@ref0/cli 0.6.0 → 0.8.0

package/dist/main.mjs

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Cause, Clock, Config, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
+import { Cause, Clock, Config, ConfigProvider, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
 import { Argument, CliOutput, Command, Flag, Prompt } from "effect/cli";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "effect/http-api";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { hostname } from "node:os";
 import { execFile, spawn } from "node:child_process";
-import { connect, createServer } from "node:net";
+import { createServer } from "node:http";
+import { access, constants } from "node:fs/promises";
+import { hostname } from "node:os";
+import { connect, createServer as createServer$1 } from "node:net";
 import { join } from "node:path";
 import { McpProtocol, McpServer, Tool, Toolkit } from "effect/ai";
 //#region ../contracts/src/typeid.ts
@@ -1299,7 +1301,9 @@ const FindingRef = Schema.Struct({
 * Who a passkey request asks: the accountable person; a person, by their name; or anyone holding
 * one of the repo's permissions, the first of whom to answer decides. Until a permission's holders
 * are kept, they're its owner's admins. A workflow run's `passkey.run` asks its run's accountable
-* person; a gate's `passkey.check` asks the person behind the run that meets its need.
+* person; a gate's `passkey.check` asks the person behind the run that meets its need. A person or
+* a permission is someone else, a second pair of eyes, so the person `'accountable'` would ask
+* never answers it: a request with nobody else to ask is refused.
 */
 const PasskeyFrom = Schema.Union([
 	Schema.Literal("accountable"),
@@ -6506,39 +6510,59 @@ var PasskeyRefused = class extends Schema.TaggedError()("PasskeyRefused", { next
 //#endregion
 //#region ../contracts/src/attachments.ts
 /** A machine asks, a signed-in person claims and approves, and the answer returns to its terminal. */
+/**
+* What could reorder or hide the text around it, such as U+202E: a control, format, surrogate,
+* private-use or unassigned character, or a line or paragraph separator.
+*/
+const hiddenCharacters = String.raw`\p{C}\p{Zl}\p{Zp}`;
+/** Text with none of them, which reads as it's written wherever it's shown. */
+const shownAsWritten = Schema.isPattern(new RegExp(`^[^${hiddenCharacters}]+$`, "u"));
+/** Text with each character that could reorder or hide what's around it taken out. */
+const withoutHiddenCharacters = (text) => text.replaceAll(new RegExp(`[${hiddenCharacters}]`, "gu"), "");
 /** A machine's own word for itself: shown to the person as what it says, never as fact. */
-const MachineName = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(64));
+const MachineName = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(64), shownAsWritten);
 /** The harness a machine says it connects for, never proof of what it runs. */
 const ConnectHarness = Schema.Literals(["claude-code", "codex"]);
-/**
-* A machine asks with no owner and sends hashes of its grant, collecting and link secrets.
-* The optional callback names only a loopback port and a random state segment, never a host.
-*/
+/** The machine's loopback listener; no caller may choose its host. */
+const AttachmentCallback = Schema.Struct({
+	port: Schema.Int.check(Schema.isBetween({
+		minimum: 1024,
+		maximum: 65535
+	})),
+	state: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/))
+});
+/** A config folder's path, as the machine shows it, never proof of its location. */
+const ConfigFolderPath = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(200), shownAsWritten);
+const uniqueFolderPaths = Schema.makeFilter((folders) => new Set(folders.map((folder) => folder.path)).size === folders.length, { expected: "unique config folder paths" });
+const RequestFolder = Schema.Struct({
+	path: ConfigFolderPath,
+	harness: ConnectHarness,
+	secretHash: SecretHash,
+	replaces: Schema.optionalKey(TokenId)
+});
+/** One to eight config folders, each with its own grant secret. */
 const RequestAttachment = Schema.Struct({
 	machine: MachineId,
 	machineName: MachineName,
-	harness: Schema.optionalKey(ConnectHarness),
-	secretHash: SecretHash,
+	folders: Schema.Array(RequestFolder).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
 	collectHash: SecretHash,
 	linkHash: SecretHash,
-	callback: Schema.optionalKey(Schema.Struct({
-		port: Schema.Int.check(Schema.isBetween({
-			minimum: 1024,
-			maximum: 65535
-		})),
-		state: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/))
-	}))
+	callback: Schema.optionalKey(AttachmentCallback)
 });
 /** An attachment request, as its person reads it once they type its code. */
 const AttachmentRequestView = Schema.Struct({
 	approval: ApprovalId,
 	/** The machine's own word for itself, never fact. */
 	machineName: MachineName,
-	/** The harness the machine says it uses, never fact. */
-	harness: Schema.optionalKey(ConnectHarness),
+	folders: Schema.Array(Schema.Struct({
+		path: ConfigFolderPath,
+		harness: ConnectHarness,
+		replaces: Schema.optionalKey(TokenId)
+	})),
 	askedFrom: Schema.optionalKey(Schema.String),
 	askedAt: Timestamp,
-	expiresAt: Timestamp
+	expiresAt: Timestamp,
+	callback: Schema.optionalKey(AttachmentCallback)
 });
 /**
 * What its answerer chooses to connect a machine's request to: one of the person's own agents,
@@ -6562,6 +6586,16 @@ const ConnectOrganization = Schema.Struct({
 	organization: OrgId,
 	name: OwnerName
 });
+/** Whether admission replaced a live host grant, or skipped one that no longer belongs here. */
+const GrantReplacement = Schema.Struct({
+	grant: TokenId,
+	state: Schema.Literals([
+		"replaces",
+		"revoked",
+		"skipped"
+	]),
+	attachedAt: Schema.optionalKey(Timestamp)
+});
 /**
 * What a yes would connect the machine to, as options resolved the choice: the agent, or none
 * yet, to make with the handle; and each organization its attachment is authorized in.
@@ -6569,22 +6603,32 @@ const ConnectOrganization = Schema.Struct({
 const ConnectChosen = Schema.Struct({
 	agent: Schema.optionalKey(AgentRef),
 	handle: AgentHandle,
-	organizations: Schema.Array(ConnectOrganization)
+	organizations: Schema.Array(ConnectOrganization),
+	replacement: Schema.optionalKey(GrantReplacement)
 });
-/**
-* A machine's request, as its answerer chooses what it connects to. Without a choice: the
-* request and the person's agents that are on, and nothing chosen for them. With one: the
-* request, what the choice resolved to, and the passkey's options, whose challenge signs over
-* the connect it would run.
-*/
-const ConnectOptions = Schema.Union([Schema.Struct({
-	request: AttachmentRequestView,
-	agents: Schema.Array(ConnectableAgent)
+/** A complete choice: name every folder once, leaving at least one in. */
+const ConnectFolderChoice = Schema.Union([Schema.Struct({
+	path: ConfigFolderPath,
+	excluded: Schema.Literal(true)
 }), Schema.Struct({
+	path: ConfigFolderPath,
+	agent: ConnectAgent
+})]);
+const ConnectFolderChoices = Schema.Array(ConnectFolderChoice).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths);
+const ConnectFolderOption = Schema.Union([Schema.Struct({
+	path: ConfigFolderPath,
+	excluded: Schema.Literal(true)
+}), Schema.Struct({
+	path: ConfigFolderPath,
+	connect: ConnectChosen
+})]);
+/** Defaults and explicit choices both resolve the entire request and sign one challenge. */
+const ConnectOptions = Schema.Struct({
 	request: AttachmentRequestView,
-	connect: ConnectChosen,
+	agents: Schema.Array(ConnectableAgent),
+	folders: Schema.Array(ConnectFolderOption),
 	passkey: PasskeyRequestOptions
-})]);
+});
 /** Why connecting connected nothing, said for the person. */
 const AttachmentFailure = Schema.Struct({
 	reason: Schema.Literals([
@@ -6612,11 +6656,9 @@ const RequestOrganization = Schema.Struct({
 	])
 });
 /**
-* Where a machine's request stands, for the machine that asked, by its collecting secret: waiting,
-* or how it ended. Every answer but waiting is final, but a connect nobody confirmed 10 minutes
-* after it connected fails `not confirmed` once ref0 takes its grant to revoke it. Connected
-* names the owner by its name, and the host grant, whose token the machine makes from its ID and
-* the grant's secret.
+* The result collected with the machine's two proofs: each included folder's identity and grant,
+* its agent's owner name and organizations, and excluded paths. Confirmation checks each saved
+* grant's live deadline in the Owner DO.
 */
 const RequestState = Schema.Union([
 	Schema.Struct({
@@ -6626,20 +6668,30 @@ const RequestState = Schema.Union([
 	Schema.Struct({
 		state: Schema.Literal("connected"),
 		owner: OwnerName,
-		agent: AgentRef,
-		handle: AgentHandle,
-		credential: CredentialRef,
-		organizations: Schema.Array(RequestOrganization)
+		folders: Schema.Array(Schema.Struct({
+			path: ConfigFolderPath,
+			owner: OwnerName,
+			...MachineConnected.fields,
+			organizations: Schema.Array(RequestOrganization),
+			replacement: Schema.optionalKey(GrantReplacement)
+		})),
+		excluded: Schema.Array(ConfigFolderPath)
 	}),
 	Schema.Struct({ state: Schema.Literal("refused") }),
 	Schema.Struct({ state: Schema.Literal("aborted") }),
 	Schema.Struct({ state: Schema.Literal("expired") }),
 	Schema.Struct({
 		state: Schema.Literal("failed"),
-		reason: Schema.Literals([...AttachmentFailure.fields.reason.literals, "not confirmed"]),
+		reason: AttachmentFailure.fields.reason,
 		nextStep: Schema.String
 	})
 ]);
+/** The grant IDs saved by this terminal, each belonging to the same admission. */
+const SavedMachineGrants = Schema.Array(TokenId).check(Schema.isMinLength(1), Schema.isMaxLength(8), Schema.isUnique());
+Schema.Struct({
+	approval: ApprovalId,
+	grants: SavedMachineGrants
+});
 /**
 * The machine saying it saved the grant it collected: confirmed, the same again, or not, once ref0
 * has taken the grant to revoke it, and the machine deletes what it saved.
@@ -6670,21 +6722,34 @@ const AuthorizeIn = Schema.Struct({
 	organization: OrgId,
 	targetGeneration: TargetGeneration
 });
-/** What every connect names: the agent, the machine and its host grant, and what it was bound to. */
-const connectFields = {
+/** One folder admitted under the request's machine and approving browser. */
+const ConnectFolderCommand = Schema.Struct({
+	path: ConfigFolderPath,
 	agent: AttachmentAgent,
-	machine: MachineId,
-	machineName: MachineName,
 	token: TokenId,
 	secretHash: SecretHash,
-	browserSession: TokenId,
-	personGeneration: Generation,
+	replaces: Schema.optionalKey(TokenId),
 	authorizeIn: Schema.Array(AuthorizeIn)
-};
+});
 Schema.Struct({
 	request: ApprovalId,
-	...connectFields
+	machine: MachineId,
+	machineName: MachineName,
+	browserSession: TokenId,
+	personGeneration: Generation,
+	folders: Schema.Array(ConnectFolderCommand).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
+	excluded: Schema.Array(ConfigFolderPath).check(Schema.isMaxLength(7), Schema.isUnique())
+});
+const FoldersConnected = Schema.Struct({
+	folders: Schema.Array(Schema.Struct({
+		path: ConfigFolderPath,
+		...MachineConnected.fields,
+		replacement: Schema.optionalKey(GrantReplacement)
+	})),
+	excluded: Schema.Array(ConfigFolderPath)
 });
+Schema.Array(GrantReplacement);
+Schema.Array(TokenId).check(Schema.isMaxLength(8));
 /** An attachment that isn't there, or isn't the caller's, answers the same. */
 var AttachmentNotFound = class extends Schema.TaggedError()("AttachmentNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
 /** Connecting connected nothing, and why: what an attachment's approval came to instead. */
@@ -6866,7 +6931,7 @@ const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), S
 */
 const ApprovalOptionsRequest = Schema.Struct({
 	code: Schema.optionalKey(TypedApprovalCode),
-	agent: Schema.optionalKey(ConnectAgent)
+	folders: Schema.optionalKey(ConnectFolderChoices)
 });
 /**
 * An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
@@ -6919,7 +6984,11 @@ const ApprovalState = Schema.Union([
 		state: Schema.Literal("waiting"),
 		expiresAt: Timestamp
 	}),
-	Schema.Struct({ state: Schema.Literal("approved") }),
+	Schema.Struct({
+		state: Schema.Literal("approved"),
+		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
+		collected: Schema.optionalKey(Schema.Literal(true))
+	}),
 	Schema.Struct({ state: Schema.Literal("refused") }),
 	Schema.Struct({ state: Schema.Literal("expired") }),
 	Schema.Struct({
@@ -11706,10 +11775,12 @@ Schema.Union([
 	NotPermitted
 ]);
 /**
-* A session's fork's path on ref0's host. Its thread's, `/{owner}/{project}/threads/{n}/{repo}.git`
-* on a project's thread and `/{owner}/threads/{n}/{repo}.git` on an org thread, reaches the fork
-* of the session whose token asks, and takes its pushes. A session's,
-* `…/threads/{n}/sessions/{m}/{repo}.git`, reads that session's fork, and takes no push.
+* A fork's path on ref0's host. Its thread's, `/{owner}/{project}/threads/{n}/{repo}.git` on a
+* project's thread and `/{owner}/threads/{n}/{repo}.git` on an org thread, reaches the fork of the
+* session whose token asks, and takes its pushes. A session's,
+* `…/threads/{n}/sessions/{m}/{repo}.git`, reads that session's current fork, and a fork's,
+* `…/threads/{n}/forks/{fork}/{repo}.git`, reads that fork when it holds thread `n`'s work, a
+* session's on it or a run's whose pull request is on it. Neither takes a push.
 */
 const ForkPath = Schema.String.check(Schema.isPattern(/^\/[^\s]+\.git$/), Schema.isMaxLength(512)).pipe(Schema.brand("ForkPath"));
 /** A session's fork's URL on the app's one origin: the one a notice names, and a clone pushes to. */
@@ -11733,17 +11804,21 @@ const ForkView = Schema.Struct({
 	/** On the app's one origin, whichever host was asked. */
 	url: ForkUrl
 });
-Schema.Struct({
+/**
+* For a reader that sees only threads it holds a grant on, those threads: a fork of a thread
+* stacked, at any depth, on any other is refused, since it holds that thread's work. Unset for one
+* that reads the project as a whole.
+*/
+const readerSees = { only: Schema.optionalKey(Schema.Array(ThreadId)) };
+Schema.Union([Schema.Struct({
 	session: SessionId,
-	fork: Schema.optionalKey(ForkId),
-	/**
-	* For a reader that sees only threads it holds a grant on, those threads: a fork of a thread
-	* stacked, at any depth, on any other is refused, since it holds that thread's work. Unset for
-	* one that reads the project as a whole.
-	*/
-	only: Schema.optionalKey(Schema.Array(ThreadId))
-});
-/** A session's fork in Artifacts, as Git reaches it: where it is, and which Git repository. */
+	...readerSees
+}), Schema.Struct({
+	fork: ForkId,
+	thread: ThreadId,
+	...readerSees
+})]);
+/** A fork in Artifacts, as Git reaches it: where it is, and which Git repository. */
 const ForkPlace = Schema.Struct({
 	...CurrentBaseline.fields,
 	gitRepository: GitRepositoryId
@@ -11774,19 +11849,16 @@ const SessionBase = Schema.Struct({
 	commit: CommitOid,
 	/**
 	* Where to fetch it from, on ref0's origin: the repo's own path, as `ref0 clone` cloned it, for
-	* `main`; for a stack, the path of the fork that holds the pin.
+	* `main`; for a stack, the path of the fork that holds the pin, by its ID under the thread below.
 	*/
 	path: Schema.String.check(Schema.isPattern(/^\/[^\s]+\.git$/), Schema.isMaxLength(512)),
 	/** `path` on the app's one origin. A client checks it's a fork of its own repo there. */
 	url: Schema.String,
 	ref: Schema.Literal("refs/heads/main")
 });
-/**
-* No base to fetch: `main` has no commit yet, or the pin of the thread below is in a workflow
-* run's fork, which has no session's path to fetch from.
-*/
+/** No base to fetch: `main` has no commit yet. */
 var NoBase = class extends Schema.TaggedError()("NoBase", {
-	why: Schema.Literals(["main empty", "held by a run"]),
+	why: Schema.Literal("main empty"),
 	nextStep: Schema.String
 }, { httpApiStatus: 404 }) {};
 Schema.Struct({
@@ -11804,15 +11876,14 @@ const BaseOnMain = Schema.Struct({
 	commit: CommitOid
 });
 /**
-* The base on the thread below, `lower`: its pin's commit, the fork that holds it, and that
-* fork's session, or none for a workflow run's fork.
+* The base on the thread below, `lower`: its pin's commit, and the fork that holds it, a session's
+* on that thread or a run's whose pull request is on it.
 */
 const BaseOnStack = Schema.Struct({
 	on: Schema.Literal("stack"),
 	lower: ThreadId,
 	commit: CommitOid,
-	fork: ForkId,
-	session: Schema.NullOr(SessionId)
+	fork: ForkId
 });
 Schema.Union([
 	BaseOnMain,
@@ -11860,10 +11931,10 @@ const GateInPlaceView = Schema.Struct({
 /**
 * One `from`'s yes over the run that counts for a part that needs one (L2), as `passkey.check`
 * asks: `asked`, waiting, of `asked` when it's one person; `yes`, by whom and when; `no`;
-* `expired`, its day passed unanswered; `refused`, the person it names can't be asked; or
-* `revoked`, a yes whose answerer a miss revoked since, until an admin restores them. A local
-* run's no or day passing waits for a newer local run; a ref0 run's, or a refusal, leaves the
-* part with no yes, until an admin overrides it.
+* `expired`, its day passed unanswered; `refused`, asking nobody, `why`; or `revoked`, a yes whose
+* answerer a miss revoked since, until an admin restores them. A local run's no or day passing
+* waits for a newer local run; a ref0 run's, or a refusal, leaves the part with no yes, until an
+* admin overrides it.
 */
 const GatePartYes = Schema.Struct({
 	from: PasskeyFrom,
@@ -11875,6 +11946,12 @@ const GatePartYes = Schema.Struct({
 		"refused",
 		"revoked"
 	]),
+	/**
+	* Why a request was refused: `target`, nobody it names can be asked, a person who isn't there
+	* or can't see the pull request's thread; or `self`, it names the person behind the run, or a
+	* permission only they hold, who can't be the second pair of eyes over their own run.
+	*/
+	why: Schema.optionalKey(Schema.Literals(["target", "self"])),
 	asked: Schema.optionalKey(PersonId),
 	by: Schema.optionalKey(OwnerName),
 	at: Schema.optionalKey(Schema.DateTimeUtcFromMillis)
@@ -14912,6 +14989,11 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 	security: { bearer: HttpApiSecurity.bearer },
 	error: [Unauthenticated]
 }) {};
+/**
+* A machine's request whose name its contract refuses, answered as `CommandRefused`, which says
+* what to change. Any other part that fails its contract is answered with Effect's empty 400.
+*/
+var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
 const idempotency = { "idempotency-key": RequestId };
 const inProject$1 = {
 	owner: OwnerRef,
@@ -15035,14 +15117,17 @@ var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachment
 		SlowDown,
 		AuthorityUnavailable
 	]
-}), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
+}).middleware(MachineNameRefusal), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
 	params: { approval: ApprovalId },
 	payload: Schema.Struct({ answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64))) }),
 	success: RequestState,
 	error: [AttachmentNotFound, AuthorityUnavailable]
 }).middleware(ApprovalSecret), HttpApiEndpoint.post("confirm", "/v1/attachments/requests/:approval/collected", {
 	params: { approval: ApprovalId },
-	payload: Schema.Struct({ answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64))) }),
+	payload: Schema.Struct({
+		grants: SavedMachineGrants,
+		answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64)))
+	}),
 	headers: idempotency,
 	success: RequestConfirmed,
 	error: [AttachmentNotFound, AuthorityUnavailable]
@@ -18086,7 +18171,7 @@ const schemasOf = (name) => Option.fromNullishOr(reflected.get(name));
 * keeps what it came to as `/v1` would answer it.
 */
 const connectAnswers = {
-	successes: [Schema.toCodecJson(MachineConnected)],
+	successes: [Schema.toCodecJson(FoldersConnected)],
 	refusals: /* @__PURE__ */ new Map([[409, [Schema.toCodecJson(AttachmentFailed)]]])
 };
 const isEndpointName = (name) => name in surfaces;
@@ -18548,7 +18633,7 @@ const HarnessBinding = Schema.Struct({
 //#region ../contracts/src/harness-status.ts
 /**
 * What `ref0 status --json` prints, for a script or an agent: whether ref0 follows the sessions
-* of the harness it ran under, one check for each thing that has to hold, as its lines say them.
+* in every initialized or connected folder, as an array of folder reports.
 */
 /** A check's answer: unknown when ref0 couldn't ask, never a guess. */
 const StatusAnswer = Schema.Literals([
@@ -18556,7 +18641,7 @@ const StatusAnswer = Schema.Literals([
 	"no",
 	"unknown"
 ]);
-/** One line of the report: what's checked, its answer and why, and for a no, what to do next. */
+/** One line of the report: what's checked, its answer and why, and for any non-yes answer, the command to run next. */
 const StatusCheck = Schema.Struct({
 	check: Schema.Literals([
 		"connected",
@@ -18569,9 +18654,9 @@ const StatusCheck = Schema.Struct({
 	says: Schema.String,
 	next: Schema.optionalKey(Schema.String)
 });
-/** The report: the harness and its config folder, the agent it starts sessions as, and checks. */
+/** One folder: the harness, if known, and its config folder, the agent it starts sessions as, and checks. */
 const StatusReport = Schema.Struct({
-	harness: Schema.Literals(["claude-code", "codex"]),
+	harness: Schema.optionalKey(Schema.Literals(["claude-code", "codex"])),
 	configFolder: Schema.String,
 	agent: Schema.optionalKey(Schema.Struct({
 		owner: OwnerName,
@@ -18624,24 +18709,72 @@ const newRequestId = Effect.gen(function* () {
 	return yield* Effect.orDie(decodeRequestId$1(`request_${encodeSuffix(uuidV7(millis, random))}`));
 });
 //#endregion
+//#region src/sha256.ts
+/** Bytes as lowercase hex. */
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+const encoder$1 = new TextEncoder();
+/** The SHA-256 of a text's UTF-8 bytes, as lowercase hex. */
+const sha256 = (text) => Effect.flatMap(Crypto.Crypto, (crypto) => Effect.map(Effect.orDie(crypto.digest("SHA-256", encoder$1.encode(text))), hex));
+//#endregion
+//#region src/origin.ts
+/**
+* ref0's own API origin: the one the CLI and the plugin's launcher use when neither `REF0_API`
+* nor a clone's `ref0.api` names another.
+*/
+const defaultOrigin = ApiOrigin.make("https://ref0.dev");
+/** A normalized origin as one reversible, path-safe storage key. */
+const originKey = (api) => encodeURIComponent(new URL(api).origin);
+/**
+* The name an origin's plugin, marketplace and MCP server install under. ref0's own keeps the
+* public plugin's, `ref0`, so its status command is `/ref0:status` in Claude Code and
+* `$ref0:status` in Codex. Every other is `ref0-` and 128 bits of its SHA-256, which keep plugin
+* IDs and qualified hook-tool names within harness limits, so no two origins share plugins,
+* hooks or servers.
+*/
+const originPluginName = (api) => {
+	const origin = new URL(api).origin;
+	if (origin === defaultOrigin) return Effect.succeed("ref0");
+	return Effect.map(sha256(origin), (digest) => `ref0-${digest.slice(0, 32)}`);
+};
+//#endregion
 //#region src/config.ts
 /**
 * `REF0_API` as a person sets it, any trailing `/` left off, read as ref0's origin. One that isn't
 * an origin, such as a bare host or one with a path, fails the CLI at start, naming `REF0_API`.
 */
 const ApiFromEnv = Schema.String.pipe(Schema.decodeTo(ApiOrigin, SchemaTransformation.transform({
-	decode: (api) => api.replace(/\/+$/, ""),
+	decode: (api) => api.replace(/^https?:/i, (scheme) => scheme.toLowerCase()).replace(/\/+$/, ""),
 	encode: (api) => api
 })));
 /**
-* Where the CLI finds ref0: the API's origin, from `REF0_API`, or ref0's own. One value, as the
+* Where the CLI finds ref0: the API's origin, from `REF0_API`, the checkout's `ref0.api`, or ref0's own. One value, as the
 * domain is one value everywhere.
 */
 var Ref0Config = class Ref0Config extends Context.Service()("ref0/cli/Ref0Config") {
 	static layer = Layer.effect(Ref0Config, Effect.gen(function* () {
-		const api = yield* Config.schema(ApiFromEnv, "REF0_API").pipe(Config.withDefault(ApiOrigin.make("https://ref0.dev")));
-		return Ref0Config.of({ api });
-	}));
+		const explicit = yield* Config.schema(ApiFromEnv, "REF0_API").pipe(Config.option);
+		let api = Option.getOrUndefined(explicit);
+		if (api === void 0) {
+			const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+			const unavailable = new Config.ConfigError(new ConfigProvider.SourceError({ message: "Could not read ref0.api with Git. Set REF0_API explicitly, or make Git available and check the checkout config." }));
+			api = yield* Effect.scoped(Effect.gen(function* () {
+				const handle = yield* spawner.spawn(ChildProcess.make("git", [
+					"config",
+					"--get",
+					"ref0.api"
+				]));
+				const [checkout, , code] = yield* Effect.all([
+					handle.stdout.pipe(Stream.decodeText(), Stream.mkString),
+					handle.stderr.pipe(Stream.runDrain),
+					handle.exitCode
+				], { concurrency: "unbounded" });
+				if (code === ChildProcessSpawner.ExitCode(1)) return defaultOrigin;
+				if (code !== ChildProcessSpawner.ExitCode(0)) return yield* Effect.fail(unavailable);
+				return yield* Config.schema(ApiFromEnv, "ref0.api").parse(ConfigProvider.fromUnknown({ "ref0.api": checkout.trim() }));
+			})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
+		}
+		return Ref0Config.of({ api: ApiOrigin.make(new URL(api).origin) });
+	})).pipe(Layer.provide(NodeServices.layer));
 };
 //#endregion
 //#region src/secret.ts
@@ -18952,11 +19085,19 @@ const renderLine = (line, terminal) => {
 	return `${line.status === "yes" ? styled("✓", 32, terminal) : styled("✗", 31, terminal)} ${line.status}  ${printable(line.text)}`;
 };
 const renderBlocks = (blocks, stream) => {
-	const terminal = process[stream].isTTY === true && !process.env["NO_COLOR"];
+	const terminal = process[stream].isTTY === true && process.env["NO_COLOR"] === void 0;
 	return blocks.flatMap((block) => block.length === 0 ? [] : [block.map((line) => renderLine(line, terminal)).join("\n")]).join("\n\n");
 };
 /** Words go to stderr by default; a command's answer goes to stdout. */
 const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream)).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
+/**
+* A yes-or-no question as the terminal shows it, bold, then `(y/N)`: no unless the person says
+* yes. The cursor stays after it, for their answer.
+*/
+const questionLine = (question) => `${renderBlocks([[{
+	label: question,
+	text: "(y/N)"
+}]], "stdout")} `;
 /** Keep explicit line breaks and wrap between words within the available columns. */
 const wrapWords = (text, width) => text.split("\n").flatMap((line) => {
 	const wrapped = [];
@@ -19025,6 +19166,23 @@ const accountCommands = [Command.make("whoami", { json }, ({ json: asJson }) =>
 	yield* printAnswer(answer.json, asJson, me.agent === void 0 ? `You, as ${me.actor.id}.` : `Agent ${me.agent.id}, in session ${me.session?.session ?? "none"}.`);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Who’s acting, and what they hold"), Command.withShortDescription("Show who’s acting and what they hold"))];
 //#endregion
+//#region ../model/src/agent-commits.ts
+/**
+* How an agent's commits name it as their author: `pip/claude <agent_…@ref0.work>`. The person
+* stays the committer, with their own signature. Git keeps every commit for good, and anyone
+* who reads the repo reads its author, so these name the agent and nothing about its sessions.
+*/
+/**
+* An agent's commit email: built from its agent ID alone, so it never changes, and never passes
+* to another agent. Nobody reads mail there.
+*/
+const agentCommitEmail = (agent) => `${agent}@ref0.work`;
+/**
+* An agent's name as its commits' author: its owner, then its handle, as commands write it. A
+* handle renamed later stays as it was in the commits made before.
+*/
+const agentCommitName = (owner, handle) => `${owner}/${handle}`;
+//#endregion
 //#region ../model/src/cut-text.ts
 /**
 * `text` within `max` as a `Schema`'s length counts it, in UTF-16 code units: whole code points
@@ -19305,13 +19463,13 @@ function freeTextProblem(text, maxCharacters) {
 //#endregion
 //#region ../model/src/git-paths.ts
 /**
-* A session's fork's path: an owner, a project for a project's thread and none for an org
-* thread's, a thread, a session when it names one and the source fork when that names one too, a
-* repo, and what Git asks for. The two thread forms never read alike: after `threads` comes a
-* number on an org thread's, and the word `threads` on a project's, so a project named `threads`
-* keeps its forks. Nor do the two fork forms: a repo's name holds no `/`.
+* A fork's path: an owner, a project for a project's thread and none for an org thread's, a
+* thread, then a session or a fork by its ID when it names one, a repo, and what Git asks for.
+* The two thread forms never read alike: after `threads` comes a number on an org thread's, and
+* the word `threads` on a project's, so a project named `threads` keeps its forks. Nor do the three
+* fork forms: a repo's name holds no `/`.
 */
-const forkPath = /^\/([^/]+)(?:\/([^/]+))?\/threads\/([1-9]\d{0,9})(?:\/sessions\/([1-9]\d{0,9})(?:\/forks\/(fork_[a-z0-9]+))?)?\/([^/]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+const forkPath = /^\/([^/]+)(?:\/([^/]+))?\/threads\/([1-9]\d{0,9})(?:\/sessions\/([1-9]\d{0,9})|\/forks\/(fork_[a-z0-9]+))?\/([^/]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
 //#endregion
 //#region ../model/src/thread-workflows.ts
 const minuteMillis = 6e4;
@@ -20092,97 +20250,353 @@ const blockedCommands = [Command.make("blocked").pipe(Command.withDescription("W
 	clearing("met", "Mark an outside blocker met, or lift a hold")
 ]))];
 //#endregion
+//#region src/connect-browser.ts
+/** The desktop opener, checked before a listener is started. SSH gets only the paste. */
+const browserOpener = Effect.gen(function* () {
+	const system = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""));
+	if (system.trim() === "Darwin") return "/usr/bin/open";
+	if (system.trim() !== "Linux") return void 0;
+	const display = yield* Config.String("DISPLAY").pipe(Config.withDefault(""));
+	const wayland = yield* Config.String("WAYLAND_DISPLAY").pipe(Config.withDefault(""));
+	if (display === "" && wayland === "") return void 0;
+	const search = yield* Config.String("PATH").pipe(Config.withDefault(""));
+	for (const folder of search.split(":")) {
+		const program = `${folder || "."}/xdg-open`;
+		const executable = yield* Effect.tryPromise(() => access(program, constants.X_OK)).pipe(Effect.option);
+		if (Option.isSome(executable)) return program;
+	}
+});
+/** Starts the browser independently; a missing or failing desktop never stops the paste. */
+const openBrowser = (program, link) => Effect.sync(() => {
+	const failed = () => Effect.runFork(Console.error("Couldn’t open the browser. Open the printed link yourself."));
+	try {
+		const child = spawn(program, [link], {
+			detached: true,
+			stdio: "ignore",
+			shell: false
+		});
+		child.once("error", failed);
+		child.once("exit", (code) => {
+			if (code !== 0) failed();
+		});
+		child.unref();
+	} catch {
+		failed();
+	}
+});
+const isAnswer = Schema.is(TypedApprovalCode);
+/** One form answer from ref0's own page, on IPv4 loopback only, owned by the waiting scope. */
+const listenForAnswer = Effect.fnUntraced(function* (origin) {
+	const state = (yield* freshLinkSecret).secret;
+	const answer = yield* Deferred.make();
+	let taken = false;
+	const server = createServer((request, response) => {
+		if (taken || request.method !== "POST" || request.url !== `/${state}` || request.headers.origin !== origin || request.headers["content-type"]?.split(";")[0] !== "application/x-www-form-urlencoded") {
+			response.writeHead(404).end();
+			request.resume();
+			return;
+		}
+		let body = "";
+		request.setTimeout(5e3, () => request.destroy());
+		request.on("error", () => void 0);
+		request.on("data", (chunk) => {
+			body += chunk.toString("utf8");
+			if (body.length > 1024) request.destroy();
+		});
+		request.on("end", () => {
+			const fields = new URLSearchParams(body);
+			const code = fields.get("answer");
+			if (taken || code === null || fields.getAll("answer").length !== 1 || !isAnswer(code)) {
+				response.writeHead(404).end();
+				return;
+			}
+			taken = true;
+			response.writeHead(200, {
+				"content-type": "text/plain; charset=utf-8",
+				"cache-control": "no-store"
+			});
+			response.end("Connected. Go back to your terminal.");
+			server.close();
+			Deferred.doneUnsafe(answer, Exit.succeed(code));
+		});
+	});
+	server.maxConnections = 16;
+	server.headersTimeout = 5e3;
+	server.requestTimeout = 5e3;
+	const stop = Effect.sync(() => {
+		taken = true;
+		server.close();
+		server.closeAllConnections();
+	});
+	yield* Effect.acquireRelease(Effect.callback((resume) => {
+		server.once("error", () => resume(Effect.fail(new ListenerUnavailable())));
+		server.listen(0, "127.0.0.1", () => resume(Effect.void));
+	}), () => stop);
+	const address = server.address();
+	if (address === null || Predicate.isString(address)) return yield* Effect.die("No loopback port");
+	return {
+		callback: {
+			port: address.port,
+			state
+		},
+		answer: Deferred.await(answer),
+		stop
+	};
+});
+var ListenerUnavailable = class extends Schema.TaggedError()("ListenerUnavailable", {}) {};
+//#endregion
+//#region src/names.ts
+/**
+* The names one part of the CLI writes and another reads, each defined here once: the commands,
+* flags and variable a harness's plugin runs `ref0` with, which their definitions take too, and
+* the variables `ref0 watch` sets for the command it runs, which a harness that command starts
+* reads.
+*/
+/**
+* The commands a harness runs: `ref0 mcp`, `ref0 hook` with each of its command hooks, and
+* `ref0 status` for the plugin's own command.
+*/
+const harnessCommandNames = {
+	mcp: "mcp",
+	hook: "hook",
+	sessionStart: "session-start",
+	sessionEnd: "session-end",
+	status: "status"
+};
+/** The flag a plugin passes its command hooks: the hook protocol their declarations speak. */
+const harnessFlagNames = { protocol: "protocol" };
+/**
+* What the plugin's lookup script and server launcher put in `ref0`'s environment: the plugin's
+* release, which no hook's declaration carries.
+*/
+const pluginVersionVariable = "REF0_PLUGIN_VERSION";
+/** A flag as a command line writes it. */
+const flagWord = (name) => `--${name}`;
+/**
+* What `ref0 watch` puts in the environment of the command it runs: the thread, the event that
+* started it, and its title.
+*/
+const watchVariables = {
+	thread: "REF0_THREAD",
+	event: "REF0_EVENT",
+	title: "REF0_TITLE"
+};
+/**
+* What ref0 puts in the environment of an agent's commands for its commits, beside Git's own
+* author variables: the harness, for the trailer, and what a forwarder in ref0's hooks folder
+* sets for the repo's own hook it runs, so a forwarder that hook reaches runs nothing.
+*/
+const gitHookVariables = {
+	harness: "REF0_HARNESS",
+	forwarded: "REF0_GIT_HOOK"
+};
+//#endregion
+//#region src/harness/plugin-files.ts
+/**
+* What both harnesses' parts of ref0's plugin folder are built from: hooks, each an `mcp_tool`
+* hook to `ref0 mcp` or a command, the hooks file they're written into, and the two ways the
+* plugin finds `ref0`: a script for its command hooks, and a launcher for its server. The public plugin
+* names no machine's paths, owner or agent. Installation pins its lookup to one API origin.
+* Only its release, in its manifests, script and launcher, changes from one release to the next;
+* never a hook's declaration, which carries the hook protocol instead.
+*/
+const encodeHooks = Schema.encodeSync(Schema.fromJsonString(HooksFile));
+const encodeMcp = Schema.encodeSync(Schema.fromJsonString(McpServersFile));
+/** A path as one word for `sh`, which runs command hooks. */
+const shellWord = (word) => `'${word.replaceAll("'", `'\\''`)}'`;
+/** An event's hook asking `ref0 mcp`, with a template naming each field it reads. */
+const mcpToolHook = (server, event, fields) => ({ hooks: [{
+	type: "mcp_tool",
+	server,
+	tool: "hook",
+	input: Object.fromEntries([
+		["protocol", "1"],
+		["hook_event_name", event],
+		...fields.map((field) => [field, `\${${field}}`])
+	])
+}] });
+const commandHook = (command) => ({ hooks: [{
+	type: "command",
+	command
+}] });
+/** The plugin's lookup script, by its path inside the plugin. */
+const lookupScript = "bin/ref0";
+/** The plugin's root, as a command hook names it for the harness to fill in. */
+const pluginRoot = "${CLAUDE_PLUGIN_ROOT}";
+/** What the lookup script and the launcher say when neither finds `ref0`. */
+const missingRef0 = "run npm i -g @ref0/cli, then ref0 connect";
+/**
+* How the plugin finds `ref0`, as `sh` statements: on `PATH` in the public template, or at the
+* origin-specific launcher after installation, telling it the plugin's release. M0 measured both lookups in each
+* harness. The script isn't executable, so the plugin's `bin/` never puts it on an agent's `PATH`
+* as `ref0`, where it would find itself.
+*/
+const lookup = (version, api) => [
+	`${pluginVersionVariable}=${shellWord(version)}`,
+	`export ${pluginVersionVariable}`,
+	...api === void 0 ? ["candidate=$(command -v ref0 2>/dev/null || :)", "if [ -n \"$candidate\" ]; then exec \"$candidate\" \"$@\"; fi"] : [
+		"REF0_SELECT_ORIGIN=1",
+		"export REF0_SELECT_ORIGIN",
+		`if [ -x "$HOME/.ref0/origins/${originKey(api)}/bin/ref0" ]; then exec "$HOME/.ref0/origins/${originKey(api)}/bin/ref0" "$@"; fi`
+	],
+	`printf '%s\\n' ${shellWord(missingRef0)} >&2`,
+	"exit 127"
+];
+/** The lookup script, which a command hook or the plugin's command runs with `sh`. */
+const lookupScriptFile = (version, api) => ({
+	path: `ref0/${lookupScript}`,
+	text: [
+		"#!/bin/sh",
+		"# Runs ref0 for the hooks and commands of its plugin.",
+		...lookup(version, api),
+		""
+	].join("\n")
+});
+/**
+* Runs `ref0 <words>` through the lookup script. Claude Code fills in the plugin's root before
+* it runs the command, and Codex sets it in the hook's environment, where `sh` reads it.
+*/
+const throughLookup = (words) => [
+	"/bin/sh",
+	`"${pluginRoot}/${lookupScript}"`,
+	...words
+].join(" ");
+/** Runs `ref0 hook <event>`, saying the hook protocol its declaration speaks. */
+const ref0Hook = (event) => commandHook(throughLookup([
+	harnessCommandNames.hook,
+	event,
+	flagWord(harnessFlagNames.protocol),
+	"1"
+]));
+/** Starts the agent's session: a command, since it runs before the harness connects its servers. */
+const sessionStartHook = ref0Hook(harnessCommandNames.sessionStart);
+/** Ends the session, as a command too. */
+const sessionEndHook = ref0Hook(harnessCommandNames.sessionEnd);
+/**
+* The plugin's server, `ref0 mcp`, started by M0's inline launcher, the lookup in one line: a
+* script path in a server's arguments stays literal in Codex. It has no `cwd`, so the server
+* keeps the project's folder in both harnesses. Codex starts its servers with only `HOME`, `PATH`
+* and `SHELL`, so it's asked for `CODEX_HOME`, which an unset one leaves unset.
+*/
+const mcpFile = (version, api, server = "ref0") => ({
+	path: "ref0/.mcp.json",
+	text: encodeMcp({ mcpServers: { [server]: {
+		command: "/bin/sh",
+		args: [
+			"-c",
+			lookup(version, api).join("; "),
+			"ref0",
+			harnessCommandNames.mcp
+		],
+		env_vars: [
+			"CODEX_HOME",
+			"CLAUDE_CONFIG_DIR",
+			"REF0_API"
+		]
+	} } })
+});
+/** Each event a harness's hooks send `ref0 mcp`, with the fields it reads, as an `mcp_tool` hook. */
+const mcpToolHooks = (server, hookFields) => Object.fromEntries(Object.entries(hookFields).map(([event, fields]) => [event, [mcpToolHook(server, event, fields)]]));
+//#endregion
 //#region src/keychain.ts
 /**
 * The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
 * makes, and a session's token. Never a file. On macOS through `security`, on Linux through
-* `secret-tool`, under the service `ref0`, by account. A secret goes in through stdin, never as
+* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
 * an argument, since any process on the machine can read another's arguments.
 */
-var KeychainError = class extends Schema.TaggedError()("KeychainError", { nextStep: Schema.String }) {};
-var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
-	static layer = Layer.effect(Keychain, Effect.gen(function* () {
-		const crypto = yield* Crypto.Crypto;
-		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-		const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
-		const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
-		const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
-		const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
-			const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
-			const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
-			const code = yield* handle.exitCode;
-			return {
-				output: output.trim(),
-				complaint: complaint.trim(),
-				code,
-				succeeded: code === ChildProcessSpawner.ExitCode(0)
-			};
-		})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
-		const get = Effect.fn("Keychain.get")(function* (account) {
-			const found = macOS ? yield* run("security", [
-				"find-generic-password",
-				"-s",
-				"ref0",
-				"-a",
-				account,
-				"-w"
-			], "") : yield* run("secret-tool", [
-				"lookup",
-				"service",
-				"ref0",
-				"account",
-				account
-			], "");
-			if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
-			if (macOS) {
-				if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
-				return yield* unavailable;
-			}
-			if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
-			const listed = yield* run("secret-tool", [
-				"search",
-				"--all",
-				"service",
-				"ref0",
-				"account",
-				account
-			], "");
-			if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
-			return Option.none();
-		});
-		const set = Effect.fn("Keychain.set")(function* (account, secret) {
-			const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
-			const value = Redacted.value(secret);
-			if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
-			const input = macOS ? `add-generic-password -U -s ref0 -a ${quote(account)} -w ${quote(value)}\n` : value;
-			if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
-			if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
-				"store",
-				"--label",
-				`ref0 ${account}`,
-				"service",
-				"ref0",
-				"account",
-				account
-			], Redacted.value(secret))).succeeded) return yield* unavailable;
-		});
-		const remove = Effect.fn("Keychain.remove")(function* (account) {
-			if (!(yield* macOS ? run("security", [
-				"delete-generic-password",
-				"-s",
-				"ref0",
-				"-a",
-				account
-			], "") : run("secret-tool", [
-				"clear",
-				"service",
-				"ref0",
-				"account",
-				account
-			], "")).succeeded) return yield* unavailable;
-		});
-		const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
-		const probe = Effect.gen(function* () {
+var KeychainError = class extends Schema.TaggedError()("KeychainError", {
+	nextStep: Schema.String,
+	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
+	unreadable: Schema.optionalKey(Schema.Literal(true))
+}) {};
+/**
+* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
+* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
+*/
+const keychainIn = Effect.fnUntraced(function* (service) {
+	const crypto = yield* Crypto.Crypto;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
+	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
+	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
+	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
+		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
+		const code = yield* handle.exitCode;
+		return {
+			output: output.trim(),
+			complaint: complaint.trim(),
+			code,
+			succeeded: code === ChildProcessSpawner.ExitCode(0)
+		};
+	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
+	const get = Effect.fn("Keychain.get")(function* (account) {
+		const found = macOS ? yield* run("security", [
+			"find-generic-password",
+			"-s",
+			service,
+			"-a",
+			account,
+			"-w"
+		], "") : yield* run("secret-tool", [
+			"lookup",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
+		if (macOS) {
+			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
+			return yield* unavailable;
+		}
+		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
+		const listed = yield* run("secret-tool", [
+			"search",
+			"--all",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
+		return Option.none();
+	});
+	const set = Effect.fn("Keychain.set")(function* (account, secret) {
+		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
+		const value = Redacted.value(secret);
+		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
+		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
+		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
+		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
+			"store",
+			"--label",
+			`ref0 ${account}`,
+			"service",
+			service,
+			"account",
+			account
+		], Redacted.value(secret))).succeeded) return yield* unavailable;
+	});
+	const remove = Effect.fn("Keychain.remove")(function* (account) {
+		if (!(yield* macOS ? run("security", [
+			"delete-generic-password",
+			"-s",
+			service,
+			"-a",
+			account
+		], "") : run("secret-tool", [
+			"clear",
+			"service",
+			service,
+			"account",
+			account
+		], "")).succeeded) return yield* unavailable;
+	});
+	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
+	return {
+		probe: Effect.gen(function* () {
 			const account = `connect-probe/${yield* random}`;
 			const value = Redacted.make(yield* random);
 			yield* Effect.gen(function* () {
@@ -20194,19 +20608,19 @@ var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
 		}).pipe(Effect.timeoutOrElse({
 			duration: Duration.minutes(1),
 			orElse: () => Effect.fail(unavailable)
-		}));
-		return Keychain.of({
-			probe,
-			get,
-			set,
-			remove
-		});
-	}));
+		})),
+		get,
+		set,
+		remove
+	};
+});
+var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
+	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
 };
 //#endregion
 //#region src/harness/binding.ts
 /**
-* Where a session's token is kept: the machine's keychain, under the service `ref0`, by an
+* Where a session's token is kept: the machine's keychain, under the API origin’s keychain service, by an
 * account naming its binding. One per harness process, so a resume in another terminal while
 * the first still runs keeps its own token.
 */
@@ -20342,13 +20756,15 @@ const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
 const Folders = Schema.Array(Schema.String);
 const decodeFolders = Schema.decodeUnknownOption(Schema.fromJsonString(Folders));
 const encodeFolders = Schema.encodeSync(Schema.fromJsonString(Folders));
-/** The variable naming each harness's config folder, and its default under HOME. */
+/** Each harness's name, the variable naming its config folder, and its default under HOME. */
 const configFolders = {
 	"claude-code": {
+		name: "Claude Code",
 		variable: "CLAUDE_CONFIG_DIR",
 		inHome: ".claude"
 	},
 	codex: {
+		name: "Codex",
 		variable: "CODEX_HOME",
 		inHome: ".codex"
 	}
@@ -20363,7 +20779,8 @@ var ConfigFolders = class ConfigFolders extends Context.Service()("ref0/cli/Conf
 			"claude-code": yield* Config.String(configFolders["claude-code"].variable).pipe(Config.withDefault("")),
 			codex: yield* Config.String(configFolders.codex.variable).pipe(Config.withDefault(""))
 		};
-		const directory = path.join(home, ".ref0");
+		const config = yield* Ref0Config;
+		const directory = path.join(home, ".ref0", "origins", originKey(config.api));
 		const file = path.join(directory, "config-folders.json");
 		const resolved = (given) => fs.realPath(given).pipe(Effect.catch(() => {
 			const parent = path.dirname(given);
@@ -20400,18 +20817,68 @@ const currentHarness = Effect.gen(function* () {
 	return Option.isSome(found) ? found.value.harness : Option.isSome(sandbox) ? "codex" : claude !== "" ? "claude-code" : codex !== "" ? "codex" : "claude-code";
 });
 const currentConfigFolder = Effect.flatMap(currentHarness, (harness) => ConfigFolders.use((folders) => folders.folder(harness)));
+/** A folder as the person reads it, and ref0 shows it: under the home as `~/…`, else whole. */
+const shownConfigFolder = (home, folder) => folder.startsWith(`${home}/`) ? `~/${folder.slice(home.length + 1)}` : folder;
+/** Initialized folders in the home, and the folder each variable names, when it's asked to. */
+const searchConfigFolders = Effect.fnUntraced(function* (variables) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const folders = yield* ConfigFolders;
+	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
+	const names = yield* fs.readDirectory(home).pipe(Effect.orElseSucceed(() => []));
+	const found = [];
+	const seen = /* @__PURE__ */ new Set();
+	const has = (file, kind = "File") => fs.stat(file).pipe(Effect.map((info) => info.type === kind), Effect.orElseSucceed(() => false));
+	for (const harness of ["claude-code", "codex"]) {
+		const { variable, inHome } = configFolders[harness];
+		const named = variables ? yield* Config.String(variable).pipe(Config.withDefault("")) : "";
+		const candidates = [
+			path.join(home, inHome),
+			...names.filter((name) => name.startsWith(`${inHome}-`)).sort().map((name) => path.join(home, name)),
+			...named === "" ? [] : [named]
+		];
+		for (const candidate of candidates) {
+			const configFolder = yield* folders.resolve(candidate);
+			if (seen.has(configFolder) || !(yield* has(configFolder, "Directory"))) continue;
+			if (!(harness === "claude-code" ? (yield* has(path.join(configFolder, ".claude.json"))) || candidate === path.join(home, ".claude") && (yield* has(path.join(home, ".claude.json"))) || (yield* has(path.join(configFolder, "projects"), "Directory")) && (yield* has(path.join(configFolder, "sessions"), "Directory")) : (yield* has(path.join(configFolder, ".sandbox_migration"))) || (yield* has(path.join(configFolder, "skills/.system/.codex-system-skills.marker"))) || (yield* has(path.join(configFolder, "installation_id"))) && (yield* has(path.join(configFolder, "sessions"), "Directory")) || (yield* has(path.join(configFolder, "config.toml"))))) continue;
+			seen.add(configFolder);
+			found.push({
+				harness,
+				configFolder
+			});
+		}
+	}
+	return found;
+});
+/** Find initialized harness folders without reading credentials or config file contents. */
+const findConfigFolders = searchConfigFolders(true);
+/**
+* The line that connects a folder, from the person's own terminal: `ref0 connect` finds it
+* there unless only its variable names it, which this session's environment may have set.
+*/
+const connectLineFor = Effect.fnUntraced(function* (harness, configFolder) {
+	const found = yield* searchConfigFolders(false);
+	const real = yield* (yield* ConfigFolders).resolve(configFolder);
+	if (found.some((each) => each.harness === harness && each.configFolder === real)) return "ref0 connect";
+	return `${configFolders[harness].variable}=${shellWord(configFolder)} ref0 connect`;
+});
 //#endregion
 //#region src/host-grant.ts
-/** All lasting authority for one config folder, stored as one keychain value. */
-const KeptHostGrant = Schema.Struct({
+/**
+* All lasting authority for one config folder, stored as one keychain value: the agent the folder
+* acts as, by its owner, handle and agent ID, and its token. The ID is kept in the same write as
+* the token, so a folder with a grant always knows which agent its commits name.
+*/
+const KeptHostGrant = Schema.Struct({
 	harness: ConnectHarness,
 	owner: OwnerName,
 	agent: AgentHandle,
+	agentId: AgentId,
 	token: Schema.RedactedFromValue(Schema.String)
 });
 const decodeGrant = Schema.decodeUnknownOption(Schema.fromJsonString(KeptHostGrant));
 const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
-/** Grants under service ref0, account host-grant/<resolved config folder>. */
+/** Grants in the origin’s keychain service, account host-grant/<resolved config folder>. */
 var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant") {
 	static layer = Layer.effect(HostGrant, Effect.gen(function* () {
 		const keychain = yield* Keychain;
@@ -20421,7 +20888,10 @@ var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant")
 			get: (folder) => account(folder).pipe(Effect.flatMap(keychain.get), Effect.flatMap((kept) => {
 				if (Option.isNone(kept)) return Effect.succeedNone;
 				const grant = decodeGrant(Redacted.value(kept.value));
-				return Option.isSome(grant) ? Effect.succeed(grant) : Effect.fail(new KeychainError({ nextStep: "This config folder’s host grant is unreadable. Run ref0 connect again." }));
+				return Option.isSome(grant) ? Effect.succeed(grant) : Effect.fail(new KeychainError({
+					nextStep: "This config folder’s host grant is unreadable. Run ref0 connect again.",
+					unreadable: true
+				}));
 			})),
 			keep: (folder, grant) => Effect.gen(function* () {
 				yield* keychain.set(yield* account(folder), Redacted.make(encodeGrant(grant)));
@@ -20443,43 +20913,6 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 	return Option.none();
 });
 //#endregion
-//#region src/names.ts
-/**
-* The names one part of the CLI writes and another reads, each defined here once: the commands,
-* flags and variable a harness's plugin runs `ref0` with, which their definitions take too, and
-* the variables `ref0 watch` sets for the command it runs, which a harness that command starts
-* reads.
-*/
-/**
-* The commands a harness runs: `ref0 mcp`, `ref0 hook` with each of its command hooks, and
-* `ref0 status` for the plugin's own command.
-*/
-const harnessCommandNames = {
-	mcp: "mcp",
-	hook: "hook",
-	sessionStart: "session-start",
-	sessionEnd: "session-end",
-	status: "status"
-};
-/** The flag a plugin passes its command hooks: the hook protocol their declarations speak. */
-const harnessFlagNames = { protocol: "protocol" };
-/**
-* What the plugin's lookup script and server launcher put in `ref0`'s environment: the plugin's
-* release, which no hook's declaration carries.
-*/
-const pluginVersionVariable = "REF0_PLUGIN_VERSION";
-/** A flag as a command line writes it. */
-const flagWord = (name) => `--${name}`;
-/**
-* What `ref0 watch` puts in the environment of the command it runs: the thread, the event that
-* started it, and its title.
-*/
-const watchVariables = {
-	thread: "REF0_THREAD",
-	event: "REF0_EVENT",
-	title: "REF0_TITLE"
-};
-//#endregion
 //#region src/version.ts
 /**
 * The CLI's version, from its `package.json` as the build reads it: what `ref0 --version`
@@ -20487,52 +20920,7 @@ const watchVariables = {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.6.0";
-Schema.encodeSync(Schema.fromJsonString(HooksFile));
-Schema.encodeSync(Schema.fromJsonString(McpServersFile));
-/** A path as one word for `sh`, which runs command hooks. */
-const shellWord = (word) => `'${word.replaceAll("'", `'\\''`)}'`;
-/** An event's hook asking `ref0 mcp`, with a template naming each field it reads. */
-const mcpToolHook = (server, event, fields) => ({ hooks: [{
-	type: "mcp_tool",
-	server,
-	tool: "hook",
-	input: Object.fromEntries([
-		["protocol", "1"],
-		["hook_event_name", event],
-		...fields.map((field) => [field, `\${${field}}`])
-	])
-}] });
-const commandHook = (command) => ({ hooks: [{
-	type: "command",
-	command
-}] });
-/** The plugin's lookup script, by its path inside the plugin. */
-const lookupScript = "bin/ref0";
-/** The plugin's root, as a command hook names it for the harness to fill in. */
-const pluginRoot = "${CLAUDE_PLUGIN_ROOT}";
-/**
-* Runs `ref0 <words>` through the lookup script. Claude Code fills in the plugin's root before
-* it runs the command, and Codex sets it in the hook's environment, where `sh` reads it.
-*/
-const throughLookup = (words) => [
-	"/bin/sh",
-	`"${pluginRoot}/${lookupScript}"`,
-	...words
-].join(" ");
-/** Runs `ref0 hook <event>`, saying the hook protocol its declaration speaks. */
-const ref0Hook = (event) => commandHook(throughLookup([
-	harnessCommandNames.hook,
-	event,
-	flagWord(harnessFlagNames.protocol),
-	"1"
-]));
-/** Starts the agent's session: a command, since it runs before the harness connects its servers. */
-const sessionStartHook = ref0Hook(harnessCommandNames.sessionStart);
-/** Ends the session, as a command too. */
-const sessionEndHook = ref0Hook(harnessCommandNames.sessionEnd);
-/** Each event a harness's hooks send `ref0 mcp`, with the fields it reads, as an `mcp_tool` hook. */
-const mcpToolHooks = (server, hookFields) => Object.fromEntries(Object.entries(hookFields).map(([event, fields]) => [event, [mcpToolHook(server, event, fields)]]));
+const cliVersion = "0.8.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -20549,8 +20937,8 @@ const protocolFlagged = (command) => /--protocol (\S+)/.exec(command)?.[1];
 const protocolsOf = (file) => Object.values(file.hooks).flatMap((groups) => groups.flatMap((group) => group.hooks)).map((hook) => hook.type === "mcp_tool" ? hook.input["protocol"] : protocolFlagged(hook.command)).filter(Predicate.isString);
 /** `--protocol`, which each command hook passes: the hook protocol its declaration speaks. */
 const protocolFlag = Flag.String(harnessFlagNames.protocol).pipe(Flag.withDescription("The hook protocol the plugin speaks"));
-/** The command that installs the plugin again for an agent, or connects one first. */
-const installLine = (folder, connected = true, harness) => connected ? `ref0 install ${shellWord(folder)}` : harness === void 0 ? "ref0 connect" : `ref0 connect --harness ${harness}`;
+/** The command that installs the plugin again into a connected folder. */
+const installLine = (folder) => `ref0 install ${shellWord(folder)}`;
 /**
 * Why this `ref0` doesn't speak the plugin's hook protocol, and what to run: a newer plugin needs
 * a newer `ref0`, and an older one installing again. None when `ref0` speaks it.
@@ -20576,8 +20964,9 @@ const updateLine = (plugin, reinstall) => Option.map(protocolMismatch(plugin, re
 //#region src/machine.ts
 /**
 * This machine, as ref0 knows it: an ID made once and kept in ref0's config, `machine` under
-* `$XDG_CONFIG_HOME/ref0` or `~/.config/ref0`, and its own name for itself, which ref0 shows
-* the person as what it says. Neither is a secret, and neither is proof of anything.
+* `$XDG_CONFIG_HOME/ref0` or `~/.config/ref0`, and its host name, from which `ref0 connect` makes
+* the name ref0 shows the person as what it says. Neither is a secret, and neither is proof of
+* anything.
 */
 var MachineError = class extends Schema.TaggedError()("MachineError", { nextStep: Schema.String }) {};
 const decodeMachineId = Schema.decodeUnknownOption(MachineId);
@@ -20605,10 +20994,84 @@ var Machine = class Machine extends Context.Service()("ref0/cli/Machine") {
 				onSome: Effect.succeed
 			}));
 		});
-		const name = (yield* Effect.sync(() => hostname())).slice(0, 64) || "this machine";
+		const hostName = yield* Effect.sync(() => hostname());
 		return Machine.of({
 			id,
-			name
+			hostName
+		});
+	}));
+};
+//#endregion
+//#region src/old-host-grants.ts
+/**
+* 0.5.0 kept each host grant under `host-grant/<owner>/<agent>` in the keychain service `ref0`,
+* and which agent each config folder acted as in `~/.ref0/plugin-agents.json`. Nothing reads
+* them since but `ref0 connect`: it names the grant each folder replaces, then forgets each
+* folder once its new grant is kept, and deletes each grant no folder still names. Two folders
+* acting as one agent shared its grant, so one kept and one not leaves it for the next run.
+* 0.5.0 kept no origin, and spoke to ref0.dev unless `REF0_API` said otherwise, so only a
+* connect to ref0.dev reads them.
+*/
+const ByFolder = Schema.Record(Schema.String, Schema.Struct({
+	owner: OwnerName,
+	agent: AgentHandle
+}));
+const PluginAgents = Schema.Struct({
+	"claude-code": ByFolder,
+	codex: ByFolder
+});
+const decodeAgents = Schema.decodeUnknownOption(Schema.fromJsonString(PluginAgents));
+const encodeAgents = Schema.encodeSync(Schema.fromJsonString(PluginAgents));
+const decodeTokenId$2 = Schema.decodeUnknownOption(TokenId);
+var OldHostGrants = class OldHostGrants extends Context.Service()("ref0/cli/OldHostGrants") {
+	static layer = Layer.effect(OldHostGrants, Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const config = yield* Ref0Config;
+		const keychain = yield* keychainIn("ref0");
+		const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
+		const file = path.join(home, ".ref0", "plugin-agents.json");
+		const account = (named) => `host-grant/${named.owner}/${named.agent}`;
+		const agents = config.api === defaultOrigin ? fs.readFileString(file).pipe(Effect.option, Effect.map(Option.flatMap(decodeAgents))) : Effect.succeedNone;
+		const replaces = Effect.fnUntraced(function* ({ harness, configFolder }) {
+			const kept = yield* agents;
+			if (Option.isNone(kept)) return Option.none();
+			const named = kept.value[harness][configFolder];
+			if (named === void 0) return Option.none();
+			const token = yield* keychain.get(account(named));
+			return Option.flatMap(token, (held) => Option.flatMap(parseToken(Redacted.value(held)), (parts) => decodeTokenId$2(parts.token)));
+		});
+		const retire = Effect.fnUntraced(function* (kept) {
+			const before = yield* agents;
+			if (Option.isNone(before)) return;
+			const left = {
+				"claude-code": { ...before.value["claude-code"] },
+				codex: { ...before.value.codex }
+			};
+			const forgotten = /* @__PURE__ */ new Map();
+			for (const folder of kept) {
+				const named = left[folder.harness][folder.configFolder];
+				if (named === void 0) continue;
+				delete left[folder.harness][folder.configFolder];
+				forgotten.set(account(named), [...forgotten.get(account(named)) ?? [], {
+					...folder,
+					named
+				}]);
+			}
+			const stillNamed = new Set([...Object.values(left["claude-code"]), ...Object.values(left.codex)].map(account));
+			for (const [name, folders] of forgotten) {
+				if (stillNamed.has(name)) continue;
+				if (yield* keychain.remove(name).pipe(Effect.as(true), Effect.catch(() => Effect.map(keychain.get(name).pipe(Effect.orElseSucceed(() => Option.some(Redacted.make("")))), Option.isNone)))) continue;
+				for (const folder of folders) left[folder.harness][folder.configFolder] = folder.named;
+			}
+			if (forgotten.size === 0) return;
+			const empty = Object.keys(left["claude-code"]).length === 0 && Object.keys(left.codex).length === 0;
+			const next = `${file}.next`;
+			yield* (empty ? fs.remove(file) : fs.writeFileString(next, encodeAgents(left), { mode: 384 }).pipe(Effect.andThen(fs.rename(next, file)))).pipe(Effect.ignore);
+		});
+		return OldHostGrants.of({
+			replaces,
+			retire
 		});
 	}));
 };
@@ -20616,9 +21079,12 @@ var Machine = class Machine extends Context.Service()("ref0/cli/Machine") {
 //#region src/attachment-request.ts
 /**
 * The machine prints its link and Find code, then collects with its own secret and the answer
-* pasted from the approving browser. It keeps and confirms the grant before installing.
+* from the approving browser. It keeps and confirms each folder's grant before installing.
 */
 const isAnswerCode = Schema.is(TypedApprovalCode);
+/** A key's escape code, such as an arrow's, as a terminal sends it. */
+const escapeCode = /\u001b\[[\d;]*[A-Za-z~]/gu;
+const decodeTokenId$1 = Schema.decodeUnknownOption(TokenId);
 const decodeSecretHash$1 = Schema.decodeUnknownEffect(SecretHash);
 /** How often the machine asks whether its person has answered. */
 const pollMillis = 2e3;
@@ -20634,62 +21100,92 @@ const giveUpAfterMillis = 12e4;
 * it, before the machine stops it. Ctrl-C can't: the grant is kept even after an interrupt.
 */
 const keepTimeout = Duration.minutes(1);
+/**
+* How long keeping every folder's grant may take, so the machine confirms what it kept well
+* before ref0 revokes what it hasn't, 10 minutes after it connected.
+*/
+const keepBudget = Duration.minutes(5);
 /** A request that couldn't finish: no answer in time, no connection, or ref0 briefly unable. */
 var Unanswered = class extends Schema.TaggedError()("Unanswered", {}) {};
 const unanswered = () => Effect.fail(new Unanswered());
+/**
+* The name the machine sends for itself: its host name without any character that could reorder
+* or hide what's around it, cut to 64 characters without splitting one in two, or `this machine`
+* when that leaves none.
+*/
+const machineNameOf = (hostName) => {
+	let name = "";
+	for (const character of withoutHiddenCharacters(hostName).trim()) {
+		if (name.length + character.length > 64) break;
+		name += character;
+	}
+	return name || "this machine";
+};
 /** A refusal ref0 gave, said as it gave it. */
 const said = (refusal) => sayFailed(refusal.nextStep);
 const isEnded = (state) => state.state !== "waiting";
-/** The line that asks again, as the person ran it. */
-const connectLine = (harness) => Option.match(harness, {
-	onNone: () => "ref0 connect",
-	onSome: (into) => `ref0 connect --harness ${into}`
-});
-/** What connecting connected, in words: the agent, and each organization it doesn't work in yet. */
-const connectedWords = (connected) => {
-	const named = (state) => connected.organizations.filter((place) => place.state === state).map((place) => place.name);
-	const pending = named("pending");
-	const refused = named("refused");
-	return [
-		`Connected: ${connected.handle}, ${connected.owner}’s agent, on this machine.`,
-		...pending.length === 0 ? [] : [`ref0 is still authorizing it in ${pending.join(", ")}: it works there once that’s done.`],
-		...refused.length === 0 ? [] : [`It doesn’t work in ${refused.join(", ")}, which refused to authorize it.`]
-	].join(" ");
-};
+/** The line that asks again. */
+const again$2 = "ref0 connect";
 /** What each way a request can end without connecting says, with the line that asks again. */
-const endedWords$1 = (state, again) => {
+const endedWords$1 = (state) => {
 	switch (state.state) {
-		case "refused": return `It was refused, and nothing was connected. To ask again, run: ${again}`;
-		case "aborted": return `It was aborted, and nothing was connected. To ask again, run: ${again}`;
-		case "expired": return `Nobody approved it in time, and nothing was connected. For a new code, run: ${again}`;
-		case "failed": return `${state.nextStep} To connect this machine, run: ${again}`;
+		case "refused": return `It was refused, and nothing was connected. To ask again, run: ${again$2}`;
+		case "aborted": return `It was aborted, and nothing was connected. To ask again, run: ${again$2}`;
+		case "expired": return `Nobody approved it in time, and nothing was connected. For a new code, run: ${again$2}`;
+		case "failed": return `${state.nextStep} To connect this machine, run: ${again$2}`;
 	}
 };
+/** The grant a kept record holds, by its ID. */
+const grantOf = (token) => Option.flatMap(parseToken(Redacted.value(token)), (parts) => decodeTokenId$1(parts.token));
 /**
-* Asks with no owner, shows the link, and takes the answer pasted from the person’s own page.
+* Asks with no owner for every folder given, each with a grant secret of its own, shows the
+* link, and takes the answer from the person's own page. Then it keeps each folder ref0
+* connected, confirms exactly the grants it kept, and forgets 0.5.0's grants they replace.
 */
-const requestAttachment = Effect.fnUntraced(function* (harness) {
+const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const config = yield* Ref0Config;
-	const again = connectLine(harness);
 	const machine = yield* Machine;
 	const hostGrant = yield* HostGrant;
+	const oldGrants = yield* OldHostGrants;
 	const http = yield* HttpClient.HttpClient;
-	const grant = yield* freshTokenSecret;
+	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	const collecting = yield* freshSecret;
 	const link = yield* freshLinkSecret;
 	const pasted = yield* Ref.make(void 0);
+	const opener = yield* browserOpener;
+	const listener = opener === void 0 ? void 0 : yield* listenForAnswer(new URL(config.api).origin).pipe(Effect.catchTag("ListenerUnavailable", () => Effect.as(Console.error("Couldn’t listen for the browser. Paste the code instead."), void 0)));
 	const machineId = yield* machine.id.pipe(Effect.catchTag("MachineError", said));
 	const client = yield* ref0Client(config.api).pipe(Effect.provide(anonymousCredential), Effect.provideService(HttpClient.HttpClient, http));
 	const unreachable = () => sayFailed(`Couldn’t reach ref0 at ${config.api}. Try again.`);
 	const requestId = yield* newRequestId;
+	const asking = yield* Effect.forEach(asked, Effect.fnUntraced(function* (folder) {
+		const previous = yield* hostGrant.get(folder.configFolder).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone), Effect.catchTag("KeychainError", said));
+		return {
+			...folder,
+			shown: shownConfigFolder(home, folder.configFolder),
+			grant: yield* freshTokenSecret,
+			replaces: Option.isSome(previous) ? grantOf(previous.value.token) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said))
+		};
+	}));
+	const folders = yield* Effect.forEach(asking, Effect.fnUntraced(function* (folder) {
+		const requested = {
+			path: folder.shown,
+			harness: folder.harness,
+			secretHash: yield* Effect.orDie(decodeSecretHash$1(folder.grant.hash))
+		};
+		return Option.isSome(folder.replaces) ? {
+			...requested,
+			replaces: folder.replaces.value
+		} : requested;
+	}));
 	const payload = {
 		machine: machineId,
-		machineName: machine.name,
-		secretHash: yield* Effect.orDie(decodeSecretHash$1(grant.hash)),
+		machineName: machineNameOf(machine.hostName),
+		folders,
 		collectHash: yield* Effect.orDie(decodeSecretHash$1(collecting.hash)),
 		linkHash: yield* Effect.orDie(decodeSecretHash$1(link.hash))
 	};
-	if (Option.isSome(harness)) payload.harness = harness.value;
+	if (listener !== void 0) payload.callback = listener.callback;
 	const started = yield* client.machineAttachments.request({
 		headers: { "idempotency-key": requestId },
 		payload
@@ -20710,9 +21206,10 @@ const requestAttachment = Effect.fnUntraced(function* (harness) {
 	yield* Console.error([
 		`Open ${config.api}/connect#${link.secret}`,
 		`Or type ${started.code} in Find under Waiting on you, by ${minute(started.expiresAt)}.`,
-		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for that agent.",
+		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for each agent it connects.",
 		"Waiting for the answer. Ctrl-C stops it."
 	].join("\n"));
+	if (opener !== void 0) yield* openBrowser(opener, `${config.api}/connect#${link.secret}`);
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
 	const collector = yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http));
 	const params = { approval: started.approval };
@@ -20734,35 +21231,83 @@ const requestAttachment = Effect.fnUntraced(function* (harness) {
 		while (true) {
 			const state = yield* collect;
 			if (Option.isSome(state) && isEnded(state.value)) return state.value;
-			if ((yield* Clock.currentTimeMillis) > giveUpAt) return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grant 10 minutes after it connected. To connect this machine, run: ${again}`);
+			if ((yield* Clock.currentTimeMillis) > giveUpAt) return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$2}`);
 			yield* Effect.sleep(pollMillis);
 		}
 	});
-	const finish = Effect.fnUntraced(function* (state) {
-		if (state.state !== "connected") return yield* sayFailed(endedWords$1(state, again));
-		const token = formatToken(state.credential.person, state.credential.id, grant.secret);
-		const into = Option.isSome(harness) ? harness.value : yield* currentHarness;
-		const folder = yield* (yield* ConfigFolders).folder(into);
-		yield* hostGrant.keep(folder, {
-			harness: into,
-			owner: state.owner,
-			agent: state.handle,
+	const keepOne = Effect.fnUntraced(function* (folder, connection, keepBy) {
+		const left = keepBy - (yield* Clock.currentTimeMillis);
+		if (left <= 0) return Option.some("The keychain took too long with the folders before it, so this machine didn’t keep this one’s grant.");
+		const token = formatToken(connection.credential.person, connection.credential.id, folder.grant.secret);
+		const kept = yield* hostGrant.keep(folder.configFolder, {
+			harness: folder.harness,
+			owner: connection.owner,
+			agent: connection.handle,
+			agentId: connection.agent.id,
 			token: Redacted.make(token)
 		}).pipe(Effect.timeoutOrElse({
-			duration: keepTimeout,
+			duration: Duration.min(keepTimeout, Duration.millis(left)),
 			orElse: () => Effect.fail(new KeychainError({ nextStep: "The keychain didn’t answer within a minute. Check that it’s unlocked." }))
 		}), Effect.retry({
 			times: 2,
 			schedule: Schedule.spaced("1 second")
-		}), Effect.catchTag("KeychainError", (failed) => sayFailed(`It connected, but this machine couldn’t keep what it needs to act: ${failed.nextStep} This machine never confirmed the grant, so ref0 revokes it 10 minutes after it connected, even if the keychain kept it after all. To connect this machine, run: ${again}`)));
-		const unconfirmed = () => sayFailed(`It connected, and this machine kept its grant, but ref0 didn’t answer when it said so. If ref0 never heard, it revokes the grant 10 minutes after it connected: then run ${again}`);
+		}), Effect.result);
+		return Result.isSuccess(kept) ? Option.none() : Option.some(kept.failure.nextStep);
+	});
+	const finish = Effect.fnUntraced(function* (state) {
+		if (state.state !== "connected") return yield* sayFailed(endedWords$1(state));
+		const keepBy = (yield* Clock.currentTimeMillis) + Duration.toMillis(keepBudget);
+		const kept = [];
+		const grants = [];
+		const notKept = [];
+		for (const folder of asking) {
+			const connection = state.folders.find((each) => each.path === folder.shown);
+			if (connection === void 0) {
+				if (!state.excluded.includes(folder.shown)) notKept.push({
+					harness: folder.harness,
+					configFolder: folder.configFolder,
+					nextStep: "ref0 didn’t connect this folder."
+				});
+				continue;
+			}
+			const failed = yield* keepOne(folder, connection, keepBy);
+			if (Option.isSome(failed)) {
+				notKept.push({
+					harness: folder.harness,
+					configFolder: folder.configFolder,
+					nextStep: failed.value
+				});
+				continue;
+			}
+			kept.push({
+				harness: folder.harness,
+				configFolder: folder.configFolder,
+				owner: connection.owner,
+				agent: connection.agent.id,
+				handle: connection.handle,
+				organizations: connection.organizations
+			});
+			grants.push(connection.credential.id);
+		}
+		yield* oldGrants.retire(kept);
+		const [first, ...rest] = grants;
+		if (first === void 0) return yield* sayFailed([[
+			"It connected, but this machine couldn’t keep what it needs to act:",
+			...notKept.map((each) => `${shownConfigFolder(home, each.configFolder)}: ${each.nextStep}`),
+			"This machine never confirmed the grants, so ref0 revokes them 10 minutes after they connected, even if the keychain kept them after all. To connect this machine, run:",
+			{ command: again$2 }
+		]]);
+		const unconfirmed = () => sayFailed(`It connected, and this machine kept its grants, but ref0 didn’t answer when it said so. If ref0 never heard, it revokes them 10 minutes after they connected: then run ${again$2}`);
 		const confirmId = yield* newRequestId;
 		const answerCode = yield* Ref.get(pasted);
-		if (answerCode === void 0) return yield* sayFailed("The answer code is missing. Run ref0 connect again.");
+		if (answerCode === void 0) return yield* sayFailed(`The answer code is missing. Run ${again$2} again.`);
 		if (!(yield* collector.machineAttachments.confirm({
 			params,
 			headers: { "idempotency-key": confirmId },
-			payload: { answerCode }
+			payload: {
+				answerCode,
+				grants: [first, ...rest]
+			}
 		}).pipe(Effect.timeoutOrElse({
 			duration: requestTimeout,
 			orElse: unanswered
@@ -20777,14 +21322,17 @@ const requestAttachment = Effect.fnUntraced(function* (harness) {
 			times: 2,
 			schedule: Schedule.spaced("1 second")
 		}), Effect.catchTag("Unanswered", unconfirmed))).confirmed) {
-			yield* hostGrant.remove(folder).pipe(Effect.ignore);
-			return yield* sayFailed(`ref0 revoked the grant, since this machine didn’t confirm in time that it kept it. It’s deleted here, and nothing is connected. To connect this machine, run: ${again}`);
+			for (const folder of kept) yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
+			return yield* sayFailed(`ref0 revoked the grants, since this machine didn’t confirm in time that it kept them. They’re deleted here, and nothing is connected. To connect this machine, run: ${again$2}`);
 		}
 		return {
 			owner: state.owner,
-			agent: state.agent.id,
-			handle: state.handle,
-			organizations: state.organizations
+			kept,
+			notKept,
+			excluded: asking.flatMap(({ harness, configFolder, shown }) => state.excluded.includes(shown) ? [{
+				harness,
+				configFolder
+			}] : [])
 		};
 	});
 	const stopped = Effect.gen(function* () {
@@ -20805,29 +21353,434 @@ const requestAttachment = Effect.fnUntraced(function* (harness) {
 		}), Effect.retry({
 			while: Predicate.isTagged("Unanswered"),
 			times: 2
-		}), Effect.catchTag("Unanswered", () => sayFailed("Couldn’t reach ref0 to abort it. If it’s approved anyway, ref0 revokes its grant 10 minutes after it connects, since this machine never kept it.")));
+		}), Effect.catchTag("Unanswered", () => sayFailed("Couldn’t reach ref0 to abort it. If it’s approved anyway, ref0 revokes its grants 10 minutes after they connect, since this machine never kept them.")));
 		if (!isEnded(state)) {
-			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed("It was already answered, but no code was pasted. Nothing was kept here; its unconfirmed grant expires.");
+			if ((yield* Ref.get(pasted)) === void 0) return yield* sayFailed("It was already answered, but no code was pasted. Nothing was kept here; its unconfirmed grants expire.");
 			yield* Console.error("It was already answered, so this machine waits to hear how.");
 		}
 		const connected = yield* finish(isEnded(state) ? state : yield* answered);
-		const install = Option.isSome(harness) ? ` Nothing was installed: to install ref0’s plugin for it, run ${installLine(yield* (yield* ConfigFolders).folder(harness.value))}` : "";
-		yield* Console.error(`${connectedWords(connected)}${install}`);
+		yield* printBlocks([[{ label: `Connected as ${connected.owner}’s agents` }, ...connected.kept.map((folder) => `${shownConfigFolder(home, folder.configFolder)}  ${folder.handle}`)], ["Stopped, so nothing was installed. To install ref0’s plugin into each, run:", ...connected.kept.map((folder) => ({ command: installLine(folder.configFolder) }))]]);
 	});
 	const terminal = yield* Terminal.Terminal;
 	const readAnswer = Effect.gen(function* () {
-		yield* Console.error("Paste the code from your own page on ref0.dev.");
+		yield* Console.error(`Paste the code from your own page on ${config.api}.`);
 		while (true) {
-			const typed = (yield* terminal.readLine).trim();
+			const typed = (yield* terminal.readLine).replaceAll(escapeCode, "").trim();
+			if (typed === "") continue;
 			if (!isAnswerCode(typed)) {
-				yield* Console.error("Paste the 8-character code from your own page on ref0.dev.");
+				yield* Console.error(`Paste the 8-character code from your own page on ${config.api}.`);
 				continue;
 			}
-			yield* Ref.set(pasted, typed);
+			yield* Ref.update(pasted, (first) => first ?? typed);
+			if (listener !== void 0) yield* listener.stop;
 			return yield* Effect.never;
 		}
 	}).pipe(Effect.catchTag("QuitError", () => Effect.interrupt));
-	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, readAnswer)).pipe(Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
+	const receiveAnswer = listener === void 0 ? readAnswer : Effect.raceFirst(readAnswer, listener.answer.pipe(Effect.flatMap((code) => Ref.update(pasted, (first) => first ?? code)), Effect.andThen(Effect.never)));
+	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
+}, Effect.scoped);
+//#endregion
+//#region src/connect-lock.ts
+/**
+* One `ref0 connect` at a time on this machine, for every API origin, from finding its config
+* folders to installing into them: two at once could each keep a grant for one folder, and the
+* one written last would leave the other live with nobody holding it.
+*
+* The lock is `~/.ref0/connect.lock`. Each entry names its process, when that process started,
+* and a nonce, and is written whole, then linked into place, so nobody reads one half written.
+* An entry whose process has ended is passed over to `connect.lock-<its nonce>`, which only one
+* process can link: a crash leaves the lock to the next run, and two runs that find the same
+* ended entry can't both take it. A run that linked further along reads the chain again from
+* the head before it holds, and lets go if any of it changed. The holder unlinks from the head,
+* so a crash part way through leaves only entries no chain reaches.
+*/
+/** Another run holds the lock, or a file in it can't be read. */
+var ConnectBusy = class extends Schema.TaggedError()("ConnectBusy", { nextStep: Schema.String }) {};
+const Entry = Schema.Struct({
+	pid: Schema.Int.check(Schema.isGreaterThan(0)),
+	started: Schema.String,
+	nonce: Schema.String.check(Schema.isPattern(/^[0-9a-f-]{36}$/))
+});
+const decodeEntry = Schema.decodeUnknownOption(Schema.fromJsonString(Entry));
+const encodeEntry = Schema.encodeSync(Schema.fromJsonString(Entry));
+/** A process, as far as the lock goes: which one this is, and whether one is still running. */
+var Processes = class Processes extends Context.Service()("ref0/cli/Processes") {
+	static layer = Layer.effect(Processes, Effect.gen(function* () {
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		const startOf = (pid) => spawner.string(ChildProcess.make("ps", [
+			"-o",
+			"lstart=",
+			"-p",
+			String(pid)
+		], {
+			env: {
+				TZ: "UTC",
+				LC_ALL: "C"
+			},
+			extendEnv: true
+		})).pipe(Effect.map((text) => text.trim()), Effect.timeout("5 seconds"), Effect.orElseSucceed(() => ""));
+		const signalled = (pid) => Effect.try(() => process.kill(pid, 0)).pipe(Effect.as(true), Effect.catch((error) => Effect.succeed(Predicate.hasProperty(error.cause, "code") && error.cause.code === "EPERM")));
+		return Processes.of({
+			own: Effect.map(startOf(process.pid), (started) => ({
+				pid: process.pid,
+				started
+			})),
+			running: Effect.fnUntraced(function* ({ pid, started }) {
+				if (!(yield* signalled(pid))) return false;
+				if (started === "") return true;
+				const now = yield* startOf(pid);
+				return now === "" || now === started;
+			})
+		});
+	}));
+};
+var ConnectLock = class ConnectLock extends Context.Service()("ref0/cli/ConnectLock") {
+	static layer = Layer.effect(ConnectLock, Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const crypto = yield* Crypto.Crypto;
+		const processes = yield* Processes;
+		const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
+		const directory = path.join(home, ".ref0");
+		const head = path.join(directory, "connect.lock");
+		const shown = "~/.ref0/connect.lock";
+		const unwritable = new ConnectBusy({ nextStep: `Couldn’t write ${shown}. Check that ~/.ref0 is writable, then run ref0 connect again.` });
+		const unreadable = new ConnectBusy({ nextStep: `${shown} holds a file ref0 can’t read. If no ref0 connect is running, delete ${shown}*, then run ref0 connect again.` });
+		const busy = (pid) => new ConnectBusy({ nextStep: `Another ref0 connect is running on this machine, as process ${pid}. Let it finish, then run ref0 connect again.` });
+		const raced = new ConnectBusy({ nextStep: "Another ref0 connect started at the same time. Let it finish, then run ref0 connect again." });
+		const after = (entry) => `${head}-${entry.nonce}`;
+		const read = Effect.fnUntraced(function* (name) {
+			const text = yield* fs.readFileString(name).pipe(Effect.map(Option.some), Effect.catchTag("PlatformError", (error) => Predicate.isTagged(error.reason, "NotFound") ? Effect.succeedNone : Effect.fail(unreadable)));
+			if (Option.isNone(text)) return Option.none();
+			const entry = decodeEntry(text.value);
+			if (Option.isNone(entry)) return yield* unreadable;
+			return entry;
+		});
+		const intact = Effect.fnUntraced(function* (chain, own) {
+			for (const [index, name] of chain.entries()) {
+				const entry = yield* read(name);
+				if (Option.isNone(entry)) return false;
+				const next = chain[index + 1];
+				if (next === void 0) return entry.value.nonce === own.nonce;
+				if (after(entry.value) !== next) return false;
+			}
+			return false;
+		});
+		const take = Effect.fnUntraced(function* (draft, own) {
+			for (let attempt = 0; attempt < 3; attempt += 1) {
+				const chain = [];
+				let name = head;
+				for (let step = 0; step < 16; step += 1) {
+					if (yield* fs.link(draft, name).pipe(Effect.as(true), Effect.catchTag("PlatformError", (error) => Predicate.isTagged(error.reason, "AlreadyExists") ? Effect.succeed(false) : Effect.fail(unwritable)))) {
+						chain.push(name);
+						if (yield* intact(chain, own)) return chain;
+						yield* fs.remove(name).pipe(Effect.ignore);
+						break;
+					}
+					const entry = yield* read(name);
+					if (Option.isNone(entry)) continue;
+					if (yield* processes.running(entry.value)) return yield* busy(entry.value.pid);
+					chain.push(name);
+					name = after(entry.value);
+				}
+			}
+			return yield* raced;
+		});
+		const release = Effect.fnUntraced(function* (chain, own) {
+			if (!(yield* intact(chain, own).pipe(Effect.orElseSucceed(() => false)))) return;
+			for (const name of chain) yield* fs.remove(name).pipe(Effect.ignore);
+		});
+		const hold = Effect.gen(function* () {
+			const own = {
+				...yield* processes.own,
+				nonce: yield* crypto.randomUUIDv4.pipe(Effect.mapError(() => unwritable))
+			};
+			const draft = path.join(directory, `connect.lock.${own.nonce}.draft`);
+			yield* Effect.acquireRelease(Effect.gen(function* () {
+				yield* fs.makeDirectory(directory, {
+					recursive: true,
+					mode: 448
+				});
+				yield* fs.writeFileString(draft, encodeEntry(own), {
+					flag: "wx",
+					mode: 384
+				});
+				return yield* take(draft, own);
+			}).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unwritable)), Effect.ensuring(fs.remove(draft).pipe(Effect.ignore))), (chain) => release(chain, own));
+		});
+		return ConnectLock.of({ hold });
+	}));
+};
+//#endregion
+//#region src/yes-or-no.ts
+/**
+* How long what a terminal held while nobody read it takes to arrive once a question reads: one
+* read, well within this.
+*/
+const settle = Duration.millis(50);
+const again$1 = "Type y or yes, or n or no. Enter alone is no.";
+/** A line's answer, or none when it's neither yes nor no. */
+const answerOf$1 = (line) => {
+	const word = line.trim().toLowerCase();
+	if (word === "y" || word === "yes") return Option.some(true);
+	if (word === "" || word === "n" || word === "no") return Option.some(false);
+	return Option.none();
+};
+/** What Backspace takes back: one character as the person sees it, an emoji's parts included. */
+const characters = new Intl.Segmenter();
+/** Whether a key types text: none of its characters moves the cursor or controls the terminal. */
+const typesText = (text) => text !== "" && !/\p{Cc}/u.test(text);
+const quits = (key) => key.ctrl && (key.name === "c" || key.name === "d");
+/** The explanation goes to stderr, the question to stdout and its answer comes from stdin. */
+const allTerminals = () => process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
+/**
+* Asks yes-or-no questions in this terminal, one after another: each shows `explained` on stderr,
+* then the question, and waits for a line. What was typed before a question showed doesn't answer
+* it, unless another question was asked when it arrived: a line typed after the one that answered
+* a question answers the next. The answer is no, unasked, unless stdin, stdout and stderr are each
+* a terminal, and on Ctrl-C or Ctrl-D.
+*/
+const yesOrNoQuestions = Effect.gen(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const ahead = yield* Ref.make([]);
+	const ask = (explained, question) => Effect.gen(function* () {
+		if (!allTerminals()) return false;
+		const keys = yield* terminal.readInput;
+		yield* Effect.sleep(settle);
+		yield* Queue.clear(keys);
+		const pending = [...yield* Ref.getAndSet(ahead, [])];
+		const next = Effect.suspend(() => {
+			const key = pending.shift();
+			return key === void 0 ? Queue.take(keys) : Effect.succeed(key);
+		});
+		yield* printBlocks([explained]);
+		yield* terminal.display(questionLine(question));
+		let typed = "";
+		let previous = "";
+		while (true) {
+			const pressed = yield* Effect.option(next);
+			if (Option.isNone(pressed) || quits(pressed.value.key)) {
+				yield* terminal.display("\n");
+				return false;
+			}
+			const { input, key } = pressed.value;
+			const ended = key.name === "enter" && previous === "return";
+			previous = key.name;
+			if (ended) continue;
+			if (key.name === "backspace") {
+				if (typed === "") continue;
+				typed = typed.slice(0, [...characters.segment(typed)].at(-1)?.index);
+				yield* terminal.display("\b \b");
+				continue;
+			}
+			if (key.name !== "return" && key.name !== "enter") {
+				const text = Option.getOrElse(input, () => "");
+				if (!typesText(text)) continue;
+				typed += text;
+				yield* terminal.display(text);
+				continue;
+			}
+			yield* terminal.display("\n");
+			const answer = answerOf$1(typed);
+			if (Option.isSome(answer)) {
+				const rest = [...pending, ...yield* Queue.clear(keys)];
+				const ended = key.name === "return" && rest[0]?.key.name === "enter";
+				yield* Ref.set(ahead, ended ? rest.slice(1) : rest);
+				return answer.value;
+			}
+			typed = "";
+			yield* terminal.display(`${again$1}\n${questionLine(question)}`);
+		}
+	}).pipe(Effect.scoped, Effect.orElseSucceed(() => false));
+	return ask;
+});
+//#endregion
+//#region src/harness/install-claude-code.ts
+/** Install into one config folder, from the release Claude Code fetched and ref0 checked. */
+const installClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
+	const run = yield* release.into(configFolder);
+	yield* run([
+		"plugin",
+		"install",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	yield* run([
+		"plugin",
+		"update",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	return release.folder;
+});
+//#endregion
+//#region src/harness/hook-fields.ts
+/**
+* The same for Codex 0.160.0, which skips a hook outright if its template names a field the event
+* lacks, so each list holds only fields every hook of its event carried in the prototypes, and
+* only events they saw, each a `HookEvent`. Codex puts the model in every hook but `SessionEnd`.
+* Its `UserPromptSubmit` carries the prompt (`spikes/harness/results/codex/catalog.json`), which
+* no list names, as for Claude Code.
+* Every Codex hook carries `transcript_path`, the session's rollout, `null` for a session kept
+* nowhere (Codex's hook input schemas, 0.160.0 to 0.163.0): its turns' tokens are read there.
+* A subagent's are read from its own rollout, which its `SubagentStop` names, with the
+* subagent's own turn as its `turn_id` (Codex 0.163.0's subagents, 20 Oct 2026).
+*/
+const codexHookFields = {
+	UserPromptSubmit: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"transcript_path"
+	],
+	PreToolUse: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"tool_name",
+		"tool_use_id",
+		"tool_input"
+	],
+	PostToolUse: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"tool_name",
+		"tool_use_id",
+		"tool_input",
+		"tool_response"
+	],
+	Stop: [
+		"session_id",
+		"turn_id",
+		"model",
+		"stop_hook_active",
+		"transcript_path"
+	],
+	SubagentStop: [
+		"session_id",
+		"turn_id",
+		"agent_id",
+		"agent_type",
+		"stop_hook_active",
+		"agent_transcript_path"
+	]
+};
+Schema.encodeSync(Schema.fromJsonString(CodexPluginManifest));
+/** How Codex names a plugin's MCP server in an `mcp_tool` hook. */
+const codexServer = "ref0";
+/** Codex's hooks file, by its path inside the plugin. */
+const codexHooksPath = "hooks/codex-hooks.json";
+({ ...mcpToolHooks(codexServer, codexHookFields) });
+/**
+* The folder of Codex's skills, by its path inside the plugin. Not `skills`, which Claude Code
+* reads too, where a `status` skill would be a second status command. Codex 0.163.0 skips
+* Claude Code's `commands/status.md`, since its `!` line is a template it can't run.
+*/
+const codexSkillsPath = "codex-skills";
+/** The status skill, by its path inside the plugin. */
+const codexStatusSkillPath = `${codexSkillsPath}/status/SKILL.md`;
+/**
+* How a person runs the status skill of a plugin installed as `name`: Codex 0.163.0 names a
+* plugin's skill by the plugin, then the skill.
+*/
+const codexStatusShortcut = (name) => `$${name}:status`;
+/** The skill's placeholder for the plugin's folder, which Codex's agent fills in. */
+const pluginFolder = "<plugin>";
+/** What the status skill runs: `ref0 status`, through the plugin's lookup script. */
+const codexStatusLine = throughLookup([harnessCommandNames.status]).replaceAll(pluginRoot, pluginFolder);
+[
+	"---",
+	"name: status",
+	`description: Shows whether ref0 follows this Codex session, and what to do next if it doesn’t. Use when the person runs ${codexStatusShortcut("ref0")} or asks whether ref0 is working.`,
+	"---",
+	"",
+	"Run ref0’s check and show the person what it says.",
+	"",
+	`1. This file is \`${pluginFolder}/${codexSkillsPath}/status/SKILL.md\`. Run this command, with \`${pluginFolder}\` replaced by that folder’s absolute path:`,
+	"",
+	"   ```sh",
+	`   ${codexStatusLine}`,
+	"   ```",
+	"",
+	"   Run it outside Codex’s sandbox, with `sandbox_permissions: \"require_escalated\"`, since in the sandbox it can’t ask Codex, this machine’s keychain or ref0. If that isn’t allowed, run it in the sandbox.",
+	"2. Show every line it prints as it is, and add nothing. It exits 1 when a line says no: that’s its answer, not an error to fix.",
+	""
+].join("\n");
+//#endregion
+//#region src/harness/origin-plugin.ts
+const manifestJson = Schema.fromJsonString(PluginManifest);
+const codexJson = Schema.fromJsonString(CodexPluginManifest);
+const marketJson = Schema.fromJsonString(PluginMarketplace);
+const hooksJson = Schema.fromJsonString(HooksFile);
+/**
+* Keep the checked release under this origin's own marketplace and plugin identity, with its
+* hooks, server and Codex status skill named for it.
+*/
+const keepOriginPlugin = Effect.fnUntraced(function* (source, home) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const { api } = yield* Ref0Config;
+	const name = yield* originPluginName(api);
+	const directory = path.join(home, ".ref0", "origins", originKey(api), "plugins");
+	yield* fs.makeDirectory(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const folder = yield* fs.makeTempDirectory({
+		directory,
+		prefix: "release-"
+	});
+	yield* fs.copy(source, folder, { overwrite: true });
+	const manifestFile = path.join(folder, "ref0/.claude-plugin/plugin.json");
+	const manifest = yield* fs.readFileString(manifestFile).pipe(Effect.flatMap(Schema.decodeUnknownEffect(manifestJson)));
+	yield* fs.writeFileString(manifestFile, yield* Schema.encodeEffect(manifestJson)({
+		...manifest,
+		name
+	}));
+	const codexFile = path.join(folder, "ref0/.codex-plugin/plugin.json");
+	const codex = yield* fs.readFileString(codexFile).pipe(Effect.flatMap(Schema.decodeUnknownEffect(codexJson)));
+	yield* fs.writeFileString(codexFile, yield* Schema.encodeEffect(codexJson)({
+		...codex,
+		name
+	}));
+	yield* fs.writeFileString(path.join(folder, ".claude-plugin/marketplace.json"), yield* Schema.encodeEffect(marketJson)({
+		name,
+		owner: { name: "ref0" },
+		plugins: [{
+			name,
+			source: "./ref0",
+			description: manifest.description
+		}]
+	}));
+	for (const [file, server] of [["hooks/hooks.json", `plugin:${name}:${name}`], ["hooks/codex-hooks.json", name]]) {
+		const target = path.join(folder, "ref0", file);
+		const hooks = yield* fs.readFileString(target).pipe(Effect.flatMap(Schema.decodeUnknownEffect(hooksJson)));
+		const scoped = Object.fromEntries(Object.entries(hooks.hooks).map(([event, groups]) => [event, groups.map((group) => ({
+			...group,
+			hooks: group.hooks.map((hook) => hook.type === "mcp_tool" ? {
+				...hook,
+				server
+			} : hook)
+		}))]));
+		yield* fs.writeFileString(target, encodeHooks({ hooks: scoped }));
+	}
+	for (const file of [lookupScriptFile(manifest.version, api), mcpFile(manifest.version, api, name)]) yield* fs.writeFileString(path.join(folder, file.path), file.text);
+	const skillFile = path.join(folder, "ref0", codexStatusSkillPath);
+	if (yield* fs.exists(skillFile)) {
+		const skill = yield* fs.readFileString(skillFile);
+		yield* fs.writeFileString(skillFile, skill.replaceAll(codexStatusShortcut("ref0"), codexStatusShortcut(name)));
+	}
+	return {
+		folder,
+		name,
+		id: `${name}@${name}`
+	};
 });
 //#endregion
 //#region src/harness/marketplace.ts
@@ -20837,49 +21790,45 @@ const decodeCodexPluginManifest = Schema.decodeUnknownEffect(Schema.fromJsonStri
 const decodePluginManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(PluginManifest));
 const decodePluginMarketplace = Schema.decodeUnknownEffect(Schema.fromJsonString(PluginMarketplace));
 const decodeHooksFile = Schema.decodeUnknownEffect(Schema.fromJsonString(HooksFile));
-var InstallFailed = class extends Schema.TaggedError()("InstallFailed", { nextStep: Schema.String }) {};
-/** Fetch and inspect the public marketplace with the harness, before installing its plugin. */
-const marketplaceFor = Effect.fnUntraced(function* (harness, options, again) {
+/**
+* Why ref0's plugin isn't installed in a config folder, and anything to fix first. Then the
+* folder's install runs again, or, for a plugin newer than this `ref0`, `run` updates `ref0`.
+*/
+var InstallFailed = class extends Schema.TaggedError()("InstallFailed", {
+	says: Schema.String,
+	run: Schema.optionalKey(Schema.String)
+}) {};
+/** The one command that repairs a folder's install. */
+const repairOf = (failed, configFolder) => failed.run ?? installLine(configFolder);
+/**
+* Fetch and inspect the public marketplace with the harness, before installing its plugin. The
+* fetch runs in a config folder of its own: the public marketplace's name, `ref0`, is ref0.dev's
+* own installed marketplace's too, and Codex's fetch would upgrade an installed plugin. Every
+* folder then installs from the release ref0 checked.
+*/
+const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const unavailable = new InstallFailed({ nextStep: `Couldn’t read ref0’s plugin from ref-0/plugins. Check your network; if the marketplace has no plugin yet, wait for ref0’s next release. Then run: ${again}` });
-	const binary = harness === "codex" ? "codex" : "claude";
-	const foreign = new InstallFailed({ nextStep: `This setup has a marketplace named ref0 from another source. Check it with: ${binary} plugin marketplace list. Remove it with: ${binary} plugin marketplace remove ref0. Then run: ${again}` });
-	const installEnv = {};
-	let checkedRevision;
-	const env = {
+	const unavailable = new InstallFailed({ says: "Couldn’t read ref0’s plugin from ref-0/plugins. Check your network; if the marketplace has no plugin yet, wait for ref0’s next release." });
+	const variable = harness === "codex" ? "CODEX_HOME" : "CLAUDE_CONFIG_DIR";
+	const envFor = (configFolder) => ({
 		HOME: options.home,
-		[harness === "codex" ? "CODEX_HOME" : "CLAUDE_CONFIG_DIR"]: options.configFolder
+		[variable]: configFolder
+	});
+	const prepare = (configFolder) => fs.makeDirectory(configFolder, { recursive: true }).pipe(Effect.mapError(() => new InstallFailed({ says: "Couldn’t prepare Codex’s config folder. Check that it’s writable." })));
+	const probe = yield* fs.makeTempDirectoryScoped().pipe(Effect.mapError(() => unavailable));
+	const fetchEnv = {
+		HOME: probe,
+		[variable]: path.join(probe, "config")
 	};
-	let fetchEnv = env;
-	if (harness === "codex") {
-		yield* fs.makeDirectory(options.configFolder, { recursive: true }).pipe(Effect.mapError(() => new InstallFailed({ nextStep: `Couldn’t prepare Codex’s config folder. Check that it’s writable, then run: ${again}` })));
-		const probe = yield* fs.makeTempDirectoryScoped().pipe(Effect.mapError(() => unavailable));
-		fetchEnv = {
-			HOME: probe,
-			CODEX_HOME: path.join(probe, "config")
-		};
-		yield* fs.makeDirectory(fetchEnv["CODEX_HOME"] ?? probe).pipe(Effect.mapError(() => unavailable));
-	}
-	const run = (args, stage = "fetch") => {
+	yield* fs.makeDirectory(path.join(probe, "config")).pipe(Effect.mapError(() => unavailable));
+	const run = (args, into) => {
 		const name = harness === "codex" ? "Codex" : "Claude Code";
-		const operation = stage === "install" ? "install ref0’s plugin" : "read its marketplaces";
-		const failed = (reason, detail = "") => stage === "fetch" ? unavailable : new InstallFailed({ nextStep: `${name} ${reason}.${detail === "" ? "" : ` ${detail}`} Then run: ${again}` });
+		const failed = (reason, detail = "") => into === void 0 ? unavailable : new InstallFailed({ says: `${name} ${reason}.${detail === "" ? "" : ` ${detail}`}` });
 		return Effect.scoped(Effect.gen(function* () {
-			const handle = yield* spawner.spawn(ChildProcess.make(options.command, harness === "codex" && stage === "install" && checkedRevision !== void 0 ? [
-				"--config",
-				`marketplaces.ref0.ref="${checkedRevision}"`,
-				...args
-			] : args, {
-				env: {
-					fetch: fetchEnv,
-					inspect: env,
-					install: {
-						...env,
-						...installEnv
-					}
-				}[stage],
+			const handle = yield* spawner.spawn(ChildProcess.make(options.command, args, {
+				env: into === void 0 ? fetchEnv : envFor(into),
 				extendEnv: true
 			}));
 			const [stdout, stderr, exit] = yield* Effect.all([
@@ -20887,47 +21836,38 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options, again) {
 				handle.stderr.pipe(Stream.decodeText(), Stream.splitLines, Stream.runFold(() => Option.none(), (first, line) => Option.isSome(first) ? first : Option.some(line))),
 				handle.exitCode
 			], { concurrency: "unbounded" });
-			if (exit !== ChildProcessSpawner.ExitCode(0)) return yield* failed(`refused to ${operation}`, Option.getOrElse(stderr, () => ""));
+			if (exit !== ChildProcessSpawner.ExitCode(0)) return yield* failed("refused to install ref0’s plugin", Option.getOrElse(stderr, () => ""));
 			return stdout;
 		})).pipe(Effect.timeout("2 minutes"), Effect.catchTags({
-			PlatformError: () => Effect.fail(failed(`couldn’t ${operation}`)),
-			TimeoutError: () => Effect.fail(failed(`timed out trying to ${operation}`))
+			PlatformError: () => Effect.fail(failed("couldn’t install ref0’s plugin")),
+			TimeoutError: () => Effect.fail(failed("timed out trying to install ref0’s plugin"))
 		}));
 	};
-	const list = Effect.fnUntraced(function* (stage = "fetch") {
+	const fetchedRoot = Effect.fnUntraced(function* () {
 		const text = yield* run([
 			"plugin",
 			"marketplace",
 			"list",
 			"--json"
-		], stage);
+		]);
 		if (harness === "claude-code") {
 			const found = (yield* decodeClaudeMarketplacesListed(text).pipe(Effect.mapError(() => unavailable))).find((entry) => entry.name === "ref0");
-			if (found === void 0) return Option.none();
-			if (found.source !== "github" || found.repo !== "ref-0/plugins") return yield* foreign;
-			return Option.some(found.installLocation);
+			if (found?.source !== "github" || found.repo !== "ref-0/plugins") return yield* unavailable;
+			return found.installLocation;
 		}
 		const found = (yield* decodeCodexMarketplacesListed(text).pipe(Effect.mapError(() => unavailable))).marketplaces.find((entry) => entry.name === "ref0");
-		if (found === void 0) return Option.none();
-		if (found.marketplaceSource?.sourceType !== "git" || found.marketplaceSource.source !== "https://github.com/ref-0/plugins.git") return yield* foreign;
-		return Option.some(found.root);
+		if (found?.marketplaceSource?.sourceType !== "git" || found.marketplaceSource.source !== "https://github.com/ref-0/plugins.git") return yield* unavailable;
+		return found.root;
 	});
-	const existing = yield* list("inspect");
-	yield* run(harness === "codex" || Option.isNone(existing) ? [
+	yield* run([
 		"plugin",
 		"marketplace",
 		"add",
 		"ref-0/plugins"
-	] : [
-		"plugin",
-		"marketplace",
-		"update",
-		"ref0"
 	]);
-	const fetched = yield* list();
-	if (Option.isNone(fetched)) return yield* unavailable;
-	let folder = yield* Effect.gen(function* () {
-		let root = yield* fs.realPath(fetched.value);
+	const fetched = yield* fetchedRoot();
+	const folder = yield* Effect.gen(function* () {
+		let root = yield* fs.realPath(fetched);
 		{
 			const temp = yield* fs.makeTempDirectoryScoped();
 			const snapshot = path.join(temp, "marketplace");
@@ -20949,30 +21889,6 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options, again) {
 				extendEnv: true
 			})).pipe(Effect.timeout("2 minutes"), Effect.catchCause(() => Effect.fail(unavailable)))) !== ChildProcessSpawner.ExitCode(0)) return yield* unavailable;
 			root = yield* fs.realPath(snapshot);
-			if (harness === "codex") {
-				const revision = (yield* spawner.string(ChildProcess.make("git", [
-					"-C",
-					snapshot,
-					"rev-parse",
-					"HEAD"
-				]))).trim();
-				if (!/^[a-f0-9]{40,64}$/.test(revision)) return yield* unavailable;
-				checkedRevision = revision;
-			}
-			const url = new URL("file:///");
-			url.pathname = snapshot;
-			Object.assign(installEnv, {
-				GIT_CONFIG_GLOBAL: "/dev/null",
-				GIT_CONFIG_NOSYSTEM: "1",
-				GIT_CONFIG_PARAMETERS: "",
-				GIT_CONFIG_COUNT: "3",
-				GIT_CONFIG_KEY_0: `url.${url.href}.insteadOf`,
-				GIT_CONFIG_VALUE_0: "https://github.com/ref-0/plugins.git",
-				GIT_CONFIG_KEY_1: `url.${url.href}.insteadOf`,
-				GIT_CONFIG_VALUE_1: "git@github.com:ref-0/plugins.git",
-				GIT_CONFIG_KEY_2: `url.${url.href}.insteadOf`,
-				GIT_CONFIG_VALUE_2: "ssh://git@github.com/ref-0/plugins.git"
-			});
 		}
 		const market = yield* fs.readFileString(path.join(root, ".claude-plugin/marketplace.json")).pipe(Effect.flatMap(decodePluginMarketplace));
 		const plugin = market.plugins.find((entry) => entry.name === "ref0");
@@ -20990,63 +21906,48 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options, again) {
 		const declarations = Object.values(hooks.hooks).flatMap((groups) => groups.flatMap((group) => group.hooks));
 		if (protocols.length === 0 || protocols.length !== declarations.length || protocols.some((protocol) => !/^\d+$/.test(protocol))) return yield* unavailable;
 		for (const protocol of protocols) {
-			const mismatch = updateLine({
+			const mismatch = protocolMismatch({
 				protocol,
 				version: Option.some(manifest.version)
-			}, again);
-			if (Option.isSome(mismatch)) return yield* new InstallFailed({ nextStep: mismatch.value });
+			}, installLine(options.configFolder));
+			if (Option.isNone(mismatch)) continue;
+			const { says, run } = mismatch.value;
+			return yield* Number(protocol) > 1 ? new InstallFailed({
+				says: `${says}.`,
+				run
+			}) : new InstallFailed({ says: `${says}.` });
 		}
-		return fetched.value;
+		return root;
 	}).pipe(Effect.catchTags({
 		PlatformError: () => Effect.fail(unavailable),
 		SchemaError: () => Effect.fail(unavailable)
 	}));
-	if (harness === "codex") {
-		yield* run(Option.isNone(existing) ? [
+	const scoped = yield* keepOriginPlugin(folder, options.home).pipe(Effect.mapError(() => unavailable));
+	const into = Effect.fnUntraced(function* (configFolder) {
+		if (harness === "codex") yield* prepare(configFolder);
+		const runIn = (args) => run(args, configFolder);
+		yield* runIn([
 			"plugin",
 			"marketplace",
-			"add",
-			"ref-0/plugins"
-		] : [
+			"remove",
+			scoped.name
+		]).pipe(Effect.ignore);
+		yield* runIn([
 			"plugin",
 			"marketplace",
-			"upgrade",
-			"ref0"
-		], "install");
-		const selected = yield* list("install");
-		if (Option.isNone(selected)) return yield* unavailable;
-		folder = selected.value;
-	}
+			"add",
+			scoped.folder
+		]);
+		return runIn;
+	});
 	return {
-		folder,
-		run: (args) => run(args, "install")
+		folder: scoped.folder,
+		name: scoped.name,
+		id: scoped.id,
+		into
 	};
 });
 //#endregion
-//#region src/harness/install-claude-code.ts
-/** Install from the public marketplace fetched and checked by Claude Code itself. */
-const installClaudeCode = Effect.fnUntraced(function* (options) {
-	const { folder, run } = yield* marketplaceFor("claude-code", {
-		...options,
-		command: options.claude
-	}, installLine(options.configFolder));
-	yield* run([
-		"plugin",
-		"install",
-		"ref0@ref0",
-		"--scope",
-		"user"
-	]);
-	yield* run([
-		"plugin",
-		"update",
-		"ref0@ref0",
-		"--scope",
-		"user"
-	]);
-	return folder;
-}, Effect.scoped);
-//#endregion
 //#region src/harness/codex-app-server.ts
 /**
 * Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
@@ -21088,138 +21989,50 @@ const opening = [{
 /**
 * Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
 * answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
-*/
-const exchange = (codex, lines, ids) => Effect.scoped(Effect.gen(function* () {
-	const answered = yield* (yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make(codex, ["app-server"], {
-		forceKillAfter: "2 seconds",
-		stdin: {
-			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
-			endOnDone: false
-		}
-	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$1(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
-	return Option.filter(answered, (answers) => answers.size === ids.length);
-})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
-const resultOf = (method, answer) => {
-	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
-	if ("error" in answer) return Effect.fail(new CodexRefused({
-		method: method.method,
-		error: answer.error
-	}));
-	const { result } = method;
-	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
-		method: method.method,
-		issue: error.message
-	})));
-};
-/**
-* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
-* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
-* its request's ID, and its result is read by the method's result schema.
-*/
-const askCodex = (codex, method, params) => Effect.gen(function* () {
-	const asked = {
-		jsonrpc: "2.0",
-		id: askedId,
-		method: method.method,
-		params
-	};
-	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
-	const answers = yield* exchange(codex, lines, [initializeId, askedId]);
-	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
-	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
-	return yield* resultOf(method, answers.value.get(askedId));
-});
-//#endregion
-//#region src/harness/hook-fields.ts
-/**
-* The same for Codex 0.160.0, which skips a hook outright if its template names a field the event
-* lacks, so each list holds only fields every hook of its event carried in the prototypes, and
-* only events they saw, each a `HookEvent`. Codex puts the model in every hook but `SessionEnd`.
-* Its `UserPromptSubmit` carries the prompt (`spikes/harness/results/codex/catalog.json`), which
-* no list names, as for Claude Code.
-* Every Codex hook carries `transcript_path`, the session's rollout, `null` for a session kept
-* nowhere (Codex's hook input schemas, 0.160.0 to 0.163.0): its turns' tokens are read there.
-* A subagent's are read from its own rollout, which its `SubagentStop` names, with the
-* subagent's own turn as its `turn_id` (Codex 0.163.0's subagents, 20 Oct 2026).
-*/
-const codexHookFields = {
-	UserPromptSubmit: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"transcript_path"
-	],
-	PreToolUse: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"tool_name",
-		"tool_use_id",
-		"tool_input"
-	],
-	PostToolUse: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"tool_name",
-		"tool_use_id",
-		"tool_input",
-		"tool_response"
-	],
-	Stop: [
-		"session_id",
-		"turn_id",
-		"model",
-		"stop_hook_active",
-		"transcript_path"
-	],
-	SubagentStop: [
-		"session_id",
-		"turn_id",
-		"agent_id",
-		"agent_type",
-		"stop_hook_active",
-		"agent_transcript_path"
-	]
+*/
+const exchange = (codex, lines, ids, configFolder) => Effect.scoped(Effect.gen(function* () {
+	const answered = yield* (yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make(codex, ["app-server"], {
+		env: configFolder === void 0 ? void 0 : { CODEX_HOME: configFolder },
+		extendEnv: true,
+		forceKillAfter: "2 seconds",
+		stdin: {
+			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
+			endOnDone: false
+		}
+	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$1(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
+	return Option.filter(answered, (answers) => answers.size === ids.length);
+})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
+/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
+const resultOf = (method, answer) => {
+	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
+	if ("error" in answer) return Effect.fail(new CodexRefused({
+		method: method.method,
+		error: answer.error
+	}));
+	const { result } = method;
+	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
+		method: method.method,
+		issue: error.message
+	})));
 };
-Schema.encodeSync(Schema.fromJsonString(CodexPluginManifest));
-/** How Codex names a plugin's MCP server in an `mcp_tool` hook. */
-const codexServer = "ref0";
-/** Codex's hooks file, by its path inside the plugin. */
-const codexHooksPath = "hooks/codex-hooks.json";
-({ ...mcpToolHooks(codexServer, codexHookFields) });
 /**
-* The folder of Codex's skills, by its path inside the plugin. Not `skills`, which Claude Code
-* reads too, where a `status` skill would be a second `/ref0:status`. Codex 0.163.0 skips
-* Claude Code's `commands/status.md`, since its `!` line is a template it can't run.
+* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
+* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
+* its request's ID, and its result is read by the method's result schema.
 */
-const codexSkillsPath = "codex-skills";
-/** The skill's placeholder for the plugin's folder, which Codex's agent fills in. */
-const pluginFolder = "<plugin>";
-/** What `$ref0:status` runs: `ref0 status`, through the plugin's lookup script. */
-const codexStatusLine = throughLookup([harnessCommandNames.status]).replaceAll(pluginRoot, pluginFolder);
-[
-	"---",
-	"name: status",
-	"description: Shows whether ref0 follows this Codex session, and what to do next if it doesn’t. Use when the person runs $ref0:status or asks whether ref0 is working.",
-	"---",
-	"",
-	"Run ref0’s check and show the person what it says.",
-	"",
-	`1. This file is \`${pluginFolder}/${codexSkillsPath}/status/SKILL.md\`. Run this command, with \`${pluginFolder}\` replaced by that folder’s absolute path:`,
-	"",
-	"   ```sh",
-	`   ${codexStatusLine}`,
-	"   ```",
-	"",
-	"   Run it outside Codex’s sandbox, with `sandbox_permissions: \"require_escalated\"`, since in the sandbox it can’t ask Codex, this machine’s keychain or ref0. If that isn’t allowed, run it in the sandbox.",
-	"2. Show every line it prints as it is, and add nothing. It exits 1 when a line says no: that’s its answer, not an error to fix.",
-	""
-].join("\n");
+const askCodex = (codex, method, params, configFolder) => Effect.gen(function* () {
+	const asked = {
+		jsonrpc: "2.0",
+		id: askedId,
+		method: method.method,
+		params
+	};
+	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
+	const answers = yield* exchange(codex, lines, [initializeId, askedId], configFolder);
+	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
+	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
+	return yield* resultOf(method, answers.value.get(askedId));
+});
 //#endregion
 //#region src/harness/install-codex.ts
 /**
@@ -21229,7 +22042,7 @@ const codexStatusLine = throughLookup([harnessCommandNames.status]).replaceAll(p
 * asks again. Marketplace commands were measured with Codex 0.163.0 on 23 Oct 2026.
 */
 /** Codex names a plugin's hooks by the plugin, then the file, event and place. */
-const pluginHook = (hook) => hook.pluginId === "ref0@ref0" && hook.key.startsWith("ref0@ref0:");
+const pluginHook = (hook, id) => hook.pluginId === id && hook.key.startsWith(`${id}:`);
 /** The plugin's two command hooks, as declared. */
 const ownCommands = [sessionStartHook, sessionEndHook].flatMap((group) => group.hooks.map((hook) => hook.command));
 /**
@@ -21245,7 +22058,7 @@ const ownCommand = (hook) => {
 * Whether a hook is one ref0 wrote: one of its two commands, or ref0's `hook` tool on its own
 * server. Anything else under ref0's name isn't trusted.
 */
-const ownHook = (hook) => hook.handlerType === "command" && ownCommand(hook) || hook.handlerType === "mcpTool" && hook.server === "ref0" && hook.tool === "hook";
+const ownHook = (hook, server) => hook.handlerType === "command" && ownCommand(hook) || hook.handlerType === "mcpTool" && hook.server === server && hook.tool === "hook";
 /** Whether Codex waits for the person to trust a hook before it runs it: new, or changed. */
 const waitingForTrust = (hook) => hook.trustStatus === "untrusted" || hook.trustStatus === "modified";
 /**
@@ -21255,7 +22068,7 @@ const waitingForTrust = (hook) => hook.trustStatus === "untrusted" || hook.trust
 * so "Trust all and continue", like `t` on `/hooks`' list, would trust those too. Its review names
 * each hook's source, which tells ref0's apart from a repo's made to look like them.
 */
-const trustRef0Hooks = (reinstall) => `In a terminal, run: ${reinstall}, and say yes. Or, where a new Codex session says "Hooks need review", choose "Review hooks" and trust each hook whose source is "Plugin - ref0@ref0", not "Trust all and continue", which trusts every hook waiting.`;
+const trustRef0Hooks = (reinstall, id) => `In a terminal, run: ${reinstall}, and say yes. Or, where a new Codex session says "Hooks need review", choose "Review hooks" and trust each hook whose source is "Plugin - ${id}", not "Trust all and continue", which trusts every hook waiting.`;
 /**
 * The "ref0" permission profile, decided 9 Oct (5): Codex's workspace profile, with each
 * workspace root's `.git` writable and the network on, so a Codex agent can commit, push, and
@@ -21277,21 +22090,18 @@ const profileSet = (read) => {
 	const roots = profile?.filesystem?.[":workspace_roots"];
 	return read.config.default_permissions === "ref0" && profile?.extends === ref0Profile.extends && isPathModes(roots) && roots[".git"] === "write" && profile.network?.enabled === true;
 };
-const installCodex = Effect.fnUntraced(function* (options) {
-	const again = installLine(options.configFolder);
-	const failed = (what) => new InstallFailed({ nextStep: `Couldn’t ${what}. Check that Codex is installed, then run: ${again}` });
-	const { folder, run } = yield* marketplaceFor("codex", {
-		...options,
-		command: options.codex
-	}, again);
-	yield* run([
+/** Install into one config folder, from the release Codex fetched and ref0 checked. */
+const installCodex = Effect.fnUntraced(function* (release, options) {
+	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+	const { folder, id, name } = release;
+	yield* (yield* release.into(options.configFolder))([
 		"plugin",
 		"add",
-		"ref0@ref0"
+		id
 	]);
-	const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [options.home] }).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter(pluginHook);
+	const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [options.home] }, options.configFolder).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, id));
 	if (hooks.length === 0) return yield* failed("read the plugin’s hooks from Codex");
-	if (!hooks.every(ownHook)) return yield* new InstallFailed({ nextStep: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ref0@ref0, then run: ${again}` });
+	if (!hooks.every((hook) => ownHook(hook, name))) return yield* new InstallFailed({ says: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ${id}.` });
 	const trust = Effect.fnUntraced(function* (waiting) {
 		if (!(yield* options.approve(waiting))) return false;
 		yield* askCodex(options.codex, codexMethods.configBatchWrite, {
@@ -21303,14 +22113,14 @@ const installCodex = Effect.fnUntraced(function* (options) {
 			filePath: null,
 			expectedVersion: null,
 			reloadUserConfig: false
-		}).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
+		}, options.configFolder).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
 		return true;
 	});
 	const offerProfile = Effect.fnUntraced(function* () {
 		const config = yield* askCodex(options.codex, codexMethods.configRead, {
 			includeLayers: false,
 			cwd: null
-		}).pipe(Effect.option);
+		}, options.configFolder).pipe(Effect.option);
 		if (Option.isSome(config) && (profileSet(config.value) || enough(config.value))) return true;
 		const replacing = Option.match(config, {
 			onNone: () => ({
@@ -21336,7 +22146,7 @@ const installCodex = Effect.fnUntraced(function* (options) {
 			filePath: null,
 			expectedVersion: null,
 			reloadUserConfig: false
-		}).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
+		}, options.configFolder).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
 		return true;
 	});
 	const waiting = hooks.filter(waitingForTrust);
@@ -21345,19 +22155,9 @@ const installCodex = Effect.fnUntraced(function* (options) {
 		trusted: waiting.length === 0 || (yield* trust(waiting)),
 		profile: yield* offerProfile()
 	};
-}, Effect.scoped);
+});
 //#endregion
 //#region src/harness/install.ts
-/**
-* Installing ref0's plugin into a harness for an agent this machine is connected to: what
-* `ref0 connect --harness claude-code` does once its host grant is kept, and what
-* `ref0 install` does again from that grant, so an install that failed never needs a new code.
-* The keychain record supplies the identity to the plugin's hooks and server. Installation
-* writes `~/.ref0/bin/ref0` with the absolute Node and CLI paths, where the plugin
-* looks when neither is on PATH.
-*/
-/** The harnesses a plugin installs into, as a flag names them. */
-const harnessFlag = Flag.Literals("harness", ConnectHarness.literals);
 /** A command on this machine's `PATH`, by absolute path. */
 const onPath = Effect.fnUntraced(function* (name) {
 	const fs = yield* FileSystem.FileSystem;
@@ -21373,101 +22173,145 @@ const onPath = Effect.fnUntraced(function* (name) {
 const runs$2 = (hook) => hook.handlerType === "command" ? printable(hook.command ?? "") : `the ${printable(hook.tool ?? "")} tool on MCP server ${printable(hook.server ?? "")}`;
 /**
 * Shows the person ref0's hooks for Codex, on stderr so a JSON answer stays alone on stdout,
-* and asks whether Codex may run them. Only in a terminal, and never for `--json`: anywhere
-* else the answer is no, and the hooks stay off until the person runs it again or trusts them in
-* Codex itself.
-*/
-const askToTrust = (hooks, asked) => Effect.gen(function* () {
-	const terminal = process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
-	if (!asked || !terminal) return false;
-	yield* Console.error(["Codex runs a plugin's hooks only once you trust them. ref0's are:", ...hooks.map((hook) => `- ${hook.eventName}: ${runs$2(hook)}`)].join("\n"));
-	return yield* Prompt.run(Prompt.Confirm({
-		message: "Trust them, so Codex runs them?",
-		initial: false
-	}));
-}).pipe(Effect.orElseSucceed(() => false));
+* and asks whether Codex may run them. On a no, or with no terminal to ask in, the hooks stay
+* off until the person runs it again or trusts them in Codex itself.
+*/
+const askToTrust = (hooks, shown, yesOrNo) => yesOrNo([`Codex runs a plugin's hooks only once you trust them. ref0's, for ${printable(shown)}, are:`, ...hooks.map((hook) => `- ${hook.eventName}: ${runs$2(hook)}`)], "Trust them, so Codex runs them?");
 /**
 * Shows the person ref0's sandbox profile for Codex, on stderr, and asks whether it may be
-* Codex's default: only in a terminal, and never for `--json`, as with the hooks. A change to
-* their Codex's security, so it's shown in full and asked the first time (decided 9 Oct, 5).
-*/
-const askForProfile = (replacing, asked) => Effect.gen(function* () {
-	const terminal = process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
-	if (!asked || !terminal) return false;
-	yield* Console.error([
-		"Codex's sandbox keeps commands from writing .git or reaching the network, so a Codex agent can't commit or push to ref0.",
-		"ref0's profile, \"ref0\", is Codex's workspace profile with two changes:",
-		"- each workspace root's .git is writable, so an agent can commit",
-		"- the network is on, so an agent can push; any command can then reach the internet, services and sockets on this machine, and your login Keychain",
-		"In a linked worktree (git worktree add), Codex still needs full access there.",
-		...replacing.default === void 0 ? [] : [`It replaces your default now, ${printable(replacing.default)}.`],
-		...replacing.ownRef0 ? ["It replaces the profile you have named \"ref0\", and every rule in it."] : []
-	].join("\n"));
-	return yield* Prompt.run(Prompt.Confirm({
-		message: "Make \"ref0\" your Codex's default profile?",
-		initial: false
-	}));
-}).pipe(Effect.orElseSucceed(() => false));
+* Codex's default. A change to their Codex's security, so it's shown in full and asked the first
+* time (decided 9 Oct, 5).
+*/
+const askForProfile = (replacing, shown, yesOrNo) => yesOrNo([
+	"Codex's sandbox keeps commands from writing .git or reaching the network, so a Codex agent can't commit or push to ref0.",
+	"ref0's profile, \"ref0\", is Codex's workspace profile with two changes:",
+	"- each workspace root's .git is writable, so an agent can commit",
+	"- the network is on, so an agent can push; any command can then reach the internet, services and sockets on this machine, and your login Keychain",
+	"In a linked worktree (git worktree add), Codex still needs full access there.",
+	...replacing.default === void 0 ? [] : [`It replaces your default now, ${printable(replacing.default)}.`],
+	...replacing.ownRef0 ? ["It replaces the profile you have named \"ref0\", and every rule in it."] : []
+], `Make "ref0" the default profile for ${printable(shown)}?`);
+/** What a Codex folder without ref0's profile, or full access, can't do. */
+const sandboxWords = "Codex’s sandbox is as it was, so its agents commit and push to ref0 only where it has full access; to change that, run it again in a terminal.";
 /**
 * Writes the plugin's fallback launcher with absolute Node and CLI paths, so it runs even
 * when neither is on the harness's PATH. Another connect replaces the launcher atomically.
 */
-const writeRef0Launcher = Effect.fnUntraced(function* (home) {
+const writeRef0Launcher = Effect.fnUntraced(function* (home, git) {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const ref0 = process.argv[1];
 	if (ref0 === void 0) return;
 	const target = yield* fs.realPath(ref0);
-	const folder = path.join(home, ".ref0", "bin");
+	const config = yield* Ref0Config;
+	const folder = path.join(home, ".ref0", "origins", originKey(config.api), "bin");
 	const link = path.join(folder, "ref0");
 	const next = `${link}.next`;
 	yield* fs.makeDirectory(folder, { recursive: true });
 	yield* fs.remove(next, { force: true });
 	const node = yield* fs.realPath(process.execPath);
-	yield* fs.writeFileString(next, `#!/bin/sh\nexec ${shellWord(node)} ${shellWord(target)} "$@"\n`);
+	const gitPath = yield* fs.realPath(git);
+	yield* fs.writeFileString(next, [
+		"#!/bin/sh",
+		"if [ \"$REF0_SELECT_ORIGIN\" = 1 ]; then",
+		`  checkout=$(${shellWord(gitPath)} config --get ref0.api 2>/dev/null)`,
+		"  result=$?",
+		"  case \"$result\" in",
+		"    0) REF0_SELECTED_API=$checkout ;;",
+		`    1) REF0_SELECTED_API=\${REF0_API:-${defaultOrigin}} ;;`,
+		`    *) printf '%s\\n' ${shellWord("ref0: could not read the checkout origin with Git. Restore Git, then run ref0 install again.")} >&2; exit 1 ;;`,
+		"  esac",
+		"  export REF0_SELECTED_API",
+		`  ${shellWord(node)} -e ${shellWord("try { process.exit(new URL(process.env.REF0_SELECTED_API).origin === process.argv[1] ? 0 : 1) } catch { process.exit(1) }")} ${shellWord(config.api)} || exit 0`,
+		"fi",
+		"unset REF0_SELECT_ORIGIN REF0_SELECTED_API",
+		`export REF0_API=${shellWord(config.api)}`,
+		`exec ${shellWord(node)} ${shellWord(target)} "$@"`,
+		""
+	].join("\n"));
 	yield* fs.chmod(next, 493);
 	yield* fs.rename(next, link);
 });
-/** Installs into a connected folder. The plugin reads its identity from the keychain. */
-const installFor = Effect.fnUntraced(function* (_agent, harness, options) {
+/**
+* Installs into each connected folder: the launcher once, and the plugin fetched and checked once
+* for each harness, then added to each of that harness's folders. A folder whose install fails
+* leaves the rest installing, and answers its failure in its own place. The plugin reads each
+* folder's identity from the keychain.
+*/
+const installInto = Effect.fnUntraced(function* (folders, options) {
 	const home = yield* Config.String("HOME");
-	const agents = yield* ConfigFolders;
-	const configFolder = options.configFolder ?? (yield* agents.folder(harness));
-	const again = installLine(configFolder);
-	yield* writeRef0Launcher(home).pipe(Effect.mapError(() => new InstallFailed({ nextStep: `Couldn’t write ~/.ref0. Check that it’s writable, then run: ${again}` })));
-	if (harness === "claude-code") {
-		const claude = yield* onPath("claude");
-		if (Option.isNone(claude)) return yield* new InstallFailed({ nextStep: `Claude Code isn’t on this machine’s PATH. Install it, then run: ${again}` });
-		const folder = yield* installClaudeCode({
-			claude: claude.value,
-			home,
-			configFolder
-		});
-		return {
-			folder,
-			trusted: true,
-			words: `Installed in Claude Code, from ${folder}.`
-		};
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	const yesOrNo = options.asJson ? () => Effect.succeed(false) : yield* yesOrNoQuestions;
+	const answers = /* @__PURE__ */ new Map();
+	const failAll = (into, failed) => {
+		for (const folder of into) answers.set(folder, Result.fail(failed));
+	};
+	const launcher = yield* Effect.cached(Effect.gen(function* () {
+		const git = yield* onPath("git");
+		if (Option.isNone(git)) return yield* new InstallFailed({ says: "Git isn’t on this machine’s PATH. Install it." });
+		yield* writeRef0Launcher(home, git.value).pipe(Effect.mapError(() => new InstallFailed({ says: "Couldn’t write ~/.ref0. Check that it’s writable." })));
+	}));
+	for (const harness of ConnectHarness.literals) {
+		const into = folders.filter((folder) => folder.harness === harness);
+		if (into.length === 0) continue;
+		const command = yield* onPath(harness === "codex" ? "codex" : "claude");
+		if (Option.isNone(command)) {
+			failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
+			continue;
+		}
+		yield* Effect.scoped(Effect.gen(function* () {
+			yield* launcher;
+			const release = yield* marketplaceFor(harness, {
+				command: command.value,
+				home,
+				configFolder: into[0]?.configFolder ?? home
+			});
+			for (const folder of into) {
+				const installed = yield* (harness === "claude-code" ? installedInClaudeCode(release, folder.configFolder) : installedInCodex(release, {
+					codex: command.value,
+					home,
+					configFolder: folder.configFolder,
+					name,
+					yesOrNo
+				})).pipe(Effect.result);
+				answers.set(folder, installed);
+			}
+		}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)))));
 	}
-	const codex = yield* onPath("codex");
-	if (Option.isNone(codex)) return yield* new InstallFailed({ nextStep: `Codex isn’t on this machine’s PATH. Install it, then run: ${again}` });
-	const terminal = yield* Effect.context();
-	const done = yield* installCodex({
-		codex: codex.value,
-		home,
-		configFolder,
-		approve: (hooks) => askToTrust(hooks, !options.asJson).pipe(Effect.provide(terminal)),
-		approveProfile: (replacing) => askForProfile(replacing, !options.asJson).pipe(Effect.provide(terminal))
+	return folders.map((folder) => ({
+		...folder,
+		installed: answers.get(folder) ?? Result.fail(new InstallFailed({ says: "ref0 didn’t install into this folder." }))
+	}));
+});
+const installedInClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
+	const folder = yield* installClaudeCode(release, configFolder);
+	return {
+		folder,
+		trusted: true,
+		profile: true,
+		words: `Installed in Claude Code, from ${folder}.`
+	};
+});
+const installedInCodex = Effect.fnUntraced(function* (release, options) {
+	const shown = shownConfigFolder(options.home, options.configFolder);
+	const done = yield* installCodex(release, {
+		codex: options.codex,
+		home: options.home,
+		configFolder: options.configFolder,
+		approve: (hooks) => askToTrust(hooks, shown, options.yesOrNo),
+		approveProfile: (replacing) => askForProfile(replacing, shown, options.yesOrNo)
 	});
-	const sandbox = done.profile ? "" : " Codex’s sandbox is as it was, so its agents commit and push to ref0 only where it has full access; to change that, run it again in a terminal.";
-	const trust = trustRef0Hooks(again);
+	const sandbox = done.profile ? "" : ` ${sandboxWords}`;
+	const trust = trustRef0Hooks(installLine(options.configFolder), `${options.name}@${options.name}`);
 	return done.trusted ? {
 		folder: done.folder,
 		trusted: true,
+		profile: done.profile,
 		words: `Installed in Codex, from ${done.folder}.${sandbox}`
 	} : {
 		folder: done.folder,
 		trusted: false,
+		profile: done.profile,
 		words: `Installed in Codex, from ${done.folder}, with ref0’s hooks off until you trust them. ${trust}${sandbox}`,
 		nextStep: trust
 	};
@@ -21477,13 +22321,15 @@ const installCommands = [Command.make("install", { folder: Argument.String("fold
 	const folder = Option.isSome(given) ? yield* folders.resolve(given.value) : yield* currentConfigFolder;
 	const grant = yield* (yield* HostGrant).get(folder);
 	if (Option.isNone(grant)) return yield* sayFailed(`This config folder, ${folder}, isn’t connected. Run ref0 connect.`);
-	const installed = yield* installFor(grant.value, grant.value.harness, {
-		asJson: false,
+	const answers = yield* installInto([{
+		harness: grant.value.harness,
 		configFolder: folder
-	});
-	yield* printAnswer({ installed: installed.folder }, false, installed.words);
+	}], { asJson: false });
+	for (const { installed } of answers) {
+		if (Result.isFailure(installed)) return yield* sayFailed([[`${installed.failure.says} Then run:`, { command: repairOf(installed.failure, folder) }]]);
+		yield* printAnswer({ installed: installed.success.folder }, false, installed.success.words);
+	}
 }).pipe(Effect.catchTags({
-	InstallFailed: (failed) => sayFailed(failed.nextStep),
 	KeychainError: (failed) => sayFailed(failed.nextStep),
 	ConfigError: () => sayFailed("HOME isn’t set, so ref0 has nowhere to keep the plugin.")
 }))).pipe(Command.withDescription("Installs ref0’s plugin into a connected config folder"), Command.withShortDescription("Install ref0’s plugin into a config folder"))];
@@ -21499,42 +22345,162 @@ var Tty = class Tty extends Context.Service()("ref0/cli/Tty") {
 //#endregion
 //#region src/commands/connect.ts
 /**
-* A person connects from their own terminal, opens the printed link, and pastes their page's
-* answer code. An agent's session and a process without a terminal cannot start it.
-*/
-const harness = harnessFlag.pipe(Flag.optional, Flag.withDescription("Then install ref0’s plugin into this harness, for the agent"));
+* A person connects from their own terminal: ref0 finds every Claude Code and Codex config
+* folder in their home, and they keep the ones to connect. One request asks for all of them;
+* they open its link, approve on their page, and its answer code reaches the terminal. Then
+* each folder's grant is kept and confirmed, and ref0's plugin installed into it. An agent's
+* session and a process without a terminal cannot start it, and only one runs at a time.
+*/
+/** One request connects at most this many config folders. */
+const mostFolders = 8;
+const isConfigFolderPath = Schema.is(ConfigFolderPath);
+/** The line that asks again. */
+const again = "ref0 connect";
+/** Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. */
+const choose = Effect.fnUntraced(function* (found, home) {
+	const choices = found.map((folder) => {
+		const shown = shownConfigFolder(home, folder.configFolder);
+		const sendable = isConfigFolderPath(shown);
+		const choice = {
+			title: `${printable(shown)}  ${configFolders[folder.harness].name}`,
+			value: folder,
+			selected: sendable,
+			disabled: !sendable
+		};
+		return sendable ? choice : {
+			...choice,
+			description: "Its path is too long, or holds characters ref0 can’t show."
+		};
+	});
+	const ticked = choices.filter((choice) => choice.selected).length;
+	return yield* Prompt.run(Prompt.MultiSelect({
+		message: ticked > mostFolders ? `Connect which config folders? One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. Space ticks or unticks one; Enter connects those ticked.` : "Connect which config folders? Space ticks or unticks one; Enter connects those ticked.",
+		choices,
+		max: mostFolders
+	}));
+});
+/** Each other owner whose agents connected folders this run didn't touch act as. */
+const otherOwners = Effect.fnUntraced(function* (connected) {
+	const folders = yield* ConfigFolders;
+	const grants = yield* HostGrant;
+	const touched = new Set([
+		...connected.kept,
+		...connected.notKept,
+		...connected.excluded
+	].map((folder) => folder.configFolder));
+	const others = /* @__PURE__ */ new Map();
+	for (const folder of yield* folders.all) {
+		if (touched.has(folder)) continue;
+		const grant = yield* grants.get(folder).pipe(Effect.orElseSucceed(Option.none));
+		if (Option.isNone(grant) || grant.value.owner === connected.owner) continue;
+		others.set(grant.value.owner, [...others.get(grant.value.owner) ?? [], folder]);
+	}
+	return [...others].map(([owner, configFolders]) => ({
+		owner,
+		configFolders
+	}));
+});
+/** The organizations an agent is in this state in, by name, once each. */
+const organizationsIn = (kept, state) => {
+	const byAgent = /* @__PURE__ */ new Map();
+	for (const folder of kept) for (const place of folder.organizations) {
+		if (place.state !== state) continue;
+		byAgent.set(folder.handle, (byAgent.get(folder.handle) ?? /* @__PURE__ */ new Set()).add(place.name));
+	}
+	return [...byAgent].map(([handle, names]) => ({
+		handle,
+		names: [...names].join(", ")
+	}));
+};
+/** What the terminal shows once each grant is kept and confirmed, and each install tried. */
+const reportOf = (connected, installed, others, home) => {
+	const shown = (folder) => shownConfigFolder(home, folder.configFolder);
+	const connectedBlock = [
+		{ label: `Connected as ${connected.owner}’s agents` },
+		...installed.map((folder) => `${shown(folder)}  ${folder.owner === connected.owner ? folder.handle : `${folder.owner}/${folder.handle}`}`),
+		...connected.excluded.map((folder) => `${shown(folder)}  taken out on the page, not connected`),
+		...others.map((other) => {
+			const one = other.configFolders.length === 1;
+			return `${other.configFolders.map((folder) => shownConfigFolder(home, folder)).join(", ")} ${one ? "is" : "are"} still connected as ${other.owner}’s ${one ? "agent" : "agents"}.`;
+		})
+	];
+	const organizationsBlock = [...organizationsIn(connected.kept, "pending").map(({ handle, names }) => `ref0 is still authorizing ${handle} in ${names}: it works there once that’s done.`), ...organizationsIn(connected.kept, "refused").map(({ handle, names }) => `${handle} doesn’t work in ${names}, which refused to authorize it.`)];
+	const failedBlocks = [...connected.notKept.map((folder) => [`${shown(folder)} isn’t connected: ${folder.nextStep} To connect it, run:`, { command: again }]), ...installed.flatMap((folder) => {
+		if (Result.isFailure(folder.installed)) return [[`${shown(folder)} is connected, but ref0’s plugin isn’t installed: ${folder.installed.failure.says} Then run:`, { command: repairOf(folder.installed.failure, folder.configFolder) }]];
+		const done = folder.installed.success;
+		const notes = [...done.nextStep === void 0 ? [] : [done.nextStep], ...done.profile ? [] : [sandboxWords]];
+		return notes.length === 0 ? [] : [[`${shown(folder)}: ${notes.join(" ")}`]];
+	})];
+	const anyInstalled = installed.some((folder) => Result.isSuccess(folder.installed));
+	return [
+		connectedBlock,
+		...organizationsBlock.length === 0 ? [] : [organizationsBlock],
+		...failedBlocks,
+		...anyInstalled ? [["Start a new session in each."]] : []
+	];
+};
+/** The same, for `--json`: each folder asked for, and how it ended. */
+const answerOf = (connected, installed, others) => ({
+	owner: connected.owner,
+	folders: [
+		...installed.map(({ configFolder, harness, owner, handle, organizations, installed: done }) => Result.isSuccess(done) ? {
+			configFolder,
+			harness,
+			state: "installed",
+			owner,
+			agent: handle,
+			organizations,
+			plugin: done.success.folder,
+			trusted: done.success.trusted,
+			nextStep: done.success.nextStep ?? null
+		} : {
+			configFolder,
+			harness,
+			state: "notInstalled",
+			owner,
+			agent: handle,
+			organizations,
+			says: done.failure.says,
+			nextStep: repairOf(done.failure, configFolder)
+		}),
+		...connected.notKept.map(({ configFolder, harness, nextStep }) => ({
+			configFolder,
+			harness,
+			state: "notKept",
+			says: nextStep,
+			nextStep: again
+		})),
+		...connected.excluded.map(({ configFolder, harness }) => ({
+			configFolder,
+			harness,
+			state: "excluded"
+		}))
+	],
+	others
+});
 /** Connecting this machine. */
-const connectCommands = [Command.make("connect", {
-	json,
-	harness
-}, ({ json: asJson, harness: into }) => Effect.gen(function* () {
+const connectCommands = [Command.make("connect", { json }, ({ json: asJson }) => Effect.gen(function* () {
 	const session = yield* SessionToken;
 	const tty = yield* Tty;
 	if (Option.isSome(yield* session.current)) return yield* sayFailed("ref0 connect runs only in a person’s own terminal, never in an agent’s session: it shows a code, and a yes to that code connects this machine to an agent. If this machine needs connecting, tell your person to run ref0 connect in their own terminal. Never ask them to approve a code for you.");
 	if (!tty.attached) return yield* sayFailed("ref0 connect runs only in a terminal you type into, and this isn’t one. Run it yourself, in your own terminal: not through a script, a pipe or an agent.");
+	yield* (yield* ConnectLock).hold;
 	yield* (yield* Keychain).probe;
-	const connected = yield* requestAttachment(into);
-	const words = connectedWords(connected);
-	if (Option.isNone(into)) return yield* printAnswer(connected, asJson, words);
-	const installed = yield* installFor({
-		owner: connected.owner,
-		agent: connected.handle
-	}, into.value, { asJson }).pipe(Effect.catchTags({
-		InstallFailed: (failed) => sayFailed(`${words} Only the install failed. ${failed.nextStep}`),
-		ConfigError: () => sayFailed(`${words} Only the install failed: HOME isn’t set, so ref0 has nowhere to keep the plugin.`)
-	}));
-	const answer = installed.nextStep === void 0 ? {
-		...connected,
-		installed: installed.folder,
-		trusted: installed.trusted
-	} : {
-		...connected,
-		installed: installed.folder,
-		trusted: installed.trusted,
-		nextStep: installed.nextStep
-	};
-	yield* printAnswer(answer, asJson, `${words} ${installed.words}`);
-}).pipe(Effect.catchTag("KeychainError", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Connect this machine to one of your agents, in your terminal"))];
+	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
+	const found = yield* findConfigFolders;
+	if (found.length === 0) return yield* sayFailed(`ref0 found no Claude Code or Codex config folder in your home. Start Claude Code or Codex once, then run ${again} again.`);
+	const chosen = yield* choose(found, home).pipe(Effect.catchTag("QuitError", () => sayFailed("Stopped, and nothing was asked.")));
+	if (chosen.length === 0) return yield* sayFailed(`No config folder was ticked, so nothing was asked. To connect one, run ${again} again.`);
+	const connected = yield* requestAttachment(chosen);
+	const installed = yield* installInto(connected.kept, { asJson });
+	const others = yield* otherOwners(connected);
+	yield* printAnswer(answerOf(connected, installed, others), asJson, reportOf(connected, installed, others, home));
+	if (connected.notKept.length > 0 || installed.some((folder) => Result.isFailure(folder.installed))) return yield* new Said();
+}).pipe(Effect.scoped, Effect.catchTags({
+	KeychainError: (failed) => sayFailed(failed.nextStep),
+	ConnectBusy: (failed) => sayFailed(failed.nextStep),
+	ConfigError: () => sayFailed("HOME isn’t set, so ref0 has nowhere to keep the plugin. Set it, then run ref0 install.")
+}))).pipe(Command.withDescription("Connect this machine’s config folders to your agents, in your terminal"))];
 //#endregion
 //#region src/connection-lines.ts
 /**
@@ -22067,13 +23033,6 @@ const traceLines = (page, nextCommand) => {
 	].join("\n");
 };
 //#endregion
-//#region src/sha256.ts
-/** Bytes as lowercase hex. */
-const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-const encoder = new TextEncoder();
-/** The SHA-256 of a text's UTF-8 bytes, as lowercase hex. */
-const sha256 = (text) => Effect.flatMap(Crypto.Crypto, (crypto) => Effect.map(Effect.orDie(crypto.digest("SHA-256", encoder.encode(text))), hex));
-//#endregion
 //#region src/local/sandboxes.ts
 /**
 * A local run's sandboxes: the check's own, by name, opened on this machine, in the checkout.
@@ -22248,7 +23207,7 @@ const execIn = Effect.fnUntraced(function* (root, held, command, options = {}, l
 });
 /** Why a port can't be served on here, if it can't: something on this machine holds it. */
 const portHeld = (port) => Effect.callback((resume) => {
-	const probe = createServer();
+	const probe = createServer$1();
 	probe.once("error", (error) => resume(Effect.succeedSome(error.code === "EADDRINUSE" ? `Port ${port} is in use on this machine: serve on another` : `Port ${port} can't be served on here: ${error.message}`)));
 	probe.listen(port, "127.0.0.1", () => probe.close(() => resume(Effect.succeedNone)));
 });
@@ -23272,6 +24231,11 @@ const askedWords = (from) => {
 	if (from === "accountable") return "the person behind the run";
 	return "person" in from ? from.person : `anyone who holds ${from.permission}`;
 };
+/**
+* A request refused since it asks someone else and nobody is left but the person behind the run,
+* in words.
+*/
+const selfWords = (from) => from !== "accountable" && "permission" in from ? `nobody who holds ${from.permission} but the person behind the run, who can’t vouch for it` : `${askedWords(from)} is the person behind the run, who can’t vouch for it`;
 /** One yes a part needs, in words, as it stands over the run named. */
 const yesWords = (yes) => {
 	switch (yes.state) {
@@ -23279,7 +24243,7 @@ const yesWords = (yes) => {
 		case "asked": return `asked ${askedWords(yes.from)}${yes.asked === void 0 ? "" : `, ${yes.asked}`}`;
 		case "no": return `no from ${yes.by ?? askedWords(yes.from)}`;
 		case "expired": return `${askedWords(yes.from)} didn’t answer in a day`;
-		case "refused": return `${askedWords(yes.from)} can’t be asked`;
+		case "refused": return yes.why === "self" ? selfWords(yes.from) : `${askedWords(yes.from)} can’t be asked`;
 		case "revoked": return `yes from ${yes.by ?? askedWords(yes.from)}, revoked since`;
 	}
 };
@@ -23394,7 +24358,7 @@ const gateCommands = [Command.make("gate", {
 /** The remote a clone pushes to: its thread's fork path, named as the thread is. */
 const forkRemote = (fork) => `thread-${threadParts(fork.thread).number}`;
 /** Git's credential helper for ref0, as Git runs it: this `ref0`, quoted for the shell. */
-const helperCommand = (ref0) => `!${shellWord(ref0)} git-credential`;
+const helperCommand = (ref0, api) => `!REF0_API=${shellWord(api)} ${shellWord(ref0)} git-credential`;
 /**
 * The config Git takes while it clones, and keeps in the clone: for ref0's origin, the helpers
 * Git already has cleared, as macOS's keychain helper would keep one session's token for the
@@ -23402,7 +24366,7 @@ const helperCommand = (ref0) => `!${shellWord(ref0)} git-credential`;
 */
 const credentialConfig = (api, ref0) => [
 	[`credential.${api}.helper`, ""],
-	[`credential.${api}.helper`, helperCommand(ref0)],
+	[`credential.${api}.helper`, helperCommand(ref0, api)],
 	[`credential.${api}.useHttpPath`, "true"]
 ];
 /**
@@ -23413,6 +24377,7 @@ const forkConfig = (api, fork, repo) => [
 	[`remote.${forkRemote(fork)}.url`, forkUrlOf(api, fork.path)],
 	[`remote.${forkRemote(fork)}.fetch`, `+refs/heads/*:refs/remotes/${forkRemote(fork)}/*`],
 	["remote.pushDefault", forkRemote(fork)],
+	["ref0.api", api],
 	["ref0.repo", repo],
 	["ref0.thread", fork.thread]
 ];
@@ -24550,7 +25515,7 @@ const pathOf$1 = (written) => agentParts(written) ?? {
 	agent: ""
 };
 /** An agent, as a person reads it in a list: `acme/triage  on`. */
-const lineOf$3 = (named, view) => `${named}/${view.handle}  ${view.turnedOff ? "off" : "on"}`;
+const lineOf$2 = (named, view) => `${named}/${view.handle}  ${view.turnedOff ? "off" : "on"}`;
 const agents = Command.make("agents", {
 	owner: owner$1,
 	cursor: cursor$1,
@@ -24564,7 +25529,7 @@ const agents = Command.make("agents", {
 			onSome: (after) => ({ after })
 		})
 	});
-	const lines = answer.value.agents.map((each) => lineOf$3(named, each));
+	const lines = answer.value.agents.map((each) => lineOf$2(named, each));
 	const next = answer.value.nextAfter;
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `${named} has no agents.` : [...lines, ...next === void 0 ? [] : [`More: --cursor ${next}`]].join("\n"));
 }).pipe(Effect.catchTag("CallFailed", failedWith$7))).pipe(Command.withDescription("An owner’s agents: yours, or an organization’s you’re in"), Command.withShortDescription("List an owner’s agents"));
@@ -24661,7 +25626,7 @@ const agentCommands = [agents, Command.make("agent", {
 		params
 	});
 	const added = DateTime.formatIso(answer.value.addedAt);
-	yield* printAnswer(answer.json, asJson, `${lineOf$3(params.owner, answer.value)}  generation ${answer.value.generation}  added ${added}`);
+	yield* printAnswer(answer.json, asJson, `${lineOf$2(params.owner, answer.value)}  generation ${answer.value.generation}  added ${added}`);
 }).pipe(Effect.catchTag("CallFailed", failedWith$7))).pipe(Command.withDescription("Read one agent; add one, turn one off or on, or authorize an attachment of your own"), Command.withShortDescription("Read and manage an agent"), Command.withSubcommands([
 	add$1,
 	disable$1,
@@ -24687,7 +25652,7 @@ const pathOf = (written) => agentParts(written) ?? {
 	agent: ""
 };
 /** An attachment, as a person reads it in a list: `pip  token_…  machine_…  attached …`. */
-const lineOf$2 = (view) => [
+const lineOf$1 = (view) => [
 	view.person,
 	view.credential.id,
 	view.machine ?? "an app",
@@ -24707,7 +25672,7 @@ const attachmentCommands = [Command.make("attachments", {
 			onSome: (after) => ({ after })
 		})
 	});
-	const lines = answer.value.attachments.map(lineOf$2);
+	const lines = answer.value.attachments.map(lineOf$1);
 	const next = answer.value.nextAfter;
 	yield* printAnswer(answer.json, asJson, lines.length === 0 ? `Nothing of yours is attached to ${written}.` : [...lines, ...next === void 0 ? [] : [`More: --cursor ${next}`]].join("\n"));
 }).pipe(Effect.catchTag("CallFailed", failedWith$6))).pipe(Command.withDescription("An agent’s machines and apps: all to an admin, yours to you"), Command.withShortDescription("List an agent’s machines and apps")), Command.make("disconnect", {
@@ -25745,7 +26710,7 @@ const failedWith$2 = (failed) => sayFailed(failed.nextStep);
 * A thread in a line: its number, its title, where it stands, what started it if a workflow
 * did, and how long it has waited if nobody has picked it up.
 */
-const lineOf$1 = (view, now) => {
+const lineOf = (view, now) => {
 	const byWorkflow = view.origin?.workflow === void 0 ? "" : `  by workflow ${view.origin.workflow.workflow}`;
 	const waiting = nobodyOnWords(view, now);
 	return `#${view.number}  ${view.title ?? "(untitled)"}  ${view.stage}${byWorkflow}${waiting === void 0 ? "" : `  ${waiting}`}`;
@@ -25802,7 +26767,7 @@ const projectList = (address, from, waiting, asJson) => Effect.gen(function* ()
 	const page = answer.value;
 	const now = yield* Clock.currentTimeMillis;
 	const none = waiting ? "No child is waiting for someone: every open one a plan or a workflow started over an hour ago has had a session." : "No threads yet.";
-	const lines = page.threads.length === 0 ? [none] : page.threads.map((view) => lineOf$1(view, now));
+	const lines = page.threads.length === 0 ? [none] : page.threads.map((view) => lineOf(view, now));
 	const more = page.nextAfter === void 0 ? [] : [`More: ref0 threads ${address}${waiting ? " --nobody-on" : ""} --after ${page.nextAfter}`];
 	yield* printAnswer(answer.json, asJson, [...lines, ...more].join("\n"));
 });
@@ -25870,7 +26835,7 @@ const readThread = ({ thread: address, json: asJson }) => Effect.gen(function* (
 	const view = answer.value;
 	const now = yield* Clock.currentTimeMillis;
 	yield* printAnswer(answer.json, asJson, [
-		lineOf$1(view, now),
+		lineOf(view, now),
 		...workflowsLines(view, DateTime.makeUnsafe(now)),
 		...view.origin === void 0 ? [] : [originLine(view.origin)],
 		`Why: ${whyOf(view, address)}`,
@@ -27557,7 +28522,8 @@ var Attribution = class Attribution extends Context.Service()("ref0/cli/Attribut
 		const crypto = yield* Crypto.Crypto;
 		const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 		const stateHome = yield* Config.String("XDG_STATE_HOME").pipe(Config.withDefault(path.join(home, ".local", "state")));
-		const directory = path.join(stateHome, "ref0", "attribution");
+		const config = yield* Ref0Config;
+		const directory = path.join(stateHome, "ref0", "origins", originKey(config.api), "attribution");
 		const held = yield* Ref.make(/* @__PURE__ */ new Map());
 		const checking = yield* Semaphore.make(1);
 		const keeping = yield* Semaphore.make(1);
@@ -28967,7 +29933,8 @@ var HarnessTasks = class HarnessTasks extends Context.Service()("ref0/cli/Harnes
 		const path = yield* Path.Path;
 		const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 		const stateHome = yield* Config.String("XDG_STATE_HOME").pipe(Config.withDefault(path.join(home, ".local", "state")));
-		const directory = path.join(stateHome, "ref0", "tasks");
+		const config = yield* Ref0Config;
+		const directory = path.join(stateHome, "ref0", "origins", originKey(config.api), "tasks");
 		const held = yield* Ref.make(/* @__PURE__ */ new Map());
 		const keeping = yield* Semaphore.make(1);
 		const fileOf = (session, generation) => path.join(directory, `${session}.${generation}.json`);
@@ -29474,7 +30441,8 @@ var Transcripts = class Transcripts extends Context.Service()("ref0/cli/Transcri
 		const crypto = yield* Crypto.Crypto;
 		const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 		const stateHome = yield* Config.String("XDG_STATE_HOME").pipe(Config.withDefault(path.join(home, ".local", "state")));
-		const directory = path.join(stateHome, "ref0", "transcripts");
+		const config = yield* Ref0Config;
+		const directory = path.join(stateHome, "ref0", "origins", originKey(config.api), "transcripts");
 		const held = yield* Ref.make(/* @__PURE__ */ new Map());
 		const fileOf = (session, generation) => path.join(directory, `${session}.${generation}.json`);
 		const keptGenerations = (session) => Effect.map(fs.readDirectory(directory).pipe(Effect.orElseSucceed(() => [])), (names) => names.flatMap((name) => {
@@ -29805,9 +30773,9 @@ var Waker = class Waker extends Context.Service()("ref0/cli/Waker") {
 //#endregion
 //#region src/harness/hook-answer.ts
 /** How Claude Code names a tool of the plugin's server. */
-const claudeCodeToolName = (tool) => `mcp__plugin_ref0_ref0__${tool}`;
+const claudeCodeToolName = (tool, server) => `mcp__plugin_${server}_${server}__${tool}`;
 /** How Codex names a tool of the plugin's server, once its tool search found it. */
-const codexToolName = (tool) => `mcp__ref0__${tool}`;
+const codexToolName = (tool, server) => `mcp__${server}__${tool}`;
 /** The tool the harness calls for its hooks. The agent sees it too, but may never call it. */
 const hookTool = "hook";
 const preToolUse = (permissionDecision, permissionDecisionReason) => ({ hookSpecificOutput: {
@@ -29823,11 +30791,11 @@ const preToolUse = (permissionDecision, permissionDecisionReason) => ({ hookSpec
 * serves the agent, named in `agentTools`, are allowed, since a plugin can't add permission
 * rules. Codex approves them through its config instead; its hooks' `allow` grants nothing.
 */
-function answerHook(hook, agentTools) {
+function answerHook(hook, agentTools, server) {
 	if (hook.event !== "PreToolUse" || hook.tool === void 0) return {};
 	const name = hook.tool.name;
-	if (name === claudeCodeToolName("hook") || name === codexToolName("hook")) return preToolUse("deny", "ref0's hook tool is the harness's, not the agent's");
-	for (const tool of agentTools) if (name === claudeCodeToolName(tool)) return preToolUse("allow", "ref0's own tool");
+	if (name === claudeCodeToolName("hook", server) || name === codexToolName("hook", server)) return preToolUse("deny", "ref0's hook tool is the harness's, not the agent's");
+	for (const tool of agentTools) if (name === claudeCodeToolName(tool, server)) return preToolUse("allow", "ref0's own tool");
 	return {};
 }
 /**
@@ -30840,6 +31808,7 @@ const agentTools = /* @__PURE__ */ new Set();
 const decodeArguments = Schema.decodeUnknownEffect(HookArguments);
 const hookHandlers = (plugin) => HarnessTools.toLayer(Effect.gen(function* () {
 	const session = yield* HarnessSession;
+	const server = yield* originPluginName((yield* Ref0Config).api);
 	return { hook: (call) => Effect.gen(function* () {
 		const update = updateLine({
 			protocol: call.protocol,
@@ -30848,7 +31817,7 @@ const hookHandlers = (plugin) => HarnessTools.toLayer(Effect.gen(function* () {
 		if (Option.isSome(update)) return yield* new HookRefused({ message: update.value });
 		const hook = readHook(yield* decodeArguments(call).pipe(Effect.orDie));
 		const delivered = yield* session.deliver(hook);
-		return withContext(answerHook(hook, agentTools), hook.event, delivered);
+		return withContext(answerHook(hook, agentTools, server), hook.event, delivered);
 	}) };
 }));
 /** Every MCP version Effect speaks; the harness picks. */
@@ -30897,9 +31866,9 @@ const codexSetupHere = Effect.fnUntraced(function* (process) {
 const mcp = Command.make(harnessCommandNames.mcp, {}, () => Effect.gen(function* () {
 	const agents = yield* ConfigFolders;
 	const found = yield* (yield* HarnessProcess).innermost;
-	const agent = Option.isSome(found) ? yield* (yield* HostGrant).get(yield* agents.folder(found.value.harness)) : Option.none();
+	const agent = Option.isSome(found) ? yield* (yield* HostGrant).get(yield* agents.folder(found.value.harness)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone)) : Option.none();
 	const codex = Option.isSome(found) && found.value.harness === "codex" ? yield* codexSetupHere(found.value.process) : Option.none();
-	const reinstall = Option.isSome(found) ? installLine(yield* agents.folder(found.value.harness), Option.isSome(agent), found.value.harness) : "ref0 connect";
+	const reinstall = Option.isSome(found) && Option.isSome(agent) ? installLine(yield* agents.folder(found.value.harness)) : "ref0 connect";
 	return yield* Layer.launch(mcpServer(cliVersion, {
 		plugin: {
 			version: yield* pluginVersion,
@@ -30993,6 +31962,245 @@ const endHarnessSession = Effect.gen(function* () {
 }).pipe(Effect.ignore);
 const sessionEnd = Command.make(harnessCommandNames.sessionEnd, { protocol: protocolFlag }, (flags) => flags.protocol === "1" ? endHarnessSession : Effect.void).pipe(Command.withDescription("Ends the ref0 session of a harness session that's closing"), Command.withShortDescription("End the harness’s ref0 session"));
 //#endregion
+//#region src/harness/git-hooks.ts
+/**
+* ref0's Git hooks: folders of forwarders in `~/.ref0/origins/<origin>/git-hooks`, which ref0 names as
+* `core.hooksPath` in its agents' commands alone, never in a repo, its config or its hooks.
+* `core.hooksPath` replaces a repo's whole hooks folder, so each forwarder runs the repo's own
+* hook of its name, with the same arguments, stdin and exit status, wherever the repo keeps it:
+* husky's `.husky/_`, `.git/hooks/` or another `core.hooksPath`. It finds and runs that hook
+* with ref0's entry left out of its environment, so a hook that looks up another, as
+* `pre-applypatch.sample` runs `pre-commit`, finds the repo's own. A forwarder runs nothing
+* when the repo's hooks path is one of ref0's folders, or when a forwarder started it, so none
+* calls itself: a first version that left ref0's entry in started about 1,000 processes.
+*
+* Git runs a hook that exists even where the repo has none, so the forwarders cost each hook one
+* `sh` and one `git rev-parse`, about 1.5 ms. Two hooks run on every index write and ref update,
+* hundreds of times in a long rebase, so only `all` forwards them, for a checkout that has its
+* own; `most` forwards every other (measured 23 Oct 2026, in the piece's pull request).
+*
+* The folders are the CLI's: a session's start writes them again when a forwarder differs, as
+* after an update. Each is read-only, so a tool that installs hooks wherever `core.hooksPath`
+* points, run in an agent's command, fails there rather than replacing a forwarder for every
+* repo.
+*/
+/** The hooks Git runs on every index write and ref update. */
+const frequentHooks = ["post-index-change", "reference-transaction"];
+/**
+* Every other hook Git looks for in its hooks path. Not `push-to-checkout`, which replaces Git's
+* own update of a checkout pushed to merely by existing, nor `fsmonitor-watchman`, which Git runs
+* from `core.fsmonitor`, never from the hooks path.
+*/
+const forwardedHooks = [
+	"applypatch-msg",
+	"pre-applypatch",
+	"post-applypatch",
+	"pre-commit",
+	"pre-merge-commit",
+	"prepare-commit-msg",
+	"commit-msg",
+	"post-commit",
+	"pre-rebase",
+	"post-checkout",
+	"post-merge",
+	"pre-push",
+	"pre-receive",
+	"update",
+	"proc-receive",
+	"post-receive",
+	"post-update",
+	"pre-auto-gc",
+	"post-rewrite",
+	"sendemail-validate",
+	"p4-changelist",
+	"p4-prepare-changelist",
+	"p4-post-changelist",
+	"p4-pre-submit"
+];
+/**
+* The forwarder for one hook. `hooks` is the folder holding ref0's folders: an entry naming one
+* of them is ref0's, and is left out. The rest keep their order, renumbered.
+*/
+const forwarder = (name, hooks) => [
+	"#!/bin/sh",
+	`# ref0 ${cliVersion}'s forwarder for Git's ${name} hook. ref0 sets core.hooksPath to this`,
+	"# folder only in its agents' commands. This runs the repo's own hook, found and run with",
+	"# ref0's entry left out, with the same arguments, stdin and exit status.",
+	`[ -n "\${${gitHookVariables.forwarded}-}" ] && exit 0`,
+	`ref0_hooks=${shellWord(hooks)}`,
+	"ref0_n=${GIT_CONFIG_COUNT:-0}",
+	"ref0_i=0",
+	"ref0_j=0",
+	"while [ \"$ref0_i\" -lt \"$ref0_n\" ]; do",
+	"  eval \"ref0_key=\\${GIT_CONFIG_KEY_$ref0_i-} ref0_value=\\${GIT_CONFIG_VALUE_$ref0_i-}\"",
+	"  unset \"GIT_CONFIG_KEY_$ref0_i\" \"GIT_CONFIG_VALUE_$ref0_i\"",
+	"  if [ \"$ref0_key\" != core.hooksPath ] || [ \"${ref0_value%/*}\" != \"$ref0_hooks\" ]; then",
+	"    export \"GIT_CONFIG_KEY_$ref0_j=$ref0_key\" \"GIT_CONFIG_VALUE_$ref0_j=$ref0_value\"",
+	"    ref0_j=$((ref0_j + 1))",
+	"  fi",
+	"  ref0_i=$((ref0_i + 1))",
+	"done",
+	"if [ \"$ref0_j\" -eq 0 ]; then unset GIT_CONFIG_COUNT; else export GIT_CONFIG_COUNT=\"$ref0_j\"; fi",
+	`ref0_hook=$(git rev-parse --git-path hooks/${name}) || exit`,
+	"[ -f \"$ref0_hook\" ] && [ -x \"$ref0_hook\" ] || exit 0",
+	"ref0_dir=$(cd -P \"${ref0_hook%/*}\" && pwd) || exit",
+	"[ \"${ref0_dir%/*}\" = \"$ref0_hooks\" ] && exit 0",
+	`export ${gitHookVariables.forwarded}=${name}`,
+	"exec \"$ref0_hook\" \"$@\"",
+	""
+].join("\n");
+/** The hooks each folder forwards. */
+const hooksIn = (folder) => folder === "all" ? [...forwardedHooks, ...frequentHooks] : forwardedHooks;
+/** The folder holding ref0's hooks folders, made if it isn't yet: its path, through any links. */
+const gitHooksHome = Effect.fnUntraced(function* (home, api) {
+	const fs = yield* FileSystem.FileSystem;
+	const given = (yield* Path.Path).join(home, ".ref0", "origins", originKey(api), "git-hooks");
+	yield* fs.makeDirectory(given, {
+		recursive: true,
+		mode: 448
+	});
+	return yield* fs.realPath(given);
+});
+/**
+* One of ref0's hooks folders, in `hooks`, written first unless every forwarder in it is already
+* as this CLI writes it: its path, as the agent's `core.hooksPath` names it.
+*/
+const hooksFolder = Effect.fnUntraced(function* (hooks, folder) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const crypto = yield* Crypto.Crypto;
+	const written = path.join(hooks, folder);
+	const names = hooksIn(folder);
+	const current = Effect.forEach(names, (name) => fs.readFileString(path.join(written, name)).pipe(Effect.map((text) => text === forwarder(name, hooks)), Effect.orElseSucceed(() => false))).pipe(Effect.map((each) => each.every(Boolean)));
+	if (yield* current) return written;
+	yield* Effect.gen(function* () {
+		yield* fs.makeDirectory(written, { recursive: true });
+		yield* fs.chmod(written, 493);
+		for (const name of names) {
+			const next = path.join(written, `${name}.${yield* crypto.randomUUIDv4}.next`);
+			yield* fs.writeFileString(next, forwarder(name, hooks), { mode: 365 });
+			yield* fs.rename(next, path.join(written, name));
+		}
+		yield* fs.chmod(written, 365);
+	}).pipe(Effect.catch((error) => Effect.flatMap(current, (done) => done ? Effect.void : Effect.fail(error))));
+	return written;
+});
+//#endregion
+//#region src/harness/commit-environment.ts
+/**
+* The agent as the author of its commits, set at a Claude Code session's start in the
+* environment of the agent's own commands, and nowhere else: the file `CLAUDE_ENV_FILE` names,
+* which Claude Code runs ahead of each of them. It sets Git's author to the agent, by its owner
+* and handle and its commit email; one `GIT_CONFIG_*` entry naming ref0's hooks folder as
+* `core.hooksPath`, after any the command already has; and the harness, for the trailer. Git
+* takes the committer from the person's own config, with their signature, and a commit the
+* person makes in their own terminal has none of it.
+*
+* The agent is the one the session's config folder acts as, from that folder's host grant, which
+* `ref0 connect` keeps with the agent's ID. It sets no author when the grant can't be read, or
+* when the session's checkout signs off its commits: any of the last 20 on its default branch
+* has a `Signed-off-by`, or it has `.github/dco.yml`. A DCO check wants each sign-off to match
+* its commit's author, and an agent never signs off. The hooks path is still set.
+*/
+/** How many commits on the default branch a session's start reads for a sign-off. */
+const signedOffWithin = 20;
+/**
+* What a session's start adds to the file Claude Code runs ahead of the agent's commands. The
+* hooks path goes after the entries a command already has, once however often the file runs.
+* Without an author, it drops one an outer agent's session set.
+*/
+const environmentScript = (set) => [
+	"",
+	"# ref0: the agent as the author of its commits, and ref0's Git hooks, in its commands",
+	...Option.match(set.author, {
+		onNone: () => ["case ${GIT_AUTHOR_EMAIL-} in *@ref0.work) unset GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL ;; esac"],
+		onSome: (author) => [`export GIT_AUTHOR_NAME=${shellWord(author.name)}`, `export GIT_AUTHOR_EMAIL=${shellWord(author.email)}`]
+	}),
+	`export ${gitHookVariables.harness}=${set.harness}`,
+	"if [ -z \"${ref0_hooks_set-}\" ]; then",
+	"  ref0_n=${GIT_CONFIG_COUNT:-0}",
+	`  export "GIT_CONFIG_KEY_$ref0_n=core.hooksPath" "GIT_CONFIG_VALUE_$ref0_n="${shellWord(set.folder)} "GIT_CONFIG_COUNT=$((ref0_n + 1))"`,
+	"  ref0_hooks_set=1",
+	"  unset ref0_n",
+	"fi",
+	""
+].join("\n");
+/**
+* What the agent reads at its session's start once its commands name ref0's hooks folder: an
+* installer run there fails on that read-only folder, and without ref0's entry it installs into
+* the repo's own.
+*/
+const hookInstallerWords = `ref0: Git in your commands runs hooks through ref0's read-only folder, so run a hook installer, such as git lfs install, pre-commit install, lefthook install or simple-git-hooks, as env -u GIT_CONFIG_COUNT <command>, to install into the repo's own hooks folder.`;
+/**
+* What the session's checkout says: which of ref0's hooks folders it needs, `all` when it has
+* its own frequent hook, and whether it signs off its commits. Outside a checkout, neither.
+*/
+const checkoutAt = Effect.fnUntraced(function* (cwd) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const git = (folder, args) => spawner.string(ChildProcess.make("git", [
+		"-C",
+		folder,
+		...args
+	])).pipe(Effect.catchCause(() => Effect.succeed("")));
+	const executable = (file) => fs.stat(file).pipe(Effect.map((info) => info.type === "File" && (info.mode & 73) !== 0), Effect.orElseSucceed(() => false));
+	const top = (yield* git(cwd, ["rev-parse", "--show-toplevel"])).trim();
+	const outside = {
+		folder: "most",
+		signsOff: false
+	};
+	if (top === "") return outside;
+	const hooks = (yield* git(top, ["rev-parse", ...frequentHooks.flatMap((name) => ["--git-path", `hooks/${name}`])])).split("\n").filter(Boolean);
+	const folder = (yield* Effect.forEach(hooks, (hook) => executable(path.resolve(top, hook)))).some(Boolean) ? "all" : "most";
+	if (yield* fs.exists(path.join(top, ".github", "dco.yml")).pipe(Effect.orElseSucceed(() => false))) return {
+		folder,
+		signsOff: true
+	};
+	const defaultBranch = (yield* git(top, [
+		"symbolic-ref",
+		"-q",
+		"refs/remotes/origin/HEAD"
+	])).trim();
+	return {
+		folder,
+		signsOff: (yield* git(top, [
+			"log",
+			"--no-show-signature",
+			"-n",
+			`${signedOffWithin}`,
+			"--format=%(trailers:key=Signed-off-by,valueonly)",
+			defaultBranch === "" ? "HEAD" : defaultBranch,
+			"--"
+		])).trim() !== ""
+	};
+});
+/**
+* Adds the agent's commit environment to the file Claude Code names, for the session opening in
+* `cwd`: only in Claude Code, and only for a setup with an agent. ref0's hooks folder is written
+* first, so the file never names a folder that isn't there. Whether it set ref0's hooks path.
+*/
+const setCommitEnvironment = Effect.fnUntraced(function* (cwd) {
+	const fs = yield* FileSystem.FileSystem;
+	const folders = yield* ConfigFolders;
+	const file = yield* Config.String("CLAUDE_ENV_FILE").pipe(Config.withDefault(""));
+	if (file === "") return false;
+	const connected = yield* (yield* HostGrant).get(yield* folders.folder("claude-code")).pipe(Effect.map(Option.map(Option.some)), Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedSome(Option.none())));
+	if (Option.isNone(connected)) return false;
+	const checkout = yield* checkoutAt(cwd);
+	const folder = yield* hooksFolder(yield* gitHooksHome(yield* Config.String("HOME"), (yield* Ref0Config).api), checkout.folder);
+	const author = checkout.signsOff ? Option.none() : Option.map(connected.value, (grant) => ({
+		name: agentCommitName(grant.owner, grant.agent),
+		email: agentCommitEmail(grant.agentId)
+	}));
+	yield* fs.writeFileString(file, environmentScript({
+		author,
+		folder,
+		harness: "claude-code"
+	}), { flag: "a" });
+	return true;
+});
+//#endregion
 //#region src/harness/session-start.ts
 /**
 * `ref0 hook session-start`: the harness's `SessionStart` hook, a command, before `ref0 mcp`
@@ -31042,25 +32250,29 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 	const input = yield* stdio.stdin.pipe(Stream.decodeText(), Stream.mkString);
 	const hook = decodeHook(input);
 	if (Option.isNone(hook)) return;
+	if (yield* setCommitEnvironment(hook.value.cwd ?? ".").pipe(Effect.orElseSucceed(() => false))) yield* Console.log(hookInstallerWords);
 	const binding = yield* bindingHere(hook.value.session_id);
 	if (Option.isNone(binding)) return;
 	const harnessName = binding.value.harness === "codex" ? "codex" : "claude-code";
 	const folder = yield* agents.folder(harnessName);
-	const agent = yield* (yield* HostGrant).get(folder);
+	const kept = yield* (yield* HostGrant).get(folder).pipe(Effect.map((agent) => ({
+		agent,
+		readable: true
+	})), Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeed({
+		agent: Option.none(),
+		readable: false
+	})));
+	const agent = kept.agent;
+	const repair = Option.isSome(agent) ? installLine(folder) : yield* connectLineFor(harnessName, folder);
 	const update = updateLine({
 		protocol,
 		version: yield* pluginVersion
-	}, installLine(folder, Option.isSome(agent), harnessName));
+	}, repair);
 	if (Option.isSome(update)) return yield* Console.log(update.value);
 	if (Option.isNone(agent)) {
-		const fs = yield* FileSystem.FileSystem;
-		const path = yield* Path.Path;
-		const home = yield* Config.String("HOME");
-		const setup = configFolders[harnessName];
-		const defaultPath = path.join(home, setup.inHome);
-		const prefix = folder === (yield* fs.realPath(defaultPath).pipe(Effect.orElseSucceed(() => defaultPath))) ? "" : `${setup.variable}=${shellWord(folder)} `;
 		const name = harnessName === "codex" ? "Codex" : "Claude Code";
-		return yield* Console.log(`ref0: no agent is connected for this ${name} setup, ${folder}, so no session starts. Run: ${prefix}${installLine(folder, Option.isSome(agent), harnessName)}`);
+		const why = kept.readable ? `no agent is connected for this ${name} config folder, ${folder}` : `the host grant kept for this ${name} config folder, ${folder}, can't be read`;
+		return yield* Console.log(`ref0: ${why}, so no session starts. In your own terminal, run: ${repair}`);
 	}
 	const account = sessionAccount(binding.value);
 	const held = yield* keychain.get(account);
@@ -31093,15 +32305,8 @@ const sessionStart = Command.make(harnessCommandNames.sessionStart, { protocol:
 const harnessCommands = [mcp, Command.make(harnessCommandNames.hook).pipe(Command.withDescription("The harness's hooks that run as commands"), Command.withShortDescription("Run the harness’s session hooks"), Command.withSubcommands([sessionStart, sessionEnd]))];
 //#endregion
 //#region src/harness/status.ts
-/**
-* `ref0 status`: whether ref0 follows the sessions of the harness it runs under, a line for each
-* thing that has to hold. This machine holds a host grant for the agent the harness's config
-* folder starts sessions as, and ref0 accepts it; ref0's plugin is installed and on, and speaks
-* this `ref0`'s hook protocol; Codex trusts its hooks, where Codex can say; and ref0 follows this
-* session. Each "no" ends with the one thing to do next, and the command exits 1. It never prints
-* a secret: a token only asks ref0 who it is. The plugin's `/ref0:status` runs it.
-*/
-const encodeReport = Schema.encodeEffect(StatusReport);
+/** Each connected or initialized folder has its own report; secrets are used only to ask ref0. */
+const encodeReports = Schema.encodeEffect(Schema.Array(StatusReport));
 const checkOf = (check, answer, says, next) => next === void 0 ? {
 	check,
 	answer,
@@ -31112,24 +32317,16 @@ const checkOf = (check, answer, says, next) => next === void 0 ? {
 	says,
 	next
 };
-const harnessWords = {
-	"claude-code": "Claude Code",
-	codex: "Codex"
-};
-const labels = {
-	connected: "Connected",
-	accepted: "Accepted",
-	plugin: "Plugin",
-	trusted: "Hooks trusted",
-	session: "Session"
-};
-const lineOf = (check) => [
-	`${labels[check.check]}: ${check.answer}.`,
-	check.says,
-	check.next
-].filter(Predicate.isString).join(" ");
-/** The report as a person reads it: the harness and its folder, then a line for each check. */
-const wordsOf = (report) => [`ref0 status, for ${harnessWords[report.harness]} in ${report.configFolder}:`, ...report.checks.map(lineOf)].join("\n");
+/** Each non-yes line puts its repair command on the next line, through the shared printer. */
+const wordsOf = (report, home) => {
+	return [{
+		label: shownConfigFolder(home, report.configFolder),
+		text: ` ${report.agent === void 0 ? report.harness === void 0 ? "unknown harness" : configFolders[report.harness].name : `${report.agent.agent}, ${report.agent.owner}'s agent`}`
+	}, ...report.checks.flatMap((check) => [{
+		status: check.answer,
+		text: `${check.check}: ${check.says}`
+	}, ...check.next === void 0 ? [] : [{ command: check.next }]])];
+};
 const refused = () => Effect.succeed({ kind: "refused" });
 const whoIs = Effect.fnUntraced(function* (token) {
 	const config = yield* Ref0Config;
@@ -31142,157 +32339,140 @@ const whoIs = Effect.fnUntraced(function* (token) {
 	}), Effect.orElseSucceed(() => ({ kind: "unanswered" })));
 });
 const unansweredWords = (api) => `ref0 didn’t answer at ${api}.`;
-const tryAgain = "Run ref0 status again in a minute.";
-/** Whether this machine holds a host grant for the agent kept for the harness, and ref0 accepts it. */
-const grantChecks = Effect.fnUntraced(function* (harness, grant) {
-	const words = harnessWords[harness];
-	const notAsked = checkOf("accepted", "unknown", "Not asked, with no host grant to ask with.");
-	if (Result.isFailure(grant)) return [checkOf("connected", "unknown", "The keychain didn’t say whether this config folder holds a host grant.", grant.failure.nextStep), notAsked];
-	const agent = grant.success;
-	if (Option.isNone(agent)) return [checkOf("connected", "no", `This machine’s ${words} isn’t connected to an agent.`, `Run: ${installLine("", false, harness)}`), notAsked];
-	const { owner, agent: handle } = agent.value;
-	const who = `${owner}’s ${handle}`;
-	const connect = `Run: ref0 connect --harness ${harness}`;
-	const connected = checkOf("connected", "yes", `This machine holds a host grant for ${who}.`);
-	switch ((yield* whoIs(agent.value.token)).kind) {
-		case "accepted": return [connected, checkOf("accepted", "yes", `ref0 accepts it: ${handle} is on, and the grant isn’t revoked.`)];
-		case "refused": return [checkOf("connected", "no", `This machine keeps a host grant for ${who} that ref0 no longer accepts.`, connect), checkOf("accepted", "no", `ref0 refuses it: the grant was revoked or not confirmed, or ${handle} was turned off.`, connect)];
-		case "unanswered": return [connected, checkOf("accepted", "unknown", unansweredWords((yield* Ref0Config).api), tryAgain)];
+/** Check the grant kept for this folder, without borrowing another folder's authority. */
+const grantChecks = Effect.fnUntraced(function* (grant, configFolder) {
+	const asked = yield* whoIs(grant.token);
+	const connected = checkOf("connected", "yes", "this machine holds its grant");
+	switch (asked.kind) {
+		case "accepted": return [connected, checkOf("accepted", "yes", "ref0 accepts its grant")];
+		case "refused": return [connected, checkOf("accepted", "no", "ref0 refuses its grant", yield* connectLineFor(grant.harness, configFolder))];
+		case "unanswered": return [connected, checkOf("accepted", "unknown", unansweredWords((yield* Ref0Config).api), "ref0 status")];
 	}
 });
-/**
-* The plugin check once its hooks are read: whether each speaks this `ref0`'s hook protocol, and
-* what to run if one doesn't.
-*/
-const speaksCheck = (harness, protocols, version, reinstall) => {
-	const words = harnessWords[harness];
-	if (protocols.length === 0) return checkOf("plugin", "no", `ref0’s plugin in ${words} has no hooks ref0 can read.`, `Run: ${reinstall}`);
-	const speaking = {
+/** Protocol mismatches either update this CLI or reinstall this folder's plugin. */
+const speaksCheck = (protocols, version, reinstall) => {
+	if (protocols.length === 0) return checkOf("plugin", "no", "no readable hooks in this folder", reinstall);
+	const mismatch = protocolMismatch({
 		protocol: protocols.find((protocol) => protocol !== "1") ?? "1",
 		version
-	};
-	const mismatch = protocolMismatch(speaking, reinstall);
-	if (Option.isSome(mismatch)) return checkOf("plugin", "no", `${mismatch.value.says}.`, `Run: ${mismatch.value.run}`);
-	const which = Option.match(version, {
-		onNone: () => "ref0’s plugin",
-		onSome: (release) => `ref0’s plugin ${release}`
-	});
-	return checkOf("plugin", "yes", `${which} is on in ${words}, and speaks hook protocol 1, as this ref0 does.`);
+	}, reinstall);
+	if (Option.isSome(mismatch)) return checkOf("plugin", "no", mismatch.value.says, mismatch.value.run);
+	return checkOf("plugin", "yes", "installed and speaks this ref0");
 };
 const decodePlugins = Schema.decodeUnknownEffect(Schema.fromJsonString(ClaudePluginsListed));
 const decodeHooks = Schema.decodeUnknownEffect(Schema.fromJsonString(HooksFile));
-/**
-* Whether Claude Code has ref0's plugin on, and its hooks speak this `ref0`'s protocol, from
-* `claude plugin list` and the hooks file in the folder Claude Code reads it from. Claude Code
-* doesn't say whether it trusts a plugin's hooks, so there's no line for that.
-*/
-const claudeCodeChecks = Effect.fnUntraced(function* (agent) {
-	const reinstall = installLine(yield* (yield* ConfigFolders).folder("claude-code"), Option.isSome(agent), "claude-code");
+/** Ask Claude Code about this folder, even when another folder is current in the terminal. */
+const claudeCodeChecks = Effect.fnUntraced(function* (configFolder) {
+	const reinstall = installLine(configFolder);
 	const claude = yield* onPath("claude");
-	if (Option.isNone(claude)) return [checkOf("plugin", "unknown", "Claude Code isn’t on this machine’s PATH, so ref0 can’t ask it.")];
+	if (Option.isNone(claude)) return [checkOf("plugin", "unknown", "Claude Code isn’t on PATH", reinstall)];
+	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	const listed = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).string(ChildProcess.make(claude.value, [
 		"plugin",
 		"list",
 		"--json"
-	])).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
-	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Claude Code didn’t list its plugins, so ref0 can’t tell.", "Run: claude plugin list")];
-	const plugin = listed.value.find((each) => each.id === "ref0@ref0");
-	if (plugin === void 0) return [checkOf("plugin", "no", "ref0’s plugin isn’t installed in Claude Code.", `Run: ${reinstall}`)];
-	if (!plugin.enabled) return [checkOf("plugin", "no", "ref0’s plugin is installed in Claude Code, but turned off.", "Run: claude plugin enable ref0@ref0")];
+	], {
+		env: {
+			HOME: home,
+			CLAUDE_CONFIG_DIR: configFolder
+		},
+		extendEnv: true
+	})).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
+	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Claude Code didn’t list its plugins", reinstall)];
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	const id = `${name}@${name}`;
+	const plugin = listed.value.find((each) => each.id === id);
+	if (plugin === void 0) return [checkOf("plugin", "no", "not installed in this folder", reinstall)];
+	if (!plugin.enabled) return [checkOf("plugin", "no", "turned off in this folder", `CLAUDE_CONFIG_DIR=${shellWord(configFolder)} claude plugin enable ${id}`)];
 	const fs = yield* FileSystem.FileSystem;
 	const folder = plugin.readFromFolder ?? plugin.installPath;
 	const hooks = folder === void 0 ? Option.none() : yield* fs.readFileString(`${folder}/hooks/hooks.json`).pipe(Effect.flatMap(decodeHooks), Effect.option);
-	return [speaksCheck("claude-code", Option.match(hooks, {
+	return [speaksCheck(Option.match(hooks, {
 		onNone: () => [],
 		onSome: protocolsOf
 	}), Option.fromUndefinedOr(plugin.version), reinstall)];
 });
-/** Whether Codex trusts ref0's hooks, which it runs only once the person has. */
-const trustCheck = (hooks, reinstall) => {
-	if (!hooks.every(ownHook)) return checkOf("trusted", "no", "Codex’s ref0 plugin holds hooks ref0 didn’t write.", `Remove it with: codex plugin remove ref0@ref0, then run: ${reinstall}`);
-	const waiting = hooks.filter(waitingForTrust).length;
-	if (waiting > 0) return checkOf("trusted", "no", `Codex runs ref0’s hooks only once you trust them, and ${waiting} of ${hooks.length} ${waiting === 1 ? "isn’t" : "aren’t"}.`, trustRef0Hooks(reinstall));
-	return checkOf("trusted", "yes", "Codex trusts each of ref0’s hooks.");
+/** Trust only ref0's hooks; removal of an unexpected plugin targets this folder too. */
+const trustCheck = (hooks, configFolder, name) => {
+	const reinstall = installLine(configFolder);
+	if (!hooks.every((hook) => ownHook(hook, name))) return checkOf("trusted", "no", "the plugin holds hooks ref0 didn’t write", `CODEX_HOME=${shellWord(configFolder)} codex plugin remove ${name}@${name} && ${reinstall}`);
+	if (hooks.some(waitingForTrust)) return checkOf("trusted", "no", "ref0’s hooks need your trust in a terminal", reinstall);
+	return checkOf("trusted", "yes", "Codex trusts each ref0 hook");
 };
-/**
-* Whether Codex runs ref0's plugin's hooks, each speaking this `ref0`'s protocol, and trusts
-* them, from its app server's `hooks/list`, as `ref0 install` reads them.
-*/
-const codexChecks = Effect.fnUntraced(function* (agent) {
-	const reinstall = installLine(yield* (yield* ConfigFolders).folder("codex"), Option.isSome(agent), "codex");
-	const notAsked = (why) => checkOf("trusted", "unknown", `Not asked, ${why}.`);
+/** Ask Codex's app server under this folder's CODEX_HOME. */
+const codexChecks = Effect.fnUntraced(function* (configFolder) {
+	const reinstall = installLine(configFolder);
 	const codex = yield* onPath("codex");
-	if (Option.isNone(codex)) return [checkOf("plugin", "unknown", "Codex isn’t on this machine’s PATH, so ref0 can’t ask it."), notAsked("with no Codex to ask")];
+	if (Option.isNone(codex)) return [checkOf("plugin", "unknown", "Codex isn’t on PATH", reinstall)];
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
-	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [home] }).pipe(Effect.option);
-	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Codex didn’t list its hooks, so ref0 can’t tell."), notAsked("with no hooks listed")];
-	const hooks = listed.value.data.flatMap((entry) => entry.hooks).filter(pluginHook);
-	if (hooks.length === 0) return [checkOf("plugin", "no", "ref0’s plugin isn’t installed in Codex, or is turned off.", `Run: ${reinstall}`), notAsked("with no hooks of ref0’s in Codex")];
+	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [home] }, configFolder).pipe(Effect.option);
+	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Codex didn’t list its hooks", reinstall)];
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	const hooks = listed.value.data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, `${name}@${name}`));
+	if (hooks.length === 0) return [checkOf("plugin", "no", "not installed or turned off in this folder", reinstall)];
 	const protocols = hooks.map((hook) => protocolFlagged(hook.command ?? "")).filter(Predicate.isString);
-	return [speaksCheck("codex", protocols, Option.none(), reinstall), trustCheck(hooks, reinstall)];
+	return [speaksCheck(protocols, Option.none(), reinstall), trustCheck(hooks, configFolder, name)];
 });
-/**
-* Whether ref0 follows the harness session this runs in: its token, kept when the session
-* started, and whether ref0 still accepts it. A session started before its agent was connected
-* was never followed, and a new one is.
-*/
-const sessionCheck = Effect.fnUntraced(function* (harness, earlierYes) {
+/** A session belongs only to the current folder, even when several folders share its agent. */
+const sessionCheck = Effect.fnUntraced(function* (harness, configFolder) {
+	const launch = `${configFolders[harness].variable}=${shellWord(configFolder)} ${harness === "codex" ? "codex" : "claude"}`;
 	const binding = yield* bindingHere().pipe(Effect.map(Option.filter((found) => found.harness === harness)), Effect.orElseSucceed(() => Option.none()));
-	if (Option.isNone(binding)) return checkOf("session", "unknown", (yield* harnessEnvironment).CODEX_SANDBOX === void 0 ? `This isn’t a ${harnessWords[harness]} session, so there’s none to follow.` : "Codex’s sandbox hides which Codex session this is, so ref0 can’t say whether it follows it.");
-	const words = harnessWords[harness];
-	const startNew = `Start a new ${words} session${earlierYes ? "" : " once the lines above say yes"}.`;
+	if (Option.isNone(binding)) return checkOf("session", "unknown", (yield* harnessEnvironment).CODEX_SANDBOX === void 0 ? "no current session to check" : "Codex’s sandbox hides its session", launch);
 	const token = yield* Effect.result((yield* Keychain).get(sessionAccount(binding.value)));
-	if (Result.isFailure(token)) return checkOf("session", "unknown", `The keychain didn’t say whether ref0 follows this ${words} session.`, token.failure.nextStep);
-	const notFollowed = checkOf("session", "no", `ref0 doesn’t follow this ${words} session.`, startNew);
-	if (Option.isNone(token.success)) return notFollowed;
+	if (Result.isFailure(token)) return checkOf("session", "unknown", `The keychain didn’t say whether ref0 follows this ${configFolders[harness].name} session.`, token.failure.nextStep);
+	if (Option.isNone(token.success)) return checkOf("session", "no", "start a new session in this folder", launch);
 	const asked = yield* whoIs(token.success.value);
 	switch (asked.kind) {
-		case "accepted": return asked.me.session === void 0 ? notFollowed : checkOf("session", "yes", `ref0 follows this ${words} session, as ${asked.me.session.session}.`);
-		case "refused": return checkOf("session", "no", `ref0 no longer follows this ${words} session: it ended, or its agent was turned off.`, startNew);
-		case "unanswered": return checkOf("session", "unknown", unansweredWords((yield* Ref0Config).api), tryAgain);
+		case "accepted": return asked.me.session === void 0 ? checkOf("session", "no", "start a new session in this folder", launch) : checkOf("session", "yes", `ref0 follows this session as ${asked.me.session.session}`);
+		case "refused": return checkOf("session", "no", "ref0 no longer follows this session", launch);
+		case "unanswered": return checkOf("session", "unknown", unansweredWords((yield* Ref0Config).api), "ref0 status");
 	}
 });
-/**
-* The harness asked about: the flag's, else the harness process this runs under, else Codex in
-* Codex's sandbox, which hides that process and says so, else Claude Code. A harness found
-* without its session still names the setup.
-*/
-const harnessHere = Effect.fnUntraced(function* (flagged) {
-	if (Option.isSome(flagged)) return flagged.value;
-	return yield* currentHarness;
-});
-const statusCommands = [Command.make(harnessCommandNames.status, {
-	harness: harnessFlag.pipe(Flag.optional, Flag.withDescription("The harness to check; the session’s, or claude-code, without it")),
-	json
-}, ({ harness: flagged, json: asJson }) => Effect.gen(function* () {
-	const harness = yield* harnessHere(flagged);
-	const configFolder = yield* (yield* ConfigFolders).folder(harness);
-	const kept = yield* Effect.result((yield* HostGrant).get(configFolder));
-	const agent = Result.isSuccess(kept) ? Option.map(kept.success, ({ owner, agent }) => ({
-		owner,
-		agent
-	})) : Option.none();
-	const grant = yield* grantChecks(harness, kept);
-	const plugin = yield* harness === "codex" ? codexChecks(agent) : claudeCodeChecks(agent);
-	const before = [...grant, ...plugin];
-	const session = yield* sessionCheck(harness, before.every((check) => check.answer === "yes"));
-	const checks = [...before, session];
-	const report = Option.match(agent, {
-		onNone: () => ({
-			harness,
-			configFolder,
-			checks
-		}),
-		onSome: (kept) => ({
-			harness,
+const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ json: asJson }) => Effect.gen(function* () {
+	const folders = yield* ConfigFolders;
+	const grants = yield* HostGrant;
+	const current = yield* currentConfigFolder;
+	const found = yield* findConfigFolders;
+	const candidates = /* @__PURE__ */ new Map();
+	for (const given of yield* folders.all) {
+		const folder = yield* folders.resolve(given);
+		if (!candidates.has(folder)) candidates.set(folder, void 0);
+	}
+	for (const { configFolder, harness } of found) candidates.set(configFolder, harness);
+	const paths = [...candidates.keys()].sort((a, b) => a === current ? -1 : b === current ? 1 : 0);
+	const reports = [];
+	for (const configFolder of paths) {
+		const kept = yield* Effect.result(grants.get(configFolder));
+		const unreadable = Result.isFailure(kept) && kept.failure.unreadable === true;
+		const grant = Result.isSuccess(kept) ? kept.success : Option.none();
+		const harness = Option.isSome(grant) ? grant.value.harness : candidates.get(configFolder);
+		if (Result.isFailure(kept) || Option.isNone(grant)) {
+			const report = {
+				configFolder,
+				checks: [Result.isFailure(kept) && !unreadable ? checkOf("connected", "unknown", "The keychain didn’t say whether this config folder holds a host grant.", kept.failure.nextStep) : checkOf("connected", "no", unreadable ? "its host grant can’t be read" : "not connected", harness === void 0 ? "ref0 connect" : yield* connectLineFor(harness, configFolder))]
+			};
+			reports.push(harness === void 0 ? report : {
+				...report,
+				harness
+			});
+			continue;
+		}
+		const checks = [...yield* grantChecks(grant.value, configFolder), ...yield* grant.value.harness === "codex" ? codexChecks(configFolder) : claudeCodeChecks(configFolder)];
+		if (configFolder === current) checks.push(yield* sessionCheck(grant.value.harness, configFolder));
+		reports.push({
+			harness: grant.value.harness,
 			configFolder,
-			agent: kept,
+			agent: {
+				owner: grant.value.owner,
+				agent: grant.value.agent
+			},
 			checks
-		})
-	});
-	yield* printAnswer(yield* Effect.orDie(encodeReport(report)), asJson, wordsOf(report));
-	if (checks.some((check) => check.answer === "no")) return yield* new Said();
-})).pipe(Command.withDescription("Says whether ref0 follows this machine’s sessions, and what to do next if it doesn’t"), Command.withShortDescription("Show whether ref0 works here"))];
+		});
+	}
+	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
+	yield* printAnswer(yield* Effect.orDie(encodeReports(reports)), asJson, reports.length === 0 ? [["No initialized harness folders found.", { command: "ref0 connect" }]] : reports.map((report) => wordsOf(report, home)));
+	if (reports.some((report) => report.checks.some((check) => check.answer === "no"))) return yield* new Said();
+})).pipe(Command.withDescription("Shows every config folder’s connection and plugin, with this session’s folder first"), Command.withShortDescription("Check every harness config folder"))];
 //#endregion
 //#region src/ref0.ts
 /**
@@ -31331,7 +32511,7 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 	...agentCommands,
 	...attachmentCommands
 ]));
-const keychain = Keychain.layer.pipe(Layer.provide(NodeServices.layer));
+const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
 const sessionToken = harnessSessionToken.pipe(Layer.provide([keychain, harnessProcess]));
 /** Every service `ref0`'s commands use, on this machine. */
@@ -31339,7 +32519,7 @@ const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,
 	sessionToken,
 	FetchHttpClient.layer
-])), Ref0Config.layer, sessionToken, FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(NodeServices.layer));
+])), sessionToken, FetchHttpClient.layer, keychain, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
 //#endregion
 //#region src/main.ts
 ref0.pipe(Command.run({ version: cliVersion }), Effect.provide(services), NodeRuntime.runMain);