@ucsandman/legcli 0.14.0 → 0.15.0

package/src/digest.mjs

@@ -0,0 +1,197 @@
+// digest — what happened while you were away, from what is already on disk.
+//
+// The audit trail (src/audit.mjs) is the flat list of who did what. This is
+// the other question a person asks at a desk after eight hours off: which
+// terminals are still mine, what needs me now, which walls hit and where each
+// terminal went, what landed, and what a card came back with. Grouped by
+// repository, attention first, every count beside the volume it was read
+// from. Nothing new is recorded here.
+//
+// Owner only on a shared board (src/server.mjs): it names repositories,
+// prompts and people.
+import { listSessions, readEvents as readSessionEvents, readLandings, isActive } from './sessions.mjs'
+import { listCards, readEvents as readCardEvents } from './store.mjs'
+import { listUsage, wallActive, fmtReset } from './usage.mjs'
+import { canonPath } from './fsx.mjs'
+
+export const DEFAULT_SINCE = '8h'
+const shortId = (id) => String(id ?? '').split('-').pop()
+const ms = (iso) => { const n = Date.parse(iso ?? ''); return Number.isFinite(n) ? n : null }
+
+// `8h`, `30m`, `2d`, or an ISO timestamp. Anything else is refused by name:
+// a window nobody asked for is a wrong number in disguise.
+export function parseSince(value, nowMs = Date.now()) {
+  const s = String(value ?? DEFAULT_SINCE).trim()
+  const m = /^(\d+)(m|h|d)$/i.exec(s)
+  if (m) return nowMs - parseInt(m[1], 10) * { m: 60000, h: 3600000, d: 86400000 }[m[2].toLowerCase()]
+  const iso = Date.parse(s)
+  if (Number.isFinite(iso)) return iso
+  throw new Error(`bad --since "${s}" (8h, 30m, 2d, or an ISO time)`)
+}
+
+// The events a person wants to see per terminal, in the order they happened.
+const NOTED = new Set(['limit', 'handoff', 'all_out', 'lost', 'ended', 'landed', 'bounced', 'continued', 'harness_blocked'])
+
+function terminalEntry(s, sinceMs) {
+  const events = readSessionEvents(s.session_id)
+  const inWindow = events.filter((e) => (ms(e.ts) ?? 0) >= sinceMs)
+  const noted = inWindow.filter((e) => NOTED.has(e.type)).map((e) => ({ at: e.ts, type: e.type, summary: String(e.summary ?? '') }))
+  const errors = inWindow.filter((e) => e.type === 'error').length
+  // a human being waited on (from the Notification hook) or the all-out clock;
+  // only while the terminal is live: a dead terminal waits on nobody
+  const waiting = isActive(s) && s.waiting && typeof s.waiting === 'object'
+    ? { type: s.waiting.type ?? null, message: s.waiting.message ?? null, since: s.waiting.since ?? null, resets_at: s.waiting.resets_at ?? null, agent: s.waiting.agent ?? null, account: s.waiting.account ?? null }
+    : null
+  return {
+    session_id: s.session_id, short: shortId(s.session_id),
+    agent: s.agent, account: s.account, model: s.model ?? null, status: s.status,
+    started_at: s.started_at, ended_at: s.ended_at ?? null, exit_code: s.exit_code ?? null,
+    live: isActive(s),
+    task: s.task ? String(s.task).replace(/\s+/g, ' ').slice(0, 160) : null,
+    branch: s.branch ?? null, worktree: Boolean(s.worktree),
+    turns: s.turns ?? 0, files_touched: (s.files_touched ?? []).length, ahead: s.ahead ?? null,
+    waiting, errors, events: inWindow.length, noted,
+  }
+}
+
+function cardEntry(c, sinceMs) {
+  const events = readCardEvents(c.card_id)
+  const inWindow = events.filter((e) => (ms(e.ts) ?? 0) >= sinceMs)
+  const last = inWindow.length ? inWindow[inWindow.length - 1] : null
+  return {
+    card_id: c.card_id, title: c.title ?? String(c.task ?? '').replace(/\s+/g, ' ').slice(0, 120),
+    status: c.status, station: c.station, leg: c.leg ?? 0,
+    updated_at: c.updated_at ?? null,
+    events: inWindow.length,
+    last: last ? { at: last.ts, type: last.type, summary: String(last.summary ?? '') } : null,
+    bounce_reason: c.bounce_reason ?? null, land_attempts: c.land_attempts ?? 0,
+  }
+}
+
+// → { since, until, volume, attention, repos, walls }
+export function buildDigest({ since = DEFAULT_SINCE, now = Date.now(), sessions = null, cards = null, landings = null, usage = null } = {}) {
+  const sinceMs = typeof since === 'number' ? since : parseSince(since, now)
+  const allSessions = sessions ?? listSessions()
+  const allCards = cards ?? listCards()
+  const allLandings = landings ?? readLandings()
+  const allUsage = usage ?? listUsage()
+
+  // a terminal counts when it moved in the window or is still live now
+  const terminals = allSessions
+    .filter((s) => isActive(s) || (ms(s.updated_at) ?? 0) >= sinceMs || (ms(s.ended_at) ?? 0) >= sinceMs)
+    .map((s) => terminalEntry(s, sinceMs))
+  const cardRows = allCards
+    .filter((c) => (ms(c.updated_at) ?? 0) >= sinceMs || ['running', 'handing_off', 'queued', 'waiting_human', 'needs_approval', 'paused'].includes(c.status))
+    .map((c) => cardEntry(c, sinceMs))
+  // landings.jsonl keeps bounces too (status 'bounced'); only what reached
+  // trunk is a landing. A line from before `status` existed carries `reason`
+  // only when it bounced.
+  const landed = allLandings.filter((l) => (ms(l.ts) ?? 0) >= sinceMs && (l.status ?? (l.reason ? 'bounced' : 'landed')) === 'landed')
+    .map((l) => ({ at: l.ts, repo: l.repo ?? null, session_id: l.session_id ?? null, short: shortId(l.session_id), agent: l.agent ?? null, by: l.by ?? null, commits: Array.isArray(l.commits) ? l.commits.length : null, summary: l.what ?? null }))
+
+  // group by repository; a terminal outside any repo groups under its cwd
+  const groups = new Map()
+  const groupFor = (repo, name) => {
+    const key = repo ? (() => { try { return canonPath(repo) } catch { return String(repo).toLowerCase() } })() : '(no repository)'
+    if (!groups.has(key)) groups.set(key, { repo: repo ?? null, repo_name: name ?? repo ?? '(no repository)', terminals: [], cards: [], landed: [] })
+    return groups.get(key)
+  }
+  for (const t of terminals) {
+    const s = allSessions.find((x) => x.session_id === t.session_id)
+    groupFor(s.repo ?? s.cwd ?? null, s.repo_name ?? s.cwd ?? null).terminals.push(t)
+  }
+  for (const c of cardRows) {
+    const card = allCards.find((x) => x.card_id === c.card_id)
+    groupFor(card.repo ?? null, card.repo ? String(card.repo).split(/[\\/]/).filter(Boolean).pop() : null).cards.push(c)
+  }
+  for (const l of landed) groupFor(l.repo, l.repo ? String(l.repo).split(/[\\/]/).filter(Boolean).pop() : null).landed.push(l)
+  const repos = [...groups.values()].sort((a, b) => String(a.repo_name).localeCompare(String(b.repo_name)))
+  for (const g of repos) {
+    g.terminals.sort((a, b) => (a.live === b.live ? String(b.started_at).localeCompare(String(a.started_at)) : a.live ? -1 : 1))
+    g.landed.sort((a, b) => String(b.at).localeCompare(String(a.at)))
+  }
+
+  // what needs a person, most urgent first: a question on a live terminal,
+  // a card parked for a human, a failed card, a terminal that was lost
+  const attention = []
+  for (const t of terminals) {
+    if (t.waiting && t.waiting.type && t.waiting.type !== 'reset') attention.push({ kind: 'waiting_on_you', id: t.session_id, short: t.short, agent: t.agent, account: t.account, since: t.waiting.since, message: t.waiting.message, rank: 0 })
+    else if (t.waiting && t.waiting.type === 'reset') attention.push({ kind: 'all_out', id: t.session_id, short: t.short, agent: t.agent, account: t.account, since: t.waiting.since, resets_at: t.waiting.resets_at, message: `every option is out; waiting for ${t.waiting.agent ?? '?'}${t.waiting.account && t.waiting.account !== 'default' ? '/' + t.waiting.account : ''}`, rank: 2 })
+    else if (t.status === 'lost' && (ms(t.ended_at) ?? 0) >= sinceMs) attention.push({ kind: 'lost', id: t.session_id, short: t.short, agent: t.agent, account: t.account, since: t.ended_at, message: 'the terminal closed or crashed; its bundle is on disk', rank: 4 })
+  }
+  for (const c of cardRows) {
+    if (['waiting_human', 'needs_approval', 'paused'].includes(c.status)) attention.push({ kind: 'card_' + c.status, id: c.card_id, short: shortId(c.card_id), since: c.updated_at, message: `${c.title} is ${c.status.replace('_', ' ')} at ${c.station}`, rank: 1 })
+    else if (c.status === 'failed' && (ms(c.updated_at) ?? 0) >= sinceMs) attention.push({ kind: 'card_failed', id: c.card_id, short: shortId(c.card_id), since: c.updated_at, message: `${c.title} failed at ${c.station}${c.last ? ': ' + c.last.summary.slice(0, 120) : ''}`, rank: 3 })
+  }
+  attention.sort((a, b) => a.rank - b.rank || String(a.since ?? '').localeCompare(String(b.since ?? '')))
+
+  // logins that are out right now, account-wide or per model
+  const nowS = Math.floor(now / 1000)
+  const walls = []
+  for (const u of allUsage) {
+    if (u.limited_until && u.limited_until > nowS) walls.push({ agent: u.agent, account: u.account, model: null, until: u.limited_until, reason: u.limited_reason ?? 'limit' })
+    for (const [model, w] of Object.entries(u.walls ?? {})) if (wallActive(w, nowS)) walls.push({ agent: u.agent, account: u.account, model, until: w.limited_until, reason: w.limited_reason ?? 'limit' })
+  }
+  walls.sort((a, b) => (a.until ?? 0) - (b.until ?? 0))
+
+  return {
+    since: new Date(sinceMs).toISOString(), until: new Date(now).toISOString(),
+    // L2: the verdict carries the volume it was read from
+    volume: {
+      terminals: terminals.length, cards: cardRows.length, landings: landed.length,
+      events: terminals.reduce((n, t) => n + t.events, 0) + cardRows.reduce((n, c) => n + c.events, 0),
+      sessions_on_disk: allSessions.length, cards_on_disk: allCards.length,
+    },
+    attention, repos, walls,
+  }
+}
+
+// ---- the terminal rendering ----
+const rel = (iso, nowMs) => {
+  const t = ms(iso)
+  if (t === null) return 'unknown'
+  const d = Math.max(0, nowMs - t)
+  const m = Math.round(d / 60000)
+  if (m < 1) return 'just now'
+  if (m < 60) return `${m}m ago`
+  const h = Math.floor(m / 60)
+  if (h < 48) return `${h}h ${m % 60}m ago`
+  return `${Math.floor(h / 24)}d ago`
+}
+const clock = (iso) => { const t = ms(iso); return t === null ? '?' : new Date(t).toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' }) }
+const login = (agent, account, model = null) => `${agent}${account && account !== 'default' ? '/' + account : ''}${model ? '/' + model : ''}`
+
+export function renderDigest(d, { now = Date.now() } = {}) {
+  const out = []
+  const v = d.volume
+  out.push(`since ${new Date(d.since).toLocaleString()} (${rel(d.since, now)}): ${v.terminals} terminal${v.terminals === 1 ? '' : 's'}, ${v.cards} card${v.cards === 1 ? '' : 's'}, ${v.landings} landing${v.landings === 1 ? '' : 's'}, ${v.events} events read (${v.sessions_on_disk} sessions and ${v.cards_on_disk} cards on disk)`)
+  if (!v.terminals && !v.cards && !v.landings) { out.push('nothing moved in that window.'); return out.join('\n') }
+  out.push('')
+  out.push(d.attention.length ? `needs you: ${d.attention.length}` : 'needs you: nothing')
+  for (const a of d.attention) {
+    const who = a.agent ? `${a.kind === 'lost' ? 'lost' : a.kind === 'all_out' ? 'all out' : 'waiting on you'} · leg#${a.short} ${login(a.agent, a.account)}` : `card #${a.short}`
+    out.push(`  ${who} · ${rel(a.since, now)}${a.message ? ` · ${a.message}` : ''}${a.resets_at ? ` · back ${fmtReset(a.resets_at)}` : ''}`)
+  }
+  for (const g of d.repos) {
+    out.push('')
+    out.push(`${g.repo_name}${g.repo && g.repo !== g.repo_name ? `  (${g.repo})` : ''}`)
+    for (const t of g.terminals) {
+      const state = t.live ? t.status : t.status === 'lost' ? `lost ${rel(t.ended_at, now)}` : `${t.status}${t.exit_code !== null && t.exit_code !== undefined ? ` exit ${t.exit_code}` : ''} ${rel(t.ended_at ?? t.started_at, now)}`
+      const facts = [`${t.turns} turn${t.turns === 1 ? '' : 's'}`, t.files_touched ? `${t.files_touched} file${t.files_touched === 1 ? '' : 's'}` : null, Number.isFinite(t.ahead) && t.ahead > 0 ? `+${t.ahead} ahead` : null, t.errors ? `${t.errors} error${t.errors === 1 ? '' : 's'}` : null].filter(Boolean)
+      out.push(`  leg#${t.short}  ${login(t.agent, t.account, t.model)}${t.branch ? ` @${t.branch}` : ''}  ${state} · ${facts.join(' · ')}`)
+      if (t.task) out.push(`    task: ${t.task}`)
+      for (const e of t.noted) out.push(`    ${clock(e.at)}  ${e.type.padEnd(9)} ${e.summary.slice(0, 160)}`)
+    }
+    for (const c of g.cards) {
+      out.push(`  card#${shortId(c.card_id)}  [${c.status}] at ${c.station}  ${c.title}`)
+      if (c.last) out.push(`    ${clock(c.last.at)}  ${c.last.type.padEnd(9)} ${c.last.summary.slice(0, 160)}`)
+    }
+    for (const l of g.landed) out.push(`  landed ${clock(l.at)}  ${l.commits !== null ? `${l.commits} commit${l.commits === 1 ? '' : 's'} ` : ''}by leg#${l.short}${l.agent ? ` (${l.agent})` : ''}${l.by ? `, Land pressed by ${l.by}` : ''}`)
+  }
+  if (d.walls.length) {
+    out.push('')
+    out.push('walls standing now:')
+    for (const w of d.walls) out.push(`  ${login(w.agent, w.account, w.model)}  ${w.reason} until ${fmtReset(w.until)}`)
+  }
+  return out.join('\n')
+}

package/src/git.mjs

@@ -0,0 +1,97 @@
+// git — the one git seam the interactive terminal polls through. Every call is
+// argv, never a shell, with MSYS_NO_PATHCONV=1 so Git Bash on Windows does not
+// rewrite a `refs/…` or `a..b` argument into a path.
+//
+// `status()` answers in ONE process what four calls used to: `--porcelain=v2
+// --branch` carries the HEAD oid, the branch, the upstream and the ahead/behind
+// counts in its header lines, beside the same dirty list `--porcelain` gave.
+// One idle `leg` terminal spawned 59.5 git processes a minute and blocked its
+// own event loop 4.4–10.3 s/min for that (profile 2026-09-18, §3).
+import { spawnSync } from 'node:child_process'
+
+// A `git status` on a large tree is kilobytes, not megabytes; a repo that
+// somehow produces more is a runaway, and a timeout is better than a terminal
+// wedged on a hung git.
+const MAX_BUFFER = 8 * 1024 * 1024
+const TIMEOUT_MS = 20000
+
+// The directories Leg itself writes into the work tree: a bundle, a session
+// notes file or a local DashClaw state file is never "a file this session
+// touched", and the card must not show one.
+const TOOL_DIRS = /^(\.leg|\.baton|\.context-handoffs|\.dashclaw-local)\//
+
+// `ok: true` answers '' instead of null when git refuses, for callers that read
+// "no output" and "not a repo" the same way (src/bundle.mjs notes).
+export function git(cwd, args, { ok = false } = {}) {
+  const r = spawnSync('git', args, { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: MAX_BUFFER, timeout: TIMEOUT_MS, env: { ...process.env, MSYS_NO_PATHCONV: '1' } })
+  if (r.status !== 0) return ok ? '' : null
+  // trimEnd only: a v1 porcelain line starts with a space (" M README.md")
+  return r.stdout.trimEnd()
+}
+
+// git quotes a path with special characters (core.quotePath) and prints it
+// wrapped in double quotes. The v1 parser stripped exactly the outer pair, so
+// this does too: the two agree on what lands on the card.
+const unquote = (p) => p.replace(/^"|"$/g, '')
+
+// Field counts from git-status(1) "Porcelain Format Version 2", verified
+// against git 2.52.0 on 2026-09-18:
+//   1 <XY> <sub> <mH> <mI> <mW> <hH> <hI> <path>                    → 7 fields
+//   2 <XY> <sub> <mH> <mI> <mW> <hH> <hI> <X><score> <path>\t<orig> → 8 fields
+//   u <XY> <sub> <m1> <m2> <m3> <mW> <h1> <h2> <h3> <path>          → 9 fields
+//   ? <path> / ! <path>
+// A path may contain spaces, so the tail is taken whole, never split.
+const ORDINARY = /^1(?: \S+){7} (.*)$/
+const RENAMED = /^2(?: \S+){8} (.*)$/
+const UNMERGED = /^u(?: \S+){9} (.*)$/
+const OTHER = /^[?!] (.*)$/
+
+// → { head, branch, upstream, ahead, behind, dirty }
+// `head` is null on a repo with no commits (`# branch.oid (initial)`), `branch`
+// is 'HEAD' on a detached checkout — the word `rev-parse --abbrev-ref HEAD`
+// used, so every caller written against that answer still reads the same thing.
+// `ahead`/`behind` are null unless the checkout tracks an upstream that exists;
+// git prints `# branch.ab` only then, and a count that could not be taken must
+// never be printed as a zero (redesign A.4 row 8).
+export function parseStatus(text) {
+  let head = null
+  let branch = null
+  let upstream = null
+  let ahead = null
+  let behind = null
+  const dirty = []
+  for (const line of String(text ?? '').split('\n')) {
+    if (!line) continue
+    if (line.startsWith('# ')) {
+      const sp = line.indexOf(' ', 2)
+      const key = sp === -1 ? line.slice(2) : line.slice(2, sp)
+      const value = sp === -1 ? '' : line.slice(sp + 1)
+      if (key === 'branch.oid') head = value === '(initial)' ? null : value
+      else if (key === 'branch.head') branch = value === '(detached)' ? 'HEAD' : value
+      else if (key === 'branch.upstream') upstream = value || null
+      else if (key === 'branch.ab') {
+        const m = /^\+(\d+) -(\d+)$/.exec(value)
+        if (m) { ahead = parseInt(m[1], 10); behind = parseInt(m[2], 10) }
+      }
+      continue
+    }
+    let path = null
+    if (line.startsWith('1 ')) path = ORDINARY.exec(line)?.[1] ?? null
+    // a rename carries both names, the new one first, separated by a TAB: the
+    // new name is the file that is on disk now, and the one a human recognises
+    else if (line.startsWith('2 ')) path = (RENAMED.exec(line)?.[1] ?? '').split('\t')[0] || null
+    else if (line.startsWith('u ')) path = UNMERGED.exec(line)?.[1] ?? null
+    else if (line.startsWith('? ') || line.startsWith('! ')) path = OTHER.exec(line)?.[1] ?? null
+    if (!path) continue
+    const file = unquote(path)
+    if (file && !TOOL_DIRS.test(file)) dirty.push(file)
+  }
+  return { head, branch, upstream, ahead, behind, dirty }
+}
+
+// One process for the whole picture. null when git refuses (not a repository,
+// or no git on this machine) — the caller's "is this a repo at all" gate.
+export function status(cwd) {
+  const out = git(cwd, ['status', '--porcelain=v2', '--branch'])
+  return out === null ? null : parseStatus(out)
+}

package/src/handoff.mjs

@@ -2,10 +2,10 @@
 // bundle format: it writes a structured notes file, calls the CLI as an argv
 // subprocess (`save --repo-local` inside the worktree so the next agent finds
 // the bundle in its cwd), validates the bundle, and later `load`s the resume.
-import { spawnSync } from 'node:child_process'
+import { spawnSync, execFile } from 'node:child_process'
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { scrub } from './runner.mjs'
+import { scrub } from './redact.mjs'
 
 const MIN_VERSION = [0, 4, 0]
 
@@ -42,6 +42,24 @@ export function chb(args, { cwd, timeout = 120000 } = {}) {
   return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' }
 }
 
+// The same call off the caller's event loop: same argv, same env, same timeout.
+// Used by the periodic bundle checkpoint only (src/bundle.mjs
+// saveSessionBundleAsync) - a synchronous save inside the terminal's poll tick
+// froze limit detection and every board control for as long as the python CLI
+// took, up to its whole 120 s timeout. Same answer shape as chb(), and the same
+// throw when the CLI could not be started at all.
+export function chbAsync(args, { cwd, timeout = 120000 } = {}) {
+  const { bin, prefix } = resolveChb()
+  return new Promise((res, rej) => {
+    execFile(bin, [...prefix, ...args], { cwd, windowsHide: true, encoding: 'utf8', timeout, maxBuffer: 32 * 1024 * 1024, env: process.env }, (err, stdout, stderr) => {
+      // a numeric code is an exit status (the CLI ran and refused); anything
+      // else - ENOENT, a kill on timeout - is a failure to start
+      if (err && typeof err.code !== 'number') return rej(new Error(`context-handoff-bundle ${args[0]} failed to start: ${err.message}`))
+      res({ status: err ? err.code : 0, stdout: stdout ?? '', stderr: stderr ?? '' })
+    })
+  })
+}
+
 // Version from package metadata (works on releases without --version).
 export function chbVersion() {
   const v = chb(['--version'])

package/src/history/common.mjs

@@ -4,7 +4,7 @@
 // for one title) and forgiving (a torn last line, a BOM, a directory where a
 // file was expected, all come back as "nothing", never as a throw that would
 // take the other providers down with it).
-import { existsSync, openSync, readSync, closeSync, fstatSync, statSync, readdirSync, readFileSync } from 'node:fs'
+import { existsSync, openSync, readSync, closeSync, fstatSync, statSync, lstatSync, readdirSync, readFileSync } from 'node:fs'
 import { dirname, join, resolve, isAbsolute } from 'node:path'
 import { redact } from '../redact.mjs'
 import { canonPath } from '../fsx.mjs'
@@ -16,6 +16,8 @@ export const PROMPT_MAX = 300
 
 export function safeStat(p) { try { return statSync(p) } catch { return null } }
 export function safeList(dir) { try { return readdirSync(dir, { withFileTypes: true }) } catch { return [] } }
+// a symlink or, on Windows, a junction: lstat reports both as a link
+export function isLink(p) { try { return lstatSync(p).isSymbolicLink() } catch { return false } }
 export function safeRead(p) { try { return readFileSync(p, 'utf8') } catch { return null } }
 
 // The first `bytes` of a file as text. A BOM is dropped; a partial trailing

package/src/history/providers/claude.mjs

@@ -19,7 +19,7 @@ import { join } from 'node:path'
 import { LAYOUT } from '../../accounts.mjs'
 import { pidAlive } from '../../sessions.mjs'
 import { messagesFromLines } from '../../taps/claude.mjs'
-import { readHead, readTail, jsonLines, line, isoOrNull, isoFromMs, safeList, safeStat, safeRead, PROMPT_MAX } from '../common.mjs'
+import { readHead, readTail, jsonLines, line, isoOrNull, isoFromMs, safeList, safeStat, safeRead, isLink, PROMPT_MAX } from '../common.mjs'
 
 export const name = 'claude'
 export const label = 'Claude Code'
@@ -113,6 +113,10 @@ export function scan({ home, prev = {} }) {
   const entries = {}
   let scanned = 0; let parsed = 0
   const before = prev.entries ?? {}
+  // an extra account's `projects` is a junction back to the real home's
+  // (src/accounts.mjs LAYOUT.claude.share), so the same transcripts are
+  // already listed under `default`: a shared store is indexed once, there
+  if (isLink(projects)) return { entries, aux: { prompts: promptIndex(home, prev.aux?.prompts) }, scanned, parsed, shared: true }
   for (const dir of safeList(projects)) {
     if (!dir.isDirectory()) continue // a junction or symlink is never followed
     const pdir = join(projects, dir.name)

package/src/history/worktrees.mjs

@@ -3,8 +3,16 @@
 // the discovered conversations were working in. Read only: nothing here
 // prunes, removes or touches a worktree; src/worktree.mjs keeps that job, for
 // Leg's own worktrees only, unchanged.
+//
+// Two entry points over one body of logic. `listWorktrees` is synchronous and
+// is what the CLI (`leg worktrees`) uses: a command that has nothing else to do
+// while git answers. `listWorktreesAsync` runs the same git calls through
+// execFile, at most GIT_CONCURRENCY at a time, and is what the board uses: a
+// cold list is twenty `git status` calls at about half a second each, and run
+// synchronously that is ten to twenty-five seconds in which the board's single
+// event loop serves no stylesheet, no click and no SSE frame.
 import { existsSync, statSync } from 'node:fs'
-import { execFileSync } from 'node:child_process'
+import { execFile, execFileSync } from 'node:child_process'
 import { listSessions, isActive } from '../sessions.mjs'
 import { listCards } from '../store.mjs'
 import { parseWorktreeList } from '../worktree.mjs'
@@ -14,33 +22,58 @@ import { repoNameOf, canonOrNull } from './common.mjs'
 export const STALE_DAYS = 14
 export const DIRTY_LIMIT = 40
 export const REPO_LIMIT = 40
+// how many git processes the async path keeps in flight at once
+export const GIT_CONCURRENCY = 4
 
 const LEG_DIR_RE = /[\\/]\.(?:leg|baton)-worktrees[\\/]([^\\/]+)$/i
 
-function dirtyOf(path, timeoutMs = 5000) {
-  try {
-    const out = execFileSync('git', ['-c', 'core.fsmonitor=', '-c', 'core.hooksPath=', '-C', path, 'status', '--porcelain'], { windowsHide: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, MSYS_NO_PATHCONV: '1' }, stdio: ['ignore', 'pipe', 'ignore'] })
-    return out.split(/\r?\n/).filter(Boolean).length
-  } catch { return null }
+const gitOpts = (timeoutMs) => ({ windowsHide: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 })
+const statusArgs = (path) => ['-c', 'core.fsmonitor=', '-c', 'core.hooksPath=', '-C', path, 'status', '--porcelain']
+const listArgs = (repo) => ['-c', 'core.fsmonitor=', '-c', 'core.hooksPath=', '-C', repo, 'worktree', 'list', '--porcelain']
+
+// MSYS_NO_PATHCONV is spelled out at each spawn site: test/lessons.test.mjs
+// checks every git spawn line in src/ for it
+function gitSync(args, timeoutMs) {
+  try { return execFileSync('git', args, { ...gitOpts(timeoutMs), env: { ...process.env, MSYS_NO_PATHCONV: '1' }, stdio: ['ignore', 'pipe', 'ignore'] }) } catch { return null }
+}
+// stderr is captured and dropped rather than inherited, the same as the sync
+// path: a repo that is not one any more must not print on the operator's terminal
+function gitAsync(args, timeoutMs) {
+  return new Promise((resolve) => {
+    try { execFile('git', args, { ...gitOpts(timeoutMs), env: { ...process.env, MSYS_NO_PATHCONV: '1' } }, (err, stdout) => resolve(err ? null : stdout)) } catch { resolve(null) }
+  })
 }
 
+// at most `limit` promises in flight, answers keyed by the item that asked
+async function pooled(items, limit, fn) {
+  const out = new Map()
+  let next = 0
+  const worker = async () => {
+    while (next < items.length) {
+      const item = items[next++]
+      out.set(item, await fn(item))
+    }
+  }
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker))
+  return out
+}
+
+const countDirty = (out) => (out === null ? null : out.split(/\r?\n/).filter(Boolean).length)
+
+function dirtyOf(path, timeoutMs = 5000) { return countDirty(gitSync(statusArgs(path), timeoutMs)) }
+
 // git's own list for one repository, stderr dropped: a repo that is not one
 // any more ("fatal: not a git repository") is an empty list, not a line on the
 // operator's terminal.
-function gitWorktrees(repo, timeoutMs = 5000) {
-  try {
-    const out = execFileSync('git', ['-c', 'core.fsmonitor=', '-c', 'core.hooksPath=', '-C', repo, 'worktree', 'list', '--porcelain'], { windowsHide: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, MSYS_NO_PATHCONV: '1' }, stdio: ['ignore', 'pipe', 'ignore'] })
-    return parseWorktreeList(out)
-  } catch { return [] }
-}
+function gitWorktrees(repo, timeoutMs = 5000) { return parseWorktreeList(gitSync(listArgs(repo), timeoutMs) ?? '') }
 
 const mtimeOf = (p) => { try { return statSync(p).mtimeMs } catch { return null } }
 const at = (iso) => (iso ? Date.parse(iso) || 0 : 0)
 
-// { worktrees: [...], repos, ts }. `dirty` runs git status on up to
-// `dirtyLimit` existing checkouts (null past the cap, so the board never waits
-// on two hundred of them). `records`/`sessions`/`cards` are for tests.
-export function listWorktrees({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimit = REPO_LIMIT, repo = null, sessions = null, cards = null, records = null, homes = null, now = Date.now() } = {}) {
+// ---- the three phases, with the git calls between them ---------------------
+// Everything the view is built from except git: the records, the repositories
+// they name, and which one repository was asked for.
+function gather({ repo = null, sessions = null, cards = null, records = null, homes = null } = {}) {
   const sess = sessions ?? listSessions()
   const crd = cards ?? listCards()
   const recs = records ?? listHistory({ limit: 0, homes, includeSubagents: true }).records
@@ -51,7 +84,17 @@ export function listWorktrees({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimi
   for (const r of recs) addRepo(r.repo)
   const only = repo ? canonOrNull(repo) : null
   if (only) for (const k of [...repos.keys()]) if (k !== only) repos.delete(k)
+  return { sess, crd, recs, repos, only }
+}
+
+// The repositories git is asked about: the first `repoLimit` of them, in the
+// order they were discovered, so a home with two hundred never forks two hundred.
+const askedRepos = (ctx, repoLimit) => [...ctx.repos.values()].slice(0, repoLimit)
 
+// Every row, with each checkout's owner and conversations resolved. `lists` is
+// what git said about each asked repository.
+function buildRows(ctx, lists) {
+  const { sess, crd, recs, only } = ctx
   const rows = new Map() // canon path → row
   const row = (path, repoPath, extra = {}) => {
     const key = canonOrNull(path)
@@ -60,11 +103,8 @@ export function listWorktrees({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimi
     if (!rows.has(key)) rows.set(key, { path, repo: repoPath, repo_name: repoNameOf(repoPath), branch: null, head: null, exists: existsSync(path), main: false, listed_by_git: false, owner: { kind: 'external' }, conversations: { count: 0, latest: [], last_at: null }, dirty: null, stale: false, orphaned: false })
     return Object.assign(rows.get(key), extra)
   }
-  let repoCount = 0
-  for (const [, repoPath] of repos) {
-    if (repoCount >= repoLimit) break
-    repoCount += 1
-    gitWorktrees(repoPath).forEach((w, i) => row(w.path, repoPath, { branch: w.branch, head: w.head, listed_by_git: true, main: i === 0 && canonOrNull(w.path) === canonOrNull(repoPath) }))
+  for (const [repoPath, listed] of lists) {
+    listed.forEach((w, i) => row(w.path, repoPath, { branch: w.branch, head: w.head, listed_by_git: true, main: i === 0 && canonOrNull(w.path) === canonOrNull(repoPath) }))
   }
   // checkouts git no longer lists (deleted by hand, pruned) but a record still names
   for (const s of sess) if (s.worktree?.path && s.repo) row(s.worktree.path, s.repo, { branch: rows.get(canonOrNull(s.worktree.path))?.branch ?? s.worktree.branch ?? null })
@@ -100,17 +140,57 @@ export function listWorktrees({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimi
     list.sort((a, b) => at(b.updated_at) - at(a.updated_at))
     rows.get(key).conversations = { count: list.length, last_at: list[0]?.updated_at ?? null, latest: list.slice(0, 3).map((r) => ({ id: r.id, provider: r.provider, managed: r.managed, live: r.live, title: r.title, updated_at: r.updated_at })) }
   }
-  // dirty and stale
-  let checked = 0
+  return rows
+}
+
+// The checkouts `git status` is run on: the first `dirtyLimit` that exist, in
+// row order, so the board never waits on two hundred of them.
+function dirtyTargets(rows, { dirty, dirtyLimit }) {
+  if (!dirty) return []
+  const out = []
   for (const r of rows.values()) {
-    if (r.exists && dirty && checked < dirtyLimit) { r.dirty = dirtyOf(r.path); checked += 1 }
+    if (out.length >= dirtyLimit) break
+    if (r.exists) out.push(r)
+  }
+  return out
+}
+
+function finish(ctx, rows, dirtyBy, { now, checked }) {
+  for (const r of rows.values()) {
+    if (dirtyBy.has(r.path)) r.dirty = dirtyBy.get(r.path)
     const liveOwner = Boolean(r.owner.live)
     const last = Math.max(at(r.conversations.last_at), at(r.owner.updated_at), r.exists ? (mtimeOf(r.path) ?? 0) : 0)
     r.last_activity_at = last ? new Date(last).toISOString() : null
     r.stale = r.exists && !r.main && !liveOwner && (!last || now - last > STALE_DAYS * 86400000)
   }
   const out = [...rows.values()].sort((a, b) => String(a.repo).localeCompare(String(b.repo)) || (a.main ? -1 : b.main ? 1 : 0) || a.path.localeCompare(b.path))
-  return { worktrees: out, repos: repos.size, dirty_checked: checked, ts: new Date(now).toISOString() }
+  return { worktrees: out, repos: ctx.repos.size, dirty_checked: checked, ts: new Date(now).toISOString() }
+}
+
+// { worktrees: [...], repos, ts }. `dirty` runs git status on up to
+// `dirtyLimit` existing checkouts (null past the cap, so the board never waits
+// on two hundred of them). `records`/`sessions`/`cards` are for tests.
+export function listWorktrees({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimit = REPO_LIMIT, repo = null, sessions = null, cards = null, records = null, homes = null, now = Date.now(), timeoutMs = 5000 } = {}) {
+  const ctx = gather({ repo, sessions, cards, records, homes })
+  const lists = new Map(askedRepos(ctx, repoLimit).map((p) => [p, gitWorktrees(p, timeoutMs)]))
+  const rows = buildRows(ctx, lists)
+  const targets = dirtyTargets(rows, { dirty, dirtyLimit })
+  const dirtyBy = new Map(targets.map((r) => [r.path, dirtyOf(r.path, timeoutMs)]))
+  return finish(ctx, rows, dirtyBy, { now, checked: targets.length })
+}
+
+// The same list, with git off the caller's stack: identical payload, up to
+// GIT_CONCURRENCY processes at a time, each with its own timeout.
+export async function listWorktreesAsync({ dirty = true, dirtyLimit = DIRTY_LIMIT, repoLimit = REPO_LIMIT, repo = null, sessions = null, cards = null, records = null, homes = null, now = Date.now(), timeoutMs = 5000, concurrency = GIT_CONCURRENCY } = {}) {
+  const ctx = gather({ repo, sessions, cards, records, homes })
+  const listed = await pooled(askedRepos(ctx, repoLimit), concurrency, (p) => gitAsync(listArgs(p), timeoutMs))
+  const lists = new Map([...listed].map(([p, out]) => [p, parseWorktreeList(out ?? '')]))
+  const rows = buildRows(ctx, lists)
+  const targets = dirtyTargets(rows, { dirty, dirtyLimit })
+  const dirtyOut = await pooled(targets.map((r) => r.path), concurrency, (p) => gitAsync(statusArgs(p), timeoutMs))
+  const dirtyBy = new Map([...dirtyOut].map(([p, out]) => [p, countDirty(out)]))
+  // `now` defaults at call time, not at resolution time, the same as the sync path
+  return finish(ctx, rows, dirtyBy, { now, checked: targets.length })
 }
 
 export function underLegWorktrees(path) { return LEG_DIR_RE.test(String(path ?? '')) }

package/src/launcher.mjs

@@ -12,7 +12,7 @@ import { redact } from './redact.mjs'
 import { home, listCards, readRuns } from './store.mjs'
 import { names as adapterNames, get as getAdapter, isFake } from './adapters/index.mjs'
 import { resolveChb, chbVersion } from './handoff.mjs'
-import { schedulerStatus, MAX_CONCURRENT } from './scheduler.mjs'
+import { schedulerStatus, MAX_CONCURRENT } from './scheduler-status.mjs'
 import { enabledSyncs } from './sync/index.mjs'
 
 const SRC = dirname(fileURLToPath(import.meta.url))

package/src/limits.mjs

@@ -29,7 +29,25 @@ function loadSignals() {
   return out
 }
 
-export const SIGNALS = loadSignals()
+// The fixture tree (24 files, one RegExp compile each) loads on first use,
+// not at import: a command that pulls in this module (via runner.mjs,
+// transitively via the scheduler or orchestrator) but never calls classify()
+// never pays for it. `SIGNALS` stays a plain array to every reader (test/
+// and scripts/limits-table.mjs both use SIGNALS.length/.filter/.map at their
+// own top level, with no loader to call first) via a Proxy whose `get` trap
+// loads and memoises on first property access.
+let cachedSignals = null
+function ensureSignals() {
+  if (!cachedSignals) cachedSignals = loadSignals()
+  return cachedSignals
+}
+
+export const SIGNALS = new Proxy([], {
+  get(_target, prop) { return Reflect.get(ensureSignals(), prop) },
+  has(_target, prop) { return Reflect.has(ensureSignals(), prop) },
+  ownKeys() { return Reflect.ownKeys(ensureSignals()) },
+  getOwnPropertyDescriptor(_target, prop) { return Reflect.getOwnPropertyDescriptor(ensureSignals(), prop) },
+})
 
 const AUTH_SOURCE_RE = /another auth source is set/i
 

package/src/scheduler-status.mjs

@@ -0,0 +1,22 @@
+// scheduler-status — the scheduler's pidfile and its two cheap readers,
+// split out of src/scheduler.mjs so a caller that only wants "is the
+// scheduler running" (the launcher, `leg status`) does not have to pull in
+// the whole orchestrator → land/mergequeue/stations/chain/pipeline/contract/
+// commands/runner/limits graph. src/scheduler.mjs re-exports both, so every
+// existing import of them keeps working unchanged.
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { home } from './store.mjs'
+
+export const MAX_CONCURRENT = Math.max(1, parseInt((process.env.LEG_MAX_CONCURRENT || process.env.BATON_MAX_CONCURRENT) || '2', 10) || 2)
+
+export function pidfile() { return join(home(), 'scheduler.pid') }
+
+export function schedulerStatus() {
+  const f = pidfile()
+  if (!existsSync(f)) return { running: false, pid: null }
+  const pid = parseInt(readFileSync(f, 'utf8').trim(), 10)
+  let alive = false
+  try { process.kill(pid, 0); alive = true } catch {}
+  return { running: alive, pid, stale: !alive }
+}