@amistio/cli 0.1.38 → 0.1.40

package/README.md

@@ -9,7 +9,7 @@ npm install -g @amistio/cli
 amistio --help
 ```
 
-The package install provides the `amistio` command and the optional `amistio-host-helper` executable. Repository cloning, project pairing, credential storage, sync watching, helper activation, and runner execution happen only when the user explicitly runs commands such as `amistio bootstrap`, `amistio import`, `amistio pair`, `amistio sync watch`, `amistio host-helper status`, or `amistio run --watch`. When the app copies a personal project into an organization, the CLI command syntax stays the same; create the org-scoped code and run `amistio import <code>` from the intended local checkout. Import scans repo-local project-brain docs plus recognized repo-local IDE and local AI tool memory or instruction files such as `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/*.mdc`, `.windsurfrules`, and `memories/*.md`; durable Amistio memory belongs in `docs/memory/`, and global plugin memory outside the repository is not scanned by default.
+The package install provides the `amistio` command and the optional `amistio-host-helper` executable. Repository cloning, project pairing, credential storage, sync watching, harness diagnostics, helper activation, and runner execution happen only when the user explicitly runs commands such as `amistio bootstrap`, `amistio import`, `amistio pair`, `amistio sync watch`, `amistio harness status`, `amistio host-helper status`, or `amistio run --watch`. When the app copies a personal project into an organization, the CLI command syntax stays the same; create the org-scoped code and run `amistio import <code>` from the intended local checkout. Import scans repo-local project-brain docs plus recognized repo-local IDE and local AI tool memory or instruction files such as `AGENTS.md`, `.github/copilot-instructions.md`, `.cursor/rules/*.mdc`, `.windsurfrules`, and `memories/*.md`; durable Amistio memory belongs in `docs/memory/`, and global plugin memory outside the repository is not scanned by default.
 
 For enterprise setup, use the web Runner panel as the primary guide. It shows repository, pairing code, GitHub access, AI provider, local runner, and verification readiness with plain next actions; advanced CLI logs remain secondary diagnostics. The panel also shows trust/privacy boundaries, cost forecast and budget posture, runner health, blockers, verification health, and runner-version distribution from safe runner metadata.
 
@@ -38,6 +38,9 @@ Repository autopilot is disabled until the repository link option is enabled in
 After pairing, confirm that at least one local AI tool is available:
 
 ```sh
+amistio harness status
+amistio harness providers
+amistio harness tools
 amistio tools
 amistio host-helper status
 amistio host-helper conformance
@@ -54,26 +57,29 @@ amistio run --watch --background --tool opencode
 AMISTIO_HOST_HELPER_PATH=$(command -v amistio-host-helper) amistio host-helper status
 AMISTIO_HOST_HELPER_PATH=$(command -v amistio-host-helper) amistio host-helper conformance
 amistio runner status
+amistio runner repair
 amistio runner smoke-session-lifecycle
 ```
 
 Provider-backed model preferences use sanitized catalog fields: `--provider`, `--model-id`, optional `--model-variant`, and `--reasoning-effort` (`auto`, `low`, `medium`, `high`, or `xhigh`). Opencode catalog metadata is synthesized by Amistio or derived from readable local OpenCode JSON config until opencode exposes a native catalog. Provider credentials, API keys, and local secret paths stay in the local tool configuration; they are not stored in Amistio preferences or runner heartbeats.
 
+`amistio harness status`, `amistio harness providers`, and `amistio harness tools` are local diagnostics for the built-in Amistio harness. They report the default harness boundary, safe direct-provider readiness, and bounded Amistio-owned tool adapters without uploading provider credentials, environment values, local config paths, or raw tool errors. The web Runner panel remains the primary setup flow.
+
 Opencode remains an optional compatibility route. When a provider/model is named for opencode, Amistio validates it against the safe provider catalog before launching the external tool instead of silently falling back. Command-mode local tool runs are bounded by `--tool-timeout-seconds`, wait for process cleanup after timeout, and return redacted/capped stdout and stderr so large external output, local execution-root paths, and secret-looking assignments are not persisted unbounded.
 
 When `--tool copilot` uses the GitHub Copilot SDK, Amistio approves read-only permission requests by default and denies mutating, network, MCP, hook, memory, and shell requests. Set `AMISTIO_COPILOT_APPROVE_ALL=1` only on a local machine where broad Copilot SDK approval is intentional.
 
 When `--tool codex` uses the Codex SDK, intermediate progress can be quiet until the final response. For live Codex CLI logs, run `amistio run --watch --tool codex --invocation-channel command`.
 
-`amistio runner status` reports local background runner state, latest heartbeat, and bounded resource usage when available. Resource usage is latest-sample runner process memory/CPU plus safe aggregate system memory/load signals; it does not include source files, environment variables, command lines, process lists, credentials, or arbitrary local paths.
+`amistio runner status` reports local background runner state, latest heartbeat, and bounded resource usage when available. `amistio runner repair` rotates the local runner ID for the paired checkout after a forgotten-runner tombstone; use `amistio runner repair --clear-credential` only when you need to delete the local credential and re-pair from the Runner panel. Resource usage is latest-sample runner process memory/CPU plus safe aggregate system memory/load signals; it does not include source files, environment variables, command lines, process lists, credentials, or arbitrary local paths.
 
 `amistio runner smoke-session-lifecycle` runs a local no-claim smoke for the runner tool-session lifecycle. It does not contact the API, claim production work, inspect source, or mutate local runner state; it verifies that completed one-shot sessions close, active sessions are treated as in use, stale sessions are not selected for reuse, and fresh related reusable sessions can still continue.
 
 The runner advertises its supported work kinds in heartbeats. Current runners can claim read-only `projectContextRefresh` jobs from the workspace Context panel and create due runner-driven refreshes when no fresh approved map exists. Context refreshes inspect the paired checkout locally without modifying files and submit only bounded summaries, slices, entities, relations, safe citations, confidence, freshness, and repo-relative paths. If a submitted context refresh contains unsafe evidence, unsafe paths, or a map too large to store safely, Amistio marks the refresh failed with a safe reason instead of storing the rejected raw result. Approved maps are reused as context packs for source-aware assistant and impact-preview work. Current runners can also claim read-only issue diagnosis jobs from the web Issues panel, generate root-cause analysis and a proposed fix, and submit that result without modifying source. They can claim manual read-only `appEvaluationScan` jobs from the workspace Evaluate panel and create at most one due hourly evaluation during normal watch/background polling when app evaluation is enabled for the repository link. Evaluation results contain bounded summaries, safe evidence, suggested actions, lifecycle proposals, and repo-relative paths only. Current runners can also claim manual read-only `securityPostureScan` jobs from the workspace Security panel and create due daily posture checks during normal watch/background polling. Security scan results contain bounded summaries, standard references, safe evidence, and repo-relative paths only. Current runners can claim manual read-only `testQualityScan` jobs from the workspace Test panel and create one due daily Test scan per repository when Test quality is enabled. Test scans run only existing lint, typecheck, test, coverage, build, or verify commands and submit bounded command summaries, coverage summaries, safe findings, blocked reasons, warnings, and repo-relative paths. Missing tests, missing coverage, low coverage, failing checks, flaky tests, and test gaps create reviewable plan-backed findings in the app. Current runners also claim `implementationTestGate` jobs before implementation completion, PR handoff, or runner-managed push; a passing gate is required unless the web Test panel records an audited override. Blocked implementation Test gates submit structured Test findings, such as `blockedEnvironment`, with safe evidence, a suggested action, and a verification plan. Current runners can claim read-only `implementationVerification` jobs from Tasks to prove whether completed implementation work actually landed; verification submits bounded acceptance-criteria evidence, checks, gaps, outcome, and recommendation without mutating source. Source, secrets, environment variables, command lines, process lists, credentials, provider sessions, and arbitrary local paths stay local. Implementation or cleanup is queued separately only after the user approves an issue analysis, app evaluation finding, security remediation plan, or Test quality plan in the app.
 
-Approved implementation work uses Git as the handoff boundary. During worktree preflight, the runner locally copies eligible ignored root dotenv files such as `.env.local` or `.env.test.local` from the paired checkout into the implementation worktree when the target is missing and ignored, so local tests can use the same machine configuration. Dotenv values, variable names, file contents, and local paths are not uploaded to Amistio, and copied dotenv files stay ignored so PR handoff does not commit them. After the local tool completes successfully, the runner materializes approved Markdown, MDX, and HTML project-brain artifacts for the same work scope into the isolated worktree before final Git status. It then commits all source and artifact changes, fetches and rebases from the linked remote's default branch, pushes an `amistio/work/...` branch, opens or reuses a pull request with the locally authenticated `gh` CLI, reports only safe PR and artifact-inclusion metadata to Amistio, and removes the local worktree after the PR URL is durable. Artifact-only materialization changes still create or reuse a PR; no-change completion requires no source changes and no approved artifact changes, and runner-created no-change worktrees are removed after final clean checks. Prepare the runner machine with Git commit identity, fetch/push permission to the linked remote, and `gh auth status`. If artifact materialization, commit, fetch/rebase, push, or PR creation fails, the work item is blocked with safe recovery choices; source files and patches are not uploaded to Amistio. The Work panel can queue scoped Retry handoff or Retry cleanup commands to the paired runner for the same work item, branch, and worktree key. Rebase conflicts capture bounded repo-relative conflict files and try `git rebase --abort` so the implementation branch can be retried or manually reviewed without leaving an active rebase. Dirty, unmerged, or ambiguous worktrees are preserved rather than discarded.
+Approved implementation work uses Git as the handoff boundary. During worktree preflight, the runner locally copies eligible ignored root dotenv files such as `.env.local` or `.env.test.local` from the paired checkout into the implementation worktree when the target is missing and ignored, so local tests can use the same machine configuration. Dotenv values, variable names, file contents, and local paths are not uploaded to Amistio, and copied dotenv files stay ignored so PR handoff does not commit them. After the local tool completes successfully, the runner materializes approved Markdown, MDX, and HTML project-brain artifacts for the same work scope into the isolated worktree before final Git status. It then commits all source and artifact changes, fetches and rebases from the linked remote's default branch, pushes an `amistio/work/...` branch, opens or reuses a pull request with the locally authenticated `gh` CLI, reports only safe PR and artifact-inclusion metadata to Amistio, and removes the local worktree after the PR URL is durable. Artifact-only materialization changes still create or reuse a PR; no-change completion requires no source changes and no approved artifact changes, and runner-created no-change worktrees are removed after final clean checks. Prepare the runner machine with Git commit identity, fetch/push permission to the linked remote, and `gh auth status`. If artifact materialization, commit, fetch/rebase, push, or PR creation fails, the work item is blocked with safe recovery choices; source files and patches are not uploaded to Amistio. The Work panel can queue scoped Retry handoff or Retry cleanup commands only to the runner that owns the preserved worktree for the same work item, branch, and worktree key. Rebase conflicts capture bounded repo-relative conflict files and try `git rebase --abort` so the implementation branch can be retried or manually reviewed without leaving an active rebase. Dirty, unmerged, or ambiguous worktrees are preserved rather than discarded.
 
-Failed or stale work can be requeued from the web Tasks panel. Requeue creates a new linked work attempt and preserves the original terminal attempt for audit history; it is blocked while equivalent work is already active or when the paired runner does not advertise the needed work kind. Completed implementation status is separate from proof: queue `implementationVerification` from Tasks when a plan needs source-aware evidence before cleanup or implementation status decisions.
+Failed or stale work can be requeued from the web Tasks panel. Requeue creates a new linked work attempt and preserves the original terminal attempt for audit history; Requeue all sends one backend batch that recomputes safe candidates, reports already-active and skipped rows, and still uses linked attempts. Requeue is blocked while equivalent work is already active or when the paired runner does not advertise the needed work kind. Completed implementation status is separate from proof: queue `implementationVerification` from Tasks when a plan needs source-aware evidence before cleanup or implementation status decisions.
 
 Runner setup and local-tool execution use bounded failure controls. `amistio run --watch` retries Git worktree preflight failures by releasing the claim for another attempt, then fails the work item after `--max-preflight-attempts` attempts, defaulting to 3. Active local-tool runs renew the work lease, and `--tool-timeout-seconds` caps tool execution, defaulting to 1800 seconds.
 
@@ -83,7 +89,7 @@ Watch mode prints a completed-work success once per work item, keeps fresh compl
 
 Known validation failures such as `unsafe_context_path` are printed with attention-needed next steps. For project-context refresh path-safety failures, deploy the latest web/API fix, update and restart the runner when applicable, retry the refresh, and capture only bounded non-secret output if it repeats.
 
-If watch mode reports that the runner was forgotten by the server, stop the foreground process and start or pair a new runner from the Runner panel. Forgotten runner IDs are intentionally blocked from heartbeats and work claims, so the CLI exits instead of retrying with the tombstoned identity.
+If watch mode reports that the runner was forgotten by the server, run `amistio runner repair` from the paired checkout, then start `amistio run --watch` again. The repair command stores a fresh local runner ID because the default ID for a machine/project/repository is stable and can remain tombstoned. Use `--clear-credential` only when the Runner panel tells you to create a fresh pairing code.
 
 App-evaluation result finalization rejections print safe validation paths and preserve the local finalization evidence without exposing raw source or secrets. If a structured app-evaluation result is rejected, update and restart the runner, confirm the web/API deployment is current, and retry the evaluation before acting on cleanup or implementation recommendations.
 

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createHash as createHash9, randomUUID as randomUUID2 } from "node:crypto";
-import { writeFile as writeFile11 } from "node:fs/promises";
-import os8 from "node:os";
-import path17 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
+import { writeFile as writeFile12 } from "node:fs/promises";
+import os9 from "node:os";
+import path18 from "node:path";
 import { Command } from "commander";
 
 // ../shared/src/schemas.ts
@@ -3145,8 +3145,8 @@ var toolSessionMutationSchema = z3.object({
 });
 function resolveApiUrl(apiUrl, urlPath) {
   const base = apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl;
-  const path18 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
-  return new URL(`${base}${path18}`);
+  const path19 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
+  return new URL(`${base}${path19}`);
 }
 
 // src/orchestrator.ts
@@ -5494,6 +5494,102 @@ async function readRunnerDaemonMetadataFile(filePath) {
   }
 }
 
+// src/runner-identity-store.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir8, readFile as readFile7, writeFile as writeFile8 } from "node:fs/promises";
+import os5 from "node:os";
+import path9 from "node:path";
+
+// src/runner-status.ts
+import { createHash as createHash4 } from "node:crypto";
+var watchStateReminderMs = 60 * 1e3;
+function formatWatchStartupContext(input) {
+  return [
+    `Runner ${input.runnerId} is watching project ${input.projectId}.`,
+    `Repository link: ${input.repositoryLinkId}`,
+    `API: ${input.apiUrl}`,
+    `Polling interval: ${input.intervalSeconds}s. Press Ctrl+C to stop.`
+  ];
+}
+function formatWatchIdleLine(action, intervalSeconds) {
+  return `${formatProjectNextAction(action)} Checking again in ${intervalSeconds}s.`;
+}
+function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateReminderMs) {
+  const key = watchStateKey(action);
+  if (!previous || previous.key !== key) {
+    return true;
+  }
+  if (action.kind === "workCompleted") {
+    return false;
+  }
+  return nowMs - previous.printedAtMs >= reminderMs;
+}
+function watchStateKey(action) {
+  return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
+}
+function stableRunnerId(input) {
+  const digest = createHash4("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
+  return `runner_${digest}`;
+}
+
+// src/runner-identity-store.ts
+var LocalRunnerIdentityStore = class {
+  constructor(filePath = path9.join(os5.homedir(), ".config", "amistio", "runner-identities.json")) {
+    this.filePath = filePath;
+  }
+  filePath;
+  async get(key) {
+    const data = await this.read();
+    return data.runnerIds[key];
+  }
+  async set(key, runnerId) {
+    const data = await this.read();
+    data.runnerIds[key] = runnerId;
+    await this.write(data);
+  }
+  async delete(key) {
+    const data = await this.read();
+    if (!(key in data.runnerIds)) {
+      return;
+    }
+    delete data.runnerIds[key];
+    await this.write(data);
+  }
+  async read() {
+    try {
+      return normalizeStoredRunnerIdentityFile(JSON.parse(await readFile7(this.filePath, "utf8")));
+    } catch {
+      return { runnerIds: {} };
+    }
+  }
+  async write(data) {
+    await mkdir8(path9.dirname(this.filePath), { recursive: true });
+    await writeFile8(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf8", mode: 384 });
+    await chmod2(this.filePath, 384);
+  }
+};
+function runnerIdentityKey(scope) {
+  return `${scope.accountId}:${scope.projectId}:${scope.repositoryLinkId}`;
+}
+function createFreshRunnerId() {
+  return `runner_${randomUUID2().replace(/-/g, "").slice(0, 20)}`;
+}
+async function resolveLocalRunnerId(scope, store = new LocalRunnerIdentityStore()) {
+  return await store.get(runnerIdentityKey(scope)) ?? stableRunnerId(scope);
+}
+function normalizeStoredRunnerIdentityFile(value) {
+  if (!value || typeof value !== "object" || !("runnerIds" in value)) {
+    return { runnerIds: {} };
+  }
+  const runnerIds = value.runnerIds;
+  if (!runnerIds || typeof runnerIds !== "object") {
+    return { runnerIds: {} };
+  }
+  return {
+    runnerIds: Object.fromEntries(Object.entries(runnerIds).filter((entry) => typeof entry[1] === "string"))
+  };
+}
+
 // src/runner-watch-errors.ts
 var forgottenRunnerWatchMessage = "This runner was forgotten by the server. Start or pair a new runner from the Runner panel; this runner ID cannot heartbeat or claim work anymore.";
 async function handleRunnerWatchError(options) {
@@ -5531,10 +5627,10 @@ ${options.detail}`);
 
 // src/runner-service.ts
 import { spawn as spawn3 } from "node:child_process";
-import { createHash as createHash4 } from "node:crypto";
-import { mkdir as mkdir8, readFile as readFile7, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
-import os5 from "node:os";
-import path9 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { mkdir as mkdir9, readFile as readFile8, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
+import os6 from "node:os";
+import path10 from "node:path";
 function detectRunnerServicePlatform(platform = process.platform) {
   if (platform === "darwin") return "launchd";
   if (platform === "linux") return "systemd";
@@ -5545,19 +5641,19 @@ function createRunnerServiceDescriptor(input) {
   if (platform === "unsupported") {
     throw new Error("Startup services are supported for user-level launchd on macOS and systemd user services on Linux.");
   }
-  const homeDir = input.homeDir ?? os5.homedir();
+  const homeDir = input.homeDir ?? os6.homedir();
   const serviceName = runnerServiceName(input);
   const serviceFilePath = runnerServiceFilePath(platform, serviceName, homeDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const command = [input.executablePath ?? process.execPath, input.scriptPath ?? process.argv[1], ...input.args];
-  const logPath = path9.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
+  const logPath = path10.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
   const metadata = {
     schemaVersion: 1,
     accountId: input.accountId,
     projectId: input.projectId,
     repositoryLinkId: input.repositoryLinkId,
     runnerId: input.runnerId,
-    rootDir: path9.resolve(input.rootDir),
+    rootDir: path10.resolve(input.rootDir),
     apiUrl: input.apiUrl,
     serviceName,
     serviceFilePath,
@@ -5574,9 +5670,9 @@ function createRunnerServiceDescriptor(input) {
 }
 async function installRunnerService(input, options = {}) {
   const descriptor = createRunnerServiceDescriptor(input);
-  await mkdir8(path9.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
-  await mkdir8(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
-  await writeFile8(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
+  await mkdir9(path10.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
+  await mkdir9(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
+  await writeFile9(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
   await writeRunnerServiceMetadata(descriptor.metadata, input.metadataDir);
   if (options.activate !== false) {
     const activation = await activateRunnerService(descriptor.metadata);
@@ -5598,7 +5694,7 @@ async function removeRunnerService(input) {
 }
 async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetadataDir()) {
   try {
-    const parsed = JSON.parse(await readFile7(runnerServiceMetadataPath(input, metadataDir), "utf8"));
+    const parsed = JSON.parse(await readFile8(runnerServiceMetadataPath(input, metadataDir), "utf8"));
     if (parsed.schemaVersion !== 1 || !parsed.serviceName || !parsed.serviceFilePath) {
       return void 0;
     }
@@ -5608,8 +5704,8 @@ async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetad
   }
 }
 async function writeRunnerServiceMetadata(metadata, metadataDir = defaultRunnerMetadataDir()) {
-  await mkdir8(metadataDir, { recursive: true });
-  await writeFile8(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
+  await mkdir9(metadataDir, { recursive: true });
+  await writeFile9(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
 }
 async function runnerServiceRuntimeStatus(metadata) {
   if (metadata.platform === "launchd") {
@@ -5692,18 +5788,18 @@ WantedBy=default.target
 }
 function runnerServiceFilePath(platform, serviceName, homeDir) {
   if (platform === "launchd") {
-    return path9.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
+    return path10.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
   }
-  return path9.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
+  return path10.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
 }
 function runnerServiceMetadataPath(input, metadataDir) {
-  return path9.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
+  return path10.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
 }
 function runnerServiceName(input) {
   return `com.amistio.runner.${runnerServiceKey(input).slice(0, 20)}`;
 }
 function runnerServiceKey(input) {
-  return createHash4("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.runnerId}`).digest("hex");
+  return createHash5("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.runnerId}`).digest("hex");
 }
 function launchdDomain() {
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
@@ -6031,9 +6127,9 @@ function createSmokeSession({ now, status, lastActivityAt }) {
 
 // src/sync.ts
 import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { mkdir as mkdir9, readdir as readdir5, readFile as readFile8, stat as stat4, writeFile as writeFile9 } from "node:fs/promises";
-import path10 from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir as mkdir10, readdir as readdir5, readFile as readFile9, stat as stat4, writeFile as writeFile10 } from "node:fs/promises";
+import path11 from "node:path";
 import { promisify as promisify3 } from "node:util";
 var execFileAsync3 = promisify3(execFile3);
 var legacySyncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
@@ -6129,7 +6225,7 @@ async function readLocalSyncedDocuments(rootDir) {
   const documentFiles = await findBrainDocumentFiles(rootDir);
   const documents = [];
   for (const fullPath of documentFiles) {
-    const raw = await readFile8(fullPath, "utf8");
+    const raw = await readFile9(fullPath, "utf8");
     const repoPath = toRepoPath(rootDir, fullPath);
     const parsed = parseSyncedDocument(raw, repoPath);
     if (!parsed) {
@@ -6179,8 +6275,8 @@ async function materializeBrainDocuments(rootDir, documents, options = {}) {
       result.skipped.push(document.repoPath);
       continue;
     }
-    await mkdir9(path10.dirname(fullPath), { recursive: true });
-    await writeFile9(fullPath, createSyncedDocumentContent(document), "utf8");
+    await mkdir10(path11.dirname(fullPath), { recursive: true });
+    await writeFile10(fullPath, createSyncedDocumentContent(document), "utf8");
     result.written.push(document.repoPath);
   }
   return result;
@@ -6309,7 +6405,7 @@ function parseSyncedHtml(content) {
 }
 async function readExistingSyncedDocument(fullPath) {
   try {
-    const raw = await readFile8(fullPath, "utf8");
+    const raw = await readFile9(fullPath, "utf8");
     const parsed = parseSyncedDocument(raw, fullPath);
     if (!parsed) {
       return { exists: true };
@@ -6334,7 +6430,7 @@ async function readExistingSyncedDocument(fullPath) {
 async function findBrainDocumentFiles(rootDir) {
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot]) {
-    const fullRoot = path10.join(rootDir, syncRoot);
+    const fullRoot = path11.join(rootDir, syncRoot);
     if (!await exists2(fullRoot)) {
       continue;
     }
@@ -6344,7 +6440,7 @@ async function findBrainDocumentFiles(rootDir) {
 }
 async function walkBrainDocumentFiles(directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true })) {
-    const fullPath = path10.join(directory, entry.name);
+    const fullPath = path11.join(directory, entry.name);
     if (entry.isDirectory()) {
       await walkBrainDocumentFiles(fullPath, files);
     } else if (entry.isFile() && /\.(md|mdx|html?)$/i.test(entry.name)) {
@@ -6353,23 +6449,23 @@ async function walkBrainDocumentFiles(directory, files) {
   }
 }
 function safeRepoPath(rootDir, repoPath) {
-  if (path10.isAbsolute(repoPath)) {
+  if (path11.isAbsolute(repoPath)) {
     throw new Error(`Refusing to use absolute repo path: ${repoPath}`);
   }
-  const normalized = path10.normalize(repoPath);
-  if (normalized === ".." || normalized.startsWith(`..${path10.sep}`)) {
+  const normalized = path11.normalize(repoPath);
+  if (normalized === ".." || normalized.startsWith(`..${path11.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
-  const root = path10.resolve(rootDir);
-  const fullPath = path10.resolve(root, normalized);
-  if (!fullPath.startsWith(`${root}${path10.sep}`)) {
+  const root = path11.resolve(rootDir);
+  const fullPath = path11.resolve(root, normalized);
+  if (!fullPath.startsWith(`${root}${path11.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
   return fullPath;
 }
 function isControlPlanePath(repoPath) {
-  const normalized = path10.normalize(repoPath);
-  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path10.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path10.sep}`);
+  const normalized = path11.normalize(repoPath);
+  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path11.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path11.sep}`);
 }
 function canonicalControlPlaneRepoPath(repoPath) {
   const normalized = repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -6380,16 +6476,16 @@ function canonicalControlPlaneRepoPath(repoPath) {
   return normalized;
 }
 function toRepoPath(rootDir, fullPath) {
-  return path10.relative(rootDir, fullPath).split(path10.sep).join("/");
+  return path11.relative(rootDir, fullPath).split(path11.sep).join("/");
 }
 function inferTitle(content, repoPath) {
   const heading = content.split("\n").find((line) => line.startsWith("# "))?.replace(/^#\s+/, "").trim();
   if (heading) return heading;
   const htmlHeading = content.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
-  return htmlHeading || path10.basename(repoPath, path10.extname(repoPath));
+  return htmlHeading || path11.basename(repoPath, path11.extname(repoPath));
 }
 async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingDocuments, options) {
-  const root = path10.resolve(rootDir);
+  const root = path11.resolve(rootDir);
   const maxBytes = (options.maxFileKb ?? defaultAutoSyncMaxFileKb) * 1024;
   const syncedAt = options.syncedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const existingById = new Map(existingDocuments.map((document) => [document.documentId, document]));
@@ -6414,7 +6510,7 @@ async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingD
       skipped.push({ repoPath: normalizedRepoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile8(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile9(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath: normalizedRepoPath, reason: "unreadable" });
       continue;
@@ -6479,7 +6575,7 @@ async function listAutoSyncCandidatePaths(rootDir) {
   }
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot, ...legacySyncRoots]) {
-    const fullRoot = path10.join(rootDir, syncRoot);
+    const fullRoot = path11.join(rootDir, syncRoot);
     if (await exists2(fullRoot)) {
       await walkAutoSyncFiles(rootDir, fullRoot, files);
     }
@@ -6488,8 +6584,8 @@ async function listAutoSyncCandidatePaths(rootDir) {
 }
 async function walkAutoSyncFiles(rootDir, directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true }).catch(() => [])) {
-    const fullPath = path10.join(directory, entry.name);
-    const repoPath = normalizeRepoPath3(path10.relative(rootDir, fullPath));
+    const fullPath = path11.join(directory, entry.name);
+    const repoPath = normalizeRepoPath3(path11.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!autoSyncExcludedDirectoryNames.has(entry.name)) {
         await walkAutoSyncFiles(rootDir, fullPath, files);
@@ -6523,7 +6619,7 @@ function legacyDocumentTypeForRepoPath(repoPath) {
   return root && root in documentTypeByRoot ? documentTypeByRoot[root] : void 0;
 }
 function stableExternalDocumentId(metadata, repoPath) {
-  return `doc_external_${createHash5("sha256").update(`${metadata.amistioAccountId}:${metadata.amistioProjectId}:${metadata.repositoryLinkId}:${repoPath}`).digest("hex").slice(0, 24)}`;
+  return `doc_external_${createHash6("sha256").update(`${metadata.amistioAccountId}:${metadata.amistioProjectId}:${metadata.repositoryLinkId}:${repoPath}`).digest("hex").slice(0, 24)}`;
 }
 function normalizeRepoPath3(repoPath) {
   return repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -6551,9 +6647,9 @@ async function exists2(filePath) {
 }
 
 // src/tool-session-store.ts
-import { mkdir as mkdir10, readFile as readFile9, writeFile as writeFile10 } from "node:fs/promises";
-import os6 from "node:os";
-import path11 from "node:path";
+import { mkdir as mkdir11, readFile as readFile10, writeFile as writeFile11 } from "node:fs/promises";
+import os7 from "node:os";
+import path12 from "node:path";
 var LocalToolSessionStore = class {
   constructor(filePath = defaultSessionStorePath()) {
     this.filePath = filePath;
@@ -6567,12 +6663,12 @@ var LocalToolSessionStore = class {
   async setProviderSessionId(toolSessionId, toolName, providerSessionId) {
     const data = await this.read();
     data[toolSessionId] = { toolName, providerSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await mkdir10(path11.dirname(this.filePath), { recursive: true });
-    await writeFile10(this.filePath, JSON.stringify(data, null, 2), "utf8");
+    await mkdir11(path12.dirname(this.filePath), { recursive: true });
+    await writeFile11(this.filePath, JSON.stringify(data, null, 2), "utf8");
   }
   async read() {
     try {
-      return JSON.parse(await readFile9(this.filePath, "utf8"));
+      return JSON.parse(await readFile10(this.filePath, "utf8"));
     } catch {
       return {};
     }
@@ -6580,16 +6676,16 @@ var LocalToolSessionStore = class {
 };
 function defaultSessionStorePath() {
   if (process.platform === "darwin") {
-    return path11.join(os6.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
+    return path12.join(os7.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
   }
   if (process.platform === "win32") {
-    return path11.join(process.env.APPDATA ?? os6.homedir(), "Amistio", "tool-sessions.json");
+    return path12.join(process.env.APPDATA ?? os7.homedir(), "Amistio", "tool-sessions.json");
   }
-  return path11.join(process.env.XDG_STATE_HOME ?? path11.join(os6.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
+  return path12.join(process.env.XDG_STATE_HOME ?? path12.join(os7.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
 }
 
 // src/work-runner.ts
-import path12 from "node:path";
+import path13 from "node:path";
 var generationResultStart = "AMISTIO_BRAIN_GENERATION_RESULT_START";
 var generationResultEnd = "AMISTIO_BRAIN_GENERATION_RESULT_END";
 var assistantAnswerStart = "AMISTIO_ASSISTANT_ANSWER_START";
@@ -8072,15 +8168,15 @@ function normalizeProjectContextRepoPath(value, options) {
   if (!trimmed || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) || /^file:/i.test(trimmed) || /^[A-Za-z]:($|[^\\/])/.test(trimmed)) {
     throwUnsafeProjectContextPath();
   }
-  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path12.isAbsolute(trimmed) || path12.win32.isAbsolute(trimmed);
+  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path13.isAbsolute(trimmed) || path13.win32.isAbsolute(trimmed);
   if (!absolute) {
     return normalizeRelativeProjectContextPath(trimmed);
   }
   if (!options.repositoryRoot) {
     throwUnsafeProjectContextPath();
   }
-  const useWindowsPathRules = path12.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
-  const relativePath = useWindowsPathRules ? path12.win32.relative(path12.win32.resolve(options.repositoryRoot), path12.win32.resolve(trimmed)) : path12.relative(path12.resolve(options.repositoryRoot), path12.resolve(trimmed));
+  const useWindowsPathRules = path13.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
+  const relativePath = useWindowsPathRules ? path13.win32.relative(path13.win32.resolve(options.repositoryRoot), path13.win32.resolve(trimmed)) : path13.relative(path13.resolve(options.repositoryRoot), path13.resolve(trimmed));
   return normalizeRelativeProjectContextPath(relativePath);
 }
 function normalizeRelativeProjectContextPath(value) {
@@ -8131,48 +8227,16 @@ function stripJsonFence(value) {
   return trimmed.replace(/^```(?:json)?\s*/i, "").replace(/```$/i, "").trim();
 }
 
-// src/runner-status.ts
-import { createHash as createHash6 } from "node:crypto";
-var watchStateReminderMs = 60 * 1e3;
-function formatWatchStartupContext(input) {
-  return [
-    `Runner ${input.runnerId} is watching project ${input.projectId}.`,
-    `Repository link: ${input.repositoryLinkId}`,
-    `API: ${input.apiUrl}`,
-    `Polling interval: ${input.intervalSeconds}s. Press Ctrl+C to stop.`
-  ];
-}
-function formatWatchIdleLine(action, intervalSeconds) {
-  return `${formatProjectNextAction(action)} Checking again in ${intervalSeconds}s.`;
-}
-function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateReminderMs) {
-  const key = watchStateKey(action);
-  if (!previous || previous.key !== key) {
-    return true;
-  }
-  if (action.kind === "workCompleted") {
-    return false;
-  }
-  return nowMs - previous.printedAtMs >= reminderMs;
-}
-function watchStateKey(action) {
-  return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
-}
-function stableRunnerId(input) {
-  const digest = createHash6("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
-  return `runner_${digest}`;
-}
-
 // src/runner-resources.ts
-import os7 from "node:os";
+import os8 from "node:os";
 var defaultRuntime = {
   nowMs: () => Date.now(),
   memoryUsage: () => process.memoryUsage(),
   uptime: () => process.uptime(),
   cpuUsage: () => process.cpuUsage(),
-  totalmem: () => os7.totalmem(),
-  freemem: () => os7.freemem(),
-  loadavg: () => os7.loadavg()
+  totalmem: () => os8.totalmem(),
+  freemem: () => os8.freemem(),
+  loadavg: () => os8.loadavg()
 };
 var previousRunnerResourceSample;
 function sampleCurrentRunnerResourceUsage() {
@@ -8285,8 +8349,8 @@ function roundNumber(value, digits) {
 // src/importer.ts
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdir as readdir6, readFile as readFile10, stat as stat5 } from "node:fs/promises";
-import path13 from "node:path";
+import { readdir as readdir6, readFile as readFile11, stat as stat5 } from "node:fs/promises";
+import path14 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync4 = promisify4(execFile4);
 var defaultMaxFileKb = 256;
@@ -8307,12 +8371,12 @@ var documentFolderByType = {
   workflow: "docs/workflows"
 };
 async function inspectLocalRepository(rootDir, defaultBranch) {
-  const requestedRoot = path13.resolve(rootDir);
+  const requestedRoot = path14.resolve(rootDir);
   const root = await runGit2(["-C", requestedRoot, "rev-parse", "--show-toplevel"]).catch(() => requestedRoot);
   const detectedBranch = await runGit2(["-C", root, "symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => defaultBranch);
   const originUrl = await runGit2(["-C", root, "remote", "get-url", "origin"]).catch(() => void 0);
   const parsedCloneUrl = originUrl ? parseOptionalOriginCloneUrl(originUrl) : void 0;
-  const repoName = (parsedCloneUrl?.repoName ?? path13.basename(root)) || "repository";
+  const repoName = (parsedCloneUrl?.repoName ?? path14.basename(root)) || "repository";
   const fingerprintSeed = parsedCloneUrl ? `origin:${parsedCloneUrl.normalizedKey}` : `repo:${repoName}:${detectedBranch || defaultBranch}`;
   return {
     rootDir: root,
@@ -8324,7 +8388,7 @@ async function inspectLocalRepository(rootDir, defaultBranch) {
   };
 }
 async function scanLegacyDocuments(options) {
-  const rootDir = path13.resolve(options.rootDir);
+  const rootDir = path14.resolve(options.rootDir);
   const maxBytes = (options.maxFileKb ?? defaultMaxFileKb) * 1024;
   const skipped = [];
   const candidates = [];
@@ -8344,7 +8408,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "excluded" });
       continue;
     }
-    const fullPath = path13.join(rootDir, ...repoPath.split("/"));
+    const fullPath = path14.join(rootDir, ...repoPath.split("/"));
     const fileStat = await stat5(fullPath).catch(() => void 0);
     if (!fileStat?.isFile()) {
       skipped.push({ repoPath, reason: "unreadable" });
@@ -8354,7 +8418,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile10(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile11(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath, reason: "unreadable" });
       continue;
@@ -8446,8 +8510,8 @@ async function listRepositoryPaths(rootDir) {
 async function walkRepository(rootDir, directory, files) {
   const entries = await readdir6(directory, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const fullPath = path13.join(directory, entry.name);
-    const repoPath = normalizeRepoPath4(path13.relative(rootDir, fullPath));
+    const fullPath = path14.join(directory, entry.name);
+    const repoPath = normalizeRepoPath4(path14.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!excludedDirectoryNames.has(entry.name)) {
         await walkRepository(rootDir, fullPath, files);
@@ -8515,9 +8579,9 @@ function uniqueDestinationPath(basePath, sourcePath, usedPaths) {
     usedPaths.add(basePath);
     return basePath;
   }
-  const extension = path13.posix.extname(basePath) || ".md";
-  const directory = path13.posix.dirname(basePath);
-  const basename = path13.posix.basename(basePath, extension);
+  const extension = path14.posix.extname(basePath) || ".md";
+  const directory = path14.posix.dirname(basePath);
+  const basename = path14.posix.basename(basePath, extension);
   const uniquePath = `${directory}/${basename}-${hashText(sourcePath, 8)}${extension}`;
   usedPaths.add(uniquePath);
   return uniquePath;
@@ -8590,7 +8654,7 @@ function inferTitle2(content, repoPath) {
   if (heading) return heading;
   const htmlHeading = body.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
   if (htmlHeading) return htmlHeading;
-  const basename = path13.posix.basename(repoPath, path13.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
+  const basename = path14.posix.basename(repoPath, path14.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
   return titleCase(basename || "Imported Document");
 }
 function stripFrontmatter(content) {
@@ -8624,7 +8688,7 @@ async function runGit2(args) {
 
 // src/runner-actions.ts
 import { spawn as spawn4 } from "node:child_process";
-import path14 from "node:path";
+import path15 from "node:path";
 function buildBackgroundRunnerArgs(options) {
   const args = [
     "run",
@@ -8634,7 +8698,7 @@ function buildBackgroundRunnerArgs(options) {
     "--runner-id",
     options.runnerId,
     "--root",
-    path14.resolve(options.root),
+    path15.resolve(options.root),
     "--session",
     options.session,
     "--interval-seconds",
@@ -8752,8 +8816,8 @@ function truncateProcessOutput(value) {
 
 // src/git-worktree.ts
 import { execFile as execFile5 } from "node:child_process";
-import { copyFile, lstat, mkdir as mkdir11, readdir as readdir7, stat as stat6 } from "node:fs/promises";
-import path15 from "node:path";
+import { copyFile, lstat, mkdir as mkdir12, readdir as readdir7, stat as stat6 } from "node:fs/promises";
+import path16 from "node:path";
 import { promisify as promisify5 } from "node:util";
 var execFileAsync5 = promisify5(execFile5);
 var exactLocalEnvironmentFiles = /* @__PURE__ */ new Set([".env", ".env.local", ".env.development", ".env.development.local", ".env.test", ".env.test.local", ".env.production", ".env.production.local"]);
@@ -8785,7 +8849,7 @@ async function prepareGitWorktreeIsolation(rootDir, workItem) {
     const preparedLocalEnvironmentFileCount2 = await prepareLocalWorktreeEnvironment(repoRoot, worktreePath);
     return { ...identity, baseRevision, worktreePath, ...preparedLocalEnvironmentFileCount2 ? { preparedLocalEnvironmentFileCount: preparedLocalEnvironmentFileCount2 } : {} };
   }
-  await mkdir11(path15.dirname(worktreePath), { recursive: true });
+  await mkdir12(path16.dirname(worktreePath), { recursive: true });
   const branchExists = await gitCommandSucceeds(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${identity.branch}`]);
   const worktreeArgs = branchExists ? ["worktree", "add", worktreePath, identity.branch] : ["worktree", "add", "-b", identity.branch, worktreePath, baseRevision];
   await gitOutput(repoRoot, worktreeArgs).catch((error) => {
@@ -8803,9 +8867,9 @@ async function resolveExistingGitWorktreeIsolation(rootDir, workItem) {
   return { ...identity, baseRevision, worktreePath };
 }
 function localWorktreePath(repoRoot, worktreeKey) {
-  const repoName = path15.basename(repoRoot);
+  const repoName = path16.basename(repoRoot);
   const worktreeSlug = worktreeKey.split("/").filter(Boolean).pop() ?? "work";
-  return path15.join(path15.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
+  return path16.join(path16.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
 }
 async function assertExistingWorktree(worktreePath, branch) {
   await gitOutput(worktreePath, ["rev-parse", "--is-inside-work-tree"]);
@@ -8831,8 +8895,8 @@ async function prepareLocalWorktreeEnvironment(repoRoot, worktreePath) {
   const candidates = await localEnvironmentFileCandidates(repoRoot);
   let preparedCount = 0;
   for (const candidate of candidates) {
-    const sourcePath = path15.join(repoRoot, candidate);
-    const targetPath = path15.join(worktreePath, candidate);
+    const sourcePath = path16.join(repoRoot, candidate);
+    const targetPath = path16.join(worktreePath, candidate);
     if (await pathExists(targetPath)) {
       continue;
     }
@@ -8863,7 +8927,7 @@ async function localEnvironmentFileCandidates(repoRoot) {
     if (!isRootFileName(name)) {
       continue;
     }
-    const source = await lstat(path15.join(repoRoot, name)).catch(() => void 0);
+    const source = await lstat(path16.join(repoRoot, name)).catch(() => void 0);
     if (source?.isFile()) {
       candidates.push(name);
     }
@@ -8874,7 +8938,7 @@ function isAllowedLocalEnvironmentFile(name) {
   return exactLocalEnvironmentFiles.has(name) || localEnvironmentFilePattern.test(name);
 }
 function isRootFileName(name) {
-  return name === path15.basename(name) && !name.includes("/") && !name.includes("\\");
+  return name === path16.basename(name) && !name.includes("/") && !name.includes("\\");
 }
 async function gitOutput(cwd, args) {
   const { stdout } = await execFileAsync5("git", args, { cwd, maxBuffer: 1024 * 1024 });
@@ -8907,7 +8971,7 @@ function safeFileError(error) {
 
 // src/implementation-handoff.ts
 import { execFile as execFile6 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 import { promisify as promisify6 } from "node:util";
 var execFileAsync6 = promisify6(execFile6);
 async function completeImplementationHandoff(input) {
@@ -9175,7 +9239,7 @@ async function cleanupWorktree(run, input) {
     return { status: "failed", message: "Cleanup skipped because the worktree is not clean after PR handoff." };
   }
   try {
-    await gitOutput2(run, input.primaryRepoRoot || path16.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
+    await gitOutput2(run, input.primaryRepoRoot || path17.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
     return { status: "completed" };
   } catch (error) {
     return { status: "failed", message: `Cleanup failed: ${safeErrorMessage(error)}` };
@@ -9896,7 +9960,7 @@ program.command("import").description("Pair an existing checkout and import lega
 });
 program.command("pair").description("Pair this repository with an Amistio web project").requiredOption("--account <accountId>", "Amistio account ID").requiredOption("--project <projectId>", "Amistio project ID").option("--repository-link <repositoryLinkId>", "Existing repository link ID").option("--default-branch <branch>", "Default branch", "main").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--token <token>", "Runner/device credential to store outside the repository").option("--root <path>", "Repository root", defaultRoot).action(async (options, command) => {
   const pairingRoot = await resolvePairingRoot(options.root, { explicitRoot: command.getOptionValueSource("root") === "cli" });
-  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID2()}`;
+  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID3()}`;
   let credential = options.token;
   if (options.pairingCode) {
     const pairing = await new ApiClient({
@@ -10082,7 +10146,7 @@ work.command("prompt").description("Print or write an approved work prompt witho
   }
   const prompt = await createRunnerWorkPrompt(context.client, context.metadata.amistioProjectId, workItem);
   if (options.out) {
-    await writeFile11(options.out, prompt, "utf8");
+    await writeFile12(options.out, prompt, "utf8");
     console.log(`Wrote work prompt to ${options.out}.`);
   } else {
     console.log(prompt);
@@ -10096,6 +10160,34 @@ program.command("tools").description("List local AI coding tools that the Amisti
   }
   console.log("custom - pass --tool-command to use any other local runner command.");
 });
+var harness = program.command("harness").description("Inspect the built-in Amistio harness, direct providers, and bounded tool adapters");
+harness.command("status").description("Show the built-in harness boundary and execution policy summary").action(() => {
+  console.log(`Harness: ${builtinAmistioHarnessAdapter.displayName} (${builtinAmistioHarnessAdapter.id})`);
+  console.log("Default: built-in Amistio harness");
+  console.log("Runner-owned boundary: pairing, work claiming, leases, worktree isolation, redaction, finalization, and handoff.");
+  console.log(`Read-only work policy: ${runnerSupportedWorkKinds.filter((workKind) => harnessMutationPolicyForWorkKind(workKind) === "readOnly").join(", ")}`);
+  console.log(`Mutating work policy: ${runnerSupportedWorkKinds.filter((workKind) => harnessMutationPolicyForWorkKind(workKind) === "mutating").join(", ")}`);
+  console.log("Run execution: amistio run --watch");
+  console.log("Local AI clients: amistio tools");
+  console.log("Host execution helper: amistio host-helper status");
+});
+harness.command("providers").description("Check safe local readiness for direct and agent-client provider routes").option("--root <path>", "Repository root", defaultRoot).action(async (options) => {
+  for (const target of harnessProviderCheckTargets()) {
+    const result = await checkProviderAuthLink({ request: target.request, root: options.root });
+    console.log(`${target.label}: ${result.providerAuthStatus.status}`);
+    for (const line of formatProviderAuthStatusLines(result.providerAuthStatus)) {
+      console.log(`  ${line}`);
+    }
+  }
+});
+harness.command("tools").description("List bounded Amistio-owned tool adapters available to the harness").action(() => {
+  console.log("Bounded Amistio harness tools. For optional local AI clients, run `amistio tools`.");
+  for (const adapter of boundedToolAdapterCatalog) {
+    const mutation = adapter.mutating ? "mutating" : "read-only";
+    const implemented = adapter.implemented ? "yes" : "no";
+    console.log(`${implemented} ${adapter.kind} ${adapter.id} - ${adapter.displayName}; ${mutation}; ${adapter.concurrency}; resources: ${adapter.serializedResourceKinds.join(", ")}`);
+  }
+});
 var hostHelper = program.command("host-helper").description("Inspect the optional Amistio host helper used for stronger local execution primitives");
 hostHelper.command("status").description("Show configured host-helper protocol and capability status").option("--path <path>", "Helper executable path; defaults to AMISTIO_HOST_HELPER_PATH").action(async (options) => {
   const config = options.path?.trim() ? { command: options.path.trim() } : nativeHostHelperConfigFromEnvironment();
@@ -10164,7 +10256,7 @@ program.command("orchestrate").description("Update the Amistio control plane thr
     ...options.toolCommand ? { toolCommand: options.toolCommand } : {},
     ...localModelConfig,
     streamOutput: options.stream,
-    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID2()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
+    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID3()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
   });
   if (!options.stream && result.stdout.trim()) {
     console.log(result.stdout.trim());
@@ -10187,12 +10279,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
     process.exitCode = 1;
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const resolvedOptions = { ...options, runnerId };
   if (resolvedOptions.maxConcurrentWork > MAX_CONCURRENT_RUNNER_WORK) {
     console.log(`--max-concurrent-work is capped at ${MAX_CONCURRENT_RUNNER_WORK}.`);
@@ -10210,7 +10297,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
       projectId: context.metadata.amistioProjectId,
       repositoryLinkId: context.metadata.repositoryLinkId,
       runnerId,
-      rootDir: path17.resolve(options.root),
+      rootDir: path18.resolve(options.root),
       apiUrl: options.apiUrl,
       args: buildBackgroundRunnerArgs(resolvedOptions)
     });
@@ -10281,6 +10368,38 @@ program.command("run").description("Claim and run approved Amistio work locally"
   }
 });
 var runner = program.command("runner").description("Manage local Amistio runner processes");
+runner.command("repair").description("Repair local runner identity state for this paired repository").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Fresh runner ID to store instead of generating one").option("--clear-credential", "Delete the local runner credential so this checkout must be paired again").option("--dry-run", "Print repair actions without changing local config").action(async (options) => {
+  const metadata = await readProjectLink(options.root);
+  if (!metadata) {
+    console.log("Repository is not paired. Run `amistio pair` first.");
+    return;
+  }
+  const scope = runnerIdentityScope(metadata);
+  const identityKey = runnerIdentityKey(scope);
+  const identityStore = new LocalRunnerIdentityStore();
+  const credentialStore = new LocalCredentialStore();
+  const stableRunner = stableRunnerId(scope);
+  const currentRunnerId = await identityStore.get(identityKey) ?? stableRunner;
+  const nextRunnerId = options.runnerId?.trim() || createFreshRunnerId();
+  if (options.dryRun) {
+    console.log(`Would rotate local runner ID from ${currentRunnerId} to ${nextRunnerId}.`);
+    if (options.clearCredential) {
+      console.log("Would delete the local runner credential for this paired checkout.");
+    }
+    return;
+  }
+  await identityStore.set(identityKey, nextRunnerId);
+  if (options.clearCredential) {
+    await credentialStore.delete(credentialKey(metadata.amistioAccountId, metadata.amistioProjectId, metadata.repositoryLinkId));
+  }
+  console.log(`Local runner ID repaired: ${currentRunnerId} -> ${nextRunnerId}.`);
+  if (options.clearCredential) {
+    console.log("Deleted the local runner credential. Create a fresh pairing code in the Runner panel, then run the copied pair/import command.");
+  } else {
+    console.log(`Next: amistio run${formatApiUrlFlag(options.apiUrl)} --watch`);
+    console.log("If a startup service uses the old runner ID, reinstall it from the Runner panel command.");
+  }
+});
 runner.command("status").description("Show background runner status for the paired repository").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Limit status to one runner ID").action(async (options) => {
   const context = await loadPairedApiContext(options.root, options.apiUrl);
   if (!context) {
@@ -10387,12 +10506,7 @@ runnerService.command("install").description("Install a user-level startup servi
     process.exitCode = 1;
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   if (options.maxConcurrentWork > MAX_CONCURRENT_RUNNER_WORK) {
     console.log(`--max-concurrent-work is capped at ${MAX_CONCURRENT_RUNNER_WORK}.`);
     process.exitCode = 1;
@@ -10404,7 +10518,7 @@ runnerService.command("install").description("Install a user-level startup servi
     projectId: context.metadata.amistioProjectId,
     repositoryLinkId: context.metadata.repositoryLinkId,
     runnerId,
-    rootDir: path17.resolve(options.root),
+    rootDir: path18.resolve(options.root),
     apiUrl: options.apiUrl,
     args,
     platform
@@ -10430,12 +10544,7 @@ runnerService.command("status").description("Show the startup service status for
     console.log("Repository is not paired. Run `amistio pair` first.");
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const metadata = await readRunnerServiceMetadata({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
   if (!metadata) {
     console.log("No startup service metadata found for this paired repository runner.");
@@ -10454,12 +10563,7 @@ runnerService.command("remove").description("Remove the startup service for this
     console.log("Repository is not paired. Run `amistio pair` first.");
     return;
   }
-  const runnerId = options.runnerId ?? stableRunnerId({
-    accountId: context.metadata.amistioAccountId,
-    projectId: context.metadata.amistioProjectId,
-    repositoryLinkId: context.metadata.repositoryLinkId,
-    machineId: runnerMachineId()
-  });
+  const runnerId = options.runnerId ?? await resolveLocalRunnerId(runnerIdentityScope(context.metadata));
   const removed = await removeRunnerService({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
   console.log(removed ? `Removed startup service ${removed.serviceName}.` : "No startup service metadata found for this paired repository runner.");
 });
@@ -11088,7 +11192,7 @@ async function runNextWorkItem({
       projectId,
       result.workItem.workItemId,
       finalStatus,
-      `run_${result.workItem.workItemId}_${randomUUID2()}`,
+      `run_${result.workItem.workItemId}_${randomUUID3()}`,
       runnerId,
       {
         tool: preview.toolName,
@@ -11182,7 +11286,7 @@ async function prepareWorktreeForClaimedItem({ apiClient, heartbeatConcurrency,
     const telemetry = workItemIsolationTelemetry(workItem, { ...identity, baseRevision: workItem.baseRevision ?? "unknown", worktreePath: "" });
     const finalAttempt = workItem.attempt >= maxPreflightAttempts;
     const statusMessage = finalAttempt ? `Git worktree preflight failed after ${workItem.attempt}/${maxPreflightAttempts} attempts. ${message}` : `Git worktree preflight attempt ${workItem.attempt}/${maxPreflightAttempts} failed. Requeueing for retry. ${message}`;
-    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`, runnerId, {
+    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
       ...telemetry,
       message: statusMessage,
       ...finalAttempt ? { blockerReason: message } : { releaseClaim: true },
@@ -11251,7 +11355,7 @@ async function recordFinalizationFailure({ apiClient, durationMs, error, isolati
   const settlements = await Promise.allSettled([
     apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
     markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage6(error)),
-    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`, runnerId, {
+    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
       ...isolationTelemetry,
       tool: toolName,
       durationMs,
@@ -11402,7 +11506,7 @@ async function updateRunnerCommandStatus(apiClient, context, command, status, me
     runnerId: context.runnerId,
     repositoryLinkId: context.repositoryLinkId,
     status,
-    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID2()}`,
+    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID3()}`,
     message,
     ...error ? { error } : {},
     ...providerAuthStatus ? { providerAuthStatus } : {}
@@ -11445,6 +11549,9 @@ async function executeImplementationHandoffRecoveryCommand(apiClient, command, c
   if (workItem.repositoryLinkId && workItem.repositoryLinkId !== context.repositoryLinkId) {
     return { succeeded: false, message: "Handoff recovery command is not scoped to this repository link." };
   }
+  if (workItem.claimedByRunnerId && workItem.claimedByRunnerId !== context.runnerId) {
+    return { succeeded: false, message: `Handoff recovery command belongs to runner ${workItem.claimedByRunnerId}. Restart that runner or use Requeue fresh attempt.` };
+  }
   if (!workItem.implementationHandoff?.recovery?.availableActions.includes(command.handoffRecoveryAction)) {
     return { succeeded: false, message: "Handoff recovery action is no longer available for this work item." };
   }
@@ -11491,7 +11598,7 @@ async function findRecoveryWorkItem(apiClient, projectId, workItemId) {
   return workItems.find((item) => item.workItemId === workItemId);
 }
 async function submitRecoveredHandoff(apiClient, context, workItem, handoff, action) {
-  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID2()}`, context.runnerId, {
+  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID3()}`, context.runnerId, {
     implementationHandoff: handoff,
     ...handoff.message ? { message: handoff.message } : {},
     ...workItem.controllingAdrId ? { controllingAdrId: workItem.controllingAdrId } : {},
@@ -11775,7 +11882,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID2()}`,
+      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`,
       artifacts,
       tool: toolName,
       durationMs,
@@ -11850,7 +11957,7 @@ ${toolResult.stderr}`);
   const failedResult2 = await apiClient.submitBrainGenerationResult(projectId, workItem.workItemId, {
     status: "failed",
     runnerId,
-    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...failedSessionTelemetry,
@@ -11900,7 +12007,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
       answer: answerResult.answer,
       sourceBoundary: answerResult.sourceBoundary,
       citations: answerResult.citations,
@@ -11936,7 +12043,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -11999,7 +12106,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
       report: {
         ...report,
         analyzedRepoRevision: report.analyzedRepoRevision ?? metadata?.lastSyncedRevision
@@ -12036,7 +12143,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12097,7 +12204,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
       diagnosis,
       tool: toolName,
       durationMs,
@@ -12131,7 +12238,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12192,7 +12299,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `security_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12226,7 +12333,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `security_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12287,7 +12394,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12321,7 +12428,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12382,7 +12489,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12416,7 +12523,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12478,7 +12585,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
       result: refreshResult,
       tool: toolName,
       durationMs,
@@ -12524,7 +12631,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12585,7 +12692,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
       result: verificationResult,
       tool: toolName,
       durationMs,
@@ -12619,7 +12726,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12680,7 +12787,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -12714,7 +12821,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12775,7 +12882,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID2()}`,
+      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
       result: gateResult,
       tool: toolName,
       durationMs,
@@ -12809,7 +12916,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID2()}`,
+    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -12954,6 +13061,14 @@ async function loadPairedApiContext(root, apiUrl) {
     })
   };
 }
+function runnerIdentityScope(metadata) {
+  return {
+    accountId: metadata.amistioAccountId,
+    projectId: metadata.amistioProjectId,
+    repositoryLinkId: metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  };
+}
 async function loadProjectNextAction(apiClient, projectId, repositoryLinkId, root) {
   const [{ workItems }, { documents }, { runners }] = await Promise.all([
     apiClient.listWorkItems(projectId),
@@ -13038,7 +13153,7 @@ async function prepareToolSession({
     });
     return { ...selection, toolSession: toolSession2 };
   }
-  const toolSessionId = `tool_session_${randomUUID2()}`;
+  const toolSessionId = `tool_session_${randomUUID3()}`;
   const { toolSession } = await apiClient.createToolSession(projectId, {
     toolSessionId,
     repositoryLinkId,
@@ -13145,6 +13260,23 @@ function truncateLogExcerpt(value) {
 function formatHostHelperCapability(label, support) {
   return `${label}: ${support.supported ? "supported" : "unsupported"}${support.reason ? ` (${support.reason})` : ""}`;
 }
+function harnessProviderCheckTargets() {
+  return [
+    { label: "GitHub Models Direct", request: { providerId: "github-models", providerClientId: "github-models-api", routeType: "directProvider" } },
+    { label: "GitHub Copilot SDK", request: { providerId: "github-copilot", providerClientId: "github-copilot-sdk", routeType: "agentClient" } }
+  ];
+}
+function formatProviderAuthStatusLines(status) {
+  const lines = [
+    `Target: ${status.providerId}:${status.providerClientId}:${status.routeType}`,
+    `Checked: ${status.checkedAt}`
+  ];
+  if (status.authMethodLabel) lines.push(`Auth: ${status.authMethodLabel}`);
+  if (status.modelCount !== void 0) lines.push(`Models: ${status.modelCount}`);
+  if (status.message) lines.push(`Message: ${status.message}`);
+  if (status.errorCode) lines.push(`Code: ${status.errorCode}`);
+  return lines;
+}
 function collectRepeatedOption(value, previous) {
   return [...previous, value];
 }
@@ -13171,7 +13303,7 @@ function parseReasoningEffort(value) {
   throw new Error(`Expected reasoning effort auto, low, medium, high, or xhigh; received ${value}.`);
 }
 function inferRepoName(root) {
-  return path17.basename(path17.resolve(root)) || "repository";
+  return path18.basename(path18.resolve(root)) || "repository";
 }
 function createRepoFingerprint(accountId, projectId, repositoryLinkId) {
   return createHash9("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
@@ -13448,7 +13580,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   return {
     version: CLI_VERSION,
     mode,
-    hostname: os8.hostname(),
+    hostname: os9.hostname(),
     ...runnerIsolationCapabilityMetadata(),
     maxConcurrentWork: concurrencyMetadata.maxConcurrentWork,
     activeClaimLaneIds: concurrencyMetadata.activeClaimLaneIds,
@@ -13473,7 +13605,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   };
 }
 function runnerMachineId() {
-  return createHash9("sha256").update(`${os8.hostname()}:${os8.platform()}:${os8.arch()}`).digest("hex").slice(0, 20);
+  return createHash9("sha256").update(`${os9.hostname()}:${os9.platform()}:${os9.arch()}`).digest("hex").slice(0, 20);
 }
 async function delay(milliseconds) {
   await new Promise((resolve) => setTimeout(resolve, milliseconds));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amistio/cli",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "repository": {
     "type": "git",