@ref0/cli 0.8.0 → 0.10.0

package/dist/main.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Cause, Clock, Config, ConfigProvider, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
+import { Cause, Clock, Config, ConfigProvider, Console, Context, Cron, Crypto, Data, DateTime, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, Match, Option, Path, Predicate, Queue, Random, Redacted, Ref, Result, Runtime, Schedule, Schema, SchemaIssue, SchemaTransformation, Scope, Semaphore, Stdio, Stream, Struct, Terminal, Tuple } from "effect";
 import { Argument, CliOutput, Command, Flag, Prompt } from "effect/cli";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "effect/http-api";
@@ -11,7 +11,7 @@ import { access, constants } from "node:fs/promises";
 import { hostname } from "node:os";
 import { connect, createServer as createServer$1 } from "node:net";
 import { join } from "node:path";
-import { McpProtocol, McpServer, Tool, Toolkit } from "effect/ai";
+import { McpProtocol, McpSchema, McpServer, Tool, Toolkit } from "effect/ai";
 //#region ../contracts/src/typeid.ts
 /**
 * TypeIDs: a prefix, an underscore, then a UUID in 26 characters of Crockford's base32,
@@ -18337,11 +18337,29 @@ const CodexProfile = Schema.Struct({
 	])))),
 	network: Schema.optionalKey(Schema.NullOr(Schema.Struct({ enabled: Schema.optionalKey(Schema.NullOr(Schema.Boolean)) })))
 });
-/** `config/read`'s result, as much of it as ref0 reads: the default profile, and the profiles. */
-const CodexConfigRead = Schema.Struct({ config: Schema.Struct({
-	default_permissions: Schema.optionalKey(Schema.NullOr(Schema.String)),
-	permissions: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, CodexProfile)))
-}) });
+/** Codex applies excludes before `set`, then applies either form of allowlist after it. */
+const CodexShellEnvironment = Schema.Struct({
+	set: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, Schema.String))),
+	exclude: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.String))),
+	include_only: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.String))),
+	filters: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, Schema.Literals(["include", "exclude"]))))
+});
+/** The permission and environment policies, with user-layer versions and raw policy for rollback. */
+const CodexConfigRead = Schema.Struct({
+	config: Schema.Struct({
+		default_permissions: Schema.optionalKey(Schema.NullOr(Schema.String)),
+		permissions: Schema.optionalKey(Schema.NullOr(Schema.Record(Schema.String, CodexProfile))),
+		shell_environment_policy: Schema.optionalKey(Schema.NullOr(CodexShellEnvironment))
+	}),
+	layers: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.Struct({
+		name: Schema.Struct({
+			type: Schema.String,
+			file: Schema.optionalKey(Schema.String)
+		}),
+		version: Schema.String,
+		config: Schema.optionalKey(Schema.Struct({ shell_environment_policy: Schema.optionalKey(Schema.Record(Schema.String, Schema.Json)) }))
+	}))))
+});
 /**
 * `config/batchWrite`'s result, as much of it as ref0 holds Codex to: that it wrote, and whether
 * a layer above the person's own config overrides what it wrote.
@@ -18446,7 +18464,7 @@ const HooksFile = Schema.Struct({ hooks: Schema.Record(Schema.String, Schema.Arr
 const McpServersFile = Schema.Struct({ mcpServers: Schema.Record(Schema.String, Schema.Struct({
 	command: Schema.String,
 	args: Schema.Array(Schema.String),
-	/** The variables Codex passes the server beside `HOME`, `PATH` and `SHELL`. */
+	/** The variables Codex passes the server beside the few it always passes, such as `HOME`. */
 	env_vars: Schema.optionalKey(Schema.Array(Schema.String))
 })) });
 const PluginManifest = Schema.Struct({
@@ -18597,12 +18615,15 @@ const CommandHookInput = Schema.Struct({
 });
 /**
 * `SessionStart`'s input, as far as ref0 reads it: the session, where it started, and why
-* (`startup`, `resume`, `clear` or `compact`, which both harnesses send).
+* (`startup`, `resume`, `clear` or `compact`, which both harnesses send); and, for the trailer
+* on the agent's commits, its transcript and the model it started with, which Claude Code sends.
 */
 const SessionStartHookInput = Schema.Struct({
 	session_id: HarnessSessionId,
 	cwd: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 4096))),
-	source: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 32)))
+	source: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 32))),
+	transcript_path: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	model: Schema.optionalKey(Schema.NullOr(Schema.String))
 });
 /**
 * A frame on Claude Code's own inbox socket, as `ref0 mcp` writes one, a line each: the token
@@ -18648,6 +18669,7 @@ const StatusCheck = Schema.Struct({
 		"accepted",
 		"plugin",
 		"trusted",
+		"server",
 		"session"
 	]),
 	answer: StatusAnswer,
@@ -18802,6 +18824,12 @@ const freshLinkSecret = Effect.suspend(() => hashed(Buffer.from(crypto.getRandom
 //#endregion
 //#region src/session.ts
 /**
+* An agent's command in a harness session that has no ref0 session, though an agent is connected
+* for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
+* person instead.
+*/
+var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
+/**
 * The token of the session this command runs in, if it runs in one: an agent's, which its
 * harness bound when the session started. Where it's found is the harness's to say. Outside a
 * session, there's none, and every command is the person's, asked by approval.
@@ -19079,7 +19107,7 @@ const minute = (at) => `${DateTime.formatIso(at).slice(0, 16).replace("T", " ")}
 const styled = (text, code, terminal) => terminal ? `\u001b[${code}m${printable(text)}\u001b[0m` : printable(text);
 const renderLine = (line, terminal) => {
 	if (Predicate.isString(line)) return printable(line);
-	if ("label" in line) return styled(line.label, 1, terminal) + (line.text ? ` ${printable(line.text)}` : "");
+	if ("label" in line) return (line.before ? `${printable(line.before)} ` : "") + styled(line.label, 1, terminal) + (line.text ? ` ${printable(line.text)}` : "");
 	if ("command" in line) return printable(line.command).split("\n").map((part) => `  ${part}`).join("\n");
 	if (line.status === "unknown") return `? unknown  ${printable(line.text)}`;
 	return `${line.status === "yes" ? styled("✓", 32, terminal) : styled("✗", 31, terminal)} ${line.status}  ${printable(line.text)}`;
@@ -19172,11 +19200,13 @@ const accountCommands = [Command.make("whoami", { json }, ({ json: asJson }) =>
 * stays the committer, with their own signature. Git keeps every commit for good, and anyone
 * who reads the repo reads its author, so these name the agent and nothing about its sessions.
 */
+/** The domain of every agent's commit email, which tells an agent's commits from a person's. */
+const agentCommitDomain = "ref0.work";
 /**
 * An agent's commit email: built from its agent ID alone, so it never changes, and never passes
 * to another agent. Nobody reads mail there.
 */
-const agentCommitEmail = (agent) => `${agent}@ref0.work`;
+const agentCommitEmail = (agent) => `${agent}@${agentCommitDomain}`;
 /**
 * An agent's name as its commits' author: its owner, then its handle, as commands write it. A
 * handle renamed later stays as it was in the commits made before.
@@ -19471,6 +19501,67 @@ function freeTextProblem(text, maxCharacters) {
 */
 const forkPath = /^\/([^/]+)(?:\/([^/]+))?\/threads\/([1-9]\d{0,9})(?:\/sessions\/([1-9]\d{0,9})|\/forks\/(fork_[a-z0-9]+))?\/([^/]+)\.git\/(info\/refs|git-upload-pack|git-receive-pack)$/;
 //#endregion
+//#region ../model/src/path-glob.ts
+/** Charges `cells` to the budget: whether it had them. */
+const spend = (budget, cells) => {
+	budget.left -= cells;
+	return budget.left >= 0;
+};
+/**
+* Whether one segment matches one segment pattern, `*` and `?` within it; none once the budget
+* runs out.
+*/
+function segmentMatches(pattern, segment, budget) {
+	const characters = Array.from(segment);
+	const width = characters.length + 1;
+	let reach = new Uint8Array(width);
+	let next = new Uint8Array(width);
+	reach[0] = 1;
+	for (const symbol of pattern) {
+		if (!spend(budget, width)) return void 0;
+		next.fill(0);
+		if (symbol === "*") {
+			let any = 0;
+			for (let j = 0; j < width; j += 1) {
+				any |= reach[j] ?? 0;
+				next[j] = any;
+			}
+		} else for (let j = 1; j < width; j += 1) next[j] = (reach[j - 1] ?? 0) & (symbol === "?" || characters[j - 1] === symbol ? 1 : 0);
+		[reach, next] = [next, reach];
+	}
+	return reach[width - 1] === 1;
+}
+/**
+* Whether `path`, a repo path like `src/a.ts`, matches `pattern`, within `budget`: none once it
+* runs out.
+*/
+function pathMatchesWithin(pattern, path, budget) {
+	const parts = pattern.split("/");
+	const segments = path.split("/");
+	const width = segments.length + 1;
+	let reach = new Uint8Array(width);
+	let next = new Uint8Array(width);
+	reach[0] = 1;
+	for (const part of parts) {
+		if (!spend(budget, width)) return void 0;
+		next.fill(0);
+		if (part === "**") {
+			let any = 0;
+			for (let j = 0; j < width; j += 1) {
+				any |= reach[j] ?? 0;
+				next[j] = any;
+			}
+		} else for (let j = 1; j < width; j += 1) {
+			if (reach[j - 1] !== 1) continue;
+			const matched = segmentMatches(part, segments[j - 1] ?? "", budget);
+			if (matched === void 0) return void 0;
+			next[j] = matched ? 1 : 0;
+		}
+		[reach, next] = [next, reach];
+	}
+	return reach[width - 1] === 1;
+}
+//#endregion
 //#region ../model/src/thread-workflows.ts
 const minuteMillis = 6e4;
 const hourMillis = 60 * minuteMillis;
@@ -20370,6 +20461,18 @@ const harnessFlagNames = { protocol: "protocol" };
 * release, which no hook's declaration carries.
 */
 const pluginVersionVariable = "REF0_PLUGIN_VERSION";
+/**
+* What the launcher puts in `ref0 mcp`'s environment in a checkout of another origin: that
+* origin. The server runs all the same, answering every hook with nothing, since a harness
+* takes a server that exits before `initialize` as broken.
+*/
+const otherOriginVariable = "REF0_OTHER_ORIGIN";
+/**
+* What `ref0 status` puts in the environment of a folder's ref0 server, which it starts to check
+* it starts: the harness it plays. No harness sets it, so a harness's server finds its harness up
+* its parent chain.
+*/
+const serverCheckVariable = "REF0_SERVER_CHECK";
 /** A flag as a command line writes it. */
 const flagWord = (name) => `--${name}`;
 /**
@@ -20383,11 +20486,15 @@ const watchVariables = {
 };
 /**
 * What ref0 puts in the environment of an agent's commands for its commits, beside Git's own
-* author variables: the harness, for the trailer, and what a forwarder in ref0's hooks folder
-* sets for the repo's own hook it runs, so a forwarder that hook reaches runs nothing.
+* author variables: for the trailer, the harness, the session's transcript, whose last model it
+* names, and the model the session started with, for a transcript that names none; and what a
+* forwarder in ref0's hooks folder sets for the repo's own hook it runs, so a forwarder that hook
+* reaches forwards nothing.
 */
 const gitHookVariables = {
 	harness: "REF0_HARNESS",
+	transcript: "REF0_TRANSCRIPT",
+	model: "REF0_MODEL",
 	forwarded: "REF0_GIT_HOOK"
 };
 //#endregion
@@ -20473,10 +20580,19 @@ const sessionStartHook = ref0Hook(harnessCommandNames.sessionStart);
 /** Ends the session, as a command too. */
 const sessionEndHook = ref0Hook(harnessCommandNames.sessionEnd);
 /**
+* What Linux's keychain needs to be reached: `secret-tool` finds the session bus by its address,
+* or else in the runtime folder, and with neither it can't read a grant. Codex 0.164.0 passes a
+* server neither unless asked. macOS's keychain needs neither, and Codex passes an unset one as
+* unset.
+*/
+const keychainVariables = ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR"];
+/**
 * The plugin's server, `ref0 mcp`, started by M0's inline launcher, the lookup in one line: a
 * script path in a server's arguments stays literal in Codex. It has no `cwd`, so the server
-* keeps the project's folder in both harnesses. Codex starts its servers with only `HOME`, `PATH`
-* and `SHELL`, so it's asked for `CODEX_HOME`, which an unset one leaves unset.
+* keeps the project's folder in both harnesses. Codex starts its servers with only a few of its
+* variables, such as `HOME`, `PATH` and `SHELL` (`server-check.ts` lists them), so it's asked for
+* `CODEX_HOME` and the keychain's, each passed through as Codex has it and never written down: a
+* bus address changes with each login. Claude Code passes its whole environment.
 */
 const mcpFile = (version, api, server = "ref0") => ({
 	path: "ref0/.mcp.json",
@@ -20491,133 +20607,14 @@ const mcpFile = (version, api, server = "ref0") => ({
 		env_vars: [
 			"CODEX_HOME",
 			"CLAUDE_CONFIG_DIR",
-			"REF0_API"
+			"REF0_API",
+			...keychainVariables
 		]
 	} } })
 });
 /** Each event a harness's hooks send `ref0 mcp`, with the fields it reads, as an `mcp_tool` hook. */
 const mcpToolHooks = (server, hookFields) => Object.fromEntries(Object.entries(hookFields).map(([event, fields]) => [event, [mcpToolHook(server, event, fields)]]));
 //#endregion
-//#region src/keychain.ts
-/**
-* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
-* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
-* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
-* an argument, since any process on the machine can read another's arguments.
-*/
-var KeychainError = class extends Schema.TaggedError()("KeychainError", {
-	nextStep: Schema.String,
-	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
-	unreadable: Schema.optionalKey(Schema.Literal(true))
-}) {};
-/**
-* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
-* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
-*/
-const keychainIn = Effect.fnUntraced(function* (service) {
-	const crypto = yield* Crypto.Crypto;
-	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
-	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
-	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
-	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
-		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
-		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
-		const code = yield* handle.exitCode;
-		return {
-			output: output.trim(),
-			complaint: complaint.trim(),
-			code,
-			succeeded: code === ChildProcessSpawner.ExitCode(0)
-		};
-	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
-	const get = Effect.fn("Keychain.get")(function* (account) {
-		const found = macOS ? yield* run("security", [
-			"find-generic-password",
-			"-s",
-			service,
-			"-a",
-			account,
-			"-w"
-		], "") : yield* run("secret-tool", [
-			"lookup",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
-		if (macOS) {
-			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
-			return yield* unavailable;
-		}
-		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
-		const listed = yield* run("secret-tool", [
-			"search",
-			"--all",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
-		return Option.none();
-	});
-	const set = Effect.fn("Keychain.set")(function* (account, secret) {
-		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
-		const value = Redacted.value(secret);
-		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
-		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
-		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
-		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
-			"store",
-			"--label",
-			`ref0 ${account}`,
-			"service",
-			service,
-			"account",
-			account
-		], Redacted.value(secret))).succeeded) return yield* unavailable;
-	});
-	const remove = Effect.fn("Keychain.remove")(function* (account) {
-		if (!(yield* macOS ? run("security", [
-			"delete-generic-password",
-			"-s",
-			service,
-			"-a",
-			account
-		], "") : run("secret-tool", [
-			"clear",
-			"service",
-			service,
-			"account",
-			account
-		], "")).succeeded) return yield* unavailable;
-	});
-	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
-	return {
-		probe: Effect.gen(function* () {
-			const account = `connect-probe/${yield* random}`;
-			const value = Redacted.make(yield* random);
-			yield* Effect.gen(function* () {
-				yield* set(account, value);
-				const kept = yield* get(account);
-				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
-				yield* remove(account);
-			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
-		}).pipe(Effect.timeoutOrElse({
-			duration: Duration.minutes(1),
-			orElse: () => Effect.fail(unavailable)
-		})),
-		get,
-		set,
-		remove
-	};
-});
-var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
-	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
-};
-//#endregion
 //#region src/harness/binding.ts
 /**
 * Where a session's token is kept: the machine's keychain, under the API origin’s keychain service, by an
@@ -20655,9 +20652,8 @@ function bindingFromEnvironment(environment, found, hookSession) {
 //#endregion
 //#region src/harness/session-token.ts
 /**
-* The session token of the harness session a command runs in, from the keychain, under the
-* account its binding names. Outside a harness, or in one whose session ref0 never started,
-* there's none, and a command is its person's, asked by approval.
+* The harness session a command runs in: the harness process up its parent chain, and the
+* binding its session's token is kept under, which `command-token.ts` reads.
 */
 const optional$1 = (name) => Config.String(name).pipe(Config.option, Config.map(Option.getOrUndefined));
 /** What the harness put in this process's environment, as far as a binding needs. */
@@ -20665,7 +20661,6 @@ const harnessEnvironment = Config.all({
 	CLAUDE_CODE_SESSION_ID: optional$1("CLAUDE_CODE_SESSION_ID"),
 	CLAUDE_PID: optional$1("CLAUDE_PID"),
 	CODEX_SESSION_ID: optional$1("CODEX_SESSION_ID"),
-	CODEX_HOME: optional$1("CODEX_HOME"),
 	CODEX_SANDBOX: optional$1("CODEX_SANDBOX")
 });
 /**
@@ -20740,17 +20735,6 @@ const bindingForServer = Effect.fnUntraced(function* (harnessSession) {
 		process: found.value.process
 	});
 });
-/** `SessionToken` from the keychain, by the binding of the harness session this runs in. */
-const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
-	const keychain = yield* Keychain;
-	const harness = yield* HarnessProcess;
-	const current = Effect.gen(function* () {
-		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
-		if (Option.isNone(binding)) return Option.none();
-		return yield* keychain.get(sessionAccount(binding.value));
-	});
-	return SessionToken.of({ current });
-}));
 //#endregion
 //#region src/harness/config-folders.ts
 const Folders = Schema.Array(Schema.String);
@@ -20863,101 +20847,227 @@ const connectLineFor = Effect.fnUntraced(function* (harness, configFolder) {
 	return `${configFolders[harness].variable}=${shellWord(configFolder)} ref0 connect`;
 });
 //#endregion
-//#region src/host-grant.ts
-/**
-* All lasting authority for one config folder, stored as one keychain value: the agent the folder
-* acts as, by its owner, handle and agent ID, and its token. The ID is kept in the same write as
-* the token, so a folder with a grant always knows which agent its commits name.
-*/
-const KeptHostGrant = Schema.Struct({
-	harness: ConnectHarness,
-	owner: OwnerName,
-	agent: AgentHandle,
-	agentId: AgentId,
-	token: Schema.RedactedFromValue(Schema.String)
-});
-const decodeGrant = Schema.decodeUnknownOption(Schema.fromJsonString(KeptHostGrant));
-const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
-/** Grants in the origin’s keychain service, account host-grant/<resolved config folder>. */
-var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant") {
-	static layer = Layer.effect(HostGrant, Effect.gen(function* () {
-		const keychain = yield* Keychain;
-		const folders = yield* ConfigFolders;
-		const account = (folder) => folders.resolve(folder).pipe(Effect.map((real) => `host-grant/${real}`));
-		return HostGrant.of({
-			get: (folder) => account(folder).pipe(Effect.flatMap(keychain.get), Effect.flatMap((kept) => {
-				if (Option.isNone(kept)) return Effect.succeedNone;
-				const grant = decodeGrant(Redacted.value(kept.value));
-				return Option.isSome(grant) ? Effect.succeed(grant) : Effect.fail(new KeychainError({
-					nextStep: "This config folder’s host grant is unreadable. Run ref0 connect again.",
-					unreadable: true
-				}));
-			})),
-			keep: (folder, grant) => Effect.gen(function* () {
-				yield* keychain.set(yield* account(folder), Redacted.make(encodeGrant(grant)));
-				yield* folders.keep(folder).pipe(Effect.mapError(() => new KeychainError({ nextStep: "Couldn’t record this connected config folder in ~/.ref0. Check that it’s writable, then run ref0 connect." })));
-			}),
-			remove: (folder) => account(folder).pipe(Effect.flatMap(keychain.remove))
-		});
-	}));
-};
-/** An explicitly named agent's grant: the current folder first, then other connected folders. */
-const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
-	const grants = yield* HostGrant;
-	const folders = yield* ConfigFolders;
-	const candidates = [yield* currentConfigFolder, ...yield* folders.all];
-	for (const folder of new Set(candidates)) {
-		const grant = yield* grants.get(folder);
-		if (Option.isSome(grant) && grant.value.owner === owner && grant.value.agent === agent) return grant;
-	}
-	return Option.none();
-});
-//#endregion
-//#region src/version.ts
-/**
-* The CLI's version, from its `package.json` as the build reads it: what `ref0 --version`
-* prints, what its MCP server and Codex client say they are, and what the plugin carries, so
-* an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
-* and only as a default export.
-*/
-const cliVersion = "0.8.0";
-//#endregion
-//#region src/harness/hook-protocol.ts
+//#region src/keychain.ts
 /**
-* Whether this `ref0` speaks the hook protocol of the plugin that ran it, and what to say when
-* it doesn't. The plugin and the CLI update apart, so each hook's declaration carries the
-* protocol it speaks, and a `ref0` that speaks another answers with the update line: the session
-* start says it to the agent, and `ref0 mcp` refuses each hook with it.
+* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
+* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
+* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
+* an argument, since any process on the machine can read another's arguments.
 */
-/** The plugin's release, from its lookup script or launcher; none if something else ran `ref0`. */
-const pluginVersion = Config.String(pluginVersionVariable).pipe(Config.option);
-/** The protocol passed by a command hook, without running any of its code. */
-const protocolFlagged = (command) => /--protocol (\S+)/.exec(command)?.[1];
-/** Every readable protocol in a fetched or installed hooks file. */
-const protocolsOf = (file) => Object.values(file.hooks).flatMap((groups) => groups.flatMap((group) => group.hooks)).map((hook) => hook.type === "mcp_tool" ? hook.input["protocol"] : protocolFlagged(hook.command)).filter(Predicate.isString);
-/** `--protocol`, which each command hook passes: the hook protocol its declaration speaks. */
-const protocolFlag = Flag.String(harnessFlagNames.protocol).pipe(Flag.withDescription("The hook protocol the plugin speaks"));
-/** The command that installs the plugin again into a connected folder. */
-const installLine = (folder) => `ref0 install ${shellWord(folder)}`;
+var KeychainError = class extends Schema.TaggedError()("KeychainError", {
+	nextStep: Schema.String,
+	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
+	unreadable: Schema.optionalKey(Schema.Literal(true))
+}) {};
 /**
-* Why this `ref0` doesn't speak the plugin's hook protocol, and what to run: a newer plugin needs
-* a newer `ref0`, and an older one installing again. None when `ref0` speaks it.
+* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
+* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
 */
-const protocolMismatch = (plugin, reinstall) => {
-	if (plugin.protocol === "1") return Option.none();
-	const which = Option.match(plugin.version, {
-		onNone: () => "ref0’s plugin",
-		onSome: (version) => `ref0’s plugin ${version}`
-	});
-	const newer = Number(plugin.protocol) > 1;
-	return Option.some(newer ? {
-		says: `${which} needs a newer ref0 than ${cliVersion}`,
-		run: "npm i -g @ref0/cli"
-	} : {
-		says: `${which} is older than ref0 ${cliVersion} speaks`,
-		run: reinstall
-	});
-};
+const keychainIn = Effect.fnUntraced(function* (service) {
+	const crypto = yield* Crypto.Crypto;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
+	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
+	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
+	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
+		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
+		const code = yield* handle.exitCode;
+		return {
+			output: output.trim(),
+			complaint: complaint.trim(),
+			code,
+			succeeded: code === ChildProcessSpawner.ExitCode(0)
+		};
+	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
+	const get = Effect.fn("Keychain.get")(function* (account) {
+		const found = macOS ? yield* run("security", [
+			"find-generic-password",
+			"-s",
+			service,
+			"-a",
+			account,
+			"-w"
+		], "") : yield* run("secret-tool", [
+			"lookup",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
+		if (macOS) {
+			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
+			return yield* unavailable;
+		}
+		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
+		const listed = yield* run("secret-tool", [
+			"search",
+			"--all",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
+		return Option.none();
+	});
+	const set = Effect.fn("Keychain.set")(function* (account, secret) {
+		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
+		const value = Redacted.value(secret);
+		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
+		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
+		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
+		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
+			"store",
+			"--label",
+			`ref0 ${account}`,
+			"service",
+			service,
+			"account",
+			account
+		], Redacted.value(secret))).succeeded) return yield* unavailable;
+	});
+	const remove = Effect.fn("Keychain.remove")(function* (account) {
+		if (!(yield* macOS ? run("security", [
+			"delete-generic-password",
+			"-s",
+			service,
+			"-a",
+			account
+		], "") : run("secret-tool", [
+			"clear",
+			"service",
+			service,
+			"account",
+			account
+		], "")).succeeded) return yield* unavailable;
+	});
+	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
+	return {
+		probe: Effect.gen(function* () {
+			const account = `connect-probe/${yield* random}`;
+			const value = Redacted.make(yield* random);
+			yield* Effect.gen(function* () {
+				yield* set(account, value);
+				const kept = yield* get(account);
+				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
+				yield* remove(account);
+			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
+		}).pipe(Effect.timeoutOrElse({
+			duration: Duration.minutes(1),
+			orElse: () => Effect.fail(unavailable)
+		})),
+		get,
+		set,
+		remove
+	};
+});
+var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
+	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
+};
+//#endregion
+//#region src/host-grant.ts
+/**
+* All lasting authority for one config folder, stored as one keychain value: the agent the folder
+* acts as, by its owner, handle and agent ID, and its token. The ID is kept in the same write as
+* the token, so a folder with a grant always knows which agent its commits name.
+*/
+const KeptHostGrant = Schema.Struct({
+	harness: ConnectHarness,
+	owner: OwnerName,
+	agent: AgentHandle,
+	agentId: AgentId,
+	token: Schema.RedactedFromValue(Schema.String)
+});
+const decodeGrant = Schema.decodeUnknownOption(Schema.fromJsonString(KeptHostGrant));
+const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
+/**
+* The token alone, from any record that's JSON with a string `token`, so a record this ref0 can't
+* read as a grant, such as one an earlier ref0 kept, still names the grant it held.
+*/
+const decodeHeldToken = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ token: KeptHostGrant.fields.token })));
+/** Grants in the origin’s keychain service, account host-grant/<resolved config folder>. */
+var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant") {
+	static layer = Layer.effect(HostGrant, Effect.gen(function* () {
+		const keychain = yield* Keychain;
+		const folders = yield* ConfigFolders;
+		const account = (folder) => folders.resolve(folder).pipe(Effect.map((real) => `host-grant/${real}`));
+		return HostGrant.of({
+			get: (folder) => account(folder).pipe(Effect.flatMap(keychain.get), Effect.flatMap((kept) => {
+				if (Option.isNone(kept)) return Effect.succeedNone;
+				const grant = decodeGrant(Redacted.value(kept.value));
+				return Option.isSome(grant) ? Effect.succeed(grant) : Effect.fail(new KeychainError({
+					nextStep: "This config folder’s host grant is unreadable. Run ref0 connect again.",
+					unreadable: true
+				}));
+			})),
+			heldToken: (folder) => account(folder).pipe(Effect.flatMap(keychain.get), Effect.map(Option.flatMap((kept) => Option.map(decodeHeldToken(Redacted.value(kept)), (held) => held.token)))),
+			keep: (folder, grant) => Effect.gen(function* () {
+				yield* keychain.set(yield* account(folder), Redacted.make(encodeGrant(grant)));
+				yield* folders.keep(folder).pipe(Effect.mapError(() => new KeychainError({ nextStep: "Couldn’t record this connected config folder in ~/.ref0. Check that it’s writable, then run ref0 connect." })));
+			}),
+			remove: (folder) => account(folder).pipe(Effect.flatMap(keychain.remove))
+		});
+	}));
+};
+/** An explicitly named agent's grant: the current folder first, then other connected folders. */
+const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
+	const grants = yield* HostGrant;
+	const folders = yield* ConfigFolders;
+	const candidates = [yield* currentConfigFolder, ...yield* folders.all];
+	for (const folder of new Set(candidates)) {
+		const grant = yield* grants.get(folder);
+		if (Option.isSome(grant) && grant.value.owner === owner && grant.value.agent === agent) return grant;
+	}
+	return Option.none();
+});
+//#endregion
+//#region src/version.ts
+/**
+* The CLI's version, from its `package.json` as the build reads it: what `ref0 --version`
+* prints, what its MCP server and Codex client say they are, and what the plugin carries, so
+* an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
+* and only as a default export.
+*/
+const cliVersion = "0.10.0";
+//#endregion
+//#region src/harness/hook-protocol.ts
+/**
+* Whether this `ref0` speaks the hook protocol of the plugin that ran it, and what to say when
+* it doesn't. The plugin and the CLI update apart, so each hook's declaration carries the
+* protocol it speaks, and a `ref0` that speaks another answers with the update line: the session
+* start says it to the agent, and `ref0 mcp` refuses each hook with it.
+*/
+/** The plugin's release, from its lookup script or launcher; none if something else ran `ref0`. */
+const pluginVersion = Config.String(pluginVersionVariable).pipe(Config.option);
+/** The protocol passed by a command hook, without running any of its code. */
+const protocolFlagged = (command) => /--protocol (\S+)/.exec(command)?.[1];
+/** Every readable protocol in a fetched or installed hooks file. */
+const protocolsOf = (file) => Object.values(file.hooks).flatMap((groups) => groups.flatMap((group) => group.hooks)).map((hook) => hook.type === "mcp_tool" ? hook.input["protocol"] : protocolFlagged(hook.command)).filter(Predicate.isString);
+/** `--protocol`, which each command hook passes: the hook protocol its declaration speaks. */
+const protocolFlag = Flag.String(harnessFlagNames.protocol).pipe(Flag.withDescription("The hook protocol the plugin speaks"));
+/** The command that installs the plugin again into a connected folder. */
+const installLine = (folder) => `ref0 install ${shellWord(folder)}`;
+/**
+* Why this `ref0` doesn't speak the plugin's hook protocol, and what to run: a newer plugin needs
+* a newer `ref0`, and an older one installing again. None when `ref0` speaks it.
+*/
+const protocolMismatch = (plugin, reinstall) => {
+	if (plugin.protocol === "1") return Option.none();
+	const which = Option.match(plugin.version, {
+		onNone: () => "ref0’s plugin",
+		onSome: (version) => `ref0’s plugin ${version}`
+	});
+	const newer = Number(plugin.protocol) > 1;
+	return Option.some(newer ? {
+		says: `${which} needs a newer ref0 than ${cliVersion}`,
+		run: "npm i -g @ref0/cli"
+	} : {
+		says: `${which} is older than ref0 ${cliVersion} speaks`,
+		run: reinstall
+	});
+};
 /** The line that says what to run when the plugin speaks a protocol this `ref0` doesn't. */
 const updateLine = (plugin, reinstall) => Option.map(protocolMismatch(plugin, reinstall), ({ says, run }) => `ref0: ${says}. Run: ${run}`);
 //#endregion
@@ -21076,45 +21186,129 @@ var OldHostGrants = class OldHostGrants extends Context.Service()("ref0/cli/OldH
 	}));
 };
 //#endregion
-//#region src/attachment-request.ts
-/**
-* The machine prints its link and Find code, then collects with its own secret and the answer
-* from the approving browser. It keeps and confirms each folder's grant before installing.
-*/
-const isAnswerCode = Schema.is(TypedApprovalCode);
-/** A key's escape code, such as an arrow's, as a terminal sends it. */
-const escapeCode = /\u001b\[[\d;]*[A-Za-z~]/gu;
-const decodeTokenId$1 = Schema.decodeUnknownOption(TokenId);
-const decodeSecretHash$1 = Schema.decodeUnknownEffect(SecretHash);
-/** How often the machine asks whether its person has answered. */
-const pollMillis = 2e3;
-/** How long one request may take before the machine gives up on it, and asks again. */
-const requestTimeout = Duration.seconds(15);
-/**
-* How long past the time to answer the machine still asks while ref0 says it waits: a yes
-* admitted in time waits until ref0 publishes what it connected.
-*/
-const giveUpAfterMillis = 12e4;
-/**
-* How long one try to keep the host grant may wait on the keychain, such as on a prompt to unlock
-* it, before the machine stops it. Ctrl-C can't: the grant is kept even after an interrupt.
-*/
-const keepTimeout = Duration.minutes(1);
+//#region src/yes-or-no.ts
 /**
-* How long keeping every folder's grant may take, so the machine confirms what it kept well
-* before ref0 revokes what it hasn't, 10 minutes after it connected.
+* How long what a terminal held while nobody read it takes to arrive once a question reads: one
+* read, well within this.
 */
-const keepBudget = Duration.minutes(5);
-/** A request that couldn't finish: no answer in time, no connection, or ref0 briefly unable. */
-var Unanswered = class extends Schema.TaggedError()("Unanswered", {}) {};
-const unanswered = () => Effect.fail(new Unanswered());
+const settle = Duration.millis(50);
+const again$2 = "Type y or yes, or n or no. Enter alone is no.";
+/** A line's answer, or none when it's neither yes nor no. */
+const answerOf$1 = (line) => {
+	const word = line.trim().toLowerCase();
+	if (word === "y" || word === "yes") return Option.some(true);
+	if (word === "" || word === "n" || word === "no") return Option.some(false);
+	return Option.none();
+};
+/** What Backspace takes back: one character as the person sees it, an emoji's parts included. */
+const characters = new Intl.Segmenter();
+/** `typed` with Backspace pressed once. */
+const takeBack = (typed) => typed.slice(0, [...characters.segment(typed)].at(-1)?.index);
+/** Whether a key types text: none of its characters moves the cursor or controls the terminal. */
+const typesText = (text) => text !== "" && !/\p{Cc}/u.test(text);
+/** Ctrl-C or Ctrl-D, which a terminal in raw mode hands ref0 as keys, never as a signal. */
+const quits = (key) => key.ctrl && (key.name === "c" || key.name === "d");
+/** The explanation goes to stderr, the question to stdout and its answer comes from stdin. */
+const allTerminals = () => process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
 /**
-* The name the machine sends for itself: its host name without any character that could reorder
-* or hide what's around it, cut to 64 characters without splitting one in two, or `this machine`
-* when that leaves none.
+* Asks yes-or-no questions in this terminal, one after another: each shows `explained` on stderr,
+* then the question, and waits for a line. What was typed before a question showed doesn't answer
+* it, unless another question was asked when it arrived: a line typed after the one that answered
+* a question answers the next. The answer is no, unasked, unless stdin, stdout and stderr are each
+* a terminal, and on Ctrl-C or Ctrl-D.
 */
-const machineNameOf = (hostName) => {
-	let name = "";
+const yesOrNoQuestions = Effect.gen(function* () {
+	const terminal = yield* Terminal.Terminal;
+	const ahead = yield* Ref.make([]);
+	const ask = (explained, question) => Effect.gen(function* () {
+		if (!allTerminals()) return false;
+		const keys = yield* terminal.readInput;
+		yield* Effect.sleep(settle);
+		yield* Queue.clear(keys);
+		const pending = [...yield* Ref.getAndSet(ahead, [])];
+		const next = Effect.suspend(() => {
+			const key = pending.shift();
+			return key === void 0 ? Queue.take(keys) : Effect.succeed(key);
+		});
+		yield* printBlocks([explained]);
+		yield* terminal.display(questionLine(question));
+		let typed = "";
+		let previous = "";
+		while (true) {
+			const pressed = yield* Effect.option(next);
+			if (Option.isNone(pressed) || quits(pressed.value.key)) {
+				yield* terminal.display("\n");
+				return false;
+			}
+			const { input, key } = pressed.value;
+			const ended = key.name === "enter" && previous === "return";
+			previous = key.name;
+			if (ended) continue;
+			if (key.name === "backspace") {
+				if (typed === "") continue;
+				typed = takeBack(typed);
+				yield* terminal.display("\b \b");
+				continue;
+			}
+			if (key.name !== "return" && key.name !== "enter") {
+				const text = Option.getOrElse(input, () => "");
+				if (!typesText(text)) continue;
+				typed += text;
+				yield* terminal.display(text);
+				continue;
+			}
+			yield* terminal.display("\n");
+			const answer = answerOf$1(typed);
+			if (Option.isSome(answer)) {
+				const rest = [...pending, ...yield* Queue.clear(keys)];
+				const ended = key.name === "return" && rest[0]?.key.name === "enter";
+				yield* Ref.set(ahead, ended ? rest.slice(1) : rest);
+				return answer.value;
+			}
+			typed = "";
+			yield* terminal.display(`${again$2}\n${questionLine(question)}`);
+		}
+	}).pipe(Effect.scoped, Effect.orElseSucceed(() => false));
+	return ask;
+});
+//#endregion
+//#region src/attachment-request.ts
+/**
+* The machine prints its link and Find code, then collects with its own secret and the answer
+* from the approving browser. It keeps and confirms each folder's grant before installing.
+*/
+const isAnswerCode = Schema.is(TypedApprovalCode);
+const decodeTokenId$1 = Schema.decodeUnknownOption(TokenId);
+const decodeSecretHash$1 = Schema.decodeUnknownEffect(SecretHash);
+/** How often the machine asks whether its person has answered. */
+const pollMillis = 2e3;
+/** How long one request may take before the machine gives up on it, and asks again. */
+const requestTimeout = Duration.seconds(15);
+/**
+* How long past the time to answer the machine still asks while ref0 says it waits: a yes
+* admitted in time waits until ref0 publishes what it connected.
+*/
+const giveUpAfterMillis = 12e4;
+/**
+* How long one try to keep the host grant may wait on the keychain, such as on a prompt to unlock
+* it, before the machine stops it. Ctrl-C can't: the grant is kept even after an interrupt.
+*/
+const keepTimeout = Duration.minutes(1);
+/**
+* How long keeping every folder's grant may take, so the machine confirms what it kept well
+* before ref0 revokes what it hasn't, 10 minutes after it connected.
+*/
+const keepBudget = Duration.minutes(5);
+/** A request that couldn't finish: no answer in time, no connection, or ref0 briefly unable. */
+var Unanswered = class extends Schema.TaggedError()("Unanswered", {}) {};
+const unanswered = () => Effect.fail(new Unanswered());
+/**
+* The name the machine sends for itself: its host name without any character that could reorder
+* or hide what's around it, cut to 64 characters without splitting one in two, or `this machine`
+* when that leaves none.
+*/
+const machineNameOf = (hostName) => {
+	let name = "";
 	for (const character of withoutHiddenCharacters(hostName).trim()) {
 		if (name.length + character.length > 64) break;
 		name += character;
@@ -21125,14 +21319,14 @@ const machineNameOf = (hostName) => {
 const said = (refusal) => sayFailed(refusal.nextStep);
 const isEnded = (state) => state.state !== "waiting";
 /** The line that asks again. */
-const again$2 = "ref0 connect";
+const again$1 = "ref0 connect";
 /** What each way a request can end without connecting says, with the line that asks again. */
 const endedWords$1 = (state) => {
 	switch (state.state) {
-		case "refused": return `It was refused, and nothing was connected. To ask again, run: ${again$2}`;
-		case "aborted": return `It was aborted, and nothing was connected. To ask again, run: ${again$2}`;
-		case "expired": return `Nobody approved it in time, and nothing was connected. For a new code, run: ${again$2}`;
-		case "failed": return `${state.nextStep} To connect this machine, run: ${again$2}`;
+		case "refused": return `It was refused, and nothing was connected. To ask again, run: ${again$1}`;
+		case "aborted": return `It was aborted, and nothing was connected. To ask again, run: ${again$1}`;
+		case "expired": return `Nobody approved it in time, and nothing was connected. For a new code, run: ${again$1}`;
+		case "failed": return `${state.nextStep} To connect this machine, run: ${again$1}`;
 	}
 };
 /** The grant a kept record holds, by its ID. */
@@ -21148,6 +21342,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const hostGrant = yield* HostGrant;
 	const oldGrants = yield* OldHostGrants;
 	const http = yield* HttpClient.HttpClient;
+	const terminal = yield* Terminal.Terminal;
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	const collecting = yield* freshSecret;
 	const link = yield* freshLinkSecret;
@@ -21159,12 +21354,12 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	const unreachable = () => sayFailed(`Couldn’t reach ref0 at ${config.api}. Try again.`);
 	const requestId = yield* newRequestId;
 	const asking = yield* Effect.forEach(asked, Effect.fnUntraced(function* (folder) {
-		const previous = yield* hostGrant.get(folder.configFolder).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone), Effect.catchTag("KeychainError", said));
+		const held = yield* hostGrant.heldToken(folder.configFolder).pipe(Effect.catchTag("KeychainError", said));
 		return {
 			...folder,
 			shown: shownConfigFolder(home, folder.configFolder),
 			grant: yield* freshTokenSecret,
-			replaces: Option.isSome(previous) ? grantOf(previous.value.token) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said))
+			replaces: Option.isSome(held) ? grantOf(held.value) : yield* oldGrants.replaces(folder).pipe(Effect.catchTag("KeychainError", said))
 		};
 	}));
 	const folders = yield* Effect.forEach(asking, Effect.fnUntraced(function* (folder) {
@@ -21203,12 +21398,20 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		while: Predicate.isTagged("Unanswered"),
 		times: 2
 	}), Effect.catchTag("Unanswered", unreachable));
-	yield* Console.error([
+	yield* printBlocks([[
 		`Open ${config.api}/connect#${link.secret}`,
-		`Or type ${started.code} in Find under Waiting on you, by ${minute(started.expiresAt)}.`,
+		{
+			before: "Or type",
+			label: started.code,
+			text: `in Find under Waiting on you, by ${minute(started.expiresAt)}.`
+		},
 		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for each agent it connects.",
 		"Waiting for the answer. Ctrl-C stops it."
-	].join("\n"));
+	]]);
+	let typed = "";
+	const show = (text) => Effect.ignore(terminal.display(text));
+	const endWait = yield* Effect.cached(Effect.suspend(() => typed === "" ? Effect.void : show("\n")).pipe(Effect.andThen(Console.error(""))));
+	const saidAfterWait = (refusal) => Effect.andThen(endWait, said(refusal));
 	if (opener !== void 0) yield* openBrowser(opener, `${config.api}/connect#${link.secret}`);
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
 	const collector = yield* ref0Client(config.api).pipe(Effect.provide(Layer.merge(anonymousCredential, withSecret)), Effect.provideService(HttpClient.HttpClient, http));
@@ -21220,8 +21423,8 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		duration: requestTimeout,
 		orElse: () => Effect.succeedNone
 	}), Effect.catchTags({
-		AttachmentNotFound: said,
-		Unauthenticated: said,
+		AttachmentNotFound: saidAfterWait,
+		Unauthenticated: saidAfterWait,
 		AuthorityUnavailable: () => Effect.succeedNone,
 		HttpClientError: () => Effect.succeedNone,
 		SchemaError: () => Effect.succeedNone
@@ -21231,7 +21434,10 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		while (true) {
 			const state = yield* collect;
 			if (Option.isSome(state) && isEnded(state.value)) return state.value;
-			if ((yield* Clock.currentTimeMillis) > giveUpAt) return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$2}`);
+			if ((yield* Clock.currentTimeMillis) > giveUpAt) {
+				yield* endWait;
+				return yield* sayFailed(`ref0 hasn’t said how it ended, so this machine kept nothing. If it was approved, ref0 revokes its grants 10 minutes after it connected. To connect this machine, run: ${again$1}`);
+			}
 			yield* Effect.sleep(pollMillis);
 		}
 	});
@@ -21295,12 +21501,12 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			"It connected, but this machine couldn’t keep what it needs to act:",
 			...notKept.map((each) => `${shownConfigFolder(home, each.configFolder)}: ${each.nextStep}`),
 			"This machine never confirmed the grants, so ref0 revokes them 10 minutes after they connected, even if the keychain kept them after all. To connect this machine, run:",
-			{ command: again$2 }
+			{ command: again$1 }
 		]]);
-		const unconfirmed = () => sayFailed(`It connected, and this machine kept its grants, but ref0 didn’t answer when it said so. If ref0 never heard, it revokes them 10 minutes after they connected: then run ${again$2}`);
+		const unconfirmed = () => sayFailed(`It connected, and this machine kept its grants, but ref0 didn’t answer when it said so. If ref0 never heard, it revokes them 10 minutes after they connected: then run ${again$1}`);
 		const confirmId = yield* newRequestId;
 		const answerCode = yield* Ref.get(pasted);
-		if (answerCode === void 0) return yield* sayFailed(`The answer code is missing. Run ${again$2} again.`);
+		if (answerCode === void 0) return yield* sayFailed(`The answer code is missing. Run ${again$1} again.`);
 		if (!(yield* collector.machineAttachments.confirm({
 			params,
 			headers: { "idempotency-key": confirmId },
@@ -21323,7 +21529,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 			schedule: Schedule.spaced("1 second")
 		}), Effect.catchTag("Unanswered", unconfirmed))).confirmed) {
 			for (const folder of kept) yield* hostGrant.remove(folder.configFolder).pipe(Effect.ignore);
-			return yield* sayFailed(`ref0 revoked the grants, since this machine didn’t confirm in time that it kept them. They’re deleted here, and nothing is connected. To connect this machine, run: ${again$2}`);
+			return yield* sayFailed(`ref0 revoked the grants, since this machine didn’t confirm in time that it kept them. They’re deleted here, and nothing is connected. To connect this machine, run: ${again$1}`);
 		}
 		return {
 			owner: state.owner,
@@ -21361,23 +21567,42 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		const connected = yield* finish(isEnded(state) ? state : yield* answered);
 		yield* printBlocks([[{ label: `Connected as ${connected.owner}’s agents` }, ...connected.kept.map((folder) => `${shownConfigFolder(home, folder.configFolder)}  ${folder.handle}`)], ["Stopped, so nothing was installed. To install ref0’s plugin into each, run:", ...connected.kept.map((folder) => ({ command: installLine(folder.configFolder) }))]]);
 	});
-	const terminal = yield* Terminal.Terminal;
-	const readAnswer = Effect.gen(function* () {
-		yield* Console.error(`Paste the code from your own page on ${config.api}.`);
+	const typedCode = Effect.gen(function* () {
+		const keys = yield* terminal.readInput;
 		while (true) {
-			const typed = (yield* terminal.readLine).replaceAll(escapeCode, "").trim();
-			if (typed === "") continue;
-			if (!isAnswerCode(typed)) {
-				yield* Console.error(`Paste the 8-character code from your own page on ${config.api}.`);
+			const pressed = yield* Effect.option(Queue.take(keys));
+			if (Option.isNone(pressed) || quits(pressed.value.key)) return yield* Effect.interrupt;
+			const { input, key } = pressed.value;
+			if (key.name === "backspace") {
+				if (typed === "") continue;
+				typed = takeBack(typed);
+				yield* show("\b \b");
+				continue;
+			}
+			if (key.name !== "return" && key.name !== "enter") {
+				const text = Option.getOrElse(input, () => "");
+				if (!typesText(text)) continue;
+				typed += text;
+				yield* show(text);
 				continue;
 			}
-			yield* Ref.update(pasted, (first) => first ?? typed);
-			if (listener !== void 0) yield* listener.stop;
-			return yield* Effect.never;
+			const line = typed.trim();
+			if (typed !== "") yield* show("\n");
+			typed = "";
+			if (line === "") continue;
+			if (isAnswerCode(line)) return line;
+			yield* printBlocks([[`Paste the 8-character code from your own page on ${config.api}.`]]);
 		}
-	}).pipe(Effect.catchTag("QuitError", () => Effect.interrupt));
+	}).pipe(Effect.scoped);
+	const readAnswer = Effect.gen(function* () {
+		yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
+		const code = yield* typedCode;
+		yield* Ref.update(pasted, (first) => first ?? code);
+		if (listener !== void 0) yield* listener.stop;
+		return yield* Effect.never;
+	});
 	const receiveAnswer = listener === void 0 ? readAnswer : Effect.raceFirst(readAnswer, listener.answer.pipe(Effect.flatMap((code) => Ref.update(pasted, (first) => first ?? code)), Effect.andThen(Effect.never)));
-	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
+	return yield* Effect.uninterruptibleMask((restore) => restore(Effect.raceFirst(answered, receiveAnswer)).pipe(Effect.ensuring(listener === void 0 ? Effect.void : listener.stop), Effect.ensuring(endWait), Effect.onInterrupt(() => Effect.ignore(stopped)), Effect.flatMap(finish)));
 }, Effect.scoped);
 //#endregion
 //#region src/connect-lock.ts
@@ -21512,108 +21737,1411 @@ var ConnectLock = class ConnectLock extends Context.Service()("ref0/cli/ConnectL
 	}));
 };
 //#endregion
-//#region src/yes-or-no.ts
-/**
-* How long what a terminal held while nobody read it takes to arrive once a question reads: one
-* read, well within this.
-*/
-const settle = Duration.millis(50);
-const again$1 = "Type y or yes, or n or no. Enter alone is no.";
-/** A line's answer, or none when it's neither yes nor no. */
-const answerOf$1 = (line) => {
-	const word = line.trim().toLowerCase();
-	if (word === "y" || word === "yes") return Option.some(true);
-	if (word === "" || word === "n" || word === "no") return Option.some(false);
-	return Option.none();
-};
-/** What Backspace takes back: one character as the person sees it, an emoji's parts included. */
-const characters = new Intl.Segmenter();
-/** Whether a key types text: none of its characters moves the cursor or controls the terminal. */
-const typesText = (text) => text !== "" && !/\p{Cc}/u.test(text);
-const quits = (key) => key.ctrl && (key.name === "c" || key.name === "d");
-/** The explanation goes to stderr, the question to stdout and its answer comes from stdin. */
-const allTerminals = () => process.stdin.isTTY === true && process.stdout.isTTY === true && process.stderr.isTTY === true;
-/**
-* Asks yes-or-no questions in this terminal, one after another: each shows `explained` on stderr,
-* then the question, and waits for a line. What was typed before a question showed doesn't answer
-* it, unless another question was asked when it arrived: a line typed after the one that answered
-* a question answers the next. The answer is no, unasked, unless stdin, stdout and stderr are each
-* a terminal, and on Ctrl-C or Ctrl-D.
-*/
-const yesOrNoQuestions = Effect.gen(function* () {
-	const terminal = yield* Terminal.Terminal;
-	const ahead = yield* Ref.make([]);
-	const ask = (explained, question) => Effect.gen(function* () {
-		if (!allTerminals()) return false;
-		const keys = yield* terminal.readInput;
-		yield* Effect.sleep(settle);
-		yield* Queue.clear(keys);
-		const pending = [...yield* Ref.getAndSet(ahead, [])];
-		const next = Effect.suspend(() => {
-			const key = pending.shift();
-			return key === void 0 ? Queue.take(keys) : Effect.succeed(key);
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function getLineColFromPtr(string, ptr) {
+	let lines = string.slice(0, ptr).split(/\r?\n/);
+	return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+	let lines = string.split(/\r?\n/);
+	let codeblock = "";
+	let numberLen = (Math.log10(line + 1) | 0) + 1;
+	for (let i = line - 1; i <= line + 1; i++) {
+		let l = lines[i - 1];
+		if (!l) continue;
+		codeblock += i.toString().padEnd(numberLen, " ");
+		codeblock += ":  ";
+		codeblock += l;
+		codeblock += "\n";
+		if (i === line) {
+			codeblock += " ".repeat(numberLen + column + 2);
+			codeblock += "^\n";
+		}
+	}
+	return codeblock;
+}
+var TomlError = class TomlError extends Error {
+	line;
+	column;
+	codeblock;
+	constructor(message, options) {
+		const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+		const codeblock = makeCodeBlock(options.toml, line, column);
+		super(`Invalid TOML document: ${message}\n\n${codeblock}`, options);
+		this.line = line;
+		this.column = column;
+		this.codeblock = codeblock;
+	}
+	/** @internal */
+	static x(message, ctx, ptr) {
+		throw new TomlError(message, {
+			toml: ctx.s,
+			ptr: ptr ?? ctx.p
 		});
-		yield* printBlocks([explained]);
-		yield* terminal.display(questionLine(question));
-		let typed = "";
-		let previous = "";
-		while (true) {
-			const pressed = yield* Effect.option(next);
-			if (Option.isNone(pressed) || quits(pressed.value.key)) {
-				yield* terminal.display("\n");
-				return false;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/primitive.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseString(ctx) {
+	let startPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p++);
+	let first = c;
+	let isLiteral = c === 39;
+	let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+	if (isMultiline) {
+		if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10) ctx.p++;
+		else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) ctx.p += 2;
+	}
+	let parsed = "";
+	let sliceStart = ctx.p;
+	let state = 0;
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		c = ctx.s.charCodeAt(ctx.p);
+		if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) state = state && 3;
+		else if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in strings", ctx);
+		else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+			if (isMultiline) {
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
 			}
-			const { input, key } = pressed.value;
-			const ended = key.name === "enter" && previous === "return";
-			previous = key.name;
-			if (ended) continue;
-			if (key.name === "backspace") {
-				if (typed === "") continue;
-				typed = typed.slice(0, [...characters.segment(typed)].at(-1)?.index);
-				yield* terminal.display("\b \b");
-				continue;
+			if (!state) {
+				let s = ctx.s.slice(sliceStart, ctx.p);
+				parsed = parsed ? parsed + s : s;
 			}
-			if (key.name !== "return" && key.name !== "enter") {
-				const text = Option.getOrElse(input, () => "");
-				if (!typesText(text)) continue;
-				typed += text;
-				yield* terminal.display(text);
-				continue;
+			ctx.p += isMultiline ? 3 : 1;
+			return parsed;
+		} else if (!state) {
+			if (!isLiteral && c === 92) {
+				parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+				state = 1;
 			}
-			yield* terminal.display("\n");
-			const answer = answerOf$1(typed);
-			if (Option.isSome(answer)) {
-				const rest = [...pending, ...yield* Queue.clear(keys)];
-				const ended = key.name === "return" && rest[0]?.key.name === "enter";
-				yield* Ref.set(ahead, ended ? rest.slice(1) : rest);
-				return answer.value;
+		} else if (state === 1) {
+			if (c === 120 || c === 117 || c === 85) {
+				let errPtr = ctx.p++ - 1;
+				let value = 0;
+				let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+				for (let j = 0; j < len; j++, ctx.p++) {
+					let hex = ctx.s.charCodeAt(ctx.p);
+					let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
+					if (digit < 0) TomlError.x("invalid non-hex character in unicode escape", ctx);
+					value = value << 4 | digit;
+				}
+				if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) TomlError.x("invalid unicode escape", ctx, errPtr);
+				parsed += String.fromCodePoint(value);
+				sliceStart = ctx.p--;
+				state = 0;
+			} else if (isMultiline && (c === 32 || c === 9)) state = 2;
+			else {
+				if (c === 98) parsed += "\b";
+				else if (c === 116) parsed += "	";
+				else if (c === 110) parsed += "\n";
+				else if (c === 102) parsed += "\f";
+				else if (c === 114) parsed += "\r";
+				else if (c === 101) parsed += "\x1B";
+				else if (c === 34) parsed += "\"";
+				else if (c === 92) parsed += "\\";
+				else TomlError.x("unrecognised escape sequence", ctx);
+				sliceStart = ctx.p + 1;
+				state = 0;
 			}
-			typed = "";
-			yield* terminal.display(`${again$1}\n${questionLine(question)}`);
+		} else if (c !== 32 && c !== 9) {
+			if (state === 2) TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+			state = !isLiteral && c === 92 ? 1 : 0;
+			sliceStart = ctx.p;
+		}
+	}
+	TomlError.x("unfinished string", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/date.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class TomlDate extends Date {
+	#hasDate = false;
+	#hasTime = false;
+	#offset = null;
+	constructor(date, fasttype, unsafeDelim) {
+		let hasDate = true;
+		let hasTime = true;
+		let offset = "Z";
+		let c;
+		if (typeof date === "string") {
+			if (fasttype) prep: {
+				if (fasttype < 3) {
+					if (+date.slice(11, 13) > 23) {
+						date = "";
+						break prep;
+					}
+					if (fasttype === 2) {
+						offset = null;
+						date += "Z";
+					} else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) offset = date.slice(date.length - 6);
+					if (unsafeDelim) date = date.slice(0, 10) + "T" + date.slice(11);
+				} else if (fasttype === 4) date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+				hasDate = fasttype !== 4;
+				hasTime = fasttype !== 3;
+			}
+			else {
+				let match = date.match(DATE_TIME_RE);
+				if (match) {
+					if (!match[1]) {
+						hasDate = false;
+						date = `0000-01-01T${date}`;
+					}
+					hasTime = !!match[2];
+					hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+					if (match[2] && +match[2] > 23) date = "";
+					else {
+						offset = match[3] || null;
+						if (!offset && hasTime) date += "Z";
+					}
+				} else date = "";
+			}
+		}
+		super(date);
+		if (!isNaN(this.getTime())) {
+			this.#hasDate = hasDate;
+			this.#hasTime = hasTime;
+			this.#offset = offset;
+		}
+	}
+	isDateTime() {
+		return this.#hasDate && this.#hasTime;
+	}
+	isLocal() {
+		return !this.#hasDate || !this.#hasTime || !this.#offset;
+	}
+	isDate() {
+		return this.#hasDate && !this.#hasTime;
+	}
+	isTime() {
+		return this.#hasTime && !this.#hasDate;
+	}
+	isValid() {
+		return this.#hasDate || this.#hasTime;
+	}
+	toISOString() {
+		let iso = super.toISOString();
+		if (this.isDate()) return iso.slice(0, 10);
+		if (this.isTime()) return iso.slice(11, 23);
+		if (this.#offset === null) return iso.slice(0, -1);
+		if (this.#offset === "Z" || this.#offset === "z") return iso;
+		let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+		offset = this.#offset[0] === "-" ? offset : -offset;
+		return (/* @__PURE__ */ new Date(this.getTime() - offset * 6e4)).toISOString().slice(0, -1) + this.#offset;
+	}
+	static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+		let date = new TomlDate(jsDate);
+		date.#offset = offset;
+		return date;
+	}
+	static wrapAsLocalDateTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalDate(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasTime = false;
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasDate = false;
+		date.#offset = null;
+		return date;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/extract.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function isDigit(char, base = 10) {
+	return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+	return char === 32 || char === 9 || char === 10 || char === 13 || delim && (char === delim || char === 44) || char === 35;
+}
+/** @internal */
+function extractValue(ctx, end) {
+	let errPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p);
+	if (c === 91 || c === 123) {
+		ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+		let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+		ctx.d++;
+		return value;
+	}
+	if (c === 34 || c === 39) return parseString(ctx);
+	if (c === 116) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, true;
+	}
+	if (c === 102) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, false;
+	}
+	if (c === 43 || c === 45) return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+	if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) return parseDate(ctx, c, end);
+	if (ctx.s.charCodeAt(ctx.p + 2) === 58) return parseTime(ctx, c, end);
+	return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+	let c = startChr;
+	let state = 0;
+	let hasUnderscores = false;
+	if (c === 105) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, (sign || 1) / 0;
+	}
+	if (c === 110) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, NaN;
+	}
+	if (c === 48) {
+		if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr)) return ctx.bi === true ? 0n : 0;
+		if (!sign) {
+			if (c === 120) return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+			else if (c === 98) return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+			else if (c === 111) return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+		}
+		if (c === 46) state = 2;
+		else if (c === 101 || c === 69) state = 4;
+		else TomlError.x("illegal leading zero", ctx, startPtr);
+	} else if (!isDigit(c)) TomlError.x("invalid value", ctx, startPtr);
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+		if (!state) state = 1;
+		if (c === 95) {
+			if (!(state & 1)) TomlError.x("illegal underscore", ctx);
+			state += 11;
+			hasUnderscores = true;
+		} else if (state === 1 && c === 46) state = 2;
+		else if ((state === 1 || state === 3) && (c === 101 || c === 69)) state = 4;
+		else if (state === 4 && (c === 43 || c === 45)) state = 6;
+		else if (!isDigit(c)) TomlError.x(`illegal character in numeric literal`, ctx);
+		else if (state > 9) state -= 11;
+		else if (!(state & 1)) state++;
+	}
+	if (!state) {
+		let val = (startChr - 48) * (sign || 1);
+		return ctx.bi === true ? BigInt(val) : val;
+	}
+	if (!(state & 1)) TomlError.x("unfinished numeric value", ctx, startPtr);
+	let str = ctx.s.slice(startPtr, ctx.p);
+	if (hasUnderscores) str = str.replaceAll("_", "");
+	return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+	let c, underscore = 1;
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) if (c === 95) {
+		if (underscore & 1) TomlError.x("illegal underscore", ctx);
+		underscore = 3;
+	} else if (!isDigit(c, base)) TomlError.x(`illegal character in numeric literal`, ctx);
+	else if (underscore & 1) underscore--;
+	if (underscore & 1) TomlError.x("unfinished numeric value", ctx);
+	let str = ctx.s.slice(startPtr + 2, ctx.p);
+	if (underscore) str = str.replaceAll("_", "");
+	return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+	if (ctx.bi !== true) int: {
+		let val = parseInt(str, base);
+		if (!Number.isSafeInteger(val)) {
+			if (ctx.bi) break int;
+			TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+		}
+		return val;
+	}
+	return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+	let startPtr = ctx.p++, unsafeSeparator;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+	ctx.p += 5;
+	if (!isDigit(ctx.s.charCodeAt(ctx.p++))) TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+	if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 3, false, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) !== 58) TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	if (c = ctx.s.charCodeAt(ctx.p)) {
+		if (c === 90 || c === 122) return readDate(ctx, ctx.s.slice(startPtr, ++ctx.p), 1, unsafeSeparator, startPtr, "[+00:00]");
+		if (c === 43 || c === 45) return readDate(ctx, ctx.s.slice(startPtr, ctx.p += 6), 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+	}
+	return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+	let start = ctx.p;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) return parseNumber(ctx, --ctx.p, c, 0, endChr);
+	if (ctx.s.charCodeAt(ctx.p += 4) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	return readDate(ctx, ctx.s.slice(start, ctx.p), 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+	if (ctx.ld) {
+		let date = new TomlDate(str, type, unsafeDelim);
+		if (!date.isValid()) TomlError.x("invalid date", ctx, errPtr);
+		return date;
+	}
+	try {
+		if (temporalSuffix) str += temporalSuffix;
+		switch (type) {
+			case 1: return Temporal.ZonedDateTime.from(str);
+			case 2: return Temporal.PlainDateTime.from(str);
+			case 3: return Temporal.PlainDate.from(str);
+			case 4: return Temporal.PlainTime.from(str);
+		}
+	} catch (e) {
+		TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/util.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function skipComment(ctx) {
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		let c = ctx.s.charCodeAt(ctx.p);
+		if (c === 10) break;
+		if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+			ctx.p++;
+			break;
+		}
+		if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in comments", ctx);
+	}
+}
+/** @internal */
+function skipVoid(ctx, banNewLines, banComments) {
+	let c;
+	while (ctx.p < ctx.s.length) {
+		while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10))) ctx.p++;
+		if (banComments || c !== 35) break;
+		skipComment(ctx);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/struct.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseKey(ctx, end = 61) {
+	let startPtr;
+	let state = 0;
+	let parsed = [];
+	let sliceStart;
+	let c = ctx.s.charCodeAt(startPtr = ctx.p);
+	do
+		if (c === end) {
+			if (!state) TomlError.x("unexpected end of key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			return ctx.p++, parsed;
+		} else if (c === 46) {
+			if (!state) TomlError.x("illegal empty bare key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			state = 0;
+		} else if (!state && (c === 34 || c === 39)) {
+			if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2)) TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+			parsed.push(parseString(ctx));
+			state = 2;
+			ctx.p--;
+		} else if (c === 32 || c === 9) {
+			if (state === 1) {
+				parsed.push(ctx.s.slice(sliceStart, ctx.p));
+				state = 2;
+			}
+		} else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) TomlError.x("illegal character in key", ctx);
+		else if (!state) {
+			state = 1;
+			sliceStart = ctx.p;
+		}
+	while (c = ctx.s.charCodeAt(++ctx.p));
+	TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+/** @internal */
+function parseInlineTable(ctx) {
+	let startPtr = ctx.p++;
+	let res = Object.create(null);
+	let seen = /* @__PURE__ */ new Set();
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+			ctx.p++;
+			return res;
+		}
+		let k;
+		let t = res;
+		let hasOwn = false;
+		let errPtr = ctx.p;
+		let key = parseKey(ctx);
+		for (let i = 0; i < key.length; i++) {
+			if (i) t = hasOwn ? t[k] : t[k] = Object.create(null);
+			k = key[i];
+			if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) {
+				t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+				break;
+			}
+			if (!hasOwn && unsafe) Object.defineProperty(t, k, {
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+		}
+		if (hasOwn) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+		skipVoid(ctx, true, true);
+		let value = extractValue(ctx, 125);
+		if (t && typeof (t[k] = value) === "object") seen.add(value);
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished table", ctx, startPtr);
+}
+/** @internal */
+function parseArray(ctx) {
+	let startPtr = ctx.p++;
+	let res = [];
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+			ctx.p++;
+			return res;
+		}
+		res.push(extractValue(ctx, 93));
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished array", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/parse.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function peekTable(ctx, key, table, meta, type) {
+	let t = table;
+	let m = meta;
+	let k;
+	let hasOwn = false;
+	let state;
+	for (let i = 0; i < key.length; i++) {
+		if (i) {
+			t = hasOwn ? t[k] : t[k] = Object.create(null);
+			m = (state = m[k]).c;
+			if (type === 0 && (state.t === 1 || state.t === 2)) return null;
+			if (state.t === 2) {
+				let l = t.length - 1;
+				t = t[l];
+				m = m[l].c;
+			}
+		}
+		k = key[i];
+		if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) return null;
+		if (!hasOwn) {
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) return false;
+			if (unsafe) {
+				Object.defineProperty(t, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+				Object.defineProperty(m, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+			}
+			m[k] = {
+				t: i < key.length - 1 && type === 2 ? 3 : type,
+				d: false,
+				i: 0,
+				c: Object.create(null)
+			};
+		}
+	}
+	state = m[k];
+	if (state.t !== type && !(type === 1 && state.t === 3)) return null;
+	if (type === 2) {
+		if (!state.d) {
+			state.d = true;
+			t[k] = [];
+		}
+		t[k].push(t = Object.create(null));
+		state.c[state.i++] = state = {
+			t: 1,
+			d: false,
+			i: 0,
+			c: Object.create(null)
+		};
+	}
+	if (state.d) return null;
+	state.d = true;
+	if (type === 1) t = hasOwn ? t[k] : t[k] = Object.create(null);
+	else if (type === 0 && hasOwn) return null;
+	return [
+		k,
+		t,
+		state.c
+	];
+}
+function validateTablePeek(ctx, peek, ptr) {
+	if (peek === null || ctx.uk === 2) TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+	let ctx = {
+		s: toml,
+		p: 0,
+		d: options.maxDepth ?? 1e3,
+		bi: options.integersAsBigInt ?? false,
+		ld: options.useLegacyDate ?? true,
+		uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+	};
+	let res = Object.create(null);
+	let meta = Object.create(null);
+	let tmp;
+	let skipping = false;
+	let tbl = res;
+	let m = meta;
+	if (toml.charCodeAt(0) === 65279) ctx.p++;
+	skipVoid(ctx);
+	while (ctx.p < toml.length) {
+		if (toml.charCodeAt(ctx.p) === 91) {
+			let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+			tmp = ctx.p += +isTableArray;
+			skipping = false;
+			let k = parseKey(ctx, 93);
+			if (isTableArray) {
+				if (toml.charCodeAt(ctx.p) !== 93) TomlError.x("expected end of table array declaration", ctx);
+				ctx.p++;
+			}
+			let p = peekTable(ctx, k, res, meta, isTableArray ? 2 : 1);
+			if (!p) {
+				validateTablePeek(ctx, p, tmp);
+				skipping = true;
+			} else {
+				m = p[2];
+				tbl = p[1];
+			}
+		} else {
+			tmp = ctx.p;
+			let p = peekTable(ctx, parseKey(ctx), tbl, m, 0);
+			if (!p && !skipping) validateTablePeek(ctx, p, tmp);
+			skipVoid(ctx, true, true);
+			let v = extractValue(ctx, void 0);
+			if (p && !skipping) p[1][p[0]] = v;
+		}
+		skipVoid(ctx, true);
+		if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+		skipVoid(ctx);
+	}
+	return res;
+}
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+"".isWellFormed;
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/index.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+//#endregion
+//#region src/harness/codex-checkouts.ts
+const codexGitFolder = (configFolder, pluginId) => {
+	const at = pluginId.indexOf("@");
+	return `${configFolder}/plugins/cache/${pluginId.slice(at + 1)}/${pluginId.slice(0, at)}/@git`;
+};
+const codexCheckoutsFolder = (gitFolder) => `${gitFolder}/checkouts`;
+/** Parse Git's quoted parameters as data, never shell code, and keep every other `-c`. */
+const withoutCodexInclude = String.raw`
+use Text::ParseWords qw(shellwords);
+my @parameters = shellwords($ENV{GIT_CONFIG_PARAMETERS} // '');
+my $root = '';
+@parameters = grep { if (m{^include\.path=(.*/plugins/cache/[^/]+/[^/]+/\@git)/agents/[^/]+\.gitconfig$}) { $root = $1; 0 } else { 1 } } @parameters;
+if (($ARGV[0] // '') eq 'root') { print $root; exit; }
+for (@parameters) { s/'/'\\''/g; $_ = "'$_'"; }
+print join(' ', @parameters);
+`;
+/**
+* Both session start and the sign-off refusal use this writer. Perl's flock works on Linux
+* and macOS and is released even after a crash. One lock covers reading the shared includes,
+* writing a checkout's overrides, replacing the includes, and restoring the agent's file.
+* Git writes the include keys so unusual checkout names can't become config syntax. Its
+* gitdir conditions escape wildcard characters and cover the main checkout and worktrees.
+*/
+const codexCheckoutWriter = String.raw`
+use strict;
+use warnings;
+use Fcntl qw(LOCK_EX);
+use File::Path qw(make_path);
+use File::Temp qw(tempfile);
+use Digest::SHA qw(sha256_hex);
+umask 0077;
+my ($directory, $common, $hooks, $signs_off, $author_file, $author_text, $clear_author, $activate_author) = @ARGV;
+make_path($directory);
+open my $lock, '>>', "$directory/lock" or die "open checkout lock: $!\n";
+$SIG{ALRM} = sub { die "checkout lock timed out\n" };
+alarm 5;
+flock($lock, LOCK_EX) or die "lock checkouts: $!\n";
+alarm 0;
+sub quoted {
+    my $value = shift;
+    $value =~ s/\\/\\\\/g;
+    $value =~ s/"/\\"/g;
+    $value =~ s/\n/\\n/g;
+    $value =~ s/\t/\\t/g;
+    $value =~ s/\x08/\\b/g;
+    return qq{"$value"};
+}
+sub replace_file {
+    my ($file, $text) = @_;
+    my ($out, $next) = tempfile('.ref0-XXXXXX', DIR => $directory, UNLINK => 1);
+    print {$out} $text or die "write config: $!\n";
+    close $out or die "close config: $!\n";
+    rename $next, $file or die "replace config: $!\n";
+}
+my $disabled = "# ref0: author disabled until commit setup succeeds\n";
+if (defined $clear_author && length $clear_author) {
+    my $text = $author_text // '';
+    if (-e $clear_author) {
+        open my $in, '<', $clear_author or die "read author: $!\n";
+        local $/;
+        $text = <$in>;
+        close $in or die "close author: $!\n";
+    }
+    $text =~ s/^\[author\]\n.*?(?=^\[|\z)//msg;
+    $text = $disabled . $text unless index($text, $disabled) == 0;
+    replace_file($clear_author, $text);
+    exit;
+}
+if (length $common) {
+    my $checkout = "$directory/" . sha256_hex($common) . '.gitconfig';
+    my $text = "[core]\n\thooksPath = " . quoted($hooks) . "\n";
+    $text .= "[author]\n\tname = \"\"\n\temail = \"\"\n" if $signs_off;
+    my $includes = "$directory/checkouts.gitconfig";
+    my $before = '';
+    if (-e $includes) {
+        open my $in, '<', $includes or die "read checkouts: $!\n";
+        local $/;
+        $before = <$in>;
+        close $in or die "close checkouts: $!\n";
+    }
+    my ($out, $next) = tempfile('.ref0-XXXXXX', DIR => $directory, UNLINK => 1);
+    print {$out} $before or die "write checkouts: $!\n";
+    close $out or die "close checkouts: $!\n";
+    (my $pattern = $common) =~ s/([\\*?\[])/\\$1/g;
+    for my $gitdir ($pattern, "$pattern/worktrees/") {
+        system('git', 'config', '--file', $next, '--replace-all', "includeIf.gitdir:$gitdir.path", $checkout) == 0
+            or die "write checkout include\n";
+    }
+    replace_file($checkout, $text);
+    rename $next, $includes or die "replace checkouts: $!\n";
+}
+if (defined $author_file && length $author_file) {
+    # An in-flight old session cannot restore an author cleared after a failed switch.
+    my $may_write = 1;
+    if (!$activate_author && -e $author_file) {
+        open my $in, '<', $author_file or die "read author: $!\n";
+        my $first = <$in> // '';
+        close $in or die "close author: $!\n";
+        $may_write = 0 if $first eq $disabled;
+    }
+    replace_file($author_file, $author_text) if $may_write;
+}
+`;
+/** The same writer inside a hook, where the next plain commit must use the person as author. */
+const codexSignOff = [
+	"ref0_common=$(git rev-parse --path-format=absolute --git-common-dir) || exit 1",
+	"ref0_common=$(cd -P \"$ref0_common\" && pwd) || exit 1",
+	"[ -n \"${ref0_codex-}\" ] || exit 1",
+	"ref0_codex_hooks=$ref0_hooks/most",
+	"for ref0_frequent in post-index-change reference-transaction; do",
+	"  ref0_own=$(git rev-parse --git-path \"hooks/$ref0_frequent\") || exit 1",
+	"  [ ! -x \"$ref0_own\" ] || ref0_codex_hooks=$ref0_hooks/all",
+	"done",
+	`perl -e ${shellWord(codexCheckoutWriter)} "$ref0_codex/checkouts" "$ref0_common" "$ref0_codex_hooks" 1 || exit 1`
+];
+//#endregion
+//#region src/harness/empty-folder.ts
+/**
+* The folder one of a harness's own commands runs in: made empty for it in the system's temporary
+* folder, and removed once the command's scope ends. ref0 never runs one in the folder the person
+* runs ref0 in, and names the config folder only by `CLAUDE_CONFIG_DIR` or `CODEX_HOME`.
+*
+* Measured 24 Oct 2026. Claude Code 2.1.310's `plugin marketplace remove` also clears the name
+* from `.claude/settings.json` and `.claude/settings.local.json` in the folder it runs in, and
+* `plugin list` reads them. In the home folder, the first is `~/.claude`'s own settings: removing
+* ref0's marketplace from `~/.claude-work` there turned ref0's plugin off in `~/.claude`. Codex
+* 0.164.0 reads a trusted project's `.codex/` in each folder from its own up to the Git root: from
+* a folder under a home kept in Git, such as `~/.ref0`, it reads `~/.codex` as that project's too.
+*/
+const emptyFolder = (fs) => fs.makeTempDirectoryScoped({ prefix: "ref0-harness-" });
+//#endregion
+//#region src/harness/codex-app-server.ts
+/**
+* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
+* from an empty folder of its own, the requests written a line each, the answers read until each
+* request has one, then stopped. Each answer is matched to its request by ID, and read by that
+* request's method. Anything else it writes, such as notifications, or an answer to an ID ref0
+* didn't send, is passed over.
+*/
+/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
+var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
+/** Codex's app server answered a request with an error. */
+var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
+	method: Schema.String,
+	error: CodexError
+}) {};
+/** Codex's app server answered a request with a result its method's schema doesn't read. */
+var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
+	method: Schema.String,
+	issue: Schema.String
+}) {};
+const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
+const decodeAnswer$2 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
+/** The IDs of the exchange's two requests: the opening's, and the one asked. */
+const initializeId = "ref0-initialize";
+const askedId = "ref0-asked";
+/** The exchange's opening: who's asking, then that it's ready. */
+const opening = [{
+	jsonrpc: "2.0",
+	id: initializeId,
+	method: codexMethods.initialize.method,
+	params: { clientInfo: {
+		name: "ref0",
+		title: null,
+		version: cliVersion
+	} }
+}, {
+	jsonrpc: "2.0",
+	method: codexMethods.initialized.method
+}];
+/**
+* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
+* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
+*/
+const exchange = (codex, lines, ids, env) => Effect.scoped(Effect.gen(function* () {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const fs = yield* FileSystem.FileSystem;
+	const answered = yield* (yield* spawner.spawn(ChildProcess.make(codex, ["app-server"], {
+		cwd: yield* emptyFolder(fs),
+		env,
+		extendEnv: true,
+		forceKillAfter: "2 seconds",
+		stdin: {
+			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
+			endOnDone: false
+		}
+	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$2(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
+	return Option.filter(answered, (answers) => answers.size === ids.length);
+})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
+/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
+const resultOf = (method, answer) => {
+	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
+	if ("error" in answer) return Effect.fail(new CodexRefused({
+		method: method.method,
+		error: answer.error
+	}));
+	const { result } = method;
+	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
+		method: method.method,
+		issue: error.message
+	})));
+};
+/**
+* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
+* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
+* its request's ID, and its result is read by the method's result schema.
+*/
+const askCodex = (codex, method, params, env = {}) => Effect.gen(function* () {
+	const asked = {
+		jsonrpc: "2.0",
+		id: askedId,
+		method: method.method,
+		params
+	};
+	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
+	const answers = yield* exchange(codex, lines, [initializeId, askedId], env);
+	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
+	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
+	return yield* resultOf(method, answers.value.get(askedId));
+});
+//#endregion
+//#region src/harness/commit-hooks.ts
+/**
+* ref0's part of Git's `prepare-commit-msg` and `commit-msg` hooks, which their forwarders in
+* ref0's hooks folder run once the repo's own hook succeeds, and only in an agent's commands,
+* where `REF0_HARNESS` is set. A commit anywhere else is unchanged.
+*
+* The trailer, `Assisted-by: <harness>:<model>`, goes on once with `git interpret-trailers`:
+* `prepare-commit-msg` adds it to a message the command or Git wrote, and `commit-msg` to one
+* written in an editor, or again if an editor removed it, since Git runs `prepare-commit-msg`
+* before the editor and `commit-msg` after. Neither adds it to a message Git refuses as empty, or
+* to `commit.template` left as it was, which Git would otherwise commit. Two commits made in an
+* editor are beyond them: one with `--no-verify`, which skips `commit-msg`, gets no trailer, and
+* a template from `-t`, which `commit-msg` can't see, gets it even when left as it was. The model
+* is the last one the session's transcript names, read from its end in `sh`, with no Node
+* process, or else the one the session started with. Both are as the harness reports them, never
+* proven.
+*
+* The refusal: a commit whose author is an agent's commit email and whose message has a
+* `Signed-off-by`. A sign-off must match its commit's author, and an agent never signs off.
+* `prepare-commit-msg` catches `-s` and `-m`, which `--no-verify` doesn't skip, and `commit-msg`
+* a sign-off written in an editor, unless `--no-verify` skips it.
+*
+* Only the refusal stops a commit: when Git can't say what ref0's part needs, such as a Git older
+* than 2.20 without `--no-divider`, the commit goes on without the trailer.
+*
+* Neither part runs while Git replays commits, in a rebase or a cherry-pick: Git makes those
+* commits itself with their own authors, and these hooks see the command's author instead (Git
+* 2.53, 23 Oct 2026). Nor does the trailer go on an amend that keeps another's commit: `git
+* commit` gives its hooks the author it commits with, and an amend keeps HEAD's, to the second.
+* So a new commit by HEAD's author in HEAD's second gets none either.
+*/
+/** The hooks ref0 adds its part to, after the repo's own. */
+const commitHooks = ["prepare-commit-msg", "commit-msg"];
+/** Whether a hook is one ref0 adds its part to. */
+const isCommitHook = (name) => commitHooks.some((hook) => hook === name);
+/** The trailer's key, as the Linux kernel writes it. */
+const assistedBy = "Assisted-by";
+/** How much of the transcript's end the hook reads for its last model: well past its last turn. */
+const transcriptTail = 1048576;
+/**
+* Git's trailer tool, reading and writing `:` alone whatever the repo's `trailer.separators`
+* says, since Git writes a sign-off with `:`.
+*/
+const trailers = "git -c trailer.separators=: interpret-trailers --no-divider";
+/**
+* Whether its input says anything, as Git decides whether a message is empty: with a line that's
+* neither blank nor a sign-off.
+*/
+const saysSomething = "grep -qv -e '^[[:space:]]*$' -e '^Signed-off-by: '";
+/** How the agent commits again as the person, which the refusal prints. */
+const asThePerson = "env -u GIT_AUTHOR_NAME -u GIT_AUTHOR_EMAIL git commit -s …";
+/** What the refusal prints, for a commit by `author` that the person `person` should author. */
+const signOffRefusal = (author, person) => `ref0: this commit has a Signed-off-by, and its author is ${author}, an agent. A sign-off must match its commit's author, and an agent never signs off, so commit again with ${person} as the author, adding --reset-author to an amend:\n  ${asThePerson}\n`;
+/** ref0's part of `hook`, run once the repo's own hook has succeeded. */
+const commitPart = (hook) => {
+	const { harness, transcript, model } = gitHookVariables;
+	return [
+		"ref0_nl='",
+		"'",
+		`[ -n "\${${harness}-}" ] || exit 0`,
+		`case $${harness} in *[!a-z0-9-]*) exit 0 ;; esac`,
+		"ref0_git=$(git rev-parse --git-dir) || exit 0",
+		"[ -d \"$ref0_git/rebase-merge\" ] || [ -d \"$ref0_git/rebase-apply\" ] || [ -f \"$ref0_git/CHERRY_PICK_HEAD\" ] && exit 0",
+		`ref0_trailers=$(${trailers} --parse "$1") || exit 0`,
+		"case ${GIT_AUTHOR_EMAIL-} in",
+		`*@${agentCommitDomain})`,
+		"  if printf '%s\\n' \"$ref0_trailers\" | grep -qi '^signed-off-by:'; then",
+		"    ref0_person=$(git var GIT_COMMITTER_IDENT)",
+		`    if [ "$${harness}" = codex ]; then`,
+		...codexSignOff.map((line) => `      ${line}`),
+		"      printf '%s\\n' 'ref0: this checkout now uses the person as author. Run the same git commit -s again; add --reset-author to an amend.' >&2",
+		"    else",
+		`      printf ${shellWord(signOffRefusal("%s", "%s"))} "\${GIT_AUTHOR_NAME-} <$GIT_AUTHOR_EMAIL>" "\${ref0_person% * *}" >&2`,
+		"    fi",
+		"    exit 1",
+		"  fi",
+		"  ;;",
+		"*)",
+		"  if [ -n \"${GIT_AUTHOR_DATE-}\" ]; then",
+		`    ref0_head=$(git log -1 --no-show-signature --date=raw --format='%(trailers:key=${assistedBy},valueonly)%n%an <%ae> %ad' HEAD 2>/dev/null)`,
+		"    [ \"${ref0_head##*\"$ref0_nl\"}\" = \"${GIT_AUTHOR_NAME-} <${GIT_AUTHOR_EMAIL-}> ${GIT_AUTHOR_DATE#@}\" ] && [ -z \"${ref0_head%\"$ref0_nl\"*}\" ] && exit 0",
+		"  fi",
+		"  ;;",
+		"esac",
+		...hook === "prepare-commit-msg" ? ["case ${2-} in ''|template) exit 0 ;; esac"] : [],
+		`case "$ref0_nl$ref0_trailers$ref0_nl" in *"\${ref0_nl}${assistedBy}: $${harness}:"*|*"\${ref0_nl}${assistedBy}: $${harness}$ref0_nl"*) exit 0 ;; esac`,
+		...hook === "prepare-commit-msg" ? [`${saysSomething} "$1" || exit 0`] : [
+			"ref0_message=$(git stripspace --strip-comments < \"$1\")",
+			`printf '%s\\n' "$ref0_message" | ${saysSomething} || exit 0`,
+			`ref0_template=$(git config --path commit.template) && ref0_template=$(git stripspace --strip-comments < "$ref0_template" 2>/dev/null) && case $ref0_message in "$ref0_template"*) printf '%s\\n' "\${ref0_message#"$ref0_template"}" | ${saysSomething} || exit 0 ;; esac`
+		],
+		"ref0_model=",
+		`if [ "$${harness}" = codex ]; then`,
+		"  case ${CODEX_THREAD_ID-} in \"\"|*[!a-zA-Z0-9-]*) ;; *)",
+		"    ref0_rollout=$(find \"${CODEX_HOME:-\"$HOME/.codex\"}/sessions\" -type f -name \"rollout-*-${CODEX_THREAD_ID}.jsonl\" 2>/dev/null | head -n 1)",
+		`    [ -f "$ref0_rollout" ] && ref0_model=$(tail -c ${transcriptTail} "$ref0_rollout" | LC_ALL=C grep '"type"[[:space:]]*:[[:space:]]*"turn_context"' | grep -o '"model"[[:space:]]*:[[:space:]]*"[A-Za-z0-9][A-Za-z0-9._:@/-]*"' | tail -n 1 | sed 's/^[^:]*:[[:space:]]*"//; s/"$//')`,
+		"  ;; esac",
+		"else",
+		`[ -f "\${${transcript}-}" ] && ref0_model=$(tail -c ${transcriptTail} "$${transcript}" | LC_ALL=C grep -o '"message":{"model":"[A-Za-z0-9][A-Za-z0-9._:@/-]*"')`,
+		"ref0_model=${ref0_model##*\\\"model\\\":\\\"}",
+		"ref0_model=${ref0_model%\\\"}",
+		`[ -n "$ref0_model" ] || ref0_model=\${${model}-}`,
+		"fi",
+		"case $ref0_model in *[!A-Za-z0-9._:@/-]*) ref0_model= ;; esac",
+		`${trailers} --in-place --if-exists addIfDifferent --trailer "${assistedBy}: $${harness}\${ref0_model:+:$ref0_model}" "$1"`,
+		"exit 0"
+	];
+};
+//#endregion
+//#region src/harness/git-hooks.ts
+/**
+* ref0's Git hooks: folders of forwarders in `~/.ref0/origins/<origin>/git-hooks`, which ref0 names as
+* `core.hooksPath` in its agents' commands alone, never in a repo, its config or its hooks.
+* `core.hooksPath` replaces a repo's whole hooks folder, so each forwarder runs the repo's own
+* hook of its name, with the same arguments, stdin and exit status, wherever the repo keeps it:
+* husky's `.husky/_`, `.git/hooks/` or another `core.hooksPath`. It finds and runs that hook
+* with ref0's entry left out of its environment, so a hook that looks up another, as
+* `pre-applypatch.sample` runs `pre-commit`, finds the repo's own. A forwarder runs nothing
+* when the repo's hooks path is one of ref0's folders, or when a forwarder started it, so none
+* calls itself: a first version that left ref0's entry in started about 1,000 processes. Only
+* `prepare-commit-msg` and `commit-msg` do more: once the repo's own hook succeeds, they add
+* ref0's part, in `commit-hooks.ts`.
+*
+* Git runs a hook that exists even where the repo has none, so the forwarders cost each hook one
+* `sh` and one `git rev-parse`, about 1.5 ms. Two hooks run on every index write and ref update,
+* hundreds of times in a long rebase, so only `all` forwards them, for a checkout that has its
+* own; `most` forwards every other (measured 23 Oct 2026, in the piece's pull request).
+*
+* The folders are the CLI's: a session's start writes them again when a forwarder differs, as
+* after an update. Each is read-only, so a tool that installs hooks wherever `core.hooksPath`
+* points, run in an agent's command, fails there rather than replacing a forwarder for every
+* repo.
+*/
+/** The hooks Git runs on every index write and ref update. */
+const frequentHooks = ["post-index-change", "reference-transaction"];
+/**
+* Every other hook Git looks for in its hooks path. Not `push-to-checkout`, which replaces Git's
+* own update of a checkout pushed to merely by existing, nor `fsmonitor-watchman`, which Git runs
+* from `core.fsmonitor`, never from the hooks path.
+*/
+const forwardedHooks = [
+	"applypatch-msg",
+	"pre-applypatch",
+	"post-applypatch",
+	"pre-commit",
+	"pre-merge-commit",
+	"prepare-commit-msg",
+	"commit-msg",
+	"post-commit",
+	"pre-rebase",
+	"post-checkout",
+	"post-merge",
+	"pre-push",
+	"pre-receive",
+	"update",
+	"proc-receive",
+	"post-receive",
+	"post-update",
+	"pre-auto-gc",
+	"post-rewrite",
+	"sendemail-validate",
+	"p4-changelist",
+	"p4-prepare-changelist",
+	"p4-post-changelist",
+	"p4-pre-submit"
+];
+/**
+* What finds and runs the repo's own hook `name`, with ref0's entry left out: an entry naming one
+* of ref0's folders, in `$ref0_hooks`, is ref0's, and the rest keep their order, renumbered.
+* `done` ends it with nothing to run, `failed` when Git can't say where the hook is, and `run`
+* runs the hook it found.
+*/
+const forwarding = (name, end) => [
+	`[ -n "\${${gitHookVariables.forwarded}-}" ] && ${end.done}`,
+	"case ${GIT_CONFIG_PARAMETERS-} in *'/@git/agents/'*)",
+	`  ref0_codex=$(perl -e ${shellWord(withoutCodexInclude)} root) || ${end.failed}`,
+	`  GIT_CONFIG_PARAMETERS=$(perl -e ${shellWord(withoutCodexInclude)}) || ${end.failed}`,
+	"  if [ -z \"$GIT_CONFIG_PARAMETERS\" ]; then unset GIT_CONFIG_PARAMETERS; else export GIT_CONFIG_PARAMETERS; fi",
+	";; esac",
+	"ref0_n=${GIT_CONFIG_COUNT:-0}",
+	"ref0_i=0",
+	"ref0_j=0",
+	"while [ \"$ref0_i\" -lt \"$ref0_n\" ]; do",
+	"  eval \"ref0_key=\\${GIT_CONFIG_KEY_$ref0_i-} ref0_value=\\${GIT_CONFIG_VALUE_$ref0_i-}\"",
+	"  unset \"GIT_CONFIG_KEY_$ref0_i\" \"GIT_CONFIG_VALUE_$ref0_i\"",
+	"  if [ \"$ref0_key\" != core.hooksPath ] || [ \"${ref0_value%/*}\" != \"$ref0_hooks\" ]; then",
+	"    export \"GIT_CONFIG_KEY_$ref0_j=$ref0_key\" \"GIT_CONFIG_VALUE_$ref0_j=$ref0_value\"",
+	"    ref0_j=$((ref0_j + 1))",
+	"  fi",
+	"  ref0_i=$((ref0_i + 1))",
+	"done",
+	"if [ \"$ref0_j\" -eq 0 ]; then unset GIT_CONFIG_COUNT; else export GIT_CONFIG_COUNT=\"$ref0_j\"; fi",
+	`ref0_hook=$(git rev-parse --git-path hooks/${name}) || ${end.failed}`,
+	`[ -f "$ref0_hook" ] && [ -x "$ref0_hook" ] || ${end.done}`,
+	`ref0_dir=$(cd -P "\${ref0_hook%/*}" && pwd) || ${end.failed}`,
+	`[ "\${ref0_dir%/*}" = "$ref0_hooks" ] && ${end.done}`,
+	...end.run
+];
+/**
+* The forwarder for one hook, in ref0's folders in `hooks`. Each `exec`s the repo's own hook,
+* but `prepare-commit-msg` and `commit-msg`, which run it and add ref0's part once it succeeds,
+* even when a forwarder started them and they forward nothing.
+*/
+const forwarder = (name, hooks) => [
+	"#!/bin/sh",
+	`# ref0 ${cliVersion}'s forwarder for Git's ${name} hook. ref0 sets core.hooksPath to this`,
+	"# folder only in its agents' commands. This runs the repo's own hook, found and run with",
+	"# ref0's entry left out, with the same arguments, stdin and exit status.",
+	`ref0_hooks=${shellWord(hooks)}`,
+	...isCommitHook(name) ? [
+		"# Then, in an agent's commands, it adds the Assisted-by trailer and refuses a sign-off on an",
+		"# agent's commit.",
+		"ref0_forward() {",
+		...forwarding(name, {
+			done: "return 0",
+			failed: "return",
+			run: [`${gitHookVariables.forwarded}=${name} "$ref0_hook" "$@"`]
+		}).map((line) => `  ${line}`),
+		"}",
+		"ref0_forward \"$@\" || exit",
+		...commitPart(name)
+	] : forwarding(name, {
+		done: "exit 0",
+		failed: "exit",
+		run: [`export ${gitHookVariables.forwarded}=${name}`, "exec \"$ref0_hook\" \"$@\""]
+	}),
+	""
+].join("\n");
+/** The hooks each folder forwards. */
+const hooksIn = (folder) => folder === "all" ? [...forwardedHooks, ...frequentHooks] : forwardedHooks;
+/** The folder holding ref0's hooks folders, made if it isn't yet: its path, through any links. */
+const gitHooksHome = Effect.fnUntraced(function* (home, api) {
+	const fs = yield* FileSystem.FileSystem;
+	const given = (yield* Path.Path).join(home, ".ref0", "origins", originKey(api), "git-hooks");
+	yield* fs.makeDirectory(given, {
+		recursive: true,
+		mode: 448
+	});
+	return yield* fs.realPath(given);
+});
+/**
+* One of ref0's hooks folders, in `hooks`, written first unless every forwarder in it is already
+* as this CLI writes it: its path, as the agent's `core.hooksPath` names it.
+*/
+const hooksFolder = Effect.fnUntraced(function* (hooks, folder) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const crypto = yield* Crypto.Crypto;
+	const written = path.join(hooks, folder);
+	const names = hooksIn(folder);
+	const current = Effect.forEach(names, (name) => fs.readFileString(path.join(written, name)).pipe(Effect.map((text) => text === forwarder(name, hooks)), Effect.orElseSucceed(() => false))).pipe(Effect.map((each) => each.every(Boolean)));
+	if (yield* current) return written;
+	yield* Effect.gen(function* () {
+		yield* fs.makeDirectory(written, { recursive: true });
+		yield* fs.chmod(written, 493);
+		for (const name of names) {
+			const next = path.join(written, `${name}.${yield* crypto.randomUUIDv4}.next`);
+			yield* fs.writeFileString(next, forwarder(name, hooks), { mode: 365 });
+			yield* fs.rename(next, path.join(written, name));
 		}
-	}).pipe(Effect.scoped, Effect.orElseSucceed(() => false));
-	return ask;
+		yield* fs.chmod(written, 365);
+	}).pipe(Effect.catch((error) => Effect.flatMap(current, (done) => done ? Effect.void : Effect.fail(error))));
+	return written;
 });
 //#endregion
-//#region src/harness/install-claude-code.ts
-/** Install into one config folder, from the release Claude Code fetched and ref0 checked. */
-const installClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
-	const run = yield* release.into(configFolder);
-	yield* run([
-		"plugin",
-		"install",
-		release.id,
-		"--scope",
-		"user"
-	]);
-	yield* run([
-		"plugin",
-		"update",
-		release.id,
-		"--scope",
-		"user"
-	]);
-	return release.folder;
+//#region src/harness/codex-commits.ts
+/**
+* `@git` isn't a valid Codex plugin version. Version selection and upgrade skip it, while
+* `plugin remove` deletes it with the plugin's cache root (Codex 0.160–0.164). A same-version
+* reinstall replaces the root; session start restores these files before the first command.
+* Only `checkouts` is writable in ref0's permission profile, never the agents' author files.
+*/
+/** A Git config value, including paths with quotes, backslashes or line breaks. */
+const gitValue = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("	", "\\t").replaceAll("\b", "\\b")}"`;
+var CodexCommitFailed = class extends Schema.TaggedError()("CodexCommitFailed", { detail: Schema.String }) {};
+/** Writes a checkout's overrides and, at session start, the agent's include under the same lock. */
+const writeCodexCheckout = Effect.fnUntraced(function* (input) {
+	if ((yield* (yield* ChildProcessSpawner.ChildProcessSpawner).exitCode(ChildProcess.make("perl", [
+		"-e",
+		codexCheckoutWriter,
+		codexCheckoutsFolder(input.gitFolder),
+		input.common,
+		input.folder,
+		input.signsOff ? "1" : "0",
+		input.author?.file ?? "",
+		input.author?.text ?? "",
+		input.clearAuthor ?? "",
+		input.activateAuthor ? "1" : ""
+	]))) !== ChildProcessSpawner.ExitCode(0)) return yield* new CodexCommitFailed({ detail: "Could not write Codex’s Git config files." });
+});
+/** The include installed into `set`, and restored by each session's start. */
+const codexAgentConfig = Effect.fnUntraced(function* (agent, root, home) {
+	const fs = yield* FileSystem.FileSystem;
+	const directory = `${root}/agents`;
+	yield* fs.makeDirectory(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const folder = yield* hooksFolder(yield* gitHooksHome(home, (yield* Ref0Config).api), "most");
+	yield* hooksFolder(yield* gitHooksHome(home, (yield* Ref0Config).api), "all");
+	const author = `[author]\n\tname = ${gitValue(agentCommitName(agent.owner, agent.agent))}\n\temail = ${gitValue(agentCommitEmail(agent.agentId))}\n`;
+	const file = `${directory}/${agent.agentId}.gitconfig`;
+	return {
+		file,
+		text: `${author}[core]\n\thooksPath = ${gitValue(folder)}\n[include]\n\tpath = ${gitValue(`${codexCheckoutsFolder(root)}/checkouts.gitconfig`)}\n`,
+		folder,
+		parameters: shellWord(`include.path=${file}`)
+	};
+});
+/**
+* Codex has no environment file: its install selects a file; session start fills its checkout,
+* for the agent of the config folder `CODEX_HOME` names, or the default `~/.codex`.
+*/
+const setCodexCommitEnvironment = Effect.fnUntraced(function* (cwd, checkout) {
+	const folders = yield* ConfigFolders;
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const agent = yield* (yield* HostGrant).get(yield* folders.folder("codex")).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
+	if (Option.isNone(agent)) return false;
+	const pluginRoot = yield* Config.String("CLAUDE_PLUGIN_ROOT").pipe(Config.withDefault(""));
+	if (pluginRoot === "") return yield* new CodexCommitFailed({ detail: "Codex gave the hook no plugin root." });
+	const gitFolder = path.join(path.dirname(pluginRoot), "@git");
+	const home = yield* Config.String("HOME");
+	const author = yield* codexAgentConfig(agent.value, gitFolder, home);
+	const common = (yield* spawner.string(ChildProcess.make("git", [
+		"-C",
+		cwd,
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	])).pipe(Effect.orElseSucceed(() => ""))).trim();
+	const folder = yield* hooksFolder(yield* gitHooksHome(yield* Config.String("HOME"), (yield* Ref0Config).api), checkout.folder);
+	yield* writeCodexCheckout({
+		gitFolder,
+		common: common === "" ? "" : yield* fs.realPath(path.resolve(common)),
+		folder,
+		signsOff: checkout.signsOff,
+		author
+	});
+	return true;
 });
 //#endregion
 //#region src/harness/hook-fields.ts
@@ -21828,6 +23356,7 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 		const failed = (reason, detail = "") => into === void 0 ? unavailable : new InstallFailed({ says: `${name} ${reason}.${detail === "" ? "" : ` ${detail}`}` });
 		return Effect.scoped(Effect.gen(function* () {
 			const handle = yield* spawner.spawn(ChildProcess.make(options.command, args, {
+				cwd: yield* emptyFolder(fs),
 				env: into === void 0 ? fetchEnv : envFor(into),
 				extendEnv: true
 			}));
@@ -21948,90 +23477,212 @@ const marketplaceFor = Effect.fnUntraced(function* (harness, options) {
 	};
 });
 //#endregion
-//#region src/harness/codex-app-server.ts
-/**
-* Codex's app server, spoken as its TUI speaks it: `codex app-server` started for one exchange,
-* the requests written a line each, the answers read until each request has one, then stopped.
-* Each answer is matched to its request by ID, and read by that request's method. Anything else
-* it writes, such as notifications, or an answer to an ID ref0 didn't send, is passed over.
-*/
-/** Codex's app server didn't answer a request within 15 seconds, or didn't start. */
-var CodexUnanswered = class extends Schema.TaggedError()("CodexUnanswered", { method: Schema.String }) {};
-/** Codex's app server answered a request with an error. */
-var CodexRefused = class extends Schema.TaggedError()("CodexRefused", {
-	method: Schema.String,
-	error: CodexError
-}) {};
-/** Codex's app server answered a request with a result its method's schema doesn't read. */
-var CodexAnswerMismatch = class extends Schema.TaggedError()("CodexAnswerMismatch", {
-	method: Schema.String,
-	issue: Schema.String
-}) {};
-const encodeRequest = Schema.encodeUnknownEffect(Schema.fromJsonString(CodexRequest));
-const decodeAnswer$1 = Schema.decodeUnknownOption(Schema.fromJsonString(CodexAnswer));
-/** The IDs of the exchange's two requests: the opening's, and the one asked. */
-const initializeId = "ref0-initialize";
-const askedId = "ref0-asked";
-/** The exchange's opening: who's asking, then that it's ready. */
-const opening = [{
-	jsonrpc: "2.0",
-	id: initializeId,
-	method: codexMethods.initialize.method,
-	params: { clientInfo: {
-		name: "ref0",
-		title: null,
-		version: cliVersion
-	} }
-}, {
-	jsonrpc: "2.0",
-	method: codexMethods.initialized.method
-}];
-/**
-* Codex's answers to `lines`, by ID, or none if it didn't answer each of `ids`. Each ID's first
-* answer is its own: a repeat, or an answer to an ID ref0 didn't send, is passed over.
-*/
-const exchange = (codex, lines, ids, configFolder) => Effect.scoped(Effect.gen(function* () {
-	const answered = yield* (yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make(codex, ["app-server"], {
-		env: configFolder === void 0 ? void 0 : { CODEX_HOME: configFolder },
-		extendEnv: true,
-		forceKillAfter: "2 seconds",
-		stdin: {
-			stream: Stream.fromIterable(lines.map((line) => `${line}\n`)).pipe(Stream.encodeText),
-			endOnDone: false
-		}
-	}))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.map((line) => decodeAnswer$1(line)), Stream.filter(Option.isSome), Stream.scan(() => /* @__PURE__ */ new Map(), (answers, { value: answer }) => ids.includes(answer.id) && !answers.has(answer.id) ? new Map(answers).set(answer.id, answer) : answers), Stream.takeUntil((answers) => answers.size === ids.length), Stream.runLast);
-	return Option.filter(answered, (answers) => answers.size === ids.length);
-})).pipe(Effect.timeoutOption("15 seconds"), Effect.map(Option.flatten), Effect.catchCause(() => Effect.succeed(Option.none())));
-/** `answer`'s result, read by `method`'s own schema, or why it can't be. */
-const resultOf = (method, answer) => {
-	if (answer === void 0) return Effect.fail(new CodexUnanswered({ method: method.method }));
-	if ("error" in answer) return Effect.fail(new CodexRefused({
-		method: method.method,
-		error: answer.error
-	}));
-	const { result } = method;
-	return Schema.decodeUnknownEffect(result)(answer.result).pipe(Effect.mapError((error) => new CodexAnswerMismatch({
-		method: method.method,
-		issue: error.message
-	})));
-};
-/**
-* One exchange with Codex's app server under the person's Codex home: the opening, then `method`
-* asked with `params`, which TypeScript holds to the method's own. Its answer is the one with
-* its request's ID, and its result is read by the method's result schema.
-*/
-const askCodex = (codex, method, params, configFolder) => Effect.gen(function* () {
-	const asked = {
-		jsonrpc: "2.0",
-		id: askedId,
-		method: method.method,
-		params
+//#region src/harness/codex-install-commits.ts
+const decodeProfile = Schema.decodeUnknownEffect(CodexConfigRead);
+const sameJson = Schema.toEquivalence(Schema.Json);
+/** Only the single ref0 include installed by this CLI belongs to ref0. */
+const selectedInclude = (set) => {
+	const parameters = set["GIT_CONFIG_PARAMETERS"] ?? "";
+	const included = parameters.slice(1, -1).replaceAll("'\\''", "'");
+	return set["REF0_HARNESS"] === "codex" && shellWord(included) === parameters && /^include\.path=[\s\S]*\/plugins\/cache\/[^/]+\/[^/]+\/@git\/agents\/[a-z0-9_-]+\.gitconfig$/.test(included) ? included.slice(13) : void 0;
+};
+/** A changed grant must never leave the previous agent as author after a failed install. */
+const clearOtherCodexAuthor = Effect.fnUntraced(function* (agent, options) {
+	const fs = yield* FileSystem.FileSystem;
+	const configFile = `${options.configFolder}/config.toml`;
+	if (!(yield* fs.exists(configFile))) return;
+	const text = yield* fs.readFileString(configFile);
+	const document = yield* Effect.try(() => parse(text, { integersAsBigInt: "asNeeded" }));
+	const read = yield* decodeProfile({ config: document });
+	const file = selectedInclude(read.config.shell_environment_policy?.set ?? {});
+	if (file === void 0) return;
+	const name = yield* originPluginName((yield* Ref0Config).api);
+	if (file === `${codexGitFolder(options.configFolder, `${name}@${name}`)}/agents/${agent.agentId}.gitconfig`) return;
+	const oldRoot = file.slice(0, file.lastIndexOf("/agents/"));
+	const fallback = yield* codexAgentConfig(agent, oldRoot, options.home ?? (yield* Config.String("HOME").pipe(Config.withDefault("."))));
+	yield* writeCodexCheckout({
+		gitFolder: oldRoot,
+		common: "",
+		folder: "",
+		signsOff: false,
+		clearAuthor: file,
+		author: fallback
+	});
+	yield* Console.error(`ref0: Commits now name you instead of the previously connected agent, including its running sessions; ref0’s Git hooks still run. Fix the shell_environment_policy conflict in Codex’s config or profile named above: remove conflicting set values or allowlists, and keep GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL excluded. Then run: ${installLine(options.configFolder)}`);
+});
+/** Install the connected agent's include and shell policy. */
+const installCodexCommits = Effect.fnUntraced(function* (agent, options) {
+	const env = {
+		HOME: options.home,
+		CODEX_HOME: options.configFolder
 	};
-	const lines = yield* Effect.forEach([...opening, asked], (request) => encodeRequest(request).pipe(Effect.orDie));
-	const answers = yield* exchange(codex, lines, [initializeId, askedId], configFolder);
-	if (Option.isNone(answers)) return yield* new CodexUnanswered({ method: method.method });
-	yield* resultOf(codexMethods.initialize, answers.value.get(initializeId));
-	return yield* resultOf(method, answers.value.get(askedId));
+	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+	return yield* Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		yield* fs.makeDirectory(`${options.home}/.ref0`, {
+			recursive: true,
+			mode: 448
+		});
+		if ((yield* (yield* spawner.spawn(ChildProcess.make("perl", [
+			"-e",
+			"use Fcntl qw(LOCK_EX); open my $lock, \">>\", $ARGV[0] or die $!; alarm 5; flock($lock, LOCK_EX) or die $!; alarm 0; $|=1; print \"locked\\n\"; <STDIN>;",
+			`${options.home}/.ref0/codex-install.lock`
+		], { stdin: "pipe" }))).stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.take(1), Stream.mkString)) !== "locked") return yield* failed("lock Codex’s commit setup");
+		const read = yield* askCodex(options.codex, codexMethods.configRead, {
+			includeLayers: true,
+			cwd: null
+		}, env);
+		const policy = read.config.shell_environment_policy;
+		const set = policy?.set ?? {};
+		const own = selectedInclude(set) !== void 0;
+		const collision = [
+			"GIT_CONFIG_PARAMETERS",
+			"REF0_HARNESS",
+			"GIT_AUTHOR_NAME",
+			"GIT_AUTHOR_EMAIL"
+		].find((key) => Object.hasOwn(set, key) && !(own && (key === "GIT_CONFIG_PARAMETERS" || key === "REF0_HARNESS")));
+		const allowlist = policy?.include_only != null || Object.values(policy?.filters ?? {}).includes("include");
+		if (collision !== void 0 || allowlist) {
+			yield* Console.error(`ref0: Codex’s shell_environment_policy ${collision === void 0 ? "has an allowlist" : `already sets ${collision}`}, so ref0 left its commit environment as it was.`);
+			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			return;
+		}
+		const profiles = (yield* fs.readDirectory(options.configFolder)).filter((file) => file.endsWith(".config.toml"));
+		for (const file of profiles) {
+			const text = yield* fs.readFileString(`${options.configFolder}/${file}`);
+			const document = yield* Effect.try({
+				try: () => parse(text, { integersAsBigInt: "asNeeded" }),
+				catch: () => failed(`read Codex’s profile ${printable(file)}`)
+			});
+			const profile = yield* decodeProfile({ config: document });
+			const overrides = profile.config.shell_environment_policy?.set ?? {};
+			const key = [
+				"GIT_CONFIG_PARAMETERS",
+				"REF0_HARNESS",
+				"GIT_AUTHOR_NAME",
+				"GIT_AUTHOR_EMAIL"
+			].find((key) => Object.hasOwn(overrides, key));
+			const profilePolicy = profile.config.shell_environment_policy;
+			const filters = profilePolicy?.filters;
+			const replaced = filters != null && policy?.filters == null;
+			const excluded = filters != null ? [...replaced ? [] : ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"], ...Object.keys(filters)] : profilePolicy?.exclude;
+			const losesAuthors = excluded !== void 0 && excluded !== null && ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].some((name) => !excluded.some((pattern) => pathMatchesWithin(pattern.toLowerCase(), name.toLowerCase(), { left: 1e4 })));
+			const allowlist = profilePolicy?.include_only != null || Object.values(filters ?? {}).includes("include");
+			if (key === void 0 && !losesAuthors && !allowlist) continue;
+			yield* Console.error(`ref0: Codex’s profile ${printable(file)} ${key === void 0 ? "overrides the author exclusions or has an allowlist" : `already sets ${key}`}, so ref0 left its commit environment as it was.`);
+			if (own) return yield* failed("update the existing commit environment; fix the conflicting Codex config or profile, then reinstall");
+			return;
+		}
+		if (!own && (options.approveCommits === void 0 || !(yield* options.approveCommits()))) return;
+		const crypto = yield* Crypto.Crypto;
+		const author = yield* codexAgentConfig(agent, options.gitFolder, options.home);
+		const configFile = `${options.configFolder}/config.toml`;
+		const before = (file) => Effect.flatMap(fs.exists(file), (exists) => exists ? Effect.map(fs.readFileString(file), Option.some) : Effect.succeed(Option.none()));
+		const previousAuthor = yield* before(author.file);
+		const restore = (file, before) => Effect.gen(function* () {
+			if (Option.isNone(before)) return yield* fs.remove(file, { force: true });
+			const next = `${file}.${yield* crypto.randomUUIDv4}.next`;
+			yield* fs.writeFileString(next, before.value, { mode: 384 });
+			yield* fs.rename(next, file);
+		});
+		const user = read.layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+		const previousPolicy = user?.config === void 0 ? policy ?? null : user.config.shell_environment_policy ?? null;
+		const edits = [{
+			keyPath: "shell_environment_policy.set",
+			value: {
+				...set,
+				GIT_CONFIG_PARAMETERS: author.parameters,
+				REF0_HARNESS: "codex"
+			},
+			mergeStrategy: "replace"
+		}, ...policy?.filters == null ? [{
+			keyPath: "shell_environment_policy.exclude",
+			value: [.../* @__PURE__ */ new Set([
+				...policy?.exclude ?? [],
+				"GIT_AUTHOR_NAME",
+				"GIT_AUTHOR_EMAIL"
+			])],
+			mergeStrategy: "replace"
+		}] : [{
+			keyPath: "shell_environment_policy.filters",
+			value: {
+				...policy.filters,
+				...Object.fromEntries(["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL"].flatMap((key) => Object.keys(policy.filters ?? {}).some((pattern) => pattern.toUpperCase() === key) ? [] : [[key, "exclude"]]))
+			},
+			mergeStrategy: "replace"
+		}]];
+		const installedPolicy = {
+			...previousPolicy,
+			...Object.fromEntries(edits.map((edit) => [edit.keyPath.slice(25), edit.value]))
+		};
+		const readCurrent = askCodex(options.codex, codexMethods.configRead, {
+			includeLayers: true,
+			cwd: null
+		}, env);
+		const recover = Effect.gen(function* () {
+			const layer = (yield* readCurrent).layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+			if (layer?.config === void 0) return false;
+			const currentPolicy = layer.config.shell_environment_policy ?? null;
+			if (sameJson(currentPolicy, previousPolicy)) return true;
+			if (!sameJson(currentPolicy, installedPolicy)) return false;
+			const restored = yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "shell_environment_policy",
+					value: previousPolicy,
+					mergeStrategy: "replace"
+				}],
+				filePath: configFile,
+				expectedVersion: layer.version,
+				reloadUserConfig: false
+			}, env).pipe(Effect.option);
+			if (Option.isSome(restored)) return true;
+			const checkedLayer = (yield* readCurrent).layers?.find((layer) => layer.name.type === "user" && layer.name.file === configFile);
+			return checkedLayer?.config !== void 0 && sameJson(checkedLayer.config.shell_environment_policy ?? null, previousPolicy);
+		}).pipe(Effect.orElseSucceed(() => false));
+		let attemptedConfig = false;
+		yield* Effect.gen(function* () {
+			yield* writeCodexCheckout({
+				gitFolder: options.gitFolder,
+				common: "",
+				folder: author.folder,
+				signsOff: false,
+				author,
+				activateAuthor: true
+			});
+			attemptedConfig = true;
+			if ((yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits,
+				filePath: configFile,
+				expectedVersion: user?.version ?? null,
+				reloadUserConfig: false
+			}, env)).status !== "ok") return yield* failed("set Codex’s commit environment because another config layer overrides it");
+		}).pipe(Effect.onError(() => Effect.gen(function* () {
+			if (!attemptedConfig || (yield* recover)) yield* restore(author.file, previousAuthor);
+			else yield* Console.error("ref0: Could not safely restore Codex’s commit policy after the failed setup. Its author file was kept so the include remains valid. Check your Codex config, then run ref0 install again.");
+		}).pipe(Effect.orDie)));
+	}).pipe(Effect.scoped, Effect.mapError(() => failed("set Codex’s commit environment")));
+}, Effect.scoped);
+//#endregion
+//#region src/harness/install-claude-code.ts
+/** Install into one config folder, from the release Claude Code fetched and ref0 checked. */
+const installClaudeCode = Effect.fnUntraced(function* (release, configFolder) {
+	const run = yield* release.into(configFolder);
+	yield* run([
+		"plugin",
+		"install",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	yield* run([
+		"plugin",
+		"update",
+		release.id,
+		"--scope",
+		"user"
+	]);
+	return release.folder;
 });
 //#endregion
 //#region src/harness/install-codex.ts
@@ -22076,95 +23727,120 @@ const trustRef0Hooks = (reinstall, id) => `In a terminal, run: ${reinstall}, and
 * `CODEX_HOME`: neither half alone lets a commit and HTTPS through. A linked worktree's own git
 * directory isn't covered; there Codex needs full access, which whatever launches it sets.
 */
-const ref0Profile = {
+const ref0Profile = (checkouts) => ({
 	extends: ":workspace",
-	filesystem: { ":workspace_roots": { ".git": "write" } },
+	filesystem: {
+		":workspace_roots": { ".git": "write" },
+		[checkouts]: "write"
+	},
 	network: { enabled: true }
-};
+});
 const isPathModes = Schema.is(Schema.Record(Schema.String, Schema.String));
 /** A default that already lets a command write `.git` and reach the network, so needs nothing. */
 const enough = (read) => read.config.default_permissions === ":danger-full-access";
 /** Whether a setup's config has ref0's profile, as its default. */
-const profileSet = (read) => {
+const profileSet = (read, checkouts) => {
 	const profile = read.config.permissions?.["ref0"];
 	const roots = profile?.filesystem?.[":workspace_roots"];
-	return read.config.default_permissions === "ref0" && profile?.extends === ref0Profile.extends && isPathModes(roots) && roots[".git"] === "write" && profile.network?.enabled === true;
+	return read.config.default_permissions === "ref0" && profile?.extends === ref0Profile(checkouts).extends && isPathModes(roots) && roots[".git"] === "write" && profile.filesystem?.[checkouts] === "write" && profile.network?.enabled === true;
 };
-/** Install into one config folder, from the release Codex fetched and ref0 checked. */
-const installCodex = Effect.fnUntraced(function* (release, options) {
-	const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
-	const { folder, id, name } = release;
-	yield* (yield* release.into(options.configFolder))([
-		"plugin",
-		"add",
-		id
-	]);
-	const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [options.home] }, options.configFolder).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, id));
-	if (hooks.length === 0) return yield* failed("read the plugin’s hooks from Codex");
-	if (!hooks.every((hook) => ownHook(hook, name))) return yield* new InstallFailed({ says: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ${id}.` });
-	const trust = Effect.fnUntraced(function* (waiting) {
-		if (!(yield* options.approve(waiting))) return false;
-		yield* askCodex(options.codex, codexMethods.configBatchWrite, {
-			edits: [{
-				keyPath: "hooks.state",
-				value: Object.fromEntries(waiting.map((hook) => [hook.key, { trusted_hash: hook.currentHash }])),
-				mergeStrategy: "upsert"
-			}],
-			filePath: null,
-			expectedVersion: null,
-			reloadUserConfig: false
-		}, options.configFolder).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
-		return true;
-	});
-	const offerProfile = Effect.fnUntraced(function* () {
-		const config = yield* askCodex(options.codex, codexMethods.configRead, {
-			includeLayers: false,
-			cwd: null
-		}, options.configFolder).pipe(Effect.option);
-		if (Option.isSome(config) && (profileSet(config.value) || enough(config.value))) return true;
-		const replacing = Option.match(config, {
-			onNone: () => ({
-				default: void 0,
-				ownRef0: false
-			}),
-			onSome: (read) => ({
-				default: read.config.default_permissions ?? void 0,
-				ownRef0: read.config.permissions?.["ref0"] !== void 0
-			})
+/**
+* Install into one config folder, from the release Codex fetched and ref0 checked, for the agent
+* the folder's host grant names.
+*/
+const installCodex = Effect.fnUntraced(function* (release, agent, options) {
+	return yield* Effect.gen(function* () {
+		const failed = (what) => new InstallFailed({ says: `Couldn’t ${what}. Check that Codex is installed.` });
+		const { folder, id, name } = release;
+		yield* (yield* release.into(options.configFolder))([
+			"plugin",
+			"add",
+			id
+		]);
+		const gitFolder = codexGitFolder(options.configFolder, id);
+		const checkouts = codexCheckoutsFolder(gitFolder);
+		const env = {
+			HOME: options.home,
+			CODEX_HOME: options.configFolder
+		};
+		const hooks = (yield* askCodex(options.codex, codexMethods.hooksList, { cwds: [] }, env).pipe(Effect.mapError(() => failed("read the plugin’s hooks from Codex")))).data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, id));
+		if (hooks.length === 0) return yield* failed("read the plugin’s hooks from Codex");
+		if (!hooks.every((hook) => ownHook(hook, name))) return yield* new InstallFailed({ says: `Codex’s ref0 plugin holds hooks ref0 didn’t write, so none was trusted. Remove it with: codex plugin remove ${id}.` });
+		const trust = Effect.fnUntraced(function* (waiting) {
+			if (!(yield* options.approve(waiting))) return false;
+			yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "hooks.state",
+					value: Object.fromEntries(waiting.map((hook) => [hook.key, { trusted_hash: hook.currentHash }])),
+					mergeStrategy: "upsert"
+				}],
+				filePath: null,
+				expectedVersion: null,
+				reloadUserConfig: false
+			}, env).pipe(Effect.mapError(() => failed("record the hooks as trusted in Codex")));
+			return true;
 		});
-		if (!(yield* options.approveProfile(replacing))) return false;
-		yield* askCodex(options.codex, codexMethods.configBatchWrite, {
-			edits: [{
-				keyPath: "permissions.ref0",
-				value: ref0Profile,
-				mergeStrategy: "replace"
-			}, {
-				keyPath: "default_permissions",
-				value: "ref0",
-				mergeStrategy: "replace"
-			}],
-			filePath: null,
-			expectedVersion: null,
-			reloadUserConfig: false
-		}, options.configFolder).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
-		return true;
-	});
-	const waiting = hooks.filter(waitingForTrust);
-	return {
-		folder,
-		trusted: waiting.length === 0 || (yield* trust(waiting)),
-		profile: yield* offerProfile()
-	};
+		const offerProfile = Effect.fnUntraced(function* () {
+			const config = yield* askCodex(options.codex, codexMethods.configRead, {
+				includeLayers: false,
+				cwd: null
+			}, env).pipe(Effect.option);
+			if (Option.isSome(config) && (profileSet(config.value, checkouts) || enough(config.value))) return true;
+			const replacing = Option.match(config, {
+				onNone: () => ({
+					default: void 0,
+					ownRef0: false
+				}),
+				onSome: (read) => ({
+					default: read.config.default_permissions ?? void 0,
+					ownRef0: read.config.permissions?.["ref0"] !== void 0
+				})
+			});
+			if (!(yield* options.approveProfile(replacing, checkouts))) return false;
+			yield* askCodex(options.codex, codexMethods.configBatchWrite, {
+				edits: [{
+					keyPath: "permissions.ref0",
+					value: ref0Profile(checkouts),
+					mergeStrategy: "replace"
+				}, {
+					keyPath: "default_permissions",
+					value: "ref0",
+					mergeStrategy: "replace"
+				}],
+				filePath: null,
+				expectedVersion: null,
+				reloadUserConfig: false
+			}, env).pipe(Effect.mapError(() => failed("set ref0’s profile in Codex")));
+			return true;
+		});
+		const waiting = hooks.filter(waitingForTrust);
+		const trusted = waiting.length === 0 || (yield* trust(waiting));
+		const profile = yield* offerProfile();
+		yield* installCodexCommits(agent, {
+			...options,
+			gitFolder
+		});
+		return {
+			folder,
+			trusted,
+			profile
+		};
+	}).pipe(Effect.onError(() => clearOtherCodexAuthor(agent, options).pipe(Effect.orDie)));
 });
 //#endregion
 //#region src/harness/install.ts
-/** A command on this machine's `PATH`, by absolute path. */
+/**
+* A command on this machine's `PATH`, by absolute path: a folder `PATH` names relative to this
+* one is read from here, since a harness's commands run from an empty folder of their own. Each
+* folder is kept as written, `..` and all, so the system follows a symlink before the `..` after it.
+*/
 const onPath = Effect.fnUntraced(function* (name) {
 	const fs = yield* FileSystem.FileSystem;
+	const paths = yield* Path.Path;
 	const path = yield* Config.String("PATH").pipe(Config.withDefault(""));
 	for (const folder of path.split(":")) {
 		if (folder === "") continue;
-		const candidate = `${folder}/${name}`;
+		const candidate = `${paths.isAbsolute(folder) ? folder : `${process.cwd()}/${folder}`}/${name}`;
 		if (yield* fs.exists(candidate).pipe(Effect.orElseSucceed(() => false))) return Option.some(candidate);
 	}
 	return Option.none();
@@ -22182,15 +23858,18 @@ const askToTrust = (hooks, shown, yesOrNo) => yesOrNo([`Codex runs a plugin's ho
 * Codex's default. A change to their Codex's security, so it's shown in full and asked the first
 * time (decided 9 Oct, 5).
 */
-const askForProfile = (replacing, shown, yesOrNo) => yesOrNo([
+const askForProfile = (replacing, checkouts, shown, yesOrNo) => yesOrNo([
 	"Codex's sandbox keeps commands from writing .git or reaching the network, so a Codex agent can't commit or push to ref0.",
-	"ref0's profile, \"ref0\", is Codex's workspace profile with two changes:",
+	"ref0's profile, \"ref0\", is Codex's workspace profile with these changes:",
 	"- each workspace root's .git is writable, so an agent can commit",
+	`- ${printable(checkouts)} is writable, so a signed-off checkout can keep you as author; the agent’s author files stay outside it`,
 	"- the network is on, so an agent can push; any command can then reach the internet, services and sockets on this machine, and your login Keychain",
 	"In a linked worktree (git worktree add), Codex still needs full access there.",
 	...replacing.default === void 0 ? [] : [`It replaces your default now, ${printable(replacing.default)}.`],
 	...replacing.ownRef0 ? ["It replaces the profile you have named \"ref0\", and every rule in it."] : []
 ], `Make "ref0" the default profile for ${printable(shown)}?`);
+/** Shows the person what naming the agent as author changes in Codex, and asks whether it may. */
+const askForCommits = (shown, yesOrNo) => yesOrNo(["ref0 will set GIT_CONFIG_PARAMETERS and REF0_HARNESS in this Codex setup’s shell_environment_policy, and exclude inherited GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL. Its agents will author their commits, with you as committer. Signed-off checkouts keep you as author. Your own terminal is unchanged."], `Name the agent as author of its Codex commits, for ${printable(shown)}?`);
 /** What a Codex folder without ref0's profile, or full access, can't do. */
 const sandboxWords = "Codex’s sandbox is as it was, so its agents commit and push to ref0 only where it has full access; to change that, run it again in a terminal.";
 /**
@@ -22213,6 +23892,7 @@ const writeRef0Launcher = Effect.fnUntraced(function* (home, git) {
 	const gitPath = yield* fs.realPath(git);
 	yield* fs.writeFileString(next, [
 		"#!/bin/sh",
+		`unset ${otherOriginVariable}`,
 		"if [ \"$REF0_SELECT_ORIGIN\" = 1 ]; then",
 		`  checkout=$(${shellWord(gitPath)} config --get ref0.api 2>/dev/null)`,
 		"  result=$?",
@@ -22222,7 +23902,11 @@ const writeRef0Launcher = Effect.fnUntraced(function* (home, git) {
 		`    *) printf '%s\\n' ${shellWord("ref0: could not read the checkout origin with Git. Restore Git, then run ref0 install again.")} >&2; exit 1 ;;`,
 		"  esac",
 		"  export REF0_SELECTED_API",
-		`  ${shellWord(node)} -e ${shellWord("try { process.exit(new URL(process.env.REF0_SELECTED_API).origin === process.argv[1] ? 0 : 1) } catch { process.exit(1) }")} ${shellWord(config.api)} || exit 0`,
+		`  if ! ${shellWord(node)} -e ${shellWord("try { process.exit(new URL(process.env.REF0_SELECTED_API).origin === process.argv[1] ? 0 : 1) } catch { process.exit(1) }")} ${shellWord(config.api)}; then`,
+		`    [ "$1" = ${harnessCommandNames.mcp} ] || exit 0`,
+		`    ${otherOriginVariable}=$REF0_SELECTED_API`,
+		`    export ${otherOriginVariable}`,
+		"  fi",
 		"fi",
 		"unset REF0_SELECT_ORIGIN REF0_SELECTED_API",
 		`export REF0_API=${shellWord(config.api)}`,
@@ -22246,38 +23930,47 @@ const installInto = Effect.fnUntraced(function* (folders, options) {
 	const failAll = (into, failed) => {
 		for (const folder of into) answers.set(folder, Result.fail(failed));
 	};
+	const started = /* @__PURE__ */ new Set();
+	const clearUnstarted = (into) => Effect.forEach(into.filter((folder) => folder.harness === "codex" && !started.has(folder)), (folder) => codexAgentOf(folder.configFolder).pipe(Effect.flatMap((agent) => clearOtherCodexAuthor(agent, {
+		configFolder: folder.configFolder,
+		home
+	}).pipe(Effect.orDie)), Effect.catchTag("InstallFailed", () => Effect.void)), { discard: true });
 	const launcher = yield* Effect.cached(Effect.gen(function* () {
 		const git = yield* onPath("git");
 		if (Option.isNone(git)) return yield* new InstallFailed({ says: "Git isn’t on this machine’s PATH. Install it." });
 		yield* writeRef0Launcher(home, git.value).pipe(Effect.mapError(() => new InstallFailed({ says: "Couldn’t write ~/.ref0. Check that it’s writable." })));
 	}));
-	for (const harness of ConnectHarness.literals) {
-		const into = folders.filter((folder) => folder.harness === harness);
-		if (into.length === 0) continue;
-		const command = yield* onPath(harness === "codex" ? "codex" : "claude");
-		if (Option.isNone(command)) {
-			failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
-			continue;
-		}
-		yield* Effect.scoped(Effect.gen(function* () {
-			yield* launcher;
-			const release = yield* marketplaceFor(harness, {
-				command: command.value,
-				home,
-				configFolder: into[0]?.configFolder ?? home
-			});
-			for (const folder of into) {
-				const installed = yield* (harness === "claude-code" ? installedInClaudeCode(release, folder.configFolder) : installedInCodex(release, {
-					codex: command.value,
-					home,
-					configFolder: folder.configFolder,
-					name,
-					yesOrNo
-				})).pipe(Effect.result);
-				answers.set(folder, installed);
+	yield* Effect.gen(function* () {
+		for (const harness of ConnectHarness.literals) {
+			const into = folders.filter((folder) => folder.harness === harness);
+			if (into.length === 0) continue;
+			const command = yield* onPath(harness === "codex" ? "codex" : "claude");
+			if (Option.isNone(command)) {
+				failAll(into, new InstallFailed({ says: `${configFolders[harness].name} isn’t on this machine’s PATH. Install it.` }));
+				yield* clearUnstarted(into);
+				continue;
 			}
-		}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)))));
-	}
+			yield* Effect.scoped(Effect.gen(function* () {
+				yield* launcher;
+				const release = yield* marketplaceFor(harness, {
+					command: command.value,
+					home,
+					configFolder: into[0]?.configFolder ?? home
+				});
+				for (const folder of into) {
+					started.add(folder);
+					const installed = yield* (harness === "claude-code" ? installedInClaudeCode(release, folder.configFolder) : installedInCodex(release, {
+						codex: command.value,
+						home,
+						configFolder: folder.configFolder,
+						name,
+						yesOrNo
+					})).pipe(Effect.result);
+					answers.set(folder, installed);
+				}
+			}).pipe(Effect.catchTag("InstallFailed", (failed) => Effect.sync(() => failAll(into, failed)).pipe(Effect.andThen(clearUnstarted(into))))));
+		}
+	}).pipe(Effect.onInterrupt(() => clearUnstarted(folders)));
 	return folders.map((folder) => ({
 		...folder,
 		installed: answers.get(folder) ?? Result.fail(new InstallFailed({ says: "ref0 didn’t install into this folder." }))
@@ -22292,14 +23985,27 @@ const installedInClaudeCode = Effect.fnUntraced(function* (release, configFolder
 		words: `Installed in Claude Code, from ${folder}.`
 	};
 });
+/** The agent a Codex folder's host grant names, whose ID its commits' author file is named by. */
+const codexAgentOf = (configFolder) => HostGrant.use((grants) => grants.get(configFolder)).pipe(Effect.catchTag("KeychainError", (failed) => Effect.fail(failed.unreadable === true ? new InstallFailed({
+	says: "Its host grant can’t be read.",
+	run: "ref0 connect"
+}) : new InstallFailed({ says: failed.nextStep }))), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(new InstallFailed({
+		says: "It isn’t connected.",
+		run: "ref0 connect"
+	})),
+	onSome: (grant) => Effect.succeed(grant)
+})));
 const installedInCodex = Effect.fnUntraced(function* (release, options) {
 	const shown = shownConfigFolder(options.home, options.configFolder);
-	const done = yield* installCodex(release, {
+	const agent = yield* codexAgentOf(options.configFolder);
+	const done = yield* installCodex(release, agent, {
 		codex: options.codex,
 		home: options.home,
 		configFolder: options.configFolder,
 		approve: (hooks) => askToTrust(hooks, shown, options.yesOrNo),
-		approveProfile: (replacing) => askForProfile(replacing, shown, options.yesOrNo)
+		approveProfile: (replacing, checkouts) => askForProfile(replacing, checkouts, shown, options.yesOrNo),
+		approveCommits: () => askForCommits(shown, options.yesOrNo)
 	});
 	const sandbox = done.profile ? "" : ` ${sandboxWords}`;
 	const trust = trustRef0Hooks(installLine(options.configFolder), `${options.name}@${options.name}`);
@@ -22482,7 +24188,7 @@ const answerOf = (connected, installed, others) => ({
 const connectCommands = [Command.make("connect", { json }, ({ json: asJson }) => Effect.gen(function* () {
 	const session = yield* SessionToken;
 	const tty = yield* Tty;
-	if (Option.isSome(yield* session.current)) return yield* sayFailed("ref0 connect runs only in a person’s own terminal, never in an agent’s session: it shows a code, and a yes to that code connects this machine to an agent. If this machine needs connecting, tell your person to run ref0 connect in their own terminal. Never ask them to approve a code for you.");
+	if (yield* session.current.pipe(Effect.map(Option.isSome), Effect.catchTag("NoSession", () => Effect.succeed(true)))) return yield* sayFailed("ref0 connect runs only in a person’s own terminal, never in an agent’s session: it shows a code, and a yes to that code connects this machine to an agent. If this machine needs connecting, tell your person to run ref0 connect in their own terminal. Never ask them to approve a code for you.");
 	if (!tty.attached) return yield* sayFailed("ref0 connect runs only in a terminal you type into, and this isn’t one. Run it yourself, in your own terminal: not through a script, a pipe or an agent.");
 	yield* (yield* ConnectLock).hold;
 	yield* (yield* Keychain).probe;
@@ -23350,7 +25056,7 @@ const isPlainJson = (value, depth = 0) => {
 	const proto = Object.getPrototypeOf(value);
 	return (proto === Object.prototype || proto === null) && Object.values(value).every(inner);
 };
-const decodeAnswer = Schema.decodeUnknownOption(CheckRunAnswer);
+const decodeAnswer$1 = Schema.decodeUnknownOption(CheckRunAnswer);
 const encodeJson$1 = Schema.encodeSync(Schema.fromJsonString(Schema.Json));
 /**
 * A check's bundle, written for `import()` under a name of its code's and this process's, in the
@@ -23491,7 +25197,7 @@ const runPart = Effect.fnUntraced(function* (own, part) {
 			error: "timeout",
 			why: `It ran past its timeout, ${part.timeoutSeconds} seconds`
 		}),
-		onSome: (answer) => isPlainJson(answer, 0) ? Option.getOrElse(decodeAnswer(answer), () => ({
+		onSome: (answer) => isPlainJson(answer, 0) ? Option.getOrElse(decodeAnswer$1(answer), () => ({
 			error: "invalid output",
 			why: "Its answer isn't one a check gives"
 		})) : {
@@ -23688,7 +25394,7 @@ const runLocally = Effect.fnUntraced(function* (folder, check, named, asJson) {
 	if (Option.isNone(thread)) return yield* sayFailed("Name the thread with --thread owner/project#number.");
 	const root = yield* gitIn(folder, ["rev-parse", "--show-toplevel"]);
 	if (Option.isNone(root) || root.value === "") return yield* sayFailed("Git couldn’t find this checkout’s root.");
-	const session = yield* (yield* SessionToken).current.pipe(Effect.catchTag("KeychainError", (failed) => sayFailed(failed.nextStep)));
+	const session = yield* (yield* SessionToken).current.pipe(Effect.catchTag(["KeychainError", "NoSession"], (failed) => sayFailed(failed.nextStep)));
 	if (Option.isSome(session) && Option.isSome(named.agent)) return yield* sayFailed("A session’s local run is signed by the session: leave out --agent.");
 	if (Option.isNone(session) && Option.isNone(named.agent)) return yield* sayFailed("Outside a session, name the agent this machine is attached as, with --agent owner/handle: a local run is signed by the attachment it ran on.");
 	const attachment = Option.isSome(named.agent) ? { attachment: yield* namedAttachment(named.agent.value, Option.none(), true) } : {};
@@ -24467,6 +26173,44 @@ const answerGit = Effect.fnUntraced(function* (operation, input) {
 	return Option.map(token, credentialLines);
 });
 //#endregion
+//#region src/own-session.ts
+/**
+* A command only an agent's session runs, on a repo of the session's project. Its endpoints take
+* the repo's name alone and find it in that project, so the command takes the name alone too: an
+* owner it couldn't check could name another project's repo, and the session's of that name
+* would be changed in its place.
+*/
+const decodeRepoName$1 = Schema.decodeUnknownOption(RepoName);
+/**
+* The token of the agent's session a command runs in. Outside one it says `outside`, what the
+* command is for; in a harness session whose ref0 session never started, why and what to do.
+* Either way it fails before anything's sent.
+*/
+const ownSession = Effect.fnUntraced(function* (outside) {
+	const token = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", (none) => sayFailed(none.nextStep)));
+	if (Option.isNone(token)) return yield* sayFailed(outside);
+	return token.value;
+});
+/** The repo of a session's command, by its name alone. */
+const sessionRepoFlag = Flag.String("repo").pipe(Flag.withDescription("A repo of your session’s project, by its name alone, as shop; if not named, the one this checkout is of"), Flag.optional);
+/**
+* The session a command runs as, and the name of the repo it acts on: the one named, or this
+* checkout's. Outside a session it says `outside`, what the command is for, and fails before
+* anything's sent.
+*/
+const sessionRepo = Effect.fnUntraced(function* (named, outside) {
+	yield* ownSession(outside);
+	const checkout = yield* Checkout;
+	const repo = Option.isSome(named) ? decodeRepoName$1(named.value) : yield* checkout.repoAt(".");
+	if (Option.isNone(repo)) return yield* sayFailed(Option.isSome(named) ? "Name a repo of your session’s project by its name alone, as --repo shop." : "Name the repo with --repo and its name, as --repo shop, or run this in its checkout.");
+	const session = (yield* callEndpoint({ endpoint: "me.get" })).value.session?.session;
+	if (session === void 0) return yield* sayFailed("This token isn’t a session’s.");
+	return {
+		session,
+		repo: repo.value
+	};
+});
+//#endregion
 //#region src/sync-history.ts
 const decodePlace = Schema.decodeUnknownEffect(Schema.Struct({
 	owner: OwnerRef,
@@ -24522,7 +26266,7 @@ const trimShallow = Effect.fnUntraced(function* (gitDir) {
 */
 const loadSyncHistory = Effect.fnUntraced(function* (gitDir, repo) {
 	const config = yield* Ref0Config;
-	const token = yield* (yield* SessionToken).current;
+	const token = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", () => Effect.succeedNone));
 	if (Option.isNone(token)) return yield* new HistoryNotLoaded({ why: "this terminal has no session to load it as" });
 	const fs = yield* FileSystem.FileSystem;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
@@ -24695,9 +26439,8 @@ const gitCommands = [
 		json
 	}, ({ repo: written, directory, json: asJson }) => Effect.gen(function* () {
 		const { owner, repo: name } = repoParts(written);
-		const session = yield* SessionToken;
 		const config = yield* Ref0Config;
-		if (Option.isNone(yield* session.current)) return yield* sayFailed("ref0 clone runs in an agent’s session, which pushes to a fork of its own. A person’s clone, by approval, isn’t built yet.");
+		yield* ownSession("ref0 clone runs only in an agent’s ref0 session, which pushes to a fork of its own, and none runs here. In Claude Code or Codex, one starts at each prompt once ref0 connect has connected its config folder.");
 		const ours = (yield* callEndpoint({ endpoint: "me.get" })).value.session?.session;
 		if (ours === void 0) return yield* sayFailed("This token isn’t a session’s.");
 		const fork = yield* callEndpoint({
@@ -24729,8 +26472,7 @@ const gitCommands = [
 		yield* printAnswer(fork.json, asJson, `Cloned ${owner}/${name} into ${into}. origin is read-only to agents: git push goes to ${forkRemote(fork.value)}, the fork of whichever session on the thread pushes.`);
 	}).pipe(Effect.catchTag("CallFailed", failedWith$10))).pipe(Command.withDescription("Clone a repo of the session’s project, to push to its fork"), Command.withShortDescription("Clone a repo to work in your session’s fork")),
 	Command.make("sync", { json }, ({ json: asJson }) => Effect.gen(function* () {
-		const session = yield* SessionToken;
-		if (Option.isNone(yield* session.current)) return yield* sayFailed("ref0 sync runs in an agent’s session, in a clone ref0 clone made.");
+		yield* ownSession("ref0 sync runs in an agent’s session, in a clone ref0 clone made.");
 		const synced = yield* syncBase(".");
 		if (synced.kind === "refused") return yield* sayFailed(synced.why);
 		const { on, commit } = synced.base;
@@ -26014,35 +27756,6 @@ const planCommands = [
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("Answer a decision that waits on you"))
 ];
 //#endregion
-//#region src/own-session.ts
-/**
-* A command only an agent's session runs, on a repo of the session's project. Its endpoints take
-* the repo's name alone and find it in that project, so the command takes the name alone too: an
-* owner it couldn't check could name another project's repo, and the session's of that name
-* would be changed in its place.
-*/
-const decodeRepoName$1 = Schema.decodeUnknownOption(RepoName);
-/** The repo of a session's command, by its name alone. */
-const sessionRepoFlag = Flag.String("repo").pipe(Flag.withDescription("A repo of your session’s project, by its name alone, as shop; if not named, the one this checkout is of"), Flag.optional);
-/**
-* The session a command runs as, and the name of the repo it acts on: the one named, or this
-* checkout's. Outside a session it says `outside`, what the command is for, and fails before
-* anything's sent.
-*/
-const sessionRepo = Effect.fnUntraced(function* (named, outside) {
-	const token = yield* SessionToken;
-	if (Option.isNone(yield* token.current)) return yield* sayFailed(outside);
-	const checkout = yield* Checkout;
-	const repo = Option.isSome(named) ? decodeRepoName$1(named.value) : yield* checkout.repoAt(".");
-	if (Option.isNone(repo)) return yield* sayFailed(Option.isSome(named) ? "Name a repo of your session’s project by its name alone, as --repo shop." : "Name the repo with --repo and its name, as --repo shop, or run this in its checkout.");
-	const session = (yield* callEndpoint({ endpoint: "me.get" })).value.session?.session;
-	if (session === void 0) return yield* sayFailed("This token isn’t a session’s.");
-	return {
-		session,
-		repo: repo.value
-	};
-});
-//#endregion
 //#region src/pull-request-lines.ts
 /**
 * Pull requests as `ref0 pr` says them: each one's number, thread, state and current version,
@@ -26503,8 +28216,7 @@ const taskCommands = [Command.make("tasks", {
 	file: Flag.FileText("file").pipe(Flag.withDescription("The whole list, as JSON: each task’s text, up to 200 characters, and its state, \"to do\", \"in progress\" or \"done\"; at most 50")),
 	json
 }, ({ file, json: asJson }) => Effect.gen(function* () {
-	const session = yield* SessionToken;
-	if (Option.isNone(yield* session.current)) return yield* sayFailed("ref0 tasks runs in an agent’s session, which sets its own list.");
+	yield* ownSession("ref0 tasks runs in an agent’s session, which sets its own list.");
 	const parsed = yield* Effect.result(decodeJsonText(file));
 	if (Result.isFailure(parsed)) return yield* sayFailed("That list isn’t JSON.");
 	const checked = yield* Effect.result(checkTasks(parsed.success));
@@ -27107,9 +28819,8 @@ const waitCommands = [Command.make("wait", {
 	blockers: Flag.Boolean("blockers").pipe(Flag.withDescription("Wait until nothing blocks your session’s thread from merging"), Flag.withDefault(false)),
 	json
 }, ({ blockers, json: asJson }) => Effect.gen(function* () {
-	const session = yield* SessionToken;
 	if (!blockers) return yield* sayFailed("Say what to wait for: ref0 wait --blockers waits until nothing blocks your thread.");
-	if (Option.isNone(yield* session.current)) return yield* sayFailed("ref0 wait --blockers runs in an agent’s session: it waits on its own thread.");
+	yield* ownSession("ref0 wait --blockers runs in an agent’s session: it waits on its own thread.");
 	yield* waitOnBlockers(asJson);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription(`Wait until nothing blocks your session’s thread from merging, for 9 minutes at most`), Command.withShortDescription("Wait for your session’s thread to be ready to merge"))];
 //#endregion
@@ -30727,6 +32438,7 @@ var Waker = class Waker extends Context.Service()("ref0/cli/Waker") {
 			const socket = yield* Config.String("CLAUDE_CODE_MESSAGING_SOCKET").pipe(Config.option);
 			const token = yield* Config.Redacted("CLAUDE_CODE_MESSAGING_TOKEN").pipe(Config.option);
 			const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+			const fs = yield* FileSystem.FileSystem;
 			const post = Option.zipWith(socket, token, (path, secret) => Effect.callback((resume) => {
 				const connection = connect(path);
 				connection.on("error", () => resume(Effect.succeed(false)));
@@ -30753,6 +32465,7 @@ var Waker = class Waker extends Context.Service()("ref0/cli/Waker") {
 					"--message",
 					wakeLine
 				], {
+					cwd: yield* emptyFolder(fs),
 					env: { CODEX_HOME: setup.home },
 					extendEnv: true
 				}));
@@ -30867,6 +32580,8 @@ function readHook(args) {
 */
 /** The keychain account a binding's thread is kept under, beside its session token's. */
 const threadAccount = (binding) => `${sessionAccount(binding)}/thread`;
+/** The keychain account a start not yet landed is kept under, beside its session token's. */
+const pendingAccount = (binding) => `${sessionAccount(binding)}/pending`;
 const decodeRequest = Schema.decodeUnknownEffect(StartSessionRequest);
 const decodeRequestId = Schema.decodeUnknownOption(RequestId);
 /**
@@ -30906,14 +32621,14 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 	const folder = yield* (yield* ConfigFolders).folder(harness);
 	const grant = yield* hostGrant.get(folder);
 	if (Option.isNone(grant) || grant.value.harness !== harness) return Option.none();
-	const pendingAccount = `${sessionAccount(input.binding)}/pending`;
+	const pending = pendingAccount(input.binding);
 	const held = Option.flatMap(yield* keychain.get(sessionAccount(input.binding)), (kept) => parseToken(Redacted.value(kept)));
-	const pending = Option.filter(Option.flatMap(yield* keychain.get(pendingAccount), (kept) => decodePending(Redacted.value(kept))), (one) => !Option.exists(held, (parts) => parts.secret === one.secret));
-	const { requestId, secret } = Option.isSome(pending) ? pending.value : {
+	const resent = Option.filter(Option.flatMap(yield* keychain.get(pending), (kept) => decodePending(Redacted.value(kept))), (one) => !Option.exists(held, (parts) => parts.secret === one.secret));
+	const { requestId, secret } = Option.isSome(resent) ? resent.value : {
 		requestId: yield* newRequestId,
 		secret: encodeSecret(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))
 	};
-	if (Option.isNone(pending)) yield* keychain.set(pendingAccount, Redacted.make(`${requestId} ${secret}`));
+	if (Option.isNone(resent)) yield* keychain.set(pending, Redacted.make(`${requestId} ${secret}`));
 	const hash = yield* hashOf(secret);
 	const where = input.on.kind === "thread" ? threadParts(input.on.written) : {
 		owner: grant.value.owner,
@@ -30943,7 +32658,7 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 	const started = yield* (yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(grant.value.token)))).sessions.start({
 		headers: { "idempotency-key": requestId },
 		payload
-	}).pipe(Effect.tapError((error) => Match.value(error).pipe(Match.tag("ProjectNotFound", "ProjectNotReady", "ThreadNotFound", "ThreadIsClosed", "TextRefused", "NotPermitted", "DeliveryOutsideWindow", () => keychain.remove(pendingAccount)), Match.orElse(() => Effect.void))));
+	}).pipe(Effect.tapError((error) => Match.value(error).pipe(Match.tag("ProjectNotFound", "ProjectNotReady", "ThreadNotFound", "ThreadIsClosed", "TextRefused", "NotPermitted", "DeliveryOutsideWindow", () => keychain.remove(pending)), Match.orElse(() => Effect.void))));
 	const thread = input.on.kind === "thread" ? input.on.written : writtenThread(grant.value.owner, {
 		kind: "project",
 		name: newThreadProject
@@ -30951,7 +32666,7 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 	yield* keychain.remove(gitTokenAccount(input.binding)).pipe(Effect.ignore);
 	yield* keychain.set(sessionAccount(input.binding), Redacted.make(formatToken(started.credential.person, started.credential.id, secret)));
 	yield* keychain.set(threadAccount(input.binding), Redacted.make(thread)).pipe(Effect.ignore);
-	yield* keychain.remove(pendingAccount).pipe(Effect.ignore);
+	yield* keychain.remove(pending).pipe(Effect.ignore);
 	return Option.some(started);
 });
 //#endregion
@@ -31013,6 +32728,11 @@ const ownerOf = (bound) => ({
 const decodeWrittenThread = Schema.decodeUnknownOption(WrittenThread);
 /** How long a harness session with no token is left before the keychain is asked again. */
 const unboundMillis = 3e4;
+/**
+* How long a prompt's start may run on past its hook's deadline before it's given up, and a later
+* prompt sends it again, as itself: well past the slowest start seen on staging, 4.5 seconds.
+*/
+const startBound = "20 seconds";
 /** How often `ref0 mcp` renews its session's 30-minute lease while its harness process lives. */
 const renewEvery = "10 minutes";
 /** How soon a renewal that failed is tried again, well inside the lease. */
@@ -31028,6 +32748,7 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 	const hints = yield* LiveHints;
 	const context = yield* Effect.context();
 	const owned = yield* Ref.make(Option.none());
+	const onTheWay = yield* Ref.make(Option.none());
 	const listen = Effect.fnUntraced(function* (bound) {
 		const client = yield* clientOf(bound.token);
 		let pause = 1;
@@ -31123,17 +32844,31 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		if (Option.isNone(started)) return Option.none();
 		return yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none()));
 	});
+	const startedFor = Effect.fnUntraced(function* (binding, hook, starting) {
+		const sent = yield* Ref.get(onTheWay);
+		if (Option.isSome(sent) && sent.value.harnessSession === binding.harnessSession) return yield* Deferred.await(sent.value.done);
+		if (!starting) return Option.none();
+		const done = yield* Deferred.make();
+		const mine = Option.some({
+			harnessSession: binding.harnessSession,
+			done
+		});
+		yield* Ref.set(onTheWay, mine);
+		yield* Effect.forkIn(startAtPrompt(binding, hook).pipe(Effect.timeoutOption(startBound), Effect.map(Option.flatten), Effect.orElseSucceed(() => Option.none()), Effect.ensuring(Ref.update(onTheWay, (now) => now === mine ? Option.none() : now)), Effect.onExit((exit) => Deferred.done(done, exit))), scope);
+		return yield* Deferred.await(done);
+	});
 	const bind = Effect.fnUntraced(function* (hook) {
 		const now = yield* Clock.currentTimeMillis;
 		const current = yield* Ref.get(state);
 		if (current.kind === "bound" && current.bound.binding.harnessSession === hook.harnessSession) return Option.some(current.bound);
 		const starting = hook.event === "UserPromptSubmit" && Option.isSome(agent);
+		const sent = Option.exists(yield* Ref.get(onTheWay), (one) => one.harnessSession === hook.harnessSession);
 		const over = current.kind === "ended" && current.harnessSession === hook.harnessSession;
 		const waiting = current.kind === "unbound" && now < current.until && !starting;
-		if (over && !starting || waiting) return Option.none();
+		if ((over && !starting || waiting) && !sent) return Option.none();
 		const binding = yield* bindingForServer(hook.harnessSession);
 		const held = Option.isNone(binding) ? Option.none() : yield* heldFor(binding.value, over);
-		const token = Option.isSome(held) || Option.isNone(binding) || !starting ? held : yield* startAtPrompt(binding.value, hook);
+		const token = Option.isSome(held) || Option.isNone(binding) ? held : yield* startedFor(binding.value, hook, starting);
 		if (Option.isNone(binding) || Option.isNone(token)) {
 			if (!over) yield* Ref.set(state, {
 				kind: "unbound",
@@ -31423,7 +33158,7 @@ const toRead = (hook, ownHook) => {
 const sessionTurns = Effect.fnUntraced(function* (edges) {
 	const transcripts = yield* Transcripts;
 	const turn = yield* Ref.make(Option.none());
-	const trackTurn = Effect.fnUntraced(function* (client, bound, hook, deadline) {
+	const trackTurn = Effect.fnUntraced(function* (client, bound, hook, deadline, late = false) {
 		const checkout = yield* Checkout;
 		const session = bound.session;
 		const owner = ownerOf(bound);
@@ -31437,6 +33172,10 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 		const prompted = isNew ? hook.transcript : void 0;
 		if (prompted !== void 0) yield* transcripts.begin(owner, harness, prompted, harnessTurn);
 		const ending = prompted === void 0 ? void 0 : yield* transcripts.read(owner, harness, [prompted], { until: harnessTurn });
+		const fresh = late && harness === "claude-code" ? {
+			...nothingSeen,
+			tokens: readFailed(nothingSeen.tokens)
+		} : nothingSeen;
 		const tracked = isNew ? Option.some({
 			kind: "starting",
 			harnessTurn,
@@ -31447,7 +33186,7 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 					tokens: addRead(now.seen.tokens, ending, true)
 				}
 			}) : now.previous),
-			seen: nothingSeen
+			seen: fresh
 		}) : before;
 		if (Option.isNone(tracked)) return;
 		const ownHook = hook.harnessTurn === tracked.value.harnessTurn;
@@ -31523,6 +33262,7 @@ const sessionTurns = Effect.fnUntraced(function* (edges) {
 	return {
 		now: Ref.get(turn),
 		track: trackTurn,
+		trackLate: (client, bound, prompt, deadline) => trackTurn(client, bound, prompt, deadline, true),
 		fresh: Ref.set(turn, Option.none())
 	};
 });
@@ -31659,6 +33399,7 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 			const scope = yield* Scope.Scope;
 			const tasks = yield* sessionTasks;
 			const turns = yield* sessionTurns({ tasksLanded: tasks.landed });
+			const prompted = yield* Ref.make(Option.none());
 			const edits = yield* sessionEdits({ turn: turns.now });
 			const delivery = yield* sessionDelivery;
 			const wake = yield* sessionWake({
@@ -31716,9 +33457,13 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 				lastLook
 			});
 			const deliver = Effect.fnUntraced(function* (hook, deadline) {
+				if (hook.event === "UserPromptSubmit") yield* Ref.set(prompted, Option.some(hook));
 				const bound = yield* binding.bind(hook);
 				if (Option.isNone(bound)) return Option.none();
 				const client = yield* clientOf(bound.value.token);
+				const prompt = Option.filter(yield* Ref.get(prompted), (one) => one.harnessSession === hook.harnessSession && one.harnessTurn === hook.harnessTurn);
+				if (Option.isSome(prompt)) yield* Ref.set(prompted, Option.none());
+				if (Option.isSome(prompt) && prompt.value !== hook) yield* turns.trackLate(client, bound.value, prompt.value, deadline);
 				const unattributed = yield* edits.noteEdits(bound.value, hook);
 				const within = yield* binding.within;
 				if (yield* tasks.note(bound.value, hook)) yield* Effect.forkIn(tasks.send(client, bound.value).pipe(Effect.ignore), within);
@@ -31834,6 +33579,18 @@ const mcpServer = (version, started) => McpServer.toolkit(HarnessTools).pipe(Lay
 	protocols
 })));
 /**
+* `ref0 mcp` in a checkout of another origin, which the launcher names: the plugin's server all
+* the same, answering every hook with nothing, since that origin's own plugin serves the
+* checkout. A harness takes a server that closes before `initialize` as broken, and Claude Code
+* then skips it for 15 minutes, in every folder. It reads nothing of this machine's, so it
+* answers at once.
+*/
+const otherOriginServer = (version) => McpServer.toolkit(HarnessTools).pipe(Layer.provide(HarnessTools.toLayer({ hook: () => Effect.succeed({}) })), Layer.provide(McpServer.layerStdio({
+	name: "ref0",
+	version,
+	protocols
+})));
+/**
 * The `codex` that started this server, by absolute path: its executable, which Linux names, or
 * its command's first word when that's a path. Codex isn't sure to be on `PATH` (M0).
 */
@@ -31864,11 +33621,18 @@ const codexSetupHere = Effect.fnUntraced(function* (process) {
 	});
 });
 const mcp = Command.make(harnessCommandNames.mcp, {}, () => Effect.gen(function* () {
+	const checked = yield* Config.schema(ConnectHarness, serverCheckVariable).pipe(Config.option);
+	const other = yield* Config.option(Config.String(otherOriginVariable));
+	if (Option.isSome(other) && Option.isNone(checked)) {
+		yield* printBlocks([[`ref0: this folder is for ${other.value}, so ref0’s plugin for ${(yield* Ref0Config).api} does nothing in it.`]]);
+		return yield* Layer.launch(otherOriginServer(cliVersion));
+	}
 	const agents = yield* ConfigFolders;
-	const found = yield* (yield* HarnessProcess).innermost;
-	const agent = Option.isSome(found) ? yield* (yield* HostGrant).get(yield* agents.folder(found.value.harness)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone)) : Option.none();
+	const found = Option.isSome(checked) ? Option.none() : yield* (yield* HarnessProcess).innermost;
+	const harness = Option.orElse(checked, () => Option.map(found, (each) => each.harness));
+	const agent = Option.isSome(harness) ? yield* (yield* HostGrant).get(yield* agents.folder(harness.value)).pipe(Effect.catchTag("KeychainError", (failed) => failed.unreadable === true ? Effect.succeedNone : sayFailed(failed.nextStep))) : Option.none();
 	const codex = Option.isSome(found) && found.value.harness === "codex" ? yield* codexSetupHere(found.value.process) : Option.none();
-	const reinstall = Option.isSome(found) && Option.isSome(agent) ? installLine(yield* agents.folder(found.value.harness)) : "ref0 connect";
+	const reinstall = Option.isSome(harness) && Option.isSome(agent) ? installLine(yield* agents.folder(harness.value)) : "ref0 connect";
 	return yield* Layer.launch(mcpServer(cliVersion, {
 		plugin: {
 			version: yield* pluginVersion,
@@ -31962,139 +33726,17 @@ const endHarnessSession = Effect.gen(function* () {
 }).pipe(Effect.ignore);
 const sessionEnd = Command.make(harnessCommandNames.sessionEnd, { protocol: protocolFlag }, (flags) => flags.protocol === "1" ? endHarnessSession : Effect.void).pipe(Command.withDescription("Ends the ref0 session of a harness session that's closing"), Command.withShortDescription("End the harness’s ref0 session"));
 //#endregion
-//#region src/harness/git-hooks.ts
-/**
-* ref0's Git hooks: folders of forwarders in `~/.ref0/origins/<origin>/git-hooks`, which ref0 names as
-* `core.hooksPath` in its agents' commands alone, never in a repo, its config or its hooks.
-* `core.hooksPath` replaces a repo's whole hooks folder, so each forwarder runs the repo's own
-* hook of its name, with the same arguments, stdin and exit status, wherever the repo keeps it:
-* husky's `.husky/_`, `.git/hooks/` or another `core.hooksPath`. It finds and runs that hook
-* with ref0's entry left out of its environment, so a hook that looks up another, as
-* `pre-applypatch.sample` runs `pre-commit`, finds the repo's own. A forwarder runs nothing
-* when the repo's hooks path is one of ref0's folders, or when a forwarder started it, so none
-* calls itself: a first version that left ref0's entry in started about 1,000 processes.
-*
-* Git runs a hook that exists even where the repo has none, so the forwarders cost each hook one
-* `sh` and one `git rev-parse`, about 1.5 ms. Two hooks run on every index write and ref update,
-* hundreds of times in a long rebase, so only `all` forwards them, for a checkout that has its
-* own; `most` forwards every other (measured 23 Oct 2026, in the piece's pull request).
-*
-* The folders are the CLI's: a session's start writes them again when a forwarder differs, as
-* after an update. Each is read-only, so a tool that installs hooks wherever `core.hooksPath`
-* points, run in an agent's command, fails there rather than replacing a forwarder for every
-* repo.
-*/
-/** The hooks Git runs on every index write and ref update. */
-const frequentHooks = ["post-index-change", "reference-transaction"];
-/**
-* Every other hook Git looks for in its hooks path. Not `push-to-checkout`, which replaces Git's
-* own update of a checkout pushed to merely by existing, nor `fsmonitor-watchman`, which Git runs
-* from `core.fsmonitor`, never from the hooks path.
-*/
-const forwardedHooks = [
-	"applypatch-msg",
-	"pre-applypatch",
-	"post-applypatch",
-	"pre-commit",
-	"pre-merge-commit",
-	"prepare-commit-msg",
-	"commit-msg",
-	"post-commit",
-	"pre-rebase",
-	"post-checkout",
-	"post-merge",
-	"pre-push",
-	"pre-receive",
-	"update",
-	"proc-receive",
-	"post-receive",
-	"post-update",
-	"pre-auto-gc",
-	"post-rewrite",
-	"sendemail-validate",
-	"p4-changelist",
-	"p4-prepare-changelist",
-	"p4-post-changelist",
-	"p4-pre-submit"
-];
-/**
-* The forwarder for one hook. `hooks` is the folder holding ref0's folders: an entry naming one
-* of them is ref0's, and is left out. The rest keep their order, renumbered.
-*/
-const forwarder = (name, hooks) => [
-	"#!/bin/sh",
-	`# ref0 ${cliVersion}'s forwarder for Git's ${name} hook. ref0 sets core.hooksPath to this`,
-	"# folder only in its agents' commands. This runs the repo's own hook, found and run with",
-	"# ref0's entry left out, with the same arguments, stdin and exit status.",
-	`[ -n "\${${gitHookVariables.forwarded}-}" ] && exit 0`,
-	`ref0_hooks=${shellWord(hooks)}`,
-	"ref0_n=${GIT_CONFIG_COUNT:-0}",
-	"ref0_i=0",
-	"ref0_j=0",
-	"while [ \"$ref0_i\" -lt \"$ref0_n\" ]; do",
-	"  eval \"ref0_key=\\${GIT_CONFIG_KEY_$ref0_i-} ref0_value=\\${GIT_CONFIG_VALUE_$ref0_i-}\"",
-	"  unset \"GIT_CONFIG_KEY_$ref0_i\" \"GIT_CONFIG_VALUE_$ref0_i\"",
-	"  if [ \"$ref0_key\" != core.hooksPath ] || [ \"${ref0_value%/*}\" != \"$ref0_hooks\" ]; then",
-	"    export \"GIT_CONFIG_KEY_$ref0_j=$ref0_key\" \"GIT_CONFIG_VALUE_$ref0_j=$ref0_value\"",
-	"    ref0_j=$((ref0_j + 1))",
-	"  fi",
-	"  ref0_i=$((ref0_i + 1))",
-	"done",
-	"if [ \"$ref0_j\" -eq 0 ]; then unset GIT_CONFIG_COUNT; else export GIT_CONFIG_COUNT=\"$ref0_j\"; fi",
-	`ref0_hook=$(git rev-parse --git-path hooks/${name}) || exit`,
-	"[ -f \"$ref0_hook\" ] && [ -x \"$ref0_hook\" ] || exit 0",
-	"ref0_dir=$(cd -P \"${ref0_hook%/*}\" && pwd) || exit",
-	"[ \"${ref0_dir%/*}\" = \"$ref0_hooks\" ] && exit 0",
-	`export ${gitHookVariables.forwarded}=${name}`,
-	"exec \"$ref0_hook\" \"$@\"",
-	""
-].join("\n");
-/** The hooks each folder forwards. */
-const hooksIn = (folder) => folder === "all" ? [...forwardedHooks, ...frequentHooks] : forwardedHooks;
-/** The folder holding ref0's hooks folders, made if it isn't yet: its path, through any links. */
-const gitHooksHome = Effect.fnUntraced(function* (home, api) {
-	const fs = yield* FileSystem.FileSystem;
-	const given = (yield* Path.Path).join(home, ".ref0", "origins", originKey(api), "git-hooks");
-	yield* fs.makeDirectory(given, {
-		recursive: true,
-		mode: 448
-	});
-	return yield* fs.realPath(given);
-});
-/**
-* One of ref0's hooks folders, in `hooks`, written first unless every forwarder in it is already
-* as this CLI writes it: its path, as the agent's `core.hooksPath` names it.
-*/
-const hooksFolder = Effect.fnUntraced(function* (hooks, folder) {
-	const fs = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const crypto = yield* Crypto.Crypto;
-	const written = path.join(hooks, folder);
-	const names = hooksIn(folder);
-	const current = Effect.forEach(names, (name) => fs.readFileString(path.join(written, name)).pipe(Effect.map((text) => text === forwarder(name, hooks)), Effect.orElseSucceed(() => false))).pipe(Effect.map((each) => each.every(Boolean)));
-	if (yield* current) return written;
-	yield* Effect.gen(function* () {
-		yield* fs.makeDirectory(written, { recursive: true });
-		yield* fs.chmod(written, 493);
-		for (const name of names) {
-			const next = path.join(written, `${name}.${yield* crypto.randomUUIDv4}.next`);
-			yield* fs.writeFileString(next, forwarder(name, hooks), { mode: 365 });
-			yield* fs.rename(next, path.join(written, name));
-		}
-		yield* fs.chmod(written, 365);
-	}).pipe(Effect.catch((error) => Effect.flatMap(current, (done) => done ? Effect.void : Effect.fail(error))));
-	return written;
-});
-//#endregion
 //#region src/harness/commit-environment.ts
 /**
 * The agent as the author of its commits, set at a Claude Code session's start in the
 * environment of the agent's own commands, and nowhere else: the file `CLAUDE_ENV_FILE` names,
 * which Claude Code runs ahead of each of them. It sets Git's author to the agent, by its owner
 * and handle and its commit email; one `GIT_CONFIG_*` entry naming ref0's hooks folder as
-* `core.hooksPath`, after any the command already has; and the harness, for the trailer. Git
-* takes the committer from the person's own config, with their signature, and a commit the
-* person makes in their own terminal has none of it.
+* `core.hooksPath`, after any the command already has; and, for the trailer, the harness, the
+* session's transcript and the model it started with, both from Claude Code's `SessionStart`.
+* Its other hooks carry no model, so the trailer reads the transcript's last. Git takes the
+* committer from the person's own config, with their signature, and a commit the person makes in
+* their own terminal has none of it.
 *
 * The agent is the one the session's config folder acts as, from that folder's host grant, which
 * `ref0 connect` keeps with the agent's ID. It sets no author when the grant can't be read, or
@@ -32104,6 +33746,18 @@ const hooksFolder = Effect.fnUntraced(function* (hooks, folder) {
 */
 /** How many commits on the default branch a session's start reads for a sign-off. */
 const signedOffWithin = 20;
+/** A model as the trailer names it, which the hook also checks: one word, without a newline. */
+const modelName = /^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/;
+/**
+* The model a session started with, as the trailer names it: none for a value it can't name.
+* Claude Code may follow the model with its context window, as `[1m]`, which isn't the model.
+*/
+const startingModel = (model) => Option.filter(Option.fromNullishOr(model?.replace(/\[[^\]]*\]$/, "")), (name) => modelName.test(name));
+/** A variable the file exports, or unsets when the session has no value for it. */
+const exported = (name, value) => Option.match(value, {
+	onNone: () => `unset ${name}`,
+	onSome: (word) => `export ${name}=${shellWord(word)}`
+});
 /**
 * What a session's start adds to the file Claude Code runs ahead of the agent's commands. The
 * hooks path goes after the entries a command already has, once however often the file runs.
@@ -32113,10 +33767,12 @@ const environmentScript = (set) => [
 	"",
 	"# ref0: the agent as the author of its commits, and ref0's Git hooks, in its commands",
 	...Option.match(set.author, {
-		onNone: () => ["case ${GIT_AUTHOR_EMAIL-} in *@ref0.work) unset GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL ;; esac"],
+		onNone: () => [`case \${GIT_AUTHOR_EMAIL-} in *@${agentCommitDomain}) unset GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL ;; esac`],
 		onSome: (author) => [`export GIT_AUTHOR_NAME=${shellWord(author.name)}`, `export GIT_AUTHOR_EMAIL=${shellWord(author.email)}`]
 	}),
 	`export ${gitHookVariables.harness}=${set.harness}`,
+	exported(gitHookVariables.transcript, set.transcript),
+	exported(gitHookVariables.model, set.model),
 	"if [ -z \"${ref0_hooks_set-}\" ]; then",
 	"  ref0_n=${GIT_CONFIG_COUNT:-0}",
 	`  export "GIT_CONFIG_KEY_$ref0_n=core.hooksPath" "GIT_CONFIG_VALUE_$ref0_n="${shellWord(set.folder)} "GIT_CONFIG_COUNT=$((ref0_n + 1))"`,
@@ -32125,12 +33781,16 @@ const environmentScript = (set) => [
 	"fi",
 	""
 ].join("\n");
+/** How the agent runs a tool that installs hooks where `core.hooksPath` points. */
+const hookInstallerPrefix = "env -u GIT_CONFIG_COUNT";
 /**
 * What the agent reads at its session's start once its commands name ref0's hooks folder: an
 * installer run there fails on that read-only folder, and without ref0's entry it installs into
 * the repo's own.
 */
-const hookInstallerWords = `ref0: Git in your commands runs hooks through ref0's read-only folder, so run a hook installer, such as git lfs install, pre-commit install, lefthook install or simple-git-hooks, as env -u GIT_CONFIG_COUNT <command>, to install into the repo's own hooks folder.`;
+const hookInstallerWords = `ref0: Git in your commands runs hooks through ref0's read-only folder, so run a hook installer, such as git lfs install, pre-commit install, lefthook install or simple-git-hooks, as ${hookInstallerPrefix} <command>, to install into the repo's own hooks folder.`;
+/** Codex uses an include in `GIT_CONFIG_PARAMETERS`, leaving a launcher's count alone. */
+const codexHookInstallerWords = hookInstallerWords.replace(hookInstallerPrefix, "env -u GIT_CONFIG_PARAMETERS");
 /**
 * What the session's checkout says: which of ref0's hooks folders it needs, `all` when it has
 * its own frequent hook, and whether it signs off its commits. Outside a checkout, neither.
@@ -32176,29 +33836,59 @@ const checkoutAt = Effect.fnUntraced(function* (cwd) {
 	};
 });
 /**
-* Adds the agent's commit environment to the file Claude Code names, for the session opening in
-* `cwd`: only in Claude Code, and only for a setup with an agent. ref0's hooks folder is written
-* first, so the file never names a folder that isn't there. Whether it set ref0's hooks path.
+* The harness whose `SessionStart` runs this: Claude Code, which alone gives its hook the file it
+* runs ahead of the agent's commands, and never its agent's commands; else Codex, when the
+* innermost harness process above it is Codex's, as the session's binding reads it. Codex's hook
+* input says nothing Claude Code's doesn't, and Codex sets no `CODEX_HOME` for the default
+* `~/.codex`. Neither otherwise.
+*/
+const startingHarness = Effect.gen(function* () {
+	const file = yield* Config.String("CLAUDE_ENV_FILE").pipe(Config.withDefault(""));
+	if (file !== "") return Option.some({
+		harness: "claude-code",
+		file
+	});
+	const found = yield* (yield* HarnessProcess).innermost;
+	return Option.isSome(found) && found.value.harness === "codex" ? Option.some({ harness: "codex" }) : Option.none();
+});
+/**
+* What the agent reads when its commits couldn't be set up at its session's start, in one line,
+* whatever failed: the session still starts. Its commits may then name the person, skip ref0's
+* hooks, or meet a sign-off's refusal once.
+*/
+const commitSetupFailedWords = (error) => {
+	return `ref0: ref0 couldn't set up Git for your commands, so your commits may not name you as their author or run ref0's hooks: ${("nextStep" in error ? error.nextStep : "detail" in error ? error.detail : error.message).replaceAll(/\s+/g, " ").trim()}`;
+};
+/**
+* Adds the agent's commit environment for the session a `SessionStart` opens, in Claude Code to
+* the file it names and in Codex to its checkout's section, only for a setup with an agent. ref0's
+* hooks folder is written first, so nothing names a folder that isn't there. The harness whose
+* hooks path it set, if it set one.
 */
-const setCommitEnvironment = Effect.fnUntraced(function* (cwd) {
+const setCommitEnvironment = Effect.fnUntraced(function* (session) {
 	const fs = yield* FileSystem.FileSystem;
 	const folders = yield* ConfigFolders;
-	const file = yield* Config.String("CLAUDE_ENV_FILE").pipe(Config.withDefault(""));
-	if (file === "") return false;
+	const starting = yield* startingHarness;
+	if (Option.isNone(starting)) return Option.none();
+	const hook = starting.value;
+	if (hook.harness === "codex") return (yield* setCodexCommitEnvironment(session.cwd ?? ".", yield* checkoutAt(session.cwd ?? "."))) ? Option.some("codex") : Option.none();
 	const connected = yield* (yield* HostGrant).get(yield* folders.folder("claude-code")).pipe(Effect.map(Option.map(Option.some)), Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedSome(Option.none())));
-	if (Option.isNone(connected)) return false;
-	const checkout = yield* checkoutAt(cwd);
+	if (Option.isNone(connected)) return Option.none();
+	const checkout = yield* checkoutAt(session.cwd ?? ".");
 	const folder = yield* hooksFolder(yield* gitHooksHome(yield* Config.String("HOME"), (yield* Ref0Config).api), checkout.folder);
 	const author = checkout.signsOff ? Option.none() : Option.map(connected.value, (grant) => ({
 		name: agentCommitName(grant.owner, grant.agent),
 		email: agentCommitEmail(grant.agentId)
 	}));
-	yield* fs.writeFileString(file, environmentScript({
+	const script = environmentScript({
 		author,
 		folder,
-		harness: "claude-code"
-	}), { flag: "a" });
-	return true;
+		harness: "claude-code",
+		transcript: Option.filter(Option.fromNullishOr(session.transcript_path), (path) => path !== ""),
+		model: startingModel(session.model)
+	});
+	yield* fs.writeFileString(hook.file, script, { flag: "a" });
+	return Option.some("claude-code");
 });
 //#endregion
 //#region src/harness/session-start.ts
@@ -32250,7 +33940,8 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 	const input = yield* stdio.stdin.pipe(Stream.decodeText(), Stream.mkString);
 	const hook = decodeHook(input);
 	if (Option.isNone(hook)) return;
-	if (yield* setCommitEnvironment(hook.value.cwd ?? ".").pipe(Effect.orElseSucceed(() => false))) yield* Console.log(hookInstallerWords);
+	const hooksSet = yield* setCommitEnvironment(hook.value).pipe(Effect.catch((error) => Console.log(commitSetupFailedWords(error)).pipe(Effect.as(Option.none()))));
+	if (Option.isSome(hooksSet)) yield* Console.log(hooksSet.value === "codex" ? codexHookInstallerWords : hookInstallerWords);
 	const binding = yield* bindingHere(hook.value.session_id);
 	if (Option.isNone(binding)) return;
 	const harnessName = binding.value.harness === "codex" ? "codex" : "claude-code";
@@ -32304,6 +33995,203 @@ const sessionStart = Command.make(harnessCommandNames.sessionStart, { protocol:
 /** The commands a harness runs: `ref0 mcp`, and its command hooks. */
 const harnessCommands = [mcp, Command.make(harnessCommandNames.hook).pipe(Command.withDescription("The harness's hooks that run as commands"), Command.withShortDescription("Run the harness’s session hooks"), Command.withSubcommands([sessionStart, sessionEnd]))];
 //#endregion
+//#region src/harness/command-token.ts
+/**
+* The session an agent's command acts as: its harness session's, by the token kept under its
+* binding. Outside a harness there's none, and a command is its person's, asked by approval; so
+* too in a harness whose config folder has no agent connected. Where one is connected, a harness
+* session with no token has lost its start, and the command says why, as far as ref0 can tell,
+* and what to do, rather than run as its person.
+*/
+/**
+* Whether ref0's server, `ref0 mcp`, runs right under a harness process, as the harness starts
+* it: none when the process table can't be read.
+*/
+var HarnessServers = class HarnessServers extends Context.Service()("ref0/cli/HarnessServers") {
+	static layer = Layer.effect(HarnessServers, Effect.gen(function* () {
+		const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+		const runsUnder = (process) => spawner.string(ChildProcess.make("ps", [
+			"-A",
+			"-o",
+			"ppid=,args="
+		])).pipe(Effect.map((table) => table.trim() === "" ? Option.none() : Option.some(table.split("\n").some((line) => {
+			const [parent = "", ...words] = line.trim().split(/\s+/);
+			return Number(parent) === process && words.at(-1) === harnessCommandNames.mcp && words.some((word) => word.includes("ref0"));
+		}))), Effect.orElseSucceed(() => Option.none()));
+		return HarnessServers.of({ runsUnder });
+	}));
+};
+/**
+* What an agent's command in a harness session with no ref0 session says to do: run again, while
+* the prompt's start is on its way; reconnect or restart, when the server isn't running; else
+* send the prompt again, which starts one.
+*/
+const noSessionStep = (harness, server, seen) => {
+	const name = configFolders[harness].name;
+	const restart = harness === "codex" ? "restart Codex" : `run /mcp, choose ${server} and Reconnect, or restart Claude Code`;
+	if (Option.contains(seen.serverRuns, false)) return `This ${name} session has no ref0 session: ref0’s server isn’t running in it, so none started at the last prompt. Tell your person to ${restart}, then send the prompt again.`;
+	if (seen.pending) return `This ${name} session has no ref0 session yet: its start at the last prompt hasn’t landed. Run this again in a few seconds. If it says this again, tell your person to send the prompt again.`;
+	return `This ${name} session has no ref0 session: none started at the last prompt. Tell your person to send the prompt again. If it says this again, tell them to ${restart}.`;
+};
+/** `SessionToken` from the keychain, by the binding of the harness session this runs in. */
+const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
+	const keychain = yield* Keychain;
+	const harness = yield* HarnessProcess;
+	const servers = yield* HarnessServers;
+	const hostGrant = yield* HostGrant;
+	const folders = yield* ConfigFolders;
+	const config = yield* Ref0Config;
+	const plugin = yield* originPluginName(config.api);
+	const current = Effect.gen(function* () {
+		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
+		if (Option.isNone(binding)) return Option.none();
+		const kept = yield* keychain.get(sessionAccount(binding.value));
+		if (Option.isSome(kept)) return kept;
+		const name = binding.value.harness === "codex" ? "codex" : "claude-code";
+		const grant = yield* hostGrant.get(yield* folders.folder(name)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
+		if (Option.isNone(grant) || grant.value.harness !== name) return Option.none();
+		const pending = yield* keychain.get(pendingAccount(binding.value));
+		const serverRuns = yield* servers.runsUnder(binding.value.process);
+		return yield* new NoSession({ nextStep: noSessionStep(name, `plugin:${plugin}:${plugin}`, {
+			serverRuns,
+			pending: Option.isSome(pending)
+		}) });
+	});
+	return SessionToken.of({ current });
+}));
+//#endregion
+//#region src/harness/server-check.ts
+/**
+* Whether a config folder's ref0 server starts, asked as its harness asks: the command its
+* installed plugin's `.mcp.json` names, started from an empty folder of ref0's own with the
+* environment that harness would give it from this terminal's, and sent `initialize`. Told by
+* `serverCheckVariable` which harness it's started as, the server reads that folder's grant from
+* the keychain as it does at a session's start, and starts no session. Its whole process group is
+* stopped once it answers, stops, or the limit passes, so nothing it started outlasts the check.
+*/
+/**
+* The variables Codex 0.164.0 passes a stdio server of its own, beside those its entry's
+* `env_vars` names that are set. Nothing else reaches the server (measured on Linux, 24 Oct 2026).
+*/
+const codexPasses = [
+	"HOME",
+	"LOGNAME",
+	"PATH",
+	"SHELL",
+	"USER",
+	"LANG",
+	"LC_ALL",
+	"TERM",
+	"TMPDIR",
+	"TZ",
+	"__CF_USER_TEXT_ENCODING",
+	"SSL_CERT_FILE",
+	"NODE_EXTRA_CA_CERTS"
+];
+/**
+* How long a server has to answer `initialize`: ten times its slowest start measured on Linux,
+* 0.5 s (24 Oct 2026), so status stays quick. A harness may wait longer (Codex 0.164.0 waited 14 s
+* for a slow one), so a server that doesn't answer in it is unknown, not one that can't start.
+*/
+const serverLimit = Duration.seconds(5);
+const checkId = "ref0-status";
+/**
+* `initialize` and its answer, as JSON-RPC carries them, in MCP's own schemas: those `ref0 mcp`
+* serves through Effect's MCP server.
+*/
+const InitializeRequest = Schema.Struct({
+	jsonrpc: Schema.Literal("2.0"),
+	id: Schema.Literal(checkId),
+	method: Schema.Literal(McpSchema.Initialize._tag),
+	params: McpSchema.Initialize.payloadSchema
+});
+const InitializeAnswer = Schema.Struct({
+	id: Schema.Literal(checkId),
+	result: McpSchema.InitializeResult
+});
+/** `initialize`, at a version every ref0 server speaks, as a harness's first line. */
+const initialize = `${Schema.encodeSync(Schema.fromJsonString(InitializeRequest))({
+	jsonrpc: "2.0",
+	id: checkId,
+	method: McpSchema.Initialize._tag,
+	params: {
+		protocolVersion: "2025-06-18",
+		capabilities: new McpSchema.ClientCapabilities({}),
+		clientInfo: {
+			name: "ref0 status",
+			version: cliVersion
+		}
+	}
+})}\n`;
+const decodeServers = Schema.decodeUnknownEffect(Schema.fromJsonString(McpServersFile));
+const decodeAnswer = Schema.decodeUnknownOption(Schema.fromJsonString(InitializeAnswer));
+/**
+* `names` as this terminal sets them, which a harness started here would pass on. A relative
+* `PATH` folder is read from here, as `onPath` reads it, since the server starts elsewhere.
+*/
+const fromHere = Effect.fnUntraced(function* (names) {
+	const paths = yield* Path.Path;
+	const set = [];
+	for (const name of new Set(names)) {
+		const value = yield* Config.String(name).pipe(Config.option);
+		if (Option.isNone(value)) continue;
+		set.push([name, name === "PATH" ? value.value.split(":").map((folder) => folder === "" || paths.isAbsolute(folder) ? folder : `${process.cwd()}/${folder}`).join(":") : value.value]);
+	}
+	return Object.fromEntries(set);
+});
+/** The first line a stopped server said, made printable. */
+const firstLine = (said) => printable(said.split("\n").map((line) => line.trim()).find((line) => line !== "") ?? "");
+/**
+* Starts the server named `name` in the plugin installed at `plugin`, as `harness` would for
+* `configFolder`, and answers how its start went.
+*/
+const startServer = Effect.fnUntraced(function* (harness, configFolder, plugin, name) {
+	const fs = yield* FileSystem.FileSystem;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const server = yield* fs.readFileString(`${plugin}/.mcp.json`).pipe(Effect.flatMap(decodeServers), Effect.map((file) => Option.fromNullishOr(file.mcpServers[name])), Effect.orElseSucceed(Option.none));
+	if (Option.isNone(server)) return { kind: "unnamed" };
+	const asked = server.value.env_vars ?? [];
+	const checked = {
+		REF0_API: (yield* Ref0Config).api,
+		[serverCheckVariable]: harness
+	};
+	const env = harness === "codex" ? {
+		...yield* fromHere([...codexPasses, ...asked]),
+		CODEX_HOME: configFolder,
+		...checked
+	} : {
+		...yield* fromHere([
+			...codexPasses,
+			...keychainVariables,
+			...asked
+		]),
+		CLAUDE_CONFIG_DIR: configFolder,
+		...checked
+	};
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawner.spawn(ChildProcess.make(server.value.command, server.value.args, {
+			cwd: yield* emptyFolder(fs),
+			env,
+			extendEnv: harness === "claude-code",
+			forceKillAfter: "1 second",
+			stdin: {
+				stream: Stream.make(initialize).pipe(Stream.encodeText),
+				endOnDone: false
+			}
+		}));
+		const said = yield* handle.stderr.pipe(Stream.decodeText(), Stream.mkString, Effect.forkScoped);
+		const lines = yield* handle.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.takeUntil((line) => Option.isSome(decodeAnswer(line))), Stream.runCollect);
+		if (lines.some((line) => Option.isSome(decodeAnswer(line)))) return { kind: "answered" };
+		return {
+			kind: "stopped",
+			said: firstLine(yield* Fiber.join(said)) || firstLine(lines.join("\n"))
+		};
+	})).pipe(Effect.catchTag("PlatformError", (error) => Effect.succeed({
+		kind: "stopped",
+		said: firstLine(error.message)
+	})), Effect.timeoutOption(serverLimit), Effect.map(Option.getOrElse(() => ({ kind: "unanswered" }))));
+});
+//#endregion
 //#region src/harness/status.ts
 /** Each connected or initialized folder has its own report; secrets are used only to ask ref0. */
 const encodeReports = Schema.encodeEffect(Schema.Array(StatusReport));
@@ -32359,6 +34247,15 @@ const speaksCheck = (protocols, version, reinstall) => {
 	if (Option.isSome(mismatch)) return checkOf("plugin", "no", mismatch.value.says, mismatch.value.run);
 	return checkOf("plugin", "yes", "installed and speaks this ref0");
 };
+/** A server's start, as its line says it, with this folder's reinstall for one that can't start. */
+const serverCheckOf = (started, configFolder) => {
+	switch (started.kind) {
+		case "answered": return checkOf("server", "yes", "starts");
+		case "stopped": return checkOf("server", "no", started.said === "" ? "can’t start, and said nothing" : `can’t start: ${started.said}`, installLine(configFolder));
+		case "unnamed": return checkOf("server", "no", "the plugin names no ref0 server", installLine(configFolder));
+		case "unanswered": return checkOf("server", "unknown", `didn’t answer in ${Duration.toSeconds(serverLimit)} s`, "ref0 status");
+	}
+};
 const decodePlugins = Schema.decodeUnknownEffect(Schema.fromJsonString(ClaudePluginsListed));
 const decodeHooks = Schema.decodeUnknownEffect(Schema.fromJsonString(HooksFile));
 /** Ask Claude Code about this folder, even when another folder is current in the terminal. */
@@ -32367,30 +34264,32 @@ const claudeCodeChecks = Effect.fnUntraced(function* (configFolder) {
 	const claude = yield* onPath("claude");
 	if (Option.isNone(claude)) return [checkOf("plugin", "unknown", "Claude Code isn’t on PATH", reinstall)];
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
-	const listed = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).string(ChildProcess.make(claude.value, [
+	const fs = yield* FileSystem.FileSystem;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const listed = yield* Effect.scoped(Effect.flatMap(emptyFolder(fs), (cwd) => spawner.string(ChildProcess.make(claude.value, [
 		"plugin",
 		"list",
 		"--json"
 	], {
+		cwd,
 		env: {
 			HOME: home,
 			CLAUDE_CONFIG_DIR: configFolder
 		},
 		extendEnv: true
-	})).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
+	})))).pipe(Effect.flatMap(decodePlugins), Effect.timeout("15 seconds"), Effect.option);
 	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Claude Code didn’t list its plugins", reinstall)];
 	const name = yield* originPluginName((yield* Ref0Config).api);
 	const id = `${name}@${name}`;
 	const plugin = listed.value.find((each) => each.id === id);
 	if (plugin === void 0) return [checkOf("plugin", "no", "not installed in this folder", reinstall)];
 	if (!plugin.enabled) return [checkOf("plugin", "no", "turned off in this folder", `CLAUDE_CONFIG_DIR=${shellWord(configFolder)} claude plugin enable ${id}`)];
-	const fs = yield* FileSystem.FileSystem;
 	const folder = plugin.readFromFolder ?? plugin.installPath;
 	const hooks = folder === void 0 ? Option.none() : yield* fs.readFileString(`${folder}/hooks/hooks.json`).pipe(Effect.flatMap(decodeHooks), Effect.option);
 	return [speaksCheck(Option.match(hooks, {
 		onNone: () => [],
 		onSome: protocolsOf
-	}), Option.fromUndefinedOr(plugin.version), reinstall)];
+	}), Option.fromUndefinedOr(plugin.version), reinstall), folder === void 0 ? checkOf("server", "unknown", "Claude Code didn’t say where ref0’s plugin is", reinstall) : serverCheckOf(yield* startServer("claude-code", configFolder, folder, name), configFolder)];
 });
 /** Trust only ref0's hooks; removal of an unexpected plugin targets this folder too. */
 const trustCheck = (hooks, configFolder, name) => {
@@ -32404,14 +34303,19 @@ const codexChecks = Effect.fnUntraced(function* (configFolder) {
 	const reinstall = installLine(configFolder);
 	const codex = yield* onPath("codex");
 	if (Option.isNone(codex)) return [checkOf("plugin", "unknown", "Codex isn’t on PATH", reinstall)];
-	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
-	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [home] }, configFolder).pipe(Effect.option);
+	const listed = yield* askCodex(codex.value, codexMethods.hooksList, { cwds: [] }, { CODEX_HOME: configFolder }).pipe(Effect.option);
 	if (Option.isNone(listed)) return [checkOf("plugin", "unknown", "Codex didn’t list its hooks", reinstall)];
 	const name = yield* originPluginName((yield* Ref0Config).api);
 	const hooks = listed.value.data.flatMap((entry) => entry.hooks).filter((hook) => pluginHook(hook, `${name}@${name}`));
 	if (hooks.length === 0) return [checkOf("plugin", "no", "not installed or turned off in this folder", reinstall)];
 	const protocols = hooks.map((hook) => protocolFlagged(hook.command ?? "")).filter(Predicate.isString);
-	return [speaksCheck(protocols, Option.none(), reinstall), trustCheck(hooks, configFolder, name)];
+	const path = yield* Path.Path;
+	const source = hooks.find((hook) => Predicate.isString(hook.sourcePath))?.sourcePath;
+	return [
+		speaksCheck(protocols, Option.none(), reinstall),
+		trustCheck(hooks, configFolder, name),
+		Predicate.isString(source) ? serverCheckOf(yield* startServer("codex", configFolder, path.dirname(path.dirname(source)), name), configFolder) : checkOf("server", "unknown", "Codex didn’t say where ref0’s plugin is", reinstall)
+	];
 });
 /** A session belongs only to the current folder, even when several folders share its agent. */
 const sessionCheck = Effect.fnUntraced(function* (harness, configFolder) {
@@ -32440,8 +34344,7 @@ const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ js
 	}
 	for (const { configFolder, harness } of found) candidates.set(configFolder, harness);
 	const paths = [...candidates.keys()].sort((a, b) => a === current ? -1 : b === current ? 1 : 0);
-	const reports = [];
-	for (const configFolder of paths) {
+	const reportOf = Effect.fnUntraced(function* (configFolder) {
 		const kept = yield* Effect.result(grants.get(configFolder));
 		const unreadable = Result.isFailure(kept) && kept.failure.unreadable === true;
 		const grant = Result.isSuccess(kept) ? kept.success : Option.none();
@@ -32451,15 +34354,19 @@ const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ js
 				configFolder,
 				checks: [Result.isFailure(kept) && !unreadable ? checkOf("connected", "unknown", "The keychain didn’t say whether this config folder holds a host grant.", kept.failure.nextStep) : checkOf("connected", "no", unreadable ? "its host grant can’t be read" : "not connected", harness === void 0 ? "ref0 connect" : yield* connectLineFor(harness, configFolder))]
 			};
-			reports.push(harness === void 0 ? report : {
+			return harness === void 0 ? report : {
 				...report,
 				harness
-			});
-			continue;
+			};
+		}
+		const [granted, installed] = yield* Effect.all([grantChecks(grant.value, configFolder), grant.value.harness === "codex" ? codexChecks(configFolder) : claudeCodeChecks(configFolder)], { concurrency: "unbounded" });
+		const checks = [...granted, ...installed];
+		if (configFolder === current) {
+			const session = yield* sessionCheck(grant.value.harness, configFolder);
+			const server = checks.find((check) => check.check === "server");
+			checks.push(server !== void 0 && server.answer !== "yes" && session.answer === "no" ? checkOf("session", "no", `none, since ref0’s server ${server.answer === "no" ? "can’t start" : "didn’t answer"}`, server.next) : session);
 		}
-		const checks = [...yield* grantChecks(grant.value, configFolder), ...yield* grant.value.harness === "codex" ? codexChecks(configFolder) : claudeCodeChecks(configFolder)];
-		if (configFolder === current) checks.push(yield* sessionCheck(grant.value.harness, configFolder));
-		reports.push({
+		return {
 			harness: grant.value.harness,
 			configFolder,
 			agent: {
@@ -32467,8 +34374,9 @@ const statusCommands = [Command.make(harnessCommandNames.status, { json }, ({ js
 				agent: grant.value.agent
 			},
 			checks
-		});
-	}
+		};
+	});
+	const reports = yield* Effect.forEach(paths, reportOf, { concurrency: "unbounded" });
 	const home = yield* Config.String("HOME").pipe(Config.withDefault("."));
 	yield* printAnswer(yield* Effect.orDie(encodeReports(reports)), asJson, reports.length === 0 ? [["No initialized harness folders found.", { command: "ref0 connect" }]] : reports.map((report) => wordsOf(report, home)));
 	if (reports.some((report) => report.checks.some((check) => check.answer === "no"))) return yield* new Said();
@@ -32513,7 +34421,12 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 ]));
 const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
-const sessionToken = harnessSessionToken.pipe(Layer.provide([keychain, harnessProcess]));
+const sessionToken = harnessSessionToken.pipe(Layer.provide([
+	keychain,
+	harnessProcess,
+	HarnessServers.layer.pipe(Layer.provide(NodeServices.layer)),
+	HostGrant.layer.pipe(Layer.provide(keychain))
+]));
 /** Every service `ref0`'s commands use, on this machine. */
 const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,