@ucsandman/legcli 0.9.0 → 0.11.0

package/src/redact.mjs

@@ -11,19 +11,37 @@ const PATTERNS = [
   ['Anthropic key (sk-ant-)', /(?<![A-Za-z0-9_-])sk-ant-[A-Za-z0-9_-]{8,}/g],
   ['DashClaw key (oc_live_)', /(?<![A-Za-z0-9_-])oc_live_[a-f0-9]\w*/g],
   ['bearer token', /Bearer\s+[A-Za-z0-9._-]{16,}/g],
-  ['GitHub token (ghp_)', /(?<![A-Za-z0-9_-])ghp_[A-Za-z0-9]{20,}/g],
-  ['GitHub server token (ghs_)', /(?<![A-Za-z0-9_-])ghs_[A-Za-z0-9]{20,}/g],
+  ['GitHub token (gh[pousr]_)', /(?<![A-Za-z0-9_-])gh[pousr]_[A-Za-z0-9]{20,}/g],
   ['GitHub fine-grained token (github_pat_)', /(?<![A-Za-z0-9_-])github_pat_[A-Za-z0-9_]{20,}/g],
   ['AWS key (AKIA)', /(?<![A-Za-z0-9_-])AKIA[0-9A-Z]{12,}/g],
-  ['Slack token (xox)', /(?<![A-Za-z0-9_-])xox[bp]-\S*/g],
-  ['key=value secret', /api[_-]?key\s*[=:]\s*\S+/gi],
+  ['Slack token (xox/xapp)', /(?<![A-Za-z0-9_-])(?:xox[baprs]|xapp)-\S+/g],
+  ['key=value secret', /api[_-]?key[ \t]*[=:][ \t]*\S+/gi],
+  // shapes a discovered transcript from another agent carries that the list
+  // above missed (measured 2026-09-16: 15 of 18 common shapes went through)
+  ['Stripe key (sk_live_/rk_live_)', /(?<![A-Za-z0-9_-])[sr]k_(?:live|test)_[A-Za-z0-9]{8,}/g],
+  ['Google API key (AIza)', /(?<![A-Za-z0-9_-])AIza[0-9A-Za-z_-]{30,}/g],
+  ['xAI key (xai-)', /(?<![A-Za-z0-9_-])xai-[A-Za-z0-9]{16,}/g],
+  ['npm token (npm_)', /(?<![A-Za-z0-9_-])npm_[A-Za-z0-9]{20,}/g],
+  ['GitLab token (glpat-)', /(?<![A-Za-z0-9_-])glpat-[A-Za-z0-9_-]{16,}/g],
+  ['Hugging Face token (hf_)', /(?<![A-Za-z0-9_-])hf_[A-Za-z0-9]{20,}/g],
+  ['JWT', /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
+  ['private key block', /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g],
+  // a digit or two capitals somewhere: base64 of any credential has one of
+  // them, "Basic authentication/authorization" in prose has neither
+  ['basic auth header', /Basic\s+(?=[A-Za-z0-9+/=]*(?:[0-9]|[A-Z][A-Za-z0-9+/=]*[A-Z]))[A-Za-z0-9+/=]{16,}/g],
+  ['URL with credentials', /(?<=[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)[^\s@/]{4,}(?=@)/gi],
+  // an environment-style NAME (upper case): `cache_key = build(...)` and
+  // `refresh_token: string` in code are not secrets; a value never crosses a
+  // line break, so `SECRET_KEY=` at the end of a line takes nothing after it
+  ['env-style secret assign', /(?:[A-Z0-9_]*_(?:KEY|TOKEN|SECRET|PASSWORD)|aws_secret_access_key)[ \t]*[=:][ \t]*["']?[^\s"',;]{8,}/g],
+  ['password=value', /\b(?:password|passwd)[ \t]*[=:][ \t]*["']?[^\s"',;]{8,}/gi],
 ]
 
 export const SECRET_RES = PATTERNS.map(([, re]) => re)
 // non-global copies for `.test()` (a /g regex carries lastIndex state)
 export const SECRET_PATTERNS = PATTERNS.map(([name, re]) => [name, new RegExp(re.source, re.flags.replace('g', ''))])
 
-const ENV_KEYS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY', 'DASHCLAW_API_KEY', 'BATON_TOKEN', 'GITHUB_TOKEN', 'GH_TOKEN']
+const ENV_KEYS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY', 'DASHCLAW_API_KEY', 'LEG_TOKEN', 'BATON_TOKEN', 'LEG_LICENSE_PRIVATE_KEY', 'BATON_LICENSE_PRIVATE_KEY', 'GITHUB_TOKEN', 'GH_TOKEN', 'STRIPE_SECRET_KEY', 'STRIPE_TEST_SECRET_KEY', 'RESEND_API_KEY', 'NPM_TOKEN']
 let envValues = null
 function heldValues() {
   if (envValues) return envValues

package/src/server.mjs

@@ -5,12 +5,14 @@
 // LEG_BIND (127.0.0.1) + LEG_PORT (4747) + LEG_TOKEN are the
 // multiplayer seams (src/auth.mjs). BATON_* names still work as fallback.
 import http from 'node:http'
-import { spawnSync } from 'node:child_process'
-import { existsSync, readFileSync, statSync, rmSync, watch as fsWatch, mkdirSync, openSync, fstatSync, readSync, closeSync } from 'node:fs'
+import https from 'node:https'
+import { spawnSync, execFile } from 'node:child_process'
+import { existsSync, readFileSync, readdirSync, statSync, rmSync, watch as fsWatch, mkdirSync, openSync, fstatSync, readSync, closeSync } from 'node:fs'
 import { join, dirname, resolve, extname, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { checkBind, authorize, remoteAddress, presentedToken, isLoopback, isLoopbackRequest, tokenMatches } from './auth.mjs'
-import { readShare, isOn as shareIsOn, sharePath, identify, personNamed } from './share.mjs'
+import { readShare, isOn as shareIsOn, sharePath, identify, personNamed, mayUseCards, mayUseMachine, readTls } from './share.mjs'
+import { auditTrail, ACTOR_KINDS } from './audit.mjs'
 import { createLimiter } from './ratelimit.mjs'
 import { realPath, canonPath } from './fsx.mjs'
 import { listCards, readCard, readRuns, readEvents, cardDir, home } from './store.mjs'
@@ -29,10 +31,12 @@ import { sessionDetail, sessionDiff, DiffInputError } from './session-detail.mjs
 import { hasRecentSynthesis } from './synthesis.mjs'
 import { refreshPointers } from './resume.mjs'
 import { landSession, landBlocker, landingNow, pruneSessionWorktree, canLand, prepareLanding, applyLandFix } from './land.mjs'
-import { readUsage, recordUsage, usageIsStale, candidates, isAvailable } from './usage.mjs'
+import { readUsage, recordUsage, usageIsStale, candidates, isAvailable, fmtReset } from './usage.mjs'
 import { readAccounts, envFor, LAYOUT } from './accounts.mjs'
 import { readCodexUsage } from './taps/codex.mjs'
 import { readPreferences, writePreferences, normalizeHandoffOrder, requireHandoffOrder } from './preferences.mjs'
+import { listHistory, findRecord, recordDetail, refreshIndex, readIndex, providerSupport, HistoryInputError, PROVIDER_NAMES } from './history/index.mjs'
+import { listWorktrees } from './history/worktrees.mjs'
 
 const SELF = fileURLToPath(import.meta.url)
 export function resolveBoardDir() {
@@ -226,6 +230,64 @@ async function adaptersInfo() {
 }
 
 // ---- sessions (baton claude|codex|agy) ----
+// The worktree list runs git once per known repository: cached for a short
+// while so a board that polls does not fork fifty processes a second.
+const WORKTREES_TTL = 20000
+const worktreesCache = new Map()
+// A stale index is refreshed by a child `leg history refresh`, never in this
+// process: the scan stats thousands of files and walks every cwd, and inside
+// the board's event loop that is seconds of no SSE frames and no clicks. The
+// child takes the same index lock a CLI refresh would, so the two never tear
+// one file; the next listing reads what it wrote.
+const LEG_BIN = join(dirname(SELF), '..', 'bin', 'leg.mjs')
+let historyRefreshing = false
+function backgroundHistoryRefresh() {
+  if (historyRefreshing) return
+  historyRefreshing = true
+  try {
+    execFile(process.execPath, [LEG_BIN, 'history', 'refresh', '--json'], { env: process.env, windowsHide: true, timeout: 120000 }, () => { historyRefreshing = false })
+  } catch { historyRefreshing = false }
+}
+function worktreesFor({ repo = null, dirty = true } = {}) {
+  const key = `${repo ?? ''}|${dirty}`
+  const hit = worktreesCache.get(key)
+  if (hit && Date.now() - hit.at < WORKTREES_TTL) return hit.data
+  const data = listWorktrees({ repo, dirty, dirtyLimit: 20, repoLimit: 20 })
+  worktreesCache.set(key, { at: Date.now(), data })
+  return data
+}
+
+// canLand shells out to git several times for one worktree, and the view runs
+// it for every terminal that ever had one — over a second of subprocesses on a
+// board with a few dozen records, paid again on every SSE push. A terminal that
+// has ended never moves, so the answer is cached against the record's own
+// revision with the short TTL the trunk already uses, which still notices a
+// commit made by hand in the worktree within that window.
+// A terminal that is still running can change what it can land from one turn to
+// the next. One that has ended only moves if someone works in its worktree by
+// hand, and a landing clears this cache outright, so it is re-read a great deal
+// less often.
+const CAN_LAND_TTL = 15000
+const CAN_LAND_TTL_ENDED = 60000
+const canLandCache = new Map()
+function canLandFor(s) {
+  const key = `${s.session_id}|${s.updated_at ?? ''}`
+  const hit = canLandCache.get(key)
+  if (hit && Date.now() < hit.until) return hit.data
+  const data = canLand(s)
+  // Expiries are spread across the window instead of falling together: twenty
+  // worktrees re-read in one pass is another second of git inside the event
+  // loop, which is the stall this cache exists to remove. Staggered, the board
+  // pays for about one of them per push and never blocks on the set.
+  const ttl = isActive(s) ? CAN_LAND_TTL : CAN_LAND_TTL_ENDED
+  const until = Date.now() + ttl / 2 + Math.random() * ttl
+  // the key carries updated_at, so a busy terminal leaves a dead entry per
+  // write: drop the whole map rather than grow it for the life of the process
+  if (canLandCache.size > 500) canLandCache.clear()
+  canLandCache.set(key, { until, data })
+  return data
+}
+
 const trunkCache = new Map()
 function trunkFor(repo) {
   const hit = trunkCache.get(repo)
@@ -283,6 +345,11 @@ function visibleSessionFile(file) {
 
 export function sessionsView({ viewer = null, share = null } = {}) {
   const shared = Boolean(share && shareIsOn(share))
+  // Decided before the map below, because the per-session payload has to know
+  // it: a guest owns their own terminal and may hand it off, so they get its
+  // list of destinations — but a reset time is this machine's usage data and
+  // belongs to nobody else, even on a terminal that is theirs.
+  const guest = shared && viewer && viewer.role !== 'owner'
   const list = reapLost(listSessions())
   const ov = overlaps(list)
   const configuredAccounts = readAccounts()
@@ -293,13 +360,28 @@ export function sessionsView({ viewer = null, share = null } = {}) {
     const preferredNext = chain[0] ?? null
     const availabilityKnown = Boolean(s.installed)
     const eligibleNext = availabilityKnown ? (chain.find((next) => s.installed[next.agent] !== false && isAvailable(readUsage(next.agent, next.account))) ?? null) : null
-    const can = s.worktree ? canLand(s) : { ok: false, blockers: [{ code: 'no_worktree', message: 'this terminal works in the checkout itself: there is no branch of its own to land', fix: null }] }
+    const can = s.worktree ? canLandFor(s) : { ok: false, blockers: [{ code: 'no_worktree', message: 'this terminal works in the checkout itself: there is no branch of its own to land', fix: null }] }
     return {
       ...s,
       handoff_order: handoffOrder,
       chain,
       preferred_next: preferredNext,
       eligible_next: eligibleNext,
+      // every destination this terminal could be handed to, each with the
+      // reason it cannot be picked right now. The board's picker renders this
+      // list directly, so a greyed option always carries its own explanation.
+      handoff_targets: chain.map((c) => {
+        const u = readUsage(c.agent, c.account)
+        const missing = availabilityKnown && s.installed[c.agent] === false
+        const walled = !isAvailable(u)
+        return {
+          agent: c.agent,
+          account: c.account,
+          available: !missing && !walled,
+          reason: missing ? 'not installed on this machine' : walled ? 'at its usage limit' : null,
+          resets_at: walled && !guest ? (u.limited_until ?? null) : null,
+        }
+      }),
       handoff_availability_known: availabilityKnown,
       can_edit_handoff_order: s.runtime_capabilities?.includes(HANDOFF_ORDER_CAPABILITY) ?? false,
       active: isActive(s),
@@ -327,7 +409,6 @@ export function sessionsView({ viewer = null, share = null } = {}) {
   const canon = new Map()
   const landingsFor = (key) => landings.filter((l) => { if (!canon.has(l.repo)) canon.set(l.repo, canonPath(l.repo)); return canon.get(l.repo) === key })
   const trunk = [...repos].map(([key, r]) => { try { return withLandings(trunkFor(r), landingsFor(key)) } catch { return { repo: r, commits: [] } } })
-  const guest = shared && viewer && viewer.role !== 'owner'
   const mine = (s) => !shared || !viewer || viewer.role === 'owner' || (s.owner ?? share.owner) === viewer.name
   const shown = sessions.map((s) => (mine(s) ? { ...s, requests: readRequests(s.session_id).filter((r) => r.state === 'pending') } : redactSession(s)))
   return {
@@ -376,7 +457,7 @@ function serveStatic(res, urlPath) {
 }
 
 // ---- SSE: watch $BATON_HOME/cards for fs events and push only what changed ----
-function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () => sessionsView(), reauth = (c) => c.viewer } = {}) {
+function createSse({ healthIntervalMs = 10000, debounceMs = 30, sessionsDebounceMs = 300, sessionsMinIntervalMs = 2000, viewFor = () => sessionsView(), reauth = (c) => c.viewer } = {}) {
   const clients = new Set() // { res, viewer, token, loopback, sig }
   let watcher = null
   let healthTimer = null
@@ -401,14 +482,15 @@ function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () =>
   // resets the count the first is reading from.
   const refreshCard = (id) => {
     const card = readCard(id)
-    // pipeline cards and their events are the owner's: a guest never gets them
-    const forOwner = (payload) => (viewer) => (viewer && viewer.role !== 'owner' ? null : payload)
+    // pipeline cards and their events belong to the people who may run them:
+    // the owner and any operator. A guest never gets them.
+    const forOwner = (payload) => (viewer) => (viewer && !mayUseCards(viewer.role) ? null : payload)
     if (!card) { for (const c of clients) c.sig.delete(id); broadcast('removed', forOwner({ card_id: id })); return }
     const events = readEvents(id)
     // broadcast() refreshes each client's viewer (and drops revoked ones) first
     broadcast('card', forOwner(summarize(card)))
     for (const c of [...clients]) {
-      if (!c.viewer || c.viewer.role !== 'owner') { c.sig.set(id, events.length); continue }
+      if (!c.viewer || !mayUseCards(c.viewer.role)) { c.sig.set(id, events.length); continue }
       const from = c.sig.get(id) ?? 0
       c.sig.set(id, events.length)
       for (const e of events.slice(from)) { try { c.res.write(`event: event\ndata: ${JSON.stringify(e)}\n\n`) } catch {} }
@@ -426,13 +508,70 @@ function createSse({ healthIntervalMs = 10000, debounceMs = 30, viewFor = () =>
   }
   let sessionsWatcher = null
   let sessionsTimer = null
-  const pushSessions = () => { sessionsTimer = null; try { broadcast('sessions', (viewer) => viewFor(viewer)) } catch (err) { log(`sessions view: ${err.message}`) } }
+  let lastSessionsPush = 0
+  const pushSessions = () => {
+    sessionsTimer = null
+    try { broadcast('sessions', (viewer) => viewFor(viewer)) } catch (err) { log(`sessions view: ${err.message}`) }
+    lastSessionsPush = Date.now()
+    // the health tick pushes on its own schedule: record what it sent, so the
+    // next watcher hint is measured against the page's real contents
+    lastFingerprint = sessionsFingerprint()
+  }
+  // One live agent rewrites its record about every six seconds and takes a
+  // control lock about once a second, and every one of those touches the
+  // sessions tree. Rebuilding the whole view costs a second or more of `git`,
+  // so a watcher that answers every touch turns a single running terminal into
+  // a permanent busy loop on the one event loop this board serves every
+  // request from: the board then takes seconds to hand over a stylesheet and
+  // `leg` itself times out probing /api/health.
+  //
+  // A watcher event is only a hint. Locks and the temp files an atomic write
+  // leaves behind are dropped by name, but taking a lock inside a session
+  // directory also changes that directory's own mtime, and that event arrives
+  // carrying nothing but the directory name — no filter on the name can tell
+  // it from a real write. So the hint is checked against the data: a stat over
+  // the files the view is actually built from costs a fraction of a
+  // millisecond and answers the question the event cannot.
+  const NOISE = /(\.lock|\.tmp)$/i
+  const sessionsChangeMatters = (filename) => !filename || !NOISE.test(String(filename))
+  const sessionsFingerprint = () => {
+    const root = sessionsRoot()
+    let dirs
+    try { dirs = readdirSync(root) } catch { return '' }
+    let sig = ''
+    for (const name of dirs) {
+      if (!name.startsWith('s-')) continue
+      for (const file of ['session.json', 'land.json', 'requests.json']) {
+        try { const st = statSync(join(root, name, file)); sig += `${name}/${file}:${st.mtimeMs}:${st.size};` } catch { /* not written yet */ }
+      }
+    }
+    return sig
+  }
+  let lastFingerprint = null
+  const pushIfChanged = () => {
+    sessionsTimer = null
+    const sig = sessionsFingerprint()
+    // the hint was noise: the view would rebuild to exactly what the page
+    // already has, so nothing is rebuilt and nothing is sent
+    if (sig === lastFingerprint) return
+    lastFingerprint = sig
+    pushSessions()
+  }
+  const scheduleSessionsPush = () => {
+    if (sessionsTimer) return
+    const wait = Math.max(sessionsDebounceMs, sessionsMinIntervalMs - (Date.now() - lastSessionsPush))
+    sessionsTimer = setTimeout(pushIfChanged, wait)
+  }
   const startWatch = () => {
     if (watcher) return
     try {
       const sdir = sessionsRoot()
       mkdirSync(sdir, { recursive: true })
-      sessionsWatcher = fsWatch(realPath(sdir), { recursive: true }, () => { if (!sessionsTimer) sessionsTimer = setTimeout(pushSessions, 300) })
+      // the client that opened this watch was handed the current view with its
+      // hello frame, so the fingerprint starts from what it already has: an
+      // unprimed one makes the first hint of any kind look like a change
+      lastFingerprint = sessionsFingerprint()
+      sessionsWatcher = fsWatch(realPath(sdir), { recursive: true }, (_event, filename) => { if (sessionsChangeMatters(filename)) scheduleSessionsPush() })
     } catch (err) { log(`sessions watch: ${err.message}`); sessionsWatcher = null }
     // watch the real long path: libuv's recursive watcher asserts when the
     // watched dir is an 8.3 short path (fs-event.c, seen on a GitHub runner)
@@ -496,7 +635,7 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
   }
   const limiter = createLimiter()
   const viewFor = (viewer, sh) => sessionsView({ viewer, share: sh ?? currentShare() })
-  const forOwner = (payload) => (viewer) => (viewer && viewer.role !== 'owner' ? null : payload)
+  const forOwner = (payload) => (viewer) => (viewer && !mayUseCards(viewer.role) ? null : payload)
   // SSE re-identifies each client from the live roster on every push
   const reauthClient = (c) => {
     const sh = currentShare()
@@ -571,17 +710,23 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
     const rl = limiter.request(auth.person ? viewer.name : ip)
     if (!rl.ok) return send(res, 429, { error: `rate limit: more than ${limiter.max} requests a minute` }, { 'Retry-After': String(rl.retry_after) })
     const actor = { type: 'human', id: viewer.name }
-    // a guest sees the terminals lane, read-only; the pipeline side is the owner's
-    const guest = shared && viewer.role !== 'owner'
+    // What this viewer may reach, decided once from their role (src/share.mjs).
+    // `canCards` is the pipeline board: cards, the floor, the adapters and the
+    // leases, which an operator runs. `canMachine` is everything that describes
+    // this computer rather than the work — the settings, the trunk's repo
+    // paths, the history index, the worktree map — and stays the owner's.
+    const canCards = !shared || mayUseCards(viewer.role)
+    const canMachine = !shared || mayUseMachine(viewer.role)
     const ownsSession = (s) => !shared || viewer.role === 'owner' || (s.owner ?? share.owner) === viewer.name
     const parts = path.split('/').filter(Boolean) // ['api', ...]
-    if (guest && ['cards', 'floor', 'presets', 'adapters', 'leases', 'trunk'].includes(parts[1])) return send(res, 403, { error: 'the pipeline board belongs to the owner of this machine' })
+    if (!canCards && ['cards', 'floor', 'presets', 'adapters', 'leases'].includes(parts[1])) return send(res, 403, { error: 'the pipeline board belongs to the owner and the operators of this machine' })
+    if (!canMachine && ['trunk', 'history', 'worktrees', 'audit'].includes(parts[1])) return send(res, 403, { error: 'this is the map of the machine itself: every repository path and every conversation on it. It belongs to the owner of this machine.' })
     try {
       if (req.method === 'GET' && path === '/api/health') {
         const you = { ...viewer, share: { on: shared, people: shared ? share.people.length : 0 } }
-        if (guest) return send(res, 200, { ok: true, version: VERSION, you })
+        if (!canCards) return send(res, 200, { ok: true, version: VERSION, you })
         const cards = listCards()
-        return send(res, 200, { ok: true, pid: process.pid, version: VERSION, bind, port, home: home(), you, scheduler: { ...schedulerStatus(), in_process: Boolean(sched), max_concurrent: MAX_CONCURRENT }, tools: await detectTools(), columns: columnsFor(cards), cards: cards.length })
+        return send(res, 200, { ok: true, pid: process.pid, version: VERSION, bind, port, home: canMachine ? home() : null, you, scheduler: { ...schedulerStatus(), in_process: Boolean(sched), max_concurrent: MAX_CONCURRENT }, tools: await detectTools(), columns: columnsFor(cards), cards: cards.length })
       }
       if (req.method === 'GET' && path === '/api/adapters') return send(res, 200, { adapters: await adaptersInfo() })
       if (req.method === 'GET' && path === '/api/presets') return send(res, 200, { presets: PRESETS })
@@ -602,14 +747,14 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
       }
       if (req.method === 'GET' && path === '/api/events') {
         res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' })
-        const cards = guest ? [] : listCards()
+        const cards = canCards ? listCards() : []
         res.write(`event: hello\ndata: ${JSON.stringify({ columns: columnsFor(cards), cards: cards.map(summarize), sessions: viewFor(viewer), ts: new Date().toISOString() })}\n\n`)
         sse.add(res, cards, viewer, { token: presentedToken(req, url), loopback: isLoopbackRequest(req) })
         return
       }
       if (req.method === 'GET' && path === '/api/sessions') return send(res, 200, viewFor(viewer))
       if (path === '/api/settings') {
-        if (guest) return send(res, 403, { error: 'the machine settings belong to the owner of this board' })
+        if (!canMachine) return send(res, 403, { error: 'the machine settings belong to the owner of this board' })
         if (req.method === 'GET') return send(res, 200, { preferences: readPreferences() })
         if (req.method === 'POST' || req.method === 'PATCH') {
           const body = await readBody(req)
@@ -738,15 +883,38 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
           if (why) return send(res, 409, { error: why })
           landSession(sess, { by: actor.id, autoCommit: true })
             .catch((err) => log(`land ${id}: ${err.message}`))
-            .finally(() => { trunkCache.clear(); try { sse.broadcast('sessions', (v) => viewFor(v)) } catch {} })
+            // a landing moves the branch under every worktree cut from it, so
+            // the cached land-ability goes with the cached trunk
+            .finally(() => { trunkCache.clear(); canLandCache.clear(); try { sse.broadcast('sessions', (v) => viewFor(v)) } catch {} })
           log(`land requested for ${id} by ${actor.id}`)
           return send(res, 202, { ok: true, requested: 'land' })
         }
         if (req.method === 'POST' && (parts[3] === 'handoff' || parts[3] === 'end')) {
           if (!isActive(sess)) return send(res, 409, { error: `session ${id} is not active` })
-          requestControl(id, parts[3] === 'handoff' ? { handoff: true, by: actor.id } : { end: true, by: actor.id })
-          log(`${parts[3]} requested for ${id} by ${actor.id}`)
-          return send(res, 200, { ok: true, requested: parts[3] })
+          if (parts[3] === 'end') {
+            requestControl(id, { end: true, by: actor.id })
+            log(`end requested for ${id} by ${actor.id}`)
+            return send(res, 200, { ok: true, requested: 'end' })
+          }
+          // Hand off now, optionally to a named destination. With no body the
+          // chain decides, exactly as it did before the picker existed.
+          const body = await readBody(req)
+          let target = null
+          if (body && body.agent !== undefined && body.agent !== null && body.agent !== '') {
+            const want = { agent: String(body.agent), account: String(body.account ?? 'default') }
+            const order = normalizeHandoffOrder(sess.handoff_order)
+            const chain = candidates({ agent: sess.agent, account: sess.account, accounts: readAccounts(), order })
+            const hit = chain.find((c) => c.agent === want.agent && c.account === want.account)
+            const label = `${want.agent}${want.account !== 'default' ? '/' + want.account : ''}`
+            if (!hit) return send(res, 400, { error: `${label} is not a destination for this terminal (${chain.map((c) => c.agent + (c.account !== 'default' ? '/' + c.account : '')).join(', ') || 'none'})` })
+            if (sess.installed && sess.installed[want.agent] === false) return send(res, 409, { error: `${label} is not installed on this machine` })
+            const u = readUsage(want.agent, want.account)
+            if (!isAvailable(u)) return send(res, 409, { error: `${label} is at its usage limit until ${fmtReset(u.limited_until)}; pick another or use Hand off now without a destination` })
+            target = hit
+          }
+          requestControl(id, target ? { handoff: true, target, by: actor.id } : { handoff: true, by: actor.id })
+          log(`handoff requested for ${id} by ${actor.id}${target ? ` to ${target.agent}/${target.account}` : ''}`)
+          return send(res, 200, { ok: true, requested: 'handoff', target })
         }
         if (req.method === 'DELETE' && parts.length === 3) {
           if (isActive(sess)) return send(res, 409, { error: 'end the session before removing it' })
@@ -766,6 +934,75 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
           return send(res, 200, { removed: id, worktree })
         }
       }
+      // ---- history: the read-only index over every agent's own store ----
+      if (parts[1] === 'history') {
+        const q = url.searchParams
+        const int = (v, def, max) => { const n = parseInt(v ?? '', 10); return Number.isFinite(n) && n >= 0 ? Math.min(n, max) : def }
+        if (req.method === 'GET' && parts.length === 2) {
+          const provider = q.get('provider') || null
+          if (provider && provider.split(',').some((p) => !PROVIDER_NAMES.includes(p.trim()))) return send(res, 400, { error: `unknown provider in "${provider}" (${PROVIDER_NAMES.join('|')})` })
+          const tri = (v) => (v === '1' || v === 'true' ? true : v === '0' || v === 'false' ? false : null)
+          const explicitRefresh = tri(q.get('refresh')) === true
+          let refreshArg = null
+          if (!explicitRefresh) {
+            const idx = readIndex()
+            if (idx) {
+              const age = idx.refreshed_at ? Date.now() - Date.parse(idx.refreshed_at) : Infinity
+              if (age > 60000) backgroundHistoryRefresh()
+              refreshArg = false
+            }
+          } else {
+            refreshArg = true
+          }
+          return send(res, 200, listHistory({
+            provider, repo: q.get('repo') || null, search: q.get('search') || null,
+            before: q.get('before') || null,
+            // never the whole index in one response: a page is 1 to 200 rows
+            limit: Math.max(1, int(q.get('limit'), 50, 200)), offset: int(q.get('offset'), 0, 1e6),
+            managed: tri(q.get('managed')), live: tri(q.get('live')), includeHidden: tri(q.get('hidden')) === true,
+            refresh: refreshArg,
+          }))
+        }
+        if (req.method === 'GET' && parts[2] === 'providers') return send(res, 200, { providers: providerSupport() })
+        if (req.method === 'POST' && parts[2] === 'refresh') {
+          const body = await readBody(req)
+          const t = Date.now()
+          try {
+            const r = refreshIndex({ force: body.full === true })
+            return send(res, 200, { ms: Date.now() - t, refreshed_at: r.index.refreshed_at, stats: r.stats })
+          } catch (err) { return send(res, 409, { error: `refresh did not run: ${err.message}` }) }
+        }
+        if (req.method === 'GET' && parts.length === 3) {
+          // the id is a lookup key, never a path: findRecord compares strings,
+          // and the transcript it names is read only from inside a known store
+          let rec
+          let wanted
+          try { wanted = decodeURIComponent(parts[2]) } catch { return send(res, 400, { error: 'malformed id' }) }
+          try { rec = findRecord(wanted, { refresh: false }) } catch (err) {
+            if (err instanceof HistoryInputError) return send(res, 400, { error: err.message })
+            throw err
+          }
+          if (!rec) return send(res, 404, { error: `no conversation matches ${parts[2]}` })
+          return send(res, 200, recordDetail(rec, { messages: int(q.get('messages'), 8, 50) }))
+        }
+        return send(res, 404, { error: 'not found' })
+      }
+      if (req.method === 'GET' && path === '/api/worktrees') {
+        const q = url.searchParams
+        return send(res, 200, worktreesFor({ repo: q.get('repo') || null, dirty: q.get('dirty') !== '0' }))
+      }
+      if (req.method === 'GET' && path === '/api/audit') {
+        const q = url.searchParams
+        const kind = q.get('kind')
+        if (kind && !ACTOR_KINDS.includes(kind)) return send(res, 400, { error: `kind is one of ${ACTOR_KINDS.join(', ')}` })
+        const limit = parseInt(q.get('limit') ?? '200', 10)
+        return send(res, 200, auditTrail({
+          limit: Number.isFinite(limit) ? limit : 200,
+          since: q.get('since'),
+          who: q.get('who'),
+          kind,
+        }))
+      }
       if (req.method === 'GET' && path === '/api/floor') return send(res, 200, floor(listCards()))
       if (req.method === 'GET' && path === '/api/trunk') return send(res, 200, trunk(listCards(), parseSince(url.searchParams.get('since'))))
       if (req.method === 'GET' && path === '/api/leases') return send(res, 200, { leases: held(listCards()) })
@@ -826,21 +1063,28 @@ export function createBoardServer({ bind, port, token = process.env.LEG_TOKEN ||
   }
 
   const onReq = (req, res) => { handle(req, res).catch((err) => { try { send(res, 500, { error: scrub(err.message) }) } catch {} }) }
-  const server = http.createServer(onReq)
+  // TLS when a certificate pair is configured (leg share on --tls-cert/--tls-key,
+  // or LEG_TLS_CERT/LEG_TLS_KEY). readTls throws rather than fall back to
+  // plaintext: a board told to use TLS and quietly serving http would be the
+  // worst outcome of the three.
+  const tls = readTls(initialShare)
+  const server = tls ? https.createServer({ cert: tls.cert, key: tls.key }, onReq) : http.createServer(onReq)
   // When the board is bound to a non-loopback address (share on), also listen on
   // 127.0.0.1 so the machine's own browser has a tokenless owner URL — a real
-  // remote peer's address is never loopback, so it still needs a token.
+  // remote peer's address is never loopback, so it still needs a token. That one
+  // stays plain http even under TLS: the certificate is for the shared name, and
+  // loopback traffic never leaves this machine.
   const loopbackCompanion = !isLoopback(bind) ? http.createServer(onReq) : null
 
   return {
     server,
-    bind, port,
+    bind, port, tls: tls ? { cert_path: tls.cert_path, key_path: tls.key_path } : null,
     start() {
       return new Promise((resolvePromise, reject) => {
         server.once('error', reject)
         server.listen(port, bind, () => {
           const addr = server.address()
-          log(`listening on http://${bind}:${addr.port} (home ${home()}${token ? ', token required' : ', loopback open'})`)
+          log(`listening on ${tls ? 'https' : 'http'}://${bind}:${addr.port} (home ${home()}${token ? ', token required' : ', loopback open'}${tls ? `, TLS from ${tls.cert_path}` : ''})`)
           // A terminal that crashed instead of exiting left its hand-off in
           // .leg/RESUME.md looking live. The board is the thing that starts
           // after a crash, so it is where that gets corrected.

package/src/sessions.mjs

@@ -85,6 +85,15 @@ export function updateSession(id, patch, { event } = {}) {
     const delta = typeof patch === 'function' ? patch(cur) : patch
     const next = { ...cur, ...delta, updated_at: now() }
     if (delta.limits && cur.limits) next.limits = { ...cur.limits, ...delta.limits }
+    // every agent conversation this session has been: a hand-off overwrites
+    // agent_session_id with the next agent's, and history (src/history) still
+    // needs to know the earlier legs were this session's too
+    if (delta.agent_session_id && delta.agent_session_id !== cur.agent_session_id) {
+      const seen = cur.agent_sessions ?? []
+      if (!seen.some((x) => x.agent === next.agent && x.agent_session_id === delta.agent_session_id)) {
+        next.agent_sessions = [...seen, { agent: next.agent, agent_session_id: delta.agent_session_id, transcript_path: delta.transcript_path ?? null, at: now() }].slice(-24)
+      }
+    }
     writeJsonAtomic(join(sessionDir(id), 'session.json'), next)
     if (event) appendEvent(id, event)
     return next

package/src/share.mjs

@@ -6,15 +6,29 @@
 // (`BATON_PERSON`, else the owner). With it off nothing changes: loopback is
 // open and `BATON_TOKEN` is the only token.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
-import { existsSync, readFileSync, mkdirSync } from 'node:fs'
+import { existsSync, readFileSync, mkdirSync, statSync } from 'node:fs'
 import { networkInterfaces, userInfo } from 'node:os'
 import { createSocket } from 'node:dgram'
 import { join } from 'node:path'
 import { home } from './store.mjs'
 import { writeJsonAtomic } from './fsx.mjs'
 
-export const OFF = { version: 1, on: false, bind: null, bind_kind: null, port: null, owner: null, people: [] }
-export const ROLES = ['owner', 'guest']
+export const OFF = { version: 1, on: false, bind: null, bind_kind: null, port: null, owner: null, people: [], tls: null }
+
+// Three roles, because two were not enough to describe a second human who runs
+// cards on this machine but has no business in its settings or its project map.
+//   owner     everything: machine settings, the harness, every terminal, cards
+//   operator  the pipeline board and their own terminals; not the settings,
+//             not the history index, not anyone else's terminal
+//   guest     the terminals lane, read-only and redacted; may ask for a hand-off
+export const ROLES = ['owner', 'operator', 'guest']
+
+// One place that says what a role may reach, so no endpoint decides for itself.
+// `cards` is the pipeline side of the board. `machine` is everything that
+// describes this computer rather than the work: the settings, the harness
+// policy, the history index and the worktree map.
+export function mayUseCards(role) { return role === 'owner' || role === 'operator' }
+export function mayUseMachine(role) { return role === 'owner' }
 
 export function sharePath() { return join(home(), 'share.json') }
 
@@ -55,9 +69,49 @@ export function identify(share, presented) {
 export function personNamed(share, name) { return share.people.find((p) => p.name.toLowerCase() === String(name ?? '').toLowerCase()) ?? null }
 export function isOwner(person) { return person?.role === 'owner' }
 
+// ---- TLS ----
+// Leg does not make certificates. It uses a pair you already have, which on a
+// Tailscale network is one command (`tailscale cert <machine>.<tailnet>.ts.net`)
+// and gives a certificate browsers already trust. A self-signed pair would
+// teach everyone on the board to click through a warning, which is worse than
+// no TLS at all on a network that is already private.
+export class TlsRefused extends Error {
+  constructor(msg) { super(msg); this.name = 'TlsRefused'; this.exitCode = 3 }
+}
+
+function tlsPaths(share, env) {
+  return {
+    cert: env.LEG_TLS_CERT || env.BATON_TLS_CERT || share?.tls?.cert || null,
+    key: env.LEG_TLS_KEY || env.BATON_TLS_KEY || share?.tls?.key || null,
+  }
+}
+
+// → { cert, key, cert_path, key_path } | null. Throws TlsRefused when a pair is
+// configured but unusable: a board that quietly fell back to plaintext after
+// being told to use TLS is the one failure this must not have.
+export function readTls(share = readShare(), env = process.env) {
+  const { cert: certPath, key: keyPath } = tlsPaths(share, env)
+  if (!certPath && !keyPath) return null
+  if (!certPath || !keyPath) throw new TlsRefused('TLS needs both a certificate and a key (--tls-cert and --tls-key, or LEG_TLS_CERT and LEG_TLS_KEY)')
+  for (const [label, file] of [['certificate', certPath], ['key', keyPath]]) {
+    if (!existsSync(file)) throw new TlsRefused(`TLS ${label} not found: ${file}`)
+    try { statSync(file) } catch (err) { throw new TlsRefused(`TLS ${label} ${file}: ${err.message}`) }
+  }
+  let cert
+  let key
+  try { cert = readFileSync(certPath) } catch (err) { throw new TlsRefused(`TLS certificate ${certPath}: ${err.message}`) }
+  try { key = readFileSync(keyPath) } catch (err) { throw new TlsRefused(`TLS key ${keyPath}: ${err.message}`) }
+  if (!cert.length || !key.length) throw new TlsRefused('the TLS certificate or key is empty')
+  return { cert, key, cert_path: certPath, key_path: keyPath }
+}
+
+export function tlsConfigured(share = readShare(), env = process.env) { return Boolean(tlsPaths(share, env).cert) }
+
+export function scheme(share = readShare(), env = process.env) { return tlsConfigured(share, env) ? 'https' : 'http' }
+
 export function addPerson(name, { role = 'guest', share = readShare() } = {}) {
   if (!validName(name)) throw new Error(`bad name "${name}": letters, digits, dash and underscore, up to 32 characters`)
-  if (!ROLES.includes(role)) throw new Error(`bad role "${role}" (owner|guest)`)
+  if (!ROLES.includes(role)) throw new Error(`bad role "${role}" (${ROLES.join('|')})`)
   if (personNamed(share, name)) throw new Error(`"${name}" is already on the board; baton share rotate ${name} issues a new link`)
   const token = newToken()
   const person = { name, role, token_sha256: hashToken(token), created_at: new Date().toISOString(), last_seen: null }
@@ -122,7 +176,7 @@ export async function resolveBind(kind = 'tailscale') {
   return lan.address
 }
 
-export function linkFor(share, token) { return `http://${share.bind}:${share.port}/?token=${token}` }
+export function linkFor(share, token) { return `${scheme(share)}://${share.bind}:${share.port}/?token=${token}` }
 
 // Whose terminal this is: BATON_PERSON, else the board's owner, else 'local'.
 export function whoami(share = readShare()) {
@@ -131,9 +185,15 @@ export function whoami(share = readShare()) {
   return share.owner || 'local'
 }
 
-export async function turnOn({ bind = 'tailscale', port = Number(process.env.LEG_PORT || process.env.BATON_PORT || 4747), owner } = {}) {
+export async function turnOn({ bind = 'tailscale', port = Number(process.env.LEG_PORT || process.env.BATON_PORT || 4747), owner, tlsCert = null, tlsKey = null } = {}) {
   const share = readShare()
   const address = await resolveBind(bind)
+  if (tlsCert || tlsKey) {
+    if (!tlsCert || !tlsKey) throw new TlsRefused('TLS needs both --tls-cert and --tls-key')
+    share.tls = { cert: tlsCert, key: tlsKey }
+    // read the pair now, so a bad one fails here and not at the next board start
+    readTls(share, {})
+  }
   share.on = true
   share.bind = address
   share.bind_kind = ['tailscale', 'lan'].includes(String(bind).toLowerCase()) ? String(bind).toLowerCase() : 'address'