@catalyst-cloud/cli 0.16.37 → 0.16.39

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.16.39
+
+`catalyst query pulls` now sends `--state`, `--repo` and `--draft` to Catalyst, so `--state open --all` reads only the workspace's open pull requests instead of paging through every pull request it has ever had. `--state` takes `open`, `closed` or `merged`, and `--draft` takes `draft` or `ready`. Any other value is refused before a request is made. `open` and `closed` leave out merged pull requests, and the repository and state match in any letter case. Against an older Catalyst that ignores these filters, the CLI applies them to the rows it gets back, so the result is the same. A filtered read of the local replica now checks every pull request it holds, so an older pull request linked to a ticket is still found.
+
+The `catalyst-linear` skill reads the project's label definitions before it chooses a ticket's work type and component.
+
+## 0.16.38
+
+On a Mac with thoughts custody, a runner update agent that 0.16.35 or 0.16.36 moved kept failing every update with `custody_restore_failed:runtime_custody_mismatch`, even after the CLI updated itself to 0.16.37. The scheduled update installs the new CLI beside the old one, not globally, so the 0.16.37 repair never ran. Now `catalyst runner update` checks which node it runs under. When that differs from the node the custody was set up with, it runs the same command again under the custody's node and exits with that run's result. The agent file is left as it is, and no run in progress is interrupted. `--check` and `--fleet`, a Mac without thoughts custody, and Linux are unchanged.
+
+`catalyst setup --only codex-attribution --codex-home <dir>` gives a second Codex home the default home's telemetry exporter, so its usage is reported too. It does this only for a home logged in to one of the workspace's coding accounts that has no exporter of its own. Before it changes that home's `config.toml`, it keeps a copy beside it, and the new file is never more readable than the original. A `config.toml` that is a link is left alone. `--dry-run` shows the exporter it would copy with every value except the endpoint, protocol and environment shown as `<hidden>`. `catalyst setup --remove-codex-attribution --codex-home <dir>` takes the copied exporter back out.
+
 ## 0.16.37
 
 On a Mac with thoughts custody, every runner update failed after 0.16.35 or 0.16.36 pointed the runner update agent at a CLI installed under a different node. The update log showed `custody_restore_failed:runtime_custody_mismatch`. The custody records the node it was set up with, and refuses any other. The update agent now runs the CLI under that recorded node, whether `catalyst runner auto-update on` or the global install writes it. Installing this release globally repairs an agent that was already moved, and keeps the previous agent file beside it, as `<file>.before-0.16.37`. A Mac without thoughts custody, and Linux, are unchanged.

package/README.md

@@ -144,7 +144,7 @@ When Codex is on this computer (a `codex` command on your PATH, or `Codex.app` i
 
 On a Mac, setup also installs the `dev.catalystcloud.codex-attribution` LaunchAgent. It runs `catalyst codex-env --apply` when you log in, and again whenever Codex signs in to another account in its default home, so apps you start from the Dock or Finder, the Codex desktop app included, carry the same attributes. An app that is already open keeps the environment it started with. It picks up a change the next time it starts. On Linux, setup adds the shell function only. Without Codex, setup adds nothing and says it skipped this. Run `catalyst setup` again after you install Codex to add it.
 
-`catalyst status` ends with one line that says whether this is installed, which coding account the Codex home resolves to, and how old the cached account list is. `catalyst setup --no-shell-hook` skips all of it. On a machine that is already set up, `catalyst setup --only codex-attribution` adds just this and runs no other step. Before it first changes `~/.zshrc` or `~/.bashrc`, it keeps a copy of the file beside it, ending in `.before-codex-attribution`. Run again, it reports each file as unchanged. With `--dry-run` it prints the exact block each file would get and the LaunchAgent file, and changes nothing. `catalyst setup --remove-codex-attribution` removes it and runs nothing else. Each file goes back to exactly what it was before the block was added, the LaunchAgent is unloaded and deleted, and the two attributes it set (the coding account and the machine name) are taken back out of the launch environment. Attributes you set there yourself are kept. A fake HOME gets none of this.
+`catalyst status` ends with one line that says whether this is installed, which coding account the Codex home resolves to, and how old the cached account list is. `catalyst setup --no-shell-hook` skips all of it. On a machine that is already set up, `catalyst setup --only codex-attribution` adds just this and runs no other step. Before it first changes `~/.zshrc` or `~/.bashrc`, it keeps a copy of the file beside it, ending in `.before-codex-attribution`. Run again, it reports each file as unchanged. With `--dry-run` it prints the exact block each file would get and the LaunchAgent file, and changes nothing. A Codex home other than the default one sends no telemetry until its own `config.toml` has an exporter. Name it with `--codex-home <dir>` (repeatable): when it is logged in to one of the workspace's coding accounts and has no exporter of its own, setup copies the default home's `[otel]` tables into it, after keeping a copy of its `config.toml` beside it. A dry run shows those tables with every header value as `<hidden>`. A home that already has an exporter, or whose login is not a workspace coding account, is left as it is. `catalyst setup --remove-codex-attribution` removes it and runs nothing else; with `--codex-home <dir>` it also takes the copied exporter out of that home's `config.toml`. Each file goes back to exactly what it was before the block was added, the LaunchAgent is unloaded and deleted, and the two attributes it set (the coding account and the machine name) are taken back out of the launch environment. Attributes you set there yourself are kept. A fake HOME gets none of this.
 
 ### Headless setup (CI, image builds, agent VMs)
 

package/dist/args.js

@@ -104,6 +104,11 @@ export const FLAG_TABLES = {
             help: "resume at a verified onboarding step",
         },
         only: { value: true, help: "run only the named onboarding step; codex-attribution adds only the Codex launch hooks, with no other step" },
+        "codex-home": {
+            value: true,
+            repeat: true,
+            help: "codex-attribution: a further Codex home to send telemetry, given the default home's exporter (repeatable; also taken out by --remove-codex-attribution)",
+        },
         yes: { value: false, help: "accept the plan's default choices" },
         "dry-run": {
             value: false,
@@ -132,7 +137,12 @@ export const FLAG_TABLES = {
     query: {
         team: { value: true, help: "team key filter" },
         project: { value: true, help: "project id filter" },
-        state: { value: true, help: "state name filter" },
+        state: {
+            value: true,
+            help: "issues: state name filter; pulls: open, closed or merged",
+        },
+        repo: { value: true, help: "pulls: only this repository (owner/name)" },
+        draft: { value: true, help: "pulls: draft or ready" },
         limit: {
             value: true,
             help: "max rows (default 50); one page only unless --all",
@@ -607,13 +617,13 @@ export const VERB_USAGE = {
     update: "update [--check] [--project <absolute path>] [--dir <runner directory>] | update sdk --project <absolute path> | update policy [<component> on|off] | update policy sdk on|off --project <absolute path> | update policy windows <HH:MM,...>|default [--time-zone <zone>] [--json]   (components: runner, supervisor, watchdog, cli, skills-cloud, skills-dev, replica)",
     setup: "setup [onboard options]   (sets up Catalyst step by step; same as catalyst onboard) | setup --engine <file> --engine-sha256 <hex> [-- <install options>]   (run by install.sh; install.sh --help lists the options)",
     login: "login [--base-url <url>] [--start-replica]   (keyless; or --key <personal-key> / CATALYST_CLOUD_TOKEN)",
-    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--remove-local-data] [--runner|--no-runner] [--no-shell-hook] [--no-color] [--yes] [--dry-run] [--json] | onboard --only codex-attribution [--dry-run] [--json] | onboard --remove-codex-attribution [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--remove-local-data] [--json]",
+    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--remove-local-data] [--runner|--no-runner] [--no-shell-hook] [--no-color] [--yes] [--dry-run] [--json] | onboard --only codex-attribution [--codex-home <dir>]... [--dry-run] [--json] | onboard --remove-codex-attribution [--codex-home <dir>]... [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--remove-local-data] [--json]",
     install: "install [--skills-dir <dir>] [--force]",
     status: "status",
     notice: "notice",
     me: "me [--json]",
     contract: "contract [--refresh] [--path <a.b.c>] [--json]",
-    query: "query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>> [--team K] [--project P] [--state S] [--limit N] [--all] [--source replica|api] [--json]",
+    query: "query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>> [--team K] [--project P] [--state S] [--repo O/N] [--draft draft|ready] [--ticket T] [--limit N] [--all] [--source replica|api] [--json]",
     replica: 'replica <start [--detach]|stop|status [--probe] [--json]|sql "<select>"|schema [table]> [--db <path>]',
     runtime: "runtime <status [--json]|install|path|uninstall>",
     events: "events <tail|wait-for|query|status [--probe] [--json]> [--type NAME] [--ticket CTC-N] [--repo O/N] [--ref O/N:BRANCH] [--pr O/N#N] [--session T/PHASE#N] [--to me] [--after SEQUENCE] [--limit N] [--timeout SECONDS] [--directory PATH]",

package/dist/cli.js

@@ -8,7 +8,7 @@ import { createSetupRenderer, setupBanner, } from "./setup-render.js";
 import { existsSync, openSync, closeSync } from "node:fs";
 import { ReadStream as TerminalInput } from "node:tty";
 import { Writable } from "node:stream";
-import { flagBool, parseArgs, positionals, verbHelp } from "./args.js";
+import { flagBool, flagList, parseArgs, positionals, verbHelp } from "./args.js";
 import { reportCliVersion } from "./cli-version.js";
 import { CONFIG_MODE, DEFAULT_BASE_URL, LEGACY_PACKAGE_NAME, PACKAGE_NAME, cliPath, configPathFor, contractPathFor, defaultCtx, defaultReplicaDbFor, defaultSkillsDirFor, formatMode, loadConfig, modernCliPath, normalizeBaseUrl, readManifest, requireConfig, saveConfig, writeConfig, } from "./config.js";
 import { loadContract, pickPath } from "./contract.js";
@@ -88,7 +88,7 @@ export function usageText() {
         "  catalyst join ...   (deprecated alias of login; removed in the next minor version)",
         "  catalyst install [--skills-dir <dir>] [--force]   (repair path; your agent's own command installs the skills)",
         "  catalyst onboard [--resume-from <step>] [--only <step>] [--runner|--no-runner] [--no-shell-hook] [--yes] [--dry-run] [--json]",
-        "  catalyst setup --only codex-attribution [--dry-run] [--json]   (add only the Codex launch hook and login agent, keeping a copy of each rc file it changes)",
+        "  catalyst setup --only codex-attribution [--codex-home <dir>]... [--dry-run] [--json]   (add only the Codex launch hook and login agent, keeping a copy of each rc file it changes; each --codex-home also gets the default home's telemetry exporter)",
         "  catalyst setup --remove-codex-attribution   (take out the Codex launch hook and login agent setup added)",
         `  catalyst ${SETUP_USAGE}`,
         "  catalyst status | notice | me | ready | accounts",
@@ -295,14 +295,18 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                         throw new UsageError(`--${flag} needs --headless`);
                 if (typeof args.flags.runner === "string" && !onboardHeadlessRequested(args, ctx.env))
                     throw new UsageError("--runner yes|no needs --headless; use --runner or --no-runner interactively");
+                // CTC-7028: further Codex homes go with the hooks' own two paths only.
+                const codexHomes = flagList(args, "codex-home");
+                if (codexHomes.length > 0 && args.flags.only !== "codex-attribution" && args.flags["remove-codex-attribution"] !== true)
+                    throw new UsageError("--codex-home goes with --only codex-attribution or --remove-codex-attribution");
                 // The Codex launch hooks' removal runs on its own, with no onboarding around it.
                 if (args.flags["remove-codex-attribution"] === true) {
                     if (args.flags["dry-run"] === true)
                         throw new UsageError("--remove-codex-attribution changes files; run it without --dry-run");
                     deps.setupUi?.dispose();
-                    const removal = removeCodexAttribution(ctx, deps.codexAttribution);
+                    const removal = removeCodexAttribution(ctx, deps.codexAttribution, codexHomes);
                     if (args.json)
-                        ctx.stdout(JSON.stringify({ removed: removal.ok, files: removal.files, agent: removal.agent }));
+                        ctx.stdout(JSON.stringify({ removed: removal.ok, files: removal.files, agent: removal.agent, homes: removal.homes }));
                     else
                         for (const line of removal.lines)
                             ctx.stdout(line);
@@ -313,9 +317,9 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                     if (args.flags["no-shell-hook"] === true)
                         throw new UsageError("--only codex-attribution adds the Codex launch hooks; --no-shell-hook says not to");
                     deps.setupUi?.dispose();
-                    const only = onlyCodexAttribution(ctx, deps.codexAttribution, { dryRun: args.flags["dry-run"] === true });
+                    const only = onlyCodexAttribution(ctx, deps.codexAttribution, { dryRun: args.flags["dry-run"] === true, codexHomes });
                     if (args.json)
-                        ctx.stdout(JSON.stringify({ ok: only.ok, dryRun: only.dryRun, files: only.files, backups: only.backups, agent: only.agent }));
+                        ctx.stdout(JSON.stringify({ ok: only.ok, dryRun: only.dryRun, files: only.files, backups: only.backups, agent: only.agent, homes: only.homes }));
                     else
                         for (const line of only.lines)
                             ctx.stdout(line);

package/dist/codex-attribution.js

@@ -22,7 +22,8 @@
 import { accessSync, chmodSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { userInfo } from "node:os";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
-import { ACCOUNT_SLOT_ATTRIBUTE, HOST_NAME_ATTRIBUTE, attrValue, defaultCodexHome, readCodexAccountId, readCodexAccountsCache, resolveSlot, } from "./codex-env.js";
+import { ACCOUNT_SLOT_ATTRIBUTE, HOST_NAME_ATTRIBUTE, attrValue, defaultCodexHome, NO_LOGIN_SLOT, readCodexAccountId, readCodexAccountsCache, resolveSlot, UNREGISTERED_SLOT, } from "./codex-env.js";
+import { hasOtel, maskedOtel, otelTables, withOtel, withoutOtel } from "./codex-otel.js";
 import { configDirFor, loadConfig } from "./config.js";
 import { defaultRun, scheduledPath, writeFileAtomic, xml, } from "./runner-auto-update.js";
 export const CODEX_ATTRIBUTION_LABEL = "dev.catalystcloud.codex-attribution";
@@ -641,6 +642,129 @@ export function setupCodexAttribution(ctx, deps = {}) {
 }
 /** The copy `--only codex-attribution` keeps of an rc file before it first changes it. */
 export const RC_BACKUP_SUFFIX = ".before-codex-attribution";
+/** The workspace's coding-account list as this machine cached it, or null when it is for another
+ *  workspace, missing, or this machine is logged out. */
+function accountsCache(ctx) {
+    let workspace;
+    try {
+        workspace = loadConfig(ctx.home)?.account ?? null;
+    }
+    catch {
+        workspace = null;
+    }
+    const cached = workspace === null ? null : readCodexAccountsCache(ctx.home);
+    return cached !== null && cached.workspace === workspace ? cached : null;
+}
+/** Why a named home cannot take the exporter, or null when it can: it is logged in to one of the
+ *  workspace's coding accounts and is not the default home the exporter comes from. */
+function homeRefusal(ctx, home) {
+    if (resolve(home) === resolve(defaultCodexHome(ctx)))
+        return "it is the default Codex home, which the exporter is copied from";
+    const slot = resolveSlot(readCodexAccountId(home), accountsCache(ctx));
+    if (slot === NO_LOGIN_SLOT)
+        return "there is no Codex login in it";
+    if (slot === UNREGISTERED_SLOT)
+        return "its Codex login is not one of this workspace's coding accounts (run catalyst codex-env --refresh if it was added just now)";
+    return null;
+}
+/** A home's config.toml as it is now: its text and mode, or why it cannot be changed. */
+function readHomeConfig(target) {
+    let stat;
+    try {
+        stat = lstatSync(target);
+    }
+    catch {
+        return { text: "", mode: 0o600, existed: false };
+    }
+    if (stat.isSymbolicLink())
+        return { why: "its config.toml is a link, which setup does not follow" };
+    if (!stat.isFile())
+        return { why: "its config.toml is not a regular file" };
+    try {
+        return { text: readFileSync(target, "utf8"), mode: stat.mode & 0o7777, existed: true };
+    }
+    catch (err) {
+        return { why: `its config.toml could not be read (${message(err)})` };
+    }
+}
+/** CTC-7028: each named Codex home gets the default home's exporter, after a copy of its config.toml
+ *  is kept beside it. Header values are never printed. */
+function exportFromHomes(ctx, homes, ops, dryRun, result) {
+    if (homes.length === 0)
+        return;
+    const sourcePath = join(defaultCodexHome(ctx), "config.toml");
+    const source = readOr(sourcePath);
+    const block = source === null ? null : otelTables(source);
+    // The copy carries the collector credential, so the target is never left more readable than the
+    // file it came from.
+    let sourceMode = 0o600;
+    try {
+        sourceMode = statSync(sourcePath).mode & 0o777;
+    }
+    catch {
+        // no source means no block, and nothing is written
+    }
+    for (const raw of homes) {
+        const home = resolve(raw);
+        const target = join(home, "config.toml");
+        const name = tilde(target, ctx.home);
+        const skip = (why) => {
+            result.homes.push({ home, state: "skipped", why });
+            result.lines.push(`Left ${tilde(home, ctx.home)} as it is: ${why}.`);
+        };
+        const refusal = homeRefusal(ctx, home);
+        if (refusal !== null) {
+            skip(refusal);
+            continue;
+        }
+        const config = readHomeConfig(target);
+        if ("why" in config) {
+            skip(config.why);
+            continue;
+        }
+        if (hasOtel(config.text)) {
+            result.homes.push({ home, state: "unchanged" });
+            result.lines.push(`${name} already has a telemetry exporter (unchanged).`);
+            continue;
+        }
+        if (block === null) {
+            skip(`${tilde(sourcePath, ctx.home)} has no [otel] exporter to copy`);
+            continue;
+        }
+        const backup = `${target}${RC_BACKUP_SUFFIX}`;
+        if (dryRun) {
+            result.homes.push({ home, state: "would_add" });
+            result.lines.push(config.existed
+                ? `Would add the telemetry exporter from ${tilde(sourcePath, ctx.home)} to ${name}, after keeping a copy of the file as ${tilde(backup, ctx.home)}${existsSync(backup) ? " (an earlier copy is already there and would be kept)" : ""}. Values other than the endpoint, protocol and environment are shown as <hidden>:`
+                : `Would create ${name} with the telemetry exporter from ${tilde(sourcePath, ctx.home)}. Values other than the endpoint, protocol and environment are shown as <hidden>:`, ...maskedOtel(block));
+            continue;
+        }
+        try {
+            if (config.existed) {
+                if (existsSync(backup))
+                    result.backups.push({ path: target, backup, kept: "earlier" });
+                else {
+                    writeRcAtomic(backup, readFileSync(target), config.mode, ops);
+                    result.backups.push({ path: target, backup, kept: "new" });
+                }
+            }
+            writeRcAtomic(target, withOtel(config.text, block), config.mode & sourceMode, ops);
+        }
+        catch (err) {
+            result.ok = false;
+            skip(`its config.toml could not be written (${message(err)})`);
+            continue;
+        }
+        result.homes.push({ home, state: "added" });
+        const kept = result.backups.find((b) => b.path === target);
+        result.lines.push(`Codex launches with ${tilde(home, ctx.home)} send their telemetry: the exporter from ${tilde(sourcePath, ctx.home)} is in ${name}.` +
+            (kept === undefined
+                ? ""
+                : kept.kept === "new"
+                    ? ` The file as it was is kept at ${tilde(kept.backup, ctx.home)}.`
+                    : ` An earlier copy of the file is kept at ${tilde(kept.backup, ctx.home)}.`));
+    }
+}
 /** `catalyst setup --only codex-attribution`: the hooks setup adds after a full run, and nothing else.
  *  Before it first changes an existing rc file it keeps a byte-for-byte copy beside it, and an earlier
  *  copy is never overwritten, so the copy is what the file was before any hook. `dryRun` writes
@@ -653,6 +777,7 @@ export function onlyCodexAttribution(ctx, deps = {}, options = {}) {
         files: [],
         backups: [],
         agent: { state: "other_home" },
+        homes: [],
         lines: [],
     };
     if (!ownsHome(ctx.home, deps)) {
@@ -725,6 +850,7 @@ export function onlyCodexAttribution(ctx, deps = {}, options = {}) {
     }
     if (result.files.length === 0)
         result.lines.push("No shell rc file got the Codex launch hook: there is no ~/.zshrc or ~/.bashrc, and your login shell is neither zsh nor bash.");
+    exportFromHomes(ctx, options.codexHomes ?? [], ops, dryRun, result);
     const d = resolved(ctx, deps);
     if (d.platform !== "darwin") {
         result.agent = { state: "not_macos" };
@@ -771,8 +897,43 @@ export function codexAttributionAfterSetup(args, ctx, deps = {}) {
     for (const line of setupCodexAttribution(ctx, deps))
         say(line);
 }
+/** Takes the copied exporter block out of each named home's config.toml. With nothing edited after
+ *  setup added it, the file is byte for byte what it was. */
+function removeHomeExporters(ctx, homes, ops) {
+    const out = [];
+    const lines = [];
+    for (const raw of homes) {
+        const home = resolve(raw);
+        const target = join(home, "config.toml");
+        const name = tilde(target, ctx.home);
+        const config = readHomeConfig(target);
+        if ("why" in config) {
+            out.push({ home, state: "skipped", why: config.why });
+            lines.push(`Left ${tilde(home, ctx.home)} as it is: ${config.why}.`);
+            continue;
+        }
+        const restored = config.existed ? withoutOtel(config.text) : null;
+        if (restored === null) {
+            out.push({ home, state: "absent" });
+            lines.push(`${name} had no telemetry exporter from setup.`);
+            continue;
+        }
+        try {
+            writeRcAtomic(target, restored, config.mode, ops);
+        }
+        catch (err) {
+            const why = `its config.toml could not be written (${message(err)})`;
+            out.push({ home, state: "skipped", why });
+            lines.push(`Left ${tilde(home, ctx.home)} as it is: ${why}.`);
+            continue;
+        }
+        out.push({ home, state: "removed" });
+        lines.push(`Took the copied telemetry exporter out of ${name}; the file is as it was before setup added it.`);
+    }
+    return { homes: out, lines };
+}
 /** `catalyst setup --remove-codex-attribution`. Run twice, the second run finds nothing to remove. */
-export function removeCodexAttribution(ctx, deps = {}) {
+export function removeCodexAttribution(ctx, deps = {}, codexHomes = []) {
     const files = shellRcFiles(ctx).flatMap((file) => {
         try {
             const outcome = removeShellHook(file.path, ctx.home, fileOps(deps));
@@ -810,12 +971,16 @@ export function removeCodexAttribution(ctx, deps = {}) {
         lines.push(`Took the coding account and machine name out of ${ENV_NAME} in the launch environment, and kept the attributes you set there yourself. Apps that are already open keep the old value until they restart.`);
     else if (agent.environment === "failed")
         lines.push(`Could not change ${ENV_NAME} in the launch environment. Run launchctl getenv ${ENV_NAME} to see it, and launchctl unsetenv ${ENV_NAME} to clear it.`);
+    const homes = removeHomeExporters(ctx, codexHomes, fileOps(deps));
+    lines.push(...homes.lines);
     return {
         ok: files.every((f) => f.state !== "skipped") &&
+            homes.homes.every((h) => h.state !== "skipped") &&
             agent.agent !== "failed" &&
             agent.environment !== "failed",
         files,
         agent,
+        homes: homes.homes,
         lines,
     };
 }

package/dist/codex-otel.js

@@ -0,0 +1,134 @@
+// codex-otel.ts — CTC-7028. A Codex home named with `--codex-home` sends its telemetry.
+//
+// Codex reads its exporter from the `[otel]` tables of its home's config.toml. A second home (a second
+// Codex login on the same machine) starts with none, so its launches send nothing, and the coding
+// account `catalyst setup --only codex-attribution` resolves for it never reaches a row. Setup copies
+// the default home's `[otel]` and `[otel.*]` tables, verbatim, into each named home that is logged in
+// to one of the workspace's coding accounts and has no exporter of its own.
+//
+// ⛔ HEADER VALUES CARRY THE COLLECTOR CREDENTIAL. They are copied file to file and never printed,
+// logged or put in argv. TOML can spell a header many ways (a headers table, an inline table, a
+// dotted or quoted key), so a dry run shows only an allow-list of plain values and hides the rest.
+//
+// The copy goes in as one marked block at the end of the file, so `--remove-codex-attribution` can
+// take it out again and leave the file byte for byte as it was.
+export const OTEL_BEGIN = "# >>> catalyst codex-attribution: telemetry exporter copied from the default Codex home >>>";
+/** The same marker when setup also had to end the file's last line before the block. */
+export const OTEL_BEGIN_NEWLINE = `${OTEL_BEGIN} (line break added)`;
+export const OTEL_END = "# <<< catalyst codex-attribution <<<";
+export const HIDDEN = "<hidden>";
+const TABLE = /^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(#.*)?$/;
+const OTEL_NAME = /^"?otel"?(\.|$)/;
+const KEY = /^(\s*[^=\s][^=]*?)\s*=\s*(.*)$/;
+/** The only values a dry run shows. Everything else under otel (headers in any spelling, inline
+ *  tables, unknown keys) can carry the collector credential, so it is shown as <hidden>. */
+const SHOWN = new Set(["endpoint", "protocol", "environment", "exporter", "log_user_prompt"]);
+function lines(text) {
+    return text.split("\n");
+}
+/** How far a value opens brackets, counting none inside quoted strings or after a comment. */
+function depth(value) {
+    const bare = value.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, "").replace(/#.*$/, "");
+    let d = 0;
+    for (const ch of bare)
+        d += ch === "[" || ch === "{" ? 1 : ch === "]" || ch === "}" ? -1 : 0;
+    return d;
+}
+/** Each line of a config.toml, read well enough to tell a table header from a value line. */
+function classify(text) {
+    let open = 0;
+    return lines(text).map((line) => {
+        if (open > 0) {
+            open += depth(line);
+            return { kind: "continued" };
+        }
+        const table = TABLE.exec(line);
+        if (table)
+            return { kind: "table", name: table[1] ?? "" };
+        const key = KEY.exec(line);
+        if (key && !line.trim().startsWith("#")) {
+            open = Math.max(0, depth(key[2] ?? ""));
+            return { kind: "key", key: key[1] ?? "", value: key[2] ?? "" };
+        }
+        return { kind: "other" };
+    });
+}
+/** The `[otel]` and `[otel.*]` tables of a config.toml, each with the lines up to the next table, in
+ *  file order; null when there is none. */
+export function otelTables(text) {
+    const out = [];
+    const all = lines(text);
+    let inOtel = false;
+    classify(text).forEach((line, i) => {
+        if (line.kind === "table")
+            inOtel = OTEL_NAME.test(line.name);
+        if (inOtel)
+            out.push(all[i] ?? "");
+    });
+    while (out.length > 0 && out[out.length - 1]?.trim() === "")
+        out.pop();
+    return out.length === 0 ? null : `${out.join("\n")}\n`;
+}
+/** True when the file already configures any exporter: an otel table, an `otel` key, or our block. */
+export function hasOtel(text) {
+    let inTable = false;
+    const all = lines(text);
+    return classify(text).some((line, i) => {
+        if (all[i] === OTEL_BEGIN || all[i] === OTEL_BEGIN_NEWLINE)
+            return true;
+        if (line.kind === "table") {
+            inTable = true;
+            return OTEL_NAME.test(line.name);
+        }
+        return !inTable && line.kind === "key" && /^\s*"?otel"?\s*(\.|$)/.test(line.key);
+    });
+}
+/** The block for display. Table headers, comments and the values of the keys in SHOWN are as they
+ *  are; every other value, any value under a headers table, and every continued line is <hidden>. */
+export function maskedOtel(block) {
+    let headers = false;
+    const all = lines(block.replace(/\n$/, ""));
+    return classify(all.join("\n")).map((line, i) => {
+        const raw = all[i] ?? "";
+        if (line.kind === "table") {
+            headers = /(^|\.)\s*"?headers"?$/.test(line.name);
+            return raw;
+        }
+        if (line.kind === "continued")
+            return `  ${HIDDEN}`;
+        if (line.kind === "other")
+            return raw.trim() === "" || raw.trim().startsWith("#") ? raw : HIDDEN;
+        const name = line.key.trim().replace(/^"|"$/g, "");
+        const plain = !/[{[]/.test(line.value);
+        return !headers && plain && SHOWN.has(name) ? raw : `${line.key} = ${HIDDEN}`;
+    });
+}
+/** The file with the block appended. A file that does not end its last line gets one line break first,
+ *  and the marker records it, so taking the block out restores the file byte for byte. */
+export function withOtel(original, block) {
+    const open = original === "" || original.endsWith("\n");
+    return `${original}${open ? "" : "\n"}${open ? OTEL_BEGIN : OTEL_BEGIN_NEWLINE}\n${block}${OTEL_END}\n`;
+}
+/** The file without our block, or null when it has none (or only half of one, which is left alone). */
+export function withoutOtel(text) {
+    let start = lineAt(text, OTEL_BEGIN);
+    let addedBreak = false;
+    if (start < 0) {
+        start = lineAt(text, OTEL_BEGIN_NEWLINE);
+        addedBreak = true;
+    }
+    if (start < 0)
+        return null;
+    const endAt = text.indexOf(`\n${OTEL_END}\n`, start);
+    if (endAt < 0)
+        return null;
+    const before = text.slice(0, start);
+    return (addedBreak && before.endsWith("\n") ? before.slice(0, -1) : before) + text.slice(endAt + OTEL_END.length + 2);
+}
+/** Where the line that is exactly `line` starts, or -1. */
+function lineAt(text, line) {
+    if (text.startsWith(`${line}\n`))
+        return 0;
+    const at = text.indexOf(`\n${line}\n`);
+    return at < 0 ? -1 : at + 1;
+}

package/dist/query.js

@@ -68,7 +68,7 @@ export async function cmdQuery(args, ctx, deps = {}) {
             status.verdict === "not-configured") {
             throw new UsageError(`--source replica but the replica is ${status?.verdict ?? "unavailable"}`);
         }
-        result = await fromReplica(ctx, cfg, sub, rest, filters, deps);
+        result = await fromReplica(ctx, cfg, sub, rest, filters, deps, args);
     }
     else {
         result = await fromApi(ctx, cfg, sub, rest, filters, args);
@@ -80,7 +80,7 @@ export async function cmdQuery(args, ctx, deps = {}) {
     printResult(ctx, args, sub, result);
     return 0;
 }
-async function fromReplica(ctx, cfg, sub, rest, f, deps) {
+async function fromReplica(ctx, cfg, sub, rest, f, deps, args) {
     const sdk = await loadSdk();
     const dbPath = replicaDbPath(cfg, ctx.home, ctx.env);
     const engine = await engineFor(sdk, dbPath, ctx, {
@@ -100,8 +100,24 @@ async function fromReplica(ctx, cfg, sub, rest, f, deps) {
             }
             case "issue":
                 return replica.issue(needArg(rest, "issue <identifier>"));
-            case "pulls":
-                return replica.pulls({ limit: f.limit });
+            case "pulls": {
+                const scope = pullScope(args);
+                if (!(scope.state || scope.repo || scope.draft || scope.ticket))
+                    return replica.pulls({ limit: f.limit });
+                // CTC-7158 — the replica is local, so a narrowed read scans every row rather than only the
+                // newest window: an older pull request linked to the ticket is still found.
+                const kept = [];
+                for (let offset = 0;; offset += REPLICA_PULL_PAGE) {
+                    const page = replica.pulls({
+                        limit: REPLICA_PULL_PAGE,
+                        offset,
+                    });
+                    kept.push(...page.filter((row) => pullMatches(row, scope)));
+                    if (page.length < REPLICA_PULL_PAGE || kept.length >= f.limit)
+                        break;
+                }
+                return kept.slice(0, f.limit);
+            }
             case "projects":
                 return applyFilters(replica.projects({
                     limit: Math.max(f.limit, 200),
@@ -147,16 +163,23 @@ async function fromApi(ctx, cfg, sub, rest, f, args) {
             return res.status === 404 ? null : res.body;
         }
         case "pulls": {
-            const ticket = flagString(args, "ticket");
+            const scope = pullScope(args);
+            if (scope.ticket) {
+                const rows = await ticketPulls(ctx, api, scope);
+                return f.all ? rows : rows.slice(0, f.limit);
+            }
+            // CTC-7158 — the facets go to the cloud, so `--state open --all` reads the open pull requests
+            // instead of paging every one the workspace has ever had.
+            const query = { state: scope.state, repo: scope.repo, draft: scope.draft };
             if (f.all) {
-                const { rows } = await fetchAllPages(api, "/api/v1/pulls", { ticket });
-                return rows;
+                const { rows } = await fetchAllPages(api, "/api/v1/pulls", query);
+                return keepPullScope(ctx, rows, scope);
             }
             const page = await fetchPage(api, "/api/v1/pulls", {
+                ...query,
                 limit: f.limit,
-                ticket,
             });
-            const rows = page.rows.slice(0, f.limit);
+            const rows = keepPullScope(ctx, page.rows, scope).slice(0, f.limit);
             const notice = truncationNotice(page);
             if (notice)
                 ctx.stderr(notice);
@@ -264,6 +287,78 @@ function requireIssueScope(scope, f) {
         throw new CliError(`the cloud did not apply ${flag} (${scope === null ? "it sent no x-mirror-scope header" : `it applied: ${scope.join(", ") || "nothing"}`}), so the page is not that scope; nothing printed. Read it with --source replica, or drop ${flag}`, "filter-not-applied", 1);
     }
 }
+const REPLICA_PULL_PAGE = 500;
+const PULL_STATES = ["open", "closed", "merged"];
+const PULL_DRAFTS = ["draft", "ready"];
+/** CTC-7158 — the cloud reads an unknown `?state=` or `?draft=` as no narrowing, so a typo would
+ *  page every pull request. Refuse it here instead. */
+function pullScope(args) {
+    const state = trimmedFlag(args, "state")?.toLowerCase();
+    if (state !== undefined && !PULL_STATES.includes(state))
+        throw new UsageError(`--state for pulls is one of ${PULL_STATES.join(", ")} (got "${state}")`);
+    const draft = trimmedFlag(args, "draft")?.toLowerCase();
+    if (draft !== undefined && !PULL_DRAFTS.includes(draft))
+        throw new UsageError(`--draft is one of ${PULL_DRAFTS.join(", ")} (got "${draft}")`);
+    return {
+        state: state,
+        repo: trimmedFlag(args, "repo"),
+        draft: draft,
+        ticket: trimmedFlag(args, "ticket"),
+    };
+}
+const truthy = (v) => v === true || v === 1 || v === "1" || v === "true";
+/** The cloud's facet rules (the read model's pull scope): `open` and `closed` leave out merged pull
+ *  requests, `merged` is the merged flag alone, `ready` is not a draft, and state and repo match
+ *  without case. */
+function pullMatches(row, s) {
+    const merged = truthy(row.merged);
+    const state = String(row.state ?? "").toLowerCase();
+    if (s.state === "open" && (state !== "open" || merged))
+        return false;
+    if (s.state === "merged" && !merged)
+        return false;
+    if (s.state === "closed" && (state !== "closed" || merged))
+        return false;
+    if (s.draft === "draft" && !truthy(row.draft))
+        return false;
+    if (s.draft === "ready" && truthy(row.draft))
+        return false;
+    if (s.repo && !sameName(row.repo_id, s.repo))
+        return false;
+    if (s.ticket && "linear_issue_identifier" in row && !sameName(row.linear_issue_identifier, s.ticket))
+        return false;
+    return true;
+}
+/** A cloud that predates a facet returns rows outside it. Drop them and say so, so the answer is
+ *  still the asked scope. */
+function keepPullScope(ctx, rows, s) {
+    const kept = rows.filter((row) => pullMatches(row, s));
+    if (kept.length < rows.length)
+        ctx.stderr(`the cloud returned ${rows.length - kept.length} pull requests outside the asked scope; dropped them here`);
+    return kept;
+}
+/** CTC-7158 — `/pulls` has no ticket facet, and an unknown param narrows nothing, so `?ticket=`
+ *  returned the newest page for any ticket. The ticket's own read names its linked pull requests;
+ *  read each of those instead. */
+async function ticketPulls(ctx, api, s) {
+    const ticket = s.ticket;
+    const res = await api.getJson(`/api/v1/issues/${encodeURIComponent(ticket)}`, { accept: [404] });
+    if (res.status === 404)
+        throw new CliError(`--ticket ${ticket}: no such ticket`, "not-found", 1);
+    const rows = [];
+    for (const link of res.body.linked_pulls ?? []) {
+        if (!link.node_id)
+            continue;
+        const pr = await api.getJson(`/api/v1/pulls/${encodeURIComponent(link.node_id)}`, { accept: [404] });
+        if (pr.status === 404) {
+            ctx.stderr(`--ticket ${ticket}: linked pull request ${link.node_id} is not in the mirror`);
+            continue;
+        }
+        if (pullMatches(pr.body, { ...s, ticket: undefined }))
+            rows.push(pr.body);
+    }
+    return rows;
+}
 function trimmedFlag(args, name) {
     const value = flagString(args, name)?.trim();
     return value === "" ? undefined : value;

package/dist/runner-command.js

@@ -1,7 +1,9 @@
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { flagBool, flagString, positionals } from "./args.js";
 import { CliError, UsageError } from "./errors.js";
-import { autoUpdateStatus, disableAutoUpdate, enableAutoUpdate, scheduledPath, } from "./runner-auto-update.js";
+import { autoUpdateStatus, custodyNode, disableAutoUpdate, enableAutoUpdate, scheduledPath, } from "./runner-auto-update.js";
 import { dockerRunnerUpdateEngine, readReleaseState, RELEASE_COMPONENTS, runnerDir, runRunnerUpdate, updateResultLines, lastProblem, lastProblemLines, } from "./runner-update.js";
 import { dockerFleetUpdateEngine, runFleetUpdate } from "./runner-update-fleet.js";
 import { runUpdate, sharedReleaseRead, updateReportJson, updateReportLines } from "./update.js";
@@ -9,6 +11,32 @@ import { effectivePolicy, readUpdatePolicy, setComponentPolicy } from "./update-
 import { resolveClaude } from "./update-plugin.js";
 import { defaultWindows, windowBounds } from "./update-windows.js";
 import { cmdRunnerLifecycle, RUNNER_LIFECYCLE_ACTIONS } from "./runner.js";
+/** Set on the re-run, so it never re-runs itself again. */
+export const CUSTODY_RERUN_ENV = "CATALYST_CUSTODY_NODE_RERUN";
+const real = (path) => {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+};
+/** CTC-7046: a Mac's thoughts custody refuses any update run under another node than the one it was
+ *  set up with. An update run under another node, by an agent written before 0.16.37 or by a person's
+ *  shell, re-runs itself under the custody's node and answers with that run's exit code. This works
+ *  whatever wrote the agent, and never reloads the agent mid-run. Null: carry on in this process. */
+function custodyRerun(ctx, deps, dir) {
+    if ((deps.platform ?? process.platform) !== "darwin" || ctx.env[CUSTODY_RERUN_ENV] === "1")
+        return null;
+    const node = (deps.node ?? custodyNode)(dir);
+    if (node === null || real(node) === real(deps.execPath ?? process.execPath))
+        return null;
+    const [script, ...rest] = deps.argv ?? process.argv.slice(1);
+    if (script === undefined)
+        return null;
+    const run = deps.run ?? ((command, args, env) => spawnSync(command, [...args], { stdio: "inherit", env }).status ?? 1);
+    return run(node, [script, ...rest], { ...ctx.env, [CUSTODY_RERUN_ENV]: "1" });
+}
 const USAGE = "catalyst runner [status] | stop | start | uninstall [--yes] [--delete-checkouts] | runner update [--check] [--dir <runner directory>] [--fleet] | runner auto-update [status|on|off]";
 const UPDATE_FLAGS = ["check", "auto", "dir", "fleet"];
 function schedulerDeps(ctx, deps) {
@@ -76,6 +104,11 @@ export async function cmdRunner(args, ctx, deps = {}) {
         const fleet = flagBool(args, "fleet");
         if (fleet && dirFlag === undefined)
             throw new UsageError("--fleet needs --dir, the directory that holds compose.json");
+        if (!fleet && !check) {
+            const rerun = custodyRerun(ctx, deps.custody ?? {}, dir());
+            if (rerun !== null)
+                return rerun;
+        }
         // One desired-release read serves the image check and the component report (CTC-6708).
         const engine = sharedReleaseRead(deps.engine ?? dockerRunnerUpdateEngine({ env: ctx.env }));
         // The 15-minute schedule runs `runner update --auto`. After the images it carries on with every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/cli",
-  "version": "0.16.37",
+  "version": "0.16.39",
   "description": "Set up Catalyst Cloud, check your tickets and manage your account from the command line.",
   "license": "MIT",
   "type": "module",

package/skills/catalyst-github/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's GitHub: show a ticket's pull request with its checks, reviews and review threads, say whether it is mergeable under this repository's policy, and explain what a PR accumulates as the ticket moves (the branch, the draft, the rewrite, the force-pushes, the labels, the queue). Use when someone asks "show me the PR", "what are the checks saying", "why hasn't it merged", "what does the queue need", "what does that label mean", or wants the branch and merge conventions Catalyst follows.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # Catalyst's GitHub
 

package/skills/catalyst-github/references/reading-from-the-cloud.md

@@ -5,6 +5,7 @@ Cloud reads are the default on every machine. They need no local writer and no l
 | question | command |
 | -- | -- |
 | Which pull requests name this ticket? | `catalyst query pulls --ticket <KEY-123>` |
+| Which pull requests are open, in one repository or across them all? | `catalyst query pulls --state open --all` (add `--repo <owner/name>` or `--draft ready`). The cloud filters, so this reads only open ones. Never page every pull request with `--all` and filter it yourself. |
 | What state is the PR in: draft, merged, conflict, auto-merge? | `node scripts/read-pr.mjs <KEY-123>` |
 | Which checks are red or still running at the head? | `node scripts/read-pr.mjs <KEY-123>` |
 | Is it mergeable under this repository's policy? | `node scripts/is-it-mergeable.mjs <KEY-123>`, which also reads `catalyst contract --path merge` |

package/skills/catalyst-linear/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's view of Linear on the customer's own cloud account. Reads a ticket with its comments, relations, labels, linked pull requests and agent sessions inline, from the cloud API by default, with local replica reads available as an explicit opt-in, always naming the source; searches tickets, PRs, projects and initiatives; writes comments, card moves, labels and new tickets through the account's agent proxy as the app actor, with every route, stage id, label id and marker read from the account's contract. Knows what a ticket accumulates as Catalyst works it (phase-outcome comments, the document per phase, the agent session, the labels, the single blocks relation, the bookkeeping marker, the eyes acknowledgement). Use when a person says "show me the ticket", "what did Catalyst write on it", "comment on it", "move it", "label it" or "file a ticket". Not for raising a decision for a human (what-needs-me) and not for pull requests (catalyst-github).
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # Catalyst Linear
 
@@ -30,6 +30,7 @@ Exit codes: 0 done, 1 not found or a usage error, 2 this machine is not connecte
 | "what did Catalyst write on this ticket?", a comment shape, a label, the marker, the 👀 | `references/what-a-ticket-accumulates.md` |
 | before any read you will report on; "is this current?"; citing; searching | `references/reading-a-ticket.md` |
 | before any comment, move, label or new ticket; identity, budget, slots, ids | `references/writing-to-linear.md` |
+| proposing work-type or component labels for creation, triage or backfill | `references/ticket-classification.md`; then the project's `.agents/references/ticket-labels.json` if present |
 | which command answers a ticket question from the cloud: stage, last phase, PR, what changed | `references/reading-from-the-cloud.md` |
 | local SQL, only when `catalyst replica status --json` reports `configured: true` | `references/local-replica.md` |
 

package/skills/catalyst-linear/references/ticket-classification.md

@@ -0,0 +1,11 @@
+# Ticket classification
+
+Use this reference when proposing work-type or component labels while creating, triaging, or backfilling tickets. It describes the process; a project's `.agents/references/ticket-labels.json`, when present, owns its vocabulary and boundaries. Read that file from the project checkout before classifying. Do not copy one project's catalog to another team.
+
+1. Read the ticket's description, acceptance criteria, and current labels. A title or repository route alone is not enough to settle a component. Treat linked implementation paths as supporting evidence for a retrospective review, not as proof of the original request.
+2. Decide whether the record requests delivery or asks for a decision, approval, information, or action. Choose one type from the project's catalog when the evidence supports it. A project may define `ask` as a type for the latter records. Keep that type separate from the workflow marker that routes asks, and from the implementation ticket an ask may block. A bug requires evidence of an existing promised behavior that fails; a new capability is a feature; a new guard is test work, while a broken existing CI contract is a bug. Documentation explains behavior; maintenance publishes or configures it; refactoring preserves it.
+3. Select zero or more components whose behavior the requested work materially changes. Allow more than one for independent affected areas. Abstain on an unclear boundary; a path, a generic word, or a test mention alone does not establish ownership. Keep project and initiative relationships, ask/control state, and repository routing separate from these labels.
+4. Record the evidence, uncertainty, and any alternative before a backfill. Apply recommendations only within the authorized scope and under a reviewed classification policy. Preserve the ticket's existing work type unless a reviewed correction calls for replacement. Add supported components without removing unrelated labels. Create a label only when that scope and policy authorize it.
+5. Before a write, use `writing-to-linear.md` to resolve the live label name, scope, ID or ambiguity through current account access. The project file is policy, not an ID cache. Read back the ticket after a reviewed write.
+
+For cleanup of case-only duplicates, inventory active and archived labels and issues. Check synchronization with linked systems, test a disposable canary, and read back both systems after a delay. A write that appears to remove a duplicate may be reversed by synchronization. Stop broad cleanup until the canary has a stable result.

package/skills/catalyst-linear/references/writing-to-linear.md

@@ -30,6 +30,8 @@ Every write spends one unit of the per-host daily budget (`thresholds.hostDailyW
 
 `--label`, `--add` and `--remove` take a label's name or its UUID. A UUID is sent as a label id; every other value is sent as a name, and the proxy resolves it in the ticket's team. When the contract lists one of Catalyst's own labels (the ask marker, the hold label, the release label) as absent from the workspace, the CLI refuses rather than inventing it.
 
+For work-type and component choices, load [ticket classification](ticket-classification.md) and the project's `.agents/references/ticket-labels.json` when present. Those files define recommendations, not live IDs. Verify the current team's label scope and the ticket's existing memberships before changing any classification label. A case-only duplicate needs a synchronization check, a disposable canary and delayed readback in both systems before wider cleanup. Include archived labels and issues in the inventory.
+
 Two labels are a human's, not yours: the release label (which frees a ticket the shape detector held) is applied by a human; the hold labels on a pull request are `catalyst-github`'s subject.
 
 ## A new ticket takes the team key

package/skills/catalyst-onboard/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Set up Catalyst Cloud and say whether setup is working. Walks a person from nothing to their first ticket running, one step at a time: the coding account, the project, the integrations and connected accounts, each repository's settings file, then one real ticket moving. Also logs this machine in, reads the readiness verdict with who can fix each failure, and checks the optional local replica. Use when someone says "set me up", "onboard me", "I just signed up", "get me started", "what do I do first", "log me in", "which account is this machine on", "am I set up", "what is missing", "why does nothing happen" or "is the replica running", when a login expired, or when a skill script exits 2 saying this machine is not connected. Does every step a key can do through the catalyst CLI, hands over the exact page for the steps only a browser can do, and never claims a step it did not watch succeed.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # Onboard me
 

package/skills/run-this-project/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Own one Catalyst Cloud project end to end until it closes. Use when the person says "run this project for me", "own this until it ships", "keep this moving", or hands you a project id or a set of tickets to drive. Subscribes to the account's event stream for the scope through the catalyst CLI, reacts to each change in the same turn, makes tickets ready and moves them to dispatch, parks what should stop, chases stalls, escalates inward, and keeps one status summary current. Writes to Linear as the app actor; never polls.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # Run this project
 

package/skills/unstick/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Get a stuck Catalyst Cloud ticket moving again. Use when the person asks "why is this parked and can you release it?", "unpark this", "get things flowing again", "the outage is over, retry what failed", or hands you a ticket that is not moving. Reads why nothing runs and what holds the ticket through the catalyst CLI, decides whether the recorded cause is fixed, previews the release, releases every governor holding the ticket the right way (or one failure class across a team), and raises an ask only for what a person has to do. Never releases a cause it cannot show changed without saying so.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # Unstick
 

package/skills/what-needs-me/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   The human's decision inbox on Catalyst Cloud, and the one way an agent raises a decision on their behalf. Use when the person asks "what needs me?", "what am I blocking?", or when active work is gated on a choice only they can make. Lists open asks ranked by how much open work each one holds, files an ask through the cloud's ask route with the account's own template, and records the answer so the held work releases. Never answers as the human, never duplicates an open ask.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # What needs me
 

package/skills/what-this-repo-needs/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   What environment variable names does this repository need, and where does each one come from? Scans the repository offline (no login, no network) and lists the names in three groups (build/test, deploy-only, bindings), each with where it was found, what uses it, and where a local value would come from. Never reads a value or prints one. Also checks the environment variable table in `.catalyst/catalyst.toml` offline. Use when someone asks "what does catalyst.env.json mean", "what env vars does this repo need", "why does the container need this", or before reviewing or writing the declaration.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # What this repository needs
 

package/skills/whats-happening/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Use for "what's happening?", "what machines do we have?", "how much capacity do we have?", "where are we?", "why is that stuck?", "what closed?", "what's next?", "how does this work?", "why did it do that?", "how does it prioritise?" and "what does this setting do, where is it set?" in Catalyst Cloud, or asks for something to be done rather than known. Reads the contract via catalyst CLI. Read-only: route work/decisions, never answer as the human.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.37 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.39 — written in this repository for customer accounts -->
 
 # What's happening