toyon 0.10.0 → 0.11.0

package/dist/daemon.js

@@ -4,6 +4,14 @@ import { rmSync as rmSync8, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname12 } from "path";
 import { fileURLToPath } from "url";
 
+// ../shared/src/protocol/events.ts
+var SHELL_TOOL = "shell";
+var CHECK_TOOL = "check";
+var TOOL_SEARCH = "ToolSearch";
+var ASK_TOOL = "AskUserQuestion";
+var TOYON_MCP_SERVER = "toyon";
+var HANDOFF_TOOL = "handoff";
+
 // ../shared/src/agent-tools.ts
 var EDIT_KINDS = new Set(["edit", "delete", "move", "execute"]);
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"]);
@@ -16,6 +24,9 @@ var WRITTEN_KINDS = ["read", "edit", "delete", "move", "search", "execute", "fet
 function isWrittenKind(kind) {
   return WRITTEN_KINDS.includes(kind ?? "");
 }
+function writingCall(call, input) {
+  return (isWrittenKind(call.kind) || call.name === ASK_TOOL) && emptyInput(input);
+}
 function emptyInput(input) {
   if (!input || typeof input !== "object")
     return true;
@@ -271,6 +282,11 @@ function configSibling(rel, kind) {
   return place[kind];
 }
 
+// ../shared/src/pair.ts
+var PAIR_TTL_MS = 120000;
+var pairLink = (host, code) => `https://${host}/#pair=${code}`;
+var isTailnetName = (host) => host.endsWith(".ts.net");
+
 // ../shared/src/daemon.ts
 var DAEMON_FILES = {
   token: "token",
@@ -280,8 +296,18 @@ var DAEMON_FILES = {
   log: "daemon.log",
   remote: "remote.json"
 };
+function machineLabel(hostname, remote) {
+  const of = (name) => name.split(".")[0]?.toLowerCase() ?? "";
+  if (remote && isTailnetName(remote.host))
+    return of(remote.host) || of(hostname);
+  return of(hostname) || "toyon";
+}
+var PREVIEW_GRANT_PARAM = "toyon_grant";
 var PREVIEW_PORTS = { from: 10001, to: 10008 };
 var DNS_NAME = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function isLoopbackHost(host) {
+  return host === "127.0.0.1" || host === "::1" || host === "[::1]" || host === "localhost" || host.endsWith(".localhost");
+}
 function isRemoteHost(name) {
   return DNS_NAME.test(name) && !/\.\d+$/.test(name) && name !== "localhost" && !name.endsWith(".localhost");
 }
@@ -6486,13 +6512,8 @@ function clipOutput(text) {
 ${text.slice(text.length - (CONTEXT_CHARS - HEAD_CHARS))}`;
 }
 
-// ../shared/src/pair.ts
-var PAIR_TTL_MS = 120000;
-var pairLink = (host, code) => `https://${host}/#pair=${code}`;
-var isTailnetName = (host) => host.endsWith(".ts.net");
-
 // ../shared/src/protocol/limits.ts
-var PROTOCOL_VERSION = 89;
+var PROTOCOL_VERSION = 93;
 var FILE_MAX_CHARS = 5000000;
 var IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
 var IMAGE_MAX_EDGE = 2576;
@@ -6565,11 +6586,6 @@ var elementTraitsSchema = object({
   attrs: array(tuple([string2().max(40), string2().max(200)])).max(12)
 });
 
-// ../shared/src/protocol/events.ts
-var SHELL_TOOL = "shell";
-var CHECK_TOOL = "check";
-var TOOL_SEARCH = "ToolSearch";
-
 // ../shared/src/protocol/ws.ts
 var id = string2().min(1).max(200);
 var permissionModeSchema = _enum(["auto", "ask", "plan"]);
@@ -6922,6 +6938,14 @@ var clientMsgSchema = discriminatedUnion("t", [
     answers: array(askAnswerSchema).max(8).optional()
   }),
   object({ t: literal("agent-decide"), worktreeId: id, askId: string2().max(64), choiceId: string2().max(200) }),
+  object({
+    t: literal("handoff-answer"),
+    worktreeId: id,
+    id: string2().max(64),
+    go: boolean2(),
+    note: string2().max(5000).optional()
+  }),
+  object({ t: literal("handoff-ask"), worktreeId: id, repoId: id, text: prompt.optional() }),
   object({ t: literal("agent-logout"), agent: id }),
   object({ t: literal("agent-config"), agent: id, repoId: id.optional() }),
   object({ t: literal("reveal-agent-file"), agent: id, file: string2().max(64), repoId: id.optional() }),
@@ -8220,7 +8244,7 @@ function safeUser() {
 // ../daemon/package.json
 var package_default = {
   name: "@toyon/daemon",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   type: "module",
   main: "src/index.ts",
@@ -12415,12 +12439,24 @@ class AgentAccounts {
     if (before.canLogout !== entry.canLogout || !same(before.status, entry.status))
       this.onChange?.();
   }
+  observeLimits(agentId, limits) {
+    const before = this.known.get(agentId) ?? { canLogout: false, status: undefined };
+    const entry = { ...before, limits };
+    this.known.set(agentId, entry);
+    if (!sameLimits(before.limits, limits))
+      this.onChange?.();
+  }
   describe(infos) {
     return infos.map((info) => {
       const k = this.known.get(info.id);
       if (!k)
         return info;
-      return { ...info, ...k.status ? { auth: k.status } : {}, ...k.canLogout ? { canLogout: true } : {} };
+      return {
+        ...info,
+        ...k.status ? { auth: k.status } : {},
+        ...k.canLogout ? { canLogout: true } : {},
+        ...k.limits ? { limits: k.limits } : {}
+      };
     });
   }
   logout(agentId) {
@@ -12464,6 +12500,12 @@ class AgentAccounts {
     }
   }
 }
+function sameLimits(a, b) {
+  if (!a || !b)
+    return a === b;
+  const win = (x) => x ? `${x.used}@${x.resetsAt}` : "";
+  return a.status === b.status && a.binding === b.binding && win(a.windows.five_hour) === win(b.windows.five_hour) && win(a.windows.seven_day) === win(b.windows.seven_day);
+}
 function same(a, b) {
   if (!a || !b)
     return a === b;
@@ -12477,13 +12519,17 @@ import { Readable, Writable } from "stream";
 // ../daemon/src/runtime/kill.ts
 var KILL_GRACE_MS = 3000;
 var EXIT_GRACE_MS = 200;
-async function killGroup(pid, exited) {
+async function killGroup(pid, exited, graceMs = KILL_GRACE_MS) {
   if (!signalGroup(pid, "SIGTERM"))
     return;
-  if (await within(exited, KILL_GRACE_MS))
-    return "SIGTERM";
+  const deadline = Date.now() + graceMs;
+  if (await within(exited, graceMs)) {
+    await groupGone(pid, deadline);
+    if (!groupAlive(pid))
+      return "SIGTERM";
+  }
   signalGroup(pid, "SIGKILL");
-  await within(exited, EXIT_GRACE_MS);
+  await Promise.all([within(exited, EXIT_GRACE_MS), groupGone(pid, Date.now() + EXIT_GRACE_MS)]);
   return "SIGKILL";
 }
 async function killProcessGroup(child) {
@@ -12518,8 +12564,7 @@ function groupAlive(pgid) {
     return e.code !== "ESRCH";
   }
 }
-function groupGone(pgid) {
-  const deadline = Date.now() + KILL_GRACE_MS + EXIT_GRACE_MS + 500;
+function groupGone(pgid, deadline = Date.now() + KILL_GRACE_MS + EXIT_GRACE_MS + 500) {
   return new Promise((resolve) => {
     const poll = () => {
       if (!groupAlive(pgid) || Date.now() >= deadline)
@@ -12949,6 +12994,303 @@ class LinuxSandbox {
   }
 }
 
+// ../daemon/src/agent/mcp.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// ../daemon/src/core/remote.ts
+import { createHmac, timingSafeEqual } from "crypto";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+function loadRemote(file, env = process.env, managed = MANAGED_DEFAULTS) {
+  if (env.TOYON_CLOUD === "1") {
+    const host = (env.TOYON_PUBLIC_HOST ?? "").toLowerCase();
+    if (!isRemoteHost(host)) {
+      throw new Error(`TOYON_CLOUD=1 needs TOYON_PUBLIC_HOST, the name the edge answers for; got "${host}"`);
+    }
+    const previews = env.TOYON_PREVIEWS ?? portPreviews(host);
+    const why = checkPreviews(previews, host);
+    if (why)
+      throw new Error(`TOYON_PREVIEWS: ${why}`);
+    return { host, previews, front: "edge" };
+  }
+  if (!existsSync(file))
+    return null;
+  if (managed.remote === "off") {
+    log.warn("remote", `${file} is ignored: remote access is turned off by your organization's policy`);
+    return null;
+  }
+  const view = parseRemote(readFileSync2(file, "utf8"));
+  if (!view) {
+    log.warn("remote", `${file} names no valid host or previews; remote access is off`);
+    return null;
+  }
+  if (managed.remote === "tailscale" && !view.host.endsWith(".ts.net")) {
+    log.warn("remote", `${file} names ${view.host}; your organization's policy allows a tailnet name only, so remote access is off`);
+    return null;
+  }
+  return { ...view, front: "local" };
+}
+function sameSecret(given, want) {
+  if (given === null)
+    return false;
+  const a = Buffer.from(given);
+  const b = Buffer.from(want);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+var isLoopbackPeer = (ip) => ip === "127.0.0.1" || ip === "::1" || ip.startsWith("::ffff:127.");
+function requestedAuthority(req) {
+  const host = (req.headers.get("host") ?? "").toLowerCase();
+  if (host.includes(":"))
+    return host;
+  const port = req.headers.get("x-forwarded-port");
+  return port && /^\d{1,5}$/.test(port) && port !== "443" ? `${host}:${port}` : host;
+}
+var forbidden = (body = "forbidden") => ({ kind: "refused", response: new Response(body, { status: 403 }) });
+function toHttps(req, host) {
+  const url = new URL(req.url);
+  const location = `https://${host}${url.pathname}${url.search}`;
+  return {
+    kind: "refused",
+    response: new Response(`open ${location} instead`, {
+      status: 302,
+      headers: { location, "cache-control": "no-store" }
+    })
+  };
+}
+function door(req, peer, remote, listener) {
+  if (remote === null && listener === "preview")
+    return { kind: "local" };
+  if (remote?.front !== "edge" && !isLoopbackPeer(peer)) {
+    const typed = requestedAuthority(req).replace(/:80$/, "");
+    const browsing = req.method === "GET" || req.method === "HEAD";
+    return remote && listener === "daemon" && browsing && typed === remote.host ? toHttps(req, remote.host) : forbidden();
+  }
+  const authority = requestedAuthority(req);
+  const host = authority.split(":")[0] ?? "";
+  if (isLoopbackHost(host)) {
+    return remote?.front === "edge" ? forbidden() : { kind: "local" };
+  }
+  if (remote === null)
+    return forbidden();
+  const preview = matchPreview(remote.previews, authority);
+  let worktreeId = null;
+  if (listener === "daemon") {
+    if (preview !== null && "id" in preview)
+      worktreeId = preview.id;
+    else if (preview !== null || host !== remote.host)
+      return forbidden();
+  } else if (preview === null || "id" in preview) {
+    return forbidden();
+  }
+  if (req.headers.get("x-forwarded-proto") !== "https") {
+    return forbidden(`${host} reaches Toyon over https only; the front must terminate TLS`);
+  }
+  if (listener === "preview")
+    return { kind: "preview", worktreeId: null };
+  return worktreeId === null ? { kind: "shell" } : { kind: "preview", worktreeId };
+}
+var PREVIEW_COOKIE = "toyon_preview";
+function previewGrant(token) {
+  return createHmac("sha256", token).update("toyon preview grant").digest("hex");
+}
+function grantCookie(grant, name, opts = {}) {
+  const site = opts.partitioned ? "SameSite=None; Partitioned" : "SameSite=Strict";
+  return `${PREVIEW_COOKIE}=${grant}; Domain=${name}; Path=/; Max-Age=34560000; HttpOnly; Secure; ${site}`;
+}
+function takeGrant(cookie, grant) {
+  let ok = false;
+  const kept = [];
+  for (const part of (cookie ?? "").split(";")) {
+    const pair = part.trim();
+    if (pair === "")
+      continue;
+    const eq = pair.indexOf("=");
+    if (eq > 0 && pair.slice(0, eq) === PREVIEW_COOKIE) {
+      if (sameSecret(pair.slice(eq + 1), grant))
+        ok = true;
+      continue;
+    }
+    kept.push(pair);
+  }
+  return { ok, rest: kept.length ? kept.join("; ") : null };
+}
+function passPreview(req, gate) {
+  const pass = takeGrant(req.headers.get("cookie"), gate.grant);
+  const url = new URL(req.url);
+  const code = url.searchParams.get(PREVIEW_GRANT_PARAM);
+  if (code !== null) {
+    url.searchParams.delete(PREVIEW_GRANT_PARAM);
+    const location = `${url.pathname}${url.search}`;
+    if (!pass.ok && !gate.redeem(code))
+      return { ok: false, response: refusedPreview() };
+    const headers = { location, "cache-control": "no-store" };
+    if (!pass.ok) {
+      const partitioned = req.headers.get("sec-fetch-site") === "cross-site";
+      headers["set-cookie"] = grantCookie(gate.grant, gate.host, { partitioned });
+    }
+    return { ok: false, response: new Response(null, { status: 302, headers }) };
+  }
+  if (!pass.ok)
+    return { ok: false, response: refusedPreview() };
+  const headers = new Headers(req.headers);
+  if (pass.rest === null)
+    headers.delete("cookie");
+  else
+    headers.set("cookie", pass.rest);
+  return { ok: true, req: new Request(req, { headers }) };
+}
+function refusedPreview() {
+  return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="3"></head>` + `<body>This preview opens from Toyon; open your Toyon link first.</body></html>`, { status: 403, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+}
+function setsGrant(line) {
+  return line.slice(0, line.indexOf("=")).trim() === PREVIEW_COOKIE;
+}
+
+// ../daemon/src/agent/mcp.ts
+class ToolSet {
+  providers = [];
+  add(provider) {
+    this.providers.push(provider);
+  }
+  list(worktreeId) {
+    return this.providers.map((p) => p.tool(worktreeId));
+  }
+  async call(worktreeId, name, args) {
+    const provider = this.providers.find((p) => p.tool(worktreeId).name === name);
+    if (!provider)
+      return { text: `unknown tool ${name}`, isError: true };
+    return provider.call(worktreeId, args);
+  }
+}
+var PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"];
+var DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+var BODY_MAX_BYTES = 64 * 1024;
+var PARSE_ERROR = -32700;
+var INVALID_PARAMS = -32602;
+var METHOD_NOT_FOUND = -32601;
+var INTERNAL_ERROR = -32603;
+var rpcError = (id, code, message) => ({
+  jsonrpc: "2.0",
+  id,
+  error: { code, message }
+});
+var asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
+
+class ToyonMcp {
+  d;
+  bearers = new Map;
+  constructor(d) {
+    this.d = d;
+  }
+  open(worktreeId) {
+    const bearer = randomBytes2(32).toString("base64url");
+    this.bearers.set(worktreeId, bearer);
+    return {
+      type: "http",
+      name: TOYON_MCP_SERVER,
+      url: this.d.url(worktreeId),
+      headers: [{ name: "Authorization", value: `Bearer ${bearer}` }]
+    };
+  }
+  close(worktreeId) {
+    this.bearers.delete(worktreeId);
+  }
+  async fetch(req, worktreeId) {
+    if (req.headers.get("origin") !== null)
+      return new Response("forbidden", { status: 403 });
+    if (req.method !== "POST")
+      return new Response("method not allowed", { status: 405, headers: { allow: "POST" } });
+    const bearer = this.bearers.get(worktreeId);
+    if (!bearer || !sameSecret(req.headers.get("authorization"), `Bearer ${bearer}`)) {
+      return new Response("unauthorized", { status: 401 });
+    }
+    const body = await readCapped(req, BODY_MAX_BYTES);
+    if (body === null)
+      return new Response("request body too large", { status: 413 });
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return Response.json(rpcError(null, PARSE_ERROR, "parse error"), { status: 400 });
+    }
+    const batch = Array.isArray(parsed);
+    const messages = batch ? parsed : [parsed];
+    const replies = [];
+    for (const m of messages) {
+      const reply = await this.handle(worktreeId, m);
+      if (reply !== undefined)
+        replies.push(reply);
+    }
+    if (replies.length === 0)
+      return new Response(null, { status: 202 });
+    return Response.json(batch ? replies : replies[0], {
+      status: 200,
+      headers: { "cache-control": "no-store" }
+    });
+  }
+  async handle(worktreeId, raw) {
+    const m = asRecord(raw);
+    if (!m || typeof m.method !== "string")
+      return rpcError(m?.id ?? null, PARSE_ERROR, "parse error");
+    const method = m.method;
+    const id = m.id;
+    const params = asRecord(m.params) ?? {};
+    if (method.startsWith("notifications/"))
+      return;
+    if (id === undefined)
+      return;
+    const ok = (result) => ({ jsonrpc: "2.0", id, result });
+    switch (method) {
+      case "initialize": {
+        const asked = params.protocolVersion;
+        const protocolVersion = typeof asked === "string" && PROTOCOL_VERSIONS.includes(asked) ? asked : DEFAULT_PROTOCOL_VERSION;
+        return ok({
+          protocolVersion,
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: TOYON_MCP_SERVER, version: this.d.version }
+        });
+      }
+      case "ping":
+        return ok({});
+      case "tools/list": {
+        const tools = this.d.tools.list(worktreeId);
+        log.debug(worktreeId, `mcp: tools/list answered with ${tools.map((t) => t.name).join(", ") || "nothing"}`);
+        return ok({ tools });
+      }
+      case "tools/call": {
+        const name = params.name;
+        if (typeof name !== "string" || !this.d.tools.list(worktreeId).some((t) => t.name === name)) {
+          return rpcError(id, INVALID_PARAMS, `unknown tool ${typeof name === "string" ? name : ""}`.trim());
+        }
+        try {
+          const r = await this.d.tools.call(worktreeId, name, params.arguments ?? {});
+          return ok({ content: [{ type: "text", text: r.text }], ...r.isError ? { isError: true } : {} });
+        } catch (e) {
+          if (e instanceof UserError)
+            return ok({ content: [{ type: "text", text: e.message }], isError: true });
+          log.error(worktreeId, `mcp: ${name} failed`, e);
+          return rpcError(id, INTERNAL_ERROR, "internal error");
+        }
+      }
+      default:
+        return rpcError(id, METHOD_NOT_FOUND, `method not found: ${method}`);
+    }
+  }
+}
+async function readCapped(req, max) {
+  const body = req.body;
+  if (!body)
+    return "";
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of body) {
+    total += chunk.byteLength;
+    if (total > max)
+      return null;
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
 // ../daemon/src/agent/acp/options.ts
 var OPTION_FIELDS = { model: "model", thought_level: "effort" };
 var OPTION_CATEGORIES = Object.keys(OPTION_FIELDS);
@@ -13050,7 +13392,7 @@ class OptionProbe {
 }
 
 // ../daemon/src/agent/registry.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname3, isAbsolute, join as join6, resolve as resolve3 } from "path";
 
@@ -13078,7 +13420,7 @@ var cloud = {
 // ../daemon/src/git/exec.ts
 import { spawn as spawn2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 
 // ../daemon/src/core/metrics.ts
@@ -13121,7 +13463,7 @@ function lockfileHash(dir) {
   const h = createHash2("sha1");
   for (const f of LOCKFILES) {
     try {
-      h.update(readFileSync2(join3(dir, f)));
+      h.update(readFileSync3(join3(dir, f)));
     } catch {}
   }
   return h.digest("hex");
@@ -13138,7 +13480,7 @@ function resolveGit() {
     "/opt/homebrew/bin/git",
     "/usr/local/bin/git"
   ]) {
-    if (existsSync(p))
+    if (existsSync2(p))
       return p;
   }
   return "git";
@@ -13441,7 +13783,7 @@ function confine(launch, b, extraWrite = [], platform = process.platform, which
 }
 
 // ../daemon/src/agent/native.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
 var OS = { darwin: "darwin", linux: "linux", win32: "windows" };
 function nativePackage(pkg, host) {
   const os = OS[host.platform];
@@ -13464,14 +13806,14 @@ function hostTraits() {
 }
 function muslLoader() {
   try {
-    return existsSync2("/lib") && readdirSync2("/lib").some((f) => f.startsWith("ld-musl-"));
+    return existsSync3("/lib") && readdirSync2("/lib").some((f) => f.startsWith("ld-musl-"));
   } catch {
     return false;
   }
 }
 function cpuFlags() {
   try {
-    return readFileSync3("/proc/cpuinfo", "utf8").match(/^flags\s*:(.*)$/m)?.[1]?.trim().split(/\s+/) ?? [];
+    return readFileSync4("/proc/cpuinfo", "utf8").match(/^flags\s*:(.*)$/m)?.[1]?.trim().split(/\s+/) ?? [];
   } catch {
     return [];
   }
@@ -13534,7 +13876,7 @@ function opencodeEnv() {
 }
 
 // ../daemon/src/agent/sandbox.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
 import { join as join5, resolve as resolve2 } from "path";
 
@@ -13579,7 +13921,7 @@ function ensureDirs(p) {
 }
 
 // ../daemon/src/git/exclude.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync } from "fs";
 import { dirname } from "path";
 async function excludeFile(cwd) {
   const r = await git(cwd, "rev-parse", "--path-format=absolute", "--git-path", "info/exclude");
@@ -13592,7 +13934,7 @@ async function excludeFromGit(cwd, pattern) {
   const file = await excludeFile(cwd);
   if (!file)
     return;
-  const current = existsSync3(file) ? readFileSync4(file, "utf8") : "";
+  const current = existsSync4(file) ? readFileSync5(file, "utf8") : "";
   if (current.split(`
 `).some((l) => l.trim() === pattern))
     return;
@@ -13608,7 +13950,7 @@ async function excludeBlock(cwd, name, patterns) {
     return;
   const open = `# toyon ${name}`;
   const close = `# toyon end ${name}`;
-  const current = existsSync3(file) ? readFileSync4(file, "utf8") : "";
+  const current = existsSync4(file) ? readFileSync5(file, "utf8") : "";
   const lines = current.split(`
 `);
   const from = lines.indexOf(open);
@@ -13627,9 +13969,9 @@ async function excludeBlock(cwd, name, patterns) {
 }
 async function unexcludeFromGit(cwd, pattern) {
   const file = await excludeFile(cwd);
-  if (!file || !existsSync3(file))
+  if (!file || !existsSync4(file))
     return;
-  const lines = readFileSync4(file, "utf8").split(`
+  const lines = readFileSync5(file, "utf8").split(`
 `);
   const kept = lines.filter((l) => l.trim() !== pattern);
   if (kept.length === lines.length)
@@ -13639,12 +13981,12 @@ async function unexcludeFromGit(cwd, pattern) {
 }
 
 // ../daemon/src/agent/bounds.ts
-import { existsSync as existsSync4, realpathSync } from "fs";
+import { existsSync as existsSync5, realpathSync } from "fs";
 import { basename, dirname as dirname2, resolve, sep } from "path";
 function canonical(p) {
   let probe = p;
   const tail = [];
-  while (!existsSync4(probe)) {
+  while (!existsSync5(probe)) {
     const parent = dirname2(probe);
     if (parent === probe)
       return p;
@@ -13706,9 +14048,9 @@ async function writeClaudeLocalSettings(cwd, b) {
   const file = join5(cwd, SETTINGS_REL);
   mkdirSync4(join5(cwd, ".claude"), { recursive: true });
   let existing = {};
-  if (existsSync5(file)) {
+  if (existsSync6(file)) {
     try {
-      const parsed = JSON.parse(readFileSync5(file, "utf8"));
+      const parsed = JSON.parse(readFileSync6(file, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
         existing = parsed;
     } catch (e) {
@@ -13726,7 +14068,7 @@ async function writeClaudeLocalSettings(cwd, b) {
   writeFileSync2(tmp, `${JSON.stringify(next, null, 2)}
 `);
   renameSync(tmp, file);
-  if (existsSync5(join5(cwd, ".git")))
+  if (existsSync6(join5(cwd, ".git")))
     await excludeFromGit(cwd, SETTINGS_REL);
 }
 
@@ -13740,7 +14082,10 @@ var BUILTIN_AGENTS = [
     short: "Claude",
     builtin: true,
     run: { kind: "npm-bin", pkg: "@agentclientprotocol/claude-agent-acp", version: "0.84.0", bin: "claude-agent-acp" },
-    ...cloud.enabled ? { env: { NO_BROWSER: "1" } } : {},
+    env: {
+      CLAUDE_CODE_ENABLE_FUNCTION_HOOKS: "1",
+      ...cloud.enabled ? { NO_BROWSER: "1" } : {}
+    },
     terminalLogins: {
       "claude-login": { args: ["--cli", "auth", "login", "--claudeai"], env: { NO_BROWSER: "1" }, plan: true }
     },
@@ -13854,18 +14199,18 @@ class AgentRegistry {
     const pkgDir = join6(this.dir, spec.id, "node_modules", name);
     if (spec.run.kind === "npm-native") {
       const bin = join6(pkgDir, spec.run.bin);
-      return existsSync6(bin) ? bin : null;
+      return existsSync7(bin) ? bin : null;
     }
     const pkgJson = join6(pkgDir, "package.json");
-    if (!existsSync6(pkgJson))
+    if (!existsSync7(pkgJson))
       return null;
     try {
-      const meta = JSON.parse(readFileSync6(pkgJson, "utf8"));
+      const meta = JSON.parse(readFileSync7(pkgJson, "utf8"));
       const rel = typeof meta.bin === "string" ? meta.bin : meta.bin?.[spec.run.bin];
       if (!rel)
         return null;
       const script = join6(dirname3(pkgJson), rel);
-      return existsSync6(script) ? script : null;
+      return existsSync7(script) ? script : null;
     } catch (e) {
       log.warn("agents", `cannot read ${pkgJson}`, e);
       return null;
@@ -13885,7 +14230,7 @@ class AgentRegistry {
       return this.installErrors.get(spec.id) ?? (spec.onDemand ? "not installed" : "not installed yet");
     }
     const cmd = spec.run.command;
-    if (isAbsolute(cmd) ? existsSync6(cmd) : Bun.which(cmd))
+    if (isAbsolute(cmd) ? existsSync7(cmd) : Bun.which(cmd))
       return null;
     return `${cmd} not found on PATH`;
   }
@@ -13947,7 +14292,7 @@ class AgentRegistry {
       return null;
     const pkgJson = join6(this.dir, spec.id, "node_modules", name, "package.json");
     try {
-      return JSON.parse(readFileSync6(pkgJson, "utf8")).version ?? null;
+      return JSON.parse(readFileSync7(pkgJson, "utf8")).version ?? null;
     } catch {
       return null;
     }
@@ -13990,8 +14335,9 @@ class AgentRegistry {
   }
 }
 var ID_RE = /^[a-z][a-z0-9-]{0,31}$/;
-function parseCustomAgents(raw) {
-  const out = [];
+var isRecord2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function parseAgentsFile(raw, builtins) {
+  const out = [...builtins];
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -13999,7 +14345,7 @@ function parseCustomAgents(raw) {
     log.warn("agents", "agents.json is not valid JSON; ignoring it", e);
     return out;
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+  if (!isRecord2(parsed)) {
     log.warn("agents", "agents.json must be an object keyed by agent id; ignoring it");
     return out;
   }
@@ -14007,24 +14353,42 @@ function parseCustomAgents(raw) {
     const e = v ?? {};
     const str = (k) => typeof e[k] === "string" && e[k].trim() ? e[k] : undefined;
     const command = str("command");
-    const why = !ID_RE.test(id) ? "id must be lowercase letters, digits and dashes" : !command ? 'needs a non-empty "command"' : e.args !== undefined && !(Array.isArray(e.args) && e.args.every((a) => typeof a === "string")) ? '"args" must be an array of strings' : e.env !== undefined && !(e.env && typeof e.env === "object" && Object.values(e.env).every((x) => typeof x === "string")) ? '"env" must be an object of strings' : e.confinement !== undefined && (e.confinement === "claude-settings" || !CONFINEMENTS.includes(e.confinement)) ? '"confinement" must be "none", "adapter-sandbox" or "toyon-sandbox"' : null;
+    const at = out.findIndex((s) => s.id === id);
+    const tunes = !command && at >= 0 && out[at].builtin;
+    const why = !ID_RE.test(id) ? "id must be lowercase letters, digits and dashes" : !command && !tunes ? 'needs a non-empty "command" (only a builtin is tuned without one)' : e.args !== undefined && !(Array.isArray(e.args) && e.args.every((a) => typeof a === "string")) ? '"args" must be an array of strings' : e.env !== undefined && !(isRecord2(e.env) && Object.values(e.env).every((x) => typeof x === "string")) ? '"env" must be an object of strings' : e.meta !== undefined && !isRecord2(e.meta) ? '"meta" must be an object' : e.confinement !== undefined && (e.confinement === "claude-settings" || !CONFINEMENTS.includes(e.confinement)) ? '"confinement" must be "none", "adapter-sandbox" or "toyon-sandbox"' : null;
     if (why) {
       log.warn("agents", `agents.json: skipping "${id}": ${why}`);
       continue;
     }
-    out.push({
+    const env = e.env;
+    const meta = e.meta;
+    if (tunes) {
+      const base = out[at];
+      out[at] = {
+        ...base,
+        ...env ? { env: { ...base.env, ...env } } : {},
+        ...meta ? { meta } : {}
+      };
+      continue;
+    }
+    const spec = {
       id,
       name: str("name") ?? id,
       builtin: false,
       run: { kind: "command", command, ...e.args ? { args: e.args } : {} },
-      ...e.env ? { env: e.env } : {},
+      ...env ? { env } : {},
+      ...meta ? { meta } : {},
       confinement: e.confinement ?? "none",
       systemPrompt: "prompt-prefix",
       ...str("mode") ? { mode: str("mode") } : {},
       ...str("planMode") ? { modes: { plan: str("planMode"), build: str("mode") } } : {},
       ...str("quickModel") ? { quickModel: str("quickModel") } : {},
       loginHint: str("loginHint") ?? `${str("name") ?? id} is not logged in`
-    });
+    };
+    if (at >= 0)
+      out[at] = spec;
+    else
+      out.push(spec);
   }
   return out;
 }
@@ -14033,8 +14397,8 @@ function managedSpecs(specs, managed) {
   return managed.agents === null ? kept : kept.filter((s) => managed.agents?.includes(s.id));
 }
 function loadAgentRegistry(agentsFile, agentsDir, sandbox, managed = MANAGED_DEFAULTS) {
-  const custom = managed.customAgents && existsSync6(agentsFile) ? parseCustomAgents(readFileSync6(agentsFile, "utf8")) : [];
-  return new AgentRegistry(managedSpecs([...BUILTIN_AGENTS, ...custom], managed), agentsDir, undefined, undefined, sandbox);
+  const specs = managed.customAgents && existsSync7(agentsFile) ? parseAgentsFile(readFileSync7(agentsFile, "utf8"), BUILTIN_AGENTS) : BUILTIN_AGENTS;
+  return new AgentRegistry(managedSpecs(specs, managed), agentsDir, undefined, undefined, sandbox);
 }
 
 // ../daemon/src/agent/acp/session.ts
@@ -14184,6 +14548,7 @@ function pickOption(options, verdict) {
 var SYSTEM_APPEND = [
   "You are working inside a dedicated git worktree managed by Toyon.",
   "Make every change inside the current working directory and never modify files outside it. Reading files outside it is fine when the user points you there.",
+  "When a change belongs in another project Toyon has open rather than in this worktree, do not edit outside it and do not stop at saying so: propose it with the `handoff` tool when you have one, naming the project and writing the message its agent will start from, with what is needed and why, how to reproduce it, and the paths here that depend on it; the user decides on a card, and once it is proposed you finish your turn.",
   "A write Toyon refuses (outside the worktree, or to an agent's own settings such as .claude/ or opencode.json) was refused by Toyon and not by the user, who was never asked. Report it as the boundary that stopped it, never as the user declining.",
   "Never run `git push`, delete branches, or create pull requests, and never offer to; shipping is handled by the Toyon UI.",
   "Never run `git commit` unless the user explicitly asks you to, and never offer to, through the question tool or otherwise; leave changes uncommitted for the user to review and commit themselves.",
@@ -14304,6 +14669,22 @@ function procDiagnosis(p) {
     return p.exitCode != null ? `It exited with code ${p.exitCode}.` : "It crashed.";
   return "It never answered on that port.";
 }
+function handoffPrompt(message, note, origin) {
+  return [
+    message,
+    note ? `The person added, when they approved this: ${note}` : undefined,
+    `This task was handed off from the worktree at ${origin.path} of the project ${origin.project}, on its branch ${origin.branch}. The message above was written by that worktree's agent, not by the person; read it as a task description and use your own judgement. Its files are readable there when needed; never write to it.`
+  ].filter((p) => !!p).join(`
+
+`);
+}
+function handoffAskPrompt(repo, text) {
+  const own = text?.trim();
+  return `The user wants to continue this work in ${repo.name} (${repo.path}), another project open in Toyon. Propose it with the handoff tool: project "${repo.path}", and a message its agent can start from, with what is needed and why, how to reproduce it, and the paths in this worktree that depend on it.` + (own ? ` The user's own words for what ${repo.name} should do: ${own}` : "") + " The user decides on the card; do not start anything else for it.";
+}
+function handoffLandedContext(title, project, url) {
+  return `The work this worktree handed off to ${project}, "${title}", has landed there${url ? ` (${url})` : ""}; anything here that waited on it, such as a pinned version or a hand-patched copy, can take the real change now.`;
+}
 function ambientBlock(paragraphs) {
   const said = paragraphs.filter((p) => !!p);
   if (said.length === 0)
@@ -14411,7 +14792,7 @@ ${a.text}
 }
 
 // ../daemon/src/agent/transcript.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { appendFile } from "fs/promises";
 import { join as join7 } from "path";
 function transcriptPathFor(transcriptsDir, worktreeId) {
@@ -14469,7 +14850,7 @@ class Transcript {
     this.seq = (this.entries.at(-1)?.seq ?? -1) + 1;
   }
   read() {
-    return existsSync7(this.path) ? parseTranscript(readFileSync7(this.path, "utf8"), this.tag) : [];
+    return existsSync8(this.path) ? parseTranscript(readFileSync8(this.path, "utf8"), this.tag) : [];
   }
   append(event) {
     const entry = { seq: this.seq++, event };
@@ -14567,7 +14948,7 @@ async function cleanUp(ctx, a, sessionId) {
 }
 
 // ../daemon/src/agent/acp/background.ts
-import { existsSync as existsSync8, statSync as statSync3 } from "fs";
+import { existsSync as existsSync9, statSync as statSync3 } from "fs";
 import { open as open2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { basename as basename2, dirname as dirname4, join as join8 } from "path";
@@ -14591,7 +14972,7 @@ function sessionLogFor(file, configDir = claudeConfigDir()) {
     return null;
   const session = dirname4(tasks);
   const path = join8(configDir, "projects", basename2(dirname4(session)), `${basename2(session)}.jsonl`);
-  return existsSync8(path) ? path : null;
+  return existsSync9(path) ? path : null;
 }
 function taskEnd(text, toolId) {
   const at = text.indexOf(`<tool-use-id>${toolId}</tool-use-id>`);
@@ -14900,25 +15281,25 @@ function unifiedDiff(oldText, newText, context = 3) {
 
 // ../daemon/src/agent/acp/map.ts
 function spawnOf(meta) {
-  const claude = asRecord(asRecord(meta).claudeCode);
+  const claude = asRecord2(asRecord2(meta).claudeCode);
   const parentToolId = typeof claude.parentToolUseId === "string" ? claude.parentToolUseId : undefined;
-  const codex = asRecord(asRecord(meta).codex).subagent;
+  const codex = asRecord2(asRecord2(meta).codex).subagent;
   const spawns = claude.toolName === "Agent" || claude.toolName === "Task";
-  const subagent = spawns || claude.subagent === true || Object.keys(asRecord(codex)).length > 0;
+  const subagent = spawns || claude.subagent === true || Object.keys(asRecord2(codex)).length > 0;
   return { ...parentToolId ? { parentToolId } : {}, ...subagent ? { subagent: true } : {} };
 }
-function asRecord(v) {
+function asRecord2(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
 var NETWORK_ASK = "SandboxNetworkAccess";
 function isNetworkAsk(update) {
-  return update.name === NETWORK_ASK || asRecord(asRecord(update._meta).claudeCode).toolName === NETWORK_ASK;
+  return update.name === NETWORK_ASK || asRecord2(asRecord2(update._meta).claudeCode).toolName === NETWORK_ASK;
 }
 function isToolSearch(update) {
-  return update.name === TOOL_SEARCH || asRecord(asRecord(update._meta).claudeCode).toolName === TOOL_SEARCH;
+  return update.name === TOOL_SEARCH || asRecord2(asRecord2(update._meta).claudeCode).toolName === TOOL_SEARCH;
 }
 function toolSearchQuery(rawInput) {
-  const query = asRecord(rawInput).query;
+  const query = asRecord2(rawInput).query;
   if (typeof query !== "string")
     return "";
   const names = /^select:(.*)$/.exec(query.trim());
@@ -14926,14 +15307,33 @@ function toolSearchQuery(rawInput) {
     return query.trim();
   return (names[1] ?? "").split(",").map((s) => s.trim()).filter(Boolean).join(", ");
 }
+var TOYON_TOOL = new RegExp(`^(?:mcp__${TOYON_MCP_SERVER}__|${TOYON_MCP_SERVER}/)([A-Za-z0-9_-]+)$`);
+function toyonTool(update) {
+  const meta = asRecord2(asRecord2(update._meta).claudeCode).toolName;
+  for (const spelled of [update.name ?? "", typeof meta === "string" ? meta : ""]) {
+    const m = TOYON_TOOL.exec(spelled);
+    if (m)
+      return m[1];
+  }
+  return null;
+}
+function toyonTitle(tool, rawInput, title) {
+  if (tool !== HANDOFF_TOOL)
+    return title && toyonTool({ name: title }) === null ? title : tool;
+  const project = asRecord2(rawInput).project;
+  return typeof project === "string" && project.trim() ? `Continue in ${project.trim()}` : "Continue in another project";
+}
 function heading(update) {
   const name = typeof update.name === "string" ? update.name : "";
-  const host = asRecord(update.rawInput).host;
+  const host = asRecord2(update.rawInput).host;
   if (isNetworkAsk(update) && typeof host === "string")
     return { name: "", title: host, kind: "fetch" };
   if (isToolSearch(update)) {
     return { name: TOOL_SEARCH, title: toolSearchQuery(update.rawInput) || TOOL_SEARCH, kind: "search" };
   }
+  const own = toyonTool(update);
+  if (own)
+    return { name: own, title: toyonTitle(own, update.rawInput, update.title), kind: "other" };
   return { name, title: update.title, ...update.kind ? { kind: update.kind } : {} };
 }
 function endOfAsk(req, res, memos) {
@@ -15014,7 +15414,7 @@ function mapUpdate(update, memos, tag, sink, background) {
         content: update.content ?? [],
         rawOutput: update.rawOutput,
         ended: false,
-        writing: isWrittenKind(head.kind) && emptyInput(input),
+        writing: writingCall(head, input),
         ...spawn.parentToolId ? { parent: spawn.parentToolId } : {},
         ...spawn.subagent ? { spawns: true } : {}
       };
@@ -15045,7 +15445,7 @@ function mapUpdate(update, memos, tag, sink, background) {
           input,
           content: [],
           ended: false,
-          writing: isWrittenKind(update.kind ?? undefined) && emptyInput(input),
+          writing: writingCall({ name: update.name ?? "", kind: update.kind ?? undefined }, input),
           ...spawn.parentToolId ? { parent: spawn.parentToolId } : {},
           ...spawn.subagent ? { spawns: true } : {}
         };
@@ -15061,10 +15461,10 @@ function mapUpdate(update, memos, tag, sink, background) {
         });
       }
       const refined = { ...memo.held };
-      const title = memo.name === TOOL_SEARCH ? toolSearchQuery(update.rawInput) : update.title;
+      const title = memo.name === TOOL_SEARCH ? toolSearchQuery(update.rawInput) : memo.name === HANDOFF_TOOL ? update.rawInput !== undefined ? toyonTitle(HANDOFF_TOOL, update.rawInput, update.title) : undefined : update.title;
       if (title && title !== memo.title)
         refined.title = memo.title = title;
-      if (update.name && update.name !== memo.name)
+      if (update.name && update.name !== memo.name && toyonTool(update) !== memo.name)
         refined.name = memo.name = update.name;
       if (update.kind && update.kind !== memo.kind)
         refined.kind = memo.kind = update.kind;
@@ -15214,6 +15614,46 @@ function mapStopReason(r) {
   return r === "cancelled" ? "interrupted" : r;
 }
 
+// ../daemon/src/agent/acp/ratelimit.ts
+var RATE_LIMIT_META = "_claude/rateLimit";
+var STATUSES = new Set(["allowed", "allowed_warning", "rejected"]);
+var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined;
+function window(v) {
+  const w = v;
+  if (!w || typeof w !== "object")
+    return;
+  const used = num(w.utilization);
+  const resetsAt = num(w.resetsAt);
+  if (used === undefined || resetsAt === undefined)
+    return;
+  return { used: Math.max(0, used), resetsAt: resetsAt * 1000 };
+}
+function parseRateLimit(meta, now) {
+  const info = meta?.[RATE_LIMIT_META];
+  if (!info || typeof info !== "object")
+    return null;
+  const status = info.status;
+  if (!STATUSES.has(status))
+    return null;
+  const binding = typeof info.rateLimitType === "string" ? info.rateLimitType : undefined;
+  const unified = info.unifiedWindows ?? undefined;
+  const windows = {};
+  const fiveHour = window(unified?.five_hour);
+  const sevenDay = window(unified?.seven_day);
+  if (fiveHour)
+    windows.five_hour = fiveHour;
+  if (sevenDay)
+    windows.seven_day = sevenDay;
+  if (!fiveHour && !sevenDay && (binding === "five_hour" || binding === "seven_day")) {
+    const top = window({ utilization: info.utilization, resetsAt: info.resetsAt });
+    if (top)
+      windows[binding] = top;
+  }
+  if (!windows.five_hour && !windows.seven_day)
+    return null;
+  return { status, ...binding ? { binding } : {}, windows, at: now };
+}
+
 // ../daemon/src/agent/acp/steering.ts
 var STEER_METHOD = "_session/steering";
 function supportsSteering(init) {
@@ -15258,6 +15698,7 @@ class AcpSession {
   tasks;
   asking = 0;
   asks = new Map;
+  openHandoffs = new Set;
   log;
   seq;
   commandList = [];
@@ -15295,6 +15736,17 @@ class AcpSession {
       this.emit({ type: "tool-end", toolId, output: output.join(`
 `), isError: true });
     }
+    for (const { event } of this.log.entries)
+      this.trackHandoff(event);
+    if (this.openHandoffs.size > 0)
+      this.syncStatus();
+  }
+  trackHandoff(event) {
+    if (event.type === "handoff-proposed")
+      return this.openHandoffs.add(event.id).size > 0;
+    if (event.type === "handoff" || event.type === "handoff-declined")
+      return this.openHandoffs.delete(event.id);
+    return false;
   }
   get commands() {
     return this.commandList;
@@ -15305,6 +15757,12 @@ class AcpSession {
       return;
     await this.warm();
   }
+  modeChanged() {
+    const live = this.live;
+    if (!live || this.stopped)
+      return;
+    fireAndForget(this.d.worktreeId, this.applyMode(live), "mode change mid-session");
+  }
   async warm() {
     if (this.stopped)
       return;
@@ -15318,6 +15776,9 @@ class AcpSession {
   get runningAgent() {
     return this.conn?.spec.id ?? null;
   }
+  get mcpTools() {
+    return this.conn ? this.conn.mcpServers.length > 0 : null;
+  }
   pgid_ = null;
   get pgid() {
     return this.pgid_;
@@ -15376,6 +15837,8 @@ class AcpSession {
   }
   note(event) {
     this.emit(event);
+    if (this.trackHandoff(event))
+      this.syncStatus();
   }
   emit(event) {
     const entry = this.log.append(event);
@@ -15519,7 +15982,7 @@ class AcpSession {
         this.interrupted = false;
         this.steered = [];
       }
-      this.setStatus("idle");
+      this.setStatus(this.openHandoffs.size > 0 ? "waiting" : "idle");
     } catch (e) {
       if (this.conn && (isAuthRequired(e) || this.rejectedCredential(e))) {
         const rejected = !isAuthRequired(e);
@@ -15690,7 +16153,23 @@ class AcpSession {
     this.emit({ type: "turn-end", stopReason: mapStopReason(res.stopReason), ts: Date.now() });
   }
   contextFor(item) {
-    return ambientBlock([...item.context ?? [], this.d.preview?.()]);
+    return ambientBlock([...item.context ?? [], this.d.preview?.(), ...this.landedSince()]);
+  }
+  landedSince() {
+    const entries = this.log.entries;
+    const isMessage = (e) => e.type === "user-message" || e.type === "fix-asked";
+    let i = entries.length - 1;
+    while (i >= 0 && !isMessage(entries[i].event))
+      i--;
+    const out = [];
+    for (i--;i >= 0; i--) {
+      const e = entries[i].event;
+      if (isMessage(e))
+        break;
+      if (e.type === "handoff-landed")
+        out.unshift(handoffLandedContext(e.title, e.repoName, e.url));
+    }
+    return out;
   }
   ensureConn(why) {
     if (this.conn)
@@ -15723,6 +16202,7 @@ class AcpSession {
         log.warn(this.d.worktreeId, "agent process exited while idle");
         this.conn = null;
         this.live = null;
+        this.d.mcp?.close();
         this.cancelAsks();
         this.tasks.endAll("the agent stopped, and the command with it");
         this.endOwn("interrupted");
@@ -15749,6 +16229,7 @@ class AcpSession {
         deleteSupported: !!init.agentCapabilities?.sessionCapabilities?.delete,
         acceptsImages: init.agentCapabilities?.promptCapabilities?.image === true,
         steering: supportsSteering(init),
+        mcpServers: takesHttpMcp(init) && this.d.mcp ? [this.d.mcp.open()] : [],
         side,
         commands
       };
@@ -15775,6 +16256,7 @@ class AcpSession {
   }
   async openLive(conn) {
     const additionalDirectories = conn.bounds.gitDir ? [conn.bounds.gitDir] : [];
+    const meta = sessionMeta(conn.spec);
     let sessionId = this.d.getSessionId();
     let modes;
     let configOptions;
@@ -15784,9 +16266,9 @@ class AcpSession {
         const r = await conn.ctx.request(methods.agent.session.resume, {
           sessionId,
           cwd: this.d.cwd,
-          mcpServers: [],
+          mcpServers: conn.mcpServers,
           additionalDirectories,
-          ...conn.spec.systemPrompt === "meta-append" ? { _meta: { systemPrompt: { append: SYSTEM_APPEND } } } : {}
+          ...meta ? { _meta: meta } : {}
         });
         modes = r.modes;
         configOptions = r.configOptions;
@@ -15800,9 +16282,9 @@ class AcpSession {
     if (!resumed) {
       const r = await conn.ctx.request(methods.agent.session.new, {
         cwd: this.d.cwd,
-        mcpServers: [],
+        mcpServers: conn.mcpServers,
         additionalDirectories,
-        ...conn.spec.systemPrompt === "meta-append" ? { _meta: { systemPrompt: { append: SYSTEM_APPEND } } } : {}
+        ...meta ? { _meta: meta } : {}
       });
       sessionId = r.sessionId;
       modes = r.modes;
@@ -15903,12 +16385,23 @@ class AcpSession {
     if (!live || params.sessionId !== live.sessionId) {
       return log.debug(this.d.worktreeId, `acp: update for another session ${params.sessionId} dropped`);
     }
+    if (params.update.sessionUpdate === "usage_update" && this.conn) {
+      const limits = parseRateLimit(params.update._meta, Date.now());
+      if (limits)
+        this.d.onLimits?.(this.conn.spec.id, limits);
+    }
     if (params.update.sessionUpdate === "current_mode_update") {
       live.modeId = params.update.currentModeId;
       return;
     }
-    if (params.update.sessionUpdate === "config_option_update")
+    if (params.update.sessionUpdate === "config_option_update") {
+      const before = live.options;
       this.absorb(live, params.update.configOptions);
+      for (const [category, opt] of live.options) {
+        if (before.get(category)?.current !== opt.current)
+          this.d.onOptionChanged?.(category, opt.current);
+      }
+    }
     const events = mapUpdate(params.update, live.tools, this.d.worktreeId, (file, bytes) => fireAndForget(this.d.worktreeId, this.d.attachments.putToolImage(this.d.worktreeId, file, bytes), "tool image"), (toolId, start, input) => this.tasks.start(toolId, start, input));
     this.forward(live, events);
     this.holdInput(live, params.update);
@@ -15968,14 +16461,16 @@ class AcpSession {
   }
   async askPermission(params) {
     const plan = params.toolCall.kind === "switch_mode";
-    const detail = permissionDetail(params);
+    const parts = permissionParts(params);
+    const detail = parts.detail ?? "";
     const planPath = plan ? await this.d.onPlan?.(detail) ?? null : null;
     const offered = plan ? params.options : params.options.filter((o) => o.kind !== "allow_always");
     const choices = offered.map((o) => ({ id: o.optionId, name: o.name, kind: o.kind }));
     return this.openAsk((id) => ({
       type: "agent-permission",
       id,
-      title: params.toolCall.title ?? params.toolCall.name ?? "the agent needs a decision",
+      title: parts.title,
+      ...parts.command ? { command: parts.command } : {},
       ...detail ? { detail } : {},
       ...planPath ? { plan: planPath } : {},
       choices,
@@ -16056,7 +16551,8 @@ class AcpSession {
   syncStatus() {
     if (this.status === "error")
       return;
-    this.setStatus(this.asks.size > 0 ? "waiting" : this.running || this.own ? "working" : "idle");
+    const waiting = this.asks.size > 0 || this.openHandoffs.size > 0;
+    this.setStatus(waiting ? "waiting" : this.running || this.own ? "working" : "idle");
   }
   trackOwn(events) {
     if (!this.own) {
@@ -16123,6 +16619,7 @@ class AcpSession {
     const conn = this.conn;
     this.conn = null;
     this.live = null;
+    this.d.mcp?.close();
     if (!conn)
       return;
     log.info(this.d.worktreeId, `agent ${conn.spec.id} stopped: ${why} (pid ${conn.link.pid ?? "unknown"})`);
@@ -16134,12 +16631,21 @@ class AcpSession {
 function isAuthRequired(e) {
   return e instanceof RequestError && e.code === -32000;
 }
+function takesHttpMcp(init) {
+  const http = init.agentCapabilities?.mcpCapabilities?.http;
+  return http === true || typeof http === "object" && http !== null;
+}
 var DETAIL_LINES = 80;
-function permissionDetail(params) {
+function stringField(raw, key) {
+  const v = raw && typeof raw === "object" ? raw[key] : undefined;
+  return typeof v === "string" && v.trim() ? v : undefined;
+}
+function permissionParts(params) {
+  const { toolCall } = params;
   const parts = [];
-  for (const c of params.toolCall.content ?? []) {
+  for (const c of toolCall.content ?? []) {
     if (c.type === "content" && c.content.type === "text")
-      parts.push(c.content.text);
+      parts.push({ text: true, md: c.content.text });
     else if (c.type === "diff") {
       const lines = c.newText.split(`
 `);
@@ -16147,27 +16653,37 @@ function permissionDetail(params) {
 `);
       const more = lines.length > DETAIL_LINES ? `
 \u2026 ${lines.length - DETAIL_LINES} more lines` : "";
-      parts.push(`\`${c.path}\`
+      parts.push({ text: false, md: `\`${c.path}\`
 
 \`\`\`
 ${shown}${more}
-\`\`\``);
+\`\`\`` });
     }
   }
-  if (parts.length > 0)
-    return parts.join(`
+  const raw = toolCall.rawInput;
+  const command = stringField(raw, "command");
+  if (!command) {
+    const detail = parts.map((p) => p.md).join(`
+
+`) || stringField(raw, "plan") || "";
+    return { title: toolCall.title ?? toolCall.name ?? "the agent needs a decision", ...detail ? { detail } : {} };
+  }
+  const same = (a, b) => a.trim() === b.trim();
+  const prose = (s) => s && !same(s, command) && s !== toolCall.name ? s : undefined;
+  const title = stringField(raw, "description") ?? parts.find((p) => p.text && prose(p.md))?.md ?? prose(toolCall.title ?? undefined) ?? "run this command?";
+  const detail = parts.filter((p) => !(p.text && (same(p.md, title) || same(p.md, command)))).map((p) => p.md).join(`
 
 `);
-  const raw = params.toolCall.rawInput;
-  if (typeof raw?.plan === "string")
-    return raw.plan;
-  if (typeof raw?.command === "string")
-    return `\`\`\`sh
-${raw.command}
-\`\`\``;
-  return "";
+  return { title, command, ...detail ? { detail } : {} };
 }
 var REJECTED_CREDENTIAL_RE = /\b401\b|unauthorized|invalid[\s_-]?api[\s_-]?key|authentication[\s_-]?(error|failed)|api key (is )?(invalid|expired|incorrect)|incorrect api key|(token|credential)s? (have |has )?expired|expired (token|credential)|not (logged in|authenticated)/i;
+function sessionMeta(spec) {
+  const meta = {
+    ...spec.meta,
+    ...spec.systemPrompt === "meta-append" ? { systemPrompt: { append: SYSTEM_APPEND } } : {}
+  };
+  return Object.keys(meta).length > 0 ? meta : undefined;
+}
 function terminalLogin(m) {
   if ("type" in m && m.type === "terminal")
     return { own: false, args: m.args ?? [] };
@@ -16192,27 +16708,41 @@ function sameCommands(a, b) {
 }
 
 // ../daemon/src/agent/planDoc.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
 import { join as join9 } from "path";
 var PLANS_DIR = join9(".toyon", "plans");
 var PLAN_NAME = /^(\d+)\.md$/;
 function isPlanPath(rel) {
   return rel.startsWith(`${PLANS_DIR}/`) && PLAN_NAME.test(rel.slice(PLANS_DIR.length + 1));
 }
-function nextNumber(dir) {
-  if (!existsSync9(dir))
-    return 1;
+function lastNumber(dir) {
+  if (!existsSync10(dir))
+    return 0;
   let max = 0;
   for (const name of readdirSync3(dir)) {
     const n = Number(PLAN_NAME.exec(name)?.[1]);
     if (n > max)
       max = n;
   }
-  return max + 1;
+  return max;
+}
+function sameAsLast(cwd, rel, markdown) {
+  try {
+    return readFileSync9(join9(cwd, rel), "utf8").trim() === markdown.trim();
+  } catch (e) {
+    log.warn(cwd, `could not read ${rel}`, e);
+    return false;
+  }
 }
 async function writePlanDoc(cwd, markdown) {
   const dir = join9(cwd, PLANS_DIR);
-  const rel = join9(PLANS_DIR, `${nextNumber(dir)}.md`);
+  const last = lastNumber(dir);
+  if (last > 0) {
+    const newest = join9(PLANS_DIR, `${last}.md`);
+    if (sameAsLast(cwd, newest, markdown))
+      return newest;
+  }
+  const rel = join9(PLANS_DIR, `${last + 1}.md`);
   try {
     mkdirSync6(dir, { recursive: true });
     writeFileSync4(join9(cwd, rel), markdown.endsWith(`
@@ -16227,10 +16757,10 @@ async function writePlanDoc(cwd, markdown) {
 }
 function planEdited(cwd, rel, proposed) {
   const file = join9(cwd, rel);
-  if (!existsSync9(file))
+  if (!existsSync10(file))
     return false;
   try {
-    return readFileSync8(file, "utf8").trim() !== proposed.trim();
+    return readFileSync9(file, "utf8").trim() !== proposed.trim();
   } catch (e) {
     log.warn(cwd, `could not read ${rel}`, e);
     return false;
@@ -16548,6 +17078,26 @@ function orphansIn(ledger, rows, bootId, ledgerBootId, now) {
   }
   return out;
 }
+function strayProcs(rows, worktreesDir, livePaths) {
+  const root = worktreesDir.endsWith("/") ? worktreesDir : `${worktreesDir}/`;
+  const seen = new Set;
+  const out = [];
+  for (const r of rows) {
+    if (r.ppid !== 1 || seen.has(r.pgid) || r.pgid === process.pid)
+      continue;
+    const at = r.command.indexOf(root);
+    if (at === -1)
+      continue;
+    const [repoDir, wtDir] = r.command.slice(at + root.length).split(/\s/, 1)[0].split("/");
+    if (!repoDir || !wtDir)
+      continue;
+    if (livePaths.has(`${root}${repoDir}/${wtDir}`))
+      continue;
+    seen.add(r.pgid);
+    out.push({ worktreeId: "daemon", pgid: r.pgid, name: wtDir });
+  }
+  return out;
+}
 function strayAdapters(rows, agentsDir) {
   return rows.filter((r) => r.pid === r.pgid && r.ppid === 1 && r.command.includes(agentsDir));
 }
@@ -16683,131 +17233,17 @@ function expandEnv(env, vars) {
   return out;
 }
 
-// ../daemon/src/core/remote.ts
-import { createHmac, timingSafeEqual } from "crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
-function loadRemote(file, env = process.env, managed = MANAGED_DEFAULTS) {
-  if (env.TOYON_CLOUD === "1") {
-    const host = (env.TOYON_PUBLIC_HOST ?? "").toLowerCase();
-    if (!isRemoteHost(host)) {
-      throw new Error(`TOYON_CLOUD=1 needs TOYON_PUBLIC_HOST, the name the edge answers for; got "${host}"`);
-    }
-    const previews = env.TOYON_PREVIEWS ?? portPreviews(host);
-    const why = checkPreviews(previews, host);
-    if (why)
-      throw new Error(`TOYON_PREVIEWS: ${why}`);
-    return { host, previews, front: "edge" };
-  }
-  if (!existsSync10(file))
-    return null;
-  if (managed.remote === "off") {
-    log.warn("remote", `${file} is ignored: remote access is turned off by your organization's policy`);
-    return null;
-  }
-  const view = parseRemote(readFileSync9(file, "utf8"));
-  if (!view) {
-    log.warn("remote", `${file} names no valid host or previews; remote access is off`);
-    return null;
-  }
-  if (managed.remote === "tailscale" && !view.host.endsWith(".ts.net")) {
-    log.warn("remote", `${file} names ${view.host}; your organization's policy allows a tailnet name only, so remote access is off`);
-    return null;
-  }
-  return { ...view, front: "local" };
-}
-function sameSecret(given, want) {
-  if (given === null)
-    return false;
-  const a = Buffer.from(given);
-  const b = Buffer.from(want);
-  return a.length === b.length && timingSafeEqual(a, b);
-}
-var isLoopbackPeer = (ip) => ip === "127.0.0.1" || ip === "::1" || ip.startsWith("::ffff:127.");
-var isLoopbackHost = (h) => h === "127.0.0.1" || h === "localhost" || h.endsWith(".localhost");
-function requestedAuthority(req) {
-  const host = (req.headers.get("host") ?? "").toLowerCase();
-  if (host.includes(":"))
-    return host;
-  const port = req.headers.get("x-forwarded-port");
-  return port && /^\d{1,5}$/.test(port) && port !== "443" ? `${host}:${port}` : host;
-}
-var forbidden = (body = "forbidden") => ({ kind: "refused", response: new Response(body, { status: 403 }) });
-function door(req, peer, remote, listener) {
-  if (remote === null && listener === "preview")
-    return { kind: "local" };
-  if (remote?.front !== "edge" && !isLoopbackPeer(peer))
-    return forbidden();
-  const authority = requestedAuthority(req);
-  const host = authority.split(":")[0] ?? "";
-  if (isLoopbackHost(host)) {
-    return remote?.front === "edge" ? forbidden() : { kind: "local" };
-  }
-  if (remote === null)
-    return forbidden();
-  const preview = matchPreview(remote.previews, authority);
-  let worktreeId = null;
-  if (listener === "daemon") {
-    if (preview !== null && "id" in preview)
-      worktreeId = preview.id;
-    else if (preview !== null || host !== remote.host)
-      return forbidden();
-  } else if (preview === null || "id" in preview) {
-    return forbidden();
-  }
-  if (req.headers.get("x-forwarded-proto") !== "https") {
-    return forbidden(`${host} reaches Toyon over https only; the front must terminate TLS`);
-  }
-  if (listener === "preview")
-    return { kind: "preview", worktreeId: null };
-  return worktreeId === null ? { kind: "shell" } : { kind: "preview", worktreeId };
-}
-var PREVIEW_COOKIE = "toyon_preview";
-function previewGrant(token) {
-  return createHmac("sha256", token).update("toyon preview grant").digest("hex");
-}
-function grantCookie(grant, name) {
-  return `${PREVIEW_COOKIE}=${grant}; Domain=${name}; Path=/; Max-Age=34560000; HttpOnly; Secure; SameSite=Strict`;
-}
-function takeGrant(cookie, grant) {
-  let ok = false;
-  const kept = [];
-  for (const part of (cookie ?? "").split(";")) {
-    const pair = part.trim();
-    if (pair === "")
-      continue;
-    const eq = pair.indexOf("=");
-    if (eq > 0 && pair.slice(0, eq) === PREVIEW_COOKIE) {
-      if (sameSecret(pair.slice(eq + 1), grant))
-        ok = true;
-      continue;
-    }
-    kept.push(pair);
-  }
-  return { ok, rest: kept.length ? kept.join("; ") : null };
-}
-function passPreview(req, grant) {
-  const pass = takeGrant(req.headers.get("cookie"), grant);
-  if (!pass.ok) {
-    return {
-      ok: false,
-      response: new Response(`<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="3"></head>` + `<body>This preview opens from Toyon; open your Toyon link first.</body></html>`, { status: 403, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } })
-    };
-  }
-  const headers = new Headers(req.headers);
-  if (pass.rest === null)
-    headers.delete("cookie");
-  else
-    headers.set("cookie", pass.rest);
-  return { ok: true, req: new Request(req, { headers }) };
-}
-function setsGrant(line) {
-  return line.slice(0, line.indexOf("=")).trim() === PREVIEW_COOKIE;
-}
-
 // ../daemon/src/runtime/proxy.ts
 var DIAL_TIMEOUT_MS = 5000;
 var frame = (ev) => typeof ev.data === "string" ? ev.data : new Uint8Array(ev.data);
 var VITE_PING = "text/x-vite-ping";
+var ORIGIN_KEYED = "origin-agent-cluster";
+function placeholder(status) {
+  return new Response(waitingPage(), {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8", "retry-after": "2", [ORIGIN_KEYED]: "?1" }
+  });
+}
 function previewHandler(opts) {
   const hostPart = (t) => t.host.includes(":") ? `[${t.host}]` : t.host;
   return {
@@ -16825,12 +17261,8 @@ function previewHandler(opts) {
       let target = opts.getTarget();
       if (target == null && !machine && opts.ready)
         target = await opts.ready();
-      if (target == null) {
-        return new Response(waitingPage(), {
-          status: 503,
-          headers: { "content-type": "text/html; charset=utf-8", "retry-after": "2" }
-        });
-      }
+      if (target == null)
+        return placeholder(503);
       if (isUpgrade) {
         const proto = req.headers.get("sec-websocket-protocol") ?? undefined;
         const upstreamUrl = `ws://${hostPart(target)}:${target.port}${url.pathname}${url.search}`;
@@ -16856,20 +17288,18 @@ function previewHandler(opts) {
           redirect: "manual"
         });
       } catch {
-        return new Response(waitingPage(), {
-          status: 502,
-          headers: { "content-type": "text/html; charset=utf-8", "retry-after": "2" }
-        });
+        return placeholder(502);
       }
       const html = (res.headers.get("content-type") ?? "").includes("text/html");
       const encoded = res.headers.has("content-encoding");
       const cookies = res.headers.getSetCookie();
       const grantSet = cookies.some(setsGrant);
-      if (!html && !encoded && !grantSet)
-        return res;
       const h = new Headers(res.headers);
-      h.delete("content-length");
-      h.delete("content-encoding");
+      h.set(ORIGIN_KEYED, "?1");
+      if (html || encoded) {
+        h.delete("content-length");
+        h.delete("content-encoding");
+      }
       if (grantSet) {
         h.delete("set-cookie");
         for (const c of cookies)
@@ -16923,7 +17353,9 @@ function startProxy(opts) {
         return d.response;
       let admitted = req;
       if (d.kind === "preview") {
-        const pass = passPreview(req, opts.grant);
+        if (!opts.gate)
+          return new Response("forbidden", { status: 403 });
+        const pass = passPreview(req, opts.gate);
         if (!pass.ok)
           return pass.response;
         admitted = pass.req;
@@ -17513,6 +17945,7 @@ var PREVIEW_WAKE_MS = 8000;
 var PREVIEW_POLL_MS = 100;
 var PROC_UP_MS = 60000;
 function defaultAgent(wt, d, preview, onProcess) {
+  const mcp = d.mcp;
   const agent = new AcpSession({
     worktreeId: wt.id,
     cwd: wt.path,
@@ -17538,16 +17971,13 @@ function defaultAgent(wt, d, preview, onProcess) {
     onStatus: (status) => d.hub.emit("agentStatus", wt.id, status),
     beforeTurn: async () => d.turnStarting?.(wt.id),
     onAuth: (agentId, o) => d.accounts?.observe(agentId, o),
+    onLimits: (agentId, limits) => d.accounts?.observeLimits(agentId, limits),
     seedCommands: () => d.state.cachedCommands(d.state.requireWorktree(wt.id).agent ?? "", wt.repoId),
     onCommandsLearned: (commands) => d.state.setCachedCommands(d.state.requireWorktree(wt.id).agent ?? "", wt.repoId, commands),
     mode: () => d.state.requireWorktree(wt.id).mode ?? DEFAULT_PERMISSION_MODE,
     setMode: (mode) => {
-      const w = d.state.requireWorktree(wt.id);
-      if (w.mode === mode)
-        return;
-      w.mode = mode;
-      d.state.save();
-      d.hub.emit("worktreesChanged");
+      if (d.state.setMode(wt.id, mode))
+        d.hub.emit("worktreesChanged");
     },
     onPlan: async (markdown) => {
       const w = d.state.worktree(wt.id);
@@ -17570,7 +18000,17 @@ function defaultAgent(wt, d, preview, onProcess) {
       const agentId = d.state.requireWorktree(wt.id).agent ?? "";
       if (d.state.setCachedOptions(agentId, category, choices))
         d.hub.emit("agentsChanged");
-    }
+    },
+    onOptionChanged: (category, value) => {
+      const w = d.state.requireWorktree(wt.id);
+      const field = OPTION_FIELDS[category];
+      if (w[field] === value)
+        return;
+      w[field] = value;
+      d.state.save();
+      d.hub.emit("worktreesChanged");
+    },
+    ...mcp ? { mcp: { open: () => mcp.open(wt.id), close: () => mcp.close(wt.id) } } : {}
   });
   agent.onQueueChange = () => d.hub.emit("queue", wt.id, agent.queueItems);
   agent.onCommandsChange = (commands) => d.hub.emit("agentCommands", wt.id, commands);
@@ -17587,7 +18027,7 @@ function defaultProxy(wt, previewName, procs, d, wake) {
     port: wt.proxyPort,
     hostname: cloud.bindHost,
     remote: d.remote ?? null,
-    grant: d.grant ?? "",
+    gate: d.gate ?? null,
     bridgeScript: d.bridgeScript,
     getTarget: () => previewTargetOf(procs, previewName),
     onRequest: wake.onRequest,
@@ -18296,6 +18736,11 @@ class RuntimeRegistry {
     const before = new Map(this.deps.state.groups(id).map((g) => [g.pgid, g]));
     const now = Date.now();
     const next = live.map((g) => ({ ...g, startedAt: before.get(g.pgid)?.startedAt ?? now }));
+    const alive = this.deps.groupAlive ?? groupAlive;
+    for (const [pgid, g] of before) {
+      if (!live.some((l) => l.pgid === pgid) && alive(pgid))
+        next.push(g);
+    }
     this.deps.state.setGroups(id, next);
   }
   async reclaimOrphans() {
@@ -18310,6 +18755,13 @@ class RuntimeRegistry {
       seen.add(row.pgid);
       found.push({ worktreeId: "daemon", pgid: row.pgid, name: "adapter" });
     }
+    const livePaths = new Set(state.worktrees.map((w) => w.path));
+    for (const o of strayProcs(rows, this.deps.paths.worktreesDir, livePaths)) {
+      if (seen.has(o.pgid))
+        continue;
+      seen.add(o.pgid);
+      found.push(o);
+    }
     const reclaim = this.deps.reclaim ?? reclaimGroup;
     await Promise.all(found.map(async (o) => {
       await reclaim(o.pgid);
@@ -18325,11 +18777,11 @@ class RuntimeRegistry {
 }
 
 // ../daemon/src/worktrees/naming.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import { existsSync as existsSync11 } from "fs";
 import { join as join10 } from "path";
 function shortId() {
-  return randomBytes2(5).toString("hex");
+  return randomBytes3(5).toString("hex");
 }
 function freeSlot(parent) {
   for (;; ) {
@@ -18475,6 +18927,10 @@ function openAskOf(entries) {
       open.set(e.id, e.title);
     else if (e.type === "agent-ask-end")
       open.delete(e.id);
+    else if (e.type === "handoff-proposed")
+      open.set(e.id, `Continue in ${e.repo.name}?`);
+    else if (e.type === "handoff" || e.type === "handoff-declined")
+      open.delete(e.id);
   }
   const last = [...open.values()].at(-1)?.trim();
   return last ? clip(last) : undefined;
@@ -18519,6 +18975,7 @@ var LAND_SYSTEM = "You judge whether a coding task is finished, recap where it s
 var LAND_ASK = [
   "A coding agent just stopped in a git worktree. Decide whether the work is finished and ready to merge, or still in progress: a question the agent is waiting on, a step it said it would do next, or a part of the request it did not get to.",
   "The agent never commits: every change is left uncommitted for the user, and the agent saying so is normal, not a sign the work is unfinished.",
+  "The replies are oldest first and the agent's last word is where the work stands now; it supersedes the earlier ones. A check, test or job an earlier reply said was still running is done if the last word says so, and is a step still to do only when the last word itself is waiting on it.",
   "Reply with exactly this shape and nothing else:",
   "Line 1: READY, or NOT READY: <what is still left to do, under 8 words, about the change itself and not the conversation>",
   "Line 2: blank",
@@ -18543,7 +19000,7 @@ ${i.recentSubjects.map((s) => `  ${s}`).join(`
     head.push(`Note from the user for the commit message, to be reflected in its wording: ${clip(i.note.trim(), 500)}`);
   const diff = `Diff summary:
 ${i.diffStat.trim() || "(none)"}`;
-  let blocks = i.turns.slice(-LAND_TURNS).map(turnBlock);
+  let blocks = turnBlocks(i.turns);
   const size = () => [...head, "", ...blocks, "", diff].join(`
 
 `).length;
@@ -18556,14 +19013,18 @@ ${i.diffStat.trim() || "(none)"}`;
 
 `);
 }
-function turnBlock(t) {
+function turnBlocks(turns) {
+  const newest = turns.slice(-LAND_TURNS);
+  return newest.map((t, n) => turnBlock(t, n === newest.length - 1));
+}
+function turnBlock(t, last) {
   const lines = [];
   if (t.asks.length)
     lines.push(`User asked: ${clip(t.asks.join(" / "), 400)}`);
   if (t.fixes.length)
     lines.push(`Toyon, not the user, asked for a fix: ${clip(t.fixes.join(" / "), 400)}`);
   if (t.reply.trim())
-    lines.push(`Agent ended with: ${clip(t.reply, 1000)}`);
+    lines.push(`${last ? "Agent's last word, where the work stands now" : "Agent ended with"}: ${clip(t.reply, 1000)}`);
   return lines.join(`
 `);
 }
@@ -18577,7 +19038,7 @@ function answerPrompt(i) {
   const head = [ANSWER_ASK, "", `Task: ${clip(i.title, 200)}`];
   if (i.firstAsk)
     head.push(`First request: ${clip(i.firstAsk, 300)}`);
-  let blocks = i.turns.slice(-LAND_TURNS).map(turnBlock);
+  let blocks = turnBlocks(i.turns);
   const size = () => [...head, "", ...blocks].join(`
 
 `).length;
@@ -19284,6 +19745,40 @@ function folderDialog() {
   };
 }
 
+// ../daemon/src/core/grants.ts
+import { randomBytes as randomBytes4 } from "crypto";
+class GrantCodes {
+  live = [];
+  ttlMs;
+  max;
+  now;
+  constructor(opts = {}) {
+    this.ttlMs = opts.ttlMs ?? 60000;
+    this.max = opts.max ?? 32;
+    this.now = opts.now ?? Date.now;
+  }
+  mint() {
+    this.sweep();
+    const code = randomBytes4(9).toString("base64url");
+    this.live.push({ code, until: this.now() + this.ttlMs });
+    if (this.live.length > this.max)
+      this.live.splice(0, this.live.length - this.max);
+    return { code, ms: this.ttlMs };
+  }
+  redeem(code) {
+    this.sweep();
+    const i = this.live.findIndex((g) => sameSecret(code, g.code));
+    if (i < 0)
+      return false;
+    this.live.splice(i, 1);
+    return true;
+  }
+  sweep() {
+    const t = this.now();
+    this.live = this.live.filter((g) => t < g.until);
+  }
+}
+
 // ../daemon/src/core/hub.ts
 class Hub {
   listeners = new Map;
@@ -19563,8 +20058,21 @@ class SelfWatch {
 }
 
 // ../daemon/src/core/state.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 import { existsSync as existsSync14, readFileSync as readFileSync10, renameSync as renameSync2, writeFileSync as writeFileSync5 } from "fs";
+var TRUSTED_MAX = 16;
+function isShellOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (url.origin !== origin)
+    return false;
+  return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHost(url.hostname);
+}
+var DAEMON_GROUPS = "daemon";
 var GROUPS_SAVE_MS = 250;
 var SEEN_WORKTREES = 50;
 var empty = { repos: [], worktrees: [], sessions: {} };
@@ -19602,7 +20110,7 @@ function loadState(paths) {
       delete state.seen?.[id];
   }
   for (const id of Object.keys(state.groups ?? {})) {
-    if (!ids.has(id) && !id.startsWith("disc-"))
+    if (!ids.has(id) && !id.startsWith("disc-") && id !== DAEMON_GROUPS)
       delete state.groups?.[id];
   }
   if (state.modelCache) {
@@ -19625,7 +20133,7 @@ function loadOrCreateToken(paths) {
   const TOKEN_FILE = paths.tokenFile;
   if (existsSync14(TOKEN_FILE))
     return readFileSync10(TOKEN_FILE, "utf8").trim();
-  const token = randomBytes3(32).toString("hex");
+  const token = randomBytes5(32).toString("hex");
   writeFileSync5(TOKEN_FILE, token, { mode: 384 });
   return token;
 }
@@ -19716,8 +20224,12 @@ class StateStore {
     delete this.state.sessions[id];
     if (this.state.seen)
       delete this.state.seen[id];
-    if (this.state.groups)
+    if (this.state.groups) {
+      const left = this.state.groups[id] ?? [];
       delete this.state.groups[id];
+      if (left.length > 0)
+        this.state.groups[DAEMON_GROUPS] = [...this.state.groups[DAEMON_GROUPS] ?? [], ...left];
+    }
     this.save();
   }
   groups(worktreeId) {
@@ -19767,6 +20279,16 @@ class StateStore {
       this.state.bootAt = id;
     this.save();
   }
+  setMode(worktreeId, mode) {
+    const wt = this.requireWorktree(worktreeId);
+    if (wt.kind === "spare")
+      throw new UserError("no mode for a spare worktree");
+    if (wt.mode === mode)
+      return false;
+    wt.mode = mode;
+    this.save();
+    return true;
+  }
   session(worktreeId) {
     return this.state.sessions[worktreeId];
   }
@@ -19840,6 +20362,17 @@ class StateStore {
     this.state.pairedAt = Date.now();
     this.save();
   }
+  get trustedOrigins() {
+    return (this.state.trustedOrigins ?? []).map((t) => t.origin);
+  }
+  trustOrigin(origin) {
+    if (!isShellOrigin(origin))
+      return;
+    const list = (this.state.trustedOrigins ?? []).filter((t) => t.origin !== origin);
+    list.push({ origin, at: Date.now() });
+    this.state.trustedOrigins = list.slice(-TRUSTED_MAX);
+    this.save();
+  }
   save() {
     if (this.groupsTimer)
       clearTimeout(this.groupsTimer);
@@ -26048,10 +26581,10 @@ function servedLocally(origin) {
 }
 
 // ../daemon/src/server/ws.ts
-import { homedir as homedir11 } from "os";
+import { homedir as homedir11, hostname as hostname2 } from "os";
 
 // ../daemon/src/core/pair.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 class PairCodes {
   now;
   live = null;
@@ -26059,7 +26592,7 @@ class PairCodes {
     this.now = now;
   }
   mint() {
-    const code = randomBytes4(9).toString("base64url");
+    const code = randomBytes6(9).toString("base64url");
     this.live = { code, until: this.now() + PAIR_TTL_MS };
     return { code, ms: PAIR_TTL_MS };
   }
@@ -26114,7 +26647,7 @@ async function readTailnetPhones(run = ((bin) => bin ? cli(bin) : null)(Bun.whic
 }
 
 // ../daemon/src/server/handlers.ts
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 // ../daemon/src/agent/config.ts
 import { existsSync as existsSync22, readFileSync as readFileSync14 } from "fs";
@@ -26831,7 +27364,7 @@ var handlers = {
         await s.worktrees.create(msg.repoId, msg.prompt, { ...opts, worktreeId: msg.worktreeId });
         return;
       }
-      const group = randomBytes5(4).toString("hex");
+      const group = randomBytes7(4).toString("hex");
       const made = await Promise.allSettled(Array.from({ length: of }, (_, i) => s.worktrees.create(msg.repoId, msg.prompt, {
         ...opts,
         ...i === 0 ? { worktreeId: msg.worktreeId } : {},
@@ -27180,6 +27713,14 @@ var handlers = {
     requireRun(s, msg.worktreeId);
     s.runtime.agentFor(msg.worktreeId)?.answer(msg.askId, { kind: "choice", choiceId: msg.choiceId });
   },
+  async "handoff-answer"(msg, _ctx, s) {
+    requireRun(s, msg.worktreeId);
+    await s.handoff.answer(msg.worktreeId, msg.id, msg.go, msg.note);
+  },
+  async "handoff-ask"(msg, _ctx, s) {
+    requireRun(s, msg.worktreeId);
+    await s.handoff.ask(msg.worktreeId, msg.repoId, msg.text);
+  },
   "agent-config"(msg, ctx, s) {
     const spec = s.agents.require(msg.agent);
     const repoPath = msg.repoId ? s.state.repo(msg.repoId)?.path ?? null : null;
@@ -27320,7 +27861,37 @@ async function dispatch(msg, ctx, s) {
 
 // ../daemon/src/server/http.ts
 import { existsSync as existsSync23 } from "fs";
+import { hostname } from "os";
 import { join as join21 } from "path";
+
+// ../daemon/src/server/cors.ts
+var ALLOW_HEADERS = "authorization, content-type";
+var ALLOW_METHODS = "GET, POST";
+var MAX_AGE = "86400";
+function preflight(allowOrigin) {
+  const res = new Response(null, { status: 204 });
+  return withCors(res, allowOrigin);
+}
+function withCors(res, origin) {
+  res.headers.set("access-control-allow-origin", origin);
+  res.headers.set("access-control-allow-headers", ALLOW_HEADERS);
+  res.headers.set("access-control-allow-methods", ALLOW_METHODS);
+  res.headers.set("access-control-max-age", MAX_AGE);
+  res.headers.append("vary", "Origin");
+  return res;
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+      return false;
+    return isLoopbackHost(u.hostname);
+  } catch {
+    return false;
+  }
+}
+
+// ../daemon/src/server/http.ts
 var IMMUTABLE = "private, max-age=31536000, immutable";
 var NO_STORE = "no-store";
 function attachedHeaders(imageType) {
@@ -27333,25 +27904,31 @@ function attachedHeaders(imageType) {
 function createFetch(opts) {
   const grant = previewGrant(opts.token);
   const remote = opts.remote;
+  const gate = remote && { grant, host: remote.host, redeem: (code) => opts.grants.redeem(code) };
   const health = () => Response.json({
     ok: true,
     version: opts.version,
     pid: process.pid,
     branded: opts.branded(),
     remote: remote && { host: remote.host, previews: remote.previews },
+    machine: machineLabel(hostname(), remote),
     managed: opts.managed,
     ...opts.metrics()
   });
-  return async function fetch2(req, srv) {
-    const url = new URL(req.url);
-    if (remote?.front === "edge" && url.pathname === "/health")
-      return health();
-    const d = door(req, srv.requestIP(req)?.address ?? "", remote, "daemon");
-    if (d.kind === "refused")
-      return d.response;
+  const corsAllow = (req, url, d) => {
+    const origin = req.headers.get("origin");
+    if (!origin || d.kind !== "local" && d.kind !== "shell")
+      return null;
+    if (url.pathname === "/pair/redeem")
+      return origin;
+    if (opts.trusted().includes(origin))
+      return origin;
+    return d.kind === "local" && isLoopbackOrigin(origin) ? origin : null;
+  };
+  async function route(req, srv, url, d) {
     const remoteShell = d.kind === "shell";
-    if (d.kind === "preview" && d.worktreeId !== null) {
-      const pass = passPreview(req, grant);
+    if (d.kind === "preview" && d.worktreeId !== null && gate) {
+      const pass = passPreview(req, gate);
       if (!pass.ok)
         return pass.response;
       const handler = opts.preview(d.worktreeId);
@@ -27425,6 +28002,15 @@ function createFetch(opts) {
       const phones = remote && isTailnetName(remote.host) ? await opts.phones() : null;
       return Response.json(phones, { headers: { "cache-control": NO_STORE } });
     }
+    if (url.pathname === "/preview-grant" && req.method === "POST") {
+      if (!sameSecret(req.headers.get("authorization"), `Bearer ${opts.token}`)) {
+        return new Response("unauthorized", { status: 401 });
+      }
+      if (!remote)
+        return new Response("previews here are not reached by name", { status: 400 });
+      const body = opts.grants.mint();
+      return Response.json(body, { headers: { "cache-control": NO_STORE } });
+    }
     if (url.pathname === "/pair/redeem" && req.method === "POST") {
       if (!remote || !remoteShell)
         return new Response("not found", { status: 404 });
@@ -27432,7 +28018,7 @@ function createFetch(opts) {
       if (typeof body.code !== "string" || !opts.pair.redeem(body.code)) {
         return new Response("code expired", { status: 401 });
       }
-      opts.onPaired();
+      opts.onPaired(req.headers.get("origin"));
       const reply = { token: opts.token };
       return Response.json(reply, {
         headers: { "cache-control": NO_STORE, "set-cookie": grantCookie(grant, remote.host) }
@@ -27560,6 +28146,28 @@ function createFetch(opts) {
     if (existsSync23(index))
       return new Response(Bun.file(index), { headers: { "cache-control": NO_STORE } });
     return new Response("Toyon daemon running; shell not built (run: bun run build)", { status: 200 });
+  }
+  return async function fetch2(req, srv) {
+    const url = new URL(req.url);
+    if (remote?.front === "edge" && url.pathname === "/health")
+      return health();
+    if (url.pathname.startsWith("/mcp/")) {
+      const peer = srv.requestIP(req)?.address ?? "";
+      if (!isLoopbackPeer(peer))
+        return new Response("forbidden", { status: 403 });
+      const worktreeId = url.pathname.slice("/mcp/".length);
+      if (!worktreeId || worktreeId.includes("/"))
+        return new Response("not found", { status: 404 });
+      return opts.mcp(req, worktreeId);
+    }
+    const d = door(req, srv.requestIP(req)?.address ?? "", remote, "daemon");
+    if (d.kind === "refused")
+      return d.response;
+    const allow = corsAllow(req, url, d);
+    if (allow && req.method === "OPTIONS")
+      return preflight(allow);
+    const res = await route(req, srv, url, d);
+    return res && allow ? withCors(res, allow) : res;
   };
 }
 
@@ -27688,22 +28296,20 @@ function startServer(opts) {
     agents: s.agents.adapters(),
     sockets: [...sockets].map((ws) => ({ subs: [...ws.data.subs], sent: ws.data.sent, bytes: ws.data.bytes }))
   });
-  let statusesInFlight = false;
-  let statusesDirty = false;
+  let statusesQueued = false;
   const worktreesChanged = () => {
-    if (statusesInFlight) {
-      statusesDirty = true;
+    if (statusesQueued)
       return;
-    }
-    statusesInFlight = true;
-    fireAndForget("ws", (async () => {
-      do {
-        statusesDirty = false;
-        broadcast({ t: "worktrees", rows: await s.worktrees.rows(), trunks: await s.worktrees.trunks() });
-      } while (statusesDirty);
-    })().finally(() => {
-      statusesInFlight = false;
-    }), "worktrees broadcast");
+    statusesQueued = true;
+    setTimeout(() => {
+      statusesQueued = false;
+      try {
+        const { rows, trunks } = s.worktrees.snapshot();
+        broadcast({ t: "worktrees", rows, trunks });
+      } catch (e) {
+        log.warn("ws", "worktrees broadcast failed", e);
+      }
+    }, 0);
   };
   s.hub.on("worktreesChanged", worktreesChanged);
   s.hub.on("agentStatus", worktreesChanged);
@@ -27817,6 +28423,7 @@ function startServer(opts) {
   s.hub.on("attachmentsChanged", (boxId, items, clientId) => broadcast({ t: "attachments", boxId, items, ...clientId ? { clientId } : {} }));
   const helloFrame = async () => {
     await s.update.refresh();
+    const { rows, trunks } = s.worktrees.snapshot();
     return {
       t: "hello",
       version,
@@ -27824,8 +28431,8 @@ function startServer(opts) {
       registry: await s.update.registry(),
       protocol: PROTOCOL_VERSION,
       repos: s.state.repos,
-      rows: await s.worktrees.rows({ quick: true }),
-      trunks: await s.worktrees.trunks({ quick: true }),
+      rows,
+      trunks,
       themes: s.themes.themes,
       themePrefs: s.themes.prefs,
       agents: agentInfos(),
@@ -27834,7 +28441,8 @@ function startServer(opts) {
       home: homedir11(),
       folderDialog: process.platform === "darwin" && !cloud.enabled,
       keepAwake: s.keepAwake.setting(),
-      remote: opts.remote && { host: opts.remote.host, previews: opts.remote.previews },
+      remote: opts.remote,
+      machine: machineLabel(hostname2(), opts.remote),
       paired: s.state.paired,
       gitIdentity: await s.repos.gitIdentity(),
       pending: s.repos.pending,
@@ -27874,11 +28482,21 @@ function startServer(opts) {
       restart: (now) => s.restarter.request({ now }),
       restartWait: () => ({ waiting: s.restarter.waitingOn(), asking: s.restarter.asking() }),
       pair: new PairCodes,
-      onPaired: () => {
-        s.state.notePaired();
+      grants: opts.grants,
+      onPaired: (origin) => {
+        const own = origin === null || origin === `https://${opts.remote?.host}`;
+        if (own)
+          s.state.notePaired();
+        else {
+          s.state.trustOrigin(origin);
+          if (s.state.trustedOrigins.includes(origin))
+            opts.onTrusted(origin);
+        }
         broadcast({ t: "paired" });
       },
-      phones: () => readTailnetPhones()
+      trusted: () => s.state.trustedOrigins,
+      phones: () => readTailnetPhones(),
+      mcp: (req, id) => s.mcp.fetch(req, id)
     }),
     websocket: {
       async open(ws) {
@@ -29060,6 +29678,245 @@ class FixService {
   }
 }
 
+// ../daemon/src/worktrees/handoff.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var MESSAGE_MAX = 20000;
+var TITLE_MAX2 = 200;
+var PROJECT_MAX = 200;
+var PER_TURN_MAX = 3;
+var refused = (text) => ({ text, isError: true });
+function openProposals(entries) {
+  const open = new Map;
+  for (const { event } of entries) {
+    if (event.type === "handoff-proposed")
+      open.set(event.id, event);
+    else if (event.type === "handoff" || event.type === "handoff-declined")
+      open.delete(event.id);
+  }
+  return [...open.values()];
+}
+function proposedThisTurn(entries) {
+  let n = 0;
+  for (let i = entries.length - 1;i >= 0; i--) {
+    const e = entries[i].event;
+    if (e.type === "turn-start")
+      break;
+    if (e.type === "handoff-proposed")
+      n++;
+  }
+  return n;
+}
+
+class HandoffService {
+  d;
+  settling = new Set;
+  constructor(d) {
+    this.d = d;
+    d.hub.on("landed", (worktreeId) => this.landed(worktreeId));
+  }
+  targets(worktreeId) {
+    const own = this.d.state.worktree(worktreeId)?.repoId;
+    return this.d.state.repos.filter((r) => r.id !== own);
+  }
+  resolve(worktreeId, project) {
+    const q = project.trim();
+    const others = this.targets(worktreeId);
+    if (others.length === 0)
+      return { refused: "No other project is open in Toyon, so there is nothing to hand off to." };
+    const names = others.map((r) => r.name).join(", ");
+    if (!q)
+      return { refused: `Name the project to continue in. Open projects: ${names}.` };
+    const found = match(others, q);
+    if (found.length === 1)
+      return { repo: found[0] };
+    if (found.length > 1) {
+      return {
+        refused: `"${q}" names more than one open project: ${found.map((r) => r.path).join(", ")}. Say which by its path.`
+      };
+    }
+    const wt = this.d.state.worktree(worktreeId);
+    const own = wt ? this.d.state.repo(wt.repoId) : undefined;
+    if (own && match([own], q).length === 1) {
+      return {
+        refused: `${own.name} is this worktree's own project; a handoff goes to another one. Open projects: ${names}.`
+      };
+    }
+    return { refused: `No open project is called "${q}". Open projects: ${names}.` };
+  }
+  tool(worktreeId) {
+    const names = this.targets(worktreeId).map((r) => r.name);
+    const open = names.length ? `Open projects you can name: ${names.join(", ")}.` : "No other project is open right now.";
+    return {
+      name: HANDOFF_TOOL,
+      description: `Propose continuing the current task in another project Toyon has open, when a change belongs there and not in this worktree. Nothing starts: a card with your message appears in this chat and the person decides. ${open}`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          project: { type: "string", description: "The other project's name as listed, or its path." },
+          message: {
+            type: "string",
+            description: "What that project's agent starts from: what is needed and why, how to reproduce it, and the paths in this worktree that depend on it. It is sent as that agent's first message."
+          },
+          title: { type: "string", description: "A short name for the new worktree, a few words." }
+        },
+        required: ["project", "message"],
+        additionalProperties: false
+      }
+    };
+  }
+  async call(worktreeId, args) {
+    const a = args && typeof args === "object" && !Array.isArray(args) ? args : null;
+    const shaped = a && typeof a.project === "string" && typeof a.message === "string" && (a.title === undefined || typeof a.title === "string");
+    if (!shaped)
+      return refused("handoff takes { project: string, message: string, title?: string }.");
+    return this.propose(worktreeId, { project: a.project, message: a.message, ...a.title ? { title: a.title } : {} }, "agent");
+  }
+  propose(worktreeId, p, by) {
+    const wt = this.d.state.worktree(worktreeId);
+    if (!wt)
+      throw new UserError("that chat is gone");
+    if (p.project.length > PROJECT_MAX)
+      return refused(`The project name is over ${PROJECT_MAX} characters.`);
+    if ((p.title ?? "").length > TITLE_MAX2)
+      return refused(`The title is over ${TITLE_MAX2} characters; a few words.`);
+    if (p.message.length > MESSAGE_MAX) {
+      return refused(`The message is over ${MESSAGE_MAX} characters; cut it to what the other agent needs.`);
+    }
+    const target = this.resolve(worktreeId, p.project);
+    if ("refused" in target)
+      return refused(target.refused);
+    const message = p.message.trim();
+    if (!message)
+      return refused("Write the message the other project's agent should start from.");
+    const agent = this.d.runtime.ensureAgent(wt).agent;
+    const entries = agent.transcript();
+    if (openProposals(entries).length > 0) {
+      return refused("A handoff is already waiting for the person on this chat; finish your turn.");
+    }
+    if (by === "agent" && proposedThisTurn(entries) >= PER_TURN_MAX) {
+      return refused("Three handoffs were proposed this turn already; finish your turn and let the person answer.");
+    }
+    const title = p.title?.trim();
+    const { repo } = target;
+    agent.note({
+      type: "handoff-proposed",
+      id: randomUUID2(),
+      repo: { id: repo.id, name: repo.name, path: repo.path },
+      message,
+      ...title ? { title } : {},
+      by,
+      mode: wt.mode ?? DEFAULT_PERMISSION_MODE,
+      ts: Date.now()
+    });
+    return { text: "Proposed to the person as a card; they decide. Finish your turn." };
+  }
+  async answer(worktreeId, id, go, note) {
+    const wt = this.d.state.worktree(worktreeId);
+    if (!wt)
+      throw new UserError("that chat is gone");
+    const agent = this.d.runtime.ensureAgent(wt).agent;
+    const entries = agent.transcript();
+    const proposed = entries.find(({ event }) => event.type === "handoff-proposed" && event.id === id)?.event;
+    if (!proposed)
+      throw new UserError("That card is not in this chat");
+    if (!openProposals(entries).some((p) => p.id === id)) {
+      return log.debug(worktreeId, `answer for a handoff that already closed (${id})`);
+    }
+    if (this.settling.has(id))
+      return;
+    if (!go) {
+      agent.note({ type: "handoff-declined", id, ts: Date.now() });
+      return;
+    }
+    this.settling.add(id);
+    try {
+      const repo = this.d.state.repo(proposed.repo.id);
+      if (!repo)
+        throw new UserError(`${proposed.repo.name} is no longer open in Toyon`);
+      const origin = this.d.state.requireRepo(wt.repoId);
+      const added = note?.trim() || undefined;
+      const prompt = handoffPrompt(proposed.message, added, { path: wt.path, project: origin.name, branch: wt.branch });
+      const made = await this.d.create(repo.id, prompt, {
+        ...proposed.title ? { title: proposed.title } : {},
+        mode: proposed.mode,
+        from: { kind: "worktree", ref: wt.branch, origin: { id: wt.id, repoId: wt.repoId } }
+      });
+      agent.note({
+        type: "handoff",
+        id,
+        worktreeId: made.id,
+        repoId: repo.id,
+        repoName: repo.name,
+        title: made.title,
+        ts: Date.now()
+      });
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      agent.note({ type: "handoff-declined", id, outcome: "failed", reason, ts: Date.now() });
+      throw e;
+    } finally {
+      this.settling.delete(id);
+    }
+  }
+  async ask(worktreeId, repoId, text) {
+    const wt = this.d.state.requireWorktree(worktreeId);
+    const repo = this.d.state.repo(repoId);
+    if (!repo)
+      throw new UserError("no such project");
+    if (repo.id === wt.repoId)
+      throw new UserError(`${repo.name} is this worktree's own project`);
+    const agent = this.d.runtime.agentFor(worktreeId);
+    if (!agent)
+      throw new UserError("worktree still starting; try again in a moment");
+    if (agent.mcpTools === null)
+      await agent.warm();
+    if (agent.mcpTools === true) {
+      agent.send(handoffAskPrompt(repo, text), { asked: { kind: "handoff", why: `continue in ${repo.name}` } });
+      return;
+    }
+    const own = text?.trim();
+    if (!own)
+      throw new UserError(`Write what ${repo.name} should do first`);
+    const r = this.propose(worktreeId, { project: repo.path, message: own }, "person");
+    if (r.isError)
+      throw new UserError(r.text);
+  }
+  landed(worktreeId) {
+    const wt = this.d.state.worktree(worktreeId);
+    if (wt?.from?.kind !== "worktree")
+      return;
+    const origin = this.d.state.worktree(wt.from.origin.id);
+    if (origin?.kind !== "worktree")
+      return;
+    const repo = this.d.state.repo(wt.repoId);
+    if (!repo)
+      return;
+    this.d.runtime.ensureAgent(origin).agent.note({
+      type: "handoff-landed",
+      worktreeId: wt.id,
+      repoName: repo.name,
+      title: wt.title,
+      ...wt.pr?.url ? { url: wt.pr.url } : {},
+      ts: Date.now()
+    });
+  }
+}
+function match(repos, q) {
+  const lower = q.toLowerCase();
+  const ladder = [
+    (r) => r.path === q,
+    (r) => r.name === q,
+    (r) => r.name.toLowerCase() === lower,
+    (r) => r.name.toLowerCase().startsWith(lower)
+  ];
+  for (const rung of ladder) {
+    const found = repos.filter(rung);
+    if (found.length > 0)
+      return found;
+  }
+  return [];
+}
+
 // ../daemon/src/worktrees/landing.ts
 var TAIL_CHARS = 400;
 var DIFF_CHARS = 2000;
@@ -29866,7 +30723,7 @@ var UNWATCHED = {
   step() {},
   git: (cwd, args) => stepRun(cwd, args)
 };
-function refused(what, r, n = 200) {
+function refused2(what, r, n = 200) {
   if (r.exit === "timeout") {
     const after = describeDuration(r.ceilingMs ?? STEP_TIMEOUT_MS);
     return `${what} gave up after ${after}${r.shown ? "; what it printed is on the chat" : ""}`;
@@ -29877,7 +30734,7 @@ function stepRefused(what, r, n = 200) {
   const row = typeof r.exit === "number" && r.hook ? rowOf(r) : undefined;
   return {
     ok: false,
-    message: refused(what, r, n),
+    message: refused2(what, r, n),
     ...row && r.hook ? { hook: { ...row, name: r.hook } } : {}
   };
 }
@@ -30217,7 +31074,7 @@ async function fetchBase(worktreePath, repo, w = UNWATCHED) {
   w.step(`fetching ${base}`);
   const f = await w.git(worktreePath, ["fetch", "--quiet", tracked.remote, tracked.merge]);
   if (!f.ok)
-    return { ok: false, message: refused("fetch failed", f) };
+    return { ok: false, message: refused2("fetch failed", f) };
   return { ok: true, message: `fetched ${base}` };
 }
 async function pushBranch(worktreePath, branch, w = UNWATCHED) {
@@ -30621,6 +31478,95 @@ class ArchivedGit {
   }
 }
 
+// ../daemon/src/worktrees/counts.ts
+var COUNTS_FLOOR_MS = 1e4;
+var same2 = (a, b) => a.ahead === b.ahead && a.behind === b.behind && a.unpushed === b.unpushed && a.dirty === b.dirty;
+
+class Counts {
+  d;
+  cache = new Map;
+  reading = new Map;
+  marks = new Map;
+  markAll = 0;
+  constructor(d) {
+    this.d = d;
+  }
+  get(id) {
+    return this.cache.get(id)?.value;
+  }
+  stale(id) {
+    if (id === undefined) {
+      this.markAll++;
+      for (const c of this.cache.values())
+        c.at = 0;
+      return;
+    }
+    this.marks.set(id, (this.marks.get(id) ?? 0) + 1);
+    const c = this.cache.get(id);
+    if (c)
+      c.at = 0;
+  }
+  put(id, value) {
+    return this.store(id, value);
+  }
+  refresh(ids) {
+    const reads = [];
+    for (const id of new Set(ids)) {
+      const running = this.reading.get(id);
+      if (running) {
+        reads.push(running);
+        continue;
+      }
+      const cached = this.cache.get(id);
+      if (cached && Date.now() - cached.at < COUNTS_FLOOR_MS)
+        continue;
+      if (this.d.going(id))
+        continue;
+      reads.push(this.readOne(id));
+    }
+    if (!reads.length)
+      return null;
+    return Promise.all(reads).then((moved) => moved.some(Boolean));
+  }
+  async read(id) {
+    this.stale(id);
+    await this.refresh([id]);
+    const c = this.cache.get(id);
+    return c?.failed || !c?.value ? null : c.value;
+  }
+  markOf(id) {
+    return (this.marks.get(id) ?? 0) + this.markAll;
+  }
+  readOne(id) {
+    const read = (async () => {
+      for (;; ) {
+        const mark = this.markOf(id);
+        let value = null;
+        try {
+          value = await this.d.read(id);
+        } catch {}
+        if (this.d.going(id))
+          return false;
+        if (this.markOf(id) !== mark)
+          continue;
+        if (value)
+          return this.store(id, value);
+        this.cache.set(id, { value: this.get(id), at: Date.now(), failed: true });
+        return false;
+      }
+    })().finally(() => {
+      this.reading.delete(id);
+    });
+    this.reading.set(id, read);
+    return read;
+  }
+  store(id, value) {
+    const prev = this.cache.get(id)?.value;
+    this.cache.set(id, { value, at: Date.now() });
+    return !prev || !same2(prev, value);
+  }
+}
+
 // ../daemon/src/worktrees/spare.ts
 import { existsSync as existsSync29 } from "fs";
 import { basename as basename9, join as join26 } from "path";
@@ -30909,7 +31855,7 @@ class Trunk {
     const f = await withFetchLock(repo.path, () => w.git(repo.path, ["fetch", "--quiet"]));
     this.noteFetch(repo.id, f);
     if (!f.ok)
-      return { ok: false, message: refused("fetch failed", f) };
+      return { ok: false, message: refused2("fetch failed", f) };
     this.d.invalidateCounts();
     return this.follow(main.id);
   }
@@ -30937,14 +31883,13 @@ class Trunk {
       this.d.hub.emit("worktreesChanged");
     return ff;
   }
-  async all(opts = {}) {
-    const quick = opts.quick ? { missed: false } : null;
+  all() {
     const out = {};
-    await Promise.all(this.d.state.repos.map(async (repo) => {
+    for (const repo of this.d.state.repos) {
       const main = mainOf(this.d.state, repo.id);
       if (!main)
-        return;
-      const { behind, dirty } = await this.d.counts(main, repo.defaultBranch, quick);
+        continue;
+      const { behind, dirty } = this.d.counts(main) ?? {};
       const stale = this.stale.get(repo.id);
       const fetched = this.fetches.get(repo.id);
       out[repo.id] = {
@@ -30956,9 +31901,7 @@ class Trunk {
         ...fetched?.at ? { fetchedAt: fetched.at } : {},
         ...fetched?.failed ? { fetchFailed: fetched.failed } : {}
       };
-    }));
-    if (quick?.missed)
-      setTimeout(() => this.d.hub.emit("worktreesChanged"), 0);
+    }
     return out;
   }
 }
@@ -31071,6 +32014,10 @@ function withCarry(context, c) {
   const line = c.moved ? `This worktree started with ${files} the person moved here from ${c.branch} by hand. They are part of the task, not something to clean up.` : `${c.branch} has ${files} the person chose to leave there. This worktree does not have them.`;
   return [...context ?? [], line];
 }
+var idsOf = (rows, trunks) => [
+  ...rows.map((r) => r.id),
+  ...Object.values(trunks).map((t) => t.id)
+];
 var commandLine = (args) => args.map((a) => /^[\w./:=@,+-]+$/.test(a) ? a : JSON.stringify(a.split(`
 `, 1)[0])).join(" ");
 
@@ -31082,21 +32029,29 @@ class WorktreeService {
   trunk;
   archive;
   archiving = new Map;
+  restoring = new Map;
   going = new Set;
-  countsCache = new Map;
+  counts;
   handChecked = new Map;
   naming = new Set;
   discoverCache = new Map;
+  relisting = new Map;
+  listMark = 0;
+  pending = new Set;
   usage = new Map;
   constructor(d) {
     this.d = d;
     this.runs = d.runs ?? new RunService({ state: d.state, hub: d.hub });
     this.archive = new WorktreeArchive(d.paths.archiveDir);
+    this.counts = new Counts({
+      read: (id) => this.readCounts(id),
+      going: (id) => this.going.has(id)
+    });
     this.trunk = new Trunk({
       state: d.state,
       hub: d.hub,
-      counts: (main, defaultBranch, quick) => quick ? Promise.resolve(this.countsQuick(main.id, quick)) : this.counts(main.id, main.path, defaultBranch, false),
-      invalidateCounts: () => this.invalidateCounts()
+      counts: (main) => this.counts.get(main.id),
+      invalidateCounts: () => this.counts.stale()
     });
     this.spare = new SparePool({
       state: d.state,
@@ -31135,7 +32090,7 @@ class WorktreeService {
       this.usage.set(worktreeId, { used, size, ...cost !== undefined ? { cost } : {} });
     });
     d.hub.on("turnSettled", (worktreeId, turn) => {
-      this.countsCache.delete(worktreeId);
+      this.counts.stale(worktreeId);
       if (turn.end === "done") {
         const wt = d.state.worktree(worktreeId);
         const prompt = wt?.unnamed ? firstAskOf(d.runtime.agentFor(worktreeId)?.transcript() ?? []) : undefined;
@@ -31158,7 +32113,8 @@ class WorktreeService {
     const agent = this.d.agents.require(opts.agent ?? this.d.state.defaultAgent ?? DEFAULT_AGENT_ID).id;
     const profile = this.checkProfile(repo, opts.profile);
     const task = taskText(prompt, attachments);
-    const base = titleFrom(task);
+    const given = cleanTitle2(opts.title ?? "") || undefined;
+    const base = given ?? titleFrom(task);
     const title = variant ? `${base} v${variant.index}` : base;
     if (opts.carry && variant && variant.of > 1) {
       throw new UserError(`only a single worktree can take the changes on ${repo.defaultBranch}`);
@@ -31172,6 +32128,10 @@ class WorktreeService {
         claimed.variant = variant;
       if (opts.createdBy)
         claimed.createdBy = opts.createdBy;
+      if (given)
+        delete claimed.unnamed;
+      if (opts.from)
+        claimed.from = opts.from;
       claimed.promptedAt = claimed.createdAt;
       claimed.agent = agent;
       if (opts.mode)
@@ -31191,7 +32151,7 @@ class WorktreeService {
       if (rt.agent.runningAgent !== null && rt.agent.runningAgent !== agent)
         await rt.agent.restart();
       rt.agent.send(agentPrompt, { context: withCarry(context, carried), attachments });
-      this.scheduleNaming(claimed, task, variant);
+      this.nameOrAsk(claimed, task, given, variant);
       if (carried.unmoved)
         throw new UserError(carried.unmoved, { delivered: true });
       return claimed;
@@ -31211,11 +32171,12 @@ class WorktreeService {
       kind: "worktree",
       proxyPort: await allocateProxyPort(),
       title,
-      unnamed: true,
+      ...given ? {} : { unnamed: true },
       createdAt: Date.now(),
       promptedAt: Date.now(),
       agent,
       ...variant ? { variant } : {},
+      ...opts.from ? { from: opts.from } : {},
       ...opts.createdBy ? { createdBy: opts.createdBy } : {},
       ...profile !== undefined ? { profile } : {},
       ...opts.mode ? { mode: opts.mode } : {},
@@ -31225,11 +32186,18 @@ class WorktreeService {
     const carried = await this.carryMain(repo, wt, !!opts.carry);
     this.launch(wt, repo, repo.path);
     this.d.runtime.ensureAgent(wt).agent.send(agentPrompt, { context: withCarry(context, carried), attachments });
-    this.scheduleNaming(wt, task, variant);
+    this.nameOrAsk(wt, task, given, variant);
     if (carried.unmoved)
       throw new UserError(carried.unmoved, { delivered: true });
     return wt;
   }
+  nameOrAsk(wt, task, given, variant) {
+    if (given === undefined) {
+      this.scheduleNaming(wt, task, variant);
+      return;
+    }
+    fireAndForget(wt.id, this.rename(wt.id, given), "branch for the given title");
+  }
   async carryMain(repo, wt, move) {
     try {
       return await this.carryMainOrThrow(repo, wt, move);
@@ -31242,12 +32210,14 @@ class WorktreeService {
   async carryMainOrThrow(repo, wt, move) {
     const main = repo.defaultBranch;
     if (!move) {
-      const count = this.countsCache.get(this.mainOf(repo.id)?.id ?? "")?.dirty ?? 0;
+      const count = this.counts.get(this.mainOf(repo.id)?.id ?? "")?.dirty ?? 0;
       return { branch: main, moved: false, count };
     }
     let count = 0;
+    let left;
     const unmoved = await withRepoLock(repo.path, async () => {
       count = (await statusFiles(repo.path)).length;
+      left = count;
       if (count === 0)
         return;
       const before = await git(repo.path, "rev-parse", "-q", "--verify", "refs/stash");
@@ -31258,6 +32228,7 @@ class WorktreeService {
       const sha = after.out.trim();
       if (!after.ok || before.ok && before.out.trim() === sha)
         return;
+      left = 0;
       const entry = async () => {
         const list = await git(repo.path, "stash", "list", "--format=%H");
         const i = list.out.split(`
@@ -31281,11 +32252,15 @@ class WorktreeService {
       }
       const ref = await entry();
       const back = ref ? await git(repo.path, "stash", "pop", ref) : null;
+      left = back?.ok ? count : undefined;
       return back?.ok ? `the changes on ${main} did not apply in ${wt.title}, so they stayed on ${main}` : `the changes on ${main} did not apply in ${wt.title}; they are kept in git stash as "toyon: into ${wt.title}"`;
     });
     const mainWt = this.mainOf(repo.id);
-    if (mainWt)
-      this.countsCache.delete(mainWt.id);
+    if (mainWt) {
+      if (left !== undefined)
+        this.counts.put(mainWt.id, { ...this.counts.get(mainWt.id), dirty: left });
+      this.counts.stale(mainWt.id);
+    }
     return { branch: main, moved: count > 0 && !unmoved, count, unmoved };
   }
   launch(wt, repo, depsSource, opts = {}) {
@@ -31435,14 +32410,10 @@ class WorktreeService {
     this.restartProcs(wt, repo);
   }
   setMode(worktreeId, mode) {
-    const wt = this.d.state.requireWorktree(worktreeId);
-    if (wt.kind === "spare")
-      throw new UserError("no mode for a spare worktree");
-    if (wt.mode === mode)
+    if (!this.d.state.setMode(worktreeId, mode))
       return;
-    wt.mode = mode;
-    this.d.state.save();
     this.d.hub.emit("worktreesChanged");
+    this.d.runtime.agentFor(worktreeId)?.modeChanged();
   }
   setModel(worktreeId, model) {
     this.setOption(worktreeId, "model", model);
@@ -31726,6 +32697,18 @@ class WorktreeService {
     return this.d.state.repo(rec.worktree.repoId) ?? this.d.state.repos.find((r) => r.path === rec.repoPath);
   }
   async restore(archiveId, createdBy, message) {
+    const running = this.restoring.get(archiveId);
+    const live = running ? await running : this.d.state.worktree(archiveId);
+    if (live) {
+      if (message)
+        await this.send(live.id, { text: message.text, clientId: createdBy, attachments: message.attachments });
+      return live;
+    }
+    const done = this.bringBack(archiveId, createdBy, message).finally(() => this.restoring.delete(archiveId));
+    this.restoring.set(archiveId, done);
+    return done;
+  }
+  async bringBack(archiveId, createdBy, message) {
     const rec = this.archive.get(archiveId);
     if (!rec)
       throw new UserError("that archived worktree is gone");
@@ -31785,7 +32768,7 @@ class WorktreeService {
     const dropped = await git(repo.path, "update-ref", "-d", archiveRef(old.id));
     if (!dropped.ok)
       log.warn(old.id, `could not drop its archive ref: ${dropped.err}`);
-    this.countsCache.delete(wt.id);
+    this.counts.stale(wt.id);
     this.launch(wt, repo, repo.path);
     this.d.runtime.ensureAgent(wt).agent.note({
       type: "restored",
@@ -31897,8 +32880,7 @@ class WorktreeService {
     for (const w of sources)
       await this.discardWorktree(w.id);
     await this.refreshLanded(target);
-    this.countsCache.delete(target.id);
-    this.d.hub.emit("worktreesChanged");
+    await this.headMoved(target.id);
     return { target, grafted: sources.map((w) => w.title) };
   }
   startPreview(worktreeId) {
@@ -32063,7 +33045,7 @@ ${wt.landing.body}` : s;
     const result = await commitWorktree(wt.path, message, this.landWatch(wt));
     if (result.ok) {
       await this.verdictSurvives(wt, { dropMessage: true });
-      this.headMoved(wt.id);
+      await this.headMoved(wt.id);
     }
     return result;
   }
@@ -32165,6 +33147,7 @@ ${wt.landing.body}` : s;
   }
   noteLanded(wt, message, archiveIds) {
     this.d.runtime.ensureAgent(wt).agent.note({ type: "landed", message, archiveIds, ts: Date.now() });
+    this.d.hub.emit("landed", wt.id);
   }
   siblingIds(wt) {
     return siblingsOf(wt, this.d.state.worktrees).map((s) => s.id);
@@ -32232,11 +33215,11 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
         const taken = await takeMainIn(wt.path, base, own, w);
         if (!taken.ok)
           return { result: taken };
-        this.headMoved(wt.id);
+        await this.headMoved(wt.id);
         const pushed = await pushBranch(wt.path, wt.branch, w);
         if (!pushed.ok)
           return { result: pushed };
-        this.headMoved(wt.id);
+        await this.headMoved(wt.id);
         this.setLanding(wt.id, undefined);
         const did = committed ? "committed and pushed" : "pushed";
         return { result: { ok: true, url: wt.pr.url, message: `${did}; PR #${wt.pr.number} has the new commits` } };
@@ -32248,7 +33231,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
       const taken = await takeMainIn(wt.path, base, own, w);
       if (!taken.ok)
         return { result: taken };
-      this.headMoved(wt.id);
+      await this.headMoved(wt.id);
       if ((await aheadBehind(wt.path, base)).ahead === 0) {
         const r = await this.prMergedOp(wt.id, mark, w);
         const on = `origin's ${repo.defaultBranch} has this work already`;
@@ -32329,7 +33312,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
       const taken = await takeMainIn(wt.path, base, own, w);
       if (!taken.ok)
         return { result: taken };
-      this.headMoved(wt.id);
+      await this.headMoved(wt.id);
       if ((await aheadBehind(wt.path, base)).ahead === 0) {
         already = true;
         sha = await commitOf(wt.path, base) ?? "";
@@ -32337,7 +33320,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
       }
       const squash = method === "squash" ? await squashMessage(wt.path, base, suggested) : "";
       const built = await landingCommit(wt.path, wt.branch, base, method, squash, own, w);
-      this.headMoved(wt.id);
+      await this.headMoved(wt.id);
       if (!built.ok || !built.sha)
         return { result: built };
       sha = built.sha;
@@ -32386,7 +33369,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     const r = await git(wt.path, "reset", "--keep", base);
     if (!r.ok)
       log.warn(wt.id, `could not restart ${wt.branch} from ${base}: ${r.err}`);
-    this.headMoved(wt.id);
+    await this.headMoved(wt.id);
   }
   async fetchBase(wt, repo, w) {
     if (!baseIsRemote(repo))
@@ -32453,7 +33436,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
       }
       const taken = await withRepoLock(repo.path, () => takeMainIn(r.path, r.base, own, w, carry));
       if (taken.ok) {
-        this.headMoved(worktreeId);
+        await this.headMoved(worktreeId);
         if (r.wt)
           await this.verdictSurvives(r.wt, { dropMessage: false });
       }
@@ -32469,10 +33452,8 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     const w = { step: (name) => this.step(worktreeId, name), git: UNWATCHED.git };
     return this.ship(worktreeId, "pull-main", async () => {
       const result = await this.trunk.pull(repo.id, w);
-      if (result.ok) {
-        this.invalidateCounts();
-        this.headMoved(worktreeId);
-      }
+      if (result.ok && result.moved)
+        await this.recountAll();
       return result;
     });
   }
@@ -32494,8 +33475,8 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
   syncTrunk(repoId) {
     return this.trunk.sync(repoId);
   }
-  async trunks(opts = {}) {
-    const all = await this.trunk.all(opts);
+  trunksNow() {
+    const all = this.trunk.all();
     for (const t of Object.values(all)) {
       const shipping = this.ops.get(t.id);
       if (shipping)
@@ -32511,79 +33492,95 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     this.usage.set(worktreeId, found);
     return found ?? undefined;
   }
-  headMoved(worktreeId) {
-    this.countsCache.delete(worktreeId);
+  async headMoved(worktreeId) {
+    this.counts.stale(worktreeId);
+    await this.counts.refresh([worktreeId]);
     this.d.hub.emit("worktreesChanged");
   }
+  async recountAll() {
+    this.counts.stale();
+    await this.counts.refresh(this.countedIds());
+  }
   invalidateCounts(worktreeId) {
-    if (worktreeId)
-      this.countsCache.delete(worktreeId);
-    else
-      this.countsCache.clear();
+    this.counts.stale(worktreeId);
   }
   recount(repoId) {
-    this.countsCache.clear();
+    this.counts.stale();
     this.d.hub.emit("repoTick", repoId);
     const repo = this.d.state.repo(repoId);
     if (repo && baseIsRemote(repo))
       fireAndForget(repoId, this.trunk.sync(repoId), "trunk sync");
   }
   invalidateDiscovered() {
-    this.discoverCache.clear();
+    this.listMark++;
+    for (const cached of this.discoverCache.values())
+      cached.at = 0;
   }
   discoveredById(id) {
-    for (const { rows } of this.discoverCache.values()) {
-      const found = rows.find((r) => r.id === id);
-      if (found)
-        return found;
-    }
-    return null;
-  }
-  discoveredQuick(quick) {
-    return this.d.state.repos.flatMap((repo) => {
-      const cached = this.discoverCache.get(repo.id);
-      if (cached)
-        return cached.rows;
-      quick.missed = true;
-      return [];
-    });
+    return this.foundCached().find((r) => r.id === id) ?? null;
   }
   async discovered() {
-    const perRepo = await Promise.all(this.d.state.repos.map(async (repo) => {
-      const cached = this.discoverCache.get(repo.id);
-      if (cached && Date.now() - cached.at < 1e4)
-        return cached.rows;
-      try {
-        const rows = await discoverIn(repo.id, repo.path, this.d.state.worktrees);
-        this.discoverCache.set(repo.id, { rows, at: Date.now() });
-        return rows;
-      } catch (e) {
-        log.warn(repo.id, "could not list this repo's worktrees", e);
-        return cached?.rows ?? [];
-      }
+    await this.relist(this.d.state.repos.filter((repo) => this.listDue(repo.id)));
+    return this.foundCached();
+  }
+  foundNow() {
+    const due = this.d.state.repos.filter((repo) => this.listDue(repo.id));
+    if (due.length)
+      this.behind("discover", this.relist(due), "worktree list");
+    return this.foundCached();
+  }
+  foundCached() {
+    const owned = new Set(this.d.state.worktrees.flatMap((w) => [w.id, w.path]));
+    return this.d.state.repos.flatMap((repo) => (this.discoverCache.get(repo.id)?.rows ?? []).filter((r) => !owned.has(r.id) && !owned.has(r.path)));
+  }
+  listDue(repoId) {
+    const cached = this.discoverCache.get(repoId);
+    return !cached || Date.now() - cached.at >= COUNTS_FLOOR_MS;
+  }
+  async relist(repos) {
+    const moved = await Promise.all(repos.map((repo) => {
+      const running = this.relisting.get(repo.id);
+      if (running)
+        return running;
+      const listing = (async () => {
+        const cached = this.discoverCache.get(repo.id);
+        try {
+          for (;; ) {
+            const mark = this.listMark;
+            const rows = await discoverIn(repo.id, repo.path, this.d.state.worktrees);
+            if (mark !== this.listMark)
+              continue;
+            this.discoverCache.set(repo.id, { rows, at: Date.now() });
+            return JSON.stringify(cached?.rows ?? []) !== JSON.stringify(rows);
+          }
+        } catch (e) {
+          log.warn(repo.id, "could not list this repo's worktrees", e);
+          return false;
+        } finally {
+          this.relisting.delete(repo.id);
+        }
+      })();
+      this.relisting.set(repo.id, listing);
+      return listing;
     }));
-    const rows = perRepo.flat();
-    this.d.runtime.pruneLooseShells(new Set(rows.map((r) => r.id)));
-    return rows;
-  }
-  async counts(id, path, base, countable) {
-    const cached = this.countsCache.get(id);
-    if (cached && Date.now() - cached.at < 1e4)
-      return cached;
-    if (this.going.has(id))
-      return cached ?? {};
-    try {
-      const ab = countable ? await aheadBehind(path, base) : await this.trunk.behind(id, path);
-      const dirty = (await statusFiles(path)).length;
-      const unpushed = await this.unpushed(id, path);
-      if (this.going.has(id))
-        return cached ?? {};
-      const fresh = { ...ab, ...unpushed === undefined ? {} : { unpushed }, dirty, at: Date.now() };
-      this.countsCache.set(id, fresh);
-      return fresh;
-    } catch {
-      return cached ?? {};
-    }
+    this.d.runtime.pruneLooseShells(new Set(this.foundCached().map((r) => r.id)));
+    const any = moved.some(Boolean);
+    if (any)
+      this.d.hub.emit("worktreesChanged");
+    return any;
+  }
+  async readCounts(id) {
+    const wt = this.d.state.worktree(id);
+    const found = wt ? null : this.discoveredById(id);
+    const row = wt ?? found;
+    const repo = row && this.d.state.repo(row.repoId);
+    if (!row || !repo)
+      return null;
+    const countable = wt ? !isMain(wt) : !!found?.branch;
+    const ab = countable ? await aheadBehind(row.path, baseOf(repo)) : await this.trunk.behind(id, row.path);
+    const dirty = (await statusFiles(row.path)).length;
+    const unpushed = await this.unpushed(id, row.path);
+    return { ...ab, ...unpushed === undefined ? {} : { unpushed }, dirty };
   }
   async unpushed(id, path) {
     if (this.d.state.worktree(id)?.pr?.state !== "open")
@@ -32591,12 +33588,9 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     return await aheadUpstream(path) ?? undefined;
   }
   async freshCounts(worktreeId) {
-    const wt = this.d.state.worktree(worktreeId);
-    const repo = wt && this.d.state.repo(wt.repoId);
-    if (!wt || !repo)
+    if (this.going.has(worktreeId))
       return {};
-    this.countsCache.delete(worktreeId);
-    return this.counts(wt.id, wt.path, baseOf(repo), true);
+    return await this.counts.read(worktreeId) ?? {};
   }
   readable(id) {
     const wt = this.d.state.worktree(id);
@@ -32687,14 +33681,13 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     }
   }
   noteCounts(id, main, dirty, ab) {
-    const prev = this.countsCache.get(id);
+    const prev = this.counts.get(id);
     if (main && !prev)
       return;
     const ahead = main ? prev?.ahead : ab.ahead;
     const behind = main ? prev?.behind : ab.behind;
     const unpushed = main ? prev?.unpushed : ab.unpushed;
-    this.countsCache.set(id, { ahead, behind, unpushed, dirty, at: Date.now() });
-    if (prev?.dirty !== dirty || prev?.ahead !== ahead || prev?.behind !== behind || prev?.unpushed !== unpushed)
+    if (this.counts.put(id, { ahead, behind, unpushed, dirty }))
       this.d.hub.emit("worktreesChanged");
   }
   async gitLog(worktreeId) {
@@ -32738,12 +33731,40 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
     this.d.state.save();
     this.d.hub.emit("worktreesChanged");
   }
-  async rows(opts = {}) {
-    const quick = opts.quick ? { missed: false } : null;
-    const [owned, found] = await Promise.all([this.ownedRows(quick), this.foundRows(quick)]);
-    if (quick?.missed)
-      setTimeout(() => this.d.hub.emit("worktreesChanged"), 0);
-    return [...owned, ...found];
+  snapshot() {
+    const rows = [...this.ownedRows(), ...this.foundRows()];
+    const trunks = this.trunksNow();
+    const reading = this.counts.refresh(idsOf(rows, trunks));
+    if (reading) {
+      this.behind("counts", reading.then((moved) => {
+        if (moved)
+          this.d.hub.emit("worktreesChanged");
+      }), "badge counts");
+    }
+    return { rows, trunks };
+  }
+  rows() {
+    return this.snapshot().rows;
+  }
+  trunks() {
+    return this.snapshot().trunks;
+  }
+  countedIds() {
+    return idsOf([...this.ownedRows(), ...this.foundCached()], this.trunksNow());
+  }
+  behind(tag, read, what) {
+    this.pending.add(read);
+    const done = () => this.pending.delete(read);
+    read.then(done, done);
+    fireAndForget(tag, read, what);
+  }
+  async settled() {
+    let waited = false;
+    while (this.pending.size) {
+      waited = true;
+      await Promise.all(this.pending);
+    }
+    return waited;
   }
   mainOf(repoId) {
     return mainOf(this.d.state, repoId);
@@ -32751,24 +33772,16 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
   leadSpareOf(repoId) {
     return this.spare.current(repoId)?.worktreeId ?? null;
   }
-  countsQuick(id, quick) {
-    const c = this.countsCache.get(id);
-    if (c)
-      return c;
-    quick.missed = true;
-    return {};
-  }
   isRow(wt) {
     if (wt.kind === "worktree")
       return true;
     const lead = this.leadSpareOf(wt.repoId);
     return wt.kind === "spare" ? lead === wt.id : lead === null;
   }
-  async ownedRows(quick) {
-    return Promise.all(this.d.state.worktrees.filter((wt) => this.isRow(wt)).map(async (wt) => {
+  ownedRows() {
+    return this.d.state.worktrees.filter((wt) => this.isRow(wt)).map((wt) => {
       const rt = this.d.runtime.get(wt.id);
-      const repo = this.d.state.requireRepo(wt.repoId);
-      const { ahead, behind, unpushed, dirty } = quick ? this.countsQuick(wt.id, quick) : await this.counts(wt.id, wt.path, baseOf(repo), !isMain(wt));
+      const { ahead, behind, unpushed, dirty } = this.counts.get(wt.id) ?? {};
       return {
         id: wt.id,
         repoId: wt.repoId,
@@ -32791,13 +33804,11 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
         sessionId: this.d.state.session(wt.id),
         shipping: this.ops.get(wt.id)
       };
-    }));
+    });
   }
-  async foundRows(quick) {
-    const found = quick ? this.discoveredQuick(quick) : await this.discovered();
-    return Promise.all(found.map(async (f) => {
-      const repo = this.d.state.repo(f.repoId);
-      const { ahead, behind, dirty } = !repo ? {} : quick ? this.countsQuick(f.id, quick) : await this.counts(f.id, f.path, baseOf(repo), !!f.branch);
+  foundRows() {
+    return this.foundNow().map((f) => {
+      const { ahead, behind, dirty } = this.counts.get(f.id) ?? {};
       return {
         ...f,
         procs: [],
@@ -32808,7 +33819,7 @@ ${wt.landing.body}` : wt.landing.subject : undefined;
         dirty,
         shipping: this.ops.get(f.id)
       };
-    }));
+    });
   }
 }
 
@@ -32919,6 +33930,12 @@ ensureDirs(paths);
 var token = loadOrCreateToken(paths);
 var port = Number(process.env.TOYON_PORT ?? DAEMON_DEFAULT_PORT);
 var remote = loadRemote(paths.remoteFile, process.env, managed.policy);
+var grants = new GrantCodes;
+var previewGate = remote && {
+  grant: previewGrant(token),
+  host: remote.host,
+  redeem: (code) => grants.redeem(code)
+};
 if (remote && addressedByPort(remote.previews))
   pinProxyPorts(PREVIEW_PORTS);
 var state = new StateStore(paths);
@@ -32951,6 +33968,9 @@ var accounts = new AgentAccounts({
 accounts.onChange = () => hub.emit("agentsChanged");
 var uploads = new UploadStore(paths.uploadsDir);
 var attachments2 = new AttachmentStore(paths.attachmentsDir, uploads);
+var mcpPort = port;
+var tools = new ToolSet;
+var mcp = new ToyonMcp({ url: (id) => `http://127.0.0.1:${mcpPort}/mcp/${id}`, version: package_default.version, tools });
 var runtime = new RuntimeRegistry({
   hub,
   state,
@@ -32962,10 +33982,11 @@ var runtime = new RuntimeRegistry({
   bridgeScript: () => bridge.get(),
   turnStarting: (id) => worktrees.turnStarted(id),
   remote,
-  grant: previewGrant(token),
+  gate: previewGate,
   viewed: (id) => idle.isViewed(id),
   shown: (id) => idle.isShown(id),
-  mainLeads: (repoId) => worktrees.spare.current(repoId) === null
+  mainLeads: (repoId) => worktrees.spare.current(repoId) === null,
+  mcp
 });
 var drafts = new DraftStore({
   file: paths.draftsFile,
@@ -32990,6 +34011,13 @@ var worktrees = new WorktreeService({
   fix
 });
 new BackendShare({ state, hub, runtime, own: (id, names) => worktrees.ownProcs(id, names) });
+var handoff2 = new HandoffService({
+  state,
+  hub,
+  runtime,
+  create: (repoId, prompt, opts) => worktrees.create(repoId, prompt, opts)
+});
+tools.add(handoff2);
 var turns = new TurnService({
   state,
   hub,
@@ -33094,12 +34122,18 @@ var keepAwake = new KeepAwake({
   mode: () => state.keepAwake,
   answerable: remote !== null
 });
-var { branded, stop: stopServer } = startServer({
+var {
+  server,
+  branded,
+  stop: stopServer
+} = startServer({
   port,
   token,
   shellDist: SHELL_DIST,
   version: package_default.version,
   noteShellOrigin: (origin) => bridge.learnShellOrigin(origin),
+  onTrusted: () => refreshShellOrigins(),
+  grants,
   remote,
   managed,
   services: {
@@ -33124,6 +34158,8 @@ var { branded, stop: stopServer } = startServer({
     prs,
     landing,
     fix,
+    handoff: handoff2,
+    mcp,
     themes,
     agents,
     accounts,
@@ -33136,17 +34172,22 @@ var { branded, stop: stopServer } = startServer({
     folderDialog: folderDialog()
   }
 });
-bridge.setShellOrigins([
-  ...remote?.front === "edge" ? [] : [
-    `http://127.0.0.1:${port}`,
-    `http://localhost:${port}`,
-    `http://toyon.localhost:${port}`,
-    ...branded ? ["http://toyon.localhost"] : [],
-    `http://127.0.0.1:${SHELL_DEV_PORT}`,
-    `http://localhost:${SHELL_DEV_PORT}`
-  ],
-  ...remote ? [`https://${remote.host}`] : []
-]);
+mcpPort = server.port ?? port;
+function refreshShellOrigins() {
+  bridge.setShellOrigins([
+    ...remote?.front === "edge" ? [] : [
+      `http://127.0.0.1:${port}`,
+      `http://localhost:${port}`,
+      `http://toyon.localhost:${port}`,
+      ...branded ? ["http://toyon.localhost"] : [],
+      `http://127.0.0.1:${SHELL_DEV_PORT}`,
+      `http://localhost:${SHELL_DEV_PORT}`
+    ],
+    ...remote ? [`https://${remote.host}`] : [],
+    ...state.trustedOrigins
+  ]);
+}
+refreshShellOrigins();
 writeFileSync10(paths.pidFile, `${process.pid}
 `);
 var stopLagSampler = startLagSampler();