@autohq/cli 0.1.396 → 0.1.398

package/dist/agent-bridge.js

@@ -30819,7 +30819,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.396",
+  version: "0.1.398",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -33716,6 +33716,52 @@ var SecretRevealResponseSchema = external_exports.object({
   value: external_exports.string()
 });
 
+// ../../packages/schemas/src/session-bindings.ts
+var BINDING_TARGET_TYPES = [
+  "github.pull_request",
+  "github.issue",
+  "slack.thread",
+  "chat.message",
+  "agent.singleton"
+];
+var TRIGGER_BINDING_TARGET_TYPES = [
+  "github.pull_request",
+  "github.issue",
+  "slack.thread",
+  "agent.singleton"
+];
+var SESSION_BINDING_SOURCES = [
+  "trigger_spawn",
+  "agent_tool",
+  "chat_send",
+  "system"
+];
+var SESSION_BINDING_STATUSES = ["active", "released"];
+var SESSION_BINDING_RELEASE_POLICIES = ["manual", "held"];
+var SESSION_BINDING_RELEASED_BY = [
+  "agent_tool",
+  "archive",
+  "trigger_release",
+  "operator",
+  "takeover"
+];
+var BindingTargetTypeSchema = external_exports.enum(BINDING_TARGET_TYPES);
+var TriggerBindingTargetTypeSchema = external_exports.enum(
+  TRIGGER_BINDING_TARGET_TYPES
+);
+var SessionBindingSourceSchema = external_exports.enum(SESSION_BINDING_SOURCES);
+var SessionBindingStatusSchema = external_exports.enum(SESSION_BINDING_STATUSES);
+var SessionBindingReleasePolicySchema = external_exports.enum(
+  SESSION_BINDING_RELEASE_POLICIES
+);
+var SessionBindingReleasedBySchema = external_exports.enum(
+  SESSION_BINDING_RELEASED_BY
+);
+var BindingTargetSchema = external_exports.object({
+  type: BindingTargetTypeSchema,
+  externalId: external_exports.string().min(1)
+});
+
 // ../../packages/schemas/src/tools.ts
 var REMOTE_MCP_TRANSPORTS = ["streamable_http"];
 var LOCAL_TOOL_IMPLEMENTATIONS = ["auto", "chat", "ping"];
@@ -33887,38 +33933,6 @@ var InlineAgentToolSchema = RemoteMcpToolSchema.extend({
 var AgentToolRefSchema = InlineAgentToolSchema;
 var AgentToolsSchema = external_exports.record(ToolAliasSchema, AgentToolRefSchema);
 
-// ../../packages/schemas/src/session-bindings.ts
-var BINDING_TARGET_TYPES = [
-  "github.pull_request",
-  "github.issue",
-  "slack.thread",
-  "chat.message",
-  "agent.singleton"
-];
-var TRIGGER_BINDING_TARGET_TYPES = [
-  "github.pull_request",
-  "github.issue",
-  "slack.thread",
-  "agent.singleton"
-];
-var SESSION_BINDING_SOURCES = [
-  "trigger_spawn",
-  "agent_tool",
-  "chat_send",
-  "system"
-];
-var SESSION_BINDING_STATUSES = ["active", "released"];
-var BindingTargetTypeSchema = external_exports.enum(BINDING_TARGET_TYPES);
-var TriggerBindingTargetTypeSchema = external_exports.enum(
-  TRIGGER_BINDING_TARGET_TYPES
-);
-var SessionBindingSourceSchema = external_exports.enum(SESSION_BINDING_SOURCES);
-var SessionBindingStatusSchema = external_exports.enum(SESSION_BINDING_STATUSES);
-var BindingTargetSchema = external_exports.object({
-  type: BindingTargetTypeSchema,
-  externalId: external_exports.string().min(1)
-});
-
 // ../../packages/schemas/src/trigger-router.ts
 var CANONICAL_ROUTE_BY_KINDS = [
   "allLiveSessions",
@@ -33984,7 +33998,15 @@ var CanonicalTriggerRoutingSchema = external_exports.discriminatedUnion("kind",
   external_exports.object({
     kind: external_exports.literal("bind"),
     target: TriggerBindingTargetTypeSchema,
-    onUnmatched: OnUnmatchedSchema
+    onUnmatched: OnUnmatchedSchema,
+    // Declarative binding release: after the router routes this event
+    // (delivered, revived, or unmatched), the platform releases the target's
+    // active binding as a follow-up activity. Deliver-then-release — the bound
+    // session receives the message first; the binding is released after
+    // routing completes. No-op when no active binding exists. `agent.singleton`
+    // is rejected at apply time (singleton slots are pool-membership state
+    // owned by the reconciler).
+    release: external_exports.boolean().default(false)
   })
 ]);
 var LegacySingletonRouteBySchema = external_exports.object({
@@ -34011,7 +34033,8 @@ var LegacyOwnedArtifactDeliverRoutingSchema = external_exports.object({
   ({ routeBy, onUnmatched }) => ({
     kind: "bind",
     target: routeBy.artifactType,
-    onUnmatched
+    onUnmatched,
+    release: false
   })
 );
 var LegacyDeliverOrSpawnRoutingSchema = external_exports.object({
@@ -34397,6 +34420,30 @@ var AgentIdentitySchema = external_exports.object({
 }).strict().refine((identity) => Object.keys(identity).length > 0, {
   message: "Identity requires at least one field"
 });
+var BINDING_LIFECYCLE_VALUES = ["manual", "held"];
+var BindingLifecycleSpecSchema = external_exports.object({
+  lifecycle: external_exports.enum(BINDING_LIFECYCLE_VALUES).default("manual")
+}).strict();
+var AgentBindingsSchema = external_exports.record(external_exports.string(), BindingLifecycleSpecSchema).superRefine((bindings, context) => {
+  for (const key of Object.keys(bindings)) {
+    const parsed = BindingTargetTypeSchema.safeParse(key);
+    if (!parsed.success) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [key],
+        message: `\`${key}\` is not a valid binding target type`
+      });
+      continue;
+    }
+    if (parsed.data === "agent.singleton") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [key],
+        message: "`agent.singleton` is excluded from `bindings` constraints; the pool slot has its own release lifecycle"
+      });
+    }
+  }
+});
 var AgentSpecFieldsSchema = external_exports.object({
   harness: external_exports.enum(AGENT_HARNESSES).optional(),
   model: AgentModelSelectionSchema.optional(),
@@ -34414,6 +34461,7 @@ var AgentSpecFieldsSchema = external_exports.object({
   replace: AgentReplacePolicySchema.optional(),
   onReplace: external_exports.string().trim().min(1).max(2e4).optional(),
   manages: AgentManagesSchema.optional(),
+  bindings: AgentBindingsSchema.default({}),
   workingDirectory: external_exports.string().trim().min(1).optional(),
   tools: AgentToolsSchema.default({})
 });
@@ -34447,6 +34495,8 @@ var AgentApplySpecSchema = AgentSpecFieldsSchema.extend({
   validateRunnableConfig(spec, context);
   validateAgentModelFieldsForHarness(spec, context);
   validateConcurrencyConfig(spec, context);
+  validateBindingsConfig(spec, context);
+  validateTriggerReleaseConfig(spec, context);
 });
 function validateConcurrencyConfig(spec, context) {
   if (spec.concurrency === void 0 && spec.replace !== void 0) {
@@ -34485,6 +34535,49 @@ function validateConcurrencyConfig(spec, context) {
 function isSlotDeliveryTrigger(trigger) {
   return trigger.routing.kind === "deliver" && !trigger.routing.routeBy;
 }
+function validateBindingsConfig(spec, context) {
+  if (!spec.bindings) {
+    return;
+  }
+  const heldTargets = new Set(
+    Object.entries(spec.bindings).filter(([, config2]) => config2.lifecycle === "held").map(([target]) => target)
+  );
+  if (heldTargets.size === 0) {
+    return;
+  }
+  const releaseTargets = /* @__PURE__ */ new Set();
+  for (const trigger of spec.triggers) {
+    if (trigger.routing.kind !== "bind") {
+      continue;
+    }
+    if (trigger.routing.release) {
+      releaseTargets.add(trigger.routing.target);
+    }
+  }
+  for (const target of heldTargets) {
+    if (!releaseTargets.has(target)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["bindings", target, "lifecycle"],
+        message: `\`lifecycle: held\` requires at least one bind-routed trigger on "${target}" with \`release: true\` so the platform can release it`
+      });
+    }
+  }
+}
+function validateTriggerReleaseConfig(spec, context) {
+  for (const [index, trigger] of spec.triggers.entries()) {
+    if (trigger.routing.kind !== "bind") {
+      continue;
+    }
+    if (trigger.routing.release && trigger.routing.target === "agent.singleton") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["triggers", index, "routing", "release"],
+        message: "`release: true` cannot target `agent.singleton`: singleton slots are pool-membership state owned by the reconciler, not trigger-releasable bindings"
+      });
+    }
+  }
+}
 var AgentStatusSchema = external_exports.object({
   runCount: external_exports.number().int().nonnegative().default(0),
   lastActivityAt: external_exports.string().datetime().nullable().default(null)
@@ -36215,6 +36308,8 @@ var RunBindingRecordSchema = external_exports.object({
   externalId: external_exports.string(),
   source: SessionBindingSourceSchema,
   status: SessionBindingStatusSchema,
+  releasePolicy: SessionBindingReleasePolicySchema,
+  releasedBy: SessionBindingReleasedBySchema.nullable(),
   payload: JsonValueSchema2.nullable(),
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime()
@@ -36434,7 +36529,11 @@ var SetupOnboardingPullRequestCreateRequestSchema = external_exports.object({
   roster: external_exports.object({
     agents: external_exports.array(external_exports.string().trim().min(1)),
     customBrief: external_exports.string().trim().min(1).max(500).nullable().default(null)
-  }).optional()
+  }).optional(),
+  // When false the PR omits the onboarding concierge agent and its avatar,
+  // installing only the roster picks. Used by the agents-page catalog surface
+  // (post-onboarding); the onboarding welcome flow leaves this unset (true).
+  concierge: external_exports.boolean().optional()
 });
 var SetupOnboardingPullRequestSchema = external_exports.object({
   number: external_exports.number().int().positive(),

package/dist/index.js

@@ -17823,6 +17823,59 @@ var init_secrets = __esm({
   }
 });
 
+// ../../packages/schemas/src/session-bindings.ts
+var BINDING_TARGET_TYPES, TRIGGER_BINDING_TARGET_TYPES, SESSION_BINDING_SOURCES, SESSION_BINDING_STATUSES, SESSION_BINDING_RELEASE_POLICIES, SESSION_BINDING_RELEASED_BY, BindingTargetTypeSchema, TriggerBindingTargetTypeSchema, SessionBindingSourceSchema, SessionBindingStatusSchema, SessionBindingReleasePolicySchema, SessionBindingReleasedBySchema, BindingTargetSchema;
+var init_session_bindings = __esm({
+  "../../packages/schemas/src/session-bindings.ts"() {
+    "use strict";
+    init_zod();
+    BINDING_TARGET_TYPES = [
+      "github.pull_request",
+      "github.issue",
+      "slack.thread",
+      "chat.message",
+      "agent.singleton"
+    ];
+    TRIGGER_BINDING_TARGET_TYPES = [
+      "github.pull_request",
+      "github.issue",
+      "slack.thread",
+      "agent.singleton"
+    ];
+    SESSION_BINDING_SOURCES = [
+      "trigger_spawn",
+      "agent_tool",
+      "chat_send",
+      "system"
+    ];
+    SESSION_BINDING_STATUSES = ["active", "released"];
+    SESSION_BINDING_RELEASE_POLICIES = ["manual", "held"];
+    SESSION_BINDING_RELEASED_BY = [
+      "agent_tool",
+      "archive",
+      "trigger_release",
+      "operator",
+      "takeover"
+    ];
+    BindingTargetTypeSchema = external_exports.enum(BINDING_TARGET_TYPES);
+    TriggerBindingTargetTypeSchema = external_exports.enum(
+      TRIGGER_BINDING_TARGET_TYPES
+    );
+    SessionBindingSourceSchema = external_exports.enum(SESSION_BINDING_SOURCES);
+    SessionBindingStatusSchema = external_exports.enum(SESSION_BINDING_STATUSES);
+    SessionBindingReleasePolicySchema = external_exports.enum(
+      SESSION_BINDING_RELEASE_POLICIES
+    );
+    SessionBindingReleasedBySchema = external_exports.enum(
+      SESSION_BINDING_RELEASED_BY
+    );
+    BindingTargetSchema = external_exports.object({
+      type: BindingTargetTypeSchema,
+      externalId: external_exports.string().min(1)
+    });
+  }
+});
+
 // ../../packages/schemas/src/tools.ts
 function remoteMcpUrlSchema(input) {
   return external_exports.string().trim().url().refine(
@@ -18005,45 +18058,6 @@ var init_tools = __esm({
   }
 });
 
-// ../../packages/schemas/src/session-bindings.ts
-var BINDING_TARGET_TYPES, TRIGGER_BINDING_TARGET_TYPES, SESSION_BINDING_SOURCES, SESSION_BINDING_STATUSES, BindingTargetTypeSchema, TriggerBindingTargetTypeSchema, SessionBindingSourceSchema, SessionBindingStatusSchema, BindingTargetSchema;
-var init_session_bindings = __esm({
-  "../../packages/schemas/src/session-bindings.ts"() {
-    "use strict";
-    init_zod();
-    BINDING_TARGET_TYPES = [
-      "github.pull_request",
-      "github.issue",
-      "slack.thread",
-      "chat.message",
-      "agent.singleton"
-    ];
-    TRIGGER_BINDING_TARGET_TYPES = [
-      "github.pull_request",
-      "github.issue",
-      "slack.thread",
-      "agent.singleton"
-    ];
-    SESSION_BINDING_SOURCES = [
-      "trigger_spawn",
-      "agent_tool",
-      "chat_send",
-      "system"
-    ];
-    SESSION_BINDING_STATUSES = ["active", "released"];
-    BindingTargetTypeSchema = external_exports.enum(BINDING_TARGET_TYPES);
-    TriggerBindingTargetTypeSchema = external_exports.enum(
-      TRIGGER_BINDING_TARGET_TYPES
-    );
-    SessionBindingSourceSchema = external_exports.enum(SESSION_BINDING_SOURCES);
-    SessionBindingStatusSchema = external_exports.enum(SESSION_BINDING_STATUSES);
-    BindingTargetSchema = external_exports.object({
-      type: BindingTargetTypeSchema,
-      externalId: external_exports.string().min(1)
-    });
-  }
-});
-
 // ../../packages/schemas/src/trigger-router.ts
 function normalizeLegacyHeartbeatTickWorkflowInput(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
@@ -18131,7 +18145,15 @@ var init_trigger_router = __esm({
       external_exports.object({
         kind: external_exports.literal("bind"),
         target: TriggerBindingTargetTypeSchema,
-        onUnmatched: OnUnmatchedSchema
+        onUnmatched: OnUnmatchedSchema,
+        // Declarative binding release: after the router routes this event
+        // (delivered, revived, or unmatched), the platform releases the target's
+        // active binding as a follow-up activity. Deliver-then-release — the bound
+        // session receives the message first; the binding is released after
+        // routing completes. No-op when no active binding exists. `agent.singleton`
+        // is rejected at apply time (singleton slots are pool-membership state
+        // owned by the reconciler).
+        release: external_exports.boolean().default(false)
       })
     ]);
     LegacySingletonRouteBySchema = external_exports.object({
@@ -18158,7 +18180,8 @@ var init_trigger_router = __esm({
       ({ routeBy, onUnmatched }) => ({
         kind: "bind",
         target: routeBy.artifactType,
-        onUnmatched
+        onUnmatched,
+        release: false
       })
     );
     LegacyDeliverOrSpawnRoutingSchema = external_exports.object({
@@ -18480,6 +18503,49 @@ function validateConcurrencyConfig(spec, context) {
 function isSlotDeliveryTrigger(trigger) {
   return trigger.routing.kind === "deliver" && !trigger.routing.routeBy;
 }
+function validateBindingsConfig(spec, context) {
+  if (!spec.bindings) {
+    return;
+  }
+  const heldTargets = new Set(
+    Object.entries(spec.bindings).filter(([, config2]) => config2.lifecycle === "held").map(([target]) => target)
+  );
+  if (heldTargets.size === 0) {
+    return;
+  }
+  const releaseTargets = /* @__PURE__ */ new Set();
+  for (const trigger of spec.triggers) {
+    if (trigger.routing.kind !== "bind") {
+      continue;
+    }
+    if (trigger.routing.release) {
+      releaseTargets.add(trigger.routing.target);
+    }
+  }
+  for (const target of heldTargets) {
+    if (!releaseTargets.has(target)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["bindings", target, "lifecycle"],
+        message: `\`lifecycle: held\` requires at least one bind-routed trigger on "${target}" with \`release: true\` so the platform can release it`
+      });
+    }
+  }
+}
+function validateTriggerReleaseConfig(spec, context) {
+  for (const [index, trigger] of spec.triggers.entries()) {
+    if (trigger.routing.kind !== "bind") {
+      continue;
+    }
+    if (trigger.routing.release && trigger.routing.target === "agent.singleton") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["triggers", index, "routing", "release"],
+        message: "`release: true` cannot target `agent.singleton`: singleton slots are pool-membership state owned by the reconciler, not trigger-releasable bindings"
+      });
+    }
+  }
+}
 function validateTriggerChecks(trigger, context, eventKeys) {
   const checks = trigger.checks ?? [];
   if (checks.length === 0) {
@@ -18603,7 +18669,7 @@ function isChatMessageEvent(trigger) {
 function hasFilterValue(trigger, path2, expected) {
   return trigger.where?.[path2] === expected;
 }
-var RESOURCE_KIND_AGENT, AGENT_HARNESSES, AgentHarnessSchema, TriggerFilterScalarSchema, TriggerFilterPathSchema, TriggerFilterClauseSchema, TriggerFilterSchema, TriggerCheckTimeoutSchema, AgentArchiveAfterInactiveSchema, AgentSessionPolicySchema, AgentConcurrencySchema, AgentReplacePolicySchema, AgentManagesSchema, TriggerEventSchema, TriggerEventsSchema, PAYLOAD_PREFIXED_TEMPLATE_TOKEN, TriggerChecksField, TriggerEventSourceFields, TriggerSchema, ApplyTriggerSchema, HeartbeatTriggerSchema, ApplyHeartbeatTriggerSchema, TriggerDefinitionSchema, ApplyTriggerDefinitionSchema, TriggersSchema, ApplyTriggersSchema, AVATAR_ASSET_EXTENSIONS, MAX_AVATAR_ASSET_BYTES, MIN_AVATAR_ASSET_DIMENSION_PX, MAX_AVATAR_ASSET_DIMENSION_PX, PNG_SIGNATURE, AGENT_IDENTITY_DESCRIPTION_MAX_LENGTH, SHA256_HEX_PATTERN, AgentIdentitySchema, AgentSpecFieldsSchema, AgentSpecSchema, AgentApplySpecSchema, AgentStatusSchema, AgentResourceSchema, AgentApplyRequestSchema, ApplyTriggerReceiptSchema, AgentApplyResponseSchema, AGENT_TELEGRAM_IDENTITY_STATUSES, AgentTelegramIdentityStatusSchema, AgentPresenceIdentitySchema, AgentPresenceResponseSchema, AgentPresenceConnectRequestSchema, AgentPresenceConnectPendingSchema, AgentPresenceConnectResponseSchema, AgentPresenceIconRequestSchema, AgentPresenceIconResponseSchema, AgentPresenceCompleteResponseSchema;
+var RESOURCE_KIND_AGENT, AGENT_HARNESSES, AgentHarnessSchema, TriggerFilterScalarSchema, TriggerFilterPathSchema, TriggerFilterClauseSchema, TriggerFilterSchema, TriggerCheckTimeoutSchema, AgentArchiveAfterInactiveSchema, AgentSessionPolicySchema, AgentConcurrencySchema, AgentReplacePolicySchema, AgentManagesSchema, TriggerEventSchema, TriggerEventsSchema, PAYLOAD_PREFIXED_TEMPLATE_TOKEN, TriggerChecksField, TriggerEventSourceFields, TriggerSchema, ApplyTriggerSchema, HeartbeatTriggerSchema, ApplyHeartbeatTriggerSchema, TriggerDefinitionSchema, ApplyTriggerDefinitionSchema, TriggersSchema, ApplyTriggersSchema, AVATAR_ASSET_EXTENSIONS, MAX_AVATAR_ASSET_BYTES, MIN_AVATAR_ASSET_DIMENSION_PX, MAX_AVATAR_ASSET_DIMENSION_PX, PNG_SIGNATURE, AGENT_IDENTITY_DESCRIPTION_MAX_LENGTH, SHA256_HEX_PATTERN, AgentIdentitySchema, BINDING_LIFECYCLE_VALUES, BindingLifecycleSpecSchema, AgentBindingsSchema, AgentSpecFieldsSchema, AgentSpecSchema, AgentApplySpecSchema, AgentStatusSchema, AgentResourceSchema, AgentApplyRequestSchema, ApplyTriggerReceiptSchema, AgentApplyResponseSchema, AGENT_TELEGRAM_IDENTITY_STATUSES, AgentTelegramIdentityStatusSchema, AgentPresenceIdentitySchema, AgentPresenceResponseSchema, AgentPresenceConnectRequestSchema, AgentPresenceConnectPendingSchema, AgentPresenceConnectResponseSchema, AgentPresenceIconRequestSchema, AgentPresenceIconResponseSchema, AgentPresenceCompleteResponseSchema;
 var init_agents = __esm({
   "../../packages/schemas/src/agents.ts"() {
     "use strict";
@@ -18614,6 +18680,7 @@ var init_agents = __esm({
     init_primitives();
     init_resources();
     init_secrets();
+    init_session_bindings();
     init_tools();
     init_trigger_router();
     RESOURCE_KIND_AGENT = "agent";
@@ -18778,6 +18845,30 @@ var init_agents = __esm({
     }).strict().refine((identity2) => Object.keys(identity2).length > 0, {
       message: "Identity requires at least one field"
     });
+    BINDING_LIFECYCLE_VALUES = ["manual", "held"];
+    BindingLifecycleSpecSchema = external_exports.object({
+      lifecycle: external_exports.enum(BINDING_LIFECYCLE_VALUES).default("manual")
+    }).strict();
+    AgentBindingsSchema = external_exports.record(external_exports.string(), BindingLifecycleSpecSchema).superRefine((bindings, context) => {
+      for (const key of Object.keys(bindings)) {
+        const parsed = BindingTargetTypeSchema.safeParse(key);
+        if (!parsed.success) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: [key],
+            message: `\`${key}\` is not a valid binding target type`
+          });
+          continue;
+        }
+        if (parsed.data === "agent.singleton") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: [key],
+            message: "`agent.singleton` is excluded from `bindings` constraints; the pool slot has its own release lifecycle"
+          });
+        }
+      }
+    });
     AgentSpecFieldsSchema = external_exports.object({
       harness: external_exports.enum(AGENT_HARNESSES).optional(),
       model: AgentModelSelectionSchema.optional(),
@@ -18795,6 +18886,7 @@ var init_agents = __esm({
       replace: AgentReplacePolicySchema.optional(),
       onReplace: external_exports.string().trim().min(1).max(2e4).optional(),
       manages: AgentManagesSchema.optional(),
+      bindings: AgentBindingsSchema.default({}),
       workingDirectory: external_exports.string().trim().min(1).optional(),
       tools: AgentToolsSchema.default({})
     });
@@ -18812,6 +18904,8 @@ var init_agents = __esm({
       validateRunnableConfig(spec, context);
       validateAgentModelFieldsForHarness(spec, context);
       validateConcurrencyConfig(spec, context);
+      validateBindingsConfig(spec, context);
+      validateTriggerReleaseConfig(spec, context);
     });
     AgentStatusSchema = external_exports.object({
       runCount: external_exports.number().int().nonnegative().default(0),
@@ -20612,6 +20706,8 @@ var init_session_introspection = __esm({
       externalId: external_exports.string(),
       source: SessionBindingSourceSchema,
       status: SessionBindingStatusSchema,
+      releasePolicy: SessionBindingReleasePolicySchema,
+      releasedBy: SessionBindingReleasedBySchema.nullable(),
       payload: JsonValueSchema.nullable(),
       createdAt: external_exports.string().datetime(),
       updatedAt: external_exports.string().datetime()
@@ -20856,7 +20952,11 @@ var init_setup = __esm({
       roster: external_exports.object({
         agents: external_exports.array(external_exports.string().trim().min(1)),
         customBrief: external_exports.string().trim().min(1).max(500).nullable().default(null)
-      }).optional()
+      }).optional(),
+      // When false the PR omits the onboarding concierge agent and its avatar,
+      // installing only the roster picks. Used by the agents-page catalog surface
+      // (post-onboarding); the onboarding welcome flow leaves this unset (true).
+      concierge: external_exports.boolean().optional()
     });
     SetupOnboardingPullRequestSchema = external_exports.object({
       number: external_exports.number().int().positive(),
@@ -34861,7 +34961,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.396",
+      version: "0.1.398",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.396",
+  "version": "0.1.398",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"