@algosuite/vo-mcp 0.2.0-beta.17 → 0.2.0-beta.19

package/dist/runner-cli.js

@@ -2142,11 +2142,11 @@ function createControlPlaneClient({
     throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   }
   const root = resolvedBaseUrl.replace(/\/+$/, "");
-  async function req(method, path18, body, { timeoutMs } = {}) {
+  async function req(method, path16, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path18}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path16}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -2159,7 +2159,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path18} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path16} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -2278,8 +2278,8 @@ function createControlPlaneClient({
       return json ? json.task : null;
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path18 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await req("GET", path18);
+      const path16 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await req("GET", path16);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -3089,17 +3089,26 @@ function selectOrphanKills({ instances = [], liveProcesses = /* @__PURE__ */ new
   }
   return { kills, pruneDirs };
 }
-function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5 } = {}) {
+function windowsSystemRoot(env2 = process.env) {
+  return env2.SystemRoot || env2.WINDIR || "C:\\Windows";
+}
+function windowsPowershellExe(env2 = process.env) {
+  return path10.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
   const map = /* @__PURE__ */ new Map();
   if (platform === "win32") {
     const ps = "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }";
-    const result2 = spawn5("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], {
+    const result2 = spawn5(windowsPowershellExe(env2), ["-NoProfile", "-NonInteractive", "-Command", ps], {
       windowsHide: true,
       encoding: "utf8",
       timeout: 2e4,
       maxBuffer: 32 * 1024 * 1024
     });
-    if (result2.error || result2.status !== 0 || typeof result2.stdout !== "string") return map;
+    if (result2.error || result2.status !== 0 || typeof result2.stdout !== "string") {
+      warn(`[orphan-reaper] process enumeration failed (${result2.error ? result2.error.message : `powershell exit ${result2.status}`}); reaping nothing this cycle`);
+      return map;
+    }
     for (const line of result2.stdout.split(/\r?\n/)) {
       const m = line.trim().match(/^(\d+)\s+(-?\d+)$/);
       if (m) map.set(Number(m[1]), { creationMs: Number(m[2]) });
@@ -3107,7 +3116,10 @@ function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 =
     return map;
   }
   const result = spawn5("ps", ["-eo", "pid=,lstart="], { encoding: "utf8", timeout: 2e4, maxBuffer: 32 * 1024 * 1024 });
-  if (result.error || result.status !== 0 || typeof result.stdout !== "string") return map;
+  if (result.error || result.status !== 0 || typeof result.stdout !== "string") {
+    warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);
+    return map;
+  }
   for (const line of result.stdout.split(/\r?\n/)) {
     const parsed = parsePosixPsLine(line);
     if (parsed) map.set(parsed.pid, { creationMs: parsed.creationMs });
@@ -3123,10 +3135,11 @@ function parsePosixPsLine(line) {
   if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;
   return { pid, creationMs: when };
 }
-function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5 } = {}) {
+function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (platform === "win32") {
-    const r = spawn5("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
+    const taskkill = path10.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
+    const r = spawn5(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
   }
   try {
@@ -3187,6 +3200,65 @@ var init_orphan_agent_reaper = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/cli-version-floor.mjs
+function parseCliVersion(output) {
+  const match = /\b(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?\b/.exec(String(output ?? ""));
+  return match ? `${match[1]}.${match[2]}.${match[3]}` : null;
+}
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    if (pa[i] !== pb[i]) return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
+function checkCliVersionFloor(versionOutput, { floor = MIN_CLAUDE_CLI_VERSION } = {}) {
+  const version = parseCliVersion(versionOutput);
+  if (!version) {
+    const seen = String(versionOutput ?? "").trim().slice(0, 120) || "<empty>";
+    return {
+      ok: false,
+      version: null,
+      floor,
+      message: `could not parse a semver from \`claude --version\` output ("${seen}") \u2014 cannot prove the CLI meets the ${floor} security floor. ${SECURITY_RATIONALE}`
+    };
+  }
+  if (compareSemver(version, floor) < 0) {
+    return {
+      ok: false,
+      version,
+      floor,
+      message: `claude CLI ${version} is BELOW the minimum security floor ${floor}. ` + SECURITY_RATIONALE
+    };
+  }
+  return {
+    ok: true,
+    version,
+    floor,
+    message: `claude CLI ${version} meets the minimum security floor ${floor}`
+  };
+}
+function applyCliVersionFloor({ versionOutput, env: env2 = process.env, log: log3 = console.error } = {}) {
+  const check = checkCliVersionFloor(versionOutput);
+  if (check.ok) return { refused: false, check, message: check.message };
+  const enforce = String(env2?.VO_CLI_FLOOR_ENFORCE ?? "") === "1";
+  const message = `[cli-version-floor] ${enforce ? "REFUSING (VO_CLI_FLOOR_ENFORCE=1)" : "WARNING (warn-only)"}: ` + check.message;
+  try {
+    log3(message);
+  } catch {
+  }
+  return { refused: enforce, check, message };
+}
+var MIN_CLAUDE_CLI_VERSION, SECURITY_RATIONALE;
+var init_cli_version_floor = __esm({
+  "../../scripts/virtual-office/code-runner/cli-version-floor.mjs"() {
+    "use strict";
+    MIN_CLAUDE_CLI_VERSION = "2.1.216";
+    SECURITY_RATIONALE = "Claude Code 2.1.211/2.1.213 fixed a PreToolUse-hook bypass on unsandboxed Bash (our destructive-fs/git/cloud tripwires DO NOT FIRE on older CLIs) and worktree-subagents mutating the main checkout. Update: npm install -g @anthropic-ai/claude-code (or the native installer).";
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/claude-runner.mjs
 import { spawn as spawn2 } from "node:child_process";
 function extractText(content) {
@@ -3409,6 +3481,7 @@ var init_claude_runner = __esm({
     init_windows_claude_launch();
     init_terminal_process_cleanup();
     init_orphan_agent_reaper();
+    init_cli_version_floor();
     ClaudeRunner = class {
       get binary() {
         return "claude";
@@ -3445,7 +3518,7 @@ var init_claude_runner = __esm({
        */
       async checkAuth() {
         try {
-          const probe = spawnClaudeSync(["--version"], { timeout: 3e3, stdio: "ignore" });
+          const probe = spawnClaudeSync(["--version"], { timeout: 3e3, encoding: "utf8" });
           if (probe.error) {
             return {
               installed: false,
@@ -3456,6 +3529,8 @@ var init_claude_runner = __esm({
           if (probe.status !== 0) {
             return { installed: true, authenticated: false, message: "claude binary exists but --version failed (auth unclear)" };
           }
+          const floorGate = applyCliVersionFloor({ versionOutput: probe.stdout, env: process.env });
+          if (floorGate.refused) return { installed: true, authenticated: false, message: floorGate.message };
           const loggedIn = probeClaudeLoginState();
           if (loggedIn === false) {
             return {
@@ -3598,7 +3673,7 @@ function resolveCodexBinary({
   return "codex";
 }
 function buildCodexArgs({ model, effort } = {}) {
-  const args = ["exec", "--json", "-c", 'approval_policy="never"', "--sandbox", "workspace-write"];
+  const args = ["exec", "--json", "-c", 'approval_policy="never"', "--sandbox", "workspace-write", "--skip-git-repo-check"];
   if (model) {
     args.push("--model", String(model));
   }
@@ -3667,11 +3742,25 @@ var init_codex_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      /**
+       * SECURITY: never `shell: true` — same RCE class as cursor-runner. The old
+       * `shell: win32 && !/\.exe$/` fell back to shell mode whenever
+       * resolveCodexBinary() could not find one of its hardcoded absolute paths and
+       * returned the bare string 'codex'. Node's shell mode joins argv into
+       * `cmd /d /s /c` with windowsVerbatimArguments, and buildCodexArgs() puts the
+       * control-plane-controlled `model` into argv, so a payload of
+       * `{ agent: 'codex', model: 'gpt-5 & <cmd>' }` executed arbitrary code —
+       * including on hosts where codex is NOT installed, because cmd runs the first
+       * command, it fails, and `&` runs the rest anyway.
+       *
+       * With shell:false a `.cmd`/`.ps1` shim no longer resolves and the spawn fails
+       * closed with ENOENT, matching resolveWindowsClaudeExecutable()'s policy.
+       */
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /**
@@ -3805,10 +3894,26 @@ var init_cursor_runner = __esm({
       parseEvent(line) {
         return parseCursorEvent(line);
       }
+      /**
+       * SECURITY: never `shell: true`. Node's shell mode on Windows joins argv and
+       * hands it to `cmd /d /s /c` with windowsVerbatimArguments, so every cmd
+       * metacharacter (& | > ^) in an argument is interpreted by the shell. This
+       * runner puts two control-plane-controlled strings into argv — `task.model`
+       * and the composed prompt (buildCursorArgs) — so shell mode turned a task
+       * payload into arbitrary host code execution. It fired even without
+       * cursor-agent installed: cmd runs the first command, it fails, and `&` runs
+       * the rest anyway. With shell:false argv goes straight to CreateProcess and
+       * metacharacters are inert.
+       *
+       * Consequence on Windows: a `.cmd`/`.ps1` shim no longer resolves, so the
+       * runner fails closed with ENOENT rather than executing through a shell —
+       * the same policy resolveWindowsClaudeExecutable() enforces for Claude.
+       */
       getSpawnOptions() {
         return {
-          shell: process.platform === "win32",
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /**
@@ -3823,7 +3928,7 @@ var init_cursor_runner = __esm({
       async checkAuth() {
         try {
           const { status, error } = spawnSync7("cursor-agent", ["--version"], {
-            shell: process.platform === "win32",
+            shell: false,
             windowsHide: true,
             timeout: 3e3,
             stdio: "ignore"
@@ -3880,11 +3985,13 @@ var init_meta_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      // SECURITY: never shell — see no-shell-spawn.test.mjs. Inert today (buildArgs
+      // throws) but this goes hot the moment the transport is enabled.
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       applyAuthEnv(env2 = process.env) {
@@ -3933,11 +4040,13 @@ var init_openai_compatible_runner = __esm({
       parseEvent(line) {
         return parseCodexEvent(line);
       }
-      getSpawnOptions({ bin } = {}) {
-        const effectiveBin = String(bin || this.binary || "");
+      // SECURITY: never shell — see no-shell-spawn.test.mjs. Inert today (buildArgs
+      // throws) but this goes hot the moment the transport is enabled.
+      getSpawnOptions() {
         return {
-          shell: process.platform === "win32" && !/\.exe$/i.test(effectiveBin),
-          windowsHide: true
+          shell: false,
+          windowsHide: true,
+          windowsVerbatimArguments: false
         };
       }
       /** Fill the BYO key env var from the OS keychain when not already set. */
@@ -4182,6 +4291,16 @@ var init_rate_limit_resume = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/secure-random.mjs
+import { randomInt } from "node:crypto";
+var secureUnitRandom;
+var init_secure_random = __esm({
+  "../../scripts/virtual-office/code-runner/secure-random.mjs"() {
+    "use strict";
+    secureUnitRandom = () => randomInt(0, 2 ** 32) / 2 ** 32;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/git-resilience.mjs
 function isTransientGitError(err) {
   if (!err) return false;
@@ -4193,7 +4312,7 @@ function isTransientGitError(err) {
   }
   return TRANSIENT_RE.test(msg);
 }
-function computeGitBackoffMs(attempt, { baseMs = 5e3, capMs = 3e4, rng = Math.random } = {}) {
+function computeGitBackoffMs(attempt, { baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom } = {}) {
   const exp = Math.min(capMs, baseMs * Math.pow(2, Math.max(0, attempt)));
   return Math.floor(exp / 2 + rng() * (exp / 2));
 }
@@ -4201,6 +4320,7 @@ var TRANSIENT_CODES, TRANSIENT_RE;
 var init_git_resilience = __esm({
   "../../scripts/virtual-office/code-runner/git-resilience.mjs"() {
     "use strict";
+    init_secure_random();
     TRANSIENT_CODES = /* @__PURE__ */ new Set([
       "ETIMEDOUT",
       "ECONNRESET",
@@ -4227,10 +4347,39 @@ var init_auto_merge = __esm({
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
 import { spawnSync as spawnSync8 } from "node:child_process";
-import path11 from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { fileURLToPath } from "node:url";
+function stripCredentials(env2 = process.env) {
+  const safe = { ...env2 };
+  for (const key of CREDENTIAL_ENV_KEYS) delete safe[key];
+  return safe;
+}
+function resolveOverlapScript({
+  worktreeDir,
+  trustedPath = TRUSTED_OVERLAP_SCRIPT,
+  existsFn = existsSync5,
+  joinFn = (dir) => `${dir}/scripts/ci/check-local-pr-overlap.mjs`
+} = {}) {
+  if (existsFn(trustedPath)) return { scriptPath: trustedPath, trusted: true };
+  return { scriptPath: joinFn(worktreeDir), trusted: false };
+}
+var TRUSTED_OVERLAP_SCRIPT, CREDENTIAL_ENV_KEYS;
 var init_pr_overlap_gate = __esm({
   "../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs"() {
     "use strict";
+    TRUSTED_OVERLAP_SCRIPT = fileURLToPath(
+      new URL("../../ci/check-local-pr-overlap.mjs", import.meta.url)
+    );
+    CREDENTIAL_ENV_KEYS = Object.freeze([
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "VO_CONTROL_PLANE_ADMIN_TOKEN",
+      "VO_CONTROL_PLANE_TOKEN",
+      "GITHUB_APP_PRIVATE_KEY",
+      "ANTHROPIC_API_KEY",
+      "OPENAI_API_KEY",
+      "CURSOR_API_KEY"
+    ]);
   }
 });
 
@@ -4274,14 +4423,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const tok = tokens[i];
     if (!tok) continue;
-    const path18 = tok.slice(3);
-    if (path18) files.push(path18);
+    const path16 = tok.slice(3);
+    if (path16) files.push(path16);
     if (tok[0] === "R" || tok[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path18) {
-  const p = String(path18 || "");
+function isAgentScratch(path16) {
+  const p = String(path16 || "");
   return SCRATCH_PATTERNS.some((re) => re.test(p));
 }
 function isMaxTurnsResult(summary) {
@@ -4488,7 +4637,6 @@ var init_partial_pr_continuation = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/publish-async.mjs
-import path12 from "node:path";
 function compactTitle(value, max = 100) {
   return String(value || "").replace(/\s+/g, " ").trim().slice(0, max) || "code-task";
 }
@@ -4498,7 +4646,7 @@ function gitRetryLog(op) {
     console.error(`[publish] transient ${op} failure (attempt ${attempt}): ${why} \u2014 retrying in ${Math.round(delayMs / 1e3)}s`);
   };
 }
-async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = Math.random, onRetry } = {}) {
+async function retryTransientAsync(fn, { attempts = 3, baseMs = 5e3, capMs = 3e4, rng = secureUnitRandom, onRetry } = {}) {
   let lastErr;
   for (let i = 0; i < attempts; i += 1) {
     try {
@@ -4529,8 +4677,12 @@ async function resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand
   }
   return branch;
 }
-async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null } = {}) {
-  const scriptPath = path12.join(worktreeDir, "scripts", "ci", "check-local-pr-overlap.mjs");
+async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env: env2 = process.env, excludePrNumber = null, log: log3 = (m) => console.warn(`[pr-overlap-gate] ${m}`) } = {}) {
+  const { scriptPath, trusted } = resolveOverlapScript({ worktreeDir });
+  const childEnv = trusted ? env2 : stripCredentials(env2);
+  if (!trusted) {
+    log3(`WARNING: trusted overlap script not found; running worktree copy ${scriptPath} with credentials stripped.`);
+  }
   try {
     const output = await runProcess2("node", [
       scriptPath,
@@ -4539,7 +4691,7 @@ async function runLocalPrOverlapGateAsync(worktreeDir, files, { branch = "", env
       ...excludePrNumber ? ["--exclude-pr", String(excludePrNumber)] : []
     ], {
       cwd: worktreeDir,
-      env: env2,
+      env: childEnv,
       input: JSON.stringify([...new Set((files || []).map((file) => String(file || "").trim()).filter(Boolean))]),
       timeout: 12e4
     });
@@ -4821,6 +4973,8 @@ var init_publish_async = __esm({
     init_auto_merge();
     init_git_resilience();
     init_process_runner2();
+    init_secure_random();
+    init_pr_overlap_gate();
     init_existing_pr_publication();
     init_partial_pr_continuation();
     sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -4837,7 +4991,7 @@ function defaultRunCommand2(cmd, args, cwd, opts = {}) {
 function buildResumeLocalBranchName(remoteBranch, {
   now = () => /* @__PURE__ */ new Date(),
   pid = process.pid,
-  random = Math.random
+  random = secureUnitRandom
 } = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const unique = `${pid}-${random().toString(36).slice(2, 8)}`;
@@ -4929,6 +5083,85 @@ var init_resume_branch = __esm({
     "use strict";
     init_publish();
     init_process_runner2();
+    init_secure_random();
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/skill-catalog.mjs
+import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function parseFrontmatterNameDescription(raw) {
+  const text = String(raw).replace(/\r\n/g, "\n");
+  if (!text.startsWith("---\n")) return null;
+  const end = text.indexOf("\n---\n", 4);
+  if (end === -1) return null;
+  let name = "";
+  let description = "";
+  for (const line of text.slice(4, end).split("\n")) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim();
+    const value = line.slice(idx + 1).trim();
+    if (key === "name") name = value;
+    else if (key === "description") description = value;
+  }
+  return name && description ? { name, description } : null;
+}
+function resolveDefaultRepoRoot() {
+  const starts = [dirname3(fileURLToPath2(import.meta.url)), process.cwd()];
+  for (const start of starts) {
+    let dir = start;
+    for (let i = 0; i < 8; i += 1) {
+      try {
+        if (statSync(join3(dir, ".claude", "skills")).isDirectory()) return dir;
+      } catch {
+      }
+      const parent = dirname3(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return process.cwd();
+}
+function loadSkillCatalog({ repoRoot: repoRoot2 = resolveDefaultRepoRoot() } = {}) {
+  try {
+    const skillsDir = join3(repoRoot2, ".claude", "skills");
+    const catalog = [];
+    for (const entry of readdirSync2(skillsDir)) {
+      const dir = join3(skillsDir, entry);
+      try {
+        if (!statSync(dir).isDirectory()) continue;
+        const parsed = parseFrontmatterNameDescription(
+          readFileSync3(join3(dir, "SKILL.md"), "utf8")
+        );
+        if (parsed) catalog.push(parsed);
+      } catch {
+      }
+    }
+    return catalog.sort((a, b) => a.name.localeCompare(b.name)).slice(0, CATALOG_CAP);
+  } catch {
+    return [];
+  }
+}
+function buildSkillCatalogBlock(catalog) {
+  if (!Array.isArray(catalog) || catalog.length === 0) return "";
+  const lines = catalog.map((s) => `  - ${s.name}: ${s.description}`);
+  return [
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 ALGOSUITE SKILL CATALOG \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "The repo ships a skill corpus (same one Claude Code loads natively). When a",
+    "task matches a skill below, LOAD ITS FULL INSTRUCTIONS FIRST and follow them:",
+    "  - via MCP: call vo_skill_get with the skill name (any vendor with AlgoHQ MCP tools), or",
+    "  - via file: read .claude/skills/<name>/SKILL.md in this worktree.",
+    lines.join("\n"),
+    ""
+  ].join("\n");
+}
+var CATALOG_CAP;
+var init_skill_catalog = __esm({
+  "../../scripts/virtual-office/code-runner/skill-catalog.mjs"() {
+    "use strict";
+    CATALOG_CAP = 60;
   }
 });
 
@@ -4976,9 +5209,13 @@ function buildKnowledgeContextBlock(contextMarkdown) {
 }
 function composeDispatchPrompt(taskPrompt, opts = {}) {
   const knowledge = buildKnowledgeContextBlock(opts.knowledgeContextMarkdown);
+  const catalog = opts.includeSkillCatalog === false ? "" : buildSkillCatalogBlock(
+    opts.skillCatalog ?? loadSkillCatalog({ repoRoot: opts.repoRoot })
+  );
   const task = String(taskPrompt ?? "").trim();
   return [
     buildDispatchOnboarding(opts),
+    catalog,
     knowledge,
     "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 YOUR TASK \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
     task,
@@ -4989,6 +5226,7 @@ var MANDATORY_READS, NON_NEGOTIABLES;
 var init_dispatch_onboarding = __esm({
   "../../scripts/virtual-office/code-runner/dispatch-onboarding.mjs"() {
     "use strict";
+    init_skill_catalog();
     MANDATORY_READS = [
       "CLAUDE.md (repo root \u2014 Claude-specific rules; auto-loaded, but READ it)",
       'AGENTS.md (repo root \u2014 cross-vendor rules + "Onboarding for a lane"; NOT auto-loaded)',
@@ -5126,7 +5364,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash3, randomUUID } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path13 from "node:path";
+import path11 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -5136,25 +5374,25 @@ function sanitizeTaskAttachmentName(name, index = 0) {
   return `${String(index + 1).padStart(2, "0")}-${normalized}`;
 }
 function assertGeneratedDirectory(directory, tempRoot) {
-  const resolvedDirectory = path13.resolve(directory);
-  const resolvedRoot = path13.resolve(tempRoot);
-  if (path13.dirname(resolvedDirectory) !== resolvedRoot || !path13.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
+  const resolvedDirectory = path11.resolve(directory);
+  const resolvedRoot = path11.resolve(tempRoot);
+  if (path11.dirname(resolvedDirectory) !== resolvedRoot || !path11.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
 }
 async function createAttachmentDirectory(taskId, tempRoot) {
-  const root = path13.resolve(tempRoot);
+  const root = path11.resolve(tempRoot);
   await mkdir(root, { recursive: true });
-  const directory = await mkdtemp(path13.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID(), directory: path13.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path13.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  const directory = await mkdtemp(path11.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID(), directory: path11.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path11.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, tempRoot: root };
 }
 async function cleanupGeneratedDirectory(state) {
   if (!state || state.cleaned) return;
   const directory = assertGeneratedDirectory(state.directory, state.tempRoot);
-  const marker = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path11.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -5173,7 +5411,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path13.resolve(tempRoot);
+  const root = path11.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -5182,8 +5420,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(DIRECTORY_PREFIX)) continue;
-    const directory = assertGeneratedDirectory(path13.join(root, entry.name), root);
-    const markerRaw = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path11.join(root, entry.name), root);
+    const markerRaw = await readFile(path11.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -5226,10 +5464,10 @@ async function materializeTaskAttachments(client, task, { tempRoot = os2.tmpdir(
       const sha256 = createHash3("sha256").update(content).digest("hex");
       if (sha256 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path13.join(state.directory, name);
+      const filePath = path11.join(state.directory, name);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
-      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path13.resolve(filePath) });
+      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path11.resolve(filePath) });
     }
     return { directory: state.directory, files, manifestMarkdown: buildManifest(files), cleanup: () => cleanupGeneratedDirectory(state) };
   } catch (error) {
@@ -5252,7 +5490,7 @@ var init_task_attachments = __esm({
 
 // ../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs
 import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { readdir as readdir2, readFile as readFile2, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { createHash as createHash4 } from "node:crypto";
 function deriveUuid(seed) {
@@ -5284,18 +5522,18 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   for (const f of files) {
     if (!f.endsWith(".json")) continue;
     try {
-      const record = JSON.parse(await readFile2(join3(spoolDir, f), "utf8"));
+      const record = JSON.parse(await readFile2(join4(spoolDir, f), "utf8"));
       if (record && typeof record.session_key === "string") {
-        out.push({ full: join3(spoolDir, f), record });
+        out.push({ full: join4(spoolDir, f), record });
       }
     } catch {
     }
   }
   return out;
 }
-async function readCloudMap(path18) {
+async function readCloudMap(path16) {
   try {
-    return JSON.parse(await readFile2(path18, "utf8"));
+    return JSON.parse(await readFile2(path16, "utf8"));
   } catch {
     return {};
   }
@@ -5368,8 +5606,8 @@ var SPOOL_DIR, CLOUD_MAP_FILE, STALE_MS, ACTIVE_SILENCE_MS;
 var init_session_spool_forwarder = __esm({
   "../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs"() {
     "use strict";
-    SPOOL_DIR = join3(homedir3(), ".vo", "session-spool");
-    CLOUD_MAP_FILE = join3(homedir3(), ".vo", "session-cloud-map.json");
+    SPOOL_DIR = join4(homedir3(), ".vo", "session-spool");
+    CLOUD_MAP_FILE = join4(homedir3(), ".vo", "session-cloud-map.json");
     STALE_MS = 60 * 60 * 1e3;
     ACTIVE_SILENCE_MS = 10 * 60 * 1e3;
   }
@@ -5438,14 +5676,14 @@ var init_rate_limit_resume_scheduler_core = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-scheduler.mjs
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve } from "node:path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
+import { dirname as dirname4, join as join5, resolve } from "node:path";
 function log(msg) {
   console.log(`[rate-limit-scheduler ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
 function readQueue(queuePath) {
-  if (!existsSync5(queuePath)) return [];
-  const content = readFileSync3(queuePath, "utf-8");
+  if (!existsSync6(queuePath)) return [];
+  const content = readFileSync4(queuePath, "utf-8");
   const lines = content.split("\n").filter((l) => l.trim());
   const entries = [];
   for (const line of lines) {
@@ -5458,18 +5696,18 @@ function readQueue(queuePath) {
   return entries;
 }
 function writeQueue(queuePath, entries) {
-  mkdirSync4(dirname3(queuePath), { recursive: true });
+  mkdirSync4(dirname4(queuePath), { recursive: true });
   const lines = entries.map((e) => JSON.stringify(e)).join("\n");
   writeFileSync3(queuePath, lines + (entries.length > 0 ? "\n" : ""), "utf-8");
 }
 function attemptsStorePath() {
-  return join4(dirname3(resumeQueuePath()), "resume-attempts.json");
+  return join5(dirname4(resumeQueuePath()), "resume-attempts.json");
 }
 function readAttemptsStore() {
   const p = attemptsStorePath();
-  if (!existsSync5(p)) return {};
+  if (!existsSync6(p)) return {};
   try {
-    const parsed = JSON.parse(readFileSync3(p, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(p, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -5477,7 +5715,7 @@ function readAttemptsStore() {
 }
 function writeAttemptsStore(store) {
   const p = attemptsStorePath();
-  mkdirSync4(dirname3(p), { recursive: true });
+  mkdirSync4(dirname4(p), { recursive: true });
   writeFileSync3(p, JSON.stringify(store, null, 2), "utf-8");
 }
 function countsFromStore(store) {
@@ -5863,7 +6101,7 @@ var init_agent_availability = __esm({
 import { spawn as spawn4 } from "node:child_process";
 import fs6 from "node:fs";
 import os3 from "node:os";
-import path14 from "node:path";
+import path12 from "node:path";
 function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } = {}) {
   const read = (p) => {
     try {
@@ -5872,7 +6110,7 @@ function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } =
       return null;
     }
   };
-  const status = read(path14.join(homeDir, ".claude", "claude-usage.json"));
+  const status = read(path12.join(homeDir, ".claude", "claude-usage.json"));
   if (status && (status.seven_day || status.five_hour)) {
     const entry = {
       agent: "claude",
@@ -5881,7 +6119,7 @@ function readClaudeUsage({ homeDir = os3.homedir(), read: rawRead = readJson } =
     };
     if (entry.seven_day_used_pct !== null || entry.five_hour_used_pct !== null) return entry;
   }
-  const weekly = read(path14.join(homeDir, ".claude", "claude-weekly-usage.json"));
+  const weekly = read(path12.join(homeDir, ".claude", "claude-weekly-usage.json"));
   if (weekly) {
     const entry = {
       agent: "claude",
@@ -6203,7 +6441,7 @@ var init_superseded_pr_source = __esm({
 
 // ../../scripts/virtual-office/code-runner/pr-watcher.mjs
 import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as spawnSync11 } from "node:child_process";
 function ghViewPr(prNumber, repo) {
@@ -6298,7 +6536,7 @@ async function readState(stateFile) {
 }
 async function writeState(stateFile, state) {
   try {
-    await mkdir2(join5(stateFile, ".."), { recursive: true });
+    await mkdir2(join6(stateFile, ".."), { recursive: true });
     await writeFile3(stateFile, JSON.stringify(state, null, 2), "utf8");
   } catch {
   }
@@ -6503,7 +6741,7 @@ var init_pr_watcher = __esm({
     init_pr_watcher_failure_confirmation();
     init_superseded_pr_source();
     init_superseded_pr_source();
-    DEFAULT_STATE_FILE = join5(homedir4(), ".vo", "dispatched-prs.json");
+    DEFAULT_STATE_FILE = join6(homedir4(), ".vo", "dispatched-prs.json");
     FAIL_CONCLUSIONS = /* @__PURE__ */ new Set([
       "FAILURE",
       "TIMED_OUT",
@@ -6619,9 +6857,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path18 = String(req.url || "").split("?")[0];
+    const path16 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path18 === "/status") {
+    if (req.method === "GET" && path16 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -6632,7 +6870,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path18 === "/stop") {
+    if (req.method === "POST" && path16 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -6743,44 +6981,45 @@ ${effortConfig.multiAgentInstruction}
   parts.push(String(basePrompt || "").trim());
   return parts.join("\n");
 }
-var EFFORT_MODE_CONFIG, DEFAULT_MODE;
+var RED_TEAM_DIRECTIVE, EFFORT_MODE_CONFIG, DEFAULT_MODE;
 var init_effort_mode_config = __esm({
   "../../scripts/virtual-office/code-runner/effort-mode-config.mjs"() {
     "use strict";
+    RED_TEAM_DIRECTIVE = "Before declaring done, red-team your own work: name the top ways it could be wrong \u2014 especially code that is correct but silently not wired into production callers \u2014 give the failure scenario for each, and state the evidence that rules it out.";
     EFFORT_MODE_CONFIG = {
       fast: {
         tier: "cheap",
         permissionMode: "acceptEdits",
         maxTurns: 80,
-        thinkingDirective: "",
+        thinkingDirective: RED_TEAM_DIRECTIVE,
         multiAgentInstruction: ""
       },
       standard: {
         tier: "mid",
         permissionMode: "acceptEdits",
         maxTurns: 200,
-        thinkingDirective: "",
+        thinkingDirective: RED_TEAM_DIRECTIVE,
         multiAgentInstruction: ""
       },
       deep: {
         tier: "best",
         permissionMode: "acceptEdits",
         maxTurns: 300,
-        thinkingDirective: "Think step-by-step. Verify assumptions against source code. Check edge cases.",
+        thinkingDirective: `Think step-by-step. Verify assumptions against source code. Check edge cases. ${RED_TEAM_DIRECTIVE}`,
         multiAgentInstruction: ""
       },
       ultra: {
         tier: "best",
         permissionMode: "acceptEdits",
         maxTurns: 500,
-        thinkingDirective: "Think step-by-step. Exhaustively verify every assumption against source code and documentation. Adversarially review your own work.",
+        thinkingDirective: `Think step-by-step. Exhaustively verify every assumption against source code and documentation. ${RED_TEAM_DIRECTIVE}`,
         multiAgentInstruction: "If this task needs multiple phases (research, build, verify), propose a plan first."
       },
       ultracode: {
         tier: "best",
         permissionMode: "acceptEdits",
         maxTurns: 800,
-        thinkingDirective: "Think step-by-step. Exhaustively verify every assumption against source code and documentation. Build worked examples to validate correctness. Adversarially review your own work.",
+        thinkingDirective: `Think step-by-step. Exhaustively verify every assumption against source code and documentation. Build worked examples to validate correctness. ${RED_TEAM_DIRECTIVE}`,
         multiAgentInstruction: "Decompose this work into parallel research, build, and verification streams; use workflow orchestration where it helps."
       }
     };
@@ -6790,8 +7029,8 @@ var init_effort_mode_config = __esm({
 
 // ../../scripts/virtual-office/model-registry.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
-import { fileURLToPath } from "node:url";
+import path13 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
 }
@@ -6913,7 +7152,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs7.mkdirSync(path15.dirname(cacheFile), { recursive: true });
+  fs7.mkdirSync(path13.dirname(cacheFile), { recursive: true });
   fs7.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -6971,10 +7210,10 @@ var __dirname, ROOT, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANT
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path15.dirname(fileURLToPath(import.meta.url));
-    ROOT = path15.resolve(__dirname, "..", "..");
-    DEFAULT_CACHE_DIR = path15.join(ROOT, ".virtual-office-cache", "model-registry");
-    DEFAULT_CACHE_FILE = path15.join(DEFAULT_CACHE_DIR, "catalog.json");
+    __dirname = path13.dirname(fileURLToPath3(import.meta.url));
+    ROOT = path13.resolve(__dirname, "..", "..");
+    DEFAULT_CACHE_DIR = path13.join(ROOT, ".virtual-office-cache", "model-registry");
+    DEFAULT_CACHE_FILE = path13.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -7175,10 +7414,18 @@ var init_model_router = __esm({
       }
     };
     AGENT_MODEL_COMPATIBILITY = {
-      claude: (model) => /^claude-/i.test(String(model || "")),
-      codex: (model) => /^(?:gpt-|o\d|codex)/i.test(String(model || "")),
-      cursor: () => true,
-      meta: (model) => /^muse-spark-/i.test(String(model || ""))
+      // SECURITY: these are ANCHORED AT BOTH ENDS on purpose. The old patterns were
+      // prefix-only, so `gpt-5 & <cmd>` and `claude-3 & <cmd>` passed the gate with
+      // the payload still attached and landed in the agent's argv.
+      claude: (model) => /^claude-[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || "")),
+      codex: (model) => /^(?:gpt-|o\d|codex)[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || "")),
+      // Defense in depth: `task.model` is control-plane-controlled and lands in the
+      // cursor-agent argv. `() => true` accepted ANY string, including cmd
+      // metacharacters — which was the second half of the shell:true RCE in
+      // cursor-runner. Restrict to the shape a model id actually has so a payload
+      // like `x & powershell -enc ...` is rejected before it reaches a spawn.
+      cursor: (model) => /^[A-Za-z0-9][A-Za-z0-9._:@\[\]-]{0,79}$/.test(String(model || "")),
+      meta: (model) => /^muse-spark-[A-Za-z0-9._:@\[\]-]{0,79}$/i.test(String(model || ""))
     };
   }
 });
@@ -7551,9 +7798,9 @@ var init_classify_task = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/auto-router/effort-policy.mjs
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function difficultyToRung(difficulty, thresholds) {
   const b = thresholds.rungBounds;
   if (difficulty >= b.R5) return "R5";
@@ -7578,9 +7825,9 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path18 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
+function readCodexModelsCache({ path: path16 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync5 } = {}) {
   try {
-    const parsed = JSON.parse(read(path18, "utf8"));
+    const parsed = JSON.parse(read(path16, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
@@ -7630,23 +7877,148 @@ var init_effort_policy = __esm({
     init_meta_model_catalog();
     RUNG_ORDER = ["R1", "R2", "R3", "R4", "R5"];
     rungIndex = (rung) => RUNG_ORDER.indexOf(rung);
-    DEFAULT_CODEX_MODELS_CACHE = join6(homedir5(), ".codex", "models_cache.json");
+    DEFAULT_CODEX_MODELS_CACHE = join7(homedir5(), ".codex", "models_cache.json");
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/auto-router/role-cost-shadow.mjs
+function attributeRoleCosts({ plannerTokens, workerTokens, plannerModelRate, workerModelRate } = {}) {
+  const inputs = { plannerTokens, workerTokens, plannerModelRate, workerModelRate };
+  for (const [name, value] of Object.entries(inputs)) {
+    if (!isNonNegativeFinite(value)) {
+      return {
+        valid: false,
+        reason: `invalid ${name} (${String(value)}) \u2014 fail-open, no attribution`,
+        ...EMPTY_ATTRIBUTION
+      };
+    }
+  }
+  const plannerCostUsd = plannerTokens * plannerModelRate;
+  const workerCostUsd = workerTokens * workerModelRate;
+  const totalCostUsd = plannerCostUsd + workerCostUsd;
+  const totalTokens = plannerTokens + workerTokens;
+  const plannerCostShare = totalCostUsd > 0 ? plannerCostUsd / totalCostUsd : null;
+  const workerCostShare = totalCostUsd > 0 ? workerCostUsd / totalCostUsd : null;
+  const plannerTokenShare = totalTokens > 0 ? plannerTokens / totalTokens : null;
+  const workerTokenShare = totalTokens > 0 ? workerTokens / totalTokens : null;
+  const plannerCostShareRatio = plannerCostShare !== null && plannerTokenShare !== null && plannerTokenShare > 0 ? plannerCostShare / plannerTokenShare : null;
+  return {
+    valid: true,
+    plannerCostUsd,
+    workerCostUsd,
+    totalCostUsd,
+    plannerCostShare,
+    workerCostShare,
+    plannerTokenShare,
+    workerTokenShare,
+    plannerCostShareRatio
+  };
+}
+function shadowFanOutGate({ taskClass, disagreementSignal, confidence, panelSize } = {}, { thresholds } = {}) {
+  const cfg = { ...DEFAULT_SHADOW_FAN_OUT, ...thresholds?.shadowFanOut ?? {} };
+  const defaultsUsed = !thresholds?.shadowFanOut;
+  const no = (reason) => ({ wouldFanOut: false, reason, criterion: SHADOW_CRITERION, defaultsUsed });
+  if (!isUnitInterval(disagreementSignal)) {
+    return no(`invalid disagreementSignal (${String(disagreementSignal)}) \u2014 fail-open, single-model`);
+  }
+  if (!isUnitInterval(confidence)) {
+    return no(`invalid confidence (${String(confidence)}) \u2014 fail-open, single-model`);
+  }
+  const size = panelSize === void 0 || panelSize === null ? cfg.defaultPanelSize : panelSize;
+  if (!Number.isInteger(size) || size < 1) {
+    return no(`invalid panelSize (${String(panelSize)}) \u2014 fail-open, single-model`);
+  }
+  const never = Array.isArray(cfg.neverFanOutClasses) ? cfg.neverFanOutClasses : [];
+  if (typeof taskClass === "string" && never.includes(taskClass)) {
+    return no(`class=${taskClass} in neverFanOutClasses \u2014 fan-out never pays on low-stakes classes`);
+  }
+  if (size < cfg.minPanelSize) {
+    return no(`panelSize ${size} < ${cfg.minPanelSize} \u2014 too small to contribute independent signal`);
+  }
+  if (disagreementSignal < cfg.minDisagreementSignal) {
+    return no(`disagreement ${disagreementSignal} < ${cfg.minDisagreementSignal} \u2014 extra models would confirm, not inform`);
+  }
+  if (confidence > cfg.maxSingleModelConfidence) {
+    return no(`confidence ${confidence} > ${cfg.maxSingleModelConfidence} \u2014 single model already confident; fan-out adds cost, not signal`);
+  }
+  return {
+    wouldFanOut: true,
+    reason: `disagreement ${disagreementSignal} \u2265 ${cfg.minDisagreementSignal} AND confidence ${confidence} \u2264 ${cfg.maxSingleModelConfidence} (panel ${size})`,
+    criterion: SHADOW_CRITERION,
+    defaultsUsed
+  };
+}
+function buildShadowRecords({ decision, task = {}, thresholds, roleCostInputs = null } = {}) {
+  if (!decision || typeof decision !== "object") return [];
+  const base = {
+    shadow: true,
+    routerVersion: decision.routerVersion ?? null,
+    ts: decision.ts ?? null,
+    taskId: task?.id ?? null
+  };
+  const roleCost = roleCostInputs ? attributeRoleCosts(roleCostInputs) : { valid: false, reason: "planner/worker token telemetry unavailable at routing time", ...EMPTY_ATTRIBUTION };
+  const hasTaskSignal = typeof task?.disagreement_signal === "number";
+  const disagreementSignal = hasTaskSignal ? task.disagreement_signal : typeof decision.difficulty === "number" ? decision.difficulty / 100 : void 0;
+  const gate = shadowFanOutGate(
+    {
+      taskClass: decision.taskClass,
+      disagreementSignal,
+      confidence: decision.confidence,
+      panelSize: task?.panel_size
+    },
+    { thresholds }
+  );
+  return [
+    { kind: "shadow_role_cost", ...base, roleCost },
+    {
+      kind: "shadow_fan_out",
+      ...base,
+      disagreementSignal: disagreementSignal ?? null,
+      disagreementSource: hasTaskSignal ? "task.disagreement_signal" : "difficulty-proxy-v0",
+      ...gate
+    }
+  ];
+}
+var SHADOW_CRITERION, DEFAULT_SHADOW_FAN_OUT, isNonNegativeFinite, isUnitInterval, EMPTY_ATTRIBUTION;
+var init_role_cost_shadow = __esm({
+  "../../scripts/virtual-office/code-runner/auto-router/role-cost-shadow.mjs"() {
+    "use strict";
+    SHADOW_CRITERION = "info-bottleneck-v0";
+    DEFAULT_SHADOW_FAN_OUT = Object.freeze({
+      minDisagreementSignal: 0.4,
+      maxSingleModelConfidence: 0.6,
+      minPanelSize: 2,
+      defaultPanelSize: 3,
+      neverFanOutClasses: Object.freeze(["chore", "docs"])
+    });
+    isNonNegativeFinite = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
+    isUnitInterval = (n) => isNonNegativeFinite(n) && n <= 1;
+    EMPTY_ATTRIBUTION = Object.freeze({
+      plannerCostUsd: null,
+      workerCostUsd: null,
+      totalCostUsd: null,
+      plannerCostShare: null,
+      workerCostShare: null,
+      plannerTokenShare: null,
+      workerTokenShare: null,
+      plannerCostShareRatio: null
+    });
   }
 });
 
 // ../../scripts/virtual-office/code-runner/auto-router/auto-router.mjs
-import { readFileSync as readFileSync5, appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
+import { readFileSync as readFileSync6, appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join7, dirname as dirname4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { join as join8, dirname as dirname5 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
   const raw = String(env2.VO_CODE_RUNNER_AUTO_ROUTER || "").trim().toLowerCase();
   return MODES.has(raw) ? raw : "off";
 }
 function loadThresholds() {
   if (!cachedThresholds) {
-    const here = dirname4(fileURLToPath2(import.meta.url));
-    cachedThresholds = JSON.parse(readFileSync5(join7(here, "thresholds.json"), "utf8"));
+    const here = dirname5(fileURLToPath4(import.meta.url));
+    cachedThresholds = JSON.parse(readFileSync6(join8(here, "thresholds.json"), "utf8"));
   }
   return cachedThresholds;
 }
@@ -7712,16 +8084,36 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-var ROUTER_VERSION, DECISION_FALLBACK_PATH, MODES, cachedThresholds;
+function appendDecisionFallback(decision, { path: path16 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir3 = mkdirSync5, task, thresholds, roleCostInputs } = {}) {
+  try {
+    mkdir3(dirname5(path16), { recursive: true });
+    append(path16, `${JSON.stringify(decision)}
+`, "utf8");
+    if (isRouterDecision(decision)) {
+      try {
+        const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
+        for (const record of records) append(path16, `${JSON.stringify(record)}
+`, "utf8");
+      } catch {
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var ROUTER_VERSION, DECISION_FALLBACK_PATH, MODES, cachedThresholds, isRouterDecision;
 var init_auto_router = __esm({
   "../../scripts/virtual-office/code-runner/auto-router/auto-router.mjs"() {
     "use strict";
     init_classify_task();
     init_effort_policy();
+    init_role_cost_shadow();
     ROUTER_VERSION = "0.1.0";
-    DECISION_FALLBACK_PATH = join7(homedir6(), ".claude", "vo-auto-router-decisions.jsonl");
+    DECISION_FALLBACK_PATH = join8(homedir6(), ".claude", "vo-auto-router-decisions.jsonl");
     MODES = /* @__PURE__ */ new Set(["off", "shadow", "on"]);
     cachedThresholds = null;
+    isRouterDecision = (d) => Boolean(d && typeof d === "object" && typeof d.taskClass === "string" && typeof d.confidence === "number");
   }
 });
 
@@ -7753,7 +8145,7 @@ function resolveAgentEffort({ agent, tier, env: env2, applying, decision }) {
   }
   return applying ? decision.effort ?? null : null;
 }
-async function resolveEffortDispatch({ client, task, agent = "claude", env: env2, basePrompt, resolveModel = resolveTaskModel, route = routeTask }) {
+async function resolveEffortDispatch({ client, task, agent = "claude", env: env2, basePrompt, resolveModel = resolveTaskModel, route = routeTask, appendDecision = appendDecisionFallback }) {
   const dispatchMode = task.dispatch_mode ?? await client.getDispatchMode().catch(() => "standard");
   const effortConfig = resolveEffortMode(dispatchMode);
   const routerMode = getAutoRouterMode(env2);
@@ -7772,6 +8164,12 @@ async function resolveEffortDispatch({ client, task, agent = "claude", env: env2
     { agent }
   );
   const effort = resolveAgentEffort({ agent, tier, env: env2, applying, decision });
+  if (decision) {
+    try {
+      appendDecision(decision, { task });
+    } catch {
+    }
+  }
   return {
     dispatchMode,
     routerMode,
@@ -7851,7 +8249,7 @@ function makeReconnectBackoff({
   jitter = 0.2,
   log: log3 = () => {
   },
-  random = Math.random
+  random = secureUnitRandom
 } = {}) {
   let consecutiveFailures = 0;
   return {
@@ -7911,6 +8309,7 @@ function installProcessSafetyNet({ log: log3 = () => {
 var init_reconnect_backoff = __esm({
   "../../scripts/virtual-office/code-runner/reconnect-backoff.mjs"() {
     "use strict";
+    init_secure_random();
   }
 });
 
@@ -8025,7 +8424,7 @@ var init_agent_process_env = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs8 from "node:fs";
 import fsp9 from "node:fs/promises";
-import path16 from "node:path";
+import path14 from "node:path";
 async function defaultRun(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -8038,7 +8437,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path16.dirname(commonDir);
+  const root = path14.dirname(commonDir);
   return samePath2(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -8080,21 +8479,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path16.join(
-    path16.dirname(worktreeDir),
+  const quarantineDir = path14.join(
+    path14.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp9.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp9.writeFile(path16.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp9.writeFile(path14.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path16.join(baseline.root, relative);
-    const target = path16.join(quarantineDir, "untracked", relative);
-    await fsp9.mkdir(path16.dirname(target), { recursive: true });
+    const source = path14.join(baseline.root, relative);
+    const target = path14.join(quarantineDir, "untracked", relative);
+    await fsp9.mkdir(path14.dirname(target), { recursive: true });
     await fsp9.copyFile(source, target);
   }
-  await fsp9.writeFile(path16.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp9.writeFile(path14.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -8116,8 +8515,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path16.resolve(baseline.root, relative);
-    const prefix = `${path16.resolve(baseline.root)}${path16.sep}`;
+    const target = path14.resolve(baseline.root, relative);
+    const prefix = `${path14.resolve(baseline.root)}${path14.sep}`;
     if (!target.startsWith(prefix) || !fs8.existsSync(target)) continue;
     await fsp9.rm(target, { force: true });
   }
@@ -8154,7 +8553,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath2 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path16.resolve(value));
+      const [a, b] = [left, right].map((value) => path14.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -8163,7 +8562,7 @@ var init_isolation_audit = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs9 from "node:fs";
 import fsp10 from "node:fs/promises";
-import path17 from "node:path";
+import path15 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -8177,10 +8576,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path17.join(clonesRoot2, leaf);
+  const canonical = path15.join(clonesRoot2, leaf);
   return [
-    path17.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path17.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path15.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path15.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile4) {
@@ -8302,6 +8701,9 @@ var init_recovery_ledger = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs
+function defaultRunCommand3(cmd, args, cwd, opts = {}) {
+  return runProcess2(cmd, args, { cwd, ...opts });
+}
 function explicitTaskOutcome(summary) {
   const matches = [...String(summary || "").matchAll(/ALGOSUITE_TASK_OUTCOME\s*:\s*(NO_CHANGES|BLOCKED|FAILED)\b/gi)];
   return matches.at(-1)?.[1]?.toUpperCase() || "";
@@ -8339,16 +8741,78 @@ function decideNoChangesTerminalStatus({ partial, run = {}, maxTurns } = {}) {
       result: "inconclusive_max_turns"
     };
   }
+  const cause = String(run.summary || "").trim();
   return {
     status: "failed",
-    message: "agent made no file changes",
-    result: "no_changes"
+    message: cause ? `agent made no file changes \u2014 ${cause.slice(0, 200)}` : "agent made no file changes",
+    result: (cause || "no_changes").slice(0, RESULT_LIMIT)
   };
 }
+async function closeSupersededSourceOnNoChanges({
+  task,
+  run,
+  worktreeDir,
+  githubToken,
+  log: log3 = () => {
+  },
+  runCommand = defaultRunCommand3
+} = {}) {
+  const prNumber = supersededSourcePrNumber(task?.prompt);
+  if (!Number.isInteger(prNumber) || prNumber <= 0) return false;
+  const env2 = githubToken ? installationTokenEnv(githubToken) : void 0;
+  try {
+    const raw = await runCommand("gh", ["pr", "view", String(prNumber), "--json", "state"], worktreeDir, { env: env2, timeout: 6e4 });
+    if (JSON.parse(raw || "{}")?.state !== "OPEN") return false;
+    const evidence = String(run?.summary || "verified: no re-implementation needed").replace(/\s+/g, " ").slice(0, 600);
+    await runCommand(
+      "gh",
+      ["pr", "close", String(prNumber), "--comment", `Closing: AlgoHQ repair verified this PR's intent is already satisfied on current main \u2014 no re-implementation needed. Evidence: ${evidence}`],
+      worktreeDir,
+      { env: env2, timeout: 6e4 }
+    );
+    log3(`no-changes: closed superseded source PR #${prNumber} (intent already on main)`);
+    return true;
+  } catch (err) {
+    log3(`no-changes: close of superseded source PR #${prNumber} failed (left open): ${String(err?.message || err).slice(0, 200)}`);
+    return false;
+  }
+}
+async function finalizeNoChangesOutcome({
+  client,
+  id,
+  task,
+  partial,
+  run = {},
+  maxTurns,
+  worktreeDir,
+  githubToken,
+  safeProgress: safeProgress2,
+  log: log3 = () => {
+  },
+  runCommand = defaultRunCommand3
+} = {}) {
+  const numOrUndef2 = (x) => typeof x === "number" ? x : void 0;
+  const terminal = decideNoChangesTerminalStatus({ partial, run, maxTurns });
+  await safeProgress2(client, id, {
+    ...terminal,
+    cost_usd: numOrUndef2(run.costUsd),
+    num_turns: numOrUndef2(run.numTurns)
+  });
+  if (terminal.status === "no_changes_needed") {
+    log3(`task ${id}: agent completed successfully with no changes (already fixed)`);
+    await closeSupersededSourceOnNoChanges({ task, run, worktreeDir, githubToken, log: log3, runCommand });
+  } else if (!partial) {
+    log3(`task ${id}: agent reported a blocker with no changes; preserving failure honestly`);
+  }
+  return terminal;
+}
 var RESULT_LIMIT;
 var init_no_changes_terminal_status = __esm({
   "../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs"() {
     "use strict";
+    init_process_runner2();
+    init_publish();
+    init_superseded_pr_source();
     RESULT_LIMIT = 2e3;
   }
 });
@@ -8360,7 +8824,7 @@ __export(code_runner_daemon_exports, {
 });
 import os4 from "node:os";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function log2(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
@@ -8504,14 +8968,18 @@ async function processOneTask(client, task, cfg) {
       log2(`task ${id}: dropped ${scratch.length} scratch file(s): ${scratch.join(", ")}`);
     }
     if (files.length === 0) {
-      const terminal = decideNoChangesTerminalStatus({ partial, run, maxTurns: effectiveMaxTurns });
-      await safeProgress(client, id, {
-        ...terminal,
-        cost_usd: numOrUndef(run.costUsd),
-        num_turns: numOrUndef(run.numTurns)
+      await finalizeNoChangesOutcome({
+        client,
+        id,
+        task,
+        partial,
+        run,
+        maxTurns: effectiveMaxTurns,
+        worktreeDir: wt.worktreeDir,
+        githubToken,
+        safeProgress,
+        log: log2
       });
-      if (terminal.status === "no_changes_needed") log2(`task ${id}: agent completed successfully with no changes (already fixed)`);
-      else if (!partial) log2(`task ${id}: agent reported a blocker with no changes; preserving failure honestly`);
       return;
     }
     const fresh = await client.getTask(id).catch(() => null);
@@ -8718,7 +9186,7 @@ var init_code_runner_daemon = __esm({
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
     numOrUndef = (x) => typeof x === "number" ? x : void 0;
     safeProgress = makeSafeProgress(log2);
-    invokedDirectly = process.argv[1] && fileURLToPath3(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
+    invokedDirectly = process.argv[1] && fileURLToPath5(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
     import.meta.url.endsWith("code-runner-daemon.mjs");
     if (invokedDirectly) {
       const once2 = process.argv.includes("--once");