@ref0/cli 0.11.0 → 0.12.1

package/dist/main.mjs

@@ -798,7 +798,7 @@ const ScopeKind = Schema.Literals([
 	"session",
 	"agent"
 ]);
-const Scope$1 = Schema.Struct({
+const Scope$2 = Schema.Struct({
 	kind: ScopeKind,
 	id: Schema.String.check(Schema.isMinLength(1)),
 	action: ScopeAction
@@ -971,7 +971,7 @@ const SessionDepth = Schema.Int.check(Schema.isBetween({
 * attachment's authorization there and the agent's target there.
 */
 const AskingHeld = Schema.Struct({
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	pins: Schema.Struct({
 		agent: Generation,
 		attachment: Generation,
@@ -1010,7 +1010,7 @@ const CredentialFacts = Schema.Struct({
 	}),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
 	/** What it may do, and where. Rows a reader can't decode were left out: they grant nothing. */
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	/**
 	* For a session's token: its project's owner, which answers what its agent holds there; the
 	* session, whose lease its project's Project DO holds; and how deep it is in its chain, 1 for
@@ -5186,7 +5186,7 @@ const commandFields = {
 	* What the credential may do, and where, as its person's Owner DO said: the writer checks
 	* the command's action against it on what it holds, such as which thread a number is.
 	*/
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	/** For a command a person approved: their `approval.answered`, which its events name as their cause. */
 	cause: Schema.optionalKey(EventRef),
 	/**
@@ -5705,7 +5705,7 @@ const Me = Schema.Struct({
 		session: SessionId,
 		depth: SessionDepth
 	})),
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis)
 });
 /**
@@ -6075,7 +6075,7 @@ const Reader = Schema.Struct({
 	agent: Schema.optionalKey(AgentRef),
 	/** The attachment an agent's credential was made under, which an organization asks after; null for a person. */
 	attachment: Schema.NullOr(CredentialRef),
-	scopes: Schema.Array(Scope$1)
+	scopes: Schema.Array(Scope$2)
 });
 Schema.Struct({
 	reader: Reader,
@@ -6589,14 +6589,13 @@ const ConnectOrganization = Schema.Struct({
 	organization: OrgId,
 	name: OwnerName
 });
-/** Whether admission replaced a live host grant, or skipped one that no longer belongs here. */
+/**
+* A folder's host grant from before: on and the person's, so the new grant's confirm turns it off,
+* or skipped, off already or not theirs, which a yes leaves as it is.
+*/
 const GrantReplacement = Schema.Struct({
 	grant: TokenId,
-	state: Schema.Literals([
-		"replaces",
-		"revoked",
-		"skipped"
-	]),
+	state: Schema.Literals(["replaces", "skipped"]),
 	attachedAt: Schema.optionalKey(Timestamp)
 });
 /**
@@ -6661,12 +6660,15 @@ const RequestOrganization = Schema.Struct({
 /**
 * The result collected with the machine's two proofs: each included folder's identity and grant,
 * its agent's owner name and organizations, and excluded paths. Confirmation checks each saved
-* grant's live deadline in the Owner DO.
+* grant's live deadline in the Owner DO. Once a yes connected and the machine hasn't sent its
+* answer code, waiting says until when: `confirmBy`, when ref0 revokes each grant the machine
+* hasn't confirmed.
 */
 const RequestState = Schema.Union([
 	Schema.Struct({
 		state: Schema.Literal("waiting"),
-		expiresAt: Timestamp
+		expiresAt: Timestamp,
+		confirmBy: Schema.optionalKey(Timestamp)
 	}),
 	Schema.Struct({
 		state: Schema.Literal("connected"),
@@ -13242,7 +13244,7 @@ Schema.Struct({
 	actor: ActorRef,
 	/** The attachment an agent's credential was made under, which an organization asks after; null for a person. */
 	attachment: Schema.NullOr(CredentialRef),
-	scopes: Schema.Array(Scope$1),
+	scopes: Schema.Array(Scope$2),
 	ownerName: OwnerName,
 	number: ThreadNumber
 });
@@ -19109,271 +19111,6 @@ const freshTokenSecret = Effect.suspend(() => hashed(encodeSecret(crypto.getRand
 /** A link carries 128 random bits in its fragment; ref0 receives only their hash at start. */
 const freshLinkSecret = Effect.suspend(() => hashed(Buffer.from(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16))).toString("base64url")));
 //#endregion
-//#region src/session.ts
-/**
-* An agent's command in a harness session that has no ref0 session, though an agent is connected
-* for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
-* person instead.
-*/
-var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
-/**
-* The token of the session this command runs in, if it runs in one: an agent's, which its
-* harness bound when the session started. Where it's found is the harness's to say. Outside a
-* session, there's none, and every command is the person's, asked by approval.
-*/
-var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
-	/** No session: until a harness binds one, the person asks, by approval. */
-	static none = Layer.succeed(SessionToken, SessionToken.of({ current: Effect.succeedNone }));
-};
-//#endregion
-//#region src/call.ts
-/**
-* Every command's one way to ref0: an endpoint's request, sent with the session's token when
-* the command runs in a session, or else asked of the person, by approval, from this terminal.
-* Either way the answer is the endpoint's own, as JSON.
-*/
-/** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
-var CallFailed = class extends Schema.TaggedError()("CallFailed", {
-	status: Schema.Int,
-	kind: Schema.String,
-	nextStep: Schema.String
-}) {};
-const decodeJson$1 = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
-const decodeSecretHash$2 = Schema.decodeUnknownEffect(SecretHash);
-const decodeNeeded = Schema.decodeUnknownOption(Schema.toCodecJson(ApprovalNeeded));
-const decodeRefusal = Schema.decodeUnknownOption(AnyError);
-/** How often a terminal asks whether its person has answered. */
-const pollMillis$1 = 2e3;
-/** How long one request may take before it's asked again, or the call gives up. */
-const requestTimeout$1 = Duration.seconds(15);
-/**
-* How long a session's request may take for the commands that read and compile before they
-* answer: starting check runs reads `.ref0/` from `main`, and from a thread's head when `main`
-* lacks the check, one paced read at a time, up to 256 files each.
-*/
-const timeoutOf = (endpoint) => endpoint === "runs.start" ? Duration.minutes(2) : requestTimeout$1;
-/** How long past the time to answer a terminal still asks, if ref0 hasn't said expired. */
-const giveUpAfterMillis$1 = 3e5;
-/** How long a terminal goes on asking while ref0 doesn't answer at all, before it says so. */
-const outageMillis = 3e5;
-/** What a change that failed partway says: ref0 may have made it all the same. */
-const mayHaveRun = "ref0 failed partway, so it may have run. Check before you run it again.";
-/**
-* An answer that isn't a success, as the command's failure. A change that ref0 failed on, a
-* 5xx, may have been made before it failed, so it isn't said to try again.
-*/
-const failedWith$15 = (status, body, change) => Option.match(decodeRefusal(body), {
-	onNone: () => new CallFailed({
-		status,
-		kind: "Unexpected",
-		nextStep: change && status >= 500 ? mayHaveRun : "ref0 answered oddly. Try again."
-	}),
-	onSome: (refusal) => new CallFailed({
-		status,
-		kind: refusal._tag,
-		nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
-	})
-});
-/**
-* A ran command's refusal, read as its endpoint's own error, or ref0's in its place, as the
-* command's failure: a change that failed at a 5xx may have been made all the same.
-*/
-const refusedBy = (status, refusal, change) => new CallFailed({
-	status,
-	kind: refusal._tag,
-	nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
-});
-/**
-* An answer none of its endpoint's schemas reads: another endpoint's, or one a bug in ref0 or
-* the CLI made. A change it answered may have run.
-*/
-const unreadable = (endpoint, change) => new CallFailed({
-	status: 0,
-	kind: "Unexpected",
-	nextStep: change ? `ref0’s answer to ${endpoint} isn’t one that endpoint gives, so it may have run. Check before you run it again.` : `ref0’s answer to ${endpoint} isn’t one that endpoint gives. Try again.`
-});
-const unreachable = new CallFailed({
-	status: 0,
-	kind: "Unreachable",
-	nextStep: "Couldn’t reach ref0. Try again."
-});
-/**
-* An ask ref0 doesn't know: a result kept past its day, or an ask never kept. Either way a
-* change may have run, and asking again could make it twice.
-*/
-const gone = (change, nextStep) => new CallFailed({
-	status: 404,
-	kind: "ApprovalNotFound",
-	nextStep: change ? "ref0 no longer knows how this ended, so it may have run. Check before you run it again." : nextStep
-});
-/** A change sent with no answer: ref0 may have made it, so running it again may make it twice. */
-const unanswered$1 = new CallFailed({
-	status: 0,
-	kind: "Unreachable",
-	nextStep: "ref0 didn’t answer, so it may have run. Check before you run it again."
-});
-/**
-* Waits for the person's answer to an ask, a terminal's or an agent's, by collecting where it
-* stands until it ran, was refused or expired: ref0's state, or none when it didn't answer.
-* What it ran to is read as the endpoint it asked for: its answer, as JSON, or its refusal.
-*/
-const waitForAnswer = Effect.fnUntraced(function* (collect, expiresAt, change, endpoint) {
-	const giveUpAt = DateTime.toEpochMillis(expiresAt) + giveUpAfterMillis$1;
-	let approved = false;
-	let heardAt = yield* Clock.currentTimeMillis;
-	while (true) {
-		const answered = yield* collect;
-		const now = yield* Clock.currentTimeMillis;
-		if (Option.isNone(answered)) {
-			if (now - heardAt > outageMillis) return yield* new CallFailed({
-				status: 0,
-				kind: "Unreachable",
-				nextStep: approved ? "It was approved, and ref0 stopped answering before it said it ran. Check whether it did before you run it again." : "ref0 stopped answering before it said how it ended. Check whether it ran before you run it again."
-			});
-			yield* Effect.sleep(pollMillis$1);
-			continue;
-		}
-		const state = answered.value;
-		heardAt = now;
-		if (state.state === "ran") return yield* Option.match(ranOf(endpoint, state), {
-			onNone: () => Effect.fail(unreadable(endpoint, change)),
-			onSome: Result.match({
-				onSuccess: () => Effect.succeed(state.result),
-				onFailure: (refusal) => Effect.fail(refusedBy(state.status, refusal, change))
-			})
-		});
-		if (state.state === "refused") return yield* new CallFailed({
-			status: 403,
-			kind: "Refused",
-			nextStep: "It was refused."
-		});
-		if (state.state === "approved") {
-			if (!approved) yield* Console.error("Approved. Waiting for it to run.");
-			approved = true;
-			yield* Effect.sleep(pollMillis$1);
-			continue;
-		}
-		if (state.state === "expired" || !approved && now > giveUpAt) return yield* new CallFailed({
-			status: 408,
-			kind: "Expired",
-			nextStep: "Nobody approved it in time. Run it again."
-		});
-		yield* Effect.sleep(pollMillis$1);
-	}
-});
-var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
-	static layer = Layer.effect(Ref0, Effect.gen(function* () {
-		const config = yield* Ref0Config;
-		const session = yield* SessionToken;
-		const http = yield* HttpClient.HttpClient;
-		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
-			const timeout = timeoutOf(request.command.endpoint);
-			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
-			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
-			const change = request.method !== "GET";
-			const lost = change ? unanswered$1 : unreachable;
-			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
-				response,
-				text
-			}))), Effect.timeoutOrElse({
-				duration: timeout,
-				orElse: () => Effect.fail(lost)
-			}), Effect.mapError(() => lost));
-			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
-			if (response.status === 202) {
-				const needed = decodeNeeded(body);
-				if (Option.isNone(needed)) return yield* failedWith$15(202, body, change);
-				yield* Console.error(`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`);
-				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
-			}
-			return response.status < 300 ? body : yield* failedWith$15(response.status, body, change);
-		});
-		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
-			const refused = (status) => (error) => Effect.fail(new CallFailed({
-				status,
-				kind: error._tag,
-				nextStep: error.nextStep
-			}));
-			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.succeedNone
-			}), Effect.catchTags({
-				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
-				Unauthenticated: refused(401),
-				SessionHasEnded: refused(410)
-			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
-		});
-		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
-			const { secret, hash } = yield* freshSecret;
-			const secretHash = yield* Effect.orDie(decodeSecretHash$2(hash));
-			const started = yield* client.terminalApprovals.start({
-				headers: { "idempotency-key": yield* newRequestId },
-				payload: {
-					command,
-					secretHash
-				}
-			}).pipe(Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.fail(unreachable)
-			}), Effect.catchTags({
-				CommandRefused: (refused) => Effect.fail(new CallFailed({
-					status: 400,
-					kind: refused._tag,
-					nextStep: refused.nextStep
-				})),
-				SlowDown: (slow) => Effect.fail(new CallFailed({
-					status: 429,
-					kind: slow._tag,
-					nextStep: slow.nextStep
-				}))
-			}), Effect.mapError((error) => error instanceof CallFailed ? error : unreachable));
-			yield* Console.error(`Approve this under Waiting on you, at ${config.api}${webPages.home}, with the code ${started.code}`);
-			const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, secret)));
-			const collect = (yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http))).terminalApprovals.result({ params: { approval: started.approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
-				duration: requestTimeout$1,
-				orElse: () => Effect.succeedNone
-			}), Effect.catchTag("ApprovalNotFound", (missing) => Effect.fail(gone(change, missing.nextStep))), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
-			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
-		});
-		const call = Effect.fn("Ref0.call")(function* (command) {
-			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
-				status: 0,
-				kind: error._tag,
-				nextStep: error.nextStep
-			})));
-			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
-				status: 400,
-				kind: refused._tag,
-				nextStep: refused.nextStep
-			})));
-			const change = request.method !== "GET";
-			const answer = yield* Option.match(token, {
-				onNone: () => asPerson(request.command, change, command.endpoint),
-				onSome: (bearer) => asSession(bearer, request, command.endpoint)
-			});
-			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
-			return answer;
-		});
-		return Ref0.of({ call });
-	}));
-};
-/**
-* One endpoint's call, typed from the API: the compiler checks its command, and its answer is
-* read by the endpoint's own success schemas, so what a command shows of it is checked too.
-*/
-const callEndpoint = (command) => Effect.gen(function* () {
-	const json = yield* (yield* Ref0).call(command);
-	return {
-		json,
-		value: yield* Option.match(successOf(command.endpoint, json), {
-			onNone: () => Effect.fail(unreadable(command.endpoint, false)),
-			onSome: Effect.succeed
-		})
-	};
-});
-//#endregion
 //#region src/output.ts
 /**
 * What a command prints: words for a person, or, with `--json`, the endpoint's answer as JSON,
@@ -19399,12 +19136,88 @@ const renderLine = (line, terminal) => {
 	if (line.status === "unknown") return `? unknown  ${printable(line.text)}`;
 	return `${line.status === "yes" ? styled("✓", 32, terminal) : styled("✗", 31, terminal)} ${line.status}  ${printable(line.text)}`;
 };
-const renderBlocks = (blocks, stream) => {
+/** The most columns a printed line takes, however wide the terminal. */
+const mostColumns = 100;
+/** A printed text without the styles this printer adds. */
+const unstyled = (text) => text.replaceAll(/\u001b\[\d+m/g, "");
+const graphemes = new Intl.Segmenter();
+/** The columns a printed text takes, a character each as the person sees it: styles take none. */
+const columnsOf = (text) => [...graphemes.segment(unstyled(text))].length;
+/** A word that says an inline command follows: `run ref0 connect`, `Read a text: ref0 text …`. */
+const introducesCommand = (word) => word === "run" || word === "Run" || word.endsWith(":");
+/**
+* Inline `ref0` commands made single words while they fit in `room`: `ref0` and the word after it
+* always, and a command after `run` or a colon to its clause's end, so no line breaks inside one.
+*/
+const withCommandsWhole = (words, room) => {
+	const joined = [];
+	for (let at = 0; at < words.length; at += 1) {
+		const first = words[at];
+		if (first === void 0) continue;
+		if (unstyled(first.word) !== "ref0" || at + 1 >= words.length) {
+			joined.push(first);
+			continue;
+		}
+		const before = words[at - 1];
+		let end = at + 1;
+		if (before !== void 0 && introducesCommand(unstyled(before.word))) while (end + 1 < words.length && !/[.,;:]$/.test(unstyled(words[end]?.word ?? ""))) end += 1;
+		const word = words.slice(at, end + 1).map((each, index) => index === 0 ? each.word : `${each.space}${each.word}`).join("");
+		if (columnsOf(word) > room) {
+			joined.push(first);
+			continue;
+		}
+		joined.push({
+			space: first.space,
+			word
+		});
+		at = end;
+	}
+	return joined;
+};
+/**
+* A line broken between words to fit `width` columns, each line after the first indented as the
+* first is. A line that fits stays as it is, and a word wider than the width stays whole, on a
+* line of its own.
+*/
+const wrapLine = (line, width) => {
+	if (columnsOf(line) <= width) return line;
+	const indent = /^\s*/.exec(line)?.[0] ?? "";
+	const room = Math.max(1, width - columnsOf(indent));
+	const words = withCommandsWhole(Array.from(line.slice(indent.length).matchAll(/(\s*)(\S+)/g), ([, space = "", word = ""]) => ({
+		space,
+		word
+	})), room);
+	const lines = [];
+	let current = "";
+	for (const { space, word } of words) if (current !== "" && columnsOf(current) + columnsOf(space) + columnsOf(word) > room) {
+		lines.push(current);
+		current = word;
+	} else current += current === "" ? word : `${space}${word}`;
+	return [...lines, current].map((each) => `${indent}${each}`).join("\n");
+};
+/**
+* How wide a printed line may be: the terminal's width, at most 100 columns, or none when the
+* stream isn't a terminal, as for an agent or a script, whose own reader wraps.
+*/
+const widthOf = (stream) => {
+	if (process[stream].isTTY !== true) return void 0;
+	const columns = process[stream].columns;
+	return columns > 0 ? Math.min(columns, mostColumns) : mostColumns;
+};
+const renderBlocks = (blocks, stream, width) => {
 	const terminal = process[stream].isTTY === true && process.env["NO_COLOR"] === void 0;
-	return blocks.flatMap((block) => block.length === 0 ? [] : [block.map((line) => renderLine(line, terminal)).join("\n")]).join("\n\n");
+	const shown = (line) => {
+		const rendered = renderLine(line, terminal);
+		if (width === void 0 || !Predicate.isString(line) && "command" in line) return rendered;
+		return rendered.split("\n").map((each) => wrapLine(each, width)).join("\n");
+	};
+	return blocks.flatMap((block) => block.length === 0 ? [] : [block.map(shown).join("\n")]).join("\n\n");
 };
-/** Words go to stderr by default; a command's answer goes to stdout. */
-const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream)).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
+/**
+* Words go to stderr by default; a command's answer goes to stdout. In a terminal, each line but a
+* command's is broken between words to fit it.
+*/
+const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream, widthOf(stream))).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
 /**
 * A yes-or-no question as the terminal shows it, bold, then `(y/N)`: no unless the person says
 * yes. The cursor stays after it, for their answer.
@@ -19474,6 +19287,279 @@ var Said = class extends Schema.TaggedError()("Said", {}) {
 };
 /** Says what went wrong, once, on stderr, and fails the command. */
 const sayFailed = (words) => printBlocks(Predicate.isString(words) ? [[words]] : words).pipe(Effect.andThen(Effect.fail(new Said())));
+//#endregion
+//#region src/session.ts
+/**
+* An agent's command in a harness session that has no ref0 session, though an agent is connected
+* for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
+* person instead.
+*/
+var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
+/**
+* The token of the session this command runs in, if it runs in one: an agent's, which its
+* harness bound when the session started. Where it's found is the harness's to say. Outside a
+* session, there's none, and every command is the person's, asked by approval.
+*/
+var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
+	/** No session: until a harness binds one, the person asks, by approval. */
+	static none = Layer.succeed(SessionToken, SessionToken.of({ current: Effect.succeedNone }));
+};
+/**
+* The thread the session this command runs in is on, as its start kept it beside the session's
+* token. Outside a session there's none, and in one whose start kept none.
+*/
+var SessionThread = class SessionThread extends Context.Service()("ref0/cli/SessionThread") {
+	/** No session, so no thread. */
+	static none = Layer.succeed(SessionThread, SessionThread.of({ current: Effect.succeedNone }));
+};
+//#endregion
+//#region src/call.ts
+/**
+* Every command's one way to ref0: an endpoint's request, sent with the session's token when
+* the command runs in a session, or else asked of the person, by approval, from this terminal.
+* Either way the answer is the endpoint's own, as JSON.
+*/
+/** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
+var CallFailed = class extends Schema.TaggedError()("CallFailed", {
+	status: Schema.Int,
+	kind: Schema.String,
+	nextStep: Schema.String
+}) {};
+const decodeJson$1 = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
+const decodeSecretHash$2 = Schema.decodeUnknownEffect(SecretHash);
+const decodeNeeded = Schema.decodeUnknownOption(Schema.toCodecJson(ApprovalNeeded));
+const decodeRefusal = Schema.decodeUnknownOption(AnyError);
+/** How often a terminal asks whether its person has answered. */
+const pollMillis$1 = 2e3;
+/** How long one request may take before it's asked again, or the call gives up. */
+const requestTimeout$1 = Duration.seconds(15);
+/**
+* How long a session's request may take for the commands that read and compile before they
+* answer: starting check runs reads `.ref0/` from `main`, and from a thread's head when `main`
+* lacks the check, one paced read at a time, up to 256 files each.
+*/
+const timeoutOf = (endpoint) => endpoint === "runs.start" ? Duration.minutes(2) : requestTimeout$1;
+/** How long past the time to answer a terminal still asks, if ref0 hasn't said expired. */
+const giveUpAfterMillis$1 = 3e5;
+/** How long a terminal goes on asking while ref0 doesn't answer at all, before it says so. */
+const outageMillis = 3e5;
+/** What a change that failed partway says: ref0 may have made it all the same. */
+const mayHaveRun = "ref0 failed partway, so it may have run. Check before you run it again.";
+/**
+* An answer that isn't a success, as the command's failure. A change that ref0 failed on, a
+* 5xx, may have been made before it failed, so it isn't said to try again.
+*/
+const failedWith$16 = (status, body, change) => Option.match(decodeRefusal(body), {
+	onNone: () => new CallFailed({
+		status,
+		kind: "Unexpected",
+		nextStep: change && status >= 500 ? mayHaveRun : "ref0 answered oddly. Try again."
+	}),
+	onSome: (refusal) => new CallFailed({
+		status,
+		kind: refusal._tag,
+		nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
+	})
+});
+/**
+* A ran command's refusal, read as its endpoint's own error, or ref0's in its place, as the
+* command's failure: a change that failed at a 5xx may have been made all the same.
+*/
+const refusedBy = (status, refusal, change) => new CallFailed({
+	status,
+	kind: refusal._tag,
+	nextStep: change && status >= 500 ? mayHaveRun : refusal.nextStep
+});
+/**
+* An answer none of its endpoint's schemas reads: another endpoint's, or one a bug in ref0 or
+* the CLI made. A change it answered may have run.
+*/
+const unreadable = (endpoint, change) => new CallFailed({
+	status: 0,
+	kind: "Unexpected",
+	nextStep: change ? `ref0’s answer to ${endpoint} isn’t one that endpoint gives, so it may have run. Check before you run it again.` : `ref0’s answer to ${endpoint} isn’t one that endpoint gives. Try again.`
+});
+const unreachable = new CallFailed({
+	status: 0,
+	kind: "Unreachable",
+	nextStep: "Couldn’t reach ref0. Try again."
+});
+/**
+* An ask ref0 doesn't know: a result kept past its day, or an ask never kept. Either way a
+* change may have run, and asking again could make it twice.
+*/
+const gone = (change, nextStep) => new CallFailed({
+	status: 404,
+	kind: "ApprovalNotFound",
+	nextStep: change ? "ref0 no longer knows how this ended, so it may have run. Check before you run it again." : nextStep
+});
+/** A change sent with no answer: ref0 may have made it, so running it again may make it twice. */
+const unanswered$1 = new CallFailed({
+	status: 0,
+	kind: "Unreachable",
+	nextStep: "ref0 didn’t answer, so it may have run. Check before you run it again."
+});
+/**
+* Waits for the person's answer to an ask, a terminal's or an agent's, by collecting where it
+* stands until it ran, was refused or expired: ref0's state, or none when it didn't answer.
+* What it ran to is read as the endpoint it asked for: its answer, as JSON, or its refusal.
+*/
+const waitForAnswer = Effect.fnUntraced(function* (collect, expiresAt, change, endpoint) {
+	const giveUpAt = DateTime.toEpochMillis(expiresAt) + giveUpAfterMillis$1;
+	let approved = false;
+	let heardAt = yield* Clock.currentTimeMillis;
+	while (true) {
+		const answered = yield* collect;
+		const now = yield* Clock.currentTimeMillis;
+		if (Option.isNone(answered)) {
+			if (now - heardAt > outageMillis) return yield* new CallFailed({
+				status: 0,
+				kind: "Unreachable",
+				nextStep: approved ? "It was approved, and ref0 stopped answering before it said it ran. Check whether it did before you run it again." : "ref0 stopped answering before it said how it ended. Check whether it ran before you run it again."
+			});
+			yield* Effect.sleep(pollMillis$1);
+			continue;
+		}
+		const state = answered.value;
+		heardAt = now;
+		if (state.state === "ran") return yield* Option.match(ranOf(endpoint, state), {
+			onNone: () => Effect.fail(unreadable(endpoint, change)),
+			onSome: Result.match({
+				onSuccess: () => Effect.succeed(state.result),
+				onFailure: (refusal) => Effect.fail(refusedBy(state.status, refusal, change))
+			})
+		});
+		if (state.state === "refused") return yield* new CallFailed({
+			status: 403,
+			kind: "Refused",
+			nextStep: "It was refused."
+		});
+		if (state.state === "approved") {
+			if (!approved) yield* printBlocks([["Approved. Waiting for it to run."]]);
+			approved = true;
+			yield* Effect.sleep(pollMillis$1);
+			continue;
+		}
+		if (state.state === "expired" || !approved && now > giveUpAt) return yield* new CallFailed({
+			status: 408,
+			kind: "Expired",
+			nextStep: "Nobody approved it in time. Run it again."
+		});
+		yield* Effect.sleep(pollMillis$1);
+	}
+});
+var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
+	static layer = Layer.effect(Ref0, Effect.gen(function* () {
+		const config = yield* Ref0Config;
+		const session = yield* SessionToken;
+		const http = yield* HttpClient.HttpClient;
+		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
+			const timeout = timeoutOf(request.command.endpoint);
+			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
+			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
+			const change = request.method !== "GET";
+			const lost = change ? unanswered$1 : unreachable;
+			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
+				response,
+				text
+			}))), Effect.timeoutOrElse({
+				duration: timeout,
+				orElse: () => Effect.fail(lost)
+			}), Effect.mapError(() => lost));
+			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
+			if (response.status === 202) {
+				const needed = decodeNeeded(body);
+				if (Option.isNone(needed)) return yield* failedWith$16(202, body, change);
+				yield* printBlocks([[`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`]]);
+				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
+			}
+			return response.status < 300 ? body : yield* failedWith$16(response.status, body, change);
+		});
+		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
+			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
+			const refused = (status) => (error) => Effect.fail(new CallFailed({
+				status,
+				kind: error._tag,
+				nextStep: error.nextStep
+			}));
+			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.succeedNone
+			}), Effect.catchTags({
+				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
+				Unauthenticated: refused(401),
+				SessionHasEnded: refused(410)
+			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
+		});
+		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
+			const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
+			const { secret, hash } = yield* freshSecret;
+			const secretHash = yield* Effect.orDie(decodeSecretHash$2(hash));
+			const started = yield* client.terminalApprovals.start({
+				headers: { "idempotency-key": yield* newRequestId },
+				payload: {
+					command,
+					secretHash
+				}
+			}).pipe(Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.fail(unreachable)
+			}), Effect.catchTags({
+				CommandRefused: (refused) => Effect.fail(new CallFailed({
+					status: 400,
+					kind: refused._tag,
+					nextStep: refused.nextStep
+				})),
+				SlowDown: (slow) => Effect.fail(new CallFailed({
+					status: 429,
+					kind: slow._tag,
+					nextStep: slow.nextStep
+				}))
+			}), Effect.mapError((error) => error instanceof CallFailed ? error : unreachable));
+			yield* printBlocks([[`Approve this under Waiting on you, at ${config.api}${webPages.home}, with the code ${started.code}`]]);
+			const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, secret)));
+			const collect = (yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http))).terminalApprovals.result({ params: { approval: started.approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+				duration: requestTimeout$1,
+				orElse: () => Effect.succeedNone
+			}), Effect.catchTag("ApprovalNotFound", (missing) => Effect.fail(gone(change, missing.nextStep))), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
+			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
+		});
+		const call = Effect.fn("Ref0.call")(function* (command) {
+			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
+				status: 0,
+				kind: error._tag,
+				nextStep: error.nextStep
+			})));
+			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
+				status: 400,
+				kind: refused._tag,
+				nextStep: refused.nextStep
+			})));
+			const change = request.method !== "GET";
+			const answer = yield* Option.match(token, {
+				onNone: () => asPerson(request.command, change, command.endpoint),
+				onSome: (bearer) => asSession(bearer, request, command.endpoint)
+			});
+			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
+			return answer;
+		});
+		return Ref0.of({ call });
+	}));
+};
+/**
+* One endpoint's call, typed from the API: the compiler checks its command, and its answer is
+* read by the endpoint's own success schemas, so what a command shows of it is checked too.
+*/
+const callEndpoint = (command) => Effect.gen(function* () {
+	const json = yield* (yield* Ref0).call(command);
+	return {
+		json,
+		value: yield* Option.match(successOf(command.endpoint, json), {
+			onNone: () => Effect.fail(unreadable(command.endpoint, false)),
+			onSome: Effect.succeed
+		})
+	};
+});
 /** The account's commands. */
 const accountCommands = [Command.make("whoami", { json }, ({ json: asJson }) => Effect.gen(function* () {
 	const answer = yield* callEndpoint({ endpoint: "me.get" });
@@ -20417,7 +20503,7 @@ const waitsFor = (each) => {
 * A thread a wait names, as a line says it: its number, written with its project, `acme/billing#3`,
 * when it's in another of `owner`'s, then its title and stage.
 */
-const threadWords = (thread, owner = "") => {
+const threadWords$1 = (thread, owner = "") => {
 	return `${thread.project === void 0 ? `#${thread.number}` : `${owner}/${thread.project}#${thread.number}`}${thread.title === void 0 ? "" : ` ${thread.title}`}, ${thread.stage}`;
 };
 /** What holds a stack back below the thread, as a line says it, to follow "and". */
@@ -20435,13 +20521,13 @@ const stackHeld = (stack) => {
 */
 const planLine = (wait, number, owner) => {
 	if (wait.kind === "stack") {
-		const line = `stacked on ${wait.on === void 0 ? "a thread you can’t see" : threadWords(wait.on)}: #${number} may merge once it may${stackHeld(wait)}`;
+		const line = `stacked on ${wait.on === void 0 ? "a thread you can’t see" : threadWords$1(wait.on)}: #${number} may merge once it may${stackHeld(wait)}`;
 		return wait.on === void 0 ? line : `${wait.on.thread}  ${line}`;
 	}
 	if (wait.child === void 0) return `required child ${wait.entry}, not started yet: #${number} is settled once it is`;
 	if (wait.child === null) return `required child, a thread you can’t see: #${number} is settled once it is`;
 	const holds = wait.child.project === void 0 || wait.child.stage !== "settled" ? `#${number} is settled once it is` : `#${number} is settled once a settle check reads it so`;
-	return `${wait.child.thread}  required child ${threadWords(wait.child, owner)}: ${holds}`;
+	return `${wait.child.thread}  required child ${threadWords$1(wait.child, owner)}: ${holds}`;
 };
 /** What blocks the thread, in words: so many of its own, and its stack, while it holds it. */
 const blockedBy$1 = (list) => {
@@ -20646,7 +20732,7 @@ const browserOpener = Effect.gen(function* () {
 });
 /** Starts the browser independently; a missing or failing desktop never stops the paste. */
 const openBrowser = (program, link) => Effect.sync(() => {
-	const failed = () => Effect.runFork(Console.error("Couldn’t open the browser. Open the printed link yourself."));
+	const failed = () => Effect.runFork(printBlocks([["Couldn’t open the browser. Open the printed link yourself."]]));
 	try {
 		const child = spawn(program, [link], {
 			detached: true,
@@ -21317,7 +21403,7 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.11.0";
+const cliVersion = "0.12.1";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -21635,7 +21721,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const link = yield* freshLinkSecret;
 	const pasted = yield* Ref.make(void 0);
 	const opener = yield* browserOpener;
-	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(Console.error("Couldn’t listen for the browser. Paste the code instead."), void 0)));
+	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(printBlocks([["Couldn’t listen for the browser. Paste the code instead."]]), void 0)));
 	const machineId = yield* machine.id.pipe(Effect.catchTag("MachineError", said));
 	const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
 	const unreachable = () => sayFailed(`Couldn’t reach ref0 at ${config.api}. Try again.`);
@@ -21646,7 +21732,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			...folder,
 			shown: shownConfigFolder(home, folder.configFolder),
 			grant: yield* freshTokenSecret,
-			replaces: Option.isSome(held) ? grantOf(held.value) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said))
+			replaces: Option.isSome(held) ? grantOf(held.value) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said)),
+			before: Option.isSome(held) ? yield* hostGrant.get(folder.configFolder).pipe(Effect.catchTag("KeychainError", (error) => error.unreadable === true ? Effect.succeedNone : said(error))) : Option.none()
 		};
 	}));
 	const folders = yield* Effect.forEach(asking, Effect.fnUntraced(function* (folder) {
@@ -21701,10 +21788,10 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
 	const collector = yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http));
 	const params = { approval: started.approval };
-	const collect = Effect.flatMap(Ref.get(pasted), (answerCode) => collector.machineAttachments.collect({
+	const collect = (answerCode) => collector.machineAttachments.collect({
 		params,
 		payload: answerCode === void 0 ? {} : { answerCode }
-	})).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+	}).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
 		duration: requestTimeout,
 		orElse: () => Effect.succeedNone
 	}), Effect.catchTags({
@@ -21714,29 +21801,28 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		HttpClientError: () => Effect.succeedNone,
 		SchemaError: () => Effect.succeedNone
 	}));
+	const lapsing = asking.some((folder) => Option.isSome(folder.replaces)) ? "Its new grants expire unconfirmed, and each folder’s connection from before still works." : "Its new grants expire unconfirmed.";
 	const giveUpAt = DateTime.toEpochMillis(started.expiresAt) + giveUpAfterMillis;
+	let confirmBy;
 	const answered = Effect.gen(function* () {
 		while (true) {
-			const state = yield* collect;
-			if (Option.isSome(state) && isEnded(state.value)) return state.value;
-			if ((yield* Clock.currentTimeMillis) > giveUpAt) {
+			const sent = yield* Ref.get(pasted);
+			const state = Option.getOrUndefined(yield* collect(sent));
+			if (state !== void 0 && isEnded(state)) return state;
+			if (state?.confirmBy !== void 0) confirmBy = DateTime.toEpochMillis(state.confirmBy);
+			if ((yield* Ref.get(pasted)) !== sent) continue;
+			if ((yield* Clock.currentTimeMillis) > (confirmBy ?? giveUpAt)) {
 				yield* endWait;
+				if (confirmBy !== void 0 && sent === void 0) return yield* sayFailed(`It was approved, but no code was pasted in time, so this machine kept nothing. ${lapsing} To connect this machine, run: ${again$1}`);
 				return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$1}`);
 			}
 			yield* Effect.sleep(pollMillis);
 		}
 	});
-	const keepOne = Effect.fnUntraced(function* (folder, connection, keepBy) {
+	const keepTrying = Effect.fnUntraced(function* (configFolder, grant, keepBy, late) {
 		const left = keepBy - (yield* Clock.currentTimeMillis);
-		if (left <= 0) return Option.some("The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
-		const token = formatToken(connection.credential.person, connection.credential.id, folder.grant.secret);
-		const kept = yield* hostGrant.keep(folder.configFolder, {
-			harness: folder.harness,
-			owner: connection.owner,
-			agent: connection.handle,
-			agentId: connection.agent.id,
-			token: Redacted.make(token)
-		}).pipe(Effect.timeoutOrElse({
+		if (left <= 0) return Option.some(late);
+		const kept = yield* hostGrant.keep(configFolder, grant).pipe(Effect.timeoutOrElse({
 			duration: Duration.min(keepTimeout, Duration.millis(left)),
 			orElse: () => Effect.fail(new KeychainError({ nextStep: "The keychain didn’t answer within a minute. Check that it’s unlocked." }))
 		}), Effect.retry({
@@ -21745,10 +21831,18 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		}), Effect.result);
 		return Result.isSuccess(kept) ? Option.none() : Option.some(kept.failure.nextStep);
 	});
+	const keepOne = (folder, connection, keepBy) => keepTrying(folder.configFolder, {
+		harness: folder.harness,
+		owner: connection.owner,
+		agent: connection.handle,
+		agentId: connection.agent.id,
+		token: Redacted.make(formatToken(connection.credential.person, connection.credential.id, folder.grant.secret))
+	}, keepBy, "The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
 	const finish = Effect.fnUntraced(function* (state) {
 		if (state.state !== "connected") return yield* sayFailed(endedWords$1(state));
 		const keepBy = (yield* Clock.currentTimeMillis) + Duration.toMillis(keepBudget);
 		const kept = [];
+		const keptFrom = [];
 		const grants = [];
 		const notKept = [];
 		for (const folder of asking) {
@@ -21778,9 +21872,9 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 				handle: connection.handle,
 				organizations: connection.organizations
 			});
+			keptFrom.push(folder);
 			grants.push(connection.credential.id);
 		}
-		yield* oldGrants.retire(kept);
 		const [first, ...rest] = grants;
 		if (first === void 0) return yield* sayFailed([[
 			"It connected, but this machine couldn’t keep what it needs to act:",
@@ -21813,9 +21907,27 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			times: 2,
 			schedule: Schedule.spaced("1 second")
 		}), Effect.catchTag("Unanswered", unconfirmed))).confirmed) {
-			for (const folder of kept) yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
-			return yield* sayFailed(`ref0 revoked the grants, since this machine didn’t confirm in time that it kept them. They’re deleted here, and nothing is connected. To connect this machine, run: ${again$1}`);
+			const backBy = (yield* Clock.currentTimeMillis) + Duration.toMillis(keepBudget);
+			const notBack = [];
+			for (const folder of keptFrom) {
+				if (Option.isNone(folder.before)) {
+					yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
+					continue;
+				}
+				const failed = yield* keepTrying(folder.configFolder, folder.before.value, backBy, "The keychain took too long with the folders before it.");
+				if (Option.isSome(failed)) notBack.push(`${shownConfigFolder(home, folder.configFolder)}: ${failed.value}`);
+			}
+			return yield* sayFailed([[
+				"ref0 revoked the new grants, since this machine didn’t confirm in time that it kept them.",
+				...notBack.length === 0 ? ["Each folder has its connection from before back, if it had one. To connect this machine, run:"] : [
+					"These folders hold a grant that works nowhere, since the keychain didn’t take back their records:",
+					...notBack,
+					"Each other folder has its connection from before back, if it had one. To connect this machine, run:"
+				],
+				{ command: again$1 }
+			]]);
 		}
+		yield* oldGrants.retire(kept);
 		return {
 			owner: state.owner,
 			kept,
@@ -21827,7 +21939,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		};
 	});
 	const stopped = Effect.gen(function* () {
-		yield* Console.error("Stopping: aborting the request.");
+		yield* printBlocks([["Stopping: aborting the request."]]);
 		const abortId = yield* newRequestId;
 		const state = yield* collector.machineAttachments.abort({
 			params,
@@ -21846,18 +21958,20 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			times: 2
 		}), Effect.catchTag("Unanswered", () => sayFailed("Couldn’t reach ref0 to abort it. If it’s approved anyway, ref0 revokes its grants 10 minutes after they connect, since this machine never kept them.")));
 		if (!isEnded(state)) {
-			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed("It was already answered, but no code was pasted. Nothing was kept here; its unconfirmed grants expire.");
-			yield* Console.error("It was already answered, so this machine waits to hear how.");
+			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed([["It was already answered, but no code was pasted, so this machine kept nothing.", lapsing]]);
+			yield* printBlocks([["It was already answered, so this machine waits to hear how."]]);
 		}
 		const connected = yield* finish(isEnded(state) ? state : yield* answered);
 		yield* printBlocks([[{ label: `Connected as ${connected.owner}’s agents` }, ...connected.kept.map((folder) => `${shownConfigFolder(home, folder.configFolder)}  ${folder.handle}`)], ["Stopped, so nothing was installed. To install ref0’s plugin into each, run:", ...connected.kept.map((folder) => ({ command: installLine(folder.configFolder) }))]]);
 	});
-	const typedCode = Effect.gen(function* () {
+	const readAnswer = Effect.gen(function* () {
+		if (listener === void 0) yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
 		const keys = yield* terminal.readInput;
 		let typed = "";
 		while (true) {
 			const pressed = yield* Effect.option(Queue.take(keys));
 			if (Option.isNone(pressed) || quits(pressed.value.key)) return yield* Effect.interrupt;
+			if ((yield* Ref.get(pasted)) !== void 0) continue;
 			const { input, key } = pressed.value;
 			if (key.name === "backspace") {
 				typed = takeBack(typed);
@@ -21871,17 +21985,14 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			const line = typed.trim();
 			typed = "";
 			if (line === "") continue;
-			if (isAnswerCode(line)) return line;
-			yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
+			if (!isAnswerCode(line)) {
+				yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
+				continue;
+			}
+			yield* Ref.update(pasted, (first) => first ?? line);
+			if (listener !== void 0) yield* listener.stop;
 		}
 	}).pipe(Effect.scoped);
-	const readAnswer = Effect.gen(function* () {
-		if (listener === void 0) yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
-		const code = yield* typedCode;
-		yield* Ref.update(pasted, (first) => first ?? code);
-		if (listener !== void 0) yield* listener.stop;
-		return yield* Effect.never;
-	});
 	const receiveAnswer = listener === void 0 ? readAnswer : Effect.raceFirst(readAnswer, listener.answer.pipe(Effect.flatMap((code) => Ref.update(pasted, (first) => first ?? code)), Effect.andThen(Effect.never)));
 	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.ensuring(endWait), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
 }, Effect.scoped);
@@ -22861,6 +22972,111 @@ function parse(toml, options = {}) {
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 //#endregion
+//#region src/harness/empty-folder.ts
+/**
+* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
+* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
+* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
+*
+* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
+* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
+* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
+* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
+* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
+* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
+*/
+const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
+//#endregion
+//#region src/harness/codex-app-server.ts
+/**
+* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
+* from an empty folder of its own, the requests written a line each, the answers read until each
+* request has one, then stopped. Each answer is matched to its request by ID, and read by that
+* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
+* didn't send, is passed over.
+*/
+/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
+var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
+/** Codex's app server answered a request with an error. */
+var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
+	method: Schema.String,
+	error: CodexError
+}) {};
+/** Codex's app server answered a request with a result its method's schema doesn't read. */
+var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
+	method: Schema.String,
+	issue: Schema.String
+}) {};
+const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
+const decodeAnswer$2 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
+/** The IDs of the exchange's two requests: the opening's, and the one asked. */
+const initializeId = "ref0-initialize";
+const askedId = "ref0-asked";
+/** The exchange's opening: who's asking, then that it's ready. */
+const opening = [{
+	jsonrpc: "2.0",
+	id: initializeId,
+	method: codexMethods.initialize.method,
+	params: { clientInfo: {
+		name: "ref0",
+		title: null,
+		version: cliVersion
+	} }
+}, {
+	jsonrpc: "2.0",
+	method: codexMethods.initialized.method
+}];
+/**
+* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
+* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
+*/
+const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const fs = yield* FileSystem.FileSystem;
+	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
+		cwd: yield* emptyFolder(fs),
+		env,
+		extendEnv: true,
+		forceKillAfter: "2 seconds",
+		stdin: {
+			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
+			endOnDone: false
+		}
+	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$2(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
+	return Option.filter(answered, (answers) => answers.size === ids.length);
+})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
+/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
+const resultOf = (method, answer) => {
+	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
+	if ("error" in answer) return Effect.fail(new CodexRefused({
+		method: method.method,
+		error: answer.error
+	}));
+	const { result } = method;
+	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
+		method: method.method,
+		issue: error.message
+	})));
+};
+/**
+* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
+* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
+* its request's ID, and its result is read by the method's result schema.
+*/
+const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
+	const asked = {
+		jsonrpc: "2.0",
+		id: askedId,
+		method: method.method,
+		params
+	};
+	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
+	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
+	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
+	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
+	return yield* resultOf(method, answers.value.get(askedId));
+});
+//#endregion
 //#region src/harness/codex-checkouts.ts
 const codexGitFolder = (configFolder, pluginId) => {
 	const at = pluginId.indexOf("@");
@@ -22977,111 +23193,6 @@ const codexSignOff = [
 	`perl -e ${shellWord(codexCheckoutWriter)} "$ref0_codex/checkouts" "$ref0_common" "$ref0_codex_hooks" 1 || exit 1`
 ];
 //#endregion
-//#region src/harness/empty-folder.ts
-/**
-* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
-* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
-* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
-*
-* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
-* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
-* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
-* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
-* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
-* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
-*/
-const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
-//#endregion
-//#region src/harness/codex-app-server.ts
-/**
-* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
-* from an empty folder of its own, the requests written a line each, the answers read until each
-* request has one, then stopped. Each answer is matched to its request by ID, and read by that
-* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
-* didn't send, is passed over.
-*/
-/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
-var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
-/** Codex's app server answered a request with an error. */
-var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
-	method: Schema.String,
-	error: CodexError
-}) {};
-/** Codex's app server answered a request with a result its method's schema doesn't read. */
-var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
-	method: Schema.String,
-	issue: Schema.String
-}) {};
-const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
-const decodeAnswer$2 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
-/** The IDs of the exchange's two requests: the opening's, and the one asked. */
-const initializeId = "ref0-initialize";
-const askedId = "ref0-asked";
-/** The exchange's opening: who's asking, then that it's ready. */
-const opening = [{
-	jsonrpc: "2.0",
-	id: initializeId,
-	method: codexMethods.initialize.method,
-	params: { clientInfo: {
-		name: "ref0",
-		title: null,
-		version: cliVersion
-	} }
-}, {
-	jsonrpc: "2.0",
-	method: codexMethods.initialized.method
-}];
-/**
-* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
-* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
-*/
-const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
-	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const fs = yield* FileSystem.FileSystem;
-	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
-		cwd: yield* emptyFolder(fs),
-		env,
-		extendEnv: true,
-		forceKillAfter: "2 seconds",
-		stdin: {
-			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
-			endOnDone: false
-		}
-	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$2(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
-	return Option.filter(answered, (answers) => answers.size === ids.length);
-})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
-const resultOf = (method, answer) => {
-	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
-	if ("error" in answer) return Effect.fail(new CodexRefused({
-		method: method.method,
-		error: answer.error
-	}));
-	const { result } = method;
-	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
-		method: method.method,
-		issue: error.message
-	})));
-};
-/**
-* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
-* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
-* its request's ID, and its result is read by the method's result schema.
-*/
-const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
-	const asked = {
-		jsonrpc: "2.0",
-		id: askedId,
-		method: method.method,
-		params
-	};
-	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
-	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
-	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
-	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
-	return yield* resultOf(method, answers.value.get(askedId));
-});
-//#endregion
 //#region src/harness/commit-hooks.ts
 /**
 * ref0's part of Git's `prepare-commit-msg` and `commit-msg` hooks, which their forwarders in
@@ -23391,21 +23502,75 @@ const codexAgentConfig = Effect.fnUntraced(function* (agent, root, home) {
 		parameters: shellWord(`include.path=${file}`)
 	};
 });
+/** Only the single ref0 include installed by this CLI belongs to ref0. */
+const selectedInclude = (set) => {
+	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
+	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
+	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+};
+const decodePolicy = Schema.decodeUnknownEffect(Schema.Struct({ shell_environment_policy: CodexConfigRead.fields.config.fields.shell_environment_policy }));
+/**
+* The agent's include a Codex config folder's `config.toml` selects, if it's ref0's: its file, read
+* as TOML for its `shell_environment_policy` alone.
+*/
+const selectedCodexInclude = Effect.fnUntraced(function* (configFolder) {
+	const fs = yield* FileSystem.FileSystem;
+	const configFile = `${configFolder}/config.toml`;
+	if (!(yield* fs.exists(configFile))) return Option.none();
+	const text = yield* fs.readFileString(configFile);
+	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
+	const read = yield* decodePolicy(document);
+	return Option.fromNullishOr(selectedInclude(read.shell_environment_policy?.set ?? {}));
+});
+/**
+* Takes the author out of `selected`, the include a folder's `config.toml` selects, unless it's
+* this origin's include for the folder's agent, so a folder switched to another agent never names
+* the one before. Its commits name the person until an install selects the agent's own. Whether it
+* took one out.
+*/
+const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, selected, options) {
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	if (selected === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return false;
+	const oldRoot = selected.slice(0, selected.lastIndexOf("/agents/"));
+	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home);
+	yield* writeCodexCheckout({
+		gitFolder: oldRoot,
+		common: "",
+		folder: "",
+		signsOff: false,
+		clearAuthor: selected,
+		author: fallback
+	});
+	return true;
+});
+/** What the agent reads at its session's start when its folder's `config.toml` names another. */
+const otherAgentWords = (configFolder) => `ref0: The config.toml of this Codex config folder, ${configFolder}, names another agent than the one this folder is connected as, so your commits name the person instead of you until they run, in their own terminal: ${installLine(configFolder)}`;
 /**
 * Codex has no environment file: its install selects a file; session start fills its checkout,
-* for the agent of the config folder `CODEX_HOME` names, or the default `~/.codex`.
+* for the agent of the config folder `CODEX_HOME` names, or the default `~/.codex`. An include
+* `config.toml` selects for another agent, after a switch whose install never finished or another
+* origin's install, has its author taken out first, and the agent hears so.
 */
 const setCodexCommitEnvironment = Effect.fnUntraced(function* (cwd, checkout) {
 	const folders = yield* ConfigFolders;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const agent = yield* (yield* HostGrant).get(yield* folders.folder("codex")).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
+	const configFolder = yield* folders.folder("codex");
+	const selected = yield* selectedCodexInclude(configFolder).pipe(Effect.mapError(() => new CodexCommitFailed({ detail: `Couldn’t read Codex’s config, ${configFolder}/config.toml.` })), Effect.result);
+	const agent = yield* (yield* HostGrant).get(configFolder).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
 	if (Option.isNone(agent)) return false;
+	const home = yield* Config.String("HOME");
+	if (yield* Option.match(yield* Effect.fromResult(selected), {
+		onNone: () => Effect.succeed(false),
+		onSome: (file) => clearOtherCodexAuthor(agent.value, file, {
+			configFolder,
+			home
+		})
+	})) yield* Console.log(otherAgentWords(configFolder));
 	const pluginRoot = yield* Config.String("CLAUDE_PLUGIN_ROOT").pipe(Config.withDefault(""));
 	if (pluginRoot === "") return yield* new CodexCommitFailed({ detail: "Codex gave the hook no plugin root." });
 	const gitFolder = path.join(path.dirname(pluginRoot), "@git");
-	const home = yield* Config.String("HOME");
 	const author = yield* codexAgentConfig(agent.value, gitFolder, home);
 	const common = (yield* spawner.string(ChildProcess.make("git", [
 		"-C",
@@ -23761,35 +23926,27 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 //#region src/harness/codex-install-commits.ts
 const decodeProfile = Schema.decodeUnknownEffect(CodexConfigRead);
 const sameJson = Schema.toEquivalence(Schema.Json);
-/** Only the single ref0 include installed by this CLI belongs to ref0. */
-const selectedInclude = (set) => {
-	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
-	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
-	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+/**
+* What the person reads when an install that never finished took the agent before out of a
+* folder's commits: what stopped it, in its own words, a conflict only when there is one, then
+* what to run.
+*/
+const unfinishedWords = (stopped, configFolder) => {
+	return `ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. ${Option.match(stopped, {
+		onNone: () => `The install stopped before it finished. To finish it, run: ${installLine(configFolder)}`,
+		onSome: (failed) => `${failed.says} Then run: ${repairOf(failed, configFolder)}`
+	})}`;
 };
-/** A changed grant must never leave the previous agent as author after a failed install. */
-const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, options) {
-	const fs = yield* FileSystem.FileSystem;
-	const configFile = `${options.configFolder}/config.toml`;
-	if (!(yield* fs.exists(configFile))) return;
-	const text = yield* fs.readFileString(configFile);
-	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
-	const read = yield* decodeProfile({ config: document });
-	const file = selectedInclude(read.config.shell_environment_policy?.set ?? {});
-	if (file === void 0) return;
-	const name = yield* originPluginName((yield* Ref0Config).api);
-	if (file === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return;
-	const oldRoot = file.slice(0, file.lastIndexOf("/agents/"));
-	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home ?? (yield* Config.String("HOME").pipe(Config.withDefault("."))));
-	yield* writeCodexCheckout({
-		gitFolder: oldRoot,
-		common: "",
-		folder: "",
-		signsOff: false,
-		clearAuthor: file,
-		author: fallback
-	});
-	yield* Console.error(`ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. Fix the shell_environment_policy conflict in Codex’s config or profile named above: remove conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded. Then run: ${installLine(options.configFolder)}`);
+/**
+* After an install into a Codex folder fails or is interrupted, the agent before is taken out of
+* the include `config.toml` still selects, so the folder's commits never name an agent other than
+* its grant's, and the person hears what stopped the install: `stopped`, or none when interrupted.
+*/
+const clearUnfinishedCodexInstall = Effect.fnUntraced(function* (agent, stopped, options) {
+	const selected = yield* selectedCodexInclude(options.configFolder);
+	if (Option.isNone(selected)) return;
+	if (!(yield* clearOtherCodexAuthor(agent, selected.value, options))) return;
+	yield* printBlocks([[unfinishedWords(stopped, options.configFolder)]]);
 });
 /** Install the connected agent's include and shell policy. */
 const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
@@ -23798,6 +23955,7 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 		CODEX_HOME: options.configFolder
 	};
 	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+	const conflicted = new InstallFailed({ says: "Codex’s shell_environment_policy conflicts with ref0’s commit environment, in the config or profile named above. Remove the conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded." });
 	return yield* Effect.gen(function* () {
 		const fs = yield* FileSystem.FileSystem;
 		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
@@ -23825,8 +23983,8 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 		].find((key) => Object.hasOwn(set, key) && !(own && (key === "GIT_CONFIG_PARAMETERS" || key === "REF0_HARNESS")));
 		const allowlist = policy?.include_only != null || Object.values(policy?.filters ?? {}).includes("include");
 		if (collision !== void 0 || allowlist) {
-			yield* Console.error(`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`);
-			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			yield* printBlocks([[`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`]]);
+			if (own) return yield* conflicted;
 			return;
 		}
 		const profiles = (yield* fs.readDirectory(options.configFolder)).filter((file) => file.endsWith(".config.toml"));
@@ -23851,8 +24009,8 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 			const losesAuthors = excluded !== void 0 && excluded !== null && ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].some((name) => !excluded.some((pattern) => pathMatchesWithin(pattern.toLowerCase(), name.toLowerCase(), { left: 1e4 })));
 			const allowlist = profilePolicy?.include_only != null || Object.values(filters ?? {}).includes("include");
 			if (key === void 0 && !losesAuthors && !allowlist) continue;
-			yield* Console.error(`ref0: Codex’s profile ${printable(file)} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`);
-			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			yield* printBlocks([[`ref0: Codex’s profile ${file} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`]]);
+			if (own) return yield* conflicted;
 			return;
 		}
 		if (!own && (options.approveCommits === void 0 || !(yield* options.approveCommits()))) return;
@@ -23940,9 +24098,9 @@ const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
 			}, env)).status !== "ok") return yield* failed("set Codex’s commit environment because another config layer overrides it");
 		}).pipe(Effect.onError(() => Effect.gen(function* () {
 			if (!attemptedConfig || (yield* recover)) yield* restore(author.file, previousAuthor);
-			else yield* Console.error("ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again.");
+			else yield* printBlocks([["ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again."]]);
 		}).pipe(Effect.orDie)));
-	}).pipe(Effect.scoped, Effect.mapError(() => failed("set Codex’s commit environment")));
+	}).pipe(Effect.scoped, Effect.mapError((error) => error instanceof InstallFailed ? error : failed("set Codex’s commit environment")));
 }, Effect.scoped);
 //#endregion
 //#region src/harness/install-claude-code.ts
@@ -24106,7 +24264,7 @@ const installCodex = Effect.fnUntraced(function* (release, agent, options) {
 			trusted,
 			profile
 		};
-	}).pipe(Effect.onError(() => clearOtherCodexAuthor(agent, options).pipe(Effect.orDie)));
+	}).pipe(Effect.onError((cause) => clearUnfinishedCodexInstall(agent, Cause.findErrorOption(cause), options).pipe(Effect.orDie)));
 });
 //#endregion
 //#region src/harness/install.ts
@@ -24212,7 +24370,7 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 		for (const folder of into) answers.set(folder, Result.fail(failed));
 	};
 	const started = /* @__PURE__ */ new Set();
-	const clearUnstarted = (into) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearOtherCodexAuthor(agent, {
+	const clearUnstarted = (into, stopped) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearUnfinishedCodexInstall(agent, stopped, {
 		configFolder: folder.configFolder,
 		home
 	}).pipe(Effect.orDie)), Effect.catchTag("InstallFailed", () => Effect.void)), { discard: true });
@@ -24227,8 +24385,9 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 			if (into.length === 0) continue;
 			const command = yield* onPath(harness === "codex" ? "codex" : "claude");
 			if (Option.isNone(command)) {
-				failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
-				yield* clearUnstarted(into);
+				const missing = new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` });
+				failAll(into, missing);
+				yield* clearUnstarted(into, Option.some(missing));
 				continue;
 			}
 			yield* Effect.scoped(Effect.gen(function* () {
@@ -24249,9 +24408,9 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 					})).pipe(Effect.result);
 					answers.set(folder, installed);
 				}
-			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into))))));
+			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into, Option.some(failed)))))));
 		}
-	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders)));
+	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders, Option.none())));
 	return folders.map((folder) => ({
 		...folder,
 		installed: answers.get(folder) ?? Result.fail(new InstallFailed({ says: "ref0 didn’t install into this folder." }))
@@ -24343,16 +24502,13 @@ const mostFolders = 8;
 const isConfigFolderPath = Schema.is(ConfigFolderPath);
 /** The line that asks again. */
 const again = "ref0 connect";
-/** The widest a line of ref0's own words runs, as its help does, in a terminal at least as wide. */
-const mostColumns = 100;
 /**
 * Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. The
-* question is said first, wrapped between words to the terminal, and the chooser shows only the
-* folders: once Enter chooses, it leaves the ticked ones on one line after any question it was
-* given, which the terminal would break mid-word.
+* question is said first, and the chooser shows only the folders: once Enter chooses, it leaves
+* the ticked ones on one line after any question it was given, which the terminal would break
+* mid-word.
 */
 const choose = Effect.fnUntraced(function* (found, home) {
-	const columns = yield* (yield* Terminal.Terminal).columns;
 	const choices = found.map((folder) => {
 		const shown = shownConfigFolder(home, folder.configFolder);
 		const sendable = isConfigFolderPath(shown);
@@ -24369,7 +24525,7 @@ const choose = Effect.fnUntraced(function* (found, home) {
 	});
 	const ticked = choices.filter((choice) => choice.selected).length;
 	const keys = "Space ticks or unticks one; Enter connects those ticked.";
-	yield* printBlocks([[{ label: "Connect which config folders?" }, ...wrapWords(ticked > mostFolders ? `One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. ${keys}` : keys, columns > 0 ? Math.min(columns, mostColumns) : mostColumns)]]);
+	yield* printBlocks([[{ label: "Connect which config folders?" }, ticked > mostFolders ? `One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. ${keys}` : keys]]);
 	return yield* Prompt.run(Prompt.MultiSelect({
 		choices,
 		max: mostFolders
@@ -24562,7 +24718,7 @@ const signalLines = (answer) => {
 * credential, a Sentry token, is pasted on that page too, never in a terminal. Anyone who may start a
 * thread in the project sends a signal to one of its connections by name.
 */
-const failedWith$14 = (failed) => sayFailed(failed.nextStep);
+const failedWith$15 = (failed) => sayFailed(failed.nextStep);
 const project$5 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project"), Argument.withSchema(WrittenProject));
 const name = Argument.String("name").pipe(Argument.withDescription("The connection’s name in the project, such as deploys"), Argument.withSchema(ConnectionName));
 const list$5 = Command.make("list", {
@@ -24574,7 +24730,7 @@ const list$5 = Command.make("list", {
 		params: projectParts(address)
 	});
 	yield* printAnswer(answer.json, asJson, connectionLines(answer.value));
-}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("The project’s connections, their last signal and what they dropped"), Command.withShortDescription("List a project’s connections and their last signals"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$15))).pipe(Command.withDescription("The project’s connections, their last signal and what they dropped"), Command.withShortDescription("List a project’s connections and their last signals"));
 /** A change made on the project's page: its link, and what to do there. */
 const onThePage = (address, change) => Effect.gen(function* () {
 	const config = yield* Ref0Config;
@@ -24650,14 +24806,14 @@ const send = Command.make("send", {
 		})
 	});
 	yield* printAnswer(answer.json, asJson, signalLines(answer.value));
-}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Send a signal to one of the project’s connections"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$15))).pipe(Command.withDescription("Send a signal to one of the project’s connections"));
 /** A project's connections, and sending a signal by one. */
 const connectionCommands = [connectionCommand, Command.make("signal").pipe(Command.withDescription("A project’s signals: send one by a connection"), Command.withShortDescription("Send a signal to a project"), Command.withSubcommands([send]))];
 //#endregion
 //#region src/harness/checkout.ts
 const decodeRepoName$2 = Schema.decodeUnknownOption(RepoName);
 const decodePath$2 = Schema.decodeUnknownOption(RepoPath);
-const decodeThread$1 = Schema.decodeUnknownOption(WrittenThread);
+const decodeThread$2 = Schema.decodeUnknownOption(WrittenThread);
 const decodeWrittenRepo$1 = Schema.decodeUnknownOption(WrittenRepo);
 var Checkout = class Checkout extends Context.Service()("ref0/cli/Checkout") {
 	static layer = Layer.effect(Checkout, Effect.gen(function* () {
@@ -24696,7 +24852,7 @@ var Checkout = class Checkout extends Context.Service()("ref0/cli/Checkout") {
 			"config",
 			"--get",
 			"ref0.thread"
-		]), (written) => decodeThread$1(written.trim()));
+		]), (written) => decodeThread$2(written.trim()));
 		const repoAt = (folder) => Effect.map(git(folder, [
 			"config",
 			"--get",
@@ -25699,7 +25855,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 	})).value;
 	if (code.compiled.entry.reaches?.browser === true) return yield* sayFailed(`${code.check} browses, and only a run on ref0 browses: run it there, with ref0 run ${check} --thread ${thread.value}.`);
 	if (code.runs.length === 0) {
-		yield* Console.error(`${code.check} has no part left for a local run on version ${code.version}: each is met, or failed on ref0. See ref0 gate.`);
+		yield* printBlocks([[`${code.check} has no part left for a local run on version ${code.version}: each is met, or failed on ref0. See ref0 gate.`]]);
 		return;
 	}
 	yield* holdsVersion(root.value, code);
@@ -25708,7 +25864,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 		thread: `${thread.value}’s own .ref0/`,
 		project: "the project’s checks"
 	}[code.code.origin];
-	yield* Console.error(`Running ${code.check} from ${from}, as ref0 compiled it for version ${code.version}: its code and its sandboxes’ setup run on this machine, as you, outside any container.`);
+	yield* printBlocks([[`Running ${code.check} from ${from}, as ref0 compiled it for version ${code.version}: its code and its sandboxes’ setup run on this machine, as you, outside any container.`]]);
 	const own = yield* loadCheck(code.compiled).pipe(Effect.catchTag("LocalRunFailed", (failed) => sayFailed(failed.why)));
 	const sandboxes = code.compiled.entry.sandboxes ?? [];
 	const held = /* @__PURE__ */ new Set();
@@ -25720,7 +25876,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 			const run = yield* newRunId;
 			const deadline = (yield* Clock.currentTimeMillis) + code.timeoutSeconds * 1e3;
 			const sandbox = yield* localOpener(root.value, held, sandboxes, deadline);
-			yield* Console.error(`Running ${code.check} locally, part ${index + 1} of ${code.runs.length}, as ${run}.`);
+			yield* printBlocks([[`Running ${code.check} locally, part ${index + 1} of ${code.runs.length}, as ${run}.`]]);
 			const ran = yield* runPart(own, {
 				params,
 				host: treeHost(root.value, code.tree),
@@ -25783,7 +25939,7 @@ const nextStepsFor = (place, wait) => `Wait on it with ref0 runs waiting ${wait.
 /** Says a waiting start's tree on stderr, as it stands now. */
 const sayTree = Effect.fnUntraced(function* (wait) {
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* Console.error(printable(waitingLines$1(wait, now)));
+	yield* printBlocks([[waitingLines$1(wait, now)]]);
 });
 /**
 * Waits on a start that waits until it goes on or ends, or 9 minutes pass: what it got, printed
@@ -25829,7 +25985,7 @@ const waitOnStart = Effect.fnUntraced(function* (place, first, asJson, rerunComm
 * reports it. `ref0 runs trace` reads one run's trace, a check run's or a workflow run's, a page
 * at a time.
 */
-const failedWith$13 = (failed) => sayFailed(failed.nextStep);
+const failedWith$14 = (failed) => sayFailed(failed.nextStep);
 const decodeRunId = Schema.decodeUnknownOption(CheckRunId);
 const decodeTraced = Schema.decodeUnknownOption(TracedRun);
 /** A run named by a flag, or a failure that says how to name one. */
@@ -25931,7 +26087,7 @@ const run = Command.make("run", {
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
 	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Run a check on main, or on a thread’s head: a run it ran already is answered, not run again, unless the check says reuse: false. A start its check’s start rule makes wait shows what it waits on, and waits up to 9 minutes for it, unless --no-wait. With --local, run a check of the thread’s open version on this machine, and report it"), Command.withShortDescription("Run a check on main or a thread’s head"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Run a check on main, or on a thread’s head: a run it ran already is answered, not run again, unless the check says reuse: false. A start its check’s start rule makes wait shows what it waits on, and waits up to 9 minutes for it, unless --no-wait. With --local, run a check of the thread’s open version on this machine, and report it"), Command.withShortDescription("Run a check on main or a thread’s head"));
 const trace = Command.make("trace", {
 	run: Argument.String("run").pipe(Argument.withDescription("The run, as checkrun_… or workflowrun_…")),
 	repo: repoFlag,
@@ -25974,7 +26130,7 @@ const trace = Command.make("trace", {
 		...narrowed,
 		`--cursor ${next}`
 	].join(" ")));
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A run’s trace, a check run’s or a workflow run’s: its steps and its log lines, a page at a time"), Command.withShortDescription("Show a run’s trace and log lines"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A run’s trace, a check run’s or a workflow run’s: its steps and its log lines, a page at a time"), Command.withShortDescription("Show a run’s trace and log lines"));
 const waiting$1 = Command.make("waiting", {
 	start: startArgument,
 	repo: repoFlag,
@@ -26009,7 +26165,7 @@ const waiting$1 = Command.make("waiting", {
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
 	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A start of yours its check’s start rule made wait: what it waits on, as a tree, waiting up to 9 minutes for it to go on or end, unless --no-wait"), Command.withShortDescription("Show what a waiting start waits on"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A start of yours its check’s start rule made wait: what it waits on, as a tree, waiting up to 9 minutes for it to go on or end, unless --no-wait"), Command.withShortDescription("Show what a waiting start waits on"));
 /** What a cancel did, in words. */
 const cancelledText = {
 	start: "Cancelled: nothing started, and the workflow runs it waited on ended with it.",
@@ -26035,7 +26191,7 @@ const cancel = Command.make("cancel", {
 		})
 	});
 	yield* printAnswer(answer.json, asJson, cancelledText[answer.value.cancelled]);
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Cancel a start of yours that waits: yours ends it and the workflow runs it waits on; one that joined another’s only leaves it"), Command.withShortDescription("Cancel a waiting start of yours"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("Cancel a start of yours that waits: yours ends it and the workflow runs it waits on; one that joined another’s only leaves it"), Command.withShortDescription("Cancel a waiting start of yours"));
 /** Starting a check on `main` or a thread's head, listing one scope's runs, and reading a trace. */
 const runCommands = [run, Command.make("runs", {
 	repo: Argument.String("repo").pipe(Argument.withDescription("The repo, as owner/name"), Argument.withSchema(WrittenRepo)),
@@ -26077,14 +26233,14 @@ const runCommands = [run, Command.make("runs", {
 		...narrowed,
 		`--before ${next}`
 	].join(" ")));
-}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A repo’s check runs, main’s or a thread’s, the newest first, a page at a time"), Command.withShortDescription("List a repo’s check runs"), Command.withSubcommands([
+}).pipe(Effect.catchTag("CallFailed", failedWith$14))).pipe(Command.withDescription("A repo’s check runs, main’s or a thread’s, the newest first, a page at a time"), Command.withShortDescription("List a repo’s check runs"), Command.withSubcommands([
 	trace,
 	waiting$1,
 	cancel
 ]))];
 //#endregion
 //#region src/commands/checks.ts
-const failedWith$12 = (failed) => sayFailed(failed.nextStep);
+const failedWith$13 = (failed) => sayFailed(failed.nextStep);
 const decodeCheck = Schema.decodeUnknownOption(CheckKey);
 const decodeToken = Schema.decodeUnknownOption(TokenId);
 const decodePerson = Schema.decodeUnknownOption(OwnerName);
@@ -26120,7 +26276,7 @@ const restore = Command.make("restore", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, restoredWords(answer.value, repo));
-}).pipe(Effect.catchTag("CallFailed", failedWith$12))).pipe(Command.withDescription("Restore a signer a miss revoked from answering a check, as an admin: its local runs, or their yes, count again"), Command.withShortDescription("Restore a revoked check signer"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Restore a signer a miss revoked from answering a check, as an admin: its local runs, or their yes, count again"), Command.withShortDescription("Restore a revoked check signer"));
 const signers = Command.make("signers").pipe(Command.withDescription("Who signs a check’s local runs or says yes over its runs: restore one a miss revoked"), Command.withShortDescription("Manage a check’s signers"), Command.withSubcommands([restore]));
 /** `ref0 checks`: a repo's checks. */
 const checksCommands = [Command.make("checks").pipe(Command.withDescription("A repo’s checks: the signers of their local runs and yeses"), Command.withShortDescription("Manage a repo’s check signers"), Command.withSubcommands([signers]))];
@@ -26452,7 +26608,7 @@ const projectGateLines = (view, repo) => {
 };
 //#endregion
 //#region src/commands/gate.ts
-const failedWith$11 = (failed) => sayFailed(failed.nextStep);
+const failedWith$12 = (failed) => sayFailed(failed.nextStep);
 const project$4 = Flag.Boolean("project").pipe(Flag.withDescription("The project gate instead: its active revision, and a pending one with each latch it waits on"), Flag.withDefault(false));
 /** A pull request's gate. */
 const gateCommands = [Command.make("gate", {
@@ -26478,7 +26634,7 @@ const gateCommands = [Command.make("gate", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, gateLines(answer.value, repo));
-}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("A pull request’s needs, each with where it came from, ref0’s floor or a line of .ref0/gate.ts, and whether it’s met or on whom it waits; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
+}).pipe(Effect.catchTag("CallFailed", failedWith$12))).pipe(Command.withDescription("A pull request’s needs, each with where it came from, ref0’s floor or a line of .ref0/gate.ts, and whether it’s met or on whom it waits; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
 //#endregion
 //#region src/clone.ts
 /** The remote a clone pushes to: its thread's fork path, named as the thread is. */
@@ -26836,7 +26992,7 @@ const syncBase = Effect.fnUntraced(function* (folder) {
 * with the session's fork to push to; `ref0 sync`, the session's base merged in, `main` or the
 * thread it's stacked on; and `ref0 git-credential`, the helper Git asks there.
 */
-const failedWith$10 = (failed) => sayFailed(failed.nextStep);
+const failedWith$11 = (failed) => sayFailed(failed.nextStep);
 /** `ref0 git-credential`, as Git runs it: see `answerGit`. */
 const credential = Command.make("git-credential", { operation: Argument.String("operation").pipe(Argument.withDescription("What Git asks: get, store or erase")) }, ({ operation }) => Effect.gen(function* () {
 	const input = yield* (yield* Stdio.Stdio).stdin.pipe(Stream.decodeText(), Stream.mkString);
@@ -26890,7 +27046,7 @@ const gitCommands = [
 			value
 		])) !== 0) return yield* sayFailed(`Setting ${key} in ${into} failed.`);
 		yield* printAnswer(fork.json, asJson, `Cloned ${owner}/${name} into ${into}. origin is read-only to agents: git push goes to ${forkRemote(fork.value)}, the fork of whichever session on the thread pushes.`);
-	}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Clone a repo of the session’s project, to push to its fork"), Command.withShortDescription("Clone a repo to work in your session’s fork")),
+	}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("Clone a repo of the session’s project, to push to its fork"), Command.withShortDescription("Clone a repo to work in your session’s fork")),
 	Command.make("sync", { json }, ({ json: asJson }) => Effect.gen(function* () {
 		yield* ownSession("ref0 sync runs in an agent’s session, in a clone ref0 clone made.");
 		const synced = yield* syncBase(".");
@@ -26906,7 +27062,7 @@ const gitCommands = [
 			on,
 			commit
 		}, asJson, `Merged ${at}. Push it when you’re ready: git push.`);
-	}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Merge in main, or the thread this one is stacked on, as ref0 holds it now. ref0 mcp says to when what merged touches your work"), Command.withShortDescription("Merge in main or the thread this one is stacked on")),
+	}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("Merge in main, or the thread this one is stacked on, as ref0 holds it now. ref0 mcp says to when what merged touches your work"), Command.withShortDescription("Merge in main or the thread this one is stacked on")),
 	credential
 ];
 //#endregion
@@ -27319,7 +27475,7 @@ const usageCommands = [personUsage, personMeters];
 * invitations. Each is a person's, asked of them by approval, as every terminal command of
 * theirs is; agents never change members.
 */
-const failedWith$9 = (failed) => sayFailed(failed.nextStep);
+const failedWith$10 = (failed) => sayFailed(failed.nextStep);
 const organization$2 = Argument.String("org").pipe(Argument.withDescription("The organization, by name"), Argument.withSchema(OwnerRef));
 const person = Argument.String("person").pipe(Argument.withDescription("The person, by name"), Argument.withSchema(OwnerRef));
 const invitation = Argument.String("invitation").pipe(Argument.withDescription("The invitation’s ID, such as invitation_01k6…"));
@@ -27349,7 +27505,7 @@ const create$1 = Command.make("create", {
 		payload
 	});
 	yield* printAnswer(answer.json, asJson, answer.value.state === "ready" ? `Made ${answer.value.name}.` : `Made ${answer.value.name}; it’s being set up.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Make an organization, with you as its admin"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Make an organization, with you as its admin"));
 const leave = Command.make("leave", {
 	organization: organization$2,
 	json
@@ -27359,7 +27515,7 @@ const leave = Command.make("leave", {
 		params: { owner: org }
 	});
 	yield* printAnswer(answer.json, asJson, `Left ${org}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Leave an organization"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Leave an organization"));
 const orgCommand = Command.make("org").pipe(Command.withDescription("Make an organization, leave one, or read its usage and what ref0 ran and kept for it"), Command.withShortDescription("Manage an organization and read its usage"), Command.withSubcommands([
 	create$1,
 	leave,
@@ -27376,7 +27532,7 @@ const orgs = Command.make("orgs", {
 	});
 	const lines = answer.value.organizations.map((each) => `${each.name}  ${each.role}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? "You’re in no organization yet." : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The organizations you’re a member of"), Command.withShortDescription("List your organizations"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("The organizations you’re a member of"), Command.withShortDescription("List your organizations"));
 const members = Command.make("members", {
 	organization: organization$2,
 	cursor: cursor$3,
@@ -27389,7 +27545,7 @@ const members = Command.make("members", {
 	});
 	const lines = answer.value.members.map((each) => `${each.name}  ${each.role}${each.member.kind === "agent" ? "  (its agent)" : ""}`);
 	yield* printAnswer(answer.json, asJson, [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("An organization’s members, people and its own agents"), Command.withShortDescription("List an organization’s members"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("An organization’s members, people and its own agents"), Command.withShortDescription("List an organization’s members"));
 const role = Command.make("role", {
 	organization: organization$2,
 	person,
@@ -27405,7 +27561,7 @@ const role = Command.make("role", {
 		payload: { role: chosen }
 	});
 	yield* printAnswer(answer.json, asJson, `${named} is ${answer.value.role} of ${org} now.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Make a member an admin, or an admin a member"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Make a member an admin, or an admin a member"));
 const remove$1 = Command.make("remove", {
 	organization: organization$2,
 	person,
@@ -27419,7 +27575,7 @@ const remove$1 = Command.make("remove", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, `Removed ${named} from ${org}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Remove a member, with the grants they held there"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Remove a member, with the grants they held there"));
 const memberCommand = Command.make("member").pipe(Command.withDescription("Change a member’s role, or remove them"), Command.withSubcommands([role, remove$1]));
 const listInvitations = Command.make("list", {
 	organization: organization$2,
@@ -27433,7 +27589,7 @@ const listInvitations = Command.make("list", {
 	});
 	const lines = answer.value.invitations.map((each) => `${each.invitation}  ${each.invitee.name}  ${each.role}  from ${each.sentBy.name}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `${org} has no open invitations.` : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("An organization’s open invitations"), Command.withShortDescription("List an organization’s open invitations"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("An organization’s open invitations"), Command.withShortDescription("List an organization’s open invitations"));
 const withdraw = Command.make("withdraw", {
 	organization: organization$2,
 	invitation,
@@ -27447,7 +27603,7 @@ const withdraw = Command.make("withdraw", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, `Withdrew ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Take an open invitation back"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Take an open invitation back"));
 const invite = Command.make("invite", {
 	organization: organization$2,
 	person,
@@ -27467,7 +27623,7 @@ const invite = Command.make("invite", {
 		payload
 	});
 	yield* printAnswer(answer.json, asJson, `Invited ${answer.value.invitee.name} to ${org} as ${answer.value.role}: ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Invite a person to an organization; list or withdraw invitations"), Command.withSubcommands([listInvitations, withdraw]));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Invite a person to an organization; list or withdraw invitations"), Command.withSubcommands([listInvitations, withdraw]));
 const invitations = Command.make("invitations", {
 	cursor: cursor$3,
 	json
@@ -27478,7 +27634,7 @@ const invitations = Command.make("invitations", {
 	});
 	const lines = answer.value.invitations.map((each) => `${each.invitation}  ${each.organization.name}  ${each.role}`);
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? "You have no open invitations." : [...lines, ...more(answer.value.next)].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The invitations you’ve received"), Command.withShortDescription("List invitations you’ve received"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("The invitations you’ve received"), Command.withShortDescription("List invitations you’ve received"));
 const accept = Command.make("accept", {
 	invitation,
 	json
@@ -27488,7 +27644,7 @@ const accept = Command.make("accept", {
 		params: { invitation: id }
 	});
 	yield* printAnswer(answer.json, asJson, `Joined as ${answer.value.role}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Accept an invitation"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Accept an invitation"));
 const decline = Command.make("decline", {
 	invitation,
 	json
@@ -27498,7 +27654,7 @@ const decline = Command.make("decline", {
 		params: { invitation: id }
 	});
 	yield* printAnswer(answer.json, asJson, `Declined ${answer.value.invitation}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("Decline an invitation"));
+}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Decline an invitation"));
 /** Organizations, their members and invitations. */
 const organizationCommands = [
 	orgCommand,
@@ -27511,7 +27667,7 @@ const organizationCommands = [
 ];
 //#endregion
 //#region src/commands/grants.ts
-const failedWith$8 = (failed) => sayFailed(failed.nextStep);
+const failedWith$9 = (failed) => sayFailed(failed.nextStep);
 const isOwnerRef = Schema.is(OwnerRef);
 const isProject$1 = Schema.is(WrittenProject);
 const isThread = Schema.is(WrittenThread);
@@ -27633,7 +27789,7 @@ const changeCommand = (name, endpoint) => Command.make(name, {
 		onSome: (on) => [on]
 	})];
 	yield* printAnswer(answer.json, asJson, endpoint === "grants.set" ? `Granted ${role}: ${said.join(" ")}.` : `Took back ${role}: ${said.join(" ")}.`);
-}).pipe(Effect.catchTag("CallFailed", failedWith$8)));
+}).pipe(Effect.catchTag("CallFailed", failedWith$9)));
 const revoke = changeCommand("revoke", "grants.revoke").pipe(Command.withDescription("Take a grant back, written as it was given"));
 const grant = changeCommand("grant", "grants.set").pipe(Command.withDescription("Give a grant in an organization, as an admin: ref0 grant acme/billing pip/claude write"), Command.withShortDescription("Give a grant in an organization"), Command.withSubcommands([revoke]));
 /** An organization's grants. */
@@ -27653,7 +27809,41 @@ const grantCommands = [Command.make("grants", {
 	const lines = answer.value.grants.map((each) => `${writtenSubject(org, each.subject)}  ${writtenPrincipal(each.principal)}  ${each.role}`);
 	const next = answer.value.nextAfter;
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `You see no grants in ${org}.` : [...lines, ...next === void 0 ? [] : [`More: --cursor ${next}`]].join("\n"));
-}).pipe(Effect.catchTag("CallFailed", failedWith$8))).pipe(Command.withDescription("The grants in an organization you may see"), Command.withShortDescription("List an organization’s grants")), grant];
+}).pipe(Effect.catchTag("CallFailed", failedWith$9))).pipe(Command.withDescription("The grants in an organization you may see"), Command.withShortDescription("List an organization’s grants")), grant];
+//#endregion
+//#region src/commands/identity-token.ts
+/**
+* `ref0 identity-token --audience <origin>`: an identity token for the agent's session it runs
+* in, for one outside service, which verifies it against ref0's published keys. One request, by
+* the session's own token, which never starts or renews a session. The token alone goes to
+* stdout, so it pipes into a verifier; anything else goes to stderr, with no token, and fails.
+*/
+const decodeAudience = Schema.decodeUnknownOption(IdentityAudience);
+const outside = "ref0 identity-token runs only in an agent’s ref0 session, and none runs here. In Claude Code or Codex, one starts at each prompt once ref0 connect has connected its config folder: ask the agent there.";
+const audienceOnce = "Name the audience once, as --audience https://verifier.example: the outside service’s HTTPS origin.";
+const notAnAudience = "Send the outside service’s HTTPS origin as the audience, such as https://verifier.example, with no path.";
+const mayHaveIssued = "ref0’s answer was lost or failed partway, so it may have made a token that never reached you. Ask again for a fresh one in a moment.";
+/**
+* What went wrong, said once, on stderr. An answer lost or failed partway may still have made a
+* token, as ref0's log records, but nothing to check or undo: a fresh request is the way on.
+*/
+const failedWith$8 = (failed) => sayFailed(failed.status >= 500 || failed.status === 0 && (failed.kind === "Unreachable" || failed.kind === "Unexpected") ? mayHaveIssued : failed.nextStep);
+/** Identity tokens, for outside services. */
+const identityTokenCommands = [Command.make("identity-token", {
+	audience: Flag.String("audience").pipe(Flag.withDescription("The outside service that verifies the token, as its HTTPS origin, such as https://verifier.example"), Flag.atLeast(0)),
+	json
+}, ({ audience: named, json: asJson }) => Effect.gen(function* () {
+	if (named.length !== 1) return yield* sayFailed(audienceOnce);
+	const audience = decodeAudience(named[0]);
+	if (Option.isNone(audience)) return yield* sayFailed(notAnAudience);
+	yield* ownSession(outside);
+	const issued = yield* callEndpoint({
+		endpoint: "me.identityToken",
+		payload: { audience: audience.value }
+	});
+	if (asJson) return yield* printAnswer(issued.json, true, "");
+	yield* Console.log(issued.value.token);
+}).pipe(Effect.catchTag("CallFailed", failedWith$8))).pipe(Command.withDescription("Print a short-lived identity token, a signed JWT naming your agent, for one outside service"), Command.withShortDescription("Print an identity token for one outside service"))];
 //#endregion
 //#region src/commands/agents.ts
 /**
@@ -27928,27 +28118,39 @@ const repoCommands = [Command.make("repos", {
 //#endregion
 //#region src/decision-lines.ts
 /** A decision in words, as `ref0 waiting`, `ref0 decision` and `ref0 answer` print it. */
-/** What a decision is about, in words: its thread, and a gate's version of its pull request. */
-const subjectWords = ({ subject, names }) => subject.kind === "version" && names.pullRequest !== void 0 ? `version ${subject.version} of ${names.pullRequest}, from ${names.thread}` : names.thread;
-/** A decision in a line. */
-const decisionLines = (decision) => {
-	const on = subjectWords(decision);
+/**
+* A thread as a line read in `scope` names it: `#3` when it's in that scope, else in full, as
+* `pip/default#3`.
+*/
+const threadWords = (thread, scope) => thread.startsWith(`${scope}#`) ? thread.slice(scope.length) : thread;
+/**
+* What waits, in words: a gate's pull request and version, and the thread it's from, or the thread
+* an ask is on.
+*/
+const subjectWords = ({ subject, names }, scope) => subject.kind === "version" && names.pullRequest !== void 0 ? `${names.pullRequest}, version ${subject.version}, from ${threadWords(names.thread, scope)}` : names.thread;
+/**
+* A decision in a line, read in `scope`: what waits, its answers or how it ended, then its ID, for
+* `ref0 decision` and `ref0 answer`.
+*/
+const decisionLines = (decision, scope) => {
+	const on = subjectWords(decision, scope);
 	const answers = decision.options.map((option) => option.key).join(" or ");
-	return decision.state === "open" ? `${decision.decision}  on ${on}: ${answers}` : `${decision.decision}  on ${on}: ${decision.result ?? "no answer"}, ${decision.closedWhy ?? "closed"}`;
+	return `${on}: ${decision.state === "open" ? answers : `${decision.result ?? "no answer"}, ${decision.closedWhy ?? "closed"}`}  ${decision.decision}`;
 };
-const nothing = "Nothing waits on you here.";
 /**
-* What waits, as `ref0 waiting` prints it: what waits on the caller, then, for an agent, what
-* waits on its person, which they answer on their own page.
+* What waits in `scope`, as `ref0 waiting` prints it: what waits on the caller, then, for an agent,
+* what waits on its person, which only they answer, on their own page.
 */
-const waitingLines = (decisions) => {
-	const yours = decisions.flatMap((decision) => decision.waitsOn === "you" ? [decisionLines(decision)] : []);
-	const theirs = decisions.flatMap((decision) => decision.waitsOn === "your person" ? [`  ${decisionLines(decision)}`] : []);
-	if (theirs.length === 0) return yours.length === 0 ? nothing : yours.join("\n");
+const waitingLines = (decisions, scope) => {
+	const yours = decisions.flatMap((decision) => decision.waitsOn === "you" ? [decisionLines(decision, scope)] : []);
+	const theirs = decisions.flatMap((decision) => decision.waitsOn === "your person" ? [`  ${decisionLines(decision, scope)}`] : []);
+	if (theirs.length === 0) return yours.length === 0 ? `Nothing waits on you in ${scope}.` : yours.join("\n");
+	const them = theirs.length === 1 ? "it" : "them";
 	return [
 		...yours,
-		"Waits on your person, under Waiting on you on their page:",
-		...theirs
+		`Waits on your person, who alone can answer ${them}, under Waiting on you on their page:`,
+		...theirs,
+		`ref0 refuses an agent’s answer to ${them}.`
 	].join("\n");
 };
 //#endregion
@@ -27964,7 +28166,10 @@ const checkPlan = Schema.decodeUnknownEffect(PlanInput);
 const encodePlan = Schema.encodeEffect(PlanInput);
 const decodeRecipient = Schema.decodeUnknownOption(CommentRecipient);
 const thread$4 = Argument.String("thread").pipe(Argument.withDescription("The thread, as owner/project#number, or an org thread, as acme#7"), Argument.withSchema(WrittenThread));
-const project$2 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads"), Argument.withSchema(Schema.Union([WrittenProject, OwnerName])));
+/** A project, `acme/billing`, or an organization, `acme`, for its org threads. */
+const Scope$1 = Schema.Union([WrittenProject, OwnerName]);
+const decodeScope = Schema.decodeUnknownOption(Scope$1);
+const project$2 = Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads"), Argument.withSchema(Scope$1));
 const version = Argument.Int("version").pipe(Argument.withDescription("The plan’s version"));
 const decision = Argument.String("decision").pipe(Argument.withDescription("The decision’s ID"));
 /** Where a version's approval stands: who accepted it, or its check. */
@@ -28125,25 +28330,37 @@ const comments = Command.make("comments", {
 	].filter((line) => line !== "").join("\n");
 	yield* printAnswer(answer.json, asJson, words);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("A plan version’s comments, oldest first"), Command.withShortDescription("List a plan version’s comments"));
+const plan = Command.make("plan").pipe(Command.withDescription("A thread’s plan: write, propose and read its versions, and comment"), Command.withShortDescription("Write, propose and read a thread’s plan"), Command.withSubcommands([
+	list$4,
+	write,
+	onVersion("show"),
+	onVersion("propose"),
+	comment,
+	comments
+]));
+/**
+* The project of the thread the session runs on, or its organization for an org thread's. Outside
+* a session, it says how to name one, and fails before anything's sent.
+*/
+const sessionScope = Effect.gen(function* () {
+	const thread = yield* (yield* SessionThread).current.pipe(Effect.catchTag("KeychainError", (failed) => sayFailed(failed.nextStep)));
+	const scope = Option.flatMap(thread, (written) => decodeScope(projectOf$2(written)));
+	if (Option.isNone(scope)) return yield* sayFailed("Name the project: ref0 waiting pip/shop. Or, for an organization’s org threads: ref0 waiting acme.");
+	return scope.value;
+});
 /** Plans' and decisions' commands. */
 const planCommands = [
-	Command.make("plan").pipe(Command.withDescription("A thread’s plan: write, propose and read its versions, and comment"), Command.withShortDescription("Write, propose and read a thread’s plan"), Command.withSubcommands([
-		list$4,
-		write,
-		onVersion("show"),
-		onVersion("propose"),
-		comment,
-		comments
-	])),
+	plan,
 	Command.make("waiting", {
-		project: project$2,
+		project: Argument.String("project").pipe(Argument.withDescription("The project, as owner/project, or the organization, as acme, for its org threads; in an agent’s session, its own if not named"), Argument.withSchema(Scope$1), Argument.optional),
 		json
-	}, ({ project: address, json: asJson }) => Effect.gen(function* () {
+	}, ({ project: named, json: asJson }) => Effect.gen(function* () {
+		const address = Option.isSome(named) ? named.value : yield* sessionScope;
 		const answer = yield* callEndpoint(routed(address, {
 			endpoint: "decisions.waiting",
 			params: scopeParams(address)
 		}));
-		yield* printAnswer(answer.json, asJson, waitingLines(answer.value.decisions));
+		yield* printAnswer(answer.json, asJson, waitingLines(answer.value.decisions, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("What in a project, or in an organization’s org threads, waits on you"), Command.withShortDescription("Show what waits on you")),
 	Command.make("decision", {
 		project: project$2,
@@ -28157,7 +28374,7 @@ const planCommands = [
 				decision: id
 			}
 		}));
-		yield* printAnswer(answer.json, asJson, decisionLines(answer.value));
+		yield* printAnswer(answer.json, asJson, decisionLines(answer.value, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("One decision, as it stands"), Command.withShortDescription("Show a decision and where it stands")),
 	Command.make("answer", {
 		project: project$2,
@@ -28180,7 +28397,7 @@ const planCommands = [
 				})
 			})
 		}));
-		yield* printAnswer(answer.json, asJson, decisionLines(answer.value));
+		yield* printAnswer(answer.json, asJson, decisionLines(answer.value, address));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Answer a decision that waits on you"))
 ];
 //#endregion
@@ -28220,9 +28437,14 @@ const endedLines = (view) => {
 	const why = view.closedWhy === null ? "" : closedWhyWords[view.closedWhy];
 	return [`  ${view.state.padEnd(8)}  ${at}${why}`];
 };
-const openedByWords = (view) => {
-	const by = "session" in view.openedBy ? `session ${view.openedBy.session} of agent ${view.openedBy.agent.id}` : `workflow ${view.openedBy.workflow.name}’s run ${view.openedBy.workflow.run}`;
-	return `${minute(view.openedAt)} by ${by}`;
+/**
+* When it opened, and by what: a workflow's run, or an agent's session, whose IDs go on a line of
+* their own, since ref0 answers no name for either.
+*/
+const openedLines = (view) => {
+	const at = minute(view.openedAt);
+	if ("workflow" in view.openedBy) return [`  opened    ${at} by workflow ${view.openedBy.workflow.name}’s run ${view.openedBy.workflow.run}`];
+	return [`  opened    ${at} by an agent’s session:`, `            ${view.openedBy.session} of ${view.openedBy.agent.id}`];
 };
 /** `ref0 pr show`: one pull request, a line for each thing an agent acts on. */
 const pullRequestLines = (view, repo) => {
@@ -28233,7 +28455,7 @@ const pullRequestLines = (view, repo) => {
 		`${repo}#${view.pullRequest}, thread #${view.threadNumber}: ${view.state}${repair}`,
 		`  head      ${headWords(head)}`,
 		`  current   ${versionWords(current)}, on ${base}`,
-		`  opened    ${openedByWords(view)}`,
+		...openedLines(view),
 		...endedLines(view)
 	].join("\n");
 };
@@ -29219,7 +29441,7 @@ const waitOnBlockers = Effect.fnUntraced(function* (asJson) {
 	const { thread, blockers } = first.value;
 	if (blockers.length === 0) return yield* printAnswer(first.json, asJson, `Nothing blocks #${thread} now: it may merge.`);
 	const them = blockers.length === 1 ? "it" : "them";
-	yield* Console.error(printable(`${blockedSentence(thread, blockers)} Waiting up to 9 minutes for ${them} to clear…`));
+	yield* printBlocks([[`${blockedSentence(thread, blockers)} Waiting up to 9 minutes for ${them} to clear…`]]);
 	let renewedAt = Number.NEGATIVE_INFINITY;
 	for (;;) {
 		const now = yield* Clock.currentTimeMillis;
@@ -30112,7 +30334,7 @@ const enable = Command.make("enable", {
 		const why = found.why === void 0 ? "" : ` (${found.why})`;
 		return yield* sayFailed(found.why === "activation failed" ? `ref0 couldn't read main's .ref0/ for a day, and reads it again each hour. Once ref0 workflows list ${address} shows a version of ${workflow}, turn it on.` : `main has no version of ${workflow} ref0 can run${why}. Fix its code in .ref0/ and merge it, so ref0 compiles a new version, then turn that one on.`);
 	}
-	yield* Console.error(printable(enablingLines(workflow, found.version, found.manifest, found)));
+	yield* printBlocks([[enablingLines(workflow, found.version, found.manifest, found)]]);
 	const answer = yield* callEndpoint({
 		endpoint: "workflows.enable",
 		params: repoParts(address),
@@ -30145,7 +30367,7 @@ const start = Command.make("start", {
 			source: source.value
 		}
 	});
-	yield* Console.error(printable(attachingLines(written, compiled.value)));
+	yield* printBlocks([[attachingLines(written, compiled.value)]]);
 	const answer = yield* callEndpoint({
 		endpoint: "threadWorkflows.start",
 		params,
@@ -33105,11 +33327,11 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 * started that thread, `REF0_EVENT`. Both, each as ref0 writes it, or neither. `REF0_TITLE` is
 * someone else's words, and nothing here reads it.
 */
-const decodeThread = Schema.decodeUnknownOption(WrittenThread);
+const decodeThread$1 = Schema.decodeUnknownOption(WrittenThread);
 const decodeEvent = Schema.decodeUnknownOption(EventId);
 const optional = (name) => Config.String(name).pipe(Config.option);
 const watchedHere = Effect.gen(function* () {
-	const thread = Option.flatMap(yield* optional(watchVariables.thread), decodeThread);
+	const thread = Option.flatMap(yield* optional(watchVariables.thread), decodeThread$1);
 	const event = Option.flatMap(yield* optional(watchVariables.event), decodeEvent);
 	return Option.zipWith(thread, event, (on, by) => ({
 		thread: on,
@@ -34487,6 +34709,19 @@ const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
 	});
 	return SessionToken.of({ current });
 }));
+const decodeThread = Schema.decodeUnknownOption(WrittenThread);
+/** `SessionThread` from the keychain, as the start of the harness session this runs in kept it. */
+const harnessSessionThread = Layer.effect(SessionThread, Effect.gen(function* () {
+	const keychain = yield* Keychain;
+	const harness = yield* HarnessProcess;
+	const current = Effect.gen(function* () {
+		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
+		if (Option.isNone(binding)) return Option.none();
+		const kept = yield* keychain.get(threadAccount(binding.value));
+		return Option.flatMap(kept, (thread) => decodeThread(Redacted.value(thread)));
+	});
+	return SessionThread.of({ current });
+}));
 //#endregion
 //#region src/harness/server-check.ts
 /**
@@ -34848,7 +35083,8 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 	...organizationCommands,
 	...grantCommands,
 	...agentCommands,
-	...attachmentCommands
+	...attachmentCommands,
+	...identityTokenCommands
 ]));
 const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
@@ -34863,7 +35099,7 @@ const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,
 	sessionToken,
 	FetchHttpClient.layer
-])), sessionToken, FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
+])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
 //#endregion
 //#region src/main.ts
 ref0.pipe(Command.run({ version: cliVersion }), Effect.provide(services), NodeRuntime.runMain);