@ucsandman/legcli 0.14.0 → 0.15.1

package/bin/leg.mjs

@@ -5,32 +5,15 @@
 //   leg card ls [--json] | show <id> | run <id> | rm <id> [--delete-branch] | events <id>
 //   leg card <pause|resume|kill|approve|handoff-now|rerun> <id> | reassign <id> --adapter a [--mode m]
 //   leg scheduler start [--ticks N] [--interval-ms N] | status | stop
+//
+// Startup cost matters here: every command, `--version` included, paid for
+// loading the whole module graph (orchestrator, scheduler, board, attach…)
+// before main() even ran. Each command group below imports only what it
+// needs, inside its own branch, so `leg --version` and friends stay cheap.
 import { rmSync, appendFileSync, readFileSync } from 'node:fs'
 import { join, dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
-import { PRESET_NAMES } from '../src/presets.mjs'
-import { readCard, listCards, readEvents, readRuns, cardDir } from '../src/store.mjs'
-import { runCard, humanAction } from '../src/orchestrator.mjs'
-import { createCard, CardInputError } from '../src/cards.mjs'
-import { remove as removeWorktree } from '../src/worktree.mjs'
-import { pruneSessionWorktree } from '../src/land.mjs'
-import { createScheduler, schedulerStatus, pidfile, MAX_CONCURRENT } from '../src/scheduler.mjs'
-import { availableActions } from '../src/chain.mjs'
-import { up, down, stopBoard, status, openBoard } from '../src/launcher.mjs'
-import { attach, ensureBoard } from '../src/attach.mjs'
-import { readShare, addPerson, removePerson, rotate as rotateToken, turnOn, turnOff, linkFor, personNamed, scheme, tlsConfigured, ROLES } from '../src/share.mjs'
-import { normalizeHandoffOrder, ladderFor, readPreferences, writePreferences } from '../src/preferences.mjs'
-import { MODEL_ALIASES } from '../src/buckets.mjs'
-import { SUPERVISED_AGENTS, listSessions, readSession, readEvents as readSessionEvents, requestControl, removeSession, isActive, readLand, sessionDir, appendEvent } from '../src/sessions.mjs'
-import { addAccount, removeAccount, listAccountRows, readAccounts, LAYOUT } from '../src/accounts.mjs'
-import { listUsage, fmtReset, readUsage, isAvailable, candidates, binding, wallActive, evaluateLadder, rungLabel } from '../src/usage.mjs'
-import { home } from '../src/store.mjs'
-import { entitlement, allows, describe as describeLicense, activate as activateLicense, deactivate as deactivateLicense, refresh as refreshLicense, licensePath, BUY_URL } from '../src/license.mjs'
-import { resumeVerdict, bodyOf, ago } from '../src/resume.mjs'
-import { harnessCommand } from '../src/harness/cli.mjs'
-import { adapterCommand } from '../src/adapters/cli.mjs'
-import { historyCommand, worktreesCommand } from '../src/history/cli.mjs'
 
 const SRC = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'src')
 // one source of truth for the version, so the help text cannot drift from the package
@@ -52,6 +35,7 @@ function parseArgs(argv) {
 }
 
 async function cardAdd(args) {
+  const { createCard, CardInputError } = await import('../src/cards.mjs')
   try {
     const card = await createCard({
       repo: args.repo, task: args.task, chain: args.chain, pipeline: args.pipeline,
@@ -74,7 +58,10 @@ async function cardAdd(args) {
 // start the next option in the same terminal. The payload is marked
 // simulated: it is never kept as live evidence, and the wall it records
 // clears after two minutes. codex has no Leg-owned input, so it is refused.
-function simulateLimit(s, { message = null } = {}) {
+// `sessionsApi` is the already-imported src/sessions.mjs namespace: the
+// `sessions` command group loads it once and passes it through.
+function simulateLimit(sessionsApi, s, { message = null } = {}) {
+  const { isActive, sessionDir, appendEvent, readSession } = sessionsApi
   if (!isActive(s)) die(3, `session ${s.session_id} is not active`)
   if (['limit', 'handing_off'].includes(s.status)) die(3, `session ${s.session_id} is already ${s.status}`)
   if (s.agent === 'claude') {
@@ -105,13 +92,16 @@ function simulateLimit(s, { message = null } = {}) {
 // unambiguous. Two are not, so the second is read as an account when that
 // account exists and as a model when the agent has one by that name; a word
 // that is neither is refused by name rather than guessed at.
-export function parseTarget(value, { die: fail = (code, msg) => { throw new Error(msg) } } = {}) {
+// Async so the agent/account lookups (buckets.mjs, accounts.mjs) load only
+// when a two-part target is actually given, not on every CLI invocation.
+export async function parseTarget(value, { die: fail = (code, msg) => { throw new Error(msg) } } = {}) {
   const parts = String(value).split('/').filter(Boolean)
   const agent = parts[0]
   if (!agent) fail(2, 'usage: --to <agent>[/<account>[/<model>]]')
-  const models = MODEL_ALIASES[agent] ?? []
   if (parts.length >= 3) return { agent, account: parts[1], model: parts[2].toLowerCase() }
   if (parts.length === 2) {
+    const [{ MODEL_ALIASES }, { readAccounts }] = await Promise.all([import('../src/buckets.mjs'), import('../src/accounts.mjs')])
+    const models = MODEL_ALIASES[agent] ?? []
     const second = parts[1]
     const accounts = readAccounts()[agent] ?? ['default']
     if (accounts.includes(second)) return { agent, account: second, model: null }
@@ -124,25 +114,28 @@ export function parseTarget(value, { die: fail = (code, msg) => { throw new Erro
 // What a rung is doing right now, in the words the board uses: the wall and its
 // clock, else the percentage of the bucket that binds it, else "no figure".
 // Never a guess: an agent that publishes no number says so.
-function rungState(rung) {
-  const u = readUsage(rung.agent, rung.account)
+// `usage` is the already-imported src/usage.mjs namespace.
+function rungState(rung, usage) {
+  const u = usage.readUsage(rung.agent, rung.account)
   const wall = rung.model ? u.walls?.[rung.model] : null
-  if (wall && wallActive(wall)) return `${rung.model} out until ${fmtReset(wall.limited_until)}`
-  if (!isAvailable(u)) return `at its limit until ${fmtReset(u.limited_until)}`
-  const b = binding(u, rung.model ?? null)
+  if (wall && usage.wallActive(wall)) return `${rung.model} out until ${usage.fmtReset(wall.limited_until)}`
+  if (!usage.isAvailable(u)) return `at its limit until ${usage.fmtReset(u.limited_until)}`
+  const b = usage.binding(u, rung.model ?? null)
   if (b && Number.isFinite(b.percent)) return `${Math.round(b.percent)}% of the ${b.model ? b.model + ' ' : ''}${b.kind === 'session' || b.kind === 'five_hour' ? '5h' : 'week'} window`
   return 'no figure'
 }
 
-function printLadder() {
-  const prefs = readPreferences()
+// `prefsApi`/`usage` are the already-imported src/preferences.mjs and
+// src/usage.mjs namespaces (the `ladder` command group loads them once).
+function printLadder(prefsApi, usage) {
+  const prefs = prefsApi.readPreferences()
   const ladder = prefs.handoff_ladder
-  const rows = evaluateLadder({ from: null, list: ladder, maySpend: prefs.may_spend, reserve: prefs.reserve, automatic: true, climbBack: prefs.climb_back, ladder })
+  const rows = usage.evaluateLadder({ from: null, list: ladder, maySpend: prefs.may_spend, reserve: prefs.reserve, automatic: true, climbBack: prefs.climb_back, ladder })
   out('The ladder a terminal falls down when its login stops. Rung 1 first, every time.')
   ladder.forEach((rung, i) => {
     const r = rows[i]
     const when = rung.when === 'always' ? '' : `  when ${rung.when}`
-    out(`  ${String(i + 1).padEnd(2)} ${rungLabel(rung).padEnd(20)} ${rungState(rung).padEnd(34)} ${r.ok ? 'ready' : r.reason}${when}`)
+    out(`  ${String(i + 1).padEnd(2)} ${usage.rungLabel(rung).padEnd(20)} ${rungState(rung, usage).padEnd(34)} ${r.ok ? 'ready' : r.reason}${when}`)
   })
   out('')
   out(`spending: ${prefs.may_spend ? 'on (a credits or metered rung may be taken unattended)' : 'off (a credits or metered rung is skipped unattended)'} · leg ladder spend on|off`)
@@ -152,38 +145,39 @@ function printLadder() {
   out(`order (what older readers see): ${prefs.handoff_order.join(' → ')}`)
 }
 
-function ladderCommand(cmd, args) {
-  if (!cmd || cmd === 'ls' || cmd === 'show') return printLadder()
-  const prefs = readPreferences()
+async function ladderCommand(cmd, args) {
+  const [prefsApi, usage] = await Promise.all([import('../src/preferences.mjs'), import('../src/usage.mjs')])
+  if (!cmd || cmd === 'ls' || cmd === 'show') return printLadder(prefsApi, usage)
+  const prefs = prefsApi.readPreferences()
   const ladder = prefs.handoff_ladder.map((r) => ({ ...r }))
   if (cmd === 'set') {
     const [nRaw, target] = args._
     const n = parseInt(nRaw, 10)
     if (!Number.isFinite(n) || n < 1) die(2, 'usage: leg ladder set <n> <agent>[/<account>[/<model>]] [--when always|below:N|walled-only]')
     if (!target) die(2, 'usage: leg ladder set <n> <agent>[/<account>[/<model>]] [--when always|below:N|walled-only]')
-    const want = parseTarget(target, { die })
+    const want = await parseTarget(target, { die })
     const rung = { ...want, when: typeof args.when === 'string' ? args.when : 'always' }
     const at = Math.min(n, ladder.length + 1) - 1
     ladder[at] = rung
     try {
-      const saved = writePreferences({ handoff_ladder: ladder })
-      out(`rung ${at + 1} is ${rungLabel(saved.handoff_ladder[at])}${rung.when !== 'always' ? `, when ${rung.when}` : ''}`)
+      const saved = prefsApi.writePreferences({ handoff_ladder: ladder })
+      out(`rung ${at + 1} is ${usage.rungLabel(saved.handoff_ladder[at])}${rung.when !== 'always' ? `, when ${rung.when}` : ''}`)
     } catch (err) { die(2, err.message) }
-    return printLadder()
+    return printLadder(prefsApi, usage)
   }
   if (cmd === 'rm') {
     const n = parseInt(args._[0], 10)
     if (!Number.isFinite(n) || n < 1 || n > ladder.length) die(2, `usage: leg ladder rm <n> (1..${ladder.length})`)
     if (ladder.length === 1) die(2, 'that is the only rung left: a ladder with no rungs has nowhere to hand off to')
     const [gone] = ladder.splice(n - 1, 1)
-    try { writePreferences({ handoff_ladder: ladder }) } catch (err) { die(2, err.message) }
-    out(`removed rung ${n}: ${rungLabel(gone)}`)
-    return printLadder()
+    try { prefsApi.writePreferences({ handoff_ladder: ladder }) } catch (err) { die(2, err.message) }
+    out(`removed rung ${n}: ${usage.rungLabel(gone)}`)
+    return printLadder(prefsApi, usage)
   }
   if (cmd === 'spend') {
     const v = args._[0]
     if (!['on', 'off'].includes(v)) die(2, 'usage: leg ladder spend on|off')
-    const saved = writePreferences({ may_spend: v === 'on' })
+    const saved = prefsApi.writePreferences({ may_spend: v === 'on' })
     return out(saved.may_spend
       ? 'spending is ON: an unattended hand-off may take a rung that bills credits.'
       : 'spending is OFF: an unattended hand-off skips any rung that bills credits, and says so in the ledger.')
@@ -238,13 +232,10 @@ async function main() {
     out('\nPassing the leg to the next runner when limits hit.')
     return
   }
-  if (SUPERVISED_AGENTS.includes(group)) {
-    // leg claude|codex|agy|grok [agent args...]: everything after the agent name
-    // goes straight through.
-    const code = await attach(group, [cmd, ...rest].filter((x) => x !== undefined), { open: (process.env.LEG_NO_OPEN || process.env.BATON_NO_OPEN) !== '1' })
-    process.exit(code)
-  }
   if (group === 'sessions') {
+    const sessionsApi = await import('../src/sessions.mjs')
+    const { listSessions, readSession, isActive, removeSession, readLand, requestControl } = sessionsApi
+    const readSessionEvents = sessionsApi.readEvents
     const list = listSessions()
     if (cmd === 'ls' || !cmd) {
       if (args.json) return out(JSON.stringify(list, null, 2))
@@ -263,17 +254,20 @@ async function main() {
       // is not a destination, is not installed, or is at its wall must be
       // refused now, not silently turn into "whatever is next".
       if (typeof args.to === 'string') {
-        const want = parseTarget(args.to, { die })
+        const [{ normalizeHandoffOrder, ladderFor }, usage, { readAccounts }] = await Promise.all([
+          import('../src/preferences.mjs'), import('../src/usage.mjs'), import('../src/accounts.mjs'),
+        ])
+        const want = await parseTarget(args.to, { die })
         const order = normalizeHandoffOrder(s.handoff_order)
         const ladder = ladderFor(s)
-        const chain = candidates({ agent: s.agent, account: s.account, model: s.model ?? null, accounts: readAccounts(), order, ladder })
+        const chain = usage.candidates({ agent: s.agent, account: s.account, model: s.model ?? null, accounts: readAccounts(), order, ladder })
         const hit = chain.find((c) => c.agent === want.agent && c.account === want.account && (want.model ? (c.model ?? null) === want.model : true))
-        const label = rungLabel(want)
-        if (!hit) die(2, `${label} is not a destination for this terminal (${chain.map((c) => rungLabel(c)).join(', ') || 'none'})`)
+        const label = usage.rungLabel(want)
+        if (!hit) die(2, `${label} is not a destination for this terminal (${chain.map((c) => usage.rungLabel(c)).join(', ') || 'none'})`)
         if (s.installed && s.installed[want.agent] === false) die(3, `${label} is not installed on this machine`)
-        const u = readUsage(want.agent, want.account)
-        if (!isAvailable(u)) die(3, `${label} is at its usage limit until ${fmtReset(u.limited_until)}; pick another, or drop --to to take the next option in the order`)
-        if (hit.model && wallActive(u.walls?.[hit.model])) die(3, `${label} is out until ${fmtReset(u.walls[hit.model].limited_until)}; pick another rung, or drop --to to take the next open one`)
+        const u = usage.readUsage(want.agent, want.account)
+        if (!usage.isAvailable(u)) die(3, `${label} is at its usage limit until ${usage.fmtReset(u.limited_until)}; pick another, or drop --to to take the next option in the order`)
+        if (hit.model && usage.wallActive(u.walls?.[hit.model])) die(3, `${label} is out until ${usage.fmtReset(u.walls[hit.model].limited_until)}; pick another rung, or drop --to to take the next open one`)
         const target = { agent: hit.agent, account: hit.account, ...(hit.model ? { model: hit.model } : {}) }
         requestControl(id, { handoff: true, target })
         return out(`handoff to ${label} requested for ${id}`)
@@ -291,6 +285,7 @@ async function main() {
       // the CLI twin never orphans a worktree the board can no longer reach
       if (s.worktree) {
         try {
+          const { pruneSessionWorktree } = await import('../src/land.mjs')
           const r = pruneSessionWorktree(s)
           out(r.removed
             ? `removed worktree ${s.worktree.path}${r.branchDeleted ? ` and branch ${s.worktree.branch}` : `; kept branch ${s.worktree.branch}`}`
@@ -303,7 +298,7 @@ async function main() {
     // is the only way to reach a per-model wall without waiting for one:
     // --message "You've reached your Fable limit." walls fable and leaves the
     // rest of the login open (src/buckets.mjs).
-    if (cmd === 'simulate-limit') return simulateLimit(s, { message: typeof args.message === 'string' ? args.message : null })
+    if (cmd === 'simulate-limit') return simulateLimit(sessionsApi, s, { message: typeof args.message === 'string' ? args.message : null })
     die(2, `unknown sessions command "${cmd}" (ls|show|events|handoff|end|rm|simulate-limit)`)
   }
   if (group === 'ladder') {
@@ -311,10 +306,21 @@ async function main() {
     // state and the same skip reasons the board's picker shows.
     return ladderCommand(cmd, args)
   }
+  if (group === 'digest') {
+    // What happened while you were away: terminals, cards, landings and walls
+    // in a window, grouped by repository, what needs you first. Read only.
+    // Loaded here and not at the top: a command most sessions never run.
+    const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
+    const { buildDigest, renderDigest, DEFAULT_SINCE } = await import('../src/digest.mjs')
+    let d
+    try { d = buildDigest({ since: typeof a.since === 'string' ? a.since : DEFAULT_SINCE }) } catch (err) { die(2, err.message) }
+    return out(a.json ? JSON.stringify(d, null, 2) : renderDigest(d))
+  }
   if (group === 'resume') {
     // The read side of the pointer. Freshness is never read out of the file:
     // it is recomputed from git here, now, so a resume file cannot describe a
     // picture that is no longer true to whoever is standing in the repo.
+    const { resumeVerdict, bodyOf, ago } = await import('../src/resume.mjs')
     const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
     const where = typeof a.path === 'string' ? resolve(a.path) : process.cwd()
     const v = resumeVerdict(where)
@@ -345,6 +351,9 @@ async function main() {
   if (group === 'share') {
     // Multiplayer, off by default: the board binds a shared address only once
     // at least one person has a token, and every human has their own.
+    const { readShare, addPerson, removePerson, rotate: rotateToken, turnOn, turnOff, linkFor, personNamed, scheme, tlsConfigured, ROLES } = await import('../src/share.mjs')
+    const { stopBoard } = await import('../src/launcher.mjs')
+    const { ensureBoard } = await import('../src/attach.mjs')
     const share = readShare()
     // only the listener moves: the agents running under it are not part of who
     // may look at the board
@@ -374,6 +383,7 @@ async function main() {
     if (cmd === 'on') {
       const a = parseArgs(rest)
       // more than one human is the Team plan
+      const { entitlement, allows, describe: describeLicense, BUY_URL } = await import('../src/license.mjs')
       const ent = entitlement()
       if (!allows(ent, 'share')) die(2, ent.ok ? `leg share is part of the Team plan (per seat); this machine has a ${ent.plan} license. ${BUY_URL}` : describeLicense(ent))
       try {
@@ -428,6 +438,7 @@ async function main() {
     die(2, `unknown share command "${cmd}" (status|on|add|rotate|rm|off)`)
   }
   if (group === 'accounts') {
+    const { addAccount, removeAccount, listAccountRows, LAYOUT } = await import('../src/accounts.mjs')
     if (cmd === 'add') {
       const [agent, name] = args._
       if (!agent || !name) die(2, 'usage: leg accounts add <claude|codex> <name>')
@@ -451,6 +462,7 @@ async function main() {
       return out(`removed ${agent} account "${name}" (your real ${LAYOUT[agent]?.home() ?? 'home'} was not touched)`)
     }
     if (cmd === 'ls' || !cmd) {
+      const { listUsage, fmtReset } = await import('../src/usage.mjs')
       const usage = Object.fromEntries(listUsage().map((u) => [`${u.agent}--${u.account}`, u]))
       for (const r of listAccountRows()) {
         const u = usage[`${r.agent}--${r.name}`]
@@ -465,12 +477,14 @@ async function main() {
   if (group === 'harness') {
     // The portable harness: the working environment a hand-off carries with
     // the task. Off until `leg harness enable` (src/harness/index.mjs).
+    const { harnessCommand } = await import('../src/harness/cli.mjs')
     const code = await harnessCommand(cmd, args, { out, die })
     process.exit(code)
   }
   if (group === 'adapter' || group === 'adapters') {
     // Custom adapters: any CLI as a card agent, from a JSON spec on disk
     // (src/adapters/custom.mjs). The built-ins need none of this.
+    const { adapterCommand } = await import('../src/adapters/cli.mjs')
     const code = await adapterCommand(cmd, args, { out, die })
     process.exit(code)
   }
@@ -479,6 +493,7 @@ async function main() {
     // stores hold: a read-only index (src/history/index.mjs). `continue`
     // starts a normal supervised leg on one of them. `leg history --json` is
     // `leg history ls --json`: a leading flag names no verb.
+    const { historyCommand, worktreesCommand } = await import('../src/history/cli.mjs')
     const isHelp = cmd === '--help' || cmd === '-h' || cmd === 'help' || args.help || args.h
     const bare = typeof cmd === 'string' && cmd.startsWith('--')
     const verb = isHelp ? 'help' : (bare ? 'ls' : cmd)
@@ -492,6 +507,7 @@ async function main() {
   if (group === 'license') {
     // The paid gate. Keys verify offline against the public key in
     // src/license.mjs; nothing here talks to the network except refresh.
+    const { entitlement, describe: describeLicense, activate: activateLicense, deactivate: deactivateLicense, refresh: refreshLicense, licensePath, BUY_URL } = await import('../src/license.mjs')
     if (!cmd || cmd === 'status') {
       // looking does not start the trial clock; the first session does
       const ent = entitlement({ startTrial: false })
@@ -519,18 +535,22 @@ async function main() {
   if (group === 'uninstall') {
     // Leg never edits ~/.claude or ~/.codex; everything it added lives under
     // $LEG_HOME (sessions, usage, extra-account dirs, cards).
+    const { home } = await import('../src/store.mjs')
     const dir = home()
     if (!args.yes) {
       out(`leg uninstall removes ${dir} (sessions, usage, extra-account dirs, cards, board pidfile) and nothing else.`)
       out('Your real ~/.claude, ~/.codex and agy homes are never touched. Re-run with --yes to do it.')
       return
     }
+    const { listAccountRows, removeAccount } = await import('../src/accounts.mjs')
+    const { down } = await import('../src/launcher.mjs')
     for (const r of listAccountRows()) if (r.name !== 'default') removeAccount(r.agent, r.name)
     await down()
     rmSync(dir, { recursive: true, force: true })
     return out(`removed ${dir}; now: npm rm -g @ucsandman/legcli`)
   }
   if (group === 'card') {
+    const { readCard, listCards, readEvents, readRuns, cardDir } = await import('../src/store.mjs')
     if (cmd === 'add') return cardAdd(args)
     if (cmd === 'ls') {
       const cards = listCards()
@@ -543,6 +563,7 @@ async function main() {
     const card = readCard(id) || die(3, `card not found: ${id}`)
     if (cmd === 'show') {
       if (args.json) return out(JSON.stringify({ card, runs: readRuns(id) }, null, 2))
+      const { availableActions } = await import('../src/chain.mjs')
       out(fmtCard(card))
       out(`  repo: ${card.repo}`)
       out(`  worktree: ${card.worktree ?? '(none yet)'}`)
@@ -557,12 +578,14 @@ async function main() {
       return
     }
     if (cmd === 'run') {
+      const { runCard } = await import('../src/orchestrator.mjs')
       const final = await runCard(id)
       out(`${final.card_id} ${final.status} at ${final.station}`)
       process.exit(final.status === 'done' ? 0 : 1)
     }
     if (cmd === 'rm') {
       try {
+        const { remove: removeWorktree } = await import('../src/worktree.mjs')
         const r = removeWorktree(card.repo, id, { deleteBranch: Boolean(args['delete-branch']), force: Boolean(args.force) })
         if (args['delete-branch'] && r.branchUnmerged && !r.branchDeleted) out(`kept branch leg/${id}: it has commits not on its base (rerun with --force to discard them)`)
       } catch (err) { die(3, `worktree: ${err.message}`) }
@@ -571,6 +594,7 @@ async function main() {
     }
     const human = { queue: 'enqueue', pause: 'pause', resume: 'resume', kill: 'kill', approve: 'approve', 'handoff-now': 'handoff_now', rerun: 'rerun', reassign: 'reassign' }[cmd]
     if (human) {
+      const { humanAction } = await import('../src/orchestrator.mjs')
       const payload = human === 'reassign' ? { adapter: args.adapter || die(2, 'reassign needs --adapter'), mode: args.mode } : {}
       const next = humanAction(id, human, payload, { type: 'human', id: args.actor || 'local' })
       return out(`${next.card_id} ${next.status} at ${next.station} leg ${next.leg}`)
@@ -578,6 +602,7 @@ async function main() {
     die(2, `unknown card command "${cmd}" (add|ls|show|run|rm|events|queue|pause|resume|kill|approve|handoff-now|rerun|reassign)`)
   }
   if (group === 'scheduler') {
+    const { createScheduler, schedulerStatus, pidfile, MAX_CONCURRENT } = await import('../src/scheduler.mjs')
     if (cmd === 'start') {
       const ticks = args.ticks ? parseInt(args.ticks, 10) : Infinity
       const running = schedulerStatus()
@@ -603,19 +628,34 @@ async function main() {
     die(2, `unknown scheduler command "${cmd}" (start|status|stop)`)
   }
   if (group === 'up') {
+    const { up } = await import('../src/launcher.mjs')
     const a = parseArgs([cmd, ...rest].filter((x) => x !== undefined))
     const code = await up({ dry: Boolean(a.dry), open: !a['no-open'], port: a.port !== undefined ? parseInt(a.port, 10) : undefined, bind: a.bind })
     process.exit(code)
   }
-  if (group === 'down') process.exit(await down())
-  if (group === 'status') process.exit(await status())
+  if (group === 'down') { const { down } = await import('../src/launcher.mjs'); process.exit(await down()) }
+  if (group === 'status') { const { status } = await import('../src/launcher.mjs'); process.exit(await status()) }
   if (group === 'open') {
+    const { openBoard } = await import('../src/launcher.mjs')
     const port = (process.env.LEG_PORT || process.env.BATON_PORT) || 4747
     const url = `http://127.0.0.1:${port}`
     out(openBoard(url) ? `opened ${url}` : `could not open a browser; visit ${url}`)
     return
   }
-  if (group && group !== '--help' && group !== 'help') die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|ladder|history|worktrees|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
+  // Everything above is a named command group. What is left is either a
+  // supervised agent (`leg claude|codex|agy|grok [args...]`, everything after
+  // the agent name goes straight through) or unknown. SUPERVISED_AGENTS and
+  // attach() are loaded here, last, so no other command pays for them.
+  if (group && group !== '--help' && group !== 'help') {
+    const { SUPERVISED_AGENTS } = await import('../src/sessions.mjs')
+    if (SUPERVISED_AGENTS.includes(group)) {
+      const { attach } = await import('../src/attach.mjs')
+      const code = await attach(group, [cmd, ...rest].filter((x) => x !== undefined), { open: (process.env.LEG_NO_OPEN || process.env.BATON_NO_OPEN) !== '1' })
+      process.exit(code)
+    }
+    die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|ladder|history|worktrees|digest|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
+  }
+  const { PRESET_NAMES } = await import('../src/presets.mjs')
   out(`leg ${VERSION}, your coding agents, with a board alongside and a handoff when one hits its limit
   claude|codex|agy|grok [args...]   the normal interactive agent in this terminal; args pass straight through
                                 the board opens once, the session shows as a card, usage is tracked, a limit hands off
@@ -634,6 +674,8 @@ async function main() {
   history show|continue <id> | refresh | providers
                                 one conversation, or start leg <agent> on it where the agent can resume by id
   worktrees [--repo r] [--json]  every checkout Leg can see: git's, its own, the ones conversations worked in
+  digest [--since 8h|2d|<iso>] [--json]        what happened while you were away: what needs you, then every
+                                terminal, card, landing and wall in the window, grouped by repository
   resume [--check] [--json] [--path <dir>]      the hand-off waiting in this checkout, and whether it is still true
                                freshness is recomputed from git at read time; --check prints only the verdict
                                exit 0 current, 1 stale or unstamped, 3 no pointer here

package/docs/DECISIONS.md

@@ -2,6 +2,14 @@
 
 Durable product and design decisions that the code does not explain on its own. One entry per decision, newest first.
 
+## 2026-09-18: a second claude login shares the conversation store, so an account switch keeps the conversation
+
+- **What.** `LAYOUT.claude.share` gains `projects`: `leg accounts add claude <name>` junctions Claude Code's conversation store into the account directory beside the harness directories, and `refreshAccount()` adds a missing junction to an account made before this before every launch. `keepsConversation()` in `src/usage.mjs` is the one rule that decides `--resume` over the bundle, for the terminal's switch and the board picker's `keeps_conversation` alike: a same-login downshift (as before), or another login of the same agent under which the transcript file exists. The history index skips a junctioned `projects` so a conversation is listed once.
+- **Why share rather than copy.** Wes runs two 20x logins and wants a Fable or weekly wall on one to continue on the other without re-explaining anything. Copying the one transcript at hand-off would have to write into `~/.claude/projects` on the way back, and that directory is on the README's "read, never written" list. A junction inside `$LEG_HOME/accounts/` keeps that promise: Claude Code writes its own store, Leg reads it. It also carries the auto-memory under `projects/<cwd>/memory/`, which is the same human's and should follow them.
+- **Why the rule checks the file.** A `--resume` into a login that cannot see the transcript opens an empty conversation and loses the bundle too. So the rule asks whether the file exists under the destination home at the moment of the switch, and says bundle when it does not. A false answer costs one bundle prime; a wrong true would cost the context.
+- **Why a cross-login upshift resumes when a same-login upshift does not.** The same-login rule stays as decided on 2026-09-17: the re-read at the stronger model's rate is paid on the login that is already low. Across logins the destination is a fresh window, which is the reason the human bought it.
+- **What this rules out.** codex across logins: `codex resume` under a second `CODEX_HOME` is unobserved, so codex rungs keep taking the bundle and claim nothing.
+
 ## 2026-09-18: usage is polled by the board, once per login; a rung's model is a catalog entry validated by shape
 
 - **What.** The board process runs one usage poller per login (`src/usage-poll.mjs`): 60s, doubling to ten minutes on any refusal, one status line when a login's reading fails and one when it is back. Terminals poll nothing and receive the windows on their session record. `GET /api/models` lists what each installed CLI can run, read from claude's aliases, codex's `models_cache.json` and `config.toml`, and the `models` commands of agy and grok, cached an hour under `<LEG_HOME>/models/`. A rung's `model` is validated by shape (lower-case id characters) for every provider and by membership for claude only.

package/docs/DEVIATIONS.md

@@ -104,6 +104,7 @@ shape differs from what the plan assumed. Same columns as the table above.
 |------|------|---------------|-------------|-----|
 | 2026-09-11 | bin/leg.mjs `simulate-limit` | "sends a real StopFailure payload with error rate_limit through src/hook.mjs" | the payload carries `baton_simulated: true`; the hook records the wall with a 2-minute reset instead of the default 5 h, never keeps it as live evidence, and the event says `(simulated)`; agy gets the RESOURCE_EXHAUSTED line appended to its Leg-owned session log; codex is refused (its wall lives in a rollout file Leg never writes) with `leg sessions handoff` as the alternative | a test must never wall the real claude login for five hours, and a simulated payload must never flip a docs row to observed-live |
 | 2026-09-11 | src/live-capture.mjs | "save that payload under fixtures/live/" | `fixtures/live/<agent>/limit-<signal>.json` only in a dev clone (the checkout has `.git` and `fixtures/live/`), else `~/.leg/live/`; `LEG_LIVE_DIR` overrides; first arrival per (agent, signal) wins; docs rows flip through `scripts/live-limits.mjs` markers (`<!-- live:<agent>/<signal> -->`) in the same call | an installed package has no writable fixtures directory, and a doc row must flip from evidence on disk, not from memory |
+| 2026-09-19 | src/taps/claude.mjs `writeSettings`, src/hook.mjs | the user's own `statusLine` command runs first (claimed in the file header since baton 0.2.0) | it was read only for its `padding`; the command is now kept on the session record (`user_statusline`) and the status-line hook runs it with the same stdin, printing its rows above Leg's | a baton user reported on Discord (2026-09-19) that baton replaced the status line they had configured; on a build that honours a `--settings` status line, Leg's row displaced theirs |
 | 2026-09-11 | src/attach.mjs `spawnSpec` | the next agent starts with no args | `BATON_<AGENT>_ARGS` (space-separated) is prepended to a leg Leg starts itself after a hand-off; the user's own `baton <agent> …` args still never carry over | the live test had to keep the handed-off leg on a cheap model, and a user has the same need for a chain |
 | 2026-09-11 | src/taps/codex.mjs | the first `role: user` message is the task | a message starting `# AGENTS.md instructions` is skipped like `<environment_context>` | observed live 2026-09-11: codex prepends the AGENTS.md block as the first user message of every rollout, so the card's task read as the instructions file |
 | 2026-09-11 | src/attach.mjs, src/wait.mjs | all out: print the reset times and exit 3 | status `waiting` with `session.waiting = { agent, account, resets_at, since }`; a one-line countdown on stderr (rewritten in place on a TTY, once a minute otherwise); at the reset the chooser runs again and the first option back starts from the bundle; Ctrl-C or a board End quits with exit 3 and an `ended` event "quit while waiting" | the terminal is where the work is; quitting hands the human a restart to type at the reset time |
@@ -181,3 +182,36 @@ tests. Rows for the shape changes a later reader would otherwise wonder about.
 | 2026-09-14 | src/resume.mjs idle pointer | a checkpoint bundle was described as "the last hand-off", and the per-session file was named unconditionally | `lineage.to` decides hand-off vs checkpoint, and the file is named only when it exists on disk | seen in the live pointer for this repo: it claimed a hand-off that never happened and pointed at a `RESUME-<id>.md` that was never written, which is the same class of lie the module exists to stop |
 | 2026-09-14 | src/board/sessions.js `renderDrawer()` | the whole panel is rebuilt every 3 s poll so relative timestamps stay honest | still rebuilt, but every scrollable box carries a stable `data-scroll-key` and its offset is carried across | the rebuild reset the task box, each message and the timeline to the top every three seconds, so a long message could not be read at all |
 | 2026-09-17 | src/board/sessions.js `verdictLines()` | spec A.5 lists "a model bucket came back and a terminal is still downshifted" below the two branches that print a standing percentage | the came-back branch is tested before them, right after the model-walled branch | as written it can never fire: "one login carries every live terminal" and "several logins carry work" both return for any login that has a figure at all, so the only state change worth telling a downshifted reader about was unreachable |
+
+## 2026-09-18: product, performance and architecture pass (0.15.0)
+
+Measured first (`scratchpad/prof/BASELINE.md`, reproduction commands in the
+CHANGELOG entry), then changed. Rows for the shape changes a later reader
+would otherwise wonder about; the designs not built are in
+`docs/review-2026-09-18.md`.
+
+| date | file | old shape | new shape | why |
+|------|------|-----------|-----------|-----|
+| 2026-09-18 | src/accounts.mjs, src/usage.mjs, src/attach.mjs, src/server.mjs | a hand-off to a second claude login always took the bundle; only a same-login downshift kept the conversation | the account junctions claude's `projects` store; one rule, `keepsConversation()`, decides for the terminal and the picker, and checks the transcript file is reachable under the destination home at the switch | a second 20x login should continue the conversation, not re-read it from a bundle; the junction keeps "~/.claude/projects: read, never written" true |
+| 2026-09-18 | src/history/providers/claude.mjs | every claude home was scanned, junction or not | a home whose `projects` is a link is skipped and reported `shared: true` | the same transcript listed twice from two logins |
+| 2026-09-18 | src/digest.mjs, bin/leg.mjs, src/server.mjs | nothing read the records back as an answer to a person; the audit trail was a flat list | `leg digest [--since]` and `GET /api/digest` (owner only): volume first, what needs you, per repository, walls standing now | the question after eight hours away had no reader; a window with nothing in it must print its counts, not a blank |
+| 2026-09-18 | bin/leg.mjs | 26 static imports; the agent dispatch first; `parseTarget` synchronous | one `await import()` per command group, inside its branch; the agent dispatch after every named group; `parseTarget` async and loads buckets/accounts only for a two-part target | `leg --version` loaded 68 modules for one readFileSync: 117 ms wall, 79 ms CPU, 254 fs calls; now 1 module, 52 ms, 4 fs calls |
+| 2026-09-18 | src/limits.mjs | `SIGNALS = loadSignals()` at import (24 fixture reads, one RegExp each) | a Proxy over the same array that loads on first property access | every command paid for the fixture tree; test/ and scripts/limits-table.mjs read `SIGNALS.length` at their own top level, so a loader function was not an option |
+| 2026-09-18 | src/scheduler-status.mjs (new), src/scheduler.mjs, src/launcher.mjs | `pidfile`, `schedulerStatus`, `MAX_CONCURRENT` lived in scheduler.mjs | a leaf module, re-exported from scheduler.mjs | the launcher pulled orchestrator, land, mergequeue, stations, chain, runner and limits to answer "is the scheduler running" |
+| 2026-09-18 | src/git.mjs (new), src/attach.mjs, src/bundle.mjs | six git processes per poll round (three `rev-parse`, `status --porcelain`, `@{upstream}`, `rev-list --count`), each wrapper private, no timeout, no maxBuffer | one `status --porcelain=v2 --branch` carries head, branch, upstream, ahead/behind and the dirty list; `aheadFromStatus` uses `# branch.ab` or a one-pair head cache; 20 s timeout, 8 MB buffer | an idle terminal spawned 59.5 git processes a minute and blocked its own loop 4.4 to 10.3 s/min; now 10.9/min and 2.1 s/min, CPU 1.7 to 0.1 s/min |
+| 2026-09-18 | src/git.mjs parseStatus | a rename printed the old and new names with the quotes half-stripped | the new name | the file on disk is the one a human recognises; pinned in test/git-status.test.mjs |
+| 2026-09-18 | src/attach.mjs ensureBoard | polled /api/health every 200 ms for up to 15 s before the agent got its first instruction | `wait: false` for a terminal: the agent starts at once, the wait runs behind it, `claimBoardBeforeExit` (2 s at most) still writes the pidfile before a sub-second session exits; `leg share on|off` keeps the blocking form | the one terminal of the day that starts the board waited ~790 ms doing nothing (to-agent 1,280 to 261 ms); a board without a pidfile is one `leg down` cannot stop |
+| 2026-09-18 | src/attach.mjs installedAgents | a `--version` subprocess per bare-name agent per launch, 8 s timeout each | `$LEG_HOME/installed.json`, one day per resolved bin; a `*_BIN` override is asked every time and never cached | a stub pointed at on purpose must be probed; a real CLI on PATH answers the same for a day |
+| 2026-09-18 | src/bundle.mjs, src/handoff.mjs, src/attach.mjs | the periodic checkpoint ran `chb save` synchronously inside the poll tick | `saveSessionBundleAsync` (execFile), one at a time through `checkpointGate`, awaited before the hand-off save; warning, limit and hand-off saves stay synchronous | a python subprocess with a 120 s timeout froze limit detection and every board button for its whole run |
+| 2026-09-18 | src/handoff.mjs | `scrub` imported from runner.mjs | from redact.mjs | the terminal path pulled the card runner's whole graph for one function |
+| 2026-09-18 | src/sessions.mjs updateSession | `withFileLock` defaults: past 1.2 s the read-modify-write ran unlocked | `retries: 250, staleMs: 10000`, run.json's budget | the most-written file in Leg (runner poll, claude hook, usage poller, board actions, every `leg` command); losing a patch is the race the lock exists for |
+| 2026-09-18 | src/sessions.mjs, src/attach.mjs | `rmSync(control.json)` at exit | `clearControl` under `.control.lock` | a bare unlink could delete a board request mid-write |
+| 2026-09-18 | src/attach.mjs | the 12-leg stop said "run leg again in this directory to continue from the bundle" | names the bundle path and `leg resume`; says a fresh `leg <agent>` does not load it | nothing reloads a bundle on a fresh launch; the line promised a hand-off that never happened |
+| 2026-09-18 | src/server.mjs health tick | `pushSessions()` unconditionally every 10 s per client | the stat fingerprint decides; a liveness pass (`reapLost`) runs on the tick because a dead runner moves no file; a card entering or leaving a human-waiting status forces one push | an idle board with 43 terminals did 7,294 fs calls, 8 git processes and 1.1 CPU s a minute for nothing; the first cut of this lost the dead-runner case, and the test that kills a real child now pins it |
+| 2026-09-18 | src/server.mjs sessionsView | `readUsage` per rung per terminal, again for `capacity`, again for the accounts payload (143 reads per answer) | one reader per view | a login is read at most once per answer, and every part of the answer comes from the same reading |
+| 2026-09-18 | src/synthesis.mjs | three `existsSync` per terminal per view | one `readdirSync` per checkout per view (`sessionFileIndex`) | 172 of 512 fs calls per answer, for files that mostly do not exist |
+| 2026-09-18 | src/server.mjs, src/history/worktrees.mjs | `/api/worktrees` ran up to 40 git processes synchronously on the board's loop (9 to 25 s cold) | `listWorktreesAsync` (execFile, four in flight), one refresh per query, the last list served while a refresh runs | the worst `/api/health` during a cold call fell from 11.8 s to 3.2 s; the rest is `listHistory` inside `gather()`, still synchronous |
+| 2026-09-18 | src/server.mjs /api/trunk | every card ledger read on every 2 s floor poll | a 15 s cache keyed by the window, cleared by any card change and by a landing | 27.5 to 0.5 ms p50, 113 to 15 fs calls per request |
+| 2026-09-18 | src/session-detail.mjs | one `git ls-files` per file the terminal touched, every 3 s the drawer is open | one `git ls-files -z -- <paths>` for the list | 7 to 2 processes per detail answer, 1,247 to 305 ms |
+| 2026-09-18 | src/server.mjs rows | every field of session.json on every push | `argv`, `runner_pid`, `head_at_start`, `checkpoints`, `agent_sessions`, `runtime_capabilities`, `files_touched` dropped from the row; `GET /api/sessions/<id>` still hands over the record | nothing under src/board/ read them; 8% off every push |
+| 2026-09-18 | src/history/worktrees.mjs | the git env built by a helper | `MSYS_NO_PATHCONV: '1'` spelled out at each spawn site | test/lessons.test.mjs checks every git spawn line in src/ for it, and the helper hid it from that check |

package/docs/ERRORS.md

@@ -21,7 +21,7 @@ and "CI green" after a push means the run, not the publish; `npm view
 **Fixed by deploying from the repo root with a root `.vercelignore` and
 `--archive=tgz`; the recipe is in DECISIONS.md under "the site deploys itself
 from git".** The `--yes` also auto-created an empty Vercel project named `leg`
-that still needs `vercel project rm leg`. The lesson: on a project with a Root
+that still needs `vercel project rm leg` (2026-09-18 later: `vercel project ls` no longer lists a `leg` project, so it is gone). The lesson: on a project with a Root
 Directory set, the CLI must run from the repo root, and `--yes` is a consent to
 create projects, not only to skip a confirmation.
 

package/docs/ROADMAP-v2.md

@@ -86,7 +86,18 @@ event names its actor, a board that reads only the ledger, and an auth/bind seam
    The same probe shape applies to naming the terminal tab: whether codex, agy
    and grok leave an OSC 2 title alone once the child starts drawing is
    assumed, not known, which is why the tab title is the browser's and not the
-   terminal's.
+   terminal's. 0.15.0 made the claude half of this real across logins too (a
+   second login shares the conversation store, so a login switch keeps the
+   conversation): the codex probe now also covers a second `CODEX_HOME` with
+   its `sessions` store shared the same way.
+7. **`stalled` and `repeating` on the row.** Two derived states from data the
+   record already holds: no turn, file write or commit for N minutes while not
+   waiting on a human; the same test red across two legs of one card. Printed
+   only, never acted on; a `looping` state waits for a false-positive study on
+   real transcripts. Design in `docs/review-2026-09-18.md`.
+8. **The digest on the board.** `leg digest` and `/api/digest` shipped in
+   0.15.0; the panel above Terminals on the first load of the day is the
+   human surface it still lacks. Same review doc.
 
 Also on the list: per-station prompt templates editable from the board, lease
 suggestions from the diff of the previous leg, and a floor view that shows

package/docs/adapters.md

@@ -55,8 +55,11 @@ documentation say docs-only.
   `src/hook.mjs`.
 - **Why not the status line.** Leg writes a `statusLine` entry into the same
   settings file that would record `rate_limits.five_hour.used_percentage` and
-  `resets_at`, and chains your own `statusLine` command first. Claude Code
-  2.1.268 did not run it when it was tried on this machine: an `echo` command
+  `resets_at`, and runs your own `statusLine` command first, its rows above
+  Leg's one (since 0.15.1; before that your command was read and never run,
+  so a build that honours the key showed Leg's row instead of yours). Claude
+  Code 2.1.268 and 2.1.278 did not run it when it was tried on this machine
+  (2026-09-11, 2026-09-19): an `echo` command
   passed through `--settings` and again through a project
   `.claude/settings.local.json` left the built-in status line in place, while
   hooks from the same `--settings` file fired. No artifact of that check was

package/docs/cli-contracts.md

@@ -246,10 +246,16 @@ variable and `LEG_SESSION` (source: src/attach.mjs, src/env.mjs).
 - Attach: `claude <args> -n "leg#<short id> <repo>/<branch>" --settings <LEG_HOME>/sessions/<id>/claude-settings.json`
   (source: src/attach.mjs `spawnSpec`; src/taps/claude.mjs `writeSettings`).
   Hooks in a `--settings` file merge with the user's rather than replacing
-  them; `statusLine` is the one key that replaces, so Leg runs the user's own
-  command first (source: code.claude.com/docs/en/settings;
-  src/taps/claude.mjs `userStatusLine`). observed-live 2026-09-11: a Leg
-  session ran with every user hook still firing.
+  them; `statusLine` is the one key that replaces, so Leg keeps the user's own
+  command on the session record (`user_statusline`) and its status-line hook
+  runs that command with the same stdin JSON, printing its rows above Leg's
+  one (source: code.claude.com/docs/en/settings, docs/en/statusline "Display
+  multiple lines"; src/taps/claude.mjs `userStatusLine`, `userStatusLineText`;
+  src/hook.mjs). Before 0.15.1 the user's command was read only for its
+  `padding` and never run, so a build that honours a `--settings` status line
+  showed Leg's row in place of the user's (reported by a baton user,
+  2026-09-19). observed-live 2026-09-11: a Leg session ran with every user
+  hook still firing.
 - Terminal title: `-n, --name <name>` "Set a display name for this session
   (shown in the prompt box, /resume picker, and terminal title)" —
   fixtures/help/claude.txt line 132. It sits in the general Options block, not
@@ -327,11 +333,13 @@ variable and `LEG_SESSION` (source: src/attach.mjs, src/env.mjs).
   path can also be run live with `leg sessions simulate-limit` (the same
   payload through `src/hook.mjs`, marked `leg_simulated`, never kept as
   evidence).
-- Status line, not usable on 2.1.268: a custom `statusLine` command passed
+- Status line, not usable on 2.1.268 or 2.1.278: a custom `statusLine` command passed
   through `--settings`, and again through a project
   `.claude/settings.local.json`, was not run at all when it was tried; an
   `echo` command at both levels left the built-in status line in place while
-  hooks from the same `--settings` file fired (no artifact kept; note in the
+  hooks from the same `--settings` file fired (probed again 2026-09-19 on
+  2.1.278 with a screenshot of two haiku sessions, not kept; 0 of 87 session
+  hook logs on this machine hold a statusline entry; note in the
   src/taps/claude-usage.mjs header, 2026-09-11). Leg still writes the
   `statusLine` entry, which records the
   same `rate_limits.five_hour` / `seven_day` fields