@sleds/cli 0.1.46 → 0.1.47

package/dist/sleds.mjs

@@ -295,7 +295,6 @@ var init_sledSort = __esm(() => {
 function slugify(text, max = 63) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max);
 }
-
 // ../../packages/shared/src/seat/agents.ts
 var init_agents = () => {};
 // ../../packages/shared/src/seat/burn.ts
@@ -2086,7 +2085,7 @@ ${state}`)}, fillcolor="${fill}", color="${border}"${style}];`);
 `)}
 `;
 }
-var ROUTE_APPROACH_MAX = 2000, PLAN_APPROACH_MAX = 1200, PLAN_LIST_MAX = 8, PLAN_LINE_MAX = 240, CONTROL, MAX_NODES = 24, DEPTH_WARN = 4, norm2 = (s) => s.trim().toUpperCase(), AREA_ROOTS, NOT_AREAS, sameRepo = (a, b) => a.length === 0 || b.length === 0 || a.some((r) => b.includes(r)), DOT_COLORS, ROUTE_DRAFT_RULE = "Draft the route: PR-sized nodes, file-disjoint where they run in parallel, each with a title, the files or areas it touches, the repo, and the nodes it waits on (by key: A, B, C…). Prefer wide waves over chains deeper than four. Make the tough calls once, so each node's session follows them: an `approach` paragraph for the whole route, and on each node a `plan` — its approach, what it `provides` that later nodes rely on (names, shapes, files), what it `expects` from the nodes it waits on, and the `doneChecks` that say it landed. Show the graph and the plans as text and ask for a yes; file nothing before it. An item with children takes no nodes: its children are the work, and their order lives in their blockedBy. Then `route {q, approach, nodes: [{key, title, touches, repos, blockedBy, plan: {approach, provides, expects, doneChecks}}], confirm: true}`.";
+var ROUTE_APPROACH_MAX = 2000, PLAN_APPROACH_MAX = 1200, PLAN_LIST_MAX = 8, PLAN_LINE_MAX = 240, CONTROL, MAX_NODES = 24, DEPTH_WARN = 4, norm2 = (s) => s.trim().toUpperCase(), AREA_ROOTS, NOT_AREAS, sameRepo = (a, b) => a.length === 0 || b.length === 0 || a.some((r) => b.includes(r)), DOT_COLORS, ROUTE_DRAFT_RULE = "Plan the route: PR-sized nodes, file-disjoint where they run in parallel, each with a title, the files or areas it touches, the repo, and the nodes it waits on (by key: A, B, C…). Prefer wide waves over chains deeper than four. Make the tough calls once, so each node's session follows them: an `approach` paragraph for the whole route, and on each node a `plan` — its approach, what it `provides` that later nodes rely on (names, shapes, files), what it `expects` from the nodes it waits on, and the `doneChecks` that say it landed. Show the graph and the plans as text and ask for a yes; file nothing before it. An item with children takes no nodes: its children are the work, and their order lives in their blockedBy. Then `route {q, approach, nodes: [{key, title, touches, repos, blockedBy, plan: {approach, provides, expects, doneChecks}}], confirm: true}`.";
 var init_route = __esm(() => {
   CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
   AREA_ROOTS = new Set(["apps", "packages", "services", "libs", "crates", "modules"]);
@@ -2598,7 +2597,11 @@ function failureText(e, timeoutMs) {
 function fetchClient(o) {
   const fetchFn = o.fetchFn ?? fetch;
   const base = o.proxyUrl.replace(/\/+$/, "");
-  const headers = { "content-type": "application/json", authorization: `Bearer ${o.token}` };
+  const headers = {
+    "content-type": "application/json",
+    authorization: `Bearer ${o.token}`,
+    ...o.version ? { "x-sleds-version": o.version } : {}
+  };
   const timeout = () => AbortSignal.timeout(o.timeoutMs ?? MCP_TIMEOUT_MS);
   return {
     async post(path, body) {
@@ -3411,7 +3414,7 @@ An engine (or you) takes a ready node with \`sled {take: "${key}/<key>"}\`; Run
   }
   if (nodes.length > 0)
     return {
-      text: "Show the person the graph as text and ask for a yes; then call route again with the same nodes and confirm: true. With nobody to ask (a drafting session), call again with propose: true instead.",
+      text: "Show the person the graph as text and ask for a yes; then call route again with the same nodes and confirm: true. With nobody to ask (a planning session), call again with propose: true instead.",
       isError: true
     };
   const r = await ctx.client.get(`/proxy/route?q=${encodeURIComponent(q)}`);
@@ -3425,7 +3428,7 @@ An engine (or you) takes a ready node with \`sled {take: "${key}/<key>"}\`; Run
     const key = str5(r.key) ?? q;
     const n = Array.isArray(proposed.nodes) ? proposed.nodes.length : 0;
     return {
-      text: `${proposalText(str5(r.text)) || `${key} · route drafted, not filed — ${n} nodes`}
+      text: `${proposalText(str5(r.text)) || `${key} · route planned, not filed — ${n} nodes`}
 
 ${PROPOSED_NEXT(key)}`,
       structured: { key, nodes: 0, proposed: n }
@@ -4434,7 +4437,7 @@ async function handleLine(line, ctx) {
       return isNotification ? null : errorResponse(id, -32601, `method not found: ${method}`);
   }
 }
-var PROTOCOL_VERSION = "2025-06-18", SERVER_INFO, SERVER_INSTRUCTIONS, MCP_TIMEOUT_MS = 5000, sourceSchema, specSchema, TOOLS, VIEW_TOOLS, NOT_SET_UP, UNREACHABLE, isObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v), num3 = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined, str5 = (v) => typeof v === "string" ? v : undefined, errorMessage = (j) => isObject4(j?.error) ? str5(j.error.message) : str5(j?.error), proposalText = (t) => (t ?? "").replace(/\n*Nothing runs until a person says yes:[^\n]*$/, ""), PROPOSED_NEXT = (key) => `Nothing runs until a person approves it: Approve in the SLEDS app or on the item page, or \`sleds route approve ${key}\`. If you are a drafting session, stop here.`, strList = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : undefined, RELATION_HOWS, UI_RESOURCES, response = (id, result) => JSON.stringify({ jsonrpc: "2.0", id, result }), errorResponse = (id, code, message) => JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
+var PROTOCOL_VERSION = "2025-06-18", SERVER_INFO, SERVER_INSTRUCTIONS, MCP_TIMEOUT_MS = 5000, sourceSchema, specSchema, TOOLS, VIEW_TOOLS, NOT_SET_UP, UNREACHABLE, isObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v), num3 = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined, str5 = (v) => typeof v === "string" ? v : undefined, errorMessage = (j) => isObject4(j?.error) ? str5(j.error.message) : str5(j?.error), proposalText = (t) => (t ?? "").replace(/\n*Nothing runs until a person says yes:[^\n]*$/, ""), PROPOSED_NEXT = (key) => `Nothing runs until a person approves it: Approve in the SLEDS app or on the item page, or \`sleds route approve ${key}\`. If you are a planning session, stop here.`, strList = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : undefined, RELATION_HOWS, UI_RESOURCES, response = (id, result) => JSON.stringify({ jsonrpc: "2.0", id, result }), errorResponse = (id, code, message) => JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
 var init_server = __esm(() => {
   init_worth();
   init_intake();
@@ -4722,7 +4725,7 @@ var init_server = __esm(() => {
     },
     {
       name: "route",
-      description: "The route — an item's internal order as PR-sized nodes with blockers (spec 26). With only `q`: the route as filed (each node's state, what it waits on, the ready set, where each run can be watched), or, when none is filed, the pack and the drafting rule so you draft one. Drafting: PR-sized nodes, file-disjoint where they run in parallel, each with a title, the files or areas it touches, the repo, and the nodes it waits on by key (A, B, C…); prefer wide waves over chains deeper than four. Make the tough calls once: an `approach` for the route and a `plan` on each node (its approach, what it provides to later nodes, what it expects from the nodes it waits on, its done-checks), so each node's session follows them instead of re-planning. Show the graph and the plans as text and ask for a yes; file nothing before it. Then call again with `nodes` and `confirm: true`. An item with children is refused nodes — its children are the work: set their order with blockedBy on them. The item lands only when every child has landed. Re-drafting shows what changed; a node with a run or a PR is never removed. Ready is computed from landed blockers, never set. With nobody to ask (a drafting session an engine started, spec 26 §5.1): call with `nodes` and `propose: true` instead — the route is held on the item for a person's yes and nothing is filed; then stop. A read of an item with a proposal shows it as drafted, not filed.",
+      description: "The route — an item's internal order as PR-sized nodes with blockers (spec 26). With only `q`: the route as filed (each node's state, what it waits on, the ready set, where each run can be watched), or, when none is filed, the pack and the planning rule so you plan one (Plan route — the AI step; a person's hand editor on the item page is Edit route). Planning: PR-sized nodes, file-disjoint where they run in parallel, each with a title, the files or areas it touches, the repo, and the nodes it waits on by key (A, B, C…); prefer wide waves over chains deeper than four. Make the tough calls once: an `approach` for the route and a `plan` on each node (its approach, what it provides to later nodes, what it expects from the nodes it waits on, its done-checks), so each node's session follows them instead of re-planning. Show the graph and the plans as text and ask for a yes; file nothing before it. Then call again with `nodes` and `confirm: true`. An item with children is refused nodes — its children are the work: set their order with blockedBy on them. The item lands only when every child has landed. Planning it again shows what changed; a node with a run or a PR is never removed. Ready is computed from landed blockers, never set. With nobody to ask (a planning session an engine started, spec 26 §5.1): call with `nodes` and `propose: true` instead — the route is held on the item for a person's yes and nothing is filed; then stop. A read of an item with a proposal shows it as planned, not filed.",
       inputSchema: {
         type: "object",
         properties: {
@@ -4733,7 +4736,7 @@ var init_server = __esm(() => {
           },
           nodes: {
             type: "array",
-            description: "The drafted nodes, in route order. Keys are minted (A, B, C…) when absent.",
+            description: "The planned nodes, in route order. Keys are minted (A, B, C…) when absent.",
             items: {
               type: "object",
               properties: {
@@ -4789,7 +4792,7 @@ var init_server = __esm(() => {
           },
           propose: {
             type: "boolean",
-            description: "true holds the nodes on the item as a drafted route, waiting for a person's yes; nothing is filed. For a drafting session with nobody at the keyboard — with a person here, ask and confirm instead."
+            description: "true holds the nodes on the item as a planned route, waiting for a person's yes; nothing is filed. For a planning session with nobody at the keyboard — with a person here, ask and confirm instead."
           },
           disjoint: {
             type: "boolean",
@@ -6455,11 +6458,15 @@ var init_flags = () => {};
 // ../../packages/shared/src/sentry/sentry.ts
 var init_sentry = () => {};
 
+// ../../packages/shared/src/pack/outside.ts
+var init_outside = () => {};
+
 // ../../packages/shared/src/pack/pack.ts
 var init_pack = __esm(() => {
   init_flags();
   init_profile();
   init_sentry();
+  init_outside();
   init_setup();
 });
 // ../../packages/shared/src/pack/prHeader.ts
@@ -6471,6 +6478,7 @@ var init_pack2 = __esm(() => {
   init_setup();
   init_pack();
   init_prHeader();
+  init_outside();
 });
 
 // ../../packages/shared/src/deploys/deploys.ts
@@ -8588,8 +8596,8 @@ var init_seat = __esm(() => {
 });
 
 // src/index.ts
-import { realpathSync as realpathSync3 } from "fs";
-import { homedir, platform as platform3 } from "os";
+import { existsSync as existsSync31, realpathSync as realpathSync3 } from "fs";
+import { homedir as homedir3, platform as platform3 } from "os";
 import { fileURLToPath } from "url";
 
 // ../../packages/shared/src/index.ts
@@ -9930,7 +9938,7 @@ import {
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join20, resolve as resolve9 } from "node:path";
+import { join as join21, resolve as resolve9 } from "node:path";
 
 // src/agentMcp.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
@@ -10387,20 +10395,37 @@ import { basename as basename3, dirname as dirname10, join as join12 } from "nod
 
 // src/runners/sandbox.ts
 var absRule = (dir) => `/${dir.replace(/\/+$/, "")}/**`;
+var gitDenyWrite = (gitCommonDir) => {
+  const g = gitCommonDir.replace(/\/+$/, "");
+  return {
+    files: [`${g}/config`, `${g}/config.worktree`, `${g}/worktrees/*/config.worktree`],
+    dirs: [`${g}/hooks`]
+  };
+};
 var sandboxSettings = (o) => {
   const domains = [...new Set(o.allow ?? [])];
+  const git = gitDenyWrite(o.gitCommonDir);
   return {
     sandbox: {
       enabled: true,
       allowUnsandboxedCommands: false,
       failIfUnavailable: true,
-      filesystem: { denyRead: [...o.denyRead], allowWrite: [o.gitCommonDir] },
+      filesystem: {
+        denyRead: [...o.denyRead],
+        allowWrite: [o.gitCommonDir],
+        denyWrite: [...git.files, ...git.dirs]
+      },
       network: { allowedDomains: domains, strictAllowlist: true }
     },
     permissions: {
-      deny: o.denyRead.flatMap((d) => [`Read(${absRule(d)})`, `Edit(${absRule(d)})`]),
+      deny: [
+        ...o.denyRead.flatMap((d) => [`Read(${absRule(d)})`, `Edit(${absRule(d)})`]),
+        ...git.files.map((f) => `Edit(/${f})`),
+        ...git.dirs.map((d) => `Edit(${absRule(d)})`)
+      ],
       allow: [`Edit(${absRule(o.gitCommonDir)})`, ...domains.map((d) => `WebFetch(domain:${d})`)]
-    }
+    },
+    env: { CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1" }
   };
 };
 var sandboxAgentKind = (agent) => {
@@ -11131,7 +11156,7 @@ function beatBody(state, flags, host = {}, cap = {}) {
     name: flags.name,
     os: host.os ?? process.platform,
     runner: flags.runner,
-    version: host.version ?? "0.1.46" ?? "dev",
+    version: host.version ?? "0.1.47" ?? "dev",
     running: live.length,
     items: live.slice(0, BEAT_ITEMS).map((r) => `${r.item}/${r.node}`),
     ...cap.atOnce !== undefined ? { atOnce: cap.atOnce } : {},
@@ -11148,13 +11173,28 @@ function beatBody(state, flags, host = {}, cap = {}) {
     } : {}
   };
 }
+var versionOrNull = (v) => v === null || typeof v === "string";
+function updateOf(v) {
+  if (typeof v !== "object" || v === null)
+    return;
+  const { target, minimum, manifestUrl } = v;
+  return versionOrNull(target) && versionOrNull(minimum) && versionOrNull(manifestUrl) ? { target, minimum, manifestUrl } : undefined;
+}
 async function postBeat(client, body) {
   try {
     const r = await client.postFull("/proxy/engine/beat", { ...body });
-    if (r?.status === 200 && r.json?.ok === true)
-      return { ok: true };
+    if (r?.status === 200 && r.json?.ok === true) {
+      const update = updateOf(r.json.update);
+      return update ? { ok: true, update } : { ok: true };
+    }
     const error = r?.json?.error;
-    return r?.status === 409 && typeof error === "string" ? { ok: false, refused: error } : { ok: false };
+    if (typeof error !== "string")
+      return { ok: false };
+    if (r?.status === 409)
+      return { ok: false, refused: error };
+    if (r?.status === 426)
+      return { ok: false, refused: error, below: true };
+    return { ok: false };
   } catch {
     return { ok: false };
   }
@@ -12207,6 +12247,18 @@ function groupOf(j, item) {
   const title = str6(j.title);
   return title ? { key, title } : null;
 }
+function runOf(v) {
+  if (!Array.isArray(v))
+    return;
+  return v.filter(isObject8).flatMap((x) => {
+    const repo = str6(x.repo)?.trim();
+    if (!repo)
+      return [];
+    const install = str6(x.install)?.trim();
+    const gate = str6(x.gate)?.trim();
+    return [{ repo, ...install ? { install } : {}, ...gate ? { gate } : {} }];
+  });
+}
 function sameEngine(a, b) {
   const bare = (s) => s.trim().replace(/^engine:/, "").toLowerCase();
   return bare(a) === bare(b);
@@ -12258,14 +12310,14 @@ var PROFILE_TEXT = [
   "reposDir",
   "engine"
 ];
-var SHELL_TEXT = ["agent", "launcher"];
+var SHELL_TEXT = ["agent", "launcher", "mode"];
 function profileOf(r) {
   if (!r || r.ok === false || !isObject8(r.profile))
     return null;
   const p = r.profile;
   const member = isObject8(r.member) ? r.member : {};
   const out = {
-    pickup: p.pickup === "auto" ? "auto" : "approve",
+    pickup: p.pickup === "auto" && member.pickup === "auto" ? "auto" : "approve",
     ...HOLD_DEFAULTS2,
     holdOff: p.holdOff === true
   };
@@ -12284,8 +12336,8 @@ function profileOf(r) {
     else if (str6(p[k])?.trim())
       notYours.push(k);
   }
-  if (notYours.length)
-    out.notYours = notYours;
+  if (p.pickup === "auto" && out.pickup !== "auto")
+    notYours.push("pickup");
   const atOnce = num5(p.atOnce);
   if (atOnce !== undefined && atOnce >= 1)
     out.atOnce = Math.round(atOnce);
@@ -12304,13 +12356,17 @@ function profileOf(r) {
     if (names.length)
       out.mcpAllow = names;
   }
-  if (typeof p.sandbox === "boolean")
+  if (p.sandbox === true || p.sandbox === false && member.sandbox === false)
     out.sandbox = p.sandbox;
+  else if (p.sandbox === false)
+    notYours.push("sandbox");
   if (Array.isArray(p.sandboxAllow)) {
     const hosts = p.sandboxAllow.filter((x) => typeof x === "string" && x.trim() !== "");
     if (hosts.length)
       out.sandboxAllow = hosts;
   }
+  if (notYours.length)
+    out.notYours = notYours;
   return out;
 }
 async function readProfile(client) {
@@ -12436,7 +12492,7 @@ function sledsSource(client, o) {
       ...o.leaseMin !== undefined ? { leaseMin: o.leaseMin } : {}
     });
     if (!r || r.status >= 300 || !r.json || r.json.ok === false) {
-      o.log?.(`${pending ? `${item}: could not claim the re-draft` : started ? `${item}: Start could not claim it for drafting` : `Pickup: Auto could not claim ${item} for drafting`} — ${r ? serverMessage(r) : UNREACHABLE2}`);
+      o.log?.(`${pending ? `${item}: could not claim it to plan its route again` : started ? `${item}: Start could not claim it for planning` : `Pickup: Auto could not claim ${item} for planning`} — ${r ? serverMessage(r) : UNREACHABLE2}`);
       return null;
     }
     const j = r.json;
@@ -12458,7 +12514,7 @@ function sledsSource(client, o) {
         route: routeText(brief, isObject8(row.route) ? row.route.states : null)
       };
     }
-    o.log?.(redraft ? `${item}: re-drafting the route from ${redraft.by}'s answer — it waits for a yes` : `${started ? `${item}: Start` : "Pickup: Auto"} is drafting ${started ? "its" : `${item}'s`} route first (${why.join(", ")}) — it waits for a yes`);
+    o.log?.(redraft ? `${item}: planning the route again from ${redraft.by}'s answer — it waits for a yes` : `${started ? `${item}: Start` : "Pickup: Auto"} is planning ${started ? "its" : `${item}'s`} route first (${why.join(", ")}) — it waits for a yes`);
     const leaseUntil = num5(j.leaseUntil);
     const claim = {
       item,
@@ -12560,6 +12616,7 @@ function sledsSource(client, o) {
       }
       const leaseUntil = num5(hit.leaseUntil);
       const runToken = str6(hit.runToken) ?? (taken.length === 1 ? str6(r.json?.runToken) : undefined);
+      const run = runOf(hit.run);
       const claim = {
         item,
         node: str6(hit.node) ?? node,
@@ -12571,7 +12628,8 @@ function sledsSource(client, o) {
         ...t.seatId ? { seatId: t.seatId } : {},
         ...str6(hit.answer) ? { answer: str6(hit.answer) } : {},
         ...runToken ? { runToken } : {},
-        ...group ? { group } : {}
+        ...group ? { group } : {},
+        ...run ? { run } : {}
       };
       return { ok: true, claim };
     },
@@ -13091,17 +13149,20 @@ var MANAGERS = new Set(["pnpm", "npm", "yarn", "bun"]);
 var INSTALL_VERBS = new Set(["install", "i", "ci"]);
 function installArgv(command) {
   const line = command?.trim().replace(/^`|`$/g, "") ?? "";
-  if (!line || /[;&|<>$`()]/.test(line))
+  if (!line || /[;&|<>$`()\n]/.test(line))
     return null;
   const argv = shellWords(line);
   const [tool, verb] = argv;
   if (!tool || !MANAGERS.has(tool))
     return null;
-  if (tool !== "yarn" && (!verb || !INSTALL_VERBS.has(verb)))
-    return null;
-  if (tool === "yarn" && verb !== undefined && verb !== "install" && !verb.startsWith("-"))
+  let rest;
+  if (tool === "yarn")
+    rest = argv.slice(verb === "install" ? 2 : 1);
+  else if (verb && INSTALL_VERBS.has(verb))
+    rest = argv.slice(2);
+  else
     return null;
-  return argv;
+  return rest.every((a) => a.startsWith("-")) ? argv : null;
 }
 function lockfileInstall(path, exists) {
   if (exists(join15(path, "pnpm-lock.yaml")))
@@ -13114,57 +13175,59 @@ function lockfileInstall(path, exists) {
     return ["npm", "ci"];
   return null;
 }
-function packInstallOf(pack, repo) {
-  let section = null;
-  let first;
-  const want = repo?.trim().toLowerCase();
-  for (const line of pack.split(`
-`)) {
-    const h = line.match(/^###\s+(.+?)\s*$/);
-    if (h) {
-      section = h[1].toLowerCase();
-      continue;
-    }
-    const m = line.match(/^\s*-\s*Install:\s*(.+?)\s*$/i);
-    if (!m?.[1])
-      continue;
-    if (want && section === want)
-      return m[1];
-    first ??= m[1];
-  }
-  return first;
-}
-function packGateOf(pack, repo) {
-  let inDone = false;
-  let first;
-  const want = repo?.trim().toLowerCase();
-  for (const line of pack.split(`
-`)) {
-    if (/^##\s/.test(line)) {
-      inDone = /^##\s+4\./.test(line);
-      continue;
-    }
-    if (!inDone)
-      continue;
-    const m = line.match(/^\s*-\s*([^:`]+?):\s*`(.+)`\s*$/);
-    if (!m?.[1] || !m[2])
-      continue;
-    const name = m[1].trim().toLowerCase();
-    if (name === "done means" || name.startsWith("try it"))
-      continue;
-    if (want && name === want)
-      return m[2];
-    first ??= m[2];
-  }
-  return first;
+var INTERPRETERS = new Set([
+  "node",
+  "bun",
+  "deno",
+  "python",
+  "python3",
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "npx",
+  "pnpx",
+  "bunx",
+  "dlx",
+  "env",
+  "eval",
+  "exec",
+  "ruby",
+  "perl",
+  "sudo"
+]);
+function runsInterpreter(part) {
+  const [first = "", second, third] = part.split(/\s+/);
+  const tool = first.split("/").pop() ?? first;
+  if (tool.includes("=") || INTERPRETERS.has(tool))
+    return true;
+  if (!MANAGERS.has(tool))
+    return false;
+  if (second === "dlx" || second === "x")
+    return true;
+  return second === "exec" && third !== undefined && INTERPRETERS.has(third.split("/").pop() ?? "");
 }
 function gateAllowRules(gate) {
   const whole = gate?.trim();
   if (!whole)
     return [];
+  if (/[$`()<>|&\n]/.test(whole.replace(/&&|\|\|/g, " ")))
+    return [];
   const parts = whole.split(/&&|\|\||;/).map((p) => p.trim()).filter(Boolean);
+  if (parts.some(runsInterpreter))
+    return [];
   return [...new Set([whole, ...parts])].map((c) => `Bash(${c})`);
 }
+function claimRunOf(run, repo) {
+  if (!run?.length)
+    return {};
+  const want = repo?.trim().toLowerCase();
+  const hit = want && run.find((r) => r.repo.trim().toLowerCase() === want) || run[0];
+  return {
+    ...hit?.install ? { install: hit.install } : {},
+    ...hit?.gate ? { gate: hit.gate } : {}
+  };
+}
 function ensureInstalled(exec, path, fs, o = {}) {
   if (!fs.exists(join15(path, "package.json")) || fs.exists(join15(path, "node_modules")))
     return null;
@@ -13722,10 +13785,10 @@ async function tickOnce(d) {
     let mcpConfig;
     try {
       const base = d.defaultBranch(d.exec, repoPath);
-      const worktree = d.runner.makesWorktree ? repoPath : d.ensureWorktree(d.exec, repoPath, branch, worktreePath(repoPath, name), base, packInstallOf(claim.pack, claim.repos[0])) ?? worktreePath(repoPath, name);
+      const { install, gate } = claimRunOf(claim.run, claim.repos[0]);
+      const worktree = d.runner.makesWorktree ? repoPath : d.ensureWorktree(d.exec, repoPath, branch, worktreePath(repoPath, name), base, install) ?? worktreePath(repoPath, name);
       const prTitle = d.prTitleOf?.(claim);
       mcpConfig = engineMcpConfigFor(d, name, claim.runToken, at, worktree);
-      const gate = packGateOf(claim.pack, claim.repos[0]);
       const allow = gateAllowRules(gate);
       const prompt = nodePrompt({
         claim,
@@ -14699,7 +14762,7 @@ async function startDraft(d, claim, why, state, started, finished) {
   };
   state.runs.push(run);
   d.writeState(state);
-  d.log(claim.redraft ? `${at}: re-drafting the route from ${claim.redraft.by}'s answer — it waits for a yes` : `${at}: drafting a route${why.length ? ` (${why.join(", ")})` : ""} — it waits for a yes, unless it is one node inside the brief's touches`);
+  d.log(claim.redraft ? `${at}: planning the route again from ${claim.redraft.by}'s answer — it waits for a yes` : `${at}: planning the route${why.length ? ` (${why.join(", ")})` : ""} — it waits for a yes, unless it is one node inside the brief's touches`);
   try {
     await d.source.heartbeat(claim, watch);
   } catch (e) {
@@ -14716,7 +14779,7 @@ async function settleDraft(d, run, claim, runner, finished) {
     return true;
   }
   if (beat === "done") {
-    d.log(`${ref(run)}: route drafted — it waits for a person's yes`);
+    d.log(`${ref(run)}: route planned — it waits for a person's yes`);
     endDraft(d, run, runner);
     return false;
   }
@@ -14730,7 +14793,7 @@ async function settleDraft(d, run, claim, runner, finished) {
     return false;
   }
   if (beat === "lost") {
-    d.log(`${ref(run)}: the drafting claim was lost — stopping the session`);
+    d.log(`${ref(run)}: the planning claim was lost — stopping the session`);
     endDraft(d, run, runner);
     return false;
   }
@@ -14746,7 +14809,7 @@ async function settleDraft(d, run, claim, runner, finished) {
   let log = "";
   if (status === "exited") {
     try {
-      log = runner.read(run.handle) || "The drafting session exited with no route proposed.";
+      log = runner.read(run.handle) || "The planning session exited with no route proposed.";
     } catch (e) {
       log = `(the session's output could not be read: ${message(e)})`;
     }
@@ -15689,6 +15752,18 @@ init_machine();
 init_state();
 init_meter();
 
+// src/runners/gitGuard.ts
+import { basename as basename4 } from "node:path";
+var GIT_GUARD_ENV = {
+  GIT_CONFIG_COUNT: "2",
+  GIT_CONFIG_KEY_0: "core.fsmonitor",
+  GIT_CONFIG_VALUE_0: "false",
+  GIT_CONFIG_KEY_1: "core.hooksPath",
+  GIT_CONFIG_VALUE_1: "/dev/null"
+};
+var GUARDED = new Set(["git", "gh"]);
+var guardGit = (exec) => (cmd, args, o) => GUARDED.has(basename4(cmd)) ? exec(cmd, args, { ...o, env: { ...o?.env, ...GIT_GUARD_ENV } }) : exec(cmd, args, o);
+
 // src/runners/command.ts
 var expandCommandTemplate = (template, o) => {
   const values = {
@@ -16630,7 +16705,7 @@ function flagsFromProfile(flags, given, profile, home) {
   const used = [];
   const skipped = [];
   for (const k of profile.notYours ?? [])
-    skipped.push(`${k} (the workspace default — the engine runs only one you set yourself)`);
+    skipped.push(`${k} (the workspace default — the engine takes it only from your own profile)`);
   if (profile.atOnce !== undefined && !has("at-once")) {
     out.atOnce = profile.atOnce;
     used.push(`at-once ${profile.atOnce}`);
@@ -16794,7 +16869,11 @@ function engineClient(o, org) {
   const env = o.env ?? process.env;
   const src = meterSource(o.home, undefined, { ...org ? { flag: org } : {}, env });
   if (src)
-    return fetchClient({ ...src, timeoutMs: ENGINE_TIMEOUT_MS });
+    return fetchClient({
+      ...src,
+      timeoutMs: ENGINE_TIMEOUT_MS,
+      version: "0.1.47"
+    });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
     return {
@@ -16858,7 +16937,7 @@ function engineToken(o, org) {
 }
 var withToken = (token, now) => token ? { token, tokenNow: now } : {};
 function engineDeps(o, flags, source, runner, stateName) {
-  const exec = o.exec ?? defaultExec;
+  const exec = guardGit(o.exec ?? defaultExec);
   const cwd = o.cwd ?? process.cwd();
   const exists = o.exists ?? realExists;
   const log = o.log ?? console.log;
@@ -16989,7 +17068,15 @@ function engineDeps(o, flags, source, runner, stateName) {
 function sandboxDenyRead(home, env) {
   return {
     dirs: [...new Set([configDir(home, env), join16(home, ".config", "sleds")])],
-    files: [...new Set([tokenPath(home, env), join16(home, ".sleds-token")])]
+    files: [
+      ...new Set([
+        tokenPath(home, env),
+        join16(home, ".sleds-token"),
+        settingsPath(home, env),
+        backupPath(home, env),
+        join16(claudeDir(home, env), "settings.local.json")
+      ])
+    ]
   };
 }
 function engineSandboxSettings(home, env, gitCommonDir, allow) {
@@ -17046,7 +17133,7 @@ async function driveEngine(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.46"
+    cliVersion: "0.1.47"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -17232,7 +17319,7 @@ async function drive(o, flags, deps, until, beat) {
 var SEAT_CHANGED_EXIT = 3;
 function engineRunner(o, flags) {
   const runnerFor = o.runnerFor ?? runnerFor2;
-  return runnerFor(flags.runner, o.exec ?? defaultExec, {
+  return runnerFor(flags.runner, guardGit(o.exec ?? defaultExec), {
     ...flags.runnerCmd ? { command: flags.runnerCmd } : {}
   });
 }
@@ -17319,7 +17406,7 @@ async function enginePauseCmd(o) {
     source = sledsSource(c, { engine, log });
   }
   const why = parsed.why ?? `paused on ${defaultEngineName(host)} (sleds engine pause)`;
-  const exec = o.exec ?? defaultExec;
+  const exec = guardGit(o.exec ?? defaultExec);
   const gone = new Set;
   for (const run of running) {
     const at = `${run.item}/${run.node}`;
@@ -17368,13 +17455,18 @@ import {
   writeFileSync as writeFileSync15
 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename4, dirname as dirname12, isAbsolute as isAbsolute2, join as join19 } from "node:path";
+import { basename as basename5, dirname as dirname12, isAbsolute as isAbsolute2, join as join20 } from "node:path";
 init_state();
 
+// src/runtime.ts
+import { homedir } from "node:os";
+import { join as join17, win32 } from "node:path";
+var sledsLink = (home = homedir(), platform = process.platform) => platform === "win32" ? win32.join(process.env.LOCALAPPDATA ?? win32.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join17(home, ".sleds", "bin", "sleds");
+
 // src/schedule.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync14, mkdirSync as mkdirSync13, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var REVERT_LABEL = "ai.sleds.revert";
 var defaultExec2 = (cmd, args) => {
   const r = spawnSync4(cmd, [...args], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
@@ -17382,7 +17474,7 @@ var defaultExec2 = (cmd, args) => {
     return { ok: false, stderr: r.error.message };
   return { ok: r.status === 0, stderr: r.stderr ?? "" };
 };
-var plistPath = (home) => join17(home, "Library", "LaunchAgents", `${REVERT_LABEL}.plist`);
+var plistPath = (home) => join18(home, "Library", "LaunchAgents", `${REVERT_LABEL}.plist`);
 var xmlEscape2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 var buildLaunchdPlist = (sledsArgv, deadline) => {
   const args = [...sledsArgv, "off"].map((a) => `    <string>${xmlEscape2(a)}</string>`).join(`
@@ -17421,7 +17513,7 @@ var scheduleRevert = (d, deadlineMs) => {
   if (d.platform === "darwin") {
     const p = plistPath(d.home);
     try {
-      mkdirSync13(join17(d.home, "Library", "LaunchAgents"), { recursive: true });
+      mkdirSync13(join18(d.home, "Library", "LaunchAgents"), { recursive: true });
       d.exec("launchctl", ["unload", p]);
       writeFileSync14(p, buildLaunchdPlist(d.sledsArgv, deadline));
       const r = d.exec("launchctl", ["load", p]);
@@ -17461,16 +17553,16 @@ var cancelRevert = (d, kind) => {
 };
 
 // src/commands/engineSystemd.ts
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var BOX_ENV_UNIT_PATH = "%h/.config/sleds/box.env";
 function boxEnvPath(home) {
-  return join18(home, ".config", "sleds", "box.env");
+  return join19(home, ".config", "sleds", "box.env");
 }
 function engineUnitDir(home) {
-  return join18(home, ".config", "systemd", "user");
+  return join19(home, ".config", "systemd", "user");
 }
 function engineUnitPath(home, label) {
-  return join18(engineUnitDir(home), `${label}.service`);
+  return join19(engineUnitDir(home), `${label}.service`);
 }
 function systemdQuote(s) {
   const body = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/%/g, "%%").replace(/\$/g, "$$$$");
@@ -17513,9 +17605,10 @@ function parseEngineUnit(text) {
 var ENGINE_LABEL = "ai.sleds.engine";
 var ENGINE_INSTALL_USAGE = `usage: sleds engine install [engine flags]   |   sleds engine uninstall [--name <n>] [--org <slug>]
 ${ENGINE_USAGE}`;
-function stableArgv(argv, realpath = realpathSync) {
+function stableArgv(argv, realpath = realpathSync, home) {
+  const link = sledsLink(home);
   return argv.map((a) => {
-    if (!isAbsolute2(a))
+    if (!isAbsolute2(a) || a === link)
       return a;
     try {
       return realpath(a);
@@ -17528,13 +17621,13 @@ function engineLabel(name, org, seat) {
   return [ENGINE_LABEL, org, seat?.trim(), name].filter((p) => Boolean(p)).map((p, i) => i === 0 ? p : engineSlug(p)).join(".");
 }
 function enginePlistPath(home, name, org, seat) {
-  return join19(home, "Library", "LaunchAgents", `${engineLabel(name, org, seat)}.plist`);
+  return join20(home, "Library", "LaunchAgents", `${engineLabel(name, org, seat)}.plist`);
 }
 function engineLogPath(stateDir, name) {
-  return join19(stateDir, `${engineSlug(name)}.log`);
+  return join20(stateDir, `${engineSlug(name)}.log`);
 }
 function engineEventsPath(stateDir, name) {
-  return join19(stateDir, `${engineSlug(name)}.events.jsonl`);
+  return join20(stateDir, `${engineSlug(name)}.events.jsonl`);
 }
 var xmlEscape3 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 function buildEnginePlist(o) {
@@ -17631,7 +17724,7 @@ function readEngines(dir, suffix, manager, parse) {
   }
   const out = [];
   for (const name of names.filter((n) => n.startsWith(`${ENGINE_LABEL}.`) && n.endsWith(suffix))) {
-    const path = join19(dir, name);
+    const path = join20(dir, name);
     let parsed;
     try {
       parsed = parse(readFileSync14(path, "utf8"), name);
@@ -17651,10 +17744,10 @@ function readEngines(dir, suffix, manager, parse) {
 }
 function installedEngines(home) {
   return [
-    ...readEngines(join19(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist),
+    ...readEngines(join20(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist),
     ...readEngines(engineUnitDir(home), ".service", "systemd", (text, file) => {
       const parsed = parseEngineUnit(text);
-      return parsed && { label: basename4(file, ".service"), ...parsed };
+      return parsed && { label: basename5(file, ".service"), ...parsed };
     })
   ];
 }
@@ -17689,7 +17782,7 @@ function engineInstall(o) {
   const label = engineLabel(parsed.name, parsed.org, seat);
   const logPath = engineLogPath(stateDir, parsed.name);
   mkdirSync14(stateDir, { recursive: true, mode: 448 });
-  const sledsArgv = stableArgv(o.sledsArgv, o.realpath);
+  const sledsArgv = stableArgv(o.sledsArgv, o.realpath, o.home);
   const execPath = sledsArgv[0] ?? process.execPath;
   const agentEnv = {
     PATH: musherPath(o.home, execPath, env.PATH ?? ""),
@@ -17741,7 +17834,7 @@ function installUnit(a) {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
   const unit = engineUnitPath(o.home, label);
-  const unitName = basename4(unit);
+  const unitName = basename5(unit);
   const systemctl = (...args) => exec("systemctl", ["--user", ...args]);
   mkdirSync14(dirname12(unit), { recursive: true });
   if (existsSync15(unit))
@@ -17751,7 +17844,7 @@ function installUnit(a) {
       continue;
     if (engineArg(other.programArgs, "name") !== parsed.name)
       continue;
-    systemctl("disable", "--now", basename4(other.plist));
+    systemctl("disable", "--now", basename5(other.plist));
     rmSync6(other.plist, { force: true });
     log(`replaced ${other.label}, this engine as installed before`);
   }
@@ -17810,13 +17903,13 @@ function engineUninstall(o) {
   const unit = file.endsWith(".service");
   const exec = o.exec ?? defaultExec2;
   if (unit)
-    exec("systemctl", ["--user", "disable", "--now", basename4(file)]);
+    exec("systemctl", ["--user", "disable", "--now", basename5(file)]);
   else
     exec("launchctl", ["unload", file]);
   rmSync6(file, { force: true });
   if (unit)
     exec("systemctl", ["--user", "daemon-reload"]);
-  log(`engine:${name} removed: ${basename4(file, unit ? ".service" : ".plist")} — its sessions keep running`);
+  log(`engine:${name} removed: ${basename5(file, unit ? ".service" : ".plist")} — its sessions keep running`);
   return 0;
 }
 
@@ -17933,7 +18026,7 @@ function nodeOk(version, min = NODE_MIN) {
 }
 var MARK = { ok: "ok  ", warn: "warn", fail: "FAIL" };
 function formatDoctor(checks) {
-  const lines = checks.map((c) => `${MARK[c.level]}  ${c.name.padEnd(16)}${c.detail}`);
+  const lines = checks.map((c) => `${MARK[c.level]}  ${c.name.padEnd(15)} ${c.detail}`);
   const fixes = checks.filter((c) => c.level !== "ok" && c.fix);
   if (fixes.length > 0) {
     lines.push("");
@@ -17973,7 +18066,7 @@ async function runDoctor(o) {
       level: "fail",
       name: "config",
       detail: `${configPath(home)} does not exist${overrides.length ? ` (this shell has ${overrides.join(" ")})` : ""}`,
-      fix: overrides.length ? "unset SLEDS_HOME CLAUDE_CONFIG_DIR — or run `sleds init` for this seat" : "sleds init --token <sled_…>"
+      fix: overrides.length ? "unset SLEDS_HOME CLAUDE_CONFIG_DIR — or run `sleds init` for this seat" : "sleds init"
     });
   } else {
     checks.push({
@@ -18003,7 +18096,7 @@ async function runDoctor(o) {
       level: "warn",
       name: "claude",
       detail: `${sPath} carries a different token (${maskToken(pointed.token)}) than ${configPath(home)} (${maskToken(cfg.token)})`,
-      fix: "sleds init --token <the one you mean>"
+      fix: "sleds init (or `sleds login` as the seat you mean)"
     });
   } else {
     checks.push({ level: "ok", name: "claude", detail: `${sPath} → ${pointed.url}` });
@@ -18169,13 +18262,16 @@ async function runDoctor(o) {
 }
 var SANDBOX_PROBE = "sandbox-probe";
 var PROBE_ENV = "SLEDS_DOCTOR_PROBE";
+var SETTINGS_ENV = "SLEDS_DOCTOR_SETTINGS";
 var SANDBOX_PROBE_COMMAND = [
   `cat "$${PROBE_ENV}"; echo "SLEDS_CAT_EXIT=$?"`,
+  `[ -n "$ANTHROPIC_AUTH_TOKEN$ANTHROPIC_API_KEY" ]; echo "SLEDS_ENV_EMPTY=$?"`,
+  `cat "$${SETTINGS_ENV}" >/dev/null; echo "SLEDS_SETTINGS_EXIT=$?"`,
   `curl -sS -m 10 -o /dev/null -w "SLEDS_CURL_CODE=%{http_code}\\n" https://example.com; echo "SLEDS_CURL_EXIT=$?"`,
   `gh api user -q .login; echo "SLEDS_GH_EXIT=$?"`
 ].join("; ");
 var marker = (out, name) => new RegExp(`${name}=(\\d+)`).exec(out)?.[1] ?? null;
-function readSandboxProbe(run, nonce) {
+function readSandboxProbe(run, nonce, o = {}) {
   const out = `${run.stdout}
 ${run.stderr}`;
   const failed = run.status !== 0;
@@ -18197,6 +18293,34 @@ ${run.stderr}`;
     detail: catExit === "0" ? "cat succeeded but printed no nonce — inconclusive" : `${why} — inconclusive`,
     fix
   };
+  const leaked = Boolean(o.token) && out.includes(o.token);
+  const envEmpty = marker(out, "SLEDS_ENV_EMPTY");
+  const envRow = envEmpty === "0" ? {
+    level: "fail",
+    name: "sandbox env",
+    detail: "a sandboxed session's shell has ANTHROPIC_AUTH_TOKEN or ANTHROPIC_API_KEY — the seat token is readable",
+    fix: "update Claude Code: the sandbox settings' env sets CLAUDE_CODE_SUBPROCESS_ENV_SCRUB, which 2.1.310 honors"
+  } : envEmpty !== null ? {
+    level: "ok",
+    name: "sandbox env",
+    detail: "the session's shell has no Anthropic credential in its env"
+  } : { level: "warn", name: "sandbox env", detail: `${why} — inconclusive`, fix };
+  const settingsExit = marker(out, "SLEDS_SETTINGS_EXIT");
+  const settingsRow = leaked || settingsExit === "0" && o.settingsExists !== false ? {
+    level: "fail",
+    name: "sandbox settings read",
+    detail: leaked ? "the seat token appeared in a sandboxed session's output" : "a sandboxed session read Claude Code's settings.json — a proxied seat's token is readable",
+    fix: "check that the sandbox settings deny the Claude settings files (sandbox.filesystem.denyRead)"
+  } : o.settingsExists === false ? {
+    level: "warn",
+    name: "sandbox settings read",
+    detail: "Claude Code has no settings.json for this seat — nothing to guard yet",
+    fix: "sleds init"
+  } : settingsExit !== null ? {
+    level: "ok",
+    name: "sandbox settings read",
+    detail: "Claude Code's settings.json is unreadable from a sandboxed session"
+  } : { level: "warn", name: "sandbox settings read", detail: `${why} — inconclusive`, fix };
   const code = marker(out, "SLEDS_CURL_CODE");
   const curlExit = marker(out, "SLEDS_CURL_EXIT");
   const egress = code !== null && code !== "000" ? {
@@ -18221,8 +18345,15 @@ ${run.stderr}`;
     detail: ghExit === null ? `${why} — inconclusive` : `gh fails inside the sandbox (exit ${ghExit}) — a sandboxed node cannot push or open its PR`,
     fix: ghExit === null ? fix : "gh auth status; api.github.com on the allowlist; on macOS gh (Go) needs sandbox.enableWeakerNetworkIsolation for TLS"
   };
-  return [read, egress, github];
+  return [read, envRow, settingsRow, egress, github];
 }
+var proxyToken = (home, env) => {
+  try {
+    return readProxy(readSettings(home, env))?.token;
+  } catch {
+    return;
+  }
+};
 function sandboxChecks(o, env) {
   const which = (c) => (o.which ?? defaultWhich2)(c)[0] ?? null;
   const exec = o.exec ?? sessionExec;
@@ -18247,17 +18378,14 @@ function sandboxChecks(o, env) {
       }
     ];
   const nonce = o.nonce ?? `sleds-probe-${randomBytes(16).toString("hex")}`;
-  const probe = join20(dir, SANDBOX_PROBE);
-  const work = mkdtempSync(join20(tmpdir(), "sleds-sandbox-"));
+  const probe = join21(dir, SANDBOX_PROBE);
+  const work = mkdtempSync(join21(tmpdir(), "sleds-sandbox-"));
   try {
     writeFileSync17(probe, `${nonce}
 `, { mode: 384 });
-    const settingsFile = join20(work, "settings.json");
-    const settings = sandboxSettings({
-      denyRead: [dir],
-      gitCommonDir: work,
-      allow: SANDBOX_DEFAULT_ALLOW
-    });
+    const settingsFile = join21(work, "settings.json");
+    const settings = engineSandboxSettings(o.home, env, work, SANDBOX_DEFAULT_ALLOW);
+    const claudeSettings = settingsPath(o.home, env);
     writeFileSync17(settingsFile, JSON.stringify(settings, null, 2), { mode: 384 });
     const prompt = `Run exactly this one Bash command, once, then reply with its complete output verbatim and nothing else:
 
@@ -18266,6 +18394,7 @@ ${SANDBOX_PROBE_COMMAND}`;
       "-u",
       "SLEDS_TOKEN",
       `${PROBE_ENV}=${probe}`,
+      `${SETTINGS_ENV}=${claudeSettings}`,
       claude,
       "-p",
       "--model",
@@ -18278,7 +18407,9 @@ ${SANDBOX_PROBE_COMMAND}`;
       "3",
       prompt
     ], { cwd: work });
-    return readSandboxProbe(run, nonce);
+    const settingsExists = existsSync17(claudeSettings);
+    const token = settingsExists ? proxyToken(o.home, env) : undefined;
+    return readSandboxProbe(run, nonce, { ...token ? { token } : {}, settingsExists });
   } finally {
     rmSync8(probe, { force: true });
     rmSync8(work, { recursive: true, force: true });
@@ -18515,7 +18646,7 @@ import {
   writeFileSync as writeFileSync18
 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
-import { join as join21, resolve as resolve10 } from "node:path";
+import { join as join22, resolve as resolve10 } from "node:path";
 init_machine();
 init_state();
 init_meter();
@@ -18697,7 +18828,7 @@ function flagsFromProfile2(flags, given, profile, home) {
   const used = [];
   const skipped = [];
   for (const k of profile.notYours ?? [])
-    skipped.push(`${k} (the workspace default — the engine runs only one you set yourself)`);
+    skipped.push(`${k} (the workspace default — the engine takes it only from your own profile)`);
   if (profile.atOnce !== undefined && !has("at-once")) {
     out.atOnce = profile.atOnce;
     used.push(`at-once ${profile.atOnce}`);
@@ -18770,7 +18901,7 @@ function flagsFromProfile2(flags, given, profile, home) {
     }
   }
   if (profile.reposDir && !has("repos-dir") && !has("repo")) {
-    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join21(home, d.slice(1)) : d).join(":");
+    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join22(home, d.slice(1)) : d).join(":");
     used.push(`repos ${profile.reposDir}`);
   }
   if (profile.mcpStrict !== undefined && !has("strict-mcp") && !has("no-strict-mcp")) {
@@ -18913,7 +19044,11 @@ function engineClient2(o, org) {
   const env = o.env ?? process.env;
   const src = meterSource(o.home, undefined, { ...org ? { flag: org } : {}, env });
   if (src)
-    return fetchClient({ ...src, timeoutMs: ENGINE_TIMEOUT_MS2 });
+    return fetchClient({
+      ...src,
+      timeoutMs: ENGINE_TIMEOUT_MS2,
+      version: "0.1.47"
+    });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
     return {
@@ -18961,12 +19096,12 @@ function memberMcpConfigs2(o, cwd) {
   });
   const claudeDir = (o.env ?? process.env).CLAUDE_CONFIG_DIR;
   return [
-    read(claudeDir ? join21(claudeDir, ".claude.json") : join21(o.home, ".claude.json")),
-    ...cwd ? [read(join21(cwd, ".mcp.json"))] : []
+    read(claudeDir ? join22(claudeDir, ".claude.json") : join22(o.home, ".claude.json")),
+    ...cwd ? [read(join22(cwd, ".mcp.json"))] : []
   ];
 }
 function engineStateDir2(o, org, seat) {
-  return seatStateDir(orgStateDir(o.stateDir ?? join21(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
+  return seatStateDir(orgStateDir(o.stateDir ?? join22(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
 }
 function engineSeat2(o, org) {
   try {
@@ -18986,7 +19121,7 @@ function engineToken2(o, org) {
 }
 var withToken2 = (token, now) => token ? { token, tokenNow: now } : {};
 function engineDeps2(o, flags, source, runner, stateName) {
-  const exec = o.exec ?? defaultExec;
+  const exec = guardGit(o.exec ?? defaultExec);
   const cwd = o.cwd ?? process.cwd();
   const exists = o.exists ?? realExists2;
   const log = o.log ?? console.log;
@@ -18996,8 +19131,8 @@ function engineDeps2(o, flags, source, runner, stateName) {
   const repo = flags.repo ? resolve10(cwd, flags.repo) : undefined;
   const reposDirs = splitReposDirs(flags.reposDir).map((d) => resolve10(cwd, d));
   const { branch, prTitle } = flags;
-  const hooksDir = join21(stateDir, "hooks");
-  const permissionMark = (name) => join21(hooksDir, `${name}.permission.json`);
+  const hooksDir = join22(stateDir, "hooks");
+  const permissionMark = (name) => join22(hooksDir, `${name}.permission.json`);
   const withHook = (name, settings) => applyPermissionHook(settings, [...o.sledsArgv ?? ["sleds"], "permission-event", "--mark", permissionMark(name)].map(shq2).join(" "));
   return {
     source,
@@ -19022,9 +19157,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
       sandbox: true,
       writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow) => {
         const gitCommonDir = gitCommonDirOf2(exec, cwd);
-        const dir = join21(stateDir, "sandbox");
+        const dir = join22(stateDir, "sandbox");
         mkdirSync16(dir, { recursive: true, mode: 448 });
-        const p = join21(dir, `${name}.json`);
+        const p = join22(dir, `${name}.json`);
         const walls = engineSandboxSettings2(o.home, o.env ?? process.env, gitCommonDir, [
           ...SANDBOX_DEFAULT_ALLOW,
           ...flags.sandboxAllow ?? []
@@ -19041,7 +19176,7 @@ function engineDeps2(o, flags, source, runner, stateName) {
     } : {},
     writeHookSettings: (name, allow) => {
       mkdirSync16(hooksDir, { recursive: true, mode: 448 });
-      const p = join21(hooksDir, `${name}.json`);
+      const p = join22(hooksDir, `${name}.json`);
       const base = allow?.length ? { permissions: { allow: [...allow] } } : {};
       writeFileSync18(p, `${JSON.stringify(withHook(name, base), null, 2)}
 `, { mode: 384 });
@@ -19069,9 +19204,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
       exists
     }),
     writeMcpConfig: o.writeMcpConfig ?? ((name, runToken, worktree) => {
-      const dir = join21(stateDir, "mcp");
+      const dir = join22(stateDir, "mcp");
       mkdirSync16(dir, { recursive: true, mode: 448 });
-      const p = join21(dir, `${name}.json`);
+      const p = join22(dir, `${name}.json`);
       let others = {};
       if (flags.strictMcp && flags.mcpAllow?.length) {
         const r = mcpPassThrough(flags.mcpAllow, memberMcpConfigs2(o, worktree));
@@ -19087,9 +19222,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
     }),
     removeMcpConfig: o.removeMcpConfig ?? ((p) => rmSync9(p, { force: true })),
     writePrompt: o.writePrompt ?? ((name, text) => {
-      const dir = join21(stateDir, "prompts");
+      const dir = join22(stateDir, "prompts");
       mkdirSync16(dir, { recursive: true, mode: 448 });
-      const p = join21(dir, `${name}.md`);
+      const p = join22(dir, `${name}.md`);
       writeFileSync18(p, text, { mode: 384 });
       return p;
     }),
@@ -19116,8 +19251,16 @@ function engineDeps2(o, flags, source, runner, stateName) {
 }
 function sandboxDenyRead2(home, env) {
   return {
-    dirs: [...new Set([configDir(home, env), join21(home, ".config", "sleds")])],
-    files: [...new Set([tokenPath(home, env), join21(home, ".sleds-token")])]
+    dirs: [...new Set([configDir(home, env), join22(home, ".config", "sleds")])],
+    files: [
+      ...new Set([
+        tokenPath(home, env),
+        join22(home, ".sleds-token"),
+        settingsPath(home, env),
+        backupPath(home, env),
+        join22(claudeDir(home, env), "settings.local.json")
+      ])
+    ]
   };
 }
 function engineSandboxSettings2(home, env, gitCommonDir, allow) {
@@ -19141,6 +19284,8 @@ function sandboxRefusal(flags) {
     return "sandboxed sessions: the conductor runner starts them in Conductor's cloud, where the engine cannot put the sandbox on — use another runner, or --no-sandbox";
   if (flags.agent && sandboxAgentKind(flags.agent) === null)
     return `sandboxed sessions: --agent '${flags.agent}' is neither Claude Code nor Codex, so the engine cannot sandbox it — use one of those, or --no-sandbox`;
+  if (flags.agent && sandboxAgentKind(flags.agent) === "codex")
+    return "sandboxed sessions: Codex's sandbox walls writes, not reads — the seat token stays readable; use Claude Code, or --no-sandbox";
   return null;
 }
 function pinOrg3(configJson, org) {
@@ -19183,7 +19328,7 @@ async function driveEngine2(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.46"
+    cliVersion: "0.1.47"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -19369,7 +19514,7 @@ async function drive2(o, flags, deps, until, beat) {
 var SEAT_CHANGED_EXIT2 = 3;
 function engineRunner2(o, flags) {
   const runnerFor = o.runnerFor ?? runnerFor2;
-  return runnerFor(flags.runner, o.exec ?? defaultExec, {
+  return runnerFor(flags.runner, guardGit(o.exec ?? defaultExec), {
     ...flags.runnerCmd ? { command: flags.runnerCmd } : {}
   });
 }
@@ -19510,7 +19655,7 @@ var engineCmd = async (o) => {
       if (!r || r.ok || !r.refused || r.refused === refused)
         return;
       refused = r.refused;
-      error(`${r.refused}. This engine is not shown as up until it beats under a name of its own.`);
+      error(r.below ? `${r.refused}. This engine is not shown as up until it beats on a version SLEDS serves.` : `${r.refused}. This engine is not shown as up until it beats under a name of its own.`);
     };
     afterTick = () => {
       try {
@@ -19608,7 +19753,7 @@ async function enginePauseCmd2(o) {
     source = sledsSource(c, { engine, log });
   }
   const why = parsed.why ?? `paused on ${defaultEngineName2(host)} (sleds engine pause)`;
-  const exec = o.exec ?? defaultExec;
+  const exec = guardGit(o.exec ?? defaultExec);
   const gone = new Set;
   for (const run of running) {
     const at = `${run.item}/${run.node}`;
@@ -19657,14 +19802,15 @@ import {
   writeFileSync as writeFileSync19
 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
-import { basename as basename5, dirname as dirname13, isAbsolute as isAbsolute3, join as join22 } from "node:path";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute3, join as join23 } from "node:path";
 init_state();
 var ENGINE_LABEL2 = "ai.sleds.engine";
 var ENGINE_INSTALL_USAGE2 = `usage: sleds engine install [engine flags]   |   sleds engine uninstall [--name <n>] [--org <slug>]
 ${ENGINE_USAGE}`;
-function stableArgv2(argv, realpath = realpathSync2) {
+function stableArgv2(argv, realpath = realpathSync2, home) {
+  const link = sledsLink(home);
   return argv.map((a) => {
-    if (!isAbsolute3(a))
+    if (!isAbsolute3(a) || a === link)
       return a;
     try {
       return realpath(a);
@@ -19677,13 +19823,13 @@ function engineLabel2(name, org, seat) {
   return [ENGINE_LABEL2, org, seat?.trim(), name].filter((p) => Boolean(p)).map((p, i) => i === 0 ? p : engineSlug(p)).join(".");
 }
 function enginePlistPath2(home, name, org, seat) {
-  return join22(home, "Library", "LaunchAgents", `${engineLabel2(name, org, seat)}.plist`);
+  return join23(home, "Library", "LaunchAgents", `${engineLabel2(name, org, seat)}.plist`);
 }
 function engineLogPath2(stateDir, name) {
-  return join22(stateDir, `${engineSlug(name)}.log`);
+  return join23(stateDir, `${engineSlug(name)}.log`);
 }
 function engineEventsPath2(stateDir, name) {
-  return join22(stateDir, `${engineSlug(name)}.events.jsonl`);
+  return join23(stateDir, `${engineSlug(name)}.events.jsonl`);
 }
 var xmlEscape4 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 function buildEnginePlist2(o) {
@@ -19780,7 +19926,7 @@ function readEngines2(dir, suffix, manager, parse) {
   }
   const out = [];
   for (const name of names.filter((n) => n.startsWith(`${ENGINE_LABEL2}.`) && n.endsWith(suffix))) {
-    const path = join22(dir, name);
+    const path = join23(dir, name);
     let parsed;
     try {
       parsed = parse(readFileSync19(path, "utf8"), name);
@@ -19800,10 +19946,10 @@ function readEngines2(dir, suffix, manager, parse) {
 }
 function installedEngines2(home) {
   return [
-    ...readEngines2(join22(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist2),
+    ...readEngines2(join23(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist2),
     ...readEngines2(engineUnitDir(home), ".service", "systemd", (text, file) => {
       const parsed = parseEngineUnit(text);
-      return parsed && { label: basename5(file, ".service"), ...parsed };
+      return parsed && { label: basename6(file, ".service"), ...parsed };
     })
   ];
 }
@@ -19838,7 +19984,7 @@ async function ensureReposDir(o) {
     return false;
   }
   const exists = o.exists ?? existsSync18;
-  const missing = dirs.filter((d) => !exists(/^~(\/|$)/.test(d) ? join22(o.home, d.slice(1)) : d));
+  const missing = dirs.filter((d) => !exists(/^~(\/|$)/.test(d) ? join23(o.home, d.slice(1)) : d));
   if (missing.length) {
     error(`Not a folder on this machine: ${missing.join(", ")}. ${REPOS_DIR_NEEDED}`);
     return false;
@@ -19882,7 +20028,7 @@ function engineInstall2(o) {
   const label = engineLabel2(parsed.name, parsed.org, seat);
   const logPath = engineLogPath2(stateDir, parsed.name);
   mkdirSync17(stateDir, { recursive: true, mode: 448 });
-  const sledsArgv = stableArgv2(o.sledsArgv, o.realpath);
+  const sledsArgv = stableArgv2(o.sledsArgv, o.realpath, o.home);
   const execPath = sledsArgv[0] ?? process.execPath;
   const agentEnv = {
     PATH: musherPath(o.home, execPath, env.PATH ?? ""),
@@ -19934,7 +20080,7 @@ function installUnit2(a) {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
   const unit = engineUnitPath(o.home, label);
-  const unitName = basename5(unit);
+  const unitName = basename6(unit);
   const systemctl = (...args) => exec("systemctl", ["--user", ...args]);
   mkdirSync17(dirname13(unit), { recursive: true });
   if (existsSync18(unit))
@@ -19944,7 +20090,7 @@ function installUnit2(a) {
       continue;
     if (engineArg2(other.programArgs, "name") !== parsed.name)
       continue;
-    systemctl("disable", "--now", basename5(other.plist));
+    systemctl("disable", "--now", basename6(other.plist));
     rmSync10(other.plist, { force: true });
     log(`replaced ${other.label}, this engine as installed before`);
   }
@@ -20003,13 +20149,13 @@ function engineUninstall2(o) {
   const unit = file.endsWith(".service");
   const exec = o.exec ?? defaultExec2;
   if (unit)
-    exec("systemctl", ["--user", "disable", "--now", basename5(file)]);
+    exec("systemctl", ["--user", "disable", "--now", basename6(file)]);
   else
     exec("launchctl", ["unload", file]);
   rmSync10(file, { force: true });
   if (unit)
     exec("systemctl", ["--user", "daemon-reload"]);
-  log(`engine:${name} removed: ${basename5(file, unit ? ".service" : ".plist")} — its sessions keep running`);
+  log(`engine:${name} removed: ${basename6(file, unit ? ".service" : ".plist")} — its sessions keep running`);
   return 0;
 }
 
@@ -20955,9 +21101,9 @@ init_meter();
 // src/owed.ts
 init_config();
 import { existsSync as existsSync22, mkdirSync as mkdirSync18, readFileSync as readFileSync23, renameSync as renameSync7, writeFileSync as writeFileSync20 } from "node:fs";
-import { dirname as dirname14, join as join23 } from "node:path";
-var owedPath = (home) => join23(configDir(home), "owed.json");
-var sessionPath = (home) => join23(configDir(home), "session.json");
+import { dirname as dirname14, join as join24 } from "node:path";
+var owedPath = (home) => join24(configDir(home), "owed.json");
+var sessionPath = (home) => join24(configDir(home), "session.json");
 var OWED_TTL_MS = 3 * 24 * 60 * 60000;
 var str13 = (v) => typeof v === "string" ? v : undefined;
 function sourceKey(s) {
@@ -21111,7 +21257,12 @@ function trackingClient(client, home, now) {
 function contextFor(deps) {
   const src = meterSource(deps.home, runTokenOf(deps.env));
   const now = deps.now ?? Date.now;
-  const client = src ? trackingClient(fetchClient({ ...src, fetchFn: deps.fetchFn, timeoutMs: deps.timeoutMs }), deps.home, now) : null;
+  const client = src ? trackingClient(fetchClient({
+    ...src,
+    fetchFn: deps.fetchFn,
+    timeoutMs: deps.timeoutMs,
+    version: "0.1.47"
+  }), deps.home, now) : null;
   return {
     channel: "code",
     client,
@@ -21380,7 +21531,7 @@ var DEVICE_REASONS = {
   bad_answer: "the proxy gave an answer this CLI does not understand — update it: curl -fsSL sleds.ai/install | sh"
 };
 function deviceFailureText(reason) {
-  return `Sign-in did not complete: ${DEVICE_REASONS[reason]} Or mint a seat on the dashboard (Settings › Your seat & tools) and run \`sleds init --token …\`.`;
+  return `Sign-in did not complete: ${DEVICE_REASONS[reason]} Or mint a seat on the dashboard (Settings › Your seat & tools), set it as SLEDS_TOKEN and run \`sleds init\`.`;
 }
 function parseStart(body) {
   if (typeof body !== "object" || body === null)
@@ -21642,7 +21793,7 @@ var SIGNUP_REASONS = {
   not_configured: "the proxy is not set up for self-serve signup yet.",
   team: "the team needs a name (2–80 characters).",
   personal_email: "a team needs a work email — that domain is a personal mailbox. Sign up as an individual instead, or use your company address.",
-  org_exists: "someone at your company already set up SLEDS. Ask them for a seat (Members → invite, Admin → Mint a seat) and run `sleds init --token …`.",
+  org_exists: "someone at your company already set up SLEDS. Ask them to invite you (Members → invite), then run `sleds init` and sign in through the browser.",
   unavailable: "the proxy could not reach its control plane. Try again in a moment.",
   unreachable: "could not reach the proxy.",
   code: "that code is six digits.",
@@ -21769,7 +21920,7 @@ var resolveToken = async (o) => {
       return null;
     }
     log(`Created ${team} with you as owner (${email}).${credential ? " Your platform key is stored encrypted as the org's upstream key." : " No platform key yet — add one on the dashboard (Admin → Keys) to unlock continue / overnight / switch at a wall."}`);
-    log("Invite your team on the dashboard (Members → invite by email, Admin → Mint a seat); each person runs `sleds init --token …`.");
+    log("Invite your team on the dashboard (Members → invite by email, Admin → Mint a seat); each person runs `sleds init` and signs in through the browser.");
     return { token: r.token, source: "signup" };
   }
   const credential = (await o.prompt("Your Anthropic API key (sk-ant-…, stored encrypted, spends only your account): ")).trim();
@@ -21793,7 +21944,7 @@ var init = async (o) => {
   }
   const resolved = await resolveToken(o);
   if (!resolved) {
-    error(o.signup ? "Signup did not complete. Nothing was changed." : "No seat token. Run `sleds init` without --non-interactive to sign in through the browser, or pass --token / set SLEDS_TOKEN.");
+    error(o.signup ? "Signup did not complete. Nothing was changed." : "No seat token. Run `sleds init` without --non-interactive to sign in through the browser, or set SLEDS_TOKEN (never the token on the command line).");
     return 2;
   }
   if (!isSeatToken(resolved.token)) {
@@ -22509,7 +22660,7 @@ var on = (o) => {
     return 2;
   }
   if (!isSeatToken(token)) {
-    error("Saved token is not a sled_ token. Run `sleds init --token <sled_…>`.");
+    error("Saved token is not a sled_ token. Run `sleds login` to sign in again.");
     return 2;
   }
   if (cfg.org && !cfg.org.capabilities.upstreamKey) {
@@ -22677,7 +22828,7 @@ var orgCmd = (o) => {
 init_src();
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { writeFileSync as writeFileSync23 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 function packFileName(key) {
   return `pack-${slugify(key, 80) || "item"}.md`;
 }
@@ -22705,7 +22856,7 @@ var packCmd = async (o) => {
     log(r.text);
     return 0;
   }
-  const path = join24(o.cwd ?? process.cwd(), packFileName(key));
+  const path = join25(o.cwd ?? process.cwd(), packFileName(key));
   (o.write ?? ((p, t) => writeFileSync23(p, t.endsWith(`
 `) ? t : `${t}
 `)))(path, r.text);
@@ -22964,7 +23115,9 @@ function parseVerbArgs(argv, allowed) {
       if (flag === "name")
         out.name = value;
       i++;
-    } else if (out.key === undefined)
+    } else if (a.startsWith("-"))
+      return { error: `unknown flag ${a}` };
+    else if (out.key === undefined)
       out.key = a;
     else
       return { error: `one item at a time — "${a}" is extra` };
@@ -23146,7 +23299,7 @@ async function proposeCmd(o, argv) {
       log(`- ${w}`);
     const shown = typeof r.json?.key === "string" ? r.json.key : a.key;
     const text = typeof r.json?.text === "string" ? r.json.text : "";
-    log(text.replace(/\n*Nothing runs until a person says yes:[^\n]*$/, "") || `${shown} · route drafted, not filed`);
+    log(text.replace(/\n*Nothing runs until a person says yes:[^\n]*$/, "") || `${shown} · route planned, not filed`);
     log("");
     log(`Nothing runs until a person approves it: \`sleds route approve ${shown}\`, or Approve in the app.`);
   });
@@ -23188,7 +23341,7 @@ async function approveCmd(o, argv) {
   return said(o, a.key, a.json, r, () => log(approvedLine(a.key, r.json ?? {})));
 }
 async function redraftCmd(o, argv) {
-  return oneVerb(o, argv, REDRAFT_USAGE, { draft: "retry" }, "nothing re-drafted", (key) => redraftLine(key));
+  return oneVerb(o, argv, REDRAFT_USAGE, { draft: "retry" }, "nothing planned again", (key) => redraftLine(key));
 }
 async function singleCmd(o, argv) {
   return oneVerb(o, argv, SINGLE_USAGE, { single: true }, "nothing changed", (key) => singleLine(key));
@@ -23216,17 +23369,17 @@ async function oneVerb(o, argv, usage, body, unreachable, line) {
   return said(o, a.key, a.json, r, () => log(line(shown)));
 }
 function redraftLine(key) {
-  return `${key} re-draft asked — the engine drafts its route on its next check`;
+  return `${key} plan again asked — the engine plans its route on its next check`;
 }
 function singleLine(key) {
-  return `${key} runs as one node — it is not drafted again`;
+  return `${key} runs as one node — it is not planned again`;
 }
 function answeredLine(key, route, held) {
   const nodes = Array.isArray(held) && held.length ? ` (${held.join(", ")})` : "";
   if (route === "accept")
     return `${key}: change accepted — what it held${nodes} waits until the route is re-filed`;
   if (route === "redraft")
-    return `${key}: re-draft asked — what it held${nodes} waits until the route is re-filed`;
+    return `${key}: plan again asked — what it held${nodes} waits until the route is re-filed`;
   if (route === "keep")
     return `${key}: route kept as filed — what it held is released`;
   return `${key}: answered — what it held is released`;
@@ -23303,12 +23456,24 @@ function lookToReady(route, id) {
     return { error: `no decision ${id} on this item` };
   if (d.kind !== "look")
     return { error: `decision ${id} is not a look — --ready marks a look` };
+  if (d.state === "superseded" || d.state === "answered")
+    return { settled: `decision ${id} is ${d.state}` };
   if (d.state !== "escalated")
     return { error: `decision ${id} is ${String(d.state)} — not a look you owe` };
   const about = d.about && typeof d.about === "object" ? d.about : {};
   const pr = Array.isArray(about.prs) ? about.prs.find((p) => typeof p === "string" && p) : undefined;
   return typeof pr === "string" ? { pr } : { error: `decision ${id} names no PR` };
 }
+function prLookState(stdout) {
+  try {
+    const j = JSON.parse(stdout);
+    if (!j || typeof j.isDraft !== "boolean" || typeof j.state !== "string")
+      return null;
+    return { isDraft: j.isDraft, state: j.state };
+  } catch {
+    return null;
+  }
+}
 async function readyCmd(o, argv) {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
@@ -23329,6 +23494,13 @@ async function readyCmd(o, argv) {
     error(reader.error);
     return 1;
   }
+  const settled = (why) => {
+    if (json)
+      log(JSON.stringify({ ok: true, settled: why }));
+    else
+      log(`${key}: the look is already settled — nothing to do`);
+    return 0;
+  };
   const route = await reader.read(key).catch((e) => {
     error(e instanceof Error ? e.message : String(e));
     return;
@@ -23340,12 +23512,25 @@ async function readyCmd(o, argv) {
     error(`${key}: ${look.error}`);
     return 1;
   }
-  const gh = (o.exec ?? defaultExec)("gh", ["pr", "ready", look.pr]);
-  if (gh.status !== 0) {
-    error(gh.stderr.trim() || `gh pr ready ${look.pr} exited ${gh.status}`);
+  if ("settled" in look)
+    return settled(look.settled);
+  const exec = o.exec ?? defaultExec;
+  const view = exec("gh", ["pr", "view", look.pr, "--json", "isDraft,state"]);
+  const pr = view.status === 0 ? prLookState(view.stdout) : null;
+  if (!pr) {
+    error(view.stderr.trim() || (view.status === 0 ? `gh pr view ${look.pr} said nothing readable` : `gh pr view ${look.pr} exited ${view.status}`));
     error(`${key}: the look is not answered`);
     return 1;
   }
+  const draft = pr.state === "OPEN" && pr.isDraft;
+  if (draft) {
+    const gh = exec("gh", ["pr", "ready", look.pr]);
+    if (gh.status !== 0) {
+      error(gh.stderr.trim() || `gh pr ready ${look.pr} exited ${gh.status}`);
+      error(`${key}: the look is not answered`);
+      return 1;
+    }
+  }
   const r = await client.postFull("/proxy/route/decision", {
     project: key,
     id,
@@ -23355,7 +23540,13 @@ async function readyCmd(o, argv) {
     error(`${key}: ${look.pr} is ready for review, but SLEDS is unreachable — the look is not answered`);
     return 1;
   }
-  return said(o, key, json, r, () => log(`${key}: ${look.pr} marked ready for review — the look is answered`));
+  if (r.status >= 300 || r.json?.ok === false) {
+    const again = await reader.read(key).catch(() => null);
+    const now = lookToReady(again ?? null, id);
+    if ("settled" in now)
+      return settled(now.settled);
+  }
+  return said(o, key, json, r, () => log(draft ? `${key}: ${look.pr} marked ready for review — the look is answered` : `${key}: ${look.pr} is ${pr.state === "OPEN" ? "already ready for review" : pr.state.toLowerCase()} — the look is answered`));
 }
 var DECISIONS_USAGE = "usage: sleds route decisions [<key>] [--flagged] [--json]";
 function decisionsLines(raw) {
@@ -23368,7 +23559,7 @@ function decisionsLines(raw) {
     const first = q.replace(/\s+/g, " ").trim().slice(0, 100);
     const where = [d.project && !j.project ? d.project : null, d.node].filter(Boolean).join("/");
     const flag = d.flagged ? " · decided for you" : "";
-    const pending = d.redraftPending ? " · re-draft pending" : "";
+    const pending = d.redraftPending ? " · plan again pending" : "";
     return `${String(d.state)}${flag}${pending}  ${where || "—"}  ${first}  [${String(d.id)}]`;
   });
 }
@@ -23584,12 +23775,14 @@ function routeReader(o, org) {
     read: (k) => readOrSay(client, `/proxy/route?q=${encodeURIComponent(k)}`, k)
   };
 }
-var SLED_USAGE = "usage: sleds sled --json | sleds sled top <KEY>";
+var SLED_USAGE = "usage: sleds sled --json | sleds sled top <KEY> | sleds sled order <KEY>…";
 async function sledCmd(o) {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
   const top = o.argv[0] === "top" && o.argv.length === 2 && !o.argv[1]?.startsWith("-");
-  if (!top && (o.argv.length !== 1 || o.argv[0] !== "--json")) {
+  const keys = o.argv.slice(1);
+  const order = o.argv[0] === "order" && keys.length > 0 && keys.every((k) => k.trim() && !k.startsWith("-"));
+  if (!top && !order && (o.argv.length !== 1 || o.argv[0] !== "--json")) {
     error(SLED_USAGE);
     return 2;
   }
@@ -23600,6 +23793,8 @@ async function sledCmd(o) {
   }
   if (top)
     return sledTop(client, o.argv[1], log, error);
+  if (order)
+    return sledOrder(client, keys, log, error);
   try {
     log(JSON.stringify(await readOrSay(client, "/proxy/sled", "the sled")));
     return 0;
@@ -23621,6 +23816,19 @@ async function sledTop(client, key, log, error) {
   log(`${typeof r.json?.key === "string" ? r.json.key : key} is first on your sled`);
   return 0;
 }
+async function sledOrder(client, keys, log, error) {
+  const r = await client.postFull("/proxy/sled/order", { order: keys });
+  if (!r) {
+    error("SLEDS unreachable — the sled is unchanged");
+    return 1;
+  }
+  if (r.status >= 300 || r.json?.ok === false) {
+    error(typeof r.json?.error === "string" ? r.json.error : `sled order: HTTP ${r.status}`);
+    return 1;
+  }
+  log(`${typeof r.json?.ordered === "number" ? r.json.ordered : keys.length} ordered on your sled`);
+  return 0;
+}
 
 // src/commands/run.ts
 init_config();
@@ -23726,12 +23934,12 @@ var seatEvent = async (o) => {
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync26, mkdirSync as mkdirSync22, readFileSync as readFileSync28, readdirSync as readdirSync5, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "node:fs";
 import { platform as platform2 } from "node:os";
-import { dirname as dirname17, join as join26 } from "node:path";
+import { dirname as dirname17, join as join27 } from "node:path";
 
 // src/cookieDb.ts
 import { copyFileSync, rmSync as rmSync15 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var QUERY = "SELECT name, hex(encrypted_value) AS ev FROM cookies WHERE host_key LIKE '%claude.ai%'";
 var isBun = () => typeof globalThis.Bun !== "undefined";
 async function queryRows(dbPath) {
@@ -23760,7 +23968,7 @@ function nodeSqlite() {
   return mod;
 }
 async function readCookieRows(dbPath) {
-  const copy = join25(tmpdir2(), `sleds-cookies-${process.pid}-${Date.now()}.sqlite`);
+  const copy = join26(tmpdir2(), `sleds-cookies-${process.pid}-${Date.now()}.sqlite`);
   copyFileSync(dbPath, copy);
   try {
     const rows = await queryRows(copy);
@@ -24053,7 +24261,7 @@ function findFile(root, name) {
       continue;
     }
     for (const e of entries) {
-      const p = join26(dir, e.name);
+      const p = join27(dir, e.name);
       if (e.isDirectory())
         stack.push(p);
       else if (e.name === name)
@@ -24064,7 +24272,7 @@ function findFile(root, name) {
 }
 function findCookieDb(home, source) {
   const b = BROWSERS[source.browser];
-  const root = join26(home, APP_SUPPORT, b.appDir);
+  const root = join27(home, APP_SUPPORT, b.appDir);
   if (!existsSync26(root))
     throw new Error(`no ${source.browser} data at ${root} (is it installed?)`);
   if (!b.profiled) {
@@ -24073,7 +24281,7 @@ function findCookieDb(home, source) {
       throw new Error(`no cookie store under ${root}`);
     return db;
   }
-  const localStatePath = join26(root, "Local State");
+  const localStatePath = join27(root, "Local State");
   const localState = existsSync26(localStatePath) ? readFileSync28(localStatePath, "utf8") : null;
   const wanted = source.profile ?? "Default";
   const { dir, ambiguous } = resolveProfileDir(localState, wanted);
@@ -24081,7 +24289,7 @@ function findCookieDb(home, source) {
     throw new Error(`"${wanted}" names ${ambiguous.length} ${source.browser} profiles (${ambiguous.join(", ")}) — pass the directory or the account email instead`);
   if (!dir)
     throw new Error(`no ${source.browser} profile named "${wanted}" (check chrome://version)`);
-  const db = cookieDbCandidates(join26(root, dir)).find((p) => existsSync26(p));
+  const db = cookieDbCandidates(join27(root, dir)).find((p) => existsSync26(p));
   if (!db)
     throw new Error(`profile "${dir}" has no cookie store yet (open claude.ai in it once)`);
   return db;
@@ -24123,11 +24331,11 @@ function fetchSeatUsage(jar, org, now, run) {
     return { usage: null, status };
   }
 }
-function launchAgentPlist(bun, script, home, source) {
+function launchAgentPlist(argv, home, source) {
   const label = launchLabel(source);
-  const log = join26(home, ".config", "sleds", `${label.slice("ai.sleds.".length)}.log`);
+  const log = join27(home, ".config", "sleds", `${label.slice("ai.sleds.".length)}.log`);
   const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  const args = [bun, script, "seat-sync", ...sourceArgs(source)].map((a) => `    <string>${esc(a)}</string>`).join(`
+  const args = [...argv, "seat-sync", ...sourceArgs(source)].map((a) => `    <string>${esc(a)}</string>`).join(`
 `);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -24147,16 +24355,14 @@ ${args}
 `;
 }
 function plistPath2(home, source) {
-  return join26(home, "Library", "LaunchAgents", `${launchLabel(source)}.plist`);
+  return join27(home, "Library", "LaunchAgents", `${launchLabel(source)}.plist`);
 }
-function install(home, argv, source, log) {
-  const bun = argv[0] ?? process.execPath;
-  const script = argv[1] ?? "";
-  if (!script) {
-    log("cannot resolve the sleds script path to install the timer");
+function install(home, argv, source, log, launchctl) {
+  if (!argv[0]) {
+    log("cannot resolve the sleds command to install the timer");
     return 1;
   }
-  const dir = join26(home, "Library", "LaunchAgents");
+  const dir = join27(home, "Library", "LaunchAgents");
   mkdirSync22(dir, { recursive: true });
   const path = plistPath2(home, source);
   const tokenPath = seatTokenPath(home, source);
@@ -24166,11 +24372,11 @@ function install(home, argv, source, log) {
     writeFileSync25(tokenPath, `${source.token}
 `, { mode: 384 });
   }
-  writeFileSync25(path, launchAgentPlist(bun, script, home, source), { mode: 384 });
+  writeFileSync25(path, launchAgentPlist(argv, home, source), { mode: 384 });
   try {
-    execFileSync5("launchctl", ["unload", path], { stdio: "ignore" });
+    launchctl(["unload", path]);
   } catch {}
-  execFileSync5("launchctl", ["load", "-w", path]);
+  launchctl(["load", "-w", path]);
   log(`seat-sync timer installed (every ${SYNC_INTERVAL_S / 60} min) → ${path}`);
   return 0;
 }
@@ -24195,7 +24401,9 @@ var seatSync = async (o) => {
   if (source.uninstall)
     return uninstall(o.home, source, log);
   if (source.install)
-    return install(o.home, [process.execPath, process.argv[1] ?? ""], source, log);
+    return install(o.home, o.sledsArgv ?? [process.execPath, process.argv[1] ?? ""], source, log, o.launchctl ?? ((args) => {
+      execFileSync5("launchctl", args, args[0] === "unload" ? { stdio: "ignore" } : {});
+    }));
   if (platform2() !== "darwin" && !o.readCookieRows) {
     log("seat-sync is macOS-only for now.");
     return 2;
@@ -24338,7 +24546,7 @@ var sessionEvent = async (o) => {
 // src/commands/specEvent.ts
 init_meter();
 import { readFileSync as readFileSync29, statSync as statSync2 } from "node:fs";
-import { basename as basename6, isAbsolute as isAbsolute4, relative } from "node:path";
+import { basename as basename7, isAbsolute as isAbsolute4, relative } from "node:path";
 var HOOK_STDIN_TIMEOUT_MS3 = 1000;
 var ESTIMATE_TIMEOUT_MS = 4000;
 var MIN_SPEC_CHARS = 200;
@@ -24351,12 +24559,12 @@ function isSpecPath(path) {
     return false;
   if (NOT_SPEC.test(path))
     return false;
-  return SPEC_DIRS.test(path) || SPEC_NAMES.test(basename6(path));
+  return SPEC_DIRS.test(path) || SPEC_NAMES.test(basename7(path));
 }
 function specTitle(body, path) {
   const m = /^#\s+(.+?)\s*$/m.exec(body);
   const t = m?.[1]?.trim();
-  return (t && t.length > 0 ? t : basename6(path).replace(/\.(md|mdx)$/i, "")).slice(0, 120);
+  return (t && t.length > 0 ? t : basename7(path).replace(/\.(md|mdx)$/i, "")).slice(0, 120);
 }
 function looksLikeSpec(body) {
   if (body.trim().length < MIN_SPEC_CHARS)
@@ -24414,7 +24622,7 @@ var specEvent = async (o) => {
   const spec = {
     title: specTitle(body, input.filePath),
     body: body.slice(0, MAX_SPEC_CHARS),
-    repoHint: input.cwd ? basename6(input.cwd) : undefined
+    repoHint: input.cwd ? basename7(input.cwd) : undefined
   };
   try {
     const res = await (o.fetchFn ?? fetch)(`${src.proxyUrl}/proxy/estimate`, {
@@ -25134,12 +25342,12 @@ var webhooksCmd = async (o) => {
 // src/config.ts
 init_settings();
 import { chmodSync as chmodSync7, existsSync as existsSync30, mkdirSync as mkdirSync23, readFileSync as readFileSync31, renameSync as renameSync9, writeFileSync as writeFileSync26 } from "node:fs";
-import { join as join27, resolve as resolve11 } from "node:path";
+import { join as join28, resolve as resolve11 } from "node:path";
 var configDir2 = (home, env = process.env) => {
   const o = env.SLEDS_HOME?.trim();
-  return o ? resolve11(home, o) : join27(home, ".config", "sleds");
+  return o ? resolve11(home, o) : join28(home, ".config", "sleds");
 };
-var configPath2 = (home) => join27(configDir2(home), "config.json");
+var configPath2 = (home) => join28(configDir2(home), "config.json");
 var isObject17 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var optString2 = (v) => typeof v === "string" ? v : undefined;
 var parsePriorEnv2 = (v) => {
@@ -25315,6 +25523,12 @@ function runnerFor3(name, exec = defaultExec, o = {}) {
   }
 }
 
+// src/runtime.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join29, win32 as win322 } from "node:path";
+var isCompiled = (argv1 = process.argv[1]) => Boolean(argv1 && (argv1.startsWith("/$bunfs/") || argv1.startsWith("B:\\~BUN\\")));
+var sledsLink2 = (home = homedir2(), platform = process.platform) => platform === "win32" ? win322.join(process.env.LOCALAPPDATA ?? win322.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join29(home, ".sleds", "bin", "sleds");
+
 // src/schedule.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
 var defaultExec5 = (cmd, args) => {
@@ -25325,7 +25539,7 @@ var defaultExec5 = (cmd, args) => {
 };
 
 // src/settings.ts
-import { dirname as dirname18, join as join28, resolve as resolve12 } from "node:path";
+import { dirname as dirname18, join as join30, resolve as resolve12 } from "node:path";
 var withSeatEnv2 = (command, home, env = process.env, org) => {
   const parts = [];
   const sh = env.SLEDS_HOME?.trim();
@@ -25421,6 +25635,7 @@ commands:
               Token from SLEDS_DEPLOY_TOKEN (Settings \u203A Deploys). SLEDS down never fails a release.
   sled --json What is on your sled (mine with each route, proposed, sent), for a front end.
               sleds sled top KEY     put KEY first on your sled; the engine picks it next
+              sleds sled order KEY\u2026  those items in this order, in the places they hold; the rest stay
   route <key> Print an item's route: its nodes, what each waits on, what is ready, where each
               run can be watched.
               --dot                  Graphviz instead: \`sleds route QW-142 --dot | dot -Tpng -o route.png\`
@@ -25430,10 +25645,10 @@ commands:
                                      disarms; --name <engine> sends it to that engine; --json)
               answer <key>/<node>    answer a parked node: the words after it, or --stdin; it
                                      goes back to ready and the engine takes it (--json)
-              propose <key>          hold a drafted route on the item for a person's yes, filing
-                                     nothing (a drafting session with no connector): --file
+              propose <key>          hold a planned route on the item for a person's yes, filing
+                                     nothing (a planning session with no connector): --file
                                      <nodes.json> or --stdin, --name <engine> (--json)
-              approve <key>          a person's yes to a drafted route: files it and, under
+              approve <key>          a person's yes to a planned route: files it and, under
                                      Pickup: Auto, arms it; --file <nodes.json> approves an
                                      edited set instead (--json)
               run <key>              run the engine for this one item until its route lands
@@ -25469,8 +25684,8 @@ commands:
                                      high, xhigh or max. With --agent, a claude command gets it;
                                      another runs as given and the engine says so
               --decider-effort <e>   the effort every answerer launches with; default the node's
-              --drafter-model <id>   the model a drafting session launches with; default the node's
-              --drafter-effort <e>   the effort a drafting session launches with; default the node's
+              --drafter-model <id>   the model a planning session launches with; default the node's
+              --drafter-effort <e>   the effort a planning session launches with; default the node's
               --pr-title '<template>'  the PR title the session must use: {key} {ticket} {item}
                                      {node} {title}, e.g. 'feat: [{key}] {title}'
               Flags left out come from your engine profile in SLEDS (Settings); with Pickup:
@@ -25597,14 +25812,20 @@ var hookStdin = async () => {
   const text = await readStdin2(300);
   return text.trim() ? text : undefined;
 };
-var sledsArgv = (execPath = process.execPath, script = process.argv[1], realpath) => stableArgv2(script ? [execPath, script] : [execPath], realpath);
+var sledsArgv = (execPath = process.execPath, script = process.argv[1], realpath, o = {}) => {
+  if (isCompiled(script)) {
+    const link = sledsLink2(o.home);
+    return stableArgv2([(o.exists ?? existsSync31)(link) ? link : execPath], realpath, o.home);
+  }
+  return stableArgv2(script ? [execPath, script] : [execPath], realpath, o.home);
+};
 var shellQuote = (s) => /^[\w./-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
-var statusLineCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "statusline"].map(shellQuote).join(" "), home);
-var seatEventCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "seat-event"].map(shellQuote).join(" "), home);
-var promptEventCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "prompt-event"].map(shellQuote).join(" "), home);
-var sessionEventCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "session-event"].map(shellQuote).join(" "), home);
-var stopEventCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "stop-event"].map(shellQuote).join(" "), home);
-var specEventCommand = (argv, home = homedir()) => withSeatEnv2([...argv, "spec-event"].map(shellQuote).join(" "), home);
+var statusLineCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "statusline"].map(shellQuote).join(" "), home);
+var seatEventCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "seat-event"].map(shellQuote).join(" "), home);
+var promptEventCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "prompt-event"].map(shellQuote).join(" "), home);
+var sessionEventCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "session-event"].map(shellQuote).join(" "), home);
+var stopEventCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "stop-event"].map(shellQuote).join(" "), home);
+var specEventCommand = (argv, home = homedir3()) => withSeatEnv2([...argv, "spec-event"].map(shellQuote).join(" "), home);
 var mcpFlag = (flags) => flags["no-mcp"] === true ? false : flags.mcp === true ? true : undefined;
 var main = async (argv) => {
   const { cmd, flags } = parseArgs(argv);
@@ -25612,7 +25833,7 @@ var main = async (argv) => {
     console.log(commandUsage(cmd));
     return 0;
   }
-  const home = homedir();
+  const home = homedir3();
   const scheduler = {
     platform: platform3(),
     home,
@@ -25822,7 +26043,7 @@ var main = async (argv) => {
     case "mcp":
       return mcp({ home });
     case "seat-sync":
-      return seatSync({ home, argv: process.argv.slice(3) });
+      return seatSync({ home, argv: process.argv.slice(3), sledsArgv: sledsArgv() });
     case "statusline":
       return statusline({ home });
     case "help":
@@ -25835,7 +26056,7 @@ ${renderHelpText(argv[1])}`);
     case "version":
     case "--version":
     case "-v":
-      console.log("sleds 0.1.46");
+      console.log("sleds 0.1.47");
       return 0;
     default:
       console.error(`unknown command: ${cmd}