terminalhire 0.42.27 → 0.42.28

package/dist/bin/approved-claims-sync.js

@@ -106,7 +106,7 @@ function buildApprovalsNudge(awaitingApproval) {
   if (!Number.isInteger(awaitingApproval) || awaitingApproval <= 0) return null;
   const n = awaitingApproval;
   return `  \u26A0 ${n} claim${n === 1 ? "" : "s"} awaiting poster approval \u2014 terminalhire cannot check in the background until you enrol:
-    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim slice <id>)`;
+    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim start <id>)`;
 }
 async function syncApprovedClaims({
   readAutoMarker,

package/dist/bin/jpi-claim.js

@@ -30492,7 +30492,10 @@ var init_boundary = __esm({
       },
       {
         code: "lockfile",
-        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base),
+        // The `.lock` suffix is the server's rule since TERM-412; this copy missed it, so
+        // the pre-flight passed `uv.lock` and bun's text `bun.lock` that the server refuses
+        // (TERM-1235). The name set only covers lockfiles whose names do not end in `.lock`.
+        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base) || base.endsWith(".lock"),
         why: "is a dependency lockfile. Nobody reads a lockfile diff, so a change to one is refused rather than shown"
       }
     ];
@@ -37853,9 +37856,13 @@ function fmtContestedWarning(b) {
   }
   return `  \u26A0 This issue looks taken: ${parts.join(" / ")}. A merged PR here is unlikely.`;
 }
-async function mintRegistrationProof({ claimRef } = {}) {
-  console.log("\n  This posting registers your claim with terminalhire, so your");
-  console.log("  GitHub identity has to be verified once in the browser.");
+async function mintRegistrationProof({ claimRef, intro } = {}) {
+  console.log("");
+  for (const line of intro ?? [
+    "This posting registers your claim with terminalhire, so your",
+    "GitHub identity has to be verified once in the browser."
+  ])
+    console.log(`  ${line}`);
   let oauthBase;
   try {
     oauthBase = resolveOAuthBase();
@@ -38182,17 +38189,18 @@ function readCredentialDisposition({
   return "store-and-clear-stale-marker";
 }
 async function bootstrapFounderClaimEnrollment(claim, registration) {
-  if (!(claim.amountUSD > 0)) return { stored: false, reason: "free" };
   if (!registration.pushToken || !registration.claimantLogin) {
     return { stored: false, reason: "token-unavailable" };
   }
+  const current = await readPushTokenEnc().catch(() => null);
   const disposition = readCredentialDisposition({
     markerExists: Boolean(readAutoMarker()),
-    enrolledTokenExists: Boolean(await readPushTokenEnc().catch(() => null))
+    enrolledTokenExists: Boolean(current)
   });
   if (disposition === "keep-enrolled") {
     return { stored: false, reason: "kept-enrolled" };
   }
+  if (current && current === registration.pushToken) return { stored: true, reason: "ok" };
   try {
     await writePushTokenEnc(registration.pushToken);
     if (disposition === "store-and-clear-stale-marker") clearAutoMarker();
@@ -38413,7 +38421,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
     console.log(
       `  registered with terminalhire${claim.approval.claimId ? ` (server claim ${claim.approval.claimId})` : ""}`
     );
-    if (claim.amountUSD > 0) {
+    if (enrollment) {
       if (enrollment?.stored) {
         console.log("  \u2713 credential for your granted slice + CI results stored encrypted here");
         console.log("  Background dashboard updates are NOT on (claiming does not enable them).");
@@ -38426,7 +38434,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
         if (enrollment?.detail) {
           for (const line of String(enrollment.detail).split("\n")) console.log(`    ${line}`);
         }
-        console.log("  Store it before fetching your slice: terminalhire claim --push");
+        console.log("  `claim start` will ask you to confirm in the browser once more.");
       }
     }
     if (claim.approval.state === "pending") {
@@ -38588,7 +38596,7 @@ async function cmdList(active) {
     );
     return;
   }
-  await syncFounderApprovals(claims, list);
+  const { approvalsChecked } = await syncFounderApprovals(claims, list);
   list = claims.listClaims({ active });
   await syncFounderVerdicts({
     claimsModule: claims,
@@ -38606,7 +38614,7 @@ ${list.length} ${active ? "active " : ""}claim${list.length === 1 ? "" : "s"}:
 `);
   for (const c of list) {
     const pr = c.prUrl ? ` \xB7 ${c.prUrl}` : "";
-    console.log(`  [${claimTurnLabel(c.state)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
+    console.log(`  [${claimListTurnLabel(c, approvalsChecked)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
     console.log(`    id: ${c.id} \xB7 ${c.state}${pr}`);
   }
   printMetric(claims.acceptedPRRate());
@@ -38714,6 +38722,12 @@ async function syncFounderApprovals(claimsModule, targets) {
   }
   return { pushToken, approvalsChecked, approvalsUnavailable };
 }
+function claimListTurnLabel(claim, approvalsChecked) {
+  if (approvalsChecked && claim.state === "claimed" && claim.approval?.mode === "approval-only" && claim.approval?.state === "pending") {
+    return "waiting on poster";
+  }
+  return claimTurnLabel(claim.state);
+}
 function founderClaimStanding(claim, approvalsChecked) {
   const turn = claimTurnLabel(claim.state);
   switch (claim.state) {
@@ -39956,12 +39970,74 @@ terminalhire claim: ${what} needs the stored credential, and the server says it
   }
   return true;
 }
-async function requireReadPushToken(what) {
+async function enrolHeldClaimReadToken(postingId) {
+  const fail = (lines) => {
+    for (const line of lines) console.error(line);
+    process.exit(1);
+  };
+  const proofToken = await mintRegistrationProof({
+    claimRef: opportunityShortToken(`bounty:founder:${postingId}`),
+    intro: [
+      "This machine holds no terminalhire credential yet. Confirm once in the",
+      "browser, signed in as the GitHub account that claimed this work, and",
+      "this machine is linked to your claim."
+    ]
+  });
+  if (!proofToken) {
+    fail(["terminalhire claim: could not link this machine to your claim (see above)."]);
+  }
+  let res;
+  try {
+    res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/enrol`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bountyId: postingId, proofToken }),
+      signal: AbortSignal.timeout(CLAIM_SYNC_WRITE_TIMEOUT_MS)
+    });
+  } catch (err) {
+    fail([
+      `terminalhire claim: terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}).`,
+      "  Nothing was stored. Run the same command again."
+    ]);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status === 404 && body?.error === "no-live-claim") {
+    const who = typeof body.claimantLogin === "string" ? `@${body.claimantLogin}` : "that account";
+    fail([
+      `terminalhire claim: you confirmed in the browser as ${who}, and ${who} does not`,
+      "  hold a live claim on this posting. Nothing was stored.",
+      "  Sign the browser into the GitHub account that claimed it, then run this again."
+    ]);
+  }
+  if (!res.ok || typeof body?.pushToken !== "string" || body.pushToken.length === 0) {
+    fail([
+      `terminalhire claim: linking this machine failed (${res.status}${typeof body?.message === "string" ? `: ${body.message}` : ""}). Nothing was stored.`
+    ]);
+  }
+  try {
+    await writePushTokenEnc(body.pushToken);
+  } catch (err) {
+    fail([
+      `terminalhire claim: the credential could not be stored on this machine: ${err instanceof Error ? err.message : String(err)}`
+    ]);
+  }
+  console.log("  \u2713 This machine is linked to your claim (credential stored encrypted here).");
+  return body.pushToken;
+}
+var FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
+async function requireReadPushToken(what, { enrolFor } = {}) {
   let stored = null;
   try {
     stored = await readPushTokenEnc();
   } catch {
   }
+  if (!stored && typeof enrolFor === "string" && FOUNDER_POSTING_ID.test(enrolFor)) {
+    return enrolHeldClaimReadToken(enrolFor);
+  }
   if (!stored) {
     console.error(
       `terminalhire claim: ${what} needs the persistent push token, and none is enrolled on this machine.
@@ -39984,7 +40060,9 @@ function cloneFullTierRepo({ engine, dest, url, sha, token, branch }) {
 async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRepo = cloneFullTierRepo) {
   const claimId = fullTierBody.claimId;
   const bountyId = fullTierBody.bountyId;
-  const pushToken = await requireReadPushToken("fetching your full-repo clone credential");
+  const pushToken = await requireReadPushToken("fetching your full-repo clone credential", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/clone-token`, {
@@ -40160,7 +40238,9 @@ async function attemptSliceDelivery(id, flags = {}) {
     requireFounderLoopClaim(claims, id, "slice");
   }
   const bountyId = local ? founderPostingIdOf(local) : String(id).replace(/^bounty:founder:/, "");
-  const pushToken = await requireReadPushToken("fetching your granted slice");
+  const pushToken = await requireReadPushToken("fetching your granted slice", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/slice`, {
@@ -41978,6 +42058,7 @@ export {
   buildStakeComment,
   buildStandDownComment,
   buildSubmitBody,
+  claimListTurnLabel,
   claimUpdatePatch,
   cloneFullTierRepo,
   cmdNote,

package/dist/bin/jpi-dispatch.js

@@ -36235,7 +36235,10 @@ var init_boundary = __esm({
       },
       {
         code: "lockfile",
-        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base),
+        // The `.lock` suffix is the server's rule since TERM-412; this copy missed it, so
+        // the pre-flight passed `uv.lock` and bun's text `bun.lock` that the server refuses
+        // (TERM-1235). The name set only covers lockfiles whose names do not end in `.lock`.
+        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base) || base.endsWith(".lock"),
         why: "is a dependency lockfile. Nobody reads a lockfile diff, so a change to one is refused rather than shown"
       }
     ];
@@ -41989,6 +41992,7 @@ __export(jpi_claim_exports, {
   buildStakeComment: () => buildStakeComment,
   buildStandDownComment: () => buildStandDownComment,
   buildSubmitBody: () => buildSubmitBody,
+  claimListTurnLabel: () => claimListTurnLabel,
   claimUpdatePatch: () => claimUpdatePatch,
   cloneFullTierRepo: () => cloneFullTierRepo,
   cmdNote: () => cmdNote,
@@ -43171,9 +43175,13 @@ function fmtContestedWarning(b) {
   }
   return `  \u26A0 This issue looks taken: ${parts.join(" / ")}. A merged PR here is unlikely.`;
 }
-async function mintRegistrationProof({ claimRef } = {}) {
-  console.log("\n  This posting registers your claim with terminalhire, so your");
-  console.log("  GitHub identity has to be verified once in the browser.");
+async function mintRegistrationProof({ claimRef, intro } = {}) {
+  console.log("");
+  for (const line of intro ?? [
+    "This posting registers your claim with terminalhire, so your",
+    "GitHub identity has to be verified once in the browser."
+  ])
+    console.log(`  ${line}`);
   let oauthBase2;
   try {
     oauthBase2 = resolveOAuthBase();
@@ -43475,17 +43483,18 @@ function readCredentialDisposition({
   return "store-and-clear-stale-marker";
 }
 async function bootstrapFounderClaimEnrollment(claim, registration) {
-  if (!(claim.amountUSD > 0)) return { stored: false, reason: "free" };
   if (!registration.pushToken || !registration.claimantLogin) {
     return { stored: false, reason: "token-unavailable" };
   }
+  const current = await readPushTokenEnc().catch(() => null);
   const disposition = readCredentialDisposition({
     markerExists: Boolean(readAutoMarker()),
-    enrolledTokenExists: Boolean(await readPushTokenEnc().catch(() => null))
+    enrolledTokenExists: Boolean(current)
   });
   if (disposition === "keep-enrolled") {
     return { stored: false, reason: "kept-enrolled" };
   }
+  if (current && current === registration.pushToken) return { stored: true, reason: "ok" };
   try {
     await writePushTokenEnc(registration.pushToken);
     if (disposition === "store-and-clear-stale-marker") clearAutoMarker();
@@ -43706,7 +43715,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
     console.log(
       `  registered with terminalhire${claim.approval.claimId ? ` (server claim ${claim.approval.claimId})` : ""}`
     );
-    if (claim.amountUSD > 0) {
+    if (enrollment) {
       if (enrollment?.stored) {
         console.log("  \u2713 credential for your granted slice + CI results stored encrypted here");
         console.log("  Background dashboard updates are NOT on (claiming does not enable them).");
@@ -43719,7 +43728,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
         if (enrollment?.detail) {
           for (const line of String(enrollment.detail).split("\n")) console.log(`    ${line}`);
         }
-        console.log("  Store it before fetching your slice: terminalhire claim --push");
+        console.log("  `claim start` will ask you to confirm in the browser once more.");
       }
     }
     if (claim.approval.state === "pending") {
@@ -43881,7 +43890,7 @@ async function cmdList(active) {
     );
     return;
   }
-  await syncFounderApprovals(claims, list);
+  const { approvalsChecked } = await syncFounderApprovals(claims, list);
   list = claims.listClaims({ active });
   await syncFounderVerdicts({
     claimsModule: claims,
@@ -43899,7 +43908,7 @@ ${list.length} ${active ? "active " : ""}claim${list.length === 1 ? "" : "s"}:
 `);
   for (const c of list) {
     const pr = c.prUrl ? ` \xB7 ${c.prUrl}` : "";
-    console.log(`  [${claimTurnLabel(c.state)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
+    console.log(`  [${claimListTurnLabel(c, approvalsChecked)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
     console.log(`    id: ${c.id} \xB7 ${c.state}${pr}`);
   }
   printMetric(claims.acceptedPRRate());
@@ -44006,6 +44015,12 @@ async function syncFounderApprovals(claimsModule, targets) {
   }
   return { pushToken, approvalsChecked, approvalsUnavailable };
 }
+function claimListTurnLabel(claim, approvalsChecked) {
+  if (approvalsChecked && claim.state === "claimed" && claim.approval?.mode === "approval-only" && claim.approval?.state === "pending") {
+    return "waiting on poster";
+  }
+  return claimTurnLabel(claim.state);
+}
 function founderClaimStanding(claim, approvalsChecked) {
   const turn = claimTurnLabel(claim.state);
   switch (claim.state) {
@@ -45219,12 +45234,73 @@ terminalhire claim: ${what} needs the stored credential, and the server says it
   }
   return true;
 }
-async function requireReadPushToken(what) {
+async function enrolHeldClaimReadToken(postingId) {
+  const fail = (lines) => {
+    for (const line of lines) console.error(line);
+    process.exit(1);
+  };
+  const proofToken = await mintRegistrationProof({
+    claimRef: opportunityShortToken(`bounty:founder:${postingId}`),
+    intro: [
+      "This machine holds no terminalhire credential yet. Confirm once in the",
+      "browser, signed in as the GitHub account that claimed this work, and",
+      "this machine is linked to your claim."
+    ]
+  });
+  if (!proofToken) {
+    fail(["terminalhire claim: could not link this machine to your claim (see above)."]);
+  }
+  let res;
+  try {
+    res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/enrol`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bountyId: postingId, proofToken }),
+      signal: AbortSignal.timeout(CLAIM_SYNC_WRITE_TIMEOUT_MS)
+    });
+  } catch (err) {
+    fail([
+      `terminalhire claim: terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}).`,
+      "  Nothing was stored. Run the same command again."
+    ]);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status === 404 && body?.error === "no-live-claim") {
+    const who = typeof body.claimantLogin === "string" ? `@${body.claimantLogin}` : "that account";
+    fail([
+      `terminalhire claim: you confirmed in the browser as ${who}, and ${who} does not`,
+      "  hold a live claim on this posting. Nothing was stored.",
+      "  Sign the browser into the GitHub account that claimed it, then run this again."
+    ]);
+  }
+  if (!res.ok || typeof body?.pushToken !== "string" || body.pushToken.length === 0) {
+    fail([
+      `terminalhire claim: linking this machine failed (${res.status}${typeof body?.message === "string" ? `: ${body.message}` : ""}). Nothing was stored.`
+    ]);
+  }
+  try {
+    await writePushTokenEnc(body.pushToken);
+  } catch (err) {
+    fail([
+      `terminalhire claim: the credential could not be stored on this machine: ${err instanceof Error ? err.message : String(err)}`
+    ]);
+  }
+  console.log("  \u2713 This machine is linked to your claim (credential stored encrypted here).");
+  return body.pushToken;
+}
+async function requireReadPushToken(what, { enrolFor } = {}) {
   let stored = null;
   try {
     stored = await readPushTokenEnc();
   } catch {
   }
+  if (!stored && typeof enrolFor === "string" && FOUNDER_POSTING_ID.test(enrolFor)) {
+    return enrolHeldClaimReadToken(enrolFor);
+  }
   if (!stored) {
     console.error(
       `terminalhire claim: ${what} needs the persistent push token, and none is enrolled on this machine.
@@ -45247,7 +45323,9 @@ function cloneFullTierRepo({ engine, dest, url, sha, token, branch }) {
 async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRepo = cloneFullTierRepo) {
   const claimId = fullTierBody.claimId;
   const bountyId = fullTierBody.bountyId;
-  const pushToken = await requireReadPushToken("fetching your full-repo clone credential");
+  const pushToken = await requireReadPushToken("fetching your full-repo clone credential", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/clone-token`, {
@@ -45423,7 +45501,9 @@ async function attemptSliceDelivery(id, flags = {}) {
     requireFounderLoopClaim(claims, id, "slice");
   }
   const bountyId = local ? founderPostingIdOf(local) : String(id).replace(/^bounty:founder:/, "");
-  const pushToken = await requireReadPushToken("fetching your granted slice");
+  const pushToken = await requireReadPushToken("fetching your granted slice", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/slice`, {
@@ -47197,7 +47277,7 @@ async function run7() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE4, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, CLAIM_RESOLUTION_REASONS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
+var TERMINALHIRE_DIR17, INDEX_CACHE_FILE5, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL6, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API3, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE4, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_RESOLUTION_REASONS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
@@ -47313,6 +47393,7 @@ var init_jpi_claim = __esm({
     };
     LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
     CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
+    FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
     CLAIM_RESOLUTION_REASONS = [
       "not-my-stack",
       "out-of-time",
@@ -79452,7 +79533,7 @@ function buildApprovalsNudge(awaitingApproval) {
   if (!Number.isInteger(awaitingApproval) || awaitingApproval <= 0) return null;
   const n = awaitingApproval;
   return `  \u26A0 ${n} claim${n === 1 ? "" : "s"} awaiting poster approval \u2014 terminalhire cannot check in the background until you enrol:
-    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim slice <id>)`;
+    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim start <id>)`;
 }
 async function syncApprovedClaims({
   readAutoMarker: readAutoMarker2,

package/dist/bin/jpi-mcp.js

@@ -31010,7 +31010,10 @@ var init_boundary = __esm({
       },
       {
         code: "lockfile",
-        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base),
+        // The `.lock` suffix is the server's rule since TERM-412; this copy missed it, so
+        // the pre-flight passed `uv.lock` and bun's text `bun.lock` that the server refuses
+        // (TERM-1235). The name set only covers lockfiles whose names do not end in `.lock`.
+        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base) || base.endsWith(".lock"),
         why: "is a dependency lockfile. Nobody reads a lockfile diff, so a change to one is refused rather than shown"
       }
     ];
@@ -36764,6 +36767,7 @@ __export(jpi_claim_exports, {
   buildStakeComment: () => buildStakeComment,
   buildStandDownComment: () => buildStandDownComment,
   buildSubmitBody: () => buildSubmitBody,
+  claimListTurnLabel: () => claimListTurnLabel,
   claimUpdatePatch: () => claimUpdatePatch,
   cloneFullTierRepo: () => cloneFullTierRepo,
   cmdNote: () => cmdNote,
@@ -37946,9 +37950,13 @@ function fmtContestedWarning(b) {
   }
   return `  \u26A0 This issue looks taken: ${parts.join(" / ")}. A merged PR here is unlikely.`;
 }
-async function mintRegistrationProof({ claimRef } = {}) {
-  console.log("\n  This posting registers your claim with terminalhire, so your");
-  console.log("  GitHub identity has to be verified once in the browser.");
+async function mintRegistrationProof({ claimRef, intro } = {}) {
+  console.log("");
+  for (const line of intro ?? [
+    "This posting registers your claim with terminalhire, so your",
+    "GitHub identity has to be verified once in the browser."
+  ])
+    console.log(`  ${line}`);
   let oauthBase;
   try {
     oauthBase = resolveOAuthBase();
@@ -38250,17 +38258,18 @@ function readCredentialDisposition({
   return "store-and-clear-stale-marker";
 }
 async function bootstrapFounderClaimEnrollment(claim, registration) {
-  if (!(claim.amountUSD > 0)) return { stored: false, reason: "free" };
   if (!registration.pushToken || !registration.claimantLogin) {
     return { stored: false, reason: "token-unavailable" };
   }
+  const current = await readPushTokenEnc().catch(() => null);
   const disposition = readCredentialDisposition({
     markerExists: Boolean(readAutoMarker()),
-    enrolledTokenExists: Boolean(await readPushTokenEnc().catch(() => null))
+    enrolledTokenExists: Boolean(current)
   });
   if (disposition === "keep-enrolled") {
     return { stored: false, reason: "kept-enrolled" };
   }
+  if (current && current === registration.pushToken) return { stored: true, reason: "ok" };
   try {
     await writePushTokenEnc(registration.pushToken);
     if (disposition === "store-and-clear-stale-marker") clearAutoMarker();
@@ -38481,7 +38490,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
     console.log(
       `  registered with terminalhire${claim.approval.claimId ? ` (server claim ${claim.approval.claimId})` : ""}`
     );
-    if (claim.amountUSD > 0) {
+    if (enrollment) {
       if (enrollment?.stored) {
         console.log("  \u2713 credential for your granted slice + CI results stored encrypted here");
         console.log("  Background dashboard updates are NOT on (claiming does not enable them).");
@@ -38494,7 +38503,7 @@ terminalhire claim: refusing to record \u2014 read ${b.repoFullName}'s contribut
         if (enrollment?.detail) {
           for (const line of String(enrollment.detail).split("\n")) console.log(`    ${line}`);
         }
-        console.log("  Store it before fetching your slice: terminalhire claim --push");
+        console.log("  `claim start` will ask you to confirm in the browser once more.");
       }
     }
     if (claim.approval.state === "pending") {
@@ -38656,7 +38665,7 @@ async function cmdList(active) {
     );
     return;
   }
-  await syncFounderApprovals(claims, list);
+  const { approvalsChecked } = await syncFounderApprovals(claims, list);
   list = claims.listClaims({ active });
   await syncFounderVerdicts({
     claimsModule: claims,
@@ -38674,7 +38683,7 @@ ${list.length} ${active ? "active " : ""}claim${list.length === 1 ? "" : "s"}:
 `);
   for (const c of list) {
     const pr = c.prUrl ? ` \xB7 ${c.prUrl}` : "";
-    console.log(`  [${claimTurnLabel(c.state)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
+    console.log(`  [${claimListTurnLabel(c, approvalsChecked)}] ${fmtClaimAmount(c)} \xB7 ${c.title}`);
     console.log(`    id: ${c.id} \xB7 ${c.state}${pr}`);
   }
   printMetric(claims.acceptedPRRate());
@@ -38781,6 +38790,12 @@ async function syncFounderApprovals(claimsModule, targets) {
   }
   return { pushToken, approvalsChecked, approvalsUnavailable };
 }
+function claimListTurnLabel(claim, approvalsChecked) {
+  if (approvalsChecked && claim.state === "claimed" && claim.approval?.mode === "approval-only" && claim.approval?.state === "pending") {
+    return "waiting on poster";
+  }
+  return claimTurnLabel(claim.state);
+}
 function founderClaimStanding(claim, approvalsChecked) {
   const turn = claimTurnLabel(claim.state);
   switch (claim.state) {
@@ -39994,12 +40009,73 @@ terminalhire claim: ${what} needs the stored credential, and the server says it
   }
   return true;
 }
-async function requireReadPushToken(what) {
+async function enrolHeldClaimReadToken(postingId) {
+  const fail = (lines) => {
+    for (const line of lines) console.error(line);
+    process.exit(1);
+  };
+  const proofToken = await mintRegistrationProof({
+    claimRef: opportunityShortToken(`bounty:founder:${postingId}`),
+    intro: [
+      "This machine holds no terminalhire credential yet. Confirm once in the",
+      "browser, signed in as the GitHub account that claimed this work, and",
+      "this machine is linked to your claim."
+    ]
+  });
+  if (!proofToken) {
+    fail(["terminalhire claim: could not link this machine to your claim (see above)."]);
+  }
+  let res;
+  try {
+    res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/enrol`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ bountyId: postingId, proofToken }),
+      signal: AbortSignal.timeout(CLAIM_SYNC_WRITE_TIMEOUT_MS)
+    });
+  } catch (err) {
+    fail([
+      `terminalhire claim: terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}).`,
+      "  Nothing was stored. Run the same command again."
+    ]);
+  }
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status === 404 && body?.error === "no-live-claim") {
+    const who = typeof body.claimantLogin === "string" ? `@${body.claimantLogin}` : "that account";
+    fail([
+      `terminalhire claim: you confirmed in the browser as ${who}, and ${who} does not`,
+      "  hold a live claim on this posting. Nothing was stored.",
+      "  Sign the browser into the GitHub account that claimed it, then run this again."
+    ]);
+  }
+  if (!res.ok || typeof body?.pushToken !== "string" || body.pushToken.length === 0) {
+    fail([
+      `terminalhire claim: linking this machine failed (${res.status}${typeof body?.message === "string" ? `: ${body.message}` : ""}). Nothing was stored.`
+    ]);
+  }
+  try {
+    await writePushTokenEnc(body.pushToken);
+  } catch (err) {
+    fail([
+      `terminalhire claim: the credential could not be stored on this machine: ${err instanceof Error ? err.message : String(err)}`
+    ]);
+  }
+  console.log("  \u2713 This machine is linked to your claim (credential stored encrypted here).");
+  return body.pushToken;
+}
+async function requireReadPushToken(what, { enrolFor } = {}) {
   let stored = null;
   try {
     stored = await readPushTokenEnc();
   } catch {
   }
+  if (!stored && typeof enrolFor === "string" && FOUNDER_POSTING_ID.test(enrolFor)) {
+    return enrolHeldClaimReadToken(enrolFor);
+  }
   if (!stored) {
     console.error(
       `terminalhire claim: ${what} needs the persistent push token, and none is enrolled on this machine.
@@ -40022,7 +40098,9 @@ function cloneFullTierRepo({ engine, dest, url, sha, token, branch }) {
 async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRepo = cloneFullTierRepo) {
   const claimId = fullTierBody.claimId;
   const bountyId = fullTierBody.bountyId;
-  const pushToken = await requireReadPushToken("fetching your full-repo clone credential");
+  const pushToken = await requireReadPushToken("fetching your full-repo clone credential", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/clone-token`, {
@@ -40198,7 +40276,9 @@ async function attemptSliceDelivery(id, flags = {}) {
     requireFounderLoopClaim(claims, id, "slice");
   }
   const bountyId = local ? founderPostingIdOf(local) : String(id).replace(/^bounty:founder:/, "");
-  const pushToken = await requireReadPushToken("fetching your granted slice");
+  const pushToken = await requireReadPushToken("fetching your granted slice", {
+    enrolFor: bountyId
+  });
   let res;
   try {
     res = await fetch(`${CLAIM_SYNC_BASE4}/api/claim/slice`, {
@@ -41972,7 +42052,7 @@ async function run() {
     process.exit(1);
   }
 }
-var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, CLAIM_RESOLUTION_REASONS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
+var TERMINALHIRE_DIR11, INDEX_CACHE_FILE2, CLAIM_PUSH_MARKER, REPO_CONTINUITY_NUDGE_MARKER, API_URL, CLAIM_SYNC_BASE4, CLAIM_CONSENT_VERSION, CLAIM_POLL_INTERVAL_MS, CLAIM_POLL_TIMEOUT_MS, CLAIM_SYNC_WRITE_TIMEOUT_MS, GH_API2, GH_HEADERS2, CONTENTION_HINT, AI_DISCLOSURE_NOTE, pExecFile, VALUE_FLAGS, ASSIGNMENT_MARKER, STAKE_MARKER, STANDDOWN_MARKER, OUR_MARKERS, STAKE_POST_TIMEOUT_MS, STAKE_POSTING_GRACE_MS, TAKE_BOT_REPOS, SUBMIT_ACCEPTS, REVISE_RECOVERY_STATES, CLOSED_STATES, GH_SESSION_COOKIE, PUSH_TOKEN_REFUSAL, SYNC_BACKGROUND_PUSH_ACTIVE_FIELD, ISSUE_OUTCOME_TERMINAL, RUNS_POLL_INTERVAL_MS, RUNS_POLL_ATTEMPTS, OPENABLE_AGENTS, BRIEF_DIR, BRIEF_REL_PATH, VERIFY_REL_PATH, AGENTS_REL_PATH, BRIEF_EXCLUDE_LINE, PACK_SAFE_ID, CLAIM_EVENT_LABEL, LINE_BREAKS, CONTROL_CHARS3, FOUNDER_POSTING_ID, CLAIM_RESOLUTION_REASONS, POSTING_LEVEL_RESOLUTION_REASONS, RESOLUTION_REASON_BLURB;
 var init_jpi_claim = __esm({
   "bin/jpi-claim.js"() {
     "use strict";
@@ -42088,6 +42168,7 @@ var init_jpi_claim = __esm({
     };
     LINE_BREAKS = /\r\n|[\r\n\v\f\u0085\u2028\u2029]/;
     CONTROL_CHARS3 = /[\u0000-\u001F\u007F-\u009F]/g;
+    FOUNDER_POSTING_ID = /^fb_[A-Za-z0-9_-]{1,80}$/;
     CLAIM_RESOLUTION_REASONS = [
       "not-my-stack",
       "out-of-time",

package/dist/bin/jpi-refresh.js

@@ -13483,7 +13483,7 @@ function buildApprovalsNudge(awaitingApproval) {
   if (!Number.isInteger(awaitingApproval) || awaitingApproval <= 0) return null;
   const n = awaitingApproval;
   return `  \u26A0 ${n} claim${n === 1 ? "" : "s"} awaiting poster approval \u2014 terminalhire cannot check in the background until you enrol:
-    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim slice <id>)`;
+    terminalhire claim --push --keep-updated    (or check one now: terminalhire claim start <id>)`;
 }
 async function syncApprovedClaims({
   readAutoMarker: readAutoMarker2,

package/dist/bin/jpi-run.js

@@ -4485,7 +4485,10 @@ var init_boundary = __esm({
       },
       {
         code: "lockfile",
-        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base),
+        // The `.lock` suffix is the server's rule since TERM-412; this copy missed it, so
+        // the pre-flight passed `uv.lock` and bun's text `bun.lock` that the server refuses
+        // (TERM-1235). The name set only covers lockfiles whose names do not end in `.lock`.
+        matches: (_p, _segments, base) => LOCKFILE_NAMES.has(base) || base.endsWith(".lock"),
         why: "is a dependency lockfile. Nobody reads a lockfile diff, so a change to one is refused rather than shown"
       }
     ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.42.27",
+  "version": "0.42.28",
   "description": "Developer jobs and paid bounties, matched in the terminal — ambient matches in the Claude Code spinner. Claim a scoped bounty and get paid when the poster accepts it.",
   "repository": {
     "type": "git",