@algosuite/vo-mcp 0.2.0-beta.71 → 0.2.0-beta.73

package/dist/runner-cli.js

@@ -314,21 +314,21 @@ function backupConfigOnce(configPath) {
   copyFileSync(configPath, backupPath);
   return backupPath;
 }
-function writeFileAtomic(path23, content) {
-  sweepStaleTempFiles(path23);
-  const temp = `${path23}.vo-mcp-tmp-${process.pid}-${Date.now()}`;
+function writeFileAtomic(path24, content) {
+  sweepStaleTempFiles(path24);
+  const temp = `${path24}.vo-mcp-tmp-${process.pid}-${Date.now()}`;
   try {
     writeFileSync2(temp, content, { encoding: "utf8", mode: 384 });
-    if (existsSync3(path23)) {
+    if (existsSync3(path24)) {
       try {
-        chmodSync2(temp, statSync(path23).mode & 511);
+        chmodSync2(temp, statSync(path24).mode & 511);
       } catch {
       }
     }
     let lastErr = null;
     for (let attempt = 0; attempt < RENAME_RETRIES; attempt += 1) {
       try {
-        renameSync(temp, path23);
+        renameSync(temp, path24);
         return;
       } catch (err) {
         lastErr = err;
@@ -337,7 +337,7 @@ function writeFileAtomic(path23, content) {
         sleepSync(RENAME_RETRY_MS);
       }
     }
-    writeFileSync2(path23, content, "utf8");
+    writeFileSync2(path24, content, "utf8");
     try {
       unlinkSync2(temp);
     } catch {
@@ -503,8 +503,8 @@ function tablePath(line) {
 function tableSections(lines) {
   const starts = [];
   for (let index = 0; index < lines.length; index += 1) {
-    const path23 = tablePath(lines[index] ?? "");
-    if (path23) starts.push({ path: path23, start: index });
+    const path24 = tablePath(lines[index] ?? "");
+    if (path24) starts.push({ path: path24, start: index });
   }
   return starts.map((section, index) => ({
     ...section,
@@ -696,11 +696,11 @@ function resolveLinuxConfigHome(home, env2) {
   const configured = env2["XDG_CONFIG_HOME"]?.trim();
   return configured && isAbsolute2(configured) ? configured : join5(home, ".config");
 }
-function launcherIsCurrent(path23, desiredContent, label, log2) {
-  if (!existsSync6(path23)) return false;
-  if (readFileSync5(path23, "utf8") === desiredContent) return true;
-  const backupPath = `${path23}.backup-${Date.now()}`;
-  copyFileSync2(path23, backupPath);
+function launcherIsCurrent(path24, desiredContent, label, log2) {
+  if (!existsSync6(path24)) return false;
+  if (readFileSync5(path24, "utf8") === desiredContent) return true;
+  const backupPath = `${path24}.backup-${Date.now()}`;
+  copyFileSync2(path24, backupPath);
   log2(`  Backed up existing ${label} to: ${backupPath}`);
   return false;
 }
@@ -916,17 +916,17 @@ function resolveDesktopConfigPath(home, plat, appData) {
   }
   return join6(home, ".config", "Claude", "claude_desktop_config.json");
 }
-function readClaudeConfig(path23) {
-  if (!existsSync7(path23)) return { kind: "absent", config: {}, mtimeMs: null };
+function readClaudeConfig(path24) {
+  if (!existsSync7(path24)) return { kind: "absent", config: {}, mtimeMs: null };
   for (let attempt = 0; attempt < 3; attempt += 1) {
-    const before = statSync3(path23).mtimeMs;
+    const before = statSync3(path24).mtimeMs;
     let raw;
     try {
-      raw = readFileSync6(path23, "utf8");
+      raw = readFileSync6(path24, "utf8");
     } catch {
       return { kind: "invalid", config: {}, mtimeMs: before };
     }
-    if (!existsSync7(path23) || statSync3(path23).mtimeMs !== before) continue;
+    if (!existsSync7(path24) || statSync3(path24).mtimeMs !== before) continue;
     const text = raw.replace(/^\uFEFF/u, "");
     if (!text.trim()) return { kind: "empty", config: {}, mtimeMs: before };
     try {
@@ -938,9 +938,9 @@ function readClaudeConfig(path23) {
   }
   return { kind: "invalid", config: {}, mtimeMs: null };
 }
-function writeClaudeConfig(path23, config) {
-  mkdirSync6(dirname4(path23), { recursive: true });
-  writeFileAtomic(path23, `${JSON.stringify(config, null, 2)}
+function writeClaudeConfig(path24, config) {
+  mkdirSync6(dirname4(path24), { recursive: true });
+  writeFileAtomic(path24, `${JSON.stringify(config, null, 2)}
 `);
 }
 function carriedEntryKeys(entry) {
@@ -3515,6 +3515,372 @@ var init_installation_token = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/claude-credential-choice.mjs
+function isTruthyFlag(v) {
+  const s = String(v ?? "").trim().toLowerCase();
+  return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+function wantsLogin(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env2[PREFER_LOGIN_ENV]);
+}
+function wantsKey(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
+}
+function classifyClaudeCredential(baseEnv = {}, { getKey, probeLogin } = {}) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN, key: null };
+  }
+  if (baseEnv.ANTHROPIC_API_KEY) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.ENV_KEY, key: null };
+  }
+  const key = getKey();
+  if (!key) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.NO_KEY, key: null };
+  }
+  if (preferKey) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY, key };
+  }
+  if (probeLogin() === true) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS, key: null };
+  }
+  return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN, key };
+}
+var PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, PREFER_KEY_ENV, CLAUDE_PREFER_KEY_ENV, CLAUDE_CREDENTIAL_SOURCE;
+var init_claude_credential_choice = __esm({
+  "../../scripts/virtual-office/code-runner/claude-credential-choice.mjs"() {
+    "use strict";
+    PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
+    CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
+    PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
+    CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
+    CLAUDE_CREDENTIAL_SOURCE = Object.freeze({
+      /** PREFER_LOGIN set (and not overridden): any API key is ignored. */
+      PREFER_LOGIN: "prefer_login",
+      /** An explicit ANTHROPIC_API_KEY in the environment — the manual override. */
+      ENV_KEY: "env_key",
+      /** No key anywhere; the spawn falls through to the login session. */
+      NO_KEY: "no_key",
+      /** A stored key, used because the operator explicitly opted out of tier 1. */
+      KEYCHAIN_PREFER_KEY: "keychain_prefer_key",
+      /** A stored key exists but a proven live subscription outranks it. */
+      SUBSCRIPTION_WINS: "subscription_wins",
+      /** A stored key, used because no live subscription was proven. */
+      KEYCHAIN: "keychain"
+    });
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/windows-claude-launch.mjs
+import { existsSync as existsSync8, realpathSync } from "node:fs";
+import { win32 as path12 } from "node:path";
+import { spawnSync } from "node:child_process";
+function pathValue(env2) {
+  for (const key of ["Path", "PATH", "path"]) {
+    if (typeof env2?.[key] === "string") return env2[key];
+  }
+  return "";
+}
+function cleanPathSegment(value) {
+  const trimmed = String(value || "").trim();
+  return trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+}
+function envValue(env2, name) {
+  const exact = env2?.[name];
+  if (typeof exact === "string") return exact.trim();
+  const key = Object.keys(env2 || {}).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
+  return typeof env2?.[key] === "string" ? env2[key].trim() : "";
+}
+function userClaudeCandidates(bin, env2) {
+  if (!/^claude(?:\.(?:exe|cmd|ps1))?$/iu.test(bin)) return [];
+  const userProfile = envValue(env2, "USERPROFILE");
+  const appData = envValue(env2, "APPDATA") || (userProfile ? path12.join(userProfile, "AppData", "Roaming") : "");
+  const localAppData = envValue(env2, "LOCALAPPDATA") || (userProfile ? path12.join(userProfile, "AppData", "Local") : "");
+  const candidates = [];
+  if (appData) {
+    const npmBin = path12.join(appData, "npm");
+    candidates.push(
+      path12.join(npmBin, "claude.exe"),
+      path12.join(npmBin, "claude.cmd"),
+      path12.join(npmBin, "claude.ps1"),
+      path12.join(npmBin, "claude"),
+      path12.join(npmBin, ...NATIVE_CLAUDE_PARTS)
+    );
+  }
+  if (userProfile) candidates.push(path12.join(userProfile, ".local", "bin", "claude.exe"));
+  if (localAppData) {
+    candidates.push(
+      path12.join(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"),
+      path12.join(localAppData, "Microsoft", "WindowsApps", "claude.exe")
+    );
+  }
+  return candidates;
+}
+function pathCandidates(bin, env2) {
+  if (path12.isAbsolute(bin) || /[\\/]/u.test(bin)) {
+    return [path12.resolve(bin)];
+  }
+  const extension = path12.extname(bin);
+  const fromPath = pathValue(env2).split(";").map(cleanPathSegment).filter(Boolean).flatMap((directory) => extension ? [path12.join(directory, bin)] : [
+    path12.join(directory, `${bin}.exe`),
+    path12.join(directory, `${bin}.cmd`),
+    path12.join(directory, `${bin}.ps1`),
+    path12.join(directory, bin)
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  return [...fromPath, ...userClaudeCandidates(bin, env2)].filter((candidate) => {
+    const key = candidate.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function canonicalExistingPath(candidate, exists, canonicalize) {
+  if (!exists(candidate)) return null;
+  try {
+    return canonicalize(candidate);
+  } catch {
+    return null;
+  }
+}
+function resolveWindowsClaudeExecutable({
+  bin = "claude",
+  env: env2 = process.env,
+  exists = existsSync8,
+  canonicalize = realpathSync
+} = {}) {
+  const requested = String(bin || "").trim();
+  if (!requested || requested.includes("\0")) {
+    throw new TypeError("Claude executable must be a non-empty path without NUL bytes");
+  }
+  for (const candidate of pathCandidates(requested, env2)) {
+    const found = canonicalExistingPath(candidate, exists, canonicalize);
+    if (!found) continue;
+    if (path12.extname(found).toLowerCase() === ".exe") return found;
+    const native = path12.join(path12.dirname(found), ...NATIVE_CLAUDE_PARTS);
+    const resolvedNative = canonicalExistingPath(native, exists, canonicalize);
+    if (resolvedNative) return resolvedNative;
+  }
+  const error = new Error(
+    `Could not resolve a native claude.exe for "${requested}". Install or update Claude Code with the native Windows installer (recommended) or npm install -g @anthropic-ai/claude-code; the HQ runner will not execute a shell-only .cmd/.ps1 shim.`
+  );
+  error.code = "ENOENT";
+  throw error;
+}
+function buildWindowsClaudeLaunch({
+  bin = "claude",
+  args = [],
+  env: env2 = process.env
+} = {}) {
+  return {
+    bin: resolveWindowsClaudeExecutable({ bin, env: env2 }),
+    args: Array.from(args, (value) => String(value)),
+    spawnOptions: {
+      shell: false,
+      windowsHide: true,
+      windowsVerbatimArguments: false
+    }
+  };
+}
+function spawnClaudeSync(args = [], options = {}) {
+  if (process.platform !== "win32") {
+    return spawnSync("claude", args, { windowsHide: true, ...options });
+  }
+  try {
+    const launch = buildWindowsClaudeLaunch({
+      bin: "claude",
+      args,
+      env: options.env || process.env
+    });
+    return spawnSync(launch.bin, launch.args, {
+      ...options,
+      ...launch.spawnOptions
+    });
+  } catch (error) {
+    return {
+      error,
+      status: null,
+      signal: null,
+      output: null,
+      stdout: null,
+      stderr: null
+    };
+  }
+}
+var NATIVE_CLAUDE_PARTS;
+var init_windows_claude_launch = __esm({
+  "../../scripts/virtual-office/code-runner/windows-claude-launch.mjs"() {
+    "use strict";
+    NATIVE_CLAUDE_PARTS = [
+      "node_modules",
+      "@anthropic-ai",
+      "claude-code",
+      "bin",
+      "claude.exe"
+    ];
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
+import { createRequire as createRequire2 } from "node:module";
+import { spawnSync as spawnSync2 } from "node:child_process";
+function defaultEntryCtor() {
+  if (_loadTried) return _entryCtor;
+  _loadTried = true;
+  try {
+    _entryCtor = require2("@napi-rs/keyring").Entry;
+  } catch {
+    _entryCtor = null;
+  }
+  return _entryCtor;
+}
+function getAnthropicKey({ EntryCtor = defaultEntryCtor() } = {}) {
+  if (!EntryCtor) return null;
+  try {
+    return new EntryCtor(KEY_SERVICE, KEY_ACCOUNT).getPassword() || null;
+  } catch {
+    return null;
+  }
+}
+function hasAnthropicKey(opts = {}) {
+  return getAnthropicKey(opts) !== null;
+}
+function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  const { source, key } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  const next = { ...baseEnv };
+  if (source === CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN) {
+    delete next.ANTHROPIC_API_KEY;
+    return next;
+  }
+  if (key !== null) next.ANTHROPIC_API_KEY = key;
+  return next;
+}
+function claudeCostBasis(env2 = process.env) {
+  return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
+}
+function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  const { source } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  return AUTH_SOURCE_DESCRIPTION[source];
+}
+function augmentAuthError(summary) {
+  const s = String(summary ?? "");
+  if (!AUTH_ERROR_RE.test(s)) return s;
+  return `${s}
+\u21B3 Anthropic auth failed on the runner. The \`claude\` CLI is a SEPARATE install/login from the Claude Desktop app and the Claude Code IDE extension \u2014 signing into those does NOT authenticate it. Fix: run \`claude auth login\` (Claude subscription) on the runner machine, or clear any stale ANTHROPIC_API_KEY (env / OS keychain / .env.local) and set VO_RUNNER_PREFER_LOGIN=1 \u2014 then restart the runner. Verify with \`claude -p "say hi"\`.`;
+}
+function probeClaudeLoginState({
+  spawn: spawn5 = spawnSync2,
+  buildWindowsLaunch = buildWindowsClaudeLaunch,
+  platform: platform4 = process.platform
+} = {}) {
+  try {
+    const launch = platform4 === "win32" ? buildWindowsLaunch({ bin: "claude", args: ["auth", "status"] }) : { bin: "claude", args: ["auth", "status"], spawnOptions: { windowsHide: true } };
+    const st = spawn5(launch.bin, launch.args, { ...launch.spawnOptions, timeout: 5e3, encoding: "utf8" });
+    const parsed = JSON.parse(String(st.stdout || "").trim() || "{}");
+    return typeof parsed.loggedIn === "boolean" ? parsed.loggedIn : null;
+  } catch {
+    return null;
+  }
+}
+var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, AUTH_SOURCE_DESCRIPTION, AUTH_ERROR_RE;
+var init_anthropic_key_store = __esm({
+  "../../scripts/virtual-office/code-runner/anthropic-key-store.mjs"() {
+    "use strict";
+    init_windows_claude_launch();
+    init_claude_credential_choice();
+    init_claude_credential_choice();
+    require2 = createRequire2(import.meta.url);
+    KEY_SERVICE = "algosuite-vo";
+    KEY_ACCOUNT = "anthropic-api-key";
+    _loadTried = false;
+    AUTH_SOURCE_DESCRIPTION = Object.freeze({
+      [CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN]: "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)",
+      [CLAUDE_CREDENTIAL_SOURCE.ENV_KEY]: "ANTHROPIC_API_KEY from environment",
+      [CLAUDE_CREDENTIAL_SOURCE.NO_KEY]: "claude auth login session (no API key set)",
+      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY]: "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)",
+      [CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS]: "claude auth login session (subscription beats the stored keychain key)",
+      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN]: "ANTHROPIC_API_KEY from OS keychain"
+    });
+    AUTH_ERROR_RE = /\b401\b|invalid[^.]{0,24}(authentication|credential)|authentication_error|unauthorized|not[ _-]?authenticated/i;
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/agent-auth-attestation.mjs
+function isTruthyFlag2(value) {
+  const s = String(value ?? "").trim().toLowerCase();
+  return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+function runnerAllowsApiBilling(env2 = {}) {
+  return isTruthyFlag2(env2[RUNNER_ALLOW_API_BILLING_ENV]);
+}
+function hasApiBillingCredential(env2 = {}) {
+  for (const [name, value] of Object.entries(env2)) {
+    if (!API_BILLING_ENV_NAME_SET.has(String(name).toUpperCase())) continue;
+    if (String(value ?? "").trim()) return true;
+  }
+  return false;
+}
+function stripApiBillingEnv(env2 = {}) {
+  const next = {};
+  for (const [name, value] of Object.entries(env2)) {
+    if (API_BILLING_ENV_NAME_SET.has(String(name).toUpperCase())) continue;
+    next[name] = value;
+  }
+  return next;
+}
+function resolveAgentAuthSource(env2 = {}) {
+  return hasApiBillingCredential(env2) ? AGENT_AUTH_SOURCE.API_KEY : AGENT_AUTH_SOURCE.LOGIN;
+}
+function applyApiBillingPolicy(spawnEnv = {}, { runnerEnv = spawnEnv, allowApiBilling = false } = {}) {
+  const forcedLogin = wantsLogin(runnerEnv) && !wantsKey(runnerEnv);
+  const permitted = !forcedLogin && allowApiBilling === true && runnerAllowsApiBilling(runnerEnv);
+  const env2 = permitted ? { ...spawnEnv } : stripApiBillingEnv(spawnEnv);
+  return { env: env2, agent_auth_source: resolveAgentAuthSource(env2), permitted };
+}
+function resolveRunnerAttestedAuthSource(env2 = process.env, { hasStoredKey = hasAnthropicKey } = {}) {
+  if (wantsLogin(env2) && !wantsKey(env2)) return AGENT_AUTH_SOURCE.LOGIN;
+  if (!runnerAllowsApiBilling(env2)) return AGENT_AUTH_SOURCE.LOGIN;
+  if (hasApiBillingCredential(env2)) return AGENT_AUTH_SOURCE.API_KEY;
+  try {
+    return hasStoredKey() === true ? AGENT_AUTH_SOURCE.API_KEY : AGENT_AUTH_SOURCE.LOGIN;
+  } catch {
+    return AGENT_AUTH_SOURCE.API_KEY;
+  }
+}
+function describeTaskAuthSource(env2 = process.env, task = {}) {
+  const { agent_auth_source: authSource, permitted } = applyApiBillingPolicy(env2, {
+    runnerEnv: env2,
+    allowApiBilling: task?.allow_api_billing === true
+  });
+  const reason = permitted ? "explicit_opt_in" : "default";
+  return `auth_source=${authSource} reason=${reason}`;
+}
+var AGENT_AUTH_SOURCE, AGENT_AUTH_SOURCES, API_BILLING_ENV_NAMES, RUNNER_ALLOW_API_BILLING_ENV, API_BILLING_ENV_NAME_SET;
+var init_agent_auth_attestation = __esm({
+  "../../scripts/virtual-office/code-runner/agent-auth-attestation.mjs"() {
+    "use strict";
+    init_claude_credential_choice();
+    init_anthropic_key_store();
+    AGENT_AUTH_SOURCE = Object.freeze({
+      /** A flat-cost linked account (`claude auth login`). No per-token vendor bill. */
+      LOGIN: "login",
+      /** A metered per-token credential the vendor bills. */
+      API_KEY: "api_key"
+    });
+    AGENT_AUTH_SOURCES = Object.freeze([
+      AGENT_AUTH_SOURCE.LOGIN,
+      AGENT_AUTH_SOURCE.API_KEY
+    ]);
+    API_BILLING_ENV_NAMES = Object.freeze([
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "CLAUDE_API_KEY"
+    ]);
+    RUNNER_ALLOW_API_BILLING_ENV = "VO_RUNNER_ALLOW_API_BILLING";
+    API_BILLING_ENV_NAME_SET = new Set(API_BILLING_ENV_NAMES);
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/control-plane-heartbeat-body.mjs
 function buildRunnerHeartbeatBody({
   runnerId,
@@ -3540,6 +3906,8 @@ function buildRunnerHeartbeatBody({
   accountUsage,
   availableLocalModels,
   supportedTaskKinds,
+  hostHealth,
+  agentAuthSource,
   prepared_job_shadow: preparedJobShadow
 } = {}) {
   const body = { runner_id: runnerId, ...preparedJobShadow ? { prepared_job_shadow: preparedJobShadow } : {} };
@@ -3577,11 +3945,14 @@ function buildRunnerHeartbeatBody({
   if (Array.isArray(supportedTaskKinds) && supportedTaskKinds.length > 0) {
     body.supported_task_kinds = supportedTaskKinds;
   }
+  if (hostHealth && typeof hostHealth === "object") body.host_health = hostHealth;
+  if (AGENT_AUTH_SOURCES.includes(agentAuthSource)) body.agent_auth_source = agentAuthSource;
   return body;
 }
 var init_control_plane_heartbeat_body = __esm({
   "../../scripts/virtual-office/code-runner/control-plane-heartbeat-body.mjs"() {
     "use strict";
+    init_agent_auth_attestation();
   }
 });
 
@@ -3879,13 +4250,13 @@ async function getTaskKnowledgeContextRequest(req, taskId, { query, knowledgeReq
   const canonicalQuery = canonicalizeKnowledgeContextQuery(query);
   if (canonicalQuery.trim()) body.query = canonicalQuery;
   if (typeof knowledgeRequestId === "string" && knowledgeRequestId) body.knowledge_request_id = knowledgeRequestId;
-  const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
+  const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/knowledge-context`;
   const timeoutMs = Math.max(Number(taskRequestTimeoutMs) || 0, MIN_KNOWLEDGE_CONTEXT_TIMEOUT_MS);
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
     let res;
     let cause;
     try {
-      res = await req("POST", path23, body, { timeoutMs });
+      res = await req("POST", path24, body, { timeoutMs });
     } catch (err) {
       cause = err;
     }
@@ -3953,10 +4324,10 @@ async function getPreparedJobRequest(req, taskId, options = {}, invalidateToken
   if (typeof taskId !== "string" || taskId.length === 0) {
     return { ok: false, reason: "missing_task_id", status: 0, ...envMeta };
   }
-  const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
+  const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/prepared-job?${query}`;
   let res;
   try {
-    res = await req("GET", path23, void 0, { timeoutMs });
+    res = await req("GET", path24, void 0, { timeoutMs });
   } catch (err) {
     return { ok: false, reason: `transport: ${err?.message || String(err)}`, status: 0, ...envMeta };
   }
@@ -4056,11 +4427,11 @@ function createControlPlaneClient({
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
   const claimOccurrences = /* @__PURE__ */ new Map();
-  async function req(method, path23, body, { timeoutMs } = {}) {
+  async function req(method, path24, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path23}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path24}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -4073,7 +4444,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path23} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path24} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -4082,7 +4453,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path23, body, options = {}) => req(method, path23, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path24, body, options = {}) => req(method, path24, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   const claimGate = makeClaimGateNotice({ log: (m) => console.warn(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${m}`) });
   return {
     getClaimGate: () => claimGate.current(),
@@ -4111,6 +4482,7 @@ function createControlPlaneClient({
       }
       if (session.runnerInstanceId && session.reconcileStale) body.reconcile_stale = true;
       if (session.defaultAgent) body.default_agent = session.defaultAgent;
+      if (AGENT_AUTH_SOURCES.includes(session.agentAuthSource)) body.agent_auth_source = session.agentAuthSource;
       if (Array.isArray(session.availableAgents)) {
         body.available_agents = session.availableAgents.filter((entry) => entry?.installed === true && entry?.authenticated === true).map((entry) => entry.agent);
       }
@@ -4253,8 +4625,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path23 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path23);
+      const path24 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path24);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -4367,333 +4739,47 @@ function createControlPlaneClient({
       return fetchInstallationToken({ req: taskReq, required, readOnly, repo });
     },
     /**
-     * Read the operator's dispatch-mode config (Fast→Ultracode effort setting).
-     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'marathon'; 'ultracode' legacy),
-     * defaulting to 'standard' on any error. Never throws — best-effort.
-     */
-    async getDispatchMode() {
-      try {
-        const res = await taskReq("GET", "/api/v1/dispatch-mode-config");
-        if (!res.ok) return "standard";
-        const json = await res.json();
-        return json?.dispatchMode || "standard";
-      } catch {
-        return "standard";
-      }
-    }
-  };
-}
-var cachedFirebaseToken, ClaimAuthorityChangedError;
-var init_control_plane_client = __esm({
-  "../../scripts/virtual-office/code-runner/control-plane-client.mjs"() {
-    "use strict";
-    init_installation_token();
-    init_control_plane_heartbeat_body();
-    init_control_plane_promote();
-    init_control_plane_task_list();
-    init_control_plane_resume();
-    init_control_plane_autonomous_admission();
-    init_control_plane_merge();
-    init_control_plane_weekly_tokens();
-    init_control_plane_telemetry_relay();
-    init_claim_gate_notice();
-    init_control_plane_knowledge_context();
-    init_control_plane_prepared_job();
-    cachedFirebaseToken = null;
-    ClaimAuthorityChangedError = class extends Error {
-      constructor() {
-        super("code-task claim authority changed");
-        this.name = "ClaimAuthorityChangedError";
-        this.code = "code_task_claim_authority_changed";
-      }
-    };
-  }
-});
-
-// ../../scripts/virtual-office/code-runner/windows-claude-launch.mjs
-import { existsSync as existsSync8, realpathSync } from "node:fs";
-import { win32 as path12 } from "node:path";
-import { spawnSync } from "node:child_process";
-function pathValue(env2) {
-  for (const key of ["Path", "PATH", "path"]) {
-    if (typeof env2?.[key] === "string") return env2[key];
-  }
-  return "";
-}
-function cleanPathSegment(value) {
-  const trimmed = String(value || "").trim();
-  return trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
-}
-function envValue(env2, name) {
-  const exact = env2?.[name];
-  if (typeof exact === "string") return exact.trim();
-  const key = Object.keys(env2 || {}).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
-  return typeof env2?.[key] === "string" ? env2[key].trim() : "";
-}
-function userClaudeCandidates(bin, env2) {
-  if (!/^claude(?:\.(?:exe|cmd|ps1))?$/iu.test(bin)) return [];
-  const userProfile = envValue(env2, "USERPROFILE");
-  const appData = envValue(env2, "APPDATA") || (userProfile ? path12.join(userProfile, "AppData", "Roaming") : "");
-  const localAppData = envValue(env2, "LOCALAPPDATA") || (userProfile ? path12.join(userProfile, "AppData", "Local") : "");
-  const candidates = [];
-  if (appData) {
-    const npmBin = path12.join(appData, "npm");
-    candidates.push(
-      path12.join(npmBin, "claude.exe"),
-      path12.join(npmBin, "claude.cmd"),
-      path12.join(npmBin, "claude.ps1"),
-      path12.join(npmBin, "claude"),
-      path12.join(npmBin, ...NATIVE_CLAUDE_PARTS)
-    );
-  }
-  if (userProfile) candidates.push(path12.join(userProfile, ".local", "bin", "claude.exe"));
-  if (localAppData) {
-    candidates.push(
-      path12.join(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"),
-      path12.join(localAppData, "Microsoft", "WindowsApps", "claude.exe")
-    );
-  }
-  return candidates;
-}
-function pathCandidates(bin, env2) {
-  if (path12.isAbsolute(bin) || /[\\/]/u.test(bin)) {
-    return [path12.resolve(bin)];
-  }
-  const extension = path12.extname(bin);
-  const fromPath = pathValue(env2).split(";").map(cleanPathSegment).filter(Boolean).flatMap((directory) => extension ? [path12.join(directory, bin)] : [
-    path12.join(directory, `${bin}.exe`),
-    path12.join(directory, `${bin}.cmd`),
-    path12.join(directory, `${bin}.ps1`),
-    path12.join(directory, bin)
-  ]);
-  const seen = /* @__PURE__ */ new Set();
-  return [...fromPath, ...userClaudeCandidates(bin, env2)].filter((candidate) => {
-    const key = candidate.toLowerCase();
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function canonicalExistingPath(candidate, exists, canonicalize) {
-  if (!exists(candidate)) return null;
-  try {
-    return canonicalize(candidate);
-  } catch {
-    return null;
-  }
-}
-function resolveWindowsClaudeExecutable({
-  bin = "claude",
-  env: env2 = process.env,
-  exists = existsSync8,
-  canonicalize = realpathSync
-} = {}) {
-  const requested = String(bin || "").trim();
-  if (!requested || requested.includes("\0")) {
-    throw new TypeError("Claude executable must be a non-empty path without NUL bytes");
-  }
-  for (const candidate of pathCandidates(requested, env2)) {
-    const found = canonicalExistingPath(candidate, exists, canonicalize);
-    if (!found) continue;
-    if (path12.extname(found).toLowerCase() === ".exe") return found;
-    const native = path12.join(path12.dirname(found), ...NATIVE_CLAUDE_PARTS);
-    const resolvedNative = canonicalExistingPath(native, exists, canonicalize);
-    if (resolvedNative) return resolvedNative;
-  }
-  const error = new Error(
-    `Could not resolve a native claude.exe for "${requested}". Install or update Claude Code with the native Windows installer (recommended) or npm install -g @anthropic-ai/claude-code; the HQ runner will not execute a shell-only .cmd/.ps1 shim.`
-  );
-  error.code = "ENOENT";
-  throw error;
-}
-function buildWindowsClaudeLaunch({
-  bin = "claude",
-  args = [],
-  env: env2 = process.env
-} = {}) {
-  return {
-    bin: resolveWindowsClaudeExecutable({ bin, env: env2 }),
-    args: Array.from(args, (value) => String(value)),
-    spawnOptions: {
-      shell: false,
-      windowsHide: true,
-      windowsVerbatimArguments: false
+     * Read the operator's dispatch-mode config (Fast→Ultracode effort setting).
+     * Returns the mode string ('fast'|'standard'|'deep'|'ultra'|'marathon'; 'ultracode' legacy),
+     * defaulting to 'standard' on any error. Never throws — best-effort.
+     */
+    async getDispatchMode() {
+      try {
+        const res = await taskReq("GET", "/api/v1/dispatch-mode-config");
+        if (!res.ok) return "standard";
+        const json = await res.json();
+        return json?.dispatchMode || "standard";
+      } catch {
+        return "standard";
+      }
     }
   };
 }
-function spawnClaudeSync(args = [], options = {}) {
-  if (process.platform !== "win32") {
-    return spawnSync("claude", args, { windowsHide: true, ...options });
-  }
-  try {
-    const launch = buildWindowsClaudeLaunch({
-      bin: "claude",
-      args,
-      env: options.env || process.env
-    });
-    return spawnSync(launch.bin, launch.args, {
-      ...options,
-      ...launch.spawnOptions
-    });
-  } catch (error) {
-    return {
-      error,
-      status: null,
-      signal: null,
-      output: null,
-      stdout: null,
-      stderr: null
-    };
-  }
-}
-var NATIVE_CLAUDE_PARTS;
-var init_windows_claude_launch = __esm({
-  "../../scripts/virtual-office/code-runner/windows-claude-launch.mjs"() {
-    "use strict";
-    NATIVE_CLAUDE_PARTS = [
-      "node_modules",
-      "@anthropic-ai",
-      "claude-code",
-      "bin",
-      "claude.exe"
-    ];
-  }
-});
-
-// ../../scripts/virtual-office/code-runner/claude-credential-choice.mjs
-function isTruthyFlag(v) {
-  const s = String(v ?? "").trim().toLowerCase();
-  return s === "1" || s === "true" || s === "yes" || s === "on";
-}
-function wantsLogin(env2) {
-  return isTruthyFlag(env2[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env2[PREFER_LOGIN_ENV]);
-}
-function wantsKey(env2) {
-  return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
-}
-function classifyClaudeCredential(baseEnv = {}, { getKey, probeLogin } = {}) {
-  const preferKey = wantsKey(baseEnv);
-  if (!preferKey && wantsLogin(baseEnv)) {
-    return { source: CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN, key: null };
-  }
-  if (baseEnv.ANTHROPIC_API_KEY) {
-    return { source: CLAUDE_CREDENTIAL_SOURCE.ENV_KEY, key: null };
-  }
-  const key = getKey();
-  if (!key) {
-    return { source: CLAUDE_CREDENTIAL_SOURCE.NO_KEY, key: null };
-  }
-  if (preferKey) {
-    return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY, key };
-  }
-  if (probeLogin() === true) {
-    return { source: CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS, key: null };
-  }
-  return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN, key };
-}
-var PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, PREFER_KEY_ENV, CLAUDE_PREFER_KEY_ENV, CLAUDE_CREDENTIAL_SOURCE;
-var init_claude_credential_choice = __esm({
-  "../../scripts/virtual-office/code-runner/claude-credential-choice.mjs"() {
-    "use strict";
-    PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
-    CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
-    PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
-    CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
-    CLAUDE_CREDENTIAL_SOURCE = Object.freeze({
-      /** PREFER_LOGIN set (and not overridden): any API key is ignored. */
-      PREFER_LOGIN: "prefer_login",
-      /** An explicit ANTHROPIC_API_KEY in the environment — the manual override. */
-      ENV_KEY: "env_key",
-      /** No key anywhere; the spawn falls through to the login session. */
-      NO_KEY: "no_key",
-      /** A stored key, used because the operator explicitly opted out of tier 1. */
-      KEYCHAIN_PREFER_KEY: "keychain_prefer_key",
-      /** A stored key exists but a proven live subscription outranks it. */
-      SUBSCRIPTION_WINS: "subscription_wins",
-      /** A stored key, used because no live subscription was proven. */
-      KEYCHAIN: "keychain"
-    });
-  }
-});
-
-// ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
-import { createRequire as createRequire2 } from "node:module";
-import { spawnSync as spawnSync2 } from "node:child_process";
-function defaultEntryCtor() {
-  if (_loadTried) return _entryCtor;
-  _loadTried = true;
-  try {
-    _entryCtor = require2("@napi-rs/keyring").Entry;
-  } catch {
-    _entryCtor = null;
-  }
-  return _entryCtor;
-}
-function getAnthropicKey({ EntryCtor = defaultEntryCtor() } = {}) {
-  if (!EntryCtor) return null;
-  try {
-    return new EntryCtor(KEY_SERVICE, KEY_ACCOUNT).getPassword() || null;
-  } catch {
-    return null;
-  }
-}
-function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  const { source, key } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
-  const next = { ...baseEnv };
-  if (source === CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN) {
-    delete next.ANTHROPIC_API_KEY;
-    return next;
-  }
-  if (key !== null) next.ANTHROPIC_API_KEY = key;
-  return next;
-}
-function claudeCostBasis(env2 = process.env) {
-  return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
-}
-function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  const { source } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
-  return AUTH_SOURCE_DESCRIPTION[source];
-}
-function augmentAuthError(summary) {
-  const s = String(summary ?? "");
-  if (!AUTH_ERROR_RE.test(s)) return s;
-  return `${s}
-\u21B3 Anthropic auth failed on the runner. The \`claude\` CLI is a SEPARATE install/login from the Claude Desktop app and the Claude Code IDE extension \u2014 signing into those does NOT authenticate it. Fix: run \`claude auth login\` (Claude subscription) on the runner machine, or clear any stale ANTHROPIC_API_KEY (env / OS keychain / .env.local) and set VO_RUNNER_PREFER_LOGIN=1 \u2014 then restart the runner. Verify with \`claude -p "say hi"\`.`;
-}
-function probeClaudeLoginState({
-  spawn: spawn5 = spawnSync2,
-  buildWindowsLaunch = buildWindowsClaudeLaunch,
-  platform: platform4 = process.platform
-} = {}) {
-  try {
-    const launch = platform4 === "win32" ? buildWindowsLaunch({ bin: "claude", args: ["auth", "status"] }) : { bin: "claude", args: ["auth", "status"], spawnOptions: { windowsHide: true } };
-    const st = spawn5(launch.bin, launch.args, { ...launch.spawnOptions, timeout: 5e3, encoding: "utf8" });
-    const parsed = JSON.parse(String(st.stdout || "").trim() || "{}");
-    return typeof parsed.loggedIn === "boolean" ? parsed.loggedIn : null;
-  } catch {
-    return null;
-  }
-}
-var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, AUTH_SOURCE_DESCRIPTION, AUTH_ERROR_RE;
-var init_anthropic_key_store = __esm({
-  "../../scripts/virtual-office/code-runner/anthropic-key-store.mjs"() {
+var cachedFirebaseToken, ClaimAuthorityChangedError;
+var init_control_plane_client = __esm({
+  "../../scripts/virtual-office/code-runner/control-plane-client.mjs"() {
     "use strict";
-    init_windows_claude_launch();
-    init_claude_credential_choice();
-    init_claude_credential_choice();
-    require2 = createRequire2(import.meta.url);
-    KEY_SERVICE = "algosuite-vo";
-    KEY_ACCOUNT = "anthropic-api-key";
-    _loadTried = false;
-    AUTH_SOURCE_DESCRIPTION = Object.freeze({
-      [CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN]: "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)",
-      [CLAUDE_CREDENTIAL_SOURCE.ENV_KEY]: "ANTHROPIC_API_KEY from environment",
-      [CLAUDE_CREDENTIAL_SOURCE.NO_KEY]: "claude auth login session (no API key set)",
-      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY]: "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)",
-      [CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS]: "claude auth login session (subscription beats the stored keychain key)",
-      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN]: "ANTHROPIC_API_KEY from OS keychain"
-    });
-    AUTH_ERROR_RE = /\b401\b|invalid[^.]{0,24}(authentication|credential)|authentication_error|unauthorized|not[ _-]?authenticated/i;
+    init_installation_token();
+    init_control_plane_heartbeat_body();
+    init_control_plane_promote();
+    init_control_plane_task_list();
+    init_control_plane_resume();
+    init_control_plane_autonomous_admission();
+    init_control_plane_merge();
+    init_control_plane_weekly_tokens();
+    init_control_plane_telemetry_relay();
+    init_claim_gate_notice();
+    init_agent_auth_attestation();
+    init_control_plane_knowledge_context();
+    init_control_plane_prepared_job();
+    cachedFirebaseToken = null;
+    ClaimAuthorityChangedError = class extends Error {
+      constructor() {
+        super("code-task claim authority changed");
+        this.name = "ClaimAuthorityChangedError";
+        this.code = "code_task_claim_authority_changed";
+      }
+    };
   }
 });
 
@@ -4907,7 +4993,7 @@ function normalizeClaudePermissionMode(value) {
   }
   return normalized;
 }
-function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", env: env2 = process.env } = {}) {
+function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", structuredOutputSchema, env: env2 = process.env } = {}) {
   const effectivePermissionMode = normalizeClaudePermissionMode(permissionMode);
   if (!["default", "skill_readonly", "frozen_inputs_only"].includes(toolPolicy)) {
     throw new Error(`unsupported Claude tool policy "${toolPolicy}"`);
@@ -4945,6 +5031,12 @@ function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, m
       "none"
     );
   }
+  if (structuredOutputSchema !== void 0) {
+    if (!restrictedSkill || !structuredOutputSchema || typeof structuredOutputSchema !== "object" || Array.isArray(structuredOutputSchema)) {
+      throw new Error("structured output schema is allowed only for a restricted skill");
+    }
+    args.push("--json-schema", JSON.stringify(structuredOutputSchema));
+  }
   if (frozenInputsOnly) {
     args.push("--strict-mcp-config", "--safe-mode");
   }
@@ -5370,13 +5462,15 @@ function cappedRunLastMessage(evt, lastProgress) {
   return salvage;
 }
 function buildResultEvent(evt) {
-  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_turns" || evt.subtype === "error_during_execution";
+  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_budget_usd" || evt.subtype === "error_max_turns" || evt.subtype === "error_max_structured_output_retries" || evt.subtype === "error_during_execution";
   return {
     kind: "result",
     isError,
     costUsd: typeof evt.total_cost_usd === "number" ? evt.total_cost_usd : null,
     summary: typeof evt.result === "string" && evt.result.length > 0 ? evt.result : evt.subtype || (isError ? "error" : "completed"),
+    terminalSubtype: typeof evt.subtype === "string" ? evt.subtype : null,
     numTurns: typeof evt.num_turns === "number" ? evt.num_turns : null,
+    structuredOutput: Object.hasOwn(evt, "structured_output") ? evt.structured_output : null,
     tokenUsage: extractTokenUsage(evt),
     modelUsage: extractModelUsage(evt)
   };
@@ -5515,8 +5609,150 @@ var MIN_CLAUDE_CLI_VERSION, SECURITY_RATIONALE;
 var init_cli_version_floor = __esm({
   "../../scripts/virtual-office/code-runner/cli-version-floor.mjs"() {
     "use strict";
-    MIN_CLAUDE_CLI_VERSION = "2.1.218";
-    SECURITY_RATIONALE = "Claude Code 2.1.211/2.1.213 fixed a PreToolUse-hook bypass on unsandboxed Bash (our destructive-fs/git/cloud tripwires DO NOT FIRE on older CLIs) and worktree-subagents mutating the main checkout. 2.1.218 fixed Windows paths with a lowercase-\\u segment (e.g. ...\\utils\\, ...\\ui\\) being corrupted into CJK in tool inputs, making those files silently inaccessible \u2014 the fleet is Windows and 1,376 tracked files sit under utils/ alone. Update: npm install -g @anthropic-ai/claude-code (or the native installer).";
+    MIN_CLAUDE_CLI_VERSION = "2.1.218";
+    SECURITY_RATIONALE = "Claude Code 2.1.211/2.1.213 fixed a PreToolUse-hook bypass on unsandboxed Bash (our destructive-fs/git/cloud tripwires DO NOT FIRE on older CLIs) and worktree-subagents mutating the main checkout. 2.1.218 fixed Windows paths with a lowercase-\\u segment (e.g. ...\\utils\\, ...\\ui\\) being corrupted into CJK in tool inputs, making those files silently inaccessible \u2014 the fleet is Windows and 1,376 tracked files sit under utils/ alone. Update: npm install -g @anthropic-ai/claude-code (or the native installer).";
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/claude-skill-capability.mjs
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { accessSync, constants, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import path14 from "node:path";
+function hasOption(help, option) {
+  const literal = option.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return new RegExp(`(^|\\s)${literal}(?=\\s|,|=|<|$)`, "mu").test(help);
+}
+function assessClaudeSkillCapability({ versionOutput, helpOutput }) {
+  const version = parseCliVersion(versionOutput);
+  if (!version || !VALIDATED_CLAUDE_SKILL_VERSIONS.includes(version)) {
+    return { compatible: false, version, reason: "claude version is not in the validated restricted-skill manifest" };
+  }
+  const help = String(helpOutput ?? "");
+  const missing = REQUIRED_CLAUDE_SKILL_HELP.filter((option) => !hasOption(help, option));
+  if (missing.length > 0) {
+    return { compatible: false, version, reason: `claude help is missing required options: ${missing.join(", ")}` };
+  }
+  if (!/--permission-prompts[\s\S]{0,300}(?:"none"|\bnone\b)/mu.test(help) || !/--output-format[\s\S]{0,300}\bstream-json\b/mu.test(help)) {
+    return { compatible: false, version, reason: "claude help does not prove required none/stream-json values" };
+  }
+  return { compatible: true, version, reason: "validated restricted-skill CLI contract" };
+}
+function runProbe(bin, args, env2, timeoutMs = PROBE_TIMEOUT_MS) {
+  if (process.platform === "win32") {
+    try {
+      const launch = buildWindowsClaudeLaunch({ bin, args, env: env2 });
+      return spawnSync6(launch.bin, launch.args, {
+        ...launch.spawnOptions,
+        env: env2,
+        encoding: "utf8",
+        timeout: timeoutMs
+      });
+    } catch (error) {
+      return { status: null, stdout: "", stderr: "", error };
+    }
+  }
+  return spawnSync6(bin, args, { env: env2, encoding: "utf8", timeout: timeoutMs, windowsHide: true });
+}
+function probeText(probe) {
+  return `${String(probe?.stdout ?? "")}
+${String(probe?.stderr ?? "")}`.trim();
+}
+function resolveClaudeBinaryIdentity(bin = "claude", env2 = process.env) {
+  let resolvedBin = String(bin);
+  try {
+    if (process.platform === "win32") {
+      resolvedBin = buildWindowsClaudeLaunch({ bin: resolvedBin, args: [], env: env2 }).bin;
+    } else if (!path14.isAbsolute(resolvedBin)) {
+      const found = String(env2?.PATH ?? "").split(path14.delimiter).find((dir) => {
+        try {
+          accessSync(path14.join(dir, resolvedBin), constants.X_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+      if (found) resolvedBin = path14.join(found, resolvedBin);
+    }
+    const canonical = realpathSync2(resolvedBin);
+    const stat3 = statSync4(canonical);
+    return { resolvedBin: canonical, fingerprint: `${canonical}\0${stat3.size}\0${stat3.mtimeMs}` };
+  } catch {
+    const pathValue2 = String(env2?.PATH ?? env2?.Path ?? "");
+    return { resolvedBin, fingerprint: `${resolvedBin}\0${pathValue2}` };
+  }
+}
+function probeClaudeSkillCapability({
+  bin = "claude",
+  env: env2 = process.env,
+  versionOutput,
+  spawnProbe = runProbe,
+  now = () => Date.now(),
+  cacheTtlMs = CACHE_TTL_MS,
+  timeoutMs = PROBE_TIMEOUT_MS,
+  freshIdentity = false,
+  resolveIdentity = resolveClaudeBinaryIdentity
+} = {}) {
+  const identity = resolveIdentity(bin, env2);
+  const key = identity.fingerprint;
+  const existing = cache.get(key);
+  if (!freshIdentity && versionOutput === void 0 && existing && now() - existing.at < cacheTtlMs) {
+    return existing.value;
+  }
+  const versionProbe = freshIdentity || versionOutput === void 0 ? spawnProbe(identity.resolvedBin, ["--version"], env2, timeoutMs) : null;
+  if (versionProbe?.error || versionProbe && versionProbe.status !== 0) {
+    return {
+      compatible: false,
+      version: null,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude version capability probe failed"
+    };
+  }
+  const effectiveVersionOutput = versionProbe ? probeText(versionProbe) : versionOutput;
+  const suppliedVersion = parseCliVersion(effectiveVersionOutput);
+  if (existing && now() - existing.at < cacheTtlMs && suppliedVersion === existing.value.version) {
+    return existing.value;
+  }
+  const helpProbe = spawnProbe(identity.resolvedBin, ["--help"], env2, timeoutMs);
+  if (helpProbe?.error || helpProbe?.status !== 0) {
+    return {
+      compatible: false,
+      version: suppliedVersion,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude help capability probe failed"
+    };
+  }
+  const assessed = assessClaudeSkillCapability({
+    versionOutput: effectiveVersionOutput,
+    helpOutput: probeText(helpProbe)
+  });
+  const value = { ...assessed, resolvedBin: identity.resolvedBin };
+  cache.set(key, { at: now(), value });
+  return value;
+}
+var VALIDATED_CLAUDE_SKILL_VERSIONS, REQUIRED_CLAUDE_SKILL_HELP, PROBE_TIMEOUT_MS, CACHE_TTL_MS, cache;
+var init_claude_skill_capability = __esm({
+  "../../scripts/virtual-office/code-runner/claude-skill-capability.mjs"() {
+    "use strict";
+    init_cli_version_floor();
+    init_windows_claude_launch();
+    VALIDATED_CLAUDE_SKILL_VERSIONS = Object.freeze(["2.1.263"]);
+    REQUIRED_CLAUDE_SKILL_HELP = Object.freeze([
+      "--allowedTools",
+      "--disable-slash-commands",
+      "--json-schema",
+      "--max-budget-usd",
+      "--no-chrome",
+      "--no-session-persistence",
+      "--output-format",
+      "--permission-mode",
+      "--permission-prompts",
+      "--safe-mode",
+      "--strict-mcp-config",
+      "--tools"
+    ]);
+    PROBE_TIMEOUT_MS = 2e3;
+    CACHE_TTL_MS = 5 * 60 * 1e3;
+    cache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -5546,9 +5782,12 @@ async function checkClaudeAuth({
   spawnVersion = spawnClaudeSync,
   probeLogin = probeClaudeLoginState,
   getStoredKey = getAnthropicKey,
-  env: env2 = process.env
+  probeSkillCapability = probeClaudeSkillCapability,
+  env: env2 = process.env,
+  now = () => Date.now()
 } = {}) {
   try {
+    const startedAt = now();
     let probe = spawnVersion(["--version"], {
       timeout: FIRST_VERSION_TIMEOUT_MS,
       encoding: "utf8",
@@ -5582,23 +5821,40 @@ async function checkClaudeAuth({
     }
     const floorGate = applyCliVersionFloor({ versionOutput: probe.stdout, env: env2 });
     if (floorGate.refused) {
-      return { installed: true, authenticated: false, message: floorGate.message };
+      return {
+        installed: true,
+        authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
+        message: floorGate.message
+      };
     }
     const loggedIn = retriedAfterTimeout ? null : probeLogin();
     if (loggedIn === false) {
       return {
         installed: true,
         authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
         message: "claude CLI is installed but NOT logged in \u2014 its login is SEPARATE from the Claude Desktop app and the Claude Code IDE extension. Run: claude auth login (Claude subscription), then restart the runner."
       };
     }
+    const authTier = resolveClaudeAuthTier({ env: env2, loggedIn, getStoredKey });
+    const remainingMs = AUTH_PROBE_BUDGET_MS - (now() - startedAt);
+    const skillCapability = loggedIn === true && remainingMs >= MIN_SKILL_PROBE_MS ? probeSkillCapability({
+      versionOutput: probe.stdout,
+      env: env2,
+      timeoutMs: Math.min(2e3, remainingMs)
+    }) : { compatible: false };
     return {
       installed: true,
       authenticated: true,
+      version: floorGate.check.version ?? void 0,
+      skillCapable: skillCapability.compatible === true,
       // Dispatch-time billing signal, carried on the same probe that already
       // paid for the login read. Never sent for a non-authenticated result:
       // there is no tier without a working credential.
-      authTier: resolveClaudeAuthTier({ env: env2, loggedIn, getStoredKey }),
+      authTier,
       message: loggedIn === true ? "claude CLI installed and logged in (claude auth status)" : "claude binary found (login state unknown \u2014 auth check is best-effort)"
     };
   } catch (error) {
@@ -5609,7 +5865,7 @@ async function checkClaudeAuth({
     };
   }
 }
-var FIRST_VERSION_TIMEOUT_MS, RETRY_VERSION_TIMEOUT_MS;
+var FIRST_VERSION_TIMEOUT_MS, RETRY_VERSION_TIMEOUT_MS, AUTH_PROBE_BUDGET_MS, MIN_SKILL_PROBE_MS;
 var init_claude_auth_check = __esm({
   "../../scripts/virtual-office/code-runner/claude-auth-check.mjs"() {
     "use strict";
@@ -5617,8 +5873,11 @@ var init_claude_auth_check = __esm({
     init_agent_auth_tier();
     init_cli_version_floor();
     init_windows_claude_launch();
+    init_claude_skill_capability();
     FIRST_VERSION_TIMEOUT_MS = 4500;
     RETRY_VERSION_TIMEOUT_MS = 2e3;
+    AUTH_PROBE_BUDGET_MS = 9500;
+    MIN_SKILL_PROBE_MS = 250;
   }
 });
 
@@ -5639,6 +5898,7 @@ function runAgentTask({
   maxBudgetUsd = null,
   researchHarness = false,
   toolPolicy = "default",
+  structuredOutputSchema,
   env: env2 = process.env,
   onProgress = () => {
   },
@@ -5653,11 +5913,14 @@ function runAgentTask({
   exitDrainGraceMs = 300,
   armTerminalCleanup = armTerminalProcessCleanup,
   spawnImpl = spawn2,
-  sandbox = null
+  sandbox = null,
+  allowApiBilling = false
 }) {
   return new Promise((resolve3) => {
-    const args = runner.buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, prompt });
-    const spawnEnv = typeof runner.applyAuthEnv === "function" ? runner.applyAuthEnv(env2) : env2;
+    const args = runner.buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema, prompt });
+    const authedEnv = typeof runner.applyAuthEnv === "function" ? runner.applyAuthEnv(env2) : env2;
+    const billing = applyApiBillingPolicy(authedEnv, { runnerEnv: env2, allowApiBilling });
+    const spawnEnv = billing.env;
     const costBasis = typeof runner.costBasis === "function" ? runner.costBasis(spawnEnv) : "unknown";
     if (costBasis === "vendor_billed" && runner.enforcesBudgetCap !== true && env2.VO_CODE_RUNNER_ALLOW_UNCAPPED_VENDOR_BILLED !== "1") {
       throw new Error(
@@ -5701,7 +5964,7 @@ function runAgentTask({
     } catch {
     }
     let buffer = "";
-    let result = { ok: false, costUsd: null, costBasis, summary: "", lastAgentMessage: null, numTurns: null, tokenUsage: null, modelUsage: null, executionStarted: false, killed: false };
+    let result = { ok: false, costUsd: null, costBasis, summary: "", lastAgentMessage: null, structuredOutput: null, terminalSubtype: null, numTurns: null, tokenUsage: null, modelUsage: null, executionStarted: false, killed: false, agentAuthSource: billing.agent_auth_source };
     child.once("spawn", () => {
       result = { ...result, executionStarted: true };
       Promise.resolve(onSpawn()).catch(() => {
@@ -5739,6 +6002,8 @@ function runAgentTask({
         // A budget/turn-capped run's honest last message, kept OUT of summary (see
         // claude-result-event.cappedRunLastMessage) and surfaced in the PR body.
         lastAgentMessage: cappedRunLastMessage(evt, lastProgress),
+        structuredOutput: Object.hasOwn(evt, "structuredOutput") ? evt.structuredOutput : result.structuredOutput,
+        terminalSubtype: Object.hasOwn(evt, "terminalSubtype") ? evt.terminalSubtype : result.terminalSubtype,
         numTurns: evt.numTurns,
         // MUST be listed explicitly. This assignment spreads the PREVIOUS
         // result and then names each field it carries forward, so anything
@@ -5820,7 +6085,9 @@ function runAgentTask({
         hardKill();
         return;
       }
-      if (decision.delayMs != null) wallTimer = setTimeout(armDeadline, decision.delayMs);
+      if (decision.delayMs !== null && decision.delayMs !== void 0) {
+        wallTimer = setTimeout(armDeadline, decision.delayMs);
+      }
     };
     armDeadline();
     child.stdout.on("data", (chunk) => {
@@ -5881,6 +6148,8 @@ var init_claude_runner = __esm({
     init_claude_stream_event();
     init_claude_result_event();
     init_claude_auth_check();
+    init_claude_skill_capability();
+    init_agent_auth_attestation();
     ClaudeRunner = class {
       get enforcesBudgetCap() {
         return true;
@@ -5888,8 +6157,8 @@ var init_claude_runner = __esm({
       get binary() {
         return "claude";
       }
-      buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy } = {}) {
-        return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy });
+      buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema } = {}) {
+        return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema });
       }
       parseEvent(line) {
         return parseStreamEvent(line);
@@ -5913,6 +6182,9 @@ var init_claude_runner = __esm({
       async checkAuth() {
         return checkClaudeAuth();
       }
+      checkSkillCapability({ bin = this.binary, env: env2 = process.env } = {}) {
+        return probeClaudeSkillCapability({ bin, env: env2, freshIdentity: true });
+      }
     };
     claudeRunner = new ClaudeRunner();
   }
@@ -6096,10 +6368,10 @@ var init_error_message = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/codex-runner.mjs
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { existsSync as existsSync10 } from "node:fs";
 import { win32 as win322 } from "node:path";
-function isTruthyFlag2(value) {
+function isTruthyFlag3(value) {
   return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
 }
 function resolveCodexBinary({
@@ -6211,7 +6483,7 @@ var init_codex_runner = __esm({
     CODEX_PREFER_LOGIN_ENV = "VO_RUNNER_CODEX_PREFER_LOGIN";
     LEGACY_PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
     CodexRunner = class {
-      constructor({ spawn: spawn5 = spawnSync6, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
+      constructor({ spawn: spawn5 = spawnSync7, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
         this.spawn = spawn5;
         this.resolveBinary = resolveBinary;
         this.env = env2;
@@ -6250,7 +6522,7 @@ var init_codex_runner = __esm({
         };
       }
       applyAuthEnv(env2 = process.env) {
-        if (isTruthyFlag2(env2[CODEX_PREFER_LOGIN_ENV]) || isTruthyFlag2(env2[LEGACY_PREFER_LOGIN_ENV])) {
+        if (isTruthyFlag3(env2[CODEX_PREFER_LOGIN_ENV]) || isTruthyFlag3(env2[LEGACY_PREFER_LOGIN_ENV])) {
           const out = { ...env2 };
           delete out.OPENAI_API_KEY;
           delete out.CODEX_API_KEY;
@@ -6324,7 +6596,7 @@ ${login.stderr || ""}`.trim();
 });
 
 // ../../scripts/virtual-office/code-runner/cursor-runner.mjs
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 function buildCursorArgs({ model, prompt } = {}) {
   const args = ["-p", "--output-format", "stream-json", "--force"];
   if (model) {
@@ -6436,7 +6708,7 @@ var init_cursor_runner = __esm({
       /** Best-effort: is `cursor-agent` on PATH? Never throws. */
       async checkAuth() {
         try {
-          const { status, error } = spawnSync7("cursor-agent", ["--version"], {
+          const { status, error } = spawnSync8("cursor-agent", ["--version"], {
             shell: false,
             windowsHide: true,
             timeout: 3e3,
@@ -7155,9 +7427,9 @@ var init_rate_limit_detector_core = __esm({
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-state.mjs
 import fsp10 from "node:fs/promises";
-import path14 from "node:path";
+import path15 from "node:path";
 async function atomicWrite(file, content) {
-  await fsp10.mkdir(path14.dirname(file), { recursive: true });
+  await fsp10.mkdir(path15.dirname(file), { recursive: true });
   const temp = `${file}.tmp-${process.pid}-${Date.now()}`;
   const handle = await fsp10.open(temp, "wx");
   try {
@@ -7218,7 +7490,7 @@ function writeResumeAttempts(file, store) {
 }
 async function acquireLock(lockFile, { now = Date.now, sleep: sleep3 = delay } = {}) {
   const deadline = now() + LOCK_WAIT_MS;
-  await fsp10.mkdir(path14.dirname(lockFile), { recursive: true });
+  await fsp10.mkdir(path15.dirname(lockFile), { recursive: true });
   for (; ; ) {
     let handle;
     try {
@@ -7522,7 +7794,7 @@ var init_auto_merge = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
 import { dirname as dirname6, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -7688,14 +7960,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const token2 = tokens[i];
     if (!token2) continue;
-    const path23 = token2.slice(3);
-    if (path23) files.push(path23);
+    const path24 = token2.slice(3);
+    if (path24) files.push(path24);
     if (token2[0] === "R" || token2[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path23) {
-  const normalized = String(path23 || "");
+function isAgentScratch(path24) {
+  const normalized = String(path24 || "");
   return SCRATCH_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 var SCRATCH_PATTERNS;
@@ -7713,7 +7985,7 @@ var init_publish_file_state = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/publish.mjs
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function isMaxTurnsResult(summary) {
   return /(^|[^a-z])error[-_ ]?max[-_ ]?turns([^a-z]|$)|max[-_ ]?turns/i.test(String(summary || ""));
 }
@@ -7952,7 +8224,7 @@ var init_executor = __esm({
 
 // ../../scripts/virtual-office/code-runner/test-gen-gate.mjs
 import fs7 from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 async function postFailed(client, id, message, result) {
   try {
     await client.postProgress(id, {
@@ -7988,7 +8260,7 @@ async function gateTestGenTaskOrFail({ client, id, task, files, worktreeDir, env
   }
   let testSource = "";
   try {
-    testSource = fs7.readFileSync(path15.join(worktreeDir, testFile), "utf8");
+    testSource = fs7.readFileSync(path16.join(worktreeDir, testFile), "utf8");
   } catch (err) {
     await postFailed(client, id, `could not read generated test ${testFile}: ${err.message}`, "gate_test_unreadable");
     return true;
@@ -8038,7 +8310,7 @@ var init_test_gen_gate = __esm({
 // ../../scripts/virtual-office/code-runner/completion-gate.mjs
 import { execFile } from "node:child_process";
 import fs8 from "node:fs";
-import path16 from "node:path";
+import path17 from "node:path";
 function resolveCompletionGate(task) {
   const raw = task?.completion_gate;
   if (raw === void 0 || raw === null) return null;
@@ -8076,14 +8348,14 @@ function workspaceFingerprint(worktreeDir, execFileImpl = execFile) {
 }
 function readState(worktreeDir) {
   try {
-    return JSON.parse(fs8.readFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
+    return JSON.parse(fs8.readFileSync(path17.join(worktreeDir, COMPLETION_GATE_STATE_FILE), "utf8"));
   } catch {
     return null;
   }
 }
 function writeState(worktreeDir, state) {
   try {
-    fs8.writeFileSync(path16.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
+    fs8.writeFileSync(path17.join(worktreeDir, COMPLETION_GATE_STATE_FILE), `${JSON.stringify(state)}
 `, "utf8");
   } catch {
   }
@@ -9221,7 +9493,7 @@ var init_headless_execution_contract = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
-import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync5 } from "node:fs";
 import { dirname as dirname7, join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
@@ -9243,12 +9515,12 @@ function parseFrontmatterNameDescription(raw) {
 }
 function isRepoCheckout(dir) {
   try {
-    if (!statSync4(join10(dir, ".claude", "skills")).isDirectory()) return false;
+    if (!statSync5(join10(dir, ".claude", "skills")).isDirectory()) return false;
   } catch {
     return false;
   }
   try {
-    statSync4(join10(dir, ".git"));
+    statSync5(join10(dir, ".git"));
     return true;
   } catch {
     return false;
@@ -9274,7 +9546,7 @@ function loadSkillCatalog({ repoRoot: repoRoot2 = resolveDefaultRepoRoot() } = {
     for (const entry of readdirSync3(skillsDir)) {
       const dir = join10(skillsDir, entry);
       try {
-        if (!statSync4(dir).isDirectory()) continue;
+        if (!statSync5(dir).isDirectory()) continue;
         const parsed = parseFrontmatterNameDescription(
           readFileSync8(join10(dir, "SKILL.md"), "utf8")
         );
@@ -9804,7 +10076,7 @@ var init_task_prompt = __esm({
 import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path17 from "node:path";
+import path18 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -9817,9 +10089,9 @@ function hasGeneratedPrefix(name) {
   return name.startsWith(DIRECTORY_PREFIX) || name.startsWith(LEGACY_DIRECTORY_PREFIX);
 }
 function assertGeneratedDirectory(directory, containmentRoot) {
-  const resolvedDirectory = path17.resolve(directory);
-  const resolvedRoot = path17.resolve(containmentRoot);
-  if (path17.dirname(resolvedDirectory) !== resolvedRoot || !hasGeneratedPrefix(path17.basename(resolvedDirectory))) {
+  const resolvedDirectory = path18.resolve(directory);
+  const resolvedRoot = path18.resolve(containmentRoot);
+  if (path18.dirname(resolvedDirectory) !== resolvedRoot || !hasGeneratedPrefix(path18.basename(resolvedDirectory))) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
@@ -9828,7 +10100,7 @@ async function resolveContainmentRoot(worktreeDir) {
   if (typeof worktreeDir !== "string" || !worktreeDir.trim()) {
     throw new Error("refusing to materialize task attachments outside an agent-readable worktree: no worktreeDir given");
   }
-  const root = path17.resolve(worktreeDir);
+  const root = path18.resolve(worktreeDir);
   const stats = await stat(root).catch(() => null);
   if (!stats?.isDirectory()) {
     throw new Error(`refusing to materialize task attachments: agent worktree root is not a directory (${root})`);
@@ -9837,15 +10109,15 @@ async function resolveContainmentRoot(worktreeDir) {
 }
 async function createAttachmentDirectory(taskId, containmentRoot) {
   const root = await resolveContainmentRoot(containmentRoot);
-  const directory = await mkdtemp(path17.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const directory = await mkdtemp(path18.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
   const [realRoot, realDirectory] = await Promise.all([realpath(root), realpath(directory)]);
-  if (path17.dirname(realDirectory) !== realRoot) {
+  if (path18.dirname(realDirectory) !== realRoot) {
     await rm(directory, { recursive: true, force: true }).catch(() => void 0);
     throw new Error("task-attachment directory escaped the agent worktree root");
   }
-  await writeFile(path17.join(directory, GITIGNORE_FILE), GITIGNORE_BODY, { encoding: "utf8", mode: 384 });
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID4(), directory: path17.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path17.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  await writeFile(path18.join(directory, GITIGNORE_FILE), GITIGNORE_BODY, { encoding: "utf8", mode: 384 });
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID4(), directory: path18.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path18.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, root, cleaned: false };
 }
 async function cleanupGeneratedDirectory(state) {
@@ -9859,7 +10131,7 @@ async function cleanupGeneratedDirectory(state) {
     state.cleaned = true;
     return;
   }
-  const marker = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path18.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -9878,7 +10150,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path17.resolve(tempRoot);
+  const root = path18.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -9887,8 +10159,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !hasGeneratedPrefix(entry.name)) continue;
-    const directory = assertGeneratedDirectory(path17.join(root, entry.name), root);
-    const markerRaw = await readFile(path17.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path18.join(root, entry.name), root);
+    const markerRaw = await readFile(path18.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -9945,8 +10217,8 @@ async function materializeTaskAttachments(client, task, { worktreeDir } = {}) {
       const sha2562 = createHash5("sha256").update(content).digest("hex");
       if (sha2562 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path17.resolve(state.directory, name);
-      if (path17.dirname(filePath) !== state.directory) throw new Error(`attachment ${ref.attachment_id} resolved outside its task directory`);
+      const filePath = path18.resolve(state.directory, name);
+      if (path18.dirname(filePath) !== state.directory) throw new Error(`attachment ${ref.attachment_id} resolved outside its task directory`);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
       files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256: sha2562, path: filePath });
@@ -10031,9 +10303,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path23) {
+async function readCloudMap(path24) {
   try {
-    return JSON.parse(await readFile2(path23, "utf8"));
+    return JSON.parse(await readFile2(path24, "utf8"));
   } catch {
     return {};
   }
@@ -10334,9 +10606,9 @@ function backoffMs(streak, baseMs) {
   if (streak <= 0) return 0;
   return Math.min(baseMs * 2 ** Math.min(streak - 1, 20), MAX_BACKOFF_MS);
 }
-async function loadState(path23) {
+async function loadState(path24) {
   try {
-    const parsed = JSON.parse(await readFile3(path23, "utf8"));
+    const parsed = JSON.parse(await readFile3(path24, "utf8"));
     if (parsed && typeof parsed === "object" && Number.isInteger(parsed.byte_offset) && parsed.byte_offset >= 0) {
       return { ...parsed, byte_offset: parsed.byte_offset };
     }
@@ -10344,15 +10616,15 @@ async function loadState(path23) {
   }
   return { byte_offset: 0, last_event_id: null, forwarded_total: 0, rejected_total: 0, rejected_event_ids: [] };
 }
-async function saveState(path23, state) {
-  await mkdir2(dirname9(path23), { recursive: true });
-  await writeFile3(path23, JSON.stringify(state, null, 2), "utf8");
+async function saveState(path24, state) {
+  await mkdir2(dirname9(path24), { recursive: true });
+  await writeFile3(path24, JSON.stringify(state, null, 2), "utf8");
 }
-async function readNewBytes(path23, offset, max) {
-  const st = await stat2(path23);
+async function readNewBytes(path24, offset, max) {
+  const st = await stat2(path24);
   if (st.size <= offset) return { buf: Buffer.alloc(0), size: st.size };
   const length = Math.min(st.size - offset, max);
-  const fh = await open(path23, "r");
+  const fh = await open(path24, "r");
   try {
     const buf = Buffer.alloc(length);
     const { bytesRead } = await fh.read(buf, 0, length, offset);
@@ -10603,6 +10875,10 @@ var init_telemetry_forwarder = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/loop-ticks.mjs
+function supportedTaskKindsFor(availableAgents) {
+  const claude = Array.isArray(availableAgents) ? availableAgents.find((row) => row?.agent === "claude") : null;
+  return claude?.installed === true && claude.authenticated === true && claude.skill_capable === true ? RUNNER_SUPPORTED_TASK_KINDS : RUNNER_SUPPORTED_TASK_KINDS.filter((kind) => kind !== "skill");
+}
 function makeLoopTicks({
   client,
   cfg,
@@ -10636,6 +10912,16 @@ function makeLoopTicks({
   getAgentAvailability = () => null,
   // Cached account-usage provider (account-usage.mjs); [] omits the field.
   getAccountUsage = () => [],
+  // Host-preflight verdict (host-preflight.mjs) — why this host is or is not
+  // claiming. GATED OFF BY DEFAULT and that is deliberate: the plane's
+  // heartbeat input schema is `.strict()`, so sending `host_health` before
+  // that schema accepts it would 400 EVERY beat and take the machine off the
+  // fleet — the 2026-07-25 `version` outage, and it would fire hardest on
+  // exactly the broken hosts this field describes. Flip
+  // VO_HOST_HEALTH_HEARTBEAT=1 once runner-host-health-v1 is wired into
+  // runner-heartbeat-v1.ts and deployed. The claim GATE does not depend on
+  // this: a blocked host stops claiming either way.
+  getHostHealth = () => null,
   // Injectable for tests; default to the real scheduler + wall clock.
   runResumeScheduler = runScheduler,
   now: nowFn = () => Date.now(),
@@ -10736,10 +11022,17 @@ function makeLoopTicks({
         ...servedOperators.length > 0 ? { servedOperators } : {},
         ...Array.isArray(availableAgents) && availableAgents.length > 0 ? { availableAgents } : {},
         ...Array.isArray(accountUsage) && accountUsage.length > 0 ? { accountUsage } : {},
+        ...env2.VO_HOST_HEALTH_HEARTBEAT === "1" && getHostHealth() ? { hostHealth: getHostHealth() } : {},
         uptimeSec: Math.floor(process.uptime()),
         activeTasks: getActive(),
         maxConcurrency: cfg.maxConcurrency,
-        supportedTaskKinds: RUNNER_SUPPORTED_TASK_KINDS,
+        supportedTaskKinds: supportedTaskKindsFor(availableAgents),
+        // Attested EVERY beat, from the daemon's own env + keychain, so the plane's
+        // runner-api-billing-gate can refuse a metered machine BEFORE it claims.
+        // Never throws (see resolveRunnerAttestedAuthSource) — a heartbeat that
+        // 500s on its own attestation would take the host off the fleet, which is
+        // strictly worse than the spend it was trying to prevent.
+        agentAuthSource: resolveRunnerAttestedAuthSource(env2),
         ...capacityFields,
         ...localModelFields,
         ...preparedJobFields
@@ -10771,6 +11064,7 @@ var init_loop_ticks = __esm({
     init_session_spool_forwarder();
     init_rate_limit_resume_scheduler();
     init_telemetry_forwarder();
+    init_agent_auth_attestation();
     HEARTBEAT_MS = 6e4;
     DEFAULT_RESUME_SCHEDULE_SEC = 300;
     RUNNER_SUPPORTED_TASK_KINDS = Object.freeze(["code", "inference", "skill"]);
@@ -10899,7 +11193,7 @@ function resolveAgentClaimContext(provider, defaultAgent) {
 async function collectAgentAvailability({
   agents = listAgents(),
   runnerFor,
-  probeTimeoutMs = PROBE_TIMEOUT_MS
+  probeTimeoutMs = PROBE_TIMEOUT_MS2
 } = {}) {
   const probes = agents.map(async (agent) => {
     const degraded = { agent, installed: false, authenticated: false };
@@ -10917,6 +11211,7 @@ async function collectAgentAvailability({
         installed,
         authenticated,
         ...typeof r?.version === "string" && r.version ? { version: r.version } : {},
+        ...typeof r?.skillCapable === "boolean" ? { skill_capable: r.skillCapable } : {},
         // Omitted when unknown, which is what an older daemon's silence already
         // means — the control-plane schema resolves BOTH to 'unknown'. Never
         // invent a tier to fill the gap.
@@ -10977,7 +11272,7 @@ function makeAgentAvailabilityProvider({
     }
   };
 }
-var DEFAULT_TTL_MS, PROBE_TIMEOUT_MS;
+var DEFAULT_TTL_MS, PROBE_TIMEOUT_MS2;
 var init_agent_availability = __esm({
   "../../scripts/virtual-office/code-runner/agent-availability.mjs"() {
     "use strict";
@@ -10985,7 +11280,7 @@ var init_agent_availability = __esm({
     init_agent_auth_probe_process();
     init_agent_auth_tier();
     DEFAULT_TTL_MS = 5 * 60 * 1e3;
-    PROBE_TIMEOUT_MS = 1e4;
+    PROBE_TIMEOUT_MS2 = 1e4;
   }
 });
 
@@ -11447,10 +11742,10 @@ function formatShadowLogLine(record) {
   const loud = record.unexplained_fields?.length ? "!! " : "";
   return `${loud}[prepared-job-shadow] ${parts.join(" ")}`;
 }
-function appendShadowRecord(record, { path: path23 = PREPARED_JOB_SHADOW_SINK, append = appendFileSync, mkdir: mkdir5 = mkdirSync8 } = {}) {
+function appendShadowRecord(record, { path: path24 = PREPARED_JOB_SHADOW_SINK, append = appendFileSync, mkdir: mkdir5 = mkdirSync8 } = {}) {
   try {
-    mkdir5(dirname10(path23), { recursive: true });
-    append(path23, `${JSON.stringify(record)}
+    mkdir5(dirname10(path24), { recursive: true });
+    append(path24, `${JSON.stringify(record)}
 `, "utf8");
     return true;
   } catch {
@@ -11770,7 +12065,7 @@ var init_shared = __esm({
 // ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
 import fs10 from "node:fs";
 import os3 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 function fileCaptureTime(filePath, explicit, statFn) {
   if (typeof explicit === "string" && explicit) return explicit;
   try {
@@ -11784,7 +12079,7 @@ function usageBaseUrl(env2 = process.env) {
   return String(raw).replace(/\/+$/, "");
 }
 function readOAuthToken({ homeDir = os3.homedir(), read = readJson2, now = Date.now() } = {}) {
-  const creds = read(path18.join(homeDir, ".claude", ".credentials.json"));
+  const creds = read(path19.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
   const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
@@ -11794,7 +12089,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson2, now = Date.
   return token2;
 }
 function readAccountId({ homeDir = os3.homedir(), read = readJson2 } = {}) {
-  const cfg = read(path18.join(homeDir, ".claude.json"));
+  const cfg = read(path19.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
 }
@@ -11904,7 +12199,7 @@ function readClaudeFileUsage({
     if (age === null || age > MAX_FILE_AGE_MS) return null;
     return row;
   };
-  const statusPath = path18.join(homeDir, ".claude", "claude-usage.json");
+  const statusPath = path19.join(homeDir, ".claude", "claude-usage.json");
   const status = read(statusPath);
   if (status && (status.seven_day || status.five_hour)) {
     const row = fresh(makeUsageRow({
@@ -11919,7 +12214,7 @@ function readClaudeFileUsage({
     }));
     if (row) return row;
   }
-  const weeklyPath = path18.join(homeDir, ".claude", "claude-weekly-usage.json");
+  const weeklyPath = path19.join(homeDir, ".claude", "claude-weekly-usage.json");
   const weekly = read(weeklyPath);
   if (weekly) {
     const row = fresh(makeUsageRow({
@@ -12733,11 +13028,11 @@ var init_watcher_adoption = __esm({
 // ../../scripts/virtual-office/code-runner/watcher-github-token.mjs
 function makeWatcherTokenProvider(client, { required = true, allowAmbient = false, now = () => Date.now(), log: log2 = () => {
 } } = {}) {
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   let ciUnreadableLoggedAt = null;
   return async (repo) => {
     const key = String(repo).toLowerCase();
-    const prior = cache.get(key);
+    const prior = cache2.get(key);
     if (prior && now() - prior.at < 45 * 60 * 1e3) return prior.token;
     const result = await client.getInstallationToken({ required, readOnly: true, repo });
     if (!result?.token) {
@@ -12748,7 +13043,7 @@ function makeWatcherTokenProvider(client, { required = true, allowAmbient = fals
       ciUnreadableLoggedAt = now();
       log2(`watch: the plane minted a read token for ${repo} WITHOUT CI read (ci_readable=false \u2014 the GitHub App installation has not accepted checks:read/statuses:read); PR CI stays unreadable until the operator accepts the App permission update`);
     }
-    cache.set(key, { token: result.token, at: now() });
+    cache2.set(key, { token: result.token, at: now() });
     return result.token;
   };
 }
@@ -12914,7 +13209,7 @@ function noteCiViaRest(log2) {
   log2("watch: CI status read via REST check-runs/status (gh's GraphQL rollup needs actions:read for checkSuite.workflowRun, which the read scope does not carry)");
 }
 async function readCommitCiViaRest(repo, sha, { run, env: env2 }) {
-  const api = async (path23) => JSON.parse(await run("gh", ["api", path23], { timeout: 3e4, env: env2 }) || "{}");
+  const api = async (path24) => JSON.parse(await run("gh", ["api", path24], { timeout: 3e4, env: env2 }) || "{}");
   const rollup = [];
   let total = null;
   for (let page = 1; page <= REST_MAX_PAGES && (total === null || rollup.length < total); page += 1) {
@@ -13578,9 +13873,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path23 = String(req.url || "").split("?")[0];
+    const path24 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path23 === "/status") {
+    if (req.method === "GET" && path24 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -13591,7 +13886,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path23 === "/stop") {
+    if (req.method === "POST" && path24 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -13785,22 +14080,22 @@ var init_effort_mode_config = __esm({
 import { randomUUID as randomUUID7 } from "node:crypto";
 import fs11 from "node:fs";
 import os4 from "node:os";
-import path19 from "node:path";
+import path20 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function userCacheRoot() {
   try {
     const home = os4.homedir();
-    if (home) return path19.join(home, ".claude");
+    if (home) return path20.join(home, ".claude");
   } catch {
   }
-  return path19.join(os4.tmpdir(), `vo-model-registry-${randomUUID7()}`);
+  return path20.join(os4.tmpdir(), `vo-model-registry-${randomUUID7()}`);
 }
 function resolveCacheBaseDir(env2 = process.env, moduleDir = __dirname) {
   if (env2.VO_MODEL_REGISTRY_CACHE_DIR) return env2.VO_MODEL_REGISTRY_CACHE_DIR;
   if (env2.VO_RUNNER_RUNTIME_ROOT) return env2.VO_RUNNER_RUNTIME_ROOT;
-  const segments = moduleDir.split(path19.sep);
+  const segments = moduleDir.split(path20.sep);
   const isRepoCheckout2 = segments.at(-1) === "virtual-office" && segments.at(-2) === "scripts";
-  return isRepoCheckout2 ? path19.resolve(moduleDir, "..", "..") : userCacheRoot();
+  return isRepoCheckout2 ? path20.resolve(moduleDir, "..", "..") : userCacheRoot();
 }
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -13923,7 +14218,7 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs11.mkdirSync(path19.dirname(cacheFile), { recursive: true });
+  fs11.mkdirSync(path20.dirname(cacheFile), { recursive: true });
   fs11.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
@@ -13981,13 +14276,13 @@ var __dirname, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANTHROPIC
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path19.dirname(fileURLToPath6(import.meta.url));
-    DEFAULT_CACHE_DIR = path19.join(
+    __dirname = path20.dirname(fileURLToPath6(import.meta.url));
+    DEFAULT_CACHE_DIR = path20.join(
       resolveCacheBaseDir(),
       ".virtual-office-cache",
       "model-registry"
     );
-    DEFAULT_CACHE_FILE = path19.join(DEFAULT_CACHE_DIR, "catalog.json");
+    DEFAULT_CACHE_FILE = path20.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -14626,18 +14921,18 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path23 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync9 } = {}) {
+function readCodexModelsCache({ path: path24 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync9 } = {}) {
   try {
-    const parsed = JSON.parse(read(path23, "utf8"));
+    const parsed = JSON.parse(read(path24, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
   }
 }
-function clampCodexEffort(effort, cache) {
+function clampCodexEffort(effort, cache2) {
   if (!effort) return { effort: null, degraded: false };
   const supported = /* @__PURE__ */ new Set();
-  for (const model of cache?.models || []) {
+  for (const model of cache2?.models || []) {
     if (model?.visibility === "hide") continue;
     for (const lvl of model?.supported_reasoning_levels || []) {
       if (lvl?.effort) supported.add(lvl.effort);
@@ -14885,15 +15180,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path23 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir5 = mkdirSync9, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path24 = DECISION_FALLBACK_PATH, append = appendFileSync2, mkdir: mkdir5 = mkdirSync9, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir5(dirname12(path23), { recursive: true });
-    append(path23, `${JSON.stringify(decision)}
+    mkdir5(dirname12(path24), { recursive: true });
+    append(path24, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path23, `${JSON.stringify(record)}
+        for (const record of records) append(path24, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -15425,6 +15720,17 @@ var init_agent_process_env = __esm({
       // escape hatch inert — an operator who set it still got the subscription.
       "VO_RUNNER_PREFER_KEY",
       "VO_RUNNER_CLAUDE_PREFER_KEY",
+      // The per-MACHINE metered-billing opt-in (RUNNER_ALLOW_API_BILLING_ENV in
+      // agent-auth-attestation.mjs). Listed for the SAME reason as the line above:
+      // applyApiBillingPolicy reads it off the env handed to runAgentTask, which is
+      // this function's output — omit it and the operator's opt-in is stripped before
+      // the policy ever sees it, so `permitted` is permanently false. That fails in
+      // the SAFE direction (login), unlike #9242, but it is still an inert flag.
+      //
+      // A boolean flag, not a credential: it grants nothing on its own. The keys it
+      // gates (ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN / CLAUDE_API_KEY) stay absent
+      // from this allow-list and are re-injected, if at all, only by applyAuthEnv.
+      "VO_RUNNER_ALLOW_API_BILLING",
       // The swarm tier binding (SWARM_TIER_BINDING_ENV in
       // packages/vo-mcp/src/swarm/tier-binding.ts). A fan-out resolves its billing
       // tier ONCE at admission and exports the binding so every subagent inherits
@@ -16215,6 +16521,53 @@ var init_terminal_delivery = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/skill-result-json-schema.mjs
+function buildSkillResultJsonSchema({ expectedSkill, producedByAgent }) {
+  return {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      schema_version: { const: 1 },
+      skill: { const: expectedSkill },
+      outcome: { enum: ["findings", "no_findings", "refused"] },
+      findings: {
+        type: "array",
+        maxItems: MAX_FINDINGS,
+        items: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            claim: { type: "string", minLength: 1, maxLength: 500 },
+            evidence: { type: "string", minLength: 1, maxLength: 2e3 },
+            source: { type: "string", maxLength: 500 },
+            confidence: { enum: ["high", "medium", "low"] }
+          },
+          required: ["claim", "evidence", "confidence"]
+        }
+      },
+      findings_truncated: { type: "boolean" },
+      summary: { type: "string", minLength: 1, maxLength: 2e3 },
+      produced_by_agent: { const: producedByAgent }
+    },
+    required: [
+      "schema_version",
+      "skill",
+      "outcome",
+      "findings",
+      "findings_truncated",
+      "summary",
+      "produced_by_agent"
+    ]
+  };
+}
+var MAX_FINDINGS;
+var init_skill_result_json_schema = __esm({
+  "../../scripts/virtual-office/code-runner/skill-result-json-schema.mjs"() {
+    "use strict";
+    MAX_FINDINGS = 50;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/skill-task-runner.mjs
 import { createHash as createHash9 } from "node:crypto";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
@@ -16275,13 +16628,7 @@ function skillResultPayloadSha256(result) {
   };
   return createHash9("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
 }
-function parseSkillResult(text, { expectedSkill, producedByAgent }) {
-  let value;
-  try {
-    value = JSON.parse(String(text ?? "").trim());
-  } catch {
-    throw new Error("skill agent did not return one strict JSON result");
-  }
+function parseSkillResultValue(value, { expectedSkill, producedByAgent }) {
   if (!exactKeys(value, ["schema_version", "skill", "outcome", "findings", "findings_truncated", "summary", "produced_by_agent"])) {
     throw new Error("skill result shape is invalid");
   }
@@ -16290,7 +16637,7 @@ function parseSkillResult(text, { expectedSkill, producedByAgent }) {
   if (value.produced_by_agent !== producedByAgent) throw new Error("skill result agent attribution is invalid");
   if (typeof value.findings_truncated !== "boolean") throw new Error("skill result truncation flag is invalid");
   boundedString(value.summary, 1, 2e3, "skill result summary");
-  if (!Array.isArray(value.findings) || value.findings.length > MAX_FINDINGS) throw new Error("skill result findings are invalid");
+  if (!Array.isArray(value.findings) || value.findings.length > MAX_FINDINGS2) throw new Error("skill result findings are invalid");
   if (value.outcome === "findings" ? value.findings.length === 0 : value.findings.length > 0) {
     throw new Error("skill result findings do not match its outcome");
   }
@@ -16307,6 +16654,27 @@ function parseSkillResult(text, { expectedSkill, producedByAgent }) {
   }
   return value;
 }
+function assertSkillRunWithinDispatch(run, { maxTurns, maxBudgetUsd } = {}) {
+  if (run?.terminalSubtype !== "success") {
+    throw new Error(`skill agent terminal subtype was not success (${run?.terminalSubtype || "unknown"})`);
+  }
+  if (Number.isInteger(maxTurns) && maxTurns > 0) {
+    if (!Number.isInteger(run?.numTurns) || run.numTurns < 0) {
+      throw new Error("skill agent did not report valid turn usage for the active ceiling");
+    }
+    if (run.numTurns > maxTurns) {
+      throw new Error(`skill agent exceeded the turn ceiling (${run.numTurns} > ${maxTurns})`);
+    }
+  }
+  if (typeof maxBudgetUsd === "number" && Number.isFinite(maxBudgetUsd) && maxBudgetUsd > 0) {
+    if (typeof run?.costUsd !== "number" || !Number.isFinite(run.costUsd) || run.costUsd < 0) {
+      throw new Error("skill agent did not report valid cost usage for the active ceiling");
+    }
+    if (run.costUsd > maxBudgetUsd) {
+      throw new Error(`skill agent exceeded the cost ceiling (${run.costUsd} > ${maxBudgetUsd})`);
+    }
+  }
+}
 function composeSkillTaskPrompt({ skillBody, invocation, taskPrompt, producedByAgent }) {
   const body = boundedString(skillBody, 1, MAX_SKILL_BODY_CHARS, "skill body");
   const request = boundedString(taskPrompt, 1, 810201, "skill task request");
@@ -16341,8 +16709,9 @@ async function processSkillTask(client, task, cfg, {
   swarmAdmission = null,
   runTask = runAgentTask,
   resolveDispatch = resolveEffortDispatch,
+  checkSkillCapability = ({ runner, bin, env: capabilityEnv }) => typeof runner.checkSkillCapability === "function" ? runner.checkSkillCapability({ bin, env: capabilityEnv }) : { compatible: false, reason: "resolved runner has no restricted-skill capability probe" },
   createScratch = () => mkdtemp2(join19(tmpdir(), "algohq-skill-task-")),
-  removeScratch = (path23) => rm2(path23, { recursive: true, force: true })
+  removeScratch = (path24) => rm2(path24, { recursive: true, force: true })
 } = {}) {
   const id = task.code_task_id;
   let run = null;
@@ -16389,12 +16758,25 @@ async function processSkillTask(client, task, cfg, {
     if (selected.agent !== "claude") {
       throw new Error("skill execution requires the policy-restricted Claude runner");
     }
+    const capability = await checkSkillCapability({
+      runner: selected.runner,
+      bin: selected.runnerBin,
+      env: env2
+    });
+    if (!capability?.compatible) {
+      throw new Error(`resolved Claude CLI is incompatible with restricted skill execution: ${capability?.reason || "unknown capability"}`);
+    }
+    const executionBin = capability.resolvedBin || selected.runnerBin;
     const basePrompt = composeSkillTaskPrompt({
       skillBody: skill.body,
       invocation,
       taskPrompt: task.prompt,
       producedByAgent: selected.agent
     });
+    const structuredOutputSchema = buildSkillResultJsonSchema({
+      expectedSkill: invocation.skill,
+      producedByAgent: selected.agent
+    });
     const dispatch = await resolveDispatch({ client, task, agent: selected.agent, env: env2, basePrompt });
     assertRunnerGovernors({ agent: selected.agent, task });
     scratch = await createScratch();
@@ -16412,10 +16794,11 @@ async function processSkillTask(client, task, cfg, {
     });
     run = await runTask({
       runner: selected.runner,
-      bin: selected.runnerBin,
+      bin: executionBin,
       prompt: dispatch.prompt,
       cwd: scratch,
       toolPolicy: frozenInputsOnly ? "frozen_inputs_only" : "skill_readonly",
+      structuredOutputSchema,
       permissionMode: dispatch.permissionMode,
       maxTurns: selected.agent === "claude" ? dispatch.maxTurns : void 0,
       model: dispatch.model,
@@ -16466,7 +16849,11 @@ async function processSkillTask(client, task, cfg, {
       } });
       return;
     }
-    const parsedResult = parseSkillResult(resultText(run), {
+    assertSkillRunWithinDispatch(run, dispatch);
+    if (!run.structuredOutput || typeof run.structuredOutput !== "object" || Array.isArray(run.structuredOutput)) {
+      throw new Error("skill agent did not return provider-validated structured output");
+    }
+    const parsedResult = parseSkillResultValue(run.structuredOutput, {
       expectedSkill: invocation.skill,
       producedByAgent: selected.agent
     });
@@ -16509,7 +16896,7 @@ async function processSkillTask(client, task, cfg, {
     } });
   }
 }
-var SKILL_SUCCESS_STATUS, SKILL_NAME_RE, INPUT_KEY_RE, MAX_SKILL_BODY_CHARS, MAX_INPUTS, MAX_FINDINGS, SHA256_RE;
+var SKILL_SUCCESS_STATUS, SKILL_NAME_RE, INPUT_KEY_RE, MAX_SKILL_BODY_CHARS, MAX_INPUTS, MAX_FINDINGS2, SHA256_RE;
 var init_skill_task_runner = __esm({
   "../../scripts/virtual-office/code-runner/skill-task-runner.mjs"() {
     "use strict";
@@ -16523,12 +16910,13 @@ var init_skill_task_runner = __esm({
     init_killed_run_outcome();
     init_terminal_delivery();
     init_cancelled_run_report();
+    init_skill_result_json_schema();
     SKILL_SUCCESS_STATUS = "no_changes_needed";
     SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}(?::[a-z0-9][a-z0-9-]{0,62})?$/u;
     INPUT_KEY_RE = /^[a-z][a-z0-9_]{0,39}$/u;
     MAX_SKILL_BODY_CHARS = 256e3;
     MAX_INPUTS = 12;
-    MAX_FINDINGS = 50;
+    MAX_FINDINGS2 = 50;
     SHA256_RE = /^[a-f0-9]{64}$/u;
   }
 });
@@ -16536,7 +16924,7 @@ var init_skill_task_runner = __esm({
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
 import fs12 from "node:fs";
 import fsp11 from "node:fs/promises";
-import path20 from "node:path";
+import path21 from "node:path";
 async function defaultRun3(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -16549,7 +16937,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path20.dirname(commonDir);
+  const root = path21.dirname(commonDir);
   return samePath3(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -16591,21 +16979,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path20.join(
-    path20.dirname(worktreeDir),
+  const quarantineDir = path21.join(
+    path21.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp11.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp11.writeFile(path20.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp11.writeFile(path21.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path20.join(baseline.root, relative);
-    const target = path20.join(quarantineDir, "untracked", relative);
-    await fsp11.mkdir(path20.dirname(target), { recursive: true });
+    const source = path21.join(baseline.root, relative);
+    const target = path21.join(quarantineDir, "untracked", relative);
+    await fsp11.mkdir(path21.dirname(target), { recursive: true });
     await fsp11.copyFile(source, target);
   }
-  await fsp11.writeFile(path20.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp11.writeFile(path21.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -16627,8 +17015,8 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path20.resolve(baseline.root, relative);
-    const prefix = `${path20.resolve(baseline.root)}${path20.sep}`;
+    const target = path21.resolve(baseline.root, relative);
+    const prefix = `${path21.resolve(baseline.root)}${path21.sep}`;
     if (!target.startsWith(prefix) || !fs12.existsSync(target)) continue;
     await fsp11.rm(target, { force: true });
   }
@@ -16665,7 +17053,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath3 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path20.resolve(value));
+      const [a, b] = [left, right].map((value) => path21.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -16830,6 +17218,174 @@ var init_outcome_commit = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/capped-run-classification.mjs
+function isCappedRunSummary(summary) {
+  return CAPPED_RESULT_SUBTYPES.includes(String(summary ?? "").trim());
+}
+function agentRequestedContinuation(run = {}) {
+  return `${run?.summary ?? ""}
+${run?.lastAgentMessage ?? ""}`.includes(PARTIAL_PR_CONTINUATION_MARKER);
+}
+function leftoverWorkAfterPublish(changedFiles) {
+  if (!Array.isArray(changedFiles)) return null;
+  return changedFiles.filter((file) => file && !isAgentScratch(String(file)));
+}
+function classifyCappedRunOutcome({
+  partial = false,
+  run = {},
+  prPublished = false,
+  prCarriesCommits = false,
+  changedFilesAfterPublish = null,
+  rateLimited = false
+} = {}) {
+  const verdict = (reason, extra = {}) => ({
+    needsContinuation: true,
+    complete: false,
+    reason,
+    note: null,
+    leftover: [],
+    ...extra
+  });
+  if (!partial) {
+    return { needsContinuation: false, complete: true, reason: "clean_finish", note: null, leftover: [] };
+  }
+  if (agentRequestedContinuation(run)) return verdict("agent_requested_continuation");
+  if (rateLimited) return verdict("rate_limited_resume_pending");
+  if (run?.failure) return verdict("runner_failure");
+  if (run?.gateFailureNote) return verdict("completion_gate_not_passing");
+  if (!isCappedRunSummary(run?.summary)) return verdict("not_a_cap_stop");
+  if (!prPublished) return verdict("no_published_pr");
+  if (!prCarriesCommits) return verdict("published_pr_carries_no_commits");
+  const leftover = leftoverWorkAfterPublish(changedFilesAfterPublish);
+  if (leftover === null) return verdict("worktree_state_unknown");
+  if (leftover.length > 0) return verdict("uncommitted_work_remains", { leftover });
+  return {
+    needsContinuation: false,
+    complete: true,
+    reason: "cap_after_publish",
+    note: CAP_AFTER_PUBLISH_NOTE,
+    leftover: []
+  };
+}
+var CAP_AFTER_PUBLISH_NOTE;
+var init_capped_run_classification = __esm({
+  "../../scripts/virtual-office/code-runner/capped-run-classification.mjs"() {
+    "use strict";
+    init_claude_result_event();
+    init_partial_pr_continuation();
+    init_publish_file_state();
+    CAP_AFTER_PUBLISH_NOTE = "cap reached after publish";
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/capped-run-publication-repair.mjs
+function stripPartialTitlePrefix(title) {
+  const text = String(title ?? "").trim();
+  if (!PARTIAL_TITLE_PREFIX_RE.test(text)) return null;
+  const stripped = text.replace(PARTIAL_TITLE_PREFIX_RE, "").trim();
+  return stripped || null;
+}
+async function measureWorktreeChanges(worktreeDir, runCommand) {
+  try {
+    const out = await runCommand(
+      "git",
+      ["-c", "core.quotepath=false", "status", "--porcelain", "-z"],
+      worktreeDir,
+      { timeout: 6e4, raw: true }
+    );
+    return parsePorcelainZ(out);
+  } catch {
+    return null;
+  }
+}
+async function branchCarriesCommits(worktreeDir, branch, runCommand, base = "origin/main") {
+  if (!branch) return false;
+  try {
+    const out = await runCommand(
+      "git",
+      ["rev-list", "--count", `${base}..${branch}`],
+      worktreeDir,
+      { timeout: 6e4 }
+    );
+    return Number.parseInt(String(out).trim(), 10) > 0;
+  } catch {
+    return false;
+  }
+}
+async function resolveCappedRunVerdict({
+  partial,
+  run,
+  pr,
+  worktreeDir,
+  runCommand,
+  rateLimited = false
+}) {
+  const optimistic = classifyCappedRunOutcome({
+    partial,
+    run,
+    rateLimited,
+    prPublished: true,
+    prCarriesCommits: true,
+    changedFilesAfterPublish: []
+  });
+  if (optimistic.reason !== "cap_after_publish") return optimistic;
+  const prPublished = Number.isInteger(pr?.prNumber) && pr.prNumber > 0;
+  const [changedFilesAfterPublish, prCarriesCommits] = await Promise.all([
+    measureWorktreeChanges(worktreeDir, runCommand),
+    prPublished ? branchCarriesCommits(worktreeDir, pr.branch, runCommand) : Promise.resolve(false)
+  ]);
+  return classifyCappedRunOutcome({
+    partial: true,
+    run,
+    prPublished,
+    prCarriesCommits,
+    changedFilesAfterPublish,
+    rateLimited
+  });
+}
+async function repairCompletePrPresentation({
+  pr,
+  worktreeDir,
+  githubToken = null,
+  runCommand,
+  log: log2 = () => {
+  },
+  promoteReady = true
+}) {
+  const env2 = githubToken ? installationTokenEnv(githubToken) : void 0;
+  const result = { retitled: null, markedReady: false };
+  try {
+    const raw = await runCommand("gh", ["pr", "view", String(pr.prNumber), "--json", "title"], worktreeDir, { env: env2, timeout: 6e4 });
+    const stripped = stripPartialTitlePrefix(JSON.parse(String(raw || "{}"))?.title);
+    if (stripped) {
+      await runCommand("gh", ["pr", "edit", String(pr.prNumber), "--title", stripped], worktreeDir, { env: env2, timeout: 6e4 });
+      result.retitled = stripped;
+      log2(`task PR #${pr.prNumber}: dropped the PARTIAL title prefix \u2014 the cap landed after publication`);
+    }
+  } catch (error) {
+    log2(`PR #${pr.prNumber}: could not drop the PARTIAL title prefix (${String(error?.message || error).slice(0, 160)}); outcome is still recorded complete`);
+  }
+  if (!promoteReady) return result;
+  try {
+    await markExistingPrReady(worktreeDir, pr.prNumber, { env: env2, runFn: runCommand });
+    result.markedReady = true;
+  } catch (error) {
+    log2(`PR #${pr.prNumber}: could not promote the salvage draft to ready (${String(error?.message || error).slice(0, 160)})`);
+  }
+  return result;
+}
+var PARTIAL_TITLE_PREFIX_RE;
+var init_capped_run_publication_repair = __esm({
+  "../../scripts/virtual-office/code-runner/capped-run-publication-repair.mjs"() {
+    "use strict";
+    init_publish();
+    init_publish_file_state();
+    init_existing_pr_publication();
+    init_capped_run_classification();
+    PARTIAL_TITLE_PREFIX_RE = /^⚠ PARTIAL \([^)]*\)\s*—\s*/u;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/publication-outcome.mjs
 async function closeCancelledReplacementPr({
   pr,
@@ -16956,6 +17512,20 @@ async function finalizePublishedPr({
   const runnerFailureRecord = serializedRunnerFailure ? JSON.parse(serializedRunnerFailure) : null;
   const runnerFailureMessage = runnerFailureRecord ? `blocked by ${runnerFailureRecord.code}; operator review required: ${runnerFailureRecord.operator_next_action}` : "";
   const fixDispatchGuard = overlapBlocked || runnerFailure ? { allowFixDispatch: false } : {};
+  const exec = runCommand ?? defaultRunCommand4;
+  const capVerdict = await resolveCappedRunVerdict({
+    partial,
+    run,
+    pr,
+    worktreeDir,
+    runCommand: exec,
+    rateLimited: Boolean(rateLimitResume)
+  });
+  const reclassified = partial && capVerdict.reason === "cap_after_publish";
+  const effectivePartial = partial && !reclassified;
+  if (partial) {
+    log2(reclassified ? `task ${id}: ${CAP_AFTER_PUBLISH_NOTE} with a clean worktree \u2014 recording pr_opened, not needs_continuation` : `task ${id}: partial draft stands (${capVerdict.reason})`);
+  }
   let resumeQueued = false;
   if (cfg.watchEnabled) {
     try {
@@ -16966,8 +17536,8 @@ async function finalizePublishedPr({
         taskId: id,
         operatorId: task.operator_id,
         tenantId: task.tenant_id,
-        needsContinuation: partial && !rateLimitResume && !runnerFailure && (task.continuation_attempt ?? 0) < (task.continuation_max_attempts ?? 3),
-        continuationExhausted: partial && (task.continuation_attempt ?? 0) >= (task.continuation_max_attempts ?? 3),
+        needsContinuation: effectivePartial && !rateLimitResume && !runnerFailure && (task.continuation_attempt ?? 0) < (task.continuation_max_attempts ?? 3),
+        continuationExhausted: effectivePartial && (task.continuation_attempt ?? 0) >= (task.continuation_max_attempts ?? 3),
         repairChain: task.repair_chain ?? {
           root_pr_number: pr.prNumber,
           attempt: 0,
@@ -17024,14 +17594,19 @@ async function finalizePublishedPr({
     log: log2,
     patch: {
       status: runnerFailure ? "failed" : "pr_opened",
-      message: runnerFailure ? `${runnerFailureMessage}; preserved PR ${pr.prUrl} for owner review` : `opened ${pr.prUrl}${overlapNote}${pr.newCommit === false ? " (no new commits \u2014 the branch already held every change)" : ""}`,
+      message: runnerFailure ? `${runnerFailureMessage}; preserved PR ${pr.prUrl} for owner review` : `opened ${pr.prUrl}${overlapNote}${reclassified ? ` (${CAP_AFTER_PUBLISH_NOTE} \u2014 every deliverable is committed)` : ""}${pr.newCommit === false ? " (no new commits \u2014 the branch already held every change)" : ""}`,
       pr_url: pr.prUrl,
       pr_number: pr.prNumber,
       pr_branch: pr.branch,
       result: (() => {
         const prefix = overlapBlocked ? `[VO-PUBLISH-OVERLAP-BLOCKED: ${blockedRefs}] ` : "";
         const room = 2e3 - prefix.length;
-        return `${prefix}${partial || runnerFailure ? partialPrContinuationResult(run, room, rateLimitResume ? "rate_limited" : null) : String(run.summary).slice(0, room)}`;
+        if (reclassified) {
+          const report = String(run.lastAgentMessage || run.summary || "").trim();
+          return `${prefix}${`${CAP_AFTER_PUBLISH_NOTE}
+${report}`.slice(0, room)}`;
+        }
+        return `${prefix}${effectivePartial || runnerFailure ? partialPrContinuationResult(run, room, rateLimitResume ? "rate_limited" : null) : String(run.summary).slice(0, room)}`;
       })(),
       ...runOutcomePatch(run),
       ...terminalLedgerPatch(run)
@@ -17059,6 +17634,16 @@ async function finalizePublishedPr({
     });
     return posted.cancelled;
   }
+  if (reclassified) {
+    await repairCompletePrPresentation({
+      pr,
+      worktreeDir,
+      githubToken,
+      runCommand: exec,
+      log: log2,
+      promoteReady: !overlapBlocked && !runnerFailure
+    });
+  }
   log2(`task ${id} \u2192 PR ${pr.prUrl}`);
   return false;
 }
@@ -17076,13 +17661,15 @@ var init_publication_outcome = __esm({
     init_terminal_delivery();
     init_rate_limit_resume();
     init_error_message();
+    init_capped_run_classification();
+    init_capped_run_publication_repair();
     defaultRunCommand4 = (cmd, args, cwd, opts = {}) => runProcess2(cmd, args, { cwd, ...opts });
   }
 });
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
-import path21 from "node:path";
+import path22 from "node:path";
 function defaultRun4(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
@@ -17090,13 +17677,13 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   if (!isAgentScratch(file)) {
     throw new Error(`refusing to remove non-scratch publication path: ${file}`);
   }
-  const root = path21.resolve(worktreeDir);
-  const target = path21.resolve(root, file);
-  const relative = path21.relative(root, target);
-  if (!relative || relative.startsWith(`..${path21.sep}`) || path21.isAbsolute(relative)) {
+  const root = path22.resolve(worktreeDir);
+  const target = path22.resolve(root, file);
+  const relative = path22.relative(root, target);
+  if (!relative || relative.startsWith(`..${path22.sep}`) || path22.isAbsolute(relative)) {
     throw new Error(`refusing to remove publication scratch outside worktree: ${file}`);
   }
-  for (let cursor = target; cursor !== root; cursor = path21.dirname(cursor)) {
+  for (let cursor = target; cursor !== root; cursor = path22.dirname(cursor)) {
     try {
       if ((await fsp12.lstat(cursor)).isSymbolicLink()) {
         throw new Error(`refusing to follow symlink while removing publication scratch: ${file}`);
@@ -17218,7 +17805,7 @@ var init_publication_scope = __esm({
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
 import fs13 from "node:fs";
 import fsp13 from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -17232,10 +17819,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path22.join(clonesRoot2, leaf);
+  const canonical = path23.join(clonesRoot2, leaf);
   return [
-    path22.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path22.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path23.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path23.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile6) {
@@ -17393,6 +17980,290 @@ var init_recovery_ledger = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/host-preflight.mjs
+function joinOutput(observation = {}) {
+  return [observation.stdout, observation.stderr, observation.message].map((part) => String(part ?? "")).join("\n");
+}
+function classifyGitFetchObservation(observation = {}) {
+  const text = joinOutput(observation);
+  if (GIT_AUTH_RE.test(text)) return GIT_AUTH_REQUIRED;
+  if (GIT_NETWORK_RE.test(text)) return GIT_NETWORK;
+  return GIT_OTHER;
+}
+function classifyLoginPing(observation = {}) {
+  const text = joinOutput(observation);
+  if (LOGIN_EXPIRED_RE.test(text)) return LOGIN_EXPIRED;
+  if (RATE_LIMITED_RE.test(text)) return RATE_LIMITED;
+  if (observation.ok === true && String(observation.stdout ?? "").trim().length > 0) return OK;
+  return UNKNOWN;
+}
+function reportingLines(raw) {
+  return String(raw ?? "").split(/\r?\n/u).filter((line) => line.trim() !== "" && !NON_REPORTING_LINE.test(line)).map((line) => line.trim()).filter((line) => !/[`'"]$/u.test(line));
+}
+function matchSignature(line, signatures) {
+  for (const signature of signatures) {
+    if (signature.pattern.test(line)) return signature;
+  }
+  return null;
+}
+function classifyHostFailure(text) {
+  for (const line of reportingLines(text)) {
+    const login = matchSignature(line, LOGIN_SIGNATURES);
+    if (login) return { kind: "login_expired", signature: login.id, line };
+    const git4 = matchSignature(line, GIT_SIGNATURES);
+    if (git4) return { kind: git4.kind, signature: git4.id, line };
+  }
+  return null;
+}
+function classifyHostFailureSignature(text) {
+  const value = String(text ?? "");
+  if (!value.trim()) return null;
+  const tokenMatch = new RegExp(`${HOST_ENV_FAILURE_TOKEN}:(${LOGIN_EXPIRED}|${GIT_AUTH_REQUIRED})`, "u").exec(value);
+  if (tokenMatch) return tokenMatch[1];
+  const found = classifyHostFailure(value);
+  if (!found) return null;
+  if (found.kind === "login_expired") return LOGIN_EXPIRED;
+  if (found.kind === "git_credentials") return GIT_AUTH_REQUIRED;
+  return null;
+}
+function hostFailureResultText(reason, detail = "") {
+  const trimmed = String(detail ?? "").replace(/\s+/gu, " ").trim().slice(0, 400);
+  return `${HOST_ENV_FAILURE_TOKEN}:${reason} \u2014 ${hostHealthRemedy(reason)}${trimmed ? ` [${trimmed}]` : ""}`;
+}
+function hostHealthRemedy(reason) {
+  switch (reason) {
+    case LOGIN_EXPIRED:
+      return "login expired: run claude auth login on this host";
+    case RATE_LIMITED:
+      return "agent account is rate limited: work resumes when the window resets";
+    case GIT_AUTH_REQUIRED:
+      return "git auth required: refresh the git credential on this host";
+    case GIT_NETWORK:
+      return "git cannot reach the remote: check this host network";
+    case GIT_OTHER:
+      return "git fetch failed on this host: see the runner log";
+    case UNKNOWN:
+      return "host check could not be completed";
+    default:
+      return "host is ready";
+  }
+}
+async function capture(run, cmd, args, options) {
+  try {
+    const stdout = await run(cmd, args, options);
+    return { ok: true, status: 0, stdout: String(stdout ?? ""), stderr: "", timedOut: false };
+  } catch (error) {
+    return {
+      ok: false,
+      status: typeof error?.status === "number" ? error.status : null,
+      stdout: String(error?.stdout ?? ""),
+      stderr: String(error?.stderr ?? ""),
+      message: String(error?.message ?? error ?? ""),
+      timedOut: error?.code === "ETIMEDOUT"
+    };
+  }
+}
+function nonInteractiveGitEnv(env2 = process.env) {
+  return {
+    ...env2,
+    GIT_TERMINAL_PROMPT: "0",
+    GCM_INTERACTIVE: "never",
+    GIT_OPTIONAL_LOCKS: "0"
+  };
+}
+async function checkGitFetch({
+  cwd,
+  run,
+  env: env2 = process.env,
+  remote = "origin",
+  branch = "main",
+  timeoutMs = GIT_FETCH_TIMEOUT_MS
+} = {}) {
+  if (typeof run !== "function" || !cwd) {
+    return { status: UNKNOWN, detail: "no runner clone to fetch from" };
+  }
+  const observation = await capture(run, "git", ["fetch", remote, branch], {
+    cwd,
+    timeout: timeoutMs,
+    env: nonInteractiveGitEnv(env2)
+  });
+  if (observation.ok) return { status: OK, detail: `git fetch ${remote} ${branch} succeeded` };
+  const reason = classifyGitFetchObservation(observation);
+  const raw = joinOutput(observation).replace(/\s+/gu, " ").trim();
+  return {
+    status: reason,
+    detail: observation.timedOut ? `git fetch ${remote} ${branch} exceeded ${Math.round(timeoutMs / 1e3)}s${raw ? `: ${raw.slice(0, 200)}` : " with no output"}` : raw.slice(0, 300) || `git fetch ${remote} ${branch} failed`
+  };
+}
+async function checkAgentLogin({
+  run,
+  bin = "claude",
+  env: env2 = process.env,
+  timeoutMs = LOGIN_PING_TIMEOUT_MS,
+  prompt = "Reply with the single word: ready"
+} = {}) {
+  if (typeof run !== "function") {
+    return { status: UNKNOWN, detail: "no login probe available on this host" };
+  }
+  const observation = await capture(run, bin, ["-p", prompt, "--max-turns", "1"], {
+    timeout: timeoutMs,
+    env: env2,
+    input: ""
+  });
+  const reason = classifyLoginPing(observation);
+  if (reason === OK) return { status: OK, detail: "one-turn agent ping authenticated" };
+  const raw = joinOutput(observation).replace(/\s+/gu, " ").trim();
+  return {
+    status: reason,
+    detail: observation.timedOut ? `agent ping exceeded ${Math.round(timeoutMs / 1e3)}s` : raw.slice(0, 300) || "agent ping produced no output"
+  };
+}
+function preflightAllowsClaim(health) {
+  if (!health) return true;
+  return !CLAIM_BLOCKING_GIT.has(health.git) && !CLAIM_BLOCKING_LOGIN.has(health.login);
+}
+function blockingReason(health) {
+  if (!health) return null;
+  if (CLAIM_BLOCKING_GIT.has(health.git)) return health.git;
+  if (CLAIM_BLOCKING_LOGIN.has(health.login)) return health.login;
+  return null;
+}
+async function runHostPreflight({
+  cwd,
+  runGit,
+  runAgent,
+  bin = "claude",
+  agent = "claude",
+  env: env2 = process.env,
+  now = () => Date.now(),
+  gitTimeoutMs = GIT_FETCH_TIMEOUT_MS,
+  loginTimeoutMs = LOGIN_PING_TIMEOUT_MS
+} = {}) {
+  const git4 = await checkGitFetch({ cwd, run: runGit, env: env2, timeoutMs: gitTimeoutMs });
+  const login = CLAIM_BLOCKING_GIT.has(git4.status) ? { status: UNKNOWN, detail: "skipped: git check already blocked this host" } : agent !== "claude" ? { status: UNKNOWN, detail: `login ping not implemented for agent ${agent}` } : await checkAgentLogin({ run: runAgent, bin, env: env2, timeoutMs: loginTimeoutMs });
+  const health = {
+    git: git4.status,
+    login: login.status,
+    checked_at: new Date(now()).toISOString()
+  };
+  const blocking = blockingReason(health);
+  const detail = blocking ? `${hostHealthRemedy(blocking)} \u2014 ${blocking === git4.status ? git4.detail : login.detail}` : login.status === RATE_LIMITED ? `${hostHealthRemedy(RATE_LIMITED)} \u2014 ${login.detail}` : `${git4.detail}; ${login.detail}`;
+  return { ...health, detail: detail.slice(0, 500) };
+}
+function positiveSeconds(raw, fallbackMs) {
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value * 1e3 : fallbackMs;
+}
+function makeHostPreflightGate({
+  preflight = runHostPreflight,
+  now = () => Date.now(),
+  env: env2 = process.env,
+  log: log2 = () => {
+  },
+  ...preflightOptions
+} = {}) {
+  const okIntervalMs = positiveSeconds(env2.VO_HOST_PREFLIGHT_OK_SEC, PREFLIGHT_OK_INTERVAL_MS);
+  const retryIntervalMs = positiveSeconds(env2.VO_HOST_PREFLIGHT_RETRY_SEC, PREFLIGHT_RETRY_MS);
+  let health = null;
+  let checkedAtMs = 0;
+  let running = false;
+  let lastLoggedReason;
+  const intervalMs = () => preflightAllowsClaim(health) ? okIntervalMs : retryIntervalMs;
+  return {
+    /** ms of the next scheduled check; 0 before the first one has ever run. */
+    nextCheckAt: () => checkedAtMs === 0 ? 0 : checkedAtMs + intervalMs(),
+    get: () => health,
+    allowClaim: () => preflightAllowsClaim(health),
+    blockingReason: () => blockingReason(health),
+    async ensure(nowMs = now()) {
+      if (running) return health;
+      if (checkedAtMs !== 0 && nowMs - checkedAtMs < intervalMs()) return health;
+      running = true;
+      try {
+        health = await preflight({ ...preflightOptions, env: env2, now });
+      } catch (error) {
+        health = {
+          git: UNKNOWN,
+          login: UNKNOWN,
+          checked_at: new Date(nowMs).toISOString(),
+          detail: `host preflight could not run: ${String(error?.message ?? error).slice(0, 200)}`
+        };
+        log2(`host preflight error: ${String(error?.message ?? error)}`);
+      } finally {
+        checkedAtMs = nowMs;
+        running = false;
+      }
+      const reason = blockingReason(health);
+      if (reason !== lastLoggedReason) {
+        lastLoggedReason = reason;
+        log2(reason ? `host preflight BLOCKED claiming \u2014 ${hostHealthRemedy(reason)} (${health.detail})` : "host preflight passed \u2014 git fetch and agent login are healthy");
+      }
+      return health;
+    }
+  };
+}
+var DEFAULT_BLOCKED_RECHECK_MS, DEFAULT_HEALTHY_RECHECK_MS, MAX_RECHECK_MS, GIT_FETCH_TIMEOUT_MS, LOGIN_PING_TIMEOUT_MS, PREFLIGHT_RETRY_MS, PREFLIGHT_OK_INTERVAL_MS, GIT_AUTH_REQUIRED, GIT_NETWORK, GIT_OTHER, LOGIN_EXPIRED, RATE_LIMITED, OK, UNKNOWN, HOST_ENV_FAILURE_TOKEN, CLAIM_BLOCKING_GIT, CLAIM_BLOCKING_LOGIN, GIT_AUTH_RE, GIT_NETWORK_RE, LOGIN_EXPIRED_RE, RATE_LIMITED_RE, SEVERITY_PREFIX, LOGIN_SIGNATURES, GIT_SIGNATURES, NON_REPORTING_LINE;
+var init_host_preflight = __esm({
+  "../../scripts/virtual-office/code-runner/host-preflight.mjs"() {
+    "use strict";
+    DEFAULT_BLOCKED_RECHECK_MS = 5 * 6e4;
+    DEFAULT_HEALTHY_RECHECK_MS = 30 * 6e4;
+    MAX_RECHECK_MS = 6 * 60 * 6e4;
+    GIT_FETCH_TIMEOUT_MS = 6e4;
+    LOGIN_PING_TIMEOUT_MS = 9e4;
+    PREFLIGHT_RETRY_MS = DEFAULT_BLOCKED_RECHECK_MS;
+    PREFLIGHT_OK_INTERVAL_MS = DEFAULT_HEALTHY_RECHECK_MS;
+    GIT_AUTH_REQUIRED = "git_auth_required";
+    GIT_NETWORK = "git_network";
+    GIT_OTHER = "git_other";
+    LOGIN_EXPIRED = "login_expired";
+    RATE_LIMITED = "rate_limited";
+    OK = "ok";
+    UNKNOWN = "unknown";
+    HOST_ENV_FAILURE_TOKEN = "HOST_ENV_FAILURE";
+    CLAIM_BLOCKING_GIT = /* @__PURE__ */ new Set([GIT_AUTH_REQUIRED, GIT_NETWORK, GIT_OTHER]);
+    CLAIM_BLOCKING_LOGIN = /* @__PURE__ */ new Set([LOGIN_EXPIRED]);
+    GIT_AUTH_RE = /could not read (?:Username|Password)|terminal prompts disabled|Authentication failed|authentication failed|Permission denied \(publickey\)|Invalid username or password|Support for password authentication was removed|HTTP Basic: Access denied|\b401\b|\b403\b|Logon failed|credential(?:s)? (?:helper|manager)|no credentials|Repository not found/i;
+    GIT_NETWORK_RE = /could not resolve host|couldn'?t resolve host|failed to connect|unable to access|connection (?:reset|refused|closed|timed out)|operation timed out|remote end hung up|early eof|rpc failed|recv failure|gnutls_handshake|ssl_read|\b50[234]\b|temporary failure|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH/i;
+    LOGIN_EXPIRED_RE = /OAuth (?:session|token) (?:has )?expired|could not be refreshed|Failed to authenticate|Invalid API key|invalid[^.\n]{0,24}(?:credential|authentication)|authentication_error|\bunauthorized\b|\b401\b|not (?:logged in|authenticated)|please run [`'"]?claude (?:auth )?login|run [`'"]?claude (?:auth )?login/i;
+    RATE_LIMITED_RE = /rate limit|rate[_-]limited|usage limit|\b429\b|too many requests|quota (?:exceeded|exhausted)|limit reached|out of (?:credits|quota)|resource[_ ]exhausted/i;
+    SEVERITY_PREFIX = String.raw`(?:\[?(?:error|Error|ERROR)\]?:?\s+)?`;
+    LOGIN_SIGNATURES = [
+      {
+        id: "oauth_session_expired",
+        pattern: new RegExp(
+          `^${SEVERITY_PREFIX}Failed to authenticate: OAuth session expired and could not be refreshed\\.?$`,
+          "u"
+        )
+      },
+      {
+        id: "invalid_credentials",
+        pattern: new RegExp(`^${SEVERITY_PREFIX}Invalid authentication credentials\\.?$`, "u")
+      }
+    ];
+    GIT_SIGNATURES = [
+      {
+        id: "git_fetch_timeout",
+        kind: "git_unreachable",
+        pattern: new RegExp(
+          `^${SEVERITY_PREFIX}git fetch origin main failed: timed out\\.?$`,
+          "u"
+        )
+      },
+      {
+        // fatal: could not read Username for 'https://github.com': terminal prompts disabled
+        id: "git_credential_prompt",
+        kind: "git_credentials",
+        pattern: new RegExp(
+          String.raw`^fatal:\s+could not read (?:Username|Password) for '[^']*':\s*` + String.raw`(?:terminal prompts disabled|No such device or address|Device not configured)\.?$`,
+          "u"
+        )
+      }
+    ];
+    NON_REPORTING_LINE = /^\s*(?:[+\->*#|]|\/\/|\/\*|\*\/|\d+[.)]\s|`{1,3}|'|")/u;
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/no-changes-terminal-status.mjs
 function defaultRunCommand5(cmd, args, cwd, opts = {}) {
   return runProcess2(cmd, args, { cwd, ...opts });
@@ -17414,6 +18285,14 @@ function isMaxTurnExhaustion(run = {}, maxTurns) {
 }
 function decideNoChangesTerminalStatus({ partial, run = {}, maxTurns } = {}) {
   const structuredFailure = serializeRunnerFailure(run.failure);
+  const hostFailure = classifyHostFailureSignature(run.summary) ?? classifyHostFailureSignature(structuredFailure);
+  if (hostFailure) {
+    return {
+      status: "failed",
+      message: `host cannot run work \u2014 ${hostHealthRemedy(hostFailure)}`,
+      result: hostFailureResultText(hostFailure, run.summary).slice(0, RESULT_LIMIT)
+    };
+  }
   if (!partial) {
     if (structuredFailure) {
       const failure = JSON.parse(structuredFailure);
@@ -17582,6 +18461,7 @@ var init_no_changes_terminal_status = __esm({
     init_terminal_delivery();
     init_error_message();
     init_partial_pr_continuation();
+    init_host_preflight();
     RESULT_LIMIT = 2e3;
   }
 });
@@ -17873,6 +18753,8 @@ async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmissio
       env: buildAgentProcessEnv(process.env, { agent: sel.agent, runnerId: cfg.runnerId, taskId: id, repo: task.repo, githubReadToken: agentGithubReadToken, swarmAdmission }),
       // swarmAdmission mints VO_SWARM_TIER_BINDING: ONE tier decision for this task's whole agent tree
       sandbox,
+      allowApiBilling: task.allow_api_billing === true,
+      // per-TASK grant; AND-ed with the per-machine VO_RUNNER_ALLOW_API_BILLING inside applyApiBillingPolicy
       onProgress: (text, checkpoint) => {
         const usage = checkpoint?.tokenUsage ? { token_usage: checkpoint.tokenUsage } : {};
         const patch = text ? runnerStagePatch("agent_working", text, usage) : { stage: "agent_working", ...usage };
@@ -18103,7 +18985,8 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   const agentAvailability = makeAgentAvailabilityProvider({ onError: (e) => log(`agent probe failed: ${e.message}`) });
   await agentAvailability.ready();
   const accountUsage = makeAccountUsageProvider();
-  const loopTick = makeLoopTicks({ client, cfg, env: env2, log, getActive: () => active, runnerInstanceId, capacityController, localModelController: createLocalModelRemoteController({ env: env2, log }), preparedJobController: createPreparedJobRemoteController({ log }), getAgentAvailability: () => agentAvailability.get(), getAccountUsage: () => accountUsage.get() });
+  const hostGate = makeHostPreflightGate({ cwd: process.cwd(), runGit: runProcess2, runAgent: runProcess2, bin: cfg.runnerBin, agent: cfg.agent, env: env2, log });
+  const loopTick = makeLoopTicks({ client, cfg, env: env2, log, getActive: () => active, runnerInstanceId, capacityController, localModelController: createLocalModelRemoteController({ env: env2, log }), preparedJobController: createPreparedJobRemoteController({ log }), getAgentAvailability: () => agentAvailability.get(), getAccountUsage: () => accountUsage.get(), getHostHealth: () => hostGate.get() });
   const backoff = makeReconnectBackoff({ baseMs: cfg.pollSec * 1e3, log });
   let detachedFlushRunning = false;
   while (!stopping) {
@@ -18113,9 +18996,10 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
         detachedFlushRunning = false;
       });
     }
+    await hostGate.ensure();
     const heartbeatCompletion = loopTick();
     if (watchCyclesEnabled) watchCoordinator.start();
-    const claimAgents = resolveAgentClaimContext(agentAvailability, cfg.agent);
+    const claimAgents = hostGate.allowClaim() ? resolveAgentClaimContext(agentAvailability, cfg.agent) : null;
     if (!claimAgents) {
       await heartbeatCompletion;
       await sleep2(cfg.pollSec * 1e3);
@@ -18132,7 +19016,7 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
     }
     let task;
     try {
-      task = await client.claim(cfg.runnerId, cfg.servedRepos, cfg.servedOperators, { runnerInstanceId, reconcileStale, ...claimAgents });
+      task = await client.claim(cfg.runnerId, cfg.servedRepos, cfg.servedOperators, { runnerInstanceId, reconcileStale, ...claimAgents, agentAuthSource: resolveRunnerAttestedAuthSource(process.env) });
       reconcileStale = false;
       backoff.onSuccess();
     } catch (err) {
@@ -18152,6 +19036,7 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
       continue;
     }
     log(`claimed task ${task.code_task_id} (${task.repo})`);
+    log(`task ${task.code_task_id} ${describeTaskAuthSource(process.env, task)}`);
     active += 1;
     activeTaskIds.add(task.code_task_id);
     const runTask = selectTaskProcessor(task, {
@@ -18224,6 +19109,7 @@ var init_code_runner_daemon = __esm({
     init_task_helpers();
     init_prepared_job_shadow();
     init_agent_process_env();
+    init_agent_auth_attestation();
     init_sandbox_config();
     init_inference_task_runner();
     init_skill_task_runner();
@@ -18241,6 +19127,8 @@ var init_code_runner_daemon = __esm({
     init_daemon_config();
     init_publication_scope();
     init_task_worktree_preparation();
+    init_process_runner2();
+    init_host_preflight();
     init_detached_economics_spool();
     RATE_LIMIT_RESUME_ENABLED = process.env.VO_RATE_LIMIT_RESUME !== "0";
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));