@ucsandman/legcli 0.7.0

package/scripts/limits-table.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+// limits-table — regenerate the Limit signals table in docs/cli-contracts.md
+// from fixtures/limits/**/*.json (the same files src/limits.mjs classifies with).
+import { readFileSync, writeFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { SIGNALS } from '../src/limits.mjs'
+
+const DOC = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'docs', 'cli-contracts.md')
+const START = '<!-- limits-table:start -->'
+const END = '<!-- limits-table:end -->'
+
+const cell = (s) => String(s).replace(/\|/g, '\\|').replace(/\r?\n/g, ' ')
+const rows = SIGNALS.map((s) =>
+  `| ${s.id} | ${s.adapter} | ${s.classification} | ${s.where} | **${s.source}** | ${cell(s.text).slice(0, 90)} | ${cell(s.produced_by)} |`)
+const counts = SIGNALS.reduce((m, s) => { m[s.source] = (m[s.source] ?? 0) + 1; return m }, {})
+const table = [
+  `Generated by \`node scripts/limits-table.mjs\` from ${SIGNALS.length} fixtures (${counts['observed-live'] ?? 0} observed-live, ${counts['docs-only'] ?? 0} docs-only). Classification \`limit\` hands the card to the next agent as a usage limit; \`auth\` is a failed launch (never a limit); \`launch\` is a failed launch that the next agent may still try; \`budget\` is a turn or spend cap set by Baton itself; \`info\` must never classify as a limit.`,
+  '',
+  '| id | adapter | class | where | source | text (excerpt) | produced by |',
+  '|----|---------|-------|-------|--------|----------------|-------------|',
+  ...rows,
+].join('\n')
+
+const doc = readFileSync(DOC, 'utf8')
+const a = doc.indexOf(START)
+const b = doc.indexOf(END)
+if (a === -1 || b === -1 || b < a) {
+  process.stderr.write(`markers ${START} / ${END} not found in ${DOC}\n`)
+  process.exit(1)
+}
+const next = doc.slice(0, a + START.length) + '\n' + table + '\n' + doc.slice(b)
+if (process.argv.includes('--check')) {
+  process.stdout.write(next === doc ? 'limits-table: up to date\n' : 'limits-table: STALE (run node scripts/limits-table.mjs)\n')
+  process.exit(next === doc ? 0 : 1)
+}
+writeFileSync(DOC, next)
+process.stdout.write(`limits-table: wrote ${SIGNALS.length} rows into ${DOC}\n`)

package/scripts/live-limits.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// live-limits — flip the docs rows for the interactive walls from docs-only to
+// observed-live once fixtures/live/<agent>/limit-<signal>.json exists (written
+// by src/live-capture.mjs the first time the real signal arrives). Each row in
+// docs/adapters.md and docs/cli-contracts.md carries a marker
+// `<!-- live:<agent>/<signal> -->` right after its status word.
+//   node scripts/live-limits.mjs          rewrite the rows
+//   node scripts/live-limits.mjs --check  exit 1 when a row is stale
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join, dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const LIVE = process.env.BATON_LIVE_DIR || join(ROOT, 'fixtures', 'live')
+const DOCS = ['docs/adapters.md', 'docs/cli-contracts.md'].map((p) => join(ROOT, p))
+const MARK = /\*\*(docs-only|observed-live(?: [0-9-]+)?)\*\* <!-- live:([a-z]+)\/([a-z_-]+) -->/g
+
+let stale = 0
+for (const doc of DOCS) {
+  const text = readFileSync(doc, 'utf8')
+  const next = text.replace(MARK, (whole, _status, agent, signal) => {
+    const f = join(LIVE, agent, `limit-${signal}.json`)
+    if (!existsSync(f)) return whole
+    let day = ''
+    try { day = String(JSON.parse(readFileSync(f, 'utf8')).captured_at ?? '').slice(0, 10) } catch {}
+    return `**observed-live${day ? ' ' + day : ''}** <!-- live:${agent}/${signal} -->`
+  })
+  if (next !== text) {
+    stale += 1
+    if (!process.argv.includes('--check')) { writeFileSync(doc, next); process.stdout.write(`live-limits: updated ${doc}\n`) }
+    else process.stdout.write(`live-limits: STALE ${doc}\n`)
+  }
+}
+const rows = DOCS.reduce((n, d) => n + (readFileSync(d, 'utf8').match(MARK) ?? []).length, 0)
+process.stdout.write(`live-limits: rows=${rows} ${process.argv.includes('--check') ? `stale=${stale}` : `updated=${stale}`}\n`)
+process.exit(process.argv.includes('--check') && stale ? 1 : 0)

package/scripts/privacy-check.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// privacy-check — refuses any file in the tree that carries a string from the
+// private source tooling this project was ported from. Runs in `npm test` and
+// in the commit hook (`--staged`). Exit 1 on any hit.
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { join, relative, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Extend here (phase 12 may add patterns). Matching is case-insensitive.
+// The first pattern skips the public GitHub handle "ucsandman" (NOTICE names
+// it) but still catches the local user name and the e-mail local part.
+export const PATTERNS = [
+  ['sandm', /(?<!uc)sandm/i],
+  ['1584804440', /1584804440/],
+  ['clawd', /clawd/i],
+]
+
+const SELF = fileURLToPath(import.meta.url)
+const ROOT = resolve(dirname(SELF), '..')
+const SKIP_DIRS = new Set(['node_modules', '.git', '.supergoal', '.leg', '.leg-worktrees', '.baton', '.baton-worktrees', '.context-handoffs'])
+// plain entries in .gitignore (no globs) are never shipped, so they are not scanned
+let GITIGNORED = new Set()
+try { GITIGNORED = new Set(readFileSync(resolve(ROOT, '.gitignore'), 'utf8').split(/\r?\n/).map((l) => l.trim().replace(/\/$/, '')).filter((l) => l && !l.startsWith('#') && !/[*?[]/.test(l))) } catch {}
+const BINARY_EXT = /\.(png|jpg|jpeg|gif|webp|ico|woff2?|ttf|pdf|zip|gz|tgz|mp4)$/i
+
+function walk(dir, out) {
+  for (const name of readdirSync(dir)) {
+    if (SKIP_DIRS.has(name) || GITIGNORED.has(name)) continue
+    const full = join(dir, name)
+    const st = statSync(full)
+    if (st.isDirectory()) walk(full, out)
+    else if (!BINARY_EXT.test(name) && full !== SELF) out.push(full)
+  }
+  return out
+}
+
+function stagedFiles() {
+  const out = execFileSync('git', ['diff', '--cached', '--name-only', '--diff-filter=ACMR'],
+    { cwd: ROOT, encoding: 'utf8' })
+  return out.split(/\r?\n/).filter(Boolean).map((p) => join(ROOT, p))
+    .filter((p) => p !== SELF)
+    .filter((p) => { try { return statSync(p).isFile() && !BINARY_EXT.test(p) } catch { return false } })
+}
+
+const staged = process.argv.includes('--staged')
+const files = staged ? stagedFiles() : walk(ROOT, [])
+let hits = 0
+for (const file of files) {
+  let text
+  try { text = readFileSync(file, 'utf8') } catch { continue }
+  const lines = text.split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    for (const [label, re] of PATTERNS) {
+      if (re.test(lines[i])) {
+        hits += 1
+        process.stdout.write(`${relative(ROOT, file)}:${i + 1}: ${label}\n`)
+      }
+    }
+  }
+}
+process.stdout.write(`privacy-check: hits=${hits} files=${files.length}${staged ? ' (staged)' : ''}\n`)
+process.exit(hits ? 1 : 0)

package/scripts/probe.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// probe — run one real tiny task on one CLI through the ported runner and
+// keep the evidence under fixtures/live/<adapter>/.
+//   node scripts/probe.mjs --adapter <name> --repo <path> [--mode <m>] [--timeout-s 300]
+// Prints: probe <name>: exit=<code> file=<yes|no> done=<yes|no> auth_source=<yes|no> seconds=<n>
+import { execFileSync } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
+import { join, dirname, resolve } from 'node:path'
+import { homedir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { get as getAdapter } from '../src/adapters/index.mjs'
+import { scrub } from '../src/runner.mjs'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const SRC = join(ROOT, 'src')
+const HOME = process.env.BATON_HOME || join(homedir(), '.baton')
+
+const args = {}
+const argv = process.argv.slice(2)
+for (let i = 0; i < argv.length; i += 2) args[argv[i].replace(/^--/, '')] = argv[i + 1]
+const name = args.adapter
+const repo = args.repo && resolve(args.repo)
+if (!name || !repo || !existsSync(repo)) {
+  process.stderr.write('usage: probe.mjs --adapter <name> --repo <existing dir> [--mode m] [--timeout-s 300]\n')
+  process.exit(2)
+}
+const timeoutS = parseInt(args['timeout-s'] ?? '300', 10)
+const adapter = await getAdapter(name)
+const mode = args.mode ?? adapter.modes.default
+
+const PROMPT = `Create a file named hello-${name}.txt in the current directory containing exactly the word hi. Then create the directory .baton if it is missing and write the file .baton/DONE containing the single line: done. Do nothing else. Do not ask questions.\n`
+
+const node = (script, a) => execFileSync(process.execPath, [script, ...a], { encoding: 'utf8', env: process.env })
+
+// Fresh DONE marker per probe so "done=yes" is this CLI's own work.
+rmSync(join(repo, '.baton', 'DONE'), { force: true })
+rmSync(join(repo, `hello-${name}.txt`), { force: true })
+
+const id = node(join(SRC, 'ledger.mjs'), ['create', '--slug', `probe-${name}`.slice(0, 30), '--task', PROMPT.trim(),
+  '--repo', repo, '--chain', JSON.stringify([{ adapter: name, mode }])]).trim()
+const promptFile = join(HOME, 'cards', id, 'probe-prompt.txt')
+writeFileSync(promptFile, PROMPT)
+
+const t0 = Date.now()
+let launch
+try {
+  launch = JSON.parse(node(join(SRC, 'runner.mjs'), ['launch', '--card', id, '--adapter', name,
+    '--prompt-file', promptFile, '--cwd', repo, '--mode', mode]))
+} catch (err) {
+  process.stdout.write(`probe ${name}: launch failed: ${String(err.stderr ?? err.message).trim()}\n`)
+  process.exit(1)
+}
+const runDir = launch.run_dir
+const runJson = () => { try { return JSON.parse(readFileSync(join(runDir, 'run.json'), 'utf8')) } catch { return null } }
+
+// LESSONS 07-10: claude -p prints nothing until the end; poll the run record,
+// never a short timeout on stdout.
+let run = runJson()
+while (Date.now() - t0 < timeoutS * 1000) {
+  run = runJson()
+  if (run && ['exited', 'killed', 'failed', 'orphaned'].includes(run.status)) break
+  await new Promise((r) => setTimeout(r, 2000))
+}
+const seconds = Math.round((Date.now() - t0) / 1000)
+
+// Fixtures are committed: secrets are scrubbed and the local user's home
+// directory becomes "~" in every slash and escape form.
+export function scrubPaths(text) {
+  const [drive, ...segs] = homedir().split(/[\\/]+/)
+  const esc = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  // C:\Users\name, C:/Users/name, C:\\Users\\name (JSON), C:\\\\… (nested JSON), /c/Users/name (MSYS)
+  const re = new RegExp(`(?:${esc(drive)}|/${drive[0].toLowerCase()})${segs.map((s) => `[\\\\/]+${esc(s)}`).join('')}`, 'gi')
+  return scrub(text).replace(re, '~')
+}
+
+const out = join(ROOT, 'fixtures', 'live', name)
+mkdirSync(out, { recursive: true })
+for (const f of ['out.log', 'err.log', 'run.json', 'supervisor.log', 'last.md']) {
+  if (existsSync(join(runDir, f))) writeFileSync(join(out, f), scrubPaths(readFileSync(join(runDir, f), 'utf8')))
+}
+const spec = adapter.argv({ mode, cwd: repo, prompt: PROMPT, runDir, killMs: 5400000 })
+writeFileSync(join(out, 'cmd.txt'), scrubPaths([spec.bin, ...spec.args].map((a) => (/\s/.test(a) ? JSON.stringify(a) : a)).join(' ')) + '\n')
+const textOf = (f) => (existsSync(join(runDir, f)) ? readFileSync(join(runDir, f), 'utf8') : '')
+const authSource = /another auth source/i.test(textOf('err.log') + textOf('out.log'))
+const file = existsSync(join(repo, `hello-${name}.txt`))
+  && readFileSync(join(repo, `hello-${name}.txt`), 'utf8').trim() === 'hi'
+const done = existsSync(join(repo, '.baton', 'DONE'))
+const exit = run?.status === 'exited' ? run.exit_code : `${run?.status ?? 'unknown'}`
+const parsed = adapter.parseResult(textOf('out.log'))
+writeFileSync(join(out, 'parsed.json'), scrubPaths(JSON.stringify({ ...parsed, raw: undefined }, null, 2)) + '\n')
+process.stdout.write(`probe ${name}: exit=${exit} file=${file ? 'yes' : 'no'} done=${done ? 'yes' : 'no'} auth_source=${authSource ? 'yes' : 'no'} seconds=${seconds} session=${parsed?.session_id ?? 'none'}\n`)
+process.exit(file && done && run?.exit_code === 0 ? 0 : 1)

package/scripts/seed-fake-cards.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// seed-fake-cards — fills a BATON_HOME with N backlog cards (fake chain, build
+// pipeline) through the same path the CLI uses (src/cards.mjs createCard), for
+// perf tests and manual board load-testing.
+//   node scripts/seed-fake-cards.mjs --home <dir> --repo <git repo path> --count 50
+import { resolve } from 'node:path'
+
+function parseArgs(argv) {
+  const args = {}
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a.startsWith('--')) { args[a.slice(2)] = argv[i + 1]; i++ }
+  }
+  return args
+}
+
+const args = parseArgs(process.argv.slice(2))
+if (!args.home) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50]\n'); process.exit(2) }
+if (!args.repo) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50]\n'); process.exit(2) }
+const count = parseInt(args.count ?? '50', 10) || 50
+
+// BATON_HOME must be set before store.mjs (and the ledger.mjs it imports) load.
+process.env.BATON_HOME = resolve(args.home)
+const { createCard } = await import('../src/cards.mjs')
+
+const TITLES = ['Add retry to fetch', 'Fix flaky lease test', 'Refactor log tail', 'Wire up SSE health', 'Trim README', 'Bump adapter timeout', 'Dedupe blocked events', 'Guard null station', 'Speed up card list', 'Polish error copy']
+
+let created = 0
+for (let i = 0; i < count; i++) {
+  const title = `${TITLES[i % TITLES.length]} #${i + 1}`
+  await createCard({ repo: args.repo, task: title, title, chain: 'fake' }, { type: 'human', id: 'seed' })
+  created += 1
+}
+process.stdout.write(`seeded ${created} card(s) into ${process.env.BATON_HOME}\n`)

package/scripts/seed-floor-board.mjs

@@ -0,0 +1,69 @@
+// Seeds a throwaway BATON_HOME with a floor that has something in every lane:
+// two cards running, two waiting on a human, one queued and blocked by a lease
+// another card holds, and a landing on the trunk. The floor is derived entirely
+// from card records and their events (server.mjs floor()), so the states are
+// written straight to the ledger rather than driven through real runs.
+//
+//   BATON_HOME=<dir> node scripts/seed-floor-board.mjs <repo path>
+//
+// Serve it on a spare port with BATON_TRUST=never. NEVER 4747.
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+
+process.env.BATON_HOME ||= join(tmpdir(), 'baton-floor-board')
+const repo = process.argv[2] || join(tmpdir(), 'toy-demo')
+const { createCard } = await import('../src/cards.mjs')
+const { ledgerAppend, ledgerUpdate, cardDir } = await import('../src/store.mjs')
+const { mkdirSync, writeFileSync } = await import('node:fs')
+
+// one run record per card, started far enough back that the elapsed column
+// shows a real number rather than 00:00
+function writeRun(id, startedMsAgo) {
+  const dir = join(cardDir(id), 'runs', '1')
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(cardDir(id), 'runs', '1', 'run.json'), JSON.stringify({
+    run: 1, adapter: 'fake-claude', status: 'running',
+    started_at: new Date(Date.now() - startedMsAgo).toISOString(),
+  }, null, 2))
+}
+
+const min = 60_000
+const ago = (ms) => new Date(Date.now() - ms).toISOString()
+
+const rows = [
+  { title: 'Lease holder', task: 'Rewrite the retry path in the fetch wrapper', chain: 'fake-claude,fake-codex',
+    leases: 'src/**', status: 'running', leg: 0, started: 42_000,
+    event: ['leg_started', 'leg started: adapter=fake-claude run=6 mode=default'] },
+  { title: 'Bounced by land', task: 'Dedupe the blocked events on the floor', chain: 'fake-codex',
+    leases: 'b.mjs', status: 'running', leg: 0, started: 35_000,
+    event: ['leg_started', 'leg started: adapter=fake-codex run=12 mode=default'] },
+  { title: 'Paused', task: 'Trim the README install block', chain: 'fake-claude',
+    leases: 'README.md', status: 'paused', leg: 0, started: 9 * min,
+    event: ['paused', 'paused by local'] },
+  { title: 'Waiting for human', task: 'Confirm the new pricing copy before it lands', chain: 'fake-claude,fake-codex',
+    leases: 'site/**', status: 'needs_approval', leg: 1, started: 4 * min,
+    event: ['approval_needed', 'fake-claude → fake-codex needs approval before leg 1'] },
+  { title: 'Blocked by lease', task: 'Guard the null station in the scheduler', chain: 'fake-claude',
+    leases: 'src/x/**', status: 'queued', leg: 0, started: 2 * min,
+    event: ['blocked_by', 'blocked by card "Lease holder" on src/** (against src/x/**)'] },
+]
+
+const made = []
+for (const r of rows) {
+  const card = await createCard({ repo, task: r.task, title: r.title, chain: r.chain, leases: r.leases }, { type: 'human', id: 'seed' })
+  const id = card.card_id
+  ledgerUpdate(id, { status: r.status, station: 'build', leg: r.leg })
+  ledgerAppend(id, { type: r.event[0], summary: r.event[1], station: 'build', leg: r.leg })
+  // the floor clocks a running card from its active run, and falls back to
+  // updated_at: without a run record every row read 00:00
+  writeRun(id, r.started)
+  made.push(`${r.title} -> ${r.status}`)
+}
+
+// one card already landed on the trunk, so the trunk lane is not empty
+const landed = await createCard({ repo, task: 'Add the landing note to the changelog', title: 'Add landing note', chain: 'fake-claude' }, { type: 'human', id: 'seed' })
+ledgerUpdate(landed.card_id, { status: 'done', station: 'build', leg: 0 })
+ledgerAppend(landed.card_id, { type: 'landed', summary: 'landed on main: 5714348 → b0c888f (1 file, +1/-0)', station: 'build', leg: 0 })
+made.push(`Add landing note -> landed ${ago(90_000).slice(11, 16)}`)
+
+console.log(`seeded ${made.length} cards into ${process.env.BATON_HOME}\n  ${made.join('\n  ')}`)

package/scripts/seed-wes-board.mjs

@@ -0,0 +1,91 @@
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+// Seeds a throwaway BATON_HOME shaped like a real working board: a few live
+// terminals and a larger pile of lost and ended ones, long absolute temp paths,
+// and an image tag in a prompt.
+//
+// Board UI work is measured against THIS, never against a board of healthy
+// terminals. Styling scoped to live rows and measured on a clean board reported
+// 40px terminal rows while the real screen showed 400px, and that single wrong
+// fixture cost more than any other mistake in the v4 redesign.
+//
+//   node scripts/seed-wes-board.mjs                 # seeds ./scripts/wes-home
+//   BATON_HOME=<dir> node scripts/seed-wes-board.mjs
+//
+// Serve it on an isolated port with a throwaway BATON_HOME and BATON_TRUST=never.
+// NEVER 4747: that is the operator's live board with real sessions on it.
+// a throwaway home under the OS temp dir, so nothing is written into the repo
+process.env.BATON_HOME ||= join(tmpdir(), 'baton-seed-board')
+const { createSession, updateSession } = await import('../src/sessions.mjs')
+const { recordUsage, markLimited } = await import('../src/usage.mjs')
+const { spawn } = await import('node:child_process')
+const { writeFileSync } = await import('node:fs')
+
+// reapLost() marks any active session lost when its runner pid is gone, so a
+// live row needs a live process behind it. These sleepers are that process and
+// nothing else; scratchpad/stop.mjs kills them.
+const sleepers = []
+function livePid() {
+  const p = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1e9)'], { detached: true, stdio: 'ignore' })
+  p.unref()
+  sleepers.push(p.pid)
+  return p.pid
+}
+
+const min = 60_000, hour = 60 * min
+const ago = (ms) => new Date(Date.now() - ms).toISOString()
+const B = String.fromCharCode(92)          // one backslash, unmangled by any shell
+const w = (...parts) => parts.join(B)
+const P = (...rest) => w('C:', 'Projects', ...rest)
+// the shape that matters is LENGTH: a real worktree path under a temp dir runs
+// past 90 characters, which is what buried the prompt in the rejected design
+const LONG = w('C:', 'Users', 'operator', 'AppData', 'Local', 'Temp', 'agent',
+  'C--Projects-baton--baton-worktrees-s-20260915-000000-claude-0000',
+  '00000000-0000-0000-0000-000000000000')
+
+const rows = [
+  { id: 's-20260915-0049-claude-2fbf', agent: 'claude', status: 'warning', started: 4 * hour + 24 * min,
+    cwd: P('baton'), repo: P('baton'), branch: 'main',
+    task: 'ultracode run a tournament of ideas to drastically redesign and improve the UI for this project. I do not like the current setup.' },
+  { id: 's-20260915-0213-claude-95d3', agent: 'claude', status: 'running', started: 2 * hour + 46 * min,
+    cwd: w('C:', 'documents'), repo: null, branch: null, task: null },
+  { id: 's-20260915-0257-claude-88e8', agent: 'claude', status: 'warning', started: 2 * hour + 2 * min,
+    cwd: P('recruiting-tool'), repo: P('recruiting-tool'), branch: 'main',
+    task: `<image name=screenshot.png path=${w('C:', 'Users', 'operator', 'Desktop', 'shot.png')}> [Image #1] sourcing candidates is a huge pain for my friend who recruits on LinkedIn, how can we help` },
+  { id: 's-20260915-0455-claude-8e8a', agent: 'claude', status: 'running', started: 5 * min,
+    cwd: w('C:', 'Projects'), repo: null, branch: null, task: '/handoff-load verifier-reach-contracts' },
+  { id: 's-20260914-2211-claude-4c10', agent: 'claude', status: 'lost', started: 6 * hour, ended: 3 * hour,
+    cwd: w(LONG, 'discovery-loop'), repo: P('discovery-loop'), branch: 'main', task: 'run the nightly discovery loop' },
+  { id: 's-20260914-2010-codex-7b31', agent: 'codex', status: 'lost', started: 7 * hour, ended: 4 * hour,
+    cwd: w(LONG, 'costclaw'), repo: P('costclaw'), branch: 'main', task: 'fix the per-model price table for Opus' },
+  { id: 's-20260914-1802-agy-d9f2', agent: 'agy', status: 'lost', started: 9 * hour, ended: 6 * hour,
+    cwd: w('C:', 'Projects'), repo: null, branch: null, task: 'summarise yesterday' },
+  { id: 's-20260914-1533-claude-a04b', agent: 'claude', status: 'ended', started: 11 * hour, ended: 8 * hour,
+    cwd: w(LONG, 'declick'), repo: P('declick'), branch: 'main', task: 'add the web tree verb' },
+  { id: 's-20260914-1120-codex-55ac', agent: 'codex', status: 'ended', started: 13 * hour, ended: 10 * hour,
+    cwd: P('costclaw'), repo: P('costclaw'), branch: 'main', task: 'monthly rollup excludes refunded calls' },
+]
+
+for (const r of rows) {
+  createSession({ id: r.id, agent: r.agent, cwd: r.cwd, repo: r.repo, branch: r.branch, argv: [r.agent], runner_pid: r.ended ? 1 : livePid() })
+  updateSession(r.id, {
+    status: r.status,
+    started_at: ago(r.started),
+    last_activity: ago(r.ended ?? 0),
+    ended_at: r.ended ? ago(r.ended) : null,
+    task: r.task,
+    turns: r.task ? 12 : 0,
+    files_touched: r.repo ? [w(r.cwd, 'src', 'board', 'board.css'), w(r.cwd, 'src', 'board', 'sessions.js')] : [],
+  })
+}
+
+recordUsage('claude', 'default',
+  { five_hour: { pct: 38, resets_at: Math.floor((Date.now() + 3 * hour) / 1000) },
+    seven_day: { pct: 95, resets_at: Math.floor((Date.now() + 40 * hour) / 1000) } },
+  'statusline', { observed_at: ago(2 * hour + 13 * min) })
+markLimited('codex', 'default', { resets_at: Math.floor((Date.now() + 29 * hour) / 1000), reason: 'limit', source: 'hook' })
+// agy publishes no usage figure, ever. Left unwritten on purpose.
+
+writeFileSync(join(process.env.BATON_HOME, 'sleepers.json'), JSON.stringify(sleepers))
+const live = rows.filter((r) => !r.ended).length
+console.log(`seeded ${rows.length} sessions (${live} live, ${rows.length - live} finished) into ${process.env.BATON_HOME}`)

package/scripts/stripe-setup.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// Create (idempotently) the two Baton plans in Stripe, their payment links,
+// and the webhook endpoint for the site. Test mode by default, --live for the
+// live account. Secrets never print: the webhook signing secret and the link
+// URLs are written to .env (gitignored); ids and public URLs print.
+//   node --env-file=.env scripts/stripe-setup.mjs --site https://batonagents.com [--live]
+import { readFileSync, writeFileSync } from 'node:fs'
+
+const args = Object.fromEntries(process.argv.slice(2).map((a, i, all) => a.startsWith('--') ? [a.slice(2), all[i + 1]?.startsWith('--') || all[i + 1] === undefined ? true : all[i + 1]] : []).filter((x) => x.length))
+const live = args.live === true
+const key = live ? process.env.STRIPE_SECRET_KEY : process.env.STRIPE_TEST_SECRET_KEY
+if (!key) { console.error(live ? 'STRIPE_SECRET_KEY missing' : 'STRIPE_TEST_SECRET_KEY missing'); process.exit(2) }
+if (live && !key.startsWith('sk_live')) { console.error('--live but the key is not sk_live'); process.exit(2) }
+if (!live && !key.startsWith('sk_test')) { console.error('test run but the key is not sk_test'); process.exit(2) }
+const SITE = args.site || 'https://legcli.com'
+
+function form(obj, prefix = '') {
+  const out = []
+  for (const [k, v] of Object.entries(obj)) {
+    const name = prefix ? `${prefix}[${k}]` : k
+    if (v === undefined || v === null) continue
+    if (Array.isArray(v)) v.forEach((x, i) => out.push(typeof x === 'object' ? form(x, `${name}[${i}]`) : `${encodeURIComponent(`${name}[${i}]`)}=${encodeURIComponent(x)}`))
+    else if (typeof v === 'object') out.push(form(v, name))
+    else out.push(`${encodeURIComponent(name)}=${encodeURIComponent(v)}`)
+  }
+  return out.filter(Boolean).join('&')
+}
+async function stripe(path, { method = 'GET', body, query } = {}) {
+  const r = await fetch('https://api.stripe.com/v1' + path + (query ? '?' + form(query) : ''), { method, headers: { Authorization: 'Bearer ' + key, 'Content-Type': 'application/x-www-form-urlencoded' }, body: body ? form(body) : undefined })
+  const j = await r.json()
+  if (!r.ok) throw new Error(`${method} ${path}: ${j.error?.message}`)
+  return j
+}
+
+async function priceByLookup(lookup) {
+  const r = await stripe('/prices', { query: { lookup_keys: [lookup], active: true, limit: 1 } })
+  return r.data[0] || null
+}
+
+async function ensurePlan({ name, description, lookup, unit_amount, recurring, statement }) {
+  let price = await priceByLookup(lookup)
+  if (price) return { price, created: false }
+  const product = await stripe('/products', { method: 'POST', body: { name, description, statement_descriptor: statement, metadata: { plan: lookup.replace('baton_', '') } } })
+  price = await stripe('/prices', { method: 'POST', body: { product: product.id, currency: 'usd', unit_amount, lookup_key: lookup, recurring, tax_behavior: 'exclusive', metadata: { plan: lookup.replace('baton_', '') } } })
+  return { price, created: true }
+}
+
+async function ensureLink(price, { adjustable, mode }) {
+  const existing = await stripe('/payment_links', { query: { active: true, limit: 100 } })
+  for (const l of existing.data) {
+    if (l.metadata?.baton_price === price.id && l.metadata?.baton_site === SITE) return { link: l, created: false }
+  }
+  const body = {
+    'line_items[0][price]': price.id, 'line_items[0][quantity]': 1,
+    'after_completion[type]': 'redirect', 'after_completion[redirect][url]': `${SITE}/thanks?session_id={CHECKOUT_SESSION_ID}`,
+    'automatic_tax[enabled]': true, 'tax_id_collection[enabled]': true, billing_address_collection: 'auto', allow_promotion_codes: true,
+    'metadata[baton_price]': price.id, 'metadata[baton_site]': SITE,
+  }
+  if (adjustable) { body['line_items[0][adjustable_quantity][enabled]'] = true; body['line_items[0][adjustable_quantity][minimum]'] = 1; body['line_items[0][adjustable_quantity][maximum]'] = 200 }
+  if (mode === 'payment') body['invoice_creation[enabled]'] = true
+  const link = await stripe('/payment_links', { method: 'POST', body })
+  return { link, created: true }
+}
+
+async function ensureWebhook() {
+  const url = `${SITE}/api/webhook`
+  const existing = await stripe('/webhook_endpoints', { query: { limit: 100 } })
+  const have = existing.data.find((w) => w.url === url && w.status === 'enabled')
+  if (have) return { endpoint: have, secret: null, created: false }
+  const endpoint = await stripe('/webhook_endpoints', { method: 'POST', body: { url, enabled_events: ['checkout.session.completed', 'invoice.paid'], description: 'Leg license delivery' } })
+  return { endpoint, secret: endpoint.secret, created: true }
+}
+
+function setEnv(pairs) {
+  let env = readFileSync('.env', 'utf8')
+  for (const [k, v] of Object.entries(pairs)) {
+    if (v === null || v === undefined) continue
+    env = new RegExp(`^${k}=`, 'm').test(env) ? env.replace(new RegExp(`^${k}=.*$`, 'm'), `${k}=${v}`) : env + (env.endsWith('\n') ? '' : '\n') + `${k}=${v}\n`
+  }
+  writeFileSync('.env', env)
+}
+
+// Refuse to create anything in an account that is not the seller's.
+const acct = await stripe('/account')
+const acctName = acct.settings?.dashboard?.display_name || acct.business_profile?.name || ''
+if (!/practical systems/i.test(acctName)) { console.error(`this key belongs to "${acctName}", not Practical Systems; pin the right one with creds mint STRIPE_SECRET_KEY`); process.exit(3) }
+console.log(`account: ${acctName} (${live ? 'live' : 'test'})`)
+
+const personal = await ensurePlan({ name: 'Leg Personal', description: 'One machine or several, one human. Every Leg release for 12 months; the version you have keeps working after that.', lookup: 'leg_personal', unit_amount: 7900, statement: 'LEG PERSONAL' })
+const team = await ensurePlan({ name: 'Leg Team', description: 'Per seat, per month. Everything in Personal plus the shared board (leg share) and Land for more than one human.', lookup: 'leg_team', unit_amount: 1200, recurring: { interval: 'month' }, statement: 'LEG TEAM' })
+const lp = await ensureLink(personal.price, { adjustable: false, mode: 'payment' })
+const lt = await ensureLink(team.price, { adjustable: true, mode: 'subscription' })
+const wh = await ensureWebhook()
+const mode = live ? 'LIVE' : 'TEST'
+setEnv({ [`STRIPE_${mode}_PAYMENT_LINK_PERSONAL`]: lp.link.url, [`STRIPE_${mode}_PAYMENT_LINK_TEAM`]: lt.link.url, [`STRIPE_${mode}_WEBHOOK_SECRET`]: wh.secret })
+console.log(`${mode} mode against ${SITE}`)
+console.log(`personal  ${personal.price.id} $79 once      link ${lp.link.url}${personal.created ? ' (created)' : ''}`)
+console.log(`team      ${team.price.id} $12/seat/mo   link ${lt.link.url}${team.created ? ' (created)' : ''}`)
+console.log(`webhook   ${wh.endpoint.id} -> ${wh.endpoint.url} ${wh.created ? '(created; secret written to .env)' : '(existing; secret unchanged)'}`)

package/scripts/vercel-env.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// Push the site's secrets from .env to the Vercel project without printing
+// them: each value goes to `vercel env add NAME production` on stdin.
+//   node --env-file=.env scripts/vercel-env.mjs --mode test|live --site https://legcli.com
+import { spawnSync } from 'node:child_process'
+
+const args = Object.fromEntries(process.argv.slice(2).map((a, i, all) => a.startsWith('--') ? [a.slice(2), all[i + 1]] : []).filter((x) => x.length))
+if (!['test', 'live'].includes(args.mode)) {
+  console.error('Usage: node scripts/vercel-env.mjs --mode test|live [--site URL]')
+  process.exit(2)
+}
+const live = args.mode === 'live'
+const vars = {
+  STRIPE_SECRET_KEY: live ? process.env.STRIPE_SECRET_KEY : process.env.STRIPE_TEST_SECRET_KEY,
+  STRIPE_WEBHOOK_SECRET: live ? process.env.STRIPE_LIVE_WEBHOOK_SECRET : process.env.STRIPE_TEST_WEBHOOK_SECRET,
+  RESEND_API_KEY: process.env.RESEND_API_KEY,
+  LEG_LICENSE_PRIVATE_KEY: process.env.LEG_LICENSE_PRIVATE_KEY || process.env.BATON_LICENSE_PRIVATE_KEY,
+  BATON_LICENSE_PRIVATE_KEY: process.env.LEG_LICENSE_PRIVATE_KEY || process.env.BATON_LICENSE_PRIVATE_KEY,
+  LEG_SITE_ORIGIN: args.site || 'https://legcli.com',
+  BATON_SITE_ORIGIN: args.site || 'https://legcli.com',
+  LEG_MAIL_FROM: 'Leg <legcli@practicalsystems.io>',
+  BATON_MAIL_FROM: 'Leg <legcli@practicalsystems.io>',
+  LEG_MAIL_REPLY_TO: 'legcli@practicalsystems.io',
+  BATON_MAIL_REPLY_TO: 'legcli@practicalsystems.io',
+}
+const missing = Object.entries(vars).filter(([, v]) => !v).map(([k]) => k)
+if (missing.length) { console.error('missing in .env: ' + missing.join(', ')); process.exit(2) }
+// The Vercel CLI's JS entry, run with this node: no shell, so a value with
+// shell characters is never interpreted and the repo's no-shell rule holds.
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+const roots = [process.env.APPDATA && join(process.env.APPDATA, 'npm', 'node_modules'), '/usr/local/lib/node_modules', '/usr/lib/node_modules', join(homedir(), '.npm-global', 'lib', 'node_modules')].filter(Boolean)
+const vercelJs = roots.map((r) => join(r, 'vercel', 'dist', 'index.js')).find((f) => existsSync(f))
+if (!vercelJs) { console.error('vercel CLI not found in a global node_modules; npm i -g vercel'); process.exit(2) }
+for (const [k, v] of Object.entries(vars)) {
+  spawnSync(process.execPath, [vercelJs, 'env', 'rm', k, 'production', '--yes'], { cwd: 'site', encoding: 'utf8' })
+  const r = spawnSync(process.execPath, [vercelJs, 'env', 'add', k, 'production'], { cwd: 'site', input: v, encoding: 'utf8' })
+  console.log(`${k.padEnd(28)} ${r.status === 0 ? 'set' : 'FAILED ' + (r.stderr || r.stdout).split('\n').filter(Boolean).slice(-1)[0]}`)
+}