@ucsandman/legcli 0.8.0 → 0.10.0

package/src/preferences.mjs

@@ -1,4 +1,4 @@
-// Machine-wide defaults for interactive Baton terminals. A new terminal takes
+// Machine-wide defaults for interactive Leg terminals. A new terminal takes
 // a copy of these preferences when it starts; later edits do not silently
 // change terminals that are already running.
 import { existsSync, mkdirSync, readFileSync } from 'node:fs'
@@ -27,6 +27,38 @@ export function requireHandoffOrder(value) {
   return [...value]
 }
 
+// Portable harness (src/harness/): off for every existing install. `enabled`
+// is the explicit consent `leg harness enable` records; `policy` is what an
+// unattended hand-off may do (warn: report only; sync: write managed state
+// when it is safe; strict: refuse a destination that cannot be made safe);
+// `source` is the client whose harness is the one being carried.
+export const HARNESS_POLICIES = ['warn', 'sync', 'strict']
+export const HARNESS_SOURCES = ['claude', 'codex']
+export const HARNESS_DEFAULTS = Object.freeze({ enabled: false, policy: 'warn', source: null })
+
+export function normalizeHarness(value) {
+  const v = value && typeof value === 'object' ? value : {}
+  return {
+    enabled: v.enabled === true,
+    policy: HARNESS_POLICIES.includes(v.policy) ? v.policy : HARNESS_DEFAULTS.policy,
+    source: HARNESS_SOURCES.includes(v.source) ? v.source : null,
+  }
+}
+
+export function requireHarness(patch, current = HARNESS_DEFAULTS) {
+  const next = { ...normalizeHarness(current) }
+  if (patch?.enabled !== undefined) next.enabled = Boolean(patch.enabled)
+  if (patch?.policy !== undefined) {
+    if (!HARNESS_POLICIES.includes(patch.policy)) throw new TypeError(`harness policy must be one of ${HARNESS_POLICIES.join(', ')}`)
+    next.policy = patch.policy
+  }
+  if (patch?.source !== undefined) {
+    if (patch.source !== null && !HARNESS_SOURCES.includes(patch.source)) throw new TypeError(`harness source must be one of ${HARNESS_SOURCES.join(', ')}`)
+    next.source = patch.source
+  }
+  return next
+}
+
 export function preferencesFile() { return join(home(), 'preferences.json') }
 
 export function resolveAutoApprove({ env = process.env, preferences = null, cliFlag = null } = {}) {
@@ -41,15 +73,16 @@ export function resolveAutoApprove({ env = process.env, preferences = null, cliF
 
 export function readPreferences() {
   const file = preferencesFile()
-  if (!existsSync(file)) return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true }
+  if (!existsSync(file)) return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true, harness: { ...HARNESS_DEFAULTS } }
   try {
     const value = JSON.parse(readFileSync(file, 'utf8'))
     return {
       handoff_order: normalizeHandoffOrder(value?.handoff_order),
       auto_approve: value?.auto_approve !== false,
+      harness: normalizeHarness(value?.harness),
     }
   } catch {
-    return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true }
+    return { handoff_order: [...HANDOFF_AGENTS], auto_approve: true, harness: { ...HARNESS_DEFAULTS } }
   }
 }
 
@@ -61,6 +94,7 @@ export function writePreferences(patch) {
     const next = { ...current }
     if (order !== undefined) next.handoff_order = order
     if (patch?.auto_approve !== undefined) next.auto_approve = Boolean(patch.auto_approve)
+    if (patch?.harness !== undefined) next.harness = requireHarness(patch.harness, current.harness)
     writeJsonAtomic(preferencesFile(), next)
     return next
   })

package/src/redact.mjs

@@ -1,6 +1,6 @@
 // redact — the one list of secret shapes. `scrub()` rewrites (logs, bundles,
 // launcher output); the ledger's assertNoSecrets refuses (src/ledger.mjs).
-// The source tooling kept two copies on purpose; Baton keeps one here.
+// The source tooling kept two copies on purpose; Leg keeps one here.
 // Values the launcher's own process holds for the well-known key variables
 // are read once at startup and never printed.
 // Every prefix shape starts at a token boundary: the `sk-` inside
@@ -11,19 +11,37 @@ const PATTERNS = [
   ['Anthropic key (sk-ant-)', /(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{8,}/g],
   ['DashClaw key (oc_live_)', /(?<![A-Za-z0-9_-])oc_live_[a-f0-9]\w*/g],
   ['bearer token', /Bearer\s+[A-Za-z0-9._-]{16,}/g],
-  ['GitHub token (ghp_)', /(?<![A-Za-z0-9_-])ghp_[A-Za-z0-9]{20,}/g],
-  ['GitHub server token (ghs_)', /(?<![A-Za-z0-9_-])ghs_[A-Za-z0-9]{20,}/g],
+  ['GitHub token (gh[pousr]_)', /(?<![A-Za-z0-9_-])gh[pousr]_[A-Za-z0-9]{20,}/g],
   ['GitHub fine-grained token (github_pat_)', /(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}/g],
   ['AWS key (AKIA)', /(?<![A-Za-z0-9_-])AKIA[0-9A-Z]{12,}/g],
-  ['Slack token (xox)', /(?<![A-Za-z0-9_-])xox[bp]-\S*/g],
-  ['key=value secret', /api[_-]?key\s*[=:]\s*\S+/gi],
+  ['Slack token (xox/xapp)', /(?<![A-Za-z0-9_-])(?:xox[baprs]|xapp)-\S+/g],
+  ['key=value secret', /api[_-]?key[ \t]*[=:][ \t]*\S+/gi],
+  // shapes a discovered transcript from another agent carries that the list
+  // above missed (measured 2026-09-16: 15 of 18 common shapes went through)
+  ['Stripe key (sk_live_/rk_live_)', /(?<![A-Za-z0-9_-])[sr]k_(?:live|test)_[A-Za-z0-9]{8,}/g],
+  ['Google API key (AIza)', /(?<![A-Za-z0-9_-])AIza[0-9A-Za-z_-]{30,}/g],
+  ['xAI key (xai-)', /(?<![A-Za-z0-9_-])xai-[A-Za-z0-9]{16,}/g],
+  ['npm token (npm_)', /(?<![A-Za-z0-9_-])npm_[A-Za-z0-9]{20,}/g],
+  ['GitLab token (glpat-)', /(?<![A-Za-z0-9_-])glpat-[A-Za-z0-9_-]{16,}/g],
+  ['Hugging Face token (hf_)', /(?<![A-Za-z0-9_-])hf_[A-Za-z0-9]{20,}/g],
+  ['JWT', /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
+  ['private key block', /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g],
+  // a digit or two capitals somewhere: base64 of any credential has one of
+  // them, "Basic authentication/authorization" in prose has neither
+  ['basic auth header', /Basic\s+(?=[A-Za-z0-9+/=]*(?:[0-9]|[A-Z][A-Za-z0-9+/=]*[A-Z]))[A-Za-z0-9+/=]{16,}/g],
+  ['URL with credentials', /(?<=[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)[^\s@/]{4,}(?=@)/gi],
+  // an environment-style NAME (upper case): `cache_key = build(...)` and
+  // `refresh_token: string` in code are not secrets; a value never crosses a
+  // line break, so `SECRET_KEY=` at the end of a line takes nothing after it
+  ['env-style secret assign', /(?:[A-Z0-9_]*_(?:KEY|TOKEN|SECRET|PASSWORD)|aws_secret_access_key)[ \t]*[=:][ \t]*["']?[^\s"',;]{8,}/g],
+  ['password=value', /\b(?:password|passwd)[ \t]*[=:][ \t]*["']?[^\s"',;]{8,}/gi],
 ]
 
 export const SECRET_RES = PATTERNS.map(([, re]) => re)
 // non-global copies for `.test()` (a /g regex carries lastIndex state)
 export const SECRET_PATTERNS = PATTERNS.map(([name, re]) => [name, new RegExp(re.source, re.flags.replace('g', ''))])
 
-const ENV_KEYS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY', 'DASHCLAW_API_KEY', 'BATON_TOKEN', 'GITHUB_TOKEN', 'GH_TOKEN']
+const ENV_KEYS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY', 'DASHCLAW_API_KEY', 'LEG_TOKEN', 'BATON_TOKEN', 'LEG_LICENSE_PRIVATE_KEY', 'BATON_LICENSE_PRIVATE_KEY', 'GITHUB_TOKEN', 'GH_TOKEN', 'STRIPE_SECRET_KEY', 'STRIPE_TEST_SECRET_KEY', 'RESEND_API_KEY', 'NPM_TOKEN']
 let envValues = null
 function heldValues() {
   if (envValues) return envValues

package/src/resume.mjs

@@ -1,17 +1,18 @@
 // resume — the pointer that cannot describe a picture that is no longer true.
 //
-// `.baton/RESUME.md` is the file humans and other agents open by habit. It used
+// `.leg/RESUME.md` is the file humans and other agents open by habit (legacy
+// `.baton/RESUME.md` is still read). It used
 // to be an unowned convenience copy: written once per hand-off, never touched
 // again, with no stamp and no expiry, so a normally exited terminal left hours
 // old text sitting there looking live.
 //
 // Two rules fix that, and they are the whole module:
-//   1. Every resume file Baton writes carries a stamp of the git state and the
+//   1. Every resume file Leg writes carries a stamp of the git state and the
 //      live terminals it was written against (an HTML comment, invisible in
 //      rendered markdown).
 //   2. Freshness is never remembered — it is recomputed from git at READ time.
 //      A file cannot lie about HEAD to a reader who re-asks git.
-// Baton owns the file: it rewrites it when a session ends and when the board
+// Leg owns the file: it rewrites it when a session ends and when the board
 // starts, so nothing is left describing a terminal that is gone.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
@@ -24,8 +25,8 @@ export const STAMP_PREFIX = '<!-- leg-resume '
 export const LEGACY_STAMP_PREFIX = '<!-- baton-resume '
 const STAMP_SUFFIX = ' -->'
 const STAMP_VERSION = 1
-// Baton's own directories dirty the tree on every write; a reader must not see
-// Baton's bookkeeping as the human's work moving on.
+// Leg's own directories dirty the tree on every write; a reader must not see
+// Leg's bookkeeping as the human's work moving on.
 const LEG_DIRS = /^(\.leg|\.baton|\.context-handoffs|\.dashclaw-local)[\\/]/
 const MAX_REASONS = 5
 
@@ -81,6 +82,7 @@ export function perSessionFile(cwd, id) {
   if (existsSync(join(cwd, '.baton')) && !existsSync(join(cwd, '.leg'))) return baton
   return leg
 }
+export { synthesisFile } from './synthesis.mjs'
 
 // An agent started deeper in the tree still finds its checkout's pointer.
 export function findResume(startDir) {
@@ -117,7 +119,7 @@ export function readStamp(text) {
   } catch { return null }
 }
 
-// The text without its stamp: what a human reads and what `baton resume` prints.
+// The text without its stamp: what a human reads and what `leg resume` prints.
 export function bodyOf(text) {
   const s = String(text ?? '')
   return readStamp(s) ? s.slice(s.indexOf('\n') + 1).replace(/^\n+/, '') : s
@@ -200,10 +202,10 @@ export function lastHandoffIn(root, sessions = listSessions()) {
 }
 
 function idleBody(last, live) {
-  const lines = ['# Baton: nothing in flight', '']
+  const lines = ['# Leg: nothing in flight', '']
   lines.push(live.length
     ? `No hand-off is waiting to be picked up here. Still live in this checkout: ${live.map((s) => `${s.session_id} (${s.agent})`).join(', ')}.`
-    : 'No Baton terminal is live in this checkout.')
+    : 'No Leg terminal is live in this checkout.')
   lines.push('')
   if (last) {
     const at = last.at ? String(last.at).slice(0, 16).replace('T', ' ') : 'an unrecorded time'
@@ -221,7 +223,7 @@ function idleBody(last, live) {
 }
 
 // The "nothing in flight" pointer. Always writes; the callers that must not
-// create a file in a checkout Baton never handed off in check first.
+// create a file in a checkout Leg never handed off in check first.
 export function writeIdlePointer(root, { sessions = listSessions() } = {}) {
   if (!root) return null
   const dir = existsSync(join(root, '.baton')) && !existsSync(join(root, '.leg')) ? join(root, '.baton') : join(root, '.leg')
@@ -235,7 +237,7 @@ export function writeIdlePointer(root, { sessions = listSessions() } = {}) {
 }
 
 // A session ending must not leave its hand-off sitting there looking live.
-// Only ever rewrites a pointer that already exists: Baton owns RESUME.md where
+// Only ever rewrites a pointer that already exists: Leg owns RESUME.md where
 // it wrote one, and creates none in a checkout it never handed off in.
 export function endSessionPointer(session) {
   const root = workRoot(session)
@@ -243,7 +245,7 @@ export function endSessionPointer(session) {
   return writeIdlePointer(root)
 }
 
-// Board start: every checkout Baton wrote a pointer in gets it recomputed, so a
+// Board start: every checkout Leg wrote a pointer in gets it recomputed, so a
 // terminal that crashed instead of exiting cannot leave a live-looking hand-off
 // behind. A checkout whose terminal really is live keeps its hand-off text.
 // Returns the roots rewritten.
@@ -260,9 +262,9 @@ export function refreshPointers() {
     const v = resumeVerdict(root, { sessions })
     if (v.state === 'fresh') continue
     // The terminal that wrote a hand-off owns it while it is still running: its
-    // text is the live description, and "the repo moved on" is for `baton resume
+    // text is the live description, and "the repo moved on" is for `leg resume
     // --check` to report, not for the board to overwrite. Anything else — a
-    // hand-off from a terminal that is gone, a file no Baton stamped — is
+    // hand-off from a terminal that is gone, a file no Leg stamped — is
     // replaced even when some OTHER terminal happens to be live in the
     // checkout, which is the case that left three day old text sitting there.
     if (v.session?.active) continue
@@ -284,14 +286,14 @@ function describe(list) { return list.map((s) => `${s.id ?? s.session_id} (${s.a
 export function resumeVerdict(cwd, { sessions = listSessions() } = {}) {
   const found = findResume(cwd)
   if (!found) {
-    return { state: 'missing', exit_code: EXIT.missing, root: null, file: null, kind: null, stamp: null, reasons: ['there is no .baton/RESUME.md in this checkout'], summary: 'no resume pointer in this checkout', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
+    return { state: 'missing', exit_code: EXIT.missing, root: null, file: null, kind: null, stamp: null, reasons: ['there is no .leg/RESUME.md in this checkout'], summary: 'no resume pointer in this checkout', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
   }
   const { root, file } = found
   let text = ''
   try { text = readFileSync(file, 'utf8') } catch { /* raced a rewrite */ }
   const stamp = readStamp(text)
   if (!stamp) {
-    return { state: 'unstamped', exit_code: EXIT.unstamped, root, file, kind: null, stamp: null, reasons: ['this file carries no Baton stamp, so its freshness cannot be checked against git'], summary: 'cannot be checked: no Baton stamp', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
+    return { state: 'unstamped', exit_code: EXIT.unstamped, root, file, kind: null, stamp: null, reasons: ['this file carries no Leg stamp, so its freshness cannot be checked against git'], summary: 'cannot be checked: no Leg stamp', head: null, dirty: null, live: null, session: null, written_at: null, age_ms: null }
   }
 
   const now = gitState(root)

package/src/runner.mjs

@@ -129,7 +129,7 @@ function errTail(path, lines = 10) {
 
 function killTree(pid, log) {
   if ((process.env.LEG_SKIP_KILL || process.env.BATON_SKIP_KILL) === '1') { // test seam: unkillable agent
-    log('BATON_SKIP_KILL=1: killTree skipped')
+    log('LEG_SKIP_KILL=1: killTree skipped')
     return
   }
   if (process.platform === 'win32') {
@@ -151,7 +151,7 @@ function gitHead(cwd) {
 function gitDiff(cwd, headAtStart) {
   const r = spawnSync('git', ['status', '--porcelain'], { cwd, windowsHide: true, encoding: 'utf8', env: { ...process.env, MSYS_NO_PATHCONV: '1' } })
   if (r.status !== 0) return null
-  const files = r.stdout.split(/\r?\n/).filter(Boolean).filter((l) => !/\.baton[\\/]/.test(l)).length
+  const files = r.stdout.split(/\r?\n/).filter(Boolean).filter((l) => !/\.(baton|leg)[\\/]/.test(l)).length
   const head = gitHead(cwd)
   return { changed: files > 0 || (headAtStart !== null && head !== headAtStart), files, head_at_start: headAtStart, head }
 }

package/src/scheduler.mjs

@@ -46,7 +46,7 @@ export function pickRunnable(cards, { max = MAX_CONCURRENT, landing = new Set()
 
 export function pidfile() { return join(home(), 'scheduler.pid') }
 
-export function createScheduler({ max = MAX_CONCURRENT, intervalMs = 1000, actor = { type: 'baton' } } = {}) {
+export function createScheduler({ max = MAX_CONCURRENT, intervalMs = 1000, actor = { type: 'leg' } } = {}) {
   const state = { blockedKeys: new Map(), inflight: new Map(), stopped: false, ticks: 0 }
 
   async function tick() {

package/src/server.mjs

@@ -2,11 +2,11 @@
 // server — the board's HTTP + SSE backend. Ledger-backed: every handler reads
 // card.json / events-*.jsonl on demand (no module-level card store), so a
 // restart shows the same board and a second process sees the same truth.
-// BATON_BIND (127.0.0.1) + BATON_PORT (4747) + BATON_TOKEN are the
-// multiplayer seams (src/auth.mjs).
+// LEG_BIND (127.0.0.1) + LEG_PORT (4747) + LEG_TOKEN are the
+// multiplayer seams (src/auth.mjs). BATON_* names still work as fallback.
 import http from 'node:http'
-import { spawnSync } from 'node:child_process'
-import { existsSync, readFileSync, statSync, rmSync, watch as fsWatch, mkdirSync, openSync, fstatSync, readSync, closeSync } from 'node:fs'
+import { spawnSync, execFile } from 'node:child_process'
+import { existsSync, readFileSync, readdirSync, statSync, rmSync, watch as fsWatch, mkdirSync, openSync, fstatSync, readSync, closeSync } from 'node:fs'
 import { join, dirname, resolve, extname, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { checkBind, authorize, remoteAddress, presentedToken, isLoopback, isLoopbackRequest, tokenMatches } from './auth.mjs'
@@ -26,15 +26,28 @@ import { scrub } from './runner.mjs'
 import { resolveChb } from './handoff.mjs'
 import { listSessions, readSession, readEvents as readSessionEvents, requestControl, removeSession, overlaps, isActive, sessionsRoot, reapLost, readLand, readLandings, readRequests, writeRequests, appendEvent as appendSessionEvent, updateSession, HANDOFF_ORDER_CAPABILITY } from './sessions.mjs'
 import { sessionDetail, sessionDiff, DiffInputError } from './session-detail.mjs'
+import { hasRecentSynthesis } from './synthesis.mjs'
 import { refreshPointers } from './resume.mjs'
 import { landSession, landBlocker, landingNow, pruneSessionWorktree, canLand, prepareLanding, applyLandFix } from './land.mjs'
 import { readUsage, recordUsage, usageIsStale, candidates, isAvailable } from './usage.mjs'
 import { readAccounts, envFor, LAYOUT } from './accounts.mjs'
 import { readCodexUsage } from './taps/codex.mjs'
 import { readPreferences, writePreferences, normalizeHandoffOrder, requireHandoffOrder } from './preferences.mjs'
+import { listHistory, findRecord, recordDetail, refreshIndex, readIndex, providerSupport, HistoryInputError, PROVIDER_NAMES } from './history/index.mjs'
+import { listWorktrees } from './history/worktrees.mjs'
 
 const SELF = fileURLToPath(import.meta.url)
-const BOARD_DIR = join(dirname(SELF), 'board')
+export function resolveBoardDir() {
+  const dir = join(dirname(SELF), 'board')
+  if (existsSync(dir)) return dir
+  const wtMatch = /[\\/]\.(?:leg|baton)-worktrees(?:[\\/].*)?$/.exec(dirname(SELF))
+  if (wtMatch) {
+    const root = dirname(SELF).slice(0, wtMatch.index)
+    const fallback = join(root, 'src', 'board')
+    if (existsSync(fallback)) return fallback
+  }
+  return dir
+}
 const VERSION = JSON.parse(readFileSync(join(dirname(SELF), '..', 'package.json'), 'utf8')).version
 const DEFAULT_ORDER = ['plan', 'build', 'review', 'test', 'land']
 const TYPES = { '.html': 'text/html; charset=utf-8', '.css': 'text/css; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png', '.ico': 'image/x-icon', '.json': 'application/json; charset=utf-8', '.woff2': 'font/woff2' }
@@ -215,6 +228,64 @@ async function adaptersInfo() {
 }
 
 // ---- sessions (baton claude|codex|agy) ----
+// The worktree list runs git once per known repository: cached for a short
+// while so a board that polls does not fork fifty processes a second.
+const WORKTREES_TTL = 20000
+const worktreesCache = new Map()
+// A stale index is refreshed by a child `leg history refresh`, never in this
+// process: the scan stats thousands of files and walks every cwd, and inside
+// the board's event loop that is seconds of no SSE frames and no clicks. The
+// child takes the same index lock a CLI refresh would, so the two never tear
+// one file; the next listing reads what it wrote.
+const LEG_BIN = join(dirname(SELF), '..', 'bin', 'leg.mjs')
+let historyRefreshing = false
+function backgroundHistoryRefresh() {
+  if (historyRefreshing) return
+  historyRefreshing = true
+  try {
+    execFile(process.execPath, [LEG_BIN, 'history', 'refresh', '--json'], { env: process.env, windowsHide: true, timeout: 120000 }, () => { historyRefreshing = false })
+  } catch { historyRefreshing = false }
+}
+function worktreesFor({ repo = null, dirty = true } = {}) {
+  const key = `${repo ?? ''}|${dirty}`
+  const hit = worktreesCache.get(key)
+  if (hit && Date.now() - hit.at < WORKTREES_TTL) return hit.data
+  const data = listWorktrees({ repo, dirty, dirtyLimit: 20, repoLimit: 20 })
+  worktreesCache.set(key, { at: Date.now(), data })
+  return data
+}
+
+// canLand shells out to git several times for one worktree, and the view runs
+// it for every terminal that ever had one — over a second of subprocesses on a
+// board with a few dozen records, paid again on every SSE push. A terminal that
+// has ended never moves, so the answer is cached against the record's own
+// revision with the short TTL the trunk already uses, which still notices a
+// commit made by hand in the worktree within that window.
+// A terminal that is still running can change what it can land from one turn to
+// the next. One that has ended only moves if someone works in its worktree by
+// hand, and a landing clears this cache outright, so it is re-read a great deal
+// less often.
+const CAN_LAND_TTL = 15000
+const CAN_LAND_TTL_ENDED = 60000
+const canLandCache = new Map()
+function canLandFor(s) {
+  const key = `${s.session_id}|${s.updated_at ?? ''}`
+  const hit = canLandCache.get(key)
+  if (hit && Date.now() < hit.until) return hit.data
+  const data = canLand(s)
+  // Expiries are spread across the window instead of falling together: twenty
+  // worktrees re-read in one pass is another second of git inside the event
+  // loop, which is the stall this cache exists to remove. Staggered, the board
+  // pays for about one of them per push and never blocks on the set.
+  const ttl = isActive(s) ? CAN_LAND_TTL : CAN_LAND_TTL_ENDED
+  const until = Date.now() + ttl / 2 + Math.random() * ttl
+  // the key carries updated_at, so a busy terminal leaves a dead entry per
+  // write: drop the whole map rather than grow it for the life of the process
+  if (canLandCache.size > 500) canLandCache.clear()
+  canLandCache.set(key, { until, data })
+  return data
+}
+
 const trunkCache = new Map()
 function trunkFor(repo) {
   const hit = trunkCache.get(repo)
@@ -258,6 +329,8 @@ function redactSession(s) {
     // the branch is already on the worktree chip: naming it again costs nothing
     // and is what the board's land line reads
     land: s.land ? { state: s.land.state, branch: s.land.branch ?? null, base: s.land.base ?? null, sha: s.land.sha ?? null, reason: s.land.reason ?? null } : null,
+    // the chip's word only: paths, dropped items and attention text stay on this machine
+    harness: s.harness ? { state: s.harness.state, target: s.harness.target ?? null } : null,
     task: null, cwd: null, files: [], overlap: [], requests: [], hidden: true,
     land_blocker: `read-only: this terminal belongs to ${s.owner ?? 'someone else'}`,
   }
@@ -280,7 +353,7 @@ export function sessionsView({ viewer = null, share = null } = {}) {
     const preferredNext = chain[0] ?? null
     const availabilityKnown = Boolean(s.installed)
     const eligibleNext = availabilityKnown ? (chain.find((next) => s.installed[next.agent] !== false && isAvailable(readUsage(next.agent, next.account))) ?? null) : null
-    const can = s.worktree ? canLand(s) : { ok: false, blockers: [{ code: 'no_worktree', message: 'this terminal works in the checkout itself: there is no branch of its own to land', fix: null }] }
+    const can = s.worktree ? canLandFor(s) : { ok: false, blockers: [{ code: 'no_worktree', message: 'this terminal works in the checkout itself: there is no branch of its own to land', fix: null }] }
     return {
       ...s,
       handoff_order: handoffOrder,
@@ -290,6 +363,7 @@ export function sessionsView({ viewer = null, share = null } = {}) {
       handoff_availability_known: availabilityKnown,
       can_edit_handoff_order: s.runtime_capabilities?.includes(HANDOFF_ORDER_CAPABILITY) ?? false,
       active: isActive(s),
+      has_synthesis: hasRecentSynthesis(s),
       overlap: ov.get(s.session_id) ?? [],
       elapsed_ms: Date.now() - Date.parse(s.started_at),
       // Older attached Codex processes can retain one parser mistake where an
@@ -352,16 +426,17 @@ function readBody(req) {
 }
 
 function serveStatic(res, urlPath) {
-  const map = { '/': 'index.html', '/floor': 'floor.html' }
+  const map = { '/': 'index.html', '/board': 'index.html', '/board/': 'index.html', '/floor': 'floor.html', '/floor/': 'floor.html' }
   const rel = map[urlPath] ?? urlPath.replace(/^\/+/, '')
-  const file = resolve(BOARD_DIR, rel)
-  if (!file.startsWith(BOARD_DIR + sep) || !existsSync(file) || !statSync(file).isFile()) return send(res, 404, 'not found')
+  const boardDir = resolveBoardDir()
+  const file = resolve(boardDir, rel)
+  if (!file.startsWith(boardDir + sep) || !existsSync(file) || !statSync(file).isFile()) return send(res, 404, 'not found')
   res.writeHead(200, { 'Content-Type': TYPES[extname(file)] ?? 'application/octet-stream', 'Cache-Control': 'no-store' })
   res.end(readFileSync(file))
 }
 
 // ---- SSE: watch $BATON_HOME/cards for fs events and push only what changed ----
-function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () => sessionsView(), reauth = (c) => c.viewer } = {}) {
+function createSse({ healthIntervalMs = 10000, debounceMs = 30, sessionsDebounceMs = 300, sessionsMinIntervalMs = 2000, viewFor = () => sessionsView(), reauth = (c) => c.viewer } = {}) {
   const clients = new Set() // { res, viewer, token, loopback, sig }
   let watcher = null
   let healthTimer = null
@@ -411,13 +486,70 @@ function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () =>
   }
   let sessionsWatcher = null
   let sessionsTimer = null
-  const pushSessions = () => { sessionsTimer = null; try { broadcast('sessions', (viewer) => viewFor(viewer)) } catch (err) { log(`sessions view: ${err.message}`) } }
+  let lastSessionsPush = 0
+  const pushSessions = () => {
+    sessionsTimer = null
+    try { broadcast('sessions', (viewer) => viewFor(viewer)) } catch (err) { log(`sessions view: ${err.message}`) }
+    lastSessionsPush = Date.now()
+    // the health tick pushes on its own schedule: record what it sent, so the
+    // next watcher hint is measured against the page's real contents
+    lastFingerprint = sessionsFingerprint()
+  }
+  // One live agent rewrites its record about every six seconds and takes a
+  // control lock about once a second, and every one of those touches the
+  // sessions tree. Rebuilding the whole view costs a second or more of `git`,
+  // so a watcher that answers every touch turns a single running terminal into
+  // a permanent busy loop on the one event loop this board serves every
+  // request from: the board then takes seconds to hand over a stylesheet and
+  // `leg` itself times out probing /api/health.
+  //
+  // A watcher event is only a hint. Locks and the temp files an atomic write
+  // leaves behind are dropped by name, but taking a lock inside a session
+  // directory also changes that directory's own mtime, and that event arrives
+  // carrying nothing but the directory name — no filter on the name can tell
+  // it from a real write. So the hint is checked against the data: a stat over
+  // the files the view is actually built from costs a fraction of a
+  // millisecond and answers the question the event cannot.
+  const NOISE = /(\.lock|\.tmp)$/i
+  const sessionsChangeMatters = (filename) => !filename || !NOISE.test(String(filename))
+  const sessionsFingerprint = () => {
+    const root = sessionsRoot()
+    let dirs
+    try { dirs = readdirSync(root) } catch { return '' }
+    let sig = ''
+    for (const name of dirs) {
+      if (!name.startsWith('s-')) continue
+      for (const file of ['session.json', 'land.json', 'requests.json']) {
+        try { const st = statSync(join(root, name, file)); sig += `${name}/${file}:${st.mtimeMs}:${st.size};` } catch { /* not written yet */ }
+      }
+    }
+    return sig
+  }
+  let lastFingerprint = null
+  const pushIfChanged = () => {
+    sessionsTimer = null
+    const sig = sessionsFingerprint()
+    // the hint was noise: the view would rebuild to exactly what the page
+    // already has, so nothing is rebuilt and nothing is sent
+    if (sig === lastFingerprint) return
+    lastFingerprint = sig
+    pushSessions()
+  }
+  const scheduleSessionsPush = () => {
+    if (sessionsTimer) return
+    const wait = Math.max(sessionsDebounceMs, sessionsMinIntervalMs - (Date.now() - lastSessionsPush))
+    sessionsTimer = setTimeout(pushIfChanged, wait)
+  }
   const startWatch = () => {
     if (watcher) return
     try {
       const sdir = sessionsRoot()
       mkdirSync(sdir, { recursive: true })
-      sessionsWatcher = fsWatch(realPath(sdir), { recursive: true }, () => { if (!sessionsTimer) sessionsTimer = setTimeout(pushSessions, 300) })
+      // the client that opened this watch was handed the current view with its
+      // hello frame, so the fingerprint starts from what it already has: an
+      // unprimed one makes the first hint of any kind look like a change
+      lastFingerprint = sessionsFingerprint()
+      sessionsWatcher = fsWatch(realPath(sdir), { recursive: true }, (_event, filename) => { if (sessionsChangeMatters(filename)) scheduleSessionsPush() })
     } catch (err) { log(`sessions watch: ${err.message}`); sessionsWatcher = null }
     // watch the real long path: libuv's recursive watcher asserts when the
     // watched dir is an 8.3 short path (fs-event.c, seen on a GitHub runner)
@@ -460,7 +592,7 @@ function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () =>
 // ---- the server ----
 export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN || process.env.BATON_TOKEN || '', scheduler = (process.env.LEG_NO_SCHEDULER || process.env.BATON_NO_SCHEDULER) !== '1', share, usagePolling = false, usageReader = readCodexUsage } = {}) {
   // An explicit `share` (tests) is fixed; the real server passes none and reads
-  // share.json from disk, re-reading it per request (mtime-cached) so `baton
+  // share.json from disk, re-reading it per request (mtime-cached) so `leg
   // share add|rotate|rm` takes effect on a live board — a new link works at
   // once and a removed or rotated one stops at once — without a restart.
   const explicitShare = share !== undefined
@@ -560,7 +692,9 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
     const guest = shared && viewer.role !== 'owner'
     const ownsSession = (s) => !shared || viewer.role === 'owner' || (s.owner ?? share.owner) === viewer.name
     const parts = path.split('/').filter(Boolean) // ['api', ...]
-    if (guest && ['cards', 'floor', 'presets', 'adapters', 'leases', 'trunk'].includes(parts[1])) return send(res, 403, { error: 'the pipeline board belongs to the owner of this machine' })
+    // history and worktrees are the whole machine's project map (every path,
+    // every conversation on it): the owner's, never a guest's, as a group
+    if (guest && ['cards', 'floor', 'presets', 'adapters', 'leases', 'trunk', 'history', 'worktrees'].includes(parts[1])) return send(res, 403, { error: 'the pipeline board belongs to the owner of this machine' })
     try {
       if (req.method === 'GET' && path === '/api/health') {
         const you = { ...viewer, share: { on: shared, people: shared ? share.people.length : 0 } }
@@ -599,7 +733,20 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
         if (req.method === 'POST' || req.method === 'PATCH') {
           const body = await readBody(req)
           try {
-            const preferences = writePreferences({ handoff_order: requireHandoffOrder(body.handoff_order) })
+            const patch = {}
+            if (body.handoff_order !== undefined) patch.handoff_order = requireHandoffOrder(body.handoff_order)
+            if (body.harness !== undefined) {
+              // the board may narrow the policy or turn the feature off; turning
+              // it on is the first-run consent flow, which shows what will be
+              // written before it writes (leg harness enable)
+              if (body.harness?.enabled === true) return send(res, 400, { error: 'turn the portable harness on from a terminal: leg harness enable shows what it will write before it writes it' })
+              const rank = ['warn', 'sync', 'strict']
+              const current = readPreferences().harness
+              if (body.harness?.policy !== undefined && rank.indexOf(body.harness.policy) > rank.indexOf(current.policy)) return send(res, 400, { error: `the board may only narrow the harness policy (now ${current.policy}); widen it from a terminal: leg harness policy ${body.harness.policy}` })
+              patch.harness = { policy: body.harness?.policy, enabled: body.harness?.enabled === false ? false : undefined }
+            }
+            if (!Object.keys(patch).length) return send(res, 400, { error: 'nothing to change: send handoff_order or harness' })
+            const preferences = writePreferences(patch)
             sse.broadcast('sessions', (v) => viewFor(v))
             return send(res, 200, { preferences })
           } catch (err) {
@@ -710,7 +857,9 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
           if (why) return send(res, 409, { error: why })
           landSession(sess, { by: actor.id, autoCommit: true })
             .catch((err) => log(`land ${id}: ${err.message}`))
-            .finally(() => { trunkCache.clear(); try { sse.broadcast('sessions', (v) => viewFor(v)) } catch {} })
+            // a landing moves the branch under every worktree cut from it, so
+            // the cached land-ability goes with the cached trunk
+            .finally(() => { trunkCache.clear(); canLandCache.clear(); try { sse.broadcast('sessions', (v) => viewFor(v)) } catch {} })
           log(`land requested for ${id} by ${actor.id}`)
           return send(res, 202, { ok: true, requested: 'land' })
         }
@@ -738,6 +887,63 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
           return send(res, 200, { removed: id, worktree })
         }
       }
+      // ---- history: the read-only index over every agent's own store ----
+      if (parts[1] === 'history') {
+        const q = url.searchParams
+        const int = (v, def, max) => { const n = parseInt(v ?? '', 10); return Number.isFinite(n) && n >= 0 ? Math.min(n, max) : def }
+        if (req.method === 'GET' && parts.length === 2) {
+          const provider = q.get('provider') || null
+          if (provider && provider.split(',').some((p) => !PROVIDER_NAMES.includes(p.trim()))) return send(res, 400, { error: `unknown provider in "${provider}" (${PROVIDER_NAMES.join('|')})` })
+          const tri = (v) => (v === '1' || v === 'true' ? true : v === '0' || v === 'false' ? false : null)
+          const explicitRefresh = tri(q.get('refresh')) === true
+          let refreshArg = null
+          if (!explicitRefresh) {
+            const idx = readIndex()
+            if (idx) {
+              const age = idx.refreshed_at ? Date.now() - Date.parse(idx.refreshed_at) : Infinity
+              if (age > 60000) backgroundHistoryRefresh()
+              refreshArg = false
+            }
+          } else {
+            refreshArg = true
+          }
+          return send(res, 200, listHistory({
+            provider, repo: q.get('repo') || null, search: q.get('search') || null,
+            before: q.get('before') || null,
+            // never the whole index in one response: a page is 1 to 200 rows
+            limit: Math.max(1, int(q.get('limit'), 50, 200)), offset: int(q.get('offset'), 0, 1e6),
+            managed: tri(q.get('managed')), live: tri(q.get('live')), includeHidden: tri(q.get('hidden')) === true,
+            refresh: refreshArg,
+          }))
+        }
+        if (req.method === 'GET' && parts[2] === 'providers') return send(res, 200, { providers: providerSupport() })
+        if (req.method === 'POST' && parts[2] === 'refresh') {
+          const body = await readBody(req)
+          const t = Date.now()
+          try {
+            const r = refreshIndex({ force: body.full === true })
+            return send(res, 200, { ms: Date.now() - t, refreshed_at: r.index.refreshed_at, stats: r.stats })
+          } catch (err) { return send(res, 409, { error: `refresh did not run: ${err.message}` }) }
+        }
+        if (req.method === 'GET' && parts.length === 3) {
+          // the id is a lookup key, never a path: findRecord compares strings,
+          // and the transcript it names is read only from inside a known store
+          let rec
+          let wanted
+          try { wanted = decodeURIComponent(parts[2]) } catch { return send(res, 400, { error: 'malformed id' }) }
+          try { rec = findRecord(wanted, { refresh: false }) } catch (err) {
+            if (err instanceof HistoryInputError) return send(res, 400, { error: err.message })
+            throw err
+          }
+          if (!rec) return send(res, 404, { error: `no conversation matches ${parts[2]}` })
+          return send(res, 200, recordDetail(rec, { messages: int(q.get('messages'), 8, 50) }))
+        }
+        return send(res, 404, { error: 'not found' })
+      }
+      if (req.method === 'GET' && path === '/api/worktrees') {
+        const q = url.searchParams
+        return send(res, 200, worktreesFor({ repo: q.get('repo') || null, dirty: q.get('dirty') !== '0' }))
+      }
       if (req.method === 'GET' && path === '/api/floor') return send(res, 200, floor(listCards()))
       if (req.method === 'GET' && path === '/api/trunk') return send(res, 200, trunk(listCards(), parseSince(url.searchParams.get('since'))))
       if (req.method === 'GET' && path === '/api/leases') return send(res, 200, { leases: held(listCards()) })
@@ -814,12 +1020,12 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
           const addr = server.address()
           log(`listening on http://${bind}:${addr.port} (home ${home()}${token ? ', token required' : ', loopback open'})`)
           // A terminal that crashed instead of exiting left its hand-off in
-          // .baton/RESUME.md looking live. The board is the thing that starts
+          // .leg/RESUME.md looking live. The board is the thing that starts
           // after a crash, so it is where that gets corrected.
           setImmediate(() => {
             try {
               const touched = refreshPointers()
-              if (touched.length) log(`rewrote ${touched.length} stale resume pointer${touched.length === 1 ? '' : 's'}: the terminal each described is gone, or no Baton stamped it`)
+              if (touched.length) log(`rewrote ${touched.length} stale resume pointer${touched.length === 1 ? '' : 's'}: the terminal each described is gone, or no Leg stamped it`)
             } catch (err) { log(`resume pointers not refreshed: ${err.message}`) }
           })
           if (scheduler) {