@ucsandman/legcli 0.7.0 → 0.9.0

package/src/launcher.mjs

@@ -16,7 +16,19 @@ import { schedulerStatus, MAX_CONCURRENT } from './scheduler.mjs'
 import { enabledSyncs } from './sync/index.mjs'
 
 const SRC = dirname(fileURLToPath(import.meta.url))
-const SERVER = process.env.LEG_SERVER_SCRIPT || process.env.BATON_SERVER_SCRIPT || join(SRC, 'server.mjs')
+function resolveServer() {
+  if (process.env.LEG_SERVER_SCRIPT || process.env.BATON_SERVER_SCRIPT) {
+    return process.env.LEG_SERVER_SCRIPT || process.env.BATON_SERVER_SCRIPT
+  }
+  const wtMatch = /[\\/]\.(?:leg|baton)-worktrees(?:[\\/].*)?$/.exec(SRC)
+  if (wtMatch) {
+    const root = SRC.slice(0, wtMatch.index)
+    const mainServer = join(root, 'src', 'server.mjs')
+    if (existsSync(mainServer)) return mainServer
+  }
+  return join(SRC, 'server.mjs')
+}
+const SERVER = resolveServer()
 const VERSION = JSON.parse(readFileSync(join(SRC, '..', 'package.json'), 'utf8')).version
 const HEALTH_TIMEOUT_MS = Number(process.env.LEG_HEALTH_TIMEOUT_MS || process.env.BATON_HEALTH_TIMEOUT_MS || 20000)
 
@@ -46,6 +58,7 @@ const INSTALL_HINT = {
   claude: 'https://claude.com/claude-code (then `claude` to log in)',
   codex: 'npm i -g @openai/codex (then `codex login`)',
   agy: 'Antigravity CLI (`agy`), log in once interactively',
+  grok: 'xAI Grok CLI (`grok`), log in once via `grok login`',
 }
 
 // Rows: [name, status, detail]. Nothing here is fatal except "no adapter at all".
@@ -62,7 +75,7 @@ export async function preflight() {
     const v = viaNode ? version(process.execPath, [entry, '--version']) : version(bin)
     if (v) { present += 1; rows.push([name, 'ok', `${v} (${viaNode ? entry : bin})`]) } else rows.push([name, 'missing', INSTALL_HINT[name] ?? 'not on PATH'])
   }
-  rows.push(['fake adapters', 'ok', 'fake, fake-claude, fake-codex, fake-agy (tests and demo)'])
+  rows.push(['fake adapters', 'ok', 'fake, fake-claude, fake-codex, fake-agy, fake-grok (tests and demo)'])
   return { rows, adapters_present: present }
 }
 
@@ -73,13 +86,13 @@ export function printPreflight({ rows }) {
 
 export function plannedProcesses({ port = Number(process.env.LEG_PORT || process.env.BATON_PORT || 4747), bind = process.env.LEG_BIND || process.env.BATON_BIND || '127.0.0.1' } = {}) {
   const procs = [{
-    prefix: 'server', bin: process.execPath, argv: [SERVER], env: { BATON_PORT: String(port), BATON_BIND: bind },
+    prefix: 'server', bin: process.execPath, argv: [SERVER], env: { LEG_PORT: String(port), LEG_BIND: bind, BATON_PORT: String(port), BATON_BIND: bind },
     note: 'board + API + scheduler + merge queue',
   }]
   const on = enabledSyncs()
   const syncs = [
-    { prefix: 'sync:workboard', enabled: on.includes('workboard'), note: 'OpenClaw Workboard mirror (BATON_SYNC_WORKBOARD=1); runs inside the ledger, no extra process' },
-    { prefix: 'sync:dashclaw', enabled: on.includes('dashclaw'), note: 'DashClaw action recording (BATON_SYNC_DASHCLAW=1 + DASHCLAW_URL + DASHCLAW_API_KEY); runs inside the ledger' },
+    { prefix: 'sync:workboard', enabled: on.includes('workboard'), note: 'OpenClaw Workboard mirror (LEG_SYNC_WORKBOARD=1); runs inside the ledger, no extra process' },
+    { prefix: 'sync:dashclaw', enabled: on.includes('dashclaw'), note: 'DashClaw action recording (LEG_SYNC_DASHCLAW=1 + DASHCLAW_URL + DASHCLAW_API_KEY); runs inside the ledger' },
   ]
   return { procs, syncs }
 }
@@ -159,21 +172,21 @@ function killActiveAgents() {
 }
 
 export async function up({ dry = false, open = true, port = Number(process.env.LEG_PORT || process.env.BATON_PORT || 4747), bind = process.env.LEG_BIND || process.env.BATON_BIND || '127.0.0.1' } = {}) {
-  out('baton', `baton ${VERSION} — home ${home()}`)
+  out('leg', `leg ${VERSION} — home ${home()}`)
   const pf = await preflight()
   printPreflight(pf)
-  if (pf.adapters_present === 0) out('baton', 'no real coding-agent CLI found; fake adapters still work for the demo', process.stderr)
+  if (pf.adapters_present === 0) out('leg', 'no real coding-agent CLI found; fake adapters still work for the demo', process.stderr)
   const plan = plannedProcesses({ port, bind })
-  for (const s of plan.syncs) out('baton', `${s.prefix}: ${s.enabled ? 'on' : 'off'} (${s.note})`)
+  for (const s of plan.syncs) out('leg', `${s.prefix}: ${s.enabled ? 'on' : 'off'} (${s.note})`)
   if (dry) {
-    out('baton', 'dry run: nothing spawned. Would run:')
-    for (const p of plan.procs) out('baton', `${p.prefix}: ${JSON.stringify([p.bin, ...p.argv])} env ${JSON.stringify(p.env)}`)
-    out('baton', `then poll http://${bind}:${port}/api/health, ${open ? 'open the board' : 'not open the board'}, write ${pidfile()}`)
+    out('leg', 'dry run: nothing spawned. Would run:')
+    for (const p of plan.procs) out('leg', `${p.prefix}: ${JSON.stringify([p.bin, ...p.argv])} env ${JSON.stringify(p.env)}`)
+    out('leg', `then poll http://${bind}:${port}/api/health, ${open ? 'open the board' : 'not open the board'}, write ${pidfile()}`)
     return 0
   }
   const existing = readPidfile()
   if (existing && existing.pid !== process.pid && await boardAlive(existing)) {
-    out('baton', `already running (pid ${existing.pid}, port ${existing.port}); use \`baton down\` first`, process.stderr)
+    out('leg', `already running (pid ${existing.pid}, port ${existing.port}); use \`leg down\` first`, process.stderr)
     return 1
   }
   if (existing) { try { rmSync(pidfile(), { force: true }) } catch {} }
@@ -196,34 +209,34 @@ export async function up({ dry = false, open = true, port = Number(process.env.L
     await new Promise((r) => setTimeout(r, 250))
   }
   if (!ok) {
-    out('baton', `server not healthy after ${Math.round((Date.now() - t0) / 1000)} s${exited !== null ? ` (exited ${exited})` : ''}; last lines:`, process.stderr)
+    out('leg', `server not healthy after ${Math.round((Date.now() - t0) / 1000)} s${exited !== null ? ` (exited ${exited})` : ''}; last lines:`, process.stderr)
     for (const l of lastLines) out(p.prefix, l, process.stderr)
     killTree(child.pid)
     return 1
   }
   const url = `http://${bind === '0.0.0.0' ? '127.0.0.1' : bind}:${actualPort}`
   writeFileSync(pidfile(), JSON.stringify({ pid: process.pid, port: actualPort, bind, children: [child.pid], started_at: new Date().toISOString() }, null, 2) + '\n')
-  out('baton', `ready ${url}  (scheduler max ${MAX_CONCURRENT}, ${ok.cards} card${ok.cards === 1 ? '' : 's'})`)
-  if (open) out('baton', openBoard(url) ? `opened ${url}` : `could not open a browser; visit ${url}`)
-  out('baton', 'Ctrl-C stops everything')
+  out('leg', `ready ${url}  (scheduler max ${MAX_CONCURRENT}, ${ok.cards} card${ok.cards === 1 ? '' : 's'})`)
+  if (open) out('leg', openBoard(url) ? `opened ${url}` : `could not open a browser; visit ${url}`)
+  out('leg', 'Ctrl-C stops everything')
 
   return await new Promise((resolvePromise) => {
     let stopping = false
     const stop = (why) => {
       if (stopping) return
       stopping = true
-      out('baton', `stopping (${why})`)
+      out('leg', `stopping (${why})`)
       const agents = killActiveAgents()
-      if (agents) out('baton', `killed ${agents} running agent/supervisor process(es)`)
+      if (agents) out('leg', `killed ${agents} running agent/supervisor process(es)`)
       killTree(child.pid)
       try { rmSync(pidfile(), { force: true }) } catch {}
-      out('baton', 'stopped')
+      out('leg', 'stopped')
       resolvePromise(0)
     }
     process.on('SIGINT', () => stop('SIGINT'))
     process.on('SIGTERM', () => stop('SIGTERM'))
     process.on('SIGBREAK', () => stop('SIGBREAK'))
-    child.on('exit', (code) => { if (!stopping) { out('baton', `server exited ${code}`, process.stderr); try { rmSync(pidfile(), { force: true }) } catch {} resolvePromise(code === 0 ? 0 : 1) } })
+    child.on('exit', (code) => { if (!stopping) { out('leg', `server exited ${code}`, process.stderr); try { rmSync(pidfile(), { force: true }) } catch {} resolvePromise(code === 0 ? 0 : 1) } })
   })
 }
 
@@ -240,10 +253,10 @@ export async function stopBoard() {
 
 export async function down() {
   const pf = readPidfile()
-  if (!pf) { out('baton', 'not running'); return 0 }
+  if (!pf) { out('leg', 'not running'); return 0 }
   const agents = killActiveAgents()
   const board = await stopBoard()
-  out('baton', `stopped (pid ${pf.pid}, port ${pf.port}${agents ? `, ${agents} agent process(es) killed` : ''}${board.stale ? ', stale pidfile' : ''})`)
+  out('leg', `stopped (pid ${pf.pid}, port ${pf.port}${agents ? `, ${agents} agent process(es) killed` : ''}${board.stale ? ', stale pidfile' : ''})`)
   return 0
 }
 
@@ -255,14 +268,14 @@ export async function status() {
   const by = (key) => Object.entries(cards.reduce((m, c) => { m[c[key]] = (m[c[key]] ?? 0) + 1; return m }, {})).map(([k, v]) => `${k}=${v}`).join(' ') || '(none)'
   if (running) {
     const up = Math.round((Date.now() - Date.parse(pf.started_at)) / 1000)
-    out('baton', `running  pid ${pf.pid}  port ${pf.port}  up ${Math.floor(up / 60)}m${up % 60}s  http://127.0.0.1:${pf.port}`)
+    out('leg', `running  pid ${pf.pid}  port ${pf.port}  up ${Math.floor(up / 60)}m${up % 60}s  http://127.0.0.1:${pf.port}`)
   } else {
-    out('baton', pf ? `stopped (pid ${pf.pid} is not answering on port ${pf.port}; cleared the stale pidfile)` : 'stopped')
+    out('leg', pf ? `stopped (pid ${pf.pid} is not answering on port ${pf.port}; cleared the stale pidfile)` : 'stopped')
   }
   const s = schedulerStatus()
-  out('baton', `scheduler ${s.running ? `running (pid ${s.pid})` : 'stopped'}  max concurrent ${MAX_CONCURRENT}`)
-  out('baton', `cards ${cards.length}  by status: ${by('status')}`)
-  out('baton', `by station: ${by('station')}`)
+  out('leg', `scheduler ${s.running ? `running (pid ${s.pid})` : 'stopped'}  max concurrent ${MAX_CONCURRENT}`)
+  out('leg', `cards ${cards.length}  by status: ${by('status')}`)
+  out('leg', `by station: ${by('station')}`)
   return running ? 0 : 3
 }
 

package/src/ledger.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Ported 2026-09-10 from private ucsandman team tooling; see NOTICE and docs/REUSE.md.
-// ledger — the ONLY writer of Baton's card ledger files under $BATON_HOME/cards/<id>/.
+// ledger — the ONLY writer of Leg's card ledger files under $LEG_HOME/cards/<id>/.
 // Subcommands: create | append | update | sync. Every event carries a validated
 // actor, the card id, the station and the leg, and lands in that actor's own
 // events-<actor-key>.jsonl. Importable: readEvents, parseActor, actorKey.
@@ -17,16 +17,16 @@ export const EVENT_TYPES = ['card_created', 'leg_started', 'leg_progress', 'leg_
   'limit_detected', 'handoff_written', 'leg_resumed', 'station_done', 'bounced', 'landed',
   'land_warning', 'land_retry', 'blocked_by', 'scheduler_started', 'scheduler_stopped',
   'approval_needed', 'approved', 'reassigned', 'paused', 'resumed', 'killed', 'done',
-  'failed', 'error', 'status']
+  'failed', 'error', 'status', 'harness', 'harness_blocked']
 export const STATUSES = ['backlog', 'queued', 'running', 'handing_off', 'waiting_human',
   'needs_approval', 'paused', 'done', 'failed', 'killed']
 const CLOSED = ['done', 'failed', 'killed']
 // card.json keys `update --patch` may set (everything else goes through a named flag)
 export const PATCHABLE = ['pipeline', 'leases', 'land_attempts', 'land_mode', 'test_command', 'title', 'trunk',
-  'bounce_reason', 'kill_requested', 'worktree', 'next_leg', 'handoff_outcome', 'resume_from_bundle', 'failure', 'last_bundle', 'pr_url']
+  'bounce_reason', 'kill_requested', 'worktree', 'next_leg', 'handoff_outcome', 'resume_from_bundle', 'failure', 'last_bundle', 'pr_url', 'harness']
 const NAME_RE = /^[a-z0-9][a-z0-9._-]{0,39}$/i
 
-export const ROOT = process.env.BATON_HOME || join(homedir(), '.baton')
+export const ROOT = process.env.LEG_HOME || process.env.BATON_HOME || (existsSync(join(homedir(), '.leg')) ? join(homedir(), '.leg') : existsSync(join(homedir(), '.baton')) ? join(homedir(), '.baton') : join(homedir(), '.leg'))
 
 function die(code, msg) {
   process.stderr.write(msg + '\n')
@@ -53,7 +53,7 @@ function need(args, key, allowed) {
   return v
 }
 
-// Actor: who wrote the event. {type:'agent', adapter, model?} | {type:'human', id} | {type:'baton'}.
+// Actor: who wrote the event. {type:'agent', adapter, model?} | {type:'human', id} | {type:'leg'} | {type:'baton'} (legacy).
 // Returns the normalized actor or null when the shape is wrong.
 export function parseActor(raw) {
   let a = raw
@@ -156,7 +156,7 @@ async function syncNotify(kind, ev, card) {
       kind, ev, card, home: ROOT,
       report: (summary) => {
         if (!id) return
-        appendEvent(id, { ts: now(), card_id: id, actor: { type: 'baton' }, station: card?.station ?? '-', leg: card?.leg ?? 0, type: 'status', summary })
+        appendEvent(id, { ts: now(), card_id: id, actor: { type: 'leg' }, station: card?.station ?? '-', leg: card?.leg ?? 0, type: 'status', summary })
       },
     })
   } catch {}

package/src/license.mjs

@@ -1,34 +1,35 @@
 // license — the paid-product gate. A license key is a signed, self-contained
-// token that Baton checks offline with the public key embedded below; the
+// token that Leg checks offline with the public key embedded below; the
 // private key never leaves the seller's machine. Two plans:
 //
 //   personal  one-time purchase; every release dated on or before the key's
 //             updates_until activates, later releases refuse the key but the
 //             installed one keeps working (the Sublime Text shape)
 //   team      per-seat subscription; the key carries an expiry a few days past
-//             the billing period, `baton license refresh` fetches a renewed one
+//             the billing period, `leg license refresh` fetches a renewed one
 //
-// There is no trial. Baton pays off in the moment a limit lands mid-flow, which
+// There is no trial. Leg pays off in the moment a limit lands mid-flow, which
 // is not a thing a fortnight of evaluation reliably contains; the risk reversal
 // is a 30-day money-back guarantee instead, which costs no code and no expiry
-// machinery. Key shape: BATON-<base64url payload>.<base64url signature> where
-// the signature is Ed25519 over the payload bytes exactly as encoded.
+// machinery. Key shape: LEG-<base64url payload>.<base64url signature> (legacy
+// BATON- prefix still accepted) where the signature is Ed25519 over the payload
+// bytes exactly as encoded.
 import { createPublicKey, createPrivateKey, verify as cryptoVerify, sign as cryptoSign, createHash } from 'node:crypto'
 import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, chmodSync } from 'node:fs'
 import { join } from 'node:path'
 import { home } from './store.mjs'
 
 export const PUBLIC_KEY_B64 = 'MCowBQYDK2VwAyEAIpVQymHHJAkIrZHv0u4o0bgfFmtW3Crm7uMwYHP53X8='
-// The suite has to exercise the gate itself — `baton share on` refusing a
-// Personal key, `baton <agent>` refusing nothing at all — and it cannot sign a
+// The suite has to exercise the gate itself — `leg share on` refusing a
+// Personal key, `leg <agent>` refusing nothing at all — and it cannot sign a
 // key for the real public key, which is the point of the real public key. This
 // env seam lets a spawned CLI verify against a throwaway pair. It weakens
-// nothing: Baton ships as readable JavaScript, so anyone who would set this
+// nothing: Leg ships as readable JavaScript, so anyone who would set this
 // could edit the constant above instead.
 const ACTIVE_PUBLIC_KEY = process.env.LEG_PUBLIC_KEY_B64 || process.env.BATON_PUBLIC_KEY_B64 || PUBLIC_KEY_B64
 // The date this release was cut. A personal key activates when this is on or
 // before its updates_until. Bumped with every published version.
-export const RELEASE_DATE = '2026-09-15'
+export const RELEASE_DATE = '2026-09-16'
 export const GUARANTEE_DAYS = 30
 export const SITE = process.env.LEG_SITE || process.env.BATON_SITE || 'https://legcli.com'
 export const BUY_URL = `${SITE}/#pricing`

package/src/live-capture.mjs

@@ -3,7 +3,7 @@
 // keep the payload with secrets scrubbed, so the docs rows that say
 // "docs-only" can become "observed-live" with evidence. One file per
 // (agent, signal); a later arrival never overwrites the first. A payload a
-// `baton sessions simulate-limit` produced is marked and never captured.
+// `leg sessions simulate-limit` produced is marked and never captured.
 // Where: BATON_LIVE_DIR, else this checkout's fixtures/live/ when it exists
 // (a dev clone), else <BATON_HOME>/live/. In a dev clone the matching docs
 // rows are flipped in the same call (scripts/live-limits.mjs).

package/src/mergequeue.mjs

@@ -1,6 +1,6 @@
 // mergequeue — the land station. One land at a time per repo root, FIFO: the
 // queue key is the canonical root (two spellings of one path are one queue) and
-// the turn itself is a file lock under BATON_HOME, so a `baton card run` CLI
+// the turn itself is a file lock under LEG_HOME, so a `leg card run` CLI
 // and the board server cannot land into one checkout at the same time.
 // land(card, worktree):
 //   1. root must be on <trunk> and clean, else bounce `dirty-trunk` (root untouched)
@@ -57,7 +57,7 @@ export function rootState(repo, trunk) {
 }
 
 // Commit the agents' work so the branch can be rebased and merged. The commit
-// skips git hooks (--no-verify): the repo's test command is Baton's gate, and
+// skips git hooks (--no-verify): the repo's test command is Leg's gate, and
 // interactive commit hooks (linters, wire-dark style checks) belong to humans
 // typing commits. BATON_COMMIT_VERIFY=1 runs them anyway.
 export function commitWorktree(worktree, message) {
@@ -65,7 +65,7 @@ export function commitWorktree(worktree, message) {
   if (!dirty.length) return { committed: false }
   git(worktree, ['add', '-A'])
   const verify = (process.env.LEG_COMMIT_VERIFY || process.env.BATON_COMMIT_VERIFY) === '1' ? [] : ['--no-verify']
-  git(worktree, ['-c', 'user.email=baton@localhost', '-c', 'user.name=baton', 'commit', '-q', ...verify, '-m', message])
+  git(worktree, ['-c', 'user.email=leg@localhost', '-c', 'user.name=leg', 'commit', '-q', ...verify, '-m', message])
   return { committed: true, files: dirty.length }
 }
 
@@ -82,7 +82,7 @@ export function resolveTestCommand(card, worktree) {
   return { command: null, source: 'none' }
 }
 
-function runTests(command, worktree) {
+export function runTests(command, worktree) {
   return runCommandAsync(command, worktree, { timeoutMs: TEST_TIMEOUT_MS, tailLines: 40 })
 }
 
@@ -147,7 +147,7 @@ async function landNow(card, worktree, { onWarning = () => {}, allowDirtyRoot =
   if (checkedOut !== branch) return bounce('worktree-branch', `worktree is on ${checkedOut}, not ${branch}; switch it back before landing`)
 
   const busy = operationInProgress(worktree)
-  if (busy) return bounce('worktree-busy', `a ${busy.replace(/-/g, ' ')} is already in progress in ${worktree}; finish or abort it there before landing (Baton will not touch a rebase it did not start)`)
+  if (busy) return bounce('worktree-busy', `a ${busy.replace(/-/g, ' ')} is already in progress in ${worktree}; finish or abort it there before landing (Leg will not touch a rebase it did not start)`)
 
   const root = rootState(repo, trunk)
   if (!root.onTrunk) return bounce('dirty-trunk', `repo root is on ${root.branch}, not ${trunk}; check out ${trunk} and retry`)
@@ -155,7 +155,7 @@ async function landNow(card, worktree, { onWarning = () => {}, allowDirtyRoot =
   // nature; git's own fast-forward still refuses to overwrite a local change
   if (root.dirty.length && !allowDirtyRoot) return bounce('dirty-trunk', `repo root has ${root.dirty.length} uncommitted change(s): ${root.dirty.slice(0, 10).join(', ')}`)
 
-  const committed = commitWorktree(worktree, `baton: ${card.title ?? card.card_id}`)
+  const committed = commitWorktree(worktree, `leg: ${card.title ?? card.card_id}`)
   const preSha = git(worktree, ['rev-parse', 'HEAD']).stdout.trim()
   const trunkBefore = trunkHead(repo)
 

package/src/orchestrator.mjs

@@ -18,6 +18,7 @@ import {
   RUNNER, BATON_ACTOR, readCard, ledgerAppend, ledgerUpdate, cardDir, sleep,
 } from './store.mjs'
 import { scrub, updateRun } from './runner.mjs'
+import { prepareHarnessForHandoff, harnessLine } from './harness/index.mjs'
 import * as agentStation from './stations/agent.mjs'
 import * as testStation from './stations/test.mjs'
 import * as humanStation from './stations/human.mjs'
@@ -26,13 +27,16 @@ import * as humanStation from './stations/human.mjs'
 // the merge queue). Each handler gets the orchestrator's helpers as `ops`.
 const KIND_HANDLERS = { agent: agentStation, test: testStation, human: humanStation }
 
-const POLL_MS = Number(process.env.BATON_POLL_MS || 2000)
+const POLL_MS = Number(process.env.LEG_POLL_MS || process.env.BATON_POLL_MS || 2000)
 const WAITING = ['done', 'failed', 'killed', 'paused', 'waiting_human', 'needs_approval']
 // Patchable card keys the chain machine may change; everything else is a
 // named ledger flag.
 const PATCH_KEYS = ['pipeline', 'leases', 'land_attempts', 'bounce_reason', 'kill_requested', 'next_leg', 'handoff_outcome', 'resume_from_bundle', 'failure', 'pr_url']
 
-const log = (msg) => { if (process.env.BATON_QUIET !== '1') process.stderr.write(`[baton] ${msg}\n`) }
+const log = (msg) => {
+  const quiet = (process.env.LEG_QUIET === '0' || process.env.BATON_QUIET === '0') ? false : (process.env.LEG_QUIET === '1' || process.env.BATON_QUIET === '1')
+  if (!quiet) process.stderr.write(`[leg] ${msg}\n`)
+}
 
 // Persist a chain transition: card fields via ledger update, events via append.
 export function apply(id, before, result, actor = BATON_ACTOR) {
@@ -70,7 +74,7 @@ function latestRun(id) {
 }
 
 // A run whose verdict no orchestrator has consumed: the latest run has no
-// settled_at. Happens after `baton down` (agents killed, the supervisor wrote
+// settled_at. Happens after `leg down` (agents killed, the supervisor wrote
 // its verdict, the server that would apply it was already gone) or a crashed
 // server. runCard re-attaches to it instead of launching a fresh leg.
 export function unsettledRun(id) {
@@ -176,7 +180,7 @@ async function waitForRun(id, n, { pollMs = POLL_MS } = {}) {
 function changedFiles(worktree) {
   const r = spawnSync('git', ['status', '--porcelain'], { cwd: worktree, windowsHide: true, encoding: 'utf8', env: { ...process.env, MSYS_NO_PATHCONV: '1' } })
   if (r.status !== 0) return []
-  return r.stdout.split(/\r?\n/).filter(Boolean).map((l) => l.slice(3).trim()).filter((f) => f && !f.startsWith('.baton'))
+  return r.stdout.split(/\r?\n/).filter(Boolean).map((l) => l.slice(3).trim()).filter((f) => f && !f.startsWith('.baton') && !f.startsWith('.leg'))
 }
 
 function diffStat(worktree) {
@@ -197,6 +201,26 @@ async function runLeg(card, station, worktree) {
   const prompt = legPrompt({ contractText, resumeText })
   const promptFile = join(cardDir(card.card_id), `prompt-${station.name}-leg${card.leg}.txt`)
   writeFileSync(promptFile, prompt)
+  // The portable harness for the adapter about to run (src/harness/index.mjs):
+  // nothing when the feature is off; otherwise the card keeps the outcome and
+  // the ledger says what transferred. Under the strict policy a destination
+  // that cannot be made safe is not launched: the leg fails as launch_failed,
+  // which never advances the chain, and a human fixes it and reruns.
+  const previous = card.leg > 0 ? station.chain[card.leg - 1]?.adapter ?? null : null
+  let harness
+  try { harness = prepareHarnessForHandoff({ from: previous, to: entry.adapter, sessionId: card.card_id }) } catch (err) { harness = { state: 'error', proceed: true, to: entry.adapter, reason: String(err.message).slice(0, 200), summary: `harness error: ${String(err.message).slice(0, 120)}` } }
+  if (harness.state !== 'off') {
+    // the card keeps the verdict; the full record (components, dropped items,
+    // files, backups) is in $LEG_HOME/harness/history.jsonl, and the ledger's
+    // argv is not the place for it
+    const { state, target, source = null, policy, fingerprint = null, captured_at = null, synced_at = null, summary = null, proceed, reason = null } = harness
+    ledgerUpdate(card.card_id, { patch: { harness: { state, target, source, policy, fingerprint, captured_at, synced_at, summary, proceed, reason, dropped: harness.dropped?.length ?? 0, attention: harness.attention?.length ?? 0 } } })
+    const line = harnessLine(harness)
+    // the ledger refuses a line that looks like a secret by exiting; evidence
+    // about the harness must never be what fails a leg
+    if (line) { try { ledgerAppend(card.card_id, { type: harness.proceed ? 'harness' : 'harness_blocked', station: station.name, leg: card.leg, summary: line, body: [...(harness.attention ?? []).map((a) => `attention ${a.component}: ${a.reason}`), ...(harness.dropped ?? []).map((d) => `dropped ${d.component}: ${d.item}: ${d.reason}`)].join('\n') || undefined }) } catch (err) { log(`harness event not recorded: ${scrub(String(err.message)).slice(0, 160)}`) } }
+    if (!harness.proceed) return { status: 'failed', outcome: 'launch_failed', handoff: true, signal: 'none', reason: `strict harness policy refused ${entry.adapter}: ${harness.reason ?? harness.state}`, run: null, exit_code: null }
+  }
   const args = ['launch', '--card', card.card_id, '--adapter', entry.adapter, '--prompt-file', promptFile, '--cwd', worktree, '--driver-pid', String(process.pid)]
   if (entry.mode) args.push('--mode', entry.mode)
   if (entry.maxTurns) args.push('--max-turns', String(entry.maxTurns))

package/src/preferences.mjs

@@ -1,4 +1,4 @@
-// Machine-wide defaults for interactive Baton terminals. A new terminal takes
+// Machine-wide defaults for interactive Leg terminals. A new terminal takes
 // a copy of these preferences when it starts; later edits do not silently
 // change terminals that are already running.
 import { existsSync, mkdirSync, readFileSync } from 'node:fs'
@@ -7,11 +7,15 @@ import { home } from './store.mjs'
 import { writeJsonAtomic, withFileLock } from './fsx.mjs'
 
 export const HANDOFF_AGENTS = ['claude', 'codex', 'agy']
+export const ALL_HANDOFF_AGENTS = ['claude', 'codex', 'agy', 'grok']
 
 export function validHandoffOrder(value) {
-  return Array.isArray(value) && value.length === HANDOFF_AGENTS.length &&
-    new Set(value).size === HANDOFF_AGENTS.length &&
-    value.every((agent) => HANDOFF_AGENTS.includes(agent))
+  if (!Array.isArray(value)) return false
+  const set = new Set(value)
+  if (set.size !== value.length) return false
+  if (value.length === 3 && ['claude', 'codex', 'agy'].every((a) => set.has(a))) return true
+  if (value.length === 4 && ['claude', 'codex', 'agy', 'grok'].every((a) => set.has(a))) return true
+  return false
 }
 
 export function normalizeHandoffOrder(value) {
@@ -23,24 +27,74 @@ export function requireHandoffOrder(value) {
   return [...value]
 }
 
+// Portable harness (src/harness/): off for every existing install. `enabled`
+// is the explicit consent `leg harness enable` records; `policy` is what an
+// unattended hand-off may do (warn: report only; sync: write managed state
+// when it is safe; strict: refuse a destination that cannot be made safe);
+// `source` is the client whose harness is the one being carried.
+export const HARNESS_POLICIES = ['warn', 'sync', 'strict']
+export const HARNESS_SOURCES = ['claude', 'codex']
+export const HARNESS_DEFAULTS = Object.freeze({ enabled: false, policy: 'warn', source: null })
+
+export function normalizeHarness(value) {
+  const v = value && typeof value === 'object' ? value : {}
+  return {
+    enabled: v.enabled === true,
+    policy: HARNESS_POLICIES.includes(v.policy) ? v.policy : HARNESS_DEFAULTS.policy,
+    source: HARNESS_SOURCES.includes(v.source) ? v.source : null,
+  }
+}
+
+export function requireHarness(patch, current = HARNESS_DEFAULTS) {
+  const next = { ...normalizeHarness(current) }
+  if (patch?.enabled !== undefined) next.enabled = Boolean(patch.enabled)
+  if (patch?.policy !== undefined) {
+    if (!HARNESS_POLICIES.includes(patch.policy)) throw new TypeError(`harness policy must be one of ${HARNESS_POLICIES.join(', ')}`)
+    next.policy = patch.policy
+  }
+  if (patch?.source !== undefined) {
+    if (patch.source !== null && !HARNESS_SOURCES.includes(patch.source)) throw new TypeError(`harness source must be one of ${HARNESS_SOURCES.join(', ')}`)
+    next.source = patch.source
+  }
+  return next
+}
+
 export function preferencesFile() { return join(home(), 'preferences.json') }
 
+export function resolveAutoApprove({ env = process.env, preferences = null, cliFlag = null } = {}) {
+  if (cliFlag !== null && cliFlag !== undefined) return Boolean(cliFlag)
+  const envVal = env.LEG_AUTO_APPROVE ?? env.BATON_AUTO_APPROVE
+  if (envVal !== undefined) return envVal !== '0' && envVal !== 'false' && envVal !== 'off'
+  if ((env.LEG_NO_AUTO_APPROVE ?? env.BATON_NO_AUTO_APPROVE) === '1') return false
+  const prefs = preferences ?? readPreferences()
+  if (typeof prefs?.auto_approve === 'boolean') return prefs.auto_approve
+  return true
+}
+
 export function readPreferences() {
   const file = preferencesFile()
-  if (!existsSync(file)) return { handoff_order: [...HANDOFF_AGENTS] }
+  if (!existsSync(file)) return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true, harness: { ...HARNESS_DEFAULTS } }
   try {
     const value = JSON.parse(readFileSync(file, 'utf8'))
-    return { handoff_order: normalizeHandoffOrder(value?.handoff_order) }
+    return {
+      handoff_order: normalizeHandoffOrder(value?.handoff_order),
+      auto_approve: value?.auto_approve !== false,
+      harness: normalizeHarness(value?.harness),
+    }
   } catch {
-    return { handoff_order: [...HANDOFF_AGENTS] }
+    return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true, harness: { ...HARNESS_DEFAULTS } }
   }
 }
 
 export function writePreferences(patch) {
-  const order = requireHandoffOrder(patch?.handoff_order)
+  const order = patch?.handoff_order !== undefined ? requireHandoffOrder(patch?.handoff_order) : undefined
   mkdirSync(home(), { recursive: true })
   return withFileLock(preferencesFile() + '.lock', () => {
-    const next = { ...readPreferences(), handoff_order: order }
+    const current = readPreferences()
+    const next = { ...current }
+    if (order !== undefined) next.handoff_order = order
+    if (patch?.auto_approve !== undefined) next.auto_approve = Boolean(patch.auto_approve)
+    if (patch?.harness !== undefined) next.harness = requireHarness(patch.harness, current.harness)
     writeJsonAtomic(preferencesFile(), next)
     return next
   })

package/src/redact.mjs

@@ -1,6 +1,6 @@
 // redact — the one list of secret shapes. `scrub()` rewrites (logs, bundles,
 // launcher output); the ledger's assertNoSecrets refuses (src/ledger.mjs).
-// The source tooling kept two copies on purpose; Baton keeps one here.
+// The source tooling kept two copies on purpose; Leg keeps one here.
 // Values the launcher's own process holds for the well-known key variables
 // are read once at startup and never printed.
 // Every prefix shape starts at a token boundary: the `sk-` inside

package/src/resume.mjs

@@ -1,17 +1,18 @@
 // resume — the pointer that cannot describe a picture that is no longer true.
 //
-// `.baton/RESUME.md` is the file humans and other agents open by habit. It used
+// `.leg/RESUME.md` is the file humans and other agents open by habit (legacy
+// `.baton/RESUME.md` is still read). It used
 // to be an unowned convenience copy: written once per hand-off, never touched
 // again, with no stamp and no expiry, so a normally exited terminal left hours
 // old text sitting there looking live.
 //
 // Two rules fix that, and they are the whole module:
-//   1. Every resume file Baton writes carries a stamp of the git state and the
+//   1. Every resume file Leg writes carries a stamp of the git state and the
 //      live terminals it was written against (an HTML comment, invisible in
 //      rendered markdown).
 //   2. Freshness is never remembered — it is recomputed from git at READ time.
 //      A file cannot lie about HEAD to a reader who re-asks git.
-// Baton owns the file: it rewrites it when a session ends and when the board
+// Leg owns the file: it rewrites it when a session ends and when the board
 // starts, so nothing is left describing a terminal that is gone.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
@@ -24,8 +25,8 @@ export const STAMP_PREFIX = '<!-- leg-resume '
 export const LEGACY_STAMP_PREFIX = '<!-- baton-resume '
 const STAMP_SUFFIX = ' -->'
 const STAMP_VERSION = 1
-// Baton's own directories dirty the tree on every write; a reader must not see
-// Baton's bookkeeping as the human's work moving on.
+// Leg's own directories dirty the tree on every write; a reader must not see
+// Leg's bookkeeping as the human's work moving on.
 const LEG_DIRS = /^(\.leg|\.baton|\.context-handoffs|\.dashclaw-local)[\\/]/
 const MAX_REASONS = 5
 
@@ -81,6 +82,7 @@ export function perSessionFile(cwd, id) {
   if (existsSync(join(cwd, '.baton')) && !existsSync(join(cwd, '.leg'))) return baton
   return leg
 }
+export { synthesisFile } from './synthesis.mjs'
 
 // An agent started deeper in the tree still finds its checkout's pointer.
 export function findResume(startDir) {
@@ -117,7 +119,7 @@ export function readStamp(text) {
   } catch { return null }
 }
 
-// The text without its stamp: what a human reads and what `baton resume` prints.
+// The text without its stamp: what a human reads and what `leg resume` prints.
 export function bodyOf(text) {
   const s = String(text ?? '')
   return readStamp(s) ? s.slice(s.indexOf('\n') + 1).replace(/^\n+/, '') : s
@@ -200,10 +202,10 @@ export function lastHandoffIn(root, sessions = listSessions()) {
 }
 
 function idleBody(last, live) {
-  const lines = ['# Baton: nothing in flight', '']
+  const lines = ['# Leg: nothing in flight', '']
   lines.push(live.length
     ? `No hand-off is waiting to be picked up here. Still live in this checkout: ${live.map((s) => `${s.session_id} (${s.agent})`).join(', ')}.`
-    : 'No Baton terminal is live in this checkout.')
+    : 'No Leg terminal is live in this checkout.')
   lines.push('')
   if (last) {
     const at = last.at ? String(last.at).slice(0, 16).replace('T', ' ') : 'an unrecorded time'
@@ -221,7 +223,7 @@ function idleBody(last, live) {
 }
 
 // The "nothing in flight" pointer. Always writes; the callers that must not
-// create a file in a checkout Baton never handed off in check first.
+// create a file in a checkout Leg never handed off in check first.
 export function writeIdlePointer(root, { sessions = listSessions() } = {}) {
   if (!root) return null
   const dir = existsSync(join(root, '.baton')) && !existsSync(join(root, '.leg')) ? join(root, '.baton') : join(root, '.leg')
@@ -235,7 +237,7 @@ export function writeIdlePointer(root, { sessions = listSessions() } = {}) {
 }
 
 // A session ending must not leave its hand-off sitting there looking live.
-// Only ever rewrites a pointer that already exists: Baton owns RESUME.md where
+// Only ever rewrites a pointer that already exists: Leg owns RESUME.md where
 // it wrote one, and creates none in a checkout it never handed off in.
 export function endSessionPointer(session) {
   const root = workRoot(session)
@@ -243,7 +245,7 @@ export function endSessionPointer(session) {
   return writeIdlePointer(root)
 }
 
-// Board start: every checkout Baton wrote a pointer in gets it recomputed, so a
+// Board start: every checkout Leg wrote a pointer in gets it recomputed, so a
 // terminal that crashed instead of exiting cannot leave a live-looking hand-off
 // behind. A checkout whose terminal really is live keeps its hand-off text.
 // Returns the roots rewritten.
@@ -260,9 +262,9 @@ export function refreshPointers() {
     const v = resumeVerdict(root, { sessions })
     if (v.state === 'fresh') continue
     // The terminal that wrote a hand-off owns it while it is still running: its
-    // text is the live description, and "the repo moved on" is for `baton resume
+    // text is the live description, and "the repo moved on" is for `leg resume
     // --check` to report, not for the board to overwrite. Anything else — a
-    // hand-off from a terminal that is gone, a file no Baton stamped — is
+    // hand-off from a terminal that is gone, a file no Leg stamped — is
     // replaced even when some OTHER terminal happens to be live in the
     // checkout, which is the case that left three day old text sitting there.
     if (v.session?.active) continue
@@ -284,14 +286,14 @@ function describe(list) { return list.map((s) => `${s.id ?? s.session_id} (${s.a
 export function resumeVerdict(cwd, { sessions = listSessions() } = {}) {
   const found = findResume(cwd)
   if (!found) {
-    return { state: 'missing', exit_code: EXIT.missing, root: null, file: null, kind: null, stamp: null, reasons: ['there is no .baton/RESUME.md in this checkout'], summary: 'no resume pointer in this checkout', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
+    return { state: 'missing', exit_code: EXIT.missing, root: null, file: null, kind: null, stamp: null, reasons: ['there is no .leg/RESUME.md in this checkout'], summary: 'no resume pointer in this checkout', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
   }
   const { root, file } = found
   let text = ''
   try { text = readFileSync(file, 'utf8') } catch { /* raced a rewrite */ }
   const stamp = readStamp(text)
   if (!stamp) {
-    return { state: 'unstamped', exit_code: EXIT.unstamped, root, file, kind: null, stamp: null, reasons: ['this file carries no Baton stamp, so its freshness cannot be checked against git'], summary: 'cannot be checked: no Baton stamp', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
+    return { state: 'unstamped', exit_code: EXIT.unstamped, root, file, kind: null, stamp: null, reasons: ['this file carries no Leg stamp, so its freshness cannot be checked against git'], summary: 'cannot be checked: no Leg stamp', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
   }
 
   const now = gitState(root)