cyberlegion 1.10.0 → 2.0.1

package/dist/cli.mjs

@@ -8,7 +8,7 @@ import { stripVTControlCharacters } from "node:util";
 import { homedir } from "node:os";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { lstat, readFile, readdir, readlink, realpath, unlink, writeFile } from "node:fs/promises";
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/error.js
 /**
 * CommanderError class
 */
@@ -42,8 +42,7 @@ var InvalidArgumentError = class extends CommanderError {
 		this.name = this.constructor.name;
 	}
 };
-//#endregion
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/argument.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/argument.js
 var Argument = class {
 	/**
 	* Initialize a new command argument with the given name and description.
@@ -161,8 +160,7 @@ function humanReadableArgName(arg) {
 	const nameOutput = arg.name() + (arg.variadic === true ? "..." : "");
 	return arg.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
 }
-//#endregion
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/help.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/help.js
 /**
 * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS`
 * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types
@@ -230,8 +228,8 @@ var Help = class {
 			const removeShort = helpOption.short && cmd._findOption(helpOption.short);
 			const removeLong = helpOption.long && cmd._findOption(helpOption.long);
 			if (!removeShort && !removeLong) visibleOptions.push(helpOption);
-			else if (helpOption.long && !removeLong) visibleOptions.push(cmd.createOption(helpOption.long, helpOption.description));
-			else if (helpOption.short && !removeShort) visibleOptions.push(cmd.createOption(helpOption.short, helpOption.description));
+			else if (helpOption.long && !removeLong) visibleOptions.push(cmd.createOption(helpOption.long, helpOption.description).helpGroup(helpOption.helpGroupHeading));
+			else if (helpOption.short && !removeShort) visibleOptions.push(cmd.createOption(helpOption.short, helpOption.description).helpGroup(helpOption.helpGroupHeading));
 		}
 		if (this.sortOptions) visibleOptions.sort(this.compareOptions);
 		return visibleOptions;
@@ -636,8 +634,7 @@ var Help = class {
 		return wrappedLines.join("\n");
 	}
 };
-//#endregion
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/option.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/option.js
 var Option = class {
 	/**
 	* Initialize a new `Option` with the given `flags` and `description`.
@@ -650,7 +647,7 @@ var Option = class {
 		this.description = description || "";
 		this.required = flags.includes("<");
 		this.optional = flags.includes("[");
-		this.variadic = /\w\.\.\.[>\]]$/.test(flags);
+		this.variadic = /\p{ID_Continue}\.\.\.[>\]]$/u.test(flags);
 		this.mandatory = false;
 		const optionFlags = splitOptionFlags(flags);
 		this.short = optionFlags.shortFlag;
@@ -934,8 +931,7 @@ function splitOptionFlags(flags) {
 		longFlag
 	};
 }
-//#endregion
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/suggestSimilar.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/suggestSimilar.js
 const maxDistance = 3;
 function editDistance(a, b) {
 	if (Math.abs(a.length - b.length) > maxDistance) return Math.max(a.length, b.length);
@@ -986,8 +982,7 @@ function suggestSimilar(word, candidates) {
 	if (similar.length === 1) return `\n(Did you mean ${similar[0]}?)`;
 	return "";
 }
-//#endregion
-//#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/command.js
+// ../../node_modules/.pnpm/commander@15.1.0/node_modules/commander/lib/command.js
 var Command = class Command extends EventEmitter {
 	/**
 	* Initialize a new `Command`.
@@ -1737,7 +1732,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 	getOptionValueSourceWithGlobals(key) {
 		let source;
 		this._getCommandAndAncestors().forEach((cmd) => {
-			if (cmd.getOptionValueSource(key) !== void 0) source = cmd.getOptionValueSource(key);
+			if (Object.hasOwn(cmd._optionValueSources, key)) source = cmd.getOptionValueSource(key);
 		});
 		return source;
 	}
@@ -2246,7 +2241,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 			return arg.length > 1 && arg[0] === "-";
 		}
 		const negativeNumberArg = (arg) => {
-			if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
+			if (!/^-(\d+|\d*\.\d+)([eE][+-]?\d+)?$/.test(arg)) return false;
 			return !this._getCommandAndAncestors().some((cmd) => cmd.options.map((opt) => opt.short).some((short) => /^-\d$/.test(short)));
 		};
 		let activeVariadicOption = null;
@@ -2646,7 +2641,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 	* (This does not override a group set directly on the subcommand using .helpGroup().)
 	*
 	* @example
-	* program.commandsGroup('Development Commands:);
+	* program.commandsGroup('Development Commands:');
 	* program.command('watch')...
 	* program.command('lint')...
 	* ...
@@ -2815,7 +2810,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 	* Pass in false to disable the built-in help option.
 	*
 	* @example
-	* program.helpOption('-?, --help' 'show help'); // customise
+	* program.helpOption('-?, --help', 'show help'); // customise
 	* program.helpOption(false); // disable
 	*
 	* @param {(string | boolean)} flags
@@ -2937,12 +2932,12 @@ function incrementNodeInspectorPort(args) {
 		let debugHost = "127.0.0.1";
 		let debugPort = "9229";
 		let match;
-		if ((match = arg.match(/^(--inspect(-brk)?)$/)) !== null) debugOption = match[1];
-		else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
+		if ((match = arg.match(/^(--inspect(-brk|-wait)?)$/)) !== null) debugOption = match[1];
+		else if ((match = arg.match(/^(--inspect(-brk|-port|-wait)?)=(\[[^\]]+\]|[^:]+)$/)) !== null) {
 			debugOption = match[1];
 			if (/^\d+$/.test(match[3])) debugPort = match[3];
 			else debugHost = match[3];
-		} else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
+		} else if ((match = arg.match(/^(--inspect(-brk|-port|-wait)?)=(\[[^\]]+\]|[^:]+):(\d+)$/)) !== null) {
 			debugOption = match[1];
 			debugHost = match[3];
 			debugPort = match[4];
@@ -2962,8 +2957,7 @@ function useColor() {
 	if (process$1.env.FORCE_COLOR || process$1.env.CLICOLOR_FORCE !== void 0) return true;
 }
 new Command();
-//#endregion
-//#region ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/exec-Bmdcg_T7.mjs
+// ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/exec-Bmdcg_T7.mjs
 const nodeExec$1 = (cmd, args) => {
 	try {
 		const out = execFileSync(cmd, args, {
@@ -2990,8 +2984,7 @@ const nodeExec$1 = (cmd, args) => {
 function withReason(exec, message) {
 	return exec.lastError ? `${message} — ${exec.lastError}` : message;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/backend-D3VSsev4.mjs
+// ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/backend-D3VSsev4.mjs
 const KNOWN_MUX = [
 	"tmux",
 	"rmux",
@@ -9138,8 +9131,7 @@ function callerPane(adapter, env) {
 	const self = currentPane(env);
 	return self && self.mux === adapter.name ? { id: self.pane } : void 0;
 }
-//#endregion
-//#region src/admin.ts
+// src/admin.ts
 /**
 * Merge one store's registry + mailboxes + briefs into another (skip agent ids already present at
 * the destination). Used by `admin migrate` when moving state between an old project-local root
@@ -9173,8 +9165,7 @@ function migrateStore(from, to) {
 		briefs
 	};
 }
-//#endregion
-//#region ../../node_modules/.pnpm/cyber-agentkit@2.0.0/node_modules/cyber-agentkit/dist/worktrees.js
+// ../../node_modules/.pnpm/cyber-agentkit@2.2.0/node_modules/cyber-agentkit/dist/worktrees.js
 /**
 * Whether a checkout has uncommitted changes, tracked or untracked, or `undefined` when git could not
 * say. `undefined` is not `false`: a caller deciding whether a worktree is safe to reuse must not read
@@ -10247,8 +10238,7 @@ async function exists(path) {
 		return false;
 	}
 }
-//#endregion
-//#region ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/worktree.mjs
+// ../../node_modules/.pnpm/cyber-mux@0.12.0/node_modules/cyber-mux/dist/worktree.mjs
 /**
 * This module's own refusals and failures — plain cyber-mux prose, never a dependency's raw words.
 * `reportWorktreeFailure` (`cli.ts`) forwards a `WorktreeGitError`'s message onto stdout verbatim
@@ -10309,8 +10299,7 @@ function resolvePrimaryRoot(exec) {
 function assertDistinctFromPrimary(worktreeRoot, primaryRoot) {
 	if (resolve(worktreeRoot) === resolve(primaryRoot)) throw new WorktreeGitError("refusing to run in the primary checkout — spawn a worktree distinct from the primary checkout");
 }
-//#endregion
-//#region src/paths.ts
+// src/paths.ts
 /** The tracked marker file that makes a hub root initialized (see ensureMarker). */
 const MARKER_FILE = "config.json";
 /** Where `spawn` stamps that marker inside a worktree it creates, relative to the worktree root. */
@@ -10406,8 +10395,7 @@ const paths = {
 function sanitizePane(pane) {
 	return pane.replace(/[^A-Za-z0-9_-]/g, "_");
 }
-//#endregion
-//#region src/mux-env.ts
+// src/mux-env.ts
 /**
 * Transitional env-normalization seam (mux.feature: "a pane carrying only the legacy fast-path vars
 * is still honored"). cyber-mux's own fast-path reads `$CYBER_MUX`/`$CYBER_MUX_PANE` — its
@@ -10436,8 +10424,7 @@ function normalizeMuxEnv(env) {
 		CYBER_MUX_PANE: env.CYBERLEGION_MUX_PANE
 	};
 }
-//#endregion
-//#region src/identity.ts
+// src/identity.ts
 const realExec = nodeExec$1;
 /** `currentPane`, narrowed to a backend the registry can actually store a locator under. A caller
 * inside a pane-carrying-but-unstorable multiplexer (wezterm/zellij) is simply unpaned here — it can
@@ -10450,6 +10437,133 @@ function storablePane(env) {
 		pane: cur.pane
 	} : void 0;
 }
+/** The calling session's storable pane, resolved the way `register` resolves it: herdr's answer
+* when herdr gives a trustworthy one, `$HERDR_PANE_ID` otherwise (#154, #268). */
+function callingStorablePane(ctx) {
+	return selfPane(storablePane(ctx.env ?? process.env), ctx.exec ?? realExec);
+}
+/**
+* This session's own pane as the multiplexer sees it now. The env names the pane the shell was
+* launched in, and for herdr that goes stale: herdr gives a pane a new id when it moves to another
+* tab or workspace, while the shell keeps its launch-time `$HERDR_PANE_ID`, and herdr ids recur on a
+* hub, so the stale id can be another unit's pane (#154). herdr's `pane current` resolves the
+* calling pane itself, so its answer wins on a herdr that answers it truly (0.8.2 on). When herdr
+* gives no answer, or an older herdr disagrees with the env, the env id stands. tmux pane
+* ids last as long as the pane, so tmux needs no second opinion.
+*/
+function selfPane(cur, exec) {
+	if (cur?.mux !== "herdr") return cur;
+	const live = herdrCallingPane(exec);
+	if (!live) return cur;
+	if (live.pane === cur.pane) return {
+		...cur,
+		...live.terminal ? { terminal: live.terminal } : {}
+	};
+	if (!herdrReportsCallingPane(exec)) return cur;
+	return {
+		...cur,
+		pane: live.pane,
+		...live.terminal ? { terminal: live.terminal } : {}
+	};
+}
+/** herdr 0.8.2 fixed `pane current` to answer the calling pane; before it, the command answered
+* another client's focused pane (herdr #2297), which would misattribute exactly as a stale env id
+* does. A version that cannot be read is treated as too old. */
+function herdrReportsCallingPane(exec) {
+	const m = exec("herdr", ["--version"])?.match(/(\d+)\.(\d+)\.(\d+)/);
+	if (!m) return false;
+	const [major, minor, patch] = m.slice(1).map(Number);
+	return major > 0 || minor > 8 || minor === 8 && patch >= 2;
+}
+function herdrCallingPane(exec) {
+	return herdrPaneAnswer(exec("herdr", ["pane", "current"]));
+}
+/** Parse a herdr `pane current` / `pane get` answer into its pane id and terminal id. */
+function herdrPaneAnswer(out) {
+	if (!out) return void 0;
+	try {
+		const pane = JSON.parse(out)?.result?.pane;
+		const id = pane?.pane_id;
+		if (typeof id !== "string" || !id) return void 0;
+		const terminal = pane.terminal_id;
+		return {
+			pane: id,
+			...typeof terminal === "string" && terminal ? { terminal } : {}
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* The herdr terminal id behind a pane id — what a unit's herdr pane record keys on besides the pane
+* id. herdr gives a pane a new id when it moves to another workspace and keeps its terminal id
+* (#272; herdr 0.9.5: `pane move wRD:p2 --tab wRE:t1` answered `wRE:p2` on the same `terminal_id`).
+* Undefined when herdr does not answer or reports no terminal id.
+*/
+function herdrTerminalOf(exec, paneId) {
+	return herdrPaneAnswer(exec("herdr", [
+		"pane",
+		"get",
+		paneId
+	]))?.terminal;
+}
+/** The pane locator for a pane a spawn or restart just opened: tagged with its multiplexer so the
+* unit's own `prune` runs the right liveness check, and for herdr carrying the terminal id a move
+* keeps. `null` for a backend a record cannot carry. */
+function openedPaneLocator(exec, mux, id) {
+	if (mux === "tmux") return {
+		mux,
+		id
+	};
+	if (mux !== "herdr") return null;
+	const terminal = herdrTerminalOf(exec, id);
+	return {
+		mux,
+		id,
+		...terminal ? { terminal } : {}
+	};
+}
+/** herdr's live panes keyed by terminal id → current pane id. Empty when herdr gives no list, which
+* says nothing about any pane. */
+function herdrTerminals(exec) {
+	const map = /* @__PURE__ */ new Map();
+	const out = exec("herdr", ["pane", "list"]);
+	if (!out) return map;
+	try {
+		const panes = JSON.parse(out)?.result?.panes;
+		if (!Array.isArray(panes)) return map;
+		for (const p of panes) if (typeof p?.terminal_id === "string" && typeof p?.pane_id === "string") map.set(p.terminal_id, p.pane_id);
+	} catch {
+		return map;
+	}
+	return map;
+}
+/**
+* Where a herdr record that carries its terminal id lives now: the pane id herdr lists for that
+* terminal (`{ id }`), `'gone'` when herdr answered with a list that lacks the terminal, or
+* `undefined` when herdr gave no list. Not called for a record without a terminal id, which keeps
+* being judged by its pane id.
+*/
+function locateTerminal(exec, terminal, cache = {}) {
+	cache.terminals ??= herdrTerminals(exec);
+	if (cache.terminals.size === 0) return void 0;
+	const id = cache.terminals.get(terminal);
+	return id ? { id } : "gone";
+}
+/** Point a record whose herdr pane moved at the pane id it has now, moving its pane pointer with it.
+* The old pointer is dropped only while it still names this record, since herdr hands old ids out
+* again. */
+function followMove(ctx, rec, id) {
+	const pane = rec.pane;
+	if (!pane || pane.id === id) return;
+	if (ctx.store.resolvePaneId(pane.id) === rec.id) ctx.store.removePaneIndex(pane.id);
+	rec.pane = {
+		...pane,
+		id
+	};
+	saveAgent(ctx.store, rec);
+	ctx.store.putPaneIndex(id, rec.id);
+}
 const nowIso = (ctx) => new Date(ctx.now?.() ?? Date.now()).toISOString();
 function randomId() {
 	return randomBytes(8).toString("hex");
@@ -10495,10 +10609,33 @@ function detectHarness(explicit, ctx) {
 * explicit via the env var.
 */
 function resolveSelfId(ctx) {
+	return resolveSelf(ctx).id;
+}
+function resolveSelf(ctx) {
 	const env = ctx.env ?? process.env;
-	const cur = currentPane(normalizeMuxEnv(env));
-	if (cur) return ctx.store.resolvePaneId(cur.pane);
-	return env.CYBERLEGION_AGENT_ID || void 0;
+	const cur = selfPane(currentPane(normalizeMuxEnv(env)), ctx.exec ?? realExec);
+	if (cur) return {
+		id: selfIdAt(ctx.store, cur),
+		cur
+	};
+	return {
+		id: env.CYBERLEGION_AGENT_ID || void 0,
+		cur
+	};
+}
+/**
+* The unit a pane belongs to. The pane pointer answers first. When herdr named the calling pane's
+* terminal, a pointer whose record carries a different terminal is stale (the id was handed to
+* this pane after the unit's own pane moved away), and a missing pointer may mean this pane moved:
+* either way the record bearing this terminal is the caller (#272). A record without a terminal id
+* is trusted by its pointer as before.
+*/
+function selfIdAt(store, cur) {
+	const indexed = store.resolvePaneId(cur.pane);
+	if (!cur.terminal) return indexed;
+	const terminal = indexed ? loadAgent(store, indexed)?.pane?.terminal : void 0;
+	if (indexed && (!terminal || terminal === cur.terminal)) return indexed;
+	return listAgents(store).find((a) => a.pane?.mux === "herdr" && a.pane.terminal === cur.terminal)?.id;
 }
 /** Register (or idempotently refresh) this session's identity. */
 function register(ctx, input) {
@@ -10510,8 +10647,8 @@ function register(ctx, input) {
 	const existing = existingId ? loadAgent(ctx.store, existingId) : void 0;
 	const id = existing?.id ?? existingId ?? randomId();
 	const ts = nowIso(ctx);
-	const cur = storablePane(env);
 	const exec = ctx.exec ?? realExec;
+	const cur = selfPane(storablePane(env), exec);
 	const rec = {
 		id,
 		handle: input.handle ?? existing?.handle ?? id.slice(0, 6),
@@ -10546,7 +10683,8 @@ function paneLocator(cur, exec, env) {
 	};
 	return {
 		mux: cur.mux,
-		id: cur.pane
+		id: cur.pane,
+		...cur.terminal ? { terminal: cur.terminal } : {}
 	};
 }
 /** Derive a standing record's stable id from its handle — same slug rule as `sanitizePane`, prefixed
@@ -10855,10 +10993,26 @@ function bumpLastSeen(ctx, id) {
 	rec.lastSeen = nowIso(ctx);
 	saveAgent(ctx.store, rec);
 }
-/** Refresh this session's own last-seen if it is registered — best-effort, never throws. */
+/**
+* Refresh this session's own last-seen if it is registered — best-effort, never throws. In a herdr
+* pane whose calling pane herdr reported, it also heals the record's pane to the id and terminal
+* herdr gave, so a unit whose pane moved fixes its own record on its next turn (#272).
+*/
 function touch(ctx) {
-	const id = resolveSelfId(ctx);
-	if (id) bumpLastSeen(ctx, id);
+	const { id, cur } = resolveSelf(ctx);
+	if (!id) return;
+	bumpLastSeen(ctx, id);
+	if (cur?.mux !== "herdr" || !cur.terminal) return;
+	const rec = loadAgent(ctx.store, id);
+	if (rec?.pane?.mux !== "herdr") return;
+	if (rec.pane.terminal !== cur.terminal) {
+		rec.pane = {
+			...rec.pane,
+			terminal: cur.terminal
+		};
+		saveAgent(ctx.store, rec);
+	}
+	followMove(ctx, rec, cur.pane);
 }
 const STALE_MS = 9e5;
 /** Standing and service records have no session of their own, so nothing about a pane or a timer
@@ -10885,7 +11039,9 @@ function isPrunable(rec) {
 function sessionLive(ctx, rec) {
 	if (rec.status === "exited" || rec.status === "stopped") return false;
 	if (!rec.pane) return true;
-	const panes = PANE_ADAPTERS[rec.pane.mux].listPanes(ctx.exec ?? realExec);
+	const exec = ctx.exec ?? realExec;
+	if (rec.pane.mux === "herdr" && rec.pane.terminal) return locateTerminal(exec, rec.pane.terminal) !== "gone";
+	const panes = PANE_ADAPTERS[rec.pane.mux].listPanes(exec);
 	if (panes.length === 0) return true;
 	const id = rec.pane.id;
 	return panes.some((p) => p.id === id);
@@ -10960,11 +11116,12 @@ function reconcile(ctx, opts) {
 	if (panes.length === 0) return [];
 	const live = new Set(panes.map((p) => p.id));
 	const changed = [];
+	const cache = {};
 	for (const rec of listAgents(ctx.store)) {
 		if (!isPrunable(rec)) continue;
 		if (!rec.pane) continue;
 		if (rec.pane.mux !== cur.mux) continue;
-		if (!live.has(rec.pane.id)) {
+		if (rec.pane.mux === "herdr" && rec.pane.terminal ? terminalGone(ctx, rec, rec.pane.terminal, cache) : !live.has(rec.pane.id)) {
 			rec.status = "exited";
 			saveAgent(ctx.store, rec);
 			changed.push(rec);
@@ -10989,27 +11146,111 @@ function paneGone(exec, pane, lists) {
 	}
 	return panes.length > 0 && !panes.some((p) => p.id === pane.id);
 }
-/** Mark agents whose session is gone as exited. Reconcile-culls against the current mux's live set
-* first, then judges each remaining record (covers the other mux and sessions outside any
-* multiplexer pane): a pane-bound record by its pane alone — a live or unprobeable pane keeps it
-* whatever its last-seen — and a pane-less record by the staleness timer, its only signal. */
-function prune(ctx) {
+/**
+* Whether a herdr record that carries its terminal id is positively gone: herdr listed its panes and
+* that terminal is not among them. A live terminal under a new pane id is a moved pane, so the record
+* follows it instead (#272). A pane id that herdr now gives another terminal does not keep the record
+* alive, since herdr ids recur. No list at all decides nothing.
+*/
+function terminalGone(ctx, rec, terminal, cache) {
+	const at = locateTerminal(ctx.exec ?? realExec, terminal, cache);
+	if (at === "gone") return true;
+	if (at) followMove(ctx, rec, at.id);
+	return false;
+}
+/**
+* Mark agents whose session is gone as exited, then delete every exited unit with nothing left to
+* work from. Reconcile-culls against the current mux's live set first, then judges each remaining
+* record (covers the other mux and sessions outside any multiplexer pane): a pane-bound record by its
+* pane alone — a live or unprobeable pane keeps it whatever its last-seen — and a pane-less record by
+* the staleness timer, its only signal. An exited unit whose own linked worktree is still on disk is
+* kept, since `unit close` owns removing that worktree. So is an exited unit that is the last record
+* pointing at a linked worktree it shares, while that worktree is on disk and its work has not landed
+* (`options.landed`): deleting it would leave that work with nothing pointing at it. Every other
+* exited unit is deleted with `deleteExited`.
+*/
+function prune(ctx, options = {}) {
 	const exec = ctx.exec ?? realExec;
 	const now = ctx.now?.() ?? Date.now();
-	const changed = reconcile(ctx);
+	const marked = reconcile(ctx);
 	const lists = /* @__PURE__ */ new Map();
+	const cache = {};
 	for (const rec of listAgents(ctx.store)) {
 		if (!isPrunable(rec)) continue;
-		if (rec.pane ? paneGone(exec, rec.pane, lists) : now - new Date(rec.lastSeen).getTime() > STALE_MS) {
+		if (!rec.pane ? now - new Date(rec.lastSeen).getTime() > STALE_MS : rec.pane.mux === "herdr" && rec.pane.terminal ? terminalGone(ctx, rec, rec.pane.terminal, cache) : paneGone(exec, rec.pane, lists)) {
 			rec.status = "exited";
 			saveAgent(ctx.store, rec);
-			changed.push(rec);
-		}
+			marked.push(rec);
+		}
+	}
+	const deleted = deleteExited(ctx, options.landed ?? (() => false));
+	const gone = new Set(deleted.map((r) => r.id));
+	return [...marked.filter((r) => !gone.has(r.id)).map((r) => ({
+		...r,
+		pruned: "exited"
+	})), ...deleted.map((r) => ({
+		...r,
+		pruned: "deleted"
+	}))];
+}
+/** Whether `checkout` is a linked worktree still on disk — something a record can point at. The
+* primary checkout always exists, but nothing removes it, so no record has to stay to point at it. */
+function linkedOnDisk(checkout) {
+	return checkout?.root != null && existsSync(checkout.root) && !isPrimaryCheckout(checkout.root, checkout.primaryRoot);
+}
+/** Whether another record in the store still points at the worktree at `root`, owned or shared. */
+function pointedAtByOther(store, root, self) {
+	const at = resolve(root);
+	return listAgents(store).some((a) => a.id !== self && (a.worktree?.root != null && resolve(a.worktree.root) === at || a.sharedWorktree?.root != null && resolve(a.sharedWorktree.root) === at));
+}
+/**
+* Whether deleting this exited record would orphan a worktree on disk. Its own linked worktree is kept
+* for `unit close` to remove. A worktree it only shares is kept while this record is the last one
+* pointing at it and its work has not landed — the owner's record is gone, so nothing else would
+* lead to that work.
+*/
+function keepsWorktree(store, rec, landed) {
+	if (linkedOnDisk(rec.worktree)) return true;
+	const shared = rec.sharedWorktree;
+	return linkedOnDisk(shared) && !pointedAtByOther(store, shared.root, rec.id) && !landed(shared.root);
+}
+/** Whether a worktree root is its repository's primary checkout — the one test `unit close` and
+* `unit prune` share for "a seat on the main checkout, which nothing removes". */
+function isPrimaryCheckout(worktreeRoot, primaryRoot) {
+	return worktreeRoot != null && primaryRoot != null && resolve(worktreeRoot) === resolve(primaryRoot);
+}
+/**
+* Delete every exited unit that leaves no work on disk (`keepsWorktree`): its record, brief, mailbox, and the pane
+* pointer that still names it. Nothing revives an exited unit (`unit restart` takes only a running or
+* stopped one), so these records are read by nobody. A pane pointer is dropped only when it still
+* resolves to the deleted unit, since a multiplexer may have handed the pane id to another unit
+* since. A worktree that is gone from disk may still be registered with git, and the record is the
+* last place that names its repository, so that registration is cleared first, best-effort, as
+* `unit close` does. No pane is torn down: an exited unit's pane is already gone or belongs to
+* someone else.
+*/
+function deleteExited(ctx, landed) {
+	const exec = ctx.exec ?? realExec;
+	const deleted = [];
+	for (const rec of listAgents(ctx.store)) {
+		if (rec.status !== "exited" || isSessionIndependent(rec) || keepsWorktree(ctx.store, rec, landed)) continue;
+		const primaryRoot = rec.worktree?.primaryRoot;
+		if (primaryRoot && existsSync(primaryRoot)) exec("git", [
+			"-C",
+			primaryRoot,
+			"worktree",
+			"prune"
+		]);
+		const pane = rec.pane?.id ?? ctx.store.findPaneByAgentId(rec.id);
+		if (pane && ctx.store.resolvePaneId(pane) === rec.id) ctx.store.removePaneIndex(pane);
+		ctx.store.removeAgent(rec.id);
+		ctx.store.removeAgentData(rec.id);
+		ctx.store.removeMailbox(rec.id);
+		deleted.push(rec);
 	}
-	return changed;
+	return deleted;
 }
-//#endregion
-//#region src/console/prompt-guard.ts
+// src/console/prompt-guard.ts
 const CODEX_PLACEHOLDERS = /* @__PURE__ */ new Set([
 	"Ask Codex to do anything",
 	"Explain this codebase",
@@ -11167,8 +11408,7 @@ async function clearLine(adapter, exec, target, sleep) {
 	adapter.sendText(exec, target, KILL_LINE);
 	await sleep(KEY_SETTLE_MS);
 }
-//#endregion
-//#region src/console/ring.ts
+// src/console/ring.ts
 const DEFAULT_ATTEMPTS = 10;
 const DEFAULT_SETTLE_MS = 400;
 /** cyber-mux's `isStaged` matches on the same prefix length. */
@@ -11273,8 +11513,7 @@ async function ringTurn(adapter, exec, target, message, opts = {}) {
 	const why = state === "lost" ? "the text vanished without the harness posting it" : `input still staged after ${attempts} re-submit attempts`;
 	throw new Error(`nudge failed: peer at pane ${target.id} never took the turn — ${why}`);
 }
-//#endregion
-//#region src/console/doorbell.ts
+// src/console/doorbell.ts
 /** The doorbell text delivered to a woken recipient; also the standalone `unit nudge` default. */
 const DELIVERY_DOORBELL = "You have unread mail — check your inbox.";
 /**
@@ -11473,8 +11712,7 @@ async function wakeSpawn(getAdapter, exec, input, nudgeOpts = SPAWN_NUDGE_OPTS,
 		};
 	}
 }
-//#endregion
-//#region src/console/trust.ts
+// src/console/trust.ts
 /**
 * Each harness's folder-trust prompt, as it draws it, and the keys that accept it. Read from Claude
 * Code 2.1.286, Codex 0.153.4 (and its newer "Trust this folder?" wording), and cursor-agent
@@ -11584,8 +11822,7 @@ function stuck(where) {
 		message: `${where}, and the prompt is still showing after spawn sent the keys that accept it. A person must answer it.`
 	};
 }
-//#endregion
-//#region src/mux-select.ts
+// src/mux-select.ts
 /**
 * Backend selection via cyber-mux's two-mode mux probe, normalized through the transitional
 * `$CYBERLEGION_MUX*` → `$CYBER_MUX*` env seam (`mux-env.ts`) — tmux/herdr map to their existing
@@ -11605,8 +11842,7 @@ function selectSessionAdapter(env, exec = realExec) {
 	if (probe.mux === "wezterm" || probe.mux === "zellij") throw new Error(`spawn detected ${probe.mux}, a backend unit/registry cannot store a pane locator under (only tmux and herdr) — refusing before opening anything`);
 	throw new Error("spawn requires a session backend — run inside tmux ($TMUX) or herdr ($HERDR_ENV=1)");
 }
-//#endregion
-//#region src/workspace-label.ts
+// src/workspace-label.ts
 /** Leading actions that tear down or revert — the `A2-` class, checked first. */
 const TEARDOWN_ACTIONS = /* @__PURE__ */ new Set([
 	"clean",
@@ -11749,8 +11985,7 @@ function fitWords(words, budget) {
 	}
 	return out;
 }
-//#endregion
-//#region src/worktree-lease.ts
+// src/worktree-lease.ts
 /**
 * The two worktree-library calls a unit's lifetime makes: `unit spawn` acquires a worktree, `unit
 * close` releases it. Gathered here so a test can stand in for them and drive spawn's routing without
@@ -11774,8 +12009,7 @@ function leaseHolder(id) {
 * cyberlegion's own file, not the unit's work, and counting it would keep every slot from reuse in a
 * project that does not track it. */
 const LEASE_IGNORE = [WORKTREE_MARKER];
-//#endregion
-//#region src/session.ts
+// src/session.ts
 /** How each harness's own CLI is launched in the new pane. */
 const LAUNCH_MAP = {
 	claude: "claude",
@@ -12000,10 +12234,7 @@ async function spawn(ctx, input) {
 		cwd,
 		worktree,
 		...sharedWorktree ? { sharedWorktree } : {},
-		pane: muxName === "tmux" || muxName === "herdr" ? {
-			mux: muxName,
-			id: target.id
-		} : null,
+		pane: openedPaneLocator(exec, muxName, target.id),
 		status: "active",
 		createdAt: ts,
 		lastSeen: ts,
@@ -12325,8 +12556,7 @@ function resolveBrief(input, readStdin = () => readFileSync(0, "utf8")) {
 	if (input.task != null && input.task !== "") return input.task;
 	return null;
 }
-//#endregion
-//#region src/agentdef/resolve.ts
+// src/agentdef/resolve.ts
 function parseAgentDefFile(text) {
 	const m = /^---\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n)?([\s\S]*)$/.exec(text);
 	if (!m) return {
@@ -12446,8 +12676,7 @@ function listAgentDefs(input = {}) {
 	}
 	return defs;
 }
-//#endregion
-//#region src/agentdef/realize.ts
+// src/agentdef/realize.ts
 const DEFAULT_HARNESS = "claude";
 /** POSIX single-quote a value for safe inclusion in a shell command line. */
 function shellQuote(value) {
@@ -12565,8 +12794,7 @@ function resolveSpawnLaunch(input) {
 		...input.searchRoots ? { searchRoots: input.searchRoots } : {}
 	}), overrides);
 }
-//#endregion
-//#region src/cli-input.ts
+// src/cli-input.ts
 /**
 * Translate `unit spawn`'s options into the spawn input and its wake decision — resolving an
 * `--agent`/`--agent-file` def into the harness and composed launch command, with an explicit
@@ -12614,8 +12842,7 @@ function spawnCommandInput(opts, listCursorModels) {
 function readCommandOutput(format, result) {
 	return format === "json" ? JSON.stringify(result, null, 2) : result.output;
 }
-//#endregion
-//#region src/cursor-models.ts
+// src/cursor-models.ts
 /** The model ids in `cursor-agent models` output: the first token of each line, ANSI colour and list
 * bullets stripped. Headings and tips come along too; callers only test a specific id for membership. */
 function parseCursorModels(output) {
@@ -12638,8 +12865,7 @@ function listCursorModels() {
 		return [];
 	}
 }
-//#endregion
-//#region src/message.ts
+// src/message.ts
 /** Write one message into the recipient's inbox. Collision-free by <epochMs>-<hex>. */
 function send(ctx, input) {
 	const toId = resolveRecipient(ctx.store, input.to);
@@ -12736,8 +12962,7 @@ function deleteMessage(ctx, meId, msgId) {
 function deleteMailbox(store, id) {
 	store.removeMailbox(id);
 }
-//#endregion
-//#region src/decommission.ts
+// src/decommission.ts
 /**
 * Tear a unit down and reap its registry record — the deterministic inverse of `spawn`. Refuses a
 * dirty worktree unless `--force`. Teardown always precedes reap: an already-gone worktree or pane
@@ -12773,7 +12998,7 @@ async function decommission(ctx, input) {
 	const worktreeExists = worktreeRoot != null && existsSync(worktreeRoot);
 	const primaryRoot = worktreeExists ? await primaryRootOf(exec, worktreeRoot) : rec.worktree?.primaryRoot;
 	const held = rec.worktree?.lease;
-	const onPrimary = worktreeRoot != null && primaryRoot != null && resolve(worktreeRoot) === resolve(primaryRoot);
+	const onPrimary = isPrimaryCheckout(worktreeRoot, primaryRoot);
 	if (onPrimary && input.force) throw new Error(`refusing to close "${input.id}" with --force — its worktree is the primary checkout, which close never alters; close it without --force to end its session and reap its record`);
 	const removesWorktree = worktreeExists && !input.keepWorktree && !held && !onPrimary;
 	if (removesWorktree && !input.force && isDirty(exec, worktreeRoot)) throw new Error(`unit "${input.id}" has uncommitted changes in its worktree — pass --force to discard them`);
@@ -12839,10 +13064,9 @@ function isDirty(exec, worktreeRoot) {
 		"--porcelain",
 		"--untracked-files=all"
 	]);
-	return !!status && status.split("\n").some((line) => line && line !== `?? ${WORKTREE_MARKER}`);
+	return !!status && status.split("\n").some((line) => line && line !== `?? .agents/cyberlegion/config.json`);
 }
-//#endregion
-//#region src/install.ts
+// src/install.ts
 const PIN_TOKEN = /^[0-9A-Za-z][0-9A-Za-z._+-]*$/;
 function validatePin(pin) {
 	if (!PIN_TOKEN.test(pin)) throw new Error(`invalid --pin "${pin}" — expected a version or dist-tag token like 0.2.0 or latest (no spaces, ranges, or shell metacharacters)`);
@@ -12995,8 +13219,43 @@ function removeCursor(settings, event, canonical) {
 	else delete hooks[event];
 	return true;
 }
-//#endregion
-//#region src/output.ts
+// src/landed.ts
+/**
+* Which worktrees a unit shares hold work that has landed, as the `landed` judgment `prune` takes.
+* It is the worktree library's own judgment, the one its `acquire` recycles a worktree by: the
+* checkout is clean and its branch has landed on the default branch. Asked once per repository
+* before prune's synchronous pass, for every shared worktree still on disk. A worktree git cannot
+* judge (detached, no default branch, a repository git does not know) does not count as landed, so
+* prune keeps the record that points at it.
+*/
+async function landedWorktrees(ctx) {
+	const exec = asyncExec(ctx.exec ?? realExec);
+	const roots = /* @__PURE__ */ new Map();
+	for (const rec of listAgents(ctx.store)) {
+		const shared = rec.sharedWorktree;
+		if (shared?.root && existsSync(shared.root)) roots.set(shared.root, shared.primaryRoot);
+	}
+	const landed = /* @__PURE__ */ new Set();
+	const asked = /* @__PURE__ */ new Set();
+	for (const [root, recorded] of roots) {
+		const primary = await primaryRoot({
+			from: root,
+			exec
+		}).catch(() => recorded);
+		if (!primary || asked.has(primary)) continue;
+		asked.add(primary);
+		const entries = await listWorktrees({
+			primaryRoot: primary,
+			exec,
+			ignore: LEASE_IGNORE
+		}).catch(() => []);
+		for (const e of entries) if (e.linked && e.merged === true && e.dirty === false) landed.add(e.root);
+	}
+	const normalized = /* @__PURE__ */ new Map();
+	for (const root of roots.keys()) normalized.set(root, landed.has(await normalizeWorktreePath(root)));
+	return (root) => normalized.get(root) ?? false;
+}
+// src/output.ts
 function stringifyCell(v) {
 	if (v == null) return "";
 	const s = String(v);
@@ -13029,8 +13288,7 @@ function fail(msg) {
 	console.error(JSON.stringify({ error: msg }));
 	process.exit(1);
 }
-//#endregion
-//#region src/participants.ts
+// src/participants.ts
 const UNIT_PREFIX = "cyberlegion:unit/";
 /** This hub's own participant key. One per hub root, so reconciling one hub (a `--space`, say)
 * never retires the units another hub registered in the same cynapse store. */
@@ -13194,8 +13452,7 @@ async function syncCynapse(hub, env = process.env, load = importCynapse) {
 		cyn?.close();
 	}
 }
-//#endregion
-//#region src/permission.ts
+// src/permission.ts
 const CLI_RULE = "Bash(cyberlegion *)";
 const COVERING = /^Bash(?:\((?:\*|cyberlegion(?: \*|:\*|\*))\))?$/;
 /** Claude Code's user settings file: `$CLAUDE_CONFIG_DIR/settings.json`, else `~/.claude/settings.json`. */
@@ -13246,8 +13503,7 @@ function addPermissionRule(file) {
 	writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`);
 	return "added";
 }
-//#endregion
-//#region src/presence-spawn.ts
+// src/presence-spawn.ts
 /** The brief a presence spawned into a standing owner's home starts from: whom it stands in for, and
 * where that owner's mail is. What to *do* with the mail is the home's agent definition's business. */
 function presenceBrief(handle) {
@@ -13342,8 +13598,7 @@ async function spawnPresence(ctx, owner, options = {}) {
 		...turn
 	};
 }
-//#endregion
-//#region src/project.ts
+// src/project.ts
 /**
 * The canonical git common dir for `dir`, or undefined outside a repository. The common dir is the
 * one path every checkout of a repository shares — the default checkout and each linked worktree
@@ -13462,8 +13717,7 @@ function byPath(ctx, dir) {
 	if (!commonDir) throw new Error(`"${dir}" is not inside a git repository`);
 	return ctx.store.getProject(projectIdOf(commonDir)) ?? registerProject(ctx, { dir });
 }
-//#endregion
-//#region src/runtime/inject-inbox.ts
+// src/runtime/inject-inbox.ts
 const EVENTS = ["SessionStart"];
 /**
 * Resolve the calling agent, gather its unread mail (and a standing owner's, when this session is
@@ -13518,8 +13772,7 @@ function injectInbox(ctx, event) {
 		additionalContext: parts.join("\n\n")
 	} };
 }
-//#endregion
-//#region src/service.ts
+// src/service.ts
 /** A refused ownership transition. `stale` means the caller's generation, token, or holder claim is
 * not the current one — the caller is not (or no longer) the authority it claims to be. */
 var ServiceOwnershipError = class extends Error {
@@ -13824,8 +14077,7 @@ async function startService(ctx, projectRef, name, input) {
 		throw err;
 	}
 }
-//#endregion
-//#region src/standing-home.ts
+// src/standing-home.ts
 /**
 * Decide what a registration does to a standing owner's home: `undefined` keeps whatever the record
 * already has, `null` drops it, and a `StandingHome` replaces it. Every way a home can be wrong is
@@ -13872,8 +14124,7 @@ function resolveHomeFlags(exec, flags) {
 		...launch
 	};
 }
-//#endregion
-//#region src/store/errors.ts
+// src/store/errors.ts
 /** A record file exists but its content didn't parse as JSON — a torn write (crash mid-`writeFileSync`,
 * pre-atomic-write code path) or on-disk tampering. Carries the file path and the original parse
 * error so a caller can report exactly what's broken and where, rather than "Unexpected token" with
@@ -13886,8 +14137,7 @@ var CorruptRecordError = class extends Error {
 		this.name = "CorruptRecordError";
 	}
 };
-//#endregion
-//#region src/store/process-liveness.ts
+// src/store/process-liveness.ts
 /**
 * Probe whether `pid` is alive using `process.kill(pid, 0)` — the POSIX "does this process exist"
 * idiom; it sends no signal, it only tests deliverability. `ESRCH` (no such process) is the only
@@ -13907,8 +14157,7 @@ function probeProcess(pid) {
 		return err.code === "ESRCH" ? "dead" : "unknown";
 	}
 }
-//#endregion
-//#region src/store/lock.ts
+// src/store/lock.ts
 var LockTimeoutError = class extends Error {
 	name;
 	constructor(name) {
@@ -14045,8 +14294,7 @@ async function withLockAsync(root, name, fn, opts) {
 		handle.release();
 	}
 }
-//#endregion
-//#region src/store/file-store.ts
+// src/store/file-store.ts
 /** Parse a record file's content, wrapping a `JSON.parse` failure in a typed, file-named
 * `CorruptRecordError` instead of letting a bare `SyntaxError` bubble up from deep inside
 * `listInbox`/`listAgents`/`getAgent` with no indication of WHICH file broke. A file that doesn't
@@ -14256,8 +14504,7 @@ var FileStore = class {
 		return withLockAsync(this.root, name, fn);
 	}
 };
-//#endregion
-//#region src/unit-runtime.ts
+// src/unit-runtime.ts
 /** A standing or service record is an address with no runtime of its own — nothing to stop or start. */
 function assertHasRuntime(rec, ref) {
 	if (rec.kind === "standing" || rec.kind === "service") throw new Error(`"${ref}" is a ${rec.kind} record — it has no runtime to stop, restart, or rebind`);
@@ -14345,8 +14592,9 @@ function stopUnit(ctx, ref) {
 * record to the new pane, and ring it. When the record carries the harness's conversation id and the
 * harness can resume by id, the session resumes that conversation and is rung to continue, with the
 * plain launch as a shell fallback should the harness reject the id; otherwise (or with `fresh`) it
-* starts empty and is rung to read its brief — a rebrief. Every refusal runs before anything is torn
-* down.
+* starts empty and is rung to read its brief — a rebrief. An exited unit is refused: its session
+* ended without a `unit stop`, and the multiplexer that resumes agents has already brought back any
+* that were coming back. Every refusal runs before anything is torn down.
 *
 * The unit is recorded `stopped` before the open, so a restart interrupted between the two leaves an
 * ordinary stopped unit and a rerun recovers it; nothing needs a separate repair path.
@@ -14355,6 +14603,7 @@ async function restartUnit(ctx, ref, options = {}) {
 	const rec = resolveAgent(ctx.store, ref);
 	assertHasRuntime(rec, ref);
 	assertNotSelf(ctx, rec, "restart");
+	if (rec.status === "exited") throw new Error(`unit "${rec.handle}" has exited — restart takes only a running or stopped unit; spawn a new unit instead, or run unit rebind ${rec.handle} from a session resumed by hand`);
 	const harness = rec.harness;
 	if (!harness || !(harness in LAUNCH_MAP)) throw new Error(`unit "${rec.handle}" has harness "${rec.harness ?? ""}", not in the launch map (${Object.keys(LAUNCH_MAP).join(" | ")}) — cannot restart it`);
 	if (!existsSync(rec.cwd)) throw new Error(`unit "${rec.handle}" cannot restart — its cwd ${rec.cwd} is gone; spawn a new unit instead`);
@@ -14396,10 +14645,7 @@ async function restartUnit(ctx, ref, options = {}) {
 	const bound = {
 		...stopped,
 		status: "active",
-		pane: mux === "tmux" || mux === "herdr" ? {
-			mux,
-			id: target.id
-		} : null,
+		pane: openedPaneLocator(exec, mux, target.id),
 		lastSeen: new Date(ctx.now?.() ?? Date.now()).toISOString()
 	};
 	saveAgent(ctx.store, bound);
@@ -14425,6 +14671,10 @@ function probeLiveness(ctx, rec) {
 	if (rec.kind === "standing" || rec.kind === "service") return "none";
 	if (rec.status === "stopped") return "stopped";
 	if (rec.status === "exited") return "exited";
+	if (rec.pane?.mux === "herdr" && rec.pane.terminal) {
+		const at = locateTerminal(ctx.exec ?? realExec, rec.pane.terminal);
+		return at === void 0 ? "unknown" : at === "gone" ? "gone" : "live";
+	}
 	const pane = runtimePane(ctx, rec);
 	const adapter = pane ? paneAdapter(ctx, rec) : void 0;
 	if (!pane || !adapter) return "unknown";
@@ -14441,7 +14691,7 @@ function probeLiveness(ctx, rec) {
 function rebindUnit(ctx, ref) {
 	const rec = resolveAgent(ctx.store, ref);
 	assertHasRuntime(rec, ref);
-	const cur = storablePane(ctx.env ?? process.env);
+	const cur = callingStorablePane(ctx);
 	if (!cur) throw new Error("unit rebind needs to run inside a tmux or herdr pane — there is no pane to bind");
 	const oldPane = runtimePane(ctx, rec);
 	if (rec.pane?.mux === cur.mux && rec.pane.id === cur.pane && ctx.store.resolvePaneId(cur.pane) === rec.id) return rec;
@@ -14449,13 +14699,15 @@ function rebindUnit(ctx, ref) {
 	const holder = holderId && holderId !== rec.id ? loadAgent(ctx.store, holderId) : void 0;
 	if (holder && holder.status !== "stopped" && holder.status !== "exited") throw new Error(`this pane belongs to unit "${holder.handle}" (${holder.id}) — rebind never takes another unit's pane`);
 	const liveness = probeLiveness(ctx, rec);
-	if (oldPane && oldPane !== cur.pane && (liveness === "live" || liveness === "unknown")) throw new Error(`unit "${rec.handle}" may still be running in pane ${oldPane} — stop it first (unit stop ${rec.handle})`);
+	const ownTerminal = !!cur.terminal && rec.pane?.mux === "herdr" && rec.pane.terminal === cur.terminal;
+	if (oldPane && oldPane !== cur.pane && !ownTerminal && (liveness === "live" || liveness === "unknown")) throw new Error(`unit "${rec.handle}" may still be running in pane ${oldPane} — stop it first (unit stop ${rec.handle})`);
 	const bound = {
 		...rec,
 		status: "active",
 		pane: {
 			mux: cur.mux,
-			id: cur.pane
+			id: cur.pane,
+			...cur.terminal ? { terminal: cur.terminal } : {}
 		},
 		lastSeen: new Date(ctx.now?.() ?? Date.now()).toISOString()
 	};
@@ -14483,7 +14735,7 @@ function controlsFor(ctx, rec, liveness) {
 		if (hasHonestReset(rec.harness)) controls.push("clear");
 	}
 	if (runtimePane(ctx, rec) !== void 0 && (liveness === "live" || liveness === "gone" || liveness === "unknown")) controls.push("stop");
-	if (rec.harness && rec.harness in LAUNCH_MAP && existsSync(rec.cwd)) controls.push("restart");
+	if (liveness !== "exited" && rec.harness && rec.harness in LAUNCH_MAP && existsSync(rec.cwd)) controls.push("restart");
 	if (liveness === "stopped" || liveness === "exited" || liveness === "gone") controls.push("rebind");
 	controls.push("close");
 	return controls;
@@ -14538,8 +14790,7 @@ function recordConversation(ctx, hookInput) {
 		conversation: id
 	});
 }
-//#endregion
-//#region src/wake/await.ts
+// src/wake/await.ts
 /** Internal poll interval — not user-facing (the round-trip cost of one `mail await` cycle). */
 const POLL_MS$1 = 1e3;
 const DEFAULT_TIMEOUT_MS = 6e5;
@@ -14584,8 +14835,7 @@ async function awaitReply(ctx, input) {
 		await sleep(POLL_MS$1);
 	}
 }
-//#endregion
-//#region src/wake/watch.ts
+// src/wake/watch.ts
 const POLL_MS = 1e3;
 /**
 * A continuous foreground observer: prints each NEW matching message as it arrives, polling on a
@@ -14617,8 +14867,7 @@ async function watchMail(ctx, input, onMessage, opts = {}) {
 		await sleep(POLL_MS);
 	}
 }
-//#endregion
-//#region src/cli.ts
+// src/cli.ts
 const VERSION = globalThis.__SKILL_SCRIPT__?.version ?? JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 function ctxOf(opts) {
 	return {
@@ -14821,18 +15070,25 @@ function runWho(opts) {
 	if (agents.length === 0) nextStep("cyberlegion unit register to join");
 }
 syncsUnits(withGlobals(unit.command("who"))).description("list the addressable units").option("--all", "include exited units").option("--reconcile", "live-probe the current mux: cull dead-pane records and adopt unbound harness-bearing panes before listing").action(runWho);
-syncsUnits(withGlobals(unit.command("prune"))).description("mark dead units exited and sweep").action((opts) => {
+syncsUnits(withGlobals(unit.command("prune"))).description("mark dead units exited and delete exited units that leave no work on disk").action(async (opts) => {
 	const ctx = ctxOf(opts);
 	touch(ctx);
-	const changed = prune(ctx);
+	const changed = prune(ctx, { landed: await landedWorktrees(ctx) });
 	emit(formatOf(opts), {
-		toon: toonList("pruned", changed, [{
-			key: "id",
-			get: (a) => a.id
-		}, {
-			key: "handle",
-			get: (a) => a.handle
-		}], `${changed.length} pruned`),
+		toon: toonList("pruned", changed, [
+			{
+				key: "id",
+				get: (a) => a.id
+			},
+			{
+				key: "handle",
+				get: (a) => a.handle
+			},
+			{
+				key: "pruned",
+				get: (a) => a.pruned
+			}
+		], `${changed.length} pruned (${changed.filter((a) => a.pruned === "deleted").length} deleted)`),
 		json: changed
 	});
 });
@@ -15819,5 +16075,4 @@ async function runCli(argv = process.argv) {
 		process.exit(1);
 	}
 }
-//#endregion
 export { runCli };