@4pm/cli 0.5.0 → 0.7.0

package/dist/index.js

@@ -1995,14 +1995,14 @@ var require_react_development = __commonJS({
               var thenableResult = result;
               var wasAwaited = false;
               var thenable = {
-                then: function(resolve5, reject) {
+                then: function(resolve6, reject) {
                   wasAwaited = true;
                   thenableResult.then(function(returnValue2) {
                     popActScope(prevActScopeDepth);
                     if (actScopeDepth === 0) {
-                      recursivelyFlushAsyncActWork(returnValue2, resolve5, reject);
+                      recursivelyFlushAsyncActWork(returnValue2, resolve6, reject);
                     } else {
-                      resolve5(returnValue2);
+                      resolve6(returnValue2);
                     }
                   }, function(error2) {
                     popActScope(prevActScopeDepth);
@@ -2032,20 +2032,20 @@ var require_react_development = __commonJS({
                   ReactCurrentActQueue.current = null;
                 }
                 var _thenable = {
-                  then: function(resolve5, reject) {
+                  then: function(resolve6, reject) {
                     if (ReactCurrentActQueue.current === null) {
                       ReactCurrentActQueue.current = [];
-                      recursivelyFlushAsyncActWork(returnValue, resolve5, reject);
+                      recursivelyFlushAsyncActWork(returnValue, resolve6, reject);
                     } else {
-                      resolve5(returnValue);
+                      resolve6(returnValue);
                     }
                   }
                 };
                 return _thenable;
               } else {
                 var _thenable2 = {
-                  then: function(resolve5, reject) {
-                    resolve5(returnValue);
+                  then: function(resolve6, reject) {
+                    resolve6(returnValue);
                   }
                 };
                 return _thenable2;
@@ -2061,7 +2061,7 @@ var require_react_development = __commonJS({
             actScopeDepth = prevActScopeDepth;
           }
         }
-        function recursivelyFlushAsyncActWork(returnValue, resolve5, reject) {
+        function recursivelyFlushAsyncActWork(returnValue, resolve6, reject) {
           {
             var queue = ReactCurrentActQueue.current;
             if (queue !== null) {
@@ -2070,16 +2070,16 @@ var require_react_development = __commonJS({
                 enqueueTask(function() {
                   if (queue.length === 0) {
                     ReactCurrentActQueue.current = null;
-                    resolve5(returnValue);
+                    resolve6(returnValue);
                   } else {
-                    recursivelyFlushAsyncActWork(returnValue, resolve5, reject);
+                    recursivelyFlushAsyncActWork(returnValue, resolve6, reject);
                   }
                 });
               } catch (error2) {
                 reject(error2);
               }
             } else {
-              resolve5(returnValue);
+              resolve6(returnValue);
             }
           }
         }
@@ -24450,7 +24450,7 @@ function resolveProfileArg(args) {
     const rest = [...args.slice(0, index), ...args.slice(index + 2)];
     return [name, rest];
   }
-  return [process.env.FOURPM_PROFILE ?? null, args];
+  return [process.env.FOURPM_PROFILE || null, args];
 }
 function listProfiles() {
   const base = join(homedir(), ".4pm", "profiles");
@@ -24469,6 +24469,27 @@ function profileDir(name) {
   mkdirSync(dir2, { recursive: true });
   return dir2;
 }
+function defaultProfileConfig() {
+  return {
+    aiCli: "claude",
+    // Lists so failover across profiles is discoverable (ADR-0057) — add more objects.
+    // `args` are the full per-CLI defaults (claude stream-json for metering — ADR-0072).
+    // `model` = the CLI's `--model` flag; default "sonnet" — the balanced mid-price tier
+    // (cheaper than opus, more capable than haiku). "" ⇒ the CLI's own default model.
+    claudeHome: [
+      { profile: ".claude", args: ["-p", "--output-format", "stream-json", "--verbose"], model: "sonnet" }
+    ],
+    codexHome: [{ profile: ".codex", args: ["exec"], model: "" }],
+    antigravityHome: [],
+    autoUpdate: true,
+    commandHistoryUploadMinutes: 10
+  };
+}
+function ensureProfileConfig(dir2) {
+  if (existsSync(join(dir2, "config.json"))) return false;
+  writeProfileConfig(dir2, defaultProfileConfig());
+  return true;
+}
 function readProfileConfig(dir2) {
   const path = join(dir2, "config.json");
   if (!existsSync(path)) return {};
@@ -24483,6 +24504,10 @@ function writeProfileConfig(dir2, patch) {
   writeFileSync(join(dir2, "config.json"), JSON.stringify(merged, null, 2), "utf8");
   return merged;
 }
+function overwriteProfileConfig(dir2, config) {
+  writeFileSync(join(dir2, "config.json"), JSON.stringify(config, null, 2), "utf8");
+  return config;
+}
 function deleteProfileConfigKey(dir2, key) {
   const config = readProfileConfig(dir2);
   delete config[key];
@@ -24638,15 +24663,17 @@ async function runLink(serverUrl, explicitProfile) {
   );
   const profileName = explicitProfile ?? sanitizeProfileName(username);
   const existed = readCredential(profileDir(profileName), profileName) != null;
-  writeCredential(profileDir(profileName), {
+  const dir2 = profileDir(profileName);
+  writeCredential(dir2, {
     serverUrl,
     hashcode3,
     scope,
     // decided by the server from the pairing user (ADR-0010); shown in the TUI
     pairedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
+  ensureProfileConfig(dir2);
   if (projectName && scope === "project") {
-    const folder = join3(profileDir(profileName), projectName);
+    const folder = join3(dir2, projectName);
     mkdirSync2(folder, { recursive: true });
     console.log(`\u2714 Created physic project folder: ${folder}`);
   }
@@ -24842,6 +24869,30 @@ function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
   const exp = Math.min(baseMs * 2 ** attempt, maxMs);
   return Math.floor(exp / 2 + Math.random() * (exp / 2));
 }
+function looksLikeJsonOrCode(text) {
+  const t = text.replace(/^\s+/, "");
+  if (t.startsWith("```")) return "code";
+  if (t.startsWith("{") || t.startsWith("[")) return "json";
+  return null;
+}
+function prettyResult(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      return JSON.stringify(JSON.parse(trimmed), null, 2);
+    } catch {
+      const start = trimmed.search(/[{[]/);
+      const end = Math.max(trimmed.lastIndexOf("}"), trimmed.lastIndexOf("]"));
+      if (start >= 0 && end > start) {
+        try {
+          return JSON.stringify(JSON.parse(trimmed.slice(start, end + 1)), null, 2);
+        } catch {
+        }
+      }
+    }
+  }
+  return trimmed;
+}
 
 // ../../22-packages/11-shared/11-constants/src/roles.ts
 var Role = {
@@ -24880,6 +24931,8 @@ var PermissionCode = {
   // ADMIN resets a sub-account's password directly (user-0010)
   USER_SET_PASSWORD: "user.set_password",
   USER_DELETE: "user.delete",
+  // org-level pause/resume of a user (ADR-0093)
+  USER_PAUSE: "user.pause",
   // invite users by email (ADR-0021)
   USER_INVITE: "user.invite",
   // team
@@ -24904,6 +24957,11 @@ var PermissionCode = {
   PROJECT_DETACH_USER: "project.detach_user",
   PROJECT_ATTACH_MANAGER: "project.attach_manager",
   PROJECT_DETACH_MANAGER: "project.detach_manager",
+  // project lifecycle (ADR-0092): pause+resume / close+reopen
+  PROJECT_PAUSE: "project.pause",
+  PROJECT_CLOSE: "project.close",
+  // project-membership pause+resume of a direct member (ADR-0093)
+  PROJECT_PAUSE_MEMBER: "project.pause_member",
   PROJECT_AI_ASSIST: "project.ai_assist",
   PROJECT_MEMO_READ: "project.memo_read",
   PROJECT_MEMO_WRITE: "project.memo_write",
@@ -24932,6 +24990,9 @@ var PermissionCode = {
   // billing
   BILLING_READ: "billing.read",
   BILLING_MANAGE: "billing.manage",
+  // org template files (ADR-0113) — ADMIN + PM manage the org's template library
+  TEMPLATE_READ: "template.read",
+  TEMPLATE_WRITE: "template.write",
   // integration (community-server — ADR-0058; served by @4pm/community)
   INTEGRATION_READ: "integration.read",
   INTEGRATION_CONNECT: "integration.connect",
@@ -24971,9 +25032,12 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.USER_READ,
     P.USER_UPDATE,
     P.USER_DELETE,
+    P.USER_PAUSE,
     P.USER_INVITE,
     P.QUOTA_READ,
     P.QUOTA_MANAGE,
+    P.TEMPLATE_READ,
+    P.TEMPLATE_WRITE,
     P.TEAM_LIST,
     P.TEAM_CREATE,
     P.TEAM_READ,
@@ -24994,6 +25058,9 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.PROJECT_DETACH_USER,
     P.PROJECT_ATTACH_MANAGER,
     P.PROJECT_DETACH_MANAGER,
+    P.PROJECT_PAUSE,
+    P.PROJECT_CLOSE,
+    P.PROJECT_PAUSE_MEMBER,
     P.PROJECT_AI_ASSIST,
     P.PROJECT_MEMO_READ,
     P.PROJECT_MEMO_WRITE,
@@ -25060,7 +25127,9 @@ var ROLE_DEFAULT_PERMISSIONS = {
     P.INTEGRATION_PAGE_WRITE
   ]
 };
-var TL_DEFAULT_PERMISSIONS = ROLE_DEFAULT_PERMISSIONS[Role.PM].filter((code) => code !== P.USER_DELETE);
+var TL_DEFAULT_PERMISSIONS = ROLE_DEFAULT_PERMISSIONS[Role.PM].filter(
+  (code) => code !== P.USER_DELETE && code !== P.USER_PAUSE
+);
 var PROJECT_SCOPE_CHECKED_CODES = [
   P.PROJECT_UPDATE,
   P.PROJECT_DELETE,
@@ -25070,6 +25139,9 @@ var PROJECT_SCOPE_CHECKED_CODES = [
   P.PROJECT_DETACH_USER,
   P.PROJECT_ATTACH_MANAGER,
   P.PROJECT_DETACH_MANAGER,
+  P.PROJECT_PAUSE,
+  P.PROJECT_CLOSE,
+  P.PROJECT_PAUSE_MEMBER,
   P.PROJECT_AI_ASSIST
 ];
 var SELF_SERVICE_CODES = [
@@ -25104,6 +25176,9 @@ var TEAM_GRANTABLE_CODES = [
   P.PROJECT_DETACH_USER,
   P.PROJECT_ATTACH_MANAGER,
   P.PROJECT_DETACH_MANAGER,
+  P.PROJECT_PAUSE,
+  P.PROJECT_CLOSE,
+  P.PROJECT_PAUSE_MEMBER,
   P.PROJECT_AI_ASSIST,
   P.PROJECT_MEMO_READ,
   P.PROJECT_MEMO_WRITE,
@@ -25122,6 +25197,9 @@ var PROJECT_GRANTABLE_CODES = [
   P.PROJECT_DETACH_USER,
   P.PROJECT_ATTACH_MANAGER,
   P.PROJECT_DETACH_MANAGER,
+  P.PROJECT_PAUSE,
+  P.PROJECT_CLOSE,
+  P.PROJECT_PAUSE_MEMBER,
   P.PROJECT_AI_ASSIST,
   P.PROJECT_MEMO_READ,
   P.PROJECT_MEMO_WRITE,
@@ -25178,6 +25256,12 @@ var QuotaOnExceed = {
   WARN: "warn"
 };
 
+// ../../22-packages/11-shared/11-constants/src/billing.ts
+var PaymentProvider = {
+  STRIPE: "stripe",
+  PAYPAL: "paypal"
+};
+
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -29228,6 +29312,7 @@ var baseRequestSchema = external_exports.object({
   order: external_exports.enum(["asc", "desc"]).default("desc")
 });
 var pinnedFilterSchema = external_exports.enum(["true", "false"]).transform((v) => v === "true").optional();
+var deletedFilterSchema = external_exports.enum(["true", "false"]).transform((v) => v === "true").optional();
 
 // ../../22-packages/11-shared/41-validation/src/schemas.ts
 var passwordSchema = external_exports.string().min(8, "password: at least 8 characters").max(72, "password: at most 72 characters").regex(/[a-zA-Z]/, "password: needs at least 1 letter").regex(/[0-9]/, "password: needs at least 1 digit");
@@ -29243,12 +29328,18 @@ var ipAllowlistSchema = external_exports.array(ipCidrSchema).max(50).default([])
 var hexTokenSchema = external_exports.string().regex(/^[0-9a-f]{64}$/, "token: invalid format");
 
 // ../../22-packages/11-shared/31-dto/src/auth.ts
+var paymentProviderSchema = external_exports.enum([
+  PaymentProvider.STRIPE,
+  PaymentProvider.PAYPAL
+]);
 var registerRequestSchema = external_exports.object({
   username: usernameSchema,
   email: emailSchema,
   password: passwordSchema,
   phone: phoneSchema,
-  ipAllowlist: ipAllowlistSchema.optional()
+  ipAllowlist: ipAllowlistSchema.optional(),
+  planCode: external_exports.string().min(1).max(50).optional(),
+  provider: paymentProviderSchema.optional()
 });
 var mailTokenRequestSchema = external_exports.object({
   token: hexTokenSchema
@@ -29292,21 +29383,37 @@ var resetPasswordRequestSchema = external_exports.object({
 
 // ../../22-packages/11-shared/31-dto/src/org.ts
 var CLI_SETTINGS_BOUNDS = {
-  reconnectMaxBackoffSec: { min: 5, max: 600 },
+  reconnectMaxBackoffSec: { min: 5, max: 60 },
   autoUpdateHour: { min: 0, max: 23 }
 };
+var orgAliasSchema = external_exports.string().regex(/^([a-z0-9-]{3,40})?$/, "alias must be 3\u201340 chars of a\u2013z, 0\u20139, -");
 var updateOrgRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100).optional(),
+  // ADMIN-only login alias (ADR-0111); empty string clears it.
+  alias: orgAliasSchema.optional(),
   settings: external_exports.record(external_exports.unknown()).optional()
 });
 
 // ../../22-packages/11-shared/31-dto/src/user.ts
 var AVATAR_MAX_BYTES = 2 * 1024 * 1024;
+var USAGE_ALERT_METRICS = ["session5h", "weekly", "monthlyTokens"];
+var usageAlertRuleSchema = external_exports.object({
+  id: external_exports.string().min(1).max(64),
+  metric: external_exports.enum(USAGE_ALERT_METRICS),
+  threshold: external_exports.number().int().min(1),
+  email: external_exports.union([emailSchema, external_exports.literal("")]).optional(),
+  enabled: external_exports.boolean().default(true)
+});
+var userAlertsSchema = external_exports.object({
+  rules: external_exports.array(usageAlertRuleSchema).max(20).default([])
+});
 var rolesSchema = external_exports.array(external_exports.enum(ALL_ROLES)).min(1).refine((roles) => isValidRoleSet(roles), {
   message: "ADMIN/MACHINE cannot be combined with other roles"
 });
 var listUsersQuerySchema = baseRequestSchema.extend({
-  role: external_exports.enum(ALL_ROLES).optional()
+  role: external_exports.enum(ALL_ROLES).optional(),
+  /** ADMIN-only Trash: list soft-deleted users (ADR-0109). */
+  deleted: deletedFilterSchema
 });
 var createUserRequestSchema = external_exports.object({
   username: usernameSchema,
@@ -29321,7 +29428,11 @@ var updateUserRequestSchema = external_exports.object({
   email: emailSchema.optional(),
   phone: phoneSchema.nullable().optional(),
   roles: rolesSchema.optional(),
-  ipAllowlist: ipAllowlistSchema.optional()
+  ipAllowlist: ipAllowlistSchema.optional(),
+  // Usage-alert rules (ADR-0110) — manager-only, like the IP allowlist.
+  alerts: userAlertsSchema.optional(),
+  // cli data retention days (ADR-0115) — manager-only; capped at the plan's retentionDays.
+  cliRetentionDays: external_exports.number().int().min(0).max(3650).optional()
 });
 var setUserPasswordRequestSchema = external_exports.object({
   password: passwordSchema
@@ -29342,7 +29453,9 @@ var contactChangeConfirmSchema = external_exports.object({
 
 // ../../22-packages/11-shared/31-dto/src/team.ts
 var listTeamsQuerySchema = baseRequestSchema.extend({
-  pinned: pinnedFilterSchema
+  pinned: pinnedFilterSchema,
+  /** ADMIN-only Trash: list soft-deleted teams (ADR-0109). */
+  deleted: deletedFilterSchema
 });
 var createTeamRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100),
@@ -29358,9 +29471,14 @@ var attachTeamUserRequestSchema = external_exports.object({
   isLead: external_exports.boolean().optional()
 });
 
+// ../../22-packages/11-shared/31-dto/src/template.ts
+var TEMPLATE_KINDS = ["report", "est", "wbs", "proposal", "feasibility"];
+
 // ../../22-packages/11-shared/31-dto/src/project.ts
 var listProjectsQuerySchema = baseRequestSchema.extend({
-  pinned: pinnedFilterSchema
+  pinned: pinnedFilterSchema,
+  /** ADMIN-only Trash: list soft-deleted projects (ADR-0109). */
+  deleted: deletedFilterSchema
 });
 var recentProjectsQuerySchema = external_exports.object({
   limit: external_exports.coerce.number().int().min(1).max(20).default(5)
@@ -29370,11 +29488,37 @@ var createProjectRequestSchema = external_exports.object({
   description: external_exports.string().max(2e3).optional(),
   machineUserId: external_exports.string().uuid().optional()
 });
+var DEFAULT_OUTBOUND_RULES = {
+  secret: [
+    String.raw`/\b(api[_-]?key|secret|password|passwd|access[_-]?token|bearer)\b\s*[:=]\s*\S+/i`,
+    String.raw`/AKIA[0-9A-Z]{16}/`,
+    String.raw`/\b(gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9]{20,})\b/`,
+    String.raw`/-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/`,
+    String.raw`/\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)\s*=\s*\S{6,}/`
+  ],
+  environment: [
+    String.raw`/\b(?:ssh|scp|rsync)\s+[\w.-]+@/i`,
+    String.raw`/\bsudo\b/i`,
+    String.raw`/\bkubectl\b/i`,
+    String.raw`/\bdocker\s+(?:push|-H|--host)\b/i`,
+    String.raw`/\b(?:aws|gcloud|az)\s+\w+/i`,
+    String.raw`/\bcurl\b[^\n]*\bhttps?:\/\/(?!localhost|127\.0\.0\.1)/i`
+  ]
+};
+function compileRulePattern(entry) {
+  const literal = /^\/(.+)\/([gimsuy]*)$/s.exec(entry.trim());
+  if (literal) return new RegExp(literal[1] ?? "", literal[2] ?? "");
+  return new RegExp(entry.trim());
+}
 var updateProjectRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100).optional(),
   description: external_exports.string().max(2e3).optional(),
   // Mid-tier IP allowlist (ADR-0050) — PM(manage)/ADMIN only; must fall within org.
-  ipAllowlist: ipAllowlistSchema.optional()
+  ipAllowlist: ipAllowlistSchema.optional(),
+  // Messenger retention in days (0 = keep forever) — manager only (ADR-0078).
+  messengerRetentionDays: external_exports.number().int().min(0).max(3650).optional(),
+  // Project settings (ADR-0081) — key-level shallow-merge; `tokens` clamped on read.
+  settings: external_exports.record(external_exports.unknown()).optional()
 });
 var MEMO_MAX_LENGTH = 65536;
 var putMemoRequestSchema = external_exports.object({
@@ -29390,9 +29534,26 @@ var updateMemoItemSchema = external_exports.object({
 }).refine((v) => v.content !== void 0 || v.done !== void 0, {
   message: "content or done required"
 });
+var putSpecDraftRequestSchema = external_exports.object({
+  spec: external_exports.record(external_exports.unknown()),
+  specVersion: external_exports.number().int().positive().optional()
+});
+var putProjectSpecRequestSchema = external_exports.object({
+  spec: external_exports.record(external_exports.unknown())
+});
+var ARTIFACT_MAX_BYTES = 512 * 1024;
+var listArtifactsQuerySchema = external_exports.object({
+  kind: external_exports.enum(TEMPLATE_KINDS).optional()
+});
+var createArtifactRequestSchema = external_exports.object({
+  kind: external_exports.enum(TEMPLATE_KINDS),
+  content: external_exports.string().min(1).max(ARTIFACT_MAX_BYTES)
+});
 var repoSpecSchema = external_exports.object({
   /** Role label (e.g. "docs" / "web" / "server") — descriptive, not constrained. */
   role: external_exports.string().max(60).optional().default(""),
+  /** Free-form description of what this repo holds (optional). */
+  desc: external_exports.string().max(500).optional().default(""),
   /** Exactly one repo of the project is the primary. */
   primary: external_exports.boolean().optional().default(false),
   /** `create` a new repo (provider) or use an `existing` one (url). */
@@ -29404,14 +29565,44 @@ var repoSpecSchema = external_exports.object({
   /** Existing repo url to clone/link (op=existing). */
   url: external_exports.string().max(500).optional().default(""),
   /** Sub-repo subfolder under the target root (empty ⇒ derived from role/name). */
-  subdir: external_exports.string().max(120).optional().default("")
+  subdir: external_exports.string().max(120).optional().default(""),
+  /** Default branch for this repo (empty ⇒ provider default, e.g. `main`). */
+  defaultBranch: external_exports.string().max(100).optional().default(""),
+  /** `.gitignore` template name for this repo (empty ⇒ none). */
+  gitignore: external_exports.string().max(40).optional().default(""),
+  /** Commit-message convention for this repo (empty ⇒ unspecified). */
+  commitConvention: external_exports.string().max(40).optional().default("")
+});
+var specFieldEnvelopeSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().optional().default(""),
+  description: external_exports.string().optional().default(""),
+  type: external_exports.string().optional().default("text"),
+  options: external_exports.array(external_exports.string()).optional(),
+  value: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]).optional().default("")
+});
+var subagentSpecSchema = external_exports.object({
+  name: external_exports.string().max(120).optional().default(""),
+  description: external_exports.string().max(2e3).optional().default("")
 });
 var projectSpecSchema = external_exports.object({
   specVersion: external_exports.number().int().positive(),
-  id: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  repos: external_exports.array(repoSpecSchema).optional()
-}).passthrough().superRefine((v, ctx) => {
+  fields: external_exports.array(specFieldEnvelopeSchema),
+  repos: external_exports.array(repoSpecSchema).optional().default([]),
+  subagents: external_exports.array(subagentSpecSchema).optional().default([]),
+  meta: external_exports.record(external_exports.unknown()).optional()
+}).superRefine((v, ctx) => {
+  const byId = new Map(v.fields.map((f) => [f.id, f.value]));
+  for (const key of ["id", "name"]) {
+    const val = byId.get(key);
+    if (typeof val !== "string" || val.trim() === "") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["fields"],
+        message: `the "${key}" field is required`
+      });
+    }
+  }
   if (v.repos && v.repos.length > 0) {
     const primaries = v.repos.filter((r) => r.primary).length;
     if (primaries !== 1) {
@@ -29425,28 +29616,39 @@ var projectSpecSchema = external_exports.object({
 });
 var createFromSpecRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
-  /** Target directory on the worker (from FsPicker — machine-0007). */
-  path: external_exports.string().min(1).max(500),
   spec: projectSpecSchema
 });
 var addRepoRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
-  path: external_exports.string().min(1).max(500),
-  /** Repo to clone; empty ⇒ `git init` in place. */
-  repoUrl: external_exports.string().url().max(500).optional(),
-  provider: external_exports.enum(["gh", "glab"]).optional()
+  repos: external_exports.array(repoSpecSchema).min(1)
+}).superRefine((v, ctx) => {
+  const primaries = v.repos.filter((r) => r.primary).length;
+  if (primaries !== 1) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["repos"],
+      message: "Exactly one repo must be primary"
+    });
+  }
+  for (let i = 0; i < v.repos.length; i++) {
+    const r = v.repos[i];
+    if (r && r.op === "existing" && !r.url) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["repos", i, "url"],
+        message: "An existing repo requires a url"
+      });
+    }
+  }
 });
-var specSuggestRequestSchema = external_exports.object({
-  projectId: external_exports.string().uuid(),
-  machineLinkId: external_exports.string().uuid(),
-  field: external_exports.string().min(1).max(100),
-  /** The spec-so-far (may be incomplete) for context. */
-  spec: external_exports.record(external_exports.unknown())
+
+// ../../22-packages/11-shared/31-dto/src/activity.ts
+var listActivityQuerySchema = baseRequestSchema.extend({
+  /** Filter by action prefix, e.g. "project." */
+  action: external_exports.string().max(50).optional()
 });
-var specReviewRequestSchema = external_exports.object({
-  projectId: external_exports.string().uuid(),
-  machineLinkId: external_exports.string().uuid(),
-  spec: external_exports.record(external_exports.unknown())
+var lifecycleActionRequestSchema = external_exports.object({
+  note: external_exports.string().max(500).optional()
 });
 
 // ../../22-packages/11-shared/31-dto/src/permission.ts
@@ -29505,17 +29707,43 @@ var updateMachineLinkRequestSchema = external_exports.object({
 });
 
 // ../../22-packages/11-shared/31-dto/src/command.ts
+var COMMAND_MAX_LEN = 8e3;
+var AI_PROMPT_MAX_LEN = 2e5;
 var dispatchCommandRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
   machineLinkId: external_exports.string().uuid(),
-  // In AI mode `command` carries the raw prompt (can be long), else an executable name.
-  command: external_exports.string().min(1).max(8e3),
+  // In AI mode `command` carries the raw prompt (can be long — the spec-assist prompts
+  // embed the whole self-describing spec envelope, ADR-0106), else an executable name.
+  command: external_exports.string().min(1).max(AI_PROMPT_MAX_LEN),
   args: external_exports.array(external_exports.string().max(1e3)).max(50).optional(),
   /**
    * AI prompt mode: run `command` as a prompt through the cli's AI CLI (profile
    * failover) instead of spawning it verbatim (mirrors a locally-typed prompt).
    */
-  ai: external_exports.boolean().optional()
+  ai: external_exports.boolean().optional(),
+  /**
+   * Short human label shown to OTHER tabs watching this cli's activity feed (ADR-0101):
+   * e.g. "AI review" so the Console shows a friendly line instead of the raw prompt.
+   */
+  label: external_exports.string().max(120).optional()
+}).superRefine((v, ctx) => {
+  if (!v.ai && v.command.length > COMMAND_MAX_LEN) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.too_big,
+      maximum: COMMAND_MAX_LEN,
+      type: "string",
+      inclusive: true,
+      path: ["command"],
+      message: `command too long (max ${COMMAND_MAX_LEN})`
+    });
+  }
+});
+var listCommandsQuerySchema = baseRequestSchema.extend({
+  projectId: external_exports.string().uuid(),
+  // Optional search filters (command-0005): `search` (from BaseRequest) matches the command
+  // text/status; `from`/`to` are an inclusive `YYYY-MM-DD` date range over `startedAt`.
+  from: external_exports.string().optional(),
+  to: external_exports.string().optional()
 });
 
 // ../../22-packages/11-shared/31-dto/src/invitation.ts
@@ -29603,16 +29831,68 @@ var planLimitSchema = external_exports.object({
   period: external_exports.enum([QuotaPeriod.DAY, QuotaPeriod.MONTH]),
   onExceed: external_exports.enum([QuotaOnExceed.BLOCK, QuotaOnExceed.WARN]).default(QuotaOnExceed.BLOCK)
 });
+var planEntitlementsSchema = external_exports.object({
+  /** Max human seats (MACHINE excluded — ADR-0041); null = unlimited. */
+  maxUsers: external_exports.number().int().min(1).nullable().default(null),
+  /** Max projects; null = unlimited. */
+  maxProjects: external_exports.number().int().min(1).nullable().default(null),
+  /** Allowed to create teams. */
+  teams: external_exports.boolean().default(false),
+  /** Allowed to use Community/4rum. */
+  community: external_exports.boolean().default(false),
+  /** Retention cap (days) for log/command/chat; null = unlimited. */
+  retentionDays: external_exports.number().int().min(1).nullable().default(null),
+  /**
+   * Total 4PM-hosted storage per org (bytes). Originally the template-file cap (ADR-0113),
+   * broadened by ADR-0122 to the org's WHOLE hosted storage: messages + command history
+   * (cli input/output/log) + files (templates/attachments/artifacts). `null` = unlimited.
+   */
+  templateStorageBytes: external_exports.number().int().min(0).nullable().default(null),
+  /** Per-file cap for a template upload (bytes — ADR-0113); null = unlimited. */
+  templateFileMaxBytes: external_exports.number().int().min(0).nullable().default(null),
+  /**
+   * How many 4PM-hosted machine-users the org may rent (ADR-0126). Base plans grant `0`;
+   * raised only by the `rented_machine` add-on (ADR-0123/0124). Never `null` (not "unlimited").
+   */
+  rentedMachineSeats: external_exports.number().int().min(0).default(0)
+});
+var DEFAULT_ENTITLEMENTS = {
+  maxUsers: 5,
+  maxProjects: 1,
+  teams: false,
+  community: false,
+  retentionDays: 30,
+  // Free tier: 100 MB total, 10 MB per file (ADR-0113).
+  templateStorageBytes: 100 * 1024 * 1024,
+  templateFileMaxBytes: 10 * 1024 * 1024,
+  // No rented machine-user seats by default — bought via the `rented_machine` add-on (ADR-0126).
+  rentedMachineSeats: 0
+};
+var checkoutRequestSchema = external_exports.object({
+  planCode: external_exports.string().min(1).max(50),
+  provider: external_exports.enum([PaymentProvider.STRIPE, PaymentProvider.PAYPAL]).optional()
+});
 var upsertPlanRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(100),
   price: external_exports.number().int().min(0).default(0),
-  limits: external_exports.array(planLimitSchema).default([])
+  limits: external_exports.array(planLimitSchema).default([]),
+  entitlements: planEntitlementsSchema.optional()
 });
 var assignPlanRequestSchema = external_exports.object({
   planCode: external_exports.string().min(1).max(50),
   /** Cycle length in days (defaults to 30). */
   periodDays: external_exports.number().int().min(1).max(366).default(30)
 });
+var addonBuyRequestSchema = external_exports.object({
+  code: external_exports.string().min(1).max(50),
+  quantity: external_exports.number().int().min(1).max(1e3),
+  /** Card path only; ignored when the org pays by credit (ADR-0104/0123). */
+  provider: external_exports.enum([PaymentProvider.STRIPE, PaymentProvider.PAYPAL]).optional()
+});
+var addonChangeRequestSchema = external_exports.object({
+  quantity: external_exports.number().int().min(0).max(1e3),
+  provider: external_exports.enum([PaymentProvider.STRIPE, PaymentProvider.PAYPAL]).optional()
+});
 
 // ../../22-packages/11-shared/31-dto/src/search.ts
 var SearchHitType = {
@@ -29626,11 +29906,11 @@ var SearchHitType = {
   MILESTONE: "milestone",
   /** Page/wiki (confluence + project docs — community). */
   PAGE: "page",
-  /** Message trong channel (Teams channel — community). */
+  /** A message in a channel (Teams channel — community). */
   MESSAGE: "message",
-  /** Message direct/group (lịch sử trò chuyện — community). */
+  /** A direct/group message (chat history — community). */
   CHAT: "chat",
-  /** Bài 4rum (community news/forum). */
+  /** A forum post (community news/forum). */
   POST: "post"
 };
 var searchQuerySchema = external_exports.object({
@@ -29670,6 +29950,12 @@ var WsChannels = {
   FS_READ: "fs.read",
   GIT_DIFF: "git.diff",
   GIT_ENV: "git.env",
+  // git history browse (read-through cli — ADR-0089): repos on the physic project,
+  // commit log, changed files of a commit, parent↔commit diff of one file.
+  GIT_REPOS: "git.repos",
+  GIT_LOG: "git.log",
+  GIT_COMMIT: "git.commit",
+  GIT_COMMIT_DIFF: "git.commit-diff",
   PROJECT_CREATE: "project.create",
   PROJECT_ADD: "project.add",
   PROJECT_PROGRESS: "project.progress",
@@ -29681,8 +29967,8 @@ var WsChannels = {
   PHYSIC_DELETE: "physic.delete",
   // command lifecycle
   COMMAND_ANNOUNCE: "command.announce",
-  AI_SUGGEST: "ai.suggest",
-  AI_REVIEW: "ai.review",
+  // AI spec-assist (suggest/review/compose) moved off dedicated ai.* channels to
+  // command.dispatch({ ai:true }) → the profile-failover AI path (ADR-0100).
   // quota & usage (ADR-0020)
   QUOTA_CHECK: "quota.check",
   USAGE_REPORT: "usage.report",
@@ -29690,8 +29976,18 @@ var WsChannels = {
   MACHINE_USAGE: "machine.usage",
   // cli → server: durable per-command history record on finish (ADR-0072)
   COMMAND_HISTORY: "command.history",
+  // cli → server: periodic upload of the cli's own JSONL log file (ADR-0122) — stored
+  // server-side + counted in the machine user's storage footprint.
+  MACHINE_LOG: "machine.log",
   // server → cli (reply): tail the cli's own JSONL logs on demand (ADR-0072)
-  LOG_READ: "log.read"
+  LOG_READ: "log.read",
+  // server → cli (reply): read a finished command's captured output on demand (ADR-0115) —
+  // cli stores command-output/{commandId}.log; returns null when pruned/unavailable.
+  COMMAND_OUTPUT_READ: "command.output-read",
+  // outbound review (ADR-0082): machine→server request, server→outbound evaluate, result back
+  REVIEW_REQUEST: "review.request",
+  REVIEW_EVALUATE: "review.evaluate",
+  REVIEW_RESULT: "review.result"
 };
 
 // ../../22-packages/21-protocol/21-websocket/src/crypto.ts
@@ -29816,7 +30112,7 @@ import { spawn } from "child_process";
 
 // src/common/logger/logger.ts
 import { appendFile, mkdir, readdir, unlink } from "fs/promises";
-import { readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync } from "fs";
 import { join as join6 } from "path";
 var LEVEL_ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
 var DAY_MS = 24 * 60 * 60 * 1e3;
@@ -29835,6 +30131,13 @@ var CliLogger = class {
     this.retentionDays = opts.retentionDays ?? DEFAULT_RETENTION_DAYS;
     void this.cleanupOldLogs();
   }
+  /** Update the retention window at runtime + prune now (ADR-0115). `days<=0` keeps current. */
+  setRetentionDays(days) {
+    if (days > 0) {
+      this.retentionDays = days;
+      void this.cleanupOldLogs();
+    }
+  }
   /** Log an error-level event. */
   error(event, fields) {
     this.write("error", event, fields);
@@ -29891,6 +30194,24 @@ function readRecentLogLines(dir2, limit) {
     return [];
   }
 }
+var LOG_UPLOAD_CONTENT_MAX = 512 * 1024;
+function readLogUpload(dir2) {
+  try {
+    const files = readdirSync2(dir2).filter((f) => /^cli-\d{4}-\d{2}-\d{2}\.jsonl$/.test(f)).sort();
+    const latest = files[files.length - 1];
+    if (!latest) return null;
+    let totalBytes = 0;
+    for (const f of files) totalBytes += statSync(join6(dir2, f)).size;
+    let content = readFileSync6(join6(dir2, latest), "utf8");
+    if (content.length > LOG_UPLOAD_CONTENT_MAX) {
+      content = `\u2026[truncated]
+${content.slice(-LOG_UPLOAD_CONTENT_MAX)}`;
+    }
+    return { fileName: latest, content, totalBytes };
+  } catch {
+    return null;
+  }
+}
 
 // src/core/update-scheduler.ts
 var TICK_MS = 6e4;
@@ -30026,7 +30347,7 @@ async function runCommand(dispatch, emit) {
   });
   child.stdout?.on("data", (data) => batcher.push(data.toString("utf8")));
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
-  await new Promise((resolve5) => {
+  await new Promise((resolve6) => {
     child.on("close", (exitCode) => {
       batcher.flush();
       emit({
@@ -30036,7 +30357,7 @@ async function runCommand(dispatch, emit) {
         done: true,
         exitCode: exitCode ?? -1
       });
-      resolve5();
+      resolve6();
     });
     child.on("error", (err) => {
       emit({
@@ -30047,7 +30368,7 @@ async function runCommand(dispatch, emit) {
         done: true,
         exitCode: -1
       });
-      resolve5();
+      resolve6();
     });
   });
 }
@@ -30127,10 +30448,10 @@ function isSessionLimit(text) {
   );
 }
 function runAttempt(commandId, cmd, args, cwd2, env3, onChunk) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     void runCommand({ commandId, cmd, args, path: cwd2, env: env3 }, (out) => {
       if (out.chunk) onChunk(out.chunk);
-      if (out.done) resolve5(out.exitCode ?? -1);
+      if (out.done) resolve6(out.exitCode ?? -1);
     });
   });
 }
@@ -30149,7 +30470,7 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
         handlers.onChunk(text);
       }
     };
-    finalExit = await runAttempt(commandId, plan.cmd, plan.args, cwd2, attempt.env, emit);
+    finalExit = await runAttempt(commandId, plan.cmd, attempt.args, cwd2, attempt.env, emit);
     const tail = parser.flush();
     if (tail) {
       captured += tail;
@@ -30209,13 +30530,18 @@ function resolveHomePath(value) {
   if (isAbsolute(value)) return value;
   return join8(homedir3(), value);
 }
-function resolveDirs(value) {
-  if (!value) return [];
-  const list = Array.isArray(value) ? value : [value];
-  return list.filter((v) => v && v.trim()).map(resolveHomePath);
+function profileDirs(profiles) {
+  if (!profiles) return [];
+  return profiles.map((p) => p.profile).filter((v) => v && v.trim()).map(resolveHomePath);
+}
+function buildRunArgs(profile, cmd, prompt) {
+  const pre = profile.args ?? DEFAULT_AI_ARGS[cmd] ?? [];
+  const model = profile.model?.trim();
+  const modelArgs = model ? ["--model", model] : [];
+  return [...pre, ...modelArgs, prompt];
 }
-function claudeConfigDirs(config) {
-  const dirs = resolveDirs(config.claudeConfigDir);
+function claudeHomeDirs(config) {
+  const dirs = profileDirs(config.claudeHome);
   return dirs.length > 0 ? dirs : [join8(homedir3(), ".claude")];
 }
 function profileDisplayLabel(dir2) {
@@ -30232,28 +30558,40 @@ function profileEnvVar(cmd) {
   if (cmd.includes("codex")) return "CODEX_HOME";
   return null;
 }
+function profilesFor(config, cmd) {
+  const envVar = profileEnvVar(cmd);
+  if (envVar === "CLAUDE_CONFIG_DIR") return config.claudeHome ?? [];
+  if (envVar === "CODEX_HOME") return config.codexHome ?? [];
+  return [];
+}
 function profileLabels(config) {
   const cmd = config.aiCli ?? DEFAULT_AI_CLI;
-  const envVar = profileEnvVar(cmd);
-  const dirs = envVar === "CLAUDE_CONFIG_DIR" ? resolveDirs(config.claudeConfigDir) : envVar === "CODEX_HOME" ? resolveDirs(config.codexHome) : [];
-  return dirs.map((dir2) => profileDisplayLabel(dir2));
+  return profileDirs(profilesFor(config, cmd)).map((dir2) => profileDisplayLabel(dir2));
 }
 function planAiRun(prompt, config, workingDir) {
   const cmd = config.aiCli ?? DEFAULT_AI_CLI;
-  const args = [...config.aiArgs ?? DEFAULT_AI_ARGS[cmd] ?? [], prompt];
   const baseEnv = config.aiEnv ?? {};
   const envVar = profileEnvVar(cmd);
-  const dirs = envVar ? envVar === "CLAUDE_CONFIG_DIR" ? resolveDirs(config.claudeConfigDir) : resolveDirs(config.codexHome) : [];
-  if (!envVar || dirs.length === 0) {
-    return { cmd, args, attempts: [{ label: "default", dir: null, env: { ...baseEnv } }] };
-  }
-  const ordered = workingDir && dirs.includes(workingDir) ? [workingDir, ...dirs.filter((d) => d !== workingDir)] : dirs;
-  const attempts = ordered.map((dir2) => ({
+  const defaultPlan = {
+    cmd,
+    attempts: [
+      { label: "default", dir: null, args: buildRunArgs({ profile: "" }, cmd, prompt), env: { ...baseEnv } }
+    ]
+  };
+  if (!envVar) return defaultPlan;
+  const resolved = profilesFor(config, cmd).filter((p) => p.profile && p.profile.trim()).map((p) => ({ profile: p, dir: resolveHomePath(p.profile) }));
+  if (resolved.length === 0) return defaultPlan;
+  const ordered = workingDir && resolved.some((r) => r.dir === workingDir) ? [
+    resolved.find((r) => r.dir === workingDir),
+    ...resolved.filter((r) => r.dir !== workingDir)
+  ] : resolved;
+  const attempts = ordered.map(({ profile, dir: dir2 }) => ({
     label: profileDisplayLabel(dir2),
     dir: dir2,
+    args: buildRunArgs(profile, cmd, prompt),
     env: { ...baseEnv, [envVar]: dir2 }
   }));
-  return { cmd, args, attempts };
+  return { cmd, attempts };
 }
 
 // src/core/claude-usage.ts
@@ -30291,16 +30629,16 @@ async function fetchUsage(token) {
   }
 }
 function runUsageCli(dir2, aiCli2) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let out = "";
     let child = null;
     const finish = () => {
       clearTimeout(timer);
-      resolve5(out);
+      resolve6(out);
     };
     const timer = setTimeout(() => {
       child?.kill();
-      resolve5(out);
+      resolve6(out);
     }, 3e4);
     timer.unref?.();
     try {
@@ -30423,26 +30761,95 @@ async function runAi(prompt) {
   });
   return parseAi(cli, stdout, prompt);
 }
-async function aiSuggest(req) {
+async function aiGenerate(prompt) {
+  const { text } = await runAi(prompt);
+  return text;
+}
+async function aiOutboundReview(input, allowedRepos, projectPath) {
+  const prompt = `You are a security reviewer for an autonomous coding agent. Decide if the following INPUT is SAFE to run. It is UNSAFE if it: (1) asks the AI using secret VALUES (api keys, env values, passwords); (2) would affect other environments (only the sandbox project is allowed, no ssh/deploy/prod); (3) edits outside the project folder "${projectPath}"; (4) commits/pushes to a repo not in this allowlist: ${allowedRepos.length ? allowedRepos.join(", ") : "(none declared)"}. Reply with ONLY JSON: {"ok": <true|false>, "reasons": ["secret"|"environment"|"path"|"repo", ...]}. INPUT:
+${input}`;
+  const { text, tokens } = await runAi(prompt);
+  const start = text.indexOf("{");
+  const end = text.lastIndexOf("}");
+  if (start < 0 || end <= start) return { ok: false, reasons: ["ai_parse"], tokens };
   try {
-    const prompt = `You are helping fill a software project specification. Suggest a concise value for the field "${req.field}". Reply with ONLY the suggested text, no preamble. Context (spec so far, JSON):
-${JSON.stringify(req.spec)}`;
-    const { text, tokens } = await runAi(prompt);
-    return { value: text, tokens };
-  } catch (err) {
-    return { value: "", error: err instanceof Error ? err.message : String(err) };
+    const j = JSON.parse(text.slice(start, end + 1));
+    const reasons = Array.isArray(j.reasons) ? j.reasons.filter((r) => typeof r === "string") : [];
+    return { ok: j.ok === true && reasons.length === 0, reasons, tokens };
+  } catch {
+    return { ok: false, reasons: ["ai_parse"], tokens };
   }
 }
-async function aiReview(req) {
-  try {
-    const prompt = `Review this software project specification for inconsistencies, gaps or contradictions. Reply with a short list, one issue per line, no preamble. If it looks consistent, reply exactly "OK". Spec (JSON):
-${JSON.stringify(req.spec)}`;
-    const { text: out, tokens } = await runAi(prompt);
-    const issues = out === "OK" ? [] : out.split("\n").map((line) => line.replace(/^[-*]\s*/, "").trim()).filter(Boolean);
-    return { issues, tokens };
-  } catch (err) {
-    return { issues: [], error: err instanceof Error ? err.message : String(err) };
+
+// src/core/outbound-review.ts
+function compilePatterns(sources, fallback) {
+  const list = sources ?? fallback;
+  const out = [];
+  for (const src of list) {
+    try {
+      out.push(compileRulePattern(src));
+    } catch (err) {
+      logger.warn("outbound-review.bad-pattern", {
+        pattern: src,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return out;
+}
+function referencedRepos(text) {
+  const repos = /* @__PURE__ */ new Set();
+  const re = /(?:https?:\/\/|git@)([\w.-]+)[/:]([\w.-]+\/[\w.-]+?)(?:\.git)?(?=[\s"')]|$)/gi;
+  let m;
+  while (m = re.exec(text)) repos.add(`${m[1]}/${m[2]}`.toLowerCase());
+  return [...repos];
+}
+function ruleReview(input, allowedRepos, projectPath, secretPatterns, envPatterns) {
+  const reasons = /* @__PURE__ */ new Set();
+  const secretRe = compilePatterns(secretPatterns, DEFAULT_OUTBOUND_RULES.secret);
+  const envRe = compilePatterns(envPatterns, DEFAULT_OUTBOUND_RULES.environment);
+  if (secretRe.some((re) => re.test(input))) reasons.add("secret");
+  if (envRe.some((re) => re.test(input))) reasons.add("environment");
+  if (/(?:^|[\s"'(])(?:\.\.[/\\])+/.test(input)) reasons.add("path");
+  const absSystem = /(?:^|[\s"'(=])(\/(?:etc|root|var|usr|bin|home|private|proc|sys)\b|[A-Za-z]:\\\\)/;
+  if (absSystem.test(input) && projectPath && !input.includes(projectPath)) reasons.add("path");
+  if (allowedRepos.length) {
+    const allow = allowedRepos.map((r) => r.toLowerCase());
+    const refs = referencedRepos(input);
+    if (refs.some((r) => !allow.some((a) => a.includes(r) || r.includes(a)))) reasons.add("repo");
+  }
+  return [...reasons];
+}
+async function evaluateReview(payload) {
+  const reasons = /* @__PURE__ */ new Set();
+  let tokens = 0;
+  if (payload.ruleCheck) {
+    const violations = ruleReview(
+      payload.prompt,
+      payload.allowedRepos,
+      payload.projectPath ?? "",
+      payload.secretPatterns,
+      payload.envPatterns
+    );
+    for (const r of violations) reasons.add(r);
+  }
+  if (payload.aiReview) {
+    try {
+      const ai = await aiOutboundReview(
+        payload.prompt,
+        payload.allowedRepos,
+        payload.projectPath ?? ""
+      );
+      tokens = ai.tokens;
+      if (!ai.ok) for (const r of ai.reasons) reasons.add(r);
+    } catch (err) {
+      logger.warn("outbound-review.ai-error", {
+        commandId: payload.commandId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
   }
+  return { commandId: payload.commandId, ok: reasons.size === 0, reasons: [...reasons], tokens };
 }
 
 // src/core/command-history.ts
@@ -30539,6 +30946,13 @@ function recordCommand(entry) {
 function getCommandHistory() {
   return entries;
 }
+function pruneCommandHistoryByAge(days) {
+  if (days <= 0) return;
+  const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
+  const before = entries.length;
+  entries = entries.filter((e) => new Date(e.startedAt).getTime() >= cutoff);
+  if (entries.length !== before) persist();
+}
 function finishCommand(commandId, exitCode, usage) {
   const entry = entries.find((e) => e.commandId === commandId && e.status === "running");
   if (!entry) return;
@@ -30566,7 +30980,7 @@ import {
   readFileSync as readFileSync11,
   readdirSync as readdirSync3,
   rmSync as rmSync3,
-  statSync
+  statSync as statSync2
 } from "fs";
 import { join as join11 } from "path";
 var KEEP_FILES = 200;
@@ -30599,11 +31013,22 @@ function readCommandOutput(commandId) {
 function prune() {
   if (!dir) return;
   try {
-    const files = readdirSync3(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync(join11(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
+    const files = readdirSync3(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync2(join11(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
     for (const { f } of files.slice(KEEP_FILES)) rmSync3(join11(dir, f), { force: true });
   } catch {
   }
 }
+function pruneCommandOutputByAge(days) {
+  if (!dir || days <= 0) return;
+  const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
+  try {
+    for (const f of readdirSync3(dir).filter((n) => n.endsWith(".log"))) {
+      const p = join11(dir, f);
+      if (statSync2(p).mtimeMs < cutoff) rmSync3(p, { force: true });
+    }
+  } catch {
+  }
+}
 
 // src/core/fs-browse.ts
 import { readdir as readdir2 } from "fs/promises";
@@ -30703,13 +31128,142 @@ ${stderr}`;
   return { installed, authenticated, account, claudeCli };
 }
 
-// src/core/scaffold.ts
-import { cp, mkdir as mkdir2, writeFile } from "fs/promises";
+// src/core/git-history.ts
+import { readdir as readdir3 } from "fs/promises";
 import { execFile as execFile4 } from "child_process";
-import { dirname as dirname4, join as join12, resolve as resolve4 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { resolve as resolve4, sep as sep3 } from "path";
 import { promisify as promisify4 } from "util";
 var run4 = promisify4(execFile4);
+var FS = "";
+var RS = "";
+function resolveRepo(root, repo) {
+  if (!root) return null;
+  const base = resolve4(root);
+  const requested = resolve4(base, repo && repo.trim() ? repo : ".");
+  return requested === base || requested.startsWith(base + sep3) ? requested : base;
+}
+async function git(cwd2, args) {
+  try {
+    const { stdout } = await run4("git", args, {
+      cwd: cwd2,
+      timeout: 15e3,
+      maxBuffer: 8 * 1024 * 1024
+    });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+async function gitRepos(root) {
+  if (!root) return { repos: [] };
+  const base = resolve4(root);
+  const found = /* @__PURE__ */ new Set();
+  const repos = [];
+  const add = async (dir2) => {
+    const inside = await git(dir2, ["rev-parse", "--show-toplevel"]);
+    const top = inside.trim();
+    if (!top || found.has(top) || !(top === base || top.startsWith(base + sep3))) return;
+    found.add(top);
+    const subdir = top === base ? "" : top.slice(base.length + 1);
+    const remote = (await git(top, ["remote", "get-url", "origin"])).trim();
+    repos.push({ subdir, name: subdir || "", remote: remote || null });
+  };
+  await add(base);
+  try {
+    const lvl1 = await readdir3(base, { withFileTypes: true });
+    for (const d of lvl1) {
+      if (!d.isDirectory() || d.name === ".git" || d.name === "node_modules") continue;
+      const p1 = resolve4(base, d.name);
+      await add(p1);
+      try {
+        const lvl2 = await readdir3(p1, { withFileTypes: true });
+        for (const d2 of lvl2) {
+          if (!d2.isDirectory() || d2.name === ".git" || d2.name === "node_modules") continue;
+          await add(resolve4(p1, d2.name));
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  repos.sort((a, b) => a.subdir.localeCompare(b.subdir));
+  return { repos };
+}
+async function gitLog(root, repo, skip, limit) {
+  const cwd2 = resolveRepo(root, repo);
+  if (!cwd2) return { entries: [], hasMore: false };
+  const capped = Math.min(Math.max(limit, 1), 200);
+  const format = ["%H", "%h", "%an", "%aI", "%s"].join(FS) + RS;
+  const stdout = await git(cwd2, [
+    "log",
+    `--skip=${Math.max(skip, 0)}`,
+    `-n`,
+    String(capped + 1),
+    `--pretty=format:${format}`
+  ]);
+  const rows = stdout.split(RS).map((r) => r.replace(/^\n/, "")).filter((r) => r.length > 0);
+  const entries2 = rows.slice(0, capped).map((row) => {
+    const [hash = "", shortHash = "", author = "", date = "", subject = ""] = row.split(FS);
+    return { hash, shortHash, author, date, subject };
+  });
+  return { entries: entries2, hasMore: rows.length > capped };
+}
+async function gitCommit(root, repo, hash) {
+  const cwd2 = resolveRepo(root, repo);
+  const empty = { hash, author: "", date: "", subject: "", files: [] };
+  if (!cwd2 || !hash) return empty;
+  const format = ["%H", "%an", "%aI", "%s"].join(FS);
+  const stdout = await git(cwd2, [
+    "show",
+    "--name-status",
+    "-M",
+    `--pretty=format:${format}`,
+    hash
+  ]);
+  if (!stdout) return empty;
+  const lines = stdout.split("\n");
+  const [full = hash, author = "", date = "", subject = ""] = (lines[0] ?? "").split(FS);
+  const files = [];
+  for (const line of lines.slice(1)) {
+    if (!line.trim()) continue;
+    const parts = line.split("	");
+    const status = (parts[0] ?? "").charAt(0);
+    if (!status) continue;
+    if (status === "R" || status === "C") {
+      files.push({ path: parts[2] ?? "", status, oldPath: parts[1] ?? void 0 });
+    } else {
+      files.push({ path: parts[1] ?? "", status });
+    }
+  }
+  return { hash: full, author, date, subject, files };
+}
+async function gitCommitDiff(root, repo, hash, path) {
+  const cwd2 = resolveRepo(root, repo);
+  if (!cwd2 || !hash || !path) return { path, oldContent: "", newContent: "" };
+  const oldContent = await git(cwd2, ["show", `${hash}^:${path}`]);
+  const newContent = await git(cwd2, ["show", `${hash}:${path}`]);
+  return { path, oldContent, newContent };
+}
+
+// src/core/git-commit-identity.ts
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+var run5 = promisify5(execFile5);
+async function setCommitAuthor(cwd2, machineUsername) {
+  if (!machineUsername) return;
+  try {
+    await run5("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+  } catch {
+  }
+}
+
+// src/core/scaffold.ts
+import { cp, mkdir as mkdir2, writeFile } from "fs/promises";
+import { execFile as execFile6 } from "child_process";
+import { dirname as dirname4, join as join12, resolve as resolve5 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { promisify as promisify6 } from "util";
+var run6 = promisify6(execFile6);
 function reposOf(spec) {
   const repos = spec?.repos;
   return Array.isArray(repos) ? repos : [];
@@ -30718,13 +31272,18 @@ function subDirName(repo) {
   const raw = (repo.subdir || repo.role || repo.name || "repo").trim();
   return raw.replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
 }
-async function provisionRepos(target, repos, emit) {
+async function provisionRepos(target, repos, emit, opts = {}) {
   for (const repo of repos) {
     if (repo.primary) {
+      if (opts.clonePrimary && repo.op === "existing" && repo.url) {
+        emit("git", `Cloning ${repo.url}\u2026`);
+        await run6("git", ["clone", repo.url, target], { timeout: 12e4 });
+        continue;
+      }
       emit("git", "Initializing the primary repo\u2026");
-      await run4("git", ["init"], { cwd: target, timeout: 2e4 });
+      await run6("git", ["init"], { cwd: target, timeout: 2e4 });
       if (repo.op === "existing" && repo.url) {
-        await run4("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
+        await run6("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
           () => void 0
         );
       }
@@ -30733,23 +31292,24 @@ async function provisionRepos(target, repos, emit) {
     const dir2 = join12(target, subDirName(repo));
     if (repo.op === "existing" && repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
-      await run4("git", ["clone", repo.url, dir2], { timeout: 12e4 });
+      await run6("git", ["clone", repo.url, dir2], { timeout: 12e4 });
     } else {
       emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
       await mkdir2(dir2, { recursive: true });
-      await run4("git", ["init"], { cwd: dir2, timeout: 2e4 });
+      await run6("git", ["init"], { cwd: dir2, timeout: 2e4 });
     }
   }
 }
 function sampleDir() {
   if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
   const here = dirname4(fileURLToPath3(import.meta.url));
-  return resolve4(here, "../../project-sample");
+  return resolve5(here, "../../project-sample");
 }
-async function scaffoldProject(payload, onProgress) {
+async function scaffoldProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
-    const target = resolve4(payload.path);
+    const root = process.env.SCAFFOLD_ROOT ? resolve5(process.env.SCAFFOLD_ROOT) : resolve5(profileDir2);
+    const target = join12(root, payload.projectName);
     await mkdir2(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
@@ -30763,25 +31323,58 @@ async function scaffoldProject(payload, onProgress) {
     }
     const repos = reposOf(payload.spec);
     if (repos.length > 0) await provisionRepos(target, repos, emit);
+    if (payload.spec) await aiInit(target, payload.spec, emit);
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
     return { ok: true, path: target };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
-async function addProject(payload, onProgress) {
+async function aiInit(target, spec, emit) {
+  emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
+  const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
+  if (subagents.length > 0) {
+    await mkdir2(join12(target, ".claude", "agents"), { recursive: true });
+    for (const sa of subagents) {
+      const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
+      if (!name) continue;
+      const body = `---
+name: ${name}
+---
+
+${(sa.description || "").trim()}
+`;
+      await writeFile(join12(target, ".claude", "agents", `${name}.md`), body, "utf8");
+    }
+  }
+  const specJson = JSON.stringify(spec);
+  await generateFile(
+    join12(target, "README.md"),
+    `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
+${specJson}`
+  );
+  await generateFile(
+    join12(target, "CLAUDE.md"),
+    `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
+${specJson}`
+  );
+}
+async function generateFile(path, prompt) {
+  try {
+    const text = await aiGenerate(prompt);
+    if (text.trim()) await writeFile(path, text.trim() + "\n", "utf8");
+  } catch {
+  }
+}
+async function addProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
-    const target = resolve4(payload.path);
+    const root = process.env.SCAFFOLD_ROOT ? resolve5(process.env.SCAFFOLD_ROOT) : resolve5(profileDir2);
+    const target = join12(root, payload.projectName);
     await mkdir2(target, { recursive: true });
-    if (payload.repoUrl) {
-      emit("clone", `Cloning ${payload.repoUrl}\u2026`);
-      await run4("git", ["clone", payload.repoUrl, target], { timeout: 12e4 });
-    } else {
-      emit("init", "git init\u2026");
-      await run4("git", ["init"], { cwd: target, timeout: 2e4 });
-    }
-    onProgress?.({ projectId: payload.projectId, step: "done", message: "Repo ready.", done: true });
+    const repos = payload.repos ?? [];
+    if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
+    onProgress?.({ projectId: payload.projectId, step: "done", message: "Project added.", done: true });
     return { ok: true, path: target };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
@@ -30791,9 +31384,10 @@ async function addProject(payload, onProgress) {
 // src/core/ws-client.ts
 var HEARTBEAT_MS = 3e4;
 var USAGE_POLL_MS = 5 * 6e4;
+var LOG_UPLOAD_MS = 10 * 6e4;
 var RECONNECT_BACKOFF_BASE_MS = 1e3;
-var RECONNECT_MAX_BACKOFF_DEFAULT_SEC = 600;
-var RECONNECT_BACKOFF_MAX_ATTEMPT = 10;
+var RECONNECT_MAX_BACKOFF_DEFAULT_SEC = 60;
+var RECONNECT_BACKOFF_MAX_ATTEMPT = 6;
 function envReconnectMaxSec() {
   const raw = Number(process.env.FOURPM_RECONNECT_MAX_BACKOFF_SEC);
   if (!Number.isFinite(raw)) return null;
@@ -30818,11 +31412,20 @@ var WsClient = class {
   context;
   socket = null;
   sessionKey = null;
+  // True once the current connectOnce() reached hello_ack — a *real* session. Gates the
+  // backoff reset so a socket that opens then closes before the handshake keeps backing off
+  // instead of hammering the server every ~1s.
+  sessionEstablished = false;
   ecdh = null;
   wsToken = "";
   heartbeat = null;
   usageTimer = null;
+  logUploadTimer = null;
+  /** Signature (fileName + totalBytes) of the last log upload — skip re-sending if unchanged. */
+  lastLogSig = null;
   usageSnapshot = null;
+  /** Whether the serving project requires outbound review before each AI spawn (ADR-0082). */
+  outboundReviewEnabled = false;
   stopped = false;
   /** Resolver to wake the backoff sleep early (set while waiting) — for /reconnect. */
   wakeReconnect = null;
@@ -30836,11 +31439,20 @@ var WsClient = class {
   /** The physic project folder root this cli serves (null = no project) — fs.list is
    *  scoped to it so the web FsPicker can only browse inward, never out. */
   physicRoot = null;
+  /** This machine-user's username — the git commit author for this project (ADR-0097).
+   *  Push uses the account already logged in with gh/glab on the worker. */
+  machineUsername = "";
   /** Waiters resolved when the session next becomes connected (readiness gate before
    *  running a local prompt). */
   connectWaiters = [];
   /** Output buffered while disconnected (flushed on reconnect). */
   offlineBuffer = [];
+  /**
+   * Command ids already accepted (insertion-ordered, bounded). WS delivery is at-least-once —
+   * a redelivered `COMMAND_DISPATCH` (reconnect/blip during a long AI run) must NOT run again:
+   * re-running an AI prompt would waste tokens and echo the prompt a second time in the console.
+   */
+  handledCommands = /* @__PURE__ */ new Set();
   offlineBufferBytes = 0;
   /** cli → server requests awaiting a reply (quota.check — ADR-0020). */
   pending = /* @__PURE__ */ new Map();
@@ -30850,6 +31462,11 @@ var WsClient = class {
   get bus() {
     return this.context.bus;
   }
+  /** True once the session stopped for good (logout / replaced / version) — the
+   *  resilient run wrapper uses this to tell a clean stop from a crash to recover from. */
+  get isStopped() {
+    return this.stopped;
+  }
   /**
    * Force an immediate reconnect: wake the backoff sleep if waiting, else drop the live
    * socket so the run() loop reconnects (the next backoff is skipped). No-op if stopped.
@@ -30870,43 +31487,50 @@ var WsClient = class {
    */
   awaitConnected(timeoutMs) {
     if (this.sessionKey && this.bus.status === "connected") return Promise.resolve(true);
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve5(true);
+        resolve6(true);
       };
       const timer = setTimeout(() => {
         this.connectWaiters = this.connectWaiters.filter((w) => w !== waiter);
-        resolve5(false);
+        resolve6(false);
       }, timeoutMs);
       this.connectWaiters.push(waiter);
     });
   }
   /**
    * Resolve the reconnect-backoff cap (ms): the org value (from ws_token) over the
-   * env override over the default. Each is already clamped to the 10-min ceiling.
+   * env override over the default. Each is already clamped to the 1-min ceiling.
    */
   reconnectMaxMs() {
     const sec = this.orgReconnectMaxSec ?? this.envReconnectMaxSec ?? RECONNECT_MAX_BACKOFF_DEFAULT_SEC;
     return sec * 1e3;
   }
+  /** Mark a commandId as accepted for dedup, keeping the set bounded (drop the oldest). */
+  markCommandHandled(commandId) {
+    this.handledCommands.add(commandId);
+    if (this.handledCommands.size > 1e3) {
+      const oldest = this.handledCommands.values().next().value;
+      if (oldest !== void 0) this.handledCommands.delete(oldest);
+    }
+  }
   /** Backoff sleep that can be woken early by reconnectNow(). */
   interruptibleSleep(ms) {
     if (this.forceReconnect) {
       this.forceReconnect = false;
       return Promise.resolve();
     }
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const timer = setTimeout(() => {
         this.wakeReconnect = null;
-        resolve5();
+        resolve6();
       }, ms);
-      timer.unref?.();
       this.wakeReconnect = () => {
         clearTimeout(timer);
         this.wakeReconnect = null;
         this.forceReconnect = false;
-        resolve5();
+        resolve6();
       };
     });
   }
@@ -30918,8 +31542,10 @@ var WsClient = class {
     for (let attempt = 0; !this.stopped; attempt++) {
       try {
         await this.connectOnce();
-        attempt = 0;
-        hashcodeInvalidStreak = 0;
+        if (this.sessionEstablished) {
+          attempt = 0;
+          hashcodeInvalidStreak = 0;
+        }
       } catch (err) {
         if (err instanceof CliApiError) {
           if (["HASHCODE_EXPIRED", "LINK_REVOKED"].includes(err.errorCode)) {
@@ -30935,6 +31561,8 @@ var WsClient = class {
               `Token request rejected (HASHCODE_INVALID) \u2014 retrying (${hashcodeInvalidStreak}/${MAX_HASHCODE_INVALID_RETRIES}).`,
               "warn"
             );
+          } else if (err.errorCode === "USER_PAUSED") {
+            this.bus.log("This account is paused \u2014 retrying until it is resumed.", "warn");
           } else {
             this.bus.log(`Connection error: ${err}`, "error");
           }
@@ -30958,8 +31586,9 @@ var WsClient = class {
    * One WS session: token → connect → handshake → handle messages until close.
    */
   connectOnce() {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       void (async () => {
+        this.sessionEstablished = false;
         this.bus.setStatus("connecting");
         const token = await requestWsToken(this.credential.serverUrl, this.credential.hashcode3);
         this.wsToken = token.wsToken;
@@ -30973,6 +31602,17 @@ var WsClient = class {
             timezone: token.timezone
           });
         }
+        if (typeof token.cliRetentionDays === "number" && token.cliRetentionDays > 0) {
+          logger.setRetentionDays(token.cliRetentionDays);
+          pruneCommandHistoryByAge(token.cliRetentionDays);
+          pruneCommandOutputByAge(token.cliRetentionDays);
+        }
+        writeProfileConfig(this.context.profileDir, {
+          sessionSwitchPct: token.projectTokens?.sessionSwitchPct ?? 0,
+          perPromptTokenLimit: token.projectTokens?.perPromptTokenLimit ?? 0
+        });
+        this.outboundReviewEnabled = token.outboundReview?.enabled === true;
+        this.machineUsername = token.machineUsername ?? "";
         if (token.scope && token.scope !== this.credential.scope) {
           this.credential.scope = token.scope;
           writeCredential(this.context.profileDir, this.credential);
@@ -30980,7 +31620,12 @@ var WsClient = class {
         } else if (token.scope) {
           this.bus.setScope(token.scope);
         }
-        const wsUrl = this.credential.serverUrl.replace(/^http/, "ws") + "/ws";
+        if (token.wsUrl !== void 0 && token.wsUrl !== this.credential.wsUrl) {
+          this.credential.wsUrl = token.wsUrl || void 0;
+          writeCredential(this.context.profileDir, this.credential);
+        }
+        const wsBase = this.credential.wsUrl ?? this.credential.serverUrl;
+        const wsUrl = wsBase.replace(/^http/, "ws") + "/ws";
         const socket = new wrapper_default(wsUrl);
         this.socket = socket;
         socket.on("open", () => {
@@ -31010,7 +31655,7 @@ var WsClient = class {
           if (code === CLOSE_DRAINING) {
             this.bus.log("Server draining \u2014 will reconnect (backoff + jitter).");
           }
-          resolve5();
+          resolve6();
         });
         socket.on("error", (err) => {
           this.clearHeartbeat();
@@ -31026,6 +31671,7 @@ var WsClient = class {
     if ("type" in message) {
       if (message.type === "hello_ack" && this.ecdh) {
         this.sessionKey = deriveSessionKey(this.ecdh, message.pubkey);
+        this.sessionEstablished = true;
         if (message.workerName) this.bus.setWorker(message.workerName);
         if (message.projectName) {
           this.bus.setProject(message.projectName);
@@ -31042,6 +31688,7 @@ var WsClient = class {
         this.flushOfflineBuffer();
         this.startHeartbeat();
         this.startUsagePolling();
+        this.startLogUpload();
         this.connectWaiters.splice(0).forEach((fn) => fn());
         return;
       }
@@ -31070,6 +31717,11 @@ var WsClient = class {
           this.socket?.close();
           return;
         }
+        if (message.errorCode === "USER_PAUSED") {
+          this.bus.log("This account is paused \u2014 retrying until it is resumed.", "warn");
+          this.socket?.close();
+          return;
+        }
         this.bus.log(`Server reported an error: ${message.errorCode}`, "warn");
         this.socket?.close();
         return;
@@ -31113,6 +31765,11 @@ var WsClient = class {
       }
       case WsChannels.COMMAND_DISPATCH: {
         const dispatch = payload;
+        if (this.handledCommands.has(dispatch.commandId)) {
+          logger.info("command.dispatch.duplicate", { commandId: dispatch.commandId });
+          break;
+        }
+        this.markCommandHandled(dispatch.commandId);
         logger.info("command.dispatch", {
           commandId: dispatch.commandId,
           cmd: dispatch.cmd,
@@ -31174,32 +31831,62 @@ var WsClient = class {
           (reply) => this.send(WsChannels.GIT_ENV, reply, message.id)
         );
         break;
+      case WsChannels.GIT_REPOS:
+        void gitRepos(this.physicRoot).then(
+          (reply) => this.send(WsChannels.GIT_REPOS, reply, message.id)
+        );
+        break;
+      case WsChannels.GIT_LOG: {
+        const req = payload;
+        void gitLog(this.physicRoot, req.repo ?? "", req.skip ?? 0, req.limit ?? 50).then(
+          (reply) => this.send(WsChannels.GIT_LOG, reply, message.id)
+        );
+        break;
+      }
+      case WsChannels.GIT_COMMIT: {
+        const req = payload;
+        void gitCommit(this.physicRoot, req.repo ?? "", req.hash).then(
+          (reply) => this.send(WsChannels.GIT_COMMIT, reply, message.id)
+        );
+        break;
+      }
+      case WsChannels.GIT_COMMIT_DIFF: {
+        const req = payload;
+        void gitCommitDiff(this.physicRoot, req.repo ?? "", req.hash, req.path).then(
+          (reply) => this.send(WsChannels.GIT_COMMIT_DIFF, reply, message.id)
+        );
+        break;
+      }
       case WsChannels.LOG_READ: {
         const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
         const lines = readRecentLogLines(join13(this.context.profileDir, "logs"), limit);
         this.send(WsChannels.LOG_READ, { lines }, message.id);
         break;
       }
+      case WsChannels.COMMAND_OUTPUT_READ: {
+        const output = readCommandOutput(payload.commandId);
+        this.send(WsChannels.COMMAND_OUTPUT_READ, { output }, message.id);
+        break;
+      }
       case WsChannels.PROJECT_CREATE:
         void scaffoldProject(
           payload,
+          this.context.profileDir,
           (p) => this.send(WsChannels.PROJECT_PROGRESS, p)
         ).then((reply) => this.send(WsChannels.PROJECT_CREATE, reply, message.id));
         break;
       case WsChannels.PROJECT_ADD:
         void addProject(
           payload,
+          this.context.profileDir,
           (p) => this.send(WsChannels.PROJECT_PROGRESS, p)
         ).then((reply) => this.send(WsChannels.PROJECT_ADD, reply, message.id));
         break;
-      case WsChannels.AI_SUGGEST:
-        void aiSuggest(payload).then(
-          (reply) => this.send(WsChannels.AI_SUGGEST, reply, message.id)
-        );
-        break;
-      case WsChannels.AI_REVIEW:
-        void aiReview(payload).then(
-          (reply) => this.send(WsChannels.AI_REVIEW, reply, message.id)
+      // AI spec-assist (project-0012/0013/0033) now runs via command.dispatch({ ai:true })
+      // → runAiPrompt (profile-failover), not dedicated ai.* channels (ADR-0100).
+      case WsChannels.REVIEW_EVALUATE:
+        void evaluateReview(payload).then(
+          (reply) => this.send(WsChannels.REVIEW_EVALUATE, reply, message.id)
         );
         break;
       default:
@@ -31242,34 +31929,93 @@ var WsClient = class {
    */
   async runAiPrompt(prompt, commandId, origin) {
     const config = readProfileConfig(this.context.profileDir);
+    const perPromptLimit = config.perPromptTokenLimit ?? 0;
+    if (perPromptLimit > 0) {
+      const estimated = estimateTokens(prompt);
+      if (estimated > perPromptLimit) {
+        this.rejectPromptOverLimit(commandId, origin, estimated, perPromptLimit);
+        return;
+      }
+    }
+    if (this.outboundReviewEnabled) {
+      let verdict;
+      try {
+        verdict = await this.request(WsChannels.REVIEW_REQUEST, {
+          commandId,
+          prompt
+        });
+      } catch {
+        verdict = { commandId, ok: false, reasons: ["unavailable"] };
+      }
+      if (!verdict.ok) {
+        this.rejectByReview(commandId, origin, verdict.reasons);
+        return;
+      }
+    }
     const cwd2 = this.physicRoot ?? config.physicPath ?? process.cwd();
     if (this.physicRoot) {
       this.ensurePhysicFolderPath(this.physicRoot);
+      await setCommitAuthor(cwd2, this.machineUsername);
     } else {
       this.bus.log("No project attached \u2014 running in the current directory.", "warn");
     }
     const cmd = config.aiCli ?? "claude";
     const workingDir = getWorkingProfile(this.context.profileDir, cmd);
-    const plan = planAiRun(prompt, config, workingDir);
-    this.bus.push({ source: origin, kind: "cmd", text: `${plan.cmd} \u2039 ${prompt}` });
+    const startDir = this.profileUnderSessionPressure(config, cmd, workingDir);
+    if (startDir && startDir !== workingDir) {
+      this.bus.push({
+        source: origin,
+        kind: "log",
+        text: `session ${this.usageSnapshot?.session.utilizationPct ?? 0}% \u2265 ${config.sessionSwitchPct}% \u2014 switching to Claude profile "${profileDisplayLabel(startDir)}"`
+      });
+    }
+    const plan = planAiRun(prompt, config, startDir ?? workingDir);
+    const markerArgs = plan.attempts[0]?.args ?? [];
+    this.bus.push({ source: origin, kind: "aireq", text: `${plan.cmd} \u2039 ${prompt}` });
     logger.info("command.ai", { commandId, origin, cmd: plan.cmd, profiles: plan.attempts.length });
     if (origin === "local") {
       this.send(WsChannels.COMMAND_ANNOUNCE, {
         commandId,
         cmd: plan.cmd,
-        args: plan.args,
+        args: markerArgs,
         origin: "local"
       });
     }
-    recordCommand({ commandId, cmd: plan.cmd, args: plan.args });
+    recordCommand({ commandId, cmd: plan.cmd, args: markerArgs });
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.bus.startBusy(plan.cmd);
     let seq = 0;
+    let responseHeaderShown = false;
+    let displayMode = "pending";
+    let resultId = null;
+    let resultBuf = "";
     const result = await runAiFailover(plan, commandId, cwd2, {
       onChunk: (text) => {
-        this.bus.push({ source: origin, kind: "out", text });
+        if (!responseHeaderShown) {
+          this.bus.push({ source: origin, kind: "aires", text: `${plan.cmd} \u203A` });
+          responseHeaderShown = true;
+        }
         appendCommandOutput(commandId, text);
         this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: text });
+        if (displayMode === "result") {
+          resultBuf += text;
+          if (resultId) this.bus.updateEntry(resultId, resultBuf);
+          return;
+        }
+        if (displayMode === "prose") {
+          this.bus.push({ source: origin, kind: "out", text });
+          return;
+        }
+        resultBuf += text;
+        if (resultBuf.replace(/^\s+/, "").length === 0) return;
+        const kind = looksLikeJsonOrCode(resultBuf);
+        if (kind) {
+          displayMode = "result";
+          resultId = this.bus.push({ source: origin, kind: "result", text: resultBuf, resultKind: kind });
+        } else {
+          displayMode = "prose";
+          this.bus.push({ source: origin, kind: "out", text: resultBuf });
+        }
       },
       onAttemptStart: (label, index, total) => this.bus.push({
         source: origin,
@@ -31300,7 +32046,7 @@ var WsClient = class {
     this.send(WsChannels.COMMAND_HISTORY, {
       commandId,
       cmd: plan.cmd,
-      args: plan.args,
+      args: markerArgs,
       status: result.exitCode === 0 ? "done" : "failed",
       exitCode: result.exitCode,
       tokens: result.usage.tokens,
@@ -31324,6 +32070,79 @@ var WsClient = class {
       level: result.exitCode === 0 ? "info" : "error"
     });
   }
+  /**
+   * Pick the Claude profile to try first when under session pressure (ADR-0081). Returns
+   * the next candidate dir (cyclically after the current working one) when the knob is set
+   * and the live session utilization is at/over it AND there is more than one candidate;
+   * otherwise null (keep the normal working-first ordering). Claude-only (session % is a
+   * Claude subscription metric).
+   */
+  profileUnderSessionPressure(config, cmd, workingDir) {
+    const threshold = config.sessionSwitchPct ?? 0;
+    if (threshold <= 0 || cmd !== "claude") return null;
+    const util2 = this.usageSnapshot?.session.utilizationPct ?? 0;
+    if (util2 < threshold) return null;
+    const dirs = claudeHomeDirs(config);
+    if (dirs.length < 2) return null;
+    const currentIndex = workingDir ? dirs.indexOf(workingDir) : -1;
+    const next = dirs[(currentIndex + 1) % dirs.length];
+    return next ?? null;
+  }
+  /**
+   * Reject a prompt whose estimated tokens exceed the project's per-prompt limit (ADR-0081)
+   * without spawning: surface it in the transcript + close the command on the server with a
+   * PROMPT_TOKEN_LIMIT_EXCEEDED note (exit 1). No usage is metered (nothing ran).
+   */
+  rejectPromptOverLimit(commandId, origin, estimated, limit) {
+    const message = `[PROMPT_TOKEN_LIMIT_EXCEEDED] Prompt (~${estimated} tokens) exceeds the project per-prompt limit of ${limit} tokens.`;
+    logger.warn("command.ai.prompt-limit", { commandId, origin, estimated, limit });
+    this.bus.push({ source: origin, kind: "log", text: message, level: "error" });
+    if (origin === "local") {
+      this.send(WsChannels.COMMAND_ANNOUNCE, {
+        commandId,
+        cmd: "claude",
+        args: [],
+        origin: "local"
+      });
+    }
+    this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: 0, chunk: message });
+    this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: 1, chunk: "", done: true, exitCode: 1 });
+    this.bus.push({
+      source: origin,
+      kind: "exit",
+      text: "\u2717 prompt rejected \u2014 over the project per-prompt token limit",
+      level: "error"
+    });
+  }
+  /**
+   * Reject a prompt an outbound reviewer blocked (ADR-0082) without spawning: surface the
+   * verdict + close the command on the server. `reasons` contains only violation categories
+   * (never secret values); a "unavailable" reason maps to no-outbound-available.
+   */
+  rejectByReview(commandId, origin, reasons) {
+    const unavailable = reasons.includes("unavailable");
+    const code = unavailable ? "OUTBOUND_REVIEW_UNAVAILABLE" : "OUTBOUND_REVIEW_REJECTED";
+    const detail = reasons.filter((r) => r !== "unavailable").join(", ");
+    const message = unavailable ? `[${code}] No outbound reviewer is available \u2014 input blocked.` : `[${code}] Outbound review rejected the input${detail ? ` (${detail})` : ""}.`;
+    logger.warn("command.ai.outbound-review", { commandId, origin, reasons });
+    this.bus.push({ source: origin, kind: "log", text: message, level: "error" });
+    if (origin === "local") {
+      this.send(WsChannels.COMMAND_ANNOUNCE, {
+        commandId,
+        cmd: "claude",
+        args: [],
+        origin: "local"
+      });
+    }
+    this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: 0, chunk: message });
+    this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: 1, chunk: "", done: true, exitCode: 1 });
+    this.bus.push({
+      source: origin,
+      kind: "exit",
+      text: "\u2717 input blocked by outbound review",
+      level: "error"
+    });
+  }
   /**
    * Send one envelope (encrypted payload + per-message wsToken — arch 0004).
    * When disconnected: the running command's output is held in a buffer (512KB cap,
@@ -31350,7 +32169,7 @@ var WsClient = class {
    * Used for quota.check before spawning an AI cli (ADR-0020).
    */
   request(channel, data) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (!this.socket || !this.sessionKey) {
         reject(new Error("Not connected to the server."));
         return;
@@ -31370,7 +32189,7 @@ var WsClient = class {
       }, 15e3);
       timer.unref?.();
       this.pending.set(envelope.id, {
-        resolve: (value) => resolve5(value),
+        resolve: (value) => resolve6(value),
         timer
       });
       this.socket.send(JSON.stringify(envelope));
@@ -31464,6 +32283,8 @@ var WsClient = class {
     this.heartbeat = null;
     if (this.usageTimer) clearInterval(this.usageTimer);
     this.usageTimer = null;
+    if (this.logUploadTimer) clearInterval(this.logUploadTimer);
+    this.logUploadTimer = null;
   }
   /**
    * Poll the Claude subscription usage API and push a `machine.usage` snapshot (ADR-0072).
@@ -31476,7 +32297,7 @@ var WsClient = class {
       const config = readProfileConfig(this.context.profileDir);
       const aiCli2 = config.aiCli ?? "claude";
       const working = getWorkingProfile(this.context.profileDir, aiCli2);
-      const configured = claudeConfigDirs(config);
+      const configured = claudeHomeDirs(config);
       const dirs = working ? [working, ...configured.filter((d) => d !== working)] : configured;
       const profile = working ? basename3(working) : dirs[0] ? basename3(dirs[0]) : "default";
       const api = await checkClaudeUsage(dirs, aiCli2);
@@ -31501,6 +32322,29 @@ var WsClient = class {
     this.usageTimer.unref?.();
     void this.pollUsage();
   }
+  /** Start the periodic upload of the cli's own JSONL log to the server (ADR-0122). */
+  startLogUpload() {
+    if (this.logUploadTimer) clearInterval(this.logUploadTimer);
+    this.logUploadTimer = setInterval(() => this.uploadLog(), LOG_UPLOAD_MS);
+    this.logUploadTimer.unref?.();
+    this.uploadLog();
+  }
+  /**
+   * Upload the newest cli log file + the total log footprint to the server (ADR-0122), so it is
+   * stored + retained server-side and counted in the machine user's storage. Skips when nothing
+   * changed since the last upload. Best-effort — never disrupts the session.
+   */
+  uploadLog() {
+    try {
+      const upload = readLogUpload(join13(this.context.profileDir, "logs"));
+      if (!upload) return;
+      const sig = `${upload.fileName}:${upload.totalBytes}`;
+      if (sig === this.lastLogSig) return;
+      this.lastLogSig = sig;
+      this.send(WsChannels.MACHINE_LOG, upload);
+    } catch {
+    }
+  }
   /**
    * Logout: close WS, delete `.cre`, and prompt to pair again (Unlinked state).
    */
@@ -31584,7 +32428,7 @@ var SessionBus = class {
   get status() {
     return this.currentStatus;
   }
-  /** Producer → consumers: push one transcript entry. */
+  /** Producer → consumers: push one transcript entry. Returns its id (for `updateEntry`). */
   push(input) {
     const entry = {
       id: randomUUID2(),
@@ -31595,6 +32439,23 @@ var SessionBus = class {
     this.history.push(entry);
     if (this.history.length > REPLAY_CAP) this.history.shift();
     this.emitter.emit("transcript", entry);
+    return entry.id;
+  }
+  /**
+   * Producer → consumers: replace the text of an already-pushed entry (ADR-0108) — used to
+   * grow a streaming `result` block in place without pushing a new line per chunk. No-op if the
+   * entry has aged out of the replay window.
+   */
+  updateEntry(id, text) {
+    const entry = this.history.find((e) => e.id === id);
+    if (!entry) return;
+    entry.text = text;
+    this.emitter.emit("transcript-update", entry);
+  }
+  /** Subscribe to in-place entry updates (a `result` block growing — ADR-0108). */
+  onTranscriptUpdate(fn) {
+    this.emitter.on("transcript-update", fn);
+    return () => this.emitter.off("transcript-update", fn);
   }
   /** Shortcut for a lifecycle log line (source = system). */
   log(text, level = "info") {
@@ -33699,7 +34560,7 @@ var src_default = Yoga;
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/reconciler.js
 var import_react_reconciler = __toESM(require_react_reconciler(), 1);
-var import_constants8 = __toESM(require_constants(), 1);
+var import_constants10 = __toESM(require_constants(), 1);
 import process3 from "process";
 
 // ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
@@ -34941,7 +35802,7 @@ var reconciler_default = (0, import_react_reconciler.default)({
   scheduleTimeout: setTimeout,
   cancelTimeout: clearTimeout,
   noTimeout: -1,
-  getCurrentEventPriority: () => import_constants8.DefaultEventPriority,
+  getCurrentEventPriority: () => import_constants10.DefaultEventPriority,
   beforeActiveInstanceBlur() {
   },
   afterActiveInstanceBlur() {
@@ -37015,8 +37876,8 @@ var Ink = class {
     }
   }
   async waitUntilExit() {
-    this.exitPromise ||= new Promise((resolve5, reject) => {
-      this.resolveExitPromise = resolve5;
+    this.exitPromise ||= new Promise((resolve6, reject) => {
+      this.resolveExitPromise = resolve6;
       this.rejectExitPromise = reject;
     });
     return this.exitPromise;
@@ -37513,6 +38374,16 @@ function textColor(line) {
   if (line.kind === "exit") return "green";
   return void 0;
 }
+function AiMarkerLine({ line }) {
+  const arrow = line.kind === "aireq" ? "\u2039" : "\u203A";
+  const idx = line.text.indexOf(arrow);
+  if (idx < 0) return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { children: line.text || " " });
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: "cyan", bold: true, children: line.text.slice(0, idx) }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, children: arrow }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { children: line.text.slice(idx + 1) })
+  ] });
+}
 function wrapToWidth(text, width) {
   if (width <= 0 || text.length <= width) return [text];
   const rows = [];
@@ -37538,20 +38409,94 @@ function wrapToWidth(text, width) {
   if (line) rows.push(line.trimEnd());
   return rows.length > 0 ? rows : [""];
 }
-function flattenEntries(entries2, textWidth) {
+var DETAIL_RE = /<detail\s+title="([^"]*)">([\s\S]*?)<\/detail>/g;
+function toSegments(raw) {
+  if (!raw.includes("<detail")) {
+    return raw.split("\n").map((text) => ({ text, collapsed: false }));
+  }
+  const out = [];
+  const re = new RegExp(DETAIL_RE);
+  let last = 0;
+  let m;
+  while ((m = re.exec(raw)) !== null) {
+    const before = raw.slice(last, m.index).replace(/\n$/, "");
+    if (before.length > 0) for (const p of before.split("\n")) out.push({ text: p, collapsed: false });
+    out.push({ text: m[1] || "details", collapsed: true, body: m[2] ?? "" });
+    last = m.index + m[0].length;
+    if (raw[last] === "\n") last += 1;
+  }
+  const rest = raw.slice(last);
+  if (rest.length > 0) for (const p of rest.split("\n")) out.push({ text: p, collapsed: false });
+  if (out.length === 0) out.push({ text: "", collapsed: false });
+  return out;
+}
+function pushCollapsible(lines, entry, opts) {
+  const { blockNo, title, body, expanded, firstRow, textWidth, keyBase } = opts;
+  const base = { source: entry.source, level: entry.level, kind: entry.kind };
+  lines.push({
+    ...base,
+    key: `${keyBase}:m`,
+    text: `${expanded ? "\u25BE" : "\u25B8"}[${blockNo}] ${title}`,
+    showTag: firstRow,
+    collapsed: true,
+    spacer: false,
+    blockIndex: blockNo
+  });
+  if (!expanded) return;
+  prettyResult(body).split("\n").forEach(
+    (seg, i) => wrapToWidth(seg, textWidth).forEach(
+      (row, j) => lines.push({ ...base, key: `${keyBase}:b:${i}:${j}`, text: row, showTag: false, collapsed: false, spacer: false })
+    )
+  );
+}
+function flattenEntries(entries2, textWidth, expanded = /* @__PURE__ */ new Set()) {
   const lines = [];
+  let prevKey = null;
+  let blockNo = 0;
   for (const entry of entries2) {
+    const blockKey = `${entry.source}|${entry.kind}`;
+    const newBlock = blockKey !== prevKey;
+    if (newBlock && lines.length > 0) {
+      lines.push({
+        key: `sp:${entry.id}`,
+        source: entry.source,
+        level: entry.level,
+        kind: entry.kind,
+        text: "",
+        showTag: false,
+        collapsed: false,
+        spacer: true
+      });
+    }
+    prevKey = blockKey;
+    let firstRow = newBlock;
+    if (entry.kind === "result") {
+      blockNo += 1;
+      const count = prettyResult(entry.text).split("\n").length;
+      const title = `result \xB7 ${entry.resultKind ?? "json"} \xB7 ${count} ${count === 1 ? "line" : "lines"}`;
+      pushCollapsible(lines, entry, { blockNo, title, body: entry.text, expanded: expanded.has(blockNo), firstRow, textWidth, keyBase: entry.id });
+      continue;
+    }
     const raw = entry.kind === "out" ? entry.text.replace(/\n$/, "") : entry.text;
-    const parts = raw.split("\n");
-    parts.forEach((text, i) => {
-      wrapToWidth(text, textWidth).forEach((row, j) => {
+    toSegments(raw).forEach((seg, i) => {
+      if (seg.collapsed) {
+        blockNo += 1;
+        pushCollapsible(lines, entry, { blockNo, title: seg.text, body: seg.body ?? "", expanded: expanded.has(blockNo), firstRow, textWidth, keyBase: `${entry.id}:${i}` });
+        firstRow = false;
+        return;
+      }
+      wrapToWidth(seg.text, textWidth).forEach((row, j) => {
         lines.push({
           key: `${entry.id}:${i}:${j}`,
           source: entry.source,
           level: entry.level,
           kind: entry.kind,
-          text: row
+          text: row,
+          showTag: firstRow,
+          collapsed: false,
+          spacer: false
         });
+        firstRow = false;
       });
     });
   }
@@ -37560,8 +38505,8 @@ function flattenEntries(entries2, textWidth) {
 function TranscriptLine({ line }) {
   const tag = sourceTag(line.source);
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Box_default, { flexDirection: "row", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Box_default, { width: 7, marginRight: 1, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: tag.color, dimColor: line.source === "system", children: tag.text }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Box_default, { flexGrow: 1, children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: textColor(line), wrap: "truncate-end", children: line.text || " " }) })
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Box_default, { width: 7, marginRight: 1, children: line.showTag ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: tag.color, dimColor: line.source === "system", children: tag.text }) : null }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Box_default, { flexGrow: 1, children: line.spacer ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { children: " " }) : line.collapsed ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, wrap: "truncate-end", children: line.text || " " }) : line.kind === "aireq" || line.kind === "aires" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AiMarkerLine, { line }) : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: textColor(line), wrap: "truncate-end", children: line.text || " " }) })
   ] });
 }
 
@@ -37573,9 +38518,9 @@ import { existsSync as existsSync10 } from "fs";
 import { join as join16 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
-  "aiArgs",
-  "claudeConfigDir",
+  "claudeHome",
   "codexHome",
+  "antigravityHome",
   "physicPath",
   "commandHistoryUploadMinutes",
   "autoUpdate",
@@ -37591,14 +38536,13 @@ function parseConfigAssignment(key, valueTokens) {
     case "physicPath":
       if (!value) return { error: `Missing value for "${key}".` };
       return { patch: { [key]: value } };
-    case "claudeConfigDir":
-    case "codexHome": {
+    case "claudeHome":
+    case "codexHome":
+    case "antigravityHome": {
       const dirs = valueTokens.filter((t) => t.trim());
       if (dirs.length === 0) return { error: `Missing value for "${key}".` };
-      return { patch: { [key]: dirs.length === 1 ? dirs[0] : dirs } };
+      return { patch: { [key]: dirs.map((profile) => ({ profile, model: "" })) } };
     }
-    case "aiArgs":
-      return { patch: { aiArgs: valueTokens } };
     case "commandHistoryUploadMinutes": {
       const n = Number(value);
       if (!Number.isFinite(n) || n <= 0) return { error: `"${value}" is not a positive number.` };
@@ -37628,22 +38572,19 @@ function runConfig(ctx) {
     return;
   }
   if (sub === "init") {
+    const writeDefaults = (verb) => {
+      overwriteProfileConfig(dir2, defaultProfileConfig());
+      ctx.print(`\u2714 ${verb} default config: ${path}`);
+      ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
+    };
     if (existsSync10(path)) {
-      ctx.print(`config already exists: ${path} (use /config set <key> <value>)`, "warn");
+      ctx.confirm(
+        `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
+        () => writeDefaults("replaced with")
+      );
       return;
     }
-    const defaults = {
-      aiCli: "claude",
-      aiArgs: ["-p"],
-      // Lists so failover across profiles is discoverable (ADR-0057) — add more dirs.
-      claudeConfigDir: [".claude"],
-      codexHome: [".codex"],
-      autoUpdate: true,
-      commandHistoryUploadMinutes: 10
-    };
-    writeProfileConfig(dir2, defaults);
-    ctx.print(`\u2714 wrote default config: ${path}`);
-    ctx.print("add claude profiles: /config set claudeConfigDir .claude .claude-1 (tried in order)");
+    writeDefaults("wrote");
     return;
   }
   if (sub === "set") {
@@ -37758,6 +38699,19 @@ function runWhoami(ctx) {
     ctx.print(`projects: ${w.projects.length ? w.projects.map((p) => p.name).join(", ") : "(none)"}`);
   });
 }
+function runFold(ctx, action) {
+  if (ctx.maxBlock === 0) {
+    ctx.print("No collapsible blocks on screen.", "warn");
+    return;
+  }
+  const n = ctx.args[0] != null ? Number(ctx.args[0]) : ctx.maxBlock;
+  if (!Number.isInteger(n) || n < 1 || n > ctx.maxBlock) {
+    ctx.print(`usage: /${action} [1-${ctx.maxBlock}]   (no number \u21D2 the newest block)`, "error");
+    return;
+  }
+  if (action === "expand") ctx.expand(n);
+  else ctx.collapse(n);
+}
 var COMMANDS = [
   {
     name: "help",
@@ -37810,6 +38764,18 @@ var COMMANDS = [
     description: "Tail the profile's structured log",
     run: runLogs
   },
+  {
+    name: "expand",
+    usage: "/expand [N]",
+    description: "Expand a collapsed \u25B8[N] block (default: newest); pretty-prints json/code",
+    run: (ctx) => runFold(ctx, "expand")
+  },
+  {
+    name: "collapse",
+    usage: "/collapse [N]",
+    description: "Collapse an expanded \u25B8[N] block (default: newest)",
+    run: (ctx) => runFold(ctx, "collapse")
+  },
   {
     name: "reconnect",
     usage: "/reconnect",
@@ -38016,13 +38982,19 @@ function App2({
   const [usage, setUsage] = (0, import_react26.useState)(bus.usage);
   const [sessionTokens, setSessionTokens] = (0, import_react26.useState)(bus.sessionTokens);
   const [scrollBack, setScrollBack] = (0, import_react26.useState)(0);
+  const [expanded, setExpanded] = (0, import_react26.useState)(() => /* @__PURE__ */ new Set());
   const [history, setHistory] = (0, import_react26.useState)(() => loadInputHistory(info.profileDir));
   const [startedAt] = (0, import_react26.useState)(() => Date.now());
+  const [pendingConfirm, setPendingConfirm] = (0, import_react26.useState)(null);
   (0, import_react26.useEffect)(() => {
-    const offTranscript = bus.onTranscript(
-      (entry) => setEntries(
+    const offTranscript = bus.onTranscript((entry) => {
+      setEntries(
         (prev) => prev.length >= ENTRY_CAP ? [...prev.slice(prev.length - ENTRY_CAP + 1), entry] : [...prev, entry]
-      )
+      );
+      if (entry.kind === "aireq" || entry.kind === "aires") setExpanded(/* @__PURE__ */ new Set());
+    });
+    const offUpdate = bus.onTranscriptUpdate(
+      (updated) => setEntries((prev) => prev.map((e) => e.id === updated.id ? { ...e, text: updated.text } : e))
     );
     const offStatus = bus.onStatus(setStatus);
     const offBusy = bus.onBusy(setBusy);
@@ -38034,6 +39006,7 @@ function App2({
     const offTokens = bus.onTokens(setSessionTokens);
     return () => {
       offTranscript();
+      offUpdate();
       offStatus();
       offBusy();
       offProfile();
@@ -38044,10 +39017,41 @@ function App2({
       offTokens();
     };
   }, [bus]);
+  const bodyHeight = Math.max(3, rows - CHROME_ROWS);
+  const textWidth = Math.max(10, cols - 1 - 8);
+  const lines = (0, import_react26.useMemo)(() => flattenEntries(entries2, textWidth, expanded), [entries2, textWidth, expanded]);
+  const maxBlock = (0, import_react26.useMemo)(() => lines.reduce((m, l) => Math.max(m, l.blockIndex ?? 0), 0), [lines]);
+  const expandFold = (n) => {
+    const target = n ?? maxBlock;
+    if (target < 1 || target > maxBlock) return;
+    setExpanded((prev) => {
+      const next = new Set(prev);
+      if (next.has(target)) next.delete(target);
+      else next.add(target);
+      return next;
+    });
+  };
+  const collapseFold = (n) => {
+    const target = n ?? maxBlock;
+    setExpanded((prev) => {
+      if (!prev.has(target)) return prev;
+      const next = new Set(prev);
+      next.delete(target);
+      return next;
+    });
+  };
   const handleSubmit = (input) => {
     setScrollBack(0);
-    setHistory((prev) => appendInputHistory(info.profileDir, input, prev));
     const trimmed = input.trim();
+    if (pendingConfirm) {
+      const { onYes } = pendingConfirm;
+      setPendingConfirm(null);
+      bus.push({ source: "local", kind: "cmd", text: trimmed });
+      if (/^y(es)?$/i.test(trimmed)) onYes();
+      else bus.push({ source: "local", kind: "log", text: "cancelled." });
+      return;
+    }
+    setHistory((prev) => appendInputHistory(info.profileDir, input, prev));
     if (trimmed.startsWith("/")) {
       bus.push({ source: "local", kind: "cmd", text: trimmed });
       runSlashCommand(trimmed, {
@@ -38059,17 +39063,21 @@ function App2({
           stdout.write("\x1B[2J\x1B[3J\x1B[H");
         },
         quit: () => exit(),
+        confirm: (prompt, onYes) => {
+          bus.push({ source: "local", kind: "log", text: prompt });
+          setPendingConfirm({ prompt, onYes });
+        },
         submitAi: (aiInput) => bus.submitLocal(aiInput),
         reconnect: () => bus.requestReconnect(),
+        expand: expandFold,
+        collapse: collapseFold,
+        maxBlock,
         live: { status, scope, worker, project, activeProfile, startedAt }
       });
       return;
     }
     bus.submitLocal(input);
   };
-  const bodyHeight = Math.max(3, rows - CHROME_ROWS);
-  const textWidth = Math.max(10, cols - 1 - 8);
-  const lines = (0, import_react26.useMemo)(() => flattenEntries(entries2, textWidth), [entries2, textWidth]);
   const maxScroll = Math.max(0, lines.length - bodyHeight);
   const clampedBack = Math.min(scrollBack, maxScroll);
   const lineRows = clampedBack > 0 ? bodyHeight - 1 : bodyHeight;
@@ -38130,6 +39138,7 @@ async function runStart(profileDir2, profileName) {
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
   logger.info("cli.start", { serverUrl: credential.serverUrl });
+  ensureProfileConfig(profileDir2);
   const config = readProfileConfig(profileDir2);
   const autoUpdate = config.autoUpdate !== false && process.env.FOURPM_NO_UPDATE !== "1";
   const result = await checkAndUpdate(credential.serverUrl, autoUpdate);
@@ -38172,6 +39181,20 @@ async function runStart(profileDir2, profileName) {
       profileDir: profileDir2,
       bus
     });
+    const runResilient = async () => {
+      for (; ; ) {
+        try {
+          await client.run();
+          return;
+        } catch (err) {
+          const e = err instanceof Error ? err : new Error(String(err));
+          logger.error("ws.run.crash", { message: e.message, stack: e.stack });
+          if (client.isStopped) return;
+          bus.log(`Recovered from an internal error \u2014 reconnecting: ${e.message}`, "error");
+          await new Promise((resolve6) => setTimeout(resolve6, 1e3));
+        }
+      }
+    };
     const useTui = Boolean(process.stdout.isTTY) && process.env.FOURPM_HEADLESS !== "1";
     if (useTui) {
       const info = {
@@ -38190,12 +39213,12 @@ async function runStart(profileDir2, profileName) {
       bus.setActiveProfile(workingDir ? profileDisplayLabel(workingDir) : labels[0] ?? null);
       const tui = runTui(bus, info);
       bus.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
-      void client.run();
+      void runResilient();
       await tui;
     } else {
       attachConsoleSink(bus);
       bus.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
-      await client.run();
+      await runResilient();
     }
   } finally {
     release();
@@ -38225,7 +39248,7 @@ async function runUnlink(profileDir2, profileName) {
 
 // src/commands/update.ts
 async function runUpdate(profileDir2, profileName, serverUrlFlag) {
-  const serverUrl = (serverUrlFlag ?? readCredential(profileDir2, profileName)?.serverUrl ?? process.env.FOURPM_SERVER ?? "http://localhost:3001").replace(/\/$/, "");
+  const serverUrl = (serverUrlFlag || readCredential(profileDir2, profileName)?.serverUrl || process.env.FOURPM_SERVER || "http://localhost:42001").replace(/\/$/, "");
   let result;
   try {
     result = await updateToLatest(serverUrl);
@@ -38295,14 +39318,21 @@ function Picker({
   ] });
 }
 function selectFromList(items, title) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let chosen = null;
     const app = render_default(/* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Picker, { items, title, onDone: (v) => chosen = v }));
-    void app.waitUntilExit().then(() => resolve5(chosen));
+    void app.waitUntilExit().then(() => resolve6(chosen));
   });
 }
 
 // src/index.ts
+process.on("unhandledRejection", (reason) => {
+  const err = reason instanceof Error ? reason : new Error(String(reason));
+  logger.error("process.unhandledRejection", { message: err.message, stack: err.stack });
+});
+process.on("uncaughtException", (err) => {
+  logger.error("process.uncaughtException", { message: err.message, stack: err.stack });
+});
 function flagValue(args, name) {
   const index = args.indexOf(`--${name}`);
   return index >= 0 ? args[index + 1] : void 0;
@@ -38331,7 +39361,7 @@ async function main() {
   const [command, ...rest] = args;
   switch (command) {
     case "link": {
-      const serverUrl = flagValue(rest, "server") ?? process.env.FOURPM_SERVER ?? "http://localhost:3001";
+      const serverUrl = flagValue(rest, "server") || process.env.FOURPM_SERVER || "http://localhost:42001";
       await runLink(serverUrl.replace(/\/$/, ""), explicitProfile);
       break;
     }
@@ -38380,7 +39410,7 @@ async function main() {
           "",
           "Profiles: named after the paired account (e.g. mcacc1); when several exist,",
           "start/unlink show a picker (\u2191\u2193 + Enter) \u2014 no --profile needed.",
-          "Server URL: from FOURPM_SERVER (default http://localhost:3001)."
+          "Server URL: from FOURPM_SERVER (default http://localhost:42001)."
         ].join("\n")
       );
   }