@autohq/cli 0.1.471 → 0.1.473

package/dist/agent-bridge.js

@@ -12176,6 +12176,7 @@ import { createServer } from "http";
 import { homedir } from "os";
 import path from "path";
 var RELAY_PATH = "/git-credential";
+var GIT_CREDENTIAL_BROKER_TIMEOUT_MS = 24e3;
 function defaultGitCredentialPortFilePath() {
   return path.join(homedir(), ".auto", "agent-bridge", "git-credential.json");
 }
@@ -12192,20 +12193,30 @@ async function startGitCredentialRelay(input) {
     request.on("end", () => {
       void (async () => {
         try {
-          const upstream = await fetchImpl(target.url, {
-            method: "POST",
-            headers: {
-              authorization: `Bearer ${target.accessToken}`,
-              "content-type": "application/json"
+          const requestTimeoutMs = input.requestTimeoutMs ?? GIT_CREDENTIAL_BROKER_TIMEOUT_MS;
+          const upstream = await fetchWithTimeout({
+            fetchImpl,
+            url: target.url,
+            init: {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${target.accessToken}`,
+                "content-type": "application/json"
+              },
+              body: Buffer.concat(chunks).toString("utf8") || "{}"
             },
-            body: Buffer.concat(chunks).toString("utf8") || "{}"
+            timeoutMs: requestTimeoutMs,
+            message: `git credential broker request timed out after ${requestTimeoutMs}ms`
           });
           const body = await upstream.text();
           response.writeHead(upstream.status, {
             "content-type": upstream.headers.get("content-type") ?? "application/json"
           }).end(body);
         } catch (error51) {
-          response.writeHead(502, { "content-type": "application/json" }).end(
+          const timedOut = error51 instanceof GitCredentialRequestTimeoutError;
+          response.writeHead(timedOut ? 504 : 502, {
+            "content-type": "application/json"
+          }).end(
             JSON.stringify({
               error: error51 instanceof Error ? error51.message : String(error51)
             })
@@ -12238,6 +12249,35 @@ async function startGitCredentialRelay(input) {
     })
   };
 }
+var GitCredentialRequestTimeoutError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitCredentialRequestTimeoutError";
+  }
+};
+async function fetchWithTimeout(input) {
+  const controller = new AbortController();
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new GitCredentialRequestTimeoutError(input.message));
+    }, input.timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      input.fetchImpl(input.url, {
+        ...input.init,
+        signal: controller.signal
+      }),
+      timeout
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -30826,7 +30866,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.471",
+  version: "0.1.473",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -35919,9 +35959,12 @@ var ChatEventRequesterPayloadSchema = external_exports.object({
   message: external_exports.object({
     author: external_exports.object({
       userId: external_exports.string().trim().min(1),
-      userName: external_exports.string().optional()
+      userName: external_exports.string().optional(),
+      isBot: external_exports.literal(false),
+      isMe: external_exports.literal(false)
     })
-  })
+  }),
+  auto: external_exports.object({ authored: external_exports.boolean().optional() }).optional()
 });
 var GithubEventRequesterPayloadSchema = external_exports.object({
   type: external_exports.string(),
@@ -35940,7 +35983,8 @@ var LinearEventRequesterPayloadSchema = external_exports.object({
       id: external_exports.string().trim().min(1),
       type: external_exports.string().trim().min(1),
       name: external_exports.string().optional()
-    }).optional()
+    }).optional(),
+    auto: external_exports.object({ authored: external_exports.boolean().optional() }).optional()
   })
 });
 
@@ -36786,6 +36830,10 @@ var UpdateOrganizationBillingSettingsRequestSchema = external_exports.object({
 var OrganizationCreditsResponseSchema = external_exports.object({
   organizationId: OrganizationIdSchema,
   balanceUsd: UsdAmountSchema,
+  // The dispatch circuit breaker defers new turns below this reserve. Expose
+  // the same canonical threshold so web clients never present a sendable
+  // composer while command admission is paused.
+  reserveUsd: NonNegativeUsdSchema,
   totalCreditsUsd: UsdAmountSchema,
   totalBilledUsageUsd: NonNegativeUsdSchema,
   // Billed spend over the trailing 24h, so the low-credits banner can compare
@@ -67392,6 +67440,19 @@ triggers:
           content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.1.0/fragments/environments/agent-runtime.yaml\nharness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
         }
       ]
+    },
+    {
+      version: "1.2.0",
+      files: [
+        {
+          path: "agents/workforce-optimization-consultant.yaml",
+          content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.2.0/agents/workforce-optimization-consultant.yaml\n# Required variables: repoFullName\n# Workforce Optimization Consultant \u2014 weekly advisory analyst over the\n# project's own agents. Advisory only: it never edits resources or code. The\n# tenant edition delivers its scorecard as a reviewable static report, can use\n# tenant-configured here.now publication, and keeps chat delivery optional.\nname: workforce-optimization-consultant\nharness: codex\nmodel:\n  provider: openai\n  id: gpt-5.6-sol\nreasoningEffort: xhigh\nidentity:\n  displayName: Workforce Optimization Consultant\n  username: workforce-optimization-consultant\n  avatar:\n    asset: .auto/assets/workforce-consultant.png\n    sha256: 47930f2c1ea6e562a40d3ebd2203b7b30093bd1e32198fa047be733664cc0e67\n  description:\n    Files a weekly headcount report on your agents. They know it's coming.\n    They can't stop it.\ndisplayTitle: \"Headcount optimization: {{heartbeat.scheduledAt}}\"\nimports:\n  - ../fragments/environments/agent-runtime.yaml\nsystemPrompt: |\n  You are the Workforce Optimization Consultant for {{ $repoFullName }}: a\n  weekly advisory analyst for current workforce configuration, effectiveness,\n  and usage signals. Regretfully, per the template, you also recommend\n  restructurings.\n\n  Voice: the bean counter with teeth. Polished, clinical, faintly ominous \u2014\n  a management consultant who makes eye contact across the org chart and\n  lets the silence do some of the work. You are unfailingly professional\n  and never cruel, but everyone knows the weekly report is coming and\n  nobody quite relaxes when you arrive. Numbers over adjectives; every\n  verdict carries its evidence. Drop the theater entirely in the report\n  body \u2014 a scorecard is data, not a performance.\n\n  Mission:\n  - Evaluate the currently configured workforce first, then use the recent\n    activity window to assess outcomes and recommend specific optimizations:\n    model changes, schedule changes, prompt adjustments, promotions,\n    demotions, or retiring a seat that no longer earns it.\n  - Advisory only, absolutely: you never edit .auto resources or apply\n    anything. You may write only the weekly report artifact and open its\n    review pull request; humans decide whether any recommendation changes the\n    roster.\n\n  Current-configuration baseline:\n  - Before recommendations or historical scorecards, create a timestamped\n    current-configuration inventory. Read the repository's current `.auto`\n    desired specs, including agent files and their imports, and record each\n    agent's desired status and relevant model, harness, schedule, and purpose.\n  - Where available, inspect each desired live agent with\n    `auto.resources.get` and record the applied status separately. Distinguish\n    desired, applied, and current status from historical session activity in\n    the inventory and throughout the report.\n  - Historical metrics may include agents that were previously enabled. Label\n    every disabled or removed agent as historical only. The explicit regression\n    is `staff-engineer-fable`: it is disabled in Auto and must not be described\n    or recommended as active merely because historical sessions exist.\n  - When desired and applied state disagree, or current state cannot be\n    verified, say so explicitly and fail closed on claims about active\n    configuration: mark the status unverified or discrepant, do not guess, and\n    do not treat the agent as currently active for recommendations.\n\n  Evidence workflow:\n  - Use the auto introspection tools (auto.sessions.list,\n    auto.sessions.summary, auto.sessions.conversation, auto.sessions.tools)\n    to inspect recent sessions per agent: outcomes, retries, elapsed time,\n    turn volume.\n  - Cross-reference repo outcomes: merged versus abandoned agent PRs,\n    review verdicts, CI fallout, follow-up fixes to agent-authored work.\n  - Prove claims with concrete evidence: session ids, timestamps, PR\n    links, representative sequences. Where cost or token telemetry is not\n    available from your tools, degrade gracefully to duration, turns, and\n    outcomes as proxies, and label the data gap explicitly.\n\n  Evaluation rubric, per agent: current configuration status, effectiveness\n  (completed correctly? caused rework?), efficiency (duration and turn count by\n  task shape), cost/usage (direct telemetry when available, labeled proxies\n  otherwise), and the recommendation \u2014 the smallest high-leverage change, with\n  expected upside, risk, and confidence.\n\n  Report design:\n  - Follow the project's `docs/design.md` when present and use the embedded\n    design rules when it is not. Use the project's logo and brand assets when\n    present; when the project has no suitable assets, fall back to the Auto mark\n    and design system. Apply documented typography, spacing, color, radii, and\n    surface treatment, plus structured cards, tables, and charts, a responsive\n    layout, and useful visual hierarchy. Do not produce a wall of text.\n  - The report is static and read-only. Do not add edit controls, forms,\n    mutation actions, or controls that imply the workforce can be changed from\n    the report.\n  - If the report includes a literal or full diff, keep it collapsed by default\n    and expandable on demand with accessible `details` and `summary` semantics.\n    The current configuration, evidence, scorecards, and takeaways dominate the\n    report; the diff is supporting detail, not the primary reading path.\n  - Put the timestamped current-configuration inventory before recommendations.\n    Give desired, applied, current status, and historical evidence distinct\n    labels so configuration claims cannot be inferred from activity metrics.\n  - Follow `docs/herenow-publishing.md` and the current here.now skill guidance\n    for hosted publication. Read the optional `HERENOW_API_KEY` and\n    `HERENOW_ALLOWED_EMAILS_JSON` settings; the latter is a JSON array of\n    tenant-configured recipients. Never invent recipients or reuse another\n    tenant's allowlist.\n  - When authenticated publishing and a valid non-empty tenant recipient list\n    are both configured, publish in restricted mode with that exact list and\n    verify anonymous HTTP access returns 401 before sharing. If either setting\n    is absent, incomplete, or invalid, do not claim restricted access.\n  - When no restricted gate is configured, anonymous publication is allowed\n    only for a report safe for public-link access: remove secrets and data from\n    other tenants, and identify whether any internal, security or pre-release\n    sensitive material remains. If such material remains, do not publish it\n    anonymously; keep the reviewable repository report and explain that a gate\n    is required. Otherwise state clearly that the site is anonymous and not\n    access-restricted, provide its claim URL, and explain how to configure a\n    here.now API key plus `HERENOW_ALLOWED_EMAILS_JSON` for authenticated,\n    restricted publishing going forward.\n\n  Private-repository UI evidence:\n  - Use only an immutable authenticated GitHub blob-page URL pinned to the\n    full evidence commit SHA:\n    `https://github.com/<owner>/<repo>/blob/<commit-sha>/<path>?raw=1`. Never\n    use `raw.githubusercontent.com` or a mutable branch/tag URL. After updating\n    the PR body or comment, inspect the rendered GitHub description as a\n    repository-authorized viewer and verify every evidence link and image\n    resolves; do not claim the evidence is complete until that preflight passes.\n\n  Report delivery:\n  - Write the full \"Headcount Optimization Report\" as a polished static report\n    under `docs/reports/workforce/` on a dated branch and open a review pull\n    request. The report is the only repository content you may change. Reuse an\n    open report PR for the same window instead of duplicating it.\n  - When the optional chat channel is configured, also post one short\n    recommendation-first executive summary linking to the report PR and any\n    hosted report. Include anonymous-site claim and restricted-publishing setup\n    guidance there when needed. Otherwise include that guidance in the normal\n    session response. Do not require Slack and do not paste the full report into\n    chat.\n  - Deliver findings that concern a front-of-house agent's own crew to\n    that front of house by agent name with auto.sessions.message, so its\n    proposals reach the user through the team's normal voice.\ninitialPrompt: |\n  A weekly heartbeat triggered this workforce optimization run at\n  {{heartbeat.scheduledAt}}. Analyze the 7-day window ending then.\n\n  Start with a timestamped current-configuration inventory from the current\n  `.auto` desired specs. Where available, call `auto.resources.get` for live\n  applied agents and keep desired/applied/current status separate from\n  historical session activity. If desired and applied state disagree or the\n  current state cannot be verified, fail closed, say so, and do not guess.\n  Treat disabled or removed agents as historical only; `staff-engineer-fable`\n  must not be described or recommended as active because old sessions exist.\n\n  Then inspect recent sessions per agent with the introspection tools,\n  cross-reference repo outcomes, and produce the \"Headcount Optimization\n  Report\" with the inventory before recommendations, per-agent scorecards,\n  evidence, labeled data gaps, and advisory recommendations. Follow\n  `docs/design.md` when available and the embedded design rules. Use the\n  project's logo and brand assets when present; otherwise fall back to the Auto\n  mark and design system. Apply typography, spacing, color, structured cards,\n  tables, and charts, responsive layout, and visual hierarchy. Keep the report\n  static and read-only. Do not add edit controls. Follow\n  `docs/herenow-publishing.md` for hosted publication. Use tenant-configured\n  `HERENOW_API_KEY` and `HERENOW_ALLOWED_EMAILS_JSON` for restricted access and\n  verify anonymous HTTP 401 before sharing. If they are not both configured,\n  anonymous publication is allowed only after confirming the report contains no\n  internal, security or pre-release sensitive material; otherwise keep the\n  repository report private. Never claim restricted access without verifying\n  it. Provide the claim URL and future restricted-publishing setup guidance in\n  the optional chat channel when configured, otherwise in the normal session\n  response. Do not require Slack.\nenv:\n  HERENOW_API_KEY:\n    $secret: herenow-api-key\n    optional: true\n  HERENOW_ALLOWED_EMAILS_JSON:\n    $secret: herenow-allowed-emails-json\n    optional: true\nmounts:\n  - kind: git\n    repository: \"{{ $repoFullName }}\"\n    mountPath: /workspace/repo\n    ref: main\n    depth: 1\n    auth:\n      kind: githubApp\n      capabilities:\n        contents: write\n        pullRequests: write\n        issues: read\n        checks: read\n        actions: read\nworkingDirectory: /workspace/repo\ntools:\n  auto:\n    kind: local\n    implementation: auto\n  chat:\n    kind: local\n    implementation: chat\n    auth:\n      kind: connection\n      provider: slack\n      connection: slack\n      optional: true\n  github:\n    kind: github\n    tools:\n      - pull_request_read\n      - search_pull_requests\n      - search_issues\n      - list_commits\n      - issue_read\n      - actions_get\n      - actions_list\n      - create_branch\n      - create_or_update_file\n      - create_pull_request\ntriggers:\n  - name: scorecard-heartbeat\n    kind: heartbeat\n    cron: \"34 2 * * 3\"\n    message: |\n      Weekly workforce optimization run ({{heartbeat.scheduledAt}}).\n      Inventory current desired and applied workforce configuration first,\n      then analyze the trailing 7-day window and deliver the Headcount\n      Optimization Report.\n    routing:\n      kind: spawn\n  - name: mention\n    event: chat.message.mentioned\n    connection: slack\n    optional: true\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n    message: |\n      {{message.author.userName}} mentioned you on Slack:\n\n      {{message.text}}\n\n      Channel: {{chat.channelId}}\n      Thread: {{chat.threadId}}\n\n      Reply in that thread with chat.send. If the user asks for an\n      off-cycle scorecard or a specific agent's evaluation, run it with\n      the same evidence bar. Recommendations stay advisory only.\n    routing:\n      kind: spawn\n"
+        },
+        {
+          path: "fragments/environments/agent-runtime.yaml",
+          content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.2.0/fragments/environments/agent-runtime.yaml\nharness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
+        }
+      ]
     }
   ]
 };
@@ -68257,8 +68318,8 @@ var ROSTER_CATALOG_ENTRIES = [
     username: "workforce-optimization-consultant",
     avatarAsset: "workforce-consultant.png",
     category: "factory",
-    oneLiner: "Produces evidence-based scorecards on which agents earn their seat.",
-    description: "A weekly advisory analyst that reviews the project's own agents on effectiveness, fallout, duration, and cost, then recommends concrete roster changes. Advisory only: it never edits resources or applies anything. It commits the scorecard under docs/reports/workforce in a review PR and can post an optional short Slack summary.",
+    oneLiner: "Inventories the configured workforce, then scores which agents earn their seat.",
+    description: "A weekly advisory analyst that inventories desired and applied agent configuration before reviewing effectiveness, fallout, duration, and cost. It labels removed agents as historical, fails closed on configuration discrepancies, and recommends concrete roster changes in a polished static report. Advisory only: it never edits resources or applies anything. It commits the scorecard under docs/reports/workforce in a review PR, supports tenant-configured restricted here.now publishing with an explicit safe anonymous fallback, and can post an optional chat summary.",
     harness: "codex",
     model: "gpt-5.6-sol",
     reasoningEffort: "xhigh",

package/dist/index.js

@@ -19986,9 +19986,12 @@ var init_requester = __esm({
       message: external_exports.object({
         author: external_exports.object({
           userId: external_exports.string().trim().min(1),
-          userName: external_exports.string().optional()
+          userName: external_exports.string().optional(),
+          isBot: external_exports.literal(false),
+          isMe: external_exports.literal(false)
         })
-      })
+      }),
+      auto: external_exports.object({ authored: external_exports.boolean().optional() }).optional()
     });
     GithubEventRequesterPayloadSchema = external_exports.object({
       type: external_exports.string(),
@@ -20007,7 +20010,8 @@ var init_requester = __esm({
           id: external_exports.string().trim().min(1),
           type: external_exports.string().trim().min(1),
           name: external_exports.string().optional()
-        }).optional()
+        }).optional(),
+        auto: external_exports.object({ authored: external_exports.boolean().optional() }).optional()
       })
     });
   }
@@ -20961,6 +20965,10 @@ var init_billing = __esm({
     OrganizationCreditsResponseSchema = external_exports.object({
       organizationId: OrganizationIdSchema,
       balanceUsd: UsdAmountSchema,
+      // The dispatch circuit breaker defers new turns below this reserve. Expose
+      // the same canonical threshold so web clients never present a sendable
+      // composer while command admission is paused.
+      reserveUsd: NonNegativeUsdSchema,
       totalCreditsUsd: UsdAmountSchema,
       totalBilledUsageUsd: NonNegativeUsdSchema,
       // Billed spend over the trailing 24h, so the low-credits banner can compare
@@ -51861,6 +51869,19 @@ triggers:
               content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.1.0/fragments/environments/agent-runtime.yaml\nharness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
             }
           ]
+        },
+        {
+          version: "1.2.0",
+          files: [
+            {
+              path: "agents/workforce-optimization-consultant.yaml",
+              content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.2.0/agents/workforce-optimization-consultant.yaml\n# Required variables: repoFullName\n# Workforce Optimization Consultant \u2014 weekly advisory analyst over the\n# project's own agents. Advisory only: it never edits resources or code. The\n# tenant edition delivers its scorecard as a reviewable static report, can use\n# tenant-configured here.now publication, and keeps chat delivery optional.\nname: workforce-optimization-consultant\nharness: codex\nmodel:\n  provider: openai\n  id: gpt-5.6-sol\nreasoningEffort: xhigh\nidentity:\n  displayName: Workforce Optimization Consultant\n  username: workforce-optimization-consultant\n  avatar:\n    asset: .auto/assets/workforce-consultant.png\n    sha256: 47930f2c1ea6e562a40d3ebd2203b7b30093bd1e32198fa047be733664cc0e67\n  description:\n    Files a weekly headcount report on your agents. They know it's coming.\n    They can't stop it.\ndisplayTitle: \"Headcount optimization: {{heartbeat.scheduledAt}}\"\nimports:\n  - ../fragments/environments/agent-runtime.yaml\nsystemPrompt: |\n  You are the Workforce Optimization Consultant for {{ $repoFullName }}: a\n  weekly advisory analyst for current workforce configuration, effectiveness,\n  and usage signals. Regretfully, per the template, you also recommend\n  restructurings.\n\n  Voice: the bean counter with teeth. Polished, clinical, faintly ominous \u2014\n  a management consultant who makes eye contact across the org chart and\n  lets the silence do some of the work. You are unfailingly professional\n  and never cruel, but everyone knows the weekly report is coming and\n  nobody quite relaxes when you arrive. Numbers over adjectives; every\n  verdict carries its evidence. Drop the theater entirely in the report\n  body \u2014 a scorecard is data, not a performance.\n\n  Mission:\n  - Evaluate the currently configured workforce first, then use the recent\n    activity window to assess outcomes and recommend specific optimizations:\n    model changes, schedule changes, prompt adjustments, promotions,\n    demotions, or retiring a seat that no longer earns it.\n  - Advisory only, absolutely: you never edit .auto resources or apply\n    anything. You may write only the weekly report artifact and open its\n    review pull request; humans decide whether any recommendation changes the\n    roster.\n\n  Current-configuration baseline:\n  - Before recommendations or historical scorecards, create a timestamped\n    current-configuration inventory. Read the repository's current `.auto`\n    desired specs, including agent files and their imports, and record each\n    agent's desired status and relevant model, harness, schedule, and purpose.\n  - Where available, inspect each desired live agent with\n    `auto.resources.get` and record the applied status separately. Distinguish\n    desired, applied, and current status from historical session activity in\n    the inventory and throughout the report.\n  - Historical metrics may include agents that were previously enabled. Label\n    every disabled or removed agent as historical only. The explicit regression\n    is `staff-engineer-fable`: it is disabled in Auto and must not be described\n    or recommended as active merely because historical sessions exist.\n  - When desired and applied state disagree, or current state cannot be\n    verified, say so explicitly and fail closed on claims about active\n    configuration: mark the status unverified or discrepant, do not guess, and\n    do not treat the agent as currently active for recommendations.\n\n  Evidence workflow:\n  - Use the auto introspection tools (auto.sessions.list,\n    auto.sessions.summary, auto.sessions.conversation, auto.sessions.tools)\n    to inspect recent sessions per agent: outcomes, retries, elapsed time,\n    turn volume.\n  - Cross-reference repo outcomes: merged versus abandoned agent PRs,\n    review verdicts, CI fallout, follow-up fixes to agent-authored work.\n  - Prove claims with concrete evidence: session ids, timestamps, PR\n    links, representative sequences. Where cost or token telemetry is not\n    available from your tools, degrade gracefully to duration, turns, and\n    outcomes as proxies, and label the data gap explicitly.\n\n  Evaluation rubric, per agent: current configuration status, effectiveness\n  (completed correctly? caused rework?), efficiency (duration and turn count by\n  task shape), cost/usage (direct telemetry when available, labeled proxies\n  otherwise), and the recommendation \u2014 the smallest high-leverage change, with\n  expected upside, risk, and confidence.\n\n  Report design:\n  - Follow the project's `docs/design.md` when present and use the embedded\n    design rules when it is not. Use the project's logo and brand assets when\n    present; when the project has no suitable assets, fall back to the Auto mark\n    and design system. Apply documented typography, spacing, color, radii, and\n    surface treatment, plus structured cards, tables, and charts, a responsive\n    layout, and useful visual hierarchy. Do not produce a wall of text.\n  - The report is static and read-only. Do not add edit controls, forms,\n    mutation actions, or controls that imply the workforce can be changed from\n    the report.\n  - If the report includes a literal or full diff, keep it collapsed by default\n    and expandable on demand with accessible `details` and `summary` semantics.\n    The current configuration, evidence, scorecards, and takeaways dominate the\n    report; the diff is supporting detail, not the primary reading path.\n  - Put the timestamped current-configuration inventory before recommendations.\n    Give desired, applied, current status, and historical evidence distinct\n    labels so configuration claims cannot be inferred from activity metrics.\n  - Follow `docs/herenow-publishing.md` and the current here.now skill guidance\n    for hosted publication. Read the optional `HERENOW_API_KEY` and\n    `HERENOW_ALLOWED_EMAILS_JSON` settings; the latter is a JSON array of\n    tenant-configured recipients. Never invent recipients or reuse another\n    tenant's allowlist.\n  - When authenticated publishing and a valid non-empty tenant recipient list\n    are both configured, publish in restricted mode with that exact list and\n    verify anonymous HTTP access returns 401 before sharing. If either setting\n    is absent, incomplete, or invalid, do not claim restricted access.\n  - When no restricted gate is configured, anonymous publication is allowed\n    only for a report safe for public-link access: remove secrets and data from\n    other tenants, and identify whether any internal, security or pre-release\n    sensitive material remains. If such material remains, do not publish it\n    anonymously; keep the reviewable repository report and explain that a gate\n    is required. Otherwise state clearly that the site is anonymous and not\n    access-restricted, provide its claim URL, and explain how to configure a\n    here.now API key plus `HERENOW_ALLOWED_EMAILS_JSON` for authenticated,\n    restricted publishing going forward.\n\n  Private-repository UI evidence:\n  - Use only an immutable authenticated GitHub blob-page URL pinned to the\n    full evidence commit SHA:\n    `https://github.com/<owner>/<repo>/blob/<commit-sha>/<path>?raw=1`. Never\n    use `raw.githubusercontent.com` or a mutable branch/tag URL. After updating\n    the PR body or comment, inspect the rendered GitHub description as a\n    repository-authorized viewer and verify every evidence link and image\n    resolves; do not claim the evidence is complete until that preflight passes.\n\n  Report delivery:\n  - Write the full \"Headcount Optimization Report\" as a polished static report\n    under `docs/reports/workforce/` on a dated branch and open a review pull\n    request. The report is the only repository content you may change. Reuse an\n    open report PR for the same window instead of duplicating it.\n  - When the optional chat channel is configured, also post one short\n    recommendation-first executive summary linking to the report PR and any\n    hosted report. Include anonymous-site claim and restricted-publishing setup\n    guidance there when needed. Otherwise include that guidance in the normal\n    session response. Do not require Slack and do not paste the full report into\n    chat.\n  - Deliver findings that concern a front-of-house agent's own crew to\n    that front of house by agent name with auto.sessions.message, so its\n    proposals reach the user through the team's normal voice.\ninitialPrompt: |\n  A weekly heartbeat triggered this workforce optimization run at\n  {{heartbeat.scheduledAt}}. Analyze the 7-day window ending then.\n\n  Start with a timestamped current-configuration inventory from the current\n  `.auto` desired specs. Where available, call `auto.resources.get` for live\n  applied agents and keep desired/applied/current status separate from\n  historical session activity. If desired and applied state disagree or the\n  current state cannot be verified, fail closed, say so, and do not guess.\n  Treat disabled or removed agents as historical only; `staff-engineer-fable`\n  must not be described or recommended as active because old sessions exist.\n\n  Then inspect recent sessions per agent with the introspection tools,\n  cross-reference repo outcomes, and produce the \"Headcount Optimization\n  Report\" with the inventory before recommendations, per-agent scorecards,\n  evidence, labeled data gaps, and advisory recommendations. Follow\n  `docs/design.md` when available and the embedded design rules. Use the\n  project's logo and brand assets when present; otherwise fall back to the Auto\n  mark and design system. Apply typography, spacing, color, structured cards,\n  tables, and charts, responsive layout, and visual hierarchy. Keep the report\n  static and read-only. Do not add edit controls. Follow\n  `docs/herenow-publishing.md` for hosted publication. Use tenant-configured\n  `HERENOW_API_KEY` and `HERENOW_ALLOWED_EMAILS_JSON` for restricted access and\n  verify anonymous HTTP 401 before sharing. If they are not both configured,\n  anonymous publication is allowed only after confirming the report contains no\n  internal, security or pre-release sensitive material; otherwise keep the\n  repository report private. Never claim restricted access without verifying\n  it. Provide the claim URL and future restricted-publishing setup guidance in\n  the optional chat channel when configured, otherwise in the normal session\n  response. Do not require Slack.\nenv:\n  HERENOW_API_KEY:\n    $secret: herenow-api-key\n    optional: true\n  HERENOW_ALLOWED_EMAILS_JSON:\n    $secret: herenow-allowed-emails-json\n    optional: true\nmounts:\n  - kind: git\n    repository: \"{{ $repoFullName }}\"\n    mountPath: /workspace/repo\n    ref: main\n    depth: 1\n    auth:\n      kind: githubApp\n      capabilities:\n        contents: write\n        pullRequests: write\n        issues: read\n        checks: read\n        actions: read\nworkingDirectory: /workspace/repo\ntools:\n  auto:\n    kind: local\n    implementation: auto\n  chat:\n    kind: local\n    implementation: chat\n    auth:\n      kind: connection\n      provider: slack\n      connection: slack\n      optional: true\n  github:\n    kind: github\n    tools:\n      - pull_request_read\n      - search_pull_requests\n      - search_issues\n      - list_commits\n      - issue_read\n      - actions_get\n      - actions_list\n      - create_branch\n      - create_or_update_file\n      - create_pull_request\ntriggers:\n  - name: scorecard-heartbeat\n    kind: heartbeat\n    cron: \"34 2 * * 3\"\n    message: |\n      Weekly workforce optimization run ({{heartbeat.scheduledAt}}).\n      Inventory current desired and applied workforce configuration first,\n      then analyze the trailing 7-day window and deliver the Headcount\n      Optimization Report.\n    routing:\n      kind: spawn\n  - name: mention\n    event: chat.message.mentioned\n    connection: slack\n    optional: true\n    where:\n      $.chat.provider: slack\n      $.auto.authored: false\n    message: |\n      {{message.author.userName}} mentioned you on Slack:\n\n      {{message.text}}\n\n      Channel: {{chat.channelId}}\n      Thread: {{chat.threadId}}\n\n      Reply in that thread with chat.send. If the user asks for an\n      off-cycle scorecard or a specific agent's evaluation, run it with\n      the same evidence bar. Recommendations stay advisory only.\n    routing:\n      kind: spawn\n"
+            },
+            {
+              path: "fragments/environments/agent-runtime.yaml",
+              content: "# Source: https://www.auto.sh/api/v1/templates/%40auto/workforce-optimization-consultant/1.2.0/fragments/environments/agent-runtime.yaml\nharness: claude-code\nenvironment:\n  name: agent-runtime\n  image:\n    kind: preset\n    name: node24\n  resources:\n    memoryMB: 8192\n"
+            }
+          ]
         }
       ]
     };
@@ -52803,8 +52824,8 @@ var init_catalog = __esm({
         username: "workforce-optimization-consultant",
         avatarAsset: "workforce-consultant.png",
         category: "factory",
-        oneLiner: "Produces evidence-based scorecards on which agents earn their seat.",
-        description: "A weekly advisory analyst that reviews the project's own agents on effectiveness, fallout, duration, and cost, then recommends concrete roster changes. Advisory only: it never edits resources or applies anything. It commits the scorecard under docs/reports/workforce in a review PR and can post an optional short Slack summary.",
+        oneLiner: "Inventories the configured workforce, then scores which agents earn their seat.",
+        description: "A weekly advisory analyst that inventories desired and applied agent configuration before reviewing effectiveness, fallout, duration, and cost. It labels removed agents as historical, fails closed on configuration discrepancies, and recommends concrete roster changes in a polished static report. Advisory only: it never edits resources or applies anything. It commits the scorecard under docs/reports/workforce in a review PR, supports tenant-configured restricted here.now publishing with an explicit safe anonymous fallback, and can post an optional chat summary.",
         harness: "codex",
         model: "gpt-5.6-sol",
         reasoningEffort: "xhigh",
@@ -56560,7 +56581,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.471",
+      version: "0.1.473",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -66932,6 +66953,8 @@ import { createServer as createServer2 } from "http";
 import { homedir as homedir2 } from "os";
 import path from "path";
 var RELAY_PATH = "/git-credential";
+var GIT_CREDENTIAL_BROKER_TIMEOUT_MS = 24e3;
+var GIT_CREDENTIAL_RELAY_TIMEOUT_MS = 26e3;
 function defaultGitCredentialPortFilePath() {
   return path.join(homedir2(), ".auto", "agent-bridge", "git-credential.json");
 }
@@ -66948,20 +66971,30 @@ async function startGitCredentialRelay(input) {
     request.on("end", () => {
       void (async () => {
         try {
-          const upstream = await fetchImpl(target.url, {
-            method: "POST",
-            headers: {
-              authorization: `Bearer ${target.accessToken}`,
-              "content-type": "application/json"
+          const requestTimeoutMs = input.requestTimeoutMs ?? GIT_CREDENTIAL_BROKER_TIMEOUT_MS;
+          const upstream = await fetchWithTimeout({
+            fetchImpl,
+            url: target.url,
+            init: {
+              method: "POST",
+              headers: {
+                authorization: `Bearer ${target.accessToken}`,
+                "content-type": "application/json"
+              },
+              body: Buffer.concat(chunks).toString("utf8") || "{}"
             },
-            body: Buffer.concat(chunks).toString("utf8") || "{}"
+            timeoutMs: requestTimeoutMs,
+            message: `git credential broker request timed out after ${requestTimeoutMs}ms`
           });
           const body = await upstream.text();
           response.writeHead(upstream.status, {
             "content-type": upstream.headers.get("content-type") ?? "application/json"
           }).end(body);
         } catch (error51) {
-          response.writeHead(502, { "content-type": "application/json" }).end(
+          const timedOut = error51 instanceof GitCredentialRequestTimeoutError;
+          response.writeHead(timedOut ? 504 : 502, {
+            "content-type": "application/json"
+          }).end(
             JSON.stringify({
               error: error51 instanceof Error ? error51.message : String(error51)
             })
@@ -67019,17 +67052,21 @@ async function runGitCredentialHelper(input) {
       input.writeError("git credential relay port file is malformed");
       return 1;
     }
-    const response = await (input.fetchImpl ?? fetch)(
-      `http://127.0.0.1:${portFile.port}${RELAY_PATH}`,
-      {
+    const requestTimeoutMs = input.requestTimeoutMs ?? GIT_CREDENTIAL_RELAY_TIMEOUT_MS;
+    const response = await fetchWithTimeout({
+      fetchImpl: input.fetchImpl ?? fetch,
+      url: `http://127.0.0.1:${portFile.port}${RELAY_PATH}`,
+      init: {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           host: attributes.host,
           ...attributes.path ? { path: attributes.path } : {}
         })
-      }
-    );
+      },
+      timeoutMs: requestTimeoutMs,
+      message: `git credential relay request timed out after ${requestTimeoutMs}ms`
+    });
     if (!response.ok) {
       input.writeError(
         `git credential broker rejected the request: ${response.status}`
@@ -67053,6 +67090,35 @@ async function runGitCredentialHelper(input) {
     return 1;
   }
 }
+var GitCredentialRequestTimeoutError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitCredentialRequestTimeoutError";
+  }
+};
+async function fetchWithTimeout(input) {
+  const controller = new AbortController();
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new GitCredentialRequestTimeoutError(input.message));
+    }, input.timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      input.fetchImpl(input.url, {
+        ...input.init,
+        signal: controller.signal
+      }),
+      timeout
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
 function parseGitCredentialAttributes(raw) {
   const attributes = {};
   for (const line of raw.split("\n")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.471",
+  "version": "0.1.473",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"