@ucsandman/legcli 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,151 @@
 # Changelog
 
+## 0.11.0 (2026-09-17)
+
+- **grok is a card adapter, not just a terminal.** `--chain grok` works. Its
+  flags were read from `grok --help` on grok 1.0.34 (`3736acbc8658`) and its
+  result envelope out of the shipped binary, both on 2026-09-17, replacing the
+  guessed field names the unregistered adapter carried. The prompt now travels
+  by `--prompt-file` (a hand-off prompt carries the whole bundle summary, and
+  Windows caps a command line near 32k) and `--cwd` is passed explicitly,
+  because grok can run against a shared leader process and a leg must edit its
+  own worktree. The probe reached the account and came back with a real wall.
+- **A grok terminal at the wall now hands off.** An exhausted Grok Build
+  account answers `402 Payment Required: Grok Build usage balance exhausted`,
+  and none of the rate-limit strings the tap looked for appear in it. The
+  terminal sat on a dead login instead of moving on. Both the tap
+  (`src/taps/grok.mjs`) and the leg classifier (a new observed-live fixture)
+  now read it as a limit. Found by running the probe against an exhausted
+  account on 2026-09-17.
+- **Any CLI can be a card agent, from a JSON spec and no code.** `leg adapter
+  template --name muse > muse.json`, `leg adapter add muse.json`, then
+  `--chain muse,claude`. `leg adapter check muse` prints the exact command line
+  a leg would run before one does; `leg adapter list|show|rm` are the rest.
+  Placeholders (`{{prompt}}`, `{{promptFile}}`, `{{cwd}}`, `{{mode}}`,
+  `{{model}}`, `{{resume}}`, `{{maxTurns}}`, `{{runDir}}`) fill the argv, and a
+  group in the args is dropped whole when a placeholder inside it is unset, so
+  an absent model never leaves a bare `--model`. The flags that turn a
+  supervised agent into an unsupervised one are refused whatever a spec says.
+  A broken spec is reported by name and reason, never thrown, so one typo
+  cannot stop the board. See [docs/adapters.md](docs/adapters.md#custom-adapters).
+- **Hand off now can name its destination.** The button still takes the next
+  option in the order; Details → **Hand off now to** lists every destination
+  with the reason a greyed one cannot be picked, and `leg sessions handoff
+  <id> --to codex` is the same choice from a terminal. A destination that is
+  not on the chain, not installed, or at its wall is refused at the click with
+  the reset time. If the one you picked walls between the click and the
+  hand-off, the work continues down the order and the terminal says which
+  agent took it instead, rather than going somewhere else in silence.
+- **TLS for a shared board.** `leg share on --tls-cert <file> --tls-key <file>`,
+  or `LEG_TLS_CERT` / `LEG_TLS_KEY`. Leg issues no certificate: a self-signed
+  pair teaches everyone to click through a warning, which is worse than
+  plaintext on a network that is already private, so it takes a pair you have
+  (`tailscale cert <machine>.<tailnet>.ts.net` is one command). Half a pair, a
+  missing file or an empty one stops the board with exit 3 rather than quietly
+  serving plaintext. The loopback companion stays http, because the certificate
+  is for the shared name and that traffic never leaves the machine.
+- **An `operator` role, between owner and guest.** An operator runs the
+  pipeline board — adds, runs, approves, reassigns and kills cards — and their
+  own terminals, and sees nothing that describes this machine: no settings, no
+  home path, no repository paths, no conversation index, no audit. `leg share
+  add dana --role operator`. What each role may reach is decided in one place
+  (`mayUseCards` / `mayUseMachine` in `src/share.mjs`) instead of per endpoint.
+- **An audit trail: who did what, across every terminal and every card.**
+  Settings → **Audit trail** on the board, `GET /api/audit` for a script, owner
+  only. Hand-offs, landings, approvals, reassignments and kills, newest first,
+  each with the person or agent that did it. It reads what the ledger already
+  recorded and stores nothing new, and every answer carries how much it read
+  (`14 terminals and 3 cards, 812 events read`) so an empty trail cannot be
+  mistaken for a quiet week.
+- **Fixed: a guest's own terminal leaked the owner's reset times.** The new
+  hand-off destination list carried the exact reset timestamp of every
+  account, and a guest owns their own terminal, so it reached them through it.
+  A guest and an operator now get the destinations and the coarse reason
+  (`at its usage limit`) without the timestamp. Caught by the share-security
+  suite in the same change.
+- **Fixed: the board slowed down as soon as a custom adapter existed.**
+  `/api/health` asks every adapter where its binary is, and reading the spec
+  directory on each of those calls put a readdir, a read and a JSON parse per
+  spec on the event loop the terminals lane is pushed from. The parsed list is
+  now cached against the directory's entries with a one-second floor, so a
+  spec added or removed is still seen at once.
+
+## 0.10.0 (2026-09-17)
+
+- **The board is responsive again, `leg` starts straight away, and the board
+  opens every time.** One running terminal was enough to saturate the board
+  server: it rewrites its record every few seconds and takes a control lock
+  about once a second, and the watcher over the sessions directory rebuilt the
+  whole terminals view — over a second of `git` — for every one of those
+  touches, including the lock files and the temp files atomic writes leave
+  behind. The server spent all its time in that loop, so it answered a
+  stylesheet in fourteen seconds and `/api/health` in seven. Four consequences,
+  all fixed:
+  - The watcher now drops locks and temp files by name, and checks the rest
+    against a stat fingerprint of the files the view is actually built from,
+    because a lock taken inside a session directory changes that directory's
+    own mtime and arrives as an event naming nothing else. What survives is
+    floored to one rebuild per interval. `canLand` is cached per record
+    revision with staggered expiries, so twenty worktrees are never re-read in
+    one pass. The terminals view went from 2,000 ms to 115 ms; on a board with
+    66 sessions `/api/health` went from 14.2 s to 2.4 ms and `/board.css` from
+    14.2 s to 1.5 ms.
+  - `leg claude` treated a board too busy to answer a health probe as no board
+    at all, spawned a second server that could only die of `EADDRINUSE`, then
+    polled the dead child for fifteen seconds. A listener on the port is now a
+    board: `leg` attaches to it.
+  - The board is opened whether or not this terminal is the one that started
+    it. Previously the browser was only opened on the path that spawned the
+    server, so with a board already running nothing ever opened.
+  - One push rebuilt the terminals grid three times (two listeners registered
+    for `leg:sessions` and one for the legacy alias, with the payload parsed
+    twice per push and one dispatch outside the staleness guard). Every button
+    was destroyed and recreated several times a second. One push now rebuilds
+    once, and an open confirm row is left alone until it is answered.
+
+- **Remove, Remove record, End and Land work.** Confirming any of them did
+  nothing at all. `confirmRow` clears `pendingConfirm` and then calls its
+  callback, and the callback read `pendingConfirm.action` — off the variable it
+  had just cleared. Every Yes on the Terminals panel threw
+  `TypeError: Cannot read properties of null (reading 'action')` into the
+  console and never reached the request. The callback now closes over a
+  snapshot taken before the row is built.
+
+- **Every conversation on this machine (`leg history`, `leg worktrees`, the
+  board's Conversations cell).** One read-only index over the conversations
+  Claude Code, Codex, Grok, Antigravity and Copilot CLI keep in their own
+  stores, plus Leg's own sessions, deduplicated (a session Leg started and
+  the same conversation in the agent's store are one row, marked `leg`; the
+  rest are `external`). List, filter by agent, repository or text, open one
+  (its last messages, read from the tail of the transcript only when asked),
+  and `leg history continue <id>` to start a supervised leg on it where the
+  installed CLI documents resume-by-id (claude, codex, grok, agy; copilot
+  lists and reads but is not an agent Leg runs). Nothing in an agent's store
+  is moved or written; Leg writes only `~/.leg/history/index.json`, refreshed
+  incrementally by size and mtime, and never opens a SQLite file. Every
+  checkout Leg can see, git's and its own and the ones conversations ran in,
+  with owner, uncommitted count, orphaned, stale and missing verdicts, read
+  only. On a shared board the whole group is the owner's. Redaction learned
+  the shapes another agent's transcript carries (Stripe, Google, xAI, npm,
+  GitLab, Hugging Face keys, JWTs, private-key blocks, basic auth, URL
+  credentials, `password=`), and the board token joined the values it strips.
+  Support matrix and every file read: docs/history.md.
+- **History, after its review.** The board's Conversations cell pages past
+  150 rows (the total no longer shrank with each cursor page); the board
+  refreshes a stale index in a child process instead of its own event loop;
+  a cwd on an unreachable network share no longer stalls a refresh; an
+  Antigravity retitle or a touched presence lock is seen by an incremental
+  refresh, and only that conversation is re-read; an older Leg session id
+  still opens the conversation it was one leg of; `leg history` prints a
+  failed refresh whatever the last index still lists, `refresh` fails cleanly
+  when another Leg holds the lock, `--limit 0` is a usage error (`--all`),
+  `--offset` works, a Leg-only row's id prints whole; a malformed id on
+  `/api/history/<id>` is a 400; an account name that is a path is ignored;
+  titles are cut to 200 as documented and go through the held-value
+  redaction too; the Copilot chip has a colour. Redaction no longer eats
+  `Basic authentication/authorization`, `cache_key = ...` or
+  `refresh_token: string`, and a value never crosses a line break.
+
 ## 0.9.0 (2026-09-16)
 
 - **The portable harness (`leg harness`), off by default.** A hand-off can now

package/README.md

@@ -95,6 +95,7 @@ yourself.
 - [Two sessions in one repo](#two-sessions-in-one-repo)
 - [More than one human](#more-than-one-human)
 - [The board](#the-board)
+- [Every conversation on this machine](#every-conversation-on-this-machine)
 - [Second accounts, and what the terms say](#second-accounts-and-what-the-terms-say)
 - [What is and is not touched](#what-is-and-is-not-touched)
 - [CLI reference](#cli-reference)
@@ -274,12 +275,21 @@ token at all.
 
 ```
 leg share on              your own link, printed once
-leg share add sam         sam's link, printed once
+leg share add sam         sam's link, printed once (a guest)
+leg share add dana --role operator    dana runs cards, not this machine
 leg share                 who is on the board (never a token again)
 leg share rotate sam      sam's old link stops working
 leg share off             back to 127.0.0.1; every link stops working
 ```
 
+There are three roles. **owner** is everything: the machine's settings, the
+harness, every terminal, the cards, the history index and the audit trail.
+**operator** is the pipeline board and their own terminals: they add, run,
+approve, reassign and kill cards, and they never see this machine's settings,
+its home path, its repository paths, its conversation index or the audit.
+**guest** is the terminals lane, read-only and redacted, with **Request
+handoff** as their only button.
+
 A token is kept as a sha256 hash, so a lost link is re-issued, never re-read.
 The board takes the token out of the address bar and keeps it in the browser.
 Your own browser on this machine needs no token.
@@ -300,12 +310,42 @@ The security pass that goes with it: every `/api` route needs a token, the
 event stream included; twenty wrong tokens from one address and that address
 waits a minute; one identity gets 600 requests a minute; a guest gets 403 on
 everything that is not theirs; and the tests send a bad and a missing token to
-every route. There is still no TLS, so keep this on Tailscale or a network you
-trust. Verified live on 2026-09-11: two terminals on one machine, one wes's and
+every route. Verified live on 2026-09-11: two terminals on one machine, one wes's and
 one sam's; sam's board showed wes's card with the prompt hidden and only
 **Request handoff**, and sam's request reached wes's board (`~/.leg/board.log`:
 "hand-off requested … by sam").
 
+### TLS
+
+Off unless you hand it a certificate. Leg does not issue one: a self-signed
+pair teaches everyone on the board to click through a warning, which is worse
+than plaintext on a network that is already private. On Tailscale the pair is
+one command:
+
+```
+tailscale cert <machine>.<tailnet>.ts.net
+leg share on --tls-cert <machine>.<tailnet>.ts.net.crt --tls-key <machine>.<tailnet>.ts.net.key
+```
+
+`LEG_TLS_CERT` and `LEG_TLS_KEY` do the same without writing the paths into
+`share.json`, and they win over it. With a pair configured the shared address
+serves https and every printed link says `https://`; the companion listener on
+`127.0.0.1`, which exists so this machine's own browser needs no token, stays
+plain http, because the certificate is for the shared name and loopback traffic
+never leaves the machine. A pair that is half-configured, missing, unreadable
+or empty stops the board with exit 3 rather than quietly serving plaintext.
+Renew the pair, then `leg down && leg up` to pick it up.
+
+### Who did what
+
+Settings → **Audit trail** is one list across every terminal and every card,
+newest first: hand-offs, landings, approvals, reassignments, kills, each with
+the person or agent that did it, the repo and the time. Filter by person or by
+kind. It reads what the ledger already recorded, so nothing new is stored, and
+it prints how much it read beside the answer (`14 terminals and 3 cards, 812
+events read`) so an empty trail cannot be mistaken for a quiet week. Owner
+only: the trail names repositories and people.
+
 ## The board
 
 `leg <agent>` opens it; `leg open` reopens it; `leg down` stops it.
@@ -336,12 +376,47 @@ one sam's; sam's board showed wes's card with the prompt hidden and only
 - **Buttons**, in a fixed order that never reflows: Land, Hand off now,
   Details, End. Once a session has ended, Remove and Remove record take End's
   place. Details opens an expansion in flow under the panel.
-- Below it, optional **Background tasks** an agent runs in a separate worktree
-  without joining the terminal conversation (see below), then **Settings**.
+  **Hand off now** takes the next option in the order. To name the destination
+  instead, open Details and use **Hand off now to**, which lists every
+  destination with the reason a greyed one cannot be picked (`at its usage
+  limit, back 11:40`, `not installed on this machine`). `leg sessions handoff
+  <id> --to codex` is the same choice from a terminal. If the destination you
+  picked walls between the click and the hand-off, the work still continues
+  down the order and the terminal says which one took it instead.
+- Below it, **Conversations**: every coding-agent conversation on this machine
+  as a count that opens, the ones Leg started and the ones Claude Code, Codex,
+  Grok, Antigravity and Copilot keep in their own stores. Filter by agent,
+  search, repository, or only what Leg started; a row opens its last messages
+  in place, with the `leg history continue` command to copy where the agent
+  can resume by id. The same drawer lists every checkout Leg can see. Then
+  optional **Background tasks** an agent runs in a separate worktree without
+  joining the terminal conversation (see below), then **Settings**.
 
 The board reads `~/.leg/sessions/*/session.json` over server-sent events; a
 session whose runner process is gone is marked `lost`, never shown as live.
 
+## Every conversation on this machine
+
+Claude Code, Codex, Grok, Antigravity and Copilot each keep their history in
+their own place. `leg history` is one list over all of them, whether or not
+Leg started the conversation, and `leg worktrees` is one list over every
+checkout: git's, Leg's own, and the ones those conversations ran in.
+
+```
+leg history                          newest first, every agent; --provider, --repo, --search, --json
+leg history show claude:0fc5         where it ran, its last messages, whether Leg can continue it
+leg history continue claude:0fc5     leg claude --resume <id> in that folder, supervised like any session
+leg worktrees                        path, repo, branch, exists, uncommitted, owner, conversations, stale
+```
+
+Nothing moves: each agent's store stays where it was, Leg writes only its own
+`~/.leg/history/index.json`, reads transcripts from their head and tail, and
+opens messages only when you open a conversation. A session Leg started and
+the same conversation in the agent's store are one row, marked `leg`; the rest
+are `external`. On a shared board the whole group is the owner's. The support
+matrix (which agents list, show messages, continue) and every file read are in
+[docs/history.md](docs/history.md).
+
 ## Second accounts, and what the terms say
 
 Optional. `leg accounts add claude work` creates
@@ -387,6 +462,10 @@ happens after you run `leg accounts add`; that is your call.
   `~/.codex/config.toml`, agy's files, your repo's settings. Claude Code gets
   hooks through a per-session `--settings` file under `~/.leg`; codex and
   agy get nothing injected.
+- **Read, never written**: each agent's own history (`~/.claude/projects`,
+  `~/.codex/sessions`, `~/.grok/sessions`, `~/.gemini/antigravity-cli`,
+  `~/.copilot/session-state`) for `leg history`; the index it builds lives
+  under `~/.leg/history/`, and no SQLite file is ever opened.
 - **Written only after `leg harness enable`** ([the portable harness](docs/harness.md),
   off by default): the destination client's global rules file
   (`~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.claude/leg-rules.md` plus
@@ -427,8 +506,13 @@ leg claude|codex|agy|grok [agent args…] the interactive agent, board alongside
 leg sessions ls [--json]             every session and its usage
 leg sessions show|events <id>
 leg sessions handoff|end <id>        same as the board buttons
+leg sessions handoff <id> --to <agent>[/<account>]   hand off to a destination you name
 leg sessions rm <id>                 forget an ended session
 leg sessions simulate-limit <id>     the real limit path without a real wall (claude, agy, grok)
+leg history [ls] [--provider p] [--repo r] [--search q] [--managed|--external] [--live] [--all] [--json]
+                                     every conversation on this machine, Leg's own and the agents' own (read only)
+leg history show <id> [--messages n] [--json] | continue <id> [agent args…] | refresh [--full] | providers
+leg worktrees [--repo <path>] [--no-dirty] [--json]   every checkout: git's, Leg's, the conversations' (read only)
 leg accounts ls                      logins and their 5h/7d usage
 leg accounts add <claude|codex|grok> <name> | rm <agent> <name> | terms
 leg harness status|inspect|check|explain|history [--json]   the portable harness, read-only
@@ -437,9 +521,12 @@ leg harness sync [--to codex,agy] [--force] [--dry-run] | diff <client> | doctor
 leg harness capture [claude|codex] | source <client> | policy <mode> | disable
 leg license                          the license on this machine, or where to buy one
 leg license activate <key> | deactivate | refresh   (refresh renews a Team key)
+leg adapter list|show <n>|check <n>  every adapter, built-in and custom
+leg adapter template [--name n]      a starter spec to fill in
+leg adapter add <file.json> | rm <n> any CLI as a card agent, from JSON
 leg share                            who is on the board (off by default; Team plan)
-leg share on [--bind tailscale|lan|<addr>] [--port N] | off
-leg share add|rotate|rm <name>       one link per human, printed once
+leg share on [--bind tailscale|lan|<addr>] [--port N] [--tls-cert <f> --tls-key <f>] | off
+leg share add|rotate|rm <name> [--role owner|operator|guest]   one link per human, printed once
 leg open | down | status             the board
 leg uninstall [--yes]
 ```
@@ -451,8 +538,10 @@ open the browser), `LEG_USAGE_POLL_MS` (60000), `LEG_CLAUDE_ARGS` /
 `LEG_CODEX_ARGS` / `LEG_AGY_ARGS` / `LEG_GROK_ARGS` (extra args for a leg Leg starts after
 a hand-off, e.g. `-m gpt-5.3-codex-spark`), `LEG_CLAUDE_BIN`,
 `LEG_CODEX_BIN`, `LEG_AGY_BIN`, `LEG_GROK_BIN`, `LEG_CHB_BIN`, `LEG_PERSON` (whose
-terminal this is when the board is shared), `LEG_RATE_MAX` (600 requests a
-minute per human) and `LEG_RATE_MAX_FAILURES` (20 wrong tokens per address).
+terminal this is when the board is shared), `LEG_TLS_CERT` / `LEG_TLS_KEY`
+(serve the shared board over https; they win over `share.json`),
+`LEG_RATE_MAX` (600 requests a minute per human) and `LEG_RATE_MAX_FAILURES`
+(20 wrong tokens per address).
 
 ## Background tasks: the v0.1 extras
 
@@ -477,8 +566,17 @@ under Advanced options.
 - Adapters spawn the CLIs headless as argv, never through a shell, with their
   own permission modes and never a bypass flag: `claude -p --output-format json
   --permission-mode <m>`, `codex exec --json -s <m> -C <worktree>`,
-  `agy -p --output-format json --mode <m> --add-dir <worktree>`; `fake`,
-  `fake-claude`, `fake-codex`, `fake-agy` for tests and demos.
+  `agy -p --output-format json --mode <m> --add-dir <worktree>`,
+  `grok --prompt-file <f> --output-format json --permission-mode <m> --cwd
+  <worktree>`; `fake`, `fake-claude`, `fake-codex`, `fake-agy` for tests and
+  demos.
+- **Any other CLI** is a card adapter too, from a JSON spec and no code:
+  `leg adapter template --name muse > muse.json`, fill in the command and its
+  flags, `leg adapter add muse.json`, then `--chain muse,claude`. `leg adapter
+  check muse` prints the exact command line a leg would run before one does.
+  See [docs/adapters.md](docs/adapters.md#custom-adapters). A custom adapter
+  runs cards; it is not an interactive `leg <agent>` terminal, because that
+  needs a usage tap and a wall signal, which only the four above expose.
 - A leg that ends on a limit signal, a stall, a crash or exit 0 without
   `.leg/DONE` hands off with a bundle to the next adapter in the same
   worktree; a `land` station rebases, tests and fast-forwards trunk or bounces
@@ -534,6 +632,7 @@ More in [docs/faq.md](docs/faq.md).
 | [Board guide](docs/board-guide.md) | every word, number and button on the board explained |
 | [Configuration](docs/configuration.md) | environment variables and options |
 | [Portable harness](docs/harness.md) | carrying rules, hooks, skills, agents, commands and MCP servers to the agent a hand-off lands on: what moves, what does not, policies, ownership, secrets |
+| [History](docs/history.md) | `leg history` and `leg worktrees`: every conversation and checkout on this machine across agents, the support matrix, what is read and what is written |
 | [Adapters](docs/adapters.md) | what each CLI exposes and how Leg attaches to it |
 | [CLI contracts](docs/cli-contracts.md) | exact argv per CLI and the limit-signal table with sources |
 | [FAQ](docs/faq.md) | a question the others did not answer |

package/bin/leg.mjs

@@ -19,14 +19,17 @@ import { createScheduler, schedulerStatus, pidfile, MAX_CONCURRENT } from '../sr
 import { availableActions } from '../src/chain.mjs'
 import { up, down, stopBoard, status, openBoard } from '../src/launcher.mjs'
 import { attach, ensureBoard } from '../src/attach.mjs'
-import { readShare, addPerson, removePerson, rotate as rotateToken, turnOn, turnOff, linkFor, personNamed } from '../src/share.mjs'
+import { readShare, addPerson, removePerson, rotate as rotateToken, turnOn, turnOff, linkFor, personNamed, scheme, tlsConfigured, ROLES } from '../src/share.mjs'
+import { normalizeHandoffOrder } from '../src/preferences.mjs'
 import { SUPERVISED_AGENTS, listSessions, readSession, readEvents as readSessionEvents, requestControl, removeSession, isActive, readLand, sessionDir, appendEvent } from '../src/sessions.mjs'
-import { addAccount, removeAccount, listAccountRows, LAYOUT } from '../src/accounts.mjs'
-import { listUsage, fmtReset } from '../src/usage.mjs'
+import { addAccount, removeAccount, listAccountRows, readAccounts, LAYOUT } from '../src/accounts.mjs'
+import { listUsage, fmtReset, readUsage, isAvailable, candidates } from '../src/usage.mjs'
 import { home } from '../src/store.mjs'
 import { entitlement, allows, describe as describeLicense, activate as activateLicense, deactivate as deactivateLicense, refresh as refreshLicense, licensePath, BUY_URL } from '../src/license.mjs'
 import { resumeVerdict, bodyOf, ago } from '../src/resume.mjs'
 import { harnessCommand } from '../src/harness/cli.mjs'
+import { adapterCommand } from '../src/adapters/cli.mjs'
+import { historyCommand, worktreesCommand } from '../src/history/cli.mjs'
 
 const SRC = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'src')
 // one source of truth for the version, so the help text cannot drift from the package
@@ -158,11 +161,32 @@ async function main() {
       for (const s of list) out(`${s.session_id}  [${s.status}]  ${s.agent}${s.account !== 'default' ? '/' + s.account : ''}  ${s.repo_name ?? s.cwd}${s.branch ? '@' + s.branch : ''}  turns=${s.turns}  ${s.limits ? `5h ${s.limits.five_hour?.pct ?? '-'}% 7d ${s.limits.seven_day?.pct ?? '-'}%` : ''}  ${String(s.task ?? '').slice(0, 50)}`)
       return
     }
-    const id = args._[0] || die(2, `usage: leg sessions ${cmd} <session-id>`)
+    const id = args._[0] || die(2, `usage: leg sessions ${cmd} <session-id>${cmd === 'handoff' ? ' [--to <agent>[/<account>]]' : ''}`)
     const s = readSession(id) || die(3, `session not found: ${id}`)
     if (cmd === 'show') return out(JSON.stringify({ session: s, events: readSessionEvents(id) }, null, 2))
     if (cmd === 'events') { for (const e of readSessionEvents(id)) out(`${e.ts}  ${String(e.type).padEnd(18)}  ${e.summary}`); return }
-    if (cmd === 'handoff') { if (!isActive(s)) die(3, `session ${id} is not active`); requestControl(id, { handoff: true }); return out(`handoff requested for ${id}`) }
+    if (cmd === 'handoff') {
+      if (!isActive(s)) die(3, `session ${id} is not active`)
+      // --to names the destination, the same choice the board's picker makes.
+      // Validated here for the same reason it is validated there: a pick that
+      // is not a destination, is not installed, or is at its wall must be
+      // refused now, not silently turn into "whatever is next".
+      if (typeof args.to === 'string') {
+        const [wantAgent, wantAccount = 'default'] = args.to.split('/')
+        const order = normalizeHandoffOrder(s.handoff_order)
+        const chain = candidates({ agent: s.agent, account: s.account, accounts: readAccounts(), order })
+        const hit = chain.find((c) => c.agent === wantAgent && c.account === wantAccount)
+        const label = `${wantAgent}${wantAccount !== 'default' ? '/' + wantAccount : ''}`
+        if (!hit) die(2, `${label} is not a destination for this terminal (${chain.map((c) => c.agent + (c.account !== 'default' ? '/' + c.account : '')).join(', ') || 'none'})`)
+        if (s.installed && s.installed[wantAgent] === false) die(3, `${label} is not installed on this machine`)
+        const u = readUsage(wantAgent, wantAccount)
+        if (!isAvailable(u)) die(3, `${label} is at its usage limit until ${fmtReset(u.limited_until)}; pick another, or drop --to to take the next option in the order`)
+        requestControl(id, { handoff: true, target: hit })
+        return out(`handoff to ${label} requested for ${id}`)
+      }
+      requestControl(id, { handoff: true })
+      return out(`handoff requested for ${id}`)
+    }
     if (cmd === 'end') { if (!isActive(s)) die(3, `session ${id} is not active`); requestControl(id, { end: true }); return out(`end requested for ${id}`) }
     if (cmd === 'rm') {
       if (isActive(s)) die(3, `session ${id} is still active; end it first`)
@@ -225,7 +249,9 @@ async function main() {
     const showLink = (person, token, s) => {
       out(`${person.name} is on the board (${person.role}). Their link, shown once:`)
       out(`  ${linkFor(s, token)}`)
-      out(person.role === 'owner' ? 'Open it on this machine, or any machine that can reach that address.' : 'They see the terminals lane read-only: no prompts, no file names, no logs, no bundles. They can ask for a hand-off; you approve it on the card.')
+      out(person.role === 'owner' ? 'Open it on this machine, or any machine that can reach that address.'
+        : person.role === 'operator' ? 'They get the pipeline board — cards, the floor, the adapters — and their own terminals. Not this machine’s settings, not its history index, not anyone else’s terminal.'
+        : 'They see the terminals lane read-only: no prompts, no file names, no logs, no bundles. They can ask for a hand-off; you approve it on the card.')
     }
     if (!cmd || cmd === 'ls' || cmd === 'status') {
       if (!share.on || !share.people.length) {
@@ -233,9 +259,12 @@ async function main() {
         out('Turn it on: leg share on            (the Tailscale address; --bind lan, or --bind <address>)')
         return
       }
-      out(`share is on: http://${share.bind}:${share.port} (${share.bind_kind})`)
-      for (const p of share.people) out(`  ${p.name.padEnd(16)} ${p.role.padEnd(6)} added ${String(p.created_at).slice(0, 10)}${p.last_seen ? `  last seen ${String(p.last_seen).slice(0, 16).replace('T', ' ')}` : ''}`)
+      out(`share is on: ${scheme(share)}://${share.bind}:${share.port} (${share.bind_kind})`)
+      for (const p of share.people) out(`  ${p.name.padEnd(16)} ${p.role.padEnd(9)} added ${String(p.created_at).slice(0, 10)}${p.last_seen ? `  last seen ${String(p.last_seen).slice(0, 16).replace('T', ' ')}` : ''}`)
       out('')
+      out(tlsConfigured(share)
+        ? `TLS: certificate ${share.tls?.cert ?? '(from the environment)'}. The board on 127.0.0.1 stays plain http for this machine's own browser.`
+        : 'No TLS: keep this on Tailscale or a network you trust. Add one with leg share on --tls-cert <file> --tls-key <file> (tailscale cert <machine>.<tailnet>.ts.net issues a trusted pair).')
       out('A token is shown once. Lost one? leg share rotate <name>. Everyone out: leg share off')
       return
     }
@@ -245,19 +274,26 @@ async function main() {
       const ent = entitlement()
       if (!allows(ent, 'share')) die(2, ent.ok ? `leg share is part of the Team plan (per seat); this machine has a ${ent.plan} license. ${BUY_URL}` : describeLicense(ent))
       try {
-        const r = await turnOn({ bind: a.bind ?? 'tailscale', port: a.port ? parseInt(a.port, 10) : undefined, owner: a.owner })
+        const r = await turnOn({
+          bind: a.bind ?? 'tailscale', port: a.port ? parseInt(a.port, 10) : undefined, owner: a.owner,
+          tlsCert: typeof a['tls-cert'] === 'string' ? a['tls-cert'] : null,
+          tlsKey: typeof a['tls-key'] === 'string' ? a['tls-key'] : null,
+        })
         await restartBoard()
-        out(`share is on: the board is at http://${r.share.bind}:${r.share.port} (${r.share.bind_kind})`)
+        out(`share is on: the board is at ${scheme(r.share)}://${r.share.bind}:${r.share.port} (${r.share.bind_kind})`)
         if (r.token) showLink(r.owner, r.token, r.share)
-        out('Add someone: leg share add <name>')
-        out('No TLS: keep this on Tailscale or a network you trust. Anyone with a link sees that your terminals exist and how much usage is left.')
+        out('Add someone: leg share add <name> [--role operator|guest]')
+        out(tlsConfigured(r.share)
+          ? `TLS is on, from ${r.share.tls?.cert ?? 'the environment'}. Renew the pair and run leg down && leg up to pick up a new one.`
+          : 'No TLS: keep this on Tailscale or a network you trust. Anyone with a link sees that your terminals exist and how much usage is left. leg share on --tls-cert <file> --tls-key <file> turns it on; tailscale cert <machine>.<tailnet>.ts.net issues a trusted pair.')
       } catch (err) { die(2, err.message) }
       return
     }
     if (cmd === 'add') {
-      const name = args._[0] || die(2, 'usage: leg share add <name> [--role owner|guest]')
+      const name = args._[0] || die(2, `usage: leg share add <name> [--role ${ROLES.join('|')}]`)
       try {
-        const r = addPerson(name, { role: args.role === 'owner' ? 'owner' : 'guest', share })
+        if (args.role !== undefined && !ROLES.includes(String(args.role))) die(2, `bad role "${args.role}" (${ROLES.join('|')})`)
+      const r = addPerson(name, { role: typeof args.role === 'string' ? args.role : 'guest', share })
         showLink(r.person, r.token, r.share)
         if (!r.share.on) out('share is still off: leg share on')
       } catch (err) { die(2, err.message) }
@@ -329,6 +365,27 @@ async function main() {
     const code = await harnessCommand(cmd, args, { out, die })
     process.exit(code)
   }
+  if (group === 'adapter' || group === 'adapters') {
+    // Custom adapters: any CLI as a card agent, from a JSON spec on disk
+    // (src/adapters/custom.mjs). The built-ins need none of this.
+    const code = await adapterCommand(cmd, args, { out, die })
+    process.exit(code)
+  }
+  if (group === 'history' || group === 'worktrees') {
+    // Every conversation on this machine, Leg's own and the ones the agents'
+    // stores hold: a read-only index (src/history/index.mjs). `continue`
+    // starts a normal supervised leg on one of them. `leg history --json` is
+    // `leg history ls --json`: a leading flag names no verb.
+    const isHelp = cmd === '--help' || cmd === '-h' || cmd === 'help' || args.help || args.h
+    const bare = typeof cmd === 'string' && cmd.startsWith('--')
+    const verb = isHelp ? 'help' : (bare ? 'ls' : cmd)
+    const a = bare ? parseArgs([cmd, ...rest]) : args
+    // `continue <id> [agent args...]`: what follows the id goes to the agent
+    // untouched, the way `leg claude [args...]` passes its argv straight through
+    const raw = bare ? [cmd, ...rest] : rest
+    const code = group === 'history' ? await historyCommand(verb, a, { out, die, raw }) : worktreesCommand(verb, a, { out, die })
+    process.exit(code)
+  }
   if (group === 'license') {
     // The paid gate. Keys verify offline against the public key in
     // src/license.mjs; nothing here talks to the network except refresh.
@@ -454,13 +511,19 @@ async function main() {
     out(openBoard(url) ? `opened ${url}` : `could not open a browser; visit ${url}`)
     return
   }
-  if (group && group !== '--help' && group !== 'help') die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
+  if (group && group !== '--help' && group !== 'help') die(2, `unknown command "${group}" (claude|codex|agy|grok|sessions|history|worktrees|resume|accounts|harness|license|share|up|down|status|open|card|scheduler|uninstall)`)
   out(`leg ${VERSION}, your coding agents, with a board alongside and a handoff when one hits its limit
   claude|codex|agy|grok [args...]   the normal interactive agent in this terminal; args pass straight through
                                 the board opens once, the session shows as a card, usage is tracked, a limit hands off
                                 a second live session in one checkout gets its own worktree (--no-worktree to share)
                                 auto-approve mode (--no-auto-approve to opt out)
   sessions ls|show|events|handoff|end|rm|simulate-limit <id>
+  history [ls] [--provider p] [--repo r] [--search q] [--json]
+                                every conversation on this machine: Leg's own, and the ones Claude Code, Codex,
+                                Grok, Antigravity and Copilot keep in their own stores (read only, nothing moved)
+  history show|continue <id> | refresh | providers
+                                one conversation, or start leg <agent> on it where the agent can resume by id
+  worktrees [--repo r] [--json]  every checkout Leg can see: git's, its own, the ones conversations worked in
   resume [--check] [--json] [--path <dir>]      the hand-off waiting in this checkout, and whether it is still true
                                freshness is recomputed from git at read time; --check prints only the verdict
                                exit 0 current, 1 stale or unstamped, 3 no pointer here