@ucsandman/legcli 0.8.0 → 0.9.0

package/scripts/npm-publish-gate.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// Registry gate for a main-branch publish. Checks @ucsandman/legcli and
+// leg-agents, refuses to ship if their versions differ, and writes
+// GITHUB_OUTPUT so ci.yml can publish only the missing package(s).
+// Fail closed: network errors, invalid JSON, prereleases, stale versions,
+// and metadata drift exit 1.
+import { appendFileSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+const EXPECTED_REPOSITORY = 'https://github.com/ucsandman/legcli.git'
+const PRIMARY_NAME = '@ucsandman/legcli'
+const ALIAS_NAME = 'leg-agents'
+
+const fail = (message) => { throw new Error(message) }
+
+const stableVersion = (value) => {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value)
+  if (!match) return null
+  const parts = match.slice(1).map(Number)
+  return parts.every(Number.isSafeInteger) ? parts : null
+}
+
+const writeOutput = (name, value) => {
+  if (process.env.GITHUB_OUTPUT) appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`)
+  console.log(`${name}=${value}`)
+}
+
+async function registryStatus (name, version) {
+  const candidate = stableVersion(version)
+  if (!candidate) fail(`invalid stable package version: ${name}@${version}`)
+  const url = `https://registry.npmjs.org/${encodeURIComponent(name)}/${encodeURIComponent(version)}`
+  let response
+  try {
+    response = await fetch(url, { headers: { Accept: 'application/json' } })
+  } catch (error) {
+    fail(`npm registry request failed for ${name}@${version}: ${error.message}`)
+  }
+
+  if (response.status === 404) {
+    let packageResponse
+    try {
+      packageResponse = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`, { headers: { Accept: 'application/json' } })
+    } catch (error) {
+      fail(`npm package metadata request failed for ${name}: ${error.message}`)
+    }
+    if (packageResponse.status === 404) {
+      console.log(`${name}@${version} is missing (package not yet on npm); publication is required`)
+      return false
+    }
+    if (packageResponse.status !== 200) {
+      fail(`npm package metadata for ${name} returned unexpected status ${packageResponse.status}`)
+    }
+    let metadata
+    try {
+      metadata = await packageResponse.json()
+    } catch {
+      fail(`npm package metadata for ${name} returned invalid JSON`)
+    }
+    const latestText = metadata?.['dist-tags']?.latest
+    const latest = stableVersion(latestText)
+    if (!latest) fail(`npm latest tag for ${name} is not a stable version: ${latestText ?? '(missing)'}`)
+    const changedPart = candidate.findIndex((part, index) => part !== latest[index])
+    const newer = changedPart !== -1 && candidate[changedPart] > latest[changedPart]
+    if (!newer) fail(`refusing to publish missing ${name}@${version} because npm latest is ${latestText}`)
+    console.log(`${name}@${version} is missing and newer than npm latest ${latestText}; publication is required`)
+    return false
+  }
+  if (response.status !== 200) fail(`npm registry returned unexpected status ${response.status} for ${name}@${version}`)
+  let published
+  try {
+    published = await response.json()
+  } catch {
+    fail(`npm registry returned invalid JSON for existing ${name}@${version}`)
+  }
+  if (published?.name !== name || published?.version !== version) {
+    fail(`npm registry response did not match the requested ${name}@${version}`)
+  }
+  console.log(`${name}@${version} already exists; skipping publication`)
+  return true
+}
+
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+const lock = JSON.parse(readFileSync(join(root, 'package-lock.json'), 'utf8'))
+const alias = JSON.parse(readFileSync(join(root, 'packages', 'leg-agents', 'package.json'), 'utf8'))
+const lockRoot = lock.packages?.['']
+
+try {
+  if (!lockRoot || pkg.name !== PRIMARY_NAME || lockRoot.name !== pkg.name || lockRoot.version !== pkg.version || lock.version !== pkg.version) {
+    fail('package.json and package-lock.json root metadata do not match')
+  }
+  if (pkg.repository?.url !== EXPECTED_REPOSITORY || lockRoot.repository?.url !== EXPECTED_REPOSITORY) {
+    fail('package repository metadata does not match the npm trusted publisher binding')
+  }
+  if (alias.name !== ALIAS_NAME) fail(`alias package name is ${alias.name}, expected ${ALIAS_NAME}`)
+  if (alias.version !== pkg.version) {
+    fail(`refusing to publish: ${ALIAS_NAME}@${alias.version} is not in lockstep with ${PRIMARY_NAME}@${pkg.version}`)
+  }
+  if (alias.dependencies?.[PRIMARY_NAME] !== pkg.version) {
+    fail(`refusing to publish: ${ALIAS_NAME} pins ${PRIMARY_NAME}@${alias.dependencies?.[PRIMARY_NAME] ?? '(missing)'}, expected ${pkg.version}`)
+  }
+  if (alias.repository?.url !== EXPECTED_REPOSITORY) {
+    fail('alias package repository metadata does not match the npm trusted publisher binding')
+  }
+
+  const primaryPublished = await registryStatus(pkg.name, pkg.version)
+  const aliasPublished = await registryStatus(alias.name, alias.version)
+  writeOutput('published', String(primaryPublished))
+  writeOutput('alias_published', String(aliasPublished))
+} catch (error) {
+  console.error(`registry gate failed: ${error.message}`)
+  process.exitCode = 1
+}

package/scripts/probe.mjs

@@ -13,7 +13,7 @@ import { scrub } from '../src/runner.mjs'
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const SRC = join(ROOT, 'src')
-const HOME = process.env.BATON_HOME || join(homedir(), '.baton')
+const HOME = process.env.LEG_HOME || process.env.BATON_HOME || (existsSync(join(homedir(), '.leg')) ? join(homedir(), '.leg') : existsSync(join(homedir(), '.baton')) ? join(homedir(), '.baton') : join(homedir(), '.leg'))
 
 const args = {}
 const argv = process.argv.slice(2)
@@ -28,11 +28,12 @@ const timeoutS = parseInt(args['timeout-s'] ?? '300', 10)
 const adapter = await getAdapter(name)
 const mode = args.mode ?? adapter.modes.default
 
-const PROMPT = `Create a file named hello-${name}.txt in the current directory containing exactly the word hi. Then create the directory .baton if it is missing and write the file .baton/DONE containing the single line: done. Do nothing else. Do not ask questions.\n`
+const PROMPT = `Create a file named hello-${name}.txt in the current directory containing exactly the word hi. Then create the directory .leg if it is missing and write the file .leg/DONE containing the single line: done. Do nothing else. Do not ask questions.\n`
 
 const node = (script, a) => execFileSync(process.execPath, [script, ...a], { encoding: 'utf8', env: process.env })
 
 // Fresh DONE marker per probe so "done=yes" is this CLI's own work.
+rmSync(join(repo, '.leg', 'DONE'), { force: true })
 rmSync(join(repo, '.baton', 'DONE'), { force: true })
 rmSync(join(repo, `hello-${name}.txt`), { force: true })
 
@@ -84,7 +85,7 @@ const textOf = (f) => (existsSync(join(runDir, f)) ? readFileSync(join(runDir, f
 const authSource = /another auth source/i.test(textOf('err.log') + textOf('out.log'))
 const file = existsSync(join(repo, `hello-${name}.txt`))
   && readFileSync(join(repo, `hello-${name}.txt`), 'utf8').trim() === 'hi'
-const done = existsSync(join(repo, '.baton', 'DONE'))
+const done = existsSync(join(repo, '.leg', 'DONE')) || existsSync(join(repo, '.baton', 'DONE'))
 const exit = run?.status === 'exited' ? run.exit_code : `${run?.status ?? 'unknown'}`
 const parsed = adapter.parseResult(textOf('out.log'))
 writeFileSync(join(out, 'parsed.json'), scrubPaths(JSON.stringify({ ...parsed, raw: undefined }, null, 2)) + '\n')

package/scripts/seed-fake-cards.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// seed-fake-cards — fills a BATON_HOME with N backlog cards (fake chain, build
+// seed-fake-cards — fills a LEG_HOME with N backlog cards (fake chain, build
 // pipeline) through the same path the CLI uses (src/cards.mjs createCard), for
 // perf tests and manual board load-testing.
 //   node scripts/seed-fake-cards.mjs --home <dir> --repo <git repo path> --count 50
@@ -19,8 +19,9 @@ if (!args.home) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir>
 if (!args.repo) { process.stderr.write('usage: seed-fake-cards.mjs --home <dir> --repo <git repo path> [--count 50]\n'); process.exit(2) }
 const count = parseInt(args.count ?? '50', 10) || 50
 
-// BATON_HOME must be set before store.mjs (and the ledger.mjs it imports) load.
-process.env.BATON_HOME = resolve(args.home)
+// LEG_HOME must be set before store.mjs (and the ledger.mjs it imports) load.
+process.env.LEG_HOME = resolve(args.home)
+process.env.BATON_HOME = process.env.LEG_HOME
 const { createCard } = await import('../src/cards.mjs')
 
 const TITLES = ['Add retry to fetch', 'Fix flaky lease test', 'Refactor log tail', 'Wire up SSE health', 'Trim README', 'Bump adapter timeout', 'Dedupe blocked events', 'Guard null station', 'Speed up card list', 'Polish error copy']

package/scripts/seed-floor-board.mjs

@@ -1,16 +1,17 @@
-// Seeds a throwaway BATON_HOME with a floor that has something in every lane:
+// Seeds a throwaway LEG_HOME with a floor that has something in every lane:
 // two cards running, two waiting on a human, one queued and blocked by a lease
 // another card holds, and a landing on the trunk. The floor is derived entirely
 // from card records and their events (server.mjs floor()), so the states are
 // written straight to the ledger rather than driven through real runs.
 //
-//   BATON_HOME=<dir> node scripts/seed-floor-board.mjs <repo path>
+//   LEG_HOME=<dir> node scripts/seed-floor-board.mjs <repo path>
 //
-// Serve it on a spare port with BATON_TRUST=never. NEVER 4747.
+// Serve it on a spare port with LEG_TRUST=never. NEVER 4747.
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 
-process.env.BATON_HOME ||= join(tmpdir(), 'baton-floor-board')
+process.env.LEG_HOME ||= process.env.BATON_HOME || join(tmpdir(), 'leg-floor-board')
+process.env.BATON_HOME ||= process.env.LEG_HOME
 const repo = process.argv[2] || join(tmpdir(), 'toy-demo')
 const { createCard } = await import('../src/cards.mjs')
 const { ledgerAppend, ledgerUpdate, cardDir } = await import('../src/store.mjs')

package/scripts/seed-wes-board.mjs

@@ -1,6 +1,6 @@
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-// Seeds a throwaway BATON_HOME shaped like a real working board: a few live
+// Seeds a throwaway LEG_HOME shaped like a real working board: a few live
 // terminals and a larger pile of lost and ended ones, long absolute temp paths,
 // and an image tag in a prompt.
 //
@@ -10,12 +10,13 @@ import { tmpdir } from 'node:os'
 // fixture cost more than any other mistake in the v4 redesign.
 //
 //   node scripts/seed-wes-board.mjs                 # seeds ./scripts/wes-home
-//   BATON_HOME=<dir> node scripts/seed-wes-board.mjs
+//   LEG_HOME=<dir> node scripts/seed-wes-board.mjs
 //
-// Serve it on an isolated port with a throwaway BATON_HOME and BATON_TRUST=never.
+// Serve it on an isolated port with a throwaway LEG_HOME and LEG_TRUST=never.
 // NEVER 4747: that is the operator's live board with real sessions on it.
 // a throwaway home under the OS temp dir, so nothing is written into the repo
-process.env.BATON_HOME ||= join(tmpdir(), 'baton-seed-board')
+process.env.LEG_HOME ||= process.env.BATON_HOME || join(tmpdir(), 'leg-seed-board')
+process.env.BATON_HOME ||= process.env.LEG_HOME
 const { createSession, updateSession } = await import('../src/sessions.mjs')
 const { recordUsage, markLimited } = await import('../src/usage.mjs')
 const { spawn } = await import('node:child_process')

package/scripts/stripe-setup.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Create (idempotently) the two Baton plans in Stripe, their payment links,
+// Create (idempotently) the two Leg plans in Stripe, their payment links,
 // and the webhook endpoint for the site. Test mode by default, --live for the
 // live account. Secrets never print: the webhook signing secret and the link
 // URLs are written to .env (gitignored); ids and public URLs print.

package/scripts/sync-harness-engine.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+// sync-harness-engine — the one way the vendored harness engine changes.
+//
+// Leg's portable-harness subsystem (src/harness/) runs the Agnostic AI port
+// engine (MIT, github.com/ucsandman/Agnostic-AI) as a library. The engine is
+// copied byte for byte into src/harness/vendor/agnostic-ai/ so the package has
+// no runtime dependency and no build step, and this script is the only thing
+// that writes there:
+//
+//   node scripts/sync-harness-engine.mjs <path-to-agnostic-ai-checkout>
+//       copy the engine files, record the upstream commit and every file's
+//       sha256 in src/harness/vendor/agnostic-ai/UPSTREAM.json
+//   node scripts/sync-harness-engine.mjs --check
+//       verify every vendored file still matches the recorded hash (runs in
+//       `npm test`); a hand edit under vendor/ fails the build, because a
+//       fix belongs upstream and then here through this script
+//   node scripts/sync-harness-engine.mjs --diff <path-to-agnostic-ai-checkout>
+//       list vendored files that differ from that checkout (exit 1 if any)
+//
+// Every verdict prints the number of files it looked at.
+import { createHash } from 'node:crypto'
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+export const VENDOR_DIR = join(ROOT, 'src', 'harness', 'vendor', 'agnostic-ai')
+export const MANIFEST = join(VENDOR_DIR, 'UPSTREAM.json')
+
+// What Leg embeds: the engine as a library plus the two data files it reads by
+// default and the hook shim its targets point at. The repo's own CLI
+// (engine/harness/cli.cjs) and everything outside engine/harness stay upstream.
+export const FILES = [
+  'LICENSE',
+  'engine/harness/README.md',
+  'engine/harness/index.cjs',
+  'engine/harness/common.cjs',
+  'engine/harness/bundle.cjs',
+  'engine/harness/capture.cjs',
+  'engine/harness/apply.cjs',
+  'engine/harness/status.cjs',
+  'engine/harness/toml.cjs',
+  'engine/harness/sources/claude.cjs',
+  'engine/harness/sources/codex.cjs',
+  'engine/harness/targets/generic.cjs',
+  'engine/harness/targets/claude.cjs',
+  'engine/harness/targets/codex.cjs',
+  'engine/harness/targets/gemini.cjs',
+  'engine/harness/targets/agy.cjs',
+  'engine/harness/targets/cursor.cjs',
+  'engine/hooks/shim.cjs',
+  'core/templates/targets.json',
+  'core/safety/guards.json',
+]
+
+const posix = (p) => p.replace(/\\/g, '/')
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex')
+// Line endings are normalised before hashing so a checkout with autocrlf and one
+// without agree on what "identical" means.
+const hashFile = (file) => sha256(readFileSync(file).toString('latin1').replace(/\r\n/g, '\n'))
+
+function git(cwd, args) {
+  try { return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() } catch { return null }
+}
+
+function walk(dir, out = []) {
+  for (const name of readdirSync(dir)) {
+    const full = join(dir, name)
+    if (statSync(full).isDirectory()) walk(full, out)
+    else out.push(full)
+  }
+  return out
+}
+
+export function readManifest() {
+  return JSON.parse(readFileSync(MANIFEST, 'utf8'))
+}
+
+export function sync(upstream) {
+  const src = resolve(upstream)
+  for (const rel of FILES) if (!existsSync(join(src, rel))) throw new Error(`upstream is missing ${rel}: ${src}`)
+  if (existsSync(VENDOR_DIR)) {
+    for (const f of walk(VENDOR_DIR)) if (posix(relative(VENDOR_DIR, f)) !== 'UPSTREAM.json') rmSync(f, { force: true })
+  }
+  const files = {}
+  for (const rel of FILES) {
+    const dest = join(VENDOR_DIR, rel)
+    mkdirSync(dirname(dest), { recursive: true })
+    copyFileSync(join(src, rel), dest)
+    files[rel] = hashFile(dest)
+  }
+  const commit = git(src, ['rev-parse', 'HEAD'])
+  const dirty = git(src, ['status', '--porcelain']) || ''
+  const manifest = {
+    _comment: 'Written by scripts/sync-harness-engine.mjs; never edited by hand. Every file under this directory is a byte-for-byte copy of the Agnostic AI engine at the commit below, and `npm test` fails if one drifts.',
+    upstream: 'https://github.com/ucsandman/Agnostic-AI',
+    license: 'MIT (see LICENSE beside this file)',
+    commit,
+    upstreamDirty: Boolean(dirty.split('\n').filter(Boolean).some((l) => FILES.some((rel) => l.endsWith(rel)))),
+    syncedAt: new Date().toISOString(),
+    files,
+  }
+  writeFileSync(MANIFEST, JSON.stringify(manifest, null, 2) + '\n')
+  return manifest
+}
+
+export function check() {
+  const manifest = readManifest()
+  const problems = []
+  let checked = 0
+  for (const [rel, hash] of Object.entries(manifest.files)) {
+    checked++
+    const file = join(VENDOR_DIR, rel)
+    if (!existsSync(file)) { problems.push(`${rel}: missing`); continue }
+    if (hashFile(file) !== hash) problems.push(`${rel}: differs from the recorded upstream hash (edit upstream, then re-run the sync)`)
+  }
+  for (const f of walk(VENDOR_DIR)) {
+    const rel = posix(relative(VENDOR_DIR, f))
+    if (rel === 'UNOWNED' || rel === 'UPSTREAM.json') continue
+    checked++
+    if (!manifest.files[rel]) problems.push(`${rel}: not in UPSTREAM.json (only the sync script adds files here)`)
+  }
+  return { problems, checked, commit: manifest.commit }
+}
+
+export function diff(upstream) {
+  const manifest = readManifest()
+  const src = resolve(upstream)
+  const changed = []
+  let checked = 0
+  for (const rel of Object.keys(manifest.files)) {
+    checked++
+    const theirs = join(src, rel)
+    if (!existsSync(theirs)) { changed.push(`${rel}: gone upstream`); continue }
+    if (hashFile(theirs) !== hashFile(join(VENDOR_DIR, rel))) changed.push(rel)
+  }
+  return { changed, checked, commit: git(src, ['rev-parse', 'HEAD']) }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const [mode, arg] = process.argv.slice(2)
+  if (mode === '--check') {
+    const r = check()
+    for (const p of r.problems) process.stdout.write(`  ${p}\n`)
+    process.stdout.write(`harness-engine: ${r.problems.length ? 'DRIFT' : 'ok'} checked=${r.checked} upstream=${r.commit ?? 'unknown'}\n`)
+    process.exit(r.problems.length ? 1 : 0)
+  }
+  if (mode === '--diff') {
+    if (!arg) { process.stderr.write('usage: sync-harness-engine.mjs --diff <agnostic-ai checkout>\n'); process.exit(2) }
+    const r = diff(arg)
+    for (const p of r.changed) process.stdout.write(`  ${p}\n`)
+    process.stdout.write(`harness-engine: ${r.changed.length} of ${r.checked} vendored file(s) differ from ${arg} (${r.commit ?? 'no git'})\n`)
+    process.exit(r.changed.length ? 1 : 0)
+  }
+  if (!mode || mode.startsWith('--')) { process.stderr.write('usage: sync-harness-engine.mjs <agnostic-ai checkout> | --check | --diff <checkout>\n'); process.exit(2) }
+  const m = sync(mode)
+  process.stdout.write(`harness-engine: vendored ${Object.keys(m.files).length} file(s) from ${m.commit ?? 'no git'}${m.upstreamDirty ? ' (upstream working tree had uncommitted engine changes)' : ''}\n`)
+}

package/scripts/sync-leg-agents.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// Keep packages/leg-agents on the same version as @ucsandman/legcli.
+// Source of truth: the root package.json version and engines.node.
+//
+//   node scripts/sync-leg-agents.mjs          write version, pin, LICENSE, NOTICE
+//   node scripts/sync-leg-agents.mjs --check  exit 1 if any of those drifted
+//
+// npm test runs --check. `npm version` runs the writer so a bump cannot
+// leave the alias behind.
+import { copyFileSync, readFileSync, writeFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { resolveCommand } from '../src/commands.mjs'
+
+export const ALIAS_NAME = 'leg-agents'
+export const PRIMARY_NAME = '@ucsandman/legcli'
+export const PACKED_FILES = ['package.json', 'bin/leg.mjs', 'LICENSE', 'NOTICE', 'README.md']
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+export function inspect (rootDir = root) {
+  const alias = join(rootDir, 'packages', 'leg-agents')
+  const rootPkg = JSON.parse(readFileSync(join(rootDir, 'package.json'), 'utf8'))
+  const aliasPkg = JSON.parse(readFileSync(join(alias, 'package.json'), 'utf8'))
+  const wrapper = readFileSync(join(alias, 'bin', 'leg.mjs'), 'utf8')
+  const rootLicense = readFileSync(join(rootDir, 'LICENSE'))
+  const rootNotice = readFileSync(join(rootDir, 'NOTICE'))
+  const aliasLicense = readFileSync(join(alias, 'LICENSE'))
+  const aliasNotice = readFileSync(join(alias, 'NOTICE'))
+  const problems = []
+
+  if (rootPkg.name !== PRIMARY_NAME) {
+    problems.push(`root package name is ${rootPkg.name}, expected ${PRIMARY_NAME}`)
+  }
+  if (aliasPkg.name !== ALIAS_NAME) {
+    problems.push(`alias package name is ${aliasPkg.name}, expected ${ALIAS_NAME}`)
+  }
+  if (aliasPkg.version !== rootPkg.version) {
+    problems.push(`alias version ${aliasPkg.version} != ${PRIMARY_NAME} ${rootPkg.version}`)
+  }
+  const pin = aliasPkg.dependencies?.[PRIMARY_NAME]
+  if (pin !== rootPkg.version) {
+    problems.push(`alias pins ${PRIMARY_NAME}@${pin ?? '(missing)'}, expected ${rootPkg.version}`)
+  }
+  if (aliasPkg.engines?.node !== rootPkg.engines?.node) {
+    problems.push(`alias engines.node ${aliasPkg.engines?.node} != root ${rootPkg.engines?.node}`)
+  }
+  if (aliasPkg.bin?.leg !== 'bin/leg.mjs') {
+    problems.push(`alias bin.leg is ${aliasPkg.bin?.leg}, expected bin/leg.mjs`)
+  }
+  if (!Array.isArray(rootPkg.files) || rootPkg.files.includes('packages') || rootPkg.files.some((f) => String(f).startsWith('packages/'))) {
+    problems.push('root package.json files must not ship packages/leg-agents')
+  }
+  if (!rootLicense.equals(aliasLicense)) problems.push('packages/leg-agents/LICENSE does not match root LICENSE')
+  if (!rootNotice.equals(aliasNotice)) problems.push('packages/leg-agents/NOTICE does not match root NOTICE')
+  if (!wrapper.startsWith('#!/usr/bin/env node')) {
+    problems.push('packages/leg-agents/bin/leg.mjs is missing the node shebang')
+  }
+  if (!wrapper.includes("require.resolve('@ucsandman/legcli/package.json')")) {
+    problems.push('alias wrapper does not resolve @ucsandman/legcli/package.json')
+  }
+  if (!wrapper.includes('pathToFileURL')) {
+    problems.push('alias wrapper must import via pathToFileURL so Windows absolute paths work')
+  }
+  if (!wrapper.includes("join(pkgRoot, 'bin', 'leg.mjs')")) {
+    problems.push('alias wrapper does not load bin/leg.mjs from the pinned package')
+  }
+
+  return { rootPkg, aliasPkg, wrapper, problems, aliasDir: alias }
+}
+
+export function packedFileList (dir) {
+  const { bin, args } = resolveCommand('npm pack --dry-run --json --ignore-scripts')
+  const stdout = execFileSync(bin, args, { cwd: dir, encoding: 'utf8', windowsHide: true })
+  const startArr = stdout.indexOf('[')
+  const startObj = stdout.indexOf('{')
+  const start = startArr === -1 ? startObj : startObj === -1 ? startArr : Math.min(startArr, startObj)
+  if (start === -1) throw new Error(`npm pack produced no JSON:\n${stdout}`)
+  const parsed = JSON.parse(stdout.slice(start))
+  const entry = Array.isArray(parsed) ? parsed[0] : parsed
+  const files = (entry.files || []).map((f) => f.path || f)
+  return files.sort()
+}
+
+export function sync (rootDir = root) {
+  const { rootPkg, aliasPkg } = inspect(rootDir)
+  const alias = join(rootDir, 'packages', 'leg-agents')
+  const next = {
+    ...aliasPkg,
+    version: rootPkg.version,
+    dependencies: { ...aliasPkg.dependencies, [PRIMARY_NAME]: rootPkg.version },
+    engines: { ...aliasPkg.engines, node: rootPkg.engines.node }
+  }
+  writeFileSync(join(alias, 'package.json'), JSON.stringify(next, null, 2) + '\n')
+  copyFileSync(join(rootDir, 'LICENSE'), join(alias, 'LICENSE'))
+  copyFileSync(join(rootDir, 'NOTICE'), join(alias, 'NOTICE'))
+  return next
+}
+
+const isMain = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+
+if (isMain) {
+  const check = process.argv.includes('--check')
+  if (!check) sync()
+  const { rootPkg, problems, aliasDir: dir } = inspect()
+  let packed
+  try {
+    packed = packedFileList(dir)
+  } catch (error) {
+    problems.push(`npm pack --dry-run failed: ${error.message}`)
+  }
+  if (packed) {
+    const expected = [...PACKED_FILES].sort()
+    if (packed.join('\n') !== expected.join('\n')) {
+      problems.push(`packed files are [${packed.join(', ')}], expected [${expected.join(', ')}]`)
+    }
+  }
+  if (problems.length) {
+    console.error(`leg-agents is out of lockstep with ${PRIMARY_NAME}@${rootPkg.version}:\n`)
+    for (const p of problems) console.error(`  - ${p}`)
+    console.error('\nRun: node scripts/sync-leg-agents.mjs')
+    process.exitCode = 1
+  } else {
+    console.log(`leg-agents: in lockstep with ${PRIMARY_NAME}@${rootPkg.version}`)
+  }
+}

package/src/accounts.mjs

@@ -44,12 +44,11 @@ export function accountsFile() { return join(home(), 'accounts.json') }
 export function accountDir(agent, name) { return join(home(), 'accounts', agent, name) }
 
 export function readAccounts() {
-  const base = { claude: ['default'], codex: ['default'], agy: ['default'] }
+  const base = { claude: ['default'], codex: ['default'], agy: ['default'], grok: ['default'] }
   if (!existsSync(accountsFile())) return base
   try {
     const j = JSON.parse(readFileSync(accountsFile(), 'utf8'))
     for (const k of Object.keys(base)) if (Array.isArray(j[k])) base[k] = ['default', ...j[k].filter((n) => n !== 'default')]
-    if (Array.isArray(j?.grok)) base.grok = ['default', ...j.grok.filter((n) => n !== 'default')]
   } catch {}
   return base
 }

package/src/adapters/codex.mjs

@@ -19,7 +19,7 @@ const adapter = {
   forbiddenFlags: ['danger-full-access', '--dangerously-bypass-approvals-and-sandbox', '--dangerously-bypass-hook-trust', '--full-auto', '--approve-for-me'],
   resolve() {
     if ((process.env.LEG_CODEX_BIN || process.env.BATON_CODEX_BIN)) {
-      const bin = process.env.BATON_CODEX_BIN
+      const bin = process.env.LEG_CODEX_BIN || process.env.BATON_CODEX_BIN
       return { bin, viaNode: /\.(mjs|cjs|js)$/.test(bin), entry: null }
     }
     // The npm package's bin/codex.js only spawns the platform package's native