@ucsandman/legcli 0.13.1 → 0.15.0

package/bin/leg.mjs

@@ -5,32 +5,15 @@
 //   leg card ls [--json] | show <id> | run <id> | rm <id> [--delete-branch] | events <id>
 //   leg card <pause|resume|kill|approve|handoff-now|rerun> <id> | reassign <id> --adapter a [--mode m]
 //   leg scheduler start [--ticks N] [--interval-ms N] | status | stop
+//
+// Startup cost matters here: every command, `--version` included, paid for
+// loading the whole module graph (orchestrator, scheduler, board, attach…)
+// before main() even ran. Each command group below imports only what it
+// needs, inside its own branch, so `leg --version` and friends stay cheap.
 import { rmSync, appendFileSync, readFileSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
-import { PRESET_NAMES } from '../src/presets.mjs'
-import { readCard, listCards, readEvents, readRuns, cardDir } from '../src/store.mjs'
-import { runCard, humanAction } from '../src/orchestrator.mjs'
-import { createCard, CardInputError } from '../src/cards.mjs'
-import { remove as removeWorktree } from '../src/worktree.mjs'
-import { pruneSessionWorktree } from '../src/land.mjs'
-import { createScheduler, schedulerStatus, pidfile, MAX_CONCURRENT } from '../src/scheduler.mjs'
-import { availableActions } from '../src/chain.mjs'
-import { up, down, stopBoard, status, openBoard } from '../src/launcher.mjs'
-import { attach, ensureBoard } from '../src/attach.mjs'
-import { readShare, addPerson, removePerson, rotate as rotateToken, turnOn, turnOff, linkFor, personNamed, scheme, tlsConfigured, ROLES } from '../src/share.mjs'
-import { normalizeHandoffOrder, ladderFor, readPreferences, writePreferences } from '../src/preferences.mjs'
-import { MODEL_ALIASES } from '../src/buckets.mjs'
-import { SUPERVISED_AGENTS, listSessions, readSession, readEvents as readSessionEvents, requestControl, removeSession, isActive, readLand, sessionDir, appendEvent } from '../src/sessions.mjs'
-import { addAccount, removeAccount, listAccountRows, readAccounts, LAYOUT } from '../src/accounts.mjs'
-import { listUsage, fmtReset, readUsage, isAvailable, candidates, binding, wallActive, evaluateLadder, rungLabel } from '../src/usage.mjs'
-import { home } from '../src/store.mjs'
-import { entitlement, allows, describe as describeLicense, activate as activateLicense, deactivate as deactivateLicense, refresh as refreshLicense, licensePath, BUY_URL } from '../src/license.mjs'
-import { resumeVerdict, bodyOf, ago } from '../src/resume.mjs'
-import { harnessCommand } from '../src/harness/cli.mjs'
-import { adapterCommand } from '../src/adapters/cli.mjs'
-import { historyCommand, worktreesCommand } from '../src/history/cli.mjs'
 
 const SRC = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'src')
 // one source of truth for the version, so the help text cannot drift from the package
@@ -52,6 +35,7 @@ function parseArgs(argv) {
 }
 
 async function cardAdd(args) {
+  const { createCard, CardInputError } = await import('../src/cards.mjs')
   try {
     const card = await createCard({
       repo: args.repo, task: args.task, chain: args.chain, pipeline: args.pipeline,
@@ -74,7 +58,10 @@ async function cardAdd(args) {
 // start the next option in the same terminal. The payload is marked
 // simulated: it is never kept as live evidence, and the wall it records
 // clears after two minutes. codex has no Leg-owned input, so it is refused.
-function simulateLimit(s, { message = null } = {}) {
+// `sessionsApi` is the already-imported src/sessions.mjs namespace: the
+// `sessions` command group loads it once and passes it through.
+function simulateLimit(sessionsApi, s, { message = null } = {}) {
+  const { isActive, sessionDir, appendEvent, readSession } = sessionsApi
   if (!isActive(s)) die(3, `session ${s.session_id} is not active`)
   if (['limit', 'handing_off'].includes(s.status)) die(3, `session ${s.session_id} is already ${s.status}`)
   if (s.agent === 'claude') {
@@ -105,13 +92,16 @@ function simulateLimit(s, { message = null } = {}) {
 // unambiguous. Two are not, so the second is read as an account when that
 // account exists and as a model when the agent has one by that name; a word
 // that is neither is refused by name rather than guessed at.
-export function parseTarget(value, { die: fail = (code, msg) => { throw new Error(msg) } } = {}) {
+// Async so the agent/account lookups (buckets.mjs, accounts.mjs) load only
+// when a two-part target is actually given, not on every CLI invocation.
+export async function parseTarget(value, { die: fail = (code, msg) => { throw new Error(msg) } } = {}) {
   const parts = String(value).split('/').filter(Boolean)
   const agent = parts[0]
   if (!agent) fail(2, 'usage: --to <agent>[/<account>[/<model>]]')
-  const models = MODEL_ALIASES[agent] ?? []
   if (parts.length >= 3) return { agent, account: parts[1], model: parts[2].toLowerCase() }
   if (parts.length === 2) {
+    const [{ MODEL_ALIASES }, { readAccounts }] = await Promise.all([import('../src/buckets.mjs'), import('../src/accounts.mjs')])
+    const models = MODEL_ALIASES[agent] ?? []
     const second = parts[1]
     const accounts = readAccounts()[agent] ?? ['default']
     if (accounts.includes(second)) return { agent, account: second, model: null }
@@ -124,25 +114,28 @@ export function parseTarget(value, { die: fail = (code, msg) => { throw new Erro
 // What a rung is doing right now, in the words the board uses: the wall and its
 // clock, else the percentage of the bucket that binds it, else "no figure".
 // Never a guess: an agent that publishes no number says so.
-function rungState(rung) {
-  const u = readUsage(rung.agent, rung.account)
+// `usage` is the already-imported src/usage.mjs namespace.
+function rungState(rung, usage) {
+  const u = usage.readUsage(rung.agent, rung.account)
   const wall = rung.model ? u.walls?.[rung.model] : null
-  if (wall && wallActive(wall)) return `${rung.model} out until ${fmtReset(wall.limited_until)}`
-  if (!isAvailable(u)) return `at its limit until ${fmtReset(u.limited_until)}`
-  const b = binding(u, rung.model ?? null)
+  if (wall && usage.wallActive(wall)) return `${rung.model} out until ${usage.fmtReset(wall.limited_until)}`
+  if (!usage.isAvailable(u)) return `at its limit until ${usage.fmtReset(u.limited_until)}`
+  const b = usage.binding(u, rung.model ?? null)
   if (b && Number.isFinite(b.percent)) return `${Math.round(b.percent)}% of the ${b.model ? b.model + ' ' : ''}${b.kind === 'session' || b.kind === 'five_hour' ? '5h' : 'week'} window`
   return 'no figure'
 }
 
-function printLadder() {
-  const prefs = readPreferences()
+// `prefsApi`/`usage` are the already-imported src/preferences.mjs and
+// src/usage.mjs namespaces (the `ladder` command group loads them once).
+function printLadder(prefsApi, usage) {
+  const prefs = prefsApi.readPreferences()
   const ladder = prefs.handoff_ladder
-  const rows = evaluateLadder({ from: null, list: ladder, maySpend: prefs.may_spend, reserve: prefs.reserve, automatic: true, climbBack: prefs.climb_back, ladder })
+  const rows = usage.evaluateLadder({ from: null, list: ladder, maySpend: prefs.may_spend, reserve: prefs.reserve, automatic: true, climbBack: prefs.climb_back, ladder })
   out('The ladder a terminal falls down when its login stops. Rung 1 first, every time.')
   ladder.forEach((rung, i) => {
     const r = rows[i]
     const when = rung.when === 'always' ? '' : `  when ${rung.when}`
-    out(`  ${String(i + 1).padEnd(2)} ${rungLabel(rung).padEnd(20)} ${rungState(rung).padEnd(34)} ${r.ok ? 'ready' : r.reason}${when}`)
+    out(`  ${String(i + 1).padEnd(2)} ${usage.rungLabel(rung).padEnd(20)} ${rungState(rung, usage).padEnd(34)} ${r.ok ? 'ready' : r.reason}${when}`)
   })
   out('')
   out(`spending: ${prefs.may_spend ? 'on (a credits or metered rung may be taken unattended)' : 'off (a credits or metered rung is skipped unattended)'} · leg ladder spend on|off`)
@@ -152,38 +145,39 @@ function printLadder() {
   out(`order (what older readers see): ${prefs.handoff_order.join(' → ')}`)
 }
 
-function ladderCommand(cmd, args) {
-  if (!cmd || cmd === 'ls' || cmd === 'show') return printLadder()
-  const prefs = readPreferences()
+async function ladderCommand(cmd, args) {
+  const [prefsApi, usage] = await Promise.all([import('../src/preferences.mjs'), import('../src/usage.mjs')])
+  if (!cmd || cmd === 'ls' || cmd === 'show') return printLadder(prefsApi, usage)
+  const prefs = prefsApi.readPreferences()
   const ladder = prefs.handoff_ladder.map((r) => ({ ...r }))
   if (cmd === 'set') {
     const [nRaw, target] = args._
     const n = parseInt(nRaw, 10)
     if (!Number.isFinite(n) || n < 1) die(2, 'usage: leg ladder set <n> <agent>[/<account>[/<model>]] [--when always|below:N|walled-only]')
     if (!target) die(2, 'usage: leg ladder set <n> <agent>[/<account>[/<model>]] [--when always|below:N|walled-only]')
-    const want = parseTarget(target, { die })
+    const want = await parseTarget(target, { die })
     const rung = { ...want, when: typeof args.when === 'string' ? args.when : 'always' }
     const at = Math.min(n, ladder.length + 1) - 1
     ladder[at] = rung
     try {
-      const saved = writePreferences({ handoff_ladder: ladder })
-      out(`rung ${at + 1} is ${rungLabel(saved.handoff_ladder[at])}${rung.when !== 'always' ? `, when ${rung.when}` : ''}`)
+      const saved = prefsApi.writePreferences({ handoff_ladder: ladder })
+      out(`rung ${at + 1} is ${usage.rungLabel(saved.handoff_ladder[at])}${rung.when !== 'always' ? `, when ${rung.when}` : ''}`)
     } catch (err) { die(2, err.message) }
-    return printLadder()
+    return printLadder(prefsApi, usage)
   }
   if (cmd === 'rm') {
     const n = parseInt(args._[0], 10)
     if (!Number.isFinite(n) || n < 1 || n > ladder.length) die(2, `usage: leg ladder rm <n> (1..${ladder.length})`)
     if (ladder.length === 1) die(2, 'that is the only rung left: a ladder with no rungs has nowhere to hand off to')
     const [gone] = ladder.splice(n - 1, 1)
-    try { writePreferences({ handoff_ladder: ladder }) } catch (err) { die(2, err.message) }
-    out(`removed rung ${n}: ${rungLabel(gone)}`)
-    return printLadder()
+    try { prefsApi.writePreferences({ handoff_ladder: ladder }) } catch (err) { die(2, err.message) }
+    out(`removed rung ${n}: ${usage.rungLabel(gone)}`)
+    return printLadder(prefsApi, usage)
   }
   if (cmd === 'spend') {
     const v = args._[0]
     if (!['on', 'off'].includes(v)) die(2, 'usage: leg ladder spend on|off')
-    const saved = writePreferences({ may_spend: v === 'on' })
+    const saved = prefsApi.writePreferences({ may_spend: v === 'on' })
     return out(saved.may_spend
       ? 'spending is ON: an unattended hand-off may take a rung that bills credits.'
       : 'spending is OFF: an unattended hand-off skips any rung that bills credits, and says so in the ledger.')
@@ -238,13 +232,10 @@ async function main() {
     out('\nPassing the leg to the next runner when limits hit.')
     return
   }
-  if (SUPERVISED_AGENTS.includes(group)) {
-    // leg claude|codex|agy|grok [agent args...]: everything after the agent name
-    // goes straight through.
-    const code = await attach(group, [cmd, ...rest].filter((x) => x !== undefined), { open: (process.env.LEG_NO_OPEN || process.env.BATON_NO_OPEN) !== '1' })
-    process.exit(code)
-  }
   if (group === 'sessions') {
+    const sessionsApi = await import('../src/sessions.mjs')
+    const { listSessions, readSession, isActive, removeSession, readLand, requestControl } = sessionsApi
+    const readSessionEvents = sessionsApi.readEvents
     const list = listSessions()
     if (cmd === 'ls' || !cmd) {
       if (args.json) return out(JSON.stringify(list, null, 2))
@@ -263,17 +254,20 @@ async function main() {
       // is not a destination, is not installed, or is at its wall must be
       // refused now, not silently turn into "whatever is next".
       if (typeof args.to === 'string') {
-        const want = parseTarget(args.to, { die })
+        const [{ normalizeHandoffOrder, ladderFor }, usage, { readAccounts }] = await Promise.all([
+          import('../src/preferences.mjs'), import('../src/usage.mjs'), import('../src/accounts.mjs'),
+        ])
+        const want = await parseTarget(args.to, { die })
         const order = normalizeHandoffOrder(s.handoff_order)
         const ladder = ladderFor(s)
-        const chain = candidates({ agent: s.agent, account: s.account, model: s.model ?? null, accounts: readAccounts(), order, ladder })
+        const chain = usage.candidates({ agent: s.agent, account: s.account, model: s.model ?? null, accounts: readAccounts(), order, ladder })
         const hit = chain.find((c) => c.agent === want.agent && c.account === want.account && (want.model ? (c.model ?? null) === want.model : true))
-        const label = rungLabel(want)
-        if (!hit) die(2, `${label} is not a destination for this terminal (${chain.map((c) => rungLabel(c)).join(', ') || 'none'})`)
+        const label = usage.rungLabel(want)
+        if (!hit) die(2, `${label} is not a destination for this terminal (${chain.map((c) => usage.rungLabel(c)).join(', ') || 'none'})`)
         if (s.installed && s.installed[want.agent] === false) die(3, `${label} is not installed on this machine`)
-        const u = readUsage(want.agent, want.account)
-        if (!isAvailable(u)) die(3, `${label} is at its usage limit until ${fmtReset(u.limited_until)}; pick another, or drop --to to take the next option in the order`)
-        if (hit.model && wallActive(u.walls?.[hit.model])) die(3, `${label} is out until ${fmtReset(u.walls[hit.model].limited_until)}; pick another rung, or drop --to to take the next open one`)
+        const u = usage.readUsage(want.agent, want.account)
+        if (!usage.isAvailable(u)) die(3, `${label} is at its usage limit until ${usage.fmtReset(u.limited_until)}; pick another, or drop --to to take the next option in the order`)
+        if (hit.model && usage.wallActive(u.walls?.[hit.model])) die(3, `${label} is out until ${usage.fmtReset(u.walls[hit.model].limited_until)}; pick another rung, or drop --to to take the next open one`)
         const target = { agent: hit.agent, account: hit.account, ...(hit.model ? { model: hit.model } : {}) }
         requestControl(id, { handoff: true, target })
         return out(`handoff to ${label} requested for ${id}`)
@@ -291,6 +285,7 @@ async function main() {
       // the CLI twin never orphans a worktree the board can no longer reach
       if (s.worktree) {
         try {
+          const { pruneSessionWorktree } = await import('../src/land.mjs')
           const r = pruneSessionWorktree(s)
           out(r.removed
             ? `removed worktree ${s.worktree.path}${r.branchDeleted ? ` and branch ${s.worktree.branch}` : `; kept branch ${s.worktree.branch}`}`
@@ -303,7 +298,7 @@ async function main() {
     // is the only way to reach a per-model wall without waiting for one:
     // --message "You've reached your Fable limit." walls fable and leaves the
     // rest of the login open (src/buckets.mjs).
-    if (cmd === 'simulate-limit') return simulateLimit(s, { message: typeof args.message === 'string' ? args.message : null })
+    if (cmd === 'simulate-limit') return simulateLimit(sessionsApi, s, { message: typeof args.message === 'string' ? args.message : null })
     die(2, `unknown sessions command "${cmd}" (ls|show|events|handoff|end|rm|simulate-limit)`)
   }
   if (group === 'ladder') {
@@ -311,10 +306,21 @@ async function main() {
     // state and the same skip reasons the board's picker shows.
     return ladderCommand(cmd, args)
   }
+  if (group === 'digest') {
+    // What happened while you were away: terminals, cards, landings and walls
+    // in a window, grouped by repository, what needs you first. Read only.
+    // Loaded here and not at the top: a command most sessions never run.
+    const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
+    const { buildDigest, renderDigest, DEFAULT_SINCE } = await import('../src/digest.mjs')
+    let d
+    try { d = buildDigest({ since: typeof a.since === 'string' ? a.since : DEFAULT_SINCE }) } catch (err) { die(2, err.message) }
+    return out(a.json ? JSON.stringify(d, null, 2) : renderDigest(d))
+  }
   if (group === 'resume') {
     // The read side of the pointer. Freshness is never read out of the file:
     // it is recomputed from git here, now, so a resume file cannot describe a
     // picture that is no longer true to whoever is standing in the repo.
+    const { resumeVerdict, bodyOf, ago } = await import('../src/resume.mjs')
     const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
     const where = typeof a.path === 'string' ? resolve(a.path) : process.cwd()
     const v = resumeVerdict(where)
@@ -345,6 +351,9 @@ async function main() {
   if (group === 'share') {
     // Multiplayer, off by default: the board binds a shared address only once
     // at least one person has a token, and every human has their own.
+    const { readShare, addPerson, removePerson, rotate: rotateToken, turnOn, turnOff, linkFor, personNamed, scheme, tlsConfigured, ROLES } = await import('../src/share.mjs')
+    const { stopBoard } = await import('../src/launcher.mjs')
+    const { ensureBoard } = await import('../src/attach.mjs')
     const share = readShare()
     // only the listener moves: the agents running under it are not part of who
     // may look at the board
@@ -374,6 +383,7 @@ async function main() {
     if (cmd === 'on') {
       const a = parseArgs(rest)
       // more than one human is the Team plan
+      const { entitlement, allows, describe: describeLicense, BUY_URL } = await import('../src/license.mjs')
       const ent = entitlement()
       if (!allows(ent, 'share')) die(2, ent.ok ? `leg share is part of the Team plan (per seat); this machine has a ${ent.plan} license. ${BUY_URL}` : describeLicense(ent))
       try {
@@ -428,6 +438,7 @@ async function main() {
     die(2, `unknown share command "${cmd}" (status|on|add|rotate|rm|off)`)
   }
   if (group === 'accounts') {
+    const { addAccount, removeAccount, listAccountRows, LAYOUT } = await import('../src/accounts.mjs')
     if (cmd === 'add') {
       const [agent, name] = args._
       if (!agent || !name) die(2, 'usage: leg accounts add <claude|codex> <name>')
@@ -451,6 +462,7 @@ async function main() {
       return out(`removed ${agent} account "${name}" (your real ${LAYOUT[agent]?.home() ?? 'home'} was not touched)`)
     }
     if (cmd === 'ls' || !cmd) {
+      const { listUsage, fmtReset } = await import('../src/usage.mjs')
       const usage = Object.fromEntries(listUsage().map((u) => [`${u.agent}--${u.account}`, u]))
       for (const r of listAccountRows()) {
         const u = usage[`${r.agent}--${r.name}`]
@@ -465,12 +477,14 @@ async function main() {
   if (group === 'harness') {
     // The portable harness: the working environment a hand-off carries with
     // the task. Off until `leg harness enable` (src/harness/index.mjs).
+    const { harnessCommand } = await import('../src/harness/cli.mjs')
     const code = await harnessCommand(cmd, args, { out, die })
     process.exit(code)
   }
   if (group === 'adapter' || group === 'adapters') {
     // Custom adapters: any CLI as a card agent, from a JSON spec on disk
     // (src/adapters/custom.mjs). The built-ins need none of this.
+    const { adapterCommand } = await import('../src/adapters/cli.mjs')
     const code = await adapterCommand(cmd, args, { out, die })
     process.exit(code)
   }
@@ -479,6 +493,7 @@ async function main() {
     // stores hold: a read-only index (src/history/index.mjs). `continue`
     // starts a normal supervised leg on one of them. `leg history --json` is
     // `leg history ls --json`: a leading flag names no verb.
+    const { historyCommand, worktreesCommand } = await import('../src/history/cli.mjs')
     const isHelp = cmd === '--help' || cmd === '-h' || cmd === 'help' || args.help || args.h
     const bare = typeof cmd === 'string' && cmd.startsWith('--')
     const verb = isHelp ? 'help' : (bare ? 'ls' : cmd)
@@ -492,11 +507,13 @@ async function main() {
   if (group === 'license') {
     // The paid gate. Keys verify offline against the public key in
     // src/license.mjs; nothing here talks to the network except refresh.
+    const { entitlement, describe: describeLicense, activate: activateLicense, deactivate: deactivateLicense, refresh: refreshLicense, licensePath, BUY_URL } = await import('../src/license.mjs')
     if (!cmd || cmd === 'status') {
-      const ent = entitlement()
+      // looking does not start the trial clock; the first session does
+      const ent = entitlement({ startTrial: false })
       out(describeLicense(ent))
       if (ent.source === 'license') out(`stored at ${licensePath()}`)
-      if (!ent.ok) out(`Buy: ${BUY_URL}   then: leg license activate <key>`)
+      if (!ent.ok || ent.source === 'trial') out(`Buy: ${BUY_URL}   then: leg license activate <key>`)
       return
     }
     if (cmd === 'activate') {
@@ -508,7 +525,7 @@ async function main() {
       } catch (err) { die(2, err.message) }
       return
     }
-    if (cmd === 'deactivate') return out(deactivateLicense() ? `removed ${licensePath()}; Leg needs a key again before it will run` : 'no license was stored')
+    if (cmd === 'deactivate') return out(deactivateLicense() ? `removed ${licensePath()}; Leg is back on the trial if it has days left, otherwise it needs a key` : 'no license was stored')
     if (cmd === 'refresh') {
       try { const p = await refreshLicense(); out(`renewed ${p.plan} license ${p.id}, valid through ${p.expires}`) } catch (err) { die(2, err.message) }
       return
@@ -518,18 +535,22 @@ async function main() {
   if (group === 'uninstall') {
     // Leg never edits ~/.claude or ~/.codex; everything it added lives under
     // $LEG_HOME (sessions, usage, extra-account dirs, cards).
+    const { home } = await import('../src/store.mjs')
     const dir = home()
     if (!args.yes) {
       out(`leg uninstall removes ${dir} (sessions, usage, extra-account dirs, cards, board pidfile) and nothing else.`)
       out('Your real ~/.claude, ~/.codex and agy homes are never touched. Re-run with --yes to do it.')
       return
     }
+    const { listAccountRows, removeAccount } = await import('../src/accounts.mjs')
+    const { down } = await import('../src/launcher.mjs')
     for (const r of listAccountRows()) if (r.name !== 'default') removeAccount(r.agent, r.name)
     await down()
     rmSync(dir, { recursive: true, force: true })
     return out(`removed ${dir}; now: npm rm -g @ucsandman/legcli`)
   }
   if (group === 'card') {
+    const { readCard, listCards, readEvents, readRuns, cardDir } = await import('../src/store.mjs')
     if (cmd === 'add') return cardAdd(args)
     if (cmd === 'ls') {
       const cards = listCards()
@@ -542,6 +563,7 @@ async function main() {
     const card = readCard(id) || die(3, `card not found: ${id}`)
     if (cmd === 'show') {
       if (args.json) return out(JSON.stringify({ card, runs: readRuns(id) }, null, 2))
+      const { availableActions } = await import('../src/chain.mjs')
       out(fmtCard(card))
       out(`  repo: ${card.repo}`)
       out(`  worktree: ${card.worktree ?? '(none yet)'}`)
@@ -556,12 +578,14 @@ async function main() {
       return
     }
     if (cmd === 'run') {
+      const { runCard } = await import('../src/orchestrator.mjs')
       const final = await runCard(id)
       out(`${final.card_id} ${final.status} at ${final.station}`)
       process.exit(final.status === 'done' ? 0 : 1)
     }
     if (cmd === 'rm') {
       try {
+        const { remove: removeWorktree } = await import('../src/worktree.mjs')
         const r = removeWorktree(card.repo, id, { deleteBranch: Boolean(args['delete-branch']), force: Boolean(args.force) })
         if (args['delete-branch'] && r.branchUnmerged && !r.branchDeleted) out(`kept branch leg/${id}: it has commits not on its base (rerun with --force to discard them)`)
       } catch (err) { die(3, `worktree: ${err.message}`) }
@@ -570,6 +594,7 @@ async function main() {
     }
     const human = { queue: 'enqueue', pause: 'pause', resume: 'resume', kill: 'kill', approve: 'approve', 'handoff-now': 'handoff_now', rerun: 'rerun', reassign: 'reassign' }[cmd]
     if (human) {
+      const { humanAction } = await import('../src/orchestrator.mjs')
       const payload = human === 'reassign' ? { adapter: args.adapter || die(2, 'reassign needs --adapter'), mode: args.mode } : {}
       const next = humanAction(id, human, payload, { type: 'human', id: args.actor || 'local' })
       return out(`${next.card_id} ${next.status} at ${next.station} leg ${next.leg}`)
@@ -577,6 +602,7 @@ async function main() {
     die(2, `unknown card command "${cmd}" (add|ls|show|run|rm|events|queue|pause|resume|kill|approve|handoff-now|rerun|reassign)`)
   }
   if (group === 'scheduler') {
+    const { createScheduler, schedulerStatus, pidfile, MAX_CONCURRENT } = await import('../src/scheduler.mjs')
     if (cmd === 'start') {
       const ticks = args.ticks ? parseInt(args.ticks, 10) : Infinity
       const running = schedulerStatus()
@@ -602,19 +628,34 @@ async function main() {
     die(2, `unknown scheduler command "${cmd}" (start|status|stop)`)
   }
   if (group === 'up') {
+    const { up } = await import('../src/launcher.mjs')
     const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
     const code = await up({ dry: Boolean(a.dry), open: !a['no-open'], port: a.port !== undefined ? parseInt(a.port, 10) : undefined, bind: a.bind })
     process.exit(code)
   }
-  if (group === 'down') process.exit(await down())
-  if (group === 'status') process.exit(await status())
+  if (group === 'down') { const { down } = await import('../src/launcher.mjs'); process.exit(await down()) }
+  if (group === 'status') { const { status } = await import('../src/launcher.mjs'); process.exit(await status()) }
   if (group === 'open') {
+    const { openBoard } = await import('../src/launcher.mjs')
     const port = (process.env.LEG_PORT || process.env.BATON_PORT) || 4747
     const url = `http://127.0.0.1:${port}`
     out(openBoard(url) ? `opened ${url}` : `could not open a browser; visit ${url}`)
     return
   }
-  if (group && group !== '--help' && group !== 'help') die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|ladder|history|worktrees|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
+  // Everything above is a named command group. What is left is either a
+  // supervised agent (`leg claude|codex|agy|grok [args...]`, everything after
+  // the agent name goes straight through) or unknown. SUPERVISED_AGENTS and
+  // attach() are loaded here, last, so no other command pays for them.
+  if (group && group !== '--help' && group !== 'help') {
+    const { SUPERVISED_AGENTS } = await import('../src/sessions.mjs')
+    if (SUPERVISED_AGENTS.includes(group)) {
+      const { attach } = await import('../src/attach.mjs')
+      const code = await attach(group, [cmd, ...rest].filter((x) => x !== undefined), { open: (process.env.LEG_NO_OPEN || process.env.BATON_NO_OPEN) !== '1' })
+      process.exit(code)
+    }
+    die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|ladder|history|worktrees|digest|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
+  }
+  const { PRESET_NAMES } = await import('../src/presets.mjs')
   out(`leg ${VERSION}, your coding agents, with a board alongside and a handoff when one hits its limit
   claude|codex|agy|grok [args...]   the normal interactive agent in this terminal; args pass straight through
                                 the board opens once, the session shows as a card, usage is tracked, a limit hands off
@@ -633,6 +674,8 @@ async function main() {
   history show|continue <id> | refresh | providers
                                 one conversation, or start leg <agent> on it where the agent can resume by id
   worktrees [--repo r] [--json]  every checkout Leg can see: git's, its own, the ones conversations worked in
+  digest [--since 8h|2d|<iso>] [--json]        what happened while you were away: what needs you, then every
+                                terminal, card, landing and wall in the window, grouped by repository
   resume [--check] [--json] [--path <dir>]      the hand-off waiting in this checkout, and whether it is still true
                                freshness is recomputed from git at read time; --check prints only the verdict
                                exit 0 current, 1 stale or unstamped, 3 no pointer here

package/docs/DECISIONS.md

@@ -2,6 +2,14 @@
 
 Durable product and design decisions that the code does not explain on its own. One entry per decision, newest first.
 
+## 2026-09-18: a second claude login shares the conversation store, so an account switch keeps the conversation
+
+- **What.** `LAYOUT.claude.share` gains `projects`: `leg accounts add claude <name>` junctions Claude Code's conversation store into the account directory beside the harness directories, and `refreshAccount()` adds a missing junction to an account made before this before every launch. `keepsConversation()` in `src/usage.mjs` is the one rule that decides `--resume` over the bundle, for the terminal's switch and the board picker's `keeps_conversation` alike: a same-login downshift (as before), or another login of the same agent under which the transcript file exists. The history index skips a junctioned `projects` so a conversation is listed once.
+- **Why share rather than copy.** Wes runs two 20x logins and wants a Fable or weekly wall on one to continue on the other without re-explaining anything. Copying the one transcript at hand-off would have to write into `~/.claude/projects` on the way back, and that directory is on the README's "read, never written" list. A junction inside `$LEG_HOME/accounts/` keeps that promise: Claude Code writes its own store, Leg reads it. It also carries the auto-memory under `projects/<cwd>/memory/`, which is the same human's and should follow them.
+- **Why the rule checks the file.** A `--resume` into a login that cannot see the transcript opens an empty conversation and loses the bundle too. So the rule asks whether the file exists under the destination home at the moment of the switch, and says bundle when it does not. A false answer costs one bundle prime; a wrong true would cost the context.
+- **Why a cross-login upshift resumes when a same-login upshift does not.** The same-login rule stays as decided on 2026-09-17: the re-read at the stronger model's rate is paid on the login that is already low. Across logins the destination is a fresh window, which is the reason the human bought it.
+- **What this rules out.** codex across logins: `codex resume` under a second `CODEX_HOME` is unobserved, so codex rungs keep taking the bundle and claim nothing.
+
 ## 2026-09-18: usage is polled by the board, once per login; a rung's model is a catalog entry validated by shape
 
 - **What.** The board process runs one usage poller per login (`src/usage-poll.mjs`): 60s, doubling to ten minutes on any refusal, one status line when a login's reading fails and one when it is back. Terminals poll nothing and receive the windows on their session record. `GET /api/models` lists what each installed CLI can run, read from claude's aliases, codex's `models_cache.json` and `config.toml`, and the `models` commands of agy and grok, cached an hour under `<LEG_HOME>/models/`. A rung's `model` is validated by shape (lower-case id characters) for every provider and by membership for claude only.
@@ -100,7 +108,7 @@ The repository stays private (see the 2026-09-11 license decision). That left ev
 ## 2026-09-11: Leg is a commercial product; the site stays on the free Vercel address
 
 - **License.** Wes: "if we're trying to sell this thing it shouldn't be open source and MIT." The repo stays private and the package ships under the Leg License Agreement (LICENSE): commercial, source readable in the package for inspection and own-use modification, no redistribution, no working around the license check. The FSL option from the pricing research was dropped for the same reason. Versions 0.2.0 and 0.3.0 remain available under MIT.
-- **Pricing.** Personal $79 once with 12 months of releases (Sublime shape); Team $12 per seat per month (adds `leg share`); no trial, and a 30-day money-back guarantee as the risk reversal instead (2026-09-15: a trial suits daily-habit products, and Leg's value is bursty, it pays off in the moment a limit lands, which a fortnight of evaluation does not reliably contain; a buyer already paying for two or three agent subscriptions is not price-sensitive at $79, they are trust-sensitive, and a trial does not answer trust). Keys are Ed25519 tokens signed with a private key that lives only in the seller's `.env` and the site's Vercel env; the public key is in `src/license.mjs`. A Personal key is a window over `RELEASE_DATE`, so every release bumps that constant.
+- **Pricing.** Personal $79 once with 12 months of releases (Sublime shape); Team $12 per seat per month (adds `leg share`); ~~no trial, and a 30-day money-back guarantee as the risk reversal instead~~ superseded 2026-09-18 (2026-09-15: a trial suits daily-habit products, and Leg's value is bursty, it pays off in the moment a limit lands, which a fortnight of evaluation does not reliably contain; a buyer already paying for two or three agent subscriptions is not price-sensitive at $79, they are trust-sensitive, and a trial does not answer trust). 2026-09-18, Wes, ahead of the Hacker News post: the 14-day trial from 0.4.0 is back, started by the first session and recorded in `$LEG_HOME/trial.json` with every gate open, and the 30-day guarantee stays as the second net after buying. A launch audience installs to look, and "buy first" on a repo they found ten minutes ago is a wall the guarantee does not lower. Keys are Ed25519 tokens signed with a private key that lives only in the seller's `.env` and the site's Vercel env; the public key is in `src/license.mjs`. A Personal key is a window over `RELEASE_DATE`, so every release bumps that constant.
 - **Checkout.** Stripe payment links (live) with automatic tax, `site/api/key` and `site/api/webhook` on Vercel functions, Resend from `legcli@practicalsystems.io`. `scripts/stripe-setup.mjs` is idempotent per site origin; a test-mode purchase was run end to end on 2026-09-11 (checkout, thanks page, key activated in the CLI, webhook 200 twice).
 - **Domain.** A `legcli.com` purchase ($11.25) was started and cancelled at Wes's "just deploy it to a free vercel site"; nothing was bought. The site is https://legcli.com/.
 - **Not a lawyer.** The license text was drafted in-session; a review before the first sale outside the US is Wes's call.
@@ -116,6 +124,7 @@ The repository stays private (see the 2026-09-11 license decision). That left ev
 - **Root Directory had to change first.** It was `.`, which is correct when deploying from inside `site/` but would have published the repo root on a git build: no `index.html`, and `api/key` and `api/webhook` gone, so a purchase in flight would not have received its key.
 - ~~**Not every push.** `site/vercel.json` carries `ignoreCommand: git diff --quiet HEAD^ HEAD .`, which Vercel maps to the Ignored Build Step. A commit that touches nothing under `site/` cancels the build. The command failing (a shallow clone with no `HEAD^`) exits non-zero, which builds, so the failure mode is a redundant deploy rather than a missed one.~~ **Superseded 2026-09-15: the failure mode was a MISSED deploy.** `HEAD^ HEAD` compares one commit, not the push. Fast-forwarding five commits to main where only the first touched `site/` left the tip with no `site/` change, so Vercel cancelled the build and the redesigned site never went out while the repo said it had. The `ignoreCommand` is removed: every push to `main` deploys the site. Vercel's own "Skip deployments when there are no changes to the root directory" toggle is the safe version of this idea, because it compares against the last deployment rather than against `HEAD^`.
 - **Agent sessions cannot do this part.** `vercel --prod` and `vercel git connect` are both denied by the harness classifier as production deploys, and the CLI auth token cannot be read. Wes ran both.
+- **2026-09-18: the git deploy did not fire, and the manual fallback has two traps.** The push of 0.13.1 (`19667ba`) produced no `vercel[bot]` deployment on GitHub (commit status stayed `pending`, no statuses), while the pushes an hour earlier had; the account had an overdue invoice at the time, which is the likeliest cause, and the git integration should be re-checked in the Vercel dashboard after a rename (the GitHub repository was renamed since the connection was made; `git remote -v` has the current name and the project still says `baton`). The fallback that works, run from the **repo root**, not `site/`: a root `.vercel/project.json` copied from `site/.vercel/` (gitignored), a root `.vercelignore` of `*`, `!site`, `!site/**`, `site/.vercel`, `site/.env*`, then `vercel --prod --yes --archive=tgz`. Trap one: `vercel --prod --yes` from inside `site/` uploads `site/` as the root, Vercel applies Root Directory `site` on top of it, and the deployment errors with an empty message. Trap two: that same `--yes` auto-linked the repo root to a **new** Vercel project named `leg` (empty, no domain); it is junk and `vercel project rm leg` removes it. Trap three: with no `.vercelignore` the CLI uploads the untracked probe debris too and refuses at 15,000 files.
 
 
 ## 2026-09-15: the board is a dark product surface, and DESIGN.md was the defect

package/docs/DEVIATIONS.md

@@ -181,3 +181,36 @@ tests. Rows for the shape changes a later reader would otherwise wonder about.
 | 2026-09-14 | src/resume.mjs idle pointer | a checkpoint bundle was described as "the last hand-off", and the per-session file was named unconditionally | `lineage.to` decides hand-off vs checkpoint, and the file is named only when it exists on disk | seen in the live pointer for this repo: it claimed a hand-off that never happened and pointed at a `RESUME-<id>.md` that was never written, which is the same class of lie the module exists to stop |
 | 2026-09-14 | src/board/sessions.js `renderDrawer()` | the whole panel is rebuilt every 3 s poll so relative timestamps stay honest | still rebuilt, but every scrollable box carries a stable `data-scroll-key` and its offset is carried across | the rebuild reset the task box, each message and the timeline to the top every three seconds, so a long message could not be read at all |
 | 2026-09-17 | src/board/sessions.js `verdictLines()` | spec A.5 lists "a model bucket came back and a terminal is still downshifted" below the two branches that print a standing percentage | the came-back branch is tested before them, right after the model-walled branch | as written it can never fire: "one login carries every live terminal" and "several logins carry work" both return for any login that has a figure at all, so the only state change worth telling a downshifted reader about was unreachable |
+
+## 2026-09-18: product, performance and architecture pass (0.15.0)
+
+Measured first (`scratchpad/prof/BASELINE.md`, reproduction commands in the
+CHANGELOG entry), then changed. Rows for the shape changes a later reader
+would otherwise wonder about; the designs not built are in
+`docs/review-2026-09-18.md`.
+
+| date | file | old shape | new shape | why |
+|------|------|-----------|-----------|-----|
+| 2026-09-18 | src/accounts.mjs, src/usage.mjs, src/attach.mjs, src/server.mjs | a hand-off to a second claude login always took the bundle; only a same-login downshift kept the conversation | the account junctions claude's `projects` store; one rule, `keepsConversation()`, decides for the terminal and the picker, and checks the transcript file is reachable under the destination home at the switch | a second 20x login should continue the conversation, not re-read it from a bundle; the junction keeps "~/.claude/projects: read, never written" true |
+| 2026-09-18 | src/history/providers/claude.mjs | every claude home was scanned, junction or not | a home whose `projects` is a link is skipped and reported `shared: true` | the same transcript listed twice from two logins |
+| 2026-09-18 | src/digest.mjs, bin/leg.mjs, src/server.mjs | nothing read the records back as an answer to a person; the audit trail was a flat list | `leg digest [--since]` and `GET /api/digest` (owner only): volume first, what needs you, per repository, walls standing now | the question after eight hours away had no reader; a window with nothing in it must print its counts, not a blank |
+| 2026-09-18 | bin/leg.mjs | 26 static imports; the agent dispatch first; `parseTarget` synchronous | one `await import()` per command group, inside its branch; the agent dispatch after every named group; `parseTarget` async and loads buckets/accounts only for a two-part target | `leg --version` loaded 68 modules for one readFileSync: 117 ms wall, 79 ms CPU, 254 fs calls; now 1 module, 52 ms, 4 fs calls |
+| 2026-09-18 | src/limits.mjs | `SIGNALS = loadSignals()` at import (24 fixture reads, one RegExp each) | a Proxy over the same array that loads on first property access | every command paid for the fixture tree; test/ and scripts/limits-table.mjs read `SIGNALS.length` at their own top level, so a loader function was not an option |
+| 2026-09-18 | src/scheduler-status.mjs (new), src/scheduler.mjs, src/launcher.mjs | `pidfile`, `schedulerStatus`, `MAX_CONCURRENT` lived in scheduler.mjs | a leaf module, re-exported from scheduler.mjs | the launcher pulled orchestrator, land, mergequeue, stations, chain, runner and limits to answer "is the scheduler running" |
+| 2026-09-18 | src/git.mjs (new), src/attach.mjs, src/bundle.mjs | six git processes per poll round (three `rev-parse`, `status --porcelain`, `@{upstream}`, `rev-list --count`), each wrapper private, no timeout, no maxBuffer | one `status --porcelain=v2 --branch` carries head, branch, upstream, ahead/behind and the dirty list; `aheadFromStatus` uses `# branch.ab` or a one-pair head cache; 20 s timeout, 8 MB buffer | an idle terminal spawned 59.5 git processes a minute and blocked its own loop 4.4 to 10.3 s/min; now 10.9/min and 2.1 s/min, CPU 1.7 to 0.1 s/min |
+| 2026-09-18 | src/git.mjs parseStatus | a rename printed the old and new names with the quotes half-stripped | the new name | the file on disk is the one a human recognises; pinned in test/git-status.test.mjs |
+| 2026-09-18 | src/attach.mjs ensureBoard | polled /api/health every 200 ms for up to 15 s before the agent got its first instruction | `wait: false` for a terminal: the agent starts at once, the wait runs behind it, `claimBoardBeforeExit` (2 s at most) still writes the pidfile before a sub-second session exits; `leg share on|off` keeps the blocking form | the one terminal of the day that starts the board waited ~790 ms doing nothing (to-agent 1,280 to 261 ms); a board without a pidfile is one `leg down` cannot stop |
+| 2026-09-18 | src/attach.mjs installedAgents | a `--version` subprocess per bare-name agent per launch, 8 s timeout each | `$LEG_HOME/installed.json`, one day per resolved bin; a `*_BIN` override is asked every time and never cached | a stub pointed at on purpose must be probed; a real CLI on PATH answers the same for a day |
+| 2026-09-18 | src/bundle.mjs, src/handoff.mjs, src/attach.mjs | the periodic checkpoint ran `chb save` synchronously inside the poll tick | `saveSessionBundleAsync` (execFile), one at a time through `checkpointGate`, awaited before the hand-off save; warning, limit and hand-off saves stay synchronous | a python subprocess with a 120 s timeout froze limit detection and every board button for its whole run |
+| 2026-09-18 | src/handoff.mjs | `scrub` imported from runner.mjs | from redact.mjs | the terminal path pulled the card runner's whole graph for one function |
+| 2026-09-18 | src/sessions.mjs updateSession | `withFileLock` defaults: past 1.2 s the read-modify-write ran unlocked | `retries: 250, staleMs: 10000`, run.json's budget | the most-written file in Leg (runner poll, claude hook, usage poller, board actions, every `leg` command); losing a patch is the race the lock exists for |
+| 2026-09-18 | src/sessions.mjs, src/attach.mjs | `rmSync(control.json)` at exit | `clearControl` under `.control.lock` | a bare unlink could delete a board request mid-write |
+| 2026-09-18 | src/attach.mjs | the 12-leg stop said "run leg again in this directory to continue from the bundle" | names the bundle path and `leg resume`; says a fresh `leg <agent>` does not load it | nothing reloads a bundle on a fresh launch; the line promised a hand-off that never happened |
+| 2026-09-18 | src/server.mjs health tick | `pushSessions()` unconditionally every 10 s per client | the stat fingerprint decides; a liveness pass (`reapLost`) runs on the tick because a dead runner moves no file; a card entering or leaving a human-waiting status forces one push | an idle board with 43 terminals did 7,294 fs calls, 8 git processes and 1.1 CPU s a minute for nothing; the first cut of this lost the dead-runner case, and the test that kills a real child now pins it |
+| 2026-09-18 | src/server.mjs sessionsView | `readUsage` per rung per terminal, again for `capacity`, again for the accounts payload (143 reads per answer) | one reader per view | a login is read at most once per answer, and every part of the answer comes from the same reading |
+| 2026-09-18 | src/synthesis.mjs | three `existsSync` per terminal per view | one `readdirSync` per checkout per view (`sessionFileIndex`) | 172 of 512 fs calls per answer, for files that mostly do not exist |
+| 2026-09-18 | src/server.mjs, src/history/worktrees.mjs | `/api/worktrees` ran up to 40 git processes synchronously on the board's loop (9 to 25 s cold) | `listWorktreesAsync` (execFile, four in flight), one refresh per query, the last list served while a refresh runs | the worst `/api/health` during a cold call fell from 11.8 s to 3.2 s; the rest is `listHistory` inside `gather()`, still synchronous |
+| 2026-09-18 | src/server.mjs /api/trunk | every card ledger read on every 2 s floor poll | a 15 s cache keyed by the window, cleared by any card change and by a landing | 27.5 to 0.5 ms p50, 113 to 15 fs calls per request |
+| 2026-09-18 | src/session-detail.mjs | one `git ls-files` per file the terminal touched, every 3 s the drawer is open | one `git ls-files -z -- <paths>` for the list | 7 to 2 processes per detail answer, 1,247 to 305 ms |
+| 2026-09-18 | src/server.mjs rows | every field of session.json on every push | `argv`, `runner_pid`, `head_at_start`, `checkpoints`, `agent_sessions`, `runtime_capabilities`, `files_touched` dropped from the row; `GET /api/sessions/<id>` still hands over the record | nothing under src/board/ read them; 8% off every push |
+| 2026-09-18 | src/history/worktrees.mjs | the git env built by a helper | `MSYS_NO_PATHCONV: '1'` spelled out at each spawn site | test/lessons.test.mjs checks every git spawn line in src/ for it, and the helper hid it from that check |

package/docs/ERRORS.md

@@ -3,6 +3,28 @@
 What broke, why, and what fixed it. One entry per failure, newest first. A first
 occurrence has to be written down or a repeat is never countable.
 
+## 2026-09-18: 0.14.0 pushed, CI green everywhere, and npm still served 0.13.1
+
+**Fixed by putting the `repository` block back into the lockfile root
+(`packages[""]`) and pushing again.** `scripts/npm-publish-gate.mjs` requires
+`package-lock.json`'s root `repository.url` to equal the trusted-publisher
+binding, and npm 10.9 (the local install) does not write that block; npm 11
+does, which is where the 0.13.1 lockfile got it. `npm version 0.14.0` on npm
+10 rewrote the lockfile without it, the test matrix and the site deploy passed,
+and only the `publish-npm` job failed, on the gate, before publishing anything.
+The lesson: a lockfile touched by a different npm major is a release change,
+and "CI green" after a push means the run, not the publish; `npm view
+@ucsandman/legcli version` is the check.
+
+## 2026-09-18: `vercel --prod --yes` from `site/` failed the deploy and created a stray Vercel project
+
+**Fixed by deploying from the repo root with a root `.vercelignore` and
+`--archive=tgz`; the recipe is in DECISIONS.md under "the site deploys itself
+from git".** The `--yes` also auto-created an empty Vercel project named `leg`
+that still needs `vercel project rm leg` (2026-09-18 later: `vercel project ls` no longer lists a `leg` project, so it is gone). The lesson: on a project with a Root
+Directory set, the CLI must run from the repo root, and `--yes` is a consent to
+create projects, not only to skip a confirmation.
+
 ## 2026-09-18: the terminal's opening `next:` line named the same agent twice and no model
 
 **Fixed in `src/attach.mjs`: the line maps the chain through `rungLabel`, so it

package/docs/ROADMAP-v2.md

@@ -86,7 +86,18 @@ event names its actor, a board that reads only the ledger, and an auth/bind seam
    The same probe shape applies to naming the terminal tab: whether codex, agy
    and grok leave an OSC 2 title alone once the child starts drawing is
    assumed, not known, which is why the tab title is the browser's and not the
-   terminal's.
+   terminal's. 0.15.0 made the claude half of this real across logins too (a
+   second login shares the conversation store, so a login switch keeps the
+   conversation): the codex probe now also covers a second `CODEX_HOME` with
+   its `sessions` store shared the same way.
+7. **`stalled` and `repeating` on the row.** Two derived states from data the
+   record already holds: no turn, file write or commit for N minutes while not
+   waiting on a human; the same test red across two legs of one card. Printed
+   only, never acted on; a `looping` state waits for a false-positive study on
+   real transcripts. Design in `docs/review-2026-09-18.md`.
+8. **The digest on the board.** `leg digest` and `/api/digest` shipped in
+   0.15.0; the panel above Terminals on the first load of the day is the
+   human surface it still lacks. Same review doc.
 
 Also on the list: per-station prompt templates editable from the board, lease
 suggestions from the diff of the previous leg, and a floor view that shows