@algosuite/vo-mcp 0.2.0-beta.71 → 0.2.0-beta.72

package/dist/runner-cli.js

@@ -314,21 +314,21 @@ function backupConfigOnce(configPath) {
   copyFileSync(configPath, backupPath);
   return backupPath;
 }
-function writeFileAtomic(path23, content) {
-  sweepStaleTempFiles(path23);
-  const temp = `${path23}.vo-mcp-tmp-${process.pid}-${Date.now()}`;
+function writeFileAtomic(path24, content) {
+  sweepStaleTempFiles(path24);
+  const temp = `${path24}.vo-mcp-tmp-${process.pid}-${Date.now()}`;
   try {
     writeFileSync2(temp, content, { encoding: "utf8", mode: 384 });
-    if (existsSync3(path23)) {
+    if (existsSync3(path24)) {
       try {
-        chmodSync2(temp, statSync(path23).mode & 511);
+        chmodSync2(temp, statSync(path24).mode & 511);
       } catch {
       }
     }
     let lastErr = null;
     for (let attempt = 0; attempt < RENAME_RETRIES; attempt += 1) {
       try {
-        renameSync(temp, path23);
+        renameSync(temp, path24);
         return;
       } catch (err) {
         lastErr = err;
@@ -337,7 +337,7 @@ function writeFileAtomic(path23, content) {
         sleepSync(RENAME_RETRY_MS);
       }
     }
-    writeFileSync2(path23, content, "utf8");
+    writeFileSync2(path24, content, "utf8");
     try {
       unlinkSync2(temp);
     } catch {
@@ -503,8 +503,8 @@ function tablePath(line) {
 function tableSections(lines) {
   const starts = [];
   for (let index = 0; index < lines.length; index += 1) {
-    const path23 = tablePath(lines[index] ?? "");
-    if (path23) starts.push({ path: path23, start: index });
+    const path24 = tablePath(lines[index] ?? "");
+    if (path24) starts.push({ path: path24, start: index });
   }
   return starts.map((section, index) => ({
     ...section,
@@ -696,11 +696,11 @@ function resolveLinuxConfigHome(home, env2) {
   const configured = env2["XDG_CONFIG_HOME"]?.trim();
   return configured && isAbsolute2(configured) ? configured : join5(home, ".config");
 }
-function launcherIsCurrent(path23, desiredContent, label, log2) {
-  if (!existsSync6(path23)) return false;
-  if (readFileSync5(path23, "utf8") === desiredContent) return true;
-  const backupPath = `${path23}.backup-${Date.now()}`;
-  copyFileSync2(path23, backupPath);
+function launcherIsCurrent(path24, desiredContent, label, log2) {
+  if (!existsSync6(path24)) return false;
+  if (readFileSync5(path24, "utf8") === desiredContent) return true;
+  const backupPath = `${path24}.backup-${Date.now()}`;
+  copyFileSync2(path24, backupPath);
   log2(`  Backed up existing ${label} to: ${backupPath}`);
   return false;
 }
@@ -916,17 +916,17 @@ function resolveDesktopConfigPath(home, plat, appData) {
   }
   return join6(home, ".config", "Claude", "claude_desktop_config.json");
 }
-function readClaudeConfig(path23) {
-  if (!existsSync7(path23)) return { kind: "absent", config: {}, mtimeMs: null };
+function readClaudeConfig(path24) {
+  if (!existsSync7(path24)) return { kind: "absent", config: {}, mtimeMs: null };
   for (let attempt = 0; attempt < 3; attempt += 1) {
-    const before = statSync3(path23).mtimeMs;
+    const before = statSync3(path24).mtimeMs;
     let raw;
     try {
-      raw = readFileSync6(path23, "utf8");
+      raw = readFileSync6(path24, "utf8");
     } catch {
       return { kind: "invalid", config: {}, mtimeMs: before };
     }
-    if (!existsSync7(path23) || statSync3(path23).mtimeMs !== before) continue;
+    if (!existsSync7(path24) || statSync3(path24).mtimeMs !== before) continue;
     const text = raw.replace(/^\uFEFF/u, "");
     if (!text.trim()) return { kind: "empty", config: {}, mtimeMs: before };
     try {
@@ -938,9 +938,9 @@ function readClaudeConfig(path23) {
   }
   return { kind: "invalid", config: {}, mtimeMs: null };
 }
-function writeClaudeConfig(path23, config) {
-  mkdirSync6(dirname4(path23), { recursive: true });
-  writeFileAtomic(path23, `${JSON.stringify(config, null, 2)}
+function writeClaudeConfig(path24, config) {
+  mkdirSync6(dirname4(path24), { recursive: true });
+  writeFileAtomic(path24, `${JSON.stringify(config, null, 2)}
 `);
 }
 function carriedEntryKeys(entry) {
@@ -3879,13 +3879,13 @@ async function getTaskKnowledgeContextRequest(req, taskId, { query, knowledgeReq
   const canonicalQuery = canonicalizeKnowledgeContextQuery(query);
   if (canonicalQuery.trim()) body.query = canonicalQuery;
   if (typeof knowledgeRequestId === "string" && knowledgeRequestId) body.knowledge_request_id = knowledgeRequestId;
-  const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
+  const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
   const timeoutMs = Math.max(Number(taskRequestTimeoutMs) || 0, MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS);
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
     let res;
     let cause;
     try {
-      res = await req("POST", path23, body, { timeoutMs });
+      res = await req("POST", path24, body, { timeoutMs });
     } catch (err) {
       cause = err;
     }
@@ -3953,10 +3953,10 @@ async function getPreparedJobRequest(req, taskId, options = {}, invalidateToken
   if (typeof taskId !== "string" || taskId.length === 0) {
     return { ok: false, reason: "missing_task_id", status: 0, ...envMeta };
   }
-  const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
+  const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
   let res;
   try {
-    res = await req("GET", path23, void 0, { timeoutMs });
+    res = await req("GET", path24, void 0, { timeoutMs });
   } catch (err) {
     return { ok: false, reason: `transport: ${err?.message || String(err)}`, status: 0, ...envMeta };
   }
@@ -4056,11 +4056,11 @@ function createControlPlaneClient({
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
   const claimOccurrences = /* @__PURE__ */ new Map();
-  async function req(method, path23, body, { timeoutMs } = {}) {
+  async function req(method, path24, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path23}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path24}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -4073,7 +4073,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path23} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path24} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -4082,7 +4082,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path23, body, options = {}) => req(method, path23, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path24, body, options = {}) => req(method, path24, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   const claimGate = makeClaimGateNotice({ log: (m) => console.warn(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${m}`) });
   return {
     getClaimGate: () => claimGate.current(),
@@ -4253,8 +4253,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path23);
+      const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path24);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -4907,7 +4907,7 @@ function normalizeClaudePermissionMode(value) {
   }
   return normalized;
 }
-function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", env: env2 = process.env } = {}) {
+function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", structuredOutputSchema, env: env2 = process.env } = {}) {
   const effectivePermissionMode = normalizeClaudePermissionMode(permissionMode);
   if (!["default", "skill_readonly", "frozen_inputs_only"].includes(toolPolicy)) {
     throw new Error(`unsupported Claude tool policy "${toolPolicy}"`);
@@ -4945,6 +4945,12 @@ function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, m
       "none"
     );
   }
+  if (structuredOutputSchema !== void 0) {
+    if (!restrictedSkill || !structuredOutputSchema || typeof structuredOutputSchema !== "object" || Array.isArray(structuredOutputSchema)) {
+      throw new Error("structured output schema is allowed only for a restricted skill");
+    }
+    args.push("--json-schema", JSON.stringify(structuredOutputSchema));
+  }
   if (frozenInputsOnly) {
     args.push("--strict-mcp-config", "--safe-mode");
   }
@@ -5370,13 +5376,15 @@ function cappedRunLastMessage(evt, lastProgress) {
   return salvage;
 }
 function buildResultEvent(evt) {
-  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_turns" || evt.subtype === "error_during_execution";
+  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_budget_usd" || evt.subtype === "error_max_turns" || evt.subtype === "error_max_structured_output_retries" || evt.subtype === "error_during_execution";
   return {
     kind: "result",
     isError,
     costUsd: typeof evt.total_cost_usd === "number" ? evt.total_cost_usd : null,
     summary: typeof evt.result === "string" && evt.result.length > 0 ? evt.result : evt.subtype || (isError ? "error" : "completed"),
+    terminalSubtype: typeof evt.subtype === "string" ? evt.subtype : null,
     numTurns: typeof evt.num_turns === "number" ? evt.num_turns : null,
+    structuredOutput: Object.hasOwn(evt, "structured_output") ? evt.structured_output : null,
     tokenUsage: extractTokenUsage(evt),
     modelUsage: extractModelUsage(evt)
   };
@@ -5520,6 +5528,148 @@ var init_cli_version_floor = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/claude-skill-capability.mjs
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { accessSync, constants, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import path14 from "node:path";
+function hasOption(help, option) {
+  const literal = option.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return new RegExp(`(^|\\s)${literal}(?=\\s|,|=|<|$)`, "mu").test(help);
+}
+function assessClaudeSkillCapability({ versionOutput, helpOutput }) {
+  const version = parseCliVersion(versionOutput);
+  if (!version || !VALIDATED_CLAUDE_SKILL_VERSIONS.includes(version)) {
+    return { compatible: false, version, reason: "claude version is not in the validated restricted-skill manifest" };
+  }
+  const help = String(helpOutput ?? "");
+  const missing = REQUIRED_CLAUDE_SKILL_HELP.filter((option) => !hasOption(help, option));
+  if (missing.length > 0) {
+    return { compatible: false, version, reason: `claude help is missing required options: ${missing.join(", ")}` };
+  }
+  if (!/--permission-prompts[\s\S]{0,300}(?:"none"|\bnone\b)/mu.test(help) || !/--output-format[\s\S]{0,300}\bstream-json\b/mu.test(help)) {
+    return { compatible: false, version, reason: "claude help does not prove required none/stream-json values" };
+  }
+  return { compatible: true, version, reason: "validated restricted-skill CLI contract" };
+}
+function runProbe(bin, args, env2, timeoutMs = PROBE_TIMEOUT_MS) {
+  if (process.platform === "win32") {
+    try {
+      const launch = buildWindowsClaudeLaunch({ bin, args, env: env2 });
+      return spawnSync6(launch.bin, launch.args, {
+        ...launch.spawnOptions,
+        env: env2,
+        encoding: "utf8",
+        timeout: timeoutMs
+      });
+    } catch (error) {
+      return { status: null, stdout: "", stderr: "", error };
+    }
+  }
+  return spawnSync6(bin, args, { env: env2, encoding: "utf8", timeout: timeoutMs, windowsHide: true });
+}
+function probeText(probe) {
+  return `${String(probe?.stdout ?? "")}
+${String(probe?.stderr ?? "")}`.trim();
+}
+function resolveClaudeBinaryIdentity(bin = "claude", env2 = process.env) {
+  let resolvedBin = String(bin);
+  try {
+    if (process.platform === "win32") {
+      resolvedBin = buildWindowsClaudeLaunch({ bin: resolvedBin, args: [], env: env2 }).bin;
+    } else if (!path14.isAbsolute(resolvedBin)) {
+      const found = String(env2?.PATH ?? "").split(path14.delimiter).find((dir) => {
+        try {
+          accessSync(path14.join(dir, resolvedBin), constants.X_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+      if (found) resolvedBin = path14.join(found, resolvedBin);
+    }
+    const canonical = realpathSync2(resolvedBin);
+    const stat3 = statSync4(canonical);
+    return { resolvedBin: canonical, fingerprint: `${canonical}\0${stat3.size}\0${stat3.mtimeMs}` };
+  } catch {
+    const pathValue2 = String(env2?.PATH ?? env2?.Path ?? "");
+    return { resolvedBin, fingerprint: `${resolvedBin}\0${pathValue2}` };
+  }
+}
+function probeClaudeSkillCapability({
+  bin = "claude",
+  env: env2 = process.env,
+  versionOutput,
+  spawnProbe = runProbe,
+  now = () => Date.now(),
+  cacheTtlMs = CACHE_TTL_MS,
+  timeoutMs = PROBE_TIMEOUT_MS,
+  freshIdentity = false,
+  resolveIdentity = resolveClaudeBinaryIdentity
+} = {}) {
+  const identity = resolveIdentity(bin, env2);
+  const key = identity.fingerprint;
+  const existing = cache.get(key);
+  if (!freshIdentity && versionOutput === void 0 && existing && now() - existing.at < cacheTtlMs) {
+    return existing.value;
+  }
+  const versionProbe = freshIdentity || versionOutput === void 0 ? spawnProbe(identity.resolvedBin, ["--version"], env2, timeoutMs) : null;
+  if (versionProbe?.error || versionProbe && versionProbe.status !== 0) {
+    return {
+      compatible: false,
+      version: null,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude version capability probe failed"
+    };
+  }
+  const effectiveVersionOutput = versionProbe ? probeText(versionProbe) : versionOutput;
+  const suppliedVersion = parseCliVersion(effectiveVersionOutput);
+  if (existing && now() - existing.at < cacheTtlMs && suppliedVersion === existing.value.version) {
+    return existing.value;
+  }
+  const helpProbe = spawnProbe(identity.resolvedBin, ["--help"], env2, timeoutMs);
+  if (helpProbe?.error || helpProbe?.status !== 0) {
+    return {
+      compatible: false,
+      version: suppliedVersion,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude help capability probe failed"
+    };
+  }
+  const assessed = assessClaudeSkillCapability({
+    versionOutput: effectiveVersionOutput,
+    helpOutput: probeText(helpProbe)
+  });
+  const value = { ...assessed, resolvedBin: identity.resolvedBin };
+  cache.set(key, { at: now(), value });
+  return value;
+}
+var VALIDATED_CLAUDE_SKILL_VERSIONS, REQUIRED_CLAUDE_SKILL_HELP, PROBE_TIMEOUT_MS, CACHE_TTL_MS, cache;
+var init_claude_skill_capability = __esm({
+  "../../scripts/virtual-office/code-runner/claude-skill-capability.mjs"() {
+    "use strict";
+    init_cli_version_floor();
+    init_windows_claude_launch();
+    VALIDATED_CLAUDE_SKILL_VERSIONS = Object.freeze(["2.1.263"]);
+    REQUIRED_CLAUDE_SKILL_HELP = Object.freeze([
+      "--allowedTools",
+      "--disable-slash-commands",
+      "--json-schema",
+      "--max-budget-usd",
+      "--no-chrome",
+      "--no-session-persistence",
+      "--output-format",
+      "--permission-mode",
+      "--permission-prompts",
+      "--safe-mode",
+      "--strict-mcp-config",
+      "--tools"
+    ]);
+    PROBE_TIMEOUT_MS = 2e3;
+    CACHE_TTL_MS = 5 * 60 * 1e3;
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/claude-auth-check.mjs
 function errorCode(error) {
   return String(error?.code || "").toUpperCase();
@@ -5546,9 +5696,12 @@ async function checkClaudeAuth({
   spawnVersion = spawnClaudeSync,
   probeLogin = probeClaudeLoginState,
   getStoredKey = getAnthropicKey,
-  env: env2 = process.env
+  probeSkillCapability = probeClaudeSkillCapability,
+  env: env2 = process.env,
+  now = () => Date.now()
 } = {}) {
   try {
+    const startedAt = now();
     let probe = spawnVersion(["--version"], {
       timeout: FIRST_VERSION_TIMEOUT_MS,
       encoding: "utf8",
@@ -5582,23 +5735,40 @@ async function checkClaudeAuth({
     }
     const floorGate = applyCliVersionFloor({ versionOutput: probe.stdout, env: env2 });
     if (floorGate.refused) {
-      return { installed: true, authenticated: false, message: floorGate.message };
+      return {
+        installed: true,
+        authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
+        message: floorGate.message
+      };
     }
     const loggedIn = retriedAfterTimeout ? null : probeLogin();
     if (loggedIn === false) {
       return {
         installed: true,
         authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
         message: "claude CLI is installed but NOT logged in \u2014 its login is SEPARATE from the Claude Desktop app and the Claude Code IDE extension. Run: claude auth login (Claude subscription), then restart the runner."
       };
     }
+    const authTier = resolveClaudeAuthTier({ env: env2, loggedIn, getStoredKey });
+    const remainingMs = AUTH_PROBE_BUDGET_MS - (now() - startedAt);
+    const skillCapability = loggedIn === true && remainingMs >= MIN_SKILL_PROBE_MS ? probeSkillCapability({
+      versionOutput: probe.stdout,
+      env: env2,
+      timeoutMs: Math.min(2e3, remainingMs)
+    }) : { compatible: false };
     return {
       installed: true,
       authenticated: true,
+      version: floorGate.check.version ?? void 0,
+      skillCapable: skillCapability.compatible === true,
       // Dispatch-time billing signal, carried on the same probe that already
       // paid for the login read. Never sent for a non-authenticated result:
       // there is no tier without a working credential.
-      authTier: resolveClaudeAuthTier({ env: env2, loggedIn, getStoredKey }),
+      authTier,
       message: loggedIn === true ? "claude CLI installed and logged in (claude auth status)" : "claude binary found (login state unknown \u2014 auth check is best-effort)"
     };
   } catch (error) {
@@ -5609,7 +5779,7 @@ async function checkClaudeAuth({
     };
   }
 }
-var FIRST_VERSION_TIMEOUT_MS, RETRY_VERSION_TIMEOUT_MS;
+var FIRST_VERSION_TIMEOUT_MS, RETRY_VERSION_TIMEOUT_MS, AUTH_PROBE_BUDGET_MS, MIN_SKILL_PROBE_MS;
 var init_claude_auth_check = __esm({
   "../../scripts/virtual-office/code-runner/claude-auth-check.mjs"() {
     "use strict";
@@ -5617,8 +5787,11 @@ var init_claude_auth_check = __esm({
     init_agent_auth_tier();
     init_cli_version_floor();
     init_windows_claude_launch();
+    init_claude_skill_capability();
     FIRST_VERSION_TIMEOUT_MS = 4500;
     RETRY_VERSION_TIMEOUT_MS = 2e3;
+    AUTH_PROBE_BUDGET_MS = 9500;
+    MIN_SKILL_PROBE_MS = 250;
   }
 });
 
@@ -5639,6 +5812,7 @@ function runAgentTask({
   maxBudgetUsd = null,
   researchHarness = false,
   toolPolicy = "default",
+  structuredOutputSchema,
   env: env2 = process.env,
   onProgress = () => {
   },
@@ -5656,7 +5830,7 @@ function runAgentTask({
   sandbox = null
 }) {
   return new Promise((resolve3) => {
-    const args = runner.buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, prompt });
+    const args = runner.buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema, prompt });
     const spawnEnv = typeof runner.applyAuthEnv === "function" ? runner.applyAuthEnv(env2) : env2;
     const costBasis = typeof runner.costBasis === "function" ? runner.costBasis(spawnEnv) : "unknown";
     if (costBasis === "vendor_billed" && runner.enforcesBudgetCap !== true && env2.VO_CODE_RUNNER_ALLOW_UNCAPPED_VENDOR_BILLED !== "1") {
@@ -5701,7 +5875,7 @@ function runAgentTask({
     } catch {
     }
     let buffer = "";
-    let result = { ok: false, costUsd: null, costBasis, summary: "", lastAgentMessage: null, numTurns: null, tokenUsage: null, modelUsage: null, executionStarted: false, killed: false };
+    let result = { ok: false, costUsd: null, costBasis, summary: "", lastAgentMessage: null, structuredOutput: null, terminalSubtype: null, numTurns: null, tokenUsage: null, modelUsage: null, executionStarted: false, killed: false };
     child.once("spawn", () => {
       result = { ...result, executionStarted: true };
       Promise.resolve(onSpawn()).catch(() => {
@@ -5739,6 +5913,8 @@ function runAgentTask({
         // A budget/turn-capped run's honest last message, kept OUT of summary (see
         // claude-result-event.cappedRunLastMessage) and surfaced in the PR body.
         lastAgentMessage: cappedRunLastMessage(evt, lastProgress),
+        structuredOutput: Object.hasOwn(evt, "structuredOutput") ? evt.structuredOutput : result.structuredOutput,
+        terminalSubtype: Object.hasOwn(evt, "terminalSubtype") ? evt.terminalSubtype : result.terminalSubtype,
         numTurns: evt.numTurns,
         // MUST be listed explicitly. This assignment spreads the PREVIOUS
         // result and then names each field it carries forward, so anything
@@ -5820,7 +5996,9 @@ function runAgentTask({
         hardKill();
         return;
       }
-      if (decision.delayMs != null) wallTimer = setTimeout(armDeadline, decision.delayMs);
+      if (decision.delayMs !== null && decision.delayMs !== void 0) {
+        wallTimer = setTimeout(armDeadline, decision.delayMs);
+      }
     };
     armDeadline();
     child.stdout.on("data", (chunk) => {
@@ -5881,6 +6059,7 @@ var init_claude_runner = __esm({
     init_claude_stream_event();
     init_claude_result_event();
     init_claude_auth_check();
+    init_claude_skill_capability();
     ClaudeRunner = class {
       get enforcesBudgetCap() {
         return true;
@@ -5888,8 +6067,8 @@ var init_claude_runner = __esm({
       get binary() {
         return "claude";
       }
-      buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy } = {}) {
-        return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy });
+      buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema } = {}) {
+        return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema });
       }
       parseEvent(line) {
         return parseStreamEvent(line);
@@ -5913,6 +6092,9 @@ var init_claude_runner = __esm({
       async checkAuth() {
         return checkClaudeAuth();
       }
+      checkSkillCapability({ bin = this.binary, env: env2 = process.env } = {}) {
+        return probeClaudeSkillCapability({ bin, env: env2, freshIdentity: true });
+      }
     };
     claudeRunner = new ClaudeRunner();
   }
@@ -6096,7 +6278,7 @@ var init_error_message = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/codex-runner.mjs
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { existsSync as existsSync10 } from "node:fs";
 import { win32 as win322 } from "node:path";
 function isTruthyFlag2(value) {
@@ -6211,7 +6393,7 @@ var init_codex_runner = __esm({
     CODEX_PREFER_LOGIN_ENV = "VO_RUNNER_CODEX_PREFER_LOGIN";
     LEGACY_PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
     CodexRunner = class {
-      constructor({ spawn: spawn5 = spawnSync6, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
+      constructor({ spawn: spawn5 = spawnSync7, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
         this.spawn = spawn5;
         this.resolveBinary = resolveBinary;
         this.env = env2;
@@ -6324,7 +6506,7 @@ ${login.stderr || ""}`.trim();
 });
 
 // ../../scripts/virtual-office/code-runner/cursor-runner.mjs
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 function buildCursorArgs({ model, prompt } = {}) {
   const args = ["-p", "--output-format", "stream-json", "--force"];
   if (model) {
@@ -6436,7 +6618,7 @@ var init_cursor_runner = __esm({
       /** Best-effort: is `cursor-agent` on PATH? Never throws. */
       async checkAuth() {
         try {
-          const { status, error } = spawnSync7("cursor-agent", ["--version"], {
+          const { status, error } = spawnSync8("cursor-agent", ["--version"], {
             shell: false,
             windowsHide: true,
             timeout: 3e3,
@@ -7155,9 +7337,9 @@ var init_rate_limit_detector_core = __esm({
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-state.mjs
 import fsp10 from "node:fs/promises";
-import path14 from "node:path";
+import path15 from "node:path";
 async function atomicWrite(file, content) {
-  await fsp10.mkdir(path14.dirname(file), { recursive: true });
+  await fsp10.mkdir(path15.dirname(file), { recursive: true });
   const temp = `${file}.tmp-${process.pid}-${Date.now()}`;
   const handle = await fsp10.open(temp, "wx");
   try {
@@ -7218,7 +7400,7 @@ function writeResumeAttempts(file, store) {
 }
 async function acquireLock(lockFile, { now = Date.now, sleep: sleep3 = delay } = {}) {
   const deadline = now() + LOCK_WAIT_MS;
-  await fsp10.mkdir(path14.dirname(lockFile), { recursive: true });
+  await fsp10.mkdir(path15.dirname(lockFile), { recursive: true });
   for (; ; ) {
     let handle;
     try {
@@ -7522,7 +7704,7 @@ var init_auto_merge = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
 import { dirname as dirname6, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -7688,14 +7870,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const token2 = tokens[i];
     if (!token2) continue;
-    const path23 = token2.slice(3);
-    if (path23) files.push(path23);
+    const path24 = token2.slice(3);
+    if (path24) files.push(path24);
     if (token2[0] === "R" || token2[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path23) {
-  const normalized = String(path23 || "");
+function isAgentScratch(path24) {
+  const normalized = String(path24 || "");
   return SCRATCH_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 var SCRATCH_PATTERNS;
@@ -7713,7 +7895,7 @@ var init_publish_file_state = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/publish.mjs
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function isMaxTurnsResult(summary) {
   return /(^|[^a-z])error[-_ ]?max[-_ ]?turns([^a-z]|$)|max[-_ ]?turns/i.test(String(summary || ""));
 }
@@ -7952,7 +8134,7 @@ var init_executor = __esm({
 
 // ../../scripts/virtual-office/code-runner/test-gen-gate.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 async function postFailed(client, id, message, result) {
   try {
     await client.postProgress(id, {
@@ -7988,7 +8170,7 @@ async function gateTestGenTaskOrFail({ client, id, task, files, worktreeDir, env
   }
   let testSource = "";
   try {
-    testSource = fs7.readFileSync(path15.join(worktreeDir, testFile), "utf8");
+    testSource = fs7.readFileSync(path16.join(worktreeDir, testFile), "utf8");
   } catch (err) {
     await postFailed(client, id, `could not read generated test ${testFile}: ${err.message}`, "gate_test_unreadable");
     return true;
@@ -8038,7 +8220,7 @@ var init_test_gen_gate = __esm({
 // ../../scripts/virtual-office/code-runner/completion-gate.mjs
 import { execFile } from "node:child_process";
 import fs8 from "node:fs";
-import path16 from "node:path";
+import path17 from "node:path";
 function resolveCompletionGate(task) {
   const raw = task?.completion_gate;
   if (raw === void 0 || raw === null) return null;
@@ -8076,14 +8258,14 @@ function workspaceFingerprint(worktreeDir, execFileImpl = execFile) {
 }
 function readState(worktreeDir) {
   try {
-    return JSON.parse(fs8.readFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
+    return JSON.parse(fs8.readFileSync(path17.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
   } catch {
     return null;
   }
 }
 function writeState(worktreeDir, state) {
   try {
-    fs8.writeFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
+    fs8.writeFileSync(path17.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
 `, "utf8");
   } catch {
   }
@@ -9221,7 +9403,7 @@ var init_headless_execution_contract = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
-import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync5 } from "node:fs";
 import { dirname as dirname7, join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
@@ -9243,12 +9425,12 @@ function parseFrontmatterNameDescription(raw) {
 }
 function isRepoCheckout(dir) {
   try {
-    if (!statSync4(join10(dir, ".claude", "skills")).isDirectory()) return false;
+    if (!statSync5(join10(dir, ".claude", "skills")).isDirectory()) return false;
   } catch {
     return false;
   }
   try {
-    statSync4(join10(dir, ".git"));
+    statSync5(join10(dir, ".git"));
     return true;
   } catch {
     return false;
@@ -9274,7 +9456,7 @@ function loadSkillCatalog({ repoRoot: repoRoot2 = resolveDefaultRepoRoot() } = {
     for (const entry of readdirSync3(skillsDir)) {
       const dir = join10(skillsDir, entry);
       try {
-        if (!statSync4(dir).isDirectory()) continue;
+        if (!statSync5(dir).isDirectory()) continue;
         const parsed = parseFrontmatterNameDescription(
           readFileSync8(join10(dir, "SKILL.md"), "utf8")
         );
@@ -9804,7 +9986,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path17 from "node:path";
+import path18 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -9817,9 +9999,9 @@ function hasGeneratedPrefix(name) {
   return name.startsWith(DIRECTORY_PREFIX) || name.startsWith(LEGACY_DIRECTORY_PREFIX);
 }
 function assertGeneratedDirectory(directory, containmentRoot) {
-  const resolvedDirectory = path17.resolve(directory);
-  const resolvedRoot = path17.resolve(containmentRoot);
-  if (path17.dirname(resolvedDirectory) !== resolvedRoot || !hasGeneratedPrefix(path17.basename(resolvedDirectory))) {
+  const resolvedDirectory = path18.resolve(directory);
+  const resolvedRoot = path18.resolve(containmentRoot);
+  if (path18.dirname(resolvedDirectory) !== resolvedRoot || !hasGeneratedPrefix(path18.basename(resolvedDirectory))) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
@@ -9828,7 +10010,7 @@ async function resolveContainmentRoot(worktreeDir) {
   if (typeof worktreeDir !== "string" || !worktreeDir.trim()) {
     throw new Error("refusing to materialize task attachments outside an agent-readable worktree: no worktreeDir given");
   }
-  const root = path17.resolve(worktreeDir);
+  const root = path18.resolve(worktreeDir);
   const stats = await stat(root).catch(() => null);
   if (!stats?.isDirectory()) {
     throw new Error(`refusing to materialize task attachments: agent worktree root is not a directory (${root})`);
@@ -9837,15 +10019,15 @@ async function resolveContainmentRoot(worktreeDir) {
 }
 async function createAttachmentDirectory(taskId, containmentRoot) {
   const root = await resolveContainmentRoot(containmentRoot);
-  const directory = await mkdtemp(path17.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const directory = await mkdtemp(path18.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
   const [realRoot, realDirectory] = await Promise.all([realpath(root), realpath(directory)]);
-  if (path17.dirname(realDirectory) !== realRoot) {
+  if (path18.dirname(realDirectory) !== realRoot) {
     await rm(directory, { recursive: true, force: true }).catch(() => void 0);
     throw new Error("task-attachment directory escaped the agent worktree root");
   }
-  await writeFile(path17.join(directory, GITIGNORE_FILE), GITIGNORE_BODY, { encoding: "utf8", mode: 384 });
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID4(), directory: path17.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path17.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  await writeFile(path18.join(directory, GITIGNORE_FILE), GITIGNORE_BODY, { encoding: "utf8", mode: 384 });
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID4(), directory: path18.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path18.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, root, cleaned: false };
 }
 async function cleanupGeneratedDirectory(state) {
@@ -9859,7 +10041,7 @@ async function cleanupGeneratedDirectory(state) {
     state.cleaned = true;
     return;
   }
-  const marker = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path18.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -9878,7 +10060,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path17.resolve(tempRoot);
+  const root = path18.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -9887,8 +10069,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !hasGeneratedPrefix(entry.name)) continue;
-    const directory = assertGeneratedDirectory(path17.join(root, entry.name), root);
-    const markerRaw = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path18.join(root, entry.name), root);
+    const markerRaw = await readFile(path18.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -9945,8 +10127,8 @@ async function materializeTaskAttachments(client, task, { worktreeDir } = {}) {
       const sha2562 = createHash5("sha256").update(content).digest("hex");
       if (sha2562 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path17.resolve(state.directory, name);
-      if (path17.dirname(filePath) !== state.directory) throw new Error(`attachment ${ref.attachment_id} resolved outside its task directory`);
+      const filePath = path18.resolve(state.directory, name);
+      if (path18.dirname(filePath) !== state.directory) throw new Error(`attachment ${ref.attachment_id} resolved outside its task directory`);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
       files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256: sha2562, path: filePath });
@@ -10031,9 +10213,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path23) {
+async function readCloudMap(path24) {
   try {
-    return JSON.parse(await readFile2(path23, "utf8"));
+    return JSON.parse(await readFile2(path24, "utf8"));
   } catch {
     return {};
   }
@@ -10334,9 +10516,9 @@ function backoffMs(streak, baseMs) {
   if (streak <= 0) return 0;
   return Math.min(baseMs * 2 ** Math.min(streak - 1, 20), MAX_BACKOFF_MS);
 }
-async function loadState(path23) {
+async function loadState(path24) {
   try {
-    const parsed = JSON.parse(await readFile3(path23, "utf8"));
+    const parsed = JSON.parse(await readFile3(path24, "utf8"));
     if (parsed && typeof parsed === "object" && Number.isInteger(parsed.byte_offset) && parsed.byte_offset >= 0) {
       return { ...parsed, byte_offset: parsed.byte_offset };
     }
@@ -10344,15 +10526,15 @@ async function loadState(path23) {
   }
   return { byte_offset: 0, last_event_id: null, forwarded_total: 0, rejected_total: 0, rejected_event_ids: [] };
 }
-async function saveState(path23, state) {
-  await mkdir2(dirname9(path23), { recursive: true });
-  await writeFile3(path23, JSON.stringify(state, null, 2), "utf8");
+async function saveState(path24, state) {
+  await mkdir2(dirname9(path24), { recursive: true });
+  await writeFile3(path24, JSON.stringify(state, null, 2), "utf8");
 }
-async function readNewBytes(path23, offset, max) {
-  const st = await stat2(path23);
+async function readNewBytes(path24, offset, max) {
+  const st = await stat2(path24);
   if (st.size <= offset) return { buf: Buffer.alloc(0), size: st.size };
   const length = Math.min(st.size - offset, max);
-  const fh = await open(path23, "r");
+  const fh = await open(path24, "r");
   try {
     const buf = Buffer.alloc(length);
     const { bytesRead } = await fh.read(buf, 0, length, offset);
@@ -10603,6 +10785,10 @@ var init_telemetry_forwarder = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/loop-ticks.mjs
+function supportedTaskKindsFor(availableAgents) {
+  const claude = Array.isArray(availableAgents) ? availableAgents.find((row) => row?.agent === "claude") : null;
+  return claude?.installed === true && claude.authenticated === true && claude.skill_capable === true ? RUNNER_SUPPORTED_TASK_KINDS : RUNNER_SUPPORTED_TASK_KINDS.filter((kind) => kind !== "skill");
+}
 function makeLoopTicks({
   client,
   cfg,
@@ -10739,7 +10925,7 @@ function makeLoopTicks({
         uptimeSec: Math.floor(process.uptime()),
         activeTasks: getActive(),
         maxConcurrency: cfg.maxConcurrency,
-        supportedTaskKinds: RUNNER_SUPPORTED_TASK_KINDS,
+        supportedTaskKinds: supportedTaskKindsFor(availableAgents),
         ...capacityFields,
         ...localModelFields,
         ...preparedJobFields
@@ -10899,7 +11085,7 @@ function resolveAgentClaimContext(provider, defaultAgent) {
 async function collectAgentAvailability({
   agents = listAgents(),
   runnerFor,
-  probeTimeoutMs = PROBE_TIMEOUT_MS
+  probeTimeoutMs = PROBE_TIMEOUT_MS2
 } = {}) {
   const probes = agents.map(async (agent) => {
     const degraded = { agent, installed: false, authenticated: false };
@@ -10917,6 +11103,7 @@ async function collectAgentAvailability({
         installed,
         authenticated,
         ...typeof r?.version === "string" && r.version ? { version: r.version } : {},
+        ...typeof r?.skillCapable === "boolean" ? { skill_capable: r.skillCapable } : {},
         // Omitted when unknown, which is what an older daemon's silence already
         // means — the control-plane schema resolves BOTH to 'unknown'. Never
         // invent a tier to fill the gap.
@@ -10977,7 +11164,7 @@ function makeAgentAvailabilityProvider({
     }
   };
 }
-var DEFAULT_TTL_MS, PROBE_TIMEOUT_MS;
+var DEFAULT_TTL_MS, PROBE_TIMEOUT_MS2;
 var init_agent_availability = __esm({
   "../../scripts/virtual-office/code-runner/agent-availability.mjs"() {
     "use strict";
@@ -10985,7 +11172,7 @@ var init_agent_availability = __esm({
     init_agent_auth_probe_process();
     init_agent_auth_tier();
     DEFAULT_TTL_MS = 5 * 60 * 1e3;
-    PROBE_TIMEOUT_MS = 1e4;
+    PROBE_TIMEOUT_MS2 = 1e4;
   }
 });
 
@@ -11447,10 +11634,10 @@ function formatShadowLogLine(record) {
   const loud = record.unexplained_fields?.length ? "!! " : "";
   return `${loud}[prepared-job-shadow] ${parts.join(" ")}`;
 }
-function appendShadowRecord(record, { path: path23 = PREPARED_JOB_SHADOW_SINK, append = appendFileSync, mkdir: mkdir5 = mkdirSync8 } = {}) {
+function appendShadowRecord(record, { path: path24 = PREPARED_JOB_SHADOW_SINK, append = appendFileSync, mkdir: mkdir5 = mkdirSync8 } = {}) {
   try {
-    mkdir5(dirname10(path23), { recursive: true });
-    append(path23, `${JSON.stringify(record)}
+    mkdir5(dirname10(path24), { recursive: true });
+    append(path24, `${JSON.stringify(record)}
 `, "utf8");
     return true;
   } catch {
@@ -11770,7 +11957,7 @@ var init_shared = __esm({
 // ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
 import fs10 from "node:fs";
 import os3 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 function fileCaptureTime(filePath, explicit, statFn) {
   if (typeof explicit === "string" && explicit) return explicit;
   try {
@@ -11784,7 +11971,7 @@ function usageBaseUrl(env2 = process.env) {
   return String(raw).replace(/\/+$/, "");
 }
 function readOAuthToken({ homeDir = os3.homedir(), read = readJson2, now = Date.now() } = {}) {
-  const creds = read(path18.join(homeDir, ".claude", ".credentials.json"));
+  const creds = read(path19.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
   const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
@@ -11794,7 +11981,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson2, now = Date.
   return token2;
 }
 function readAccountId({ homeDir = os3.homedir(), read = readJson2 } = {}) {
-  const cfg = read(path18.join(homeDir, ".claude.json"));
+  const cfg = read(path19.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
 }
@@ -11904,7 +12091,7 @@ function readClaudeFileUsage({
     if (age === null || age > MAX_FILE_AGE_MS) return null;
     return row;
   };
-  const statusPath = path18.join(homeDir, ".claude", "claude-usage.json");
+  const statusPath = path19.join(homeDir, ".claude", "claude-usage.json");
   const status = read(statusPath);
   if (status && (status.seven_day || status.five_hour)) {
     const row = fresh(makeUsageRow({
@@ -11919,7 +12106,7 @@ function readClaudeFileUsage({
     }));
     if (row) return row;
   }
-  const weeklyPath = path18.join(homeDir, ".claude", "claude-weekly-usage.json");
+  const weeklyPath = path19.join(homeDir, ".claude", "claude-weekly-usage.json");
   const weekly = read(weeklyPath);
   if (weekly) {
     const row = fresh(makeUsageRow({
@@ -12733,11 +12920,11 @@ var init_watcher_adoption = __esm({
 // ../../scripts/virtual-office/code-runner/watcher-github-token.mjs
 function makeWatcherTokenProvider(client, { required = true, allowAmbient = false, now = () => Date.now(), log: log2 = () => {
 } } = {}) {
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let ciUnreadableLoggedAt = null;
   return async (repo) => {
     const key = String(repo).toLowerCase();
-    const prior = cache.get(key);
+    const prior = cache2.get(key);
     if (prior && now() - prior.at < 45 * 60 * 1e3) return prior.token;
     const result = await client.getInstallationToken({ required, readOnly: true, repo });
     if (!result?.token) {
@@ -12748,7 +12935,7 @@ function makeWatcherTokenProvider(client, { required = true, allowAmbient = fals
       ciUnreadableLoggedAt = now();
       log2(`watch: the plane minted a read token for ${repo} WITHOUT CI read (ci_readable=false \u2014 the GitHub App installation has not accepted checks:read/statuses:read); PR CI stays unreadable until the operator accepts the App permission update`);
     }
-    cache.set(key, { token: result.token, at: now() });
+    cache2.set(key, { token: result.token, at: now() });
     return result.token;
   };
 }
@@ -12914,7 +13101,7 @@ function noteCiViaRest(log2) {
   log2("watch: CI status read via REST check-runs/status (gh's GraphQL rollup needs actions:read for checkSuite.workflowRun, which the read scope does not carry)");
 }
 async function readCommitCiViaRest(repo, sha, { run, env: env2 }) {
-  const api = async (path23) => JSON.parse(await run("gh", ["api", path23], { timeout: 3e4, env: env2 }) || "{}");
+  const api = async (path24) => JSON.parse(await run("gh", ["api", path24], { timeout: 3e4, env: env2 }) || "{}");
   const rollup = [];
   let total = null;
   for (let page = 1; page <= REST_MAX_PAGES && (total === null || rollup.length < total); page += 1) {
@@ -13578,9 +13765,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path23 = String(req.url || "").split("?")[0];
+    const path24 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path23 === "/status") {
+    if (req.method === "GET" && path24 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -13591,7 +13778,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path23 === "/stop") {
+    if (req.method === "POST" && path24 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -13785,22 +13972,22 @@ var init_effort_mode_config = __esm({
 import { randomUUID as randomUUID7 } from "node:crypto";
 import fs11 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
+import path20 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function userCacheRoot() {
   try {
     const home = os4.homedir();
-    if (home) return path19.join(home, ".claude");
+    if (home) return path20.join(home, ".claude");
   } catch {
   }
-  return path19.join(os4.tmpdir(), `vo-model-registry-${randomUUID7()}`);
+  return path20.join(os4.tmpdir(), `vo-model-registry-${randomUUID7()}`);
 }
 function resolveCacheBaseDir(env2 = process.env, moduleDir = __dirname) {
   if (env2.VO_MODEL_REGISTRY_CACHE_DIR) return env2.VO_MODEL_REGISTRY_CACHE_DIR;
   if (env2.VO_RUNNER_RUNTIME_ROOT) return env2.VO_RUNNER_RUNTIME_ROOT;
-  const segments = moduleDir.split(path19.sep);
+  const segments = moduleDir.split(path20.sep);
   const isRepoCheckout2 = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
-  return isRepoCheckout2 ? path19.resolve(moduleDir, "..", "..") : userCacheRoot();
+  return isRepoCheckout2 ? path20.resolve(moduleDir, "..", "..") : userCacheRoot();
 }
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -13923,7 +14110,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs11.mkdirSync(path19.dirname(cacheFile), { recursive: true });
+  fs11.mkdirSync(path20.dirname(cacheFile), { recursive: true });
   fs11.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -13981,13 +14168,13 @@ var __dirname, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANTHROPIC
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path19.dirname(fileURLToPath6(import.meta.url));
-    DEFAULT_CACHE_DIR = path19.join(
+    __dirname = path20.dirname(fileURLToPath6(import.meta.url));
+    DEFAULT_CACHE_DIR = path20.join(
       resolveCacheBaseDir(),
       ".virtual-office-cache",
       "model-registry"
     );
-    DEFAULT_CACHE_FILE = path19.join(DEFAULT_CACHE_DIR, "catalog.json");
+    DEFAULT_CACHE_FILE = path20.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -14626,18 +14813,18 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path23 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync9 } = {}) {
+function readCodexModelsCache({ path: path24 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync9 } = {}) {
   try {
-    const parsed = JSON.parse(read(path23, "utf8"));
+    const parsed = JSON.parse(read(path24, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
   }
 }
-function clampCodexEffort(effort, cache) {
+function clampCodexEffort(effort, cache2) {
   if (!effort) return { effort: null, degraded: false };
   const supported = /* @__PURE__ */ new Set();
-  for (const model of cache?.models || []) {
+  for (const model of cache2?.models || []) {
     if (model?.visibility === "hide") continue;
     for (const lvl of model?.supported_reasoning_levels || []) {
       if (lvl?.effort) supported.add(lvl.effort);
@@ -14885,15 +15072,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path23 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir5 = mkdirSync9, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path24 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir5 = mkdirSync9, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir5(dirname12(path23), { recursive: true });
-    append(path23, `${JSON.stringify(decision)}
+    mkdir5(dirname12(path24), { recursive: true });
+    append(path24, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path23, `${JSON.stringify(record)}
+        for (const record of records) append(path24, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -16215,6 +16402,53 @@ var init_terminal_delivery = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/skill-result-json-schema.mjs
+function buildSkillResultJsonSchema({ expectedSkill, producedByAgent }) {
+  return {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      schema_version: { const: 1 },
+      skill: { const: expectedSkill },
+      outcome: { enum: ["findings", "no_findings", "refused"] },
+      findings: {
+        type: "array",
+        maxItems: MAX_FINDINGS,
+        items: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            claim: { type: "string", minLength: 1, maxLength: 500 },
+            evidence: { type: "string", minLength: 1, maxLength: 2e3 },
+            source: { type: "string", maxLength: 500 },
+            confidence: { enum: ["high", "medium", "low"] }
+          },
+          required: ["claim", "evidence", "confidence"]
+        }
+      },
+      findings_truncated: { type: "boolean" },
+      summary: { type: "string", minLength: 1, maxLength: 2e3 },
+      produced_by_agent: { const: producedByAgent }
+    },
+    required: [
+      "schema_version",
+      "skill",
+      "outcome",
+      "findings",
+      "findings_truncated",
+      "summary",
+      "produced_by_agent"
+    ]
+  };
+}
+var MAX_FINDINGS;
+var init_skill_result_json_schema = __esm({
+  "../../scripts/virtual-office/code-runner/skill-result-json-schema.mjs"() {
+    "use strict";
+    MAX_FINDINGS = 50;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/skill-task-runner.mjs
 import { createHash as createHash9 } from "node:crypto";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
@@ -16275,13 +16509,7 @@ function skillResultPayloadSha256(result) {
   };
   return createHash9("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
 }
-function parseSkillResult(text, { expectedSkill, producedByAgent }) {
-  let value;
-  try {
-    value = JSON.parse(String(text ?? "").trim());
-  } catch {
-    throw new Error("skill agent did not return one strict JSON result");
-  }
+function parseSkillResultValue(value, { expectedSkill, producedByAgent }) {
   if (!exactKeys(value, ["schema_version", "skill", "outcome", "findings", "findings_truncated", "summary", "produced_by_agent"])) {
     throw new Error("skill result shape is invalid");
   }
@@ -16290,7 +16518,7 @@ function parseSkillResult(text, { expectedSkill, producedByAgent }) {
   if (value.produced_by_agent !== producedByAgent) throw new Error("skill result agent attribution is invalid");
   if (typeof value.findings_truncated !== "boolean") throw new Error("skill result truncation flag is invalid");
   boundedString(value.summary, 1, 2e3, "skill result summary");
-  if (!Array.isArray(value.findings) || value.findings.length > MAX_FINDINGS) throw new Error("skill result findings are invalid");
+  if (!Array.isArray(value.findings) || value.findings.length > MAX_FINDINGS2) throw new Error("skill result findings are invalid");
   if (value.outcome === "findings" ? value.findings.length === 0 : value.findings.length > 0) {
     throw new Error("skill result findings do not match its outcome");
   }
@@ -16307,6 +16535,27 @@ function parseSkillResult(text, { expectedSkill, producedByAgent }) {
   }
   return value;
 }
+function assertSkillRunWithinDispatch(run, { maxTurns, maxBudgetUsd } = {}) {
+  if (run?.terminalSubtype !== "success") {
+    throw new Error(`skill agent terminal subtype was not success (${run?.terminalSubtype || "unknown"})`);
+  }
+  if (Number.isInteger(maxTurns) && maxTurns > 0) {
+    if (!Number.isInteger(run?.numTurns) || run.numTurns < 0) {
+      throw new Error("skill agent did not report valid turn usage for the active ceiling");
+    }
+    if (run.numTurns > maxTurns) {
+      throw new Error(`skill agent exceeded the turn ceiling (${run.numTurns} > ${maxTurns})`);
+    }
+  }
+  if (typeof maxBudgetUsd === "number" && Number.isFinite(maxBudgetUsd) && maxBudgetUsd > 0) {
+    if (typeof run?.costUsd !== "number" || !Number.isFinite(run.costUsd) || run.costUsd < 0) {
+      throw new Error("skill agent did not report valid cost usage for the active ceiling");
+    }
+    if (run.costUsd > maxBudgetUsd) {
+      throw new Error(`skill agent exceeded the cost ceiling (${run.costUsd} > ${maxBudgetUsd})`);
+    }
+  }
+}
 function composeSkillTaskPrompt({ skillBody, invocation, taskPrompt, producedByAgent }) {
   const body = boundedString(skillBody, 1, MAX_SKILL_BODY_CHARS, "skill body");
   const request = boundedString(taskPrompt, 1, 810201, "skill task request");
@@ -16341,8 +16590,9 @@ async function processSkillTask(client, task, cfg, {
   swarmAdmission = null,
   runTask = runAgentTask,
   resolveDispatch = resolveEffortDispatch,
+  checkSkillCapability = ({ runner, bin, env: capabilityEnv }) => typeof runner.checkSkillCapability === "function" ? runner.checkSkillCapability({ bin, env: capabilityEnv }) : { compatible: false, reason: "resolved runner has no restricted-skill capability probe" },
   createScratch = () => mkdtemp2(join19(tmpdir(), "algohq-skill-task-")),
-  removeScratch = (path23) => rm2(path23, { recursive: true, force: true })
+  removeScratch = (path24) => rm2(path24, { recursive: true, force: true })
 } = {}) {
   const id = task.code_task_id;
   let run = null;
@@ -16389,12 +16639,25 @@ async function processSkillTask(client, task, cfg, {
     if (selected.agent !== "claude") {
       throw new Error("skill execution requires the policy-restricted Claude runner");
     }
+    const capability = await checkSkillCapability({
+      runner: selected.runner,
+      bin: selected.runnerBin,
+      env: env2
+    });
+    if (!capability?.compatible) {
+      throw new Error(`resolved Claude CLI is incompatible with restricted skill execution: ${capability?.reason || "unknown capability"}`);
+    }
+    const executionBin = capability.resolvedBin || selected.runnerBin;
     const basePrompt = composeSkillTaskPrompt({
       skillBody: skill.body,
       invocation,
       taskPrompt: task.prompt,
       producedByAgent: selected.agent
     });
+    const structuredOutputSchema = buildSkillResultJsonSchema({
+      expectedSkill: invocation.skill,
+      producedByAgent: selected.agent
+    });
     const dispatch = await resolveDispatch({ client, task, agent: selected.agent, env: env2, basePrompt });
     assertRunnerGovernors({ agent: selected.agent, task });
     scratch = await createScratch();
@@ -16412,10 +16675,11 @@ async function processSkillTask(client, task, cfg, {
     });
     run = await runTask({
       runner: selected.runner,
-      bin: selected.runnerBin,
+      bin: executionBin,
       prompt: dispatch.prompt,
       cwd: scratch,
       toolPolicy: frozenInputsOnly ? "frozen_inputs_only" : "skill_readonly",
+      structuredOutputSchema,
       permissionMode: dispatch.permissionMode,
       maxTurns: selected.agent === "claude" ? dispatch.maxTurns : void 0,
       model: dispatch.model,
@@ -16466,7 +16730,11 @@ async function processSkillTask(client, task, cfg, {
       } });
       return;
     }
-    const parsedResult = parseSkillResult(resultText(run), {
+    assertSkillRunWithinDispatch(run, dispatch);
+    if (!run.structuredOutput || typeof run.structuredOutput !== "object" || Array.isArray(run.structuredOutput)) {
+      throw new Error("skill agent did not return provider-validated structured output");
+    }
+    const parsedResult = parseSkillResultValue(run.structuredOutput, {
       expectedSkill: invocation.skill,
       producedByAgent: selected.agent
     });
@@ -16509,7 +16777,7 @@ async function processSkillTask(client, task, cfg, {
     } });
   }
 }
-var SKILL_SUCCESS_STATUS, SKILL_NAME_RE, INPUT_KEY_RE, MAX_SKILL_BODY_CHARS, MAX_INPUTS, MAX_FINDINGS, SHA256_RE;
+var SKILL_SUCCESS_STATUS, SKILL_NAME_RE, INPUT_KEY_RE, MAX_SKILL_BODY_CHARS, MAX_INPUTS, MAX_FINDINGS2, SHA256_RE;
 var init_skill_task_runner = __esm({
   "../../scripts/virtual-office/code-runner/skill-task-runner.mjs"() {
     "use strict";
@@ -16523,12 +16791,13 @@ var init_skill_task_runner = __esm({
     init_killed_run_outcome();
     init_terminal_delivery();
     init_cancelled_run_report();
+    init_skill_result_json_schema();
     SKILL_SUCCESS_STATUS = "no_changes_needed";
     SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}(?::[a-z0-9][a-z0-9-]{0,62})?$/u;
     INPUT_KEY_RE = /^[a-z][a-z0-9_]{0,39}$/u;
     MAX_SKILL_BODY_CHARS = 256e3;
     MAX_INPUTS = 12;
-    MAX_FINDINGS = 50;
+    MAX_FINDINGS2 = 50;
     SHA256_RE = /^[a-f0-9]{64}$/u;
   }
 });
@@ -16536,7 +16805,7 @@ var init_skill_task_runner = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs12 from "node:fs";
 import fsp11 from "node:fs/promises";
-import path20 from "node:path";
+import path21 from "node:path";
 async function defaultRun3(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -16549,7 +16818,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path20.dirname(commonDir);
+  const root = path21.dirname(commonDir);
   return samePath3(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -16591,21 +16860,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path20.join(
-    path20.dirname(worktreeDir),
+  const quarantineDir = path21.join(
+    path21.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp11.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp11.writeFile(path20.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp11.writeFile(path21.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path20.join(baseline.root, relative);
-    const target = path20.join(quarantineDir, "untracked", relative);
-    await fsp11.mkdir(path20.dirname(target), { recursive: true });
+    const source = path21.join(baseline.root, relative);
+    const target = path21.join(quarantineDir, "untracked", relative);
+    await fsp11.mkdir(path21.dirname(target), { recursive: true });
     await fsp11.copyFile(source, target);
   }
-  await fsp11.writeFile(path20.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp11.writeFile(path21.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -16627,8 +16896,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path20.resolve(baseline.root, relative);
-    const prefix = `${path20.resolve(baseline.root)}${path20.sep}`;
+    const target = path21.resolve(baseline.root, relative);
+    const prefix = `${path21.resolve(baseline.root)}${path21.sep}`;
     if (!target.startsWith(prefix) || !fs12.existsSync(target)) continue;
     await fsp11.rm(target, { force: true });
   }
@@ -16665,7 +16934,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath3 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path20.resolve(value));
+      const [a, b] = [left, right].map((value) => path21.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -17082,7 +17351,7 @@ var init_publication_outcome = __esm({
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
-import path21 from "node:path";
+import path22 from "node:path";
 function defaultRun4(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
@@ -17090,13 +17359,13 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   if (!isAgentScratch(file)) {
     throw new Error(`refusing to remove non-scratch publication path: ${file}`);
   }
-  const root = path21.resolve(worktreeDir);
-  const target = path21.resolve(root, file);
-  const relative = path21.relative(root, target);
-  if (!relative || relative.startsWith(`..${path21.sep}`) || path21.isAbsolute(relative)) {
+  const root = path22.resolve(worktreeDir);
+  const target = path22.resolve(root, file);
+  const relative = path22.relative(root, target);
+  if (!relative || relative.startsWith(`..${path22.sep}`) || path22.isAbsolute(relative)) {
     throw new Error(`refusing to remove publication scratch outside worktree: ${file}`);
   }
-  for (let cursor = target; cursor !== root; cursor = path21.dirname(cursor)) {
+  for (let cursor = target; cursor !== root; cursor = path22.dirname(cursor)) {
     try {
       if ((await fsp12.lstat(cursor)).isSymbolicLink()) {
         throw new Error(`refusing to follow symlink while removing publication scratch: ${file}`);
@@ -17218,7 +17487,7 @@ var init_publication_scope = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs13 from "node:fs";
 import fsp13 from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -17232,10 +17501,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path22.join(clonesRoot2, leaf);
+  const canonical = path23.join(clonesRoot2, leaf);
   return [
-    path22.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path22.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path23.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path23.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile6) {