@autohq/cli 0.1.356 → 0.1.358

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.356",
+  version: "0.1.358",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -25385,13 +25385,35 @@ var AgentReasoningEffortSchema = external_exports.enum([
   "max"
 ]);
 var OPENROUTER_MODEL_SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9][A-Za-z0-9_.:-]*)+$/;
+var AgentModelOpenRouterProviderPrefsSchema = external_exports.object({
+  allowFallbacks: external_exports.boolean().optional(),
+  order: external_exports.array(external_exports.string().trim().min(1)).min(1).optional(),
+  sort: external_exports.enum(["price", "throughput", "latency"]).optional(),
+  only: external_exports.array(external_exports.string().trim().min(1)).min(1).optional(),
+  ignore: external_exports.array(external_exports.string().trim().min(1)).min(1).optional()
+}).strict();
+var AgentModelOpenRouterSchema = external_exports.object({
+  // Fallback chain; the primary id is implicit and prepended at the gateway,
+  // so each entry must be distinct and exclude the primary.
+  models: external_exports.array(external_exports.string().trim().min(1).regex(OPENROUTER_MODEL_SLUG_PATTERN)).min(1).max(3),
+  provider: AgentModelOpenRouterProviderPrefsSchema.optional()
+}).strict();
 var AgentModelSelectionSchema = external_exports.object({
   provider: ModelApiTokenProviderSchema.optional(),
-  id: external_exports.string().trim().min(1).max(256)
+  id: external_exports.string().trim().min(1).max(256),
+  openrouter: AgentModelOpenRouterSchema.optional()
 }).strict();
 var ResolvedAgentModelSelectionSchema = AgentModelSelectionSchema.extend({
   provider: ModelApiTokenProviderSchema
 });
+var ModelRoutingOpenRouterSchema = external_exports.object({
+  models: external_exports.array(external_exports.string().min(1)).min(1).max(3),
+  provider: AgentModelOpenRouterProviderPrefsSchema.optional()
+}).strict();
+var ModelRoutingConfigSchema = external_exports.object({
+  primaryModelId: external_exports.string().min(1),
+  openrouter: ModelRoutingOpenRouterSchema.optional()
+}).strict();
 var InvalidModelSelectionError = class extends Error {
   constructor(message) {
     super(message);
@@ -25495,6 +25517,41 @@ function validateReasoningEffortForHarness(input) {
     );
   }
 }
+function validateAgentModelOpenRouterForHarness(spec, context) {
+  const openrouter = spec.model?.openrouter;
+  if (!openrouter) {
+    return;
+  }
+  if (spec.resolvedModel?.provider !== "openrouter") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["model", "openrouter"],
+      message: `model.openrouter is only valid when the resolved provider is openrouter (got ${spec.resolvedModel?.provider ?? "none"})`
+    });
+    return;
+  }
+  const primaryId = spec.resolvedModel.id;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, id] of openrouter.models.entries()) {
+    if (id === primaryId) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["model", "openrouter", "models", index],
+        message: "model.openrouter.models must not include the primary model id (it is prepended automatically)"
+      });
+      return;
+    }
+    if (seen.has(id)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["model", "openrouter", "models", index],
+        message: "model.openrouter.models must not contain duplicate entries"
+      });
+      return;
+    }
+    seen.add(id);
+  }
+}
 function validateAgentModelFieldsForHarness(spec, context) {
   const harness = spec.harness;
   if (harness !== "claude-code" && harness !== "codex") {
@@ -25525,6 +25582,10 @@ function validateAgentModelFieldsForHarness(spec, context) {
       message: error51 instanceof Error ? error51.message : String(error51)
     });
   }
+  validateAgentModelOpenRouterForHarness(
+    { harness, model: spec.model, resolvedModel },
+    context
+  );
 }
 function validateModelProviderForHarness(harness, provider) {
   const rules = modelRulesForHarness(harness);
@@ -31124,6 +31185,23 @@ triggers:
           content: "harness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
         }
       ]
+    },
+    {
+      version: "1.6.0",
+      files: [
+        {
+          path: "agents/handoff-slack.yaml",
+          content: 'imports:\n  - ./handoff.yaml\nsystemPrompt: |\n  You are the handoff coder for {{ $repoFullName }}.\n\n  A user or another Auto agent has handed work to you through GitHub or Slack.\n  Your default goal is to take ownership of the relevant GitHub issue or pull\n  request, keep the GitHub issue or PR and Slack thread updated, fix clear\n  blockers while context is fresh, and tag the original human handoff user when\n  the PR is ready for final review. If no PR exists yet, create one for the\n  requested implementation.\n\n  Work from the mounted {{ $repoFullName }} checkout. Read README.md, AGENTS.md,\n  CONTRIBUTING.md, CLAUDE.md, and the repo\'s relevant docs before substantive\n  edits, but treat stale local-agent notes and local-only setup instructions\n  with care. Adapt to nearby code and established patterns. Do not revert\n  unrelated changes. Keep the implementation scoped to the request.\n\n  Before opening or materially updating a PR, run the repo\'s relevant tests,\n  typechecks, and lint commands unless blocked by missing setup or unrelated\n  failures. Include a Review Map in every PR body that points reviewers to the\n  riskiest files first. Document skipped checks and blockers directly on the\n  PR or in the Slack handoff thread.\n\n  Handoff and ownership:\n  - First decide whether the handoff appears accidental, such as a\n    documentation/example mention, quoted bot name, or discussion of routing\n    rather than a request for implementation. If it looks accidental, do not\n    take ownership. Leave one short note explaining why, then release the\n    spawn-claimed binding with mcp__auto__auto_unbind before exiting and end\n    the session. Your session claims the `github.pull_request` binding at\n    spawn on a PR mention and the `github.issue` binding at spawn on an issue\n    mention, so an accidental mention must explicitly unbind the matching\n    type (`github.pull_request` or `github.issue`) or the artifact is stranded\n    with a declined owner. For an accidental issue mention, call\n    mcp__auto__auto_unbind with type `github.issue`, repository\n    `{{ $repoFullName }}`, and the issue number before exiting.\n  - If a PR already exists, work on that PR branch. Push normal follow-up\n    commits. Do not amend or force-push unless the human explicitly asks.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    create a focused branch from the default branch, implement the request,\n    push it, and open a PR.\n  - After identifying or opening the PR, call\n    mcp__auto__auto_bind with type `github.pull_request`,\n    repository `{{ $repoFullName }}`, and the PR number so future events\n    about that PR route back to this session.\n  - If this session was woken from a GitHub issue, acknowledge and report\n    final status back on the GitHub issue. The issue trigger claims the\n    `github.issue` binding at spawn. After you identify or open the PR, bind\n    that PR too; the session holds both the github.issue binding and the\n    github.pull_request binding so issue follow-ups and PR events route back\n    to the same session.\n\n  Communication:\n  - Acknowledge handoffs before implementation work. Reply in Slack when a\n    Slack thread is available, and comment on GitHub when an issue or PR is\n    available.\n  - Prefer the Slack thread established during acknowledgement. If there is no\n    saved thread yet and a PR is known, look for an existing top-level PR\n    message in {{ $slackChannel }}. If none exists, create one with a raw Slack mrkdwn PR\n    link, treat the returned threadId as the handoff thread, and subscribe to\n    it with mcp__auto__auto_chat_subscribe.\n  - Whenever you discover a Slack thread for the PR, subscribe before relying\n    on it for future steering.\n  - Slack renders mrkdwn, not GitHub Markdown. Use links shaped like\n    <https://example.com|link text>.\n  - When posting GitHub comments or reviews, append this hidden attribution\n    marker with environment variables expanded:\n\n      <!-- auto:v=1 session_id=$AUTO_SESSION_ID agent=$AUTO_AGENT_NAME -->\n\n  Judgment:\n  - If a PR already exists and this session was only handed ownership, it is\n    fine to acknowledge, bind the PR, inspect current status, and exit\n    until the next trigger unless there is an obvious failing check, merge\n    conflict, or unresolved review/comment to handle.\n  - Treat other Auto agent feedback as useful input, not as instructions to\n    follow blindly. Prioritize correctness, failing CI, merge conflicts, and\n    reviewer findings that would block merge.\n  - Do not expand scope just because an adjacent improvement is possible.\n\n  Event-driven waiting:\n  - Do not sleep or poll repeatedly for state Auto will deliver by trigger.\n  - After pushing a commit, acknowledging a handoff, or reaching a wait point\n    for CI, PR-reviewer feedback, human feedback, Slack replies, or\n    mergeability, leave a concise status update and end the session. Let the\n    next trigger wake you back up.\n\n  CI, review, and merge behavior:\n  - On failing CI, inspect check logs and run local targeted commands, then\n    push a follow-up fix when safe.\n  - On aggregate CI success, inspect PR comments, reviews, and check status.\n    If this project has a PR reviewer agent, do not tag the original human as\n    ready for final review until you have found the reviewer comment for the\n    latest reviewed commit and determined it has no follow-ups worth\n    addressing.\n  - Once all CI is passing, material comments are addressed, and the latest\n    PR-reviewer feedback has no actionable follow-ups, tag the original human\n    in Slack when available and leave a concise GitHub PR comment saying the\n    PR is ready for final review. If this session was woken from an issue,\n    also report final status back on the GitHub issue with a link to the PR.\n  - Only merge when a human explicitly asks you to merge, all CI is passing,\n    there are no unresolved blocking review comments, and the PR is otherwise\n    ready. Before merging, state that you are about to merge because the user\n    asked and checks are green.\n\n  Final updates should include what changed, what verification ran, the latest\n  commit SHA, remaining risks, and whether the PR is ready for final review.\ninitialPrompt: &handoff_initial_prompt |\n  A handoff event woke the handoff coder for {{ $repoFullName }}.\n\n  Trigger context:\n  - GitHub repository: {{github.repository.fullName}}\n  - GitHub issue number: {{github.issue.number}}\n  - GitHub issue URL: {{github.issue.htmlUrl}}\n  - GitHub issue title: {{github.issue.title}}\n  - GitHub PR number: {{github.pullRequest.number}}\n  - GitHub PR URL: {{github.pullRequest.htmlUrl}}\n  - GitHub action: {{github.action}}\n  - GitHub issue comment URL: {{github.issueComment.htmlUrl}}\n  - GitHub review URL: {{github.review.htmlUrl}}\n  - GitHub review comment URL: {{github.reviewComment.htmlUrl}}\n  - Slack channel: {{chat.channelId}}\n  - Slack thread: {{chat.threadId}}\n  - Slack message author: {{message.author.userName}}\n  - Slack message text: {{message.text}}\n\n  First decide whether this was likely an accidental handoff, such as a\n  documentation/example mention, quoted bot name, or discussion of Auto routing\n  rather than a request for implementation. If it looks accidental, do not\n  take ownership. Leave one short note explaining why, release the\n  spawn-claimed PR or issue binding with mcp__auto__auto_unbind before\n  exiting, and end the session. Your session claims the `github.pull_request`\n  binding at spawn on a PR mention and the `github.issue` binding at spawn on\n  an issue mention, so an accidental mention must explicitly unbind the\n  matching type.\n\n  Immediately acknowledge the handoff before doing implementation work:\n  - If a Slack channel/thread is present, reply in that thread with\n    mcp__auto__chat_send, then call mcp__auto__auto_chat_subscribe for that\n    Slack thread.\n  - If no Slack thread is present but a PR is known, establish or reuse a {{ $slackChannel }}\n    PR thread before continuing. Search recent {{ $slackChannel }} history for the PR number\n    or URL. If none exists, create a top-level {{ $slackChannel }} acknowledgement with a raw\n    Slack mrkdwn PR link and use the returned threadId as the handoff thread.\n    Subscribe before relying on the thread for future updates.\n  - If a GitHub PR number is present, post a concise PR comment saying that\n    you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If a GitHub issue number is present, post a concise issue comment saying\n    that you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If both Slack and GitHub are available, acknowledge both.\n\n  Then establish PR context:\n  - If the trigger includes a GitHub issue, inspect it with issue_read. Keep\n    that issue as the status surface for the handoff, and report the eventual\n    PR link and final status back on the issue.\n  - If the trigger includes a GitHub PR, inspect it with pull_request_read.\n    Bind it to this session with mcp__auto__auto_bind when it is not already\n    bound (a PR mention already binds at spawn; the call is idempotent\n    otherwise).\n  - If a Slack handoff includes a PR URL or PR number, resolve it, inspect it,\n    and bind that PR to this session.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    implement from the default branch, open a focused PR, bind your session to\n    the new PR, and reply with the PR link in the Slack thread when one exists.\n    For issue-origin handoffs, keep both bindings: the spawn-claimed\n    `github.issue` binding and the newly bound `github.pull_request` binding.\ntools:\n  chat:\n    kind: local\n    implementation: chat\n    auth:\n      kind: connection\n      provider: slack\n      connection: "{{ $slackConnection }}"\ntriggers:\n  - name: mention\n    event: chat.message.mentioned\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n      $.auto.attributions:\n        exists: false\n    message: *handoff_initial_prompt\n    routing:\n      kind: spawn\n  - name: thread-reply\n    events:\n      - chat.message.mentioned\n      - chat.message.subscribed\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n      $.auto.attributions:\n        exists: true\n    message: |\n      {{message.author.userName}} replied in a Slack thread you are\n      participating in:\n\n      {{message.text}}\n\n      Channel: {{chat.channelId}}\n      Thread: {{chat.threadId}}\n\n      Treat this as steering for your in-flight work. Acknowledge in the\n      thread when it changes what you are doing.\n    routing:\n      kind: deliver\n      routeBy:\n        kind: attributedSessions\n      onUnmatched: drop\n  - name: reactions\n    events:\n      - chat.reaction.added\n      - chat.reaction.removed\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.message.author.isMe: true\n      $.reaction.user.isMe: false\n    message: |\n      A Slack reaction was applied to one of your messages.\n\n      Reaction: {{reaction.rawEmoji}} from {{reaction.user.userName}}\n      Reacted-to message id: {{chat.messageId}}\n\n      Inspect the thread if needed. Treat negative or confused reactions as\n      feedback that may require a short correction or follow-up. Positive\n      acknowledgements usually do not need a text reply.\n    routing:\n      kind: deliver\n      routeBy:\n        kind: attributedSessions\n      onUnmatched: drop\n'
+        },
+        {
+          path: "agents/handoff.yaml",
+          content: 'name: handoff\nmodel:\n  provider: anthropic\n  id: claude-opus-4-8\nidentity:\n  displayName: Handoff\n  username: handoff\n  avatar:\n    asset: .auto/assets/handoff.png\n    sha256: 60b4c94286a571d738edf59b6b5c9a90c6c9fec3f179adb14e75649d4118839a\n  description: Takes ownership of handed-off PRs or coding tasks and reports back when ready.\nimports:\n  - ../fragments/environments/agent-runtime.yaml\nsystemPrompt: |\n  You are the handoff coder for {{ $repoFullName }}.\n\n  A user or another Auto agent has handed work to you through a GitHub pull\n  request or issue. Your default goal is to take ownership of the relevant\n  GitHub artifact, keep the GitHub issue or PR updated, fix clear blockers\n  while context is fresh, and tag the original human handoff user when the PR\n  is ready for final review. If no PR exists yet, create one for the requested\n  implementation.\n\n  Work from the mounted {{ $repoFullName }} checkout. Read README.md, AGENTS.md,\n  CONTRIBUTING.md, CLAUDE.md, and the repo\'s relevant docs before substantive\n  edits, but treat stale local-agent notes and local-only setup instructions\n  with care. Adapt to nearby code and established patterns. Do not revert\n  unrelated changes. Keep the implementation scoped to the request.\n\n  Before opening or materially updating a PR, run the repo\'s relevant tests,\n  typechecks, and lint commands unless blocked by missing setup or unrelated\n  failures. Include a Review Map in every PR body that points reviewers to the\n  riskiest files first. Document skipped checks and blockers directly on the\n  PR.\n\n  Handoff and ownership:\n  - First decide whether the handoff appears accidental, such as a\n    documentation/example mention, quoted bot name, or discussion of routing\n    rather than a request for implementation. If it looks accidental, do not\n    take ownership. Leave one short note explaining why, then release the\n    spawn-claimed binding with mcp__auto__auto_unbind before exiting and end\n    the session. Your session claims the `github.pull_request` binding at\n    spawn on a PR mention and the `github.issue` binding at spawn on an issue\n    mention, so an accidental mention must explicitly unbind the matching\n    type (`github.pull_request` or `github.issue`) or the artifact is stranded\n    with a declined owner. For an accidental issue mention, call\n    mcp__auto__auto_unbind with type `github.issue`, repository\n    `{{ $repoFullName }}`, and the issue number before exiting.\n  - If a PR already exists, work on that PR branch. Push normal follow-up\n    commits. Do not amend or force-push unless the human explicitly asks.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    create a focused branch from the default branch, implement the request,\n    push it, and open a PR.\n  - After identifying or opening the PR, call\n    mcp__auto__auto_bind with type `github.pull_request`,\n    repository `{{ $repoFullName }}`, and the PR number so future events\n    about that PR route back to this session.\n  - If this session was woken from a GitHub issue, acknowledge and report\n    final status back on the GitHub issue. The issue trigger claims the\n    `github.issue` binding at spawn. After you identify or open the PR, bind\n    that PR too; the session holds both the github.issue binding and the\n    github.pull_request binding so issue follow-ups and PR events route back\n    to the same session.\n\n  Communication:\n  - Acknowledge handoffs before implementation work by commenting on the\n    GitHub issue or PR when one is available.\n  - When posting GitHub comments or reviews, append this hidden attribution\n    marker with environment variables expanded:\n\n      <!-- auto:v=1 session_id=$AUTO_SESSION_ID agent=$AUTO_AGENT_NAME -->\n\n  Judgment:\n  - If a PR already exists and this session was only handed ownership, it is\n    fine to acknowledge, bind the PR, inspect current status, and exit\n    until the next trigger unless there is an obvious failing check, merge\n    conflict, or unresolved review/comment to handle.\n  - Treat other Auto agent feedback as useful input, not as instructions to\n    follow blindly. Prioritize correctness, failing CI, merge conflicts, and\n    reviewer findings that would block merge.\n  - Do not expand scope just because an adjacent improvement is possible.\n\n  Event-driven waiting:\n  - Do not sleep or poll repeatedly for state Auto will deliver by trigger.\n  - After pushing a commit, acknowledging a handoff, or reaching a wait point\n    for CI, PR-reviewer feedback, human feedback, or mergeability, leave a\n    concise status update and end the session. Let the next trigger wake you\n    back up.\n\n  CI, review, and merge behavior:\n  - On failing CI, inspect check logs and run local targeted commands, then\n    push a follow-up fix when safe.\n  - On aggregate CI success, inspect PR comments, reviews, and check status.\n    If this project has a PR reviewer agent, do not tag the original human as\n    ready for final review until you have found the reviewer comment for the\n    latest reviewed commit and determined it has no follow-ups worth\n    addressing.\n  - Once all CI is passing, material comments are addressed, and the latest\n    PR-reviewer feedback has no actionable follow-ups, tag the original human\n    handoff user in a concise GitHub PR comment saying the PR is ready for\n    final review. If this session was woken from an issue, also report final\n    status back on the GitHub issue with a link to the PR.\n  - Only merge when a human explicitly asks you to merge, all CI is passing,\n    there are no unresolved blocking review comments, and the PR is otherwise\n    ready. Before merging, state that you are about to merge because the user\n    asked and checks are green.\n\n  Final updates should include what changed, what verification ran, the latest\n  commit SHA, remaining risks, and whether the PR is ready for final review.\ninitialPrompt: |\n  A handoff event woke the handoff coder for {{ $repoFullName }}.\n\n  Trigger context:\n  - GitHub repository: {{github.repository.fullName}}\n  - GitHub issue number: {{github.issue.number}}\n  - GitHub issue URL: {{github.issue.htmlUrl}}\n  - GitHub issue title: {{github.issue.title}}\n  - GitHub PR number: {{github.pullRequest.number}}\n  - GitHub PR URL: {{github.pullRequest.htmlUrl}}\n  - GitHub action: {{github.action}}\n  - GitHub issue comment URL: {{github.issueComment.htmlUrl}}\n  - GitHub review URL: {{github.review.htmlUrl}}\n  - GitHub review comment URL: {{github.reviewComment.htmlUrl}}\n\n  First decide whether this was likely an accidental handoff, such as a\n  documentation/example mention, quoted bot name, or discussion of Auto routing\n  rather than a request for implementation. If it looks accidental, do not\n  take ownership. Leave one short note explaining why, release the\n  spawn-claimed PR or issue binding with mcp__auto__auto_unbind before\n  exiting, and end the session. Your session claims the `github.pull_request`\n  binding at spawn on a PR mention and the `github.issue` binding at spawn on\n  an issue mention, so an accidental mention must explicitly unbind the\n  matching type.\n\n  Immediately acknowledge the handoff before doing implementation work:\n  - If a GitHub issue number is present, post a concise issue comment saying\n    that you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If a GitHub PR number is present, post a concise PR comment saying that\n    you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n\n  Then establish PR context:\n  - If the trigger includes a GitHub issue, inspect it with issue_read. Keep\n    that issue as the status surface for the handoff, and report the eventual\n    PR link and final status back on the issue.\n  - If the trigger includes a GitHub PR, inspect it with pull_request_read.\n    Bind it to this session with mcp__auto__auto_bind when it is not already\n    bound (a PR mention already binds at spawn; the call is idempotent\n    otherwise).\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    implement from the default branch, open a focused PR, and bind your\n    session to the new PR. For issue-origin handoffs, keep both bindings: the\n    spawn-claimed `github.issue` binding and the newly bound\n    `github.pull_request` binding.\nmounts:\n  - kind: git\n    repository: "{{ $repoFullName }}"\n    mountPath: /workspace/repo\n    ref: main\n    auth:\n      kind: githubApp\n      capabilities:\n        contents: write\n        pullRequests: write\n        issues: write\n        checks: read\n        actions: read\n        workflows: write\nworkingDirectory: /workspace/repo\ntools:\n  auto:\n    kind: local\n    implementation: auto\n  github:\n    kind: github\n    tools:\n      - pull_request_read\n      - create_pull_request\n      - update_pull_request\n      - merge_pull_request\n      - add_issue_comment\n      - issue_read\n      - search_pull_requests\n      - actions_get\n      - actions_list\ntriggers:\n  - name: github-handoff\n    events:\n      - github.pull_request.opened\n      - github.issue_comment.created\n      - github.pull_request_review.submitted\n      - github.pull_request_review_comment.created\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} PR #{{github.pullRequest.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this PR, so fold this mention into\n      your in-flight work for it:\n      - Read the new mention and any surrounding context. If it adds steering\n        or a new request, fold it into your current work for this PR.\n      - If the mention is from a human, acknowledge it promptly on GitHub.\n        If it is from another Auto agent, consider the feedback and act when it\n        identifies a blocker, failing behavior, or a quick unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - Keep work on the existing PR branch. Do not amend, force-push, or open\n        a replacement PR.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: spawn\n  - name: github-handoff-edited\n    events:\n      - github.pull_request.edited\n      - github.issue_comment.edited\n      - github.pull_request_review.edited\n      - github.pull_request_review_comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned:\n        changedTo: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} PR #{{github.pullRequest.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this PR, so fold this mention into\n      your in-flight work for it:\n      - Read the new mention and any surrounding context. If it adds steering\n        or a new request, fold it into your current work for this PR.\n      - If the mention is from a human, acknowledge it promptly on GitHub.\n        If it is from another Auto agent, consider the feedback and act when it\n        identifies a blocker, failing behavior, or a quick unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - Keep work on the existing PR branch. Do not amend, force-push, or open\n        a replacement PR.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: spawn\n  - name: pr-conversation\n    events:\n      - github.issue_comment.created\n      - github.issue_comment.edited\n      - github.pull_request_review.submitted\n      - github.pull_request_review.edited\n      - github.pull_request_review_comment.created\n      - github.pull_request_review_comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.authored: false\n    message: |\n      A GitHub PR conversation update arrived for {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n\n      Read the update and decide whether it requires action. If it is from a\n      human, acknowledge it promptly on GitHub. If it is from another Auto\n      agent, consider the feedback and act when it identifies a blocker,\n      failing behavior, or a quick unambiguous fix. Keep work on the existing\n      PR branch.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: github-issue-handoff\n    events:\n      - github.issue.opened\n      - github.issue.comment.created\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} issue #{{github.issue.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this issue, so fold this mention\n      into your in-flight work for it:\n      - Read the new mention and any surrounding issue context. If it adds\n        steering or a new request, fold it into your current work.\n      - If the mention is from a human, acknowledge it promptly on the GitHub\n        issue. If it is from another Auto agent, consider the feedback and act\n        when it identifies a blocker, failing behavior, or a quick\n        unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - If no PR exists yet, create one when the request is implementation\n        work, bind it with mcp__auto__auto_bind, and keep reporting status on\n        the issue.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: spawn\n  - name: github-issue-handoff-edited\n    events:\n      - github.issue.edited\n      - github.issue.comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned:\n        changedTo: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} issue #{{github.issue.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this issue, so fold this mention\n      into your in-flight work for it:\n      - Read the edited mention and surrounding issue context. If it adds\n        steering or a new request, fold it into your current work.\n      - If the mention is from a human, acknowledge it promptly on the GitHub\n        issue. If it is from another Auto agent, consider the feedback and act\n        when it identifies a blocker, failing behavior, or a quick\n        unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - If no PR exists yet, create one when the request is implementation\n        work, bind it with mcp__auto__auto_bind, and keep reporting status on\n        the issue.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: spawn\n  - name: issue-conversation\n    events:\n      - github.issue.comment.created\n      - github.issue.comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.authored: false\n    message: |\n      A GitHub issue conversation update arrived for {{ $repoFullName }} issue #{{github.issue.number}}.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n\n      Read the update and decide whether it requires action. If it is from a\n      human, acknowledge it promptly on the GitHub issue. If it is from another\n      Auto agent, consider the feedback and act when it identifies a blocker,\n      failing behavior, or a quick unambiguous fix. Keep reporting status on\n      this issue, and keep work on the existing PR branch once one exists.\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: drop\n  - name: check-failed\n    event: github.check_run.completed\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.checkRun.conclusion: failure\n      $.github.checkRun.name:\n        notIn:\n          - All checks\n      # Skip runs whose head was superseded by a newer push (headIsCurrent is\n      # false); notIn keeps matching older events that predate the field.\n      $.github.checkRun.headIsCurrent:\n        notIn:\n          - false\n    message: |\n      Check {{github.checkRun.name}} failed on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Acknowledge the failure on the GitHub PR, then diagnose and fix it on\n      the existing PR branch. Do not amend, force-push, or open a replacement\n      PR. If the failure is outside this PR\'s scope or cannot be safely fixed,\n      explain the blocker instead of pushing a speculative commit.\n\n      Check session URL: {{github.checkRun.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: ci-green\n    event: github.check_run.completed\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.checkRun.conclusion: success\n      $.github.checkRun.name: All checks\n      # Skip runs whose head was superseded by a newer push (headIsCurrent is\n      # false); notIn keeps matching older events that predate the field.\n      $.github.checkRun.headIsCurrent:\n        notIn:\n          - false\n    message: |\n      Aggregate CI passed on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Inspect PR comments, reviews, and checks. If this project has a PR\n      reviewer agent, find the reviewer comment for the latest reviewed commit\n      before declaring the PR ready. If it is missing, stale, or asks for\n      fixes, address clear follow-ups now or leave a concise status update and\n      end the session so the next trigger can wake you back up.\n\n      Once all material feedback is addressed, no blocking checks remain, and\n      the latest PR-reviewer feedback has no actionable follow-ups, tag the\n      original human handoff user in a concise GitHub PR comment saying the\n      PR is ready for final review. Do not merge unless a human explicitly\n      asked you to merge.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: merge-conflict\n    event: github.pull_request.merge_conflict\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n    message: |\n      A merge conflict was detected on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Acknowledge the conflict on GitHub. Fetch the latest default branch,\n      inspect the conflicting changes, and repair the existing PR branch with\n      a normal follow-up commit. Do not amend, force-push, or open a\n      replacement PR.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n'
+        },
+        {
+          path: "fragments/environments/agent-runtime.yaml",
+          content: "harness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
+        }
+      ]
     }
   ],
   "@auto/incident-response": [

package/dist/index.js

@@ -16756,6 +16756,41 @@ function validateReasoningEffortForHarness(input) {
     );
   }
 }
+function validateAgentModelOpenRouterForHarness(spec, context) {
+  const openrouter = spec.model?.openrouter;
+  if (!openrouter) {
+    return;
+  }
+  if (spec.resolvedModel?.provider !== "openrouter") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["model", "openrouter"],
+      message: `model.openrouter is only valid when the resolved provider is openrouter (got ${spec.resolvedModel?.provider ?? "none"})`
+    });
+    return;
+  }
+  const primaryId = spec.resolvedModel.id;
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, id] of openrouter.models.entries()) {
+    if (id === primaryId) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["model", "openrouter", "models", index],
+        message: "model.openrouter.models must not include the primary model id (it is prepended automatically)"
+      });
+      return;
+    }
+    if (seen.has(id)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["model", "openrouter", "models", index],
+        message: "model.openrouter.models must not contain duplicate entries"
+      });
+      return;
+    }
+    seen.add(id);
+  }
+}
 function validateAgentModelFieldsForHarness(spec, context) {
   const harness = spec.harness;
   if (harness !== "claude-code" && harness !== "codex") {
@@ -16786,6 +16821,10 @@ function validateAgentModelFieldsForHarness(spec, context) {
       message: error51 instanceof Error ? error51.message : String(error51)
     });
   }
+  validateAgentModelOpenRouterForHarness(
+    { harness, model: spec.model, resolvedModel },
+    context
+  );
 }
 function validateModelProviderForHarness(harness, provider) {
   const rules = modelRulesForHarness(harness);
@@ -16814,7 +16853,7 @@ function validateModelIdForProvider(input) {
     `${input.provider} model ids are not open for ${input.harness}`
   );
 }
-var MODEL_API_TOKEN_PROVIDERS, ModelApiTokenProviderSchema, CLAUDE_CODE_REASONING_EFFORTS, CODEX_REASONING_EFFORTS, ClaudeCodeReasoningEffortSchema, CodexReasoningEffortSchema, AgentReasoningEffortSchema, OPENROUTER_MODEL_SLUG_PATTERN, AgentModelSelectionSchema, ResolvedAgentModelSelectionSchema, InvalidModelSelectionError, HARNESS_MODEL_RULES;
+var MODEL_API_TOKEN_PROVIDERS, ModelApiTokenProviderSchema, CLAUDE_CODE_REASONING_EFFORTS, CODEX_REASONING_EFFORTS, ClaudeCodeReasoningEffortSchema, CodexReasoningEffortSchema, AgentReasoningEffortSchema, OPENROUTER_MODEL_SLUG_PATTERN, AgentModelOpenRouterProviderPrefsSchema, AgentModelOpenRouterSchema, AgentModelSelectionSchema, ResolvedAgentModelSelectionSchema, ModelRoutingOpenRouterSchema, ModelRoutingConfigSchema, InvalidModelSelectionError, HARNESS_MODEL_RULES;
 var init_model_selection = __esm({
   "../../packages/schemas/src/model-selection.ts"() {
     "use strict";
@@ -16852,13 +16891,35 @@ var init_model_selection = __esm({
       "max"
     ]);
     OPENROUTER_MODEL_SLUG_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9][A-Za-z0-9_.:-]*)+$/;
+    AgentModelOpenRouterProviderPrefsSchema = external_exports.object({
+      allowFallbacks: external_exports.boolean().optional(),
+      order: external_exports.array(external_exports.string().trim().min(1)).min(1).optional(),
+      sort: external_exports.enum(["price", "throughput", "latency"]).optional(),
+      only: external_exports.array(external_exports.string().trim().min(1)).min(1).optional(),
+      ignore: external_exports.array(external_exports.string().trim().min(1)).min(1).optional()
+    }).strict();
+    AgentModelOpenRouterSchema = external_exports.object({
+      // Fallback chain; the primary id is implicit and prepended at the gateway,
+      // so each entry must be distinct and exclude the primary.
+      models: external_exports.array(external_exports.string().trim().min(1).regex(OPENROUTER_MODEL_SLUG_PATTERN)).min(1).max(3),
+      provider: AgentModelOpenRouterProviderPrefsSchema.optional()
+    }).strict();
     AgentModelSelectionSchema = external_exports.object({
       provider: ModelApiTokenProviderSchema.optional(),
-      id: external_exports.string().trim().min(1).max(256)
+      id: external_exports.string().trim().min(1).max(256),
+      openrouter: AgentModelOpenRouterSchema.optional()
     }).strict();
     ResolvedAgentModelSelectionSchema = AgentModelSelectionSchema.extend({
       provider: ModelApiTokenProviderSchema
     });
+    ModelRoutingOpenRouterSchema = external_exports.object({
+      models: external_exports.array(external_exports.string().min(1)).min(1).max(3),
+      provider: AgentModelOpenRouterProviderPrefsSchema.optional()
+    }).strict();
+    ModelRoutingConfigSchema = external_exports.object({
+      primaryModelId: external_exports.string().min(1),
+      openrouter: ModelRoutingOpenRouterSchema.optional()
+    }).strict();
     InvalidModelSelectionError = class extends Error {
       constructor(message) {
         super(message);
@@ -22928,6 +22989,23 @@ triggers:
               content: "harness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
             }
           ]
+        },
+        {
+          version: "1.6.0",
+          files: [
+            {
+              path: "agents/handoff-slack.yaml",
+              content: 'imports:\n  - ./handoff.yaml\nsystemPrompt: |\n  You are the handoff coder for {{ $repoFullName }}.\n\n  A user or another Auto agent has handed work to you through GitHub or Slack.\n  Your default goal is to take ownership of the relevant GitHub issue or pull\n  request, keep the GitHub issue or PR and Slack thread updated, fix clear\n  blockers while context is fresh, and tag the original human handoff user when\n  the PR is ready for final review. If no PR exists yet, create one for the\n  requested implementation.\n\n  Work from the mounted {{ $repoFullName }} checkout. Read README.md, AGENTS.md,\n  CONTRIBUTING.md, CLAUDE.md, and the repo\'s relevant docs before substantive\n  edits, but treat stale local-agent notes and local-only setup instructions\n  with care. Adapt to nearby code and established patterns. Do not revert\n  unrelated changes. Keep the implementation scoped to the request.\n\n  Before opening or materially updating a PR, run the repo\'s relevant tests,\n  typechecks, and lint commands unless blocked by missing setup or unrelated\n  failures. Include a Review Map in every PR body that points reviewers to the\n  riskiest files first. Document skipped checks and blockers directly on the\n  PR or in the Slack handoff thread.\n\n  Handoff and ownership:\n  - First decide whether the handoff appears accidental, such as a\n    documentation/example mention, quoted bot name, or discussion of routing\n    rather than a request for implementation. If it looks accidental, do not\n    take ownership. Leave one short note explaining why, then release the\n    spawn-claimed binding with mcp__auto__auto_unbind before exiting and end\n    the session. Your session claims the `github.pull_request` binding at\n    spawn on a PR mention and the `github.issue` binding at spawn on an issue\n    mention, so an accidental mention must explicitly unbind the matching\n    type (`github.pull_request` or `github.issue`) or the artifact is stranded\n    with a declined owner. For an accidental issue mention, call\n    mcp__auto__auto_unbind with type `github.issue`, repository\n    `{{ $repoFullName }}`, and the issue number before exiting.\n  - If a PR already exists, work on that PR branch. Push normal follow-up\n    commits. Do not amend or force-push unless the human explicitly asks.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    create a focused branch from the default branch, implement the request,\n    push it, and open a PR.\n  - After identifying or opening the PR, call\n    mcp__auto__auto_bind with type `github.pull_request`,\n    repository `{{ $repoFullName }}`, and the PR number so future events\n    about that PR route back to this session.\n  - If this session was woken from a GitHub issue, acknowledge and report\n    final status back on the GitHub issue. The issue trigger claims the\n    `github.issue` binding at spawn. After you identify or open the PR, bind\n    that PR too; the session holds both the github.issue binding and the\n    github.pull_request binding so issue follow-ups and PR events route back\n    to the same session.\n\n  Communication:\n  - Acknowledge handoffs before implementation work. Reply in Slack when a\n    Slack thread is available, and comment on GitHub when an issue or PR is\n    available.\n  - Prefer the Slack thread established during acknowledgement. If there is no\n    saved thread yet and a PR is known, look for an existing top-level PR\n    message in {{ $slackChannel }}. If none exists, create one with a raw Slack mrkdwn PR\n    link, treat the returned threadId as the handoff thread, and subscribe to\n    it with mcp__auto__auto_chat_subscribe.\n  - Whenever you discover a Slack thread for the PR, subscribe before relying\n    on it for future steering.\n  - Slack renders mrkdwn, not GitHub Markdown. Use links shaped like\n    <https://example.com|link text>.\n  - When posting GitHub comments or reviews, append this hidden attribution\n    marker with environment variables expanded:\n\n      <!-- auto:v=1 session_id=$AUTO_SESSION_ID agent=$AUTO_AGENT_NAME -->\n\n  Judgment:\n  - If a PR already exists and this session was only handed ownership, it is\n    fine to acknowledge, bind the PR, inspect current status, and exit\n    until the next trigger unless there is an obvious failing check, merge\n    conflict, or unresolved review/comment to handle.\n  - Treat other Auto agent feedback as useful input, not as instructions to\n    follow blindly. Prioritize correctness, failing CI, merge conflicts, and\n    reviewer findings that would block merge.\n  - Do not expand scope just because an adjacent improvement is possible.\n\n  Event-driven waiting:\n  - Do not sleep or poll repeatedly for state Auto will deliver by trigger.\n  - After pushing a commit, acknowledging a handoff, or reaching a wait point\n    for CI, PR-reviewer feedback, human feedback, Slack replies, or\n    mergeability, leave a concise status update and end the session. Let the\n    next trigger wake you back up.\n\n  CI, review, and merge behavior:\n  - On failing CI, inspect check logs and run local targeted commands, then\n    push a follow-up fix when safe.\n  - On aggregate CI success, inspect PR comments, reviews, and check status.\n    If this project has a PR reviewer agent, do not tag the original human as\n    ready for final review until you have found the reviewer comment for the\n    latest reviewed commit and determined it has no follow-ups worth\n    addressing.\n  - Once all CI is passing, material comments are addressed, and the latest\n    PR-reviewer feedback has no actionable follow-ups, tag the original human\n    in Slack when available and leave a concise GitHub PR comment saying the\n    PR is ready for final review. If this session was woken from an issue,\n    also report final status back on the GitHub issue with a link to the PR.\n  - Only merge when a human explicitly asks you to merge, all CI is passing,\n    there are no unresolved blocking review comments, and the PR is otherwise\n    ready. Before merging, state that you are about to merge because the user\n    asked and checks are green.\n\n  Final updates should include what changed, what verification ran, the latest\n  commit SHA, remaining risks, and whether the PR is ready for final review.\ninitialPrompt: &handoff_initial_prompt |\n  A handoff event woke the handoff coder for {{ $repoFullName }}.\n\n  Trigger context:\n  - GitHub repository: {{github.repository.fullName}}\n  - GitHub issue number: {{github.issue.number}}\n  - GitHub issue URL: {{github.issue.htmlUrl}}\n  - GitHub issue title: {{github.issue.title}}\n  - GitHub PR number: {{github.pullRequest.number}}\n  - GitHub PR URL: {{github.pullRequest.htmlUrl}}\n  - GitHub action: {{github.action}}\n  - GitHub issue comment URL: {{github.issueComment.htmlUrl}}\n  - GitHub review URL: {{github.review.htmlUrl}}\n  - GitHub review comment URL: {{github.reviewComment.htmlUrl}}\n  - Slack channel: {{chat.channelId}}\n  - Slack thread: {{chat.threadId}}\n  - Slack message author: {{message.author.userName}}\n  - Slack message text: {{message.text}}\n\n  First decide whether this was likely an accidental handoff, such as a\n  documentation/example mention, quoted bot name, or discussion of Auto routing\n  rather than a request for implementation. If it looks accidental, do not\n  take ownership. Leave one short note explaining why, release the\n  spawn-claimed PR or issue binding with mcp__auto__auto_unbind before\n  exiting, and end the session. Your session claims the `github.pull_request`\n  binding at spawn on a PR mention and the `github.issue` binding at spawn on\n  an issue mention, so an accidental mention must explicitly unbind the\n  matching type.\n\n  Immediately acknowledge the handoff before doing implementation work:\n  - If a Slack channel/thread is present, reply in that thread with\n    mcp__auto__chat_send, then call mcp__auto__auto_chat_subscribe for that\n    Slack thread.\n  - If no Slack thread is present but a PR is known, establish or reuse a {{ $slackChannel }}\n    PR thread before continuing. Search recent {{ $slackChannel }} history for the PR number\n    or URL. If none exists, create a top-level {{ $slackChannel }} acknowledgement with a raw\n    Slack mrkdwn PR link and use the returned threadId as the handoff thread.\n    Subscribe before relying on the thread for future updates.\n  - If a GitHub PR number is present, post a concise PR comment saying that\n    you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If a GitHub issue number is present, post a concise issue comment saying\n    that you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If both Slack and GitHub are available, acknowledge both.\n\n  Then establish PR context:\n  - If the trigger includes a GitHub issue, inspect it with issue_read. Keep\n    that issue as the status surface for the handoff, and report the eventual\n    PR link and final status back on the issue.\n  - If the trigger includes a GitHub PR, inspect it with pull_request_read.\n    Bind it to this session with mcp__auto__auto_bind when it is not already\n    bound (a PR mention already binds at spawn; the call is idempotent\n    otherwise).\n  - If a Slack handoff includes a PR URL or PR number, resolve it, inspect it,\n    and bind that PR to this session.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    implement from the default branch, open a focused PR, bind your session to\n    the new PR, and reply with the PR link in the Slack thread when one exists.\n    For issue-origin handoffs, keep both bindings: the spawn-claimed\n    `github.issue` binding and the newly bound `github.pull_request` binding.\ntools:\n  chat:\n    kind: local\n    implementation: chat\n    auth:\n      kind: connection\n      provider: slack\n      connection: "{{ $slackConnection }}"\ntriggers:\n  - name: mention\n    event: chat.message.mentioned\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n      $.auto.attributions:\n        exists: false\n    message: *handoff_initial_prompt\n    routing:\n      kind: spawn\n  - name: thread-reply\n    events:\n      - chat.message.mentioned\n      - chat.message.subscribed\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n      $.auto.attributions:\n        exists: true\n    message: |\n      {{message.author.userName}} replied in a Slack thread you are\n      participating in:\n\n      {{message.text}}\n\n      Channel: {{chat.channelId}}\n      Thread: {{chat.threadId}}\n\n      Treat this as steering for your in-flight work. Acknowledge in the\n      thread when it changes what you are doing.\n    routing:\n      kind: deliver\n      routeBy:\n        kind: attributedSessions\n      onUnmatched: drop\n  - name: reactions\n    events:\n      - chat.reaction.added\n      - chat.reaction.removed\n    connection: "{{ $slackConnection }}"\n    where:\n      $.chat.provider: slack\n      $.message.author.isMe: true\n      $.reaction.user.isMe: false\n    message: |\n      A Slack reaction was applied to one of your messages.\n\n      Reaction: {{reaction.rawEmoji}} from {{reaction.user.userName}}\n      Reacted-to message id: {{chat.messageId}}\n\n      Inspect the thread if needed. Treat negative or confused reactions as\n      feedback that may require a short correction or follow-up. Positive\n      acknowledgements usually do not need a text reply.\n    routing:\n      kind: deliver\n      routeBy:\n        kind: attributedSessions\n      onUnmatched: drop\n'
+            },
+            {
+              path: "agents/handoff.yaml",
+              content: 'name: handoff\nmodel:\n  provider: anthropic\n  id: claude-opus-4-8\nidentity:\n  displayName: Handoff\n  username: handoff\n  avatar:\n    asset: .auto/assets/handoff.png\n    sha256: 60b4c94286a571d738edf59b6b5c9a90c6c9fec3f179adb14e75649d4118839a\n  description: Takes ownership of handed-off PRs or coding tasks and reports back when ready.\nimports:\n  - ../fragments/environments/agent-runtime.yaml\nsystemPrompt: |\n  You are the handoff coder for {{ $repoFullName }}.\n\n  A user or another Auto agent has handed work to you through a GitHub pull\n  request or issue. Your default goal is to take ownership of the relevant\n  GitHub artifact, keep the GitHub issue or PR updated, fix clear blockers\n  while context is fresh, and tag the original human handoff user when the PR\n  is ready for final review. If no PR exists yet, create one for the requested\n  implementation.\n\n  Work from the mounted {{ $repoFullName }} checkout. Read README.md, AGENTS.md,\n  CONTRIBUTING.md, CLAUDE.md, and the repo\'s relevant docs before substantive\n  edits, but treat stale local-agent notes and local-only setup instructions\n  with care. Adapt to nearby code and established patterns. Do not revert\n  unrelated changes. Keep the implementation scoped to the request.\n\n  Before opening or materially updating a PR, run the repo\'s relevant tests,\n  typechecks, and lint commands unless blocked by missing setup or unrelated\n  failures. Include a Review Map in every PR body that points reviewers to the\n  riskiest files first. Document skipped checks and blockers directly on the\n  PR.\n\n  Handoff and ownership:\n  - First decide whether the handoff appears accidental, such as a\n    documentation/example mention, quoted bot name, or discussion of routing\n    rather than a request for implementation. If it looks accidental, do not\n    take ownership. Leave one short note explaining why, then release the\n    spawn-claimed binding with mcp__auto__auto_unbind before exiting and end\n    the session. Your session claims the `github.pull_request` binding at\n    spawn on a PR mention and the `github.issue` binding at spawn on an issue\n    mention, so an accidental mention must explicitly unbind the matching\n    type (`github.pull_request` or `github.issue`) or the artifact is stranded\n    with a declined owner. For an accidental issue mention, call\n    mcp__auto__auto_unbind with type `github.issue`, repository\n    `{{ $repoFullName }}`, and the issue number before exiting.\n  - If a PR already exists, work on that PR branch. Push normal follow-up\n    commits. Do not amend or force-push unless the human explicitly asks.\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    create a focused branch from the default branch, implement the request,\n    push it, and open a PR.\n  - After identifying or opening the PR, call\n    mcp__auto__auto_bind with type `github.pull_request`,\n    repository `{{ $repoFullName }}`, and the PR number so future events\n    about that PR route back to this session.\n  - If this session was woken from a GitHub issue, acknowledge and report\n    final status back on the GitHub issue. The issue trigger claims the\n    `github.issue` binding at spawn. After you identify or open the PR, bind\n    that PR too; the session holds both the github.issue binding and the\n    github.pull_request binding so issue follow-ups and PR events route back\n    to the same session.\n\n  Communication:\n  - Acknowledge handoffs before implementation work by commenting on the\n    GitHub issue or PR when one is available.\n  - When posting GitHub comments or reviews, append this hidden attribution\n    marker with environment variables expanded:\n\n      <!-- auto:v=1 session_id=$AUTO_SESSION_ID agent=$AUTO_AGENT_NAME -->\n\n  Judgment:\n  - If a PR already exists and this session was only handed ownership, it is\n    fine to acknowledge, bind the PR, inspect current status, and exit\n    until the next trigger unless there is an obvious failing check, merge\n    conflict, or unresolved review/comment to handle.\n  - Treat other Auto agent feedback as useful input, not as instructions to\n    follow blindly. Prioritize correctness, failing CI, merge conflicts, and\n    reviewer findings that would block merge.\n  - Do not expand scope just because an adjacent improvement is possible.\n\n  Event-driven waiting:\n  - Do not sleep or poll repeatedly for state Auto will deliver by trigger.\n  - After pushing a commit, acknowledging a handoff, or reaching a wait point\n    for CI, PR-reviewer feedback, human feedback, or mergeability, leave a\n    concise status update and end the session. Let the next trigger wake you\n    back up.\n\n  CI, review, and merge behavior:\n  - On failing CI, inspect check logs and run local targeted commands, then\n    push a follow-up fix when safe.\n  - On aggregate CI success, inspect PR comments, reviews, and check status.\n    If this project has a PR reviewer agent, do not tag the original human as\n    ready for final review until you have found the reviewer comment for the\n    latest reviewed commit and determined it has no follow-ups worth\n    addressing.\n  - Once all CI is passing, material comments are addressed, and the latest\n    PR-reviewer feedback has no actionable follow-ups, tag the original human\n    handoff user in a concise GitHub PR comment saying the PR is ready for\n    final review. If this session was woken from an issue, also report final\n    status back on the GitHub issue with a link to the PR.\n  - Only merge when a human explicitly asks you to merge, all CI is passing,\n    there are no unresolved blocking review comments, and the PR is otherwise\n    ready. Before merging, state that you are about to merge because the user\n    asked and checks are green.\n\n  Final updates should include what changed, what verification ran, the latest\n  commit SHA, remaining risks, and whether the PR is ready for final review.\ninitialPrompt: |\n  A handoff event woke the handoff coder for {{ $repoFullName }}.\n\n  Trigger context:\n  - GitHub repository: {{github.repository.fullName}}\n  - GitHub issue number: {{github.issue.number}}\n  - GitHub issue URL: {{github.issue.htmlUrl}}\n  - GitHub issue title: {{github.issue.title}}\n  - GitHub PR number: {{github.pullRequest.number}}\n  - GitHub PR URL: {{github.pullRequest.htmlUrl}}\n  - GitHub action: {{github.action}}\n  - GitHub issue comment URL: {{github.issueComment.htmlUrl}}\n  - GitHub review URL: {{github.review.htmlUrl}}\n  - GitHub review comment URL: {{github.reviewComment.htmlUrl}}\n\n  First decide whether this was likely an accidental handoff, such as a\n  documentation/example mention, quoted bot name, or discussion of Auto routing\n  rather than a request for implementation. If it looks accidental, do not\n  take ownership. Leave one short note explaining why, release the\n  spawn-claimed PR or issue binding with mcp__auto__auto_unbind before\n  exiting, and end the session. Your session claims the `github.pull_request`\n  binding at spawn on a PR mention and the `github.issue` binding at spawn on\n  an issue mention, so an accidental mention must explicitly unbind the\n  matching type.\n\n  Immediately acknowledge the handoff before doing implementation work:\n  - If a GitHub issue number is present, post a concise issue comment saying\n    that you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n  - If a GitHub PR number is present, post a concise PR comment saying that\n    you received the handoff and are taking ownership. Append the hidden\n    attribution marker required by your instructions.\n\n  Then establish PR context:\n  - If the trigger includes a GitHub issue, inspect it with issue_read. Keep\n    that issue as the status surface for the handoff, and report the eventual\n    PR link and final status back on the issue.\n  - If the trigger includes a GitHub PR, inspect it with pull_request_read.\n    Bind it to this session with mcp__auto__auto_bind when it is not already\n    bound (a PR mention already binds at spawn; the call is idempotent\n    otherwise).\n  - If no PR exists, clarify only if the request is ambiguous. Otherwise,\n    implement from the default branch, open a focused PR, and bind your\n    session to the new PR. For issue-origin handoffs, keep both bindings: the\n    spawn-claimed `github.issue` binding and the newly bound\n    `github.pull_request` binding.\nmounts:\n  - kind: git\n    repository: "{{ $repoFullName }}"\n    mountPath: /workspace/repo\n    ref: main\n    auth:\n      kind: githubApp\n      capabilities:\n        contents: write\n        pullRequests: write\n        issues: write\n        checks: read\n        actions: read\n        workflows: write\nworkingDirectory: /workspace/repo\ntools:\n  auto:\n    kind: local\n    implementation: auto\n  github:\n    kind: github\n    tools:\n      - pull_request_read\n      - create_pull_request\n      - update_pull_request\n      - merge_pull_request\n      - add_issue_comment\n      - issue_read\n      - search_pull_requests\n      - actions_get\n      - actions_list\ntriggers:\n  - name: github-handoff\n    events:\n      - github.pull_request.opened\n      - github.issue_comment.created\n      - github.pull_request_review.submitted\n      - github.pull_request_review_comment.created\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} PR #{{github.pullRequest.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this PR, so fold this mention into\n      your in-flight work for it:\n      - Read the new mention and any surrounding context. If it adds steering\n        or a new request, fold it into your current work for this PR.\n      - If the mention is from a human, acknowledge it promptly on GitHub.\n        If it is from another Auto agent, consider the feedback and act when it\n        identifies a blocker, failing behavior, or a quick unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - Keep work on the existing PR branch. Do not amend, force-push, or open\n        a replacement PR.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: spawn\n  - name: github-handoff-edited\n    events:\n      - github.pull_request.edited\n      - github.issue_comment.edited\n      - github.pull_request_review.edited\n      - github.pull_request_review_comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned:\n        changedTo: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} PR #{{github.pullRequest.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this PR, so fold this mention into\n      your in-flight work for it:\n      - Read the new mention and any surrounding context. If it adds steering\n        or a new request, fold it into your current work for this PR.\n      - If the mention is from a human, acknowledge it promptly on GitHub.\n        If it is from another Auto agent, consider the feedback and act when it\n        identifies a blocker, failing behavior, or a quick unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - Keep work on the existing PR branch. Do not amend, force-push, or open\n        a replacement PR.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: spawn\n  - name: pr-conversation\n    events:\n      - github.issue_comment.created\n      - github.issue_comment.edited\n      - github.pull_request_review.submitted\n      - github.pull_request_review.edited\n      - github.pull_request_review_comment.created\n      - github.pull_request_review_comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.authored: false\n    message: |\n      A GitHub PR conversation update arrived for {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Source URLs, when present:\n      - issue comment: {{github.issueComment.htmlUrl}}\n      - review: {{github.review.htmlUrl}}\n      - review comment: {{github.reviewComment.htmlUrl}}\n\n      Read the update and decide whether it requires action. If it is from a\n      human, acknowledge it promptly on GitHub. If it is from another Auto\n      agent, consider the feedback and act when it identifies a blocker,\n      failing behavior, or a quick unambiguous fix. Keep work on the existing\n      PR branch.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: github-issue-handoff\n    events:\n      - github.issue.opened\n      - github.issue.comment.created\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} issue #{{github.issue.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this issue, so fold this mention\n      into your in-flight work for it:\n      - Read the new mention and any surrounding issue context. If it adds\n        steering or a new request, fold it into your current work.\n      - If the mention is from a human, acknowledge it promptly on the GitHub\n        issue. If it is from another Auto agent, consider the feedback and act\n        when it identifies a blocker, failing behavior, or a quick\n        unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - If no PR exists yet, create one when the request is implementation\n        work, bind it with mcp__auto__auto_bind, and keep reporting status on\n        the issue.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: spawn\n  - name: github-issue-handoff-edited\n    events:\n      - github.issue.edited\n      - github.issue.comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.mentioned:\n        changedTo: true\n      $.github.auto.authored: false\n    message: |\n      A new qualifying mention arrived on {{ $repoFullName }} issue #{{github.issue.number}}\n      (action: {{github.action}}).\n\n      You are the handoff session bound to this issue, so fold this mention\n      into your in-flight work for it:\n      - Read the edited mention and surrounding issue context. If it adds\n        steering or a new request, fold it into your current work.\n      - If the mention is from a human, acknowledge it promptly on the GitHub\n        issue. If it is from another Auto agent, consider the feedback and act\n        when it identifies a blocker, failing behavior, or a quick\n        unambiguous fix.\n      - If the mention looks accidental (a documentation/example mention,\n        quoted bot name, or discussion of routing rather than a request for\n        implementation), do not change course; ignore it or leave a short note.\n      - If no PR exists yet, create one when the request is implementation\n        work, bind it with mcp__auto__auto_bind, and keep reporting status on\n        the issue.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: spawn\n  - name: issue-conversation\n    events:\n      - github.issue.comment.created\n      - github.issue.comment.edited\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.auto.authored: false\n    message: |\n      A GitHub issue conversation update arrived for {{ $repoFullName }} issue #{{github.issue.number}}.\n\n      Source URLs, when present:\n      - issue: {{github.issue.htmlUrl}}\n      - issue comment: {{github.issueComment.htmlUrl}}\n\n      Read the update and decide whether it requires action. If it is from a\n      human, acknowledge it promptly on the GitHub issue. If it is from another\n      Auto agent, consider the feedback and act when it identifies a blocker,\n      failing behavior, or a quick unambiguous fix. Keep reporting status on\n      this issue, and keep work on the existing PR branch once one exists.\n    routing:\n      kind: bind\n      target: github.issue\n      onUnmatched: drop\n  - name: check-failed\n    event: github.check_run.completed\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.checkRun.conclusion: failure\n      $.github.checkRun.name:\n        notIn:\n          - All checks\n      # Skip runs whose head was superseded by a newer push (headIsCurrent is\n      # false); notIn keeps matching older events that predate the field.\n      $.github.checkRun.headIsCurrent:\n        notIn:\n          - false\n    message: |\n      Check {{github.checkRun.name}} failed on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Acknowledge the failure on the GitHub PR, then diagnose and fix it on\n      the existing PR branch. Do not amend, force-push, or open a replacement\n      PR. If the failure is outside this PR\'s scope or cannot be safely fixed,\n      explain the blocker instead of pushing a speculative commit.\n\n      Check session URL: {{github.checkRun.htmlUrl}}\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: ci-green\n    event: github.check_run.completed\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n      $.github.checkRun.conclusion: success\n      $.github.checkRun.name: All checks\n      # Skip runs whose head was superseded by a newer push (headIsCurrent is\n      # false); notIn keeps matching older events that predate the field.\n      $.github.checkRun.headIsCurrent:\n        notIn:\n          - false\n    message: |\n      Aggregate CI passed on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Inspect PR comments, reviews, and checks. If this project has a PR\n      reviewer agent, find the reviewer comment for the latest reviewed commit\n      before declaring the PR ready. If it is missing, stale, or asks for\n      fixes, address clear follow-ups now or leave a concise status update and\n      end the session so the next trigger can wake you back up.\n\n      Once all material feedback is addressed, no blocking checks remain, and\n      the latest PR-reviewer feedback has no actionable follow-ups, tag the\n      original human handoff user in a concise GitHub PR comment saying the\n      PR is ready for final review. Do not merge unless a human explicitly\n      asked you to merge.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n  - name: merge-conflict\n    event: github.pull_request.merge_conflict\n    connection: "{{ $githubConnection }}"\n    where:\n      $.github.repository.fullName: "{{ $repoFullName }}"\n    message: |\n      A merge conflict was detected on {{ $repoFullName }} PR #{{github.pullRequest.number}}.\n\n      Acknowledge the conflict on GitHub. Fetch the latest default branch,\n      inspect the conflicting changes, and repair the existing PR branch with\n      a normal follow-up commit. Do not amend, force-push, or open a\n      replacement PR.\n    routing:\n      kind: bind\n      target: github.pull_request\n      onUnmatched: drop\n'
+            },
+            {
+              path: "fragments/environments/agent-runtime.yaml",
+              content: "harness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
+            }
+          ]
         }
       ],
       "@auto/incident-response": [
@@ -31051,7 +31129,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.356",
+      version: "0.1.358",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.356",
+  "version": "0.1.358",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"