greprag 5.83.2 → 5.84.0

package/dist/index.js

@@ -75,7 +75,6 @@ const agents_1 = require("./commands/agents");
 const loadout_1 = require("./commands/loadout");
 const persona_1 = require("./commands/persona");
 const email_1 = require("./commands/email");
-const sms_1 = require("./commands/sms");
 const codex_1 = require("./commands/codex");
 const opencode_relay_1 = require("./commands/opencode-relay");
 const opencode_watch_1 = require("./commands/opencode-watch");
@@ -395,7 +394,7 @@ async function inbox(args) {
         // --local: the ground-truth view. Skip the cloud entirely and report the
         // sessions whose watcher process is alive on THIS machine right now (pidfile
         // ∩ OS liveness). This is what the desk-line returns when the cloud asks the
-        // machine "what's truly active?" — and the answer the Front Desk should show.
+        // machine "what's truly active?".
         // The cloud `/attached` registry below can list dead sessions for minutes;
         // this never can. adr: adr/monitor-resilience.md
         if (subArgs.includes('--local')) {
@@ -635,11 +634,6 @@ async function inbox(args) {
         // Indent each body line so multi-line markdown stays visually grouped
         for (const line of msg.body.split('\n'))
             console.log(`  ${line}`);
-        // Front Desk relay: the operator reached this session through the
-        // receptionist — answer on the rail they came in on, NOT the bare handle.
-        if (msg.references?.reply_to) {
-            console.log(`  ↩ reply on the operator's rail: greprag send --to ${msg.references.reply_to} "your reply"`);
-        }
         // References block — only printed when present, formatted as a compact section.
         const refs = msg.references;
         if (refs && (refs.memory_ids?.length || refs.artifacts?.length || refs.files?.length)) {
@@ -725,16 +719,6 @@ function parseSendAddress(addr) {
         }
         return { ok: true, targetKind: 'discord', target: snowflake };
     }
-    // sms: prefix — the Front Desk return leg (a connected session replies to the
-    // operator's phone). Own addressing grammar like discord:; server-side
-    // /v1/inbox/send resolves the phone against sms_pairings. adr: docs/front-desk-switchboard.md §4
-    if (addr.startsWith('sms:')) {
-        const phone = addr.slice('sms:'.length);
-        if (!/^\+?[0-9]{8,15}$/.test(phone)) {
-            return { ok: false, error: `sms address "${addr}" must be sms:<E.164 phone, e.g. sms:+16045551234>.` };
-        }
-        return { ok: true, targetKind: 'sms', target: phone };
-    }
     const segments = addr.split('/');
     if (segments.length > 2) {
         return { ok: false, error: `address "${addr}" has too many segments. The v0.12 grammar is\n` +
@@ -843,12 +827,6 @@ function buildReferences(args) {
     if (inReplyTo) {
         references = { ...(references ?? {}), in_reply_to: inReplyTo };
     }
-    // --approval: flag this front-desk ping as an approval request so the Front
-    // Desk offers a one-tap APPROVE (relay "yes") + CONNECT. Applies on top of any
-    // references shape (incl. --ref-json). adr: adr/address-grammar.md
-    if (args.includes('--approval')) {
-        references = { ...(references ?? {}), approval: true };
-    }
     return references;
 }
 /** greprag send "<text>" --to-desk --type <internal-type>
@@ -949,7 +927,7 @@ async function send(args) {
     // Project broadcasts were removed (2026-06-07). A project-name target has no
     // scope to send to — reject it. Session/chip traffic belongs on a session id;
     // first contact goes to the bare-handle front desk.
-    // adr: adr/address-grammar.md, docs/front-desk-switchboard.md §1
+    // adr: adr/address-grammar.md
     if (parsed.ok && parsed.targetKind === 'project') {
         console.error(`address "${to}" targets a whole project — project broadcasts were removed.\n` +
             `  Send to one session:   --to <handle>@greprag.com/<session-uuid>\n` +
@@ -978,11 +956,11 @@ async function send(args) {
         process.exit(1);
     }
     // A positional body carrying a LITERAL \n (backslash-n) is sent verbatim and
-    // renders as raw "\n" on SMS, not a line break (fix e8aa3f83). Warn at the
+    // renders as raw "\n", not a line break (fix e8aa3f83). Warn at the
     // moment so the author switches to --body-file/--stdin (real newlines) instead
     // of silently shipping a mangled message.
     if (/\\n/.test(body) && !args.includes('--stdin') && getFlag(args, '--body-file') === undefined) {
-        console.error('Warning: body contains a literal "\\n" — sent as-is (raw on SMS). For real newlines use --body-file or --stdin.');
+        console.error('Warning: body contains a literal "\\n" — sent as-is, not as a line break. For real newlines use --body-file or --stdin.');
     }
     const references = buildReferences(args);
     const payload = { to, body };
@@ -1002,12 +980,6 @@ async function send(args) {
         console.log(`Sent to discord:${delivered.snowflake}`);
         return;
     }
-    // SMS destinations (Front Desk return leg) also short-circuit the inbox table
-    // — delivered to the operator's phone via Twilio, no row/id/retract.
-    if (delivered?.kind === 'sms' && delivered.phone) {
-        console.log(`Sent to sms:${delivered.phone}`);
-        return;
-    }
     // Render the delivered-to in the v0.11 single-segment grammar.
     // adr: adr/numeric-handles.md, adr/address-grammar.md
     const base = delivered.handle || `${delivered.tenant}@greprag.com`;
@@ -1050,7 +1022,7 @@ async function send(args) {
     if (retractCode)
         console.log(`Retract: greprag retract ${retractCode}`);
 }
-/** greprag discord <pair|unpair|me> — Discord DM bridge to inbox. */
+/** greprag discord <pair|unpair|me|typing> — pair Discord so sessions can DM you. */
 async function discord(args) {
     const sub = args[0];
     if (!sub || sub === 'help' || sub === '--help') {
@@ -1102,112 +1074,6 @@ async function discord(args) {
         console.log(`Project:          ${result.project_name}`);
         console.log(`Paired at:        ${result.paired_at}`);
         console.log(`Last inbound DM:  ${result.last_seen_inbound_at ?? '(never)'}`);
-        if (result.handoff) {
-            console.log(`Handoff (active):`);
-            console.log(`  Project:  ${result.handoff.project_name}`);
-            console.log(`  Session:  ${result.handoff.session_id}`);
-            console.log(`  Expires:  ${result.handoff.expires_at}`);
-        }
-        else {
-            console.log(`Handoff:          (none — DMs route to default project)`);
-        }
-        return;
-    }
-    if (sub === 'handoff') {
-        // Resolve project: --project <name> overrides anchor's project_id.
-        const projectFlag = getFlag(args, '--project');
-        let projectId;
-        let projectNameForWatch;
-        if (projectFlag) {
-            projectNameForWatch = projectFlag;
-            const res = await fetch(`${cfg.apiUrl}/v1/inbox/projects`, {
-                headers: { 'Authorization': `Bearer ${cfg.apiKey}` },
-            });
-            const json = (await res.json());
-            const hit = json.projects?.find(p => p.project_name.toLowerCase() === projectFlag.toLowerCase());
-            if (!hit) {
-                console.error(`Error: project "${projectFlag}" not found under this tenant`);
-                process.exit(1);
-            }
-            projectId = hit.project_id;
-        }
-        else {
-            const anchor = (0, project_anchor_1.readAnchor)(process.cwd());
-            if (!anchor.projectId) {
-                console.error('No project anchor in current directory. Run: greprag init, or pass --project <name>.');
-                process.exit(1);
-            }
-            projectId = anchor.projectId;
-            projectNameForWatch = anchor.projectName;
-        }
-        // Resolve session id: --session <id> overrides CLAUDE_SESSION_ID env.
-        const sessionFlag = getFlag(args, '--session');
-        const rawSession = sessionFlag || (0, session_id_1.readSessionEnv)() || '';
-        const sessionId = (0, session_id_1.truncateSessionId)(rawSession);
-        if (!sessionId) {
-            console.error('No session id available. Pass --session <8-hex>, or run inside a Claude Code session\n' +
-                '(Claude Code sets CLAUDE_CODE_SESSION_ID).');
-            process.exit(1);
-        }
-        // Optional TTL.
-        const ttlFlag = getFlag(args, '--ttl');
-        const ttlMinutes = ttlFlag ? parseInt(ttlFlag, 10) : undefined;
-        if (ttlFlag && (!Number.isFinite(ttlMinutes) || ttlMinutes <= 0)) {
-            console.error(`Error: --ttl must be a positive integer (got "${ttlFlag}")`);
-            process.exit(1);
-        }
-        const result = await (0, discord_1.callDiscordHandoff)({ apiUrl: cfg.apiUrl, apiKey: cfg.apiKey }, { projectId: projectId, sessionId, ttlMinutes });
-        if (!result.ok) {
-            console.error(`Error: ${result.error}`);
-            process.exit(1);
-        }
-        // --no-watch skips the inline watcher (for scripted "just pin" usage).
-        if (args.includes('--no-watch')) {
-            console.log(`Pinned ${result.project_name} / ${result.session_id} for ${result.ttl_minutes} min.`);
-            console.log(`Expires: ${result.expires_at}`);
-            console.log(`Bot DM'd you a confirmation. Reply on Discord to route to this session.`);
-            console.log(`(skipped inbox watcher — pass without --no-watch to stream DMs to stdout.)`);
-            return;
-        }
-        // --orchestrator: tenant-wide watcher (sees inbox traffic to/from any
-        // project under this tenant). The pin still routes the user's DMs to
-        // (this project, this session) — only the watcher's scope changes.
-        // Used by an orchestrator session that wants portfolio-wide visibility
-        // while keeping its own DM conversation anchored to itself.
-        const orchestrator = args.includes('--orchestrator');
-        // Inline watcher — the whole point of handoff. Pin the route AND listen
-        // for inbox events on the same SSE stream. When invoked under Monitor,
-        // each printed line becomes one notification, so the agent sees every
-        // event the moment it lands. Process blocks until killed.
-        console.error(`[handoff] Pinned ${result.project_name} / ${result.session_id} for ${result.ttl_minutes} min.`);
-        console.error(`[handoff] Bot DM'd you a confirmation. Reply on Discord — replies stream here.`);
-        if (orchestrator) {
-            console.error(`[handoff] Orchestrator mode — watcher is tenant-wide. You will see inbox events from any project under this tenant.`);
-        }
-        else {
-            console.error(`[handoff] Listening for DMs to session ${result.session_id} on project ${result.project_name}...`);
-        }
-        await (0, inbox_watch_1.runInboxWatch)({
-            // Orchestrator mode: tenant-wide watcher (no project/session filter).
-            // Otherwise: filter to this project + session.
-            project: orchestrator ? undefined : projectNameForWatch,
-            session: orchestrator ? undefined : sessionId,
-            json: args.includes('--json'),
-            // Direct mode (no supervisor): handoff PINS the route before watching,
-            // so a supervised respawn would re-invoke `handoff` and re-pin on every
-            // child restart. Supervision is scoped to `inbox watch` only; keep
-            // handoff's prior in-process behavior. adr: adr/monitor-resilience.md
-            noSupervise: true,
-        });
-        return;
-    }
-    if (sub === 'unhandoff') {
-        const result = await (0, discord_1.callDiscordUnhandoff)({ apiUrl: cfg.apiUrl, apiKey: cfg.apiKey });
-        if (!result.ok) {
-            console.error(`Error: ${result.error}`);
-            process.exit(1);
-        }
-        console.log('Handoff cleared. DMs revert to default project routing.');
         return;
     }
     if (sub === 'typing') {
@@ -1328,8 +1194,8 @@ Commands:
   agents <adopt|optimize|sync|status>
                                   Canonical global/repo CLAUDE.md + AGENTS.md doctrine.
   doctor [--inspect] [--yes]       Diagnose + repair orphan project_ids and identity drift
-  desk [--json]                    Inspect the Agent Front Desk and live routing state.
-  sms <command>                    Configure or inspect SMS front-desk routing.
+  desk <run|ensure|status>         The desk line: this machine answers which sessions
+                                   are live when the cloud asks.
   smell "<text>"                   Shortcut for \`greprag fix log "<text>"\`.
   context status [--session <id>]  Context-size governor readout: live tokens, threshold,
                                    % consumed, turns since the crossover advisory last fired.
@@ -1414,10 +1280,8 @@ Inbox (email-style messaging across tenants):
   retract <code>                Pull back a previously-sent message (code is printed on send).
   discord pair                  Pair Discord DMs to this project — generates a code to DM the bot.
   discord unpair                Remove the Discord pairing.
-  discord me                    Show current Discord pairing + handoff state.
-  discord handoff [--ttl N]     Pin DMs to this session for N min (default 60); bot DMs a confirmation.
-  discord unhandoff             Clear the handoff pin (DMs revert to default project).
-  discord typing                Refresh the "typing…" indicator on the paired DM thread.
+  discord me                    Show current Discord pairing state.
+  discord typing               Refresh the "typing…" indicator on the paired DM thread.
   send "body" --to discord:<snowflake>
                                 Outbound DM to a paired Discord user from any session.
                                 Unread → hard delete. Read → body replaced with a retracted notice.
@@ -1576,6 +1440,11 @@ Skills (opt-in advisor skills bundled with the CLI):
   skill uninstall <name>        Remove a previously-installed advisor
   skill source stamp <name> --project <p> --path <rel> [--path <rel>...] [--baseline <ref>]
                                 Stamp a skill-staleness baseline against local Git
+  skill history <name>          Every revision of a mirrored skill: date, author, reason, changes
+  skill diff <name> <revA> [<revB>]
+                                Unified diff between two revisions (revB defaults to current)
+  skill revert <name> --to <rev> --reason "<why>" --expected-hash <current-hash>
+                                Make an old revision current again, as a new revision
 
 Load (on-demand doctrine — the CLI is the payload, no .md files):
   load                          Browse the catalog (chip-spawn, codex chips, mechanic, …)
@@ -1663,7 +1532,6 @@ const HELP_GROUPS = [
     ['fix', fix_1.runFix],
     ['mechanic', mechanic_1.runMechanic],
     ['discord', discord],
-    ['sms', sms_1.runSms],
     ['codex', codex_1.runCodex],
     ['identity', identity_1.runIdentity],
     ['project', project_1.runProject],
@@ -1974,7 +1842,6 @@ async function main() {
         case 'send': return send(subArgs);
         case 'retract': return retract(subArgs);
         case 'discord': return discord(subArgs);
-        case 'sms': return (0, sms_1.runSms)(subArgs);
         case 'codex': return (0, codex_1.runCodex)(subArgs);
         case 'expand': return expand(subArgs);
         case 'search': return (0, search_1.runSearch)(subArgs); // one lexical search across everything (adr/searchable-store-kinds.md)

package/dist/native-skill-mirror.js

@@ -341,15 +341,15 @@ function nativeCreationLocations(platform) {
 }
 function renderChangeSkillLine(params) {
     const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
-    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash> --reason "<why>"`;
     if (params.platform === 'codex') {
         return `- **Change this skill:** run \`greprag load skill-change\`, then \`${exportCommand}\`; patch the exported Markdown files non-interactively; run \`${applyCommand}\`; then \`${params.syncCommand}\`; then verify with \`${params.loadCommand}\`.`;
     }
-    return `- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${params.skillName} ${params.editArgs}\`, then \`${params.syncCommand}\`, then verify with \`${params.loadCommand}\`.`;
+    return `- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${params.skillName} ${params.editArgs} --reason "<why>"\`, then \`${params.syncCommand}\`, then verify with \`${params.loadCommand}\`.`;
 }
 function renderEditingSection(platform, params) {
     const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
-    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+    const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash> --reason "<why>"`;
     if (platform === 'codex') {
         return `## Editing
 
@@ -369,7 +369,7 @@ Do not launch an interactive editor from Codex. If using \`greprag skill edit\`
 To edit this skill, run the guarded editor flow:
 
 \`\`\`bash
-greprag skill edit ${params.skillName} ${params.editArgs}
+greprag skill edit ${params.skillName} ${params.editArgs} --reason "<why>"
 \`\`\`
 
 Manual path:
@@ -426,11 +426,14 @@ ${typeof skill.revision === 'number' ? `Mirror revision: ${skill.revision}` : 'M
 
 ${editingSection}
 
-Snapshot rollback:
+History and rollback (every canon write keeps its bytes and reason):
 
 \`\`\`bash
+greprag skill history ${skillName} ${identityArg}
+greprag skill diff ${skillName} <revA> [<revB>] ${identityArg}
+greprag skill revert ${skillName} --to <rev> ${identityArg} --reason "<why>" --expected-hash <current-hash>
 greprag skill mirror snapshot list ${skillName} ${identityArg}
-greprag skill mirror snapshot promote ${skillName} --name <snapshot> ${editArgs} --expected-hash <current-hash>
+greprag skill mirror snapshot promote ${skillName} --name <snapshot> ${editArgs} --expected-hash <current-hash> --reason "<why>"
 \`\`\`
 
 ## Mandatory Invocation

package/dist/opencode-plugin.bundle.js

@@ -2466,7 +2466,6 @@ function buildSkillMirrorAnnounce(m, platform) {
 }
 var skillMirrorAnnounceModule = {
   id: "skill-mirror-announce",
-  source: "prompt",
   dependsOn: ["load-primer"],
   // references `greprag load` — the primer establishes it
   detect: (_env) => ({ tier: "silent" }),
@@ -2549,7 +2548,7 @@ function buildDeliveryAnnounce(env) {
     `[DELIVERY \u2014 ${project}]`,
     "Commit useful, passing work. Only committed state delivers; ignore uncommitted and untracked work in every checkout.",
     coordinationLine(env.platform),
-    "Land every ready same-repo commit: update the default branch, rebase your worktree onto its tip, retest there, take greprag merge-lock in the canonical checkout, recheck the tip, merge --ff-only, release --landed. Tip moved? Free the lock and prepare again. Never rebase a shared default branch.",
+    "Land every ready same-repo commit: update the default branch, rebase your worktree onto its tip, retest there, take greprag merge-lock in the canonical checkout, recheck the tip, merge --ff-only, release --landed. Tip moved? Free the lock and prepare again. A chip's branch arrives rebased by the chip: only fast-forward it; refused, free the lock and send it back. Never rebase in another session's worktree or a shared default branch.",
     "Deploy through this repo's delivery profile, from its canonical primary checkout unless the profile says otherwise. Worktrees build; they do not deploy. Then verify production serves the commit you shipped.",
     "THE GOAL ALREADY AUTHORIZES ALL OF THIS. Do not stop to ask permission to commit, merge, or deploy. Separate approval is for effects outside code delivery: destructive data, secrets, money, customer-facing messages.",
     "Why each rule, and the details: `greprag load delivery`."
@@ -4443,15 +4442,15 @@ function nativeCreationLocations(platform) {
 }
 function renderChangeSkillLine(params) {
   const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
-  const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+  const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash> --reason "<why>"`;
   if (params.platform === "codex") {
     return `- **Change this skill:** run \`greprag load skill-change\`, then \`${exportCommand}\`; patch the exported Markdown files non-interactively; run \`${applyCommand}\`; then \`${params.syncCommand}\`; then verify with \`${params.loadCommand}\`.`;
   }
-  return `- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${params.skillName} ${params.editArgs}\`, then \`${params.syncCommand}\`, then verify with \`${params.loadCommand}\`.`;
+  return `- **Change this skill:** run \`greprag load skill-change\`, then \`greprag skill edit ${params.skillName} ${params.editArgs} --reason "<why>"\`, then \`${params.syncCommand}\`, then verify with \`${params.loadCommand}\`.`;
 }
 function renderEditingSection(platform, params) {
   const exportCommand = `greprag skill mirror export ${params.skillName} ${params.identityArg} --to <dir>`;
-  const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash>`;
+  const applyCommand = `greprag skill mirror apply <dir> --skill ${params.skillName} ${params.editArgs} --expected-hash <exported-hash> --reason "<why>"`;
   if (platform === "codex") {
     return `## Editing
 
@@ -4471,7 +4470,7 @@ Do not launch an interactive editor from Codex. If using \`greprag skill edit\`
 To edit this skill, run the guarded editor flow:
 
 \`\`\`bash
-greprag skill edit ${params.skillName} ${params.editArgs}
+greprag skill edit ${params.skillName} ${params.editArgs} --reason "<why>"
 \`\`\`
 
 Manual path:
@@ -4524,11 +4523,14 @@ ${typeof skill.revision === "number" ? `Mirror revision: ${skill.revision}` : "M
 
 ${editingSection}
 
-Snapshot rollback:
+History and rollback (every canon write keeps its bytes and reason):
 
 \`\`\`bash
+greprag skill history ${skillName} ${identityArg}
+greprag skill diff ${skillName} <revA> [<revB>] ${identityArg}
+greprag skill revert ${skillName} --to <rev> ${identityArg} --reason "<why>" --expected-hash <current-hash>
 greprag skill mirror snapshot list ${skillName} ${identityArg}
-greprag skill mirror snapshot promote ${skillName} --name <snapshot> ${editArgs} --expected-hash <current-hash>
+greprag skill mirror snapshot promote ${skillName} --name <snapshot> ${editArgs} --expected-hash <current-hash> --reason "<why>"
 \`\`\`
 
 ## Mandatory Invocation

package/dist/reminder-injector.js

@@ -195,7 +195,7 @@ async function injectReminders(input, cfg, short, platform = 'claude-code') {
         // Harness scoping comes from each module's own `harnesses:` tag (the whitelist-drift
         // killer), NOT from an ad hoc id filter here. The old hardcoded codex/watcher-arm
         // exclusion made the per-turn surface disagree with the announce surface.
-        const base = (0, app_settings_1.filterEnabledInterrupts)((0, reminder_registry_1.harnessModules)(platform, (0, reminder_registry_1.promptModules)()));
+        const base = (0, app_settings_1.filterEnabledInterrupts)((0, reminder_registry_1.harnessModules)(platform));
         const reg = mechanicKilled() ? base.filter(m => m.id !== 'mechanic-friction') : base;
         const fired = (0, reminder_registry_1.collectReminders)(env, reg);
         if (!fired.length)

package/dist/skill-mirror-client.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.skillRevisionAuthor = skillRevisionAuthor;
 exports.collectSkillFiles = collectSkillFiles;
 exports.computeMirrorHash = computeMirrorHash;
 exports.dryRunNativeSkillAdoption = dryRunNativeSkillAdoption;
@@ -57,6 +58,30 @@ const skill_landing_1 = require("./skill-landing");
 const native_skill_adoption_1 = require("./native-skill-adoption");
 const native_skill_mirror_1 = require("./native-skill-mirror");
 const skill_mirror_files_1 = require("./skill-mirror-files");
+const proc_1 = require("./proc");
+/** Who is writing skill canon, for the revision row every write records:
+ *  the writer (`via`), the harness session, and the chip branch when the
+ *  write runs inside one. adr: adr/skill-revision-history.md */
+function skillRevisionAuthor(via, opts = {}) {
+    const env = process.env;
+    const harness = opts.harness
+        || (env.CLAUDE_CODE_SESSION_ID || env.CLAUDECODE ? 'claude-code'
+            : env.CODEX_THREAD_ID || env.CODEX_CI || env.CODEX_SHELL ? 'codex'
+                : env.OPENCODE_SESSION_ID ? 'opencode' : 'cli');
+    const sessionId = opts.sessionId || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID
+        || env.OPENCODE_SESSION_ID || env.GREPRAG_SESSION_ID || '';
+    let chip = '';
+    try {
+        const branch = (0, proc_1.safeSpawnSync)('git', ['branch', '--show-current'], {
+            cwd: opts.cwd || process.cwd(), encoding: 'utf8', timeout: 3000,
+        });
+        const name = String(branch.stdout || '').trim();
+        if (branch.status === 0 && name.startsWith('chip/'))
+            chip = name;
+    }
+    catch { /* not a git checkout */ }
+    return { via, harness, ...(sessionId ? { sessionId } : {}), ...(chip ? { chip } : {}) };
+}
 /** Mirrors the server's caps (SKILL_MIRROR_* in @greprag/core — the CLI is
  *  core-free, so the numbers are restated; the server re-validates anyway). */
 const MAX_FILES = 20;
@@ -184,6 +209,8 @@ async function syncNativeSkillAdoptions(params) {
             scope: candidate.scope,
             projectId: candidate.projectId,
             projectName: candidate.projectName,
+            reason: `adoption of native ${params.platform} skill from ${path.join(candidate.root, candidate.skillName)}`,
+            author: skillRevisionAuthor('adoption', { cwd: params.projectDir }),
         };
         const response = await fetch(`${params.apiUrl}/v1/skillmirror/${encodeURIComponent(candidate.skillName)}`, {
             method: 'POST',
@@ -335,6 +362,8 @@ async function maybeMirrorSkill(params) {
                 contentHash: hash,
                 scope: 'global',
                 expectedHash: localLease,
+                reason: params.reason || `shadow upload of local edit from ${dir}`,
+                author: skillRevisionAuthor('shadow-upload', { cwd: params.cwd, sessionId: params.sessionId }),
             }),
         });
         if (!res.ok)

package/dist/skill-staleness.js

@@ -374,8 +374,8 @@ function formatSkillNoSourceBinding(skillName) {
         `/${skillName} has no source bindings.`,
         'Authority: canonical mirrored payload exists in GrepRAG; local Codex/Claude/OpenCode SKILL.md files are generated adapter-only mirrors.',
         'Do not edit a local native adapter as skill content.',
-        `Agent-safe edit path: \`greprag skill mirror export ${skillName} --to <dir>\`, patch the exported Markdown files non-interactively, then \`greprag skill mirror apply <dir> --skill ${skillName} --expected-hash <exported-hash>\`.`,
-        `Human editor shortcut: \`greprag skill edit ${skillName}\`; Codex auto-skips the editor, and agents may pass \`--no-open\` explicitly.`,
+        `Agent-safe edit path: \`greprag skill mirror export ${skillName} --to <dir>\`, patch the exported Markdown files non-interactively, then \`greprag skill mirror apply <dir> --skill ${skillName} --expected-hash <exported-hash> --reason "<why>"\`.`,
+        `Human editor shortcut: \`greprag skill edit ${skillName} --reason "<why>"\`; Codex auto-skips the editor, and agents may pass \`--no-open\` explicitly.`,
         `After binding a real source repo, stamp it with \`greprag skill source stamp ${skillName} --project <p> --path <rel>\`.`,
     ].join('\n') + '\n';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "greprag",
-  "version": "5.83.2",
+  "version": "5.84.0",
   "description": "Private GrepRAG client for existing Claude Code, Codex, OpenCode, and Grok Build tenants.",
   "main": "dist/index.js",
   "bin": {

package/skill/commander/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: commander
 description: |
-  DEPRECATED 2026-06-07 — superseded by the Front Desk Switchboard
-  (docs/front-desk-switchboard.md). Discord DMs now route through the
-  per-tenant receptionist brain (menu / connect / ring), the same as SMS;
-  the handoff-pin + emergency-router model this skill wrapped has been
-  retired. Pairing still works; "handoff" is a no-op. Kept for reference.
+  DEPRECATED 2026-06-07, retired 2026-10-06 — the handoff-pin +
+  emergency-router model this skill wrapped is gone, and so is the Front
+  Desk that replaced it. Nothing reads DMs sent to the bot any more.
+  Pairing still works, so sessions can DM the operator. Kept for reference.
 
   Field-commander interface over greprag's Discord DM bridge. Pair your
   Discord account once, then DM the bot to put any open Claude session
@@ -28,13 +27,12 @@ metadata:
 license: MIT
 ---
 
-> **⚠ DEPRECATED (2026-06-07).** Superseded by the **Front Desk Switchboard**
-> (`docs/front-desk-switchboard.md`). Discord DMs now go through the same
-> per-tenant receptionist brain as SMS — text `MENU` to the bot for the
-> deterministic menu (live sessions, connect, settings), or just talk to the
-> receptionist. The **handoff pin + emergency router this skill describes are
-> retired** (`/handoff` is a no-op). Pairing is unchanged. This file is kept for
-> historical reference only; do not build on it.
+> **⚠ RETIRED (2026-10-06).** The **handoff pin + emergency router this skill
+> describes are gone**, and so is the Front Desk that replaced them on
+> 2026-06-07 (`adr/front-desk-retirement.md`). Nothing reads DMs sent to the
+> bot; it answers each with a fixed line. Pairing is unchanged, so sessions can
+> still DM the operator with `greprag send --to discord:<snowflake>`. This file
+> is kept for historical reference only; do not build on it.
 
 # Commander — Discord DM bridge
 

package/skill/greprag/SKILL.md

@@ -237,7 +237,7 @@ Child watch events may appear on the parent TUI — resume the child to act. Do
 - `docs/inbox-watch.md` — SSE watcher patterns, liveness model, parent-side / post-send patterns
 - `docs/doctor.md` — `greprag doctor` (identity drift, orphan consolidation)
 - `docs/corpus.md` — upload + search arbitrary text (books, codebases, voice samples)
-- `docs/discord-handoff.md` — Commander DM bridge (`greprag discord pair/handoff`)
+- `docs/discord-handoff.md` — Discord DM bridge (`greprag discord pair`, `send --to discord:`; the handoff is retired)
 - `docs/memory-advanced.md` — raw curl, `/v1/memory/by-period` `--type` values, naming note
 - `docs/fix.md` — log + query project-specific fixes (the Mechanic's queue)
 - `docs/discover.md` — cross-project advisor lookup (`greprag discover`)

package/skill/greprag/docs/discord-handoff.md

@@ -1,8 +1,6 @@
-# Discord Handoff (Commander)
+# Discord DM bridge
 
-Discord DM bridge — user steps away from desk, conversation continues on phone. Orchestrator-side summary; operator-facing flow lives at `~/.claude/skills/commander/SKILL.md`.
-
-Two surfaces: one-time pairing (identity) + per-session handoff (active routing). Emergency-router fallback: if the user DMs the bot with no handoff active, the bot auto-links to the most-recently-attached session watcher under their tenant. Tag `references.discord.emergency_route` on the inbox row flags the auto-link; reply with self-identification on first response.
+The operator pairs their Discord account once. After that, any session can DM them. The bot does not read DMs sent to it: the Front Desk that used to answer them was retired 2026-10-06, so the bot replies to each with a fixed line. The handoff pin, `/switch` and the CLI's handoff commands were retired the same day.
 
 ## Pairing (one-time per tenant)
 
@@ -10,38 +8,16 @@ Two surfaces: one-time pairing (identity) + per-session handoff (active routing)
 greprag discord pair
 ```
 
-Generates a 6-char code. User DMs `@greprag` on Discord with `/pair <code>`. After that, the user's snowflake is bound to their greprag tenant. DMs from that snowflake land as inbox messages on `default_project_id` (the project they paired from).
+Generates a 6-char code. User DMs `@greprag` on Discord with `/pair <code>`. After that, the user's snowflake is bound to their greprag tenant.
 
 You don't run this — one-time setup the user does themselves. Detect "I'm paired" via `greprag discord me`: returns `paired: true` and the pairing's project_name.
 
-## Handoff (per-session routing pin)
-
-The pattern the user almost always means by "let's continue on Discord":
-
-```bash
-greprag discord handoff --ttl 60 --json
-```
-
-Run under `Monitor` (persistent: true). The command pins DMs from the user's snowflake to (this project, this session) for 60 min, fires a confirmation DM, then **blocks** streaming the session's inbox to stdout as JSON. Each line that prints is one Discord DM — Monitor delivers them as notifications back into your turn. Pin slides forward 30+ min on every inbound; an active thread stays anchored.
-
-Replies go out via:
+## Messaging the operator
 
 ```bash
 greprag send --to discord:<snowflake> "your message body"
 ```
 
-CLI handles UTF-8, Discord's 2000-char limit, optional `--ref-json '{"discord":{"reply_to_message_id":"..."}}'` for threading. **Do not use curl for this** — bash on Windows mangles em-dashes / curly quotes / emoji into Win-1252 bytes that render as `?` on Discord. Node fetch (which the CLI uses) is UTF-8 native.
-
-For long agent turns where auto-typing's 10-second window expires, call `greprag discord typing` between work steps to refresh the indicator. Silent on success.
-
-`greprag discord unhandoff` releases the pin early (DMs revert to default project). Pin also expires naturally via TTL.
-
-## Canonical handoff flow
-
-User says "let's keep going on Discord" / "DM me" / "I'm stepping out":
+It arrives as a DM from the bot. CLI handles UTF-8 and Discord's 2000-char limit. **Do not use curl for this** — bash on Windows mangles em-dashes / curly quotes / emoji into Win-1252 bytes that render as `?` on Discord. Node fetch (which the CLI uses) is UTF-8 native.
 
-1. Confirm pairing with `greprag discord me`. If unpaired, tell the user to run `greprag discord pair` and DM `/pair <code>` first.
-2. Resolve current session_id (`CLAUDE_SESSION_ID` env, or the 8-hex from SessionStart context).
-3. Arm: `Monitor` with command `greprag discord handoff --session <8-hex> --project <name> --ttl 60 --json`, persistent.
-4. Tell the user the pin is live; the bot already DMed them. Each reply from Discord fires as a Monitor notification.
-5. On each notification, parse the JSON body (`body` field = user's message text). Draft your reply. Send via `greprag send --to discord:<snowflake> "..."`. Snowflake is in `references.discord.snowflake`.
+During long agent turns, call `greprag discord typing` between work steps to show the typing indicator (it lasts about 10 seconds). Silent on success.

package/skill/mechanic/docs/skill-fix-conventions.md

@@ -53,6 +53,6 @@ Each: **signature** (how it shows up in the run) · **location** (where it lives
 
 - **One friction, one edit.** If a run surfaced two defects, make two separate edits, each shown for its own accept/revert. Never batch.
 - **Apply + show diff.** Make the edit, then show the unified diff and stop for one accept/revert. (This is the operator-chosen gate; the Mechanic "always confirm" rule still holds.)
-- **Edit the canonical source.** Managed skills: `greprag skill edit <name> --skill-id <id>`; greprag-bundled skills: `packages/cli/skill/<name>/`. Never edit a generated `~/.claude/skills/<name>/SKILL.md` adapter or install artifact.
+- **Edit the canonical source.** Managed skills: `greprag skill edit <name> --skill-id <id> --reason "<the friction this fixes>"`; greprag-bundled skills: `packages/cli/skill/<name>/`. Never edit a generated `~/.claude/skills/<name>/SKILL.md` adapter or install artifact.
 - **Line budget:** a fix must not grow SKILL.md without adding a real proactive-fire rule or per-task step. Converting wallpaper → Convention B is net-neutral or smaller; mis-route adds at most one line.
 - **Out of taxonomy → spawn, don't improvise.** Anything not matching the six becomes one `greprag fix spawn --type doctrine "<unit>"` chip. `greprag fix log` is only for deliberate audit/design notes.

package/skill/templates/chip-spawn.md

@@ -78,7 +78,7 @@ Your parent session is named `<parent-name>`. When you finish, report to it with
 greprag session retitle <your-own-8hex> "Chip <Label> — <workstream>"
 ```
 
-The leader dictates the exact string (e.g. `Chip A — Converter format coverage`); substitute your own 8-hex from SessionStart. This force-sets the registry title so the watcher list + Discord `/switch` line up with the leader's labels. Single chips skip this.
+The leader dictates the exact string (e.g. `Chip A — Converter format coverage`); substitute your own 8-hex from SessionStart. This force-sets the registry title so the watcher list lines up with the leader's labels. Single chips skip this.
 
 ## Report back — native `SendMessage`
 
@@ -87,7 +87,9 @@ Close the task body with this (substitute `<slug>` + `<parent-name>`):
 ````
 ---
 
-**Report back:** when the work is committed, send your result to the parent with native `SendMessage`, then end your turn:
+**Rebase before you report:** when the work is committed, rebase this branch onto the current tip of your merge target (the default branch, or the integration branch on a multi-chip mission), resolve any conflicts here, and rerun the affected checks. Only you can edit this worktree, so the parent lands your branch by fast-forward alone and sends it back if the tip has moved again.
+
+**Report back:** then send your result to the parent with native `SendMessage`, then end your turn:
 
 - `to`: `"<parent-name>"`
 - `message`: status, commit hash, branch `chip/<slug>`, and a one-line summary.
@@ -116,6 +118,8 @@ Chips never `npm run deploy` (or Wrangler / another provider deploy) from the wo
 
 ## Parent merge discipline — prune at the merge (HARD RULE)
 
+Land a chip branch with `git merge --ff-only chip/<slug>` under the merge lock, nothing more: the chip rebased and retested it before reporting. Never rebase inside the chip's worktree; you cannot edit there, so a conflict strands a half-finished rebase. A refused fast-forward goes back to the chip over `SendMessage` (free the lock first).
+
 When you (the parent) merge a chip branch — through the canonical commit path or a profile-declared merge — prune in the same breath: find the worktree holding `chip/<slug>` in `git worktree list` (the app's own worktree when the chip reused it, `.claude/worktrees/<slug>` on a local start), junction guard it (`~/.claude/skills/commit/guard-junctions.sh <worktree>`), `git worktree remove <worktree>`, and `git branch -d chip/<slug>` once merged. A chip that closed itself has already removed its own worktree, so no worktree holds the branch — delete the branch and move on, don't go hunting for it. Deferred cleanup = stale worktrees piling up (field state 2026-06-10: 3 leftovers). Multi-chip missions: worktree dies at the integration-branch merge; the branch lives until the configured default-branch merge (chip-leader Phase 4).
 
 **FIX chips report to the mission owner.** A `greprag fix spawn` mission is the source of truth for FIX behavior. `fix spawn` detects usable Git history and emits `workspaceMode`: Git uses an isolated worktree; non-Git, unavailable Git, or no commit uses the project-local task with serialized writes. Dispatch honors that mode without trying a worktree first. The FIX chip identifies the exact friction, makes the smallest durable root-cause fix, verifies and commits useful work, then reports the commit/result and cleanup parameters to the parent mission owner. It creates no human landing gate. If no live parent exists and the chip carries the full-goal mission, it follows the repo profile as mission owner.