@sjawhar/pi-legion 8.10.0 → 8.11.0

package/dist/legion.js

@@ -15,8 +15,8 @@ var __export = (target, all) => {
 };
 
 // extensions/legion.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import path5 from "path";
+import { randomUUID } from "crypto";
+import path4 from "path";
 
 // ../envoy-client/src/dispatch-config.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -14431,8 +14431,6 @@ var EnvelopeSchema = exports_external.object({
 });
 var MINTED_DEDUPE_KEY_PATTERN = "^(?:envoy\\.role\\.forward\\.)?(?:publish|agent\\.[^.]+)\\.(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$";
 var mintedDedupeKey = new RegExp(MINTED_DEDUPE_KEY_PATTERN);
-// ../contracts/src/handoff-schema.ts
-var HANDOFF_PHASES = ["architect", "plan", "implement", "test", "review"];
 // ../contracts/src/subject.ts
 var LEGION_NOTICE_TOPIC_PREFIX = "notifications.legion.";
 function legionControllerNoticeSubject(project) {
@@ -15163,70 +15161,6 @@ function matchInjectedUserTurn(sessionID, message) {
   return sent.messageId;
 }
 
-// ../pi-shared/src/shell-command.ts
-var HEREDOC_OPENING = /^(.*?)[ \t]*<<(-?)[ \t]*'([A-Za-z_][A-Za-z0-9_]*)'[ \t]*$/;
-var BLANK_LINE = /^[ \t]*$/;
-var REFUSED_UNQUOTED = "\n;&|$`<>()#\\";
-var REFUSED_DOUBLE_QUOTED = "$`\\";
-function dispatchCommandHead(command) {
-  if (typeof command !== "string" || hasControlCharacter(command))
-    return;
-  const all = command.split(`
-`);
-  const first = all.findIndex((line) => !BLANK_LINE.test(line));
-  if (first === -1)
-    return;
-  const last = all.findLastIndex((line) => !BLANK_LINE.test(line));
-  const lines = all.slice(first, last + 1);
-  let head = lines[0] ?? "";
-  if (lines.length > 1) {
-    const opening = HEREDOC_OPENING.exec(head);
-    if (opening === null)
-      return;
-    const stripTabs = opening[2] === "-";
-    const delimiter = opening[3];
-    const end = lines.findIndex((line, index) => index > 0 && (stripTabs ? line.replace(/^\t+/, "") : line) === delimiter);
-    if (end !== lines.length - 1)
-      return;
-    head = opening[1] ?? "";
-  }
-  head = head.replace(/^[ \t]+|[ \t]+$/g, "");
-  return firstWord(head) === "dispatch" && headScan(head) ? head : undefined;
-}
-function firstWord(head) {
-  return head.split(/[ \t]/, 1)[0] ?? "";
-}
-function hasControlCharacter(text) {
-  for (let index = 0;index < text.length; index += 1) {
-    const code = text.charCodeAt(index);
-    if (code < 32 && code !== 10 && code !== 9 || code === 127)
-      return true;
-  }
-  return false;
-}
-function headScan(head) {
-  let quote;
-  for (const char of head) {
-    if (quote === "'") {
-      if (char === "'")
-        quote = undefined;
-      continue;
-    }
-    if (quote === '"') {
-      if (char === '"')
-        quote = undefined;
-      else if (REFUSED_DOUBLE_QUOTED.includes(char))
-        return false;
-      continue;
-    }
-    if (char === "'" || char === '"')
-      quote = char;
-    else if (REFUSED_UNQUOTED.includes(char))
-      return false;
-  }
-  return quote === undefined;
-}
-
 // ../pi-shared/src/subagent-session.ts
 import fs from "fs";
 import path2 from "path";
@@ -15310,7 +15244,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "8.10.0",
+  version: "8.11.0",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -15322,7 +15256,7 @@ var package_default = {
     ]
   },
   legion: {
-    daemonApiVersion: 18
+    daemonApiVersion: 19
   },
   repository: {
     type: "git",
@@ -15603,39 +15537,10 @@ var LegionGrantResponse = exports_external.strictObject({
   grantId: nonEmptyString,
   expiresAt: timestamp
 });
-var appLogin = exports_external.string().regex(/^[^[\]]+\[bot\]$/);
-var LegionGitHubTokenResponse = exports_external.strictObject({
-  token: nonEmptyString,
-  appLogin: exports_external.string().endsWith("[bot]"),
-  legionAppLogins: exports_external.strictObject({ implement: appLogin, review: appLogin }).optional()
-});
-var LegionGitCredentialResponse = exports_external.strictObject({
-  username: exports_external.literal("x-access-token"),
-  password: nonEmptyString
-});
-var LegionThreadsResolveRequest = exports_external.strictObject({
-  grantId: nonEmptyString,
-  repo: nonEmptyString,
-  number: exports_external.number().int().positive()
-});
-var LegionThreadOutcome = exports_external.union([
-  exports_external.strictObject({
-    url: nonEmptyString,
-    resolved: nonEmptyString,
-    newestBy: nonEmptyString.optional()
-  }),
-  exports_external.strictObject({
-    url: nonEmptyString,
-    leftOpen: nonEmptyString,
-    newestBy: nonEmptyString.optional()
-  })
-]);
-var LegionThreadsResolveResponse = exports_external.strictObject({
-  threads: exports_external.array(LegionThreadOutcome),
-  withheld: exports_external.number().int().nonnegative(),
-  refused: exports_external.strictObject({ url: nonEmptyString, error: nonEmptyString }).optional()
-});
 var LegionEmptyResponse = exports_external.strictObject({});
+var LegionHandoffCompleteResponse = exports_external.strictObject({
+  note: nonEmptyString.optional()
+});
 var LegionWaveReleaseResponse = exports_external.strictObject({
   released: exports_external.array(nonEmptyString)
 });
@@ -15643,16 +15548,12 @@ var LegionGrantRequest = exports_external.strictObject({
   sessionId: nonEmptyString,
   secret: nonEmptyString,
   tree: nonEmptyString,
-  issue: nonEmptyString,
-  push: exports_external.boolean().optional()
+  issue: nonEmptyString
 });
 var LegionControllerGrantRequest = exports_external.strictObject({
   sessionId: nonEmptyString,
   secret: nonEmptyString
 });
-var LegionGrantCredentialRequest = exports_external.strictObject({
-  grantId: nonEmptyString
-});
 var LegionHandoffCompleteRequest = exports_external.strictObject({
   grantId: nonEmptyString,
   summary: nonEmptyString,
@@ -15789,10 +15690,7 @@ function createLegionDaemonClient(baseUrl, fetchFn = fetch) {
     exit: (input) => acknowledge("/legion/v1/claims/exit", input),
     grant: (input) => post("/legion/v1/grants", LegionGrantRequest, LegionGrantResponse, input),
     controllerGrant: (input) => post("/legion/v1/grants", LegionControllerGrantRequest, LegionGrantResponse, input),
-    githubToken: (input) => post("/legion/v1/gh-token", LegionGrantCredentialRequest, LegionGitHubTokenResponse, input),
-    gitCredential: (input) => post("/legion/v1/git-credential", LegionGrantCredentialRequest, LegionGitCredentialResponse, input),
-    provisioningCredential: (input) => post("/legion/v1/provisioning-credential", LegionGrantCredentialRequest, LegionGitHubTokenResponse, input),
-    handoffComplete: (input) => post("/legion/v1/handoff/complete", LegionHandoffCompleteRequest, LegionEmptyResponse, input),
+    handoffComplete: (input) => post("/legion/v1/handoff/complete", LegionHandoffCompleteRequest, LegionHandoffCompleteResponse, input),
     issueStatus: (input) => post("/legion/v1/issues/status", LegionIssueStatusRequest, LegionEmptyResponse, input),
     gateRegister: (input) => post("/legion/v1/gates/register", LegionGateRegisterRequest, LegionEmptyResponse, input),
     waveRelease: (input) => post("/legion/v1/waves/release", LegionWaveReleaseRequest, LegionWaveReleaseResponse, input),
@@ -16044,7 +15942,7 @@ function createControllerSession(deps) {
     try {
       await claim(context);
     } catch (error48) {
-      context.ui.notify(`legion: re-claiming the controller for this session failed (${messageFor(error48)}). Until a re-claim succeeds, controller wakes and merges will not reach this session and its shell commands run without a Legion grant, so legion gh is unavailable.`, "warning");
+      context.ui.notify(`legion: re-claiming the controller for this session failed (${messageFor(error48)}). Until a re-claim succeeds, controller wakes and merges will not reach this session, and the \`legion\` tool's set_status and its other operations that call the daemon have no controller grant to mint and fail.`, "warning");
     }
   };
   const isClaimedSession = (sessionID) => controllerSessionID === sessionID && mintControllerGrant !== undefined;
@@ -16057,31 +15955,88 @@ function createControllerSession(deps) {
   return { claim, handleSessionStart, reclaimAfterSessionChange, isClaimedSession, mintGrant };
 }
 
-// src/grant-file.ts
-import { randomUUID } from "crypto";
-import { chmod, mkdir as mkdir2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
-import path4 from "path";
-async function writeGrantFile(file2, grantId) {
-  if (!path4.isAbsolute(file2)) {
-    throw new Error(`LEGION_GRANT_FILE ${file2} could not be written: the path is not absolute`);
-  }
-  const temp = `${file2}.${process.pid}.${randomUUID()}`;
+// src/handoff-commit.ts
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var FILE_BACKED = {
+  planning: { word: "plan", role: "planner" },
+  implementing: { word: "implement", role: "implementer" },
+  testing: { word: "test", role: "tester" },
+  reviewing: { word: "review", role: "reviewer" }
+};
+var execFileAsync2 = promisify3(execFile3);
+var pathJj = async (args, cwd) => {
   try {
-    await mkdir2(path4.dirname(file2), { recursive: true, mode: 448 });
-    await writeFile2(temp, grantId, { encoding: "utf8", mode: 384 });
-    await chmod(temp, 384);
-    await rename2(temp, file2);
+    const { stdout } = await execFileAsync2("jj", ["-R", cwd, ...args], {
+      cwd,
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return stdout.trim();
   } catch (error48) {
-    await rm(temp, { force: true }).catch(() => {});
-    throw new Error(`LEGION_GRANT_FILE ${file2} could not be written: ${messageFor(error48)}`);
+    const detail = error48 !== null && typeof error48 === "object" && "stderr" in error48 ? String(error48.stderr).trim() : error48 instanceof Error ? error48.message : String(error48);
+    throw new Error(`jj ${args.join(" ")} failed: ${detail}`);
   }
-}
-async function writeMintedGrant(mint) {
-  const file2 = process.env.LEGION_GRANT_FILE;
-  if (file2 === undefined || file2.trim() === "") {
-    throw new Error("LEGION_GRANT_FILE is not set on this pane: the daemon that launched it predates this plugin; relaunch the pane from a daemon on the matching release (a daemon restart keeps a live pane as it was launched)");
+};
+function requiredVariable(env, name) {
+  const value = env[name];
+  if (value === undefined || value === "") {
+    throw new Error(`${name} is not set, so handoff_complete cannot find the commit to report`);
   }
-  await writeGrantFile(file2, await mint());
+  return value;
+}
+async function findHandoffCommit(input) {
+  const { phase, role, env } = input;
+  const jj = input.jj ?? pathJj;
+  const workspace = requiredVariable(env, "LEGION_WORKSPACE");
+  const handoff = FILE_BACKED[phase];
+  if (handoff === undefined || handoff.role !== role) {
+    return jj(["log", "-r", "@-", "--no-graph", "-T", "commit_id"], workspace);
+  }
+  const issue2 = requiredVariable(env, "LEGION_ISSUE");
+  if (!DISPATCH_KEY_PATTERN.test(issue2)) {
+    throw new Error(`LEGION_ISSUE ${JSON.stringify(issue2)} is not a Dispatch issue key like LEGION-1`);
+  }
+  const file2 = `.legion/${issue2}/${handoff.word}.json`;
+  const fileset = `root:${JSON.stringify(file2)}`;
+  if (await jj(["diff", "-r", "@", "--name-only", fileset], workspace) !== "") {
+    throw new Error(`${file2} has changes in the working copy that are not committed: commit this phase's handoff before completing`);
+  }
+  if (await jj(["file", "list", "-r", "@", fileset], workspace) === "") {
+    throw new Error(`${file2} is missing from the workspace: write this phase's handoff, then commit and push it before completing`);
+  }
+  const carrying = await jj([
+    "log",
+    "-r",
+    `latest((::@- ~ ::trunk()) & files(${fileset}))`,
+    "--no-graph",
+    "-T",
+    "commit_id"
+  ], workspace);
+  if (carrying === "") {
+    throw new Error(`${file2} is not committed on this issue's branch (only the base branch carries it): write and commit this phase's handoff`);
+  }
+  const user = env.JJ_USER;
+  if (user !== undefined && user !== "") {
+    const author = await jj(["log", "-r", carrying, "--no-graph", "-T", 'author.name() ++ "\\n" ++ author.email()'], workspace);
+    const [name = "", email3 = ""] = author.split(`
+`, 2);
+    if (name !== user || email3 !== (env.JJ_EMAIL ?? "")) {
+      throw new Error(`${file2} is carried by commit ${carrying}, authored by ${name} <${email3}>, not this pane's ${user}: run jj new, then write and commit this phase's handoff again`);
+    }
+  }
+  const bookmark = `legion/${issue2}`;
+  const pushed = await jj([
+    "log",
+    "-r",
+    `${carrying} & ::remote_bookmarks(exact:${JSON.stringify(bookmark)}, exact:"origin")`,
+    "--no-graph",
+    "-T",
+    "commit_id"
+  ], workspace);
+  if (pushed === "") {
+    throw new Error(`${file2} is carried by commit ${carrying}, which is not on ${bookmark}@origin: push the issue branch, then complete again`);
+  }
+  return carrying;
 }
 
 // src/phase-stall.ts
@@ -16171,132 +16126,6 @@ function toolFailure(error48) {
   return { content: [{ type: "text", text: messageFor(error48) }], details: {}, isError: true };
 }
 
-// src/handoff-actions.ts
-import { execFile as execFile3 } from "child_process";
-var HANDOFF_OPERATION_FIELDS = {
-  handoff_write: ["phase", "data"],
-  handoff_read: ["phase"],
-  handoff_complete: ["summary", "verdict", "ready", "phase"]
-};
-var HANDOFF_OPERATIONS = Object.keys(HANDOFF_OPERATION_FIELDS);
-function isHandoffOperation(operation) {
-  return Object.hasOwn(HANDOFF_OPERATION_FIELDS, operation);
-}
-function handoffSchemaFields(z2) {
-  return {
-    phase: z2.enum(HANDOFF_PHASES).optional(),
-    data: z2.unknown().optional(),
-    summary: z2.string().optional(),
-    verdict: z2.enum(["pass", "fail"]).optional(),
-    ready: z2.boolean().optional()
-  };
-}
-var HANDOFF_DESCRIPTION = "Handoff actions (phase workers; the daemon accepts a completion only from the role working " + "the issue's current phase, never from an architect): handoff_write writes this phase's handoff " + "(`phase`, and `data`: the phase-specific fields as a JSON object, never the schemaVersion, " + "phase, completed and issue the command writes itself) to `.legion/<issue>/<phase>.json` in " + "the issue workspace; handoff_read returns the handoffs (every phase, or `phase`), a handoff " + "retro's removal of `.legion/<issue>/` took off the head read from the commit before it; " + "handoff_complete reports this phase complete to the daemon (`summary`: two sentences for the " + "architect, or the merger's READY packet; `verdict` pass|fail when your role's instructions " + "require one; `ready: true` for the merger's READY; no `phase` is needed, and one other than " + "your own is refused). Each " + "returns the command's output; a failed action changed nothing. What a later phase needs goes " + "in your handoff; a question for another live role goes to its role topic with envoy_publish.";
-function rootArchitectHandoffRefusal(operation) {
-  return `${operation} is not available to a root architect session; a root architect reads handoffs with \`legion handoff read [--phase <phase>]\` from bash`;
-}
-var ROLE_HANDOFF_PHASE = {
-  architect: "architect",
-  planner: "plan",
-  implementer: "implement",
-  tester: "test",
-  reviewer: "review"
-};
-var COMMAND_TIMEOUT_MS = 300000;
-function required2(parameters, operation, name) {
-  const value = parameters[name];
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${operation} requires ${name}`);
-  }
-  return value;
-}
-function commandArguments(operation, parameters) {
-  const accepted = HANDOFF_OPERATION_FIELDS[operation];
-  for (const name of Object.keys(parameters)) {
-    if (name !== "op" && !accepted.includes(name)) {
-      throw new Error(`${operation} does not accept field "${name}"`);
-    }
-  }
-  switch (operation) {
-    case "handoff_write": {
-      const data = parameters.data;
-      if (typeof data !== "object" || data === null || Array.isArray(data)) {
-        throw new Error("handoff_write requires data: the phase's handoff fields as a JSON object");
-      }
-      const phase = required2(parameters, operation, "phase");
-      return { args: ["handoff", "write", "--phase", phase], stdin: JSON.stringify(data) };
-    }
-    case "handoff_read":
-      return {
-        args: parameters.phase === undefined ? ["handoff", "read"] : ["handoff", "read", "--phase", required2(parameters, operation, "phase")]
-      };
-    case "handoff_complete": {
-      const command = [
-        "handoff",
-        "complete",
-        "--summary",
-        required2(parameters, operation, "summary")
-      ];
-      const { verdict, ready, phase } = parameters;
-      if (phase !== undefined) {
-        const role = requiredEnvironment(process.env, "LEGION_ROLE");
-        const own = ROLE_HANDOFF_PHASE[role];
-        if (own === undefined) {
-          throw new Error(`handoff_complete takes no phase for a ${role}, which writes no handoff`);
-        }
-        if (phase !== own) {
-          throw new Error(`handoff_complete's phase is "${own}" for a ${role}: omit phase, or pass "${own}"`);
-        }
-      }
-      if (verdict !== undefined) {
-        if (verdict !== "pass" && verdict !== "fail") {
-          throw new Error("handoff_complete's verdict is pass or fail");
-        }
-        command.push("--verdict", verdict);
-      }
-      if (ready !== undefined && typeof ready !== "boolean") {
-        throw new Error("handoff_complete's ready is true or false");
-      }
-      if (ready === true)
-        command.push("--ready");
-      return { args: command };
-    }
-  }
-}
-function runLegion(args, stdin, cwd, signal) {
-  const { promise: promise2, resolve, reject } = Promise.withResolvers();
-  const child = execFile3("legion", args, { cwd, env: process.env, signal, timeout: COMMAND_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (error48, stdout, stderr) => {
-    const output = [stdout, stderr].map((text) => text.trimEnd()).filter((text) => text !== "").join(`
-`);
-    if (error48 === null) {
-      resolve({ exitCode: 0, output });
-    } else if (typeof error48.code === "number") {
-      resolve({ exitCode: error48.code, output });
-    } else {
-      reject(new Error(`legion ${args.slice(0, 2).join(" ")} did not run: ${messageFor(error48)}`));
-    }
-  });
-  child.stdin?.on("error", (error48) => {
-    if (error48.code !== "EPIPE")
-      reject(error48);
-  });
-  child.stdin?.end(stdin ?? "");
-  return promise2;
-}
-async function runHandoffAction(input) {
-  const { args, stdin } = commandArguments(input.operation, input.parameters);
-  if (input.operation === "handoff_complete")
-    await writeMintedGrant(input.mintGrant);
-  const { exitCode, output } = await runLegion(args, stdin, requiredEnvironment(process.env, "LEGION_WORKSPACE"), input.signal);
-  const text = output === "" ? `legion ${args.slice(0, 2).join(" ")} exited ${exitCode}` : output;
-  const details = { operation: input.operation, exitCode };
-  if (exitCode !== 0)
-    return { content: [{ type: "text", text }], details, isError: true };
-  if (input.operation === "handoff_complete")
-    input.onPhaseCompleted();
-  return { content: [{ type: "text", text }], details };
-}
-
 // src/tools.ts
 var OPERATIONS = {
   architect: [
@@ -16308,9 +16137,11 @@ var OPERATIONS = {
     "close_root",
     "park_child",
     "rerun_child",
-    "read_record"
+    "read_record",
+    "handoff_complete"
   ],
-  "phase-worker": ["request_backward_move", "read_record"]
+  "phase-worker": ["request_backward_move", "read_record", "handoff_complete"],
+  controller: ["read_state", "set_status"]
 };
 var OPERATION_FIELDS = {
   register_gate: ["issue", "artifactId", "version"],
@@ -16321,8 +16152,12 @@ var OPERATION_FIELDS = {
   close_root: ["issue", "reason"],
   park_child: ["issue"],
   rerun_child: ["issue"],
-  read_record: ["issue"]
+  read_record: ["issue"],
+  handoff_complete: ["summary", "verdict", "ready"],
+  read_state: [],
+  set_status: ["issue", "status"]
 };
+var ISSUE_STATUSES2 = ["todo", "backlog", "icebox"];
 var jsonSuccess = (details) => toolSuccess(JSON.stringify(details), details);
 function toolSchema(pi) {
   const z2 = pi.zod;
@@ -16337,7 +16172,9 @@ function toolSchema(pi) {
       "park_child",
       "rerun_child",
       "read_record",
-      ...HANDOFF_OPERATIONS
+      "handoff_complete",
+      "read_state",
+      "set_status"
     ]),
     issue: z2.string().optional(),
     artifactId: z2.string().describe("register_gate's root spec document: its artifact id, slug, or filename, as a dispatch command's --artifact takes it").optional(),
@@ -16346,7 +16183,10 @@ function toolSchema(pi) {
     to: z2.enum(LEGION_PHASE_BACKWARD_TARGETS).optional(),
     reason: z2.string().optional(),
     decision: z2.enum(["retry", "escalate"]).optional(),
-    ...handoffSchemaFields(z2)
+    summary: z2.string().optional(),
+    verdict: z2.enum(["pass", "fail"]).optional(),
+    ready: z2.boolean().optional(),
+    status: z2.enum(ISSUE_STATUSES2).optional()
   });
 }
 function requiredString(parameters, operation, name) {
@@ -16365,14 +16205,6 @@ function assertOperationInput(parameters, operation) {
     }
   }
 }
-async function grantFor(daemon, session) {
-  return (await daemon.grant({
-    sessionId: session.sessionId,
-    secret: session.secret,
-    tree: session.tree,
-    issue: session.issue
-  })).grantId;
-}
 function recordFrom(state, issue2) {
   const record2 = state.issues[issue2];
   if (record2 === undefined)
@@ -16380,39 +16212,70 @@ function recordFrom(state, issue2) {
   return record2;
 }
 function createLegionTool(deps) {
-  const { pi, daemon, session, onPhaseCompleted, resolveDocument } = deps;
+  const { pi, daemon, session, controllerGrant, onPhaseCompleted, handoffCommit, resolveDocument } = deps;
+  const grantFor = async (client, active) => (await client.grant({
+    sessionId: active.sessionId,
+    secret: active.secret,
+    tree: active.tree,
+    issue: active.issue
+  })).grantId;
   return {
     name: "legion",
     label: "legion",
-    description: "Perform the workflow operation the Legion daemon assigned this role. The daemon advances phases; this tool cannot spawn workers. " + HANDOFF_DESCRIPTION,
+    description: "Perform the workflow operation the Legion daemon assigned this role. The daemon advances phases; this tool cannot spawn workers. " + "handoff_complete (phase workers and sub-architects; the daemon accepts a completion only from the role working the issue's current phase) " + "reports this phase complete: `summary` (two sentences for the architect, or the merger's READY packet), `verdict` pass|fail when your role's " + "instructions require one, `ready: true` for the merger's READY. A handoff is a committed file, `.legion/<issue>/<phase>.json`: the pushed commit " + "carrying it is found here, with the pane's jj, and reported, so write it, commit it and push the branch (`jj git push`) before calling; this call " + "refuses, posting nothing, a handoff still in the working copy, missing, not committed on this branch, carried by another pane's commit, or not yet " + "on `legion/<issue>@origin`, each naming the remedy. The daemon refuses HANDOFF_NOT_NEW (the commit is the one you reported for your previous " + "phase: write and commit this phase's handoff), and for READY READY_HEAD_CARRIES_HANDOFFS, READY_HEAD_CONFLICTS or READY_CHECKS_NOT_GREEN; a refused completion changed " + "nothing, so fix what it names and complete again. " + "The controller's read_state returns the daemon's whole state and set_status moves an issue to todo, backlog or icebox. " + "What a later phase needs goes in your handoff; a question for another live role goes to its role topic with envoy_publish.",
     defaultInactive: true,
     parameters: toolSchema(pi),
-    execute: async (_id, parameters, signal, _onUpdate, context) => {
+    execute: async (_id, parameters, _signal, _onUpdate, context) => {
       try {
         const active = session(context);
         const operation = requiredString(parameters, "legion", "op");
-        if (isHandoffOperation(operation)) {
-          if (active.kind === "architect" && active.issue === active.tree) {
-            throw new Error(rootArchitectHandoffRefusal(operation));
-          }
-          return await runHandoffAction({
-            operation,
-            parameters,
-            signal,
-            mintGrant: () => grantFor(daemon(), active),
-            onPhaseCompleted: () => onPhaseCompleted(context)
-          });
-        }
         if (!OPERATIONS[active.kind].includes(operation)) {
           throw new Error(`${operation} is not available to a ${active.kind} session`);
         }
         assertOperationInput(parameters, operation);
         const client = daemon();
+        if (active.kind === "controller") {
+          if (operation === "read_state")
+            return jsonSuccess(await client.state());
+          const issue2 = requiredString(parameters, operation, "issue");
+          const status = ISSUE_STATUSES2.find((candidate) => candidate === parameters.status);
+          if (status === undefined) {
+            throw new Error(`set_status requires status ${ISSUE_STATUSES2.join(", ")}`);
+          }
+          const { grantId } = await controllerGrant(active.sessionId);
+          await client.issueStatus({ grantId, issue: issue2, status });
+          return jsonSuccess({});
+        }
         switch (operation) {
           case "read_record": {
             const issue2 = requiredString(parameters, operation, "issue");
             return jsonSuccess({ record: recordFrom(await client.state(), issue2) });
           }
+          case "handoff_complete": {
+            if (active.kind === "architect" && active.issue === active.tree) {
+              throw new Error("handoff_complete is not available to a root architect session, which runs no phase");
+            }
+            const summary = requiredString(parameters, operation, "summary");
+            const { verdict, ready } = parameters;
+            if (verdict !== undefined && verdict !== "pass" && verdict !== "fail") {
+              throw new Error("handoff_complete's verdict is pass or fail");
+            }
+            if (ready !== undefined && typeof ready !== "boolean") {
+              throw new Error("handoff_complete's ready is true or false");
+            }
+            const { phase } = recordFrom(await client.state(), active.issue);
+            const commit = await handoffCommit(phase, active.role);
+            const grantId = await grantFor(client, active);
+            const answer = await client.handoffComplete({
+              grantId,
+              summary,
+              verdict: verdict ?? "",
+              ready: ready ?? false,
+              commit
+            });
+            onPhaseCompleted(context);
+            return jsonSuccess(answer);
+          }
           case "register_gate": {
             const version2 = parameters.version;
             if (typeof version2 !== "number" || !Number.isSafeInteger(version2) || version2 < 1) {
@@ -16537,204 +16400,17 @@ var exitProcess = (code) => process.exit(code);
 function setLegionBootstrapExitForTests(hook) {
   exitProcess = hook;
 }
-var GH_RESOLVED_URL = /(?:^|[\s;,"])(?:pr|issue):\/\//i;
-function needsGrant({ toolName, input }) {
-  if (toolName === "bash") {
-    return typeof input.command === "string" && dispatchCommandHead(input.command) === undefined;
-  }
-  if (toolName === "github")
-    return true;
-  const paths = Array.isArray(input.paths) ? input.paths : [input.path];
-  return paths.some((entry) => typeof entry === "string" && GH_RESOLVED_URL.test(entry));
-}
-async function wrapWithGrant(mint) {
-  try {
-    await writeMintedGrant(async () => (await mint()).grantId);
-    return;
-  } catch (error48) {
-    return { block: true, reason: messageFor(error48) };
-  }
-}
 async function persistedTranscript(context) {
   await context.sessionManager.ensureOnDisk();
   const sessionFile = context.sessionManager.getSessionFile();
   if (!sessionFile?.endsWith(".jsonl")) {
     throw new Error("Legion session must have a persisted transcript");
   }
-  const agentId = path5.basename(sessionFile, ".jsonl");
+  const agentId = path4.basename(sessionFile, ".jsonl");
   if (!agentId)
     throw new Error("Legion session transcript has no agent id");
   return { sessionFile, agentId };
 }
-var JJ_LOG_REWRITE_WORDS = ["undo", "abandon"];
-var JJ_OP_WORDS = ["op", "operation"];
-var JJ_OP_LOG_REWRITE_WORDS = ["restore", "revert"];
-var JJ_MENTION = /\bjj\b/;
-var JJ_LOG_REWRITE_MENTION = new RegExp(`\\b(?:${JJ_LOG_REWRITE_WORDS.join("|")})\\b|\\b(?:${JJ_OP_WORDS.join("|")})\\b\\W+(?:${JJ_OP_LOG_REWRITE_WORDS.join("|")})\\b`);
-function jjLogRewriteMention(text) {
-  if (!JJ_MENTION.test(text))
-    return;
-  const match = JJ_LOG_REWRITE_MENTION.exec(text);
-  return match === null ? undefined : `jj ${match[0].replace(/\W+/g, " ")}`;
-}
-function splitShellCommands(command) {
-  const commands = [];
-  let words = [];
-  let text = "";
-  let inWord = false;
-  let quote;
-  const endWord = () => {
-    if (inWord)
-      words.push(text);
-    text = "";
-    inWord = false;
-  };
-  const endCommand = () => {
-    endWord();
-    if (words.length > 0)
-      commands.push(words);
-    words = [];
-  };
-  for (let i = 0;i < command.length; i += 1) {
-    const char = command.charAt(i);
-    if (quote !== undefined) {
-      if (char === quote)
-        quote = undefined;
-      else if (quote === '"' && char === "\\" && command.charAt(i + 1) === `
-`)
-        i += 1;
-      else if (quote === '"' && char === "\\" && i + 1 < command.length) {
-        i += 1;
-        text += command.charAt(i);
-      } else
-        text += char;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = char;
-      inWord = true;
-    } else if (char === "\\") {
-      if (command.charAt(i + 1) === `
-`)
-        i += 1;
-      else if (i + 1 < command.length) {
-        i += 1;
-        text += command.charAt(i);
-        inWord = true;
-      }
-    } else if (char === " " || char === "\t" || char === "<" || char === ">") {
-      endWord();
-    } else if (char === "&" && (command.charAt(i - 1) === ">" || command.charAt(i - 1) === "<" || command.charAt(i + 1) === ">")) {
-      endWord();
-    } else if (";&|\n()`".includes(char)) {
-      endCommand();
-    } else {
-      text += char;
-      inWord = true;
-    }
-  }
-  if (quote !== undefined)
-    return;
-  endCommand();
-  return commands;
-}
-function commandMatch(words, name, sequence) {
-  for (let index = 0;index < words.length; index += 1) {
-    const word = words[index];
-    if (word !== name && !word?.endsWith(`/${name}`))
-      continue;
-    if (sequence.every((expected, offset) => words[index + 1 + offset] === expected))
-      return index;
-  }
-  return -1;
-}
-function isPushInvocation(words) {
-  return commandMatch(words, "legion", ["push"]) !== -1;
-}
-function commandsRunPush(commands) {
-  return commands?.some(isPushInvocation) ?? false;
-}
-function jjLogRewriteInvocation(words) {
-  const jj = commandMatch(words, "jj", []);
-  if (jj === -1)
-    return;
-  const args = words.slice(jj + 1);
-  const rewritesLog = args.some((arg) => JJ_LOG_REWRITE_WORDS.includes(arg)) || args.some((arg) => JJ_OP_WORDS.includes(arg)) && args.some((arg) => JJ_OP_LOG_REWRITE_WORDS.includes(arg));
-  return rewritesLog ? words.slice(jj).join(" ") : undefined;
-}
-var JJ_LOG_REWRITE = {
-  mention: jjLogRewriteMention,
-  invocation: jjLogRewriteInvocation,
-  refusal: (attempt) => `refused \`${attempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
-};
-var TREE_PANE_RULES = [JJ_LOG_REWRITE];
-var PANE_RULES = {
-  "phase-worker": TREE_PANE_RULES,
-  "root-architect": TREE_PANE_RULES
-};
-function refusedCommand(command, commands, rule) {
-  if (commands === undefined) {
-    return rule.mention(command) === undefined ? undefined : command.trim();
-  }
-  for (const words of commands) {
-    const mentioned = words.find((word) => rule.mention(word) !== undefined);
-    if (mentioned !== undefined)
-      return mentioned;
-    const invocation = rule.invocation(words);
-    if (invocation !== undefined)
-      return invocation;
-  }
-  return;
-}
-var NON_FILE_WRITE_URL = /^(xd|agent|proc):\/\//iu;
-var READ_HEADER_TAG = /#[0-9A-Fa-f]{4}$/u;
-var PREFIXED_CONFLICT_URL = /^(.+):(conflict:\/\/.+)$/u;
-function unwrapReadHeader(path6) {
-  const trimmed = path6.trimEnd();
-  if (trimmed.length < 2 || !trimmed.startsWith("[") || !trimmed.endsWith("]"))
-    return path6;
-  const inner = trimmed.slice(1, -1);
-  const tag = READ_HEADER_TAG.exec(inner);
-  const target = tag === null ? inner : inner.slice(0, tag.index);
-  if (target.length === 0 || tag === null && target.includes("#"))
-    return path6;
-  return target;
-}
-function nonFileWriteScheme(toolCall) {
-  if (toolCall.toolName !== "write" || typeof toolCall.input.path !== "string")
-    return;
-  const unwrapped = unwrapReadHeader(toolCall.input.path);
-  const target = PREFIXED_CONFLICT_URL.exec(unwrapped)?.[2] ?? unwrapped;
-  return NON_FILE_WRITE_URL.exec(target)?.[1]?.toLowerCase();
-}
-function paneRuleRefusal(toolCall, rules, commands) {
-  if (rules.length === 0)
-    return;
-  const { toolName, input } = toolCall;
-  if (toolName === "bash") {
-    if (typeof input.command !== "string")
-      return;
-    for (const rule of rules) {
-      const attempt = refusedCommand(input.command, commands, rule);
-      if (attempt !== undefined)
-        return rule.refusal(attempt);
-    }
-    return;
-  }
-  let text;
-  if (toolName === "eval" && typeof input.code === "string")
-    text = input.code;
-  else if (nonFileWriteScheme(toolCall) === "proc" && typeof input.content === "string") {
-    text = input.content;
-  } else
-    return;
-  for (const rule of rules) {
-    const mention = rule.mention(text);
-    if (mention !== undefined)
-      return rule.refusal(`${toolName}: ${mention}`);
-  }
-  return;
-}
 function envoyPluginRefusal() {
   const legacy = globalThis[LEGACY_LEGION_LOADED_KEY];
   if (legacy !== undefined) {
@@ -16752,14 +16428,13 @@ function envoyPluginRefusal() {
   }
 }
 function legionExtension(pi) {
-  const instance = randomUUID2().slice(0, 8);
+  const instance = randomUUID().slice(0, 8);
   logger3.debug("extension instance loaded", { extension: import.meta.url, instance });
   globalThis[LEGION_PLUGIN_LOADED_KEY] = {
     from: import.meta.url,
     envoyInterface: ENVOY_PLUGIN_INTERFACE_VERSION
   };
   const checkSubagentSession = subagentSessionCheck();
-  let paneRules;
   let phaseStall = "closed";
   const phaseWorkerSession = (context) => {
     const role = claimSession.capability(context.sessionManager.getSessionId())?.role;
@@ -16815,16 +16490,16 @@ function legionExtension(pi) {
     }
     if (session.kind === "controller") {
       await controllerSession.handleSessionStart(context);
-      return;
-    }
-    recreatedNotice = workspaceRecreatedNotice(process.env, session.kind === "root-architect" ? session.tree : session.issue);
-    if (recreatedNotice !== undefined) {
-      pi.sendMessage(workspaceRecreatedMessage(recreatedNotice), {
-        deliverAs: "steer",
-        triggerTurn: false
-      });
+    } else {
+      recreatedNotice = workspaceRecreatedNotice(process.env, session.kind === "root-architect" ? session.tree : session.issue);
+      if (recreatedNotice !== undefined) {
+        pi.sendMessage(workspaceRecreatedMessage(recreatedNotice), {
+          deliverAs: "steer",
+          triggerTurn: false
+        });
+      }
+      await claimSession.bootstrap(context);
     }
-    await claimSession.bootstrap(context);
     registerLegionTool();
     await activateLegionTool();
   });
@@ -16857,43 +16532,6 @@ function legionExtension(pi) {
   pi.on("session_switch", (_event, context) => afterSessionChange(context));
   pi.on("session_branch", (_event, context) => afterSessionChange(context));
   pi.on("session_tree", (_event, context) => afterSessionChange(context));
-  pi.on("tool_call", async (toolCall, context) => {
-    logger3.debug("legion tool_call hook", {
-      instance,
-      toolCallId: toolCall.toolCallId,
-      toolName: toolCall.toolName
-    });
-    paneRules ??= PANE_RULES[classifySession(process.env).kind] ?? [];
-    const commands = toolCall.toolName === "bash" && typeof toolCall.input.command === "string" ? splitShellCommands(dispatchCommandHead(toolCall.input.command) ?? toolCall.input.command) : undefined;
-    const refusal = paneRuleRefusal(toolCall, paneRules, commands);
-    if (refusal !== undefined)
-      return { block: true, reason: refusal };
-    if (await checkSubagentSession(context))
-      return;
-    const sessionID = context.sessionManager.getSessionId();
-    const active = claimSession.capability(sessionID);
-    if (!needsGrant(toolCall))
-      return;
-    if (active === undefined) {
-      if (controllerSession.isClaimedSession(sessionID)) {
-        return wrapWithGrant(() => controllerSession.mintGrant(sessionID));
-      }
-      if (process.env.LEGION_ROLE !== undefined && process.env.LEGION_CONTROLLER !== "1") {
-        return {
-          block: true,
-          reason: "Legion worker session is not registered; cannot mint its grant"
-        };
-      }
-      return;
-    }
-    return wrapWithGrant(() => roleDaemon().grant({
-      tree: active.tree,
-      issue: active.issue,
-      sessionId: sessionID,
-      secret: active.secret,
-      push: commandsRunPush(commands)
-    }));
-  });
   pi.on("message_start", async (event, context) => {
     if (!phaseWorkerSession(context))
       return;
@@ -16930,19 +16568,26 @@ function legionExtension(pi) {
       pi,
       daemon: roleDaemon,
       session: (context) => {
-        const active = claimSession.capability(context.sessionManager.getSessionId());
-        if (active === undefined) {
-          throw new Error("legion is available only to this session's registered claim");
+        const sessionID = context.sessionManager.getSessionId();
+        const active = claimSession.capability(sessionID);
+        if (active !== undefined) {
+          return {
+            kind: active.role === "architect" ? "architect" : "phase-worker",
+            role: active.role,
+            sessionId: active.sessionID,
+            tree: active.tree,
+            issue: active.issue,
+            secret: active.secret
+          };
         }
-        return {
-          kind: active.role === "architect" ? "architect" : "phase-worker",
-          sessionId: active.sessionID,
-          tree: active.tree,
-          issue: active.issue,
-          secret: active.secret
-        };
+        if (controllerSession.isClaimedSession(sessionID)) {
+          return { kind: "controller", sessionId: sessionID };
+        }
+        throw new Error("legion is available only to this session's registered claim");
       },
+      controllerGrant: (sessionId) => controllerSession.mintGrant(sessionId),
       onPhaseCompleted,
+      handoffCommit: (phase, role) => findHandoffCommit({ phase, role, env: process.env }),
       resolveDocument: async (issue2, reference) => {
         const config2 = activeDispatchConfig(process.env, { cwd: process.cwd() });
         if (config2 === null) {
@@ -16963,6 +16608,8 @@ function legionExtension(pi) {
       if (refusal !== undefined)
         throw new Error(refusal);
       await controllerSession.claim(context);
+      registerLegionTool();
+      await activateLegionTool();
     }
   });
 }