@sjawhar/pi-legion 9.8.2 → 10.1.0

package/dist/legion.js

@@ -19,9 +19,20 @@ var __require = import.meta.require;
 import { randomUUID } from "crypto";
 import path5 from "path";
 
-// ../envoy-client/src/dispatch-config.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { homedir } from "os";
+// ../envoy-client/src/envoy-config.ts
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  lstatSync,
+  mkdtempSync,
+  openSync,
+  readFileSync as readFileSync2,
+  readlinkSync,
+  rmSync,
+  statSync
+} from "fs";
+import { homedir, tmpdir } from "os";
 import * as path from "path";
 
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v4/classic/external.js
@@ -13564,8 +13575,97 @@ function hasErrnoCode(error48, code) {
   return error48 instanceof Error && "code" in error48 && error48.code === code;
 }
 
+// ../envoy-client/src/json-position.ts
+function jsonErrorPosition(text) {
+  let at = 0;
+  const fail = () => {
+    throw new RangeError("not JSON");
+  };
+  const space = () => {
+    while (at < text.length && ` 	
+\r`.includes(text.charAt(at)))
+      at += 1;
+  };
+  const expect = (char) => {
+    if (text.charAt(at) !== char)
+      fail();
+    at += 1;
+  };
+  const string4 = () => {
+    expect('"');
+    while (at < text.length) {
+      const char = text.charAt(at);
+      if (char === '"') {
+        at += 1;
+        return;
+      }
+      if (char < " ")
+        fail();
+      at += char === "\\" ? 2 : 1;
+    }
+    fail();
+  };
+  const value = () => {
+    space();
+    const char = text.charAt(at);
+    if (char === "{" || char === "[") {
+      const close = char === "{" ? "}" : "]";
+      at += 1;
+      space();
+      if (text.charAt(at) === close) {
+        at += 1;
+        return;
+      }
+      for (;; ) {
+        if (close === "}") {
+          space();
+          string4();
+          space();
+          expect(":");
+        }
+        value();
+        space();
+        if (text.charAt(at) === ",") {
+          at += 1;
+          continue;
+        }
+        expect(close);
+        return;
+      }
+    }
+    if (char === '"') {
+      string4();
+      return;
+    }
+    for (const word of ["true", "false", "null"]) {
+      if (text.startsWith(word, at)) {
+        at += word.length;
+        return;
+      }
+    }
+    const number4 = /^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/.exec(text.slice(at));
+    if (number4 === null)
+      fail();
+    at += number4?.[0].length ?? 0;
+  };
+  try {
+    value();
+    space();
+    if (at < text.length)
+      fail();
+    return;
+  } catch {
+    const before = text.slice(0, at).split(`
+`);
+    return `line ${before.length}, column ${(before.at(-1)?.length ?? 0) + 1}`;
+  }
+}
+
 // ../envoy-client/src/secret-file.ts
 import { readFileSync } from "fs";
+function sendable(value) {
+  return !/[\s\p{Cc}]/u.test(value);
+}
 function readSecretFile(variable, filePath) {
   let contents;
   try {
@@ -13576,131 +13676,431 @@ function readSecretFile(variable, filePath) {
   const value = contents.trim();
   if (value.length === 0)
     throw new Error(`${variable} names ${filePath}, which is empty`);
+  if (!sendable(value)) {
+    throw new Error(`${variable} names ${filePath}, which holds whitespace or a control character`);
+  }
   return value;
 }
 
-// ../envoy-client/src/dispatch-config.ts
-var DEFAULT_SERVER_URL = "http://localhost:8766";
-function normalizeDispatchUrl(url2) {
-  return url2.replace(/\/+$/, "");
+// ../envoy-client/src/envoy-config.ts
+var COMMAND_TIMEOUT_MS = 1e4;
+function nonEmpty(value) {
+  return value === undefined || value === "" ? undefined : value;
 }
-function parsedDispatchUrl(value, source) {
-  const url2 = normalizeDispatchUrl(value);
-  try {
-    new URL(url2);
-    return { url: url2, error: null };
-  } catch {
-    return { url: null, error: `${source} must be a valid URL` };
+function absolute(name, value) {
+  if (value !== undefined && !path.isAbsolute(value)) {
+    throw new Error(`${name} is ${value}, which is not an absolute path`);
+  }
+  return value;
+}
+function neutralConfig(env) {
+  const xdgConfigHome = nonEmpty(env.XDG_CONFIG_HOME);
+  if (xdgConfigHome !== undefined && !path.isAbsolute(xdgConfigHome)) {
+    return { error: `XDG_CONFIG_HOME is ${xdgConfigHome}, which is not an absolute path` };
   }
+  const configHome = xdgConfigHome ?? path.join(nonEmpty(env.HOME) ?? homedir(), ".config");
+  return { path: path.resolve(configHome, "legion", "envoy.json") };
 }
+var HARNESS_DIRECTORY_VARIABLE = {
+  omp: "PI_CODING_AGENT_DIR",
+  claude: "CLAUDE_CONFIG_DIR",
+  opencode: "OPENCODE_CONFIG_DIR"
+};
+var PLUGIN_HARNESSES = Object.keys(HARNESS_DIRECTORY_VARIABLE);
+function namedDirectory(harness, env) {
+  if (harness === "omp") {
+    const profile = nonEmpty(env.OMP_PROFILE);
+    if (profile === undefined || profile === "default")
+      return;
+  }
+  return nonEmpty(env[HARNESS_DIRECTORY_VARIABLE[harness]]);
+}
+function harnessDirectory(harness, env) {
+  for (const plugin of harness === "command" ? PLUGIN_HARNESSES : [harness]) {
+    if (harness === "command" && plugin === "claude" && env.CLAUDE_CODE_CHILD_SESSION !== "1") {
+      continue;
+    }
+    const directory = namedDirectory(plugin, env);
+    if (directory !== undefined)
+      return absolute(HARNESS_DIRECTORY_VARIABLE[plugin], directory);
+  }
+  return;
+}
+function handedConfigPath(env) {
+  const handed = nonEmpty(env.ENVOY_CONFIG_FILE);
+  return handed === undefined ? undefined : path.resolve(absolute("ENVOY_CONFIG_FILE", handed));
+}
+function envoyConfigPath(harness, env) {
+  const handedFirst = harness === "command" ? handedConfigPath(env) : undefined;
+  if (handedFirst !== undefined)
+    return handedFirst;
+  const directory = harnessDirectory(harness, env);
+  if (directory !== undefined)
+    return path.resolve(directory, "envoy.json");
+  const handed = handedConfigPath(env);
+  if (handed !== undefined)
+    return handed;
+  const neutral = neutralConfig(env);
+  if ("error" in neutral)
+    throw new Error(neutral.error);
+  return neutral.path;
+}
+var httpUrlSchema = exports_external.url({ protocol: /^https?$/, error: "must be an http or https URL" });
+var DispatchSectionSchema = exports_external.strictObject({
+  enabled: exports_external.boolean().optional(),
+  serverUrl: httpUrlSchema.optional(),
+  token: exports_external.string().optional()
+});
+var EnvoySectionSchema = exports_external.strictObject({
+  enabled: exports_external.boolean().optional(),
+  url: httpUrlSchema.optional(),
+  natsUrls: exports_external.array(exports_external.string().trim().min(1, "must not be empty")).optional(),
+  token: exports_external.string().optional(),
+  natsSeed: exports_external.string().optional()
+});
 var EnvoyFileSchema = exports_external.looseObject({
   $schema: exports_external.string().optional(),
-  natsUrls: exports_external.array(exports_external.string()).optional(),
-  dispatch: exports_external.strictObject({
-    enabled: exports_external.boolean().optional(),
-    serverUrl: exports_external.url().optional(),
-    token: exports_external.string().optional()
-  }).optional()
+  dispatch: DispatchSectionSchema.optional(),
+  envoy: EnvoySectionSchema.optional()
+});
+var CheckoutFileSchema = exports_external.looseObject({
+  $schema: exports_external.string().optional(),
+  dispatch: DispatchSectionSchema.optional()
 });
+function offWithNotice(notice) {
+  return { enabled: false, notice, error: null };
+}
+function offWithError(error48) {
+  return { enabled: false, notice: null, error: error48 };
+}
+function httpUrl2(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return;
+  }
+  return url2.protocol === "http:" || url2.protocol === "https:" ? url2 : undefined;
+}
 function describeSchemaIssue(filePath, error48) {
   const issue2 = error48.issues[0];
   if (!issue2)
-    return `${filePath}: invalid dispatch config`;
+    return `${filePath}: invalid envoy.json`;
   if (issue2.code === "unrecognized_keys") {
-    const keys = issue2.keys.map((key) => `dispatch.${key}`).join(", ");
-    return `${filePath}: unrecognized dispatch key(s): ${keys}`;
+    const section = issue2.path.join(".");
+    const keys = issue2.keys.map((key) => `${section}.${key}`).join(", ");
+    return `${filePath}: unrecognized ${section} key(s): ${keys}`;
   }
   return `${filePath}: ${issue2.path.join(".")}: ${issue2.message}`;
 }
-function readEnvoyFile(filePath) {
+function danglingLink(filePath) {
+  try {
+    return lstatSync(filePath).isSymbolicLink() ? readlinkSync(filePath) : null;
+  } catch {
+    return null;
+  }
+}
+function parseFile(filePath, schema, checkout) {
   let raw;
   try {
     raw = readFileSync2(filePath, "utf-8");
-  } catch {
-    return { kind: "absent" };
+  } catch (error48) {
+    if (hasErrnoCode(error48, "ENOENT") || hasErrnoCode(error48, "ENOTDIR")) {
+      return { kind: "absent", link: danglingLink(filePath) };
+    }
+    return { kind: "invalid", reason: `${filePath}: could not be read (${messageFor(error48)})` };
   }
   let parsedJson;
   try {
     parsedJson = JSON.parse(raw);
-  } catch (err) {
-    return { kind: "invalid", reason: `${filePath}: invalid JSON (${messageFor(err)})` };
+  } catch {
+    const position = jsonErrorPosition(raw);
+    return {
+      kind: "invalid",
+      reason: `${filePath}: invalid JSON${position === undefined ? "" : ` at ${position}`}`
+    };
   }
-  const parsed = EnvoyFileSchema.safeParse(parsedJson);
+  if (typeof parsedJson === "object" && parsedJson !== null && "natsUrls" in parsedJson) {
+    return {
+      kind: "invalid",
+      reason: checkout ? `${filePath}: the top-level natsUrls is not read, and a checkout's envoy.json holds only a dispatch section` : `${filePath}: the top-level natsUrls is not read; move it to envoy.natsUrls`
+    };
+  }
+  const parsed = schema.safeParse(parsedJson);
   if (!parsed.success) {
     return { kind: "invalid", reason: describeSchemaIssue(filePath, parsed.error) };
   }
-  return { kind: "valid", settings: parsed.data.dispatch ?? null };
-}
-function resolveDispatchConfig(env, options = {}) {
-  const explicitUrl = env.DISPATCH_URL;
-  const home = options.home ?? env.HOME ?? homedir();
-  const cwd = options.cwd ?? process.cwd();
-  const userFile = readEnvoyFile(path.join(home, ".config", "opencode", "envoy.json"));
-  const repoFile = readEnvoyFile(path.join(cwd, ".opencode", "envoy.json"));
-  for (const file2 of [userFile, repoFile]) {
-    if (file2.kind === "invalid") {
-      return { enabled: false, url: null, token: null, error: file2.reason };
-    }
-  }
-  const userSettings = userFile.kind === "valid" ? userFile.settings : null;
-  const repoSettings = repoFile.kind === "valid" ? repoFile.settings : null;
-  const merged = { ...userSettings, ...repoSettings };
-  const repoURL = repoSettings?.serverUrl;
-  if (explicitUrl === undefined && merged.enabled === true && repoURL !== undefined) {
-    const token2 = repoSettings?.token ?? null;
-    if (!token2) {
+  return { kind: "valid", settings: parsed.data };
+}
+var FAILURE_KEPT_MS = 60000;
+var COMMAND_OUTCOMES = Symbol.for("legion.envoy-config.commands.v1");
+var processGlobal = globalThis;
+var commandOutcomes = processGlobal[COMMAND_OUTCOMES] ?? new Map;
+processGlobal[COMMAND_OUTCOMES] = commandOutcomes;
+function runCommand(command, env, cwd) {
+  const childEnv = {};
+  for (const [name, variable] of Object.entries(env)) {
+    if (variable !== undefined)
+      childEnv[name] = variable;
+  }
+  const directory = mkdtempSync(path.join(tmpdir(), "envoy-command-"));
+  try {
+    chmodSync(directory, 448);
+    const output = path.join(directory, "stdout");
+    const fd = openSync(output, "wx", 384);
+    let result;
+    try {
+      result = Bun.spawnSync(["/bin/sh", "-c", command], {
+        cwd,
+        env: childEnv,
+        stdin: "ignore",
+        stdout: fd,
+        stderr: "ignore",
+        timeout: COMMAND_TIMEOUT_MS,
+        detached: true
+      });
+    } catch (error48) {
+      return { failure: `could not start: ${messageFor(error48)}`, timedOut: false };
+    } finally {
+      closeSync(fd);
+    }
+    try {
+      process.kill(-result.pid, "SIGKILL");
+    } catch {}
+    if (result.exitedDueToTimeout) {
       return {
-        enabled: false,
-        url: null,
-        token: null,
-        error: "repository dispatch.serverUrl requires dispatch.token from the same .opencode/envoy.json or DISPATCH_URL with DISPATCH_TOKEN"
+        failure: `did not finish within ${COMMAND_TIMEOUT_MS / 1000} s, and does not run again in this process`,
+        timedOut: true
       };
     }
-    const url3 = parsedDispatchUrl(repoURL, "repository dispatch.serverUrl");
-    if (url3.error !== null)
-      return { enabled: false, url: null, token: null, error: url3.error };
-    return { enabled: true, url: url3.url, token: token2, error: null };
-  }
-  const rawUrl = explicitUrl !== undefined ? { value: explicitUrl, source: "DISPATCH_URL" } : merged.enabled === true ? { value: merged.serverUrl ?? DEFAULT_SERVER_URL, source: "dispatch.serverUrl" } : null;
-  const url2 = rawUrl ? parsedDispatchUrl(rawUrl.value, rawUrl.source) : { url: null, error: null };
-  let token;
-  let tokenSource;
-  if (env.DISPATCH_TOKEN_FILE !== undefined) {
-    tokenSource = "DISPATCH_TOKEN_FILE";
-    try {
-      token = readSecretFile(tokenSource, env.DISPATCH_TOKEN_FILE);
-    } catch (error48) {
-      return { enabled: false, url: url2.url, token: null, error: messageFor(error48) };
+    if (!result.success) {
+      return {
+        failure: `exited with ${result.signalCode ?? `status ${result.exitCode}`}`,
+        timedOut: false
+      };
     }
-  } else if (env.DISPATCH_TOKEN !== undefined) {
-    tokenSource = "DISPATCH_TOKEN";
-    token = env.DISPATCH_TOKEN;
-  } else {
-    tokenSource = "dispatch.token";
-    token = merged.token ?? null;
-  }
-  if (url2.error !== null)
-    return { enabled: false, url: null, token, error: url2.error };
-  if (url2.url === null)
-    return { enabled: false, url: null, token, error: null };
-  if (!token) {
-    return {
-      enabled: false,
-      url: url2.url,
-      token,
-      error: `${tokenSource} must be a non-empty bearer token`
+    const value = readFileSync2(output, "utf-8").trim();
+    if (value.length === 0)
+      return { failure: "printed nothing", timedOut: false };
+    if (!sendable(value)) {
+      return {
+        failure: "printed more than one line, or whitespace inside its value",
+        timedOut: false
+      };
+    }
+    return { value };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+function fileValue(value, field, filePath, env) {
+  if (!value.startsWith("!")) {
+    if (!sendable(value)) {
+      throw new Error(`${filePath}: ${field} holds whitespace or a control character`);
+    }
+    return value;
+  }
+  const command = value.slice(1);
+  const cwd = path.dirname(path.resolve(filePath));
+  const key = JSON.stringify([command, filePath, cwd]);
+  let outcome = commandOutcomes.get(key);
+  if (outcome === undefined || "failure" in outcome && !outcome.timedOut && Date.now() - outcome.at >= FAILURE_KEPT_MS) {
+    outcome = { ...runCommand(command, env, cwd), at: Date.now() };
+    commandOutcomes.set(key, outcome);
+  }
+  if ("failure" in outcome)
+    throw new Error(`${filePath}: ${field}'s command ${outcome.failure}`);
+  return outcome.value;
+}
+function statDevice(directory) {
+  try {
+    return statSync(directory).dev;
+  } catch {
+    return;
+  }
+}
+function moveNotice(oldFile, newFile, move, deviceOf) {
+  const oldDevice = deviceOf(path.dirname(oldFile));
+  let ancestor = path.dirname(newFile);
+  let newDevice = deviceOf(ancestor);
+  while (newDevice === undefined && path.dirname(ancestor) !== ancestor) {
+    ancestor = path.dirname(ancestor);
+    newDevice = deviceOf(ancestor);
+  }
+  if (oldDevice !== undefined && newDevice !== undefined && oldDevice !== newDevice) {
+    return `${oldFile} is not read, and is on another filesystem than ${newFile} (a mount): create ${newFile}, and move ${oldFile} on the machine that owns it`;
+  }
+  return `${oldFile} is not read: ${move}`;
+}
+function oldUserFileNotice(filePath, env, deviceOf) {
+  const home = nonEmpty(env.HOME) ?? homedir();
+  const old = path.join(home, ".config", "opencode", "envoy.json");
+  if (!existsSync(old))
+    return;
+  const selected = path.resolve(filePath);
+  const userFile = path.resolve(home, ".config", "legion", "envoy.json");
+  if (selected === userFile) {
+    return moveNotice(old, userFile, "mkdir -p ~/.config/legion && mv ~/.config/opencode/envoy.json ~/.config/legion/", deviceOf);
+  }
+  const profileFile = PLUGIN_HARNESSES.map((harness) => namedDirectory(harness, env)).some((directory) => directory !== undefined && path.isAbsolute(directory) && selected === path.resolve(directory, "envoy.json"));
+  if (profileFile) {
+    return `${old} is not read for this profile; copy or link it to ${filePath}, or write that file`;
+  }
+  const configHome = nonEmpty(env.XDG_CONFIG_HOME);
+  const neutral = neutralConfig(env);
+  if (configHome !== undefined && path.isAbsolute(configHome) && "path" in neutral && selected === neutral.path) {
+    return `${old} is not read under XDG_CONFIG_HOME=${configHome}`;
+  }
+  return;
+}
+function missingConfigNotice(filePath, missing, off) {
+  const link = missing.link === null ? "" : ` (a link to ${missing.link}, which does not exist)`;
+  const old = missing.oldUserFileNotice === undefined ? "" : `; ${missing.oldUserFileNotice}`;
+  return `no envoy.json at ${filePath}${link}: ${off}${old}`;
+}
+function readEnvoyConfig(filePath, env, options) {
+  const deviceOf = options.deviceOf ?? statDevice;
+  const chosen = parseFile(filePath, EnvoyFileSchema, false);
+  if (chosen.kind === "invalid")
+    return { kind: "failed", path: filePath, error: chosen.reason };
+  const resolvedChosen = path.resolve(filePath);
+  const checkoutPath = path.resolve(options.cwd, ".envoy", "envoy.json");
+  const checkoutFile = checkoutPath === resolvedChosen ? { kind: "absent", link: null } : parseFile(checkoutPath, CheckoutFileSchema, true);
+  const own = chosen.kind === "valid" ? chosen.settings : {};
+  let checkout = null;
+  if (checkoutFile.kind === "invalid") {
+    checkout = { kind: "invalid", path: checkoutPath, error: checkoutFile.reason };
+  } else if (checkoutFile.kind === "valid") {
+    checkout = {
+      kind: "valid",
+      path: checkoutPath,
+      dispatch: checkoutFile.settings.dispatch ?? {},
+      envoyError: Object.hasOwn(checkoutFile.settings, "envoy") ? `${checkoutPath}: envoy is not read from a checkout's envoy.json; put it in ${filePath}` : null
     };
   }
-  return { enabled: true, url: url2.url, token, error: null };
+  const oldCheckout = path.resolve(options.cwd, ".opencode", "envoy.json");
+  const warnings = oldCheckout !== resolvedChosen && !existsSync(checkoutPath) && existsSync(oldCheckout) ? [
+    moveNotice(oldCheckout, checkoutPath, `mkdir -p ${path.dirname(checkoutPath)} && mv ${oldCheckout} ${checkoutPath}`, deviceOf)
+  ] : [];
+  const unreadOldUserFile = chosen.kind === "absent" ? oldUserFileNotice(filePath, env, deviceOf) : undefined;
+  return {
+    kind: "read",
+    path: filePath,
+    dispatch: own.dispatch ?? {},
+    envoy: own.envoy ?? {},
+    checkout,
+    missing: chosen.kind === "absent" ? {
+      link: chosen.link,
+      ...unreadOldUserFile === undefined ? {} : { oldUserFileNotice: unreadOldUserFile }
+    } : null,
+    warnings
+  };
 }
-function activeDispatchConfig(env, options = {}) {
-  const config2 = resolveDispatchConfig(env, options);
-  if (config2.error !== null)
-    throw new Error(`dispatch config: ${config2.error}`);
-  const { url: url2, token } = config2;
-  if (!config2.enabled || url2 === null || token === null)
-    return null;
-  return { ...config2, url: url2, token };
+
+// ../envoy-client/src/bearer.ts
+function bearerSource(env, section, written) {
+  const pointer = nonEmpty(env[`${section}_TOKEN_FILE`]);
+  if (pointer !== undefined) {
+    return { kind: "variable", token: readSecretFile(`${section}_TOKEN_FILE`, pointer) };
+  }
+  const plain = nonEmpty(env[`${section}_TOKEN`]);
+  if (plain !== undefined) {
+    if (!sendable(plain)) {
+      throw new Error(`${section}_TOKEN holds whitespace or a control character`);
+    }
+    return { kind: "variable", token: plain };
+  }
+  const bearer = written();
+  return bearer === undefined ? { kind: "none" } : { kind: "file", ...bearer };
+}
+function fileBearer(bearer, url2, section, env) {
+  const named = httpUrl2(url2)?.origin;
+  const paired = httpUrl2(bearer.server)?.origin;
+  if (named !== paired) {
+    throw new Error(`${section}_URL names ${named}, but ${bearer.path}'s ${bearer.field} is for ${paired}; set ${section}_TOKEN or ${section}_TOKEN_FILE for it`);
+  }
+  if (bearer.checkout && bearer.token.startsWith("!")) {
+    throw new Error(`${bearer.path}: ${bearer.field} is a command, which a checkout's envoy.json cannot run`);
+  }
+  if (bearer.token === "") {
+    throw new Error(`${bearer.field} in ${bearer.path} must be a non-empty bearer token`);
+  }
+  return fileValue(bearer.token, bearer.field, bearer.path, env);
+}
+
+// ../envoy-client/src/dispatch-config.ts
+var DEFAULT_SERVER_URL = "http://localhost:8766";
+function checkoutPair(checkout, serverUrl) {
+  const { token } = checkout.dispatch;
+  if (token === undefined) {
+    throw new Error(`${checkout.path}: dispatch.serverUrl requires dispatch.token in the same file`);
+  }
+  return {
+    kind: "file",
+    token,
+    field: "dispatch.token",
+    path: checkout.path,
+    server: serverUrl,
+    checkout: true
+  };
+}
+function writtenToken(config2, checkout) {
+  if (checkout?.dispatch.token !== undefined) {
+    throw new Error(`${checkout.path}: dispatch.token requires dispatch.serverUrl in the same file`);
+  }
+  const own = config2.dispatch;
+  if (own.token === undefined)
+    return;
+  const server = own.serverUrl ?? DEFAULT_SERVER_URL;
+  return {
+    token: own.token,
+    field: "dispatch.token",
+    path: config2.path,
+    server,
+    checkout: false
+  };
+}
+function dispatchSettings(env, config2) {
+  if (config2.kind === "failed")
+    return offWithError(config2.error);
+  const explicitUrl = nonEmpty(env.DISPATCH_URL);
+  const checkoutFile = explicitUrl === undefined ? config2.checkout : null;
+  if (checkoutFile?.kind === "invalid")
+    return offWithError(checkoutFile.error);
+  const checkout = checkoutFile?.kind === "valid" ? checkoutFile : null;
+  const own = config2.dispatch;
+  if (own.enabled === false) {
+    return offWithNotice(`${config2.path} sets dispatch.enabled to false: Dispatch is off`);
+  }
+  if (checkout?.dispatch.enabled === false) {
+    return offWithNotice(`${checkout.path} sets dispatch.enabled to false: Dispatch is off`);
+  }
+  const checkoutServer = checkout?.dispatch.serverUrl;
+  const addressed = explicitUrl !== undefined || checkoutServer !== undefined || own.serverUrl !== undefined || own.enabled === true;
+  if (!addressed) {
+    return offWithNotice(config2.missing === null ? `${config2.path} names no Dispatch server, and DISPATCH_URL is not set: Dispatch is off` : missingConfigNotice(config2.path, config2.missing, "Dispatch is off"));
+  }
+  if (explicitUrl !== undefined && httpUrl2(explicitUrl) === undefined) {
+    return offWithError("DISPATCH_URL must be an http or https URL");
+  }
+  try {
+    const source = checkout !== null && checkoutServer !== undefined ? checkoutPair(checkout, checkoutServer) : bearerSource(env, "DISPATCH", () => writtenToken(config2, checkout));
+    if (source.kind === "none") {
+      return offWithError(explicitUrl === undefined ? `${config2.path}: dispatch is enabled and no token is: set dispatch.token, or DISPATCH_TOKEN or DISPATCH_TOKEN_FILE` : `DISPATCH_URL is set and no token is: set DISPATCH_TOKEN or DISPATCH_TOKEN_FILE, or dispatch.token in ${config2.path}`);
+    }
+    const url2 = (explicitUrl ?? (source.kind === "file" ? source.server : own.serverUrl ?? DEFAULT_SERVER_URL)).replace(/\/+$/, "");
+    const token = source.kind === "variable" ? source.token : fileBearer(source, url2, "DISPATCH", env);
+    return { enabled: true, url: url2, token };
+  } catch (error48) {
+    return offWithError(messageFor(error48));
+  }
+}
+function activeDispatchSettings(resolution) {
+  if (resolution.enabled)
+    return resolution;
+  if (resolution.error !== null)
+    throw new Error(`dispatch config: ${resolution.error}`);
+  return null;
 }
 
 // ../contracts/src/dispatch-api.ts
@@ -15077,16 +15477,16 @@ function dispatchAnswered(error48, status) {
 // ../envoy-client/src/dispatch-session-state.ts
 import {
   appendFileSync,
-  closeSync,
+  closeSync as closeSync2,
   fstatSync,
   mkdirSync,
-  openSync,
+  openSync as openSync2,
   readdirSync,
   readFileSync as readFileSync3,
   readSync,
   renameSync,
-  rmSync,
-  statSync,
+  rmSync as rmSync2,
+  statSync as statSync2,
   writeFileSync
 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -15119,6 +15519,25 @@ function writeSessionTitle(dir, title) {
   writeAtomically(join2(dir, "title"), title);
 }
 
+// ../envoy-client/src/session-settings.ts
+function sessionConfigFile(harness, env) {
+  try {
+    return { path: envoyConfigPath(harness, env), error: null };
+  } catch (error48) {
+    return { path: null, error: messageFor(error48) };
+  }
+}
+function sessionDispatchSettings(file2, env, options) {
+  if (file2.path === null)
+    return { dispatch: offWithError(file2.error), warnings: [], missing: null };
+  const config2 = readEnvoyConfig(file2.path, env, options);
+  return {
+    dispatch: dispatchSettings(env, config2),
+    warnings: config2.kind === "read" ? config2.warnings : [],
+    missing: config2.kind === "read" ? config2.missing : null
+  };
+}
+
 // ../pi-shared/src/interface.ts
 import { logger } from "@oh-my-pi/pi-utils";
 var ENVOY_PLUGIN_INTERFACE_VERSION = 2;
@@ -15650,7 +16069,7 @@ async function measureCapabilities(host2, input, budgets = DEFAULT_BUDGETS) {
   });
   return { measuredAt, elapsedMs: Date.now() - started, rows };
 }
-async function runCommand(command, args, options) {
+async function runCommand2(command, args, options) {
   const child = Bun.spawn([command, ...args], {
     cwd: options.cwd,
     env: process.env,
@@ -15700,7 +16119,7 @@ function ompCapabilityHost() {
         disabledExtensions: cfgDisabledExtensions.get(settings)
       });
     },
-    run: runCommand
+    run: runCommand2
   };
 }
 
@@ -15729,7 +16148,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "9.8.2",
+  version: "10.1.0",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -16256,17 +16675,17 @@ async function userConfigChain(timeoutMs = JJ_CONFIG_PATH_TIMEOUT_MS, env = proc
       new Response(child.stdout).text(),
       new Response(child.stderr).text()
     ]);
-    const stdout = await new Promise((resolve) => {
+    const stdout = await new Promise((resolve2) => {
       const timer = setTimeout(() => {
         killGroup();
-        resolve(undefined);
+        resolve2(undefined);
       }, timeoutMs);
       completed.then(([code, output]) => {
         clearTimeout(timer);
-        resolve(code === 0 ? output : undefined);
+        resolve2(code === 0 ? output : undefined);
       }, () => {
         clearTimeout(timer);
-        resolve(undefined);
+        resolve2(undefined);
       });
     });
     if (stdout === undefined)
@@ -17199,7 +17618,9 @@ function legionExtension(pi) {
       onPhaseCompleted,
       handoffCommit: (phase, role) => findHandoffCommit({ phase, role, env: process.env }),
       resolveDocument: async (issue2, reference) => {
-        const config2 = activeDispatchConfig(process.env, { cwd: process.cwd() });
+        const config2 = activeDispatchSettings(sessionDispatchSettings(sessionConfigFile("omp", process.env), process.env, {
+          cwd: process.cwd()
+        }).dispatch);
         if (config2 === null) {
           throw new Error(`register_gate cannot look up document "${reference}" on ${issue2}: this pane has no Dispatch configured; pass the document's id`);
         }

package/dist/skills/legion-architect/SKILL.md

@@ -387,7 +387,7 @@ active phase worker.
 | `design-approved` | Its `version` is the approved one. A human approved the root spec document at its current version; the gate is open. Proceed to section 2 — except on a root whose catch-up said `handed_over`: its workers already run their phases, so start nothing; the approval releases any READY the gate refused. |
 | `design-changes-requested` | Its `version` and `reason`. A human asked for changes to the root spec at `version`, for `reason`. Revise the spec as the reason asks and request approval again as section 1 says; stay parked; the gate is closed. |
 | `phase-finished` | The daemon has already moved the issue to its next phase by its fixed table and started that phase's role; you start nothing. Read the committed handoff for the finishing phase; if it shows unresolved gaps, tell the role now working the issue (`envoy_publish` to its role topic). A `planner` notice that names a departure from the spec's design defers to section 1's full condition: when the approved Summary, Acceptance, scope and settled decisions still hold, the plan is the record; otherwise change the root spec and request approval again as section 1 says. A `reviewer` notice whose GitHub review is `CHANGES_REQUESTED` needs nothing from you: the daemon has returned the issue to `implementing` (Dispatch `in_progress`) and started the **implementer**, whose correction goes through the tester and the reviewer again, never straight to retro. A `reviewer` notice with an `APPROVED` review means the daemon has started retro (step 5). An `implementer` notice for `production_check` is its production report: read the record on the pull request and the issue, then run step 7. A `tester` notice with `verdict: "fail"` — its handoff carries `implementerProof.verdict: "rejected"`, or a failure naming the production-like proof — has gone back to the **implementer** by the daemon's table; never supply the proof from another role. A worker that reports no surface reaches the changed path sends that report instead of completing its phase, so the daemon starts nothing more on that issue and the worker stays idle in its session, not suspended: file a child issue in this tree to build the surface (infrastructure, tooling, or a skill), and when that child's `child-closed` arrives, tell the waiting worker to continue with `envoy_publish` to its role topic. That report is never a reason to advance the phase. |
-| `pr-blocked` | Its `reason` names the pull request and the `max_fix_attempts` it reached, or reads `Issue reached review_round_cap=<N>.` (the end of this row). The count is of heads pushed onto a red verdict that changed something outside `.legion/` — handoff-only pushes (`.legion/` paths only) never count, a push by the review App (a planner's, tester's, reviewer's or architect's) never counts, and the head after a red the tester's red tests earned (a review-App push that changed a path outside `.legion/`, however many handoff-only pushes follow it) does not count either — so after the tester's handoff-only push onto the implementer's red, the implementer's next push does count; a push the daemon cannot classify (a listener without `changed_paths`, a list the listener stopped at 100 paths or 32,768 runes of text, a push listing no commits) does. Published once per exhausted count, not on every later red verdict for that count. Read the failed CI evidence and recovery attempts. The notice moves nothing, and no later CI red within the attempt that ran the count out (the counted head, and every head pushed on top of it until a push lands on a head CI judged green, the tester's red tests and handoff onto the held red included) sends the work back from `testing` or `reviewing` either: the issue stays in its phase until you move it, or a worker's own decision does (a tester's `fail`, a reviewer's request for changes). A head pushed onto green CI leaves that attempt, so its red still comes as a `checks-red`. In `implementing`, give the implementer the failing checks (`envoy_publish` to its role topic). In any later phase a worker holds, tell that worker (`envoy_publish` to its role topic) to move the issue back to `implementing` with `request_backward_move`, naming the failing checks, and the daemon starts the implementer; or file a corrective child. In `awaiting_merge`, where no worker holds a phase and a backward move is refused, open a `dispatch ask` naming the failing checks for the human who merges, as section 6 does for a conflict there. Do not treat the blocked PR as final. A `review_round_cap` reason is the implementer's round count instead: every move back to an earlier phase counts one, and the notice comes again with each round past the cap. It moves nothing either, since the round that reached the cap has already started its worker. Tell the rounds apart by what announced each: a tester's fail by its `phase-finished` with `verdict: "fail"`; a request for changes by the reviewer's `phase-finished` over a `CHANGES_REQUESTED` review; the daemon's own move by a `checks-red` notice, whose reason names either a conflict (`the head conflicts with <base>`) or the required checks that failed (`CI is red at <head>`); a worker's `request_backward_move` by a `phase-finished` from the role that asked, whose reason reaches only the task of the worker the move started, so ask that worker. Judge the cap by the rounds that are not conflicts. Conflict returns need nothing from you beyond the next round. Tester fails, requests for changes and CI-red returns (a `checks-red` notice is raised for CI only when a required check fails on code the branch pushed) are the work going in circles: narrow it, re-plan it with the responsible worker, or ask a human with `dispatch ask`. Judge a worker's backward move by the reason that worker gives. A move you ordered for a conflict found before `awaiting_merge` (section 6) is a conflict return. The merger's move back to `reviewing` because its task names no approved head is not the work going in circles either. A move that sends back code found wrong counts with the tester fails. |
+| `pr-blocked` | Its `reason` names the pull request and the `max_fix_attempts` it reached, or reads `Issue reached review_round_cap=<N>.` (the end of this row). The count is of heads pushed onto a red verdict that changed something outside `.legion/` — handoff-only pushes (`.legion/` paths only) never count, a push by the review App (a planner's, tester's, reviewer's or architect's) never counts, and the head after a red the tester's red tests earned (a review-App push that changed a path outside `.legion/`, however many handoff-only pushes follow it) does not count either — so after the tester's handoff-only push onto the implementer's red, the implementer's next push does count; a push the daemon cannot classify (a listener without `changed_paths`, a list the listener stopped at 100 paths or 32,768 runes of text, a push listing no commits) does. Published once per exhausted count, not on every later red verdict for that count. Read the failed CI evidence and recovery attempts. The notice moves nothing, and no later CI red within the attempt that ran the count out (the counted head, and every head pushed on top of it until a push lands on a head CI judged green, the tester's red tests and handoff onto the held red included) sends the work back from `testing`, `reviewing`, `retro` or `merging` either: the issue stays in its phase until you move it, or a worker's own decision does (a tester's `fail`, a reviewer's request for changes). A head pushed onto green CI leaves that attempt, so its red still comes as a `checks-red`. In `implementing`, give the implementer the failing checks (`envoy_publish` to its role topic). In any later phase a worker holds, tell that worker (`envoy_publish` to its role topic) to move the issue back to `implementing` with `request_backward_move`, naming the failing checks, and the daemon starts the implementer; or file a corrective child. In `awaiting_merge`, where no worker holds a phase and a backward move is refused, open a `dispatch ask` naming the failing checks for the human who merges, as section 6 does for a conflict there. Do not treat the blocked PR as final. A `review_round_cap` reason is the implementer's round count instead: every move back to an earlier phase counts one, and the notice comes again with each round past the cap. It moves nothing either, since the round that reached the cap has already started its worker. Tell the rounds apart by what announced each: a tester's fail by its `phase-finished` with `verdict: "fail"`; a request for changes by the reviewer's `phase-finished` over a `CHANGES_REQUESTED` review; the daemon's own move by a `checks-red` notice, whose reason names either a conflict (`the head conflicts with <base>`) or the required checks that failed (`CI is red at <head>`); a worker's `request_backward_move` by a `phase-finished` from the role that asked, whose reason reaches only the task of the worker the move started, so ask that worker. Judge the cap by the rounds that are not conflicts. Conflict returns need nothing from you beyond the next round. Tester fails, requests for changes and CI-red returns (a `checks-red` notice is raised for CI only when a required check fails on code the branch pushed) are the work going in circles: narrow it, re-plan it with the responsible worker, or ask a human with `dispatch ask`. Judge a worker's backward move by the reason that worker gives. A move you ordered for a conflict found before `awaiting_merge` (section 6) is a conflict return. The merger's move back to `reviewing` because its task names no approved head is not the work going in circles either. A move that sends back code found wrong counts with the tester fails. |
 | `pr-merged` | Its `reason` names the pull request. The PR merged, under the repository's rules, before the issue reached `awaiting_merge`. The workflow runs on and asks no one to merge it: the daemon starts the **implementer** on the production check once the issue gets there, and you start nothing. Its `phase-finished` for `production_check` is what brings you to step 7: verify the record on the pull request and this issue first, then sign off naming it with `sign_off`. A merge is not the close. |
 | `pr-closed-unmerged` | Decide from current scope whether the work is reopened, started over (`park_child` then `rerun_child`, for a child), or ended with a reason. Delegate the repository action to the responsible phase worker and keep ownership. |
 | A reply on an ask you follow | Interpret the reply in the issue's design context. Answer in its thread (`dispatch comment --reply-to <comment id>`; under an open ask whose next move is yours, such as the approval request you must revise or hand back, `--reply-to-ask <ask id> --turn agent`, since a default-turn reply hands that request back to the human and a corrected `--summary` is then refused), then adjust the plan or relay it via `envoy_publish` to the responsible worker's role token; scope and product decisions remain with you. |

package/dist/skills/legion-worker/SKILL.md

@@ -118,9 +118,12 @@ turn, including one an Envoy question starts: you are kept alive to answer quest
 editing. Do not create new commits, run `jj -R "$LEGION_WORKSPACE" new`, or touch tracked files
 once your own handoff is committed and pushed — a code change belongs to
 whichever phase is active now. The same holds once the Go daemon has taken your phase back without
-your completion: CI settling red while you tested, or reviewed a round you had not completed,
-moves the issue to `implementing` and interrupts your turn, and the implementer starts only once
-that turn has ended. Do not resume the interrupted work afterward.
+your completion: CI settling red while you tested, reviewed a round you had not completed, or
+built READY, moves the issue to `implementing` and interrupts your turn, and the implementer starts
+only once that turn has ended. Do not resume the interrupted work afterward. From retro the
+issue moves the same way with nothing interrupted: you are the implementer, handed the implementing
+task once your turn ends; a retro completion started after the move is refused, and one in flight
+when the red lands can be taken as your implementing completion, caught by the tester's CI read.
 
 On every start, and especially after revival or re-creation, read the issue and then the
 committed predecessor handoffs in lifecycle order, with the `read` tool from
@@ -437,8 +440,8 @@ record of this issue's active phase. Do not add pipeline labels, run a controlle
 invent a different completion protocol — this is the whole contract.
 
 A reviewer's phase ends with its completion, not with its review; the order of a review round
-(the handoff push; for an approval, CI settled green at that head; the review of that head; then
-the completion) is in `skill://legion-worker/references/merge-gate.md`.
+(the read of the code commit's checks on GitHub; the handoff push; the review of the head that
+push made; then the completion) is in `skill://legion-worker/references/merge-gate.md`.
 
 **A refused completion is information, not a retry loop.** The daemon attributes your report to
 the run whose task you took, and answers with what it found. What each answer carries, and what to

package/dist/skills/legion-worker/references/merge-gate.md

@@ -20,7 +20,33 @@ the head voids it.
 - The reviewer verifies the `CI`, `Threads`, and `E2E` facts against GitHub directly —
   never from a handoff — then runs `task(agent="thermonuclear-deep-review")` and
   `task(agent="thermonuclear-code-quality")` once at that head — the head the round reviews —
-  and records the verdict.
+  and records the verdict. The `CI` fact is the checks that stand for the code under review:
+  those GitHub ran for the newest push of the branch that started `pull_request` workflows, when
+  every commit above that push's head changes only `.legion/` (a push that changes only
+  `.legion/` carries `skip-checks: true`, so GitHub runs no workflow for it). With `<o>/<r>`,
+  `<n>`, `<base>`, `<headRefName>` and `<headRefOid>` from
+  `gh pr view <n> --json baseRefName,headRefOid,headRefName`, four reads. The required set, from
+  the base branch's rulesets
+  (`gh api repos/<o>/<r>/rules/branches/<base> --jq '.[] | select(.type=="required_status_checks") | .parameters.required_status_checks[].context'`)
+  and its branch protection, when it has any
+  (`gh api repos/<o>/<r>/branches/<base> --jq '.protection.required_status_checks.checks[].context'`);
+  a read GitHub refuses is reported to the architect, never guessed. The CI head, the head of the
+  branch's newest `pull_request` run
+  (`gh api 'repos/<o>/<r>/actions/runs?branch=<headRefName>&event=pull_request&per_page=30' --jq '.workflow_runs[0].head_sha'`,
+  newest first); the PR body's `CI:` line names runs at that same commit
+  (`gh run view <run-id> --json headSha,status,conclusion`), or the line is stale and the review
+  says so. That commit's check-runs
+  (`gh api repos/<o>/<r>/commits/<ci head>/check-runs --paginate --jq '.check_runs[] | [.name, .status, .conclusion] | @tsv'`):
+  every required name present, `completed` and `success` (GitHub counts `neutral` and `skipped`
+  as passing for a required check). And the compare proving only `.legion/` changed since
+  (`gh api repos/<o>/<r>/compare/<ci head>...<headRefOid> --jq '[.files[].filename] | all(startswith(".legion/"))'`
+  prints `true`; `false` means code was pushed since CI ran, so wait for the new push's runs and
+  read the CI head again). A required check `queued` or `in_progress`: wait. One `completed` as
+  `cancelled`, or absent: `gh run rerun <run-id>` once, then wait; when nothing will run it (a
+  check only a commit status reports, a workflow another repository defines), tell the architect
+  and do not approve. `gh pr checks <n>` is not the read: it reads only the current head, which
+  at a handoff head shows only the `pr-title` runs the review events start (measured on
+  sjawhar/legion#1944 at 0220b94fc2 on 2026-10-14).
   Approval is refused while either `E2E (implementer)` or `E2E (tester)` is missing: `REQUEST_CHANGES` naming the missing line.
   Skip the `Thermo` line entirely on a docs-only PR. Submit **one review per round** —
   `REQUEST_CHANGES` when any correctness finding stands, otherwise `APPROVE` of the head you
@@ -42,25 +68,17 @@ the head voids it.
   when every thread is settled enough to approve, and resolving one never gates your approval.
 
 A reviewer's phase ends with its completion, not with its review. Every round writes a handoff
-and takes this order: write, commit and push the handoff; submit the review of the head that push
-made, by its SHA; then complete. An approval waits for the CI verdict to settle green at that head
-before you submit it, since an approval stands only on green checks and GitHub can dismiss one
-once the head moves, and a verdict that settles red there makes the round's decision a request for
-changes naming the failing checks, unless only review workflows the project declares
-(`projects.<KEY>.review_workflows`) are red on their own findings: then you answer their threads,
-name the ones you accepted to the implementer, who resolves them with its own `gh` as the pull
-request's author, and re-run the failed run once they are resolved, as your role prompt says, and
-approve once it passes. Any other red required workflow is a failing check like any other. A
-request for changes does not wait, since it stands whatever CI says and the issue leaves
-reviewing with it. The verdict is of the checks and workflows the base branch requires, the set
-READY checks: red when one of them failed, and never red for a check the base branch does not
-require. A required check that was cancelled, or that the head's checks
-settled without, leaves no verdict until a later settlement decides it, since a run can be
-cancelled or not yet queued when the head settles; a required workflow's run on the head that is
-still going or has not happened leaves none either. A review of a head the handoff push
-then replaces names a head the pull request no longer has. The daemon moves the issue
-once both are in — the decision GitHub reports and your completion, in either order — so a
-review posted without a completion leaves the issue in reviewing until you finish.
+and takes this order: read CI as above; write, commit and push the handoff; submit the review of
+the head that push made, by its SHA; then complete. A red at the code is a `REQUEST_CHANGES`
+naming the check, never an approval. A request for changes does not wait, since it stands
+whatever CI says and the issue leaves reviewing with it. The approval waits on nothing at the
+handoff commit either: it ends the round whatever CI says there, since the round reads no CI
+verdict, and a red the daemon reads later — at that commit or any above it — is the code's red
+and resumes the implementer from wherever the issue is (reviewing, retro or merging) without the
+reviewer. A review of a head the handoff push then replaces names a head the pull request no
+longer has. The daemon moves the issue once both are in — the decision GitHub reports and your
+completion, in either order — so a review posted without a completion leaves the issue in
+reviewing until you finish.
 
 ## Retro
 

package/dist/skills/legion-worker/references/review-threads.md

@@ -67,11 +67,8 @@ opened that is none of Legion's role Apps, with one reply in your own words. A b
 cannot accept becomes your own: say what stands and request changes. Approve once each of those
 threads carries your answer and no finding stands, read in `gh api graphql` — quote those answers
 in the approval. Your approval never waits on a resolution: resolution is the pull request author's
-App's, except when a review workflow the project declares (`projects.<KEY>.review_workflows`) is
-red on its findings. Such a workflow starts again only on a push, so neither a reply nor a
-resolution re-runs it, and it passes on a re-run only once its threads are resolved: answer its
-threads, name the ones you accepted to the implementer with `envoy_publish` to its role topic, and
-read the listing above until each shows `isResolved` true before you push your handoff, so the run
-that push starts reads the threads as the implementer left them; then re-run the failed run once,
-as your role prompt says, before you approve. The merger resolves nothing: READY requires no thread
-state beyond what your approval already judged.
+App's. A review bot that is red while a thread it opened still stands is CI like any other, and
+you re-run nothing: when the base branch requires its check, that red sends the work back to the
+implementer, who answers or fixes each of the bot's threads, resolves them with its own `gh` (the
+ones you named to it, above, and its own), and pushes, and the bot runs again on that push. The
+merger resolves nothing: READY requires no thread state beyond what your approval already judged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion",
-  "version": "9.8.2",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {