frizz 0.13.12 → 0.13.13

package/README.md

@@ -84,15 +84,15 @@ The queue is strict about what earns a card, which is what keeps it a real todo
 **Threads are built to run without you.** A worker keeps going until it reaches something only you can settle — a product call, a fork where guessing wrong is expensive to undo, an irreversible action — and then it hands back an answerable *question* rather than a wall of text for you to re-read and interpret.
 
 <p align="center">
-  <img src="assets/question.png" alt="A question card titled Question: 'Should the settings store use SQLite or a JSON file?' with two options numbered 1 and 2 on keycaps, the first tagged RECOMMENDED, a third row numbered 3 for typing something else, and a Send answers button." width="100%">
+  <img src="assets/question.png" alt="A question card titled Question: 'Should the settings store use SQLite or a JSON file?' with two options numbered 1 and 2 on keycaps, the first tagged RECOMMENDED, and a third row numbered 3 for typing something else, above the prompt box and its Send button." width="100%">
 </p>
 
-Options are numbered: press an option's number or click it to pick it, then Enter to send. A worker marks its own recommendation when it has one. There is always a row for writing something else instead.
+Options are numbered: press an option's number or click it to pick it, then Enter to send it, along with anything typed in the prompt box below. A worker marks its own recommendation when it has one. There is always a row for writing something else instead.
 
 When the answer isn't one thing, the same card takes several: check any combination and add a note.
 
 <p align="center">
-  <img src="assets/question-multi.png" alt="A question card titled Select multiple: 'Which of these findings should I fix in this pass?' with three numbered checkbox options, the first two ticked, a fourth numbered row for adding a note, and a Send answers button." width="100%">
+  <img src="assets/question-multi.png" alt="A question card titled Select multiple: 'Which of these findings should I fix in this pass?' with three numbered checkbox options, the first two ticked, and a fourth numbered row for adding a note, above the prompt box, whose Send button is lit." width="100%">
 </p>
 
 ### GitHub

package/dist/frizz.js

@@ -182,7 +182,7 @@ var init_local_origin = __esm({
 
 // packages/server/src/access-codes.ts
 import { randomBytes, timingSafeEqual, createHmac } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
 function memorySessionDirectory(seed = []) {
   const records = new Map(seed.map((r) => [r.id, r]));
@@ -227,7 +227,7 @@ function secretsMatch(a, b) {
   return left.length === right.length && timingSafeEqual(left, right);
 }
 function fileSessionDirectory(stateDir, now = Date.now) {
-  const path = join2(stateDir, "sessions.json");
+  const path = join2(stateDir, SESSION_DIRECTORY_FILE);
   let records = [];
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8"));
@@ -283,6 +283,39 @@ function loadOrCreateSessionKey(stateDir) {
   }
   return rotateSessionKey(stateDir);
 }
+function adoptSessionState(stateDir, others) {
+  if (existsSync(join2(stateDir, SESSION_KEY_FILE))) return void 0;
+  const usedAt = (dir) => {
+    try {
+      const key = statSync(join2(dir, SESSION_KEY_FILE));
+      if (!key.isFile() || key.size < 32) return void 0;
+      try {
+        return Math.max(key.mtimeMs, statSync(join2(dir, SESSION_DIRECTORY_FILE)).mtimeMs);
+      } catch {
+        return key.mtimeMs;
+      }
+    } catch {
+      return void 0;
+    }
+  };
+  let newest;
+  for (const dir of others) {
+    if (dir === stateDir) continue;
+    const at = usedAt(dir);
+    if (at !== void 0 && (!newest || at > newest.at)) newest = { dir, at };
+  }
+  if (!newest) return void 0;
+  mkdirSync(stateDir, { recursive: true });
+  for (const name of [SESSION_EPOCH_FILE, SESSION_DIRECTORY_FILE, SESSION_KEY_FILE]) {
+    try {
+      copyFileSync(join2(newest.dir, name), join2(stateDir, name));
+      chmodSync(join2(stateDir, name), 384);
+    } catch (error) {
+      if (name === SESSION_KEY_FILE) throw error;
+    }
+  }
+  return newest.dir;
+}
 function rotateSessionKey(stateDir) {
   const key = randomBytes(32);
   writeSessionKey(join2(stateDir, SESSION_KEY_FILE), key);
@@ -327,7 +360,7 @@ function loadSessionState(stateDir, epoch = SESSION_EPOCH) {
   const signedOut = advance.advanced ? directory.revokeAll() : 0;
   return { key, directory, rotateKey: () => rotateSessionKey(stateDir), advance, signedOut };
 }
-var CODE_BYTES, SESSION_BYTES, SESSION_ID_BYTES, DEFAULT_CODE_TTL_MS, DEFAULT_SESSION_TTL_MS, SESSION_EPOCH, AccessStore, SESSION_KEY_FILE, SESSION_EPOCH_FILE;
+var CODE_BYTES, SESSION_BYTES, SESSION_ID_BYTES, DEFAULT_CODE_TTL_MS, DEFAULT_SESSION_TTL_MS, SESSION_EPOCH, AccessStore, SESSION_KEY_FILE, SESSION_EPOCH_FILE, SESSION_DIRECTORY_FILE;
 var init_access_codes = __esm({
   "packages/server/src/access-codes.ts"() {
     "use strict";
@@ -504,6 +537,7 @@ var init_access_codes = __esm({
     };
     SESSION_KEY_FILE = "session-key";
     SESSION_EPOCH_FILE = "session-epoch";
+    SESSION_DIRECTORY_FILE = "sessions.json";
   }
 });
 
@@ -518,7 +552,7 @@ var init_local_path = __esm({
 });
 
 // packages/server/src/local-image.ts
-import { createReadStream, realpathSync, statSync } from "node:fs";
+import { createReadStream, realpathSync, statSync as statSync2 } from "node:fs";
 import { extname, isAbsolute } from "node:path";
 function resolveLocalImage(rawPath, range) {
   if (rawPath) rawPath = normalizeLocalPath(rawPath);
@@ -533,7 +567,7 @@ function resolveLocalImage(rawPath, range) {
   }
   let size;
   try {
-    const stat = statSync(real);
+    const stat = statSync2(real);
     if (!stat.isFile()) return { status: 404 };
     size = stat.size;
   } catch {
@@ -944,7 +978,7 @@ import {
   openSync,
   readdirSync,
   rmSync,
-  statSync as statSync2,
+  statSync as statSync3,
   symlinkSync,
   writeFileSync as writeFileSync2,
   writeSync
@@ -989,7 +1023,7 @@ function pruneRunLogs(dir, keep = RETAINED_RUNS, days = RETAINED_DAYS, now = Dat
   }
   const dated = entries.map((name) => {
     try {
-      return { name, at: statSync2(join4(dir, name)).mtimeMs };
+      return { name, at: statSync3(join4(dir, name)).mtimeMs };
     } catch {
       return { name, at: 0 };
     }
@@ -13468,14 +13502,14 @@ function signoffNudgeText(needsInput) {
     "the write-up.",
     "",
     "**DECIDE RATHER THAN ASK.** Stop only for a decision that is genuinely the human's AND that blocks you",
-    "right now: register that one with `mcp__frizz__ask`. Every other open choice INSIDE the task \u2014 a name, a",
+    "right now: register that one with `frizzctl ask`. Every other open choice INSIDE the task \u2014 a name, a",
     "default, a reversible design call \u2014 is yours to make: decide it, say in one line which way you went and",
     "what would reverse it, and carry on. A choice that would ENLARGE the task is not one of those: an",
     "unanswered question is not permission to go build the answer.",
     "",
     "Otherwise, sign off \u2014 a registration, or a fence at the END of your next message:",
     "",
-    "- `mcp__frizz__ask` \u2014 you need the human. NOT a fence: the ```question fence is retired, and a fence",
+    "- `frizzctl ask` \u2014 you need the human. NOT a fence: the ```question fence is retired, and a fence",
     "  with a question in its body is plain prose. Register it (options with one-line trade-offs, the",
     "  recommended one first), then rest normally \u2014 an open registered question is the sign-off.",
     "- `` ```done `` \u2014 genuinely FINISHED. A DISMISSAL: the card is filed away and nobody looks again, so",
@@ -13485,8 +13519,8 @@ function signoffNudgeText(needsInput) {
     "",
     "  Frizz CHECKS every line: name something that is not running and you are bumped rather than parked.",
     "  A fence that names NOTHING is not a park at all \u2014 if you are not waiting on anything, you are not",
-    "  awaiting, you are done. Register a PR with `mcp__frizz__watch_pr` and a timer with",
-    "  `mcp__frizz__timer`; `mcp__frizz__activity` reads back everything you have running, with its id.",
+    "  awaiting, you are done. Register a PR with `frizzctl watch-pr add` and a timer with",
+    "  `frizzctl timer set`; `frizzctl activity` reads back everything you have running, with its id.",
     "- `` ```awaiting `` with `steps:` \u2014 the human must PERFORM something you cannot: sign in, approve,",
     "  merge, press a button you may not. List each step as a `- ` line under `steps:`, written to be",
     "  followed cold: a real Markdown link to every page and file it names, every command in a code span,",
@@ -13495,14 +13529,14 @@ function signoffNudgeText(needsInput) {
     "  comes back to you as their reply; anything else they need to say comes as a message of their own.",
     "- `` ```awaiting `` with `questions:` \u2014 a question you registered at an EARLIER rest is still open and",
     "  you still need its answer. Name every such question (`questions: [qst_\u2026]`) and withdraw the rest with",
-    "  `mcp__frizz__unask`: a fence that leaves an open question out is refused. A named card is drawn at",
+    "  `frizzctl unask <id>`: a fence that leaves an open question out is refused. A named card is drawn at",
     "  this rest; an unnamed one stays where you asked it.",
     "",
     "**STILL OWED counts things you are not going to do yourself.** A decision you are RECOMMENDING, a",
     "draft you wrote but did not send, follow-up work you discovered \u2014 all of it dies with the card, even",
     "the part that is someone else's to do. Each ends on a question with your recommendation as option 1,",
     "or you DO it first \u2014 a sub-agent's result comes BACK to you, so it lands on your card; a new card via",
-    "`mcp__frizz__spawn_thread` is the LAST resort, since nothing it learns returns to you or its siblings.",
+    "`frizzctl spawn-thread` is the LAST resort, since nothing it learns returns to you or its siblings.",
     "None of them is a `done`. And what is not",
     'worth a card is not worth a SENTENCE: delete the dangling "one thing to carry forward", never park it',
     "in the handoff.",
@@ -13525,7 +13559,7 @@ function requireEffortOutsideAcp(profile, ctx) {
 function fallbackPort(base) {
   return base + 1e4;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ClaudeModel, AcpAgent, AcpAgentModel, AcpAgentModels, AcpAgentModelsInput, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, SIGNOFF_NUDGE_MESSAGE_NEEDS_INPUT, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, GithubIssueStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, SECRET_TTL_MS, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, SettledQuestionView, ThreadSettledQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, LiveTool, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountBackend, AccountLogoutInput, AccountLogoutResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshotShape, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, SteerThreadInput, SteerThreadResult, DismissFailedFollowUpInput, DismissFailedFollowUpResult, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, CompactThreadInput, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, UpgradeThreadModelInput, UpgradeThreadModelResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, ProjectRailCounts, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ClaudeModel, AcpAgent, AcpAgentModel, AcpAgentModels, AcpAgentModelsInput, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, SIGNOFF_NUDGE_MESSAGE_NEEDS_INPUT, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, GithubIssueStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, COMMAND_WATCH_EVERY_MAX_MS, COMMAND_WATCH_FOR_MAX_MS, COMMAND_WATCH_COMMAND_MAX, COMMAND_WATCH_RUN_TIMEOUT_MS, CommandWatchRun, CommandWatchState, CommandWatchView, AddOwnCommandWatchInput, AddOwnCommandWatchResult, DropOwnCommandWatchInput, DropOwnCommandWatchResult, ListOwnCommandWatchesInput, OwnCommandWatchesResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, SECRET_TTL_MS, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, SettledQuestionView, ThreadSettledQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, LiveTool, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountBackend, AccountLogoutInput, AccountLogoutResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshotShape, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, SteerThreadInput, SteerThreadResult, DismissFailedFollowUpInput, DismissFailedFollowUpResult, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, CompactThreadInput, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, UpgradeThreadModelInput, UpgradeThreadModelResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, ProjectRailCounts, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -13863,7 +13897,7 @@ var init_src = __esm({
       questions: external_exports.array(AskQuestion)
     });
     AwaitingHint = external_exports.object({
-      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue", "for", "title", "status", "needs_input", "step", "question"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue", "command", "for", "title", "status", "needs_input", "step", "question"]),
       value: external_exports.string()
     });
     RETIRED_AWAITING_KINDS = ["watch", "pr-watch", "human", "ci", "session", "shell", "agent", "timer", "pr", "reason"];
@@ -14021,7 +14055,7 @@ var init_src = __esm({
        *  still BOUNDS the poll; the point of the field is that a worker chooses, and one that cannot choose
        *  is better bounded than broken. */
       for: external_exports.string().trim().min(1).max(16).optional(),
-      /** What `target` names. `issue` (from `mcp__frizz__watch_issue`, 2026-09-14) registers a watcher on a
+      /** What `target` names. `issue` (from `frizzctl watch-issue`, 2026-09-14) registers a watcher on a
        *  GitHub issue — same registry, same poll cadence, same drop verb, but a different probe (`gh issue
        *  view`), a different GraphQL fragment and a report with no CI in it. ABSENT MEANS A PULL REQUEST,
        *  for the same reason `for` is optional on the wire: every `watch_pr` binary dispatched before this
@@ -14109,6 +14143,68 @@ var init_src = __esm({
       dropped: external_exports.boolean(),
       watches: external_exports.array(OwnWatchView)
     }).strict();
+    COMMAND_WATCH_EVERY_MAX_MS = 24 * 60 * 60 * 1e3;
+    COMMAND_WATCH_FOR_MAX_MS = 7 * 24 * 60 * 60 * 1e3;
+    COMMAND_WATCH_COMMAND_MAX = 4e3;
+    COMMAND_WATCH_RUN_TIMEOUT_MS = 2 * 6e4;
+    CommandWatchRun = external_exports.object({
+      at: external_exports.string(),
+      outcome: external_exports.enum(["exit", "timeout", "signal", "error"]),
+      exitCode: external_exports.number().int().nullable(),
+      output: external_exports.string()
+    }).strict();
+    CommandWatchState = external_exports.enum(["armed", "dropped", "passed", "expired", "cancelled"]);
+    CommandWatchView = external_exports.object({
+      id: external_exports.string(),
+      command: external_exports.string(),
+      /** The cadence in the house duration grammar (`5m`, `1h 30m`). */
+      every: external_exports.string(),
+      state: CommandWatchState,
+      createdAt: external_exports.string(),
+      expiresAt: external_exports.string(),
+      /** How many checks have run since it was armed, the registration's own first check included. */
+      runs: external_exports.number().int().nonnegative(),
+      lastRun: CommandWatchRun.optional()
+    }).strict();
+    AddOwnCommandWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      /** Run with `/bin/sh -c` in the project root, with the server's environment. Exit status 0 is "passed". */
+      command: external_exports.string().trim().min(1).max(COMMAND_WATCH_COMMAND_MAX),
+      /** How often to check, as a DURATION (`5m`; parseAwaitingDurationRaw). Clamped to [1m, 24h] and reported. */
+      every: external_exports.string().trim().min(1).max(16),
+      /** How long to keep checking, as a DURATION. Clamped to COMMAND_WATCH_FOR_MAX_MS and reported. */
+      for: external_exports.string().trim().min(1).max(16)
+    }).strict();
+    AddOwnCommandWatchResult = external_exports.object({
+      /** Present when the call was REFUSED — the thread may not run commands outside the CLI's permission
+       *  system, or the command cannot run here at all. A refusal is an answer, not a fault: the text says
+       *  why and what to use instead, and nothing was stored. */
+      refused: external_exports.string().optional(),
+      /** The armed row's id. Absent when nothing was armed: a refusal, or a first check that already passed. */
+      id: external_exports.string().optional(),
+      /** This exact command was already watched on this thread, so the call registered nothing new. */
+      alreadyArmed: external_exports.boolean().default(false),
+      /** The FIRST CHECK, run before anything was stored. Exit 0 there means the condition already holds:
+       *  nothing is armed, and the worker proceeds now rather than waiting a cadence to be told so. */
+      firstRun: CommandWatchRun.optional(),
+      passed: external_exports.boolean().default(false),
+      expiresAt: external_exports.string().optional(),
+      every: external_exports.string().optional(),
+      /** The `every` / `for` the worker wrote, present ONLY when it was clamped — a clamp nobody is told about
+       *  is a worker resting on coverage it does not have. */
+      clamped: external_exports.object({ every: external_exports.string().optional(), for: external_exports.string().optional() }).strict().optional(),
+      watches: external_exports.array(CommandWatchView)
+    }).strict();
+    DropOwnCommandWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      id: external_exports.string().min(1).max(64)
+    }).strict();
+    DropOwnCommandWatchResult = external_exports.object({
+      dropped: external_exports.boolean(),
+      watches: external_exports.array(CommandWatchView)
+    }).strict();
+    ListOwnCommandWatchesInput = external_exports.object({ slug: ThreadSlug }).strict();
+    OwnCommandWatchesResult = external_exports.object({ watches: external_exports.array(CommandWatchView) }).strict();
     AskQuestionKind = external_exports.enum(["question", "multi"]);
     AskedOptionSchema = external_exports.lazy(() => external_exports.object({
       // 400, not the 120 it launched with (2026-09-03): a label is a chip line, but "Post the drafted
@@ -14140,8 +14236,8 @@ var init_src = __esm({
     }).strict());
     AskInput = external_exports.object({
       slug: ThreadSlug,
-      // No cap on the count (four until 2026-09-03): the tool's own text says "several at once is one
-      // call — register them together", and a cap here told a worker with six to batch and then refused it.
+      // No cap on the count (four until 2026-09-03): the command's own help says several at once is one
+      // run — register them together — and a cap here told a worker with six to batch and then refused it.
       questions: external_exports.array(AskedQuestionSchema).min(1)
     }).strict();
     RegisteredQuestionView = external_exports.object({
@@ -14235,7 +14331,7 @@ var init_src = __esm({
       body: external_exports.string(),
       // fence body minus hint lines, capped server-side; may be ""
       hints: external_exports.array(AwaitingHint).default([]),
-      // Present only on a completion the worker REGISTERED (`mcp__frizz__done`, board.registeredDoneFence)
+      // Present only on a completion the worker REGISTERED (`frizzctl done`, board.registeredDoneFence)
       // rather than wrote as a ```done fence in its final message. The two are one fence to every predicate,
       // but the TRANSCRIPT draws a fence card from the message text it parses — so a registered done, which
       // is in no message, needs the client to know it must draw the card itself at the bottom of the thread
@@ -14805,7 +14901,19 @@ var init_src = __esm({
       // Binds the call to the session the tab is looking at, so a stale page cannot deliver a follow-up
       // into a thread that has since been re-dispatched (merged from origin/main, 2026-07-21).
       sessionId: external_exports.string().min(1),
-      message: external_exports.string().min(1),
+      // EMPTY only when `answers` ride: the staged answers alone are a message. The server refuses a send
+      // that carries neither.
+      message: external_exports.string(),
+      // REGISTERED-QUESTION ANSWERS SENT WITH THIS MESSAGE — the prompt box's one Send. The server settles
+      // each question exactly as `answerQuestions` does, then delivers ONE turn: the answers in their wire
+      // form (questionAnswerMessage) and `message` under them as the note (withAnswersNote). They ride the
+      // follow-up rather than the scheduler's answer wake so the pair arrives together, in the order the
+      // human wrote it, and as fast as a steer does.
+      answers: external_exports.array(QuestionAnswerSchema).optional(),
+      // SEND TO THE QUEUE: while the agent is mid-turn, Frizz keeps this message and delivers it when the
+      // thread comes to rest, so it opens the next turn instead of steering this one. At rest it is an
+      // ordinary send — there is nothing to wait for. See `held` in the server's delivery-ledger.ts.
+      hold: external_exports.boolean().optional(),
       // Generated once before the optimistic clear so a transport replay can be idempotent.
       deliveryId: external_exports.string().min(1).max(200).optional(),
       // Retire the worker's live process before delivering, so this message lands in a `claude` that has
@@ -14867,11 +14975,19 @@ var init_src = __esm({
     DeliverQueuedNowInput = external_exports.object({
       slug: ThreadSlug,
       // Same staleness guard as unqueueFollowUp: a stale tab must not preempt a re-dispatched session.
-      sessionId: external_exports.string().min(1)
+      sessionId: external_exports.string().min(1),
+      // Hand over what Frizz is HOLDING for the agent's rest ("Send to queue") and stop there — no
+      // interrupt. The "Send now" under a held bubble: the operator changed their mind about waiting, not
+      // about interrupting, so the message goes in as the steer it would have been.
+      releaseOnly: external_exports.boolean().optional()
     }).strict();
     DeliverQueuedNowResult = external_exports.object({
       interrupted: external_exports.boolean(),
-      reason: external_exports.string().optional()
+      reason: external_exports.string().optional(),
+      // How many messages Frizz was HOLDING for the agent's rest ("Send to queue") and has now handed over.
+      // Those were never in a provider queue, so on a runtime that cannot be interrupted this is the whole
+      // of what "send now" did — and it is a success the surface must not report as a refusal.
+      released: external_exports.number().int().nonnegative().optional()
     }).strict();
     CompactThreadInput = external_exports.object({
       slug: ThreadSlug,
@@ -14949,7 +15065,7 @@ var init_src = __esm({
       timers: external_exports.array(ThreadTimerView)
     }).strict();
     ThreadActivityItem = external_exports.object({
-      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue", "command"]),
       /** The string a `<kind>:` fence line must carry. For a shell that is the runtime task id the worker
        *  was shown; for a PR, `owner/repo#N`; for a timer, its `tmr_…` row id. */
       id: external_exports.string(),
@@ -14998,13 +15114,6 @@ var init_src = __esm({
       intervalSeconds: RecurringIntervalSeconds.optional(),
       enabled: external_exports.boolean().optional()
     }).strict();
-    ThreadPluginReloadResult = external_exports.object({
-      plugins: external_exports.number().int().min(0),
-      commands: external_exports.number().int().min(0),
-      agents: external_exports.number().int().min(0),
-      mcpServers: external_exports.array(external_exports.string()),
-      errorCount: external_exports.number().int().min(0)
-    }).strict();
     RenameThreadInput = external_exports.object({
       slug: ThreadSlug,
       title: external_exports.string().trim().min(1).max(200)
@@ -15247,6 +15356,14 @@ ${DISPATCH_TASK_BANNER}
         interactionId: InteractionOpaqueId,
         lifecycle: InteractionLifecycle,
         recordRevision: InteractionRevision
+      }).strict(),
+      external_exports.object({
+        // The machine's PROJECT LIST changed: a reorder, a rename, an icon, a project added or forgotten.
+        // Payload-free for the same reason as above — the list is one cheap read, and a client that
+        // re-reads it cannot apply a stale copy out of order. It is the one event that is not about this
+        // stream's own project: the server publishes it on EVERY open project's stream, because the rail
+        // and the grid draw the same list in every tab whichever board that tab is on.
+        type: external_exports.literal("projects-changed")
       }).strict()
     ]);
     TranscriptEdit = external_exports.object({
@@ -15490,7 +15607,8 @@ ${DISPATCH_TASK_BANNER}
       // the server's from the instant it arrives. "failed": the transport threw, or never answered — the
       // text is kept until the operator retries, edits or dismisses it, and nothing retries it on its own.
       // Additive + optional: an older client renders both as a plain bubble (gray for "sending").
-      deliveryState: external_exports.enum(["sending", "pending", "enqueued", "delivered", "unconfirmed", "failed"]).optional(),
+      // "held": the operator sent it TO THE QUEUE — Frizz has it and no transport does, until the agent rests.
+      deliveryState: external_exports.enum(["sending", "pending", "enqueued", "delivered", "unconfirmed", "failed", "held"]).optional(),
       // Why a "failed" send failed, verbatim from the transport. Set only alongside deliveryState "failed".
       deliveryError: external_exports.string().optional(),
       // FRIZZ wrote this user turn, not the human: it is a scheduler wake delivery (isWakeDelivery). The
@@ -15642,8 +15760,9 @@ ${DISPATCH_TASK_BANNER}
        * Three states, not a boolean, because the two "no icon to draw right now" cases must behave
        * differently and a boolean collapses them:
        *   · `icon`    — one is stored; draw it.
-       *   · `none`    — scanned, nothing found. Draw the monogram and DO NOT request the icon route,
-       *                 which is what stops an iconless project flashing its initials and then swapping.
+       *   · `none`    — scanned recently, nothing found. Draw the monogram and DO NOT request the icon
+       *                 route, which is what stops an iconless project flashing its initials and then
+       *                 swapping. An OLD miss reads `unknown` again, so an icon added since is found.
        *   · `unknown` — never scanned. The monogram shows, but the request MUST still go out, because
        *                 that request is what triggers the (lazy, cached) scan in the first place.
        *
@@ -20120,7 +20239,7 @@ import {
   realpathSync as realpathSync2,
   renameSync,
   rmSync as rmSync3,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
@@ -20171,7 +20290,7 @@ function syncDirectory(path) {
 }
 function lockOwnerPath(lockPath) {
   try {
-    return statSync3(lockPath).isDirectory() ? join8(lockPath, GLOBAL_LOCK_OWNER) : lockPath;
+    return statSync4(lockPath).isDirectory() ? join8(lockPath, GLOBAL_LOCK_OWNER) : lockPath;
   } catch {
     return lockPath;
   }
@@ -20202,10 +20321,10 @@ function observeLock(lockPath, adapter) {
   }
   try {
     const ownerPath = lockOwnerPath(lockPath);
-    let modified = statSync3(lockPath).mtimeMs;
+    let modified = statSync4(lockPath).mtimeMs;
     if (ownerPath !== lockPath) {
       try {
-        modified = Math.max(modified, statSync3(ownerPath).mtimeMs);
+        modified = Math.max(modified, statSync4(ownerPath).mtimeMs);
       } catch {
       }
     }
@@ -20536,7 +20655,7 @@ import {
   readFileSync as readFileSync6,
   renameSync as renameSync2,
   rmSync as rmSync4,
-  statSync as statSync4,
+  statSync as statSync5,
   writeFileSync as writeFileSync6
 } from "node:fs";
 import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join9 } from "node:path";
@@ -20603,7 +20722,7 @@ function quarantine(path, suffix) {
 }
 function pathAge(path) {
   try {
-    return Date.now() - statSync4(path).mtimeMs;
+    return Date.now() - statSync5(path).mtimeMs;
   } catch {
     return void 0;
   }
@@ -21009,7 +21128,7 @@ var init_boot_progress = __esm({
 
 // packages/server/src/project-root.ts
 import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync as closeSync3, existsSync as existsSync4, fsyncSync as fsyncSync3, mkdirSync as mkdirSync8, openSync as openSync4, readFileSync as readFileSync8, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { closeSync as closeSync3, existsSync as existsSync4, fsyncSync as fsyncSync3, mkdirSync as mkdirSync8, openSync as openSync4, readFileSync as readFileSync8, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname8, join as join11, parse, resolve as resolve3 } from "node:path";
 function projectIdPath(root) {
@@ -21103,17 +21222,6 @@ function isHomeDirectory(dir, home = homedir8()) {
     return false;
   }
 }
-function isWorldWritable(dir, platform = process.platform) {
-  if (platform === "win32") return false;
-  try {
-    return (statSync5(dir).mode & 2) !== 0;
-  } catch {
-    return false;
-  }
-}
-function refuseWorldWritableProject(dir) {
-  if (isWorldWritable(dir)) throw new Error(`A folder every account can write to cannot be a project: ${dir}`);
-}
 function existingProjectId(dir) {
   const fromFile = readProjectIdFile(dir);
   if (fromFile) return fromFile;
@@ -21190,10 +21298,11 @@ function readRegistry(home = homedir9()) {
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || !Array.isArray(parsed.projects)) return { ...EMPTY, projects: [] };
     const forgotten = Array.isArray(parsed.forgotten) ? parsed.forgotten.filter((id) => typeof id === "string") : [];
+    const host = canonicalPath(launchHostDir(home));
     return {
       version: 1,
       projects: parsed.projects.filter(
-        (p) => p && typeof p.id === "string" && typeof p.path === "string" && typeof p.slug === "string"
+        (p) => p && typeof p.id === "string" && typeof p.path === "string" && typeof p.slug === "string" && p.path !== host
       ),
       ...forgotten.length > 0 ? { forgotten } : {}
     };
@@ -21227,6 +21336,12 @@ function writeRegistry(registry, home = homedir9()) {
     }
     throw error;
   }
+  for (const listener of writeListeners) {
+    try {
+      listener(path);
+    } catch {
+    }
+  }
 }
 function slugifyProject(value) {
   const s = slugify(value);
@@ -21297,20 +21412,11 @@ function registerProject(input, home = homedir9()) {
   writeRegistry(registry, home);
   return { entry, action: "created" };
 }
-function listProjects(home = homedir9()) {
-  const byRecency = (a, b) => a.lastOpenedAt < b.lastOpenedAt ? 1 : a.lastOpenedAt > b.lastOpenedAt ? -1 : 0;
-  return readRegistry(home).projects.map((p) => ({ ...p, stale: !existsSync5(p.path) })).sort((a, b) => {
-    if (a.order === void 0 && b.order === void 0) return byRecency(a, b);
-    if (a.order === void 0) return 1;
-    if (b.order === void 0) return -1;
-    return a.order - b.order;
-  });
-}
 function findByPath(path, home = homedir9()) {
   const canonical = canonicalPath(path);
   return readRegistry(home).projects.find((p) => p.path === canonical || p.path === path);
 }
-var EMPTY, GENERIC, RESERVED;
+var EMPTY, GENERIC, RESERVED, writeListeners, ICON_RESCAN_AFTER_MS;
 var init_project_registry = __esm({
   "packages/server/src/project-registry.ts"() {
     "use strict";
@@ -21356,15 +21462,55 @@ var init_project_registry = __esm({
       "api",
       "health"
     ]);
+    writeListeners = /* @__PURE__ */ new Set();
+    ICON_RESCAN_AFTER_MS = 10 * 60 * 1e3;
+  }
+});
+
+// packages/server/src/launch-routing.ts
+import { realpathSync as realpathSync5 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+function classifyLaunch(dir, home = homedir10()) {
+  const candidate = realpathSync5(discoverProjectRoot(dir, home));
+  const refused = isHomeDirectory(candidate, home);
+  if (!refused && (isExistingProjectRoot(candidate) || findByPath(candidate, home) !== void 0)) {
+    return { kind: "open", root: candidate };
+  }
+  return !refused && hasProjectMarker(candidate) ? { kind: "offer", directory: candidate } : { kind: "grid" };
+}
+function offerPath(directory) {
+  return `/?add=${encodeURIComponent(directory)}`;
+}
+function parseLaunchRoute(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const { protocol, path, project, notice } = body;
+  if (protocol !== LAUNCH_ROUTE_PROTOCOL || typeof path !== "string") return void 0;
+  if (!path.startsWith("/") || path.startsWith("//") || path.includes("\\") || /[\u0000-\u001f]/u.test(path)) return void 0;
+  const named = project && typeof project === "object" ? project : void 0;
+  return {
+    path,
+    ...named && typeof named.name === "string" && typeof named.dir === "string" ? { project: { name: named.name, dir: named.dir } } : {},
+    ...typeof notice === "string" && notice.length > 0 ? { notice: notice.slice(0, 500) } : {}
+  };
+}
+var LAUNCH_ROUTE_PROTOCOL, LAUNCH_ROUTE_PATH, LAUNCH_TOKEN_HEADER;
+var init_launch_routing = __esm({
+  "packages/server/src/launch-routing.ts"() {
+    "use strict";
+    init_project_registry();
+    init_project_root();
+    LAUNCH_ROUTE_PROTOCOL = 1;
+    LAUNCH_ROUTE_PATH = "/control/launch";
+    LAUNCH_TOKEN_HEADER = "x-frizz-launch-token";
   }
 });
 
 // src/production.ts
 init_local_origin();
-import { readFileSync as readFileSync14 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { join as join17 } from "node:path";
+import { dirname as dirname14, join as join17 } from "node:path";
 
 // src/browser.ts
 import { spawn, execFile } from "node:child_process";
@@ -25459,14 +25605,14 @@ init_frizz_paths();
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { createServer as createServer2 } from "node:net";
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync5, rmSync as rmSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir10, tmpdir as tmpdir2 } from "node:os";
+import { existsSync as existsSync6, mkdirSync as mkdirSync10, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync6, rmSync as rmSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir11, tmpdir as tmpdir2 } from "node:os";
 import { basename as basename5, dirname as dirname10, join as join13, resolve as resolve4 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 init_project_root();
+init_launch_routing();
 init_logging();
 init_src();
-init_project_registry();
 var PORT_SCAN_COUNT = 100;
 var LAUNCH_TIMEOUT_MS = BOOT_STALL_TIMEOUT_MS;
 var LAUNCH_HARD_TIMEOUT_MS = BOOT_HARD_TIMEOUT_MS;
@@ -25583,7 +25729,7 @@ function boardAddress(url) {
   return url.includes("?") || url.endsWith("/") ? url : `${url}/`;
 }
 var SANDBOX_DROPPED_XDG_ROOTS = ["XDG_DATA_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME"];
-function prepareSandbox(env = process.env, realHome = homedir10()) {
+function prepareSandbox(env = process.env, realHome = homedir11()) {
   const home = mkdtempSync(join13(tmpdir2(), "frizz-sandbox-"));
   const inherited = { ...env };
   env.HOME = home;
@@ -25639,34 +25785,46 @@ function cleanupSandbox(home) {
   } catch {
   }
 }
-function resolveLaunchIntent(cwd = process.cwd(), home = homedir10(), env = process.env) {
-  const candidate = realpathSync5(discoverProjectRoot(cwd, home));
-  const known = isExistingProjectRoot(candidate) || findByPath(candidate, home) !== void 0;
-  const refused = isHomeDirectory(candidate, home) || isWorldWritable(candidate);
-  if (known && !refused) return { kind: "open", workspace: resolveWorkspace(cwd, home, env) };
-  const host = mostRecentProject(home, env) ?? hostWorkspace(home);
-  return !refused && hasProjectMarker(candidate) ? { kind: "offer", workspace: host, directory: candidate } : { kind: "grid", workspace: host };
+function resolveLaunchIntent(cwd = process.cwd(), home = homedir11(), env = process.env) {
+  const launch = classifyLaunch(cwd, home);
+  if (launch.kind === "open") return { kind: "open", workspace: resolveWorkspace(cwd, home, env) };
+  const host = hostWorkspace(home);
+  return launch.kind === "offer" ? { kind: "offer", workspace: host, directory: launch.directory } : { kind: "grid", workspace: host };
 }
-function hostWorkspace(home = homedir10()) {
+async function askLaunchRoute(port, ownerToken, dir, options2 = {}) {
+  const fetcher = options2.fetcher ?? fetch;
+  const deadline = Date.now() + (options2.patienceMs ?? 6e3);
+  for (; ; ) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options2.timeoutMs ?? 5e3);
+    timeout.unref?.();
+    try {
+      const response = await fetcher(`http://127.0.0.1:${port}${FRIZZ_ROUTE_PREFIX}${LAUNCH_ROUTE_PATH}`, {
+        method: "POST",
+        headers: { "content-type": "application/json", [LAUNCH_TOKEN_HEADER]: ownerToken },
+        body: JSON.stringify({ protocol: LAUNCH_ROUTE_PROTOCOL, dir, ...options2.args?.length ? { args: options2.args } : {} }),
+        signal: controller.signal
+      });
+      if (response.status === 200) return parseLaunchRoute(await response.json());
+      if (response.status !== 503 || Date.now() >= deadline) return void 0;
+    } catch {
+      return void 0;
+    } finally {
+      clearTimeout(timeout);
+    }
+    await delay2(250);
+  }
+}
+function hostWorkspace(home = homedir11()) {
   const dir = launchHostDir(home);
   mkdirSync10(dir, { recursive: true });
-  const root = realpathSync5(dir);
+  const root = realpathSync6(dir);
   const id = ensureProjectIdFile(root, home);
   const stateDir = projectStateDir(id, home);
   mkdirSync10(stateDir, { recursive: true });
   return { root, id, stateDir, name: basename5(root), identityScope: "repository" };
 }
-function mostRecentProject(home, env) {
-  for (const entry of listProjects(home)) {
-    if (entry.stale || isHomeDirectory(entry.path, home) || isWorldWritable(entry.path)) continue;
-    try {
-      return resolveWorkspace(entry.path, home, env);
-    } catch {
-    }
-  }
-  return void 0;
-}
-function resolveWorkspace(cwd = process.cwd(), home = homedir10(), env = process.env) {
+function resolveWorkspace(cwd = process.cwd(), home = homedir11(), env = process.env) {
   let gitRoot;
   try {
     gitRoot = execFileSync3("git", ["rev-parse", "--show-toplevel"], {
@@ -25680,8 +25838,7 @@ function resolveWorkspace(cwd = process.cwd(), home = homedir10(), env = process
     if (!isNotAGitWorktree(error)) throw new Error("unable to resolve Git repository root");
     gitRoot = void 0;
   }
-  const root0 = realpathSync5(gitRoot ?? discoverProjectRoot(cwd, home));
-  refuseWorldWritableProject(root0);
+  const root0 = realpathSync6(gitRoot ?? discoverProjectRoot(cwd, home));
   const identity = gitRoot ? resolveGitProjectIdentity(root0, home) : void 0;
   const root = identity?.root ?? root0;
   const id = ensureProjectIdFile(root, home, identity?.id);
@@ -25712,7 +25869,7 @@ function workspaceLaunchTarget(workspace2) {
 function workspaceFromLaunchTarget(target2, env = process.env) {
   let root;
   try {
-    root = realpathSync5(target2.projectDir);
+    root = realpathSync6(target2.projectDir);
   } catch {
     throw new Error("pinned Frizz workspace is no longer available");
   }
@@ -26483,9 +26640,25 @@ var Supervisor = class {
       if (this.restartCompletion === completion) this.restartCompletion = null;
     }
   }
+  /**
+   * A restart or an update drains the running child and forks its replacement in the project the
+   * server is hosted on. Once that folder is deleted the fork fails with ENOENT, and a child given
+   * any other cwd refuses to boot without its project — and so does the one that would put the old
+   * child back, so the click meant to refresh the board stops it. The running child is unharmed by
+   * the missing folder, so refuse before draining and leave it serving.
+   *
+   * Measured 2026-10-11 on a board hosted on a folder deleted a day later: its Update failed one
+   * step earlier, on npm dying with `uv_cwd ENOENT`, and that accident was all that kept it up.
+   */
+  missingLaunchFolder() {
+    if (existsSync7(this.cwd)) return void 0;
+    return `Frizz is running on ${this.cwd}, which no longer exists, so a new server cannot start there. Stop Frizz and start it again.`;
+  }
   /** Called only by the public supervisor control endpoint, never by ordinary document reloads. */
   restartFromBrowser() {
     if (this.browserRestart) return this.browserRestart;
+    const missing = this.missingLaunchFolder();
+    if (missing) return Promise.resolve({ state: "failed", message: missing });
     const previousBoot = this.boot?.bootId;
     const work = (async () => {
       this.lastRestartFailure = void 0;
@@ -26511,6 +26684,8 @@ var Supervisor = class {
   }
   async updateFromBrowser() {
     if (!this.updateRestart) return { state: "failed", message: "Update & Restart is unavailable in this launcher mode" };
+    const missing = this.missingLaunchFolder();
+    if (missing) return { state: "failed", message: missing };
     if (this.updateMode === "child") return this.updateChildFromBrowser();
     this.emitActivity("updating", "preparing the update \u2014 the running Frizz is untouched until it is ready");
     const candidate = await this.updateRestart();
@@ -27220,12 +27395,13 @@ import {
   mkdirSync as mkdirSync12,
   openSync as openSync6,
   readFileSync as readFileSync12,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync6,
   rmSync as rmSync9,
   statSync as statSync6,
   writeFileSync as writeFileSync11
 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
 import { delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute6, join as join15, relative as relative3, resolve as resolve6, sep as sep4 } from "node:path";
 var SERVER_PROTOCOL = 1;
 var SERVER_DATA_EPOCH = 1;
@@ -27262,9 +27438,18 @@ function serverReleaseSpec(manifest, packageOverride) {
   assertSpec(spec);
   return spec;
 }
+function serverReleaseMinimum(manifest) {
+  const metadata = record(record(manifest).frizzServer);
+  const minimum = metadata.minimum;
+  if (minimum === void 0) return void 0;
+  if (typeof minimum !== "string" || !VERSION.test(minimum)) throw new Error("invalid minimum Frizz server version");
+  const order = typeof metadata.version === "string" ? compareReleaseVersions(metadata.version, minimum) : null;
+  if (order === null || order < 0) throw new Error("the pinned Frizz server is older than the minimum this launcher declares");
+  return minimum;
+}
 function containedFile(root, name, directory = false) {
-  const path = realpathSync6(join15(root, name));
-  const rel = relative3(realpathSync6(root), path);
+  const path = realpathSync7(join15(root, name));
+  const rel = relative3(realpathSync7(root), path);
   if (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute6(rel))
     throw new Error(`Frizz server artifact escapes its package: ${name}`);
   const stat = statSync6(path);
@@ -27286,7 +27471,7 @@ function validateServerGeneration(root, spec, id, compatibility = CURRENT_COMPAT
   containedFile(root, "web-dist/index.html");
   containedFile(root, "runtime/board/index.mjs");
   containedFile(root, "runtime/cc-worker/.claude-plugin/plugin.json");
-  return { ...spec, id, root: realpathSync6(root), entry };
+  return { ...spec, id, root: realpathSync7(root), entry };
 }
 function serverGenerationLaunch(generation) {
   return {
@@ -27305,7 +27490,7 @@ function resolveNpmCli(env = process.env, executable = process.execPath) {
   for (const directory of [dirname13(executable), ...(env.PATH ?? env.Path ?? "").split(delimiter2).filter(Boolean)]) {
     candidates.push(join15(directory, "node_modules/npm/bin/npm-cli.js"), join15(directory, "../lib/node_modules/npm/bin/npm-cli.js"));
     try {
-      const path = realpathSync6(join15(directory, "npm"));
+      const path = realpathSync7(join15(directory, "npm"));
       if (path.endsWith("npm-cli.js")) candidates.push(path);
     } catch {
     }
@@ -27314,7 +27499,15 @@ function resolveNpmCli(env = process.env, executable = process.execPath) {
   if (!found) throw new Error("npm was not found beside Node or on PATH; install Node with npm to install Frizz server releases");
   return resolve6(found);
 }
-function npmServerPackageInstaller(env = process.env) {
+var NPM_OPERATION_TIMEOUT_MS = 18e4;
+function npmFailureSummary(stderr) {
+  const lines = stderr.trim().split("\n");
+  const tail = lines.slice(-8);
+  const cause = lines.find((line) => /^(?:[A-Z]\w*)?Error(?: \[\w+\])?: /u.test(line));
+  return (cause && !tail.includes(cause) ? [cause, ...tail] : tail).join("\n");
+}
+function npmServerPackageInstaller(env = process.env, options2 = {}) {
+  const timeoutMs = options2.timeoutMs ?? NPM_OPERATION_TIMEOUT_MS;
   const run2 = (args2, cwd) => new Promise((resolveOutput, reject) => {
     let cli;
     try {
@@ -27328,14 +27521,17 @@ function npmServerPackageInstaller(env = process.env) {
       cwd,
       encoding: "utf8",
       windowsHide: true,
-      timeout: 18e4,
+      timeout: timeoutMs,
       killSignal: "SIGKILL",
       maxBuffer: 4 * 1024 * 1024
     }, (error, stdout, stderr) => {
-      if (error) {
-        const tail = stderr.trim().split("\n").slice(-8).join("\n");
-        reject(new Error(`Frizz server npm operation failed: ${tail || error.message}`));
-      } else resolveOutput(stdout);
+      if (!error) {
+        resolveOutput(stdout);
+        return;
+      }
+      const limit = timeoutMs >= 6e4 ? `${Math.ceil(timeoutMs / 6e4)}m` : `${Math.ceil(timeoutMs / 1e3)}s`;
+      const why = error.killed ? `npm ${args2[0]} did not finish within ${limit} and was stopped` : npmFailureSummary(stderr) || error.message;
+      reject(new Error(`Frizz server npm operation failed: ${why}`));
     });
   });
   return {
@@ -27359,7 +27555,7 @@ function npmServerPackageInstaller(env = process.env) {
     },
     async latestVersion(packageName) {
       if (!PACKAGE.test(packageName)) throw new Error("invalid Frizz server package name");
-      const parsed = JSON.parse(await run2(["view", `${packageName}@latest`, "version", "--json"]));
+      const parsed = JSON.parse(await run2(["view", `${packageName}@latest`, "version", "--json"], tmpdir3()));
       const version = Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
       if (typeof version !== "string" || !VERSION.test(version)) throw new Error("npm returned an invalid Frizz server version");
       return version;
@@ -27393,11 +27589,12 @@ function atomicJson2(path, value) {
   }
 }
 var ServerReleaseStore = class {
-  constructor(spec, installer, roots = frizzPaths(), compatibility = CURRENT_COMPATIBILITY) {
+  constructor(spec, installer, roots = frizzPaths(), compatibility = CURRENT_COMPATIBILITY, minimum) {
     this.spec = spec;
     this.installer = installer;
     this.roots = roots;
     this.compatibility = compatibility;
+    this.minimum = minimum;
     assertSpec(spec, compatibility);
     const key = createHash4("sha256").update(spec.package).digest("hex").slice(0, 16);
     this.generations = join15(roots.cache, "server-releases", key);
@@ -27447,6 +27644,22 @@ var ServerReleaseStore = class {
     this.markCompatibilityBeforeLaunch();
     return generation;
   }
+  /**
+   * The selected release, when it is older than this shell works with: `load` will start the pinned
+   * one instead. Undefined for a machine with no selection, an unreadable one (`load` reports that),
+   * and any selection at or above the minimum.
+   */
+  belowMinimum() {
+    if (this.minimum === void 0 || !existsSync9(this.selection)) return void 0;
+    let selected;
+    try {
+      selected = record(readJson(this.selection)).version;
+    } catch {
+      return void 0;
+    }
+    if (typeof selected !== "string" || compareReleaseVersions(selected, this.minimum) !== -1) return void 0;
+    return { selected, minimum: this.minimum, pinned: this.spec.version };
+  }
   async load() {
     this.assertMarkerIsSupported();
     if (!existsSync9(this.selection)) return this.prepareInitial(this.spec.version);
@@ -27460,6 +27673,7 @@ var ServerReleaseStore = class {
     if (spec.dataEpoch < this.compatibility.dataEpoch) return this.prepareInitial(this.spec.version);
     if (spec.dataEpoch > this.compatibility.dataEpoch)
       throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+    if (this.belowMinimum()) return this.prepareInitial(this.spec.version);
     const root = this.packageRoot(selected.id);
     const generation = !existsSync9(root) ? await this.prepare(spec.version) : validateServerGeneration(root, spec, selected.id, this.compatibility);
     this.markCompatibilityBeforeLaunch();
@@ -27484,7 +27698,7 @@ var ServerReleaseStore = class {
     }
   }
   commit(generation) {
-    if (generation.package !== this.spec.package || generation.root !== realpathSync6(this.packageRoot(generation.id)))
+    if (generation.package !== this.spec.package || generation.root !== realpathSync7(this.packageRoot(generation.id)))
       throw new Error("cannot select a Frizz server outside this release store");
     validateServerGeneration(generation.root, generation, generation.id, this.compatibility);
     const { package: packageName, version, protocol, dataEpoch, id } = generation;
@@ -27496,7 +27710,7 @@ var ServerReleaseStore = class {
 init_frizz_paths();
 init_project_launch();
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, realpathSync as realpathSync7 } from "node:fs";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync13, realpathSync as realpathSync8 } from "node:fs";
 import { join as join16 } from "node:path";
 var STABLE_SERVER_OWNER_NAME = "frizz-server";
 var STABLE_SERVER_OWNER_PROJECT_ID = "c1fd5810-0f8a-4c1d-91a0-6d7445d28e5a";
@@ -27510,7 +27724,7 @@ function stableServerOwnerTarget(roots) {
   mkdirSync13(resolved.data, { recursive: true, mode: 448 });
   return {
     projectId: STABLE_SERVER_OWNER_PROJECT_ID,
-    projectDir: realpathSync7(resolved.data),
+    projectDir: realpathSync8(resolved.data),
     stateDir: join16(resolved.state, STABLE_SERVER_OWNER_NAME)
   };
 }
@@ -27587,6 +27801,9 @@ function releaseHeldLease(lease) {
   return true;
 }
 
+// src/production.ts
+init_launch_routing();
+
 // src/preflight.ts
 import { spawnSync } from "node:child_process";
 var SUPPORTED_NODE_LINES = [
@@ -27713,7 +27930,13 @@ var serverOwner;
 process.on("exit", () => {
   if (serverOwner) releaseStableServerOwner(serverOwner);
 });
-var launchIntent;
+var launchDir = (() => {
+  try {
+    return process.cwd();
+  } catch {
+    return homedir12();
+  }
+})();
 var workspace = (() => {
   try {
     if (!reexec) {
@@ -27725,21 +27948,26 @@ var workspace = (() => {
       if (!pinned) throw new Error("registry successor is missing its pinned project identity");
       return workspaceFromLaunchTarget(pinned);
     }
-    const intent = resolveLaunchIntent();
-    launchIntent = intent;
-    return intent.workspace;
+    return hostWorkspace();
   } catch (error) {
     return fail(error);
   }
 })();
-process.chdir(workspace.root);
+function runningBoardPort() {
+  const machine = readStableServerOwner();
+  if (machine.kind === "running") return machine.port;
+  return liveWorkspaceOwner(workspace.stateDir, workspaceLaunchTarget(workspace))?.port;
+}
+function controlPorts() {
+  const machine = readStableServerOwner();
+  return [.../* @__PURE__ */ new Set([...machine.kind === "running" ? [machine.port] : [], DEFAULT_PORT, fallbackPort(DEFAULT_PORT)])];
+}
 if (options.stop) {
   try {
-    const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace) });
-    const where = control.host ? workspace.root : `${workspace.root} (the board was launched from ${control.target.projectDir})`;
+    const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace), ports: controlPorts() });
     const result = await stopProjectLaunch({ stateDir: control.stateDir, target: control.target });
     console.log(
-      result.kind !== "stopped" ? `Frizz is not running for ${where}` : result.stale ? `Frizz was not running for ${where}; cleared the record a dead board left behind` : `stopped Frizz for ${where}; running agents keep going \u2014 they are detached daemons`
+      result.kind !== "stopped" ? "Frizz is not running" : result.stale ? "Frizz was not running; cleared the record a dead board left behind" : "stopped Frizz; running agents keep going \u2014 they are detached daemons"
     );
     process.exit(0);
   } catch (error) {
@@ -27747,14 +27975,13 @@ if (options.stop) {
   }
 }
 if (options.status) {
-  const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace) });
+  const control = await resolveLaunchControlTarget({ stateDir: workspace.stateDir, target: workspaceLaunchTarget(workspace), ports: controlPorts() });
   const running = await runningFrizzStatus({ stateDir: control.stateDir, target: control.target });
   if (!running) {
-    console.log(`Frizz is not running for ${workspace.root}`);
+    console.log("Frizz is not running");
     process.exit(1);
   }
   console.log(`running: http://127.0.0.1:${running.port}`);
-  console.log(`workspace: ${workspace.root}`);
   if (!control.host) console.log(`launched from: ${control.target.projectDir} (one server serves every project)`);
   console.log(`supervisor pid: ${running.pid}`);
   console.log(`version: ${running.version ?? "unknown"}`);
@@ -27762,23 +27989,23 @@ if (options.status) {
   process.exit(0);
 }
 if (options.sessions || options.signOut !== void 0) {
-  const running = liveWorkspaceOwner(workspace.stateDir, workspaceLaunchTarget(workspace));
-  if (!running?.port) {
-    console.error("frizz: no board is running for this workspace");
+  const port = runningBoardPort();
+  if (!port) {
+    console.error("frizz: Frizz is not running");
     process.exit(1);
   }
-  if (options.signOut !== void 0) await signOutSession(running.port, options.signOut);
-  await listSessions(running.port);
+  if (options.signOut !== void 0) await signOutSession(port, options.signOut);
+  await listSessions(port);
 }
 if (options.link) {
-  const running = liveWorkspaceOwner(workspace.stateDir, workspaceLaunchTarget(workspace));
-  if (!running?.port) {
-    console.error("frizz: no board is running for this workspace");
+  const port = runningBoardPort();
+  if (!port) {
+    console.error("frizz: Frizz is not running");
     process.exit(1);
   }
-  const response = await fetch(`http://127.0.0.1:${running.port}${SUPERVISOR_ACCESS_CODE_PATH}`, {
+  const response = await fetch(`http://127.0.0.1:${port}${SUPERVISOR_ACCESS_CODE_PATH}`, {
     method: "POST",
-    headers: { origin: `http://127.0.0.1:${running.port}` }
+    headers: { origin: `http://127.0.0.1:${port}` }
   }).catch(() => void 0);
   if (!response?.ok) {
     const detail = response ? (await response.json().catch(() => void 0))?.error : void 0;
@@ -27802,7 +28029,7 @@ readout?.plan([
   { key: "browser", label: options.noApp ? "Address" : "Browser" }
 ]);
 readout?.begin("server", "starting");
-logger.info("launcher", `Frizz launcher ${PACKAGE_VERSION} starting for ${workspace.root}`);
+logger.info("launcher", `Frizz launcher ${PACKAGE_VERSION} starting in ${launchDir}`);
 var target = workspaceLaunchTarget(workspace);
 var expected = expectedOwnerHealth(target, readProjectLaunchOwner(workspace.stateDir));
 async function existingPort() {
@@ -27811,39 +28038,54 @@ async function existingPort() {
   for (const port of new Set(ports)) if (await probeFrizz(port, expected)) return port;
   return void 0;
 }
-function ownSlug() {
+var legacyIntentCache;
+function legacyIntent() {
+  return legacyIntentCache ??= resolveLaunchIntent(launchDir);
+}
+function legacyProject() {
+  const intent = legacyIntent();
+  if (intent.kind !== "open") return void 0;
+  const { id, root, name } = intent.workspace;
   try {
-    return registerProject(
-      { dir: workspace.root, id: target.projectId, remoteOwner: resolveProjectLabel(workspace.root)?.split("/")[0] },
-      homedir11()
-    ).entry?.slug;
+    const slug = registerProject({ dir: root, id, remoteOwner: resolveProjectLabel(root)?.split("/")[0] }, homedir12()).entry?.slug;
+    return slug ? { id, root, name, slug } : void 0;
   } catch {
     return void 0;
   }
 }
-var cachedSlugPath;
-function slugPath() {
-  if (cachedSlugPath === void 0) {
-    if (launchIntent?.kind === "grid") cachedSlugPath = "/";
-    else if (launchIntent?.kind === "offer") cachedSlugPath = `/?add=${encodeURIComponent(launchIntent.directory)}`;
-    else {
-      const slug = ownSlug();
-      cachedSlugPath = slug ? `/project/${slug}` : "";
-    }
+function legacyLanding() {
+  try {
+    const intent = legacyIntent();
+    if (intent.kind === "grid") return { path: "/" };
+    if (intent.kind === "offer") return { path: offerPath(intent.directory) };
+    const project = legacyProject();
+    return project ? { path: `/project/${project.slug}`, project: { name: project.name, dir: project.root } } : { path: "/" };
+  } catch (error) {
+    return { path: "/", notice: `Could not open ${launchDir}: ${error instanceof Error ? error.message : String(error)}` };
   }
-  return cachedSlugPath;
 }
-async function joinRunningFrizz() {
-  const slug = ownSlug();
-  if (!slug) return void 0;
+async function resolveLanding(port, ownerToken) {
+  const answered = ownerToken ? await askLaunchRoute(port, ownerToken, launchDir) : void 0;
+  if (answered) return answered;
+  logger.info("launcher", "the running server did not say where this launch lands; using this launcher's own rules");
+  return legacyLanding();
+}
+async function joinPreSplitFrizz() {
   for (const port of /* @__PURE__ */ new Set([DEFAULT_PORT, fallbackPort(DEFAULT_PORT)])) {
-    if (await probeFrizz(port, { projectId: target.projectId, projectDir: target.projectDir, slug }))
-      return { port, slug };
+    if (!await readFrizzHealth(port)) continue;
+    let project;
+    try {
+      project = legacyProject();
+    } catch {
+      return void 0;
+    }
+    if (!project) return void 0;
+    if (await probeFrizz(port, { projectId: project.id, projectDir: project.root, slug: project.slug })) return port;
   }
   return void 0;
 }
-async function openOrPrint(port, reused, path = "") {
-  const url = `http://127.0.0.1:${port}${path}`;
+async function openOrPrint(port, reused, landing) {
+  const url = `http://127.0.0.1:${port}${landing.path}`;
   logger.info("launcher", `${reused ? "reusing" : "started"} Frizz at ${url}`);
   readout?.settle("server", "done", reused ? `already running on port ${port}` : `port ${port}`);
   let browser;
@@ -27870,26 +28112,27 @@ async function openOrPrint(port, reused, path = "") {
   const warnings = [];
   if (sandbox) warnings.push(`Sandbox: everything here is throwaway (${sandbox.home}) and is deleted when this terminal closes.`);
   if (sessionNotice && !reused) warnings.push(sessionNotice);
+  if (landing.notice) warnings.push(landing.notice);
   if (!readout) {
-    console.log(`${reused ? "reusing" : "started"} Frizz${launchIntent && launchIntent.kind !== "open" ? "" : ` for ${workspace.root}`}`);
+    console.log(`${reused ? "reusing" : "started"} Frizz${landing.project ? ` for ${landing.project.dir}` : ""}`);
     console.log(url);
     if (publicOrigin) console.log(activeAccessLink?.url ?? `${publicOrigin}/`);
     for (const warning of warnings) console.log(warning);
     return;
   }
-  const home = homedir11();
+  const home = homedir12();
   readout.ready(
     [
       { label: "Local", value: boardAddress(url), accent: true },
       ...publicOrigin ? [{ label: "Public", value: activeAccessLink?.url ?? `${publicOrigin}/`, accent: true }] : [],
-      // Only an `open` launch is ABOUT its workspace; any other is hosted on a project the operator
-      // did not pick (launcher.ts resolveLaunchIntent), and naming it here reads as "you opened this".
-      ...launchIntent && launchIntent.kind !== "open" ? [] : [{ label: "Project", value: `${workspace.name} \u2014 ${tildePath(workspace.root, home)}` }],
+      // Only a launch that OPENED a project names one: the dashboard and an offer are about no
+      // project, and the folder the server runs on is Frizz's own.
+      ...landing.project ? [{ label: "Project", value: `${landing.project.name} \u2014 ${tildePath(landing.project.dir, home)}` }] : [],
       ...logger.file ? [{ label: "Logs", value: tildePath(logger.file, home) }] : []
     ],
     reused ? (
       // This launch owns nothing and exits immediately, so ctrl-c would not stop what it reopened.
-      "reopened the server already running for this project \xB7 stop it from the terminal that started it"
+      "reopened the Frizz already running on this machine \xB7 stop it from the terminal that started it"
     ) : options.debug ? void 0 : publicOrigin ? "press L for a fresh sign-in link \xB7 R to change how this board is reached \xB7 ctrl-c to stop" : "press R to reach this board from a phone or another machine \xB7 ctrl-c to stop",
     {
       ...reused ? { status: `already running on port ${port}` } : {},
@@ -27914,32 +28157,49 @@ async function runSupervisor(port, token, onPrepared = () => {
     target,
     owner.token
   );
-  const spec = serverReleaseSpec(
-    JSON.parse(readFileSync14(join17(import.meta.dirname, "..", "package.json"), "utf8")),
-    process.env.FRIZZ_SERVER_PACKAGE
-  );
+  const manifest = JSON.parse(readFileSync14(join17(import.meta.dirname, "..", "package.json"), "utf8"));
+  const spec = serverReleaseSpec(manifest, process.env.FRIZZ_SERVER_PACKAGE);
   const installer = npmServerPackageInstaller(env);
-  const store = new ServerReleaseStore(spec, installer);
-  activityReadout?.notice("progress", "Starting", "loading the selected Frizz server release");
+  const store = new ServerReleaseStore(spec, installer, void 0, void 0, serverReleaseMinimum(manifest));
+  const raise = store.belowMinimum();
+  if (raise)
+    logger.info("launcher", `the installed Frizz server ${raise.selected} is older than this launcher works with (${raise.minimum}); starting on ${raise.pinned}`);
+  activityReadout?.notice(
+    "progress",
+    "Starting",
+    raise ? `installing Frizz server ${raise.pinned}: ${raise.selected} is older than this launcher works with` : "loading the selected Frizz server release"
+  );
   let active = await store.load();
   let pending;
   let previous = active;
   onPrepared();
   let updateAvailable = false;
   let updateVersion;
+  let probeFailure;
   const refreshUpdateAvailable = async () => {
     try {
       const checkedVersion = active.version;
       const plan = await planRegistryUpdate(spec.package, checkedVersion, installer);
+      probeFailure = void 0;
       if (active.version !== checkedVersion) return;
       updateAvailable = plan !== null;
       updateVersion = plan?.latestVersion;
-    } catch {
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message !== probeFailure) logger.warn("launcher", `could not check npm for a newer Frizz server: ${message}`);
+      probeFailure = message;
     }
   };
   void refreshUpdateAvailable();
   const updateAvailablePoll = setInterval(() => void refreshUpdateAvailable(), 30 * 60 * 1e3);
   updateAvailablePoll.unref();
+  try {
+    const projects = dirname14(workspace.stateDir);
+    const adopted = adoptSessionState(workspace.stateDir, readdirSync4(projects).map((name) => join17(projects, name)));
+    if (adopted) logger.info("launcher", `carried the remote sign-in state over from ${adopted}`);
+  } catch (error) {
+    logger.warn("launcher", `could not carry the remote sign-in state over: ${error instanceof Error ? error.message : String(error)}`);
+  }
   const sessions = loadSessionState(workspace.stateDir);
   const epochRecord = sessionEpochLogLine(sessions.advance, sessions.signedOut);
   if (epochRecord) logger.warn("launcher", epochRecord);
@@ -28043,7 +28303,7 @@ async function runSupervisor(port, token, onPrepared = () => {
       paneHost?.dispose();
       remote?.stop();
       const suffix = logger.file ? `
-  log: ${tildePath(logger.file, homedir11())}` : "";
+  log: ${tildePath(logger.file, homedir12())}` : "";
       process.stdout.write(
         code === 0 ? `
   Frizz stopped. Running agents keep going \u2014 they are detached daemons.${suffix}
@@ -28080,7 +28340,7 @@ try {
   if (globalClaim.kind === "running") {
     if (options.port && options.port !== globalClaim.port)
       throw new Error(`Frizz is already running on port ${globalClaim.port}; --port cannot change a running server`);
-    await openOrPrint(globalClaim.port, true, slugPath());
+    await openOrPrint(globalClaim.port, true, await resolveLanding(globalClaim.port, globalClaim.owner.token));
     process.exit(0);
   }
   serverOwner = globalClaim.lease;
@@ -28092,16 +28352,16 @@ try {
   }
   const existing = await existingPort();
   if (existing) {
-    await openOrPrint(existing, true, slugPath());
+    await openOrPrint(existing, true, await resolveLanding(existing, readProjectLaunchOwner(workspace.stateDir)?.token));
     process.exit(0);
   }
-  const joined = await joinRunningFrizz();
-  if (joined) {
-    await openOrPrint(joined.port, true, slugPath());
+  const preSplit = await joinPreSplitFrizz();
+  if (preSplit) {
+    await openOrPrint(preSplit, true, legacyLanding());
     process.exit(0);
   }
   const claim = tryAcquireProjectLaunchOwner(target, "launcher");
-  if (claim.kind !== "acquired") throw new Error("Frizz is starting for this project; retry shortly");
+  if (claim.kind !== "acquired") throw new Error("Frizz is starting on this machine; retry shortly");
   let release = await acquireGlobalLaunchLock();
   let portReservation;
   try {
@@ -28127,7 +28387,7 @@ try {
     ]);
     portReservation();
     portReservation = void 0;
-    await openOrPrint(port, false, slugPath());
+    await openOrPrint(port, false, await resolveLanding(port, serverOwner.token));
     await running;
   } finally {
     release?.();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.13.12",
+  "version": "0.13.13",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [
@@ -66,7 +66,8 @@
   },
   "frizzServer": {
     "package": "frizz-server",
-    "version": "0.15.22",
+    "version": "0.15.23",
+    "minimum": "0.15.21",
     "protocol": 1,
     "dataEpoch": 1
   }