@sjawhar/pi-legion-envoy 1.67.0 → 1.68.1

package/dist/envoy.js

@@ -30502,12 +30502,6 @@ var phaseHandoffSchema = exports_external.discriminatedUnion("phase", [
   testSchema,
   reviewSchema
 ]);
-var handoffMessageSchema = exports_external.object({
-  from: handoffPhase,
-  to: handoffPhase,
-  body: exports_external.string(),
-  timestamp: isoTimestamp
-});
 // ../contracts/src/subject.ts
 var AGENT_TOPIC_PREFIX = "notifications.agent.";
 var ROLE_TOPIC_PREFIX = "notifications.role.";

package/dist/legion.js

@@ -16142,7 +16142,7 @@ import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "1.67.0",
+  version: "1.68.1",
   type: "module",
   omp: {
     extensions: [
@@ -16155,7 +16155,7 @@ var package_default = {
   },
   legion: {
     daemonApiVersion: 8,
-    goDaemonApiVersion: 3
+    goDaemonApiVersion: 4
   },
   repository: {
     type: "git",
@@ -30574,12 +30574,6 @@ var phaseHandoffSchema = exports_external.discriminatedUnion("phase", [
   testSchema,
   reviewSchema
 ]);
-var handoffMessageSchema = exports_external.object({
-  from: handoffPhase,
-  to: handoffPhase,
-  body: exports_external.string(),
-  timestamp: isoTimestamp
-});
 // ../contracts/src/subject.ts
 var AGENT_TOPIC_PREFIX = "notifications.agent.";
 var ROLE_TOPIC_PREFIX = "notifications.role.";
@@ -31238,42 +31232,47 @@ function onEnvoyRoleRegained(listener) {
 }
 
 // src/legion/controller-session.ts
-function createControllerSession(persistedTranscript, checkSubagentSession, rerunReadyAfterRegain, pluginVersion) {
+function typescriptControllerDaemon(rerunReadyAfterRegain, pluginVersion) {
+  let daemon;
+  const client = () => {
+    daemon ??= createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"));
+    return daemon;
+  };
+  return {
+    claim: async ({ sessionID, capability, ompSessionFile, context }) => {
+      const daemon2 = client();
+      const { project } = await daemon2.state();
+      const token = controllerToken(project);
+      await claimEnvoyRole(sessionID, token, "setInterval" in context ? context : undefined);
+      const ready = {
+        secret: capability,
+        sessionId: sessionID,
+        ...ompSessionFile === undefined ? {} : { ompSessionFile },
+        pluginVersion
+      };
+      await daemon2.controllerReady(ready);
+      onEnvoyRoleRegained(async (role, reason) => {
+        if (role !== token)
+          return;
+        await rerunReadyAfterRegain("controller/ready", role, reason, () => daemon2.controllerReady(ready));
+      });
+      return () => daemon2.grant({ sessionId: sessionID, secret: capability });
+    }
+  };
+}
+function createControllerSession(persistedTranscript, checkSubagentSession, daemon) {
   let controllerSessionID;
   let controllerCapability;
-  let controllerDaemon;
-  const controllerDaemonClient = () => {
-    controllerDaemon ??= createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"));
-    return controllerDaemon;
-  };
+  let mintControllerGrant;
   let controllerTranscript;
   const claim = async (context) => {
     const sessionID = context.sessionManager.getSessionId();
-    const daemon = controllerDaemonClient();
-    const secret = controllerCapability ?? requiredControllerCapability(process.env);
-    controllerCapability = secret;
-    const { project } = await daemon.state();
-    const token = controllerToken(project);
-    await claimEnvoyRole(sessionID, token, "setInterval" in context ? context : undefined);
+    const capability = controllerCapability ?? requiredControllerCapability(process.env);
+    controllerCapability = capability;
     const ompSessionFile = classifySession(process.env).kind === "controller" ? (await persistedTranscript(context)).sessionFile : undefined;
-    await daemon.controllerReady({
-      secret,
-      sessionId: sessionID,
-      ...ompSessionFile === undefined ? {} : { ompSessionFile },
-      pluginVersion
-    });
+    mintControllerGrant = await daemon().claim({ sessionID, capability, ompSessionFile, context });
     controllerSessionID = sessionID;
     controllerTranscript = ompSessionFile;
-    onEnvoyRoleRegained(async (role, reason) => {
-      if (role !== token)
-        return;
-      await rerunReadyAfterRegain("controller/ready", role, reason, () => daemon.controllerReady({
-        secret,
-        sessionId: sessionID,
-        ...controllerTranscript === undefined ? {} : { ompSessionFile: controllerTranscript },
-        pluginVersion
-      }));
-    });
   };
   const handleSessionStart = async (context) => {
     if (classifySession(process.env).kind !== "controller")
@@ -31297,13 +31296,12 @@ function createControllerSession(persistedTranscript, checkSubagentSession, reru
       context.ui.notify(`legion: re-claiming the controller for this session failed (${messageFor(error48)}). Until a re-claim succeeds, controller wakes and merges will not reach this session and its shell commands run without a Legion grant, so legion gh is unavailable.`, "warning");
     }
   };
-  const isClaimedSession = (sessionID) => controllerSessionID === sessionID && controllerCapability !== undefined;
+  const isClaimedSession = (sessionID) => controllerSessionID === sessionID && mintControllerGrant !== undefined;
   const mintGrant = async (sessionID) => {
-    if (controllerSessionID !== sessionID || controllerCapability === undefined) {
+    if (controllerSessionID !== sessionID || mintControllerGrant === undefined) {
       throw new Error("Controller session is not registered; cannot mint its grant");
     }
-    const secret = controllerCapability;
-    return controllerDaemonClient().grant({ sessionId: sessionID, secret });
+    return mintControllerGrant();
   };
   return { claim, handleSessionStart, reclaimAfterSessionChange, isClaimedSession, mintGrant };
 }
@@ -31436,11 +31434,18 @@ var legionGoAdmission = exports_external.strictObject({
   active: exports_external.array(nonEmptyString2),
   waiting: exports_external.array(nonEmptyString2)
 });
+var legionGoControllerLocator = exports_external.strictObject({
+  runtime: exports_external.enum(["tmux", "kubernetes"]),
+  external: exports_external.literal(true),
+  sessionId: nonEmptyString2,
+  registeredAt: timestamp
+});
 var LegionGoStateResponse = exports_external.strictObject({
   daemon: goDaemonInfo,
   admission: legionGoAdmission,
   issues: exports_external.record(exports_external.string(), legionGoIssue),
-  pendingStatusWrites: exports_external.array(legionGoPendingStatusWrite)
+  pendingStatusWrites: exports_external.array(legionGoPendingStatusWrite),
+  controllerLocator: legionGoControllerLocator.optional()
 });
 var LegionGoRegisterResponse = exports_external.strictObject({
   claimToken: nonEmptyString2,
@@ -31450,6 +31455,15 @@ var LegionGoRegisterResponse = exports_external.strictObject({
   generation: exports_external.number().int().positive(),
   secret: nonEmptyString2
 });
+var LegionGoControllerRegisterResponse = exports_external.strictObject({
+  claimToken: nonEmptyString2,
+  role: exports_external.literal("controller"),
+  generation: exports_external.number().int().positive(),
+  secret: nonEmptyString2
+});
+var LegionGoControllerSecretResponse = exports_external.strictObject({
+  secret: nonEmptyString2
+});
 var LegionGoErrorResponse = exports_external.union([
   exports_external.strictObject({ error: nonEmptyString2 }),
   exports_external.strictObject({ code: nonEmptyString2, error: nonEmptyString2 })
@@ -31504,6 +31518,10 @@ var LegionGoGrantRequest = exports_external.strictObject({
   tree: nonEmptyString2,
   issue: nonEmptyString2
 });
+var LegionGoControllerGrantRequest = exports_external.strictObject({
+  sessionId: nonEmptyString2,
+  secret: nonEmptyString2
+});
 var LegionGoGrantCredentialRequest = exports_external.strictObject({
   grantId: nonEmptyString2
 });
@@ -31624,9 +31642,11 @@ function createLegionGoDaemonClient(baseUrl, fetchFn = fetch) {
   return {
     state: () => read("GET", "/legion/v1/state", LegionGoStateResponse),
     register: (input) => read("POST", "/legion/v1/claims/register", LegionGoRegisterResponse, input),
+    registerController: (input) => read("POST", "/legion/v1/claims/register", LegionGoControllerRegisterResponse, input),
     ready: (input) => acknowledge("/legion/v1/claims/ready", input),
     exit: (input) => acknowledge("/legion/v1/claims/exit", input),
     grant: (input) => post("/legion/v1/grants", LegionGoGrantRequest, LegionGoGrantResponse, input),
+    controllerGrant: (input) => post("/legion/v1/grants", LegionGoControllerGrantRequest, LegionGoGrantResponse, input),
     githubToken: (input) => post("/legion/v1/gh-token", LegionGoGrantCredentialRequest, LegionGoGitHubTokenResponse, input),
     gitCredential: (input) => post("/legion/v1/git-credential", LegionGoGrantCredentialRequest, LegionGoGitCredentialResponse, input),
     provisioningCredential: (input) => post("/legion/v1/provisioning-credential", LegionGoGrantCredentialRequest, LegionGoGitHubTokenResponse, input),
@@ -31726,13 +31746,31 @@ async function callGoReadyWithRetry(label, call) {
     }
   }
 }
+function goControllerDaemon(daemon, transcript) {
+  return {
+    claim: async ({ sessionID, capability, context }) => {
+      const { sessionFile, agentId } = await transcript(context);
+      const client = daemon();
+      const registration = await client.registerController({
+        bootToken: capability,
+        sessionId: sessionID,
+        ompSessionFile: sessionFile,
+        agentId,
+        pluginContract: package_default.legion.goDaemonApiVersion
+      }).catch((error48) => {
+        if (error48 instanceof LegionGoDaemonApiError) {
+          console.error(`[legion] claims/register for the controller failed (${error48.status}): ${error48.detail}`);
+        }
+        throw error48;
+      });
+      await claimEnvoyRole(sessionID, registration.claimToken, "setInterval" in context ? context : undefined);
+      return () => client.controllerGrant({ sessionId: sessionID, secret: registration.secret });
+    }
+  };
+}
 async function bootstrapGoClaim(context, state) {
-  const classification = classifySession(process.env);
-  if (classification.kind === "not-legion")
+  if (classifySession(process.env).kind === "not-legion")
     return;
-  if (classification.kind === "controller") {
-    throw new Error("LEGION_DAEMON_API=go names the Go daemon, which launches no controller session");
-  }
   const sessionID = context.sessionManager.getSessionId();
   const capability = state.capability();
   if (capability !== undefined && capability.sessionID !== sessionID)
@@ -31811,7 +31849,6 @@ import { execFile as execFile2 } from "child_process";
 var HANDOFF_OPERATION_FIELDS = {
   handoff_write: ["phase", "data"],
   handoff_read: ["phase"],
-  handoff_message: ["sender", "recipient", "body"],
   handoff_complete: ["summary", "verdict", "ready", "phase"]
 };
 var HANDOFF_OPERATIONS = Object.keys(HANDOFF_OPERATION_FIELDS);
@@ -31822,15 +31859,12 @@ function handoffSchemaFields(z2) {
   return {
     phase: z2.enum(HANDOFF_PHASES).optional(),
     data: z2.unknown().optional(),
-    sender: z2.enum(HANDOFF_PHASES).optional(),
-    recipient: z2.enum(HANDOFF_PHASES).optional(),
-    body: z2.string().optional(),
     summary: z2.string().optional(),
     verdict: z2.enum(["pass", "fail"]).optional(),
     ready: z2.boolean().optional()
   };
 }
-var HANDOFF_DESCRIPTION = "Handoff actions (phase workers and sub-architects): handoff_write writes this phase's handoff " + "(`phase`, and `data`: the phase-specific fields as a JSON object) to `.legion/<phase>.json` in " + "the issue workspace; handoff_read returns the handoffs (every phase, or `phase`); " + "handoff_message leaves a message for another phase (`sender`, `recipient`, `body`); " + "handoff_complete reports this phase complete to the daemon (`summary`: two sentences for the " + "architect; `verdict` pass|fail when your role's instructions require one; `ready: true` for " + "the merger's READY; no `phase` is needed, and one other than your own is refused). Each " + "returns the command's output; a failed action changed nothing.";
+var HANDOFF_DESCRIPTION = "Handoff actions (phase workers and sub-architects): handoff_write writes this phase's handoff " + "(`phase`, and `data`: the phase-specific fields as a JSON object) to `.legion/<phase>.json` in " + "the issue workspace; handoff_read returns the handoffs (every phase, or `phase`); " + "handoff_complete reports this phase complete to the daemon (`summary`: two sentences for the " + "architect; `verdict` pass|fail when your role's instructions require one; `ready: true` for " + "the merger's READY; no `phase` is needed, and one other than your own is refused). Each " + "returns the command's output; a failed action changed nothing. What a later phase needs goes " + "in your handoff; a question for another live role goes to its role topic with envoy_publish.";
 var ROLE_HANDOFF_PHASE = {
   architect: "architect",
   planner: "plan",
@@ -31864,21 +31898,12 @@ function commandArguments(operation, parameters) {
         throw new Error("handoff_write requires data: the phase's handoff fields as a JSON object");
       }
       const phase = required2(parameters, operation, "phase");
-      return ["handoff", "write", "--phase", phase, "--data", JSON.stringify(data)];
+      return { args: ["handoff", "write", "--phase", phase], stdin: JSON.stringify(data) };
     }
     case "handoff_read":
-      return parameters.phase === undefined ? ["handoff", "read"] : ["handoff", "read", "--phase", required2(parameters, operation, "phase")];
-    case "handoff_message":
-      return [
-        "handoff",
-        "message",
-        "--from",
-        required2(parameters, operation, "sender"),
-        "--to",
-        required2(parameters, operation, "recipient"),
-        "--body",
-        required2(parameters, operation, "body")
-      ];
+      return {
+        args: parameters.phase === undefined ? ["handoff", "read"] : ["handoff", "read", "--phase", required2(parameters, operation, "phase")]
+      };
     case "handoff_complete": {
       const command = [
         "handoff",
@@ -31908,13 +31933,13 @@ function commandArguments(operation, parameters) {
       }
       if (ready === true)
         command.push("--ready");
-      return command;
+      return { args: command };
     }
   }
 }
-function runLegion(args, cwd, signal) {
+function runLegion(args, stdin, cwd, signal) {
   const { promise: promise2, resolve, reject } = Promise.withResolvers();
-  execFile2("legion", args, { cwd, env: process.env, signal, timeout: COMMAND_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (error48, stdout, stderr) => {
+  const child = execFile2("legion", args, { cwd, env: process.env, signal, timeout: COMMAND_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (error48, stdout, stderr) => {
     const output = [stdout, stderr].map((text) => text.trimEnd()).filter((text) => text !== "").join(`
 `);
     if (error48 === null) {
@@ -31925,13 +31950,18 @@ function runLegion(args, cwd, signal) {
       reject(new Error(`legion ${args.slice(0, 2).join(" ")} did not run: ${messageFor(error48)}`));
     }
   });
+  child.stdin?.on("error", (error48) => {
+    if (error48.code !== "EPIPE")
+      reject(error48);
+  });
+  child.stdin?.end(stdin ?? "");
   return promise2;
 }
 async function runHandoffAction(input) {
-  const args = commandArguments(input.operation, input.parameters);
+  const { args, stdin } = commandArguments(input.operation, input.parameters);
   if (input.operation === "handoff_complete")
     await writeMintedGrant(input.mintGrant);
-  const { exitCode, output } = await runLegion(args, requiredEnvironment(process.env, "LEGION_WORKSPACE"), input.signal);
+  const { exitCode, output } = await runLegion(args, stdin, requiredEnvironment(process.env, "LEGION_WORKSPACE"), input.signal);
   const text = output === "" ? `legion ${args.slice(0, 2).join(" ")} exited ${exitCode}` : output;
   const details = { operation: input.operation, exitCode };
   if (exitCode !== 0)
@@ -32467,7 +32497,7 @@ function jjLogRewriteMention(text) {
   if (!JJ_MENTION.test(text))
     return;
   const match = JJ_LOG_REWRITE_MENTION.exec(text);
-  return match === null ? undefined : match[0].replace(/\W+/g, " ");
+  return match === null ? undefined : `jj ${match[0].replace(/\W+/g, " ")}`;
 }
 function splitShellCommands(command) {
   const commands = [];
@@ -32530,29 +32560,60 @@ function splitShellCommands(command) {
   endCommand();
   return commands;
 }
-function jjLogRewriteInvocation(command) {
-  const commands = splitShellCommands(command);
+function jjLogRewriteInvocation(words) {
+  const jj = words.findIndex((word) => word === "jj" || word.endsWith("/jj"));
+  if (jj === -1)
+    return;
+  const args = words.slice(jj + 1);
+  const rewritesLog = args.some((arg) => JJ_LOG_REWRITE_WORDS.includes(arg)) || args.some((arg) => JJ_OP_WORDS.includes(arg)) && args.some((arg) => JJ_OP_LOG_REWRITE_WORDS.includes(arg));
+  return rewritesLog ? words.slice(jj).join(" ") : undefined;
+}
+var JJ_LOG_REWRITE = {
+  mention: jjLogRewriteMention,
+  invocation: jjLogRewriteInvocation,
+  refusal: (attempt) => `refused \`${attempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
+};
+var LEGION_HANDOFF_COMPLETE_MENTION = /\blegion[\s"'`,[\]]+handoff[\s"'`,[\]]+complete\b/;
+var LEGION_HANDOFF_COMPLETE = {
+  mention: (text) => LEGION_HANDOFF_COMPLETE_MENTION.test(text) ? "legion handoff complete" : undefined,
+  invocation: (words) => {
+    const legion = words.findIndex((word, index) => (word === "legion" || word.endsWith("/legion")) && words[index + 1] === "handoff" && words[index + 2] === "complete");
+    return legion === -1 ? undefined : words.slice(legion).join(" ");
+  },
+  refusal: (attempt) => `refused \`${attempt}\`: a phase is completed with the \`legion\` tool's ` + "`handoff_complete`, never a shell command: the tool call is what records the phase " + "complete. A root architect or a `task` subagent has no handoff actions: it leaves the " + "completion to the worker. Text that only names the command (a commit message, a PR body) " + "reads as the command: pass it in a file."
+};
+var PANE_RULES = {
+  "phase-worker": [JJ_LOG_REWRITE, LEGION_HANDOFF_COMPLETE],
+  "root-architect": [LEGION_HANDOFF_COMPLETE]
+};
+function refusedCommand(command, commands, rule) {
   if (commands === undefined) {
-    return jjLogRewriteMention(command) === undefined ? undefined : command.trim();
+    return rule.mention(command) === undefined ? undefined : command.trim();
   }
   for (const words of commands) {
-    const mentioned = words.find((word) => jjLogRewriteMention(word) !== undefined);
+    const mentioned = words.find((word) => rule.mention(word) !== undefined);
     if (mentioned !== undefined)
       return mentioned;
-    const jj = words.findIndex((word) => word === "jj" || word.endsWith("/jj"));
-    if (jj === -1)
-      continue;
-    const args = words.slice(jj + 1);
-    const rewritesLog = args.some((arg) => JJ_LOG_REWRITE_WORDS.includes(arg)) || args.some((arg) => JJ_OP_WORDS.includes(arg)) && args.some((arg) => JJ_OP_LOG_REWRITE_WORDS.includes(arg));
-    if (rewritesLog)
-      return words.slice(jj).join(" ");
+    const invocation = rule.invocation(words);
+    if (invocation !== undefined)
+      return invocation;
   }
   return;
 }
-function jjLogRewriteAttempt(toolCall) {
+function paneRuleRefusal(toolCall, rules) {
+  if (rules.length === 0)
+    return;
   const { toolName, input } = toolCall;
   if (toolName === "bash") {
-    return typeof input.command === "string" ? jjLogRewriteInvocation(input.command) : undefined;
+    if (typeof input.command !== "string")
+      return;
+    const commands = splitShellCommands(input.command);
+    for (const rule of rules) {
+      const attempt = refusedCommand(input.command, commands, rule);
+      if (attempt !== undefined)
+        return rule.refusal(attempt);
+    }
+    return;
   }
   let text;
   if (toolName === "eval" && typeof input.code === "string")
@@ -32561,8 +32622,12 @@ function jjLogRewriteAttempt(toolCall) {
     text = [input.application, ...Array.isArray(input.args) ? input.args : [], input.text].filter((part) => typeof part === "string").join(" ");
   } else
     return;
-  const mention = jjLogRewriteMention(text);
-  return mention === undefined ? undefined : `${toolName}: jj ${mention}`;
+  for (const rule of rules) {
+    const mention = rule.mention(text);
+    if (mention !== undefined)
+      return rule.refusal(`${toolName}: ${mention}`);
+  }
+  return;
 }
 var LEGION_LOADED_MARKER = Symbol.for("legion.pi-envoy.legion-loaded");
 var CODE_MUTATION_TOOLS = ["edit", "write", "apply_patch"];
@@ -32581,7 +32646,7 @@ function legionExtension(pi) {
   let capability;
   let bootstrap;
   const checkSubagentSession = subagentSessionCheck();
-  let phaseWorkerPane;
+  let paneRules;
   let phaseStall = "closed";
   const phaseWorkerSession = (context) => capability !== undefined && capability.sessionID === context.sessionManager.getSessionId() && capability.role !== "architect";
   const advancePhaseStall = (input) => {
@@ -32626,11 +32691,13 @@ function legionExtension(pi) {
       console.error(`[legion] ${endpoint} after role ${role} was ${reason} failed; the daemon's held work stays undelivered until the next regain or boot: ${messageFor(error48)}`);
     }
   };
+  const typescriptController = typescriptControllerDaemon(rerunReadyAfterRegain, package_default.version);
+  const goController = goControllerDaemon(goRoleDaemon, persistedTranscript);
   const controllerSession = createControllerSession(async (context) => {
     const persisted = await persistedTranscript(context);
     recordBootstrappedSession(persisted.sessionFile);
     return persisted;
-  }, checkSubagentSession, rerunReadyAfterRegain, package_default.version);
+  }, checkSubagentSession, () => process.env.LEGION_DAEMON_API === "go" ? goController : typescriptController);
   const reclaimArchitect = async () => {
     if (capability === undefined || capability.kind !== "root-architect") {
       throw new Error("Legion root architect is not available for reclamation");
@@ -32828,6 +32895,10 @@ function legionExtension(pi) {
       return;
     phaseStall = restorePhaseStall(context.sessionManager.getBranch?.() ?? []);
     if (process.env.LEGION_DAEMON_API === "go") {
+      if (classifySession(process.env).kind === "controller") {
+        await controllerSession.handleSessionStart(context);
+        return;
+      }
       await bootstrapGoClaim(context, {
         capability: () => capability,
         setCapability: (next) => {
@@ -32870,16 +32941,10 @@ function legionExtension(pi) {
       toolCallId: toolCall.toolCallId,
       toolName: toolCall.toolName
     });
-    phaseWorkerPane ??= classifySession(process.env).kind === "phase-worker";
-    if (phaseWorkerPane) {
-      const jjAttempt = jjLogRewriteAttempt(toolCall);
-      if (jjAttempt !== undefined) {
-        return {
-          block: true,
-          reason: `refused \`${jjAttempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
-        };
-      }
-    }
+    paneRules ??= PANE_RULES[classifySession(process.env).kind] ?? [];
+    const refusal = paneRuleRefusal(toolCall, paneRules);
+    if (refusal !== undefined)
+      return { block: true, reason: refusal };
     if (await checkSubagentSession(context))
       return;
     const sessionID = context.sessionManager.getSessionId();

package/dist/skills/legion-controller/SKILL.md

@@ -59,23 +59,26 @@ command run `/legion-claim-controller` again.
 This handshake lets the daemon redeliver held controller work. It does not turn the controller
 into a state holder: daemon state and the Dispatch project remain authoritative.
 
-### Started by the operator (runtime: kubernetes)
-
-When the daemon runs inside a Kubernetes cluster it cannot open a terminal anywhere, so nobody
-launched your pane: the operator ran `legion controller start --config controller.yaml
-[--daemon-url <port-forward>]` on their own machine, and you are that foreground OMP session.
-The command fetched a fresh controller secret from the daemon with the operator's token, wrote it
-to a 0600 file under `LEGION_STATE_DIR` (`~/.local/state/legion/<project>-controller` by default)
-beside the `gh` shim and the `legion` launcher, and started you with `LEGION_CONTROLLER=1` and
-the same environment a tmux controller pane carries — so the extension claims the role and calls
-`/controller/ready` exactly as under tmux, and nothing changes in how you handle wakes. The
-daemon records you as `controllerLocator: {runtime: "kubernetes", external: true, sessionId,
-registeredAt}` and reads your liveness from the Envoy role registry (the holder of
+### Started by the operator
+
+When the daemon cannot open a terminal for you — the TypeScript daemon under `runtime: kubernetes`,
+and the Go daemon under either runtime, since it launches no controller — nobody launched your
+pane: the operator ran `legion controller start --config controller.yaml [--daemon-url <url>]` on
+their own machine, and you are that foreground OMP session. The command fetched a fresh controller
+secret from the daemon with the operator's token, wrote it to a 0600 file under `LEGION_STATE_DIR`
+(`~/.local/state/legion/<project>-controller` by default) beside the `gh` shim and the `legion`
+launcher, and started you with `LEGION_CONTROLLER=1` and the same environment a tmux controller pane
+carries, so nothing changes in how you handle wakes. Under the TypeScript daemon the extension
+claims the role and calls `/controller/ready` exactly as under tmux; under the Go daemon
+(`LEGION_DAEMON_API=go` in your environment) it registers on `/legion/v1/claims/register` with the
+secret, then claims the role. The daemon records you as `controllerLocator: {runtime, external:
+true, sessionId, registeredAt}`, `runtime` being the daemon's own (`kubernetes`, or `tmux` under the
+Go daemon). The TypeScript daemon reads your liveness from the Envoy role registry (the holder of
 `legion-<project>-controller` and its `last_seen`), not from a pane: keep the session running.
 Exiting it leaves the project without a controller until the operator runs the command again —
-the daemon logs `controller not registered; run legion controller start` once per boot-timeout
-interval and launches nothing itself. `legion state` and `legion status <KEY> <status>` work here
-over `LEGION_DAEMON_URL` (the port-forward). A second `legion controller start` replaces you: it
+the TypeScript daemon logs `controller not registered; run legion controller start` once per
+boot-timeout interval and launches nothing itself. `legion state` and `legion status <KEY>
+<status>` work here over `LEGION_DAEMON_URL`. A second `legion controller start` replaces you: it
 mints a new secret, so your grants stop working and the role moves to the new session.
 
 ## Deployment instructions

package/dist/skills/legion-worker/SKILL.md

@@ -507,6 +507,14 @@ Write the phase-specific handoff: call the `legion` tool with `op: "handoff_writ
 and `data`: a JSON object of the phase-specific fields only. It runs `legion handoff write` in
 `$LEGION_WORKSPACE` and returns its output.
 
+A handoff built from the one already on disk (a test handoff that accumulates review rounds can
+pass 128 KiB) can instead be piped from bash, so you never re-emit the whole payload:
+`cd -- "$LEGION_WORKSPACE" && bun -e 'const h = await Bun.file(".legion/<phase>.json").json(); delete h.schemaVersion; delete h.phase; delete h.completed; <your edit to h>; console.log(JSON.stringify(h))' | legion handoff write --phase <phase>`.
+The program is single-quoted, so strings in your edit take double quotes. It is `bun` because the
+worker image a pod runs ships `bun` and not `jq`, and a devbox pane has the `bun` Legion builds
+with. With `--data` omitted, `legion handoff write` reads the JSON object from stdin. The CLI adds
+`schemaVersion`, `phase` and `completed` itself and refuses them in the data, hence the `delete`s.
+
 `handoff_write` validates the payload against the phase's schema before writing: an
 implement handoff without a well-formed `proof`, or a test handoff that reports no failure and
 carries no `proof` of its own, exits 1 naming the field and writes nothing.
@@ -558,9 +566,9 @@ approved head and restarts the review loop this rule exists to end.
 ## Completion: report to the architect, then stay
 
 Report completion to the architect: call the `legion` tool with `op: "handoff_complete"` and
-`summary`: two sentences for the architect. A worker never runs `legion handoff` from bash: the
-tool call is what the extension records, and a turn that ends with the phase still open gets one
-reminder.
+`summary`: two sentences for the architect. A worker never runs `legion handoff complete` from
+bash, where the extension refuses it: the tool call is what the extension records, and a turn that
+ends with the phase still open gets one reminder.
 
 This publishes your phase's completion to the architect's role and clears the daemon's
 record of this issue's active phase. Do not add pipeline labels, run a controller loop, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.67.0",
+  "version": "1.68.1",
   "type": "module",
   "omp": {
     "extensions": [
@@ -13,7 +13,7 @@
   },
   "legion": {
     "daemonApiVersion": 8,
-    "goDaemonApiVersion": 3
+    "goDaemonApiVersion": 4
   },
   "repository": {
     "type": "git",