
+/** The admins of an owner, in words: at home, its person alone, by name. */
+const adminsOf = (owner, named) => isPerson(owner) ? nameOf(owner, named) : `an admin of ${nameOf(owner, named)}`;
+/** Who answers as a decider, in words: a person by their name, a check by its key. */
+const whoWords = (decider, named) => {
+	switch (decider.kind) {
+		case "person": return nameOf(decider.id, named);
+		case "role": return adminsOf(decider.owner, named);
+		case "permission": return adminsOf(named.owner, named);
+		case "check": return checkKey(decider);
+		case "agent": return decider.id;
+		case "override": return whoWords(decider.by, named);
+	}
+};
+/** Alternatives in words, each once: `pip or an admin of acme`. */
+const anyOf = (deciders, named) => [...new Set(deciders.map((each) => whoWords(each, named)))].join(" or ");
+/** A yes that met a need, in words: whose, or the check that passed or was overridden. */
+const needYesWords = (yes, named) => {
+	if (yes.decider.kind === "check") return `${checkKey(yes.decider)} ${yes.overridden === true ? "overridden" : "passed"}`;
+	if (yes.by === void 0) return `${whoWords(yes.decider, named)}’s yes`;
+	const by = nameOf(yes.by, named);
+	return yes.decider.kind === "person" ? `${by}’s yes` : `${by}’s yes, as an admin`;
+};
+/** An override left of a check, in words: whose yes overrides which of its noes. */
+const overrideWords = (check, left, named) => `a yes from ${whoWords(left.by, named)} to override ${left.of === "failed run" ? `${check}’s failed run` : `${check} not running`}`;
+/**
+* One decider a need waits on, in words: a check to pass, or its parts when the need wraps it,
+* or, once ref0 said no to it, every override left.
+*/
+const waitWords = (wait, need, named) => {
+	if (wait.decider.kind !== "check") return whoWords(wait.decider, named);
+	const check = checkKey(wait.decider);
+	if (wait.overrides === void 0) return need.kind === "check" && (need.local === true || need.passkey !== void 0) ? `${check}’s parts, as below` : `${check} to pass`;
+	if (wait.overrides.length === 0) return `${check}, which ref0 said no to`;
+	return [...new Set(wait.overrides.map((left) => overrideWords(check, left, named)))].join(", and ");
+};
+/** The decider keys whose answers meet a need, for telling two needs met by the same yes. */
+const yesKey = (standing) => {
+	if (standing.state === "met" && "by" in standing && standing.by.every(({ decider }) => decider.kind !== "check")) return standing.by.map(({ decider }) => deciderKey(decider)).join(" ");
+	if (standing.state === "waiting" && "on" in standing && !standing.all) return standing.on.map(({ decider }) => deciderKey(decider)).join(" ");
+};
+/** How a need stands, in words. */
+const standingWords = (standing, need, named) => {
+	switch (standing.state) {
+		case "refused": return `refused: ${nameOf(standing.by, named)} said no, which decides the gate no`;
+		case "met": {
+			if ("as" in standing) return standing.as === "no checks" ? "met: no check runs on this change" : "met: the merge queue’s tip runs it, and main moves only once it passes there";
+			const people = /* @__PURE__ */ new Map();
+			for (const yes of standing.by) {
+				const who = yes.by ?? deciderKey(yes.decider);
+				if (!people.has(who)) people.set(who, yes);
+			}
+			const yeses = [...new Set([...people.values()].map((yes) => needYesWords(yes, named)))];
+			return standing.by.some(({ decider }) => decider.kind === "check") ? `met: ${yeses.join(", ")}` : `met by ${yeses.join(" and ")}`;
+		}
+		case "waiting": {
+			if ("for" in standing) return "waiting for ref0 to read which of main’s checks run on this change";
+			if (standing.all) return `waiting for ${standing.on.map((wait) => waitWords(wait, need, named)).join(", and ")}`;
+			const asked = `a yes from ${anyOf(standing.on.map(({ decider }) => decider), named)}`;
+			return need.kind === "check" || need.kind === "checks" ? `waiting on ${asked}: no run can meet it before main moves` : `waiting on ${asked}`;
+		}
+	}
+};
+/**
+* Who one yes would meet a waiting need with, in words, each alone: anyone it asks a yes of, or
+* the one answerer of every override it waits on; none for a check to pass.
+*/
+const meetersOf = (standing, named) => {
+	if (standing.state !== "waiting" || !("on" in standing)) return [];
+	if (!standing.all) return standing.on.map(({ decider }) => whoWords(decider, named));
+	const answerers = new Set(standing.on.flatMap(({ overrides }) => overrides === void 0 || overrides.length === 0 ? [""] : overrides.map((left) => whoWords(left.by, named))));
+	return answerers.size === 1 && !answerers.has("") ? [...answerers] : [];
+};
+/** An open gate's standings, or none until every need has one. */
+const standingsOf = (needs) => {
+	const standings = needs.flatMap(({ standing }) => standing === void 0 ? [] : [standing]);
+	return standings.length === 0 || standings.length < needs.length ? void 0 : standings;
+};
+/**
+* Where an open gate's needs stand, after its state: each met; refused, by whom; or how many
+* still wait, and whose one yes would meet them all, since one yes answers every decider its
+* person may answer as.
+*/
+const standsWords = (needs, named) => {
+	const standings = standingsOf(needs);
+	if (standings === void 0) return "";
+	const refused = standings.find((each) => each.state === "refused");
+	if (refused !== void 0 && refused.state === "refused") return `; ${nameOf(refused.by, named)} said no, which decides it no`;
+	const waiting = standings.filter((each) => each.state === "waiting");
+	if (waiting.length === 0) return "; each need is met";
+	const [first, ...rest] = waiting.map((each) => meetersOf(each, named));
+	const common = (first ?? []).filter((who) => rest.every((each) => each.includes(who)));
+	const still = waiting.length === 1 ? "1 still waits" : `${waiting.length} still wait`;
+	if (common.length === 0) return `; ${still}`;
+	return `; ${still}, and one yes from ${[...new Set(common)].join(" or ")} meets ${waiting.length === 1 ? "it" : "them all"}`;
+};
+/**
+* In an organization, what one yes gives, under the needs, while one waits on a yes: every
+* approval and override its giver may give, so an admin's meets every need an admin may meet.
+*/
+const oneYesLines = (view, named) => {
+	return (standingsOf(view.needs) ?? []).some((each) => each.state === "waiting" && "on" in each && each.on.some(({ decider, overrides }) => decider.kind !== "check" || overrides !== void 0)) && !isPerson(view.owner) ? [`  one yes to this gate gives every approval and override above its giver may give, as themselves and as ${adminsOf(view.owner, named)}`] : [];
+};
+const stateWords = (view, named) => {
 	switch (view.state) {
-		case "pending": return "its gate hasn’t answered yet";
-		case "answered": return "answered";
-		case "failed": return `its gate failed: ${view.why ?? "ref0 couldn’t run it"}`;
+		case "pending": return "its gate hasn’t returned its needs yet";
+		case "answered": return `its gate returned its needs${standsWords(view.needs, named)}`;
+		case "failed": return `its gate failed: ${view.why ?? "ref0 couldn’t run it"}${standsWords(view.needs, named)}`;
 	}
 };
 /** The project gate's line, under the head: its revision, and why it failed. */
@@ -25891,7 +26436,7 @@ const projectWords$1 = (view) => {
 	const project = view.projectGate;
 	if (project === void 0) return [];
 	const at = `  project gate, revision ${project.revision}`;
-	return [project.state === "failed" ? `${at}: failed: ${project.why ?? "ref0 couldn’t run it"}, so an admin answers it` : `${at}: ${project.state}`];
+	return [project.state === "failed" ? `${at}: failed: ${project.why ?? "ref0 couldn’t run it"}, so an admin answers it` : `${at}: ${project.state === "pending" ? "hasn’t returned its needs yet" : "returned its needs"}`];
 };
 /**
 * What a gate read of the change, under `head`: each read's tree, its path and the object it
@@ -25906,6 +26451,23 @@ const needLines = (needs, view) => columns(needs.map(({ need, from }) => ({
 	need: spellNeed(need),
 	from: `${from.map(fromWords).join("; ")}${noteOf(need, view)}`
 })));
+/**
+* The version's needs, each with how it stands on the line under it, once its gate is open: a
+* need met by, or waiting on, the same yes as one above says so.
+*/
+const standingLines = (view, named) => {
+	const lines = needLines(view.needs, view);
+	const seen = /* @__PURE__ */ new Map();
+	return view.needs.flatMap(({ need, standing }, i) => {
+		const line = lines[i] ?? "";
+		if (standing === void 0) return [line];
+		const key = yesKey(standing);
+		const same = key === void 0 ? void 0 : seen.get(key);
+		if (key !== void 0 && same === void 0) seen.set(key, need);
+		const also = same === void 0 ? "" : `, the same yes as ${spellNeed(same)}`;
+		return [line, `    ${standingWords(standing, need, named)}${also}`];
+	});
+};
 const grewWords = (grew) => {
 	const why = grew.why ?? "ref0 couldn’t say why";
 	switch (grew.kind) {
@@ -25917,7 +26479,7 @@ const grewWords = (grew) => {
 };
 const inPlaceLines = (inPlace, view) => {
 	const head = `under main’s .ref0/, at ${inPlace.main.slice(0, 7)}:`;
-	if (inPlace.state === "pending") return [`${head} its gate there hasn’t answered yet`];
+	if (inPlace.state === "pending") return [`${head} its gate there hasn’t returned its needs yet`];
 	const reads = readLines("its gate there read:", inPlace.reads ?? []);
 	if (inPlace.state === "held" || inPlace.grew === void 0) return [
 		`${head} ${inPlace.state}`,
@@ -25991,7 +26553,11 @@ const wrappedPartLines = (parts) => parts.length === 0 ? [] : ["parts that take
 const revokedSignerLines = (one) => one.kind === "attachment" ? [`  ${one.check}  attachment ${one.attachment.id} of ${one.attachment.person}, since ${DateTime.formatIso(one.at)}: ref0 failed local run ${one.signed}'s identity twice, the second in run ${one.failed}`, `    an admin restores it: ref0 checks signers restore ${one.check} --attachment ${one.attachment.id}`] : [`  ${one.check}  ${one.person}, since ${DateTime.formatIso(one.at)}: ref0 failed the identity of run ${one.signed}, which they said yes over, twice, the second in run ${one.failed}`, `    an admin restores them: ref0 checks signers restore ${one.check} --person ${one.person}`];
 const revokedLines = (revoked) => revoked.length === 0 ? [] : ["signers revoked:", ...revoked.flatMap(revokedSignerLines)];
 const gateLines = (view, repo) => {
-	const head = `${repo}#${view.pullRequest}, version ${view.version}: ${stateWords(view)}`;
+	const named = {
+		names: new Map((view.names ?? []).map(({ owner, name }) => [owner, name])),
+		owner: view.owner
+	};
+	const head = `${repo}#${view.pullRequest}, version ${view.version}: ${stateWords(view, named)}`;
 	const inPlace = view.inPlace === void 0 ? [] : inPlaceLines(view.inPlace, view);
 	const added = view.added.map(({ need, from }) => ({
 		need: spellNeed(need),
@@ -26003,7 +26569,8 @@ const gateLines = (view, repo) => {
 	return [
 		head,
 		...projectWords$1(view),
-		...needLines(view.needs, view),
+		...standingLines(view, named),
+		...oneYesLines(view, named),
 		...readLines("its gate read:", view.reads),
 		...readLines("its project gate read:", view.projectGate?.reads ?? []),
 		...inPlace,
@@ -26032,7 +26599,7 @@ const projectGateLines = (view, repo) => {
 };
 //#endregion
 //#region src/commands/gate.ts
-const failedWith$11 = (failed) => sayFailed(failed.nextStep);
+const failedWith$12 = (failed) => sayFailed(failed.nextStep);
 const project$4 = Flag.Boolean("project").pipe(Flag.withDescription("The project gate instead: its active revision, and a pending one with each latch it waits on"), Flag.withDefault(false));
 /** A pull request's gate. */
 const gateCommands = [Command.make("gate", {
@@ -26058,7 +26625,7 @@ const gateCommands = [Command.make("gate", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, gateLines(answer.value, repo));
-}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("A pull request’s needs, each with where it came from: ref0’s floor, or a line of .ref0/gate.ts; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
+}).pipe(Effect.catchTag("CallFailed", failedWith$12))).pipe(Command.withDescription("A pull request’s needs, each with where it came from, ref0’s floor or a line of .ref0/gate.ts, and whether it’s met or on whom it waits; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
 //#endregion
 //#region src/clone.ts
 /** The remote a clone pushes to: its thread's fork path, named as the thread is. */
@@ -26416,7 +26983,7 @@ const syncBase = Effect.fnUntraced(function* (folder) {
 * with the session's fork to push to; `ref0 sync`, the session's base merged in, `main` or the
 * thread it's stacked on; and `ref0 git-credential`, the helper Git asks there.
 */
-const failedWith$10 = (failed) => sayFailed(failed.nextStep);
+const failedWith$11 = (failed) => sayFailed(failed.nextStep);
 /** `ref0 git-credential`, as Git runs it: see `answerGit`. */
 const credential = Command.make("git-credential", { operation: Argument.String("operation").pipe(Argument.withDescription("What Git asks: get, store or erase")) }, ({ operation }) => Effect.gen(function* () {
 	const input = yield* (yield* Stdio.Stdio).stdin.pipe(Stream.decodeText(), Stream.mkString);
@@ -26470,7 +27037,7 @@ const gitCommands = [
 			value
 		])) !== 0) return yield* sayFailed(`Setting ${key} in ${into} failed.`);
 		yield* printAnswer(fork.json, asJson, `Cloned ${owner}/${name} into ${into}. origin is read-only to agents: git push goes to ${forkRemote(fork.value)}, the fork of whichever session on the thread pushes.`);
-	}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Clone a repo of the session’s project, to push to its fork"), Command.withShortDescription("Clone a repo to work in your session’s fork")),
+	}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("Clone a repo of the session’s project, to push to its fork"), Command.withShortDescription("Clone a repo to work in your session’s fork")),
 	Command.make("sync", { json }, ({ json: asJson }) => Effect.gen(function* () {
 		yield* ownSession("ref0 sync runs in an agent’s session, in a clone ref0 clone made.");
 		const synced = yield* syncBase(".");
@@ -26486,7 +27053,7 @@ const gitCommands = [
 			on,
 			commit
 		}, asJson, `Merged ${at}. Push it when you’re ready: git push.`);
-	}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Merge in main, or the thread this one is stacked on, as ref0 holds it now. ref0 mcp says to when what merged touches your work"), Command.withShortDescription("Merge in main or the thread this one is stacked on")),
+	}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("Merge in main, or the thread this one is stacked on, as ref0 holds it now. ref0 mcp says to when what merged touches your work"), Command.withShortDescription("Merge in main or the thread this one is stacked on")),
 	credential
 ];
 //#endregion
@@ -26899,7 +27466,7 @@ const usageCommands = [personUsage, personMeters];
 * invitations. Each is a person's, asked of them by approval, as every terminal command of
 * theirs is; agents never change members.
 */
-const failedWith$9 = (failed) => sayFailed(failed.nextStep);
+const failedWith$10 = (failed) => sayFailed(failed.nextStep);
 const organization$2 = Argument.String("org").pipe(Argument.withDescription("The organization, by name"), Argument.withSchema(OwnerRef));
 const person = Argument.String("person").pipe(Argument.withDescription("The person, by name"), Argument.withSchema(OwnerRef));
 const invitation = Argument.String("invitation").pipe(Argument.withDescription("The invitation’s ID, such as invitation_01k6…"));
@@ -26929,7 +27496,7 @@ const create$1 = Command.make("create", {
 		payload
 	});
 	yield* printAnswer(answer.json, asJson, answer.value.state === "ready" ? `Made ${answer.value.name}.` : `Made ${answer.value.name}; it’s being set up.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Make an organization, with you as its admin"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Make an organization, with you as its admin"));
 const leave = Command.make("leave", {
 	organization: organization$2,
 	json
@@ -26939,7 +27506,7 @@ const leave = Command.make("leave", {
 		params: { owner: org }
 	});
 	yield* printAnswer(answer.json, asJson, `Left ${org}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Leave an organization"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Leave an organization"));
 const orgCommand = Command.make("org").pipe(Command.withDescription("Make an organization, leave one, or read its usage and what ref0 ran and kept for it"), Command.withShortDescription("Manage an organization and read its usage"), Command.withSubcommands([
 	create$1,
 	leave,
@@ -26956,7 +27523,7 @@ const orgs = Command.make("orgs", {
 	});
 	const lines = answer.value.organizations.map((each) => `${each.name}  ${each.role}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? "You’re in no organization yet." : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The organizations you’re a member of"), Command.withShortDescription("List your organizations"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("The organizations you’re a member of"), Command.withShortDescription("List your organizations"));
 const members = Command.make("members", {
 	organization: organization$2,
 	cursor: cursor$3,
@@ -26969,7 +27536,7 @@ const members = Command.make("members", {
 	});
 	const lines = answer.value.members.map((each) => `${each.name}  ${each.role}${each.member.kind === "agent" ? "  (its agent)" : ""}`);
 	yield* printAnswer(answer.json, asJson, [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("An organization’s members, people and its own agents"), Command.withShortDescription("List an organization’s members"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("An organization’s members, people and its own agents"), Command.withShortDescription("List an organization’s members"));
 const role = Command.make("role", {
 	organization: organization$2,
 	person,
@@ -26985,7 +27552,7 @@ const role = Command.make("role", {
 		payload: { role: chosen }
 	});
 	yield* printAnswer(answer.json, asJson, `${named} is ${answer.value.role} of ${org} now.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Make a member an admin, or an admin a member"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Make a member an admin, or an admin a member"));
 const remove$1 = Command.make("remove", {
 	organization: organization$2,
 	person,
@@ -26999,7 +27566,7 @@ const remove$1 = Command.make("remove", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, `Removed ${named} from ${org}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Remove a member, with the grants they held there"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Remove a member, with the grants they held there"));
 const memberCommand = Command.make("member").pipe(Command.withDescription("Change a member’s role, or remove them"), Command.withSubcommands([role, remove$1]));
 const listInvitations = Command.make("list", {
 	organization: organization$2,
@@ -27013,7 +27580,7 @@ const listInvitations = Command.make("list", {
 	});
 	const lines = answer.value.invitations.map((each) => `${each.invitation}  ${each.invitee.name}  ${each.role}  from ${each.sentBy.name}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `${org} has no open invitations.` : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("An organization’s open invitations"), Command.withShortDescription("List an organization’s open invitations"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("An organization’s open invitations"), Command.withShortDescription("List an organization’s open invitations"));
 const withdraw = Command.make("withdraw", {
 	organization: organization$2,
 	invitation,
@@ -27027,7 +27594,7 @@ const withdraw = Command.make("withdraw", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, `Withdrew ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Take an open invitation back"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Take an open invitation back"));
 const invite = Command.make("invite", {
 	organization: organization$2,
 	person,
@@ -27047,7 +27614,7 @@ const invite = Command.make("invite", {
 		payload
 	});
 	yield* printAnswer(answer.json, asJson, `Invited ${answer.value.invitee.name} to ${org} as ${answer.value.role}: ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Invite a person to an organization; list or withdraw invitations"), Command.withSubcommands([listInvitations, withdraw]));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Invite a person to an organization; list or withdraw invitations"), Command.withSubcommands([listInvitations, withdraw]));
 const invitations = Command.make("invitations", {
 	cursor: cursor$3,
 	json
@@ -27058,7 +27625,7 @@ const invitations = Command.make("invitations", {
 	});
 	const lines = answer.value.invitations.map((each) => `${each.invitation}  ${each.organization.name}  ${each.role}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? "You have no open invitations." : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The invitations you’ve received"), Command.withShortDescription("List invitations you’ve received"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("The invitations you’ve received"), Command.withShortDescription("List invitations you’ve received"));
 const accept = Command.make("accept", {
 	invitation,
 	json
@@ -27068,7 +27635,7 @@ const accept = Command.make("accept", {
 		params: { invitation: id }
 	});
 	yield* printAnswer(answer.json, asJson, `Joined as ${answer.value.role}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Accept an invitation"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Accept an invitation"));
 const decline = Command.make("decline", {
 	invitation,
 	json
@@ -27078,7 +27645,7 @@ const decline = Command.make("decline", {
 		params: { invitation: id }
 	});
 	yield* printAnswer(answer.json, asJson, `Declined ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Decline an invitation"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Decline an invitation"));
 /** Organizations, their members and invitations. */
 const organizationCommands = [
 	orgCommand,
@@ -27091,7 +27658,7 @@ const organizationCommands = [
 ];
 //#endregion
 //#region src/commands/grants.ts
-const failedWith$8 = (failed) => sayFailed(failed.nextStep);
+const failedWith$9 = (failed) => sayFailed(failed.nextStep);
 const isOwnerRef = Schema.is(OwnerRef);
 const isProject$1 = Schema.is(WrittenProject);
 const isThread = Schema.is(WrittenThread);
@@ -27213,7 +27780,7 @@ const changeCommand = (name, endpoint) => Command.make(name, {
 		onSome: (on) => [on]
 	})];
 	yield* printAnswer(answer.json, asJson, endpoint === "grants.set" ? `Granted ${role}: ${said.join(" ")}.` : `Took back ${role}: ${said.join(" ")}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$8)));
+}).pipe(Effect.catchTag("CallFailed", failedWith$9)));
 const revoke = changeCommand("revoke", "grants.revoke").pipe(Command.withDescription("Take a grant back, written as it was given"));
 const grant = changeCommand("grant", "grants.set").pipe(Command.withDescription("Give a grant in an organization, as an admin: ref0 grant acme/billing pip/claude write"), Command.withShortDescription("Give a grant in an organization"), Command.withSubcommands([revoke]));
 /** An organization's grants. */
@@ -27233,7 +27800,41 @@ const grantCommands = [Command.make("grants", {
 	const lines = answer.value.grants.map((each) => `${writtenSubject(org, each.subject)}  ${writtenPrincipal(each.principal)}  ${each.role}`);
 	const next = answer.value.nextAfter;
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `You see no grants in ${org}.` : [...lines, ...next === void 0 ? [] : [`More: --cursor ${next}`]].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$8))).pipe(Command.withDescription("The grants in an organization you may see"), Command.withShortDescription("List an organization’s grants")), grant];
+}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The grants in an organization you may see"), Command.withShortDescription("List an organization’s grants")), grant];
+//#endregion
+//#region src/commands/identity-token.ts
+/**
+* `ref0 identity-token --audience <origin>`: an identity token for the agent's session it runs
+* in, for one outside service, which verifies it against ref0's published keys. One request, by
+* the session's own token, which never starts or renews a session. The token alone goes to
+* stdout, so it pipes into a verifier; anything else goes to stderr, with no token, and fails.
+*/
+const decodeAudience = Schema.decodeUnknownOption(IdentityAudience);
+const outside = "ref0 identity-token runs only in an agent’s ref0 session, and none runs here. In Claude Code or Codex, one starts at each prompt once ref0 connect has connected its config folder: ask the agent there.";
+const audienceOnce = "Name the audience once, as --audience https://verifier.example: the outside service’s HTTPS origin.";
+const notAnAudience = "Send the outside service’s HTTPS origin as the audience, such as https://verifier.example, with no path.";
+const mayHaveIssued = "ref0’s answer was lost or failed partway, so it may have made a token that never reached you. Ask again for a fresh one in a moment.";
+/**
+* What went wrong, said once, on stderr. An answer lost or failed partway may still have made a
+* token, as ref0's log records, but nothing to check or undo: a fresh request is the way on.
+*/
+const failedWith$8 = (failed) => sayFailed(failed.status >= 500 || failed.status === 0 && (failed.kind === "Unreachable" || failed.kind === "Unexpected") ? mayHaveIssued : failed.nextStep);
+/** Identity tokens, for outside services. */
+const identityTokenCommands = [Command.make("identity-token", {
+	audience: Flag.String("audience").pipe(Flag.withDescription("The outside service that verifies the token, as its HTTPS origin, such as https://verifier.example"), Flag.atLeast(0)),
+	json
+}, ({ audience: named, json: asJson }) => Effect.gen(function* () {
+	if (named.length !== 1) return yield* sayFailed(audienceOnce);
+	const audience = decodeAudience(named[0]);
+	if (Option.isNone(audience)) return yield* sayFailed(notAnAudience);
+	yield* ownSession(outside);
+	const issued = yield* callEndpoint({
+		endpoint: "me.identityToken",
+		payload: { audience: audience.value }
+	});
+	if (asJson) return yield* printAnswer(issued.json, true, "");
+	yield* Console.log(issued.value.token);
+}).pipe(Effect.catchTag("CallFailed", failedWith$8))).pipe(Command.withDescription("Print a short-lived identity token, a signed JWT naming your agent, for one outside service"), Command.withShortDescription("Print an identity token for one outside service"))];
 //#endregion
 //#region src/commands/agents.ts
 /**
@@ -27508,18 +28109,40 @@ const repoCommands = [Command.make("repos", {
 //#endregion
 //#region src/decision-lines.ts
 /** A decision in words, as `ref0 waiting`, `ref0 decision` and `ref0 answer` print it. */
-/** What a decision is about, in words. */
-const subjectWords = (subject) => {
-	switch (subject.kind) {
-		case "thread": return subject.thread;
-		case "version": return `version ${subject.version} of pull request ${subject.pullRequest} in ${subject.repo}, from ${subject.thread}`;
-	}
+/**
+* A thread as a line read in `scope` names it: `#3` when it's in that scope, else in full, as
+* `pip/default#3`.
+*/
+const threadWords = (thread, scope) => thread.startsWith(`${scope}#`) ? thread.slice(scope.length) : thread;
+/**
+* What waits, in words: a gate's pull request and version, and the thread it's from, or the thread
+* an ask is on.
+*/
+const subjectWords = ({ subject, names }, scope) => subject.kind === "version" && names.pullRequest !== void 0 ? `${names.pullRequest}, version ${subject.version}, from ${threadWords(names.thread, scope)}` : names.thread;
+/**
+* A decision in a line, read in `scope`: what waits, its answers or how it ended, then its ID, for
+* `ref0 decision` and `ref0 answer`.
+*/
+const decisionLines = (decision, scope) => {
+	const on = subjectWords(decision, scope);
+	const answers = decision.options.map((option) => option.key).join(" or ");
+	return `${on}: ${decision.state === "open" ? answers : `${decision.result ?? "no answer"}, ${decision.closedWhy ?? "closed"}`}  ${decision.decision}`;
 };
-/** A decision in a line. */
-const decisionLines = (view) => {
-	const on = subjectWords(view.subject);
-	const answers = view.options.map((option) => option.key).join(" or ");
-	return view.state === "open" ? `${view.decision}  on ${on}: ${answers}` : `${view.decision}  on ${on}: ${view.result ?? "no answer"}, ${view.closedWhy ?? "closed"}`;
+/**
+* What waits in `scope`, as `ref0 waiting` prints it: what waits on the caller, then, for an agent,
+* what waits on its person, which only they answer, on their own page.
+*/
+const waitingLines = (decisions, scope) => {
+	const yours = decisions.flatMap((decision) => decision.waitsOn === "you" ? [decisionLines(decision, scope)] : []);
+	const theirs = decisions.flatMap((decision) => decision.waitsOn === "your person" ? [`  ${decisionLines(decision, scope)}`] : []);
+	if (theirs.length === 0) return yours.length === 0 ? `Nothing waits on you in ${scope}.` : yours.join("\n");
+	const them = theirs.length === 1 ? "it" : "them";
+	return [
+		...yours,
+		`Waits on your person, who alone can answer ${them}, under Waiting on you on their page:`,
+		...theirs,
+		`ref0 refuses an agent’s answer to ${them}.`
+	].join("\n");
 };
 //#endregion
 //#region src/commands/plans.ts
@@ -27534,7 +28157,10 @@ const checkPlan = Schema.decodeUnknownEffect(PlanInput);
 const encodePlan = Schema.encodeEffect(PlanInput);
 const decodeRecipient = Schema.decodeUnknownOption(CommentRecipient);
 const thread$4 = Argument.String("thread").pipe(Argument.withDescription("The thread, as owner/project#number, or an org thread, as acme#7"), Argument.withSchema(WrittenThread));
-const project$2 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads"), Argument.withSchema(Schema.Union([WrittenProject, OwnerName])));
+/** A project, `acme/billing`, or an organization, `acme`, for its org threads. */
+const Scope$1 = Schema.Union([WrittenProject, OwnerName]);
+const decodeScope = Schema.decodeUnknownOption(Scope$1);
+const project$2 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads"), Argument.withSchema(Scope$1));
 const version = Argument.Int("version").pipe(Argument.withDescription("The plan’s version"));
 const decision = Argument.String("decision").pipe(Argument.withDescription("The decision’s ID"));
 /** Where a version's approval stands: who accepted it, or its check. */
@@ -27695,27 +28321,37 @@ const comments = Command.make("comments", {
 	].filter((line) => line !== "").join("\n");
 	yield* printAnswer(answer.json, asJson, words);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("A plan version’s comments, oldest first"), Command.withShortDescription("List a plan version’s comments"));
+const plan = Command.make("plan").pipe(Command.withDescription("A thread’s plan: write, propose and read its versions, and comment"), Command.withShortDescription("Write, propose and read a thread’s plan"), Command.withSubcommands([
+	list$4,
+	write,
+	onVersion("show"),
+	onVersion("propose"),
+	comment,
+	comments
+]));
+/**
+* The project of the thread the session runs on, or its organization for an org thread's. Outside
+* a session, it says how to name one, and fails before anything's sent.
+*/
+const sessionScope = Effect.gen(function* () {
+	const thread = yield* (yield* SessionThread).current.pipe(Effect.catchTag("KeychainError", (failed) => sayFailed(failed.nextStep)));
+	const scope = Option.flatMap(thread, (written) => decodeScope(projectOf$2(written)));
+	if (Option.isNone(scope)) return yield* sayFailed("Name the project: ref0 waiting pip/shop. Or, for an organization’s org threads: ref0 waiting acme.");
+	return scope.value;
+});
 /** Plans' and decisions' commands. */
 const planCommands = [
-	Command.make("plan").pipe(Command.withDescription("A thread’s plan: write, propose and read its versions, and comment"), Command.withShortDescription("Write, propose and read a thread’s plan"), Command.withSubcommands([
-		list$4,
-		write,
-		onVersion("show"),
-		onVersion("propose"),
-		comment,
-		comments
-	])),
+	plan,
 	Command.make("waiting", {
-		project: project$2,
+		project: Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads; in an agent’s session, its own if not named"), Argument.withSchema(Scope$1), Argument.optional),
 		json
-	}, ({ project: address, json: asJson }) => Effect.gen(function* () {
+	}, ({ project: named, json: asJson }) => Effect.gen(function* () {
+		const address = Option.isSome(named) ? named.value : yield* sessionScope;
 		const answer = yield* callEndpoint(routed(address, {
 			endpoint: "decisions.waiting",
 			params: scopeParams(address)
 		}));
-		const { decisions } = answer.value;
-		const words = decisions.length === 0 ? "Nothing waits on you here." : decisions.map((each) => decisionLines(each)).join("\n");
-		yield* printAnswer(answer.json, asJson, words);
+		yield* printAnswer(answer.json, asJson, waitingLines(answer.value.decisions, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("What in a project, or in an organization’s org threads, waits on you"), Command.withShortDescription("Show what waits on you")),
 	Command.make("decision", {
 		project: project$2,
@@ -27729,7 +28365,7 @@ const planCommands = [
 				decision: id
 			}
 		}));
-		yield* printAnswer(answer.json, asJson, decisionLines(answer.value));
+		yield* printAnswer(answer.json, asJson, decisionLines(answer.value, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("One decision, as it stands"), Command.withShortDescription("Show a decision and where it stands")),
 	Command.make("answer", {
 		project: project$2,
@@ -27752,7 +28388,7 @@ const planCommands = [
 				})
 			})
 		}));
-		yield* printAnswer(answer.json, asJson, decisionLines(answer.value));
+		yield* printAnswer(answer.json, asJson, decisionLines(answer.value, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Answer a decision that waits on you"))
 ];
 //#endregion
@@ -27792,9 +28428,14 @@ const endedLines = (view) => {
 	const why = view.closedWhy === null ? "" : closedWhyWords[view.closedWhy];
 	return [`  ${view.state.padEnd(8)}  ${at}${why}`];
 };
-const openedByWords = (view) => {
-	const by = "session" in view.openedBy ? `session ${view.openedBy.session} of agent ${view.openedBy.agent.id}` : `workflow ${view.openedBy.workflow.name}’s run ${view.openedBy.workflow.run}`;
-	return `${minute(view.openedAt)} by ${by}`;
+/**
+* When it opened, and by what: a workflow's run, or an agent's session, whose IDs go on a line of
+* their own, since ref0 answers no name for either.
+*/
+const openedLines = (view) => {
+	const at = minute(view.openedAt);
+	if ("workflow" in view.openedBy) return [`  opened    ${at} by workflow ${view.openedBy.workflow.name}’s run ${view.openedBy.workflow.run}`];
+	return [`  opened    ${at} by an agent’s session:`, `            ${view.openedBy.session} of ${view.openedBy.agent.id}`];
 };
 /** `ref0 pr show`: one pull request, a line for each thing an agent acts on. */
 const pullRequestLines = (view, repo) => {
@@ -27805,7 +28446,7 @@ const pullRequestLines = (view, repo) => {
 		`${repo}#${view.pullRequest}, thread #${view.threadNumber}: ${view.state}${repair}`,
 		`  head      ${headWords(head)}`,
 		`  current   ${versionWords(current)}, on ${base}`,
-		`  opened    ${openedByWords(view)}`,
+		...openedLines(view),
 		...endedLines(view)
 	].join("\n");
 };
@@ -28791,7 +29432,7 @@ const waitOnBlockers = Effect.fnUntraced(function* (asJson) {
 	const { thread, blockers } = first.value;
 	if (blockers.length === 0) return yield* printAnswer(first.json, asJson, `Nothing blocks #${thread} now: it may merge.`);
 	const them = blockers.length === 1 ? "it" : "them";
-	yield* Console.error(printable(`${blockedSentence(thread, blockers)} Waiting up to 9 minutes for ${them} to clear…`));
+	yield* printBlocks([[`${blockedSentence(thread, blockers)} Waiting up to 9 minutes for ${them} to clear…`]]);
 	let renewedAt = Number.NEGATIVE_INFINITY;
 	for (;;) {
 		const now = yield* Clock.currentTimeMillis;
@@ -29684,7 +30325,7 @@ const enable = Command.make("enable", {
 		const why = found.why === void 0 ? "" : ` (${found.why})`;
 		return yield* sayFailed(found.why === "activation failed" ? `ref0 couldn't read main's .ref0/ for a day, and reads it again each hour. Once ref0 workflows list ${address} shows a version of ${workflow}, turn it on.` : `main has no version of ${workflow} ref0 can run${why}. Fix its code in .ref0/ and merge it, so ref0 compiles a new version, then turn that one on.`);
 	}
-	yield* Console.error(printable(enablingLines(workflow, found.version, found.manifest, found)));
+	yield* printBlocks([[enablingLines(workflow, found.version, found.manifest, found)]]);
 	const answer = yield* callEndpoint({
 		endpoint: "workflows.enable",
 		params: repoParts(address),
@@ -29717,7 +30358,7 @@ const start = Command.make("start", {
 			source: source.value
 		}
 	});
-	yield* Console.error(printable(attachingLines(written, compiled.value)));
+	yield* printBlocks([[attachingLines(written, compiled.value)]]);
 	const answer = yield* callEndpoint({
 		endpoint: "threadWorkflows.start",
 		params,
@@ -32677,11 +33318,11 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 * started that thread, `REF0_EVENT`. Both, each as ref0 writes it, or neither. `REF0_TITLE` is
 * someone else's words, and nothing here reads it.
 */
-const decodeThread = Schema.decodeUnknownOption(WrittenThread);
+const decodeThread$1 = Schema.decodeUnknownOption(WrittenThread);
 const decodeEvent = Schema.decodeUnknownOption(EventId);
 const optional = (name) => Config.String(name).pipe(Config.option);
 const watchedHere = Effect.gen(function* () {
-	const thread = Option.flatMap(yield* optional(watchVariables.thread), decodeThread);
+	const thread = Option.flatMap(yield* optional(watchVariables.thread), decodeThread$1);
 	const event = Option.flatMap(yield* optional(watchVariables.event), decodeEvent);
 	return Option.zipWith(thread, event, (on, by) => ({
 		thread: on,
@@ -34059,6 +34700,19 @@ const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
 	});
 	return SessionToken.of({ current });
 }));
+const decodeThread = Schema.decodeUnknownOption(WrittenThread);
+/** `SessionThread` from the keychain, as the start of the harness session this runs in kept it. */
+const harnessSessionThread = Layer.effect(SessionThread, Effect.gen(function* () {
+	const keychain = yield* Keychain;
+	const harness = yield* HarnessProcess;
+	const current = Effect.gen(function* () {
+		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
+		if (Option.isNone(binding)) return Option.none();
+		const kept = yield* keychain.get(threadAccount(binding.value));
+		return Option.flatMap(kept, (thread) => decodeThread(Redacted.value(thread)));
+	});
+	return SessionThread.of({ current });
+}));
 //#endregion
 //#region src/harness/server-check.ts
 /**
@@ -34168,6 +34822,7 @@ const startServer = Effect.fnUntraced(function* (harness, configFolder, plugin,
 		CLAUDE_CONFIG_DIR: configFolder,
 		...checked
 	};
+	const withheld = Object.keys(yield* fromHere(keychainVariables)).some((variable) => env[variable] === void 0);
 	return yield* Effect.scoped(Effect.gen(function* () {
 		const handle = yield* spawner.spawn(ChildProcess.make(server.value.command, server.value.args, {
 			cwd: yield* emptyFolder(fs),
@@ -34182,6 +34837,7 @@ const startServer = Effect.fnUntraced(function* (harness, configFolder, plugin,
 		const said = yield* handle.stderr.pipe(Stream.decodeText(), Stream.mkString, Effect.forkScoped);
 		const lines = yield* handle.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.takeUntil((line) => Option.isSome(decodeAnswer(line))), Stream.runCollect);
 		if (lines.some((line) => Option.isSome(decodeAnswer(line)))) return { kind: "answered" };
+		if (withheld) return { kind: "withoutKeychain" };
 		return {
 			kind: "stopped",
 			said: firstLine(yield* Fiber.join(said)) || firstLine(lines.join("\n"))
@@ -34252,6 +34908,7 @@ const serverCheckOf = (started, configFolder) => {
 	switch (started.kind) {
 		case "answered": return checkOf("server", "yes", "starts");
 		case "stopped": return checkOf("server", "no", started.said === "" ? "can’t start, and said nothing" : `can’t start: ${started.said}`, installLine(configFolder));
+		case "withoutKeychain": return checkOf("server", "no", "can’t reach the keychain, since an older ref0 installed it", installLine(configFolder));
 		case "unnamed": return checkOf("server", "no", "the plugin names no ref0 server", installLine(configFolder));
 		case "unanswered": return checkOf("server", "unknown", `didn’t answer in ${Duration.toSeconds(serverLimit)} s`, "ref0 status");
 	}
@@ -34417,7 +35074,8 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 	...organizationCommands,
 	...grantCommands,
 	...agentCommands,
-	...attachmentCommands
+	...attachmentCommands,
+	...identityTokenCommands
 ]));
 const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
@@ -34432,7 +35090,7 @@ const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,
 	sessionToken,
 	FetchHttpClient.layer
-])), sessionToken, FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
+])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
 //#endregion
 //#region src/main.ts
 ref0.pipe(Command.run({ version: cliVersion }), Effect.provide(services), NodeRuntime.runMain);