@ucsandman/legcli 0.11.0 → 0.12.0

package/fixtures/limits/claude/claude-session-limit.json

@@ -5,7 +5,7 @@
   "produced_by": "https://code.claude.com/docs/en/costs (section: When a developer asks about a limit)",
   "where": "any",
   "text": "You’ve hit your session limit",
-  "pattern": "You.ve hit your session limit",
+  "pattern": "You.ve (hit|reached) your session limit",
   "exit_code": null,
   "classification": "limit"
 }

package/fixtures/limits/claude/claude-weekly-limit.json

@@ -5,7 +5,7 @@
   "produced_by": "https://code.claude.com/docs/en/costs (section: When a developer asks about a limit)",
   "where": "any",
   "text": "You’ve hit your weekly limit",
-  "pattern": "You.ve hit your weekly limit",
+  "pattern": "You.ve (hit|reached) your weekly limit",
   "exit_code": null,
   "classification": "limit"
 }

package/fixtures/live/claude/resume-model-probe.json

@@ -0,0 +1,20 @@
+{
+  "agent": "claude",
+  "signal": "resume-with-model",
+  "captured_at": "2026-09-17T21:40:00Z",
+  "source": "observed-live",
+  "claude_version": "2.1.274",
+  "probe": [
+    "echo 'reply with exactly: ok' | claude -p --model sonnet --output-format json --max-turns 1",
+    "echo 'what did I ask you to reply with before? answer in 5 words' | claude -p --resume <session_id> --model haiku --output-format json --max-turns 1"
+  ],
+  "observed": {
+    "same_session_id": true,
+    "conversation_kept": true,
+    "second_turn_result": "To reply with exactly ok.",
+    "second_turn_modelUsage_keys": ["claude-haiku-4-5-20251001"],
+    "second_turn_cacheReadInputTokens": 0,
+    "second_turn_is_error": false
+  },
+  "conclusion": "`--resume <id> --model <alias>` composes: the session id is kept, the prior turn is remembered, and only the new model answers. The resumed context is re-read at the new model's rates (cache read 0 on the first resumed turn), so a downshift keeps the conversation and an upshift pays the re-read at the higher price. Settles spec G1 (docs/redesign-2026-09-17.md)."
+}

package/fixtures/live/claude/usage-oauth.json

@@ -0,0 +1,87 @@
+{
+  "agent": "claude",
+  "signal": "usage",
+  "source": "observed-live",
+  "captured_at": "2026-09-17T20:16:00Z",
+  "endpoint": "GET https://api.anthropic.com/api/oauth/usage",
+  "status": 200,
+  "produced_by": "docs/redesign-2026-09-17.md \"What I verified myself before writing\" (2026-09-17 20:16Z, HTTP 200, 23 keys) and the tournament candidate transcript that printed the raw limits[] rows (kind, group, percent, severity, resets_at as ISO, scope{model{id,display_name},surface}, is_active), fetched through src/taps/claude-usage.mjs fetchClaudeUsage",
+  "scrubbed": "no ids, no tokens, no account identifiers: only the limit rows, the two legacy windows and the spend block Leg reads",
+  "verified": [
+    "limits[] holds session 29%, weekly_all 47% and weekly_scoped 63% with scope.model.display_name \"Fable\" and is_active true",
+    "seven_day_opus and seven_day_sonnet are null",
+    "extra_usage.is_enabled false, disabled_reason \"out_of_credits\", monthly_limit 12500 (minor units)",
+    "spend.can_toggle false, can_purchase_credits false",
+    "seven_day_breakdown: Claude Code 100, Chats 0, Cowork 0"
+  ],
+  "payload": {
+    "five_hour": {
+      "utilization": 29,
+      "resets_at": "2026-09-17T20:30:00Z"
+    },
+    "seven_day": {
+      "utilization": 47,
+      "resets_at": "2026-09-23T19:00:00Z"
+    },
+    "seven_day_opus": null,
+    "seven_day_sonnet": null,
+    "limits": [
+      {
+        "kind": "session",
+        "group": "session",
+        "percent": 29,
+        "severity": "normal",
+        "resets_at": "2026-09-17T20:30:00Z",
+        "scope": null,
+        "is_active": false
+      },
+      {
+        "kind": "weekly_all",
+        "group": "weekly",
+        "percent": 47,
+        "severity": "normal",
+        "resets_at": "2026-09-23T19:00:00Z",
+        "scope": null,
+        "is_active": false
+      },
+      {
+        "kind": "weekly_scoped",
+        "group": "weekly",
+        "percent": 63,
+        "severity": "normal",
+        "resets_at": "2026-09-23T19:00:00Z",
+        "scope": {
+          "model": {
+            "id": null,
+            "display_name": "Fable"
+          },
+          "surface": null
+        },
+        "is_active": true
+      }
+    ],
+    "seven_day_breakdown": [
+      {
+        "name": "Claude Code",
+        "percentage": 100
+      },
+      {
+        "name": "Chats",
+        "percentage": 0
+      },
+      {
+        "name": "Cowork",
+        "percentage": 0
+      }
+    ],
+    "extra_usage": {
+      "is_enabled": false,
+      "disabled_reason": "out_of_credits",
+      "monthly_limit": 12500
+    },
+    "spend": {
+      "can_toggle": false,
+      "can_purchase_credits": false
+    }
+  }
+}

package/fixtures/verified.json

@@ -2,7 +2,7 @@
   "_comment": "The single source of truth for every dated, numbered claim Leg makes in public. scripts/check-claims.mjs asserts that each surface listed here states exactly these values, and --strict additionally compares the pinned CLI versions against what those CLIs currently publish. Re-verify on a real machine, then edit this file and every surface in the same commit.",
   "verifiedOn": "2026-09-11",
   "verifiedOnLong": "11 September 2026",
-  "tests": 674,
+  "tests": 830,
   "clis": {
     "claude": {
       "label": "Claude Code",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ucsandman/legcli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Usage-limit monitor and automatic handoff for Claude Code, Codex, agy and Grok. Type leg claude|codex|agy|grok and get the same interactive agent with a board alongside, auto-approve on by default, usage tracking per agent and account, a live context handoff bundle, and at the limit the next agent continuing in the same terminal. $79 once, 30-day money-back guarantee.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -67,6 +67,7 @@
     "@eslint/js": "^9",
     "eslint": "^9",
     "globals": "^16",
-    "marked": "^18.0.13"
+    "marked": "^18.0.13",
+    "playwright": "^1.63.0"
   }
 }

package/scripts/seed-fake-cards.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 // seed-fake-cards — fills a LEG_HOME with N backlog cards (fake chain, build
 // pipeline) through the same path the CLI uses (src/cards.mjs createCard), for
-// perf tests and manual board load-testing.
-//   node scripts/seed-fake-cards.mjs --home <dir> --repo <git repo path> --count 50
+// perf tests and manual board load-testing. --finished and --live add a
+// realistic mix of finished and live cards, driven through humanAction
+// (src/orchestrator.mjs) rather than by hand-editing card.json.
+//   node scripts/seed-fake-cards.mjs --home <dir> --repo <git repo path> --count 50 --finished 10 --live 3
 import { resolve } from 'node:path'
 
 function parseArgs(argv) {
@@ -15,21 +17,72 @@ function parseArgs(argv) {
 }
 
 const args = parseArgs(process.argv.slice(2))
-if (!args.home) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50]\n'); process.exit(2) }
-if (!args.repo) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50]\n'); process.exit(2) }
+if (!args.home) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50] [--finished 0] [--live 0]\n'); process.exit(2) }
+if (!args.repo) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50] [--finished 0] [--live 0]\n'); process.exit(2) }
 const count = parseInt(args.count ?? '50', 10) || 50
+const finishedCount = parseInt(args.finished ?? '0', 10) || 0
+const liveCount = parseInt(args.live ?? '0', 10) || 0
 
 // LEG_HOME must be set before store.mjs (and the ledger.mjs it imports) load.
 process.env.LEG_HOME = resolve(args.home)
 process.env.BATON_HOME = process.env.LEG_HOME
 const { createCard } = await import('../src/cards.mjs')
+const { humanAction } = await import('../src/orchestrator.mjs')
 
 const TITLES = ['Add retry to fetch', 'Fix flaky lease test', 'Refactor log tail', 'Wire up SSE health', 'Trim README', 'Bump adapter timeout', 'Dedupe blocked events', 'Guard null station', 'Speed up card list', 'Polish error copy']
+const actor = { type: 'human', id: 'seed' }
 
 let created = 0
 for (let i = 0; i < count; i++) {
   const title = `${TITLES[i % TITLES.length]} #${i + 1}`
-  await createCard({ repo: args.repo, task: title, title, chain: 'fake' }, { type: 'human', id: 'seed' })
+  await createCard({ repo: args.repo, task: title, title, chain: 'fake' }, actor)
   created += 1
 }
-process.stdout.write(`seeded ${created} card(s) into ${process.env.BATON_HOME}\n`)
+
+// Finished cards: queue, start, then drive a leg_result straight to done or
+// failed. `chain: 'fake'` has no fallback, so a `failed` outcome exhausts the
+// chain immediately (src/chain.mjs leg_result) instead of handing off.
+let done = 0
+let failed = 0
+for (let i = 0; i < finishedCount; i++) {
+  const wantDone = i % 2 === 0
+  const title = `Seeded finished card #${i + 1}`
+  const card = await createCard({ repo: args.repo, task: title, title, chain: 'fake', queue: true }, actor)
+  humanAction(card.card_id, 'start', {}, actor)
+  humanAction(card.card_id, 'leg_result', { outcome: wantDone ? 'completed' : 'failed', adapter: 'fake' }, actor)
+  if (wantDone) done += 1
+  else failed += 1
+}
+
+// Live cards: cycle through queued, running, needs_approval and paused, each
+// reached through the same transitions a real run takes. `fake=sleep` keeps a
+// running (or queued, on a board that is actually driving its scheduler) card
+// from finishing out from under the board the moment it is looked at.
+const LIVE_KINDS = ['queued', 'running', 'needs_approval', 'paused']
+const liveSeeded = { queued: 0, running: 0, needs_approval: 0, paused: 0 }
+for (let i = 0; i < liveCount; i++) {
+  const kind = LIVE_KINDS[i % LIVE_KINDS.length]
+  const title = `Seeded live card #${i + 1}`
+  if (kind === 'needs_approval') {
+    // a second, approval-gated leg to hand off into
+    const card = await createCard({ repo: args.repo, task: title, title, chain: 'fake-claude,fake-codex', approve: 'fake-codex', queue: true }, actor)
+    humanAction(card.card_id, 'start', {}, actor)
+    humanAction(card.card_id, 'leg_result', { outcome: 'incomplete', adapter: 'fake-claude' }, actor)
+    humanAction(card.card_id, 'bundle_written', {}, actor)
+  } else {
+    const card = await createCard({ repo: args.repo, task: title, title, chain: 'fake', fake_mode: 'fake=sleep', queue: true }, actor)
+    if (kind === 'running' || kind === 'paused') humanAction(card.card_id, 'start', {}, actor)
+    if (kind === 'paused') humanAction(card.card_id, 'pause', {}, actor)
+  }
+  liveSeeded[kind] += 1
+}
+
+// test/perf.test.mjs matches "seeded N card(s)" as a substring, so the
+// original --count-only sentence stays intact; the finished/live counts are
+// appended rather than folded into it.
+const liveSummary = LIVE_KINDS.map((k) => `${liveSeeded[k]} ${k}`).join(', ')
+const extra = []
+if (finishedCount) extra.push(`${finishedCount} finished (${done} done, ${failed} failed)`)
+if (liveCount) extra.push(`${liveCount} live (${liveSummary})`)
+const suffix = extra.length ? `, ${extra.join(', ')}` : ''
+process.stdout.write(`seeded ${created} card(s)${suffix} into ${process.env.BATON_HOME}\n`)

package/scripts/seed-wes-board.mjs

@@ -17,7 +17,7 @@ import { tmpdir } from 'node:os'
 // a throwaway home under the OS temp dir, so nothing is written into the repo
 process.env.LEG_HOME ||= process.env.BATON_HOME || join(tmpdir(), 'leg-seed-board')
 process.env.BATON_HOME ||= process.env.LEG_HOME
-const { createSession, updateSession } = await import('../src/sessions.mjs')
+const { createSession, updateSession, HANDOFF_ORDER_CAPABILITY } = await import('../src/sessions.mjs')
 const { recordUsage, markLimited } = await import('../src/usage.mjs')
 const { spawn } = await import('node:child_process')
 const { writeFileSync } = await import('node:fs')
@@ -37,28 +37,40 @@ const min = 60_000, hour = 60 * min
 const ago = (ms) => new Date(Date.now() - ms).toISOString()
 const B = String.fromCharCode(92)          // one backslash, unmangled by any shell
 const w = (...parts) => parts.join(B)
-const P = (...rest) => w('C:', 'Projects', ...rest)
+// 'Projects-seed', not 'Projects': these rows print like real repos, but a
+// button on a seeded row (End as a card, Land) runs git against the path it
+// names. On 2026-09-17 a seeded End-as-card cut a worktree and wrote a bundle
+// into the real recruiting-tool repository on this machine. A path that
+// does not exist 409s instead.
+const P = (...rest) => w('C:', 'Projects-seed', ...rest)
 // the shape that matters is LENGTH: a real worktree path under a temp dir runs
 // past 90 characters, which is what buried the prompt in the rejected design
 const LONG = w('C:', 'Users', 'operator', 'AppData', 'Local', 'Temp', 'agent',
   'C--Projects-baton--baton-worktrees-s-20260915-000000-claude-0000',
   '00000000-0000-0000-0000-000000000000')
 
+// `model` is the alias the leg resolved to, `waiting` is the Notification shape
+// (a human is being waited on), `dirty` and `ahead` are what the git poll
+// writes. One live row carries a permission prompt and another an idle prompt,
+// because the board's whole attention story is those two rows; one live row
+// carries no model at all, so the register's agent-alone path is on screen too.
 const rows = [
   { id: 's-20260915-0049-claude-2fbf', agent: 'claude', status: 'warning', started: 4 * hour + 24 * min,
-    cwd: P('baton'), repo: P('baton'), branch: 'main',
+    cwd: P('baton'), repo: P('baton'), branch: 'main', model: 'fable', dirty: 3, ahead: 2,
+    waiting: { type: 'permission_prompt', message: 'Bash(git push origin HEAD)', since: ago(40_000) },
     task: 'ultracode run a tournament of ideas to drastically redesign and improve the UI for this project. I do not like the current setup.' },
-  { id: 's-20260915-0213-claude-95d3', agent: 'claude', status: 'running', started: 2 * hour + 46 * min,
-    cwd: w('C:', 'documents'), repo: null, branch: null, task: null },
+  { id: 's-20260915-0213-claude-95d3', agent: 'claude', status: 'running', started: 2 * hour + 46 * min, quiet: 4 * min,
+    cwd: w('C:', 'documents'), repo: null, branch: null, model: 'sonnet', task: null },
   { id: 's-20260915-0257-claude-88e8', agent: 'claude', status: 'warning', started: 2 * hour + 2 * min,
-    cwd: P('recruiting-tool'), repo: P('recruiting-tool'), branch: 'main',
+    cwd: P('recruiting-tool'), repo: P('recruiting-tool'), branch: 'main', model: 'opus', dirty: 1,
+    waiting: { type: 'idle_prompt', message: 'Claude is waiting for your input', since: ago(11 * min) },
     task: `<image name=screenshot.png path=${w('C:', 'Users', 'operator', 'Desktop', 'shot.png')}> [Image #1] sourcing candidates is a huge pain for my friend who recruits on LinkedIn, how can we help` },
   { id: 's-20260915-0455-claude-8e8a', agent: 'claude', status: 'running', started: 5 * min,
     cwd: w('C:', 'Projects'), repo: null, branch: null, task: '/handoff-load verifier-reach-contracts' },
   { id: 's-20260914-2211-claude-4c10', agent: 'claude', status: 'lost', started: 6 * hour, ended: 3 * hour,
-    cwd: w(LONG, 'discovery-loop'), repo: P('discovery-loop'), branch: 'main', task: 'run the nightly discovery loop' },
+    cwd: w(LONG, 'discovery-loop'), repo: P('discovery-loop'), branch: 'main', model: 'fable', task: 'run the nightly discovery loop' },
   { id: 's-20260914-2010-codex-7b31', agent: 'codex', status: 'lost', started: 7 * hour, ended: 4 * hour,
-    cwd: w(LONG, 'costclaw'), repo: P('costclaw'), branch: 'main', task: 'fix the per-model price table for Opus' },
+    cwd: w(LONG, 'costclaw'), repo: P('costclaw'), branch: 'main', model: 'gpt-5.6-sol', task: 'fix the per-model price table for Opus' },
   { id: 's-20260914-1802-agy-d9f2', agent: 'agy', status: 'lost', started: 9 * hour, ended: 6 * hour,
     cwd: w('C:', 'Projects'), repo: null, branch: null, task: 'summarise yesterday' },
   { id: 's-20260914-1533-claude-a04b', agent: 'claude', status: 'ended', started: 11 * hour, ended: 8 * hour,
@@ -67,22 +79,79 @@ const rows = [
     cwd: P('costclaw'), repo: P('costclaw'), branch: 'main', task: 'monthly rollup excludes refunded calls' },
 ]
 
+// distinct from files_touched below: the board prints basenames, and two
+// different paths ending in the same name read as one file listed twice
+const DIRTY = ['server.mjs', 'attach.mjs', 'usage.mjs']
+// The ladder a terminal started with (docs/redesign-2026-09-17.md B.3): the
+// claude models first, because a same-login switch keeps the conversation, then
+// the other CLIs. Written onto the record the way src/attach.mjs writes it, so
+// the picker, the per-terminal ladder editor and `Back to fable` all have the
+// shape they render from. `orderFromLadder` of this list is the default order,
+// which is what `ladderFor` insists on.
+const SEED_LADDER = [
+  { agent: 'claude', account: 'default', model: 'fable', when: 'always', cost: 'plan' },
+  { agent: 'claude', account: 'default', model: 'opus', when: 'always', cost: 'plan' },
+  { agent: 'claude', account: 'default', model: 'sonnet', when: 'always', cost: 'plan' },
+  { agent: 'codex', account: 'default', model: null, when: 'always', cost: 'plan' },
+  { agent: 'agy', account: 'default', model: null, when: 'walled-only', cost: 'free' },
+]
 for (const r of rows) {
-  createSession({ id: r.id, agent: r.agent, cwd: r.cwd, repo: r.repo, branch: r.branch, argv: [r.agent], runner_pid: r.ended ? 1 : livePid() })
+  createSession({
+    id: r.id, agent: r.agent, cwd: r.cwd, repo: r.repo, branch: r.branch, argv: [r.agent],
+    runner_pid: r.ended ? 1 : livePid(), model: r.model ?? null,
+    // what a terminal started by this Leg carries: without it the board offers
+    // the ladder editor read-only and the model rail stays text
+    runtimeCapabilities: r.ended ? [] : [HANDOFF_ORDER_CAPABILITY],
+    // which CLIs were on the PATH when this terminal started. Without it the
+    // server cannot say which rung is eligible and the row prints the caveat
+    // for an older record instead of a destination.
+    installed: r.ended ? null : { claude: true, codex: true, agy: true, grok: false },
+  })
   updateSession(r.id, {
+    ...(r.ended ? {} : { handoff_ladder: SEED_LADDER.map((x) => ({ ...x })) }),
+    // the claude conversation id: a downshift on the same login resumes it,
+    // which is the only reason a picker row can say it keeps the conversation
+    ...(r.ended || r.agent !== 'claude' ? {} : { agent_session_id: `conv-${r.id.slice(-4)}` }),
     status: r.status,
     started_at: ago(r.started),
-    last_activity: ago(r.ended ?? 0),
+    last_activity: ago(r.ended ?? r.quiet ?? 0),
     ended_at: r.ended ? ago(r.ended) : null,
     task: r.task,
     turns: r.task ? 12 : 0,
+    waiting: r.waiting ?? null,
+    // `ahead` is written by the git poll in src/attach.mjs; an older record has
+    // no such key, and the row prints the token only when it is there
+    ...(r.ahead ? { ahead: r.ahead } : {}),
+    files_dirty: r.dirty && r.repo ? DIRTY.slice(0, r.dirty).map((f) => w(r.cwd, 'src', f)) : [],
     files_touched: r.repo ? [w(r.cwd, 'src', 'board', 'board.css'), w(r.cwd, 'src', 'board', 'sessions.js')] : [],
   })
 }
 
+// The two windows are what an older Leg record carries; `buckets` is what the
+// live `limits[]` array carries, and the shape here is the one verified off
+// the endpoint on 2026-09-17: a session bucket, an account-wide weekly, and a
+// model-scoped weekly the endpoint itself marks active. The board prints the
+// active one, which is the whole point: 95% is the login, 63% is what will
+// actually stop the work.
+const fiveHourReset = Math.floor((Date.now() + 3 * hour) / 1000)
+const weekReset = Math.floor((Date.now() + 40 * hour) / 1000)
 recordUsage('claude', 'default',
-  { five_hour: { pct: 38, resets_at: Math.floor((Date.now() + 3 * hour) / 1000) },
-    seven_day: { pct: 95, resets_at: Math.floor((Date.now() + 40 * hour) / 1000) } },
+  { five_hour: { pct: 38, resets_at: fiveHourReset },
+    seven_day: { pct: 95, resets_at: weekReset },
+    buckets: [
+      { kind: 'session', group: 'session', model: null, percent: 38, resets_at: fiveHourReset, is_active: false, severity: 'normal' },
+      { kind: 'weekly_all', group: 'weekly', model: null, percent: 95, resets_at: weekReset, is_active: false, severity: 'normal' },
+      { kind: 'weekly_scoped', group: 'weekly', model: 'fable', percent: 63, resets_at: weekReset, is_active: true, severity: 'normal' },
+      // a second model family with a reading of its own. The live payload on
+      // 2026-09-17 had `seven_day_opus` null, so this is the shape the endpoint
+      // publishes once opus has been used, not a figure anyone measured; it is
+      // here because the model rail and the per-model capacity phrase have
+      // nothing to draw with one bucket.
+      { kind: 'weekly_scoped', group: 'weekly', model: 'opus', percent: 12, resets_at: weekReset, is_active: false, severity: 'normal' },
+    ],
+    // the live payload on 2026-09-17: credits are off and cannot be turned on
+    // from the API, which is what the ladder editor says under may_spend
+    extra_usage: { enabled: false, reason: 'out_of_credits', can_toggle: false, limit_minor: 12500, used_minor: 0 } },
   'statusline', { observed_at: ago(2 * hour + 13 * min) })
 markLimited('codex', 'default', { resets_at: Math.floor((Date.now() + 29 * hour) / 1000), reason: 'limit', source: 'hook' })
 // agy publishes no usage figure, ever. Left unwritten on purpose.

package/src/accounts.mjs

@@ -43,7 +43,12 @@ export const LAYOUT = {
 export function accountsFile() { return join(home(), 'accounts.json') }
 export function accountDir(agent, name) { return join(home(), 'accounts', agent, name) }
 
-const NAME_RE = /^[a-z0-9][a-z0-9_-]{0,29}$/i
+// A name is a directory segment, never a path: it is joined into the CLI's
+// config dir and into the usage record's file name. Exported so the one rule
+// has one owner (src/preferences.mjs validates a rung's account with it, and
+// src/usage.mjs refuses to write a record under anything else).
+export const ACCOUNT_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,29}$/i
+const NAME_RE = ACCOUNT_NAME_RE
 
 export function readAccounts() {
   const base = { claude: ['default'], codex: ['default'], agy: ['default'], grok: ['default'] }