@amistio/cli 0.1.38 → 0.1.39

package/README.md

@@ -9,7 +9,7 @@ npm install -g @amistio/cli
 amistio --help
 ```
 
-The package install provides the `amistio` command and the optional `amistio-host-helper` executable. Repository cloning, project pairing, credential storage, sync watching, helper activation, and runner execution happen only when the user explicitly runs commands such as `amistio bootstrap`, `amistio import`, `amistio pair`, `amistio sync watch`, `amistio host-helper status`, or `amistio run --watch`. When the app copies a personal project into an organization, the CLI command syntax stays the same; create the org-scoped code and run `amistio import <code>` from the intended local checkout. Import scans repo-local project-brain docs plus recognized repo-local IDE and local AI tool memory or instruction files such as `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/*.mdc`, `.windsurfrules`, and `memories/*.md`; durable Amistio memory belongs in `docs/memory/`, and global plugin memory outside the repository is not scanned by default.
+The package install provides the `amistio` command and the optional `amistio-host-helper` executable. Repository cloning, project pairing, credential storage, sync watching, harness diagnostics, helper activation, and runner execution happen only when the user explicitly runs commands such as `amistio bootstrap`, `amistio import`, `amistio pair`, `amistio sync watch`, `amistio harness status`, `amistio host-helper status`, or `amistio run --watch`. When the app copies a personal project into an organization, the CLI command syntax stays the same; create the org-scoped code and run `amistio import <code>` from the intended local checkout. Import scans repo-local project-brain docs plus recognized repo-local IDE and local AI tool memory or instruction files such as `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/*.mdc`, `.windsurfrules`, and `memories/*.md`; durable Amistio memory belongs in `docs/memory/`, and global plugin memory outside the repository is not scanned by default.
 
 For enterprise setup, use the web Runner panel as the primary guide. It shows repository, pairing code, GitHub access, AI provider, local runner, and verification readiness with plain next actions; advanced CLI logs remain secondary diagnostics. The panel also shows trust/privacy boundaries, cost forecast and budget posture, runner health, blockers, verification health, and runner-version distribution from safe runner metadata.
 
@@ -38,6 +38,9 @@ Repository autopilot is disabled until the repository link option is enabled in
 After pairing, confirm that at least one local AI tool is available:
 
 ```sh
+amistio harness status
+amistio harness providers
+amistio harness tools
 amistio tools
 amistio host-helper status
 amistio host-helper conformance
@@ -54,18 +57,21 @@ amistio run --watch --background --tool opencode
 AMISTIO_HOST_HELPER_PATH=$(command -v amistio-host-helper) amistio host-helper status
 AMISTIO_HOST_HELPER_PATH=$(command -v amistio-host-helper) amistio host-helper conformance
 amistio runner status
+amistio runner repair
 amistio runner smoke-session-lifecycle
 ```
 
 Provider-backed model preferences use sanitized catalog fields: `--provider`, `--model-id`, optional `--model-variant`, and `--reasoning-effort` (`auto`, `low`, `medium`, `high`, or `xhigh`). Opencode catalog metadata is synthesized by Amistio or derived from readable local OpenCode JSON config until opencode exposes a native catalog. Provider credentials, API keys, and local secret paths stay in the local tool configuration; they are not stored in Amistio preferences or runner heartbeats.
 
+`amistio harness status`, `amistio harness providers`, and `amistio harness tools` are local diagnostics for the built-in Amistio harness. They report the default harness boundary, safe direct-provider readiness, and bounded Amistio-owned tool adapters without uploading provider credentials, environment values, local config paths, or raw tool errors. The web Runner panel remains the primary setup flow.
+
 Opencode remains an optional compatibility route. When a provider/model is named for opencode, Amistio validates it against the safe provider catalog before launching the external tool instead of silently falling back. Command-mode local tool runs are bounded by `--tool-timeout-seconds`, wait for process cleanup after timeout, and return redacted/capped stdout and stderr so large external output, local execution-root paths, and secret-looking assignments are not persisted unbounded.
 
 When `--tool copilot` uses the GitHub Copilot SDK, Amistio approves read-only permission requests by default and denies mutating, network, MCP, hook, memory, and shell requests. Set `AMISTIO_COPILOT_APPROVE_ALL=1` only on a local machine where broad Copilot SDK approval is intentional.
 
 When `--tool codex` uses the Codex SDK, intermediate progress can be quiet until the final response. For live Codex CLI logs, run `amistio run --watch --tool codex --invocation-channel command`.
 
-`amistio runner status` reports local background runner state, latest heartbeat, and bounded resource usage when available. Resource usage is latest-sample runner process memory/CPU plus safe aggregate system memory/load signals; it does not include source files, environment variables, command lines, process lists, credentials, or arbitrary local paths.
+`amistio runner status` reports local background runner state, latest heartbeat, and bounded resource usage when available. `amistio runner repair` rotates the local runner ID for the paired checkout after a forgotten-runner tombstone; use `amistio runner repair --clear-credential` only when you need to delete the local credential and re-pair from the Runner panel. Resource usage is latest-sample runner process memory/CPU plus safe aggregate system memory/load signals; it does not include source files, environment variables, command lines, process lists, credentials, or arbitrary local paths.
 
 `amistio runner smoke-session-lifecycle` runs a local no-claim smoke for the runner tool-session lifecycle. It does not contact the API, claim production work, inspect source, or mutate local runner state; it verifies that completed one-shot sessions close, active sessions are treated as in use, stale sessions are not selected for reuse, and fresh related reusable sessions can still continue.
 
@@ -83,7 +89,7 @@ Watch mode prints a completed-work success once per work item, keeps fresh compl
 
 Known validation failures such as `unsafe_context_path` are printed with attention-needed next steps. For project-context refresh path-safety failures, deploy the latest web/API fix, update and restart the runner when applicable, retry the refresh, and capture only bounded non-secret output if it repeats.
 
-If watch mode reports that the runner was forgotten by the server, stop the foreground process and start or pair a new runner from the Runner panel. Forgotten runner IDs are intentionally blocked from heartbeats and work claims, so the CLI exits instead of retrying with the tombstoned identity.
+If watch mode reports that the runner was forgotten by the server, run `amistio runner repair` from the paired checkout, then start `amistio run --watch` again. The repair command stores a fresh local runner ID because the default ID for a machine/project/repository is stable and can remain tombstoned. Use `--clear-credential` only when the Runner panel tells you to create a fresh pairing code.
 
 App-evaluation result finalization rejections print safe validation paths and preserve the local finalization evidence without exposing raw source or secrets. If a structured app-evaluation result is rejected, update and restart the runner, confirm the web/API deployment is current, and retry the evaluation before acting on cleanup or implementation recommendations.
 

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createHash as createHash9, randomUUID as randomUUID2 } from "node:crypto";
-import { writeFile as writeFile11 } from "node:fs/promises";
-import os8 from "node:os";
-import path17 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import { writeFile as writeFile12 } from "node:fs/promises";
+import os9 from "node:os";
+import path18 from "node:path";
 import { Command } from "commander";
 
 // ../shared/src/schemas.ts
@@ -3145,8 +3145,8 @@ var toolSessionMutationSchema = z3.object({
 });
 function resolveApiUrl(apiUrl, urlPath) {
   const base = apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl;
-  const path18 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
-  return new URL(`${base}${path18}`);
+  const path19 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
+  return new URL(`${base}${path19}`);
 }
 
 // src/orchestrator.ts
@@ -5494,6 +5494,102 @@ async function readRunnerDaemonMetadataFile(filePath) {
   }
 }
 
+// src/runner-identity-store.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir8, readFile as readFile7, writeFile as writeFile8 } from "node:fs/promises";
+import os5 from "node:os";
+import path9 from "node:path";
+
+// src/runner-status.ts
+import { createHash as createHash4 } from "node:crypto";
+var watchStateReminderMs = 60 * 1e3;
+function formatWatchStartupContext(input) {
+  return [
+    `Runner ${input.runnerId} is watching project ${input.projectId}.`,
+    `Repository link: ${input.repositoryLinkId}`,
+    `API: ${input.apiUrl}`,
+    `Polling interval: ${input.intervalSeconds}s. Press Ctrl+C to stop.`
+  ];
+}
+function formatWatchIdleLine(action, intervalSeconds) {
+  return `${formatProjectNextAction(action)} Checking again in ${intervalSeconds}s.`;
+}
+function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateReminderMs) {
+  const key = watchStateKey(action);
+  if (!previous || previous.key !== key) {
+    return true;
+  }
+  if (action.kind === "workCompleted") {
+    return false;
+  }
+  return nowMs - previous.printedAtMs >= reminderMs;
+}
+function watchStateKey(action) {
+  return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
+}
+function stableRunnerId(input) {
+  const digest = createHash4("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
+  return `runner_${digest}`;
+}
+
+// src/runner-identity-store.ts
+var LocalRunnerIdentityStore = class {
+  constructor(filePath = path9.join(os5.homedir(), ".config", "amistio", "runner-identities.json")) {
+    this.filePath = filePath;
+  }
+  filePath;
+  async get(key) {
+    const data = await this.read();
+    return data.runnerIds[key];
+  }
+  async set(key, runnerId) {
+    const data = await this.read();
+    data.runnerIds[key] = runnerId;
+    await this.write(data);
+  }
+  async delete(key) {
+    const data = await this.read();
+    if (!(key in data.runnerIds)) {
+      return;
+    }
+    delete data.runnerIds[key];
+    await this.write(data);
+  }
+  async read() {
+    try {
+      return normalizeStoredRunnerIdentityFile(JSON.parse(await readFile7(this.filePath, "utf8")));
+    } catch {
+      return { runnerIds: {} };
+    }
+  }
+  async write(data) {
+    await mkdir8(path9.dirname(this.filePath), { recursive: true });
+    await writeFile8(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf8", mode: 384 });
+    await chmod2(this.filePath, 384);
+  }
+};
+function runnerIdentityKey(scope) {
+  return `${scope.accountId}:${scope.projectId}:${scope.repositoryLinkId}`;
+}
+function createFreshRunnerId() {
+  return `runner_${randomUUID2().replace(/-/g, "").slice(0, 20)}`;
+}
+async function resolveLocalRunnerId(scope, store = new LocalRunnerIdentityStore()) {
+  return await store.get(runnerIdentityKey(scope)) ?? stableRunnerId(scope);
+}
+function normalizeStoredRunnerIdentityFile(value) {
+  if (!value || typeof value !== "object" || !("runnerIds" in value)) {
+    return { runnerIds: {} };
+  }
+  const runnerIds = value.runnerIds;
+  if (!runnerIds || typeof runnerIds !== "object") {
+    return { runnerIds: {} };
+  }
+  return {
+    runnerIds: Object.fromEntries(Object.entries(runnerIds).filter((entry) => typeof entry[1] === "string"))
+  };
+}
+
 // src/runner-watch-errors.ts
 var forgottenRunnerWatchMessage = "This runner was forgotten by the server. Start or pair a new runner from the Runner panel; this runner ID cannot heartbeat or claim work anymore.";
 async function handleRunnerWatchError(options) {
@@ -5531,10 +5627,10 @@ ${options.detail}`);
 
 // src/runner-service.ts
 import { spawn as spawn3 } from "node:child_process";
-import { createHash as createHash4 } from "node:crypto";
-import { mkdir as mkdir8, readFile as readFile7, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
-import os5 from "node:os";
-import path9 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { mkdir as mkdir9, readFile as readFile8, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
+import os6 from "node:os";
+import path10 from "node:path";
 function detectRunnerServicePlatform(platform = process.platform) {
   if (platform === "darwin") return "launchd";
   if (platform === "linux") return "systemd";
@@ -5545,19 +5641,19 @@ function createRunnerServiceDescriptor(input) {
   if (platform === "unsupported") {
     throw new Error("Startup services are supported for user-level launchd on macOS and systemd user services on Linux.");
   }
-  const homeDir = input.homeDir ?? os5.homedir();
+  const homeDir = input.homeDir ?? os6.homedir();
   const serviceName = runnerServiceName(input);
   const serviceFilePath = runnerServiceFilePath(platform, serviceName, homeDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const command = [input.executablePath ?? process.execPath, input.scriptPath ?? process.argv[1], ...input.args];
-  const logPath = path9.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
+  const logPath = path10.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
   const metadata = {
     schemaVersion: 1,
     accountId: input.accountId,
     projectId: input.projectId,
     repositoryLinkId: input.repositoryLinkId,
     runnerId: input.runnerId,
-    rootDir: path9.resolve(input.rootDir),
+    rootDir: path10.resolve(input.rootDir),
     apiUrl: input.apiUrl,
     serviceName,
     serviceFilePath,
@@ -5574,9 +5670,9 @@ function createRunnerServiceDescriptor(input) {
 }
 async function installRunnerService(input, options = {}) {
   const descriptor = createRunnerServiceDescriptor(input);
-  await mkdir8(path9.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
-  await mkdir8(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
-  await writeFile8(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
+  await mkdir9(path10.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
+  await mkdir9(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
+  await writeFile9(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
   await writeRunnerServiceMetadata(descriptor.metadata, input.metadataDir);
   if (options.activate !== false) {
     const activation = await activateRunnerService(descriptor.metadata);
@@ -5598,7 +5694,7 @@ async function removeRunnerService(input) {
 }
 async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetadataDir()) {
   try {
-    const parsed = JSON.parse(await readFile7(runnerServiceMetadataPath(input, metadataDir), "utf8"));
+    const parsed = JSON.parse(await readFile8(runnerServiceMetadataPath(input, metadataDir), "utf8"));
     if (parsed.schemaVersion !== 1 || !parsed.serviceName || !parsed.serviceFilePath) {
       return void 0;
     }
@@ -5608,8 +5704,8 @@ async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetad
   }
 }
 async function writeRunnerServiceMetadata(metadata, metadataDir = defaultRunnerMetadataDir()) {
-  await mkdir8(metadataDir, { recursive: true });
-  await writeFile8(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
+  await mkdir9(metadataDir, { recursive: true });
+  await writeFile9(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
 }
 async function runnerServiceRuntimeStatus(metadata) {
   if (metadata.platform === "launchd") {
@@ -5692,18 +5788,18 @@ WantedBy=default.target
 }
 function runnerServiceFilePath(platform, serviceName, homeDir) {
   if (platform === "launchd") {
-    return path9.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
+    return path10.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
   }
-  return path9.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
+  return path10.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
 }
 function runnerServiceMetadataPath(input, metadataDir) {
-  return path9.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
+  return path10.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
 }
 function runnerServiceName(input) {
   return `com.amistio.runner.${runnerServiceKey(input).slice(0, 20)}`;
 }
 function runnerServiceKey(input) {
-  return createHash4("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.runnerId}`).digest("hex");
+  return createHash5("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.runnerId}`).digest("hex");
 }
 function launchdDomain() {
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
@@ -6031,9 +6127,9 @@ function createSmokeSession({ now, status, lastActivityAt }) {
 
 // src/sync.ts
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { mkdir as mkdir9, readdir as readdir5, readFile as readFile8, stat as stat4, writeFile as writeFile9 } from "node:fs/promises";
-import path10 from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir as mkdir10, readdir as readdir5, readFile as readFile9, stat as stat4, writeFile as writeFile10 } from "node:fs/promises";
+import path11 from "node:path";
 import { promisify as promisify3 } from "node:util";
 var execFileAsync3 = promisify3(execFile3);
 var legacySyncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
@@ -6129,7 +6225,7 @@ async function readLocalSyncedDocuments(rootDir) {
   const documentFiles = await findBrainDocumentFiles(rootDir);
   const documents = [];
   for (const fullPath of documentFiles) {
-    const raw = await readFile8(fullPath, "utf8");
+    const raw = await readFile9(fullPath, "utf8");
     const repoPath = toRepoPath(rootDir, fullPath);
     const parsed = parseSyncedDocument(raw, repoPath);
     if (!parsed) {
@@ -6179,8 +6275,8 @@ async function materializeBrainDocuments(rootDir, documents, options = {}) {
       result.skipped.push(document.repoPath);
       continue;
     }
-    await mkdir9(path10.dirname(fullPath), { recursive: true });
-    await writeFile9(fullPath, createSyncedDocumentContent(document), "utf8");
+    await mkdir10(path11.dirname(fullPath), { recursive: true });
+    await writeFile10(fullPath, createSyncedDocumentContent(document), "utf8");
     result.written.push(document.repoPath);
   }
   return result;
@@ -6309,7 +6405,7 @@ function parseSyncedHtml(content) {
 }
 async function readExistingSyncedDocument(fullPath) {
   try {
-    const raw = await readFile8(fullPath, "utf8");
+    const raw = await readFile9(fullPath, "utf8");
     const parsed = parseSyncedDocument(raw, fullPath);
     if (!parsed) {
       return { exists: true };
@@ -6334,7 +6430,7 @@ async function readExistingSyncedDocument(fullPath) {
 async function findBrainDocumentFiles(rootDir) {
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot]) {
-    const fullRoot = path10.join(rootDir, syncRoot);
+    const fullRoot = path11.join(rootDir, syncRoot);
     if (!await exists2(fullRoot)) {
       continue;
     }
@@ -6344,7 +6440,7 @@ async function findBrainDocumentFiles(rootDir) {
 }
 async function walkBrainDocumentFiles(directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true })) {
-    const fullPath = path10.join(directory, entry.name);
+    const fullPath = path11.join(directory, entry.name);
     if (entry.isDirectory()) {
       await walkBrainDocumentFiles(fullPath, files);
     } else if (entry.isFile() && /\.(md|mdx|html?)$/i.test(entry.name)) {
@@ -6353,23 +6449,23 @@ async function walkBrainDocumentFiles(directory, files) {
   }
 }
 function safeRepoPath(rootDir, repoPath) {
-  if (path10.isAbsolute(repoPath)) {
+  if (path11.isAbsolute(repoPath)) {
     throw new Error(`Refusing to use absolute repo path: ${repoPath}`);
   }
-  const normalized = path10.normalize(repoPath);
-  if (normalized === ".." || normalized.startsWith(`..${path10.sep}`)) {
+  const normalized = path11.normalize(repoPath);
+  if (normalized === ".." || normalized.startsWith(`..${path11.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
-  const root = path10.resolve(rootDir);
-  const fullPath = path10.resolve(root, normalized);
-  if (!fullPath.startsWith(`${root}${path10.sep}`)) {
+  const root = path11.resolve(rootDir);
+  const fullPath = path11.resolve(root, normalized);
+  if (!fullPath.startsWith(`${root}${path11.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
   return fullPath;
 }
 function isControlPlanePath(repoPath) {
-  const normalized = path10.normalize(repoPath);
-  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path10.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path10.sep}`);
+  const normalized = path11.normalize(repoPath);
+  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path11.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path11.sep}`);
 }
 function canonicalControlPlaneRepoPath(repoPath) {
   const normalized = repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -6380,16 +6476,16 @@ function canonicalControlPlaneRepoPath(repoPath) {
   return normalized;
 }
 function toRepoPath(rootDir, fullPath) {
-  return path10.relative(rootDir, fullPath).split(path10.sep).join("/");
+  return path11.relative(rootDir, fullPath).split(path11.sep).join("/");
 }
 function inferTitle(content, repoPath) {
   const heading = content.split("\n").find((line) => line.startsWith("# "))?.replace(/^#\s+/, "").trim();
   if (heading) return heading;
   const htmlHeading = content.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
-  return htmlHeading || path10.basename(repoPath, path10.extname(repoPath));
+  return htmlHeading || path11.basename(repoPath, path11.extname(repoPath));
 }
 async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingDocuments, options) {
-  const root = path10.resolve(rootDir);
+  const root = path11.resolve(rootDir);
   const maxBytes = (options.maxFileKb ?? defaultAutoSyncMaxFileKb) * 1024;
   const syncedAt = options.syncedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const existingById = new Map(existingDocuments.map((document) => [document.documentId, document]));
@@ -6414,7 +6510,7 @@ async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingD
       skipped.push({ repoPath: normalizedRepoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile8(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile9(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath: normalizedRepoPath, reason: "unreadable" });
       continue;
@@ -6479,7 +6575,7 @@ async function listAutoSyncCandidatePaths(rootDir) {
   }
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot, ...legacySyncRoots]) {
-    const fullRoot = path10.join(rootDir, syncRoot);
+    const fullRoot = path11.join(rootDir, syncRoot);
     if (await exists2(fullRoot)) {
       await walkAutoSyncFiles(rootDir, fullRoot, files);
     }
@@ -6488,8 +6584,8 @@ async function listAutoSyncCandidatePaths(rootDir) {
 }
 async function walkAutoSyncFiles(rootDir, directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true }).catch(() => [])) {
-    const fullPath = path10.join(directory, entry.name);
-    const repoPath = normalizeRepoPath3(path10.relative(rootDir, fullPath));
+    const fullPath = path11.join(directory, entry.name);
+    const repoPath = normalizeRepoPath3(path11.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!autoSyncExcludedDirectoryNames.has(entry.name)) {
         await walkAutoSyncFiles(rootDir, fullPath, files);
@@ -6523,7 +6619,7 @@ function legacyDocumentTypeForRepoPath(repoPath) {
   return root && root in documentTypeByRoot ? documentTypeByRoot[root] : void 0;
 }
 function stableExternalDocumentId(metadata, repoPath) {
-  return `doc_external_${createHash5("sha256").update(`${metadata.amistioAccountId}:${metadata.amistioProjectId}:${metadata.repositoryLinkId}:${repoPath}`).digest("hex").slice(0, 24)}`;
+  return `doc_external_${createHash6("sha256").update(`${metadata.amistioAccountId}:${metadata.amistioProjectId}:${metadata.repositoryLinkId}:${repoPath}`).digest("hex").slice(0, 24)}`;
 }
 function normalizeRepoPath3(repoPath) {
   return repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -6551,9 +6647,9 @@ async function exists2(filePath) {
 }
 
 // src/tool-session-store.ts
-import { mkdir as mkdir10, readFile as readFile9, writeFile as writeFile10 } from "node:fs/promises";
-import os6 from "node:os";
-import path11 from "node:path";
+import { mkdir as mkdir11, readFile as readFile10, writeFile as writeFile11 } from "node:fs/promises";
+import os7 from "node:os";
+import path12 from "node:path";
 var LocalToolSessionStore = class {
   constructor(filePath = defaultSessionStorePath()) {
     this.filePath = filePath;
@@ -6567,12 +6663,12 @@ var LocalToolSessionStore = class {
   async setProviderSessionId(toolSessionId, toolName, providerSessionId) {
     const data = await this.read();
     data[toolSessionId] = { toolName, providerSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await mkdir10(path11.dirname(this.filePath), { recursive: true });
-    await writeFile10(this.filePath, JSON.stringify(data, null, 2), "utf8");
+    await mkdir11(path12.dirname(this.filePath), { recursive: true });
+    await writeFile11(this.filePath, JSON.stringify(data, null, 2), "utf8");
   }
   async read() {
     try {
-      return JSON.parse(await readFile9(this.filePath, "utf8"));
+      return JSON.parse(await readFile10(this.filePath, "utf8"));
     } catch {
       return {};
     }
@@ -6580,16 +6676,16 @@ var LocalToolSessionStore = class {
 };
 function defaultSessionStorePath() {
   if (process.platform === "darwin") {
-    return path11.join(os6.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
+    return path12.join(os7.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
   }
   if (process.platform === "win32") {
-    return path11.join(process.env.APPDATA ?? os6.homedir(), "Amistio", "tool-sessions.json");
+    return path12.join(process.env.APPDATA ?? os7.homedir(), "Amistio", "tool-sessions.json");
   }
-  return path11.join(process.env.XDG_STATE_HOME ?? path11.join(os6.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
+  return path12.join(process.env.XDG_STATE_HOME ?? path12.join(os7.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
 }
 
 // src/work-runner.ts
-import path12 from "node:path";
+import path13 from "node:path";
 var generationResultStart = "AMISTIO_BRAIN_GENERATION_RESULT_START";
 var generationResultEnd = "AMISTIO_BRAIN_GENERATION_RESULT_END";
 var assistantAnswerStart = "AMISTIO_ASSISTANT_ANSWER_START";
@@ -8072,15 +8168,15 @@ function normalizeProjectContextRepoPath(value, options) {
   if (!trimmed || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) || /^file:/i.test(trimmed) || /^[A-Za-z]:($|[^\\/])/.test(trimmed)) {
     throwUnsafeProjectContextPath();
   }
-  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path12.isAbsolute(trimmed) || path12.win32.isAbsolute(trimmed);
+  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path13.isAbsolute(trimmed) || path13.win32.isAbsolute(trimmed);
   if (!absolute) {
     return normalizeRelativeProjectContextPath(trimmed);
   }
   if (!options.repositoryRoot) {
     throwUnsafeProjectContextPath();
   }
-  const useWindowsPathRules = path12.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
-  const relativePath = useWindowsPathRules ? path12.win32.relative(path12.win32.resolve(options.repositoryRoot), path12.win32.resolve(trimmed)) : path12.relative(path12.resolve(options.repositoryRoot), path12.resolve(trimmed));
+  const useWindowsPathRules = path13.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
+  const relativePath = useWindowsPathRules ? path13.win32.relative(path13.win32.resolve(options.repositoryRoot), path13.win32.resolve(trimmed)) : path13.relative(path13.resolve(options.repositoryRoot), path13.resolve(trimmed));
   return normalizeRelativeProjectContextPath(relativePath);
 }
 function normalizeRelativeProjectContextPath(value) {
@@ -8131,48 +8227,16 @@ function stripJsonFence(value) {
   return trimmed.replace(/^```(?:json)?\s*/i, "").replace(/```$/i, "").trim();
 }
 
-// src/runner-status.ts
-import { createHash as createHash6 } from "node:crypto";
-var watchStateReminderMs = 60 * 1e3;
-function formatWatchStartupContext(input) {
-  return [
-    `Runner ${input.runnerId} is watching project ${input.projectId}.`,
-    `Repository link: ${input.repositoryLinkId}`,
-    `API: ${input.apiUrl}`,
-    `Polling interval: ${input.intervalSeconds}s. Press Ctrl+C to stop.`
-  ];
-}
-function formatWatchIdleLine(action, intervalSeconds) {
-  return `${formatProjectNextAction(action)} Checking again in ${intervalSeconds}s.`;
-}
-function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateReminderMs) {
-  const key = watchStateKey(action);
-  if (!previous || previous.key !== key) {
-    return true;
-  }
-  if (action.kind === "workCompleted") {
-    return false;
-  }
-  return nowMs - previous.printedAtMs >= reminderMs;
-}
-function watchStateKey(action) {
-  return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
-}
-function stableRunnerId(input) {
-  const digest = createHash6("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
-  return `runner_${digest}`;
-}
-
 // src/runner-resources.ts
-import os7 from "node:os";
+import os8 from "node:os";
 var defaultRuntime = {
   nowMs: () => Date.now(),
   memoryUsage: () => process.memoryUsage(),
   uptime: () => process.uptime(),
   cpuUsage: () => process.cpuUsage(),
-  totalmem: () => os7.totalmem(),
-  freemem: () => os7.freemem(),
-  loadavg: () => os7.loadavg()
+  totalmem: () => os8.totalmem(),
+  freemem: () => os8.freemem(),
+  loadavg: () => os8.loadavg()
 };
 var previousRunnerResourceSample;
 function sampleCurrentRunnerResourceUsage() {
@@ -8285,8 +8349,8 @@ function roundNumber(value, digits) {
 // src/importer.ts
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdir as readdir6, readFile as readFile10, stat as stat5 } from "node:fs/promises";
-import path13 from "node:path";
+import { readdir as readdir6, readFile as readFile11, stat as stat5 } from "node:fs/promises";
+import path14 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync4 = promisify4(execFile4);
 var defaultMaxFileKb = 256;
@@ -8307,12 +8371,12 @@ var documentFolderByType = {
   workflow: "docs/workflows"
 };
 async function inspectLocalRepository(rootDir, defaultBranch) {
-  const requestedRoot = path13.resolve(rootDir);
+  const requestedRoot = path14.resolve(rootDir);
   const root = await runGit2(["-C", requestedRoot, "rev-parse", "--show-toplevel"]).catch(() => requestedRoot);
   const detectedBranch = await runGit2(["-C", root, "symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => defaultBranch);
   const originUrl = await runGit2(["-C", root, "remote", "get-url", "origin"]).catch(() => void 0);
   const parsedCloneUrl = originUrl ? parseOptionalOriginCloneUrl(originUrl) : void 0;
-  const repoName = (parsedCloneUrl?.repoName ?? path13.basename(root)) || "repository";
+  const repoName = (parsedCloneUrl?.repoName ?? path14.basename(root)) || "repository";
   const fingerprintSeed = parsedCloneUrl ? `origin:${parsedCloneUrl.normalizedKey}` : `repo:${repoName}:${detectedBranch || defaultBranch}`;
   return {
     rootDir: root,
@@ -8324,7 +8388,7 @@ async function inspectLocalRepository(rootDir, defaultBranch) {
   };
 }
 async function scanLegacyDocuments(options) {
-  const rootDir = path13.resolve(options.rootDir);
+  const rootDir = path14.resolve(options.rootDir);
   const maxBytes = (options.maxFileKb ?? defaultMaxFileKb) * 1024;
   const skipped = [];
   const candidates = [];
@@ -8344,7 +8408,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "excluded" });
       continue;
     }
-    const fullPath = path13.join(rootDir, ...repoPath.split("/"));
+    const fullPath = path14.join(rootDir, ...repoPath.split("/"));
     const fileStat = await stat5(fullPath).catch(() => void 0);
     if (!fileStat?.isFile()) {
       skipped.push({ repoPath, reason: "unreadable" });
@@ -8354,7 +8418,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile10(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile11(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath, reason: "unreadable" });
       continue;
@@ -8446,8 +8510,8 @@ async function listRepositoryPaths(rootDir) {
 async function walkRepository(rootDir, directory, files) {
   const entries = await readdir6(directory, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const fullPath = path13.join(directory, entry.name);
-    const repoPath = normalizeRepoPath4(path13.relative(rootDir, fullPath));
+    const fullPath = path14.join(directory, entry.name);
+    const repoPath = normalizeRepoPath4(path14.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!excludedDirectoryNames.has(entry.name)) {
         await walkRepository(rootDir, fullPath, files);
@@ -8515,9 +8579,9 @@ function uniqueDestinationPath(basePath, sourcePath, usedPaths) {
     usedPaths.add(basePath);
     return basePath;
   }
-  const extension = path13.posix.extname(basePath) || ".md";
-  const directory = path13.posix.dirname(basePath);
-  const basename = path13.posix.basename(basePath, extension);
+  const extension = path14.posix.extname(basePath) || ".md";
+  const directory = path14.posix.dirname(basePath);
+  const basename = path14.posix.basename(basePath, extension);
   const uniquePath = `${directory}/${basename}-${hashText(sourcePath, 8)}${extension}`;
   usedPaths.add(uniquePath);
   return uniquePath;
@@ -8590,7 +8654,7 @@ function inferTitle2(content, repoPath) {
   if (heading) return heading;
   const htmlHeading = body.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
   if (htmlHeading) return htmlHeading;
-  const basename = path13.posix.basename(repoPath, path13.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
+  const basename = path14.posix.basename(repoPath, path14.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
   return titleCase(basename || "Imported Document");
 }
 function stripFrontmatter(content) {
@@ -8624,7 +8688,7 @@ async function runGit2(args) {
 
 // src/runner-actions.ts
 import { spawn as spawn4 } from "node:child_process";
-import path14 from "node:path";
+import path15 from "node:path";
 function buildBackgroundRunnerArgs(options) {
   const args = [
     "run",
@@ -8634,7 +8698,7 @@ function buildBackgroundRunnerArgs(options) {
     "--runner-id",
     options.runnerId,
     "--root",
-    path14.resolve(options.root),
+    path15.resolve(options.root),
     "--session",
     options.session,
     "--interval-seconds",
@@ -8752,8 +8816,8 @@ function truncateProcessOutput(value) {
 
 // src/git-worktree.ts
 import { execFile as execFile5 } from "node:child_process";
-import { copyFile, lstat, mkdir as mkdir11, readdir as readdir7, stat as stat6 } from "node:fs/promises";
-import path15 from "node:path";
+import { copyFile, lstat, mkdir as mkdir12, readdir as readdir7, stat as stat6 } from "node:fs/promises";
+import path16 from "node:path";
 import { promisify as promisify5 } from "node:util";
 var execFileAsync5 = promisify5(execFile5);
 var exactLocalEnvironmentFiles = /* @__PURE__ */ new Set([".env", ".env.local", ".env.development", ".env.development.local", ".env.test", ".env.test.local", ".env.production", ".env.production.local"]);
@@ -8785,7 +8849,7 @@ async function prepareGitWorktreeIsolation(rootDir, workItem) {
     const preparedLocalEnvironmentFileCount2 = await prepareLocalWorktreeEnvironment(repoRoot, worktreePath);
     return { ...identity, baseRevision, worktreePath, ...preparedLocalEnvironmentFileCount2 ? { preparedLocalEnvironmentFileCount: preparedLocalEnvironmentFileCount2 } : {} };
   }
-  await mkdir11(path15.dirname(worktreePath), { recursive: true });
+  await mkdir12(path16.dirname(worktreePath), { recursive: true });
   const branchExists = await gitCommandSucceeds(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${identity.branch}`]);
   const worktreeArgs = branchExists ? ["worktree", "add", worktreePath, identity.branch] : ["worktree", "add", "-b", identity.branch, worktreePath, baseRevision];
   await gitOutput(repoRoot, worktreeArgs).catch((error) => {
@@ -8803,9 +8867,9 @@ async function resolveExistingGitWorktreeIsolation(rootDir, workItem) {
   return { ...identity, baseRevision, worktreePath };
 }
 function localWorktreePath(repoRoot, worktreeKey) {
-  const repoName = path15.basename(repoRoot);
+  const repoName = path16.basename(repoRoot);
   const worktreeSlug = worktreeKey.split("/").filter(Boolean).pop() ?? "work";
-  return path15.join(path15.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
+  return path16.join(path16.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
 }
 async function assertExistingWorktree(worktreePath, branch) {
   await gitOutput(worktreePath, ["rev-parse", "--is-inside-work-tree"]);
@@ -8831,8 +8895,8 @@ async function prepareLocalWorktreeEnvironment(repoRoot, worktreePath) {
   const candidates = await localEnvironmentFileCandidates(repoRoot);
   let preparedCount = 0;
   for (const candidate of candidates) {
-    const sourcePath = path15.join(repoRoot, candidate);
-    const targetPath = path15.join(worktreePath, candidate);
+    const sourcePath = path16.join(repoRoot, candidate);
+    const targetPath = path16.join(worktreePath, candidate);
     if (await pathExists(targetPath)) {
       continue;
     }
@@ -8863,7 +8927,7 @@ async function localEnvironmentFileCandidates(repoRoot) {
     if (!isRootFileName(name)) {
       continue;
     }
-    const source = await lstat(path15.join(repoRoot, name)).catch(() => void 0);
+    const source = await lstat(path16.join(repoRoot, name)).catch(() => void 0);
     if (source?.isFile()) {
       candidates.push(name);
     }
@@ -8874,7 +8938,7 @@ function isAllowedLocalEnvironmentFile(name) {
   return exactLocalEnvironmentFiles.has(name) || localEnvironmentFilePattern.test(name);
 }
 function isRootFileName(name) {
-  return name === path15.basename(name) && !name.includes("/") && !name.includes("\\");
+  return name === path16.basename(name) && !name.includes("/") && !name.includes("\\");
 }
 async function gitOutput(cwd, args) {
   const { stdout } = await execFileAsync5("git", args, { cwd, maxBuffer: 1024 * 1024 });
@@ -8907,7 +8971,7 @@ function safeFileError(error) {
 
 // src/implementation-handoff.ts
 import { execFile as execFile6 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 import { promisify as promisify6 } from "node:util";
 var execFileAsync6 = promisify6(execFile6);
 async function completeImplementationHandoff(input) {
@@ -9175,7 +9239,7 @@ async function cleanupWorktree(run, input) {
     return { status: "failed", message: "Cleanup skipped because the worktree is not clean after PR handoff." };
   }
   try {
-    await gitOutput2(run, input.primaryRepoRoot || path16.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
+    await gitOutput2(run, input.primaryRepoRoot || path17.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
     return { status: "completed" };
   } catch (error) {
     return { status: "failed", message: `Cleanup failed: ${safeErrorMessage(error)}` };
@@ -9896,7 +9960,7 @@ program.command("import").description("Pair an existing checkout and import lega
 });
 program.command("pair").description("Pair this repository with an Amistio web project").requiredOption("--account <accountId>", "Amistio account ID").requiredOption("--project <projectId>", "Amistio project ID").option("--repository-link <repositoryLinkId>", "Existing repository link ID").option("--default-branch <branch>", "Default branch", "main").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--token <token>", "Runner/device credential to store outside the repository").option("--root <path>", "Repository root", defaultRoot).action(async (options, command) => {
   const pairingRoot = await resolvePairingRoot(options.root, { explicitRoot: command.getOptionValueSource("root") === "cli" });
-  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID2()}`;
+  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID3()}`;
   let credential = options.token;
   if (options.pairingCode) {
     const pairing = await new ApiClient({
@@ -10082,7 +10146,7 @@ work.command("prompt").description("Print or write an approved work prompt witho
   }
   const prompt = await createRunnerWorkPrompt(context.client, context.metadata.amistioProjectId, workItem);
   if (options.out) {
-    await writeFile11(options.out, prompt, "utf8");
+    await writeFile12(options.out, prompt, "utf8");
     console.log(`Wrote work prompt to ${options.out}.`);
   } else {
     console.log(prompt);
@@ -10096,6 +10160,34 @@ program.command("tools").description("List local AI coding tools that the Amisti
   }
   console.log("custom - pass --tool-command to use any other local runner command.");
 });
+var harness = program.command("harness").description("Inspect the built-in Amistio harness, direct providers, and bounded tool adapters");
+harness.command("status").description("Show the built-in harness boundary and execution policy summary").action(() => {
+  console.log(`Harness: ${builtinAmistioHarnessAdapter.displayName} (${builtinAmistioHarnessAdapter.id})`);
+  console.log("Default: built-in Amistio harness");
+  console.log("Runner-owned boundary: pairing, work claiming, leases, worktree isolation, redaction, finalization, and handoff.");
+  console.log(`Read-only work policy: ${runnerSupportedWorkKinds.filter((workKind) => harnessMutationPolicyForWorkKind(workKind) === "readOnly").join(", ")}`);
+  console.log(`Mutating work policy: ${runnerSupportedWorkKinds.filter((workKind) => harnessMutationPolicyForWorkKind(workKind) === "mutating").join(", ")}`);
+  console.log("Run execution: amistio run --watch");
+  console.log("Local AI clients: amistio tools");
+  console.log("Host execution helper: amistio host-helper status");
+});
+harness.command("providers").description("Check safe local readiness for direct and agent-client provider routes").option("--root <path>", "Repository root", defaultRoot).action(async (options) => {
+  for (const target of harnessProviderCheckTargets()) {
+    const result = await checkProviderAuthLink({ request: target.request, root: options.root });
+    console.log(`${target.label}: ${result.providerAuthStatus.status}`);
+    for (const line of formatProviderAuthStatusLines(result.providerAuthStatus)) {
+      console.log(`  ${line}`);
+    }
+  }
+});
+harness.command("tools").description("List bounded Amistio-owned tool adapters available to the harness").action(() => {
+  console.log("Bounded Amistio harness tools. For optional local AI clients, run `amistio tools`.");
+  for (const adapter of boundedToolAdapterCatalog) {
+    const mutation = adapter.mutating ? "mutating" : "read-only";
+    const implemented = adapter.implemented ? "yes" : "no";
+    console.log(`${implemented} ${adapter.kind} ${adapter.id} - ${adapter.displayName}; ${mutation}; ${adapter.concurrency}; resources: ${adapter.serializedResourceKinds.join(", ")}`);
+  }
+});
 var hostHelper = program.command("host-helper").description("Inspect the optional Amistio host helper used for stronger local execution primitives");
 hostHelper.command("status").description("Show configured host-helper protocol and capability status").option("--path <path>", "Helper executable path; defaults to AMISTIO_HOST_HELPER_PATH").action(async (options) => {
   const config = options.path?.trim() ? { command: options.path.trim() } : nativeHostHelperConfigFromEnvironment();
@@ -10164,7 +10256,7 @@ program.command("orchestrate").description("Update the Amistio control plane thr
     ...options.toolCommand ? { toolCommand: options.toolCommand } : {},
     ...localModelConfig,
     streamOutput: options.stream,
-    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID2()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
+    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID3()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
   });
   if (!options.stream && result.stdout.trim()) {
     console.log(result.stdout.trim());
@@ -10187,12 +10279,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
     process.exitCode = 1;
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const resolvedOptions = { ...options, runnerId };
   if (resolvedOptions.maxConcurrentWork > MAX_CONCURRENT_RUNNER_WORK) {
     console.log(`--max-concurrent-work is capped at ${MAX_CONCURRENT_RUNNER_WORK}.`);
@@ -10210,7 +10297,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
       projectId: context.metadata.amistioProjectId,
       repositoryLinkId: context.metadata.repositoryLinkId,
       runnerId,
-      rootDir: path17.resolve(options.root),
+      rootDir: path18.resolve(options.root),
       apiUrl: options.apiUrl,
       args: buildBackgroundRunnerArgs(resolvedOptions)
     });
@@ -10281,6 +10368,38 @@ program.command("run").description("Claim and run approved Amistio work locally"
   }
 });
 var runner = program.command("runner").description("Manage local Amistio runner processes");
+runner.command("repair").description("Repair local runner identity state for this paired repository").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Fresh runner ID to store instead of generating one").option("--clear-credential", "Delete the local runner credential so this checkout must be paired again").option("--dry-run", "Print repair actions without changing local config").action(async (options) => {
+  const metadata = await readProjectLink(options.root);
+  if (!metadata) {
+    console.log("Repository is not paired. Run `amistio pair` first.");
+    return;
+  }
+  const scope = runnerIdentityScope(metadata);
+  const identityKey = runnerIdentityKey(scope);
+  const identityStore = new LocalRunnerIdentityStore();
+  const credentialStore = new LocalCredentialStore();
+  const stableRunner = stableRunnerId(scope);
+  const currentRunnerId = await identityStore.get(identityKey) ?? stableRunner;
+  const nextRunnerId = options.runnerId?.trim() || createFreshRunnerId();
+  if (options.dryRun) {
+    console.log(`Would rotate local runner ID from ${currentRunnerId} to ${nextRunnerId}.`);
+    if (options.clearCredential) {
+      console.log("Would delete the local runner credential for this paired checkout.");
+    }
+    return;
+  }
+  await identityStore.set(identityKey, nextRunnerId);
+  if (options.clearCredential) {
+    await credentialStore.delete(credentialKey(metadata.amistioAccountId, metadata.amistioProjectId, metadata.repositoryLinkId));
+  }
+  console.log(`Local runner ID repaired: ${currentRunnerId} -> ${nextRunnerId}.`);
+  if (options.clearCredential) {
+    console.log("Deleted the local runner credential. Create a fresh pairing code in the Runner panel, then run the copied pair/import command.");
+  } else {
+    console.log(`Next: amistio run${formatApiUrlFlag(options.apiUrl)} --watch`);
+    console.log("If a startup service uses the old runner ID, reinstall it from the Runner panel command.");
+  }
+});
 runner.command("status").description("Show background runner status for the paired repository").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Limit status to one runner ID").action(async (options) => {
   const context = await loadPairedApiContext(options.root, options.apiUrl);
   if (!context) {
@@ -10387,12 +10506,7 @@ runnerService.command("install").description("Install a user-level startup servi
     process.exitCode = 1;
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   if (options.maxConcurrentWork > MAX_CONCURRENT_RUNNER_WORK) {
     console.log(`--max-concurrent-work is capped at ${MAX_CONCURRENT_RUNNER_WORK}.`);
     process.exitCode = 1;
@@ -10404,7 +10518,7 @@ runnerService.command("install").description("Install a user-level startup servi
     projectId: context.metadata.amistioProjectId,
     repositoryLinkId: context.metadata.repositoryLinkId,
     runnerId,
-    rootDir: path17.resolve(options.root),
+    rootDir: path18.resolve(options.root),
     apiUrl: options.apiUrl,
     args,
     platform
@@ -10430,12 +10544,7 @@ runnerService.command("status").description("Show the startup service status for
     console.log("Repository is not paired. Run `amistio pair` first.");
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const metadata = await readRunnerServiceMetadata({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
   if (!metadata) {
     console.log("No startup service metadata found for this paired repository runner.");
@@ -10454,12 +10563,7 @@ runnerService.command("remove").description("Remove the startup service for this
     console.log("Repository is not paired. Run `amistio pair` first.");
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const removed = await removeRunnerService({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
   console.log(removed ? `Removed startup service ${removed.serviceName}.` : "No startup service metadata found for this paired repository runner.");
 });
@@ -11088,7 +11192,7 @@ async function runNextWorkItem({
       projectId,
       result.workItem.workItemId,
       finalStatus,
-      `run_${result.workItem.workItemId}_${randomUUID2()}`,
+      `run_${result.workItem.workItemId}_${randomUUID3()}`,
       runnerId,
       {
         tool: preview.toolName,
@@ -11182,7 +11286,7 @@ async function prepareWorktreeForClaimedItem({ apiClient, heartbeatConcurrency,
     const telemetry = workItemIsolationTelemetry(workItem, { ...identity, baseRevision: workItem.baseRevision ?? "unknown", worktreePath: "" });
     const finalAttempt = workItem.attempt >= maxPreflightAttempts;
     const statusMessage = finalAttempt ? `Git worktree preflight failed after ${workItem.attempt}/${maxPreflightAttempts} attempts. ${message}` : `Git worktree preflight attempt ${workItem.attempt}/${maxPreflightAttempts} failed. Requeueing for retry. ${message}`;
-    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`, runnerId, {
+    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
       ...telemetry,
       message: statusMessage,
       ...finalAttempt ? { blockerReason: message } : { releaseClaim: true },
@@ -11251,7 +11355,7 @@ async function recordFinalizationFailure({ apiClient, durationMs, error, isolati
   const settlements = await Promise.allSettled([
     apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
     markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage6(error)),
-    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`, runnerId, {
+    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
       ...isolationTelemetry,
       tool: toolName,
       durationMs,
@@ -11402,7 +11506,7 @@ async function updateRunnerCommandStatus(apiClient, context, command, status, me
     runnerId: context.runnerId,
     repositoryLinkId: context.repositoryLinkId,
     status,
-    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID2()}`,
+    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID3()}`,
     message,
     ...error ? { error } : {},
     ...providerAuthStatus ? { providerAuthStatus } : {}
@@ -11491,7 +11595,7 @@ async function findRecoveryWorkItem(apiClient, projectId, workItemId) {
   return workItems.find((item) => item.workItemId === workItemId);
 }
 async function submitRecoveredHandoff(apiClient, context, workItem, handoff, action) {
-  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID2()}`, context.runnerId, {
+  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID3()}`, context.runnerId, {
     implementationHandoff: handoff,
     ...handoff.message ? { message: handoff.message } : {},
     ...workItem.controllingAdrId ? { controllingAdrId: workItem.controllingAdrId } : {},
@@ -11775,7 +11879,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`,
+      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`,
       artifacts,
       tool: toolName,
       durationMs,
@@ -11850,7 +11954,7 @@ ${toolResult.stderr}`);
   const failedResult2 = await apiClient.submitBrainGenerationResult(projectId, workItem.workItemId, {
     status: "failed",
     runnerId,
-    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...failedSessionTelemetry,
@@ -11900,7 +12004,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
       answer: answerResult.answer,
       sourceBoundary: answerResult.sourceBoundary,
       citations: answerResult.citations,
@@ -11936,7 +12040,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -11999,7 +12103,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
       report: {
         ...report,
         analyzedRepoRevision: report.analyzedRepoRevision ?? metadata?.lastSyncedRevision
@@ -12036,7 +12140,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12097,7 +12201,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
       diagnosis,
       tool: toolName,
       durationMs,
@@ -12131,7 +12235,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12192,7 +12296,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `security_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12226,7 +12330,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `security_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12287,7 +12391,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12321,7 +12425,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12382,7 +12486,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12416,7 +12520,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12478,7 +12582,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
       result: refreshResult,
       tool: toolName,
       durationMs,
@@ -12524,7 +12628,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12585,7 +12689,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
       result: verificationResult,
       tool: toolName,
       durationMs,
@@ -12619,7 +12723,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12680,7 +12784,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12714,7 +12818,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12775,7 +12879,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
       result: gateResult,
       tool: toolName,
       durationMs,
@@ -12809,7 +12913,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12954,6 +13058,14 @@ async function loadPairedApiContext(root, apiUrl) {
     })
   };
 }
+function runnerIdentityScope(metadata) {
+  return {
+    accountId: metadata.amistioAccountId,
+    projectId: metadata.amistioProjectId,
+    repositoryLinkId: metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  };
+}
 async function loadProjectNextAction(apiClient, projectId, repositoryLinkId, root) {
   const [{ workItems }, { documents }, { runners }] = await Promise.all([
     apiClient.listWorkItems(projectId),
@@ -13038,7 +13150,7 @@ async function prepareToolSession({
     });
     return { ...selection, toolSession: toolSession2 };
   }
-  const toolSessionId = `tool_session_${randomUUID2()}`;
+  const toolSessionId = `tool_session_${randomUUID3()}`;
   const { toolSession } = await apiClient.createToolSession(projectId, {
     toolSessionId,
     repositoryLinkId,
@@ -13145,6 +13257,23 @@ function truncateLogExcerpt(value) {
 function formatHostHelperCapability(label, support) {
   return `${label}: ${support.supported ? "supported" : "unsupported"}${support.reason ? ` (${support.reason})` : ""}`;
 }
+function harnessProviderCheckTargets() {
+  return [
+    { label: "GitHub Models Direct", request: { providerId: "github-models", providerClientId: "github-models-api", routeType: "directProvider" } },
+    { label: "GitHub Copilot SDK", request: { providerId: "github-copilot", providerClientId: "github-copilot-sdk", routeType: "agentClient" } }
+  ];
+}
+function formatProviderAuthStatusLines(status) {
+  const lines = [
+    `Target: ${status.providerId}:${status.providerClientId}:${status.routeType}`,
+    `Checked: ${status.checkedAt}`
+  ];
+  if (status.authMethodLabel) lines.push(`Auth: ${status.authMethodLabel}`);
+  if (status.modelCount !== void 0) lines.push(`Models: ${status.modelCount}`);
+  if (status.message) lines.push(`Message: ${status.message}`);
+  if (status.errorCode) lines.push(`Code: ${status.errorCode}`);
+  return lines;
+}
 function collectRepeatedOption(value, previous) {
   return [...previous, value];
 }
@@ -13171,7 +13300,7 @@ function parseReasoningEffort(value) {
   throw new Error(`Expected reasoning effort auto, low, medium, high, or xhigh; received ${value}.`);
 }
 function inferRepoName(root) {
-  return path17.basename(path17.resolve(root)) || "repository";
+  return path18.basename(path18.resolve(root)) || "repository";
 }
 function createRepoFingerprint(accountId, projectId, repositoryLinkId) {
   return createHash9("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
@@ -13448,7 +13577,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   return {
     version: CLI_VERSION,
     mode,
-    hostname: os8.hostname(),
+    hostname: os9.hostname(),
     ...runnerIsolationCapabilityMetadata(),
     maxConcurrentWork: concurrencyMetadata.maxConcurrentWork,
     activeClaimLaneIds: concurrencyMetadata.activeClaimLaneIds,
@@ -13473,7 +13602,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   };
 }
 function runnerMachineId() {
-  return createHash9("sha256").update(`${os8.hostname()}:${os8.platform()}:${os8.arch()}`).digest("hex").slice(0, 20);
+  return createHash9("sha256").update(`${os9.hostname()}:${os9.platform()}:${os9.arch()}`).digest("hex").slice(0, 20);
 }
 async function delay(milliseconds) {
   await new Promise((resolve) => setTimeout(resolve, milliseconds));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amistio/cli",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "type": "module",
   "repository": {
     "type": "git",