@ref0/cli 0.12.1 → 0.14.0

package/dist/main.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Cause, Clock, Config, ConfigProvider, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
 import { Argument, CliOutput, Command, Flag, Prompt } from "effect/cli";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { Cause, Clock, Config, ConfigProvider, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
+import { FetchHttpClient, Headers, HttpClient, HttpClientRequest } from "effect/http";
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "effect/http-api";
+import { Base64Url } from "effect/encoding";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { execFile, spawn } from "node:child_process";
 import { createServer } from "node:http";
@@ -652,6 +653,370 @@ const AgentDetached = eventKind("agent.detached", Schema.Struct({
 	why: Schema.Literals(["revoked", "attach lost"])
 }));
 //#endregion
+//#region ../contracts/src/connections.ts
+/**
+* A connection's name in its project, such as `sentry` or `deploys`: lowercase letters, digits
+* and hyphens, from a letter, as a mention names an outside service. `ref0` names ref0's own, so
+* no connection takes it. Two connections of a project are never named alike at once.
+*/
+const ConnectionName = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,38}$/), Schema.makeFilter((name) => name !== "ref0" || "`ref0` names ref0’s own")).pipe(Schema.brand("ConnectionName"));
+/**
+* What reads a connection's deliveries: `webhook`, whose sender posts ref0's own shape, `{ kind,
+* key, title?, url? }`; or `sentry`, whose sender is Sentry, posting its issue and alert
+* webhooks, which its mapper reads. More kinds come one at a time, each with its mapper.
+*/
+const ConnectionKind = Schema.Literals(["webhook", "sentry"]);
+/** The most characters in a signal's link: a longer one is withheld. */
+const signalLinkLength = 2048;
+/**
+* An ID as a signal holds one: letters, digits and `:` `/` `.` `-` `_`, from a letter or a
+* digit, so it can't carry a space, a quote, an instruction or a command's option.
+*/
+const signalIdPattern = (length) => new RegExp(`^[A-Za-z0-9][A-Za-z0-9:/._-]{0,${length - 1}}$`);
+/** What happened, in the service's own word: `issue.created`, `deploy.finished`. */
+const SignalKind = Schema.String.check(Schema.isPattern(signalIdPattern(64))).pipe(Schema.brand("SignalKind"));
+/** What it's about, so a repeat can be recognised: an issue's ID, a release. */
+const SignalKey = Schema.String.check(Schema.isPattern(signalIdPattern(128))).pipe(Schema.brand("SignalKey"));
+/**
+* Why a signal's title or link wasn't kept: it looked like a secret; a link that isn't `https`;
+* or a link too long to keep whole.
+*/
+const SignalWithheldWhy = Schema.Literals([
+	"looks like a secret",
+	"not an https link",
+	"too long"
+]);
+/** A signal's title or link the connection gave, withheld, and why. */
+const SignalWithheld = Schema.Struct({
+	title: Schema.optionalKey(SignalWithheldWhy),
+	url: Schema.optionalKey(SignalWithheldWhy)
+});
+/**
+* A Sentry organization, by its slug as Sentry's URLs name it: lowercase letters, digits,
+* hyphens and underscores, from a letter or a digit.
+*/
+const SentryOrg = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9_-]{0,49}$/)).pipe(Schema.brand("SentryOrg"));
+/** Where a Sentry organization's data lives, and so which of Sentry's API hosts answers for it. */
+const SentryRegion = Schema.Literals(["us", "de"]);
+/** A connection added to the project, by the admin whose approval added it. */
+const ConnectionAdded = eventKind("connection.added", Schema.Struct({
+	connection: ConnectionId,
+	name: ConnectionName,
+	kind: ConnectionKind
+}));
+/** A connection's token replaced, by the admin whose approval replaced it: the old one works no more. */
+const ConnectionRotated = eventKind("connection.rotated", Schema.Struct({ connection: ConnectionId }));
+/** A connection removed, by the admin whose approval removed it: its webhook takes nothing more. */
+const ConnectionRemoved = eventKind("connection.removed", Schema.Struct({ connection: ConnectionId }));
+/**
+* A `sentry` connection's credential set, by the admin whose approval set it: the Sentry
+* organization and region it reads, and that ref0 now holds a token for them, which only ref0's
+* server reads, to call Sentry for a workflow. Never the token, nor its hash. Setting it again
+* replaces the one before.
+*/
+const ConnectionCredentialSet = eventKind("connection.credential.set", Schema.Struct({
+	connection: ConnectionId,
+	org: SentryOrg,
+	region: SentryRegion
+}));
+/**
+* A signal, received by a connection: delivered to its webhook, by `ref0:hooks`, or sent with
+* `ref0 signal send` by the person or agent whose token sent it. `at` is when ref0 received it.
+* A title or link that failed its check is withheld, and says why in `withheld`; a title too long
+* is cut, and says so in `titleCut`. `dropped` counts the deliveries the connection dropped since
+* its last signal: over a bound, or refused. A delivery's ID, if the service gave one, is in the
+* envelope's `source` only as the SHA-256 of the connection and that ID.
+*/
+const SignalReceived = eventKind("signal.received", Schema.Struct({
+	connection: ConnectionId,
+	kind: SignalKind,
+	key: SignalKey,
+	title: Schema.optionalKey(TextId),
+	url: Schema.optionalKey(TextId),
+	withheld: Schema.optionalKey(SignalWithheld),
+	titleCut: Schema.optionalKey(Schema.Literal(true)),
+	dropped: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
+	at: Schema.DateTimeUtcFromMillis
+}));
+/**
+* ref0's one origin, as a client is given it: `http` or `https`, a host and maybe a port, and no
+* credentials, path, query or fragment. That pattern alone lets through a host or port no URL has,
+* such as `https://1.2.3.999`, `https://[1::2::3]` or `https://ref0.test:99999`, so the platform's own URL parser must take
+* it too. It's kept as written, case and any default port too: every path here is appended to it
+* as it is.
+*/
+const ApiOrigin = Schema.String.check(Schema.isPattern(/^https?:\/\/(?:\[[0-9A-Fa-f:.]+\]|[^\s/?#\\@:[\]]+)(?::\d+)?$/), Schema.makeFilter((origin) => URL.canParse(origin) || "a URL the platform can parse")).pipe(Schema.brand("ApiOrigin"));
+/** Where signing in's own routes live, which Better Auth serves, outside `Api`. */
+const signInBase = "/auth";
+/**
+* A route under `signInBase`, by its method: its `path` from the origin's root, as a request
+* names it, and its `pathUnderBase`, as Better Auth names its endpoints.
+*/
+const signInRoute = (method, pathUnderBase) => ({
+	method,
+	pathUnderBase,
+	path: `${signInBase}${pathUnderBase}`
+});
+/** Signing in with GitHub, from ref0's pages: starting it, GitHub's way back, and signing out. */
+const signInRoutes = {
+	gitHubSignIn: signInRoute("POST", "/sign-in/social"),
+	gitHubCallback: signInRoute("GET", "/callback/github"),
+	signOut: signInRoute("POST", "/sign-out")
+};
+/**
+* The OAuth server outside MCP clients use (layer 4, PR 11a): its metadata, authorizing, the
+* token endpoint, registering a public client and revoking a token.
+*/
+const oauthRoutes = {
+	metadata: signInRoute("GET", "/.well-known/oauth-authorization-server"),
+	authorize: signInRoute("GET", "/oauth2/authorize"),
+	token: signInRoute("POST", "/oauth2/token"),
+	register: signInRoute("POST", "/oauth2/register"),
+	revoke: signInRoute("POST", "/oauth2/revoke")
+};
+signInRoute("POST", "/oauth2/consent");
+[...Object.values(signInRoutes), ...Object.values(oauthRoutes)];
+`${oauthRoutes.metadata.pathUnderBase}`;
+/** Where an agent's session asks for an identity token. */
+const identityTokenPath = "/v1/me/identity-token";
+/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
+const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
+const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
+/**
+* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
+* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
+* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
+*/
+const parsesAsWritten = (audience) => {
+	const parts = audiencePattern.exec(audience);
+	if (parts === null || !URL.canParse(audience)) return false;
+	const url = new URL(audience);
+	const port = parts[2] ?? "";
+	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
+};
+/**
+* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
+* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
+* case and any port too, so `https://verifier.example:443` is another audience than
+* `https://verifier.example`. ref0 never fetches or resolves it.
+*/
+const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
+/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
+const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
+/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
+const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
+/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
+const IssuedIdentityToken = Schema.Struct({
+	token: IdentityToken,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+/**
+* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
+* token, naming its issuance in ref0's log without naming any row or secret.
+*/
+const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
+/**
+* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
+* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
+* audience, different at every other, and carrying no time.
+*/
+const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
+/** A session, as one audience knows it, made as a person's is. */
+const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
+/** The accountable person, last in a token's chain: only their pairwise ID. */
+const PersonActor = Schema.Struct({ sub: PairwisePersonId });
+/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
+const sessionActing = (act) => Schema.Struct({
+	sub: PairwiseSessionId,
+	act
+});
+const oneSession = sessionActing(PersonActor);
+const twoSessions = sessionActing(oneSession);
+const threeSessions = sessionActing(twoSessions);
+/**
+* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
+* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
+* allows the agent in `sub`, never an actor.
+*/
+const IdentityActor = Schema.Union([
+	oneSession,
+	twoSessions,
+	threeSessions,
+	sessionActing(threeSessions)
+]);
+/** A time in a token, in whole UTC epoch seconds. */
+const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
+Schema.Struct({
+	iss: ApiOrigin,
+	sub: AgentId,
+	aud: IdentityAudience,
+	iat: EpochSeconds,
+	exp: EpochSeconds,
+	jti: IdentityTokenId,
+	act: IdentityActor
+}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
+/**
+* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
+* never names two keys.
+*/
+const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
+Schema.Struct({
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId,
+	typ: Schema.Literal("JWT")
+});
+/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
+const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+/** One public key in the JWKS: exactly these fields, and never a private one. */
+const PublicSigningKey = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Coordinate,
+	y: Coordinate,
+	use: Schema.Literal("sig"),
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId
+});
+Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
+Schema.Struct({
+	issuer: ApiOrigin,
+	jwks_uri: Schema.String,
+	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
+	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
+	claims_supported: Schema.Tuple([
+		Schema.Literal("iss"),
+		Schema.Literal("sub"),
+		Schema.Literal("aud"),
+		Schema.Literal("exp"),
+		Schema.Literal("iat"),
+		Schema.Literal("jti"),
+		Schema.Literal("act")
+	])
+});
+/**
+* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+* `IdentityAudience` says. The refused text is never echoed.
+*/
+var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/**
+* Less than a whole second is left before the session, a parent or the credential expires, or
+* the token would expire before it's recorded: the next prompt renews or replaces the session.
+*/
+var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
+/**
+* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
+* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
+* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
+* received or used it. A failed append discards the token, so every token has its event.
+*/
+const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
+	session: SessionId,
+	agent: AgentRef,
+	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
+	accountable: PersonId,
+	jti: IdentityTokenId,
+	audience: IdentityAudience,
+	issuer: ApiOrigin,
+	keyId: SigningKeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}));
+//#endregion
+//#region ../contracts/src/proofs.ts
+/**
+* Proofs of possession: a credential bound to a key, and the proof that comes with each request
+* made with it, RFC 9449's DPoP. A bound credential, a host grant or a session's token, names its
+* key's thumbprint as `cnf`, which only ref0's own state says, never a caller. Each request sends
+* the token as `Authorization: DPoP <token>` and one `DPoP` header: a compact JWS, signed with
+* ES256 by that key, over the request's method and URL, when it was made, and the token's hash.
+* There's no server nonce and no replay store: a captured token and proof can be used again on
+* the same method and path while the proof's time is in the window, and a token alone can't.
+*/
+/** A P-256 key's RFC 7638 thumbprint: SHA-256 over its required members, in base64url. */
+const KeyThumbprint = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("KeyThumbprint"));
+/** The key a credential is bound to, by its thumbprint: RFC 7800's `cnf`, as `{ jkt }`. */
+const KeyBinding = Schema.Struct({ jkt: KeyThumbprint });
+/** Hosts ref0's origin may name over plain HTTP, for development on one machine. */
+const loopback = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/**
+* ref0's origin as a proof names it: HTTPS, or plain HTTP only on loopback, for development. A
+* client sends a proof, and ref0 takes one, for no other.
+*/
+const ProofOrigin = ApiOrigin.check(Schema.makeFilter((origin) => {
+	const url = URL.parse(origin);
+	return url?.protocol === "https:" || url?.protocol === "http:" && loopback.has(url.hostname) || "HTTPS, or HTTP on loopback";
+})).pipe(Schema.brand("ProofOrigin"));
+/** The most a proof takes, as its compact JWS, before anything else reads it. */
+const dpopProofMaxBytes = 2048;
+const utf8$1 = new TextEncoder();
+const encodeJson$6 = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+/**
+* An object with exactly `fields`, of at most `maxBytes` as JSON, whatever a decode's options
+* say: an exact `Struct` alone drops a member it doesn't know unless its decode is told to refuse
+* one, so the members are checked on the object as it came, before the struct reads them.
+*/
+const exactly = (fields, maxBytes) => {
+	const names = new Set(Object.keys(fields));
+	return Schema.Record(Schema.String, Schema.Unknown).check(Schema.makeFilter((members) => Object.keys(members).every((name) => names.has(name)) || `only ${[...names].join(", ")}`), Schema.makeFilter((members) => utf8$1.encode(encodeJson$6(members)).byteLength <= maxBytes || `at most ${maxBytes} bytes as JSON`)).pipe(Schema.decodeTo(Schema.Struct(fields), SchemaTransformation.passthroughSupertype()));
+};
+/**
+* A P-256 public key as a JWK: exactly `kty`, `crv`, `x` and `y`, so never a private part, a
+* key reference or another algorithm's key. Whether its point is on the curve is for Web Crypto
+* to say, when it imports it.
+*/
+const PublicJwk = exactly({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: PublicSigningKey.fields.x,
+	y: PublicSigningKey.fields.y
+}, 512);
+/** A proof's protected header: its type, ES256, and the public key that signed it. */
+const DpopProofHeader = exactly({
+	typ: Schema.Literal("dpop+jwt"),
+	alg: Schema.Literal("ES256"),
+	jwk: PublicJwk
+}, dpopProofMaxBytes);
+/** A proof's `jti`: a fresh UUIDv4 for each proof. Nothing keeps it to refuse a repeat. */
+const DpopProofId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("DpopProofId"));
+/**
+* A proof's claims: its ID; the request's method, and its URL with no query or fragment, as its
+* client sent it, after the URL was built; when it was made, in whole seconds; and, with a token,
+* `ath`, the SHA-256 of the whole token in base64url.
+*/
+const DpopProofClaims = exactly({
+	jti: DpopProofId,
+	htm: Schema.String.check(Schema.isPattern(/^[A-Z]{1,16}$/)),
+	htu: Schema.String.check(Schema.isMaxLength(dpopProofMaxBytes)),
+	iat: Schema.Int.check(Schema.isGreaterThan(0)),
+	ath: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))
+}, dpopProofMaxBytes);
+/**
+* A bound credential came with a proof that's missing, malformed, stale, from another key, or
+* for another request, or came as a bearer token, or a proof came with no `DPoP` credential to
+* go with it. ref0 answers it before any handler runs, so nothing was done. A machine whose clock
+* is off signs again once, by the answer's `Date`. Also what a machine answers itself when the key
+* its credential is bound to is gone, without sending anything.
+*/
+var InvalidDpopProof = class extends Schema.TaggedError()("InvalidDpopProof", {
+	error: Schema.Literal("invalid_dpop_proof"),
+	nextStep: Schema.String
+}, { httpApiStatus: 401 }) {};
+/** The one refusal of a proof, with what to do. */
+const invalidDpopProof = new InvalidDpopProof({
+	error: "invalid_dpop_proof",
+	nextStep: "If this machine’s key was lost, run ref0 connect in your own terminal, then send the next prompt."
+});
+/**
+* The key store a request's proof is signed in didn't sign it: locked, unavailable or out of
+* time. Nothing was sent. A client's own, never an answer of ref0's.
+*/
+var KeyStoreUnavailable = class extends Schema.TaggedError()("KeyStoreUnavailable", { nextStep: Schema.String }) {};
+//#endregion
 //#region ../contracts/src/credential-events.ts
 /**
 * A person's credentials, in that person's own log. Never the token: only its ID, its kind
@@ -672,7 +1037,9 @@ const TokenDelegated = eventKind("token.delegated", Schema.Struct({
 	session: Schema.optionalKey(SessionId),
 	/** The credential this one was made under, when there is one. */
 	parent: Schema.optionalKey(CredentialRef),
-	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis)
+	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	/** The key it's bound to, by its thumbprint, for a host grant or a session's token made with one. */
+	cnf: Schema.optionalKey(KeyBinding)
 }));
 const TokenRevoked = eventKind("token.revoked", Schema.Struct({
 	credential: CredentialRef,
@@ -1009,6 +1376,11 @@ const CredentialFacts = Schema.Struct({
 		target: Schema.optionalKey(TargetGeneration)
 	}),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	/**
+	* The key it's bound to, for a host grant or a session's token made with one: every request
+	* with it must carry a proof that key signed. ref0's own state says it, never a caller.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
 	/** What it may do, and where. Rows a reader can't decode were left out: they grant nothing. */
 	scopes: Schema.Array(Scope$2),
 	/**
@@ -2754,92 +3126,6 @@ Schema.Struct({ intent: PublishIntentId });
 Schema.Struct({ intent: PublishIntentId });
 Schema.Union([PublishState, Schema.Struct({ none: Schema.Literal(true) })]);
 //#endregion
-//#region ../contracts/src/connections.ts
-/**
-* A connection's name in its project, such as `sentry` or `deploys`: lowercase letters, digits
-* and hyphens, from a letter, as a mention names an outside service. `ref0` names ref0's own, so
-* no connection takes it. Two connections of a project are never named alike at once.
-*/
-const ConnectionName = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,38}$/), Schema.makeFilter((name) => name !== "ref0" || "`ref0` names ref0’s own")).pipe(Schema.brand("ConnectionName"));
-/**
-* What reads a connection's deliveries: `webhook`, whose sender posts ref0's own shape, `{ kind,
-* key, title?, url? }`; or `sentry`, whose sender is Sentry, posting its issue and alert
-* webhooks, which its mapper reads. More kinds come one at a time, each with its mapper.
-*/
-const ConnectionKind = Schema.Literals(["webhook", "sentry"]);
-/** The most characters in a signal's link: a longer one is withheld. */
-const signalLinkLength = 2048;
-/**
-* An ID as a signal holds one: letters, digits and `:` `/` `.` `-` `_`, from a letter or a
-* digit, so it can't carry a space, a quote, an instruction or a command's option.
-*/
-const signalIdPattern = (length) => new RegExp(`^[A-Za-z0-9][A-Za-z0-9:/._-]{0,${length - 1}}$`);
-/** What happened, in the service's own word: `issue.created`, `deploy.finished`. */
-const SignalKind = Schema.String.check(Schema.isPattern(signalIdPattern(64))).pipe(Schema.brand("SignalKind"));
-/** What it's about, so a repeat can be recognised: an issue's ID, a release. */
-const SignalKey = Schema.String.check(Schema.isPattern(signalIdPattern(128))).pipe(Schema.brand("SignalKey"));
-/**
-* Why a signal's title or link wasn't kept: it looked like a secret; a link that isn't `https`;
-* or a link too long to keep whole.
-*/
-const SignalWithheldWhy = Schema.Literals([
-	"looks like a secret",
-	"not an https link",
-	"too long"
-]);
-/** A signal's title or link the connection gave, withheld, and why. */
-const SignalWithheld = Schema.Struct({
-	title: Schema.optionalKey(SignalWithheldWhy),
-	url: Schema.optionalKey(SignalWithheldWhy)
-});
-/**
-* A Sentry organization, by its slug as Sentry's URLs name it: lowercase letters, digits,
-* hyphens and underscores, from a letter or a digit.
-*/
-const SentryOrg = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9_-]{0,49}$/)).pipe(Schema.brand("SentryOrg"));
-/** Where a Sentry organization's data lives, and so which of Sentry's API hosts answers for it. */
-const SentryRegion = Schema.Literals(["us", "de"]);
-/** A connection added to the project, by the admin whose approval added it. */
-const ConnectionAdded = eventKind("connection.added", Schema.Struct({
-	connection: ConnectionId,
-	name: ConnectionName,
-	kind: ConnectionKind
-}));
-/** A connection's token replaced, by the admin whose approval replaced it: the old one works no more. */
-const ConnectionRotated = eventKind("connection.rotated", Schema.Struct({ connection: ConnectionId }));
-/** A connection removed, by the admin whose approval removed it: its webhook takes nothing more. */
-const ConnectionRemoved = eventKind("connection.removed", Schema.Struct({ connection: ConnectionId }));
-/**
-* A `sentry` connection's credential set, by the admin whose approval set it: the Sentry
-* organization and region it reads, and that ref0 now holds a token for them, which only ref0's
-* server reads, to call Sentry for a workflow. Never the token, nor its hash. Setting it again
-* replaces the one before.
-*/
-const ConnectionCredentialSet = eventKind("connection.credential.set", Schema.Struct({
-	connection: ConnectionId,
-	org: SentryOrg,
-	region: SentryRegion
-}));
-/**
-* A signal, received by a connection: delivered to its webhook, by `ref0:hooks`, or sent with
-* `ref0 signal send` by the person or agent whose token sent it. `at` is when ref0 received it.
-* A title or link that failed its check is withheld, and says why in `withheld`; a title too long
-* is cut, and says so in `titleCut`. `dropped` counts the deliveries the connection dropped since
-* its last signal: over a bound, or refused. A delivery's ID, if the service gave one, is in the
-* envelope's `source` only as the SHA-256 of the connection and that ID.
-*/
-const SignalReceived = eventKind("signal.received", Schema.Struct({
-	connection: ConnectionId,
-	kind: SignalKind,
-	key: SignalKey,
-	title: Schema.optionalKey(TextId),
-	url: Schema.optionalKey(TextId),
-	withheld: Schema.optionalKey(SignalWithheld),
-	titleCut: Schema.optionalKey(Schema.Literal(true)),
-	dropped: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
-	at: Schema.DateTimeUtcFromMillis
-}));
-//#endregion
 //#region ../contracts/src/date-time.ts
 /** A UTC date decoded from a string and encoded in ISO format. */
 const Timestamp = Schema.DateTimeUtcFromString;
@@ -5257,6 +5543,11 @@ Schema.Struct({
 	/** For a child session: when its parent's token expires, which the child's never outlives. */
 	notAfter: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
 	/**
+	* The key the start request's proof was signed by, which the session's token is bound to: as
+	* the Worker checked the proof, never a field of the request. None for a start with no proof.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
+	/**
 	* The generations the session token pins, from the host grant that started it, or its parent;
 	* and in an organization's project, for a person's own agent, its attachment's authorization's
 	* and the agent's target generation there.
@@ -5371,8 +5662,26 @@ Schema.Union([
 	NotPermitted,
 	DeliveryOutsideWindow
 ]);
+/**
+* Where a session is, as a fork's URL names it: its owner, project, thread and numbers. With its
+* project's visibility, which a session's routes read who sees the project by.
+*/
+const SessionPlace = Schema.Struct({
+	owner: OwnerId,
+	project: ProjectId,
+	visibility: Visibility,
+	thread: ThreadId,
+	threadNumber: ThreadNumber,
+	session: SessionId,
+	number: SessionNumber,
+	/** Whether it's still going: not ended, and its lease not run out. */
+	live: Schema.Boolean
+});
 Schema.Struct({ session: SessionId });
-Schema.Struct({ live: Schema.Boolean });
+Schema.Union([Schema.Struct({
+	live: Schema.Literal(true),
+	place: SessionPlace
+}), Schema.Struct({ live: Schema.Literal(false) })]);
 Schema.Struct({
 	...commandFields,
 	project: ProjectId,
@@ -5439,6 +5748,11 @@ Schema.Struct({
 	session: SessionId,
 	pins: SessionPins,
 	expiresAt: Schema.DateTimeUtcFromMillis,
+	/**
+	* The key the session's start was signed by, which its token is bound to. A parent bound to a
+	* key is bound to this one, or the token isn't registered.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
 	cause: Schema.Struct({
 		log: ProjectId,
 		event: EventId
@@ -6379,8 +6693,8 @@ var ApprovalStale = class extends Schema.TaggedError()("ApprovalStale", { nextSt
 var PreviewNotReady = class extends Schema.TaggedError()("PreviewNotReady", { nextStep: Schema.String }, { httpApiStatus: 503 }) {};
 //#endregion
 //#region ../contracts/src/passkeys.ts
-const Base64Url = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]*$/));
-Schema.Struct({ challenge: Base64Url.check(Schema.isMinLength(1)) });
+const Base64Url$1 = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]*$/));
+Schema.Struct({ challenge: Base64Url$1.check(Schema.isMinLength(1)) });
 /** How a browser reaches a passkey's authenticator, as WebAuthn names it. */
 const PasskeyTransport = Schema.Literals([
 	"ble",
@@ -6392,7 +6706,7 @@ const PasskeyTransport = Schema.Literals([
 	"usb"
 ]);
 const CredentialDescriptor = Schema.Struct({
-	id: Base64Url,
+	id: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	transports: Schema.optionalKey(Schema.Array(PasskeyTransport))
 });
@@ -6403,11 +6717,11 @@ const PasskeyCreationOptions = Schema.Struct({
 		name: Schema.String
 	}),
 	user: Schema.Struct({
-		id: Base64Url,
+		id: Base64Url$1,
 		name: Schema.String,
 		displayName: Schema.String
 	}),
-	challenge: Base64Url,
+	challenge: Base64Url$1,
 	pubKeyCredParams: Schema.Array(Schema.Struct({
 		type: Schema.Literal("public-key"),
 		alg: Schema.Int
@@ -6446,23 +6760,23 @@ const PasskeyCreationOptions = Schema.Struct({
 * as its WebAuthn library leaves it.
 */
 const PasskeyCreated = Schema.Struct({
-	id: Base64Url,
-	rawId: Base64Url,
+	id: Base64Url$1,
+	rawId: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	response: Schema.Struct({
-		clientDataJSON: Base64Url,
-		attestationObject: Base64Url,
-		authenticatorData: Schema.optional(Base64Url),
+		clientDataJSON: Base64Url$1,
+		attestationObject: Base64Url$1,
+		authenticatorData: Schema.optional(Base64Url$1),
 		transports: Schema.optional(Schema.Array(PasskeyTransport)),
 		publicKeyAlgorithm: Schema.optional(Schema.Int),
-		publicKey: Schema.optional(Base64Url)
+		publicKey: Schema.optional(Base64Url$1)
 	}),
 	authenticatorAttachment: Schema.optional(Schema.Literals(["platform", "cross-platform"])),
 	clientExtensionResults: Schema.Struct({ credProps: Schema.optionalKey(Schema.Struct({ rk: Schema.optionalKey(Schema.Boolean) })) })
 });
 /** What ref0 hands a browser to answer with a passkey: WebAuthn's request options, as JSON. */
 const PasskeyRequestOptions = Schema.Struct({
-	challenge: Base64Url,
+	challenge: Base64Url$1,
 	timeout: Schema.optionalKey(Schema.Int),
 	rpId: Schema.optionalKey(Schema.String),
 	allowCredentials: Schema.optionalKey(Schema.Array(CredentialDescriptor)),
@@ -6482,14 +6796,14 @@ const PasskeyRequestOptions = Schema.Struct({
 * as JSON. A field the browser doesn't have may be missing, or there as `undefined`.
 */
 const PasskeyAsserted = Schema.Struct({
-	id: Base64Url,
-	rawId: Base64Url,
+	id: Base64Url$1,
+	rawId: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	response: Schema.Struct({
-		clientDataJSON: Base64Url,
-		authenticatorData: Base64Url,
-		signature: Base64Url,
-		userHandle: Schema.optional(Base64Url)
+		clientDataJSON: Base64Url$1,
+		authenticatorData: Base64Url$1,
+		signature: Base64Url$1,
+		userHandle: Schema.optional(Base64Url$1)
 	}),
 	authenticatorAttachment: Schema.optional(Schema.Literals(["platform", "cross-platform"])),
 	clientExtensionResults: Schema.Struct({})
@@ -6543,10 +6857,15 @@ const RequestFolder = Schema.Struct({
 	secretHash: SecretHash,
 	replaces: Schema.optionalKey(TokenId)
 });
-/** One to eight config folders, each with its own grant secret. */
+/**
+* One to eight config folders, each with its own grant secret, and the machine key its grants are
+* bound to: its public half, which a proof that key signed comes with. A request without one makes
+* grants bound to no key, as an older ref0 asks, until binding is required.
+*/
 const RequestAttachment = Schema.Struct({
 	machine: MachineId,
 	machineName: MachineName,
+	publicKey: Schema.optionalKey(PublicJwk),
 	folders: Schema.Array(RequestFolder).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
 	collectHash: SecretHash,
 	linkHash: SecretHash,
@@ -6740,6 +7059,7 @@ Schema.Struct({
 	request: ApprovalId,
 	machine: MachineId,
 	machineName: MachineName,
+	cnf: Schema.optionalKey(KeyBinding),
 	browserSession: TokenId,
 	personGeneration: Generation,
 	folders: Schema.Array(ConnectFolderCommand).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
@@ -10345,45 +10665,6 @@ Schema.Union([Schema.Struct({
 	found: Schema.Literal(true),
 	thread: ThreadId
 }), Schema.Struct({ found: Schema.Literal(false) })]);
-/**
-* ref0's one origin, as a client is given it: `http` or `https`, a host and maybe a port, and no
-* credentials, path, query or fragment. That pattern alone lets through a host or port no URL has,
-* such as `https://1.2.3.999`, `https://[1::2::3]` or `https://ref0.test:99999`, so the platform's own URL parser must take
-* it too. It's kept as written, case and any default port too: every path here is appended to it
-* as it is.
-*/
-const ApiOrigin = Schema.String.check(Schema.isPattern(/^https?:\/\/(?:\[[0-9A-Fa-f:.]+\]|[^\s/?#\\@:[\]]+)(?::\d+)?$/), Schema.makeFilter((origin) => URL.canParse(origin) || "a URL the platform can parse")).pipe(Schema.brand("ApiOrigin"));
-/** Where signing in's own routes live, which Better Auth serves, outside `Api`. */
-const signInBase = "/auth";
-/**
-* A route under `signInBase`, by its method: its `path` from the origin's root, as a request
-* names it, and its `pathUnderBase`, as Better Auth names its endpoints.
-*/
-const signInRoute = (method, pathUnderBase) => ({
-	method,
-	pathUnderBase,
-	path: `${signInBase}${pathUnderBase}`
-});
-/** Signing in with GitHub, from ref0's pages: starting it, GitHub's way back, and signing out. */
-const signInRoutes = {
-	gitHubSignIn: signInRoute("POST", "/sign-in/social"),
-	gitHubCallback: signInRoute("GET", "/callback/github"),
-	signOut: signInRoute("POST", "/sign-out")
-};
-/**
-* The OAuth server outside MCP clients use (layer 4, PR 11a): its metadata, authorizing, the
-* token endpoint, registering a public client and revoking a token.
-*/
-const oauthRoutes = {
-	metadata: signInRoute("GET", "/.well-known/oauth-authorization-server"),
-	authorize: signInRoute("GET", "/oauth2/authorize"),
-	token: signInRoute("POST", "/oauth2/token"),
-	register: signInRoute("POST", "/oauth2/register"),
-	revoke: signInRoute("POST", "/oauth2/revoke")
-};
-signInRoute("POST", "/oauth2/consent");
-[...Object.values(signInRoutes), ...Object.values(oauthRoutes)];
-`${oauthRoutes.metadata.pathUnderBase}`;
 //#endregion
 //#region ../contracts/src/live-calls.ts
 /**
@@ -11032,22 +11313,75 @@ const TurnTokens = Schema.Union([Schema.Struct({
 	known: Schema.Literal("read"),
 	models: Schema.Array(ModelTokens).check(Schema.isMaxLength(16), Schema.makeFilter((models) => new Set(models.map((each) => each.model)).size === models.length || "each model once"))
 }), Schema.Struct({ known: Schema.Literal("unknown") })]);
+const Name = Schema.String.check(Schema.isBetweenLength(1, 128));
+const Millis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/**
+* How long a turn's tool calls ran, summed, and its longest call, by tool: Claude Code's own
+* `duration_ms` for each, and, for Codex, whose hooks say none, from its `PreToolUse` to its
+* `PostToolUse` by `ref0 mcp`'s clock. Only calls that ended count: one with no end, as one a
+* `PreToolUse` answer denied or a Codex call cut short, isn't in it. `unknown`, never zero, when a
+* call that ended can't be timed, as one whose end says no time and whose start wasn't seen.
+*/
+const ToolTime = Schema.Union([Schema.Struct({
+	known: Schema.Literal("timed"),
+	totalMs: Millis,
+	/** None when the turn called no tool. */
+	longest: Schema.optionalKey(Schema.Struct({
+		tool: Name,
+		ms: Millis
+	}))
+}), Schema.Struct({ known: Schema.Literal("unknown") })]);
+/**
+* A compaction of the session's context during a turn: whether it was `auto` or `manual`, where
+* the harness says, as Claude Code does and Codex doesn't, and how long after ref0 started the
+* turn it happened, by the harness's own transcript, where both are known.
+*/
+const Compaction = Schema.Struct({
+	trigger: Schema.optionalKey(Schema.Literals(["auto", "manual"])),
+	afterMs: Schema.optionalKey(Millis)
+});
+/**
+* A turn's context, read from the session's own transcript as its tokens are: `peak`, the most
+* one request of the session's own sent, its cached tokens included, none for a turn with no
+* request, and each compaction. `unknown`, with neither, where the transcript wasn't read whole.
+* A subagent's context is its own, and isn't in it.
+*/
+const TurnContext = Schema.Union([Schema.Struct({
+	known: Schema.Literal("read"),
+	peak: Schema.optionalKey(TokenCount),
+	compactions: Schema.Array(Compaction).check(Schema.isMaxLength(100))
+}), Schema.Struct({ known: Schema.Literal("unknown") })]);
 /**
-* A turn's facts but its tokens, which `TurnFacts` adds for whoever sends them and `turn.ended`
-* carries only to those who may see them.
+* One of the harness's own subagents that a turn ran, such as Claude Code's Task agents or
+* Codex's: its type, where the harness names one, and its own tokens, which the turn's tokens
+* already include, so the turn's less its subagents' are the session's own. Its tokens, and the
+* turn's, are `unknown` when the harness kept no transcript of it. Not a child session: ref0
+* knows it only from its `SubagentStop` and its transcript.
+*/
+const TurnSubagent = Schema.Struct({
+	type: Schema.optionalKey(Name),
+	tokens: TurnTokens
+});
+/**
+* A turn's facts but its tokens and its subagents', which `TurnFacts` adds for whoever sends them
+* and `turn.ended` carries only to those who may see them.
 */
 const turnFactsFields = {
 	/** The turn's model, where the harness said it: Codex in every hook. */
-	model: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 128))),
+	model: Schema.optionalKey(Name),
 	modelSource: ModelSource,
 	/** Tool calls by tool name. */
-	tools: Schema.Record(Schema.String.check(Schema.isBetweenLength(1, 128)), Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))).check(Schema.makeFilter((tools) => Object.keys(tools).length <= 100 || "at most 100 tools")),
+	tools: Schema.Record(Name, Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))).check(Schema.makeFilter((tools) => Object.keys(tools).length <= 100 || "at most 100 tools")),
 	/** The files its edits touched, by repo and path, at most 50; `more` counts the rest. */
 	addresses: Schema.Array(Schema.Struct({
 		repo: RepoName,
 		path: RepoPath
 	})).check(Schema.isMaxLength(50)),
-	more: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+	more: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	toolTime: ToolTime,
+	context: TurnContext,
+	/** How many subagents past the first 100 the turn ran. */
+	moreSubagents: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
 };
 /**
 * What `ref0 mcp` saw of a turn, sent at its `Stop`s and when the next one starts, and again as
@@ -11059,16 +11393,23 @@ const turnFactsFields = {
 const TurnFacts = Schema.Struct({
 	...turnFactsFields,
 	tokens: TurnTokens,
-	stoppedAfterMs: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+	/** The turn's subagents, in the order their transcripts were first read, at most 100. */
+	subagents: Schema.Array(TurnSubagent).check(Schema.isMaxLength(100)),
+	stoppedAfterMs: Schema.optionalKey(Millis)
 });
 /**
-* A turn's facts as `turn.ended` shows them: its tokens only to an admin of the project's owner
-* and to the session's accountable person. A thread's totals still go to every reader of it, in
-* `ThreadUsage`, so on a thread with one person's sessions they are that person's usage.
+* A turn's facts as `turn.ended` shows them: its tokens and its subagents' only to an admin of
+* the project's owner and to the session's accountable person. A thread's totals still go to
+* every reader of it, in `ThreadUsage`, so on a thread with one person's sessions they are that
+* person's usage.
 */
 const EndedTurnFacts = Schema.Struct({
 	...turnFactsFields,
-	tokens: Schema.optionalKey(TurnTokens)
+	tokens: Schema.optionalKey(TurnTokens),
+	subagents: Schema.Array(Schema.Struct({
+		type: TurnSubagent.fields.type,
+		tokens: Schema.optionalKey(TurnTokens)
+	})).check(Schema.isMaxLength(100))
 });
 /**
 * `POST /v1/sessions/{session}/turns`: a new turn, for the harness's own turn ID, so a retry, or
@@ -11696,151 +12037,6 @@ Schema.Struct({
 		name: RepoName
 	}))
 });
-/** Where an agent's session asks for an identity token. */
-const identityTokenPath = "/v1/me/identity-token";
-/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
-const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
-/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
-const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
-/**
-* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
-* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
-* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
-*/
-const parsesAsWritten = (audience) => {
-	const parts = audiencePattern.exec(audience);
-	if (parts === null || !URL.canParse(audience)) return false;
-	const url = new URL(audience);
-	const port = parts[2] ?? "";
-	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
-};
-/**
-* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
-* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
-* case and any port too, so `https://verifier.example:443` is another audience than
-* `https://verifier.example`. ref0 never fetches or resolves it.
-*/
-const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
-/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
-const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
-/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
-const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
-/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
-const IssuedIdentityToken = Schema.Struct({
-	token: IdentityToken,
-	expiresAt: Schema.DateTimeUtcFromMillis
-});
-/**
-* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
-* token, naming its issuance in ref0's log without naming any row or secret.
-*/
-const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
-/**
-* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
-* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
-* audience, different at every other, and carrying no time.
-*/
-const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
-/** A session, as one audience knows it, made as a person's is. */
-const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
-/** The accountable person, last in a token's chain: only their pairwise ID. */
-const PersonActor = Schema.Struct({ sub: PairwisePersonId });
-/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
-const sessionActing = (act) => Schema.Struct({
-	sub: PairwiseSessionId,
-	act
-});
-const oneSession = sessionActing(PersonActor);
-const twoSessions = sessionActing(oneSession);
-const threeSessions = sessionActing(twoSessions);
-/**
-* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
-* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
-* allows the agent in `sub`, never an actor.
-*/
-const IdentityActor = Schema.Union([
-	oneSession,
-	twoSessions,
-	threeSessions,
-	sessionActing(threeSessions)
-]);
-/** A time in a token, in whole UTC epoch seconds. */
-const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
-Schema.Struct({
-	iss: ApiOrigin,
-	sub: AgentId,
-	aud: IdentityAudience,
-	iat: EpochSeconds,
-	exp: EpochSeconds,
-	jti: IdentityTokenId,
-	act: IdentityActor
-}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
-/**
-* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
-* never names two keys.
-*/
-const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
-Schema.Struct({
-	alg: Schema.Literal("ES256"),
-	kid: SigningKeyId,
-	typ: Schema.Literal("JWT")
-});
-/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
-const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
-/** One public key in the JWKS: exactly these fields, and never a private one. */
-const PublicSigningKey = Schema.Struct({
-	kty: Schema.Literal("EC"),
-	crv: Schema.Literal("P-256"),
-	x: Coordinate,
-	y: Coordinate,
-	use: Schema.Literal("sig"),
-	alg: Schema.Literal("ES256"),
-	kid: SigningKeyId
-});
-Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
-Schema.Struct({
-	issuer: ApiOrigin,
-	jwks_uri: Schema.String,
-	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
-	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
-	claims_supported: Schema.Tuple([
-		Schema.Literal("iss"),
-		Schema.Literal("sub"),
-		Schema.Literal("aud"),
-		Schema.Literal("exp"),
-		Schema.Literal("iat"),
-		Schema.Literal("jti"),
-		Schema.Literal("act")
-	])
-});
-/**
-* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
-* `IdentityAudience` says. The refused text is never echoed.
-*/
-var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
-/**
-* Less than a whole second is left before the session, a parent or the credential expires, or
-* the token would expire before it's recorded: the next prompt renews or replaces the session.
-*/
-var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
-/**
-* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
-* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
-* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
-* received or used it. A failed append discards the token, so every token has its event.
-*/
-const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
-	session: SessionId,
-	agent: AgentRef,
-	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
-	accountable: PersonId,
-	jti: IdentityTokenId,
-	audience: IdentityAudience,
-	issuer: ApiOrigin,
-	keyId: SigningKeyId,
-	issuedAt: Schema.DateTimeUtcFromMillis,
-	expiresAt: Schema.DateTimeUtcFromMillis
-}));
 Schema.Literals([
 	"info/refs",
 	"git-upload-pack",
@@ -11868,6 +12064,11 @@ Schema.Union([
 Schema.Struct({
 	reader: Reader,
 	name: RepoName,
+	/**
+	* For a fork's path, the scope it names: a project, by its ID or its name, or, with none, the
+	* owner's own scope, which holds an organization's org threads.
+	*/
+	scope: Schema.optionalKey(Schema.Struct({ project: Schema.optionalKey(ProjectRef) })),
 	push: Schema.optionalKey(Schema.Struct({
 		thread: ThreadId,
 		session: SessionId
@@ -11881,7 +12082,9 @@ const GitTarget = Schema.Struct({
 	* their sessions' forks, and the repo's `main`. Unset for one that reads the repo's project as
 	* a whole.
 	*/
-	threads: Schema.optionalKey(Schema.Array(ThreadId))
+	threads: Schema.optionalKey(Schema.Array(ThreadId)),
+	/** For a fork's path, the project its scope resolved to: a project's, or the owner's own. */
+	scope: Schema.optionalKey(ProjectId)
 });
 Schema.Union([GitTarget, RepoNotFound]);
 /** A repo whose baseline isn't readable yet: Git is told to try again in a few seconds. */
@@ -11892,28 +12095,6 @@ const CurrentBaseline = Schema.Struct({
 	name: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/))
 });
 Schema.Union([CurrentBaseline, RepoNotReady]);
-//#endregion
-//#region ../contracts/src/fork-calls.ts
-/**
-* A session's fork of a repo: its own copy, made in the background from the repo's current
-* baseline when the session first reaches the repo. Agents push only to their own session's
-* forks. A fork isn't deleted yet: when it may be, and what's saved first, waits for the user.
-*/
-/**
-* Where a session is, as a fork's URL names it: its owner, project, thread and numbers. With its
-* project's visibility, which a session's routes read who sees the project by.
-*/
-const SessionPlace = Schema.Struct({
-	owner: OwnerId,
-	project: ProjectId,
-	visibility: Visibility,
-	thread: ThreadId,
-	threadNumber: ThreadNumber,
-	session: SessionId,
-	number: SessionNumber,
-	/** Whether it's still going: not ended, and its lease not run out. */
-	live: Schema.Boolean
-});
 Schema.Struct({ session: SessionId });
 Schema.Union([SessionPlace, SessionNotFound]);
 Schema.Struct({
@@ -14579,7 +14760,10 @@ const HistoryPack = Schema.Struct({
 		first: MergeSequence,
 		last: MergeSequence
 	})),
-	/** A baseline or deepen pack: the baseline it belongs to. After a rebuild, a retired baseline's sessions still deepen from its own chain. */
+	/**
+	* A baseline, deepen or rolled-up pack: the baseline it belongs to. After a rebuild, a retired
+	* baseline's sessions still deepen from its own chain, and its rollups hold nothing of the new one's.
+	*/
 	baseline: Schema.optionalKey(GitRepositoryId),
 	/** A deepen pack: how deep its baseline reaches with it and every pack before it. */
 	depth: Schema.optionalKey(Depth),
@@ -15208,23 +15392,30 @@ Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
 	generation: AttachedSoFar
 })]);
 Context.Service()("ref0/contracts/Caller");
+Context.Service()("ref0/contracts/ProvedKey");
 /** A browser session's cookie, as `/v1` reads it. */
 const browserSession = HttpApiSecurity.apiKey({
 	in: "cookie",
 	key: browserSessionCookie
 });
 /**
-* Every endpoint's credential, checked before its handler runs: a bearer token, or a browser
-* session's cookie. A request with both is refused before it gets here.
+* Every endpoint's credential, checked before its handler runs: a bearer token, a token bound to
+* a key with a proof that key signed (`Authorization: DPoP` and one `DPoP` header), or a browser
+* session's cookie. A request with a cookie and a token is refused before it gets here. Its
+* handler learns who's acting, and the key its proof was signed by, if it came with one, which a
+* session's start binds the session to. A client that signs proofs may fail before it sends
+* anything, when its key store doesn't sign.
 */
 var Authorization = class extends HttpApiMiddleware.Service()("ref0/contracts/Authorization", {
 	requiredForClient: true,
 	security: {
 		bearer: HttpApiSecurity.bearer,
+		dpop: HttpApiSecurity.http({ scheme: "DPoP" }),
 		browserSession
 	},
 	error: [
 		Unauthenticated,
+		InvalidDpopProof,
 		SessionHasEnded,
 		AuthorityUnavailable
 	]
@@ -15256,6 +15447,17 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
 /**
+* A request with no credential, signed by a key it names, such as a machine's ask to connect: one
+* `DPoP` header, a proof with no `ath`, since there's no token, checked before the request is
+* read, which says the key that signed it; or no proof, which says none. Every client supplies
+* it, as it does `Authorization`, so its key store's failure, before anything is sent, is typed:
+* one with a key store signs, and every other sends no proof.
+*/
+var KeyProof = class extends HttpApiMiddleware.Service()("ref0/contracts/KeyProof", {
+	requiredForClient: true,
+	error: InvalidDpopProof
+}) {};
+/**
 * An identity token's request whose audience its contract refuses, missing or not an HTTPS
 * origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
 */
@@ -15370,8 +15572,9 @@ var AttachmentsGroup = class extends HttpApiGroup.make("attachments").add(HttpAp
 })).middleware(Authorization) {};
 /**
 * Connecting a machine, the machine's side: asking, with no credential, to connect to one owner's
-* agent, whose terminal shows the code their person types; then collecting what came of it,
-* confirming it saved the grant, or aborting, with its collecting secret.
+* agent, whose terminal shows the code their person types, signed by the machine key it names;
+* then collecting what came of it, confirming it saved the grant, or aborting, with its collecting
+* secret, which needs no proof: a grant it collects is bound to the key its ask named.
 */
 var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachments").add(HttpApiEndpoint.post("request", "/v1/attachments/requests", {
 	headers: idempotency,
@@ -15381,9 +15584,10 @@ var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachment
 		NotPermitted,
 		CommandRefused,
 		SlowDown,
+		InvalidDpopProof,
 		AuthorityUnavailable
 	]
-}).middleware(MachineNameRefusal), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
+}).middleware(MachineNameRefusal).middleware(KeyProof), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
 	params: { approval: ApprovalId },
 	payload: Schema.Struct({ answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64))) }),
 	success: RequestState,
@@ -18857,6 +19061,8 @@ const HookArguments = Schema.Struct({
 	tool_input: ToolValue,
 	tool_response: ToolValue,
 	error: Field,
+	/** How long the tool ran, in milliseconds, at Claude Code's `PostToolUse` and its failure. */
+	duration_ms: Field,
 	/** A string from Claude Code, a boolean from Codex, which keeps a placeholder's JSON type. */
 	stop_hook_active: Schema.optionalKey(Schema.Union([Schema.Boolean, Schema.String])),
 	/** Codex names the turn's model in every hook but `SessionEnd`. */
@@ -19001,14 +19207,146 @@ const projectPage = (page, project) => page.replace("/$owner/$project", `/${proj
 * credential it sends, a bearer token or a browser session.
 */
 const ref0Client = (origin) => HttpApiClient.make(Api, origin === void 0 ? {} : { baseUrl: origin });
+/** No proof of a key for a request that asks for one: a client with no key store's. */
+const noKeyProof = HttpApiMiddleware.layerClient(KeyProof, ({ request, next }) => next(request));
 /** A bearer token: an agent's credential, sent with every request. */
-const bearerCredential = (token) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(HttpClientRequest.bearerToken(request, token))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+const bearerCredential = (token) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(HttpClientRequest.bearerToken(request, token))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
 /** No credential: a terminal asking its person, which sends nothing of theirs. */
-const anonymousCredential = Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+const anonymousCredential = Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
 FetchHttpClient.layer;
 //#endregion
+//#region ../sdk/src/client/proofs.ts
+/**
+* How far ref0's clock is ahead of this machine's, in milliseconds, as the `Date` of a refused
+* proof's answer said: provided once for a process, so every proof it signs after is dated by it.
+*/
+var ProofClock = class ProofClock extends Context.Service()("ref0/sdk/ProofClock") {
+	static layer = Layer.effect(ProofClock, Effect.map(Ref.make(0), (offset) => ProofClock.of({ offset })));
+};
+/** How far apart the two clocks may be before a refused proof is signed again by ref0's. */
+const clockSkewMillis = 5e3;
+const encodeHeader = Schema.encodeSync(Schema.fromJsonString(DpopProofHeader));
+const encodeClaims = Schema.encodeSync(Schema.fromJsonString(DpopProofClaims));
+const decodeProofId = Schema.decodeSync(DpopProofId);
+const utf8 = new TextEncoder();
+/** A fresh UUIDv4 from the platform's cryptographic source, a proof's `jti`. */
+const freshProofId = Effect.sync(() => {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	bytes[6] = 64 | (bytes[6] ?? 0) & 15;
+	bytes[8] = 128 | (bytes[8] ?? 0) & 63;
+	const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return decodeProofId(`${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`);
+});
+const decodeThumbprint = Schema.decodeSync(KeyThumbprint);
+/**
+* RFC 7638's thumbprint of a P-256 public key: the SHA-256 of its required members, in order, as
+* JSON, in base64url. What a credential bound to the key names it by, as `cnf.jkt`.
+*/
+const keyThumbprint = (jwk) => Effect.promise(async () => decodeThumbprint(Base64Url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8.encode(`{"crv":"P-256","kty":"EC","x":"${jwk.x}","y":"${jwk.y}"}`))))));
+/** `ath`: the SHA-256 of the whole token, in base64url. */
+const tokenHashOf = (token) => Effect.promise(async () => Base64Url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8.encode(token)))));
+/**
+* A proof for one attempt at a request: its method, and its URL as built, with no query or
+* fragment; dated by this machine's clock, moved by `offset`; with the token's hash, if it's sent
+* with one; signed by the store.
+*/
+const proofFor = Effect.fnUntraced(function* (store, attempt, offset) {
+	const now = (yield* Clock.currentTimeMillis) + offset;
+	const header = encodeHeader({
+		typ: "dpop+jwt",
+		alg: "ES256",
+		jwk: store.publicKey
+	});
+	const signs = {
+		jti: yield* freshProofId,
+		htm: attempt.method,
+		htu: `${attempt.url.origin}${attempt.url.pathname}`,
+		iat: Math.floor(now / 1e3)
+	};
+	if (attempt.token !== void 0) signs.ath = yield* tokenHashOf(attempt.token);
+	const claims = encodeClaims(signs);
+	const signed = `${Base64Url.encode(header)}.${Base64Url.encode(claims)}`;
+	const signature = yield* store.sign(utf8.encode(signed));
+	if (signature.byteLength !== 64) return yield* Effect.die("a key store answers r||s, 64 bytes");
+	return `${signed}.${Base64Url.encode(signature)}`;
+});
+/**
+* How far ref0's clock was from this machine's, moved by `offset`, by a refused proof's answer:
+* none for any other answer, or one without a `Date`.
+*/
+const skewOf = (response, local) => {
+	const challenge = response.headers["www-authenticate"] ?? "";
+	if (response.status !== 401 || !challenge.includes("DPoP error=\"invalid_dpop_proof\"")) return Option.none();
+	return Option.map(DateTime.make(response.headers["date"] ?? ""), (date) => DateTime.toEpochMillis(date) - local);
+};
+/**
+* Sends one request, with its credential if it has one, signing each attempt afresh: once, and
+* once more, by ref0's clock, after a refused proof whose answer is dated more than five seconds
+* from this machine's. The process keeps the offset for every proof after.
+*/
+const signedAttempts = (credential, offsetRef) => ({ request, next }) => Effect.gen(function* () {
+	const token = credential.token === void 0 ? void 0 : Redacted.value(credential.token);
+	const attempt = {
+		method: request.method,
+		url: new URL(`${credential.origin}${request.url}`),
+		token
+	};
+	const redacted = [...yield* Effect.service(Headers.CurrentRedactedNames), "dpop"];
+	const send = (offset) => proofFor(credential.store, attempt, offset).pipe(Effect.map((proof) => HttpClientRequest.setHeaders(request, token === void 0 ? { dpop: proof } : {
+		authorization: `DPoP ${token}`,
+		dpop: proof
+	})), Effect.flatMap(next), Effect.provideService(Headers.CurrentRedactedNames, redacted));
+	const offset = yield* Ref.get(offsetRef);
+	const answer = yield* send(offset);
+	const skew = skewOf(answer, (yield* Clock.currentTimeMillis) + offset);
+	if (Option.isNone(skew) || Math.abs(skew.value) <= clockSkewMillis) return answer;
+	yield* Effect.ignore(answer.text);
+	yield* Ref.set(offsetRef, offset + skew.value);
+	return yield* send(offset + skew.value);
+});
+/**
+* A token bound to a key, sent as `Authorization: DPoP` with a proof its key store signs afresh
+* for each attempt. Signing in's own endpoints take no token.
+*/
+const dpopCredential = (credential) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, Effect.map(Effect.service(ProofClock), (clock) => signedAttempts(credential, clock.offset))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
+/**
+* ref0's `/v1` as a typed client at a bound credential's origin, sending its token with a proof
+* its key store signs for each attempt. The client is made at the origin its proofs name, so
+* neither the token nor a proof is sent anywhere else. It needs the process's `ProofClock`. A
+* request's trace redacts its proof, but an error it fails with still holds the request: a
+* program that logs errors adds `dpop` to `Headers.CurrentRedactedNames` at its root.
+*/
+const boundClient = (credential) => ref0Client(credential.origin).pipe(Effect.provide(dpopCredential(credential)));
+/**
+* A bound credential's requests made by hand, each with a path under its origin, such as a
+* command built from its endpoint's route: sent there with its token and a proof its key store
+* signs afresh for each attempt, as `boundClient` sends its own, and never anywhere else. It needs
+* the process's `ProofClock`, and its errors hold their requests, as `boundClient`'s do.
+*/
+const boundSend = (credential) => Effect.gen(function* () {
+	const http = yield* HttpClient.HttpClient;
+	const clock = yield* ProofClock;
+	const attempts = signedAttempts(credential, clock.offset);
+	return (request) => attempts({
+		request,
+		next: (signed) => http.execute(HttpClientRequest.prependUrl(signed, credential.origin))
+	});
+});
+/**
+* A request with no credential, signed by the key it names, such as a machine's ask to connect:
+* a proof its key store signs for each attempt, with no `ath`, since there's no token. Any other
+* request is sent with nothing added.
+*/
+const keyProof = (signer) => Layer.mergeAll(HttpApiMiddleware.layerClient(KeyProof, Effect.map(Effect.service(ProofClock), (clock) => signedAttempts(signer, clock.offset))), HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+/**
+* ref0's `/v1` as a typed client at a key's origin, with no credential, signing each request that
+* asks for a proof, such as a machine's ask to connect, with the key its store holds. It needs the
+* process's `ProofClock`, and its errors still hold their requests, as `boundClient`'s do.
+*/
+const provingClient = (signer) => ref0Client(signer.origin).pipe(Effect.provide(keyProof(signer)));
+//#endregion
 //#region ../sdk/src/client/request-id.ts
-const decodeRequestId$1 = Schema.decodeUnknownEffect(RequestId);
+const decodeRequestId = Schema.decodeUnknownEffect(RequestId);
 /**
 * A new delivery ID, for a request that changes something's `Idempotency-Key`: a UUIDv7 from the
 * clock and ten random bytes, so a retry sends the same one and gets the first answer.
@@ -19017,7 +19355,7 @@ const newRequestId = Effect.gen(function* () {
 	const millis = yield* Clock.currentTimeMillis;
 	const random = /* @__PURE__ */ new Uint8Array(10);
 	for (let index = 0; index < random.length; index += 1) random[index] = yield* Random.nextIntBetween(0, 255);
-	return yield* Effect.orDie(decodeRequestId$1(`request_${encodeSuffix(uuidV7(millis, random))}`));
+	return yield* Effect.orDie(decodeRequestId(`request_${encodeSuffix(uuidV7(millis, random))}`));
 });
 //#endregion
 //#region src/sha256.ts
@@ -19088,6 +19426,317 @@ var Ref0Config = class Ref0Config extends Context.Service()("ref0/cli/Ref0Config
 	})).pipe(Layer.provide(NodeServices.layer));
 };
 //#endregion
+//#region src/keychain.ts
+/**
+* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
+* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
+* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
+* an argument, since any process on the machine can read another's arguments.
+*/
+var KeychainError = class extends Schema.TaggedError()("KeychainError", {
+	nextStep: Schema.String,
+	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
+	unreadable: Schema.optionalKey(Schema.Literal(true))
+}) {};
+/**
+* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
+* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
+*/
+const keychainIn = Effect.fnUntraced(function* (service) {
+	const crypto = yield* Crypto.Crypto;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
+	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
+	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
+	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
+		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
+		const code = yield* handle.exitCode;
+		return {
+			output: output.trim(),
+			complaint: complaint.trim(),
+			code,
+			succeeded: code === ChildProcessSpawner.ExitCode(0)
+		};
+	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
+	const get = Effect.fn("Keychain.get")(function* (account) {
+		const found = macOS ? yield* run("security", [
+			"find-generic-password",
+			"-s",
+			service,
+			"-a",
+			account,
+			"-w"
+		], "") : yield* run("secret-tool", [
+			"lookup",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
+		if (macOS) {
+			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
+			return yield* unavailable;
+		}
+		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
+		const listed = yield* run("secret-tool", [
+			"search",
+			"--all",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
+		return Option.none();
+	});
+	const set = Effect.fn("Keychain.set")(function* (account, secret) {
+		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
+		const value = Redacted.value(secret);
+		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
+		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
+		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
+		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
+			"store",
+			"--label",
+			`ref0 ${account}`,
+			"service",
+			service,
+			"account",
+			account
+		], Redacted.value(secret))).succeeded) return yield* unavailable;
+	});
+	const remove = Effect.fn("Keychain.remove")(function* (account) {
+		if (!(yield* macOS ? run("security", [
+			"delete-generic-password",
+			"-s",
+			service,
+			"-a",
+			account
+		], "") : run("secret-tool", [
+			"clear",
+			"service",
+			service,
+			"account",
+			account
+		], "")).succeeded) return yield* unavailable;
+	});
+	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
+	return {
+		probe: Effect.gen(function* () {
+			const account = `connect-probe/${yield* random}`;
+			const value = Redacted.make(yield* random);
+			yield* Effect.gen(function* () {
+				yield* set(account, value);
+				const kept = yield* get(account);
+				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
+				yield* remove(account);
+			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
+		}).pipe(Effect.timeoutOrElse({
+			duration: Duration.minutes(1),
+			orElse: () => Effect.fail(unavailable)
+		})),
+		get,
+		set,
+		remove
+	};
+});
+var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
+	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
+};
+//#endregion
+//#region src/machine-key.ts
+/**
+* This machine's key, which signs a proof for its ask to connect and for each request a host
+* grant makes: one ES256 key for each OS account and origin, in the origin's keychain service
+* under account `machine-key`, as `{ store: 'software', jwk }`. `ref0 connect` makes it, under its
+* lock, only when the keychain says it holds none, and nothing else makes one. A process reads it
+* once and keeps it, since each read is a `security` or `secret-tool` process. Its private half
+* goes to the keychain on stdin and into a Web Crypto key that can't be exported, and nowhere
+* else: no argument, environment, config, error or log.
+*/
+/** The keychain account the key is kept under. */
+const account = "machine-key";
+/** How long reading and importing the key may take for a request, and signing with it. */
+const deadline = Duration.seconds(3);
+/**
+* How long `ref0 connect` may wait on the keychain to read, make and keep the key, as its probe
+* may: a prompt to unlock the keychain can take that long.
+*/
+const connectDeadline = Duration.minutes(1);
+/** A P-256 coordinate or private scalar: 32 bytes, in base64url. */
+const Scalar = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+/** A P-256 private key as a JWK: its public point, and its private scalar `d`. */
+const PrivateJwk = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Scalar,
+	y: Scalar,
+	d: Scalar
+});
+/** The keychain's record: which store keeps the key, and the key. A hardware store keeps its own. */
+const KeptKey = Schema.Struct({
+	store: Schema.Literal("software"),
+	jwk: PrivateJwk
+});
+const decodeKept$3 = Schema.decodeUnknownOption(Schema.fromJsonString(KeptKey));
+const encodeKept$3 = Schema.encodeSync(Schema.fromJsonString(KeptKey));
+const decodePrivateJwk = Schema.decodeUnknownEffect(PrivateJwk);
+const decodePublicJwk = Schema.decodeSync(PublicJwk);
+const ecdsa = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+const es256 = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** What a key signs to prove it signs for its public half. */
+const proved = new TextEncoder().encode("ref0 machine key");
+const timedOut = new KeychainError({ nextStep: "The keychain didn’t answer in time. Check that it’s unlocked, and try again." });
+const unreadable$1 = new KeychainError({ nextStep: "ref0 can’t read this machine’s key in the keychain, so it signs nothing and makes no other. Update ref0, which may have kept it in a newer form, or repair the keychain, and try again." });
+const notKept = new KeychainError({ nextStep: "The keychain didn’t keep this machine’s key. Check that it’s unlocked, then run ref0 connect again." });
+const windows = new KeychainError({ nextStep: "ref0 connect doesn’t run on Windows yet: it keeps this machine’s key in the macOS keychain or a Linux secret service. Run it in WSL instead." });
+const didNotSign = new KeyStoreUnavailable({ nextStep: "This machine’s key didn’t sign in time. Try again." });
+/** A fresh key's private JWK, with only the members the record keeps. */
+const freshKey = Effect.promise(async () => {
+	const pair = await crypto.subtle.generateKey(ecdsa, true, ["sign", "verify"]);
+	return await crypto.subtle.exportKey("jwk", pair.privateKey);
+}).pipe(Effect.flatMap(({ kty, crv, x, y, d }) => decodePrivateJwk({
+	kty,
+	crv,
+	x,
+	y,
+	d
+})), Effect.orDie);
+/**
+* A key store over a private JWK: imported once, as a key that can't be exported, and proved to
+* sign for its public half, or it's no key to bind anything to.
+*/
+const softwareStore = Effect.fnUntraced(function* (jwk) {
+	const publicKey = decodePublicJwk({
+		kty: jwk.kty,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y
+	});
+	const signs = yield* Effect.tryPromise({
+		try: async () => {
+			const [signing, verifying] = await Promise.all([crypto.subtle.importKey("jwk", jwk, ecdsa, false, ["sign"]), crypto.subtle.importKey("jwk", publicKey, ecdsa, false, ["verify"])]);
+			const signature = await crypto.subtle.sign(es256, signing, proved);
+			return await crypto.subtle.verify(es256, verifying, signature, proved) ? signing : void 0;
+		},
+		catch: () => unreadable$1
+	});
+	if (signs === void 0) return yield* unreadable$1;
+	const sign = (bytes) => Effect.tryPromise({
+		try: async () => new Uint8Array(await crypto.subtle.sign(es256, signs, new Uint8Array(bytes))),
+		catch: () => didNotSign
+	}).pipe(Effect.timeoutOrElse({
+		duration: deadline,
+		orElse: () => Effect.fail(didNotSign)
+	}));
+	return {
+		store: {
+			publicKey,
+			sign
+		},
+		binding: { jkt: yield* keyThumbprint(publicKey) }
+	};
+});
+/**
+* This machine's key, read once for the process. `supported` refuses a platform with no keychain
+* that keeps it, such as Windows, before `ref0 connect` asks the keychain anything. `ensure` is
+* `ref0 connect`'s: the key the keychain holds, or one made and kept now if it says it holds none,
+* under the connect lock, once the keychain is probed. `boundTo` is for a kept
+* credential bound to a key: the key it names, read again once if the one held is another, such
+* as one replaced since, or `InvalidDpopProof`, without sending anything, when the keychain has
+* none or another. Neither makes a key from an item it can't read.
+*/
+var MachineKey = class MachineKey extends Context.Service()("ref0/cli/MachineKey") {
+	/** On the platform Node names, such as `win32`, where no keychain keeps the key yet. */
+	static layerOn = (platform) => Layer.effect(MachineKey, Effect.gen(function* () {
+		const keychain = yield* Keychain;
+		const held = yield* Ref.make(Option.none());
+		const reading = yield* Semaphore.make(1);
+		const read = Effect.gen(function* () {
+			const kept = yield* keychain.get(account);
+			if (Option.isNone(kept)) return Option.none();
+			const record = decodeKept$3(Redacted.value(kept.value));
+			if (Option.isNone(record)) return yield* unreadable$1;
+			const key = yield* softwareStore(record.value.jwk);
+			yield* Ref.set(held, Option.some(key));
+			return Option.some(key);
+		});
+		const made = Effect.gen(function* () {
+			const jwk = yield* freshKey;
+			yield* keychain.set(account, Redacted.make(encodeKept$3({
+				store: "software",
+				jwk
+			})));
+			const back = yield* read;
+			const same = Option.exists(back, (key) => key.store.publicKey.x === jwk.x && key.store.publicKey.y === jwk.y);
+			if (Option.isNone(back) || !same) return yield* notKept;
+			return back.value;
+		});
+		const supported = platform === "win32" ? Effect.fail(windows) : Effect.void;
+		const ensure = Effect.gen(function* () {
+			const kept = yield* read;
+			return Option.isSome(kept) ? kept.value : yield* made;
+		}).pipe(Effect.timeoutOrElse({
+			duration: connectDeadline,
+			orElse: () => Effect.fail(timedOut)
+		}), reading.withPermits(1));
+		const boundTo = (binding) => Effect.gen(function* () {
+			const now = yield* Ref.get(held);
+			if (Option.isSome(now) && now.value.binding.jkt === binding.jkt) return now.value.store;
+			const kept = yield* read.pipe(Effect.timeoutOrElse({
+				duration: deadline,
+				orElse: () => Effect.fail(timedOut)
+			}));
+			if (Option.isSome(kept) && kept.value.binding.jkt === binding.jkt) return kept.value.store;
+			return yield* invalidDpopProof;
+		}).pipe(reading.withPermits(1));
+		return MachineKey.of({
+			supported,
+			ensure,
+			boundTo
+		});
+	}));
+	static layer = MachineKey.layerOn(process.platform);
+};
+//#endregion
+//#region src/kept-client.ts
+const decodeProofOrigin$1 = Schema.decodeUnknownEffect(ProofOrigin);
+/** A bound credential: its token, at ref0's origin, with the key it's bound to, read once. */
+const boundTo = Effect.fnUntraced(function* (kept, cnf) {
+	const config = yield* Ref0Config;
+	const store = yield* (yield* MachineKey).boundTo(cnf);
+	return {
+		origin: yield* Effect.orDie(decodeProofOrigin$1(config.api)),
+		store,
+		token: kept.token
+	};
+});
+/** ref0's `/v1` as a typed client acting with a kept credential. */
+const keptClient = Effect.fnUntraced(function* (kept) {
+	if (kept.cnf === void 0) {
+		const config = yield* Ref0Config;
+		return yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(kept.token)));
+	}
+	return yield* boundClient(yield* boundTo(kept, kept.cnf));
+});
+/** Requests made by hand, each with a path under ref0's origin, sent with a kept credential. */
+const keptSend = Effect.fnUntraced(function* (kept) {
+	if (kept.cnf === void 0) {
+		const config = yield* Ref0Config;
+		const http = yield* HttpClient.HttpClient;
+		return (request) => http.execute(HttpClientRequest.prependUrl(HttpClientRequest.bearerToken(request, kept.token), config.api));
+	}
+	return yield* boundSend(yield* boundTo(kept, kept.cnf));
+});
+//#endregion
 //#region src/secret.ts
 const hashed = (secret) => Effect.gen(function* () {
 	const digest = yield* Effect.promise(async () => await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret)));
@@ -19290,15 +19939,36 @@ const sayFailed = (words) => printBlocks(Predicate.isString(words) ? [[words]] :
 //#endregion
 //#region src/session.ts
 /**
+* A session's credential as this machine keeps it, in one keychain write: its token, its
+* session, the key it's bound to, if it is, and the host grant its chain started from, by its
+* ID, so a grant kept since tells whether it's the one that started it.
+*/
+const KeptSession = Schema.Struct({
+	token: Schema.RedactedFromValue(Schema.String),
+	session: SessionId,
+	/** This machine's key, by its thumbprint, when ref0 bound the session to it. */
+	cnf: Schema.optional(KeyBinding),
+	hostGrant: CredentialRef
+});
+const decodeKeptSession = Schema.decodeUnknownOption(Schema.fromJsonString(KeptSession));
+const encodeKeptSession = Schema.encodeSync(Schema.fromJsonString(KeptSession));
+/**
+* A kept session's record, from the keychain's value: none for one this ref0 can't read, such as
+* the bare token an earlier ref0 kept, which the next prompt replaces with a session of its own.
+*/
+const readKeptSession = (value) => Option.flatMap(value, (kept) => decodeKeptSession(Redacted.value(kept)));
+/** A kept session's record, as the keychain keeps it. */
+const keptSessionValue = (kept) => Redacted.make(encodeKeptSession(kept));
+/**
 * An agent's command in a harness session that has no ref0 session, though an agent is connected
 * for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
 * person instead.
 */
 var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
 /**
-* The token of the session this command runs in, if it runs in one: an agent's, which its
-* harness bound when the session started. Where it's found is the harness's to say. Outside a
-* session, there's none, and every command is the person's, asked by approval.
+* The session this command runs in, as its credential is kept, if it runs in one: an agent's,
+* which its harness bound when the session started. Where it's found is the harness's to say.
+* Outside a session, there's none, and every command is the person's, asked by approval.
 */
 var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
 	/** No session: until a harness binds one, the person asks, by approval. */
@@ -19315,9 +19985,11 @@ var SessionThread = class SessionThread extends Context.Service()("ref0/cli/Sess
 //#endregion
 //#region src/call.ts
 /**
-* Every command's one way to ref0: an endpoint's request, sent with the session's token when
-* the command runs in a session, or else asked of the person, by approval, from this terminal.
-* Either way the answer is the endpoint's own, as JSON.
+* Every command's one way to ref0: an endpoint's request, sent as the session when the command
+* runs in one, signed with this machine's key when the session's bound to it, or else asked of
+* the person, by approval, from this terminal. Either way the answer is the endpoint's own, as
+* JSON. A session's request its key can't sign fails here, as the session's: never asked of the
+* person instead.
 */
 /** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
 var CallFailed = class extends Schema.TaggedError()("CallFailed", {
@@ -19453,42 +20125,52 @@ var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
 		const config = yield* Ref0Config;
 		const session = yield* SessionToken;
 		const http = yield* HttpClient.HttpClient;
-		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
+		const signing = yield* Effect.context();
+		const asSession = Effect.fnUntraced(function* (kept, request, endpoint) {
 			const timeout = timeoutOf(request.command.endpoint);
-			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
+			const send = yield* keptSend(kept).pipe(Effect.provide(signing), Effect.provideService(Ref0Config, config), Effect.provideService(HttpClient.HttpClient, http), Effect.mapError((error) => new CallFailed({
+				status: 0,
+				kind: error._tag,
+				nextStep: error.nextStep
+			})));
+			const base = HttpClientRequest.make(request.method)(request.url).pipe(HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
 			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
 			const change = request.method !== "GET";
 			const lost = change ? unanswered$1 : unreachable;
-			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
+			const { response, text } = yield* send(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
 				response,
 				text
+			}))), Effect.catchTag("KeyStoreUnavailable", (unsigned) => Effect.fail(new CallFailed({
+				status: 0,
+				kind: unsigned._tag,
+				nextStep: unsigned.nextStep
 			}))), Effect.timeoutOrElse({
 				duration: timeout,
 				orElse: () => Effect.fail(lost)
-			}), Effect.mapError(() => lost));
+			}), Effect.mapError((error) => error instanceof CallFailed ? error : lost));
 			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
 			if (response.status === 202) {
 				const needed = decodeNeeded(body);
 				if (Option.isNone(needed)) return yield* failedWith$16(202, body, change);
 				yield* printBlocks([[`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`]]);
-				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
+				return yield* waitForAnswer(yield* collectAsSession(kept, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
 			}
 			return response.status < 300 ? body : yield* failedWith$16(response.status, body, change);
 		});
-		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
+		const collectAsSession = Effect.fnUntraced(function* (kept, approval, change) {
 			const refused = (status) => (error) => Effect.fail(new CallFailed({
 				status,
 				kind: error._tag,
 				nextStep: error.nextStep
 			}));
-			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+			return (yield* keptClient(kept).pipe(Effect.provide(signing), Effect.provideService(Ref0Config, config), Effect.provideService(HttpClient.HttpClient, http), Effect.catch(refused(0)))).approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
 				duration: requestTimeout$1,
 				orElse: () => Effect.succeedNone
 			}), Effect.catchTags({
 				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
 				Unauthenticated: refused(401),
-				SessionHasEnded: refused(410)
+				SessionHasEnded: refused(410),
+				InvalidDpopProof: refused(401)
 			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
 		});
 		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
@@ -19525,20 +20207,20 @@ var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
 			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
 		});
 		const call = Effect.fn("Ref0.call")(function* (command) {
-			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
+			const kept = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
 				status: 0,
 				kind: error._tag,
 				nextStep: error.nextStep
 			})));
-			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
+			const request = yield* (Option.isSome(kept) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
 				status: 400,
 				kind: refused._tag,
 				nextStep: refused.nextStep
 			})));
 			const change = request.method !== "GET";
-			const answer = yield* Option.match(token, {
+			const answer = yield* Option.match(kept, {
 				onNone: () => asPerson(request.command, change, command.endpoint),
-				onSome: (bearer) => asSession(bearer, request, command.endpoint)
+				onSome: (one) => asSession(one, request, command.endpoint)
 			});
 			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
 			return answer;
@@ -21220,138 +21902,21 @@ const connectLineFor = Effect.fnUntraced(function* (harness, configFolder) {
 	return `${configFolders[harness].variable}=${shellWord(configFolder)} ref0 connect`;
 });
 //#endregion
-//#region src/keychain.ts
-/**
-* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
-* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
-* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
-* an argument, since any process on the machine can read another's arguments.
-*/
-var KeychainError = class extends Schema.TaggedError()("KeychainError", {
-	nextStep: Schema.String,
-	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
-	unreadable: Schema.optionalKey(Schema.Literal(true))
-}) {};
-/**
-* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
-* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
-*/
-const keychainIn = Effect.fnUntraced(function* (service) {
-	const crypto = yield* Crypto.Crypto;
-	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
-	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
-	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
-	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
-		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
-		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
-		const code = yield* handle.exitCode;
-		return {
-			output: output.trim(),
-			complaint: complaint.trim(),
-			code,
-			succeeded: code === ChildProcessSpawner.ExitCode(0)
-		};
-	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
-	const get = Effect.fn("Keychain.get")(function* (account) {
-		const found = macOS ? yield* run("security", [
-			"find-generic-password",
-			"-s",
-			service,
-			"-a",
-			account,
-			"-w"
-		], "") : yield* run("secret-tool", [
-			"lookup",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
-		if (macOS) {
-			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
-			return yield* unavailable;
-		}
-		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
-		const listed = yield* run("secret-tool", [
-			"search",
-			"--all",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
-		return Option.none();
-	});
-	const set = Effect.fn("Keychain.set")(function* (account, secret) {
-		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
-		const value = Redacted.value(secret);
-		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
-		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
-		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
-		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
-			"store",
-			"--label",
-			`ref0 ${account}`,
-			"service",
-			service,
-			"account",
-			account
-		], Redacted.value(secret))).succeeded) return yield* unavailable;
-	});
-	const remove = Effect.fn("Keychain.remove")(function* (account) {
-		if (!(yield* macOS ? run("security", [
-			"delete-generic-password",
-			"-s",
-			service,
-			"-a",
-			account
-		], "") : run("secret-tool", [
-			"clear",
-			"service",
-			service,
-			"account",
-			account
-		], "")).succeeded) return yield* unavailable;
-	});
-	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
-	return {
-		probe: Effect.gen(function* () {
-			const account = `connect-probe/${yield* random}`;
-			const value = Redacted.make(yield* random);
-			yield* Effect.gen(function* () {
-				yield* set(account, value);
-				const kept = yield* get(account);
-				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
-				yield* remove(account);
-			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
-		}).pipe(Effect.timeoutOrElse({
-			duration: Duration.minutes(1),
-			orElse: () => Effect.fail(unavailable)
-		})),
-		get,
-		set,
-		remove
-	};
-});
-var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
-	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
-};
-//#endregion
 //#region src/host-grant.ts
 /**
 * All lasting authority for one config folder, stored as one keychain value: the agent the folder
-* acts as, by its owner, handle and agent ID, and its token. The ID is kept in the same write as
-* the token, so a folder with a grant always knows which agent its commits name.
+* acts as, by its owner, handle and agent ID, its token, and the key it's bound to, if it is. The
+* ID is kept in the same write as the token, so a folder with a grant always knows which agent its
+* commits name.
 */
 const KeptHostGrant = Schema.Struct({
 	harness: ConnectHarness,
 	owner: OwnerName,
 	agent: AgentHandle,
 	agentId: AgentId,
-	token: Schema.RedactedFromValue(Schema.String)
+	token: Schema.RedactedFromValue(Schema.String),
+	/** This machine's key, by its thumbprint, when ref0 bound the grant to it: none from before. */
+	cnf: Schema.optionalKey(KeyBinding)
 });
 const decodeGrant = Schema.decodeUnknownOption(Schema.fromJsonString(KeptHostGrant));
 const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
@@ -21360,6 +21925,15 @@ const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
 * read as a grant, such as one an earlier ref0 kept, still names the grant it held.
 */
 const decodeHeldToken = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ token: KeptHostGrant.fields.token })));
+const decodeCredentialRef = Schema.decodeUnknownOption(CredentialRef);
+/**
+* A kept grant by its locator, whose it is and which row, as its token names them: what a
+* session it started, and a start it authorized, are kept beside. None for a token that isn't one.
+*/
+const grantRef = (grant) => Option.flatMap(parseToken(Redacted.value(grant.token)), (parts) => decodeCredentialRef({
+	person: parts.person,
+	id: parts.token
+}));
 /** Grants in the origin’s keychain service, account host-grant/<resolved config folder>. */
 var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant") {
 	static layer = Layer.effect(HostGrant, Effect.gen(function* () {
@@ -21403,7 +21977,7 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.12.1";
+const cliVersion = "0.14.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -21653,6 +22227,7 @@ const yesOrNoQuestions = Effect.gen(function* () {
 const isAnswerCode = Schema.is(TypedApprovalCode);
 const decodeTokenId$1 = Schema.decodeUnknownOption(TokenId);
 const decodeSecretHash$1 = Schema.decodeUnknownEffect(SecretHash);
+const decodeProofOrigin = Schema.decodeUnknownEffect(ProofOrigin);
 /** How often the machine asks whether its person has answered. */
 const pollMillis = 2e3;
 /** How long one request may take before the machine gives up on it, and asks again. */
@@ -21705,12 +22280,14 @@ const endedWords$1 = (state) => {
 /** The grant a kept record holds, by its ID. */
 const grantOf = (token) => Option.flatMap(parseToken(Redacted.value(token)), (parts) => decodeTokenId$1(parts.token));
 /**
-* Asks with no owner for every folder given, each with a grant secret of its own, shows the
-* link, and takes the answer from the person's own page. Then it keeps each folder ref0
-* connected, confirms exactly the grants it kept, and forgets 0.5.0's grants they replace.
+* Asks with no owner for every folder given, each with a grant secret of its own, signed by this
+* machine's key, which ref0 binds every grant to, shows the link, and takes the answer from the
+* person's own page. Then it keeps each folder ref0 connected, with the key it's bound to,
+* confirms exactly the grants it kept, and forgets 0.5.0's grants they replace.
 */
-const requestAttachment = Effect.fnUntraced(function* (asked) {
+const requestAttachment = Effect.fnUntraced(function* (asked, key) {
 	const config = yield* Ref0Config;
+	const origin = yield* decodeProofOrigin(config.api).pipe(Effect.catchTag("SchemaError", () => sayFailed(`ref0 connect signs its ask only to an HTTPS origin, or HTTP on this machine, and ${config.api} is neither.`)));
 	const machine = yield* Machine;
 	const hostGrant = yield* HostGrant;
 	const oldGrants = yield* OldHostGrants;
@@ -21723,7 +22300,10 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const opener = yield* browserOpener;
 	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(printBlocks([["Couldn’t listen for the browser. Paste the code instead."]]), void 0)));
 	const machineId = yield* machine.id.pipe(Effect.catchTag("MachineError", said));
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
+	const client = yield* provingClient({
+		origin,
+		store: key.store
+	}).pipe(Effect.provideService(HttpClient.HttpClient, http));
 	const unreachable = () => sayFailed(`Couldn’t reach ref0 at ${config.api}. Try again.`);
 	const requestId = yield* newRequestId;
 	const asking = yield* Effect.forEach(asked, Effect.fnUntraced(function* (folder) {
@@ -21750,6 +22330,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const payload = {
 		machine: machineId,
 		machineName: machineNameOf(machine.hostName),
+		publicKey: key.store.publicKey,
 		folders,
 		collectHash: yield* Effect.orDie(decodeSecretHash$1(collecting.hash)),
 		linkHash: yield* Effect.orDie(decodeSecretHash$1(link.hash))
@@ -21765,6 +22346,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		NotPermitted: said,
 		CommandRefused: said,
 		SlowDown: said,
+		KeyStoreUnavailable: said,
+		InvalidDpopProof: () => sayFailed(`ref0 refused this machine’s proof of its key, so nothing was asked. Check that this machine’s clock is right, then run ${again$1} again.`),
 		AuthorityUnavailable: unanswered,
 		HttpClientError: unanswered,
 		SchemaError: unanswered
@@ -21836,7 +22419,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		owner: connection.owner,
 		agent: connection.handle,
 		agentId: connection.agent.id,
-		token: Redacted.make(formatToken(connection.credential.person, connection.credential.id, folder.grant.secret))
+		token: Redacted.make(formatToken(connection.credential.person, connection.credential.id, folder.grant.secret)),
+		cnf: key.binding
 	}, keepBy, "The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
 	const finish = Effect.fnUntraced(function* (state) {
 		if (state.state !== "connected") return yield* sayFailed(endedWords$1(state));
@@ -24637,14 +25221,17 @@ const connectCommands = [Command.make("connect", { json }, ({ json: asJson }) =>
 	if (yield* session.current.pipe(Effect.map(Option.isSome), Effect.catchTag("NoSession", () => Effect.succeed(true)))) return yield* sayFailed("ref0 connect runs only in a person’s own terminal, never in an agent’s session: it shows a code, and a yes to that code connects this machine to an agent. If this machine needs connecting, tell your person to run ref0 connect in their own terminal. Never ask them to approve a code for you.");
 	if (!tty.attached) return yield* sayFailed("ref0 connect runs only in a terminal you type into, and this isn’t one. Run it yourself, in your own terminal: not through a script, a pipe or an agent.");
 	yield* (yield* ConnectLock).hold;
+	const machineKey = yield* MachineKey;
+	yield* machineKey.supported;
 	yield* (yield* Keychain).probe;
+	const key = yield* machineKey.ensure;
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	const found = yield* findConfigFolders;
 	if (found.length === 0) return yield* sayFailed(`ref0 found no Claude Code or Codex config folder in your home. Start Claude Code or Codex once, then run ${again} again.`);
 	const chosen = yield* choose(found, home).pipe(Effect.catchTag("QuitError", () => sayFailed("Stopped, and nothing was asked.")));
 	if (chosen.length === 0) return yield* sayFailed(`No config folder was ticked, so nothing was asked. To connect one, run ${again} again.`);
 	yield* Console.error("");
-	const connected = yield* requestAttachment(chosen);
+	const connected = yield* requestAttachment(chosen, key);
 	const installed = yield* installInto(connected.kept, { asJson });
 	const others = yield* otherOwners(connected);
 	yield* printAnswer(answerOf(connected, installed, others), asJson, reportOf(connected, installed, others, home));
@@ -25210,9 +25797,9 @@ const signalExits = {
 };
 const decodeSetup = Schema.decodeUnknownOption(Schema.Array(Schema.String));
 /** A duration's milliseconds, as a check writes it, `'30 seconds'`, or a number of them. */
-const millisOf = (duration) => Option.map(Duration.fromInput(duration), (read) => Math.ceil(Duration.toMillis(read)));
+const millisOf$1 = (duration) => Option.map(Duration.fromInput(duration), (read) => Math.ceil(Duration.toMillis(read)));
 /** A duration a command was given, in milliseconds, or why it isn't one. */
-const givenMillis = (duration) => Option.match(millisOf(duration), {
+const givenMillis = (duration) => Option.match(millisOf$1(duration), {
 	onNone: () => Effect.fail(new LocalSandboxFailed({ why: `Not a duration: ${duration}` })),
 	onSome: Effect.succeed
 });
@@ -25555,7 +26142,7 @@ const defaultRetries = {
 };
 const defaultTimeout = 6e5;
 /** A duration as a step's config writes it, in milliseconds, or the run's code's mistake. */
-const stepMillis = (duration) => Option.match(millisOf(duration), {
+const stepMillis = (duration) => Option.match(millisOf$1(duration), {
 	onNone: () => Effect.die(/* @__PURE__ */ new Error(`Not a duration: ${duration}`)),
 	onSome: Effect.succeed
 });
@@ -26700,10 +27287,9 @@ const gitTokenOf = Effect.fnUntraced(function* (binding) {
 	const keychain = yield* Keychain;
 	const kept = yield* keychain.get(gitTokenAccount(binding));
 	if (Option.isSome(kept)) return kept;
-	const sessionToken = yield* keychain.get(sessionAccount(binding));
-	if (Option.isNone(sessionToken)) return Option.none();
-	const config = yield* Ref0Config;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(sessionToken.value)));
+	const session = readKeptSession(yield* keychain.get(sessionAccount(binding)));
+	if (Option.isNone(session)) return Option.none();
+	const client = yield* keptClient(session.value);
 	const me = yield* client.me.get();
 	if (me.session === void 0) return Option.none();
 	const { secret, hash } = yield* freshTokenSecret;
@@ -26841,12 +27427,11 @@ const trimShallow = Effect.fnUntraced(function* (gitDir) {
 * attempts the merge: the checkout's own for `ref0 sync`, or the local check's scratch one.
 */
 const loadSyncHistory = Effect.fnUntraced(function* (gitDir, repo) {
-	const config = yield* Ref0Config;
-	const token = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", () => Effect.succeedNone));
-	if (Option.isNone(token)) return yield* new HistoryNotLoaded({ why: "this terminal has no session to load it as" });
+	const kept = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", () => Effect.succeedNone));
+	if (Option.isNone(kept)) return yield* new HistoryNotLoaded({ why: "this terminal has no session to load it as" });
 	const fs = yield* FileSystem.FileSystem;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token.value)));
+	const client = yield* keptClient(kept.value);
 	const params = yield* decodePlace(repoParts(repo));
 	const manifest = yield* client.repos.manifest({ params });
 	const temp = yield* fs.makeTempDirectoryScoped();
@@ -26875,7 +27460,7 @@ const loadSyncHistory = Effect.fnUntraced(function* (gitDir, repo) {
 * or the thread below, set apart.
 */
 const baseNamed = (on, main = "main") => on === "main" ? main : `#${on.thread}, which this thread is stacked on,`;
-const decodeWritten$1 = Schema.decodeUnknownOption(WrittenRepo);
+const decodeWritten$2 = Schema.decodeUnknownOption(WrittenRepo);
 const decodeCommit$1 = Schema.decodeUnknownOption(CommitOid);
 const refused$1 = (why) => ({
 	kind: "refused",
@@ -26909,7 +27494,7 @@ const syncBase = Effect.fnUntraced(function* (folder) {
 		stdout: "inherit",
 		stderr: "inherit"
 	})).pipe(Effect.map(Number), Effect.catchCause(() => Effect.succeed(-1)));
-	const written = decodeWritten$1((yield* read([
+	const written = decodeWritten$2((yield* read([
 		"config",
 		"--get",
 		"ref0.repo"
@@ -30075,7 +30660,7 @@ const watchCommands = [Command.make("watch", {
 		owner: ownerName,
 		agent: flags.agent
 	});
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(grant.value.token)));
+	const client = yield* keptClient(grant.value);
 	const watching = {
 		project: flags.project,
 		parent: Option.getOrUndefined(flags.parent),
@@ -30104,7 +30689,7 @@ const watchCommands = [Command.make("watch", {
 				parent: number
 			})
 		})
-	}).pipe(Effect.mapError((error) => Match.value(error).pipe(Match.tag("Unauthenticated", "SessionHasEnded", () => stopped(`ref0 refused the host grant ref0 connect kept for ${as} on this machine: it was revoked or never confirmed, or the machine was disconnected. Connect it again with ref0 connect, then run ref0 watch again.`)), Match.tag("ProjectNotFound", () => stopped(`${flags.project} isn’t a project ${as} can read. Check the owner/project, and that ${flags.agent} is the agent to watch as.`)), Match.tag("ThreadNotFound", () => stopped(`${flags.project} has no thread #${Option.getOrElse(flags.parent, () => 0)} to watch the children of. Find its number with ref0 threads ${flags.project}.`)), Match.tag("NotPermitted", (refused) => stopped(refused.nextStep)), Match.tag("AuthorityUnavailable", () => new ReadUnavailable({ why: "it’s restarting" })), Match.tag("ProjectNotReady", () => new ReadUnavailable({ why: `${flags.project} isn’t ready yet` })), Match.orElse(() => new ReadUnavailable({ why: `couldn’t reach ${config.api}` })))));
+	}).pipe(Effect.mapError((error) => Match.value(error).pipe(Match.tag("Unauthenticated", "SessionHasEnded", () => stopped(`ref0 refused the host grant ref0 connect kept for ${as} on this machine: it was revoked or never confirmed, or the machine was disconnected. Connect it again with ref0 connect, then run ref0 watch again.`)), Match.tag("ProjectNotFound", () => stopped(`${flags.project} isn’t a project ${as} can read. Check the owner/project, and that ${flags.agent} is the agent to watch as.`)), Match.tag("ThreadNotFound", () => stopped(`${flags.project} has no thread #${Option.getOrElse(flags.parent, () => 0)} to watch the children of. Find its number with ref0 threads ${flags.project}.`)), Match.tag("NotPermitted", "InvalidDpopProof", (refused) => stopped(refused.nextStep)), Match.tag("KeyStoreUnavailable", () => new ReadUnavailable({ why: "this machine’s key didn’t sign in time" })), Match.tag("AuthorityUnavailable", () => new ReadUnavailable({ why: "it’s restarting" })), Match.tag("ProjectNotReady", () => new ReadUnavailable({ why: `${flags.project} isn’t ready yet` })), Match.orElse(() => new ReadUnavailable({ why: `couldn’t reach ${config.api}` })))));
 	return yield* Effect.scoped(Effect.gen(function* () {
 		const state = yield* openWatchState(folder, {
 			project: flags.project,
@@ -30124,7 +30709,8 @@ const watchCommands = [Command.make("watch", {
 }).pipe(Effect.catchTags({
 	WatchStopped: (stopped) => sayFailed(stopped.nextStep),
 	WatchStateError: (failed) => sayFailed(failed.nextStep),
-	KeychainError: (failed) => sayFailed(failed.nextStep)
+	KeychainError: (failed) => sayFailed(failed.nextStep),
+	InvalidDpopProof: (refused) => sayFailed(refused.nextStep)
 }))).pipe(Command.withShortDescription("Run a command for each thread started in a project"), Command.withDescription([
 	"Runs a command for each thread started in a project, as one of your agents, through the host grant ref0 connect kept on this machine; it sees only what that agent may. It runs until stopped: the first time from now on, or with --parent from the parent’s first child on, and from where it stopped after that.",
 	"Just before each run it reads the thread again, and skips it, marked done, if it’s settled or closed. Before its first run, it skips one a session is live on, with --skip-live, and one started before the watch did that a session has started on. After, a session may be one its own failed run opened, live until its lease lapses, within 30 minutes: with --skip-live, it waits until none is live, then runs again.",
@@ -30661,7 +31247,7 @@ function editedPaths(hook) {
 /** The most bytes of a file read around an edit; a larger one's edits aren't attributed. */
 const fileBytes = 2e6;
 /** The most edit calls waiting for their `PostToolUse`; a harness that never sends one leaks none. */
-const openCalls = 64;
+const openCalls$1 = 64;
 /** The most line hashes a worktree keeps pending; the oldest edits go first. */
 const pendingLines = 2e4;
 /** A line as it's kept pending: 128 bits of its SHA-256, never its text. */
@@ -31030,7 +31616,7 @@ var Attribution = class Attribution extends Context.Service()("ref0/cli/Attribut
 					turn,
 					files
 				});
-				for (const key of calls.keys()) if (calls.size > openCalls) calls.delete(key);
+				for (const key of calls.keys()) if (calls.size > openCalls$1) calls.delete(key);
 				return {
 					...latest,
 					calls
@@ -31278,7 +31864,7 @@ const optionsWithValues = /* @__PURE__ */ new Set([
 	"--git-dir",
 	"--work-tree"
 ]);
-const decodeWritten = Schema.decodeUnknownOption(WrittenRepo);
+const decodeWritten$1 = Schema.decodeUnknownOption(WrittenRepo);
 const hunkHeader = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 /** The command a Git run's arguments name, past Git's own options. */
 const commandOf = (args) => {
@@ -31626,7 +32212,7 @@ const checkBase = Effect.fnUntraced(function* (folder, base, delivered, within)
 					"--get",
 					"ref0.repo"
 				]);
-				const repo = decodeWritten(named.out.trim());
+				const repo = decodeWritten$1(named.out.trim());
 				if (Option.isNone(repo)) return yield* failed("this checkout has no ref0.repo to load history for");
 				yield* loadSyncHistory(store, repo.value).pipe(Effect.mapError((error) => failed(error.why)));
 				yield* fs.writeFileString(loaded, "");
@@ -31948,7 +32534,7 @@ var BaseChecks = class BaseChecks extends Context.Service()("ref0/cli/BaseChecks
 		], { stdin: "ignore" })).pipe(Effect.map((code) => Number(code) === 0), Effect.orElseSucceed(() => false));
 		return BaseChecks.of({
 			settingsAt,
-			check: (top, base, delivered, within, token) => checkBase(top, base, delivered, within).pipe(Effect.provide(context), Effect.provideService(SessionToken, SessionToken.of({ current: Effect.succeedSome(token) }))),
+			check: (top, base, delivered, within, session) => checkBase(top, base, delivered, within).pipe(Effect.provide(context), Effect.provideService(SessionToken, SessionToken.of({ current: Effect.succeedSome(session) }))),
 			holds
 		});
 	}));
@@ -32001,10 +32587,10 @@ const baseWatch = Effect.fnUntraced(function* (edges) {
 			return;
 		}
 		if (Option.isNone(repo)) return;
-		const read = yield* (yield* clientOf(bound.token)).sessions.base({ params: {
+		const read = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.sessions.base({ params: {
 			session: bound.session,
 			repo: repo.value
-		} }).pipe(Effect.option);
+		} })), Effect.option);
 		if (Option.isNone(read)) return;
 		const base = read.value;
 		const mark = {
@@ -32030,7 +32616,7 @@ const baseWatch = Effect.fnUntraced(function* (edges) {
 			commit: base.commit,
 			url,
 			ref: base.ref
-		}, delivered, clone.within, bound.token).pipe(Effect.option);
+		}, delivered, clone.within, bound.kept).pipe(Effect.option);
 		if (Option.isNone(checked)) return;
 		const notice = checked.value.kind === "compared" ? checked.value.notice : Option.none();
 		yield* Ref.update(watched, (was) => was.top !== clone.top ? was : {
@@ -32384,6 +32970,321 @@ var HarnessTasks = class HarnessTasks extends Context.Service()("ref0/cli/Harnes
 	}));
 };
 //#endregion
+//#region src/harness/turn-facts.ts
+const Written = Schema.Struct({ timestamp: Schema.String });
+const decodeWritten = Schema.decodeUnknownOption(Schema.fromJsonString(Written));
+/** When a transcript's line says it was written, by the harness's clock, if it says. */
+const writtenAt = (line) => {
+	const at = Option.match(decodeWritten(line), {
+		onNone: () => NaN,
+		onSome: (written) => Date.parse(written.timestamp)
+	});
+	return Number.isFinite(at) ? at : void 0;
+};
+/** The most tool names a turn's record counts. */
+const toolNames = 100;
+/** The most replies a turn's tally remembers; a turn with more has its tokens unknown. */
+const turnReplies = 1e4;
+/**
+* The most calls a turn remembers as begun and not ended, its newest kept: a call that never
+* ends, as one a `PreToolUse` answer denied, is never counted.
+*/
+const openCalls = 100;
+const nothingRead = {
+	known: "waiting",
+	models: /* @__PURE__ */ new Map(),
+	replies: /* @__PURE__ */ new Map()
+};
+const nothingReadOf = {
+	tokens: nothingRead,
+	context: {
+		known: "waiting",
+		peak: void 0,
+		compactions: []
+	},
+	subagents: /* @__PURE__ */ new Map(),
+	moreSubagents: 0
+};
+const nothingCalled = {
+	known: true,
+	totalMs: 0,
+	longest: void 0,
+	open: /* @__PURE__ */ new Map()
+};
+const nothingSeen = {
+	...nothingReadOf,
+	tools: /* @__PURE__ */ new Map(),
+	calls: nothingCalled,
+	addresses: [],
+	more: 0,
+	model: void 0,
+	startedAt: void 0,
+	stoppedAt: void 0
+};
+/**
+* A call's `PreToolUse` or its end seen at `at`: its time Claude Code's `duration_ms`, or, where
+* the harness says none, as Codex, from its `PreToolUse` to its end. One whose time can't be
+* told makes the turn's unknown, as does a tool name ref0 refuses.
+*/
+function timeCall(calls, hook, at) {
+	const name = hook.tool?.name;
+	const callId = hook.tool?.callId;
+	if (name === void 0) return calls;
+	if (hook.event === "PreToolUse") {
+		if (callId === void 0) return calls;
+		const open = new Map(calls.open).set(callId, at);
+		for (const [oldest] of open) {
+			if (open.size <= openCalls) break;
+			open.delete(oldest);
+		}
+		return {
+			...calls,
+			open
+		};
+	}
+	if (hook.event !== "PostToolUse" && hook.event !== "PostToolUseFailure") return calls;
+	const open = new Map(calls.open);
+	const began = callId === void 0 ? void 0 : open.get(callId);
+	if (callId !== void 0) open.delete(callId);
+	const ms = hook.durationMs ?? (began === void 0 ? void 0 : Math.max(at - began, 0));
+	if (ms === void 0 || name.length > 128) return {
+		...calls,
+		known: false,
+		open
+	};
+	const longest = calls.longest === void 0 || ms > calls.longest.ms ? {
+		tool: name,
+		ms
+	} : calls.longest;
+	return {
+		...calls,
+		totalMs: calls.totalMs + ms,
+		longest,
+		open
+	};
+}
+/**
+* A hook seen at `at`: a tool call counted by its tool once it ran, and timed, the files an edit
+* is about to touch kept, at most 50 and the rest counted, the model, where the hook names one,
+* and a `Stop` as when the agent last stopped.
+*/
+function seeHook(seen, hook, edited, at) {
+	const tools = new Map(seen.tools);
+	const name = hook.tool?.name;
+	if (hook.event === "PostToolUse" && name !== void 0) {
+		const counted = tools.get(name);
+		if (counted !== void 0 || tools.size < toolNames) tools.set(name, (counted ?? 0) + 1);
+	}
+	const addresses = [...seen.addresses];
+	let more = seen.more;
+	for (const each of edited) {
+		if (addresses.some((kept) => kept.repo === each.repo && kept.path === each.path)) continue;
+		if (addresses.length < 50) addresses.push(each);
+		else more += 1;
+	}
+	return {
+		...seen,
+		tools,
+		calls: timeCall(seen.calls, hook, at),
+		addresses,
+		more,
+		model: hook.model ?? seen.model,
+		stoppedAt: hook.event === "Stop" ? at : seen.stoppedAt
+	};
+}
+/**
+* A read's replies added to a turn's, each by its message ID at the most any of its lines says:
+* a subagent's transcript writes a reply's output as it grows, line by line, so a line of a reply
+* already counted adds only what it grew. `own` when the read was of the session's own
+* transcript, which makes the turn's tokens known; nothing makes them known once a read has
+* failed.
+*/
+function addReplies(tally, replies, own) {
+	if (tally.known === "failed") return tally;
+	const models = new Map(tally.models);
+	const counted = new Map(tally.replies);
+	for (const reply of replies) {
+		const before = counted.get(reply.id);
+		const most = {
+			model: before?.model ?? reply.model,
+			input: Math.max(before?.input ?? 0, reply.input),
+			output: Math.max(before?.output ?? 0, reply.output),
+			cacheWrite: Math.max(before?.cacheWrite ?? 0, reply.cacheWrite),
+			cacheRead: Math.max(before?.cacheRead ?? 0, reply.cacheRead)
+		};
+		const sum = models.get(most.model);
+		counted.set(reply.id, most);
+		models.set(most.model, {
+			input: (sum?.input ?? 0) + most.input - (before?.input ?? 0),
+			output: (sum?.output ?? 0) + most.output - (before?.output ?? 0),
+			cacheWrite: (sum?.cacheWrite ?? 0) + most.cacheWrite - (before?.cacheWrite ?? 0),
+			cacheRead: (sum?.cacheRead ?? 0) + most.cacheRead - (before?.cacheRead ?? 0)
+		});
+	}
+	if (counted.size > turnReplies) return readFailed(tally);
+	return {
+		known: own ? "read" : tally.known,
+		models,
+		replies: counted
+	};
+}
+/**
+* A read's requests added to a turn's, by model, as Codex's rollout steps its running total.
+* `own` as for `addReplies`: a rollout is always the session's own.
+*/
+function addSteps(tally, steps, own) {
+	if (tally.known === "failed") return tally;
+	const models = new Map(tally.models);
+	for (const step of steps) {
+		const sum = models.get(step.model);
+		models.set(step.model, {
+			input: (sum?.input ?? 0) + step.input,
+			output: (sum?.output ?? 0) + step.output,
+			cacheWrite: (sum?.cacheWrite ?? 0) + step.cacheWrite,
+			cacheRead: (sum?.cacheRead ?? 0) + step.cacheRead
+		});
+	}
+	return {
+		...tally,
+		known: own ? "read" : tally.known,
+		models
+	};
+}
+/** A read that failed: the turn's tokens are unknown from then on. */
+const readFailed = (tally) => ({
+	...tally,
+	known: "failed"
+});
+/** A read's replies and requests added to a turn's tokens, or its tokens unknown if it failed. */
+const addTokens = (tally, read, own) => read.whole ? addSteps(addReplies(tally, read.replies, own), read.steps, own) : readFailed(tally);
+/** What one request sent: its input, cached or not. */
+const sentBy = (tokens) => tokens.input + tokens.cacheWrite + tokens.cacheRead;
+/**
+* A read of the session's own transcript added to its context: the most any request sent, each
+* Claude Code reply at the most its lines said, and each compaction. Unknown once a read fails.
+*/
+function addContext(context, read) {
+	if (context.known === "failed") return context;
+	if (!read.whole) return {
+		...context,
+		known: "failed"
+	};
+	return {
+		known: "read",
+		peak: [...read.replies, ...read.steps].reduce((most, request) => Math.max(most ?? 0, sentBy(request)), context.peak),
+		compactions: [...context.compactions, ...read.compactions]
+	};
+}
+/**
+* A read added to a turn's: to its tokens, and, from the session's own transcript, to its
+* context, or, from a subagent's, to that subagent's own tokens too, each subagent kept by its
+* transcript as first read, past the first 100 only counted.
+*/
+function addRead(reads, read, of) {
+	const tokens = addTokens(reads.tokens, read, of.own);
+	if (of.own) return {
+		...reads,
+		tokens,
+		context: addContext(reads.context, read)
+	};
+	const before = reads.subagents.get(of.subagent);
+	if (before === void 0 && reads.subagents.size >= 100) return {
+		...reads,
+		tokens,
+		moreSubagents: reads.moreSubagents + 1
+	};
+	const subagent = {
+		type: before?.type ?? of.type,
+		tokens: addTokens(before?.tokens ?? nothingRead, read, true)
+	};
+	return {
+		...reads,
+		tokens,
+		subagents: new Map(reads.subagents).set(of.subagent, subagent)
+	};
+}
+/**
+* A turn's tokens as ref0 keeps them: each model's counts once the session's own transcript is
+* read, or unknown, with no counts, where it wasn't, a read failed, or a count passes what a
+* turn may hold.
+*/
+function turnTokens(tally) {
+	if (tally.known !== "read" || tally.models.size > 16) return { known: "unknown" };
+	const models = [...tally.models].map(([model, counts]) => ({
+		model,
+		...counts
+	}));
+	return models.every((each) => Math.max(each.input, each.output, each.cacheWrite, each.cacheRead) <= 1e8 && each.model.length >= 1 && each.model.length <= 128) ? {
+		known: "read",
+		models
+	} : { known: "unknown" };
+}
+/** A turn's tool calls' time as ref0 keeps it: unknown once a call's time couldn't be told. */
+function toolTime(calls) {
+	if (!calls.known) return { known: "unknown" };
+	return calls.longest === void 0 ? {
+		known: "timed",
+		totalMs: calls.totalMs
+	} : {
+		known: "timed",
+		totalMs: calls.totalMs,
+		longest: calls.longest
+	};
+}
+/**
+* A turn's context as ref0 keeps it, each compaction's time as how long after ref0 started the
+* turn, 0 for one before its start landed: unknown until the session's own transcript is read,
+* once a read fails, or with more compactions than a turn names.
+*/
+function turnContext(context, startedAt) {
+	if (context.known !== "read" || context.compactions.length > 100) return { known: "unknown" };
+	if (context.peak !== void 0 && context.peak > 1e8) return { known: "unknown" };
+	const compactions = context.compactions.map((each) => {
+		const compaction = {};
+		if (each.trigger !== void 0) compaction.trigger = each.trigger;
+		if (each.at !== void 0 && startedAt !== void 0) compaction.afterMs = Math.max(each.at - startedAt, 0);
+		return compaction;
+	});
+	return context.peak === void 0 ? {
+		known: "read",
+		compactions
+	} : {
+		known: "read",
+		peak: context.peak,
+		compactions
+	};
+}
+/**
+* The facts a turn's reads give ref0: its tokens, its context and each subagent's tokens, with
+* its type where the harness named it.
+*/
+const readFacts = (reads, startedAt) => ({
+	tokens: turnTokens(reads.tokens),
+	context: turnContext(reads.context, startedAt),
+	subagents: [...reads.subagents.values()].map((subagent) => subagent.type === void 0 || subagent.type.length > 128 ? { tokens: turnTokens(subagent.tokens) } : {
+		type: subagent.type,
+		tokens: turnTokens(subagent.tokens)
+	}),
+	moreSubagents: reads.moreSubagents
+});
+/**
+* A turn's facts as ref0 keeps them, with its stop as how long after ref0 started it the agent last
+* stopped: none until both are seen, and 0 for a `Stop` before its start landed.
+*/
+function turnFacts(seen) {
+	const facts = {
+		modelSource: seen.model === void 0 ? "unknown" : "hook",
+		tools: Object.fromEntries(seen.tools),
+		addresses: seen.addresses,
+		more: seen.more,
+		toolTime: toolTime(seen.calls),
+		...readFacts(seen, seen.startedAt)
+	};
+	if (seen.model !== void 0) facts.model = seen.model;
+	if (seen.startedAt !== void 0 && seen.stoppedAt !== void 0) facts.stoppedAfterMs = Math.max(seen.stoppedAt - seen.startedAt, 0);
+	return facts;
+}
+//#endregion
 //#region src/harness/rollouts.ts
 /**
 * Codex's rollouts, as `ref0 mcp` reads a turn's tokens from them: each hook names the
@@ -32403,7 +33304,8 @@ var HarnessTasks = class HarnessTasks extends Context.Service()("ref0/cli/Harnes
 * `token_count`s, then the subagent's own turn, its total from zero, a forked subagent's as a
 * fresh one's (Codex 0.163.0's subagents, 20 Oct 2026). So its requests are those past its own
 * turn's `task_started`, and what its total carried over, nothing so far, is its first request's
-* total less that request's own usage.
+* total less that request's own usage. Each compaction of the session's context writes a
+* `compacted` record, with its time and none of what started it (Codex 0.163.0's, 23 Oct 2026).
 */
 const Count$1 = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
 /** A session's running total, as far as ref0 counts it: reasoning is inside output. */
@@ -32451,12 +33353,16 @@ const zero = {
 	cacheWrite: 0,
 	output: 0
 };
-/** The records a read decodes: each request's total, each turn's model, start and cutting short. */
+/**
+* The records a read decodes: each request's total, each turn's model, start and cutting short,
+* and each compaction.
+*/
 const counted = [
 	"\"token_count\"",
 	"\"turn_context\"",
 	"\"task_started\"",
-	"\"turn_aborted\""
+	"\"turn_aborted\"",
+	"\"compacted\""
 ];
 /** A line, as far as telling Codex's records apart, and the turn an event is of. */
 const Line$1 = Schema.Struct({
@@ -32541,6 +33447,7 @@ const tokensOf = (model, step) => ({
 */
 function stepsIn(text, from, until) {
 	const steps = [];
+	const compactions = [];
 	const lines = text.split("\n");
 	let { top, total, model } = from;
 	let whole = true;
@@ -32557,6 +33464,7 @@ function stepsIn(text, from, until) {
 		const event = kind.value.type === "event_msg" ? kind.value.payload : void 0;
 		if (event?.type === "task_started" && until !== void 0 && event.turn_id === until) return {
 			steps,
+			compactions,
 			running: {
 				top,
 				total,
@@ -32565,6 +33473,11 @@ function stepsIn(text, from, until) {
 			whole,
 			before: index
 		};
+		if (kind.value.type === "compacted") {
+			const at = writtenAt(line);
+			compactions.push(at === void 0 ? {} : { at });
+			continue;
+		}
 		if (event?.type === "turn_aborted") {
 			whole = false;
 			continue;
@@ -32595,6 +33508,7 @@ function stepsIn(text, from, until) {
 	}
 	return {
 		steps,
+		compactions,
 		running: {
 			top,
 			total,
@@ -32612,7 +33526,9 @@ function stepsIn(text, from, until) {
 * Each holds one JSON object a line, and writes an assistant reply over several lines, each with
 * the reply's `message.usage` so far: the session's own repeat it, and a subagent's grow its
 * output line by line. So a reply counts once, by its `message.id`, at the most its lines say,
-* with its own model (Claude Code 2.1.304's transcripts, 20 Oct 2026). Codex's: the session's
+* with its own model (Claude Code 2.1.304's transcripts, 20 Oct 2026), and a compaction as a
+* `system` line, `compact_boundary`, with its time and its trigger (2.1.310's, 24 Oct 2026).
+* Codex's: the session's
 * rollout, whose running total `rollouts.ts` reads, kept with its place, and each subagent's,
 * which its `SubagentStop` names, read first from where its own turn starts, past the parent's
 * history it copies. Each is read from the
@@ -32638,8 +33554,13 @@ const linesEnd = (bytes, count) => {
 	return end;
 };
 const Count = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
-/** A line, as far as telling an assistant's from the rest. */
-const Line = Schema.Struct({ type: Schema.String });
+/** A line, as far as telling an assistant's and a compaction's from the rest. */
+const Line = Schema.Struct({
+	type: Schema.String,
+	subtype: Schema.optionalKey(Schema.Unknown)
+});
+/** A compaction's line, as far as what started it. */
+const CompactionLine = Schema.Struct({ compactMetadata: Schema.Struct({ trigger: Schema.Literals(["auto", "manual"]) }) });
 /** An assistant line: a reply's ID, its model and its usage, which every line of it repeats. */
 const AssistantLine = Schema.Struct({ message: Schema.Struct({
 	model: Schema.String,
@@ -32653,18 +33574,34 @@ const AssistantLine = Schema.Struct({ message: Schema.Struct({
 }) });
 const decodeLine = Schema.decodeUnknownOption(Schema.fromJsonString(Line));
 const decodeAssistant = Schema.decodeUnknownOption(Schema.fromJsonString(AssistantLine));
+const decodeCompaction = Schema.decodeUnknownOption(Schema.fromJsonString(CompactionLine));
+/** A compaction's line read: one is counted whatever else it says. */
+const compactionOf = (line) => {
+	const trigger = Option.getOrUndefined(decodeCompaction(line))?.compactMetadata.trigger;
+	const at = writtenAt(line);
+	const compaction = {};
+	if (trigger !== void 0) compaction.trigger = trigger;
+	if (at !== void 0) compaction.at = at;
+	return compaction;
+};
 /** What Claude Code names the model of a reply it wrote itself, such as an error: no model's. */
 const synthetic = "<synthetic>";
 /**
-* The replies in a transcript's whole lines, in order, or none if an assistant line can't be read,
-* since its tokens would go missing unseen. A line that isn't JSON is passed over: a read that
-* starts inside a line, after a transcript shrank, reads its tail as one.
+* The replies and compactions in a transcript's whole lines, in order, or none if an assistant
+* line can't be read, since its tokens would go missing unseen. A line that isn't JSON is passed
+* over: a read that starts inside a line, after a transcript shrank, reads its tail as one.
 */
-function repliesIn(text) {
+function transcriptIn(text) {
 	const replies = [];
+	const compactions = [];
 	for (const line of text.split("\n")) {
 		const kind = decodeLine(line);
-		if (Option.isNone(kind) || kind.value.type !== "assistant") continue;
+		if (Option.isNone(kind)) continue;
+		if (kind.value.type === "system" && kind.value.subtype === "compact_boundary") {
+			compactions.push(compactionOf(line));
+			continue;
+		}
+		if (kind.value.type !== "assistant") continue;
 		const assistant = decodeAssistant(line);
 		if (Option.isNone(assistant)) return Option.none();
 		const { model, id, usage } = assistant.value.message;
@@ -32679,8 +33616,17 @@ function repliesIn(text) {
 			cacheRead: usage.cache_read_input_tokens ?? 0
 		});
 	}
-	return Option.some(replies);
+	return Option.some({
+		replies,
+		compactions
+	});
 }
+/** A read that found nothing. */
+const nothingIn = {
+	replies: [],
+	steps: [],
+	compactions: []
+};
 /** A transcript never read: its top. */
 const top = {
 	offset: 0,
@@ -32713,6 +33659,23 @@ const KeptCounts = Schema.Struct({
 	cacheWrite: Count,
 	cacheRead: Count
 });
+const Known = Schema.Literals([
+	"waiting",
+	"read",
+	"failed"
+]);
+const KeptTally = Schema.Struct({
+	known: Known,
+	models: Schema.Array(Schema.Struct({
+		model: Schema.String,
+		...KeptCounts.fields
+	})),
+	replies: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		model: Schema.String,
+		...KeptCounts.fields
+	}))
+});
 const KeptFile = Schema.Struct({
 	generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
 	read: Schema.Array(Schema.Struct({
@@ -32725,24 +33688,42 @@ const KeptFile = Schema.Struct({
 	turn: Schema.optionalKey(Schema.Struct({
 		number: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)),
 		facts: TurnFacts,
-		known: Schema.Literals([
-			"waiting",
-			"read",
-			"failed"
-		]),
-		models: Schema.Array(Schema.Struct({
-			model: Schema.String,
-			...KeptCounts.fields
+		startedAt: Schema.optionalKey(Count),
+		tokens: KeptTally,
+		context: Schema.Struct({
+			known: Known,
+			peak: Schema.optionalKey(Count),
+			compactions: Schema.Array(Schema.Struct({
+				trigger: Schema.optionalKey(Schema.Literals(["auto", "manual"])),
+				at: Schema.optionalKey(Count)
+			}))
+		}),
+		subagents: Schema.Array(Schema.Struct({
+			transcript: Schema.String,
+			type: Schema.optionalKey(Schema.String),
+			tokens: KeptTally
 		})),
-		replies: Schema.Array(Schema.Struct({
-			id: Schema.String,
-			model: Schema.String,
-			...KeptCounts.fields
-		}))
+		moreSubagents: Count
 	}))
 });
 const encodeKept = Schema.encodeSync(Schema.fromJsonString(KeptFile));
 const decodeKept = Schema.decodeUnknownOption(Schema.fromJsonString(KeptFile));
+const tallyFromFile = (tally) => ({
+	known: tally.known,
+	models: new Map(tally.models.map(({ model, ...counts }) => [model, counts])),
+	replies: new Map(tally.replies.map(({ id, ...reply }) => [id, reply]))
+});
+const tallyToFile = (tally) => ({
+	known: tally.known,
+	models: [...tally.models].map(([model, counts]) => ({
+		model,
+		...counts
+	})),
+	replies: [...tally.replies].map(([id, reply]) => ({
+		id,
+		...reply
+	}))
+});
 const fromFile = (file) => ({
 	generation: file.generation,
 	places: new Map(file.read.map(({ path, ...place }) => [path, place])),
@@ -32750,10 +33731,19 @@ const fromFile = (file) => ({
 	turn: Option.fromNullishOr(file.turn).pipe(Option.map((turn) => ({
 		number: turn.number,
 		facts: turn.facts,
-		tokens: {
-			known: turn.known,
-			models: new Map(turn.models.map(({ model, ...counts }) => [model, counts])),
-			replies: new Map(turn.replies.map(({ id, ...reply }) => [id, reply]))
+		startedAt: turn.startedAt,
+		reads: {
+			tokens: tallyFromFile(turn.tokens),
+			context: {
+				known: turn.context.known,
+				peak: turn.context.peak,
+				compactions: turn.context.compactions
+			},
+			subagents: new Map(turn.subagents.map(({ transcript, type, tokens }) => [transcript, {
+				type,
+				tokens: tallyFromFile(tokens)
+			}])),
+			moreSubagents: turn.moreSubagents
 		}
 	})))
 });
@@ -32767,20 +33757,32 @@ const toFile = (kept) => {
 		own: kept.own
 	};
 	if (Option.isSome(kept.turn)) {
-		const { number, facts, tokens } = kept.turn.value;
-		file.turn = {
+		const { number, facts, reads, startedAt } = kept.turn.value;
+		const { known, peak, compactions } = reads.context;
+		const turn = {
 			number,
 			facts,
-			known: tokens.known,
-			models: [...tokens.models].map(([model, counts]) => ({
-				model,
-				...counts
-			})),
-			replies: [...tokens.replies].map(([id, reply]) => ({
-				id,
-				...reply
-			}))
+			tokens: tallyToFile(reads.tokens),
+			context: peak === void 0 ? {
+				known,
+				compactions
+			} : {
+				known,
+				peak,
+				compactions
+			},
+			subagents: [...reads.subagents].map(([transcript, { type, tokens }]) => type === void 0 ? {
+				transcript,
+				tokens: tallyToFile(tokens)
+			} : {
+				transcript,
+				type,
+				tokens: tallyToFile(tokens)
+			}),
+			moreSubagents: reads.moreSubagents
 		};
+		if (startedAt !== void 0) turn.startedAt = startedAt;
+		file.turn = turn;
 	}
 	return file;
 };
@@ -32877,8 +33879,7 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 		const readOne = Effect.fnUntraced(function* (harness, transcript, from, until) {
 			const info = yield* fs.stat(transcript);
 			if (info.type !== "File") return {
-				replies: [],
-				steps: [],
+				...nothingIn,
 				whole: false,
 				to: from,
 				reached: false
@@ -32890,6 +33891,7 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 				const lost = harness === "codex" && (!same || from.running === void 0);
 				const replies = [];
 				const steps = [];
+				const compactions = [];
 				let at = lost ? yield* tailOf(file, size) : same ? from.offset : 0;
 				let running = lost ? totalLost : from.running;
 				let whole = !lost;
@@ -32908,6 +33910,7 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 					if (harness === "codex") {
 						const found = stepsIn(text, running ?? totalLost, until);
 						steps.push(...found.steps);
+						compactions.push(...found.compactions);
 						running = found.running;
 						whole &&= found.whole;
 						if (found.before !== void 0) {
@@ -32916,8 +33919,11 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 							break;
 						}
 					} else {
-						const found = repliesIn(text);
-						replies.push(...Option.getOrElse(found, () => []));
+						const found = transcriptIn(text);
+						if (Option.isSome(found)) {
+							replies.push(...found.value.replies);
+							compactions.push(...found.value.compactions);
+						}
 						whole &&= Option.isSome(found);
 					}
 					at += lines;
@@ -32926,6 +33932,7 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 				return {
 					replies,
 					steps,
+					compactions,
 					whole,
 					to: placeOf(at, hash, running),
 					reached
@@ -32978,25 +33985,27 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 			const state = yield* stateOf(owner);
 			const replies = [];
 			const steps = [];
+			const compactions = [];
 			const places = /* @__PURE__ */ new Map();
 			let whole = true;
 			for (const transcript of transcripts) {
 				const since = harness === "codex" ? turn?.since : void 0;
 				const from = state.places.get(transcript) ?? (since === void 0 ? top : yield* subagentStartOf(transcript, since));
 				const one = yield* readOne(harness, transcript, from, turn?.until).pipe(Effect.orElseSucceed(() => ({
-					replies: [],
-					steps: [],
+					...nothingIn,
 					whole: false,
 					to: from
 				})));
 				replies.push(...one.replies);
 				steps.push(...one.steps);
+				compactions.push(...one.compactions);
 				places.set(transcript, one.to);
 				whole &&= one.whole;
 			}
 			return {
 				replies,
 				steps,
+				compactions,
 				places,
 				whole
 			};
@@ -33181,6 +34190,8 @@ function withContext(answer, event, delivered) {
 //#region src/harness/hook-input.ts
 const decodeObjectText = Schema.decodeUnknownOption(Schema.fromJsonString(JsonObject));
 const filled = (text) => text === "" || text === null ? void 0 : text;
+/** Milliseconds as a hook's text says them, rounded; none for text that isn't a number. */
+const millisOf = (text) => text !== void 0 && /^\d{1,15}(\.\d+)?$/.test(text) ? Math.round(Number(text)) : void 0;
 const toolValue = (value) => {
 	if (value === void 0 || value === "") return void 0;
 	if (value instanceof Object) return value;
@@ -33194,22 +34205,26 @@ function readHook(args) {
 	};
 	const turn = filled(args.prompt_id) ?? filled(args.turn_id);
 	const agent = filled(args.agent_id);
+	const agentType = filled(args.agent_type);
 	const name = filled(args.tool_name);
 	const callId = filled(args.tool_use_id);
 	const input = toolValue(args.tool_input);
 	const response = toolValue(args.tool_response);
+	const durationMs = millisOf(filled(args.duration_ms));
 	const model = filled(args.model);
 	const cwd = filled(args.cwd);
 	const transcript = filled(args.transcript_path);
 	const agentTranscript = filled(args.agent_transcript_path);
 	if (turn !== void 0) hook.harnessTurn = turn;
 	if (agent !== void 0) hook.agent = agent;
+	if (agentType !== void 0) hook.agentType = agentType;
 	if (name !== void 0) hook.tool = callId === void 0 ? { name } : {
 		name,
 		callId
 	};
 	if (input instanceof Object) hook.toolInput = input;
 	if (response !== void 0) hook.toolResponse = response;
+	if (durationMs !== void 0) hook.durationMs = durationMs;
 	if (model !== void 0) hook.model = model;
 	if (cwd !== void 0) hook.cwd = cwd;
 	if (transcript !== void 0) hook.transcript = transcript;
@@ -33224,28 +34239,31 @@ function readHook(args) {
 * `ref0 clone` writes), or, with none, on a new thread under a plain title, such as "Claude Code
 * in shop, 9 Oct 14:02", which the agent then names in its own words (decided, 9 Oct 2026, 3).
 * The prompt's words never become the title. A session `ref0 watch` started says so, with the
-* event that started its thread, as its trigger. The session's token is kept in the keychain
-* under its binding's account, and nowhere else, and its thread beside it, so the session that
-* follows one that ended goes on the same thread.
+* event that started its thread, as its trigger. The session's credential is kept in the
+* keychain under its binding's account, and nowhere else, as one record with the key it's bound
+* to and the grant that started it, and its thread beside it, so the session that follows one
+* that ended goes on the same thread.
 */
 /** The keychain account a binding's thread is kept under, beside its session token's. */
 const threadAccount = (binding) => `${sessionAccount(binding)}/thread`;
 /** The keychain account a start not yet landed is kept under, beside its session token's. */
 const pendingAccount = (binding) => `${sessionAccount(binding)}/pending`;
 const decodeRequest = Schema.decodeUnknownEffect(StartSessionRequest);
-const decodeRequestId = Schema.decodeUnknownOption(RequestId);
 /**
-* A pending start's request ID and secret, as kept: `<request ID> <secret>`. One whose secret
-* isn't a token's, kept before tokens took only those, could never authorize, so it's dropped.
+* A start not yet landed, as kept: its request ID and secret, and the grant that authorized it
+* and the key it was signed by, so it's sent again only by that grant, with that key. One kept
+* in any other form is dropped, and the next start is a new one.
 */
-const decodePending = (kept) => {
-	const [requestId = "", secret = ""] = kept.split(" ");
-	if (!isTokenSecret(secret)) return Option.none();
-	return Option.map(decodeRequestId(requestId), (id) => ({
-		requestId: id,
-		secret
-	}));
-};
+const PendingStart = Schema.Struct({
+	requestId: RequestId,
+	secret: Schema.String.check(Schema.makeFilter((secret) => isTokenSecret(secret))),
+	hostGrant: CredentialRef,
+	cnf: Schema.optional(KeyBinding)
+});
+const decodePending = Schema.decodeUnknownOption(Schema.fromJsonString(PendingStart));
+const encodePending = Schema.encodeSync(Schema.fromJsonString(PendingStart));
+/** Whether a pending start was authorized as a start now would be: by this grant, with this key. */
+const sameAuthority = (pending, hostGrant, cnf) => pending.hostGrant.person === hostGrant.person && pending.hostGrant.id === hostGrant.id && pending.cnf?.jkt === cnf?.jkt;
 /** A secret's SHA-256, as hex: all ref0 is told of it. */
 const hashOf = (secret) => Effect.map(Effect.promise(async () => await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret))), (digest) => Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join(""));
 /** How the harness is named in a plain title. */
@@ -33266,19 +34284,27 @@ const whyNotSaidYet = "Not said yet: the agent says why this thread is needed, a
 const startHarnessSession = Effect.fnUntraced(function* (input) {
 	const hostGrant = yield* HostGrant;
 	const keychain = yield* Keychain;
-	const config = yield* Ref0Config;
 	const harness = input.binding.harness === "codex" ? "codex" : "claude-code";
 	const folder = yield* (yield* ConfigFolders).folder(harness);
 	const grant = yield* hostGrant.get(folder);
 	if (Option.isNone(grant) || grant.value.harness !== harness) return Option.none();
+	const authorizing = grantRef(grant.value);
+	if (Option.isNone(authorizing)) return Option.none();
+	const cnf = grant.value.cnf;
+	const client = yield* keptClient(grant.value);
 	const pending = pendingAccount(input.binding);
-	const held = Option.flatMap(yield* keychain.get(sessionAccount(input.binding)), (kept) => parseToken(Redacted.value(kept)));
-	const resent = Option.filter(Option.flatMap(yield* keychain.get(pending), (kept) => decodePending(Redacted.value(kept))), (one) => !Option.exists(held, (parts) => parts.secret === one.secret));
+	const held = Option.flatMap(readKeptSession(yield* keychain.get(sessionAccount(input.binding))), (kept) => parseToken(Redacted.value(kept.token)));
+	const resent = Option.filter(Option.flatMap(yield* keychain.get(pending), (kept) => decodePending(Redacted.value(kept))), (one) => sameAuthority(one, authorizing.value, cnf) && !Option.exists(held, (parts) => parts.secret === one.secret));
 	const { requestId, secret } = Option.isSome(resent) ? resent.value : {
 		requestId: yield* newRequestId,
 		secret: encodeSecret(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))
 	};
-	if (Option.isNone(resent)) yield* keychain.set(pending, Redacted.make(`${requestId} ${secret}`));
+	if (Option.isNone(resent)) yield* keychain.set(pending, Redacted.make(encodePending({
+		requestId,
+		secret,
+		hostGrant: authorizing.value,
+		cnf
+	})));
 	const hash = yield* hashOf(secret);
 	const where = input.on.kind === "thread" ? threadParts(input.on.written) : {
 		owner: grant.value.owner,
@@ -33305,7 +34331,7 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 		trigger: input.trigger,
 		attended: "reported"
 	});
-	const started = yield* (yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(grant.value.token)))).sessions.start({
+	const started = yield* client.sessions.start({
 		headers: { "idempotency-key": requestId },
 		payload
 	}).pipe(Effect.tapError((error) => Match.value(error).pipe(Match.tag("ProjectNotFound", "ProjectNotReady", "ThreadNotFound", "ThreadIsClosed", "TextRefused", "NotPermitted", "DeliveryOutsideWindow", () => keychain.remove(pending)), Match.orElse(() => Effect.void))));
@@ -33313,11 +34339,20 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 		kind: "project",
 		name: newThreadProject
 	}, started.threadNumber);
+	const kept = {
+		token: Redacted.make(formatToken(started.credential.person, started.credential.id, secret)),
+		session: started.session,
+		hostGrant: authorizing.value,
+		cnf
+	};
 	yield* keychain.remove(gitTokenAccount(input.binding)).pipe(Effect.ignore);
-	yield* keychain.set(sessionAccount(input.binding), Redacted.make(formatToken(started.credential.person, started.credential.id, secret)));
+	yield* keychain.set(sessionAccount(input.binding), keptSessionValue(kept));
 	yield* keychain.set(threadAccount(input.binding), Redacted.make(thread)).pipe(Effect.ignore);
 	yield* keychain.remove(pending).pipe(Effect.ignore);
-	return Option.some(started);
+	return Option.some({
+		started,
+		kept
+	});
 });
 //#endregion
 //#region src/harness/watched-start.ts
@@ -33400,14 +34435,13 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 	const owned = yield* Ref.make(Option.none());
 	const onTheWay = yield* Ref.make(Option.none());
 	const listen = Effect.fnUntraced(function* (bound) {
-		const client = yield* clientOf(bound.token);
 		let pause = 1;
 		let opened = false;
 		for (;;) {
-			const ticket = yield* client.live.ticket({ payload: { track: {
+			const ticket = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.live.ticket({ payload: { track: {
 				kind: "session",
 				session: bound.session
-			} } }).pipe(Effect.option);
+			} } })), Effect.option);
 			let closed;
 			if (Option.isSome(ticket)) {
 				if (opened) yield* edges.moved;
@@ -33433,12 +34467,12 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		}
 	});
 	const renew = Effect.fnUntraced(function* (bound) {
-		const client = yield* clientOf(bound.token);
 		for (;;) {
-			const renewed = yield* client.sessions.renew({
+			const key = yield* newRequestId;
+			const renewed = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.sessions.renew({
 				params: { session: bound.session },
-				headers: { "idempotency-key": yield* newRequestId }
-			}).pipe(Effect.as("renewed"), Effect.catchTag("SessionHasEnded", () => Effect.succeed("ended")), Effect.orElseSucceed(() => "failed"));
+				headers: { "idempotency-key": key }
+			}))).pipe(Effect.as("renewed"), Effect.catchTag("SessionHasEnded", () => Effect.succeed("ended")), Effect.orElseSucceed(() => "failed"));
 			if (renewed === "ended") {
 				yield* oneAtATime.withPermits(1)(Ref.set(state, {
 					kind: "ended",
@@ -33450,9 +34484,9 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		}
 	});
 	const keptThread = (binding) => keychain.get(threadAccount(binding)).pipe(Effect.map(Option.flatMap((kept) => decodeWrittenThread(Redacted.value(kept)))), Effect.orElseSucceed(() => Option.none()));
-	const hasEnded = (token) => clientOf(token).pipe(Effect.flatMap((client) => client.me.get()), Effect.as(false), Effect.catchTag("SessionHasEnded", () => Effect.succeed(true)), Effect.orElseSucceed(() => false));
+	const hasEnded = (kept) => clientOf(kept).pipe(Effect.flatMap((client) => client.me.get()), Effect.as(false), Effect.catchTag("SessionHasEnded", () => Effect.succeed(true)), Effect.orElseSucceed(() => false));
 	const heldFor = Effect.fnUntraced(function* (binding, over) {
-		const kept = yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none()));
+		const kept = readKeptSession(yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none())));
 		if (!over || Option.isNone(kept) || !(yield* hasEnded(kept.value))) return kept;
 		return Option.none();
 	});
@@ -33491,8 +34525,7 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 			"ProjectNotFound",
 			"NotPermitted"
 		], (refused) => Option.isSome(before) ? Effect.andThen(keychain.remove(threadAccount(binding)).pipe(Effect.ignore), startOn(start.thread)) : Effect.fail(refused)), Effect.orElseSucceed(() => Option.none()));
-		if (Option.isNone(started)) return Option.none();
-		return yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none()));
+		return Option.map(started, (one) => one.kept);
 	});
 	const startedFor = Effect.fnUntraced(function* (binding, hook, starting) {
 		const sent = yield* Ref.get(onTheWay);
@@ -33518,28 +34551,19 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		if ((over && !starting || waiting) && !sent) return Option.none();
 		const binding = yield* bindingForServer(hook.harnessSession);
 		const held = Option.isNone(binding) ? Option.none() : yield* heldFor(binding.value, over);
-		const token = Option.isSome(held) || Option.isNone(binding) ? held : yield* startedFor(binding.value, hook, starting);
-		if (Option.isNone(binding) || Option.isNone(token)) {
+		const kept = Option.isSome(held) || Option.isNone(binding) ? held : yield* startedFor(binding.value, hook, starting);
+		if (Option.isNone(binding) || Option.isNone(kept)) {
 			if (!over) yield* Ref.set(state, {
 				kind: "unbound",
 				until: now + unboundMillis
 			});
 			return Option.none();
 		}
-		const client = yield* clientOf(token.value);
-		const me = yield* client.me.get();
-		if (me.session === void 0) {
-			yield* Ref.set(state, {
-				kind: "unbound",
-				until: now + unboundMillis
-			});
-			return Option.none();
-		}
-		const registered = yield* client.sessions.process({ params: { session: me.session.session } });
+		const registered = yield* (yield* clientOf(kept.value)).sessions.process({ params: { session: kept.value.session } });
 		const bound = {
 			binding: binding.value,
-			token: token.value,
-			session: me.session.session,
+			kept: kept.value,
+			session: kept.value.session,
 			generation: registered.generation,
 			counter: 0,
 			unreported: []
@@ -33635,175 +34659,53 @@ const sessionTasks = Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region src/harness/turn-facts.ts
-/** The most tool names a turn's record counts. */
-const toolNames = 100;
-/** The most replies a turn's tally remembers; a turn with more has its tokens unknown. */
-const turnReplies = 1e4;
-const nothingSeen = {
-	tools: /* @__PURE__ */ new Map(),
-	addresses: [],
-	more: 0,
-	model: void 0,
-	tokens: {
-		known: "waiting",
-		models: /* @__PURE__ */ new Map(),
-		replies: /* @__PURE__ */ new Map()
-	},
-	startedAt: void 0,
-	stoppedAt: void 0
-};
-/**
-* A hook seen at `at`: a tool call counted by its tool once it ran, the files an edit is about to
-* touch kept, at most 50 and the rest counted, the model, where the hook names one, and a `Stop`
-* as when the agent last stopped.
-*/
-function seeHook(seen, hook, edited, at) {
-	const tools = new Map(seen.tools);
-	const name = hook.tool?.name;
-	if (hook.event === "PostToolUse" && name !== void 0) {
-		const counted = tools.get(name);
-		if (counted !== void 0 || tools.size < toolNames) tools.set(name, (counted ?? 0) + 1);
-	}
-	const addresses = [...seen.addresses];
-	let more = seen.more;
-	for (const each of edited) {
-		if (addresses.some((kept) => kept.repo === each.repo && kept.path === each.path)) continue;
-		if (addresses.length < 50) addresses.push(each);
-		else more += 1;
-	}
-	return {
-		...seen,
-		tools,
-		addresses,
-		more,
-		model: hook.model ?? seen.model,
-		stoppedAt: hook.event === "Stop" ? at : seen.stoppedAt
-	};
-}
-/**
-* A read's replies added to a turn's, each by its message ID at the most any of its lines says:
-* a subagent's transcript writes a reply's output as it grows, line by line, so a line of a reply
-* already counted adds only what it grew. `own` when the read was of the session's own
-* transcript, which makes the turn's tokens known; nothing makes them known once a read has
-* failed.
-*/
-function addReplies(tally, replies, own) {
-	if (tally.known === "failed") return tally;
-	const models = new Map(tally.models);
-	const counted = new Map(tally.replies);
-	for (const reply of replies) {
-		const before = counted.get(reply.id);
-		const most = {
-			model: before?.model ?? reply.model,
-			input: Math.max(before?.input ?? 0, reply.input),
-			output: Math.max(before?.output ?? 0, reply.output),
-			cacheWrite: Math.max(before?.cacheWrite ?? 0, reply.cacheWrite),
-			cacheRead: Math.max(before?.cacheRead ?? 0, reply.cacheRead)
-		};
-		const sum = models.get(most.model);
-		counted.set(reply.id, most);
-		models.set(most.model, {
-			input: (sum?.input ?? 0) + most.input - (before?.input ?? 0),
-			output: (sum?.output ?? 0) + most.output - (before?.output ?? 0),
-			cacheWrite: (sum?.cacheWrite ?? 0) + most.cacheWrite - (before?.cacheWrite ?? 0),
-			cacheRead: (sum?.cacheRead ?? 0) + most.cacheRead - (before?.cacheRead ?? 0)
-		});
-	}
-	if (counted.size > turnReplies) return readFailed(tally);
-	return {
-		known: own ? "read" : tally.known,
-		models,
-		replies: counted
-	};
-}
-/**
-* A read's requests added to a turn's, by model, as Codex's rollout steps its running total.
-* `own` as for `addReplies`: a rollout is always the session's own.
-*/
-function addSteps(tally, steps, own) {
-	if (tally.known === "failed") return tally;
-	const models = new Map(tally.models);
-	for (const step of steps) {
-		const sum = models.get(step.model);
-		models.set(step.model, {
-			input: (sum?.input ?? 0) + step.input,
-			output: (sum?.output ?? 0) + step.output,
-			cacheWrite: (sum?.cacheWrite ?? 0) + step.cacheWrite,
-			cacheRead: (sum?.cacheRead ?? 0) + step.cacheRead
-		});
-	}
-	return {
-		...tally,
-		known: own ? "read" : tally.known,
-		models
-	};
-}
-/** A read that failed: the turn's tokens are unknown from then on. */
-const readFailed = (tally) => ({
-	...tally,
-	known: "failed"
-});
-/** A read's replies and requests added to a turn's tokens, or its tokens unknown if it failed. */
-const addRead = (tally, read, own) => read.whole ? addSteps(addReplies(tally, read.replies, own), read.steps, own) : readFailed(tally);
-/**
-* A turn's tokens as ref0 keeps them: each model's counts once the session's own transcript is
-* read, or unknown, with no counts, where it wasn't, a read failed, or a count passes what a
-* turn may hold.
-*/
-function turnTokens(tally) {
-	if (tally.known !== "read" || tally.models.size > 16) return { known: "unknown" };
-	const models = [...tally.models].map(([model, counts]) => ({
-		model,
-		...counts
-	}));
-	return models.every((each) => Math.max(each.input, each.output, each.cacheWrite, each.cacheRead) <= 1e8 && each.model.length >= 1 && each.model.length <= 128) ? {
-		known: "read",
-		models
-	} : { known: "unknown" };
-}
-/**
-* A turn's facts as ref0 keeps them, with its stop as how long after ref0 started it the agent last
-* stopped: none until both are seen, and 0 for a `Stop` before its start landed.
-*/
-function turnFacts(seen) {
-	const facts = {
-		modelSource: seen.model === void 0 ? "unknown" : "hook",
-		tools: Object.fromEntries(seen.tools),
-		addresses: seen.addresses,
-		more: seen.more,
-		tokens: turnTokens(seen.tokens)
-	};
-	if (seen.model !== void 0) facts.model = seen.model;
-	if (seen.startedAt !== void 0 && seen.stoppedAt !== void 0) facts.stoppedAfterMs = Math.max(seen.stoppedAt - seen.startedAt, 0);
-	return facts;
-}
-//#endregion
 //#region src/harness/session-turns.ts
 /** The open turn as `SessionEnd` tells it once more: none until ref0 has numbered it. */
 const keptOf = (now) => now.kind === "open" ? Option.some({
 	number: now.number,
 	facts: turnFacts(now.seen),
-	tokens: now.seen.tokens
+	reads: now.seen,
+	startedAt: now.seen.startedAt
 }) : Option.none();
 /**
-* The transcripts a hook's read takes, and whether the session's own is among them: at the
-* tracked turn's own `Stop`, the session's; at any subagent's `SubagentStop`, its own, whichever
-* turn started it, since it adds to the turn still open, with the turn Codex names there, the
-* subagent's own, where its rollout's own part starts. A new turn's prompt reads the session's
-* first, for the turn it ends.
+* The transcripts a hook's read takes, and whose they are: at the tracked turn's own `Stop`, the
+* session's; at any subagent's `SubagentStop`, its own, whichever turn started it, since it adds
+* to the turn still open, with the turn Codex names there, the subagent's own, where its
+* rollout's own part starts, and its type. A new turn's prompt reads the session's first, for
+* the turn it ends.
 */
 const toRead = (hook, ownHook) => {
 	if (hook.event === "Stop" && ownHook && hook.transcript !== void 0) return {
 		transcripts: [hook.transcript],
-		own: true
+		of: { own: true }
 	};
 	if (hook.event === "SubagentStop" && hook.agentTranscript !== void 0) return {
 		transcripts: [hook.agentTranscript],
-		own: false,
+		of: {
+			own: false,
+			subagent: hook.agentTranscript,
+			type: hook.agentType
+		},
 		turn: { since: hook.harnessTurn }
 	};
 };
+/** A read that couldn't happen, as of a subagent whose harness kept no transcript of it. */
+const unread = {
+	replies: [],
+	steps: [],
+	compactions: [],
+	whole: false
+};
+/**
+* A subagent's `SubagentStop` that names no transcript of it, as Codex's in a session kept
+* nowhere: the subagent counted by its ID, with its type, and its tokens, and so the turn's,
+* unknown, since what it used can't be read.
+*/
+const untranscribed = (hook) => hook.event === "SubagentStop" && hook.agentTranscript === void 0 ? {
+	own: false,
+	subagent: `agent:${hook.agent ?? ""}`,
+	type: hook.agentType
+} : void 0;
 /** A harness session's turns, each numbered by ref0 as it starts. */
 const sessionTurns = Effect.fnUntraced(function* (edges) {
 	const transcripts = yield* Transcripts;
@@ -33824,7 +34726,11 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 		const ending = prompted === void 0 ? void 0 : yield* transcripts.read(owner, harness, [prompted], { until: harnessTurn });
 		const fresh = late && harness === "claude-code" ? {
 			...nothingSeen,
-			tokens: readFailed(nothingSeen.tokens)
+			tokens: readFailed(nothingSeen.tokens),
+			context: {
+				...nothingSeen.context,
+				known: "failed"
+			}
 		} : nothingSeen;
 		const tracked = isNew ? Option.some({
 			kind: "starting",
@@ -33833,7 +34739,7 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 				turn: now.number,
 				seen: ending === void 0 ? now.seen : {
 					...now.seen,
-					tokens: addRead(now.seen.tokens, ending, true)
+					...addRead(now.seen, ending, { own: true })
 				}
 			}) : now.previous),
 			seen: fresh
@@ -33845,9 +34751,13 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 		const hooked = ownHook && !isNew ? seeHook(tracked.value.seen, hook, edited, yield* Clock.currentTimeMillis) : tracked.value.seen;
 		const reading = toRead(hook, ownHook);
 		const read = reading === void 0 ? void 0 : yield* transcripts.read(owner, harness, reading.transcripts, reading.turn);
-		const seen = read === void 0 || reading === void 0 ? hooked : {
+		const unseen = untranscribed(hook);
+		const seen = read === void 0 || reading === void 0 ? unseen === void 0 ? hooked : {
+			...hooked,
+			...addRead(hooked, unread, unseen)
+		} : {
 			...hooked,
-			tokens: addRead(hooked.tokens, read, reading.own)
+			...addRead(hooked, read, reading.of)
 		};
 		const places = (read ?? ending)?.places;
 		let now = {
@@ -33856,7 +34766,7 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 		};
 		yield* Effect.uninterruptible(Effect.gen(function* () {
 			yield* Ref.set(turn, Option.some(now));
-			if (places !== void 0) yield* transcripts.keep(owner, places, keptOf(now));
+			if (places !== void 0 || unseen !== void 0) yield* transcripts.keep(owner, places ?? /* @__PURE__ */ new Map(), keptOf(now));
 		}));
 		if (now.kind === "starting") {
 			if (Option.isSome(now.previous)) yield* edges.tasksLanded(client, bound, deadline);
@@ -33907,7 +34817,7 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 		if (ownHook && hook.event === "Stop") {
 			yield* edges.tasksLanded(client, bound, deadline);
 			yield* tellFacts;
-		} else if (hook.event === "SubagentStop" && read !== void 0) yield* tellFacts;
+		} else if (hook.event === "SubagentStop" && (read !== void 0 || unseen !== void 0)) yield* tellFacts;
 	});
 	return {
 		now: Ref.get(turn),
@@ -34038,7 +34948,6 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 	*/
 	static layerFor(agent) {
 		return Layer.effect(HarnessSession, Effect.gen(function* () {
-			const config = yield* Ref0Config;
 			const context = yield* Effect.context();
 			const state = yield* Ref.make({
 				kind: "unbound",
@@ -34058,13 +34967,13 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 				within: Effect.suspend(() => binding.within),
 				scope
 			});
-			const clientOf = (token) => ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
+			const clientOf = (kept) => keptClient(kept).pipe(Effect.provide(context));
 			const watch = yield* baseWatch({
 				scope,
 				clientOf
 			});
 			const settle = Effect.fnUntraced(function* (bound) {
-				const client = yield* clientOf(bound.token);
+				const client = yield* clientOf(bound.kept);
 				const refused = () => Effect.succeed("refused");
 				yield* attribution.settle(ownerOf(bound), (repo, part) => client.sessions.commit({
 					params: {
@@ -34110,7 +35019,7 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 				if (hook.event === "UserPromptSubmit") yield* Ref.set(prompted, Option.some(hook));
 				const bound = yield* binding.bind(hook);
 				if (Option.isNone(bound)) return Option.none();
-				const client = yield* clientOf(bound.value.token);
+				const client = yield* clientOf(bound.value.kept);
 				const prompt = Option.filter(yield* Ref.get(prompted), (one) => one.harnessSession === hook.harnessSession && one.harnessTurn === hook.harnessTurn);
 				if (Option.isSome(prompt)) yield* Ref.set(prompted, Option.none());
 				if (Option.isSome(prompt) && prompt.value !== hook) yield* turns.trackLate(client, bound.value, prompt.value, deadline);
@@ -34311,7 +35220,7 @@ const endWithin = "5 seconds";
 const lastReadWithin = "2 seconds";
 /**
 * The turn `ref0 mcp` last told ref0 of, told once more with what the session's transcript
-* gained since: a reply written after its last `Stop` counts in it, and a `Stop` whose facts
+* gained since: a reply or a compaction written after its last `Stop` counts in it, and a `Stop` whose facts
 * didn't land has them sent again. Nothing for a turn ref0 hasn't numbered.
 */
 const lastRead = Effect.fnUntraced(function* (client, session, harness, transcript) {
@@ -34324,7 +35233,7 @@ const lastRead = Effect.fnUntraced(function* (client, session, harness, transcri
 	};
 	const turn = kept.value.turn.value;
 	const read = transcript === null || transcript === void 0 || transcript === "" ? void 0 : yield* transcripts.read(owner, harness, [transcript]);
-	const tokens = read === void 0 ? turn.tokens : addRead(turn.tokens, read, true);
+	const reads = read === void 0 ? turn.reads : addRead(turn.reads, read, { own: true });
 	yield* client.sessions.turnFacts({
 		params: {
 			session,
@@ -34334,16 +35243,11 @@ const lastRead = Effect.fnUntraced(function* (client, session, harness, transcri
 			generation: owner.generation,
 			facts: {
 				...turn.facts,
-				tokens: turnTokens(tokens)
+				...readFacts(reads, turn.startedAt)
 			}
 		}
 	});
 });
-/** The typed `/v1` as a session, with its own token: not the one this process's environment names. */
-const asSession = (token) => Effect.gen(function* () {
-	const config = yield* Ref0Config;
-	return yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
-});
 /** What the hook does, from the hook's input on stdin. */
 const endHarnessSession = Effect.gen(function* () {
 	const stdio = yield* Stdio.Stdio;
@@ -34355,13 +35259,13 @@ const endHarnessSession = Effect.gen(function* () {
 	const binding = yield* bindingHere(hook.value.session_id);
 	if (Option.isNone(binding)) return;
 	const account = sessionAccount(binding.value);
-	const token = yield* keychain.get(account);
-	if (Option.isNone(token)) return;
+	const held = yield* keychain.get(account);
+	if (Option.isNone(held)) return;
 	yield* Effect.gen(function* () {
-		const client = yield* asSession(token.value);
-		const me = yield* client.me.get();
-		if (me.session === void 0) return;
-		const session = me.session.session;
+		const kept = readKeptSession(held);
+		if (Option.isNone(kept)) return;
+		const client = yield* keptClient(kept.value);
+		const session = kept.value.session;
 		const harness = binding.value.harness === "codex" ? "codex" : "claude-code";
 		yield* lastRead(client, session, harness, hook.value.transcript_path).pipe(Effect.timeout(lastReadWithin), Effect.ignore);
 		yield* client.sessions.end({
@@ -34558,23 +35462,19 @@ const setCommitEnvironment = Effect.fnUntraced(function* (session) {
 */
 const decodeHook = Schema.decodeUnknownOption(Schema.fromJsonString(SessionStartHookInput));
 /**
-* What blocks the session's thread, in the words its agent reads, read with the session's own
-* token; none if nothing does. A session already started is found by its token.
+* What blocks the session's thread, in the words its agent reads, read as the session, as it's
+* kept; none if nothing does.
 */
-const blockedBy = Effect.fnUntraced(function* (token, known) {
-	const config = yield* Ref0Config;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
-	const session = Option.isSome(known) ? known.value : (yield* client.me.get()).session?.session;
-	if (session === void 0) return Option.none();
-	const read = yield* client.sessions.blockers({
-		params: { session },
+const blockedBy = Effect.fnUntraced(function* (kept) {
+	const read = yield* (yield* keptClient(kept)).sessions.blockers({
+		params: { session: kept.session },
 		query: {}
 	});
 	if (read.blockers.length === 0) return Option.none();
 	return Option.some(renderBlockedBy(read.thread, read.blockers));
 });
 /** Says what blocks the session's thread, if anything does; says nothing if ref0 can't tell. */
-const sayBlockers = (token, known) => blockedBy(token, known).pipe(Effect.flatMap(Option.match({
+const sayBlockers = (kept) => blockedBy(kept).pipe(Effect.flatMap(Option.match({
 	onNone: () => Effect.void,
 	onSome: Console.log
 })), Effect.ignore);
@@ -34615,9 +35515,8 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 		const why = kept.readable ? `no agent is connected for this ${name} config folder, ${folder}` : `the host grant kept for this ${name} config folder, ${folder}, can't be read`;
 		return yield* Console.log(`ref0: ${why}, so no session starts. In your own terminal, run: ${repair}`);
 	}
-	const account = sessionAccount(binding.value);
-	const held = yield* keychain.get(account);
-	if (Option.isSome(held)) return yield* sayBlockers(held.value, Option.none());
+	const held = readKeptSession(yield* keychain.get(sessionAccount(binding.value)));
+	if (Option.isSome(held)) return yield* sayBlockers(held.value);
 	const place = startPlace(yield* checkout.threadAt(hook.value.cwd ?? "."), yield* watchedHere);
 	if (Option.isNone(place.thread)) return;
 	const thread = place.thread.value;
@@ -34635,11 +35534,10 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 		version
 	}).pipe(Effect.tapError((error) => place.trigger.kind === "event" ? Console.log(refusedWords(thread, "nextStep" in error ? error.nextStep : void 0)) : Effect.void));
 	if (Option.isNone(started)) return;
-	yield* Console.log(`ref0: this session is on ${thread}, as its session ${started.value.sessionNumber}.`);
+	yield* Console.log(`ref0: this session is on ${thread}, as its session ${started.value.started.sessionNumber}.`);
 	const watched = watchedWords(place, thread);
 	if (watched !== void 0) yield* Console.log(`ref0: ${watched}`);
-	const token = yield* keychain.get(account);
-	if (Option.isSome(token)) yield* sayBlockers(token.value, Option.some(started.value.session));
+	yield* sayBlockers(started.value.kept);
 }).pipe(Effect.timeout("10 seconds"), Effect.ignore);
 const sessionStart = Command.make(harnessCommandNames.sessionStart, { protocol: protocolFlag }, (flags) => startOnHook(flags.protocol)).pipe(Command.withDescription("Starts the ref0 session of a harness session that’s opening"), Command.withShortDescription("Start a ref0 session for the harness"));
 /** The commands a harness runs: `ref0 mcp`, and its command hooks. */
@@ -34647,7 +35545,7 @@ const harnessCommands = [mcp, Command.make(harnessCommandNames.hook).pipe(Comman
 //#endregion
 //#region src/harness/command-token.ts
 /**
-* The session an agent's command acts as: its harness session's, by the token kept under its
+* The session an agent's command acts as: its harness session's, by the record kept under its
 * binding. Outside a harness there's none, and a command is its person's, asked by approval; so
 * too in a harness whose config folder has no agent connected. Where one is connected, a harness
 * session with no token has lost its start, and the command says why, as far as ref0 can tell,
@@ -34695,11 +35593,12 @@ const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
 	const current = Effect.gen(function* () {
 		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
 		if (Option.isNone(binding)) return Option.none();
-		const kept = yield* keychain.get(sessionAccount(binding.value));
+		const held = yield* keychain.get(sessionAccount(binding.value));
+		const kept = readKeptSession(held);
 		if (Option.isSome(kept)) return kept;
 		const name = binding.value.harness === "codex" ? "codex" : "claude-code";
 		const grant = yield* hostGrant.get(yield* folders.folder(name)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
-		if (Option.isNone(grant) || grant.value.harness !== name) return Option.none();
+		if ((Option.isNone(grant) || grant.value.harness !== name) && Option.isNone(held)) return Option.none();
 		const pending = yield* keychain.get(pendingAccount(binding.value));
 		const serverRuns = yield* servers.runsUnder(binding.value.process);
 		return yield* new NoSession({ nextStep: noSessionStep(name, `plugin:${plugin}:${plugin}`, {
@@ -34881,25 +35780,33 @@ const wordsOf = (report, home) => {
 	}, ...check.next === void 0 ? [] : [{ command: check.next }]])];
 };
 const refused = () => Effect.succeed({ kind: "refused" });
-const whoIs = Effect.fnUntraced(function* (token) {
-	const config = yield* Ref0Config;
-	return yield* (yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)))).me.get().pipe(Effect.timeout("10 seconds"), Effect.map((me) => ({
-		kind: "accepted",
-		me
-	})), Effect.catchTags({
-		Unauthenticated: refused,
-		SessionHasEnded: refused
-	}), Effect.orElseSucceed(() => ({ kind: "unanswered" })));
-});
+const unsigned = (failed) => Effect.succeed({
+	kind: "unsigned",
+	nextStep: failed.nextStep
+});
+/** Asks ref0 who a client's credential is. */
+const whoIs = (client) => client.me.get().pipe(Effect.timeout("10 seconds"), Effect.map((me) => ({
+	kind: "accepted",
+	me
+})), Effect.catchTags({
+	Unauthenticated: refused,
+	SessionHasEnded: refused,
+	InvalidDpopProof: refused,
+	KeyStoreUnavailable: unsigned
+}), Effect.orElseSucceed(() => ({ kind: "unanswered" })));
 const unansweredWords = (api) => `ref0 didn’t answer at ${api}.`;
 /** Check the grant kept for this folder, without borrowing another folder's authority. */
 const grantChecks = Effect.fnUntraced(function* (grant, configFolder) {
-	const asked = yield* whoIs(grant.token);
+	const asked = yield* keptClient(grant).pipe(Effect.flatMap(whoIs), Effect.catchTags({
+		InvalidDpopProof: refused,
+		KeychainError: unsigned
+	}));
 	const connected = checkOf("connected", "yes", "this machine holds its grant");
 	switch (asked.kind) {
 		case "accepted": return [connected, checkOf("accepted", "yes", "ref0 accepts its grant")];
 		case "refused": return [connected, checkOf("accepted", "no", "ref0 refuses its grant", yield* connectLineFor(grant.harness, configFolder))];
 		case "unanswered": return [connected, checkOf("accepted", "unknown", unansweredWords((yield* Ref0Config).api), "ref0 status")];
+		case "unsigned": return [connected, checkOf("accepted", "unknown", "this machine’s key couldn’t sign to ask", asked.nextStep)];
 	}
 });
 /** Protocol mismatches either update this CLI or reinstall this folder's plugin. */
@@ -34990,12 +35897,17 @@ const sessionCheck = Effect.fnUntraced(function* (harness, configFolder) {
 	if (Option.isNone(binding)) return checkOf("session", "unknown", (yield* harnessEnvironment).CODEX_SANDBOX === void 0 ? "no current session to check" : "Codex’s sandbox hides its session", launch);
 	const token = yield* Effect.result((yield* Keychain).get(sessionAccount(binding.value)));
 	if (Result.isFailure(token)) return checkOf("session", "unknown", `The keychain didn’t say whether ref0 follows this ${configFolders[harness].name} session.`, token.failure.nextStep);
-	if (Option.isNone(token.success)) return checkOf("session", "no", "start a new session in this folder", launch);
-	const asked = yield* whoIs(token.success.value);
+	const kept = readKeptSession(token.success);
+	if (Option.isNone(kept)) return checkOf("session", "no", "start a new session in this folder", launch);
+	const asked = yield* keptClient(kept.value).pipe(Effect.flatMap(whoIs), Effect.catchTags({
+		InvalidDpopProof: refused,
+		KeychainError: unsigned
+	}));
 	switch (asked.kind) {
 		case "accepted": return asked.me.session === void 0 ? checkOf("session", "no", "start a new session in this folder", launch) : checkOf("session", "yes", `ref0 follows this session as ${asked.me.session.session}`);
 		case "refused": return checkOf("session", "no", "ref0 no longer follows this session", launch);
-		case "unanswered": return checkOf("session", "unknown", unansweredWords((yield* Ref0Config).api), "ref0 status");
+		case "unanswered":
+		case "unsigned": return checkOf("session", "unknown", unansweredWords((yield* Ref0Config).api), "ref0 status");
 	}
 });
 const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ json: asJson }) => Effect.gen(function* () {
@@ -35088,6 +36000,7 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 ]));
 const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
+const machineKey = MachineKey.layer.pipe(Layer.provide(keychain));
 const sessionToken = harnessSessionToken.pipe(Layer.provide([
 	keychain,
 	harnessProcess,
@@ -35098,10 +36011,27 @@ const sessionToken = harnessSessionToken.pipe(Layer.provide([
 const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,
 	sessionToken,
-	FetchHttpClient.layer
-])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
+	FetchHttpClient.layer,
+	machineKey,
+	ProofClock.layer
+])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, machineKey, ProofClock.layer, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([
+	Ref0Config.layer,
+	FetchHttpClient.layer,
+	machineKey,
+	ProofClock.layer
+])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
+//#endregion
+//#region src/root.ts
+/**
+* The CLI's root, around every command and the services it's given. A request's error holds the
+* request it was sent with, and a request a key signed holds its proof, which is good for a
+* minute, so `dpop` is redacted wherever one is printed, as `authorization` is. A failure no
+* command said, a service that couldn't be built included, is logged here, inside that redaction,
+* rather than by `runMain`, which logs outside it.
+*/
+const atRoot = (services) => (program) => program.pipe(Effect.provide(services), Effect.tapCause((cause) => Cause.hasInterruptsOnly(cause) || !Runtime.getErrorReported(Cause.squash(cause)) ? Effect.void : Effect.logError(cause)), Effect.provideServiceEffect(Headers.CurrentRedactedNames, Effect.map(Effect.service(Headers.CurrentRedactedNames), (names) => [...names, "dpop"])));
 //#endregion
 //#region src/main.ts
-ref0.pipe(Command.run({ version: cliVersion }), Effect.provide(services), NodeRuntime.runMain);
+ref0.pipe(Command.run({ version: cliVersion }), atRoot(services), NodeRuntime.runMain({ disableErrorReporting: true }));
 //#endregion
 export {};