frizz 0.6.0 → 0.7.0

package/README.md

@@ -62,7 +62,7 @@ Frizz is a browser tab, a queue, and the agent CLIs you already pay for. It brin
 - 🐙 **GitHub integration.** Browse your repo's issues and pull requests without leaving the composer, and turn a selection of them into threads. Workers can read issues, diffs, and CI on their own.
 - 👀 **Built-in CI and PR watchers.** A worker waiting on a build or a review doesn't hand the thread back to you to be told "keep going." It watches, and picks the work back up when the run goes green or a review lands.
 - 📝 **No magic.** A thread behaves like a Claude Code session you started yourself. Frizz adds no worktrees, no branches, no dev server, no build integration, no workflow engine to fight with.
-- 🔒 **Local only.** No cloud, no account, no telemetry. The server binds `127.0.0.1` by default and its state lives in your user directory, never in your checkout.
+- 🔒 **Local only.** No cloud, no account, no telemetry. The server binds `127.0.0.1` by default and its state lives in your user directory, never in your checkout. To reach a board from a phone, put your own tunnel or proxy in front of it — see [Remote access](docs/remote-access.md).
 
 ### The queue
 
@@ -121,11 +121,12 @@ $ npx frizz --help
 
 Frizz production launcher
 
-Usage: npx frizz [options] [repository]
-       npx frizz up            start the server plus its public tunnel
+Usage: npx frizz [options]
 
-Runs the npm-resolved immutable Frizz package, then opens it in your default browser. Use frizz-dev
-only for a source checkout.
+Run it in the directory you want to work in. One server serves EVERY project on this machine,
+each at its own /project/<name> URL, so a second run joins the one already going. Runs the
+npm-resolved immutable Frizz package, then opens it in your default browser. Use frizz-dev only
+for a source checkout.
 
 Options:
   --app                  use the legacy dedicated app window instead of a browser tab
@@ -134,6 +135,8 @@ Options:
   --host [address]       serve on a network address instead of loopback (bare --host means 0.0.0.0)
   --allowed-host <name>  with --host, also accept this DNS name as the board's address (repeatable)
   --public-origin <url>  serve behind a proxy/tunnel reachable at this exact origin
+  --cloud                serve at the saved hostname and run its Cloudflare tunnel as a child
+                         process; asked once, then remembered
   --link                 print a fresh single-use access link for the running board
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help

package/dist/dev-child.js

@@ -13598,7 +13598,7 @@ var init_src = __esm({
     ].join("\n");
     PARK_CORRECTION_NAMES_LEAD = "\u26A0\uFE0F Your ```awaiting fence names ";
     PARK_CORRECTION_RETIRED_LEAD = "\u26D4 Your ```awaiting fence uses ";
-    ThreadWatchKind = external_exports.enum(["shell", "github"]);
+    ThreadWatchKind = external_exports.enum(["shell", "github", "timer"]);
     GithubChecksState = external_exports.enum(["none", "running", "passing", "failing"]);
     GithubMergeState = external_exports.enum(["mergeable", "blocked", "conflicting", "unknown"]);
     GithubWatchStatus = external_exports.object({
@@ -13632,7 +13632,12 @@ var init_src = __esm({
       state: external_exports.enum(["armed", "fired", "dropped"]),
       createdAt: external_exports.string(),
       /** `github` rows only, and absent until the first successful poll. */
-      github: GithubWatchStatus.optional()
+      github: GithubWatchStatus.optional(),
+      /** `timer` rows only: the armed timer's own registration, which is everything the row renders — the
+       *  worker's prompt is the row's NAME (a `tmr_…` id names nothing to a human) and the fire instant is
+       *  its status. Unlike `github` there is no polled half to be absent: a timer that exists is fully
+       *  known, so a timer row always carries this. */
+      timer: external_exports.object({ fireAt: external_exports.string(), prompt: external_exports.string() }).strict().optional()
     }).strict();
     PR_WATCH_DEFAULT_FOR_MS = 6 * 60 * 60 * 1e3;
     PR_WATCH_MAX_ARMED = 32;
@@ -21112,13 +21117,13 @@ function dropCancelled(messages, items) {
   const dropped = /* @__PURE__ */ new Set();
   for (const item of items) {
     if (item.state !== "cancelled") continue;
-    const text = canon(item.text);
+    const text = renderMatchKey(item.text);
     const from = Date.parse(item.at) - 5e3;
     const to = Date.parse(item.updatedAt) + CANCEL_MATCH_SLACK_MS;
     for (let i = messages.length - 1; i >= 0; i--) {
       const m = messages[i];
       if (m.role !== "user" || dropped.has(i)) continue;
-      if (canon(stripDeliveryMarkers(m.text)) !== text) continue;
+      if (renderMatchKey(m.text) !== text) continue;
       const at = m.at ? Date.parse(m.at) : NaN;
       if (Number.isFinite(at) && Number.isFinite(from) && Number.isFinite(to) && (at < from || at > to)) continue;
       dropped.add(i);
@@ -21134,13 +21139,13 @@ function projectDeliveryLedger(messages, items) {
   if (!cancelled.live.length) return messages;
   const claimed = /* @__PURE__ */ new Set();
   for (const item of cancelled.live) {
-    const text = canon(item.text);
+    const text = renderMatchKey(item.text);
     const tag = deliveryTag(item.id);
     let handled = false;
     for (let i = messages.length - 1; i >= 0; i--) {
       const m = messages[i];
       if (m.role !== "user" || claimed.has(i)) continue;
-      if (!decodeDeliveryMarkers(m.text).includes(tag) && canon(stripDeliveryMarkers(m.text)) !== text) continue;
+      if (!decodeDeliveryMarkers(m.text).includes(tag) && renderMatchKey(m.text) !== text) continue;
       if (m.queued) {
         if (item.state === "delivered") {
           messages[i] = { ...m, queued: false, deliveryId: item.id, deliveryState: item.state };
@@ -21171,10 +21176,11 @@ function projectDeliveryLedger(messages, items) {
   }
   return messages;
 }
-var PENDING_TIMEOUT_MS, UNCONFIRMED_DROP_MS, MAX_LEDGER_ITEMS, MAX_CANCELLED_ITEMS, canon, COMPOSED_ANCHOR_MIN, CANCEL_MATCH_SLACK_MS;
+var PENDING_TIMEOUT_MS, UNCONFIRMED_DROP_MS, MAX_LEDGER_ITEMS, MAX_CANCELLED_ITEMS, canon, COMPOSED_ANCHOR_MIN, renderMatchKey, CANCEL_MATCH_SLACK_MS;
 var init_delivery_ledger = __esm({
   "packages/server/src/delivery-ledger.ts"() {
     "use strict";
+    init_src();
     init_delivery_marker();
     PENDING_TIMEOUT_MS = 6e4;
     UNCONFIRMED_DROP_MS = 60 * 6e4;
@@ -21182,6 +21188,7 @@ var init_delivery_ledger = __esm({
     MAX_CANCELLED_ITEMS = 12;
     canon = (s) => s.replace(/\s+/g, " ").trim();
     COMPOSED_ANCHOR_MIN = 24;
+    renderMatchKey = (s) => canon(stripHumanGapNote(stripWakeDeliveryToken(stripDeliveryMarkers(s))));
     CANCEL_MATCH_SLACK_MS = 5e3;
   }
 });
@@ -35651,9 +35658,14 @@ function hasDeclaredBackgroundPark(tele, nowMs) {
   if (Number.isFinite(restedMs) && nowMs - restedMs > DECLARED_PARK_MAX_MS) return false;
   return true;
 }
-function hasDeclaredWait(tele, nowMs) {
+function hasParkedTimerWatch(tele, armedTimerIds) {
+  if (tele?.lastFence?.kind !== "awaiting") return false;
+  return tele.lastFence.hints.some((hint) => hint.kind === "timer" && armedTimerIds.has(hint.value.trim()));
+}
+function hasDeclaredWait(tele, nowMs, armedTimerIds = /* @__PURE__ */ new Set()) {
   if (hasDeclaredBackgroundPark(tele, nowMs)) return true;
   if (tele?.lastFence?.kind === "awaiting" && hasParkedPrWatch(tele)) return true;
+  if (hasParkedTimerWatch(tele, armedTimerIds)) return true;
   return (tele?.subAgents ?? []).some((a) => isDirectSubAgent(a) && a.state === "running");
 }
 function heldByRunningChecks(tele, github, registered) {
@@ -35691,9 +35703,23 @@ function bgSnoozeArmed(row) {
 function hasParkedExternalWait(tele, _nowMs) {
   return false;
 }
-function fenceWatchViews(slug, tele, fenceAt, github = {}, registered = []) {
+function fenceWatchViews(slug, tele, fenceAt, github = {}, registered = [], armedTimers = []) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
+  for (const t of armedTimers) {
+    if (seen.has(`timer:${t.id}`)) continue;
+    seen.add(`timer:${t.id}`);
+    out.push({
+      id: `timer:${slug}:${t.id}`,
+      kind: "timer",
+      target: t.id,
+      state: "armed",
+      createdAt: t.createdAt,
+      // Always present, unlike the github half above: a timer that exists is fully known — there is no
+      // poller to wait for. The prompt is the row's NAME client-side (a `tmr_…` id names nothing).
+      timer: { fireAt: t.fireAt, prompt: t.prompt }
+    });
+  }
   for (const w of registered) {
     if (seen.has(`github:${w.target}`)) continue;
     seen.add(`github:${w.target}`);
@@ -35742,11 +35768,13 @@ function deriveNeedsYou(row, tele, runtime, hasActionableInteraction = false, no
   if (tele?.lastFence?.kind === "done") return true;
   return true;
 }
-function deriveAwaitingBackground(row, tele, runtime, hasActionableInteraction = false, nowMs = Date.now(), limitPause = void 0, deliveryProcessGone = false, github = {}, registeredPrWatches = /* @__PURE__ */ new Set()) {
-  if (runtime !== "turn-idle" || !hasDeclaredWait(tele, nowMs)) return false;
+function deriveAwaitingBackground(row, tele, runtime, hasActionableInteraction = false, nowMs = Date.now(), limitPause = void 0, deliveryProcessGone = false, github = {}, registeredPrWatches = /* @__PURE__ */ new Set(), armedTimerIds = /* @__PURE__ */ new Set()) {
+  if (runtime !== "turn-idle" || !hasDeclaredWait(tele, nowMs, armedTimerIds)) return false;
   if (hasActionableInteraction || tele?.pendingAsk || tele?.pendingQuestion) return false;
   if (tele?.lastFence?.kind === "done") return false;
-  if (tele?.lastFence?.kind === "awaiting" && !hasParkedPrWatch(tele) && !hasDeclaredBackgroundPark(tele, nowMs)) return false;
+  if (tele?.lastFence?.kind === "awaiting" && !hasParkedPrWatch(tele) && !hasDeclaredBackgroundPark(tele, nowMs) && // A TIMER PARK IS THE SAME EXCEPTION AGAIN (2026-08-24): its fence has no park action either, so
+  // suppressing this card left the wait stated nowhere but the fence's own machinery footer.
+  !hasParkedTimerWatch(tele, armedTimerIds)) return false;
   return deriveNeedsYou({ ...row, bg_snooze_rested_at: null }, tele, runtime, hasActionableInteraction, nowMs, limitPause, false, deliveryProcessGone);
 }
 function resolveSessionProfile(row, tele) {
@@ -35830,6 +35858,13 @@ function sessionThreadView(projectDir, storage, row, tele, registeredLegacyTermi
     createdAt: new Date(w.created_at).toISOString()
   }));
   const registeredPrWatches = new Set(armedPrWatches.map((w) => w.target));
+  const armedTimers = storage.listThreadTimers(row.slug, { armedOnly: true }).map((t) => ({
+    id: t.id,
+    prompt: t.prompt,
+    fireAt: new Date(t.fire_at).toISOString(),
+    createdAt: new Date(t.created_at).toISOString()
+  }));
+  const armedTimerIds = new Set(armedTimers.map((t) => t.id));
   const headlessStalled = row.codex_runtime === "app-server" ? appServerTurnStalled(codexTurnLiveness(row.slug, row.session_id), tele?.lastActivityAt, nowMs) : isBrokerClaudeRow(row) ? !claudeBrokerDaemonAlive(row.session_id) : false;
   const headlessLostWork = isBrokerClaudeRow(row) && headlessStalled && hasUnretiredOwnAgents(tele);
   const deliveryProcessGone = isBrokerClaudeRow(row) && headlessStalled;
@@ -35847,7 +35882,7 @@ function sessionThreadView(projectDir, storage, row, tele, registeredLegacyTermi
   const archived = state === "archived";
   const limitPause = resolveLimitPause(row, tele, nowMs);
   const needsYou = archived ? false : deriveNeedsYou(row, tele, runtime, interactionPresence.needsUser, nowMs, limitPause, true, deliveryProcessGone, github, registeredPrWatches);
-  const awaitingBackground = archived ? false : deriveAwaitingBackground(row, tele, runtime, interactionPresence.needsUser, nowMs, limitPause, deliveryProcessGone, github, registeredPrWatches);
+  const awaitingBackground = archived ? false : deriveAwaitingBackground(row, tele, runtime, interactionPresence.needsUser, nowMs, limitPause, deliveryProcessGone, github, registeredPrWatches, armedTimerIds);
   const crashed = runtime === "exited" && (tele?.turn === "in-flight" || hasLiveBackgroundWork(tele) || headlessLostWork);
   const snoozedUntil = futureSnooze(row, nowMs);
   const profile = resolveSessionProfile(row, tele);
@@ -35883,7 +35918,7 @@ function sessionThreadView(projectDir, storage, row, tele, registeredLegacyTermi
     // become the github rows, `watch:` lines the shell rows — so this strip lists exactly what will
     // actually wake the thread, and the two cannot drift into claiming different things. There is no
     // registry behind either any more (`thread_watch`, retired 2026-08-14).
-    watches: fenceWatchViews(row.slug, tele, tele?.lastAssistantAt, github, armedPrWatches),
+    watches: fenceWatchViews(row.slug, tele, tele?.lastAssistantAt, github, armedPrWatches, armedTimers),
     pendingAsk: tele?.pendingAsk ? { questions: tele.pendingAsk.questions } : void 0,
     pendingQuestion: tele?.pendingQuestion ?? false,
     lastUserAt: tele?.lastUserAt,

package/dist/frizz.js

@@ -13988,7 +13988,7 @@ var init_src = __esm({
       "seen nothing since their own last message \u2014 the Goal, this reminder, a watcher wake all came from",
       "frizz \u2014 so anything you assumed they had followed, they have not."
     ].join("\n");
-    ThreadWatchKind = external_exports.enum(["shell", "github"]);
+    ThreadWatchKind = external_exports.enum(["shell", "github", "timer"]);
     GithubChecksState = external_exports.enum(["none", "running", "passing", "failing"]);
     GithubMergeState = external_exports.enum(["mergeable", "blocked", "conflicting", "unknown"]);
     GithubWatchStatus = external_exports.object({
@@ -14022,7 +14022,12 @@ var init_src = __esm({
       state: external_exports.enum(["armed", "fired", "dropped"]),
       createdAt: external_exports.string(),
       /** `github` rows only, and absent until the first successful poll. */
-      github: GithubWatchStatus.optional()
+      github: GithubWatchStatus.optional(),
+      /** `timer` rows only: the armed timer's own registration, which is everything the row renders — the
+       *  worker's prompt is the row's NAME (a `tmr_…` id names nothing to a human) and the fire instant is
+       *  its status. Unlike `github` there is no polled half to be absent: a timer that exists is fully
+       *  known, so a timer row always carries this. */
+      timer: external_exports.object({ fireAt: external_exports.string(), prompt: external_exports.string() }).strict().optional()
     }).strict();
     PR_WATCH_DEFAULT_FOR_MS = 6 * 60 * 60 * 1e3;
     PrWatchView = external_exports.object({
@@ -16313,7 +16318,6 @@ function parseCliArgs(argv) {
   let rawHost;
   let rawPublicOrigin;
   const rawAllowedHosts = [];
-  let repoPath;
   const consumed = /* @__PURE__ */ new Set();
   for (let index = 0; index < argv.length; index++) {
     const arg = argv[index];
@@ -16367,9 +16371,13 @@ function parseCliArgs(argv) {
       continue;
     }
     if (arg.startsWith("-")) continue;
-    if (repoPath !== void 0)
-      throw new Error("provide at most one repository path");
-    repoPath = arg;
+    if (arg === "up")
+      throw new Error(
+        "the up command was removed \u2014 there is one way to launch Frizz, so use --cloud instead: it serves at the saved hostname and runs its tunnel"
+      );
+    throw new Error(
+      `unexpected argument: ${arg} \u2014 Frizz takes no repository path, because one server serves every project on this machine. cd into the directory you want and run it with no arguments.`
+    );
   }
   let port;
   if (rawPort !== void 0) {
@@ -16405,7 +16413,6 @@ function parseCliArgs(argv) {
       continue;
     }
     if (arg.startsWith("--port=") || arg.startsWith("--host=") || arg.startsWith("--allowed-host=") || arg.startsWith("--public-origin=")) continue;
-    if (!arg.startsWith("-") && arg === repoPath) continue;
     if (!known.has(arg)) throw new Error(`unknown option: ${arg}`);
   }
   if (args2.has("--detach"))
@@ -16427,8 +16434,7 @@ function parseCliArgs(argv) {
     port,
     host,
     allowedHosts: normalizeAllowedHosts(rawAllowedHosts),
-    ...rawPublicOrigin === void 0 ? {} : { publicOrigin: normalizePublicOrigin(rawPublicOrigin) },
-    repoPath
+    ...rawPublicOrigin === void 0 ? {} : { publicOrigin: normalizePublicOrigin(rawPublicOrigin) }
   };
 }
 var EXPOSED_WARNING = "Anyone who can reach this address can run commands on this machine as you. Frizz has no login \u2014 only do this on a network you trust.";
@@ -17017,6 +17023,7 @@ var RestartSupervisorProxy = class {
   }
   status() {
     const delegated = this.options.status?.();
+    const updateVersion = this.options.updateVersion?.();
     const ownerTransition = this.restartInFlight !== null || this.state === "failed";
     return {
       ...delegated ?? {},
@@ -17027,6 +17034,10 @@ var RestartSupervisorProxy = class {
       // Sent ONLY when the launcher can actually answer it, so an older client — and frizz-dev, which
       // has no notion of "already current" — keeps today's behaviour on its absence.
       ...this.options.updateAvailable ? { updateAvailable: this.options.updateAvailable() === true } : {},
+      // Version numbers ride the same launcher-only contract: absent for frizz-dev and legacy
+      // supervisors, so their clients render exactly what they render today.
+      ...this.options.version ? { version: this.options.version } : {},
+      ...updateVersion ? { updateVersion } : {},
       // Sent only when TRUE, so a published Frizz's payload is byte-identical to what it sends today
       // and an older client is unaffected. Absent therefore means "not a development build".
       ...this.options.dev ? { dev: true } : {}
@@ -17576,6 +17587,8 @@ var Supervisor = class {
       restart: () => this.restartFromBrowser(),
       updateRestart: this.updateRestart ? () => this.updateFromBrowser() : void 0,
       updateAvailable: opts.updateAvailable,
+      version: opts.version,
+      updateVersion: opts.updateVersion,
       dev: opts.dev,
       status: () => {
         if (this.browserRestart || this.restartRunning) return { state: "restarting" };
@@ -18232,11 +18245,12 @@ if (options.help) {
   console.log(
     `Frizz production launcher
 
-Usage: npx ${PACKAGE_NAME} [options] [repository]
-       npx ${PACKAGE_NAME} up            start the server plus its public tunnel
+Usage: npx ${PACKAGE_NAME} [options]
 
-Runs the npm-resolved immutable Frizz package, then opens it in your default browser. Use frizz-dev
-only for a source checkout.
+Run it in the directory you want to work in. One server serves EVERY project on this machine,
+each at its own /project/<name> URL, so a second run joins the one already going. Runs the
+npm-resolved immutable Frizz package, then opens it in your default browser. Use frizz-dev only
+for a source checkout.
 
 Options:
   --app                  use the legacy dedicated app window instead of a browser tab
@@ -18245,8 +18259,8 @@ Options:
   --host [address]       serve on a network address instead of loopback (bare --host means 0.0.0.0)
   --allowed-host <name>  with --host, also accept this DNS name as the board's address (repeatable)
   --public-origin <url>  serve behind a proxy/tunnel reachable at this exact origin
-  --cloud                what the up command sets: serve at the saved public hostname and run the
-                         tunnel as a supervised child
+  --cloud                serve at the saved hostname and run its Cloudflare tunnel as a child
+                         process; asked once, then remembered
   --link                 print a fresh single-use access link for the running board
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
@@ -18288,7 +18302,7 @@ var workspace = (() => {
       if (!pinned) throw new Error("registry successor is missing its pinned project identity");
       return workspaceFromLaunchTarget(pinned);
     }
-    const intent = resolveLaunchIntent(options.repoPath);
+    const intent = resolveLaunchIntent();
     if (intent.kind === "empty")
       throw new Error(
         intent.reason === "home" ? "frizz cannot open your home directory as a project, and there is no other project to show yet. cd into a repository and run frizz there." : `${intent.directory} is not a Frizz project yet, and there is no other project to show. Run frizz inside a repository, or add this one from the projects page once a board is open.`
@@ -18430,9 +18444,12 @@ async function runSupervisor(port, token) {
   const childEntry = fileURLToPath2(new URL("./dev-child.js", import.meta.url));
   let plannedUpdate;
   let updateAvailable = true;
+  let updateVersion;
   const refreshUpdateAvailable = async () => {
     try {
-      updateAvailable = await planRegistryUpdate(PACKAGE_NAME, PACKAGE_VERSION, npmRegistryReleaseAdapter) !== null;
+      const plan = await planRegistryUpdate(PACKAGE_NAME, PACKAGE_VERSION, npmRegistryReleaseAdapter);
+      updateAvailable = plan !== null;
+      updateVersion = plan?.latestVersion;
     } catch {
     }
   };
@@ -18454,6 +18471,8 @@ async function runSupervisor(port, token) {
     childEntry,
     childEnvironment: () => ({ FRIZZ_STABLE_WEB_DIST: webDist, FRIZZ_STABLE_ARTIFACT: `npm:${PACKAGE_NAME}@${PACKAGE_VERSION}`, FRIZZ_SCRIPTS_DIR: scriptsDir, FRIZZ_WORKER_PLUGIN_DIR: workerPluginDir }),
     updateAvailable: () => updateAvailable,
+    version: PACKAGE_VERSION,
+    updateVersion: () => updateVersion,
     // The terminal that owns the board says so when the board goes down and comes back. Everything
     // here is triggered from a browser tab or by a crash, so without this the foreground process is
     // the last place to learn what happened to it.
@@ -18463,9 +18482,11 @@ async function runSupervisor(port, token) {
         const plan = await planRegistryUpdate(PACKAGE_NAME, PACKAGE_VERSION, npmRegistryReleaseAdapter);
         if (!plan) {
           updateAvailable = false;
+          updateVersion = void 0;
           return { state: "failed", message: `Frizz ${PACKAGE_VERSION} is already current` };
         }
         plannedUpdate = plan;
+        updateVersion = plan.latestVersion;
         return { state: "ready", message: `Frizz ${plan.latestVersion} will start in a new npm execution cache` };
       } catch (error) {
         return { state: "failed", message: error instanceof Error ? error.message : String(error) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [

package/runtime/cc-worker/bin/frizz-mcp.mjs

@@ -273,7 +273,7 @@ const WATCH_PR = {
     "wait at all. This tool is the wait.\n\n" +
     "THE ```awaiting FENCE IS STILL WORTH WRITING, and it is a different job: it is how you come to REST " +
     "without frizz asking you for a handoff, and how the human sees what you are waiting for. Register " +
-    "the watcher with this tool, then name the same PR on a `pr-watch:` line in your fence.\n\n" +
+    "the watcher with this tool, then name the same PR in your fence's `prs:` list.\n\n" +
     "REGISTERING IS IDEMPOTENT per pull request: asking twice returns the SAME id and tells you it was " +
     "already armed, so re-registering after a compaction is safe and is the right instinct. Use `list` " +
     "when you want to know what you are holding without changing anything — it answers with each PR's " +
@@ -925,7 +925,7 @@ async function watchPr(args) {
     : `Watching ${ref} as ${id}. Frizz wakes you when CI passes or fails and on every later review or ` +
       "comment, and the registration survives your turn ending, a compaction and a frizz restart."
   return (
-    `${head}\n\nNAME IT IN YOUR \`\`\`awaiting FENCE TOO (\`pr-watch: ${ref}\`) — the watcher does the ` +
+    `${head}\n\nNAME IT IN YOUR \`\`\`awaiting FENCE TOO (\`prs: [${ref}]\`) — the watcher does the ` +
     `waking, the fence is what lets you come to rest and shows the human what you are waiting for.\n\n` +
     `DROP IT when it stops mattering (\`action: "drop", id: "${id}"\`).\n\n${armedPrWatchList(result)}`
   )

package/runtime/cc-worker/hooks/session-seed.mjs

@@ -67,11 +67,11 @@ const core =
   '⟦frizz worker contract⟧ You are a frizz WORKER driving EXACTLY ONE effort. Your FULL operating contract — the end-of-turn signal fences, scratch-directory rules, sub-agent rules, and the question handback — lives in your SYSTEM PROMPT; follow it there (this is a runtime re-grounding, not a second copy). The human + the frizz app are the ORCHESTRATOR; you drive ONE effort and never scan the board or touch other efforts. There is no orchestrator mode and no fleet to run: doing the work yourself is the default, and you dispatch a sub-agent only when the work genuinely decomposes into independent prongs.\n' +
   'SCRATCH DIRECTORY (OPTIONAL): `' + scratch + '` — a folder kept FOR YOU: any files you like, no format expected, nothing in it read automatically, and never a substitute for doing the work. A single direct task usually needs nothing. On a long effort write the doc you would want if you lost your context — the approach, what you rejected, the human\'s decisions — AS YOU GO, mid-work, then KEEP WORKING, and arm mcp__frizz__recurring_prompt with post_compaction: true and a prompt LINKING that file, because the arming is what brings it back. Give each sub-agent its OWN file rather than a shared one.\n' +
   'DO NOT REST WHILE THE INSTRUCTION HAS PARTS LEFT — finish them in THIS turn; a milestone, a green test run and a long turn are none of them stopping points, and announcing the next step or writing it into a scratch file is not doing it.\n' +
-  'ALWAYS SIGN OFF WITH A FENCE, per the fence rules in your system prompt. A rest with NO fence is not a handoff — it is an item nobody can triage, and frizz will tell you so. ```done only when the effort\'s real work is COMPLETE (code LANDED on the mainline — an open PR is NOT done, park it on ```awaiting until it MERGES) and is a DISMISSAL (its card files the thread away where nobody looks again), so if the thread points at future work AT ALL — a pre-fix investigation, a live code-change discussion, follow-up work you DISCOVERED even when someone else will do it — ask a ```question instead, and uncertain is not done; a verdict that ends in something the HUMAN must now do (post this comment, merge or decline, pick one of these) is a ```question carrying your recommendation as option A, never a done card, because a draft you wrote but did not send is filed away with the thread; when your OWN mandate is complete and what is left is a separable effort, DO it first — dispatch a sub-agent, whose result comes BACK to you, so it lands on YOUR card — and ASK second; mcp__frizz__spawn_thread is the LAST resort, for work that genuinely cannot ride on your card, because a spawned thread reports only to the human and nothing it learns returns to you or its siblings; the ONE exception is a planning session whose plan file is fully written and persisted, because that artifact outlives the thread; ```awaiting parks a human:/timer:/pr-watch: gate or your OWN background work, never CI/releases/merge progression (those stay ACTIVE); ```question is the operator ask. Waiting on your own background shell? Your shells and sub-agents are watched AUTOMATICALLY — frizz wakes you when one finishes, fence or no fence. NAME it on a `watch: <id>` line anyway and rest: that is what lets you stop without frizz asking you for a handoff, and what shows the human what you are waiting for. Frizz checks the name against what you actually have running. Keep the write-up SHORT: 1-3 sentences, then bullets starting with a **bolded verb phrase**. The fence and the prose above it are TWO SURFACES, not one message written twice — the card is the ledger of what shipped, the prose is only what a ledger cannot hold, and a sentence that would read the same in either belongs in exactly one. And a done message says what HAPPENED: delete every dangling "one thing to carry forward" or "a follow-up could" — do it, spawn it onto its own card, ask about it, or DROP it, and if it is not worth a card it is not worth a sentence.\n' +
+  'ALWAYS SIGN OFF WITH A FENCE, per the fence rules in your system prompt. A rest with NO fence is not a handoff — it is an item nobody can triage, and frizz will tell you so. ```done only when the effort\'s real work is COMPLETE (code LANDED on the mainline — an open PR is NOT done, park it on ```awaiting until it MERGES) and is a DISMISSAL (its card files the thread away where nobody looks again), so if the thread points at future work AT ALL — a pre-fix investigation, a live code-change discussion, follow-up work you DISCOVERED even when someone else will do it — ask a ```question instead, and uncertain is not done; a verdict that ends in something the HUMAN must now do (post this comment, merge or decline, pick one of these) is a ```question carrying your recommendation as option A, never a done card, because a draft you wrote but did not send is filed away with the thread; when your OWN mandate is complete and what is left is a separable effort, DO it first — dispatch a sub-agent, whose result comes BACK to you, so it lands on YOUR card — and ASK second; mcp__frizz__spawn_thread is the LAST resort, for work that genuinely cannot ride on your card, because a spawned thread reports only to the human and nothing it learns returns to you or its siblings; the ONE exception is a planning session whose plan file is fully written and persisted, because that artifact outlives the thread; ```awaiting parks your OWN background work — a shell, a sub-agent, an armed timer, a registered PR watcher — never CI/releases/merge progression (those stay ACTIVE), and never a person: waiting on a person is a ```question; ```question is the operator ask. Waiting on your own background shell? Your shells and sub-agents are watched AUTOMATICALLY — frizz wakes you when one finishes, fence or no fence. NAME it in the fence\'s YAML frontmatter anyway — plural keys taking lists (`shells: [<id>]`, `agents:`, `timers:`, `prs:`) plus a required `for:` duration, then `---` and your prose — and rest: that is what lets you stop without frizz asking you for a handoff, and what shows the human what you are waiting for. Frizz checks every name against what you actually have running. Keep the write-up SHORT: 1-3 sentences, then bullets starting with a **bolded verb phrase**. The fence and the prose above it are TWO SURFACES, not one message written twice — the card is the ledger of what shipped, the prose is only what a ledger cannot hold, and a sentence that would read the same in either belongs in exactly one. And a done message says what HAPPENED: delete every dangling "one thing to carry forward" or "a follow-up could" — do it, spawn it onto its own card, ask about it, or DROP it, and if it is not worth a card it is not worth a sentence.\n' +
   'DECIDE rather than ask: anything derivable from the code, the conventions, or ordinary engineering judgment is YOURS to settle — asking permission to do the work you were dispatched to do is not a question, it is the job. Reserve the operator for the irreversible and the genuinely human-owned.';
 
 const grounding =
-  '⟦frizz worker re-grounding (post-compaction)⟧ Context was just compacted. You are still the frizz worker for effort `' + thread + '` — read whatever you left yourself in `' + scratch + '` NOW to recover your working state and to-do list before asserting anything, and re-read any code before claiming how it is structured. Signal at rest through your FINAL MESSAGE, always with a fence — a fenceless rest is an item nobody can triage: ```done queues a checked completion until Archive and is a DISMISSAL — completed work only, and never when the thread still points at future work (a pre-fix investigation, a live code-change discussion); use a question or bare rest; ```awaiting parks only a human:/timer: gate (or a pr-watch: PR watcher, which wakes on any new review/comment, bot or human); ```question is the explicit higher-priority operator ask. CI/releases/merge progression stay active through Monitor/background Bash.';
+  '⟦frizz worker re-grounding (post-compaction)⟧ Context was just compacted. You are still the frizz worker for effort `' + thread + '` — read whatever you left yourself in `' + scratch + '` NOW to recover your working state and to-do list before asserting anything, and re-read any code before claiming how it is structured. Signal at rest through your FINAL MESSAGE, always with a fence — a fenceless rest is an item nobody can triage: ```done queues a checked completion until Archive and is a DISMISSAL — completed work only, and never when the thread still points at future work (a pre-fix investigation, a live code-change discussion); use a question or bare rest; ```awaiting parks only your own background work, an armed timer, or a registered PR watcher (which wakes on any new review/comment, bot or human) — named in YAML frontmatter with plural list keys (`shells:`/`agents:`/`timers:`/`prs:`) plus a `for:` duration; waiting on a person is a ```question; ```question is the explicit higher-priority operator ask. CI/releases/merge progression stay active through Monitor/background Bash.';
 
 // AUTH-GATED gh guidance — teach the worker to use `gh` well, but ONLY when signed in.
 // Shell `gh auth status --active`: exit 0 = an active gh account is authenticated. The whole gate is

package/runtime/cc-worker/skills/gh/SKILL.md

@@ -58,7 +58,7 @@ gh pr view N -R OWNER/REPO --comments     # review threads + conversation
 ```
 Read the changed files **in context**, not just the hunks — `gh pr diff` shows what changed, but correctness lives in the surrounding code.
 
-**Reading ONE review (what a `pr-watch` wake hands you)**
+**Reading ONE review (what a `watch_pr` wake hands you)**
 
 A wake permalink ending `#pullrequestreview-<id>` is a **review**, and a review's `body` is routinely
 **empty** — review apps (pullfrog, coderabbit) and humans doing an inline pass put every word in the
@@ -139,12 +139,13 @@ such as `push` and `pull_request` both contribute to the aggregate verdict.
   `TaskOutput` is deprecated. Do not fake waiting with `echo waiting` or sleep-only Bash calls.
 
 Both mechanisms are session-bound. If the next check deliberately belongs at a named wall-clock
-instant, park with a durable `timer:` fence. If a specific external human reviewer/approver is the
-only remaining gate, park with `human: <actor + exact action>`. For a GitHub PR, pair it with
-`pr-watch: OWNER/REPO#NUMBER`: frizz baselines current reviews/comments and wakes on ANY new
-activity after the fence — bot or human — durably across restarts. Otherwise optionally pair a timer for
-a scheduled recheck. The dashboard operator's own go/no-go remains a ` ```question ` block. `pr:` / `ci:` /
-`session:` awaiting hints are legacy compatibility only — do not emit them for new automated waits.
+instant, set a durable timer with `mcp__frizz__timer` and park with its id in your fence's `timers:`
+list. If a specific external human reviewer/approver is the only remaining gate, that is a
+` ```question ` — waiting on a person is never a park. For a GitHub PR, register it with
+`mcp__frizz__watch_pr` and name it in the fence's `prs:` list (`prs: [OWNER/REPO#NUMBER]`): frizz
+baselines current reviews/comments and wakes on ANY new activity after registration — bot or human —
+durably across restarts. The registration creates the wait; the fence only declares it. The dashboard
+operator's own go/no-go remains a ` ```question ` block.
 
 ## Fitting gh work into your thread type
 

package/runtime/cc-worker/skills/waits/SKILL.md

@@ -19,7 +19,7 @@ thread in Active.
 | REST until the condition is met (the usual CI / PR / release wait) | a **sub-agent** that owns the wait |
 | KEEP WORKING alongside a process you launched (dev server, log tail) | `Bash` + `run_in_background: true` |
 | stream events into the turn you are actively working in | `Monitor` |
-| re-check at a named wall-clock instant, across a process exit | `timer:` awaiting fence |
+| re-check at a named wall-clock instant, across a process exit | `mcp__frizz__timer`, named in a `timers:` fence list |
 
 Never fake a wait with `echo waiting`, repeated foreground sleeps, or an `awaiting` fence for CI, bots,
 releases, or merge progression.
@@ -66,8 +66,9 @@ Give the child, literally, in the prompt:
 also inspect the workflow runs for the exact PR head, and treat `ACTION_REQUIRED` fork gates as pending,
 not passing.
 
-**PR review activity.** Do not build a watcher — emit `awaiting` with `pr-watch: owner/repo#N` and frizz
-polls it for you, waking on any new review, approval, or comment, bot or human.
+**PR review activity.** Do not build a watcher — register the PR with `mcp__frizz__watch_pr`, then name
+it in your `awaiting` fence's `prs:` list. Frizz polls it for you, waking on any new review, approval,
+or comment, bot or human. The registration creates the wait; the fence only declares it.
 
 **A release or deploy.** Poll the artifact that proves it, not the pipeline that promises it — the
 published version on the registry, the health endpoint, the deployed asset hash.