@ucsandman/legcli 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.16.0 (2026-09-19)
+
+The board reads as one product: a polish pass inside the 2026-09-15
+direction, a new mark, and a first-run screen.
+
+- **One colour rule, kept everywhere.** Login names in the capacity strip,
+  the rung in a terminal row's register and the rungs in the ladder editor are
+  text beside an identity dot; the colour no longer lands on the word. A
+  warning sentence is amber only on a row that is waiting on you. The accent
+  blue appears on Land when it can run and on Start once a task is typed, and
+  nowhere else. The capacity strip is an aligned table (dot, name, track,
+  figure) instead of a ragged sentence.
+- **Terminal rows.** The prompt is clamped to two lines (Details holds the
+  rest), the clock sits over one quiet row of buttons, a Land that cannot run
+  is not drawn (its reason is said once above the panel), and End is quiet at
+  rest. The register moved up to 15px and the scaffolding floor from 13 to
+  14px. A row whose state changed since the last render is lit for 1.4 s, the
+  one motion the rows own; rows carry a faint hover. Narrow rows lost 264px of
+  empty height each: a `flex-basis: 24ch` meant for the row direction had been
+  applied as height once the row stacked. The 420px horizontal overflow is
+  gone.
+- **One control language.** The background entry is the terminals panel's
+  footer, its choices quiet chips inside the sentence. Ledger cells share one
+  anatomy with their verbs (View, Browse, New card) on one baseline; Settings
+  is a row in the same grammar; disclosures carry a CSS chevron instead of a
+  typed `>`; the Floor and Board links are buttons.
+- **The verdict is a link.** When the sentence names a terminal, pressing it
+  scrolls to that row and focuses its prompt.
+- **First run.** A board with no terminal shows one lit panel: `leg claude`,
+  `leg codex` and `leg agy` each with a Copy, and one line on what appears
+  with the first turn.
+- **The floor.** An empty station is one line, heading beside sentence, so
+  seven empty stations are seven lines rather than seven screens.
+- **The mark.** A tile with the L cut as hip, knee and foot replaces the 🦿
+  emoji on the board, the floor, the favicon, the tab badge and the site.
+  The emoji rendered as whichever system emoji font the machine had.
+- **Docs.** Nine screenshots retaken against this build; DESIGN.md and the
+  board guide describe the new row and strip; the OG image carries the mark.
+
+## 0.15.1 (2026-09-19)
+
+Your own Claude Code status line comes back.
+
+- **Your status line runs first.** `leg claude` passes a `statusLine` through
+  `--settings`, and that key replaces yours rather than merging. Leg has
+  always read your `statusLine` command, but it only ever used its `padding`;
+  the command itself never ran, so on a build that honours a `--settings`
+  status line you saw Leg's row instead of your own. The command is now kept
+  on the session record and Leg's status-line hook runs it with the same JSON
+  Claude Code sends, printing its rows above Leg's one line. Reported by a
+  baton user on Discord. Claude Code 2.1.278 on Windows still shows its
+  built-in status line in place of any custom one passed this way, so the 5h
+  and 7d numbers keep coming from the usage endpoint (docs/faq.md).
+
 ## 0.15.0 (2026-09-18)
 
 A second login keeps the conversation, and the runtime does less work per

package/README.md

@@ -11,7 +11,7 @@
 
 *Claude hits the five-hour wall. The terminal reads `handing off to codex`, and codex carries on there. Nothing is retyped. ([the full 53-second run](https://legcli.com/#handoff))*
 
-![The Leg board at 1280px: a headline naming the terminal that has waited on you longest; under it a capacity strip with claude at 63 percent of its fable week, codex back on Saturday, agy with no figure and grok with no reading, and a button that opens the login panels; then four terminal rows, each with its status, repo and branch, uncommitted and unpushed counts, agent and model, the prompt, the one thing worth knowing and four buttons; then a Background panel of live cards and a one-line field for starting another; then counts for finished terminals, what landed, conversations and finished cards](https://legcli.com/img/docs/terminals-1280.png)
+![The Leg board at 1280px: a headline naming the terminal that has waited on you longest; under it a capacity strip with claude at 63 percent of its fable week, codex back on Saturday, agy with no figure and grok with no reading, and a button that opens the login panels; then four terminal rows, each with its status, repo and branch, uncommitted and unpushed counts, agent and model, the prompt, the one thing worth knowing and its buttons; then the one-line field for starting a background task, joined to the panel; then counts for finished terminals, what landed, conversations and finished cards](https://legcli.com/img/docs/terminals-1280.png)
 
 You keep using your coding agents exactly as you do today, in any terminal,
 from your own config directory: Leg adds its hooks in a separate per-session
@@ -420,8 +420,10 @@ with nothing in it says so with its counts.
   first, each row with the short sha, the subject, a `repo@branch` chip, and
   when plus who. A commit a Land put there says `landed by <agent> (<id tail>)`.
 - **Buttons**, in a fixed order that never reflows: Land, Hand off now,
-  Details, End. Once a session has ended, Remove and Remove record take End's
-  place. Details opens an expansion in flow under the panel.
+  Details, End, under the clock at the right of the row. Land is drawn only
+  when it can run; its reason is said once above the panel. Once a session has
+  ended, Remove and Remove record take End's place. Details opens an expansion
+  in flow under the panel.
   **Hand off now** takes the first open rung of the ladder. To name the
   destination instead, open Details and use **Hand off now to**, which lists
   every rung with its model, whether it keeps the conversation, and the reason

package/docs/DEVIATIONS.md

@@ -104,6 +104,7 @@ shape differs from what the plan assumed. Same columns as the table above.
 |------|------|---------------|-------------|-----|
 | 2026-09-11 | bin/leg.mjs `simulate-limit` | "sends a real StopFailure payload with error rate_limit through src/hook.mjs" | the payload carries `baton_simulated: true`; the hook records the wall with a 2-minute reset instead of the default 5 h, never keeps it as live evidence, and the event says `(simulated)`; agy gets the RESOURCE_EXHAUSTED line appended to its Leg-owned session log; codex is refused (its wall lives in a rollout file Leg never writes) with `leg sessions handoff` as the alternative | a test must never wall the real claude login for five hours, and a simulated payload must never flip a docs row to observed-live |
 | 2026-09-11 | src/live-capture.mjs | "save that payload under fixtures/live/" | `fixtures/live/<agent>/limit-<signal>.json` only in a dev clone (the checkout has `.git` and `fixtures/live/`), else `~/.leg/live/`; `LEG_LIVE_DIR` overrides; first arrival per (agent, signal) wins; docs rows flip through `scripts/live-limits.mjs` markers (`<!-- live:<agent>/<signal> -->`) in the same call | an installed package has no writable fixtures directory, and a doc row must flip from evidence on disk, not from memory |
+| 2026-09-19 | src/taps/claude.mjs `writeSettings`, src/hook.mjs | the user's own `statusLine` command runs first (claimed in the file header since baton 0.2.0) | it was read only for its `padding`; the command is now kept on the session record (`user_statusline`) and the status-line hook runs it with the same stdin, printing its rows above Leg's | a baton user reported on Discord (2026-09-19) that baton replaced the status line they had configured; on a build that honours a `--settings` status line, Leg's row displaced theirs |
 | 2026-09-11 | src/attach.mjs `spawnSpec` | the next agent starts with no args | `BATON_<AGENT>_ARGS` (space-separated) is prepended to a leg Leg starts itself after a hand-off; the user's own `baton <agent> …` args still never carry over | the live test had to keep the handed-off leg on a cheap model, and a user has the same need for a chain |
 | 2026-09-11 | src/taps/codex.mjs | the first `role: user` message is the task | a message starting `# AGENTS.md instructions` is skipped like `<environment_context>` | observed live 2026-09-11: codex prepends the AGENTS.md block as the first user message of every rollout, so the card's task read as the instructions file |
 | 2026-09-11 | src/attach.mjs, src/wait.mjs | all out: print the reset times and exit 3 | status `waiting` with `session.waiting = { agent, account, resets_at, since }`; a one-line countdown on stderr (rewritten in place on a TTY, once a minute otherwise); at the reset the chooser runs again and the first option back starts from the bundle; Ctrl-C or a board End quits with exit 3 and an `ended` event "quit while waiting" | the terminal is where the work is; quitting hands the human a restart to type at the reset time |

package/docs/ERRORS.md

@@ -3,6 +3,28 @@
 What broke, why, and what fixed it. One entry per failure, newest first. A first
 occurrence has to be written down or a repeat is never countable.
 
+## 2026-09-19: eleven versions reached npm and none reached the GitHub releases page
+
+**Fixed by making the publish job create the tag and the GitHub release itself,
+from the version's CHANGELOG.md section, and by backfilling v0.7.0 to v0.15.1.**
+
+The releases page stopped at v0.6.0 (2026-09-15, the pre-rename name) while npm went on to
+0.15.1. Releases 0.2.0 to 0.6.0 had been made by hand with `gh release create`,
+batched on 09-11 and 09-15; once `publish-npm` in `.github/workflows/ci.yml`
+took over the npm side on 09-14, nothing tagged or drafted anything, and no
+check noticed, because a green publish job and a stale releases page look the
+same from the terminal. Wes found it on the page. The rule that holds is a
+mechanism, not a note: the publish job now runs `scripts/release-notes.mjs`
+and `gh release create v<version>` in the same job as `npm publish` (the job
+has `contents: write` for that one step), and `scripts/npm-publish-gate.mjs`
+refuses a version with no `## <version>` section in CHANGELOG.md, so a
+release nobody wrote up never reaches npm either. `test/release-notes.test.mjs`
+pins the extraction. The backfilled tags point at the commit each npm version
+was published from (`npm view @ucsandman/legcli time` matched against
+`git log --first-parent --before`), not at the `[RELEASE]` commit, since three
+of those needed a follow-up fix before the gate let them through. 0.6.1 and
+0.8.1 have CHANGELOG sections but never reached npm, so they have no release.
+
 ## 2026-09-18: 0.14.0 pushed, CI green everywhere, and npm still served 0.13.1
 
 **Fixed by putting the `repository` block back into the lockfile root
@@ -687,3 +709,20 @@ it), and check whether a board was listening on 4747 at the time.
 - **The lesson that generalises.** A seeded board is safe to look at and not
   safe to click: any row that names a path that exists is a live control on
   that path. Seed paths must be realistic in shape and impossible in fact.
+
+## A width became 264px of height on every narrow row (2026-09-19)
+
+- **What happened.** `.term-row > .term-body { flex-basis: 24ch }` gave the
+  prompt column a starting width on the wide board. Under 760px the row
+  stacks (`flex-direction: column`), the same declaration became a starting
+  HEIGHT, and every terminal row carried about 264px of empty space under its
+  last line. It shipped in 0.13.0 and survived three review passes because
+  each one eyeballed the 400px screenshot instead of measuring it.
+- **Fix.** `flex-basis: auto` inside the narrow block. Narrow rows on the
+  seeded board went from 549/467/442/442 to 426/365/330/266.
+- **The lesson that generalises.** A flex-basis is axis-relative; any rule
+  that sets one on a container whose direction flips at a breakpoint needs
+  the opposite value in that breakpoint. And the shot script's per-row
+  heights found it in one run when three visual reviews had not: the polish
+  loop is `_shot.mjs` numbers first, picture second (`.design/board-v5/`,
+  local only).

package/docs/adapters.md

@@ -55,8 +55,11 @@ documentation say docs-only.
   `src/hook.mjs`.
 - **Why not the status line.** Leg writes a `statusLine` entry into the same
   settings file that would record `rate_limits.five_hour.used_percentage` and
-  `resets_at`, and chains your own `statusLine` command first. Claude Code
-  2.1.268 did not run it when it was tried on this machine: an `echo` command
+  `resets_at`, and runs your own `statusLine` command first, its rows above
+  Leg's one (since 0.15.1; before that your command was read and never run,
+  so a build that honours the key showed Leg's row instead of yours). Claude
+  Code 2.1.268 and 2.1.278 did not run it when it was tried on this machine
+  (2026-09-11, 2026-09-19): an `echo` command
   passed through `--settings` and again through a project
   `.claude/settings.local.json` left the built-in status line in place, while
   hooks from the same `--settings` file fired. No artifact of that check was

package/docs/board-guide.md

@@ -14,24 +14,23 @@ The visual system, and why it is what it is, is `DESIGN.md` at the repo root.
 ## Screenshots
 
 `docs/screenshots/` (listed here so you know what exists before you look for
-one). Nine were retaken on 2026-09-17 against this build, on a board seeded by
-`scripts/seed-wes-board.mjs` plus `scripts/seed-fake-cards.mjs --count 1
---finished 10 --live 3`; the rest are from the 2026-09-15 sweep and are noted
-below:
+one). Nine were retaken on 2026-09-19 against the polish pass (0.16.0), on a
+board seeded by `scripts/seed-wes-board.mjs`; the rest are from the 2026-09-17
+and 2026-09-15 sweeps and are noted below:
 
 ```
-terminals-1280.png        the whole board at 1280 px (2026-09-17)
-board-400px.png           the same board at 400 px (2026-09-17)
-capacity-drawer-1280.png  the strip with Capacity and models open (2026-09-17)
-board-details-open.png    a terminal row with its expansion open (2026-09-17)
-board-handoff.png         one row waiting on you, with the question (2026-09-17)
+terminals-1280.png        the whole board at 1280 px (2026-09-19)
+board-400px.png           the same board at 400 px (2026-09-19)
+capacity-drawer-1280.png  the strip with Capacity and models open (2026-09-19)
+board-details-open.png    a terminal row with its expansion open (2026-09-19)
+board-handoff.png         one row waiting on you, with the question (2026-09-19)
 background-1280.png       the Background panel and the one-line entry (2026-09-17)
-settings-ladder-1280.png  the ladder editor in Settings (2026-09-17)
-board-empty.png           no background tasks at all
+settings-ladder-1280.png  the ladder editor in Settings (2026-09-19)
+board-empty.png           the first-run panel: no terminal yet, three commands with Copy (2026-09-19)
 board-running.png         one card running its first agent (2026-09-17)
 board-drawer.png          that card expanded: where, runs, take over, timeline (2026-09-17)
 board-done.png            the card finished, on the agent that finished it
-floor.png                 /floor with nothing queued
+floor.png                 /floor with nothing queued, every station one line (2026-09-19)
 floor-landing.png         /floor with every lane full
 floor-final-1280.png      /floor after a card finished
 floor-final-400.png       the same at 400 px
@@ -42,18 +41,20 @@ demo-2-limit-hit.png       limit hit, bundle written, the row waiting on you
 demo-3-handoff-bundle.png  the row expanded: bundle path, run signal, timeline
 demo-4-codex-running.png   leg 2 running on fake-codex
 demo-5-done.png            done, both legs on the chain
+new-card-dialog.png        More settings: the task and who runs it (2026-09-19)
 ```
 
 The five `demo-*.png` are one run of the sequence in [DEMO.md](DEMO.md), all at
 1280 px.
 
-**Still stale, as of 2026-09-17:** `share-owner-1280.png`,
-`share-guest-1280.png`, `board-empty.png`, `board-done.png` and the five
-`demo-*.png` show the old top of the board (a 56px verdict over a column of
-login panels) rather than the capacity strip and its drawer, and the card shots
-among them predate the Background panel. Their terminal rows and their floor
-are still accurate. Retake them with the commands below rather than trusting
-the top band of any of those pictures.
+**Still stale, as of 2026-09-19:** `share-owner-1280.png`,
+`share-guest-1280.png`, `board-done.png`, `background-1280.png`,
+`board-running.png`, `board-drawer.png`, `floor-landing.png`, the two
+`floor-final-*.png` and the five `demo-*.png` predate the 0.16.0 polish pass:
+their rows still show the 2x2 button grid, coloured login words and the old
+mark, and the oldest of them show the pre-strip top of the board. What each
+one documents is still true. Retake them with the commands below rather than
+trusting the chrome in any of those pictures.
 
 To retake one, seed a board with the shape a real one has and drive it to the
 state the shot needs:
@@ -174,7 +175,7 @@ reset, the source, any wall and the age of the reading, the same sentence the
 gauges carry. A login with no percentage is not a `meter` at all, because
 `aria-valuenow` would have to be a number nobody measured.
 
-**`Capacity and models >`**, at the end of the strip, opens a drawer holding
+**`Capacity and models`**, the disclosure at the end of the strip, opens a drawer holding
 the login panels unchanged, plus a rail of model chips on each panel head:
 `fable 63%` for a measured bucket, `fable out until 9:14 PM` for a model at its
 wall, and a bare model name where Leg has a name but no figure. A percentage is
@@ -307,16 +308,18 @@ been at it, and what you can do about it.
   stops and fable continues from the bundle.`, or `from the conversation` when
   that rung is one a `--resume` keeps. Confirming posts the hand-off with the
   model on it; a rung that walled between the draw and the press comes back as
-  the server's own 409 sentence in the row. It is a link and not a fifth button:
-  the 2x2 grid is the shipped shape and does not reflow.
+  the server's own 409 sentence in the row. It is a link and not a fourth button:
+  the button row is the shipped shape and does not reflow.
 - **The clock**: elapsed since the session started (`4h 24m`), and the session's
   short id. The id used to print as `claude-7f3a` immediately after the word
   `claude`; the prefix is the agent name twice and it is gone.
-- **The buttons**, in a fixed 2x2 grid so every row's controls sit in the same
-  place: Land, Hand off now, Details, End. Land is the primary action only when
-  it can actually run, when it is blocked the accent moves to Hand off now,
-  because a disabled control should not wear the one accent colour in the
-  design. When Land is disabled its reason is printed, never left in a tooltip.
+- **The buttons**, one row under the clock at the right, so every row's
+  controls sit in the same place: Land, Hand off now, Details, End. Land is
+  drawn only when it can actually run, and then it is the one primary button
+  on the board; when it cannot, the row does not draw it and its reason is
+  printed once above the panel, never left in a tooltip. Hand off now, Details
+  and End are quiet controls: the accent means "this can land" and nothing
+  else.
 
 **A terminal waiting on a human says so, and the tab says it too.** Claude
 Code's Notification hook writes `waiting` on the record when it puts up a
@@ -417,7 +420,8 @@ one off.`, because two waiters on one terminal is the failure to avoid.
 ### Terminal buttons
 
 The order is fixed, Land, Hand off now, Details, End, and it never reflows by
-availability: a button that does not apply is omitted, never moved.
+availability: a button that does not apply is omitted, never moved. A Land that
+cannot run is omitted too, with its reason hoisted above the panel.
 
 | button | shown when | what it does |
 |--------|------------|--------------|
@@ -555,7 +559,7 @@ raised surface here would compete with the terminals that are live. Each is a
 heading, a line of detail and a button that opens the detail below the row.
 
 - **N finished**, the terminals that have ended or been lost, `4 lost, 2 ended,
-  in leg, costclaw, declick`. **View all N** opens them as full rows. On a real
+  in leg, costclaw, declick`. **View** opens them as full rows. On a real
   board after a day's work this is most of the list, which is exactly why it is a
   count and not the list.
 - **N landed**, what has landed on trunk across every repo the board can see,

package/docs/cli-contracts.md

@@ -246,10 +246,16 @@ variable and `LEG_SESSION` (source: src/attach.mjs, src/env.mjs).
 - Attach: `claude <args> -n "leg#<short id> <repo>/<branch>" --settings <LEG_HOME>/sessions/<id>/claude-settings.json`
   (source: src/attach.mjs `spawnSpec`; src/taps/claude.mjs `writeSettings`).
   Hooks in a `--settings` file merge with the user's rather than replacing
-  them; `statusLine` is the one key that replaces, so Leg runs the user's own
-  command first (source: code.claude.com/docs/en/settings;
-  src/taps/claude.mjs `userStatusLine`). observed-live 2026-09-11: a Leg
-  session ran with every user hook still firing.
+  them; `statusLine` is the one key that replaces, so Leg keeps the user's own
+  command on the session record (`user_statusline`) and its status-line hook
+  runs that command with the same stdin JSON, printing its rows above Leg's
+  one (source: code.claude.com/docs/en/settings, docs/en/statusline "Display
+  multiple lines"; src/taps/claude.mjs `userStatusLine`, `userStatusLineText`;
+  src/hook.mjs). Before 0.15.1 the user's command was read only for its
+  `padding` and never run, so a build that honours a `--settings` status line
+  showed Leg's row in place of the user's (reported by a baton user,
+  2026-09-19). observed-live 2026-09-11: a Leg session ran with every user
+  hook still firing.
 - Terminal title: `-n, --name <name>` "Set a display name for this session
   (shown in the prompt box, /resume picker, and terminal title)" —
   fixtures/help/claude.txt line 132. It sits in the general Options block, not
@@ -327,11 +333,13 @@ variable and `LEG_SESSION` (source: src/attach.mjs, src/env.mjs).
   path can also be run live with `leg sessions simulate-limit` (the same
   payload through `src/hook.mjs`, marked `leg_simulated`, never kept as
   evidence).
-- Status line, not usable on 2.1.268: a custom `statusLine` command passed
+- Status line, not usable on 2.1.268 or 2.1.278: a custom `statusLine` command passed
   through `--settings`, and again through a project
   `.claude/settings.local.json`, was not run at all when it was tried; an
   `echo` command at both levels left the built-in status line in place while
-  hooks from the same `--settings` file fired (no artifact kept; note in the
+  hooks from the same `--settings` file fired (probed again 2026-09-19 on
+  2.1.278 with a screenshot of two haiku sessions, not kept; 0 of 87 session
+  hook logs on this machine hold a statusline entry; note in the
   src/taps/claude-usage.mjs header, 2026-09-11). Leg still writes the
   `statusLine` entry, which records the
   same `rate_limits.five_hour` / `seven_day` fields

package/docs/faq.md

@@ -20,14 +20,15 @@ launch, and does not count as a usage limit.
 
 **Why does Leg poll an endpoint for claude's usage instead of reading the
 status line?**
-Because Claude Code 2.1.268 did not run a custom status line from a settings
-file Leg controls when this was tried on 2026-09-11 (recorded in
+Because Claude Code 2.1.268 and 2.1.278 did not run a custom status line from a settings
+file Leg controls when this was tried on 2026-09-11 and 2026-09-19 (recorded in
 [DEVIATIONS.md](DEVIATIONS.md)); hooks from the same `--settings` file did
 fire. So the numbers come from
 `GET api.anthropic.com/api/oauth/usage` with the login Claude Code already
 stored, which is the same data `/usage` shows. Leg still writes the
 `statusLine` entry, so the endpoint poll becomes a fallback the moment a build
-honours it, and your own status-line command is chained first either way. See
+honours it, and your own status-line command runs first, its rows above
+Leg's one, either way (since 0.15.1). See
 [adapters.md](adapters.md#claude) and `src/taps/claude-usage.mjs`.
 
 **Why does codex get no hook when claude does?**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ucsandman/legcli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Usage-limit monitor and automatic handoff for Claude Code, Codex, agy and Grok. Type leg claude|codex|agy|grok and get the same interactive agent with a board alongside, auto-approve on by default, usage tracking per agent and account, a live context handoff bundle, and at the limit the next agent continuing in the same terminal. 14-day free trial, then $79 once, 30-day money-back guarantee.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/scripts/npm-publish-gate.mjs

@@ -7,6 +7,7 @@
 import { appendFileSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { releaseSection } from './release-notes.mjs'
 
 const root = join(dirname(fileURLToPath(import.meta.url)), '..')
 const EXPECTED_REPOSITORY = 'https://github.com/ucsandman/legcli.git'
@@ -103,6 +104,9 @@ try {
   if (alias.repository?.url !== EXPECTED_REPOSITORY) {
     fail('alias package repository metadata does not match the npm trusted publisher binding')
   }
+  // The GitHub release ci.yml creates after the publish is this section, so a
+  // version nobody wrote up in CHANGELOG.md never reaches npm either.
+  releaseSection(readFileSync(join(root, 'CHANGELOG.md'), 'utf8'), pkg.version)
 
   const primaryPublished = await registryStatus(pkg.name, pkg.version)
   const aliasPublished = await registryStatus(alias.name, alias.version)

package/scripts/release-notes.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+// release-notes — the CHANGELOG.md section for one version, for the GitHub
+// release CI creates right after it publishes that version to npm.
+//
+//   node scripts/release-notes.mjs 0.15.1           the section body (no heading)
+//   node scripts/release-notes.mjs 0.15.1 --title   "Leg 0.15.1: <first sentence>"
+//
+// Exits 1 with a sentence when CHANGELOG.md has no `## <version> (` heading, so
+// the publish gate refuses a version nobody wrote up.
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+export function releaseSection(changelog, version) {
+  const lines = changelog.split(/\r?\n/)
+  const heading = new RegExp(`^## ${version.replace(/\./g, '\\.')}(\\s|$)`)
+  const start = lines.findIndex((l) => heading.test(l))
+  if (start === -1) throw new Error(`CHANGELOG.md has no "## ${version}" section; write the release up before publishing it`)
+  let end = lines.findIndex((l, i) => i > start && /^## /.test(l))
+  if (end === -1) end = lines.length
+  const body = lines.slice(start + 1, end).join('\n').trim()
+  if (!body) throw new Error(`CHANGELOG.md's "## ${version}" section is empty`)
+  return body
+}
+
+// "Leg <version>: <the section's first sentence, one line, no trailing stop>",
+// capped so the release list stays readable. Older sections open with a
+// bullet instead of a summary paragraph; the bullet's first sentence serves.
+export function releaseTitle(changelog, version, { product = 'Leg', max = 100 } = {}) {
+  const body = releaseSection(changelog, version)
+  const paragraph = body.split(/\n\s*\n/)[0].replace(/^[-*]\s+/, '').replace(/\*\*|`/g, '').replace(/\s+/g, ' ').trim()
+  const first = (paragraph.match(/^.*?[.!?](?=\s|$)/) ?? [paragraph])[0].replace(/[.!?:;,]$/, '')
+  let title = `${product} ${version}: ${first}`
+  if (title.length > max) title = title.slice(0, max - 1).replace(/\s+\S*$/, '') + '…'
+  return title
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const args = process.argv.slice(2)
+  const version = args.find((a) => !a.startsWith('--'))
+  if (!version) { console.error('usage: node scripts/release-notes.mjs <version> [--title]'); process.exit(2) }
+  try {
+    const changelog = readFileSync(join(root, 'CHANGELOG.md'), 'utf8')
+    process.stdout.write((args.includes('--title') ? releaseTitle(changelog, version) : releaseSection(changelog, version)) + '\n')
+  } catch (e) {
+    console.error(e.message)
+    process.exit(1)
+  }
+}