@ref0/cli 0.7.0 → 0.9.0

package/dist/main.mjs

@@ -6510,8 +6510,17 @@ var PasskeyRefused = class extends Schema.TaggedError()("PasskeyRefused", { next
 //#endregion
 //#region ../contracts/src/attachments.ts
 /** A machine asks, a signed-in person claims and approves, and the answer returns to its terminal. */
+/**
+* What could reorder or hide the text around it, such as U+202E: a control, format, surrogate,
+* private-use or unassigned character, or a line or paragraph separator.
+*/
+const hiddenCharacters = String.raw`\p{C}\p{Zl}\p{Zp}`;
+/** Text with none of them, which reads as it's written wherever it's shown. */
+const shownAsWritten = Schema.isPattern(new RegExp(`^[^${hiddenCharacters}]+$`, "u"));
+/** Text with each character that could reorder or hide what's around it taken out. */
+const withoutHiddenCharacters = (text) => text.replaceAll(new RegExp(`[${hiddenCharacters}]`, "gu"), "");
 /** A machine's own word for itself: shown to the person as what it says, never as fact. */
-const MachineName = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(64));
+const MachineName = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(64), shownAsWritten);
 /** The harness a machine says it connects for, never proof of what it runs. */
 const ConnectHarness = Schema.Literals(["claude-code", "codex"]);
 /** The machine's loopback listener; no caller may choose its host. */
@@ -6523,7 +6532,7 @@ const AttachmentCallback = Schema.Struct({
 	state: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/))
 });
 /** A config folder's path, as the machine shows it, never proof of its location. */
-const ConfigFolderPath = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(200), Schema.isPattern(/^[^\p{C}\p{Zl}\p{Zp}]+$/u));
+const ConfigFolderPath = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(200), shownAsWritten);
 const uniqueFolderPaths = Schema.makeFilter((folders) => new Set(folders.map((folder) => folder.path)).size === folders.length, { expected: "unique config folder paths" });
 const RequestFolder = Schema.Struct({
 	path: ConfigFolderPath,
@@ -11766,10 +11775,12 @@ Schema.Union([
 	NotPermitted
 ]);
 /**
-* A session's fork's path on ref0's host. Its thread's, `/{owner}/{project}/threads/{n}/{repo}.git`
-* on a project's thread and `/{owner}/threads/{n}/{repo}.git` on an org thread, reaches the fork
-* of the session whose token asks, and takes its pushes. A session's,
-* `…/threads/{n}/sessions/{m}/{repo}.git`, reads that session's fork, and takes no push.
+* A fork's path on ref0's host. Its thread's, `/{owner}/{project}/threads/{n}/{repo}.git` on a
+* project's thread and `/{owner}/threads/{n}/{repo}.git` on an org thread, reaches the fork of the
+* session whose token asks, and takes its pushes. A session's,
+* `…/threads/{n}/sessions/{m}/{repo}.git`, reads that session's current fork, and a fork's,
+* `…/threads/{n}/forks/{fork}/{repo}.git`, reads that fork when it holds thread `n`'s work, a
+* session's on it or a run's whose pull request is on it. Neither takes a push.
 */
 const ForkPath = Schema.String.check(Schema.isPattern(/^\/[^\s]+\.git$/), Schema.isMaxLength(512)).pipe(Schema.brand("ForkPath"));
 /** A session's fork's URL on the app's one origin: the one a notice names, and a clone pushes to. */
@@ -11793,17 +11804,21 @@ const ForkView = Schema.Struct({
 	/** On the app's one origin, whichever host was asked. */
 	url: ForkUrl
 });
-Schema.Struct({
+/**
+* For a reader that sees only threads it holds a grant on, those threads: a fork of a thread
+* stacked, at any depth, on any other is refused, since it holds that thread's work. Unset for one
+* that reads the project as a whole.
+*/
+const readerSees = { only: Schema.optionalKey(Schema.Array(ThreadId)) };
+Schema.Union([Schema.Struct({
 	session: SessionId,
-	fork: Schema.optionalKey(ForkId),
-	/**
-	* For a reader that sees only threads it holds a grant on, those threads: a fork of a thread
-	* stacked, at any depth, on any other is refused, since it holds that thread's work. Unset for
-	* one that reads the project as a whole.
-	*/
-	only: Schema.optionalKey(Schema.Array(ThreadId))
-});
-/** A session's fork in Artifacts, as Git reaches it: where it is, and which Git repository. */
+	...readerSees
+}), Schema.Struct({
+	fork: ForkId,
+	thread: ThreadId,
+	...readerSees
+})]);
+/** A fork in Artifacts, as Git reaches it: where it is, and which Git repository. */
 const ForkPlace = Schema.Struct({
 	...CurrentBaseline.fields,
 	gitRepository: GitRepositoryId
@@ -11834,19 +11849,16 @@ const SessionBase = Schema.Struct({
 	commit: CommitOid,
 	/**
 	* Where to fetch it from, on ref0's origin: the repo's own path, as `ref0 clone` cloned it, for
-	* `main`; for a stack, the path of the fork that holds the pin.
+	* `main`; for a stack, the path of the fork that holds the pin, by its ID under the thread below.
 	*/
 	path: Schema.String.check(Schema.isPattern(/^\/[^\s]+\.git$/), Schema.isMaxLength(512)),
 	/** `path` on the app's one origin. A client checks it's a fork of its own repo there. */
 	url: Schema.String,
 	ref: Schema.Literal("refs/heads/main")
 });
-/**
-* No base to fetch: `main` has no commit yet, or the pin of the thread below is in a workflow
-* run's fork, which has no session's path to fetch from.
-*/
+/** No base to fetch: `main` has no commit yet. */
 var NoBase = class extends Schema.TaggedError()("NoBase", {
-	why: Schema.Literals(["main empty", "held by a run"]),
+	why: Schema.Literal("main empty"),
 	nextStep: Schema.String
 }, { httpApiStatus: 404 }) {};
 Schema.Struct({
@@ -11864,15 +11876,14 @@ const BaseOnMain = Schema.Struct({
 	commit: CommitOid
 });
 /**
-* The base on the thread below, `lower`: its pin's commit, the fork that holds it, and that
-* fork's session, or none for a workflow run's fork.
+* The base on the thread below, `lower`: its pin's commit, and the fork that holds it, a session's
+* on that thread or a run's whose pull request is on it.
 */
 const BaseOnStack = Schema.Struct({
 	on: Schema.Literal("stack"),
 	lower: ThreadId,
 	commit: CommitOid,
-	fork: ForkId,
-	session: Schema.NullOr(SessionId)
+	fork: ForkId
 });
 Schema.Union([
 	BaseOnMain,
@@ -14978,6 +14989,11 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 	security: { bearer: HttpApiSecurity.bearer },
 	error: [Unauthenticated]
 }) {};
+/**
+* A machine's request whose name its contract refuses, answered as `CommandRefused`, which says
+* what to change. Any other part that fails its contract is answered with Effect's empty 400.
+*/
+var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
 const idempotency = { "idempotency-key": RequestId };
 const inProject$1 = {
 	owner: OwnerRef,
@@ -15101,7 +15117,7 @@ var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachment
 		SlowDown,
 		AuthorityUnavailable
 	]
-}), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
+}).middleware(MachineNameRefusal), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
 	params: { approval: ApprovalId },
 	payload: Schema.Struct({ answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64))) }),
 	success: RequestState,
@@ -18321,11 +18337,29 @@ const CodexProfile = Schema.Struct({
 	])))),
 	network: Schema.optionalKey(Schema.NullOr(Schema.Struct({ enabled: Schema.optionalKey(Schema.NullOr(Schema.Boolean)) })))
 });
-/** `config/read`'s result, as much of it as ref0 reads: the default profile, and the profiles. */
-const CodexConfigRead = Schema.Struct({ config: Schema.Struct({
-	default_permissions: Schema.optionalKey(Schema.NullOr(Schema.String)),
-	permissions: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, CodexProfile)))
-}) });
+/** Codex applies excludes before `set`, then applies either form of allowlist after it. */
+const CodexShellEnvironment = Schema.Struct({
+	set: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, Schema.String))),
+	exclude: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.String))),
+	include_only: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.String))),
+	filters: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, Schema.Literals(["include", "exclude"]))))
+});
+/** The permission and environment policies, with user-layer versions and raw policy for rollback. */
+const CodexConfigRead = Schema.Struct({
+	config: Schema.Struct({
+		default_permissions: Schema.optionalKey(Schema.NullOr(Schema.String)),
+		permissions: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, CodexProfile))),
+		shell_environment_policy: Schema.optionalKey(Schema.NullOr(CodexShellEnvironment))
+	}),
+	layers: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.Struct({
+		name: Schema.Struct({
+			type: Schema.String,
+			file: Schema.optionalKey(Schema.String)
+		}),
+		version: Schema.String,
+		config: Schema.optionalKey(Schema.Struct({ shell_environment_policy: Schema.optionalKey(Schema.Record(Schema.String, Schema.Json)) }))
+	}))))
+});
 /**
 * `config/batchWrite`'s result, as much of it as ref0 holds Codex to: that it wrote, and whether
 * a layer above the person's own config overrides what it wrote.
@@ -18581,12 +18615,15 @@ const CommandHookInput = Schema.Struct({
 });
 /**
 * `SessionStart`'s input, as far as ref0 reads it: the session, where it started, and why
-* (`startup`, `resume`, `clear` or `compact`, which both harnesses send).
+* (`startup`, `resume`, `clear` or `compact`, which both harnesses send); and, for the trailer
+* on the agent's commits, its transcript and the model it started with, which Claude Code sends.
 */
 const SessionStartHookInput = Schema.Struct({
 	session_id: HarnessSessionId,
 	cwd: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 4096))),
-	source: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 32)))
+	source: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 32))),
+	transcript_path: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	model: Schema.optionalKey(Schema.NullOr(Schema.String))
 });
 /**
 * A frame on Claude Code's own inbox socket, as `ref0 mcp` writes one, a line each: the token
@@ -19063,7 +19100,7 @@ const minute = (at) => `${DateTime.formatIso(at).slice(0, 16).replace("T", " ")}
 const styled = (text, code, terminal) => terminal ? `\u001b[${code}m${printable(text)}\u001b[0m` : printable(text);
 const renderLine = (line, terminal) => {
 	if (Predicate.isString(line)) return printable(line);
-	if ("label" in line) return styled(line.label, 1, terminal) + (line.text ? ` ${printable(line.text)}` : "");
+	if ("label" in line) return (line.before ? `${printable(line.before)} ` : "") + styled(line.label, 1, terminal) + (line.text ? ` ${printable(line.text)}` : "");
 	if ("command" in line) return printable(line.command).split("\n").map((part) => `  ${part}`).join("\n");
 	if (line.status === "unknown") return `? unknown  ${printable(line.text)}`;
 	return `${line.status === "yes" ? styled("✓", 32, terminal) : styled("✗", 31, terminal)} ${line.status}  ${printable(line.text)}`;
@@ -19074,6 +19111,14 @@ const renderBlocks = (blocks, stream) => {
 };
 /** Words go to stderr by default; a command's answer goes to stdout. */
 const printBlocks = (blocks, stream = "stderr") => Effect.sync(() => renderBlocks(blocks, stream)).pipe(Effect.flatMap((text) => stream === "stdout" ? Console.log(text) : Console.error(text)));
+/**
+* A yes-or-no question as the terminal shows it, bold, then `(y/N)`: no unless the person says
+* yes. The cursor stays after it, for their answer.
+*/
+const questionLine = (question) => `${renderBlocks([[{
+	label: question,
+	text: "(y/N)"
+}]], "stdout")} `;
 /** Keep explicit line breaks and wrap between words within the available columns. */
 const wrapWords = (text, width) => text.split("\n").flatMap((line) => {
 	const wrapped = [];
@@ -19142,6 +19187,25 @@ const accountCommands = [Command.make("whoami", { json }, ({ json: asJson }) =>
 	yield* printAnswer(answer.json, asJson, me.agent === void 0 ? `You, as ${me.actor.id}.` : `Agent ${me.agent.id}, in session ${me.session?.session ?? "none"}.`);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Who’s acting, and what they hold"), Command.withShortDescription("Show who’s acting and what they hold"))];
 //#endregion
+//#region ../model/src/agent-commits.ts
+/**
+* How an agent's commits name it as their author: `pip/claude <agent_…@ref0.work>`. The person
+* stays the committer, with their own signature. Git keeps every commit for good, and anyone
+* who reads the repo reads its author, so these name the agent and nothing about its sessions.
+*/
+/** The domain of every agent's commit email, which tells an agent's commits from a person's. */
+const agentCommitDomain = "ref0.work";
+/**
+* An agent's commit email: built from its agent ID alone, so it never changes, and never passes
+* to another agent. Nobody reads mail there.
+*/
+const agentCommitEmail = (agent) => `${agent}@${agentCommitDomain}`;
+/**
+* An agent's name as its commits' author: its owner, then its handle, as commands write it. A
+* handle renamed later stays as it was in the commits made before.
+*/
+const agentCommitName = (owner, handle) => `${owner}/${handle}`;
+//#endregion
 //#region ../model/src/cut-text.ts
 /**
 * `text` within `max` as a `Schema`'s length counts it, in UTF-16 code units: whole code points
@@ -19422,13 +19486,74 @@ function freeTextProblem(text, maxCharacters) {
 //#endregion
 //#region ../model/src/git-paths.ts
 /**
-* A session's fork's path: an owner, a project for a project's thread and none for an org
-* thread's, a thread, a session when it names one and the source fork when that names one too, a
-* repo, and what Git asks for. The two thread forms never read alike: after `threads` comes a
-* number on an org thread's, and the word `threads` on a project's, so a project named `threads`
-* keeps its forks. Nor do the two fork forms: a repo's name holds no `/`.
+* A fork's path: an owner, a project for a project's thread and none for an org thread's, a
+* thread, then a session or a fork by its ID when it names one, a repo, and what Git asks for.
+* The two thread forms never read alike: after `threads` comes a number on an org thread's, and
+* the word `threads` on a project's, so a project named `threads` keeps its forks. Nor do the three
+* fork forms: a repo's name holds no `/`.
+*/
+const forkPath = /^\/([^/]+)(?:\/([^/]+))?\/threads\/([1-9]\d{0,9})(?:\/sessions\/([1-9]\d{0,9})|\/forks\/(fork_[a-z0-9]+))?\/([^/]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+//#endregion
+//#region ../model/src/path-glob.ts
+/** Charges `cells` to the budget: whether it had them. */
+const spend = (budget, cells) => {
+	budget.left -= cells;
+	return budget.left >= 0;
+};
+/**
+* Whether one segment matches one segment pattern, `*` and `?` within it; none once the budget
+* runs out.
+*/
+function segmentMatches(pattern, segment, budget) {
+	const characters = Array.from(segment);
+	const width = characters.length + 1;
+	let reach = new Uint8Array(width);
+	let next = new Uint8Array(width);
+	reach[0] = 1;
+	for (const symbol of pattern) {
+		if (!spend(budget, width)) return void 0;
+		next.fill(0);
+		if (symbol === "*") {
+			let any = 0;
+			for (let j = 0; j < width; j += 1) {
+				any |= reach[j] ?? 0;
+				next[j] = any;
+			}
+		} else for (let j = 1; j < width; j += 1) next[j] = (reach[j - 1] ?? 0) & (symbol === "?" || characters[j - 1] === symbol ? 1 : 0);
+		[reach, next] = [next, reach];
+	}
+	return reach[width - 1] === 1;
+}
+/**
+* Whether `path`, a repo path like `src/a.ts`, matches `pattern`, within `budget`: none once it
+* runs out.
 */
-const forkPath = /^\/([^/]+)(?:\/([^/]+))?\/threads\/([1-9]\d{0,9})(?:\/sessions\/([1-9]\d{0,9})(?:\/forks\/(fork_[a-z0-9]+))?)?\/([^/]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
+function pathMatchesWithin(pattern, path, budget) {
+	const parts = pattern.split("/");
+	const segments = path.split("/");
+	const width = segments.length + 1;
+	let reach = new Uint8Array(width);
+	let next = new Uint8Array(width);
+	reach[0] = 1;
+	for (const part of parts) {
+		if (!spend(budget, width)) return void 0;
+		next.fill(0);
+		if (part === "**") {
+			let any = 0;
+			for (let j = 0; j < width; j += 1) {
+				any |= reach[j] ?? 0;
+				next[j] = any;
+			}
+		} else for (let j = 1; j < width; j += 1) {
+			if (reach[j - 1] !== 1) continue;
+			const matched = segmentMatches(part, segments[j - 1] ?? "", budget);
+			if (matched === void 0) return void 0;
+			next[j] = matched ? 1 : 0;
+		}
+		[reach, next] = [next, reach];
+	}
+	return reach[width - 1] === 1;
+}
 //#endregion
 //#region ../model/src/thread-workflows.ts
 const minuteMillis = 6e4;
@@ -20340,6 +20465,19 @@ const watchVariables = {
 	event: "REF0_EVENT",
 	title: "REF0_TITLE"
 };
+/**
+* What ref0 puts in the environment of an agent's commands for its commits, beside Git's own
+* author variables: for the trailer, the harness, the session's transcript, whose last model it
+* names, and the model the session started with, for a transcript that names none; and what a
+* forwarder in ref0's hooks folder sets for the repo's own hook it runs, so a forwarder that hook
+* reaches forwards nothing.
+*/
+const gitHookVariables = {
+	harness: "REF0_HARNESS",
+	transcript: "REF0_TRANSCRIPT",
+	model: "REF0_MODEL",
+	forwarded: "REF0_GIT_HOOK"
+};
 //#endregion
 //#region src/harness/plugin-files.ts
 /**
@@ -20814,11 +20952,16 @@ const connectLineFor = Effect.fnUntraced(function* (harness, configFolder) {
 });
 //#endregion
 //#region src/host-grant.ts
-/** All lasting authority for one config folder, stored as one keychain value. */
+/**
+* All lasting authority for one config folder, stored as one keychain value: the agent the folder
+* acts as, by its owner, handle and agent ID, and its token. The ID is kept in the same write as
+* the token, so a folder with a grant always knows which agent its commits name.
+*/
 const KeptHostGrant = Schema.Struct({
 	harness: ConnectHarness,
 	owner: OwnerName,
 	agent: AgentHandle,
+	agentId: AgentId,
 	token: Schema.RedactedFromValue(Schema.String)
 });
 const decodeGrant = Schema.decodeUnknownOption(Schema.fromJsonString(KeptHostGrant));
@@ -20865,7 +21008,7 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.7.0";
+const cliVersion = "0.9.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -20909,8 +21052,9 @@ const updateLine = (plugin, reinstall) => Option.map(protocolMismatch(plugin, re
 //#region src/machine.ts
 /**
 * This machine, as ref0 knows it: an ID made once and kept in ref0's config, `machine` under
-* `$XDG_CONFIG_HOME/ref0` or `~/.config/ref0`, and its own name for itself, which ref0 shows
-* the person as what it says. Neither is a secret, and neither is proof of anything.
+* `$XDG_CONFIG_HOME/ref0` or `~/.config/ref0`, and its host name, from which `ref0 connect` makes
+* the name ref0 shows the person as what it says. Neither is a secret, and neither is proof of
+* anything.
 */
 var MachineError = class extends Schema.TaggedError()("MachineError", { nextStep: Schema.String }) {};
 const decodeMachineId = Schema.decodeUnknownOption(MachineId);
@@ -20938,10 +21082,10 @@ var Machine = class Machine extends Context.Service()("ref0/cli/Machine") {
 				onSome: Effect.succeed
 			}));
 		});
-		const name = (yield* Effect.sync(() => hostname())).slice(0, 64) || "this machine";
+		const hostName = yield* Effect.sync(() => hostname());
 		return Machine.of({
 			id,
-			name
+			hostName
 		});
 	}));
 };
@@ -21020,14 +21164,98 @@ var OldHostGrants = class OldHostGrants extends Context.Service()("ref0/cli/OldH
 	}));
 };
 //#endregion
+//#region src/yes-or-no.ts
+/**
+* How long what a terminal held while nobody read it takes to arrive once a question reads: one
+* read, well within this.
+*/
+const settle = Duration.millis(50);
+const again$2 = "Type y or yes, or n or no. Enter alone is no.";
+/** A line's answer, or none when it's neither yes nor no. */
+const answerOf$1 = (line) => {
+	const word = line.trim().toLowerCase();
+	if (word === "y" || word === "yes") return Option.some(true);
+	if (word === "" || word === "n" || word === "no") return Option.some(false);
+	return Option.none();
+};
+/** What Backspace takes back: one character as the person sees it, an emoji's parts included. */
+const characters = new Intl.Segmenter();
+/** `typed` with Backspace pressed once. */
+const takeBack = (typed) => typed.slice(0, [...characters.segment(typed)].at(-1)?.index);
+/** Whether a key types text: none of its characters moves the cursor or controls the terminal. */
+const typesText = (text) => text !== "" && !/\p{Cc}/u.test(text);
+/** Ctrl-C or Ctrl-D, which a terminal in raw mode hands ref0 as keys, never as a signal. */
+const quits = (key) => key.ctrl && (key.name === "c" || key.name === "d");
+/** The explanation goes to stderr, the question to stdout and its answer comes from stdin. */
+const allTerminals = () => process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
+/**
+* Asks yes-or-no questions in this terminal, one after another: each shows `explained` on stderr,
+* then the question, and waits for a line. What was typed before a question showed doesn't answer
+* it, unless another question was asked when it arrived: a line typed after the one that answered
+* a question answers the next. The answer is no, unasked, unless stdin, stdout and stderr are each
+* a terminal, and on Ctrl-C or Ctrl-D.
+*/
+const yesOrNoQuestions = Effect.gen(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const ahead = yield* Ref.make([]);
+	const ask = (explained, question) => Effect.gen(function* () {
+		if (!allTerminals()) return false;
+		const keys = yield* terminal.readInput;
+		yield* Effect.sleep(settle);
+		yield* Queue.clear(keys);
+		const pending = [...yield* Ref.getAndSet(ahead, [])];
+		const next = Effect.suspend(() => {
+			const key = pending.shift();
+			return key === void 0 ? Queue.take(keys) : Effect.succeed(key);
+		});
+		yield* printBlocks([explained]);
+		yield* terminal.display(questionLine(question));
+		let typed = "";
+		let previous = "";
+		while (true) {
+			const pressed = yield* Effect.option(next);
+			if (Option.isNone(pressed) || quits(pressed.value.key)) {
+				yield* terminal.display("\n");
+				return false;
+			}
+			const { input, key } = pressed.value;
+			const ended = key.name === "enter" && previous === "return";
+			previous = key.name;
+			if (ended) continue;
+			if (key.name === "backspace") {
+				if (typed === "") continue;
+				typed = takeBack(typed);
+				yield* terminal.display("\b \b");
+				continue;
+			}
+			if (key.name !== "return" && key.name !== "enter") {
+				const text = Option.getOrElse(input, () => "");
+				if (!typesText(text)) continue;
+				typed += text;
+				yield* terminal.display(text);
+				continue;
+			}
+			yield* terminal.display("\n");
+			const answer = answerOf$1(typed);
+			if (Option.isSome(answer)) {
+				const rest = [...pending, ...yield* Queue.clear(keys)];
+				const ended = key.name === "return" && rest[0]?.key.name === "enter";
+				yield* Ref.set(ahead, ended ? rest.slice(1) : rest);
+				return answer.value;
+			}
+			typed = "";
+			yield* terminal.display(`${again$2}\n${questionLine(question)}`);
+		}
+	}).pipe(Effect.scoped, Effect.orElseSucceed(() => false));
+	return ask;
+});
+//#endregion
 //#region src/attachment-request.ts
 /**
 * The machine prints its link and Find code, then collects with its own secret and the answer
 * from the approving browser. It keeps and confirms each folder's grant before installing.
 */
 const isAnswerCode = Schema.is(TypedApprovalCode);
-/** A key's escape code, such as an arrow's, as a terminal sends it. */
-const escapeCode = /\u001b\[[\d;]*[A-Za-z~]/gu;
 const decodeTokenId$1 = Schema.decodeUnknownOption(TokenId);
 const decodeSecretHash$1 = Schema.decodeUnknownEffect(SecretHash);
 /** How often the machine asks whether its person has answered. */
@@ -21052,6 +21280,19 @@ const keepBudget = Duration.minutes(5);
 /** A request that couldn't finish: no answer in time, no connection, or ref0 briefly unable. */
 var Unanswered = class extends Schema.TaggedError()("Unanswered", {}) {};
 const unanswered = () => Effect.fail(new Unanswered());
+/**
+* The name the machine sends for itself: its host name without any character that could reorder
+* or hide what's around it, cut to 64 characters without splitting one in two, or `this machine`
+* when that leaves none.
+*/
+const machineNameOf = (hostName) => {
+	let name = "";
+	for (const character of withoutHiddenCharacters(hostName).trim()) {
+		if (name.length + character.length > 64) break;
+		name += character;
+	}
+	return name || "this machine";
+};
 /** A refusal ref0 gave, said as it gave it. */
 const said = (refusal) => sayFailed(refusal.nextStep);
 const isEnded = (state) => state.state !== "waiting";
@@ -21079,6 +21320,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const hostGrant = yield* HostGrant;
 	const oldGrants = yield* OldHostGrants;
 	const http = yield* HttpClient.HttpClient;
+	const terminal = yield* Terminal.Terminal;
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	const collecting = yield* freshSecret;
 	const link = yield* freshLinkSecret;
@@ -21111,7 +21353,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	}));
 	const payload = {
 		machine: machineId,
-		machineName: machine.name,
+		machineName: machineNameOf(machine.hostName),
 		folders,
 		collectHash: yield* Effect.orDie(decodeSecretHash$1(collecting.hash)),
 		linkHash: yield* Effect.orDie(decodeSecretHash$1(link.hash))
@@ -21134,12 +21376,20 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		while: Predicate.isTagged("Unanswered"),
 		times: 2
 	}), Effect.catchTag("Unanswered", unreachable));
-	yield* Console.error([
+	yield* printBlocks([[
 		`Open ${config.api}/connect#${link.secret}`,
-		`Or type ${started.code} in Find under Waiting on you, by ${minute(started.expiresAt)}.`,
+		{
+			before: "Or type",
+			label: started.code,
+			text: `in Find under Waiting on you, by ${minute(started.expiresAt)}.`
+		},
 		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for each agent it connects.",
 		"Waiting for the answer. Ctrl-C stops it."
-	].join("\n"));
+	]]);
+	let typed = "";
+	const show = (text) => Effect.ignore(terminal.display(text));
+	const endWait = yield* Effect.cached(Effect.suspend(() => typed === "" ? Effect.void : show("\n")).pipe(Effect.andThen(Console.error(""))));
+	const saidAfterWait = (refusal) => Effect.andThen(endWait, said(refusal));
 	if (opener !== void 0) yield* openBrowser(opener, `${config.api}/connect#${link.secret}`);
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
 	const collector = yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http));
@@ -21151,8 +21401,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		duration: requestTimeout,
 		orElse: () => Effect.succeedNone
 	}), Effect.catchTags({
-		AttachmentNotFound: said,
-		Unauthenticated: said,
+		AttachmentNotFound: saidAfterWait,
+		Unauthenticated: saidAfterWait,
 		AuthorityUnavailable: () => Effect.succeedNone,
 		HttpClientError: () => Effect.succeedNone,
 		SchemaError: () => Effect.succeedNone
@@ -21162,7 +21412,10 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		while (true) {
 			const state = yield* collect;
 			if (Option.isSome(state) && isEnded(state.value)) return state.value;
-			if ((yield* Clock.currentTimeMillis) > giveUpAt) return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$1}`);
+			if ((yield* Clock.currentTimeMillis) > giveUpAt) {
+				yield* endWait;
+				return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$1}`);
+			}
 			yield* Effect.sleep(pollMillis);
 		}
 	});
@@ -21174,6 +21427,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			harness: folder.harness,
 			owner: connection.owner,
 			agent: connection.handle,
+			agentId: connection.agent.id,
 			token: Redacted.make(token)
 		}).pipe(Effect.timeoutOrElse({
 			duration: Duration.min(keepTimeout, Duration.millis(left)),
@@ -21291,23 +21545,42 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		const connected = yield* finish(isEnded(state) ? state : yield* answered);
 		yield* printBlocks([[{ label: `Connected as ${connected.owner}’s agents` }, ...connected.kept.map((folder) => `${shownConfigFolder(home, folder.configFolder)}  ${folder.handle}`)], ["Stopped, so nothing was installed. To install ref0’s plugin into each, run:", ...connected.kept.map((folder) => ({ command: installLine(folder.configFolder) }))]]);
 	});
-	const terminal = yield* Terminal.Terminal;
-	const readAnswer = Effect.gen(function* () {
-		yield* Console.error(`Paste the code from your own page on ${config.api}.`);
+	const typedCode = Effect.gen(function* () {
+		const keys = yield* terminal.readInput;
 		while (true) {
-			const typed = (yield* terminal.readLine).replaceAll(escapeCode, "").trim();
-			if (typed === "") continue;
-			if (!isAnswerCode(typed)) {
-				yield* Console.error(`Paste the 8-character code from your own page on ${config.api}.`);
+			const pressed = yield* Effect.option(Queue.take(keys));
+			if (Option.isNone(pressed) || quits(pressed.value.key)) return yield* Effect.interrupt;
+			const { input, key } = pressed.value;
+			if (key.name === "backspace") {
+				if (typed === "") continue;
+				typed = takeBack(typed);
+				yield* show("\b \b");
 				continue;
 			}
-			yield* Ref.update(pasted, (first) => first ?? typed);
-			if (listener !== void 0) yield* listener.stop;
-			return yield* Effect.never;
+			if (key.name !== "return" && key.name !== "enter") {
+				const text = Option.getOrElse(input, () => "");
+				if (!typesText(text)) continue;
+				typed += text;
+				yield* show(text);
+				continue;
+			}
+			const line = typed.trim();
+			if (typed !== "") yield* show("\n");
+			typed = "";
+			if (line === "") continue;
+			if (isAnswerCode(line)) return line;
+			yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
 		}
-	}).pipe(Effect.catchTag("QuitError", () => Effect.interrupt));
+	}).pipe(Effect.scoped);
+	const readAnswer = Effect.gen(function* () {
+		yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
+		const code = yield* typedCode;
+		yield* Ref.update(pasted, (first) => first ?? code);
+		if (listener !== void 0) yield* listener.stop;
+		return yield* Effect.never;
+	});
 	const receiveAnswer = listener === void 0 ? readAnswer : Effect.raceFirst(readAnswer, listener.answer.pipe(Effect.flatMap((code) => Ref.update(pasted, (first) => first ?? code)), Effect.andThen(Effect.never)));
-	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
+	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.ensuring(endWait), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
 }, Effect.scoped);
 //#endregion
 //#region src/connect-lock.ts
@@ -21442,140 +21715,1523 @@ var ConnectLock = class ConnectLock extends Context.Service()("ref0/cli/ConnectL
 	}));
 };
 //#endregion
-//#region src/harness/install-claude-code.ts
-/** Install into one config folder, from the release Claude Code fetched and ref0 checked. */
-const installClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
-	const run = yield* release.into(configFolder);
-	yield* run([
-		"plugin",
-		"install",
-		release.id,
-		"--scope",
-		"user"
-	]);
-	yield* run([
-		"plugin",
-		"update",
-		release.id,
-		"--scope",
-		"user"
-	]);
-	return release.folder;
-});
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function getLineColFromPtr(string, ptr) {
+	let lines = string.slice(0, ptr).split(/\r?\n/);
+	return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+	let lines = string.split(/\r?\n/);
+	let codeblock = "";
+	let numberLen = (Math.log10(line + 1) | 0) + 1;
+	for (let i = line - 1; i <= line + 1; i++) {
+		let l = lines[i - 1];
+		if (!l) continue;
+		codeblock += i.toString().padEnd(numberLen, " ");
+		codeblock += ":  ";
+		codeblock += l;
+		codeblock += "\n";
+		if (i === line) {
+			codeblock += " ".repeat(numberLen + column + 2);
+			codeblock += "^\n";
+		}
+	}
+	return codeblock;
+}
+var TomlError = class TomlError extends Error {
+	line;
+	column;
+	codeblock;
+	constructor(message, options) {
+		const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+		const codeblock = makeCodeBlock(options.toml, line, column);
+		super(`Invalid TOML document: ${message}\n\n${codeblock}`, options);
+		this.line = line;
+		this.column = column;
+		this.codeblock = codeblock;
+	}
+	/** @internal */
+	static x(message, ctx, ptr) {
+		throw new TomlError(message, {
+			toml: ctx.s,
+			ptr: ptr ?? ctx.p
+		});
+	}
+};
 //#endregion
-//#region src/harness/hook-fields.ts
-/**
-* The same for Codex 0.160.0, which skips a hook outright if its template names a field the event
-* lacks, so each list holds only fields every hook of its event carried in the prototypes, and
-* only events they saw, each a `HookEvent`. Codex puts the model in every hook but `SessionEnd`.
-* Its `UserPromptSubmit` carries the prompt (`spikes/harness/results/codex/catalog.json`), which
-* no list names, as for Claude Code.
-* Every Codex hook carries `transcript_path`, the session's rollout, `null` for a session kept
-* nowhere (Codex's hook input schemas, 0.160.0 to 0.163.0): its turns' tokens are read there.
-* A subagent's are read from its own rollout, which its `SubagentStop` names, with the
-* subagent's own turn as its `turn_id` (Codex 0.163.0's subagents, 20 Oct 2026).
-*/
-const codexHookFields = {
-	UserPromptSubmit: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"transcript_path"
-	],
-	PreToolUse: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"tool_name",
-		"tool_use_id",
-		"tool_input"
-	],
-	PostToolUse: [
-		"session_id",
-		"turn_id",
-		"cwd",
-		"model",
-		"tool_name",
-		"tool_use_id",
-		"tool_input",
-		"tool_response"
-	],
-	Stop: [
-		"session_id",
-		"turn_id",
-		"model",
-		"stop_hook_active",
-		"transcript_path"
-	],
-	SubagentStop: [
-		"session_id",
-		"turn_id",
-		"agent_id",
-		"agent_type",
-		"stop_hook_active",
-		"agent_transcript_path"
-	]
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/primitive.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseString(ctx) {
+	let startPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p++);
+	let first = c;
+	let isLiteral = c === 39;
+	let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+	if (isMultiline) {
+		if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10) ctx.p++;
+		else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) ctx.p += 2;
+	}
+	let parsed = "";
+	let sliceStart = ctx.p;
+	let state = 0;
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		c = ctx.s.charCodeAt(ctx.p);
+		if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) state = state && 3;
+		else if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in strings", ctx);
+		else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+			if (isMultiline) {
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+			}
+			if (!state) {
+				let s = ctx.s.slice(sliceStart, ctx.p);
+				parsed = parsed ? parsed + s : s;
+			}
+			ctx.p += isMultiline ? 3 : 1;
+			return parsed;
+		} else if (!state) {
+			if (!isLiteral && c === 92) {
+				parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+				state = 1;
+			}
+		} else if (state === 1) {
+			if (c === 120 || c === 117 || c === 85) {
+				let errPtr = ctx.p++ - 1;
+				let value = 0;
+				let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+				for (let j = 0; j < len; j++, ctx.p++) {
+					let hex = ctx.s.charCodeAt(ctx.p);
+					let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
+					if (digit < 0) TomlError.x("invalid non-hex character in unicode escape", ctx);
+					value = value << 4 | digit;
+				}
+				if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) TomlError.x("invalid unicode escape", ctx, errPtr);
+				parsed += String.fromCodePoint(value);
+				sliceStart = ctx.p--;
+				state = 0;
+			} else if (isMultiline && (c === 32 || c === 9)) state = 2;
+			else {
+				if (c === 98) parsed += "\b";
+				else if (c === 116) parsed += "	";
+				else if (c === 110) parsed += "\n";
+				else if (c === 102) parsed += "\f";
+				else if (c === 114) parsed += "\r";
+				else if (c === 101) parsed += "\x1B";
+				else if (c === 34) parsed += "\"";
+				else if (c === 92) parsed += "\\";
+				else TomlError.x("unrecognised escape sequence", ctx);
+				sliceStart = ctx.p + 1;
+				state = 0;
+			}
+		} else if (c !== 32 && c !== 9) {
+			if (state === 2) TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+			state = !isLiteral && c === 92 ? 1 : 0;
+			sliceStart = ctx.p;
+		}
+	}
+	TomlError.x("unfinished string", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/date.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class TomlDate extends Date {
+	#hasDate = false;
+	#hasTime = false;
+	#offset = null;
+	constructor(date, fasttype, unsafeDelim) {
+		let hasDate = true;
+		let hasTime = true;
+		let offset = "Z";
+		let c;
+		if (typeof date === "string") {
+			if (fasttype) prep: {
+				if (fasttype < 3) {
+					if (+date.slice(11, 13) > 23) {
+						date = "";
+						break prep;
+					}
+					if (fasttype === 2) {
+						offset = null;
+						date += "Z";
+					} else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) offset = date.slice(date.length - 6);
+					if (unsafeDelim) date = date.slice(0, 10) + "T" + date.slice(11);
+				} else if (fasttype === 4) date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+				hasDate = fasttype !== 4;
+				hasTime = fasttype !== 3;
+			}
+			else {
+				let match = date.match(DATE_TIME_RE);
+				if (match) {
+					if (!match[1]) {
+						hasDate = false;
+						date = `0000-01-01T${date}`;
+					}
+					hasTime = !!match[2];
+					hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+					if (match[2] && +match[2] > 23) date = "";
+					else {
+						offset = match[3] || null;
+						if (!offset && hasTime) date += "Z";
+					}
+				} else date = "";
+			}
+		}
+		super(date);
+		if (!isNaN(this.getTime())) {
+			this.#hasDate = hasDate;
+			this.#hasTime = hasTime;
+			this.#offset = offset;
+		}
+	}
+	isDateTime() {
+		return this.#hasDate && this.#hasTime;
+	}
+	isLocal() {
+		return !this.#hasDate || !this.#hasTime || !this.#offset;
+	}
+	isDate() {
+		return this.#hasDate && !this.#hasTime;
+	}
+	isTime() {
+		return this.#hasTime && !this.#hasDate;
+	}
+	isValid() {
+		return this.#hasDate || this.#hasTime;
+	}
+	toISOString() {
+		let iso = super.toISOString();
+		if (this.isDate()) return iso.slice(0, 10);
+		if (this.isTime()) return iso.slice(11, 23);
+		if (this.#offset === null) return iso.slice(0, -1);
+		if (this.#offset === "Z" || this.#offset === "z") return iso;
+		let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+		offset = this.#offset[0] === "-" ? offset : -offset;
+		return (/* @__PURE__ */ new Date(this.getTime() - offset * 6e4)).toISOString().slice(0, -1) + this.#offset;
+	}
+	static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+		let date = new TomlDate(jsDate);
+		date.#offset = offset;
+		return date;
+	}
+	static wrapAsLocalDateTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalDate(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasTime = false;
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasDate = false;
+		date.#offset = null;
+		return date;
+	}
 };
-Schema.encodeSync(Schema.fromJsonString(CodexPluginManifest));
-/** How Codex names a plugin's MCP server in an `mcp_tool` hook. */
-const codexServer = "ref0";
-/** Codex's hooks file, by its path inside the plugin. */
-const codexHooksPath = "hooks/codex-hooks.json";
-({ ...mcpToolHooks(codexServer, codexHookFields) });
-/**
-* The folder of Codex's skills, by its path inside the plugin. Not `skills`, which Claude Code
-* reads too, where a `status` skill would be a second status command. Codex 0.163.0 skips
-* Claude Code's `commands/status.md`, since its `!` line is a template it can't run.
-*/
-const codexSkillsPath = "codex-skills";
-/** The status skill, by its path inside the plugin. */
-const codexStatusSkillPath = `${codexSkillsPath}/status/SKILL.md`;
-/**
-* How a person runs the status skill of a plugin installed as `name`: Codex 0.163.0 names a
-* plugin's skill by the plugin, then the skill.
-*/
-const codexStatusShortcut = (name) => `$${name}:status`;
-/** The skill's placeholder for the plugin's folder, which Codex's agent fills in. */
-const pluginFolder = "<plugin>";
-/** What the status skill runs: `ref0 status`, through the plugin's lookup script. */
-const codexStatusLine = throughLookup([harnessCommandNames.status]).replaceAll(pluginRoot, pluginFolder);
-[
-	"---",
-	"name: status",
-	`description: Shows whether ref0 follows this Codex session, and what to do next if it doesn’t. Use when the person runs ${codexStatusShortcut("ref0")} or asks whether ref0 is working.`,
-	"---",
-	"",
-	"Run ref0’s check and show the person what it says.",
-	"",
-	`1. This file is \`${pluginFolder}/${codexSkillsPath}/status/SKILL.md\`. Run this command, with \`${pluginFolder}\` replaced by that folder’s absolute path:`,
-	"",
-	"   ```sh",
-	`   ${codexStatusLine}`,
-	"   ```",
-	"",
-	"   Run it outside Codex’s sandbox, with `sandbox_permissions: \"require_escalated\"`, since in the sandbox it can’t ask Codex, this machine’s keychain or ref0. If that isn’t allowed, run it in the sandbox.",
-	"2. Show every line it prints as it is, and add nothing. It exits 1 when a line says no: that’s its answer, not an error to fix.",
-	""
-].join("\n");
 //#endregion
-//#region src/harness/origin-plugin.ts
-const manifestJson = Schema.fromJsonString(PluginManifest);
-const codexJson = Schema.fromJsonString(CodexPluginManifest);
-const marketJson = Schema.fromJsonString(PluginMarketplace);
-const hooksJson = Schema.fromJsonString(HooksFile);
-/**
-* Keep the checked release under this origin's own marketplace and plugin identity, with its
-* hooks, server and Codex status skill named for it.
-*/
-const keepOriginPlugin = Effect.fnUntraced(function* (source, home) {
-	const fs = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const { api } = yield* Ref0Config;
-	const name = yield* originPluginName(api);
-	const directory = path.join(home, ".ref0", "origins", originKey(api), "plugins");
-	yield* fs.makeDirectory(directory, {
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/extract.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function isDigit(char, base = 10) {
+	return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+	return char === 32 || char === 9 || char === 10 || char === 13 || delim && (char === delim || char === 44) || char === 35;
+}
+/** @internal */
+function extractValue(ctx, end) {
+	let errPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p);
+	if (c === 91 || c === 123) {
+		ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+		let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+		ctx.d++;
+		return value;
+	}
+	if (c === 34 || c === 39) return parseString(ctx);
+	if (c === 116) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, true;
+	}
+	if (c === 102) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, false;
+	}
+	if (c === 43 || c === 45) return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+	if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) return parseDate(ctx, c, end);
+	if (ctx.s.charCodeAt(ctx.p + 2) === 58) return parseTime(ctx, c, end);
+	return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+	let c = startChr;
+	let state = 0;
+	let hasUnderscores = false;
+	if (c === 105) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, (sign || 1) / 0;
+	}
+	if (c === 110) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, NaN;
+	}
+	if (c === 48) {
+		if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr)) return ctx.bi === true ? 0n : 0;
+		if (!sign) {
+			if (c === 120) return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+			else if (c === 98) return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+			else if (c === 111) return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+		}
+		if (c === 46) state = 2;
+		else if (c === 101 || c === 69) state = 4;
+		else TomlError.x("illegal leading zero", ctx, startPtr);
+	} else if (!isDigit(c)) TomlError.x("invalid value", ctx, startPtr);
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+		if (!state) state = 1;
+		if (c === 95) {
+			if (!(state & 1)) TomlError.x("illegal underscore", ctx);
+			state += 11;
+			hasUnderscores = true;
+		} else if (state === 1 && c === 46) state = 2;
+		else if ((state === 1 || state === 3) && (c === 101 || c === 69)) state = 4;
+		else if (state === 4 && (c === 43 || c === 45)) state = 6;
+		else if (!isDigit(c)) TomlError.x(`illegal character in numeric literal`, ctx);
+		else if (state > 9) state -= 11;
+		else if (!(state & 1)) state++;
+	}
+	if (!state) {
+		let val = (startChr - 48) * (sign || 1);
+		return ctx.bi === true ? BigInt(val) : val;
+	}
+	if (!(state & 1)) TomlError.x("unfinished numeric value", ctx, startPtr);
+	let str = ctx.s.slice(startPtr, ctx.p);
+	if (hasUnderscores) str = str.replaceAll("_", "");
+	return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+	let c, underscore = 1;
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) if (c === 95) {
+		if (underscore & 1) TomlError.x("illegal underscore", ctx);
+		underscore = 3;
+	} else if (!isDigit(c, base)) TomlError.x(`illegal character in numeric literal`, ctx);
+	else if (underscore & 1) underscore--;
+	if (underscore & 1) TomlError.x("unfinished numeric value", ctx);
+	let str = ctx.s.slice(startPtr + 2, ctx.p);
+	if (underscore) str = str.replaceAll("_", "");
+	return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+	if (ctx.bi !== true) int: {
+		let val = parseInt(str, base);
+		if (!Number.isSafeInteger(val)) {
+			if (ctx.bi) break int;
+			TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+		}
+		return val;
+	}
+	return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+	let startPtr = ctx.p++, unsafeSeparator;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+	ctx.p += 5;
+	if (!isDigit(ctx.s.charCodeAt(ctx.p++))) TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+	if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 3, false, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) !== 58) TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	if (c = ctx.s.charCodeAt(ctx.p)) {
+		if (c === 90 || c === 122) return readDate(ctx, ctx.s.slice(startPtr, ++ctx.p), 1, unsafeSeparator, startPtr, "[+00:00]");
+		if (c === 43 || c === 45) return readDate(ctx, ctx.s.slice(startPtr, ctx.p += 6), 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+	}
+	return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+	let start = ctx.p;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) return parseNumber(ctx, --ctx.p, c, 0, endChr);
+	if (ctx.s.charCodeAt(ctx.p += 4) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	return readDate(ctx, ctx.s.slice(start, ctx.p), 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+	if (ctx.ld) {
+		let date = new TomlDate(str, type, unsafeDelim);
+		if (!date.isValid()) TomlError.x("invalid date", ctx, errPtr);
+		return date;
+	}
+	try {
+		if (temporalSuffix) str += temporalSuffix;
+		switch (type) {
+			case 1: return Temporal.ZonedDateTime.from(str);
+			case 2: return Temporal.PlainDateTime.from(str);
+			case 3: return Temporal.PlainDate.from(str);
+			case 4: return Temporal.PlainTime.from(str);
+		}
+	} catch (e) {
+		TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/util.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function skipComment(ctx) {
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		let c = ctx.s.charCodeAt(ctx.p);
+		if (c === 10) break;
+		if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+			ctx.p++;
+			break;
+		}
+		if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in comments", ctx);
+	}
+}
+/** @internal */
+function skipVoid(ctx, banNewLines, banComments) {
+	let c;
+	while (ctx.p < ctx.s.length) {
+		while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10))) ctx.p++;
+		if (banComments || c !== 35) break;
+		skipComment(ctx);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/struct.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseKey(ctx, end = 61) {
+	let startPtr;
+	let state = 0;
+	let parsed = [];
+	let sliceStart;
+	let c = ctx.s.charCodeAt(startPtr = ctx.p);
+	do
+		if (c === end) {
+			if (!state) TomlError.x("unexpected end of key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			return ctx.p++, parsed;
+		} else if (c === 46) {
+			if (!state) TomlError.x("illegal empty bare key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			state = 0;
+		} else if (!state && (c === 34 || c === 39)) {
+			if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2)) TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+			parsed.push(parseString(ctx));
+			state = 2;
+			ctx.p--;
+		} else if (c === 32 || c === 9) {
+			if (state === 1) {
+				parsed.push(ctx.s.slice(sliceStart, ctx.p));
+				state = 2;
+			}
+		} else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) TomlError.x("illegal character in key", ctx);
+		else if (!state) {
+			state = 1;
+			sliceStart = ctx.p;
+		}
+	while (c = ctx.s.charCodeAt(++ctx.p));
+	TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+/** @internal */
+function parseInlineTable(ctx) {
+	let startPtr = ctx.p++;
+	let res = Object.create(null);
+	let seen = /* @__PURE__ */ new Set();
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+			ctx.p++;
+			return res;
+		}
+		let k;
+		let t = res;
+		let hasOwn = false;
+		let errPtr = ctx.p;
+		let key = parseKey(ctx);
+		for (let i = 0; i < key.length; i++) {
+			if (i) t = hasOwn ? t[k] : t[k] = Object.create(null);
+			k = key[i];
+			if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) {
+				t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+				break;
+			}
+			if (!hasOwn && unsafe) Object.defineProperty(t, k, {
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+		}
+		if (hasOwn) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+		skipVoid(ctx, true, true);
+		let value = extractValue(ctx, 125);
+		if (t && typeof (t[k] = value) === "object") seen.add(value);
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished table", ctx, startPtr);
+}
+/** @internal */
+function parseArray(ctx) {
+	let startPtr = ctx.p++;
+	let res = [];
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+			ctx.p++;
+			return res;
+		}
+		res.push(extractValue(ctx, 93));
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished array", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/parse.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function peekTable(ctx, key, table, meta, type) {
+	let t = table;
+	let m = meta;
+	let k;
+	let hasOwn = false;
+	let state;
+	for (let i = 0; i < key.length; i++) {
+		if (i) {
+			t = hasOwn ? t[k] : t[k] = Object.create(null);
+			m = (state = m[k]).c;
+			if (type === 0 && (state.t === 1 || state.t === 2)) return null;
+			if (state.t === 2) {
+				let l = t.length - 1;
+				t = t[l];
+				m = m[l].c;
+			}
+		}
+		k = key[i];
+		if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) return null;
+		if (!hasOwn) {
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) return false;
+			if (unsafe) {
+				Object.defineProperty(t, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+				Object.defineProperty(m, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+			}
+			m[k] = {
+				t: i < key.length - 1 && type === 2 ? 3 : type,
+				d: false,
+				i: 0,
+				c: Object.create(null)
+			};
+		}
+	}
+	state = m[k];
+	if (state.t !== type && !(type === 1 && state.t === 3)) return null;
+	if (type === 2) {
+		if (!state.d) {
+			state.d = true;
+			t[k] = [];
+		}
+		t[k].push(t = Object.create(null));
+		state.c[state.i++] = state = {
+			t: 1,
+			d: false,
+			i: 0,
+			c: Object.create(null)
+		};
+	}
+	if (state.d) return null;
+	state.d = true;
+	if (type === 1) t = hasOwn ? t[k] : t[k] = Object.create(null);
+	else if (type === 0 && hasOwn) return null;
+	return [
+		k,
+		t,
+		state.c
+	];
+}
+function validateTablePeek(ctx, peek, ptr) {
+	if (peek === null || ctx.uk === 2) TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+	let ctx = {
+		s: toml,
+		p: 0,
+		d: options.maxDepth ?? 1e3,
+		bi: options.integersAsBigInt ?? false,
+		ld: options.useLegacyDate ?? true,
+		uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+	};
+	let res = Object.create(null);
+	let meta = Object.create(null);
+	let tmp;
+	let skipping = false;
+	let tbl = res;
+	let m = meta;
+	if (toml.charCodeAt(0) === 65279) ctx.p++;
+	skipVoid(ctx);
+	while (ctx.p < toml.length) {
+		if (toml.charCodeAt(ctx.p) === 91) {
+			let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+			tmp = ctx.p += +isTableArray;
+			skipping = false;
+			let k = parseKey(ctx, 93);
+			if (isTableArray) {
+				if (toml.charCodeAt(ctx.p) !== 93) TomlError.x("expected end of table array declaration", ctx);
+				ctx.p++;
+			}
+			let p = peekTable(ctx, k, res, meta, isTableArray ? 2 : 1);
+			if (!p) {
+				validateTablePeek(ctx, p, tmp);
+				skipping = true;
+			} else {
+				m = p[2];
+				tbl = p[1];
+			}
+		} else {
+			tmp = ctx.p;
+			let p = peekTable(ctx, parseKey(ctx), tbl, m, 0);
+			if (!p && !skipping) validateTablePeek(ctx, p, tmp);
+			skipVoid(ctx, true, true);
+			let v = extractValue(ctx, void 0);
+			if (p && !skipping) p[1][p[0]] = v;
+		}
+		skipVoid(ctx, true);
+		if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+		skipVoid(ctx);
+	}
+	return res;
+}
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+"".isWellFormed;
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/index.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+//#endregion
+//#region src/harness/codex-checkouts.ts
+const codexGitFolder = (configFolder, pluginId) => {
+	const at = pluginId.indexOf("@");
+	return `${configFolder}/plugins/cache/${pluginId.slice(at + 1)}/${pluginId.slice(0, at)}/@git`;
+};
+const codexCheckoutsFolder = (gitFolder) => `${gitFolder}/checkouts`;
+/** Parse Git's quoted parameters as data, never shell code, and keep every other `-c`. */
+const withoutCodexInclude = String.raw`
+use Text::ParseWords qw(shellwords);
+my @parameters = shellwords($ENV{GIT_CONFIG_PARAMETERS} // '');
+my $root = '';
+@parameters = grep { if (m{^include\.path=(.*/plugins/cache/[^/]+/[^/]+/\@git)/agents/[^/]+\.gitconfig$}) { $root = $1; 0 } else { 1 } } @parameters;
+if (($ARGV[0] // '') eq 'root') { print $root; exit; }
+for (@parameters) { s/'/'\\''/g; $_ = "'$_'"; }
+print join(' ', @parameters);
+`;
+/**
+* Both session start and the sign-off refusal use this writer. Perl's flock works on Linux
+* and macOS and is released even after a crash. One lock covers reading the shared includes,
+* writing a checkout's overrides, replacing the includes, and restoring the agent's file.
+* Git writes the include keys so unusual checkout names can't become config syntax. Its
+* gitdir conditions escape wildcard characters and cover the main checkout and worktrees.
+*/
+const codexCheckoutWriter = String.raw`
+use strict;
+use warnings;
+use Fcntl qw(LOCK_EX);
+use File::Path qw(make_path);
+use File::Temp qw(tempfile);
+use Digest::SHA qw(sha256_hex);
+umask 0077;
+my ($directory, $common, $hooks, $signs_off, $author_file, $author_text, $clear_author, $activate_author) = @ARGV;
+make_path($directory);
+open my $lock, '>>', "$directory/lock" or die "open checkout lock: $!\n";
+$SIG{ALRM} = sub { die "checkout lock timed out\n" };
+alarm 5;
+flock($lock, LOCK_EX) or die "lock checkouts: $!\n";
+alarm 0;
+sub quoted {
+    my $value = shift;
+    $value =~ s/\\/\\\\/g;
+    $value =~ s/"/\\"/g;
+    $value =~ s/\n/\\n/g;
+    $value =~ s/\t/\\t/g;
+    $value =~ s/\x08/\\b/g;
+    return qq{"$value"};
+}
+sub replace_file {
+    my ($file, $text) = @_;
+    my ($out, $next) = tempfile('.ref0-XXXXXX', DIR => $directory, UNLINK => 1);
+    print {$out} $text or die "write config: $!\n";
+    close $out or die "close config: $!\n";
+    rename $next, $file or die "replace config: $!\n";
+}
+my $disabled = "# ref0: author disabled until commit setup succeeds\n";
+if (defined $clear_author && length $clear_author) {
+    my $text = $author_text // '';
+    if (-e $clear_author) {
+        open my $in, '<', $clear_author or die "read author: $!\n";
+        local $/;
+        $text = <$in>;
+        close $in or die "close author: $!\n";
+    }
+    $text =~ s/^\[author\]\n.*?(?=^\[|\z)//msg;
+    $text = $disabled . $text unless index($text, $disabled) == 0;
+    replace_file($clear_author, $text);
+    exit;
+}
+if (length $common) {
+    my $checkout = "$directory/" . sha256_hex($common) . '.gitconfig';
+    my $text = "[core]\n\thooksPath = " . quoted($hooks) . "\n";
+    $text .= "[author]\n\tname = \"\"\n\temail = \"\"\n" if $signs_off;
+    my $includes = "$directory/checkouts.gitconfig";
+    my $before = '';
+    if (-e $includes) {
+        open my $in, '<', $includes or die "read checkouts: $!\n";
+        local $/;
+        $before = <$in>;
+        close $in or die "close checkouts: $!\n";
+    }
+    my ($out, $next) = tempfile('.ref0-XXXXXX', DIR => $directory, UNLINK => 1);
+    print {$out} $before or die "write checkouts: $!\n";
+    close $out or die "close checkouts: $!\n";
+    (my $pattern = $common) =~ s/([\\*?\[])/\\$1/g;
+    for my $gitdir ($pattern, "$pattern/worktrees/") {
+        system('git', 'config', '--file', $next, '--replace-all', "includeIf.gitdir:$gitdir.path", $checkout) == 0
+            or die "write checkout include\n";
+    }
+    replace_file($checkout, $text);
+    rename $next, $includes or die "replace checkouts: $!\n";
+}
+if (defined $author_file && length $author_file) {
+    # An in-flight old session cannot restore an author cleared after a failed switch.
+    my $may_write = 1;
+    if (!$activate_author && -e $author_file) {
+        open my $in, '<', $author_file or die "read author: $!\n";
+        my $first = <$in> // '';
+        close $in or die "close author: $!\n";
+        $may_write = 0 if $first eq $disabled;
+    }
+    replace_file($author_file, $author_text) if $may_write;
+}
+`;
+/** The same writer inside a hook, where the next plain commit must use the person as author. */
+const codexSignOff = [
+	"ref0_common=$(git rev-parse --path-format=absolute --git-common-dir) || exit 1",
+	"ref0_common=$(cd -P \"$ref0_common\" && pwd) || exit 1",
+	"[ -n \"${ref0_codex-}\" ] || exit 1",
+	"ref0_codex_hooks=$ref0_hooks/most",
+	"for ref0_frequent in post-index-change reference-transaction; do",
+	"  ref0_own=$(git rev-parse --git-path \"hooks/$ref0_frequent\") || exit 1",
+	"  [ ! -x \"$ref0_own\" ] || ref0_codex_hooks=$ref0_hooks/all",
+	"done",
+	`perl -e ${shellWord(codexCheckoutWriter)} "$ref0_codex/checkouts" "$ref0_common" "$ref0_codex_hooks" 1 || exit 1`
+];
+//#endregion
+//#region src/harness/empty-folder.ts
+/**
+* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
+* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
+* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
+*
+* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
+* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
+* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
+* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
+* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
+* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
+*/
+const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
+//#endregion
+//#region src/harness/codex-app-server.ts
+/**
+* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
+* from an empty folder of its own, the requests written a line each, the answers read until each
+* request has one, then stopped. Each answer is matched to its request by ID, and read by that
+* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
+* didn't send, is passed over.
+*/
+/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
+var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
+/** Codex's app server answered a request with an error. */
+var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
+	method: Schema.String,
+	error: CodexError
+}) {};
+/** Codex's app server answered a request with a result its method's schema doesn't read. */
+var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
+	method: Schema.String,
+	issue: Schema.String
+}) {};
+const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
+const decodeAnswer$1 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
+/** The IDs of the exchange's two requests: the opening's, and the one asked. */
+const initializeId = "ref0-initialize";
+const askedId = "ref0-asked";
+/** The exchange's opening: who's asking, then that it's ready. */
+const opening = [{
+	jsonrpc: "2.0",
+	id: initializeId,
+	method: codexMethods.initialize.method,
+	params: { clientInfo: {
+		name: "ref0",
+		title: null,
+		version: cliVersion
+	} }
+}, {
+	jsonrpc: "2.0",
+	method: codexMethods.initialized.method
+}];
+/**
+* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
+* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
+*/
+const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const fs = yield* FileSystem.FileSystem;
+	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
+		cwd: yield* emptyFolder(fs),
+		env,
+		extendEnv: true,
+		forceKillAfter: "2 seconds",
+		stdin: {
+			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
+			endOnDone: false
+		}
+	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$1(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
+	return Option.filter(answered, (answers) => answers.size === ids.length);
+})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
+/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
+const resultOf = (method, answer) => {
+	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
+	if ("error" in answer) return Effect.fail(new CodexRefused({
+		method: method.method,
+		error: answer.error
+	}));
+	const { result } = method;
+	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
+		method: method.method,
+		issue: error.message
+	})));
+};
+/**
+* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
+* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
+* its request's ID, and its result is read by the method's result schema.
+*/
+const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
+	const asked = {
+		jsonrpc: "2.0",
+		id: askedId,
+		method: method.method,
+		params
+	};
+	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
+	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
+	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
+	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
+	return yield* resultOf(method, answers.value.get(askedId));
+});
+//#endregion
+//#region src/harness/commit-hooks.ts
+/**
+* ref0's part of Git's `prepare-commit-msg` and `commit-msg` hooks, which their forwarders in
+* ref0's hooks folder run once the repo's own hook succeeds, and only in an agent's commands,
+* where `REF0_HARNESS` is set. A commit anywhere else is unchanged.
+*
+* The trailer, `Assisted-by: <harness>:<model>`, goes on once with `git interpret-trailers`:
+* `prepare-commit-msg` adds it to a message the command or Git wrote, and `commit-msg` to one
+* written in an editor, or again if an editor removed it, since Git runs `prepare-commit-msg`
+* before the editor and `commit-msg` after. Neither adds it to a message Git refuses as empty, or
+* to `commit.template` left as it was, which Git would otherwise commit. Two commits made in an
+* editor are beyond them: one with `--no-verify`, which skips `commit-msg`, gets no trailer, and
+* a template from `-t`, which `commit-msg` can't see, gets it even when left as it was. The model
+* is the last one the session's transcript names, read from its end in `sh`, with no Node
+* process, or else the one the session started with. Both are as the harness reports them, never
+* proven.
+*
+* The refusal: a commit whose author is an agent's commit email and whose message has a
+* `Signed-off-by`. A sign-off must match its commit's author, and an agent never signs off.
+* `prepare-commit-msg` catches `-s` and `-m`, which `--no-verify` doesn't skip, and `commit-msg`
+* a sign-off written in an editor, unless `--no-verify` skips it.
+*
+* Only the refusal stops a commit: when Git can't say what ref0's part needs, such as a Git older
+* than 2.20 without `--no-divider`, the commit goes on without the trailer.
+*
+* Neither part runs while Git replays commits, in a rebase or a cherry-pick: Git makes those
+* commits itself with their own authors, and these hooks see the command's author instead (Git
+* 2.53, 23 Oct 2026). Nor does the trailer go on an amend that keeps another's commit: `git
+* commit` gives its hooks the author it commits with, and an amend keeps HEAD's, to the second.
+* So a new commit by HEAD's author in HEAD's second gets none either.
+*/
+/** The hooks ref0 adds its part to, after the repo's own. */
+const commitHooks = ["prepare-commit-msg", "commit-msg"];
+/** Whether a hook is one ref0 adds its part to. */
+const isCommitHook = (name) => commitHooks.some((hook) => hook === name);
+/** The trailer's key, as the Linux kernel writes it. */
+const assistedBy = "Assisted-by";
+/** How much of the transcript's end the hook reads for its last model: well past its last turn. */
+const transcriptTail = 1048576;
+/**
+* Git's trailer tool, reading and writing `:` alone whatever the repo's `trailer.separators`
+* says, since Git writes a sign-off with `:`.
+*/
+const trailers = "git -c trailer.separators=: interpret-trailers --no-divider";
+/**
+* Whether its input says anything, as Git decides whether a message is empty: with a line that's
+* neither blank nor a sign-off.
+*/
+const saysSomething = "grep -qv -e '^[[:space:]]*$' -e '^Signed-off-by: '";
+/** How the agent commits again as the person, which the refusal prints. */
+const asThePerson = "env -u GIT_AUTHOR_NAME -u GIT_AUTHOR_EMAIL git commit -s …";
+/** What the refusal prints, for a commit by `author` that the person `person` should author. */
+const signOffRefusal = (author, person) => `ref0: this commit has a Signed-off-by, and its author is ${author}, an agent. A sign-off must match its commit's author, and an agent never signs off, so commit again with ${person} as the author, adding --reset-author to an amend:\n  ${asThePerson}\n`;
+/** ref0's part of `hook`, run once the repo's own hook has succeeded. */
+const commitPart = (hook) => {
+	const { harness, transcript, model } = gitHookVariables;
+	return [
+		"ref0_nl='",
+		"'",
+		`[ -n "\${${harness}-}" ] || exit 0`,
+		`case $${harness} in *[!a-z0-9-]*) exit 0 ;; esac`,
+		"ref0_git=$(git rev-parse --git-dir) || exit 0",
+		"[ -d \"$ref0_git/rebase-merge\" ] || [ -d \"$ref0_git/rebase-apply\" ] || [ -f \"$ref0_git/CHERRY_PICK_HEAD\" ] && exit 0",
+		`ref0_trailers=$(${trailers} --parse "$1") || exit 0`,
+		"case ${GIT_AUTHOR_EMAIL-} in",
+		`*@${agentCommitDomain})`,
+		"  if printf '%s\\n' \"$ref0_trailers\" | grep -qi '^signed-off-by:'; then",
+		"    ref0_person=$(git var GIT_COMMITTER_IDENT)",
+		`    if [ "$${harness}" = codex ]; then`,
+		...codexSignOff.map((line) => `      ${line}`),
+		"      printf '%s\\n' 'ref0: this checkout now uses the person as author. Run the same git commit -s again; add --reset-author to an amend.' >&2",
+		"    else",
+		`      printf ${shellWord(signOffRefusal("%s", "%s"))} "\${GIT_AUTHOR_NAME-} <$GIT_AUTHOR_EMAIL>" "\${ref0_person% * *}" >&2`,
+		"    fi",
+		"    exit 1",
+		"  fi",
+		"  ;;",
+		"*)",
+		"  if [ -n \"${GIT_AUTHOR_DATE-}\" ]; then",
+		`    ref0_head=$(git log -1 --no-show-signature --date=raw --format='%(trailers:key=${assistedBy},valueonly)%n%an <%ae> %ad' HEAD 2>/dev/null)`,
+		"    [ \"${ref0_head##*\"$ref0_nl\"}\" = \"${GIT_AUTHOR_NAME-} <${GIT_AUTHOR_EMAIL-}> ${GIT_AUTHOR_DATE#@}\" ] && [ -z \"${ref0_head%\"$ref0_nl\"*}\" ] && exit 0",
+		"  fi",
+		"  ;;",
+		"esac",
+		...hook === "prepare-commit-msg" ? ["case ${2-} in ''|template) exit 0 ;; esac"] : [],
+		`case "$ref0_nl$ref0_trailers$ref0_nl" in *"\${ref0_nl}${assistedBy}: $${harness}:"*|*"\${ref0_nl}${assistedBy}: $${harness}$ref0_nl"*) exit 0 ;; esac`,
+		...hook === "prepare-commit-msg" ? [`${saysSomething} "$1" || exit 0`] : [
+			"ref0_message=$(git stripspace --strip-comments < \"$1\")",
+			`printf '%s\\n' "$ref0_message" | ${saysSomething} || exit 0`,
+			`ref0_template=$(git config --path commit.template) && ref0_template=$(git stripspace --strip-comments < "$ref0_template" 2>/dev/null) && case $ref0_message in "$ref0_template"*) printf '%s\\n' "\${ref0_message#"$ref0_template"}" | ${saysSomething} || exit 0 ;; esac`
+		],
+		"ref0_model=",
+		`if [ "$${harness}" = codex ]; then`,
+		"  case ${CODEX_THREAD_ID-} in \"\"|*[!a-zA-Z0-9-]*) ;; *)",
+		"    ref0_rollout=$(find \"${CODEX_HOME:-\"$HOME/.codex\"}/sessions\" -type f -name \"rollout-*-${CODEX_THREAD_ID}.jsonl\" 2>/dev/null | head -n 1)",
+		`    [ -f "$ref0_rollout" ] && ref0_model=$(tail -c ${transcriptTail} "$ref0_rollout" | LC_ALL=C grep '"type"[[:space:]]*:[[:space:]]*"turn_context"' | grep -o '"model"[[:space:]]*:[[:space:]]*"[A-Za-z0-9][A-Za-z0-9._:@/-]*"' | tail -n 1 | sed 's/^[^:]*:[[:space:]]*"//; s/"$//')`,
+		"  ;; esac",
+		"else",
+		`[ -f "\${${transcript}-}" ] && ref0_model=$(tail -c ${transcriptTail} "$${transcript}" | LC_ALL=C grep -o '"message":{"model":"[A-Za-z0-9][A-Za-z0-9._:@/-]*"')`,
+		"ref0_model=${ref0_model##*\\\"model\\\":\\\"}",
+		"ref0_model=${ref0_model%\\\"}",
+		`[ -n "$ref0_model" ] || ref0_model=\${${model}-}`,
+		"fi",
+		"case $ref0_model in *[!A-Za-z0-9._:@/-]*) ref0_model= ;; esac",
+		`${trailers} --in-place --if-exists addIfDifferent --trailer "${assistedBy}: $${harness}\${ref0_model:+:$ref0_model}" "$1"`,
+		"exit 0"
+	];
+};
+//#endregion
+//#region src/harness/git-hooks.ts
+/**
+* ref0's Git hooks: folders of forwarders in `~/.ref0/origins/<origin>/git-hooks`, which ref0 names as
+* `core.hooksPath` in its agents' commands alone, never in a repo, its config or its hooks.
+* `core.hooksPath` replaces a repo's whole hooks folder, so each forwarder runs the repo's own
+* hook of its name, with the same arguments, stdin and exit status, wherever the repo keeps it:
+* husky's `.husky/_`, `.git/hooks/` or another `core.hooksPath`. It finds and runs that hook
+* with ref0's entry left out of its environment, so a hook that looks up another, as
+* `pre-applypatch.sample` runs `pre-commit`, finds the repo's own. A forwarder runs nothing
+* when the repo's hooks path is one of ref0's folders, or when a forwarder started it, so none
+* calls itself: a first version that left ref0's entry in started about 1,000 processes. Only
+* `prepare-commit-msg` and `commit-msg` do more: once the repo's own hook succeeds, they add
+* ref0's part, in `commit-hooks.ts`.
+*
+* Git runs a hook that exists even where the repo has none, so the forwarders cost each hook one
+* `sh` and one `git rev-parse`, about 1.5 ms. Two hooks run on every index write and ref update,
+* hundreds of times in a long rebase, so only `all` forwards them, for a checkout that has its
+* own; `most` forwards every other (measured 23 Oct 2026, in the piece's pull request).
+*
+* The folders are the CLI's: a session's start writes them again when a forwarder differs, as
+* after an update. Each is read-only, so a tool that installs hooks wherever `core.hooksPath`
+* points, run in an agent's command, fails there rather than replacing a forwarder for every
+* repo.
+*/
+/** The hooks Git runs on every index write and ref update. */
+const frequentHooks = ["post-index-change", "reference-transaction"];
+/**
+* Every other hook Git looks for in its hooks path. Not `push-to-checkout`, which replaces Git's
+* own update of a checkout pushed to merely by existing, nor `fsmonitor-watchman`, which Git runs
+* from `core.fsmonitor`, never from the hooks path.
+*/
+const forwardedHooks = [
+	"applypatch-msg",
+	"pre-applypatch",
+	"post-applypatch",
+	"pre-commit",
+	"pre-merge-commit",
+	"prepare-commit-msg",
+	"commit-msg",
+	"post-commit",
+	"pre-rebase",
+	"post-checkout",
+	"post-merge",
+	"pre-push",
+	"pre-receive",
+	"update",
+	"proc-receive",
+	"post-receive",
+	"post-update",
+	"pre-auto-gc",
+	"post-rewrite",
+	"sendemail-validate",
+	"p4-changelist",
+	"p4-prepare-changelist",
+	"p4-post-changelist",
+	"p4-pre-submit"
+];
+/**
+* What finds and runs the repo's own hook `name`, with ref0's entry left out: an entry naming one
+* of ref0's folders, in `$ref0_hooks`, is ref0's, and the rest keep their order, renumbered.
+* `done` ends it with nothing to run, `failed` when Git can't say where the hook is, and `run`
+* runs the hook it found.
+*/
+const forwarding = (name, end) => [
+	`[ -n "\${${gitHookVariables.forwarded}-}" ] && ${end.done}`,
+	"case ${GIT_CONFIG_PARAMETERS-} in *'/@git/agents/'*)",
+	`  ref0_codex=$(perl -e ${shellWord(withoutCodexInclude)} root) || ${end.failed}`,
+	`  GIT_CONFIG_PARAMETERS=$(perl -e ${shellWord(withoutCodexInclude)}) || ${end.failed}`,
+	"  if [ -z \"$GIT_CONFIG_PARAMETERS\" ]; then unset GIT_CONFIG_PARAMETERS; else export GIT_CONFIG_PARAMETERS; fi",
+	";; esac",
+	"ref0_n=${GIT_CONFIG_COUNT:-0}",
+	"ref0_i=0",
+	"ref0_j=0",
+	"while [ \"$ref0_i\" -lt \"$ref0_n\" ]; do",
+	"  eval \"ref0_key=\\${GIT_CONFIG_KEY_$ref0_i-} ref0_value=\\${GIT_CONFIG_VALUE_$ref0_i-}\"",
+	"  unset \"GIT_CONFIG_KEY_$ref0_i\" \"GIT_CONFIG_VALUE_$ref0_i\"",
+	"  if [ \"$ref0_key\" != core.hooksPath ] || [ \"${ref0_value%/*}\" != \"$ref0_hooks\" ]; then",
+	"    export \"GIT_CONFIG_KEY_$ref0_j=$ref0_key\" \"GIT_CONFIG_VALUE_$ref0_j=$ref0_value\"",
+	"    ref0_j=$((ref0_j + 1))",
+	"  fi",
+	"  ref0_i=$((ref0_i + 1))",
+	"done",
+	"if [ \"$ref0_j\" -eq 0 ]; then unset GIT_CONFIG_COUNT; else export GIT_CONFIG_COUNT=\"$ref0_j\"; fi",
+	`ref0_hook=$(git rev-parse --git-path hooks/${name}) || ${end.failed}`,
+	`[ -f "$ref0_hook" ] && [ -x "$ref0_hook" ] || ${end.done}`,
+	`ref0_dir=$(cd -P "\${ref0_hook%/*}" && pwd) || ${end.failed}`,
+	`[ "\${ref0_dir%/*}" = "$ref0_hooks" ] && ${end.done}`,
+	...end.run
+];
+/**
+* The forwarder for one hook, in ref0's folders in `hooks`. Each `exec`s the repo's own hook,
+* but `prepare-commit-msg` and `commit-msg`, which run it and add ref0's part once it succeeds,
+* even when a forwarder started them and they forward nothing.
+*/
+const forwarder = (name, hooks) => [
+	"#!/bin/sh",
+	`# ref0 ${cliVersion}'s forwarder for Git's ${name} hook. ref0 sets core.hooksPath to this`,
+	"# folder only in its agents' commands. This runs the repo's own hook, found and run with",
+	"# ref0's entry left out, with the same arguments, stdin and exit status.",
+	`ref0_hooks=${shellWord(hooks)}`,
+	...isCommitHook(name) ? [
+		"# Then, in an agent's commands, it adds the Assisted-by trailer and refuses a sign-off on an",
+		"# agent's commit.",
+		"ref0_forward() {",
+		...forwarding(name, {
+			done: "return 0",
+			failed: "return",
+			run: [`${gitHookVariables.forwarded}=${name} "$ref0_hook" "$@"`]
+		}).map((line) => `  ${line}`),
+		"}",
+		"ref0_forward \"$@\" || exit",
+		...commitPart(name)
+	] : forwarding(name, {
+		done: "exit 0",
+		failed: "exit",
+		run: [`export ${gitHookVariables.forwarded}=${name}`, "exec \"$ref0_hook\" \"$@\""]
+	}),
+	""
+].join("\n");
+/** The hooks each folder forwards. */
+const hooksIn = (folder) => folder === "all" ? [...forwardedHooks, ...frequentHooks] : forwardedHooks;
+/** The folder holding ref0's hooks folders, made if it isn't yet: its path, through any links. */
+const gitHooksHome = Effect.fnUntraced(function* (home, api) {
+	const fs = yield* FileSystem.FileSystem;
+	const given = (yield* Path.Path).join(home, ".ref0", "origins", originKey(api), "git-hooks");
+	yield* fs.makeDirectory(given, {
+		recursive: true,
+		mode: 448
+	});
+	return yield* fs.realPath(given);
+});
+/**
+* One of ref0's hooks folders, in `hooks`, written first unless every forwarder in it is already
+* as this CLI writes it: its path, as the agent's `core.hooksPath` names it.
+*/
+const hooksFolder = Effect.fnUntraced(function* (hooks, folder) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const crypto = yield* Crypto.Crypto;
+	const written = path.join(hooks, folder);
+	const names = hooksIn(folder);
+	const current = Effect.forEach(names, (name) => fs.readFileString(path.join(written, name)).pipe(Effect.map((text) => text === forwarder(name, hooks)), Effect.orElseSucceed(() => false))).pipe(Effect.map((each) => each.every(Boolean)));
+	if (yield* current) return written;
+	yield* Effect.gen(function* () {
+		yield* fs.makeDirectory(written, { recursive: true });
+		yield* fs.chmod(written, 493);
+		for (const name of names) {
+			const next = path.join(written, `${name}.${yield* crypto.randomUUIDv4}.next`);
+			yield* fs.writeFileString(next, forwarder(name, hooks), { mode: 365 });
+			yield* fs.rename(next, path.join(written, name));
+		}
+		yield* fs.chmod(written, 365);
+	}).pipe(Effect.catch((error) => Effect.flatMap(current, (done) => done ? Effect.void : Effect.fail(error))));
+	return written;
+});
+//#endregion
+//#region src/harness/codex-commits.ts
+/**
+* `@git` isn't a valid Codex plugin version. Version selection and upgrade skip it, while
+* `plugin remove` deletes it with the plugin's cache root (Codex 0.160–0.164). A same-version
+* reinstall replaces the root; session start restores these files before the first command.
+* Only `checkouts` is writable in ref0's permission profile, never the agents' author files.
+*/
+/** A Git config value, including paths with quotes, backslashes or line breaks. */
+const gitValue = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("	", "\\t").replaceAll("\b", "\\b")}"`;
+var CodexCommitFailed = class extends Schema.TaggedError()("CodexCommitFailed", { detail: Schema.String }) {};
+/** Writes a checkout's overrides and, at session start, the agent's include under the same lock. */
+const writeCodexCheckout = Effect.fnUntraced(function* (input) {
+	if ((yield* (yield* ChildProcessSpawner.ChildProcessSpawner).exitCode(ChildProcess.make("perl", [
+		"-e",
+		codexCheckoutWriter,
+		codexCheckoutsFolder(input.gitFolder),
+		input.common,
+		input.folder,
+		input.signsOff ? "1" : "0",
+		input.author?.file ?? "",
+		input.author?.text ?? "",
+		input.clearAuthor ?? "",
+		input.activateAuthor ? "1" : ""
+	]))) !== ChildProcessSpawner.ExitCode(0)) return yield* new CodexCommitFailed({ detail: "Could not write Codex’s Git config files." });
+});
+/** The include installed into `set`, and restored by each session's start. */
+const codexAgentConfig = Effect.fnUntraced(function* (agent, root, home) {
+	const fs = yield* FileSystem.FileSystem;
+	const directory = `${root}/agents`;
+	yield* fs.makeDirectory(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const folder = yield* hooksFolder(yield* gitHooksHome(home, (yield* Ref0Config).api), "most");
+	yield* hooksFolder(yield* gitHooksHome(home, (yield* Ref0Config).api), "all");
+	const author = `[author]\n\tname = ${gitValue(agentCommitName(agent.owner, agent.agent))}\n\temail = ${gitValue(agentCommitEmail(agent.agentId))}\n`;
+	const file = `${directory}/${agent.agentId}.gitconfig`;
+	return {
+		file,
+		text: `${author}[core]\n\thooksPath = ${gitValue(folder)}\n[include]\n\tpath = ${gitValue(`${codexCheckoutsFolder(root)}/checkouts.gitconfig`)}\n`,
+		folder,
+		parameters: shellWord(`include.path=${file}`)
+	};
+});
+/** Codex has no environment file: its install selects a file; session start fills its checkout. */
+const setCodexCommitEnvironment = Effect.fnUntraced(function* (cwd, checkout) {
+	const folders = yield* ConfigFolders;
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const agent = yield* (yield* HostGrant).get(yield* folders.folder("codex"));
+	if (Option.isNone(agent)) return false;
+	const pluginRoot = yield* Config.String("CLAUDE_PLUGIN_ROOT").pipe(Config.withDefault(""));
+	if (pluginRoot === "") return false;
+	const gitFolder = path.join(path.dirname(pluginRoot), "@git");
+	const home = yield* Config.String("HOME");
+	const author = yield* codexAgentConfig(agent.value, gitFolder, home);
+	const common = (yield* spawner.string(ChildProcess.make("git", [
+		"-C",
+		cwd,
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	])).pipe(Effect.orElseSucceed(() => ""))).trim();
+	const folder = yield* hooksFolder(yield* gitHooksHome(yield* Config.String("HOME"), (yield* Ref0Config).api), checkout.folder);
+	yield* writeCodexCheckout({
+		gitFolder,
+		common: common === "" ? "" : yield* fs.realPath(path.resolve(common)),
+		folder,
+		signsOff: checkout.signsOff,
+		author
+	});
+	return true;
+});
+//#endregion
+//#region src/harness/hook-fields.ts
+/**
+* The same for Codex 0.160.0, which skips a hook outright if its template names a field the event
+* lacks, so each list holds only fields every hook of its event carried in the prototypes, and
+* only events they saw, each a `HookEvent`. Codex puts the model in every hook but `SessionEnd`.
+* Its `UserPromptSubmit` carries the prompt (`spikes/harness/results/codex/catalog.json`), which
+* no list names, as for Claude Code.
+* Every Codex hook carries `transcript_path`, the session's rollout, `null` for a session kept
+* nowhere (Codex's hook input schemas, 0.160.0 to 0.163.0): its turns' tokens are read there.
+* A subagent's are read from its own rollout, which its `SubagentStop` names, with the
+* subagent's own turn as its `turn_id` (Codex 0.163.0's subagents, 20 Oct 2026).
+*/
+const codexHookFields = {
+	UserPromptSubmit: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"transcript_path"
+	],
+	PreToolUse: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"tool_name",
+		"tool_use_id",
+		"tool_input"
+	],
+	PostToolUse: [
+		"session_id",
+		"turn_id",
+		"cwd",
+		"model",
+		"tool_name",
+		"tool_use_id",
+		"tool_input",
+		"tool_response"
+	],
+	Stop: [
+		"session_id",
+		"turn_id",
+		"model",
+		"stop_hook_active",
+		"transcript_path"
+	],
+	SubagentStop: [
+		"session_id",
+		"turn_id",
+		"agent_id",
+		"agent_type",
+		"stop_hook_active",
+		"agent_transcript_path"
+	]
+};
+Schema.encodeSync(Schema.fromJsonString(CodexPluginManifest));
+/** How Codex names a plugin's MCP server in an `mcp_tool` hook. */
+const codexServer = "ref0";
+/** Codex's hooks file, by its path inside the plugin. */
+const codexHooksPath = "hooks/codex-hooks.json";
+({ ...mcpToolHooks(codexServer, codexHookFields) });
+/**
+* The folder of Codex's skills, by its path inside the plugin. Not `skills`, which Claude Code
+* reads too, where a `status` skill would be a second status command. Codex 0.163.0 skips
+* Claude Code's `commands/status.md`, since its `!` line is a template it can't run.
+*/
+const codexSkillsPath = "codex-skills";
+/** The status skill, by its path inside the plugin. */
+const codexStatusSkillPath = `${codexSkillsPath}/status/SKILL.md`;
+/**
+* How a person runs the status skill of a plugin installed as `name`: Codex 0.163.0 names a
+* plugin's skill by the plugin, then the skill.
+*/
+const codexStatusShortcut = (name) => `$${name}:status`;
+/** The skill's placeholder for the plugin's folder, which Codex's agent fills in. */
+const pluginFolder = "<plugin>";
+/** What the status skill runs: `ref0 status`, through the plugin's lookup script. */
+const codexStatusLine = throughLookup([harnessCommandNames.status]).replaceAll(pluginRoot, pluginFolder);
+[
+	"---",
+	"name: status",
+	`description: Shows whether ref0 follows this Codex session, and what to do next if it doesn’t. Use when the person runs ${codexStatusShortcut("ref0")} or asks whether ref0 is working.`,
+	"---",
+	"",
+	"Run ref0’s check and show the person what it says.",
+	"",
+	`1. This file is \`${pluginFolder}/${codexSkillsPath}/status/SKILL.md\`. Run this command, with \`${pluginFolder}\` replaced by that folder’s absolute path:`,
+	"",
+	"   ```sh",
+	`   ${codexStatusLine}`,
+	"   ```",
+	"",
+	"   Run it outside Codex’s sandbox, with `sandbox_permissions: \"require_escalated\"`, since in the sandbox it can’t ask Codex, this machine’s keychain or ref0. If that isn’t allowed, run it in the sandbox.",
+	"2. Show every line it prints as it is, and add nothing. It exits 1 when a line says no: that’s its answer, not an error to fix.",
+	""
+].join("\n");
+//#endregion
+//#region src/harness/origin-plugin.ts
+const manifestJson = Schema.fromJsonString(PluginManifest);
+const codexJson = Schema.fromJsonString(CodexPluginManifest);
+const marketJson = Schema.fromJsonString(PluginMarketplace);
+const hooksJson = Schema.fromJsonString(HooksFile);
+/**
+* Keep the checked release under this origin's own marketplace and plugin identity, with its
+* hooks, server and Codex status skill named for it.
+*/
+const keepOriginPlugin = Effect.fnUntraced(function* (source, home) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const { api } = yield* Ref0Config;
+	const name = yield* originPluginName(api);
+	const directory = path.join(home, ".ref0", "origins", originKey(api), "plugins");
+	yield* fs.makeDirectory(directory, {
 		recursive: true,
 		mode: 448
 	});
@@ -21675,6 +23331,7 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 		const failed = (reason, detail = "") => into === void 0 ? unavailable : new InstallFailed({ says: `${name} ${reason}.${detail === "" ? "" : ` ${detail}`}` });
 		return Effect.scoped(Effect.gen(function* () {
 			const handle = yield* spawner.spawn(ChildProcess.make(options.command, args, {
+				cwd: yield* emptyFolder(fs),
 				env: into === void 0 ? fetchEnv : envFor(into),
 				extendEnv: true
 			}));
@@ -21795,90 +23452,212 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 	};
 });
 //#endregion
-//#region src/harness/codex-app-server.ts
-/**
-* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
-* the requests written a line each, the answers read until each request has one, then stopped.
-* Each answer is matched to its request by ID, and read by that request's method. Anything else
-* it writes, such as notifications, or an answer to an ID ref0 didn't send, is passed over.
-*/
-/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
-var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
-/** Codex's app server answered a request with an error. */
-var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
-	method: Schema.String,
-	error: CodexError
-}) {};
-/** Codex's app server answered a request with a result its method's schema doesn't read. */
-var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
-	method: Schema.String,
-	issue: Schema.String
-}) {};
-const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
-const decodeAnswer$1 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
-/** The IDs of the exchange's two requests: the opening's, and the one asked. */
-const initializeId = "ref0-initialize";
-const askedId = "ref0-asked";
-/** The exchange's opening: who's asking, then that it's ready. */
-const opening = [{
-	jsonrpc: "2.0",
-	id: initializeId,
-	method: codexMethods.initialize.method,
-	params: { clientInfo: {
-		name: "ref0",
-		title: null,
-		version: cliVersion
-	} }
-}, {
-	jsonrpc: "2.0",
-	method: codexMethods.initialized.method
-}];
-/**
-* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
-* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
-*/
-const exchange = (codex, lines, ids, configFolder) => Effect.scoped(Effect.gen(function* () {
-	const answered = yield* (yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make(codex, ["app-server"], {
-		env: configFolder === void 0 ? void 0 : { CODEX_HOME: configFolder },
-		extendEnv: true,
-		forceKillAfter: "2 seconds",
-		stdin: {
-			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
-			endOnDone: false
-		}
-	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$1(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
-	return Option.filter(answered, (answers) => answers.size === ids.length);
-})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
-const resultOf = (method, answer) => {
-	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
-	if ("error" in answer) return Effect.fail(new CodexRefused({
-		method: method.method,
-		error: answer.error
-	}));
-	const { result } = method;
-	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
-		method: method.method,
-		issue: error.message
-	})));
-};
-/**
-* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
-* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
-* its request's ID, and its result is read by the method's result schema.
-*/
-const askCodex = (codex, method, params, configFolder) => Effect.gen(function* () {
-	const asked = {
-		jsonrpc: "2.0",
-		id: askedId,
-		method: method.method,
-		params
+//#region src/harness/codex-install-commits.ts
+const decodeProfile = Schema.decodeUnknownEffect(CodexConfigRead);
+const sameJson = Schema.toEquivalence(Schema.Json);
+/** Only the single ref0 include installed by this CLI belongs to ref0. */
+const selectedInclude = (set) => {
+	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
+	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
+	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+};
+/** A changed grant must never leave the previous agent as author after a failed install. */
+const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, options) {
+	const fs = yield* FileSystem.FileSystem;
+	const configFile = `${options.configFolder}/config.toml`;
+	if (!(yield* fs.exists(configFile))) return;
+	const text = yield* fs.readFileString(configFile);
+	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
+	const read = yield* decodeProfile({ config: document });
+	const file = selectedInclude(read.config.shell_environment_policy?.set ?? {});
+	if (file === void 0) return;
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	if (file === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return;
+	const oldRoot = file.slice(0, file.lastIndexOf("/agents/"));
+	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home ?? (yield* Config.String("HOME").pipe(Config.withDefault("."))));
+	yield* writeCodexCheckout({
+		gitFolder: oldRoot,
+		common: "",
+		folder: "",
+		signsOff: false,
+		clearAuthor: file,
+		author: fallback
+	});
+	yield* Console.error(`ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. Fix the shell_environment_policy conflict in Codex’s config or profile named above: remove conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded. Then run: ${installLine(options.configFolder)}`);
+});
+/** Install the connected agent's include and shell policy. */
+const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
+	const env = {
+		HOME: options.home,
+		CODEX_HOME: options.configFolder
 	};
-	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
-	const answers = yield* exchange(codex, lines, [initializeId, askedId], configFolder);
-	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
-	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
-	return yield* resultOf(method, answers.value.get(askedId));
+	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+	return yield* Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		yield* fs.makeDirectory(`${options.home}/.ref0`, {
+			recursive: true,
+			mode: 448
+		});
+		if ((yield* (yield* spawner.spawn(ChildProcess.make("perl", [
+			"-e",
+			"use Fcntl qw(LOCK_EX); open my $lock, \">>\", $ARGV[0] or die $!; alarm 5; flock($lock, LOCK_EX) or die $!; alarm 0; $|=1; print \"locked\\n\"; <STDIN>;",
+			`${options.home}/.ref0/codex-install.lock`
+		], { stdin: "pipe" }))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.take(1), Stream.mkString)) !== "locked") return yield* failed("lock Codex’s commit setup");
+		const read = yield* askCodex(options.codex, codexMethods.configRead, {
+			includeLayers: true,
+			cwd: null
+		}, env);
+		const policy = read.config.shell_environment_policy;
+		const set = policy?.set ?? {};
+		const own = selectedInclude(set) !== void 0;
+		const collision = [
+			"GIT_CONFIG_PARAMETERS",
+			"REF0_HARNESS",
+			"GIT_AUTHOR_NAME",
+			"GIT_AUTHOR_EMAIL"
+		].find((key) => Object.hasOwn(set, key) && !(own && (key === "GIT_CONFIG_PARAMETERS" || key === "REF0_HARNESS")));
+		const allowlist = policy?.include_only != null || Object.values(policy?.filters ?? {}).includes("include");
+		if (collision !== void 0 || allowlist) {
+			yield* Console.error(`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`);
+			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			return;
+		}
+		const profiles = (yield* fs.readDirectory(options.configFolder)).filter((file) => file.endsWith(".config.toml"));
+		for (const file of profiles) {
+			const text = yield* fs.readFileString(`${options.configFolder}/${file}`);
+			const document = yield* Effect.try({
+				try: () => parse(text, { integersAsBigInt: "asNeeded" }),
+				catch: () => failed(`read Codex’s profile ${printable(file)}`)
+			});
+			const profile = yield* decodeProfile({ config: document });
+			const overrides = profile.config.shell_environment_policy?.set ?? {};
+			const key = [
+				"GIT_CONFIG_PARAMETERS",
+				"REF0_HARNESS",
+				"GIT_AUTHOR_NAME",
+				"GIT_AUTHOR_EMAIL"
+			].find((key) => Object.hasOwn(overrides, key));
+			const profilePolicy = profile.config.shell_environment_policy;
+			const filters = profilePolicy?.filters;
+			const replaced = filters != null && policy?.filters == null;
+			const excluded = filters != null ? [...replaced ? [] : ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"], ...Object.keys(filters)] : profilePolicy?.exclude;
+			const losesAuthors = excluded !== void 0 && excluded !== null && ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].some((name) => !excluded.some((pattern) => pathMatchesWithin(pattern.toLowerCase(), name.toLowerCase(), { left: 1e4 })));
+			const allowlist = profilePolicy?.include_only != null || Object.values(filters ?? {}).includes("include");
+			if (key === void 0 && !losesAuthors && !allowlist) continue;
+			yield* Console.error(`ref0: Codex’s profile ${printable(file)} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`);
+			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			return;
+		}
+		if (!own && (options.approveCommits === void 0 || !(yield* options.approveCommits()))) return;
+		const crypto = yield* Crypto.Crypto;
+		const author = yield* codexAgentConfig(agent, options.gitFolder, options.home);
+		const configFile = `${options.configFolder}/config.toml`;
+		const before = (file) => Effect.flatMap(fs.exists(file), (exists) => exists ? Effect.map(fs.readFileString(file), Option.some) : Effect.succeed(Option.none()));
+		const previousAuthor = yield* before(author.file);
+		const restore = (file, before) => Effect.gen(function* () {
+			if (Option.isNone(before)) return yield* fs.remove(file, { force: true });
+			const next = `${file}.${yield* crypto.randomUUIDv4}.next`;
+			yield* fs.writeFileString(next, before.value, { mode: 384 });
+			yield* fs.rename(next, file);
+		});
+		const user = read.layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+		const previousPolicy = user?.config === void 0 ? policy ?? null : user.config.shell_environment_policy ?? null;
+		const edits = [{
+			keyPath: "shell_environment_policy.set",
+			value: {
+				...set,
+				GIT_CONFIG_PARAMETERS: author.parameters,
+				REF0_HARNESS: "codex"
+			},
+			mergeStrategy: "replace"
+		}, ...policy?.filters == null ? [{
+			keyPath: "shell_environment_policy.exclude",
+			value: [.../* @__PURE__ */ new Set([
+				...policy?.exclude ?? [],
+				"GIT_AUTHOR_NAME",
+				"GIT_AUTHOR_EMAIL"
+			])],
+			mergeStrategy: "replace"
+		}] : [{
+			keyPath: "shell_environment_policy.filters",
+			value: {
+				...policy.filters,
+				...Object.fromEntries(["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].flatMap((key) => Object.keys(policy.filters ?? {}).some((pattern) => pattern.toUpperCase() === key) ? [] : [[key, "exclude"]]))
+			},
+			mergeStrategy: "replace"
+		}]];
+		const installedPolicy = {
+			...previousPolicy,
+			...Object.fromEntries(edits.map((edit) => [edit.keyPath.slice(25), edit.value]))
+		};
+		const readCurrent = askCodex(options.codex, codexMethods.configRead, {
+			includeLayers: true,
+			cwd: null
+		}, env);
+		const recover = Effect.gen(function* () {
+			const layer = (yield* readCurrent).layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+			if (layer?.config === void 0) return false;
+			const currentPolicy = layer.config.shell_environment_policy ?? null;
+			if (sameJson(currentPolicy, previousPolicy)) return true;
+			if (!sameJson(currentPolicy, installedPolicy)) return false;
+			const restored = yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "shell_environment_policy",
+					value: previousPolicy,
+					mergeStrategy: "replace"
+				}],
+				filePath: configFile,
+				expectedVersion: layer.version,
+				reloadUserConfig: false
+			}, env).pipe(Effect.option);
+			if (Option.isSome(restored)) return true;
+			const checkedLayer = (yield* readCurrent).layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+			return checkedLayer?.config !== void 0 && sameJson(checkedLayer.config.shell_environment_policy ?? null, previousPolicy);
+		}).pipe(Effect.orElseSucceed(() => false));
+		let attemptedConfig = false;
+		yield* Effect.gen(function* () {
+			yield* writeCodexCheckout({
+				gitFolder: options.gitFolder,
+				common: "",
+				folder: author.folder,
+				signsOff: false,
+				author,
+				activateAuthor: true
+			});
+			attemptedConfig = true;
+			if ((yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits,
+				filePath: configFile,
+				expectedVersion: user?.version ?? null,
+				reloadUserConfig: false
+			}, env)).status !== "ok") return yield* failed("set Codex’s commit environment because another config layer overrides it");
+		}).pipe(Effect.onError(() => Effect.gen(function* () {
+			if (!attemptedConfig || (yield* recover)) yield* restore(author.file, previousAuthor);
+			else yield* Console.error("ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again.");
+		}).pipe(Effect.orDie)));
+	}).pipe(Effect.scoped, Effect.mapError(() => failed("set Codex’s commit environment")));
+}, Effect.scoped);
+//#endregion
+//#region src/harness/install-claude-code.ts
+/** Install into one config folder, from the release Claude Code fetched and ref0 checked. */
+const installClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
+	const run = yield* release.into(configFolder);
+	yield* run([
+		"plugin",
+		"install",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	yield* run([
+		"plugin",
+		"update",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	return release.folder;
 });
 //#endregion
 //#region src/harness/install-codex.ts
@@ -21923,95 +23702,120 @@ const trustRef0Hooks = (reinstall, id) => `In a terminal, run: ${reinstall}, and
 * `CODEX_HOME`: neither half alone lets a commit and HTTPS through. A linked worktree's own git
 * directory isn't covered; there Codex needs full access, which whatever launches it sets.
 */
-const ref0Profile = {
+const ref0Profile = (checkouts) => ({
 	extends: ":workspace",
-	filesystem: { ":workspace_roots": { ".git": "write" } },
+	filesystem: {
+		":workspace_roots": { ".git": "write" },
+		[checkouts]: "write"
+	},
 	network: { enabled: true }
-};
+});
 const isPathModes = Schema.is(Schema.Record(Schema.String, Schema.String));
 /** A default that already lets a command write `.git` and reach the network, so needs nothing. */
 const enough = (read) => read.config.default_permissions === ":danger-full-access";
 /** Whether a setup's config has ref0's profile, as its default. */
-const profileSet = (read) => {
+const profileSet = (read, checkouts) => {
 	const profile = read.config.permissions?.["ref0"];
 	const roots = profile?.filesystem?.[":workspace_roots"];
-	return read.config.default_permissions === "ref0" && profile?.extends === ref0Profile.extends && isPathModes(roots) && roots[".git"] === "write" && profile.network?.enabled === true;
+	return read.config.default_permissions === "ref0" && profile?.extends === ref0Profile(checkouts).extends && isPathModes(roots) && roots[".git"] === "write" && profile.filesystem?.[checkouts] === "write" && profile.network?.enabled === true;
 };
-/** Install into one config folder, from the release Codex fetched and ref0 checked. */
-const installCodex = Effect.fnUntraced(function* (release, options) {
-	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
-	const { folder, id, name } = release;
-	yield* (yield* release.into(options.configFolder))([
-		"plugin",
-		"add",
-		id
-	]);
-	const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [options.home] }, options.configFolder).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, id));
-	if (hooks.length === 0) return yield* failed("read the plugin’s hooks from Codex");
-	if (!hooks.every((hook) => ownHook(hook, name))) return yield* new InstallFailed({ says: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ${id}.` });
-	const trust = Effect.fnUntraced(function* (waiting) {
-		if (!(yield* options.approve(waiting))) return false;
-		yield* askCodex(options.codex, codexMethods.configBatchWrite, {
-			edits: [{
-				keyPath: "hooks.state",
-				value: Object.fromEntries(waiting.map((hook) => [hook.key, { trusted_hash: hook.currentHash }])),
-				mergeStrategy: "upsert"
-			}],
-			filePath: null,
-			expectedVersion: null,
-			reloadUserConfig: false
-		}, options.configFolder).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
-		return true;
-	});
-	const offerProfile = Effect.fnUntraced(function* () {
-		const config = yield* askCodex(options.codex, codexMethods.configRead, {
-			includeLayers: false,
-			cwd: null
-		}, options.configFolder).pipe(Effect.option);
-		if (Option.isSome(config) && (profileSet(config.value) || enough(config.value))) return true;
-		const replacing = Option.match(config, {
-			onNone: () => ({
-				default: void 0,
-				ownRef0: false
-			}),
-			onSome: (read) => ({
-				default: read.config.default_permissions ?? void 0,
-				ownRef0: read.config.permissions?.["ref0"] !== void 0
-			})
+/**
+* Install into one config folder, from the release Codex fetched and ref0 checked, for the agent
+* the folder's host grant names.
+*/
+const installCodex = Effect.fnUntraced(function* (release, agent, options) {
+	return yield* Effect.gen(function* () {
+		const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+		const { folder, id, name } = release;
+		yield* (yield* release.into(options.configFolder))([
+			"plugin",
+			"add",
+			id
+		]);
+		const gitFolder = codexGitFolder(options.configFolder, id);
+		const checkouts = codexCheckoutsFolder(gitFolder);
+		const env = {
+			HOME: options.home,
+			CODEX_HOME: options.configFolder
+		};
+		const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [] }, env).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, id));
+		if (hooks.length === 0) return yield* failed("read the plugin’s hooks from Codex");
+		if (!hooks.every((hook) => ownHook(hook, name))) return yield* new InstallFailed({ says: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ${id}.` });
+		const trust = Effect.fnUntraced(function* (waiting) {
+			if (!(yield* options.approve(waiting))) return false;
+			yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "hooks.state",
+					value: Object.fromEntries(waiting.map((hook) => [hook.key, { trusted_hash: hook.currentHash }])),
+					mergeStrategy: "upsert"
+				}],
+				filePath: null,
+				expectedVersion: null,
+				reloadUserConfig: false
+			}, env).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
+			return true;
 		});
-		if (!(yield* options.approveProfile(replacing))) return false;
-		yield* askCodex(options.codex, codexMethods.configBatchWrite, {
-			edits: [{
-				keyPath: "permissions.ref0",
-				value: ref0Profile,
-				mergeStrategy: "replace"
-			}, {
-				keyPath: "default_permissions",
-				value: "ref0",
-				mergeStrategy: "replace"
-			}],
-			filePath: null,
-			expectedVersion: null,
-			reloadUserConfig: false
-		}, options.configFolder).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
-		return true;
-	});
-	const waiting = hooks.filter(waitingForTrust);
-	return {
-		folder,
-		trusted: waiting.length === 0 || (yield* trust(waiting)),
-		profile: yield* offerProfile()
-	};
+		const offerProfile = Effect.fnUntraced(function* () {
+			const config = yield* askCodex(options.codex, codexMethods.configRead, {
+				includeLayers: false,
+				cwd: null
+			}, env).pipe(Effect.option);
+			if (Option.isSome(config) && (profileSet(config.value, checkouts) || enough(config.value))) return true;
+			const replacing = Option.match(config, {
+				onNone: () => ({
+					default: void 0,
+					ownRef0: false
+				}),
+				onSome: (read) => ({
+					default: read.config.default_permissions ?? void 0,
+					ownRef0: read.config.permissions?.["ref0"] !== void 0
+				})
+			});
+			if (!(yield* options.approveProfile(replacing, checkouts))) return false;
+			yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "permissions.ref0",
+					value: ref0Profile(checkouts),
+					mergeStrategy: "replace"
+				}, {
+					keyPath: "default_permissions",
+					value: "ref0",
+					mergeStrategy: "replace"
+				}],
+				filePath: null,
+				expectedVersion: null,
+				reloadUserConfig: false
+			}, env).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
+			return true;
+		});
+		const waiting = hooks.filter(waitingForTrust);
+		const trusted = waiting.length === 0 || (yield* trust(waiting));
+		const profile = yield* offerProfile();
+		yield* installCodexCommits(agent, {
+			...options,
+			gitFolder
+		});
+		return {
+			folder,
+			trusted,
+			profile
+		};
+	}).pipe(Effect.onError(() => clearOtherCodexAuthor(agent, options).pipe(Effect.orDie)));
 });
 //#endregion
 //#region src/harness/install.ts
-/** A command on this machine's `PATH`, by absolute path. */
+/**
+* A command on this machine's `PATH`, by absolute path: a folder `PATH` names relative to this
+* one is read from here, since a harness's commands run from an empty folder of their own. Each
+* folder is kept as written, `..` and all, so the system follows a symlink before the `..` after it.
+*/
 const onPath = Effect.fnUntraced(function* (name) {
 	const fs = yield* FileSystem.FileSystem;
+	const paths = yield* Path.Path;
 	const path = yield* Config.String("PATH").pipe(Config.withDefault(""));
 	for (const folder of path.split(":")) {
 		if (folder === "") continue;
-		const candidate = `${folder}/${name}`;
+		const candidate = `${paths.isAbsolute(folder) ? folder : `${process.cwd()}/${folder}`}/${name}`;
 		if (yield* fs.exists(candidate).pipe(Effect.orElseSucceed(() => false))) return Option.some(candidate);
 	}
 	return Option.none();
@@ -22020,41 +23824,27 @@ const onPath = Effect.fnUntraced(function* (name) {
 const runs$2 = (hook) => hook.handlerType === "command" ? printable(hook.command ?? "") : `the ${printable(hook.tool ?? "")} tool on MCP server ${printable(hook.server ?? "")}`;
 /**
 * Shows the person ref0's hooks for Codex, on stderr so a JSON answer stays alone on stdout,
-* and asks whether Codex may run them. Only in a terminal, and never for `--json`: anywhere
-* else the answer is no, and the hooks stay off until the person runs it again or trusts them in
-* Codex itself.
-*/
-const askToTrust = (hooks, shown, asked) => Effect.gen(function* () {
-	const terminal = process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
-	if (!asked || !terminal) return false;
-	yield* Console.error([`Codex runs a plugin's hooks only once you trust them. ref0's, for ${printable(shown)}, are:`, ...hooks.map((hook) => `- ${hook.eventName}: ${runs$2(hook)}`)].join("\n"));
-	return yield* Prompt.run(Prompt.Confirm({
-		message: "Trust them, so Codex runs them?",
-		initial: false
-	}));
-}).pipe(Effect.orElseSucceed(() => false));
+* and asks whether Codex may run them. On a no, or with no terminal to ask in, the hooks stay
+* off until the person runs it again or trusts them in Codex itself.
+*/
+const askToTrust = (hooks, shown, yesOrNo) => yesOrNo([`Codex runs a plugin's hooks only once you trust them. ref0's, for ${printable(shown)}, are:`, ...hooks.map((hook) => `- ${hook.eventName}: ${runs$2(hook)}`)], "Trust them, so Codex runs them?");
 /**
 * Shows the person ref0's sandbox profile for Codex, on stderr, and asks whether it may be
-* Codex's default: only in a terminal, and never for `--json`, as with the hooks. A change to
-* their Codex's security, so it's shown in full and asked the first time (decided 9 Oct, 5).
-*/
-const askForProfile = (replacing, shown, asked) => Effect.gen(function* () {
-	const terminal = process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
-	if (!asked || !terminal) return false;
-	yield* Console.error([
-		"Codex's sandbox keeps commands from writing .git or reaching the network, so a Codex agent can't commit or push to ref0.",
-		"ref0's profile, \"ref0\", is Codex's workspace profile with two changes:",
-		"- each workspace root's .git is writable, so an agent can commit",
-		"- the network is on, so an agent can push; any command can then reach the internet, services and sockets on this machine, and your login Keychain",
-		"In a linked worktree (git worktree add), Codex still needs full access there.",
-		...replacing.default === void 0 ? [] : [`It replaces your default now, ${printable(replacing.default)}.`],
-		...replacing.ownRef0 ? ["It replaces the profile you have named \"ref0\", and every rule in it."] : []
-	].join("\n"));
-	return yield* Prompt.run(Prompt.Confirm({
-		message: `Make "ref0" the default profile for ${printable(shown)}?`,
-		initial: false
-	}));
-}).pipe(Effect.orElseSucceed(() => false));
+* Codex's default. A change to their Codex's security, so it's shown in full and asked the first
+* time (decided 9 Oct, 5).
+*/
+const askForProfile = (replacing, checkouts, shown, yesOrNo) => yesOrNo([
+	"Codex's sandbox keeps commands from writing .git or reaching the network, so a Codex agent can't commit or push to ref0.",
+	"ref0's profile, \"ref0\", is Codex's workspace profile with these changes:",
+	"- each workspace root's .git is writable, so an agent can commit",
+	`- ${printable(checkouts)} is writable, so a signed-off checkout can keep you as author; the agent’s author files stay outside it`,
+	"- the network is on, so an agent can push; any command can then reach the internet, services and sockets on this machine, and your login Keychain",
+	"In a linked worktree (git worktree add), Codex still needs full access there.",
+	...replacing.default === void 0 ? [] : [`It replaces your default now, ${printable(replacing.default)}.`],
+	...replacing.ownRef0 ? ["It replaces the profile you have named \"ref0\", and every rule in it."] : []
+], `Make "ref0" the default profile for ${printable(shown)}?`);
+/** Shows the person what naming the agent as author changes in Codex, and asks whether it may. */
+const askForCommits = (shown, yesOrNo) => yesOrNo(["ref0 will set GIT_CONFIG_PARAMETERS and REF0_HARNESS in this Codex setup’s shell_environment_policy, and exclude inherited GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL. Its agents will author their commits, with you as committer. Signed-off checkouts keep you as author. Your own terminal is unchanged."], `Name the agent as author of its Codex commits, for ${printable(shown)}?`);
 /** What a Codex folder without ref0's profile, or full access, can't do. */
 const sandboxWords = "Codex’s sandbox is as it was, so its agents commit and push to ref0 only where it has full access; to change that, run it again in a terminal.";
 /**
@@ -22105,44 +23895,52 @@ const writeRef0Launcher = Effect.fnUntraced(function* (home, git) {
 const installInto = Effect.fnUntraced(function* (folders, options) {
 	const home = yield* Config.String("HOME");
 	const name = yield* originPluginName((yield* Ref0Config).api);
-	const terminal = yield* Effect.context();
+	const yesOrNo = options.asJson ? () => Effect.succeed(false) : yield* yesOrNoQuestions;
 	const answers = /* @__PURE__ */ new Map();
 	const failAll = (into, failed) => {
 		for (const folder of into) answers.set(folder, Result.fail(failed));
 	};
+	const started = /* @__PURE__ */ new Set();
+	const clearUnstarted = (into) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearOtherCodexAuthor(agent, {
+		configFolder: folder.configFolder,
+		home
+	}).pipe(Effect.orDie)), Effect.catchTag("InstallFailed", () => Effect.void)), { discard: true });
 	const launcher = yield* Effect.cached(Effect.gen(function* () {
 		const git = yield* onPath("git");
 		if (Option.isNone(git)) return yield* new InstallFailed({ says: "Git isn’t on this machine’s PATH. Install it." });
 		yield* writeRef0Launcher(home, git.value).pipe(Effect.mapError(() => new InstallFailed({ says: "Couldn’t write ~/.ref0. Check that it’s writable." })));
 	}));
-	for (const harness of ConnectHarness.literals) {
-		const into = folders.filter((folder) => folder.harness === harness);
-		if (into.length === 0) continue;
-		const command = yield* onPath(harness === "codex" ? "codex" : "claude");
-		if (Option.isNone(command)) {
-			failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
-			continue;
-		}
-		yield* Effect.scoped(Effect.gen(function* () {
-			yield* launcher;
-			const release = yield* marketplaceFor(harness, {
-				command: command.value,
-				home,
-				configFolder: into[0]?.configFolder ?? home
-			});
-			for (const folder of into) {
-				const installed = yield* (harness === "claude-code" ? installedInClaudeCode(release, folder.configFolder) : installedInCodex(release, {
-					codex: command.value,
-					home,
-					configFolder: folder.configFolder,
-					name,
-					asked: !options.asJson,
-					terminal
-				})).pipe(Effect.result);
-				answers.set(folder, installed);
+	yield* Effect.gen(function* () {
+		for (const harness of ConnectHarness.literals) {
+			const into = folders.filter((folder) => folder.harness === harness);
+			if (into.length === 0) continue;
+			const command = yield* onPath(harness === "codex" ? "codex" : "claude");
+			if (Option.isNone(command)) {
+				failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
+				yield* clearUnstarted(into);
+				continue;
 			}
-		}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)))));
-	}
+			yield* Effect.scoped(Effect.gen(function* () {
+				yield* launcher;
+				const release = yield* marketplaceFor(harness, {
+					command: command.value,
+					home,
+					configFolder: into[0]?.configFolder ?? home
+				});
+				for (const folder of into) {
+					started.add(folder);
+					const installed = yield* (harness === "claude-code" ? installedInClaudeCode(release, folder.configFolder) : installedInCodex(release, {
+						codex: command.value,
+						home,
+						configFolder: folder.configFolder,
+						name,
+						yesOrNo
+					})).pipe(Effect.result);
+					answers.set(folder, installed);
+				}
+			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into))))));
+		}
+	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders)));
 	return folders.map((folder) => ({
 		...folder,
 		installed: answers.get(folder) ?? Result.fail(new InstallFailed({ says: "ref0 didn’t install into this folder." }))
@@ -22157,14 +23955,27 @@ const installedInClaudeCode = Effect.fnUntraced(function* (release, configFolder
 		words: `Installed in Claude Code, from ${folder}.`
 	};
 });
+/** The agent a Codex folder's host grant names, whose ID its commits' author file is named by. */
+const codexAgentOf = (configFolder) => HostGrant.use((grants) => grants.get(configFolder)).pipe(Effect.catchTag("KeychainError", (failed) => Effect.fail(failed.unreadable === true ? new InstallFailed({
+	says: "Its host grant can’t be read.",
+	run: "ref0 connect"
+}) : new InstallFailed({ says: failed.nextStep }))), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new InstallFailed({
+		says: "It isn’t connected.",
+		run: "ref0 connect"
+	})),
+	onSome: (grant) => Effect.succeed(grant)
+})));
 const installedInCodex = Effect.fnUntraced(function* (release, options) {
 	const shown = shownConfigFolder(options.home, options.configFolder);
-	const done = yield* installCodex(release, {
+	const agent = yield* codexAgentOf(options.configFolder);
+	const done = yield* installCodex(release, agent, {
 		codex: options.codex,
 		home: options.home,
 		configFolder: options.configFolder,
-		approve: (hooks) => askToTrust(hooks, shown, options.asked).pipe(Effect.provide(options.terminal)),
-		approveProfile: (replacing) => askForProfile(replacing, shown, options.asked).pipe(Effect.provide(options.terminal))
+		approve: (hooks) => askToTrust(hooks, shown, options.yesOrNo),
+		approveProfile: (replacing, checkouts) => askForProfile(replacing, checkouts, shown, options.yesOrNo),
+		approveCommits: () => askForCommits(shown, options.yesOrNo)
 	});
 	const sandbox = done.profile ? "" : ` ${sandboxWords}`;
 	const trust = trustRef0Hooks(installLine(options.configFolder), `${options.name}@${options.name}`);
@@ -30592,6 +32403,7 @@ var Waker = class Waker extends Context.Service()("ref0/cli/Waker") {
 			const socket = yield* Config.String("CLAUDE_CODE_MESSAGING_SOCKET").pipe(Config.option);
 			const token = yield* Config.Redacted("CLAUDE_CODE_MESSAGING_TOKEN").pipe(Config.option);
 			const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+			const fs = yield* FileSystem.FileSystem;
 			const post = Option.zipWith(socket, token, (path, secret) => Effect.callback((resume) => {
 				const connection = connect(path);
 				connection.on("error", () => resume(Effect.succeed(false)));
@@ -30618,6 +32430,7 @@ var Waker = class Waker extends Context.Service()("ref0/cli/Waker") {
 					"--message",
 					wakeLine
 				], {
+					cwd: yield* emptyFolder(fs),
 					env: { CODEX_HOME: setup.home },
 					extendEnv: true
 				}));
@@ -31731,7 +33544,7 @@ const codexSetupHere = Effect.fnUntraced(function* (process) {
 const mcp = Command.make(harnessCommandNames.mcp, {}, () => Effect.gen(function* () {
 	const agents = yield* ConfigFolders;
 	const found = yield* (yield* HarnessProcess).innermost;
-	const agent = Option.isSome(found) ? yield* (yield* HostGrant).get(yield* agents.folder(found.value.harness)) : Option.none();
+	const agent = Option.isSome(found) ? yield* (yield* HostGrant).get(yield* agents.folder(found.value.harness)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone)) : Option.none();
 	const codex = Option.isSome(found) && found.value.harness === "codex" ? yield* codexSetupHere(found.value.process) : Option.none();
 	const reinstall = Option.isSome(found) && Option.isSome(agent) ? installLine(yield* agents.folder(found.value.harness)) : "ref0 connect";
 	return yield* Layer.launch(mcpServer(cliVersion, {
@@ -31827,6 +33640,148 @@ const endHarnessSession = Effect.gen(function* () {
 }).pipe(Effect.ignore);
 const sessionEnd = Command.make(harnessCommandNames.sessionEnd, { protocol: protocolFlag }, (flags) => flags.protocol === "1" ? endHarnessSession : Effect.void).pipe(Command.withDescription("Ends the ref0 session of a harness session that's closing"), Command.withShortDescription("End the harness’s ref0 session"));
 //#endregion
+//#region src/harness/commit-environment.ts
+/**
+* The agent as the author of its commits, set at a Claude Code session's start in the
+* environment of the agent's own commands, and nowhere else: the file `CLAUDE_ENV_FILE` names,
+* which Claude Code runs ahead of each of them. It sets Git's author to the agent, by its owner
+* and handle and its commit email; one `GIT_CONFIG_*` entry naming ref0's hooks folder as
+* `core.hooksPath`, after any the command already has; and, for the trailer, the harness, the
+* session's transcript and the model it started with, both from Claude Code's `SessionStart`.
+* Its other hooks carry no model, so the trailer reads the transcript's last. Git takes the
+* committer from the person's own config, with their signature, and a commit the person makes in
+* their own terminal has none of it.
+*
+* The agent is the one the session's config folder acts as, from that folder's host grant, which
+* `ref0 connect` keeps with the agent's ID. It sets no author when the grant can't be read, or
+* when the session's checkout signs off its commits: any of the last 20 on its default branch
+* has a `Signed-off-by`, or it has `.github/dco.yml`. A DCO check wants each sign-off to match
+* its commit's author, and an agent never signs off. The hooks path is still set.
+*/
+/** How many commits on the default branch a session's start reads for a sign-off. */
+const signedOffWithin = 20;
+/** A model as the trailer names it, which the hook also checks: one word, without a newline. */
+const modelName = /^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/;
+/**
+* The model a session started with, as the trailer names it: none for a value it can't name.
+* Claude Code may follow the model with its context window, as `[1m]`, which isn't the model.
+*/
+const startingModel = (model) => Option.filter(Option.fromNullishOr(model?.replace(/\[[^\]]*\]$/, "")), (name) => modelName.test(name));
+/** A variable the file exports, or unsets when the session has no value for it. */
+const exported = (name, value) => Option.match(value, {
+	onNone: () => `unset ${name}`,
+	onSome: (word) => `export ${name}=${shellWord(word)}`
+});
+/**
+* What a session's start adds to the file Claude Code runs ahead of the agent's commands. The
+* hooks path goes after the entries a command already has, once however often the file runs.
+* Without an author, it drops one an outer agent's session set.
+*/
+const environmentScript = (set) => [
+	"",
+	"# ref0: the agent as the author of its commits, and ref0's Git hooks, in its commands",
+	...Option.match(set.author, {
+		onNone: () => [`case \${GIT_AUTHOR_EMAIL-} in *@${agentCommitDomain}) unset GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL ;; esac`],
+		onSome: (author) => [`export GIT_AUTHOR_NAME=${shellWord(author.name)}`, `export GIT_AUTHOR_EMAIL=${shellWord(author.email)}`]
+	}),
+	`export ${gitHookVariables.harness}=${set.harness}`,
+	exported(gitHookVariables.transcript, set.transcript),
+	exported(gitHookVariables.model, set.model),
+	"if [ -z \"${ref0_hooks_set-}\" ]; then",
+	"  ref0_n=${GIT_CONFIG_COUNT:-0}",
+	`  export "GIT_CONFIG_KEY_$ref0_n=core.hooksPath" "GIT_CONFIG_VALUE_$ref0_n="${shellWord(set.folder)} "GIT_CONFIG_COUNT=$((ref0_n + 1))"`,
+	"  ref0_hooks_set=1",
+	"  unset ref0_n",
+	"fi",
+	""
+].join("\n");
+/** How the agent runs a tool that installs hooks where `core.hooksPath` points. */
+const hookInstallerPrefix = "env -u GIT_CONFIG_COUNT";
+/**
+* What the agent reads at its session's start once its commands name ref0's hooks folder: an
+* installer run there fails on that read-only folder, and without ref0's entry it installs into
+* the repo's own.
+*/
+const hookInstallerWords = `ref0: Git in your commands runs hooks through ref0's read-only folder, so run a hook installer, such as git lfs install, pre-commit install, lefthook install or simple-git-hooks, as ${hookInstallerPrefix} <command>, to install into the repo's own hooks folder.`;
+/** Codex uses an include in `GIT_CONFIG_PARAMETERS`, leaving a launcher's count alone. */
+const codexHookInstallerWords = hookInstallerWords.replace(hookInstallerPrefix, "env -u GIT_CONFIG_PARAMETERS");
+/**
+* What the session's checkout says: which of ref0's hooks folders it needs, `all` when it has
+* its own frequent hook, and whether it signs off its commits. Outside a checkout, neither.
+*/
+const checkoutAt = Effect.fnUntraced(function* (cwd) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const git = (folder, args) => spawner.string(ChildProcess.make("git", [
+		"-C",
+		folder,
+		...args
+	])).pipe(Effect.catchCause(() => Effect.succeed("")));
+	const executable = (file) => fs.stat(file).pipe(Effect.map((info) => info.type === "File" && (info.mode & 73) !== 0), Effect.orElseSucceed(() => false));
+	const top = (yield* git(cwd, ["rev-parse", "--show-toplevel"])).trim();
+	const outside = {
+		folder: "most",
+		signsOff: false
+	};
+	if (top === "") return outside;
+	const hooks = (yield* git(top, ["rev-parse", ...frequentHooks.flatMap((name) => ["--git-path", `hooks/${name}`])])).split("\n").filter(Boolean);
+	const folder = (yield* Effect.forEach(hooks, (hook) => executable(path.resolve(top, hook)))).some(Boolean) ? "all" : "most";
+	if (yield* fs.exists(path.join(top, ".github", "dco.yml")).pipe(Effect.orElseSucceed(() => false))) return {
+		folder,
+		signsOff: true
+	};
+	const defaultBranch = (yield* git(top, [
+		"symbolic-ref",
+		"-q",
+		"refs/remotes/origin/HEAD"
+	])).trim();
+	return {
+		folder,
+		signsOff: (yield* git(top, [
+			"log",
+			"--no-show-signature",
+			"-n",
+			`${signedOffWithin}`,
+			"--format=%(trailers:key=Signed-off-by,valueonly)",
+			defaultBranch === "" ? "HEAD" : defaultBranch,
+			"--"
+		])).trim() !== ""
+	};
+});
+/**
+* Adds the agent's commit environment to the file Claude Code names, for the session its
+* `SessionStart` opens: only in Claude Code, and only for a setup with an agent. ref0's hooks
+* folder is written first, so the file never names a folder that isn't there. Whether it set
+* ref0's hooks path.
+*/
+const setCommitEnvironment = Effect.fnUntraced(function* (session) {
+	const fs = yield* FileSystem.FileSystem;
+	const folders = yield* ConfigFolders;
+	const file = yield* Config.String("CLAUDE_ENV_FILE").pipe(Config.withDefault(""));
+	if (file === "") {
+		if ((yield* Config.String("CODEX_HOME").pipe(Config.withDefault(""))) === "") return false;
+		return yield* setCodexCommitEnvironment(session.cwd ?? ".", yield* checkoutAt(session.cwd ?? "."));
+	}
+	const connected = yield* (yield* HostGrant).get(yield* folders.folder("claude-code")).pipe(Effect.map(Option.map(Option.some)), Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedSome(Option.none())));
+	if (Option.isNone(connected)) return false;
+	const checkout = yield* checkoutAt(session.cwd ?? ".");
+	const folder = yield* hooksFolder(yield* gitHooksHome(yield* Config.String("HOME"), (yield* Ref0Config).api), checkout.folder);
+	const author = checkout.signsOff ? Option.none() : Option.map(connected.value, (grant) => ({
+		name: agentCommitName(grant.owner, grant.agent),
+		email: agentCommitEmail(grant.agentId)
+	}));
+	const script = environmentScript({
+		author,
+		folder,
+		harness: "claude-code",
+		transcript: Option.filter(Option.fromNullishOr(session.transcript_path), (path) => path !== ""),
+		model: startingModel(session.model)
+	});
+	yield* fs.writeFileString(file, script, { flag: "a" });
+	return true;
+});
+//#endregion
 //#region src/harness/session-start.ts
 /**
 * `ref0 hook session-start`: the harness's `SessionStart` hook, a command, before `ref0 mcp`
@@ -31876,11 +33831,22 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 	const input = yield* stdio.stdin.pipe(Stream.decodeText(), Stream.mkString);
 	const hook = decodeHook(input);
 	if (Option.isNone(hook)) return;
+	if (yield* setCommitEnvironment(hook.value).pipe(Effect.orElseSucceed(() => false))) {
+		const claude = yield* Config.String("CLAUDE_ENV_FILE").pipe(Config.withDefault(""));
+		yield* Console.log(claude === "" ? codexHookInstallerWords : hookInstallerWords);
+	}
 	const binding = yield* bindingHere(hook.value.session_id);
 	if (Option.isNone(binding)) return;
 	const harnessName = binding.value.harness === "codex" ? "codex" : "claude-code";
 	const folder = yield* agents.folder(harnessName);
-	const agent = yield* (yield* HostGrant).get(folder);
+	const kept = yield* (yield* HostGrant).get(folder).pipe(Effect.map((agent) => ({
+		agent,
+		readable: true
+	})), Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeed({
+		agent: Option.none(),
+		readable: false
+	})));
+	const agent = kept.agent;
 	const repair = Option.isSome(agent) ? installLine(folder) : yield* connectLineFor(harnessName, folder);
 	const update = updateLine({
 		protocol,
@@ -31889,7 +33855,8 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 	if (Option.isSome(update)) return yield* Console.log(update.value);
 	if (Option.isNone(agent)) {
 		const name = harnessName === "codex" ? "Codex" : "Claude Code";
-		return yield* Console.log(`ref0: no agent is connected for this ${name} config folder, ${folder}, so no session starts. In your own terminal, run: ${repair}`);
+		const why = kept.readable ? `no agent is connected for this ${name} config folder, ${folder}` : `the host grant kept for this ${name} config folder, ${folder}, can't be read`;
+		return yield* Console.log(`ref0: ${why}, so no session starts. In your own terminal, run: ${repair}`);
 	}
 	const account = sessionAccount(binding.value);
 	const held = yield* keychain.get(account);
@@ -31984,24 +33951,26 @@ const claudeCodeChecks = Effect.fnUntraced(function* (configFolder) {
 	const claude = yield* onPath("claude");
 	if (Option.isNone(claude)) return [checkOf("plugin", "unknown", "Claude Code isn’t on PATH", reinstall)];
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
-	const listed = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).string(ChildProcess.make(claude.value, [
+	const fs = yield* FileSystem.FileSystem;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const listed = yield* Effect.scoped(Effect.flatMap(emptyFolder(fs), (cwd) => spawner.string(ChildProcess.make(claude.value, [
 		"plugin",
 		"list",
 		"--json"
 	], {
+		cwd,
 		env: {
 			HOME: home,
 			CLAUDE_CONFIG_DIR: configFolder
 		},
 		extendEnv: true
-	})).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
+	})))).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
 	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Claude Code didn’t list its plugins", reinstall)];
 	const name = yield* originPluginName((yield* Ref0Config).api);
 	const id = `${name}@${name}`;
 	const plugin = listed.value.find((each) => each.id === id);
 	if (plugin === void 0) return [checkOf("plugin", "no", "not installed in this folder", reinstall)];
 	if (!plugin.enabled) return [checkOf("plugin", "no", "turned off in this folder", `CLAUDE_CONFIG_DIR=${shellWord(configFolder)} claude plugin enable ${id}`)];
-	const fs = yield* FileSystem.FileSystem;
 	const folder = plugin.readFromFolder ?? plugin.installPath;
 	const hooks = folder === void 0 ? Option.none() : yield* fs.readFileString(`${folder}/hooks/hooks.json`).pipe(Effect.flatMap(decodeHooks), Effect.option);
 	return [speaksCheck(Option.match(hooks, {
@@ -32021,8 +33990,7 @@ const codexChecks = Effect.fnUntraced(function* (configFolder) {
 	const reinstall = installLine(configFolder);
 	const codex = yield* onPath("codex");
 	if (Option.isNone(codex)) return [checkOf("plugin", "unknown", "Codex isn’t on PATH", reinstall)];
-	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
-	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [home] }, configFolder).pipe(Effect.option);
+	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [] }, { CODEX_HOME: configFolder }).pipe(Effect.option);
 	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Codex didn’t list its hooks", reinstall)];
 	const name = yield* originPluginName((yield* Ref0Config).api);
 	const hooks = listed.value.data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, `${name}@${name}`));
@@ -32060,12 +34028,13 @@ const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ js
 	const reports = [];
 	for (const configFolder of paths) {
 		const kept = yield* Effect.result(grants.get(configFolder));
+		const unreadable = Result.isFailure(kept) && kept.failure.unreadable === true;
 		const grant = Result.isSuccess(kept) ? kept.success : Option.none();
 		const harness = Option.isSome(grant) ? grant.value.harness : candidates.get(configFolder);
 		if (Result.isFailure(kept) || Option.isNone(grant)) {
 			const report = {
 				configFolder,
-				checks: [checkOf("connected", Result.isFailure(kept) ? "unknown" : "no", Result.isFailure(kept) ? "The keychain didn’t say whether this config folder holds a host grant." : "not connected", Result.isFailure(kept) ? kept.failure.nextStep : harness === void 0 ? "ref0 connect" : yield* connectLineFor(harness, configFolder))]
+				checks: [Result.isFailure(kept) && !unreadable ? checkOf("connected", "unknown", "The keychain didn’t say whether this config folder holds a host grant.", kept.failure.nextStep) : checkOf("connected", "no", unreadable ? "its host grant can’t be read" : "not connected", harness === void 0 ? "ref0 connect" : yield* connectLineFor(harness, configFolder))]
 			};
 			reports.push(harness === void 0 ? report : {
 				...report,