openshain 0.6.0 → 0.8.0

package/dist/bin.js

@@ -7,6 +7,7 @@ import { init } from "./commands/init.js";
 import { knowledgeBuild, knowledgeCheck } from "./commands/knowledge.js";
 import { knowledgeAdd } from "./commands/knowledge-add.js";
 import { mcp } from "./commands/mcp.js";
+import { principalCheck } from "./commands/principal.js";
 import { toolsList } from "./commands/tools.js";
 import { workList, workShow } from "./commands/work.js";
 import { plain } from "./format.js";
@@ -22,8 +23,11 @@ const USAGE = `使い方:
   openshain knowledge build      knowledge/ の決まりと資料を検証して索引を作る
   openshain knowledge check      同じ検証を、索引を書かずに行う(--stale で古い資料も報告)
   openshain knowledge add        決まりを 1 件、質問に答えて追加する
+  openshain principal check <id> その人の社員エージェントがどこで働き、何ができるかを確かめる
   openshain mcp                  MCP Server を stdio で起動する
 
+  --principal <id>               この端末が誰として働くか。principals/ に書いた id
+                                 環境変数 OPENSHAIN_PRINCIPAL でも指定できる。本人確認はしない
   --workspace <dir>              起点のディレクトリ。省略時はカレントディレクトリ
                                  init はそこに書き、他のコマンドはそこから上に openshain.yaml を探す`;
 /** The providers this CLI knows, by the ids used in openshain.yaml. */
@@ -34,6 +38,14 @@ const providers = {
     },
     tools: { standard: (workspaceRoot) => standardTools(workspaceRoot) },
 };
+/**
+ * Who this terminal works for. The flag wins over the variable; neither is written into the
+ * company folder, because the folder is shared and the choice belongs to the machine.
+ */
+function actingFor(flag) {
+    const named = flag ?? process.env.OPENSHAIN_PRINCIPAL;
+    return named === undefined || named === "" ? undefined : named;
+}
 async function main(argv) {
     const write = (line) => console.log(plain(line));
     let values;
@@ -43,6 +55,7 @@ async function main(argv) {
             args: argv,
             options: {
                 workspace: { type: "string" },
+                principal: { type: "string" },
                 help: { type: "boolean", short: "h" },
                 stale: { type: "boolean" },
             },
@@ -60,7 +73,7 @@ async function main(argv) {
     const [command, ...rest] = positionals;
     if (!command && !values.help && process.stdin.isTTY === true && process.stdout.isTTY === true) {
         const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
-        return startTui({ workspaceRoot, providers });
+        return startTui({ workspaceRoot, providers, as: actingFor(values.principal) });
     }
     if (values.help || !command) {
         write(USAGE);
@@ -72,7 +85,7 @@ async function main(argv) {
             return 0;
         case "mcp": {
             const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
-            await mcp({ workspaceRoot, providers });
+            await mcp({ workspaceRoot, providers, as: actingFor(values.principal) });
             return 0;
         }
         case "tools": {
@@ -96,6 +109,15 @@ async function main(argv) {
             const run = sub === "build" ? knowledgeBuild : knowledgeCheck;
             return await run({ workspaceRoot, write, ...(values.stale === true && { stale: true }) });
         }
+        case "principal": {
+            const id = rest[1] ?? "";
+            if (rest[0] !== "check" || !id) {
+                write(USAGE);
+                return 2;
+            }
+            const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
+            return await principalCheck({ workspaceRoot, id, write });
+        }
         case "work": {
             const sub = rest[0];
             const id = rest[1] ?? "";
@@ -104,11 +126,12 @@ async function main(argv) {
                 return 2;
             }
             const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
+            const as = actingFor(values.principal);
             if (sub === "list") {
-                await workList({ workspaceRoot, write });
+                await workList({ workspaceRoot, as, write });
                 return 0;
             }
-            await workShow({ workspaceRoot, id, write });
+            await workShow({ workspaceRoot, id, as, write });
             return 0;
         }
         default:

package/dist/commands/init.d.ts

@@ -3,7 +3,12 @@ import { type Language } from "@openshain/core";
 export declare function detectLanguage(env: Record<string, string | undefined>): Language;
 export declare const configTemplate: (language: Language, timezone: string) => string;
 export declare const CONFIG_TEMPLATE: string;
-/** Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH. */
+/**
+ * Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH.
+ * With more than one person in the company, each person adds `env` naming themselves to their own
+ * copy: Claude Code starts the server itself, so a flag on the terminal does not reach it. JSON
+ * carries no comments, so init says that in what it prints instead.
+ */
 export declare const MCP_TEMPLATE: string;
 /** What an outside agent reads before working in the folder. Codex reads AGENTS.md; Claude Code reads it through CLAUDE.md. */
 export declare const AGENTS_TEMPLATE = "# \u3053\u306E\u4F1A\u793E\u30D5\u30A9\u30EB\u30C0\u3067\u50CD\u304F\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u3078\n\n\u3053\u306E\u30D5\u30A9\u30EB\u30C0\u306F openshain \u306E Company Workspace \u3067\u3059\u3002\u3053\u306E\u6307\u793A\u306F\u3001Claude Code \u3084 Codex \u306E\u3088\u3046\u306A\u5916\u90E8\u306E\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u304C MCP \u7D4C\u7531\u3067\u3053\u306E\u30D5\u30A9\u30EB\u30C0\u3092\u6271\u3046\u3068\u304D\u306E\u3082\u306E\u3067\u3059\u3002openshain \u306E\u5BFE\u8A71\u578B CLI \u3082\u540C\u3058\u624B\u9806\u3067 Runtime \u3092\u4F7F\u3044\u307E\u3059\u3002\n\n\u4F1A\u793E\u306E\u30D5\u30A1\u30A4\u30EB\u306E\u8AAD\u307F\u66F8\u304D\u3068\u96C6\u8A08\u306F openshain \u306E MCP tool \u3067\u884C\u3044\u307E\u3059\u3002Claude Code \u3084 Codex \u81EA\u8EAB\u306E Read\u3001Write\u3001Bash \u306F\u4F1A\u793E\u306E\u30D5\u30A1\u30A4\u30EB\u306B\u306F\u4F7F\u3044\u307E\u305B\u3093\u3002Runtime \u3092\u901A\u3089\u306A\u304B\u3063\u305F\u64CD\u4F5C\u306F\u8A18\u9332\u306B\u6B8B\u3089\u306A\u3044\u305F\u3081\u3067\u3059\u3002\n\n- \u4F9D\u983C\u3092\u53D7\u3051\u305F\u3089\u3001\u307E\u305A `work_create` \u306B\u4F9D\u983C\u306E\u6587\u3092\u305D\u306E\u307E\u307E\u6E21\u3057\u3066 Work \u3092\u4F5C\u308B\n- \u30D5\u30A1\u30A4\u30EB\u306F `fs_list`\u3001`fs_search`\u3001`fs_read`\u3001`csv_read`\u3001`markdown_read` \u3067\u898B\u308B\u3002\u5408\u8A08\u3084\u4EF6\u6570\u306F `csv_aggregate` \u306B\u4EFB\u305B\u3001\u81EA\u5206\u3067\u5408\u8A08\u3057\u306A\u3044\n- \u66F8\u304F\u3068\u304D\u306F `fs_write` \u304B `csv_write`\n- \u7D42\u308F\u3063\u305F\u3089 `work_complete` \u306B\u3001\u4F55\u3092\u3057\u305F\u304B\u3068\u3001\u66F8\u3044\u305F\u30D5\u30A1\u30A4\u30EB\u3092\u6E21\u3059\u3002\u7D9A\u3051\u3089\u308C\u306A\u3044\u3068\u304D\u306F `work_fail`\n- `openshain.yaml`\u3001`work/`\u3001`principals/`\u3001`authority/` \u306F Runtime \u306E\u3082\u306E\u3002\u5909\u66F4\u3057\u306A\u3044\n- \u547C\u3073\u51FA\u3057\u306E\u7D50\u679C\u304C `pending` \u306A\u3089\u3001\u4F1A\u793E\u306E\u6A29\u9650\u306E\u898F\u5247\u304C\u305D\u306E\u547C\u3073\u51FA\u3057\u3092\u6B62\u3081\u3066\u3044\u308B\u3002\u627F\u8A8D\u306F\u4F1A\u793E\u306E\u4EBA\u304C openshain \u306E\u753B\u9762\u3067\u6C7A\u3081\u308B\u3002\u81EA\u5206\u3067 `approval_decide` \u3084 `review_decide` \u3092\u547C\u3093\u3067\u901A\u3055\u306A\u3044\u3002\u4EBA\u306B\u4F1D\u3048\u3066\u3001\u6C7A\u307E\u308B\u307E\u3067\u5225\u306E\u4F5C\u696D\u3092\u3059\u308B\n";

package/dist/commands/init.js

@@ -42,8 +42,20 @@ limits:
 #   persist_raw: true      # provider の生の応答を記録に残す
 `;
 export const CONFIG_TEMPLATE = configTemplate("ja", "Asia/Tokyo");
-/** Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH. */
-export const MCP_TEMPLATE = `${JSON.stringify({ mcpServers: { openshain: { command: "openshain", args: ["mcp"] } } }, null, 2)}\n`;
+/**
+ * Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH.
+ * With more than one person in the company, each person adds `env` naming themselves to their own
+ * copy: Claude Code starts the server itself, so a flag on the terminal does not reach it. JSON
+ * carries no comments, so init says that in what it prints instead.
+ */
+export const MCP_TEMPLATE = `${JSON.stringify({
+    mcpServers: {
+        openshain: {
+            command: "openshain",
+            args: ["mcp"],
+        },
+    },
+}, null, 2)}\n`;
 /** What an outside agent reads before working in the folder. Codex reads AGENTS.md; Claude Code reads it through CLAUDE.md. */
 export const AGENTS_TEMPLATE = `# この会社フォルダで働くエージェントへ
 
@@ -103,6 +115,7 @@ export async function init({ workspaceRoot, write }) {
         }
     }
     write("company と principal を自分の会社に合わせ、api_key_env に書いた環境変数を設定してから openshain を実行してください。");
+    write('会社に人が複数いるときは principals/<id>.yaml に 1 人ずつ書き、各自の端末で openshain --principal <id> を実行します。Claude Code から使う人は、自分の .mcp.json の openshain に env: { OPENSHAIN_PRINCIPAL: "<id>" } を追加します。');
 }
 /**
  * Adds the openshain server to a .mcp.json that is already there, keeping every other server.

package/dist/commands/mcp.d.ts

@@ -2,9 +2,11 @@ import type { RuntimeProviders } from "@openshain/core";
 export interface McpOptions {
     workspaceRoot: string;
     providers: RuntimeProviders;
+    /** Who this server works for, when the person said so. */
+    as?: string | undefined;
 }
 /**
  * Serves the workspace over MCP on stdin and stdout until the client hangs up. Nothing else may
  * be written to stdout while it runs; the protocol owns it.
  */
-export declare function mcp({ workspaceRoot, providers }: McpOptions): Promise<void>;
+export declare function mcp({ workspaceRoot, providers, as }: McpOptions): Promise<void>;

package/dist/commands/mcp.js

@@ -4,8 +4,8 @@ import { createMcpServer } from "@openshain/mcp";
  * Serves the workspace over MCP on stdin and stdout until the client hangs up. Nothing else may
  * be written to stdout while it runs; the protocol owns it.
  */
-export async function mcp({ workspaceRoot, providers }) {
-    const server = await createMcpServer({ workspaceRoot, tools: providers.tools });
+export async function mcp({ workspaceRoot, providers, as }) {
+    const server = await createMcpServer({ workspaceRoot, tools: providers.tools, as });
     const transport = new StdioServerTransport();
     await new Promise((resolve) => {
         server.onclose = () => resolve();

package/dist/commands/principal.d.ts

@@ -0,0 +1,12 @@
+export interface PrincipalOptions {
+    workspaceRoot: string;
+    id: string;
+    write: (line: string) => void;
+}
+/**
+ * What one person's employee agent works on, and what it may do. Written by hand, a range and a
+ * table of rules are easy to get subtly wrong: a glob that matches nothing, a delegation nobody
+ * wrote, a rule that allows a path the range does not cover. Each of those fails quietly, so this
+ * command says what the files actually add up to before somebody relies on them.
+ */
+export declare function principalCheck(options: PrincipalOptions): Promise<number>;

package/dist/commands/principal.js

@@ -0,0 +1,136 @@
+import { readdir } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { loadAuthority, matchGlob, mayReachInto, mayRead, PRINCIPALS_DIR_NAME, RESERVED_PATHS, reaches, } from "@openshain/core";
+/** How many matching paths are printed before the rest are counted instead. */
+const SHOWN = 20;
+/**
+ * What one person's employee agent works on, and what it may do. Written by hand, a range and a
+ * table of rules are easy to get subtly wrong: a glob that matches nothing, a delegation nobody
+ * wrote, a rule that allows a path the range does not cover. Each of those fails quietly, so this
+ * command says what the files actually add up to before somebody relies on them.
+ */
+export async function principalCheck(options) {
+    const { workspaceRoot, id, write } = options;
+    let authority;
+    try {
+        authority = await loadAuthority(workspaceRoot);
+    }
+    catch (err) {
+        write(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
+    const person = authority.principals.get(id);
+    if (!person) {
+        const written = [...authority.principals.keys()];
+        write(written.length === 0
+            ? `${PRINCIPALS_DIR_NAME}/ に誰も書かれていません。1 人 1 ファイルで ${PRINCIPALS_DIR_NAME}/<id>.yaml に書きます。`
+            : `${id} は ${PRINCIPALS_DIR_NAME}/ にいません。書かれているのは ${written.join("、")} です。`);
+        return 1;
+    }
+    const problems = [];
+    write(`${person.name}(${person.id})`);
+    write(`  状態: ${person.status === "active" ? "在籍" : "退任(代理も承認もできません)"}`);
+    write(`  担当: ${person.roles.length === 0 ? "なし" : person.roles.join("、")}`);
+    const delegations = authority.delegations.filter((d) => d.principal === person.id);
+    if (!authority.present) {
+        write("  委任: authority/ が無いので、すべて許可です");
+    }
+    else if (delegations.length === 0) {
+        write("  委任: ありません。この人の代理では何も実行できません");
+        problems.push(`${person.id} の委任が authority/delegations.yaml にありません`);
+    }
+    else {
+        write(`  委任: ${delegations.map((d) => d.profession).join("、")} として`);
+    }
+    if (person.reads === undefined) {
+        write("  働く範囲: 会社フォルダ全体(reads を書いていません)");
+    }
+    else {
+        write(`  働く範囲: ${person.reads.join("、")}`);
+        const matched = await matching(workspaceRoot, person);
+        if (matched.length === 0) {
+            write("    一致するものがありません");
+            problems.push(`${person.id} の reads に一致するファイルもフォルダもありません`);
+        }
+        else {
+            write(`    一致するもの ${matched.length} 件`);
+            for (const path of matched.slice(0, SHOWN))
+                write(`      ${path}`);
+            if (matched.length > SHOWN)
+                write(`      ほか ${matched.length - SHOWN} 件`);
+        }
+    }
+    const byRole = authority.policy.rules.filter((rule) => named(rule.match.role, person.roles));
+    if (byRole.length > 0) {
+        write("  担当で一致する規則:");
+        for (const rule of byRole)
+            write(`    ${rule.id}(${rule.decision})`);
+    }
+    const outside = person.reads === undefined ? [] : allowedOutside(authority, person);
+    if (outside.length > 0) {
+        write("  範囲の外を allow している規則:");
+        for (const rule of outside)
+            write(`    ${rule}`);
+        problems.push(`${person.id} の範囲の外を allow している規則があります。規則は範囲を広げません`);
+    }
+    if (problems.length === 0) {
+        write("問題はありません。");
+        return 0;
+    }
+    for (const problem of problems)
+        write(problem);
+    return 1;
+}
+/** Everything in the company folder this person's agent works on, as workspace-relative paths. */
+async function matching(workspaceRoot, person) {
+    const found = [];
+    const walk = async (dir) => {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+            const full = join(dir, entry.name);
+            const path = relative(workspaceRoot, full).split(sep).join("/");
+            if (entry.name.startsWith("."))
+                continue;
+            if (dir === workspaceRoot && reserved(entry.name))
+                continue;
+            if (mayRead(person, path))
+                found.push(path);
+            if (entry.isDirectory() && mayReachInto(person, path))
+                await walk(full);
+        }
+    };
+    await walk(workspaceRoot);
+    return found;
+}
+/** Rules that allow a path the range does not cover: written in hope, and never effective. */
+function allowedOutside(authority, person) {
+    const out = [];
+    for (const rule of authority.policy.rules) {
+        const path = rule.match.path;
+        if (rule.decision !== "allow" || path === undefined)
+            continue;
+        if (rule.match.principal !== undefined && !named(rule.match.principal, [person.id]))
+            continue;
+        if (rule.match.role !== undefined && !named(rule.match.role, person.roles))
+            continue;
+        const covered = (person.reads ?? []).some((range) => matchGlob(range, path) || reaches(range, path) || matchGlob(path, range));
+        if (!covered)
+            out.push(`${rule.id}(${path})`);
+    }
+    return out;
+}
+function named(expected, actual) {
+    if (expected === undefined)
+        return false;
+    const wanted = Array.isArray(expected) ? expected : [expected];
+    return wanted.some((one) => actual.includes(one));
+}
+function reserved(name) {
+    return RESERVED_PATHS.some((path) => path.toLowerCase() === name.toLowerCase());
+}

package/dist/commands/work.d.ts

@@ -1,15 +1,25 @@
 import { type AnyEvent, type Work } from "@openshain/core";
 export interface WorkListOptions {
     workspaceRoot: string;
+    /** Who this terminal works for, when the person said so. */
+    as?: string | undefined;
     write: (line: string) => void;
 }
 /** One line per work, oldest first. Works that cannot be read are reported, not hidden. */
-export declare function workList({ workspaceRoot, write }: WorkListOptions): Promise<void>;
+export declare function workList({ workspaceRoot, as, write }: WorkListOptions): Promise<void>;
 export interface WorkShowOptions {
     workspaceRoot: string;
     id: string;
+    /** Who this terminal works for, when the person said so. */
+    as?: string | undefined;
     write: (line: string) => void;
 }
 /** Everything about one work: state, outcome, what the tools did, the usage, and who acts next. */
-export declare function workShow({ workspaceRoot, id, write }: WorkShowOptions): Promise<void>;
+export declare function workShow({ workspaceRoot, id, as, write }: WorkShowOptions): Promise<void>;
 export declare function describeWork(work: Work, events: AnyEvent[]): string[];
+/**
+ * How a reviewer is named on the screen. The role of a reviewer is a qualification the company
+ * names (tax-accountant), not one of the roles a person handles, so the word comes first and the
+ * name the company wrote stays with it.
+ */
+export declare function qualifiedAs(role: string | undefined): string;

package/dist/commands/work.js

@@ -1,11 +1,25 @@
-import { parseWorkId, pendingApprovals, pendingQuestions, WorkStore, } from "@openshain/core";
+import { join } from "node:path";
+import { loadConfig, mayReadWork, noSuchWork, PRINCIPALS_DIR_NAME, parseWorkId, pendingApprovals, pendingQuestions, readPrincipals, WorkStore, } from "@openshain/core";
 import { describeInput, padDisplay } from "../format.js";
 import { errorLabel, failureLabel, rejectionLabel, statusLabel } from "../labels.js";
 import { nextActor } from "../report.js";
 import { formatUsage, summarizeUsage } from "../usage.js";
+/**
+ * The person this terminal works for, out of the people the company has written. Nobody written:
+ * nobody to be, and every work is read, as before there was more than one person.
+ */
+async function actingPerson(workspaceRoot, as) {
+    const config = await loadConfig(workspaceRoot, { ...(as !== undefined && { as }) });
+    const people = await readPrincipals(join(workspaceRoot, PRINCIPALS_DIR_NAME));
+    return people.get(config.principal.id);
+}
 /** One line per work, oldest first. Works that cannot be read are reported, not hidden. */
-export async function workList({ workspaceRoot, write }) {
-    const { works, problems } = await new WorkStore(workspaceRoot).list();
+export async function workList({ workspaceRoot, as, write }) {
+    const me = await actingPerson(workspaceRoot, as);
+    const { works: all, problems: unreadable } = await new WorkStore(workspaceRoot).list();
+    const works = all.filter((w) => mayReadWork(me, w.principal));
+    // A work that cannot be read does not say whose it is, so a range leaves it out.
+    const problems = me?.reads === undefined ? unreadable : [];
     if (works.length === 0 && problems.length === 0) {
         write("Work はまだありません。openshain で社員エージェントに依頼すると始まります。");
         return;
@@ -18,10 +32,13 @@ export async function workList({ workspaceRoot, write }) {
     }
 }
 /** Everything about one work: state, outcome, what the tools did, the usage, and who acts next. */
-export async function workShow({ workspaceRoot, id, write }) {
+export async function workShow({ workspaceRoot, id, as, write }) {
     const store = new WorkStore(workspaceRoot);
     const workId = parseWorkId(id);
     const work = await store.get(workId);
+    if (!mayReadWork(await actingPerson(workspaceRoot, as), work.principal)) {
+        throw noSuchWork(workspaceRoot, workId);
+    }
     const events = await store.events(workId);
     for (const line of describeWork(work, events))
         write(line);
@@ -53,7 +70,7 @@ export function describeWork(work, events) {
     }
     if (work.status === "waiting_approval") {
         for (const a of pendingApprovals(events)) {
-            const who = a.kind === "review" ? `${a.reviewer?.role ?? "資格者"}の判断待ち` : "承認待ち";
+            const who = a.kind === "review" ? `${qualifiedAs(a.reviewer?.role)}の判断待ち` : "承認待ち";
             lines.push(`${who}  ${a.call.name} ${describeInput(a.call.input)}  (${a.approvalId})`);
         }
     }
@@ -67,6 +84,14 @@ export function describeWork(work, events) {
     lines.push(nextActor(work));
     return lines;
 }
+/**
+ * How a reviewer is named on the screen. The role of a reviewer is a qualification the company
+ * names (tax-accountant), not one of the roles a person handles, so the word comes first and the
+ * name the company wrote stays with it.
+ */
+export function qualifiedAs(role) {
+    return role === undefined ? "資格者" : `資格者(${role})`;
+}
 /** One line per tool call, in log order, with its outcome when it was rejected or failed. */
 function toolLines(events) {
     const lines = new Map();

package/dist/labels.js

@@ -27,6 +27,9 @@ export const REJECTION_LABELS = {
     denied: "権限の表で不許可",
     rejected_by_person: "承認されなかった",
     path_changed: "承認したときと書き込み先が変わった",
+    base_changed: "承認したときからファイルが変わった",
+    not_read: "読まずに置き換えようとした",
+    out_of_range: "範囲の外",
 };
 /** A heading for a runtime error, before the original message. */
 export const ERROR_LABELS = {

package/dist/tui/controller.d.ts

@@ -69,6 +69,8 @@ export interface Controller {
 export interface ControllerOptions {
     workspaceRoot: string;
     providers: RuntimeProviders;
+    /** Who this terminal works for, when the person said so. */
+    as?: string | undefined;
 }
 /**
  * What the screen says when the conversation was summarized. The person cannot read the summary

package/dist/tui/controller.js

@@ -2,7 +2,7 @@ import { connectInMemory, createSession, } from "@openshain/agent";
 import { loadConfig, OpenshainError, WorkStore, } from "@openshain/core";
 import { createMcpServer } from "@openshain/mcp";
 import { toolsList } from "../commands/tools.js";
-import { workList, workShow } from "../commands/work.js";
+import { qualifiedAs, workList, workShow } from "../commands/work.js";
 import { describeInput, plain } from "../format.js";
 import { statusLabel } from "../labels.js";
 import { previewCall } from "../preview.js";
@@ -86,7 +86,10 @@ const APPROVAL_WITHDRAWN = "the person left the approval undecided";
  */
 export async function createController(options) {
     const { workspaceRoot, providers } = options;
-    const config = await loadConfig(workspaceRoot, { modelProviders: Object.keys(providers.models) });
+    const config = await loadConfig(workspaceRoot, {
+        modelProviders: Object.keys(providers.models),
+        as: options.as,
+    });
     if (!config.model) {
         throw new OpenshainError("config", "対話にはモデルが要ります。openshain.yaml に model を書いてください。Claude Code や Codex から使うだけなら要りません。");
     }
@@ -100,7 +103,13 @@ export async function createController(options) {
     if (!model.describe().capabilities.tools) {
         throw new OpenshainError("config", `model ${config.model.provider}/${config.model.model} cannot call tools; openshain needs a model with tool support`);
     }
-    const server = await createMcpServer({ workspaceRoot, tools: providers.tools });
+    // The name the person gave on the command line reaches the runtime too: it is what the work is
+    // recorded under, and what the range is read from.
+    const server = await createMcpServer({
+        workspaceRoot,
+        tools: providers.tools,
+        ...(options.as !== undefined && { as: options.as }),
+    });
     const client = await connectInMemory(server);
     const store = new WorkStore(workspaceRoot);
     const listeners = new Set();
@@ -289,6 +298,10 @@ export async function createController(options) {
         push("logo", row);
     push("banner", `openshain ${VERSION}`);
     push("banner", workspaceRoot);
+    // Said where it is used, not only in the documentation: the name is a choice, not a check.
+    if (options.as) {
+        push("banner", `${config.principal.name}(${config.principal.id})として実行します。本人確認はしていません`);
+    }
     const stopped = (workId) => workId
         ? `止めました。${workId} は途中のまま残っています。/work resume ${workId} で続けられるようにします。`
         : "止めました。";
@@ -299,7 +312,10 @@ export async function createController(options) {
             case "aborted":
                 return stopped(result.work);
             case "max_tokens":
-                return "返答が長さの上限で切れました。";
+                // The answer ran into the limit mid-sentence, so a work it opened holds nothing yet.
+                return result.work
+                    ? `返答が長さの上限で切れました。${result.work} は途中のまま残っています。/work resume ${result.work} で続けられるようにします。一度に扱う量を分けて依頼すると、上限に当たらずに終わります。`
+                    : "返答が長さの上限で切れました。";
             case "refusal":
                 return "社員エージェントが続けられないと言っています。";
             case "model_error":
@@ -368,11 +384,11 @@ export async function createController(options) {
             push(outcome.done ? "progress" : "notice", compactionLine(outcome));
         }
         else if (name === "work" && sub === "list")
-            await capture((write) => workList({ workspaceRoot: options.workspaceRoot, write }));
+            await capture((write) => workList({ workspaceRoot: options.workspaceRoot, as: options.as, write }));
         else if (name === "work" && (sub === "show" || sub === "resume") && !args[1])
             push("notice", `/work ${sub} には Work の id が要ります。/work list で確かめてください。`);
         else if (name === "work" && sub === "show" && id)
-            await capture((write) => workShow({ workspaceRoot: options.workspaceRoot, id, write }));
+            await capture((write) => workShow({ workspaceRoot: options.workspaceRoot, id, as: options.as, write }));
         else if (name === "work" && sub === "resume" && id) {
             try {
                 const work = await session.select(id);
@@ -419,7 +435,7 @@ export async function createController(options) {
                     throw new Error(`${sub} は人の承認待ちです。/approve か /reject で決めます。`);
                 }
                 const role = held.reviewer?.role ?? "reviewer";
-                const who = await askLine(`${role} の名前と資格(例: 田中 太郎 / 税理士)。会社の申告として記録します`);
+                const who = await askLine(`${qualifiedAs(held.reviewer?.role)}の名前と資格(例: 田中 太郎 / 税理士)。会社の申告として記録します`);
                 const [reviewerName, qualification] = who.split("/").map((part) => part.trim());
                 const interpretation = await askLine(decision === "approve" ? "判断の本文(そのまま記録します)" : "認めない理由");
                 const { text } = await session.review({

package/dist/tui/index.d.ts

@@ -2,6 +2,8 @@ import type { RuntimeProviders } from "@openshain/core";
 export interface TuiOptions {
     workspaceRoot: string;
     providers: RuntimeProviders;
+    /** Who this terminal works for, when the person said so. */
+    as?: string | undefined;
 }
 /** Opens the conversation screen and returns when the person leaves it. */
 export declare function startTui(options: TuiOptions): Promise<number>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openshain",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Reference CLI of the openshain agent harness",
   "keywords": [
     "openshain",
@@ -49,10 +49,10 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@openshain/agent": "0.6.0",
-    "@openshain/core": "0.6.0",
-    "@openshain/mcp": "0.6.0",
-    "@openshain/tools": "0.6.0",
+    "@openshain/agent": "0.8.0",
+    "@openshain/core": "0.8.0",
+    "@openshain/mcp": "0.8.0",
+    "@openshain/tools": "0.8.0",
     "ink": "7.1.1",
     "marked": "18.0.12",
     "react": "19.2.8"

package/src/bin.ts

@@ -7,6 +7,7 @@ import { init } from "./commands/init.ts";
 import { knowledgeBuild, knowledgeCheck } from "./commands/knowledge.ts";
 import { knowledgeAdd } from "./commands/knowledge-add.ts";
 import { mcp } from "./commands/mcp.ts";
+import { principalCheck } from "./commands/principal.ts";
 import { toolsList } from "./commands/tools.ts";
 import { workList, workShow } from "./commands/work.ts";
 import { plain } from "./format.ts";
@@ -23,8 +24,11 @@ const USAGE = `使い方:
   openshain knowledge build      knowledge/ の決まりと資料を検証して索引を作る
   openshain knowledge check      同じ検証を、索引を書かずに行う(--stale で古い資料も報告)
   openshain knowledge add        決まりを 1 件、質問に答えて追加する
+  openshain principal check <id> その人の社員エージェントがどこで働き、何ができるかを確かめる
   openshain mcp                  MCP Server を stdio で起動する
 
+  --principal <id>               この端末が誰として働くか。principals/ に書いた id
+                                 環境変数 OPENSHAIN_PRINCIPAL でも指定できる。本人確認はしない
   --workspace <dir>              起点のディレクトリ。省略時はカレントディレクトリ
                                  init はそこに書き、他のコマンドはそこから上に openshain.yaml を探す`;
 
@@ -37,15 +41,25 @@ const providers: RuntimeProviders = {
   tools: { standard: (workspaceRoot) => standardTools(workspaceRoot) },
 };
 
+/**
+ * Who this terminal works for. The flag wins over the variable; neither is written into the
+ * company folder, because the folder is shared and the choice belongs to the machine.
+ */
+function actingFor(flag: string | undefined): string | undefined {
+  const named = flag ?? process.env.OPENSHAIN_PRINCIPAL;
+  return named === undefined || named === "" ? undefined : named;
+}
+
 async function main(argv: string[]): Promise<number> {
   const write = (line: string) => console.log(plain(line));
-  let values: { workspace?: string; help?: boolean; stale?: boolean };
+  let values: { workspace?: string; principal?: string; help?: boolean; stale?: boolean };
   let positionals: string[];
   try {
     ({ values, positionals } = parseArgs({
       args: argv,
       options: {
         workspace: { type: "string" },
+        principal: { type: "string" },
         help: { type: "boolean", short: "h" },
         stale: { type: "boolean" },
       },
@@ -62,7 +76,7 @@ async function main(argv: string[]): Promise<number> {
   const [command, ...rest] = positionals;
   if (!command && !values.help && process.stdin.isTTY === true && process.stdout.isTTY === true) {
     const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
-    return startTui({ workspaceRoot, providers });
+    return startTui({ workspaceRoot, providers, as: actingFor(values.principal) });
   }
   if (values.help || !command) {
     write(USAGE);
@@ -74,7 +88,7 @@ async function main(argv: string[]): Promise<number> {
       return 0;
     case "mcp": {
       const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
-      await mcp({ workspaceRoot, providers });
+      await mcp({ workspaceRoot, providers, as: actingFor(values.principal) });
       return 0;
     }
     case "tools": {
@@ -97,6 +111,15 @@ async function main(argv: string[]): Promise<number> {
       const run = sub === "build" ? knowledgeBuild : knowledgeCheck;
       return await run({ workspaceRoot, write, ...(values.stale === true && { stale: true }) });
     }
+    case "principal": {
+      const id = rest[1] ?? "";
+      if (rest[0] !== "check" || !id) {
+        write(USAGE);
+        return 2;
+      }
+      const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
+      return await principalCheck({ workspaceRoot, id, write });
+    }
     case "work": {
       const sub = rest[0];
       const id = rest[1] ?? "";
@@ -105,11 +128,12 @@ async function main(argv: string[]): Promise<number> {
         return 2;
       }
       const workspaceRoot = await findWorkspace(values.workspace ?? process.cwd());
+      const as = actingFor(values.principal);
       if (sub === "list") {
-        await workList({ workspaceRoot, write });
+        await workList({ workspaceRoot, as, write });
         return 0;
       }
-      await workShow({ workspaceRoot, id, write });
+      await workShow({ workspaceRoot, id, as, write });
       return 0;
     }
     default:

package/src/commands/init.ts

@@ -45,9 +45,21 @@ limits:
 
 export const CONFIG_TEMPLATE = configTemplate("ja", "Asia/Tokyo");
 
-/** Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH. */
+/**
+ * Registers the runtime as a project MCP server for Claude Code. `openshain` must be on PATH.
+ * With more than one person in the company, each person adds `env` naming themselves to their own
+ * copy: Claude Code starts the server itself, so a flag on the terminal does not reach it. JSON
+ * carries no comments, so init says that in what it prints instead.
+ */
 export const MCP_TEMPLATE = `${JSON.stringify(
-  { mcpServers: { openshain: { command: "openshain", args: ["mcp"] } } },
+  {
+    mcpServers: {
+      openshain: {
+        command: "openshain",
+        args: ["mcp"],
+      },
+    },
+  },
   null,
   2,
 )}\n`;
@@ -118,6 +130,9 @@ export async function init({ workspaceRoot, write }: InitOptions): Promise<void>
   write(
     "company と principal を自分の会社に合わせ、api_key_env に書いた環境変数を設定してから openshain を実行してください。",
   );
+  write(
+    '会社に人が複数いるときは principals/<id>.yaml に 1 人ずつ書き、各自の端末で openshain --principal <id> を実行します。Claude Code から使う人は、自分の .mcp.json の openshain に env: { OPENSHAIN_PRINCIPAL: "<id>" } を追加します。',
+  );
 }
 
 /**

package/src/commands/mcp.ts

@@ -5,14 +5,16 @@ import { createMcpServer } from "@openshain/mcp";
 export interface McpOptions {
   workspaceRoot: string;
   providers: RuntimeProviders;
+  /** Who this server works for, when the person said so. */
+  as?: string | undefined;
 }
 
 /**
  * Serves the workspace over MCP on stdin and stdout until the client hangs up. Nothing else may
  * be written to stdout while it runs; the protocol owns it.
  */
-export async function mcp({ workspaceRoot, providers }: McpOptions): Promise<void> {
-  const server = await createMcpServer({ workspaceRoot, tools: providers.tools });
+export async function mcp({ workspaceRoot, providers, as }: McpOptions): Promise<void> {
+  const server = await createMcpServer({ workspaceRoot, tools: providers.tools, as });
   const transport = new StdioServerTransport();
   await new Promise<void>((resolve) => {
     server.onclose = () => resolve();

package/src/commands/principal.ts

@@ -0,0 +1,151 @@
+import type { Dirent } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import {
+  type Authority,
+  loadAuthority,
+  matchGlob,
+  mayReachInto,
+  mayRead,
+  PRINCIPALS_DIR_NAME,
+  type Principal,
+  RESERVED_PATHS,
+  reaches,
+} from "@openshain/core";
+
+export interface PrincipalOptions {
+  workspaceRoot: string;
+  id: string;
+  write: (line: string) => void;
+}
+
+/** How many matching paths are printed before the rest are counted instead. */
+const SHOWN = 20;
+
+/**
+ * What one person's employee agent works on, and what it may do. Written by hand, a range and a
+ * table of rules are easy to get subtly wrong: a glob that matches nothing, a delegation nobody
+ * wrote, a rule that allows a path the range does not cover. Each of those fails quietly, so this
+ * command says what the files actually add up to before somebody relies on them.
+ */
+export async function principalCheck(options: PrincipalOptions): Promise<number> {
+  const { workspaceRoot, id, write } = options;
+  let authority: Authority;
+  try {
+    authority = await loadAuthority(workspaceRoot);
+  } catch (err) {
+    write(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+  const person = authority.principals.get(id);
+  if (!person) {
+    const written = [...authority.principals.keys()];
+    write(
+      written.length === 0
+        ? `${PRINCIPALS_DIR_NAME}/ に誰も書かれていません。1 人 1 ファイルで ${PRINCIPALS_DIR_NAME}/<id>.yaml に書きます。`
+        : `${id} は ${PRINCIPALS_DIR_NAME}/ にいません。書かれているのは ${written.join("、")} です。`,
+    );
+    return 1;
+  }
+
+  const problems: string[] = [];
+  write(`${person.name}(${person.id})`);
+  write(`  状態: ${person.status === "active" ? "在籍" : "退任(代理も承認もできません)"}`);
+  write(`  担当: ${person.roles.length === 0 ? "なし" : person.roles.join("、")}`);
+
+  const delegations = authority.delegations.filter((d) => d.principal === person.id);
+  if (!authority.present) {
+    write("  委任: authority/ が無いので、すべて許可です");
+  } else if (delegations.length === 0) {
+    write("  委任: ありません。この人の代理では何も実行できません");
+    problems.push(`${person.id} の委任が authority/delegations.yaml にありません`);
+  } else {
+    write(`  委任: ${delegations.map((d) => d.profession).join("、")} として`);
+  }
+
+  if (person.reads === undefined) {
+    write("  働く範囲: 会社フォルダ全体(reads を書いていません)");
+  } else {
+    write(`  働く範囲: ${person.reads.join("、")}`);
+    const matched = await matching(workspaceRoot, person);
+    if (matched.length === 0) {
+      write("    一致するものがありません");
+      problems.push(`${person.id} の reads に一致するファイルもフォルダもありません`);
+    } else {
+      write(`    一致するもの ${matched.length} 件`);
+      for (const path of matched.slice(0, SHOWN)) write(`      ${path}`);
+      if (matched.length > SHOWN) write(`      ほか ${matched.length - SHOWN} 件`);
+    }
+  }
+
+  const byRole = authority.policy.rules.filter((rule) => named(rule.match.role, person.roles));
+  if (byRole.length > 0) {
+    write("  担当で一致する規則:");
+    for (const rule of byRole) write(`    ${rule.id}(${rule.decision})`);
+  }
+
+  const outside = person.reads === undefined ? [] : allowedOutside(authority, person);
+  if (outside.length > 0) {
+    write("  範囲の外を allow している規則:");
+    for (const rule of outside) write(`    ${rule}`);
+    problems.push(`${person.id} の範囲の外を allow している規則があります。規則は範囲を広げません`);
+  }
+
+  if (problems.length === 0) {
+    write("問題はありません。");
+    return 0;
+  }
+  for (const problem of problems) write(problem);
+  return 1;
+}
+
+/** Everything in the company folder this person's agent works on, as workspace-relative paths. */
+async function matching(workspaceRoot: string, person: Principal): Promise<string[]> {
+  const found: string[] = [];
+  const walk = async (dir: string): Promise<void> => {
+    let entries: Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+      const full = join(dir, entry.name);
+      const path = relative(workspaceRoot, full).split(sep).join("/");
+      if (entry.name.startsWith(".")) continue;
+      if (dir === workspaceRoot && reserved(entry.name)) continue;
+      if (mayRead(person, path)) found.push(path);
+      if (entry.isDirectory() && mayReachInto(person, path)) await walk(full);
+    }
+  };
+  await walk(workspaceRoot);
+  return found;
+}
+
+/** Rules that allow a path the range does not cover: written in hope, and never effective. */
+function allowedOutside(authority: Authority, person: Principal): string[] {
+  const out: string[] = [];
+  for (const rule of authority.policy.rules) {
+    const path = rule.match.path;
+    if (rule.decision !== "allow" || path === undefined) continue;
+    if (rule.match.principal !== undefined && !named(rule.match.principal, [person.id])) continue;
+    if (rule.match.role !== undefined && !named(rule.match.role, person.roles)) continue;
+    const covered = (person.reads ?? []).some(
+      (range) => matchGlob(range, path) || reaches(range, path) || matchGlob(path, range),
+    );
+    if (!covered) out.push(`${rule.id}(${path})`);
+  }
+  return out;
+}
+
+function named(expected: string | string[] | undefined, actual: readonly string[]): boolean {
+  if (expected === undefined) return false;
+  const wanted = Array.isArray(expected) ? expected : [expected];
+  return wanted.some((one) => actual.includes(one));
+}
+
+function reserved(name: string): boolean {
+  return (RESERVED_PATHS as readonly string[]).some(
+    (path) => path.toLowerCase() === name.toLowerCase(),
+  );
+}

package/src/commands/work.ts

@@ -1,9 +1,16 @@
+import { join } from "node:path";
 import {
   type AnyEvent,
   type Event,
+  loadConfig,
+  mayReadWork,
+  noSuchWork,
+  PRINCIPALS_DIR_NAME,
+  type Principal,
   parseWorkId,
   pendingApprovals,
   pendingQuestions,
+  readPrincipals,
   type Work,
   WorkStore,
 } from "@openshain/core";
@@ -14,12 +21,28 @@ import { formatUsage, summarizeUsage } from "../usage.ts";
 
 export interface WorkListOptions {
   workspaceRoot: string;
+  /** Who this terminal works for, when the person said so. */
+  as?: string | undefined;
   write: (line: string) => void;
 }
 
+/**
+ * The person this terminal works for, out of the people the company has written. Nobody written:
+ * nobody to be, and every work is read, as before there was more than one person.
+ */
+async function actingPerson(workspaceRoot: string, as?: string): Promise<Principal | undefined> {
+  const config = await loadConfig(workspaceRoot, { ...(as !== undefined && { as }) });
+  const people = await readPrincipals(join(workspaceRoot, PRINCIPALS_DIR_NAME));
+  return people.get(config.principal.id);
+}
+
 /** One line per work, oldest first. Works that cannot be read are reported, not hidden. */
-export async function workList({ workspaceRoot, write }: WorkListOptions): Promise<void> {
-  const { works, problems } = await new WorkStore(workspaceRoot).list();
+export async function workList({ workspaceRoot, as, write }: WorkListOptions): Promise<void> {
+  const me = await actingPerson(workspaceRoot, as);
+  const { works: all, problems: unreadable } = await new WorkStore(workspaceRoot).list();
+  const works = all.filter((w) => mayReadWork(me, w.principal));
+  // A work that cannot be read does not say whose it is, so a range leaves it out.
+  const problems = me?.reads === undefined ? unreadable : [];
   if (works.length === 0 && problems.length === 0) {
     write("Work はまだありません。openshain で社員エージェントに依頼すると始まります。");
     return;
@@ -37,14 +60,19 @@ export async function workList({ workspaceRoot, write }: WorkListOptions): Promi
 export interface WorkShowOptions {
   workspaceRoot: string;
   id: string;
+  /** Who this terminal works for, when the person said so. */
+  as?: string | undefined;
   write: (line: string) => void;
 }
 
 /** Everything about one work: state, outcome, what the tools did, the usage, and who acts next. */
-export async function workShow({ workspaceRoot, id, write }: WorkShowOptions): Promise<void> {
+export async function workShow({ workspaceRoot, id, as, write }: WorkShowOptions): Promise<void> {
   const store = new WorkStore(workspaceRoot);
   const workId = parseWorkId(id);
   const work = await store.get(workId);
+  if (!mayReadWork(await actingPerson(workspaceRoot, as), work.principal)) {
+    throw noSuchWork(workspaceRoot, workId);
+  }
   const events = await store.events(workId);
   for (const line of describeWork(work, events)) write(line);
 }
@@ -74,7 +102,7 @@ export function describeWork(work: Work, events: AnyEvent[]): string[] {
   }
   if (work.status === "waiting_approval") {
     for (const a of pendingApprovals(events)) {
-      const who = a.kind === "review" ? `${a.reviewer?.role ?? "資格者"}の判断待ち` : "承認待ち";
+      const who = a.kind === "review" ? `${qualifiedAs(a.reviewer?.role)}の判断待ち` : "承認待ち";
       lines.push(`${who}  ${a.call.name} ${describeInput(a.call.input)}  (${a.approvalId})`);
     }
   }
@@ -89,6 +117,15 @@ export function describeWork(work: Work, events: AnyEvent[]): string[] {
   return lines;
 }
 
+/**
+ * How a reviewer is named on the screen. The role of a reviewer is a qualification the company
+ * names (tax-accountant), not one of the roles a person handles, so the word comes first and the
+ * name the company wrote stays with it.
+ */
+export function qualifiedAs(role: string | undefined): string {
+  return role === undefined ? "資格者" : `資格者(${role})`;
+}
+
 /** One line per tool call, in log order, with its outcome when it was rejected or failed. */
 function toolLines(events: AnyEvent[]): string[] {
   const lines = new Map<string, string>();

package/src/labels.ts

@@ -31,6 +31,9 @@ export const REJECTION_LABELS: Record<ToolRejectionCode, string> = {
   denied: "権限の表で不許可",
   rejected_by_person: "承認されなかった",
   path_changed: "承認したときと書き込み先が変わった",
+  base_changed: "承認したときからファイルが変わった",
+  not_read: "読まずに置き換えようとした",
+  out_of_range: "範囲の外",
 };
 
 /** A heading for a runtime error, before the original message. */

package/src/tui/controller.ts

@@ -18,7 +18,7 @@ import {
 } from "@openshain/core";
 import { createMcpServer } from "@openshain/mcp";
 import { toolsList } from "../commands/tools.ts";
-import { workList, workShow } from "../commands/work.ts";
+import { qualifiedAs, workList, workShow } from "../commands/work.ts";
 import { describeInput, plain } from "../format.ts";
 import { statusLabel } from "../labels.ts";
 import { type PreviewLine, previewCall } from "../preview.ts";
@@ -94,6 +94,8 @@ export interface Controller {
 export interface ControllerOptions {
   workspaceRoot: string;
   providers: RuntimeProviders;
+  /** Who this terminal works for, when the person said so. */
+  as?: string | undefined;
 }
 
 /**
@@ -176,7 +178,10 @@ const APPROVAL_WITHDRAWN = "the person left the approval undecided";
  */
 export async function createController(options: ControllerOptions): Promise<Controller> {
   const { workspaceRoot, providers } = options;
-  const config = await loadConfig(workspaceRoot, { modelProviders: Object.keys(providers.models) });
+  const config = await loadConfig(workspaceRoot, {
+    modelProviders: Object.keys(providers.models),
+    as: options.as,
+  });
   if (!config.model) {
     throw new OpenshainError(
       "config",
@@ -196,7 +201,13 @@ export async function createController(options: ControllerOptions): Promise<Cont
       `model ${config.model.provider}/${config.model.model} cannot call tools; openshain needs a model with tool support`,
     );
   }
-  const server = await createMcpServer({ workspaceRoot, tools: providers.tools });
+  // The name the person gave on the command line reaches the runtime too: it is what the work is
+  // recorded under, and what the range is read from.
+  const server = await createMcpServer({
+    workspaceRoot,
+    tools: providers.tools,
+    ...(options.as !== undefined && { as: options.as }),
+  });
   const client = await connectInMemory(server);
   const store = new WorkStore(workspaceRoot);
   const listeners = new Set<() => void>();
@@ -386,6 +397,13 @@ export async function createController(options: ControllerOptions): Promise<Cont
   for (const row of LOGO_ROWS) push("logo", row);
   push("banner", `openshain ${VERSION}`);
   push("banner", workspaceRoot);
+  // Said where it is used, not only in the documentation: the name is a choice, not a check.
+  if (options.as) {
+    push(
+      "banner",
+      `${config.principal.name}(${config.principal.id})として実行します。本人確認はしていません`,
+    );
+  }
 
   const stopped = (workId: WorkId | undefined) =>
     workId
@@ -399,7 +417,10 @@ export async function createController(options: ControllerOptions): Promise<Cont
       case "aborted":
         return stopped(result.work);
       case "max_tokens":
-        return "返答が長さの上限で切れました。";
+        // The answer ran into the limit mid-sentence, so a work it opened holds nothing yet.
+        return result.work
+          ? `返答が長さの上限で切れました。${result.work} は途中のまま残っています。/work resume ${result.work} で続けられるようにします。一度に扱う量を分けて依頼すると、上限に当たらずに終わります。`
+          : "返答が長さの上限で切れました。";
       case "refusal":
         return "社員エージェントが続けられないと言っています。";
       case "model_error":
@@ -465,11 +486,15 @@ export async function createController(options: ControllerOptions): Promise<Cont
       const outcome = await session.compact();
       push(outcome.done ? "progress" : "notice", compactionLine(outcome));
     } else if (name === "work" && sub === "list")
-      await capture((write) => workList({ workspaceRoot: options.workspaceRoot, write }));
+      await capture((write) =>
+        workList({ workspaceRoot: options.workspaceRoot, as: options.as, write }),
+      );
     else if (name === "work" && (sub === "show" || sub === "resume") && !args[1])
       push("notice", `/work ${sub} には Work の id が要ります。/work list で確かめてください。`);
     else if (name === "work" && sub === "show" && id)
-      await capture((write) => workShow({ workspaceRoot: options.workspaceRoot, id, write }));
+      await capture((write) =>
+        workShow({ workspaceRoot: options.workspaceRoot, id, as: options.as, write }),
+      );
     else if (name === "work" && sub === "resume" && id) {
       try {
         const work = await session.select(id as WorkId);
@@ -512,7 +537,7 @@ export async function createController(options: ControllerOptions): Promise<Cont
         }
         const role = held.reviewer?.role ?? "reviewer";
         const who = await askLine(
-          `${role} の名前と資格(例: 田中 太郎 / 税理士)。会社の申告として記録します`,
+          `${qualifiedAs(held.reviewer?.role)}の名前と資格(例: 田中 太郎 / 税理士)。会社の申告として記録します`,
         );
         const [reviewerName, qualification] = who.split("/").map((part) => part.trim());
         const interpretation = await askLine(

package/src/tui/index.ts

@@ -7,6 +7,8 @@ import { createController } from "./controller.ts";
 export interface TuiOptions {
   workspaceRoot: string;
   providers: RuntimeProviders;
+  /** Who this terminal works for, when the person said so. */
+  as?: string | undefined;
 }
 
 /** The alternate screen, cleared, with the terminal reporting the mouse (SGR) so the wheel reaches the screen. */