@code-partner/codepipe-hub 0.14.1-dev.420.g57ff103d → 0.14.1-dev.423.ga49d1f61

package/hub/dist/embedded.js

@@ -16,6 +16,15 @@ function humanSubjectOf(actor) {
     return actor.principal.delegatedBy ?? null;
   return null;
 }
+function accountOf(actor) {
+  const subjectId = humanSubjectOf(actor);
+  if (subjectId === null)
+    return null;
+  return {
+    subjectId,
+    email: actor.principal.kind === "human" && actor.displayEmail !== void 0 ? actor.displayEmail : null
+  };
+}
 function serviceOf(actor) {
   return actor.principal.kind === "service" ? actor.principal.service : null;
 }
@@ -448,7 +457,7 @@ var PLATFORM_VERSION;
 var init_version_generated = __esm({
   "../packages/shared/dist/version.generated.js"() {
     "use strict";
-    PLATFORM_VERSION = "0.14.1-dev.420.g57ff103d";
+    PLATFORM_VERSION = "0.14.1-dev.423.ga49d1f61";
   }
 });
 
@@ -458,7 +467,7 @@ var init_version = __esm({
   "../packages/shared/dist/version.js"() {
     "use strict";
     init_version_generated();
-    PROTOCOL_VERSION = 4;
+    PROTOCOL_VERSION = 5;
   }
 });
 
@@ -1227,7 +1236,7 @@ function parseRepoMirror(raw) {
 function isCredKind(value) {
   return typeof value === "string" && CRED_KINDS.includes(value);
 }
-var DEFAULT_BRANCH_PATTERN, BRANCH_SLUG_MAX_LENGTH, CYRILLIC_TRANSLIT, CRED_KINDS;
+var DEFAULT_BRANCH_PATTERN, BRANCH_SLUG_MAX_LENGTH, CYRILLIC_TRANSLIT, CRED_KINDS, PROJECT_ID_RE;
 var init_project = __esm({
   "../packages/shared/dist/project.js"() {
     "use strict";
@@ -1269,6 +1278,7 @@ var init_project = __esm({
       \u044F: "ya"
     };
     CRED_KINDS = ["github", "gitlab", "bitbucket", "youtrack", "contextWrite"];
+    PROJECT_ID_RE = /^[a-z][a-z0-9-]{1,30}$/;
   }
 });
 
@@ -4231,16 +4241,40 @@ function createReadOperations(port, authorizer) {
     return { projectId, items: rows, revision: valueRevision(rows) };
   }
   function projectVisibilityOf(actor) {
-    const subjectId = humanSubjectOf(actor);
-    if (subjectId === null)
+    const account = accountOf(actor);
+    if (account === null)
       return null;
     return {
-      subjectId,
-      ...actor.principal.kind === "human" && actor.displayEmail !== void 0 ? { email: actor.displayEmail } : {},
+      subjectId: account.subjectId,
+      ...account.email === null ? {} : { email: account.email },
       ...actor.projectScope === void 0 ? {} : { projectScope: actor.projectScope },
       includeUnowned: actor.authMethod !== "cli_token"
     };
   }
+  function farmsView(rows) {
+    return {
+      items: rows.map((r) => ({
+        id: r.farmId,
+        name: r.name,
+        publicKey: r.publicKey,
+        keyFingerprint: r.keyFingerprint,
+        online: r.online,
+        lastSeenAt: toOptionalTimestamp(r.lastSeenAt)
+      }))
+    };
+  }
+  function projectDeliverablesView(projectId, rows) {
+    return {
+      projectId,
+      items: rows.map((r) => ({
+        taskKey: r.taskKey,
+        title: r.title,
+        phase: r.phase,
+        updatedAt: toTimestamp(r.updatedAt),
+        repos: r.repos.map((x) => ({ repoName: x.repoName, branchName: x.branchName, baseRef: x.baseRef }))
+      }))
+    };
+  }
   async function visibleProjects(actor) {
     const visibility = projectVisibilityOf(actor);
     return visibility === null ? [] : await port.visibleProjectIds(visibility);
@@ -4709,6 +4743,15 @@ function createReadOperations(port, authorizer) {
       const rows = await port.listRepos(query.projectId);
       return reposView(query.projectId, rows);
     },
+    async listProjectDeliverables(actor, query) {
+      await require2(actor, "delivery.read", { type: "deliverable", projectId: query.projectId });
+      return projectDeliverablesView(query.projectId, await port.listProjectDeliverables(query.projectId));
+    },
+    async listFarms(actor) {
+      await require2(actor, "account.read", { type: "account" });
+      const account = accountOf(actor);
+      return farmsView(account === null ? [] : await port.listFarms(account));
+    },
     async listConfigProposals(actor, query) {
       await require2(actor, "project.read", { type: "project", id: query.projectId, projectId: query.projectId });
       const limit = normalizeLimit(query.limit);
@@ -4938,8 +4981,18 @@ function createCommandOperations(deps) {
         });
       case "unprocessable":
         throw errors.unprocessable({ details: { reason: outcome.reason } });
+      case "not_found":
+        throw errors.notFound();
+      case "rate_limited":
+        throw errors.rateLimited();
     }
   }
+  function accountActorOf(actor) {
+    const account = accountOf(actor);
+    if (account === null)
+      throw errors.forbidden({ details: { reason: "human_only" } });
+    return account;
+  }
   async function audited(actor, entry, run) {
     const policy = { decision: "not_evaluated" };
     const common = {
@@ -5428,6 +5481,115 @@ function createCommandOperations(deps) {
         return { value: outcome.result, replayed: outcome.replayed };
       });
     },
+    async createProject(actor, command) {
+      const { project } = command;
+      const projectId = project.projectId;
+      if (!PROJECT_ID_RE.test(projectId)) {
+        throw errors.invalidInput({
+          message: "A project id is lowercase letters, digits and dashes, starts with a letter, 2\u201331 characters.",
+          details: { field: "projectId" }
+        });
+      }
+      for (const repo of project.repos) {
+        if (repo.defaultBranch !== void 0 && !isValidBranchName(repo.defaultBranch)) {
+          throw errors.invalidInput({ message: "That is not a valid git branch name.", details: { field: "repos.defaultBranch", repo: repo.name } });
+        }
+      }
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "project.create", projectId, key };
+      return await audited(actor, { operationId: "project.create", aggregateType: "project", aggregateId: projectId, projectId, data: { name: project.name, tracker: project.trackerProvider } }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const run = await runIdempotent(idempotency, scope, { project }, async () => unwrap(await write2.createProject({ project, owner: accountActorOf(actor) })), now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async provisionOnFarm(actor, command) {
+      const { farmId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "farm.provision", projectId, key };
+      return await audited(actor, { operationId: "farm.provision", aggregateType: "project", aggregateId: projectId, projectId, data: { farmId } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { farmId, projectId }, async () => {
+          const row = unwrap(await write2.provisionOnFarm({ farmId, projectId, sealedBundle: command.sealedBundle, actor: accountActorOf(actor) }));
+          return { projectId, farmId, ok: row.ok, daemonStatus: row.daemonStatus, error: row.error };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async provisionGhRunners(actor, command) {
+      const { runnerId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "runner.provisionGhRunners", projectId, key };
+      return await audited(actor, { operationId: "runner.provisionGhRunners", aggregateType: "project", aggregateId: projectId, projectId, data: { runnerId } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { runnerId, projectId }, async () => {
+          const row = unwrap(await write2.provisionGhRunners({ runnerId, projectId, sealedBundle: command.sealedBundle, actor: accountActorOf(actor) }));
+          return {
+            projectId,
+            runnerId,
+            ok: row.ok,
+            runners: row.runners.map((r) => ({ owner: r.owner, repo: r.repo, status: r.status, error: r.error, labels: r.labels })),
+            error: row.error
+          };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async teardownGhRunners(actor, command) {
+      const { runnerId, projectId } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "runner.teardownGhRunners", projectId, key };
+      const repo = command.repo ?? null;
+      return await audited(actor, {
+        operationId: "runner.teardownGhRunners",
+        aggregateType: "project",
+        aggregateId: projectId,
+        projectId,
+        data: { runnerId, ...repo === null ? {} : { repo: `${repo.owner}/${repo.repo}` } }
+      }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { runnerId, projectId, repo }, async () => {
+          const row = unwrap(await write2.teardownGhRunners({
+            runnerId,
+            projectId,
+            sealedBundle: command.sealedBundle ?? null,
+            repo,
+            actor: accountActorOf(actor)
+          }));
+          return { projectId, runnerId, ok: row.ok, error: row.error };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async requestProjectIndex(actor, command) {
+      const { projectId, kind } = command;
+      const key = asIdempotencyKey(command.idempotencyKey);
+      const scope = { subjectId: actor.principal.subjectId, operationId: "project.index", projectId, key };
+      return await audited(actor, { operationId: "project.index", aggregateType: "project", aggregateId: projectId, projectId, data: { kind } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const run = await runIdempotent(idempotency, scope, { kind }, async () => {
+          const { jobId } = unwrap(await write2.enqueueProjectIndex({ projectId, kind }));
+          return { jobId, kind };
+        }, now());
+        return { value: run.result, replayed: run.replayed };
+      });
+    },
+    async issueWorkerRegistrationToken(actor) {
+      const subjectId = actor.principal.subjectId;
+      return await audited(actor, { operationId: "worker.issueRegistrationToken", aggregateType: "account", aggregateId: subjectId, projectId: null }, async (policy) => {
+        await require2(actor, "account.manage", { type: "account" }, policy);
+        const issued = unwrap(await write2.issueWorkerRegistrationToken({ owner: accountActorOf(actor) }));
+        return { value: { secret: issued.secret, expiresAt: toTimestamp(issued.expiresAt) }, replayed: false };
+      });
+    },
+    async reportInitStatus(actor, command) {
+      const { projectId, phase } = command;
+      return await audited(actor, { operationId: "project.reportInitStatus", aggregateType: "project", aggregateId: projectId, projectId, data: { phase, failed: command.error !== void 0 } }, async (policy) => {
+        await require2(actor, "project.manage", { type: "project", id: projectId, projectId }, policy);
+        const { recorded } = unwrap(await write2.reportInitStatus({ projectId, phase, error: command.error ?? null }));
+        return { value: { recorded }, replayed: false };
+      });
+    },
     async setRepoDefaultBranch(actor, command) {
       const { projectId, name } = command;
       const revision = asRevision(command.revision);
@@ -8623,14 +8785,14 @@ function buildQueueDag(tasks, isSatisfiedOutside = () => false) {
 function stableTopoOrder(currentOrder, dag) {
   const sortable = currentOrder.filter((k) => dag.before.has(k) && !dag.cycleKeys.has(k));
   const index = new Map(sortable.map((k, i) => [k, i]));
-  const pending4 = /* @__PURE__ */ new Map();
+  const pending5 = /* @__PURE__ */ new Map();
   const dependents = /* @__PURE__ */ new Map();
   for (const key of sortable) {
     const preds = [...dag.before.get(key) ?? []].filter(
       (p) => index.has(p)
       // cycle keys / out-of-order keys don't gate the sort
     );
-    pending4.set(key, preds.length);
+    pending5.set(key, preds.length);
     for (const p of preds) {
       const d = dependents.get(p) ?? [];
       d.push(key);
@@ -8638,7 +8800,7 @@ function stableTopoOrder(currentOrder, dag) {
     }
   }
   const ready = /* @__PURE__ */ new Set();
-  for (const [key, deg] of pending4) if (deg === 0) ready.add(key);
+  for (const [key, deg] of pending5) if (deg === 0) ready.add(key);
   const out = [];
   while (ready.size > 0) {
     let best = null;
@@ -8648,8 +8810,8 @@ function stableTopoOrder(currentOrder, dag) {
     ready.delete(best);
     out.push(best);
     for (const dep of dependents.get(best) ?? []) {
-      const deg = pending4.get(dep) - 1;
-      pending4.set(dep, deg);
+      const deg = pending5.get(dep) - 1;
+      pending5.set(dep, deg);
       if (deg === 0) ready.add(dep);
     }
   }
@@ -10331,8 +10493,8 @@ async function saveDeliveries(db, taskId2, sourceJobId, deliveries) {
   if (deliveries.length === 0) return;
   const now = Date.now();
   for (const d of deliveries) {
-    const pending4 = pendingRelayRevision(d);
-    const unpublished = pending4 !== null;
+    const pending5 = pendingRelayRevision(d);
+    const unpublished = pending5 !== null;
     await db.run(
       `INSERT INTO task_deliveries
          (task_id, repo_name, delivery_ref, delivery_sha, base_sha, changed_files_json, source_job_id, created_at,
@@ -10355,7 +10517,7 @@ async function saveDeliveries(db, taskId2, sourceJobId, deliveries) {
       JSON.stringify(d.changedFiles ?? []),
       sourceJobId,
       now,
-      pending4 && pending4 !== "unusable" ? JSON.stringify(pending4) : null,
+      pending5 && pending5 !== "unusable" ? JSON.stringify(pending5) : null,
       unpublished ? null : now
     );
   }
@@ -10820,7 +10982,20 @@ var init_auth = __esm({
 });
 
 // src/sandbox-reg-tokens.ts
+import { createHash as createHash2 } from "node:crypto";
 import { nanoid as nanoid7 } from "nanoid";
+function hashSandboxRegToken(secret) {
+  return createHash2("sha256").update(secret, "utf8").digest("hex");
+}
+async function issueEphemeralSandboxRegToken(db, email, ttlMs = EPHEMERAL_REG_TOKEN_TTL_MS) {
+  const normalized = email.trim().toLowerCase();
+  const secret = `sbxreg_${nanoid7(48)}`;
+  const now = Date.now();
+  const expiresAt = now + ttlMs;
+  await db.run(`INSERT INTO sandbox_reg_tokens (token_hash, email, user_id, created_at, expires_at)
+     VALUES (?, ?, (SELECT id FROM users WHERE email = ?), ?, ?)`, hashSandboxRegToken(secret), normalized, normalized, now, expiresAt);
+  return { secret, expiresAt };
+}
 var EPHEMERAL_REG_TOKEN_TTL_MS;
 var init_sandbox_reg_tokens = __esm({
   "src/sandbox-reg-tokens.ts"() {
@@ -10886,6 +11061,9 @@ async function getInitStatus(db, projectId) {
 async function write(db, projectId, status) {
   await db.run(`UPDATE projects SET init_status_json = ? WHERE id = ?`, JSON.stringify(status), projectId);
 }
+async function beginInitTracking(db, projectId, phase) {
+  await write(db, projectId, { phase, updatedAt: Date.now() });
+}
 async function advanceInitPhase(db, projectId, phase) {
   const cur = await getInitStatus(db, projectId);
   if (!cur) return false;
@@ -11113,6 +11291,25 @@ var init_state_machine2 = __esm({
 });
 
 // src/abuse-throttle.ts
+function createAbuseThrottle(opts) {
+  const hits = /* @__PURE__ */ new Map();
+  return {
+    take(key) {
+      const now = Date.now();
+      const entry = hits.get(key);
+      if (!entry || entry.resetAt <= now) {
+        hits.set(key, { count: 1, resetAt: now + opts.windowMs });
+        return true;
+      }
+      if (entry.count >= opts.max) return false;
+      entry.count += 1;
+      return true;
+    },
+    reset() {
+      hits.clear();
+    }
+  };
+}
 var init_abuse_throttle = __esm({
   "src/abuse-throttle.ts"() {
     "use strict";
@@ -11143,16 +11340,104 @@ var init_sandbox2 = __esm({
     init_sealedbox();
     init_abuse_throttle();
     init_auth();
-    init_cli_auth();
     init_sandbox_reg_tokens();
     init_users();
     init_agent_auth_probe();
     init_ws();
+    init_route_registry();
   }
 });
 
-// src/farm/pool-spec.ts
+// src/routes/farm.ts
 import { nanoid as nanoid11 } from "nanoid";
+function viewerInAssignments(viewer, assignments) {
+  return assignments.some(
+    (a) => viewer.userId !== null && a.userId === viewer.userId || a.email !== null && a.email === viewer.email
+  );
+}
+async function viewerOwnsFarm(db, viewer, farmId) {
+  const row = await db.get(
+    `SELECT 1 FROM farm_assignments
+      WHERE farm_id = ? AND (user_id = ? OR email = ?) LIMIT 1`,
+    farmId,
+    viewer.userId,
+    viewer.email
+  );
+  return !!row;
+}
+async function listFarms(db, viewer) {
+  const online = new Set(listConnectedFarmIds());
+  const rows = await db.all(`SELECT f.id, f.name, f.public_key as publicKey,
+              f.key_fingerprint as keyFingerprint, f.last_seen_at as lastSeenAt,
+              a.user_id as aUserId, a.email as aEmail
+       FROM farms f LEFT JOIN farm_assignments a ON a.farm_id = f.id
+       ORDER BY f.registered_at ASC`);
+  const byId = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    let farm = byId.get(r.id);
+    if (!farm) {
+      farm = {
+        farmId: r.id,
+        name: r.name,
+        publicKey: r.publicKey,
+        keyFingerprint: r.keyFingerprint,
+        online: online.has(r.id),
+        lastSeenAt: r.lastSeenAt,
+        assignments: []
+      };
+      byId.set(r.id, farm);
+    }
+    if (r.aUserId !== null || r.aEmail !== null) {
+      farm.assignments.push({ userId: r.aUserId, email: r.aEmail });
+    }
+  }
+  return [...byId.values()].filter((f) => !viewer || viewer.isSuperAdmin || viewerInAssignments(viewer, f.assignments)).map(({ assignments: _assignments, ...f }) => f);
+}
+var init_farm2 = __esm({
+  "src/routes/farm.ts"() {
+    "use strict";
+    init_sealedbox();
+    init_abuse_throttle();
+    init_ws();
+    init_route_registry();
+  }
+});
+
+// src/runner-reg-tokens.ts
+import { nanoid as nanoid12 } from "nanoid";
+var init_runner_reg_tokens = __esm({
+  "src/runner-reg-tokens.ts"() {
+    "use strict";
+  }
+});
+
+// src/routes/runner.ts
+import { nanoid as nanoid13 } from "nanoid";
+async function viewerOwnsRunner(db, viewer, runnerId) {
+  const row = await db.get(
+    `SELECT 1 FROM runners WHERE id = ? AND (owner_user_id = ? OR owner_email = ?) LIMIT 1`,
+    runnerId,
+    viewer.userId,
+    viewer.email
+  );
+  return !!row;
+}
+var init_runner2 = __esm({
+  "src/routes/runner.ts"() {
+    "use strict";
+    init_sealedbox();
+    init_abuse_throttle();
+    init_cli_auth();
+    init_auth();
+    init_users();
+    init_runner_reg_tokens();
+    init_ws();
+    init_route_registry();
+  }
+});
+
+// src/farm/pool-spec.ts
+import { nanoid as nanoid14 } from "nanoid";
 async function computeFarmPoolSpec(db, farmId) {
   const rows = await db.all(
     `SELECT fa.user_id as userId, fa.max_sandboxes as quota,
@@ -11184,7 +11469,7 @@ async function computeFarmPoolSpec(db, farmId) {
   return spec;
 }
 function buildSyncWorkerPoolMessage(accounts) {
-  return { type: "sync_worker_pool", requestId: nanoid11(16), accounts };
+  return { type: "sync_worker_pool", requestId: nanoid14(16), accounts };
 }
 var init_pool_spec = __esm({
   "src/farm/pool-spec.ts"() {
@@ -11192,127 +11477,6 @@ var init_pool_spec = __esm({
   }
 });
 
-// src/farm/provision.ts
-import { nanoid as nanoid12 } from "nanoid";
-function awaitResult(requestId2, send, timeoutMs) {
-  if (!send()) return Promise.reject(new Error("farm_offline"));
-  return new Promise((resolve2, reject) => {
-    const timer = setTimeout(() => {
-      pending.delete(requestId2);
-      reject(new Error("farm_timeout"));
-    }, timeoutMs);
-    pending.set(requestId2, { resolve: resolve2, reject, timer });
-  });
-}
-function requestDelete(farmId, projectId, timeoutMs) {
-  const requestId2 = nanoid12(16);
-  return awaitResult(
-    requestId2,
-    () => sendToFarm(farmId, { type: "delete_project", requestId: requestId2, projectId }),
-    timeoutMs
-  );
-}
-async function requestFarmPoolSync(db, farmId) {
-  const accounts = await computeFarmPoolSpec(db, farmId);
-  sendToFarm(farmId, buildSyncWorkerPoolMessage(accounts));
-}
-var pending;
-var init_provision = __esm({
-  "src/farm/provision.ts"() {
-    "use strict";
-    init_ws();
-    init_pool_spec();
-    pending = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/routes/farm.ts
-import { nanoid as nanoid13 } from "nanoid";
-var init_farm2 = __esm({
-  "src/routes/farm.ts"() {
-    "use strict";
-    init_sealedbox();
-    init_abuse_throttle();
-    init_cli_auth();
-    init_auth();
-    init_users();
-    init_init_status();
-    init_ws();
-    init_provision();
-  }
-});
-
-// src/runner-reg-tokens.ts
-import { nanoid as nanoid14 } from "nanoid";
-var init_runner_reg_tokens = __esm({
-  "src/runner-reg-tokens.ts"() {
-    "use strict";
-  }
-});
-
-// src/runner/provision.ts
-import { nanoid as nanoid15 } from "nanoid";
-var init_provision2 = __esm({
-  "src/runner/provision.ts"() {
-    "use strict";
-    init_ws();
-  }
-});
-
-// src/runner/bindings.ts
-function parseGhRunnerBindings(json) {
-  if (!json) return [];
-  try {
-    const parsed = JSON.parse(json);
-    return Array.isArray(parsed.bindings) ? parsed.bindings : [];
-  } catch {
-    return [];
-  }
-}
-function serialize(bindings) {
-  return JSON.stringify({ bindings });
-}
-async function removeGhRunnerBinding(db, projectId, owner, repo) {
-  return db.tx(async (tx) => {
-    const row = await tx.get(
-      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
-      projectId
-    );
-    if (!row) return false;
-    const bindings = parseGhRunnerBindings(row.bindingsJson);
-    const kept = bindings.filter((b) => !(b.owner === owner && b.repo === repo));
-    if (kept.length === bindings.length) return false;
-    await tx.run(
-      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
-      serialize(kept),
-      projectId
-    );
-    return true;
-  });
-}
-var init_bindings = __esm({
-  "src/runner/bindings.ts"() {
-    "use strict";
-  }
-});
-
-// src/routes/runner.ts
-import { nanoid as nanoid16 } from "nanoid";
-var init_runner2 = __esm({
-  "src/routes/runner.ts"() {
-    "use strict";
-    init_sealedbox();
-    init_abuse_throttle();
-    init_cli_auth();
-    init_auth();
-    init_users();
-    init_runner_reg_tokens();
-    init_ws();
-    init_provision2();
-    init_bindings();
-  }
-});
-
 // src/routes/ws.ts
 function sendToDeliveryFollowers(projectId, message) {
   const payload = JSON.stringify(message);
@@ -11356,6 +11520,13 @@ function sendToFarm(farmId, message) {
 function listConnectedFarmIds() {
   return [...farmConnections.keys()];
 }
+function sendToRunner(runnerId, message) {
+  const conn = runnerConnections.get(runnerId);
+  if (!conn) return false;
+  if (conn.socket.readyState !== conn.socket.OPEN) return false;
+  conn.socket.send(JSON.stringify(message));
+  return true;
+}
 function getProjectCliOrigin(projectId) {
   return projectCliConnections.get(projectId)?.origin ?? null;
 }
@@ -11598,7 +11769,7 @@ async function getPresence(db, viewer) {
     })()
   };
 }
-var agentLoginProviders, deliveryFollowers, projectCliConnections, projectLastSeenAt, projectLastDuplicateRegisterAt, sandboxConnections, farmConnections, cliMessageHandlers, cliRegisterHandlers;
+var agentLoginProviders, deliveryFollowers, projectCliConnections, projectLastSeenAt, projectLastDuplicateRegisterAt, sandboxConnections, farmConnections, runnerConnections, cliMessageHandlers, cliRegisterHandlers;
 var init_ws = __esm({
   "src/routes/ws.ts"() {
     "use strict";
@@ -11624,6 +11795,7 @@ var init_ws = __esm({
     projectLastDuplicateRegisterAt = /* @__PURE__ */ new Map();
     sandboxConnections = /* @__PURE__ */ new Map();
     farmConnections = /* @__PURE__ */ new Map();
+    runnerConnections = /* @__PURE__ */ new Map();
     cliMessageHandlers = /* @__PURE__ */ new Set();
     cliRegisterHandlers = /* @__PURE__ */ new Set();
   }
@@ -11751,7 +11923,7 @@ var init_policy = __esm({
 });
 
 // src/apply/merge-branch.ts
-import { nanoid as nanoid17 } from "nanoid";
+import { nanoid as nanoid15 } from "nanoid";
 async function enqueueMergeBranch(db, taskId2, log) {
   if (await hasInflightMergeBranch(db, taskId2)) {
     log.info({ taskId: taskId2 }, "merge_branch ignored \u2014 chain already in flight");
@@ -11768,7 +11940,7 @@ async function enqueueMergeBranch(db, taskId2, log) {
   const now = Date.now();
   const ids = [];
   for (const t of targets) {
-    const id = `wa_${nanoid17(12)}`;
+    const id = `wa_${nanoid15(12)}`;
     const action = {
       type: "merge_branch",
       taskId: taskId2,
@@ -11849,7 +12021,7 @@ var init_merge_branch = __esm({
 });
 
 // src/apply/publish-delivery.ts
-import { nanoid as nanoid18 } from "nanoid";
+import { nanoid as nanoid16 } from "nanoid";
 async function enqueuePublishDeliveries(db, taskId2, log) {
   const unpublished = await unpublishedDeliveries(db, taskId2);
   const unusable = unpublished.filter((p) => p.revision === null);
@@ -11860,8 +12032,8 @@ async function enqueuePublishDeliveries(db, taskId2, log) {
     };
   }
   const inFlight2 = await inFlightPublications(db, taskId2);
-  const pending4 = unpublished.filter((p) => inFlight2.get(p.repoName) !== p.revision?.sha);
-  if (pending4.length === 0) return { queued: 0 };
+  const pending5 = unpublished.filter((p) => inFlight2.get(p.repoName) !== p.revision?.sha);
+  if (pending5.length === 0) return { queued: 0 };
   const projectId = taskId2.split(":", 2)[0] ?? "";
   const contextRepoCloneUrl = await contextRepoCloneUrlOf(db, projectId);
   if (!contextRepoCloneUrl) {
@@ -11870,8 +12042,8 @@ async function enqueuePublishDeliveries(db, taskId2, log) {
   }
   const now = Date.now();
   const ids = [];
-  for (const p of pending4) {
-    const id = `wa_${nanoid18(12)}`;
+  for (const p of pending5) {
+    const id = `wa_${nanoid16(12)}`;
     const action = {
       type: "publish_delivery",
       taskId: taskId2,
@@ -12239,10 +12411,10 @@ __export(regimen_config_exports, {
   loadWorkflowSettings: () => loadWorkflowSettings,
   loadYouTrackWrites: () => loadYouTrackWrites
 });
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { parse as parseYaml2 } from "yaml";
 function contentSha2(content) {
-  return createHash2("sha1").update(content, "utf-8").digest("hex");
+  return createHash3("sha1").update(content, "utf-8").digest("hex");
 }
 async function applyRegimenContent(db, projectId, content, log, preParsed) {
   const previous = cache3.get(projectId) ?? null;
@@ -13132,7 +13304,7 @@ var init_settings = __esm({
 });
 
 // src/jobs/queue.ts
-import { nanoid as nanoid19 } from "nanoid";
+import { nanoid as nanoid17 } from "nanoid";
 async function heldByTrancheDeferral(db) {
   const rows = await db.all(
     `SELECT t.id AS id FROM tasks t
@@ -13204,7 +13376,7 @@ async function restampQueuedJobs(db, projectId) {
   return restamped;
 }
 async function createJob(db, input) {
-  const id = `job_${nanoid19(16)}`;
+  const id = `job_${nanoid17(16)}`;
   const now = Date.now();
   const projectRepos = await loadProjectRepoRefs(db, input.projectId);
   const metadata = {
@@ -13405,7 +13577,7 @@ async function claimNextJob(db, sandboxId, capabilities, lane) {
         data: e.data
       });
     },
-    newExecutionId: () => `exe_${nanoid19(16)}`,
+    newExecutionId: () => `exe_${nanoid17(16)}`,
     // DEV-49/DEV-221: stack the worktree on the predecessor's branch so the
     // agent (and the resulting meta/bases.json baseSha) start from the chain
     // tip, not the repo default. Applies to analyze/estimate/implement — a
@@ -13671,7 +13843,7 @@ var init_legacy_cred_bundles = __esm({
 });
 
 // src/db/schema.ts
-import { nanoid as nanoid20 } from "nanoid";
+import { nanoid as nanoid18 } from "nanoid";
 async function ensureColumn(db, table, column, ddl) {
   const row = await db.get(
     `SELECT 1 FROM information_schema.columns WHERE table_name = ? AND column_name = ?`,
@@ -13980,7 +14152,7 @@ async function initSchema(db) {
   await ensureColumn(db, "projects", "init_status_json", "init_status_json TEXT");
   await ensureColumn(db, "users", "id", "id TEXT");
   for (const row of await db.all(`SELECT email FROM users WHERE id IS NULL`)) {
-    await db.run(`UPDATE users SET id = ? WHERE email = ?`, `usr_${nanoid20(12)}`, row.email);
+    await db.run(`UPDATE users SET id = ? WHERE email = ?`, `usr_${nanoid18(12)}`, row.email);
   }
   await db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_users_id ON users(id)`);
   await ensureColumn(db, "projects", "owner_user_id", "owner_user_id TEXT");
@@ -14064,7 +14236,7 @@ async function initSchema(db) {
       await db.run(
         `INSERT INTO context_outbox (id, project_id, ordinal, files_json, message, state, created_at)
          VALUES (?, ?, ?, ?, 'migration: legacy display diffs', 'pending', ?)`,
-        `ctx_${nanoid20(16)}`,
+        `ctx_${nanoid18(16)}`,
         projectId,
         next.next,
         JSON.stringify(files),
@@ -15898,27 +16070,27 @@ var init_delivery_decision = __esm({
 });
 
 // src/projects/context-read.ts
-import { nanoid as nanoid21 } from "nanoid";
+import { nanoid as nanoid19 } from "nanoid";
 function requestContextFile(projectId, path, timeoutMs = DEFAULT_TIMEOUT_MS, send = sendToProjectCli) {
   const action = { type: "read_context_file", projectId, path };
-  const actionId2 = `rdctx_${nanoid21(16)}`;
+  const actionId2 = `rdctx_${nanoid19(16)}`;
   if (!send(projectId, { type: "dispatch_action", actionId: actionId2, action })) {
     return Promise.reject(new Error("cli_offline"));
   }
   return new Promise((resolve2, reject) => {
     const timer = setTimeout(() => {
-      pending2.delete(actionId2);
+      pending.delete(actionId2);
       reject(new Error("cli_timeout"));
     }, timeoutMs);
-    pending2.set(actionId2, { resolve: resolve2, reject, timer });
+    pending.set(actionId2, { resolve: resolve2, reject, timer });
   });
 }
-var pending2, DEFAULT_TIMEOUT_MS;
+var pending, DEFAULT_TIMEOUT_MS;
 var init_context_read = __esm({
   "src/projects/context-read.ts"() {
     "use strict";
     init_ws();
-    pending2 = /* @__PURE__ */ new Map();
+    pending = /* @__PURE__ */ new Map();
     DEFAULT_TIMEOUT_MS = 2e4;
   }
 });
@@ -15963,14 +16135,14 @@ async function recordVerdicts(db, taskId2, verdicts) {
   return current;
 }
 function decidePlan(plan, verdicts) {
-  const pending4 = plan.items.filter((i) => !(i.id in verdicts)).map((i) => i.id);
+  const pending5 = plan.items.filter((i) => !(i.id in verdicts)).map((i) => i.id);
   const list = plan.items.map((i) => verdicts[i.id]).filter((v) => !!v);
-  const approved = pending4.length === 0 && list.every((v) => v.approved);
+  const approved = pending5.length === 0 && list.every((v) => v.approved);
   return {
-    complete: pending4.length === 0,
-    pending: pending4,
+    complete: pending5.length === 0,
+    pending: pending5,
     approved,
-    rework: pending4.length === 0 ? compilePlanRework(plan, list) : ""
+    rework: pending5.length === 0 ? compilePlanRework(plan, list) : ""
   };
 }
 function describeDecision(d) {
@@ -16108,7 +16280,7 @@ var init_project_access = __esm({
 });
 
 // src/projects/regimen-write.ts
-import { nanoid as nanoid22 } from "nanoid";
+import { nanoid as nanoid20 } from "nanoid";
 function dispatchSetYouTrackConfig(db, projectId, payload, log) {
   const action = {
     type: "set_youtrack_config",
@@ -16116,7 +16288,7 @@ function dispatchSetYouTrackConfig(db, projectId, payload, log) {
     ...payload,
     commitMessage: `chore(youtrack): update YT config (dashboard)`
   };
-  const actionId2 = `ytcfg_${nanoid22(16)}`;
+  const actionId2 = `ytcfg_${nanoid20(16)}`;
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (!sent) {
     log.warn({ projectId, actionId: actionId2 }, "dispatchSetYouTrackConfig: CLI not connected");
@@ -16132,7 +16304,7 @@ function dispatchSetRepoDefaultBranch(db, projectId, repoName, defaultBranch, lo
     repoName,
     defaultBranch
   };
-  const actionId2 = `repocfg_${nanoid22(16)}`;
+  const actionId2 = `repocfg_${nanoid20(16)}`;
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (!sent) {
     log.warn({ projectId, actionId: actionId2 }, "dispatchSetRepoDefaultBranch: CLI not connected");
@@ -16152,7 +16324,7 @@ function dispatchSetProjectSetting(db, projectId, edits, log, opts) {
     edits,
     commitMessage: opts?.commitMessage ?? "chore(settings): update project settings (dashboard)"
   };
-  const actionId2 = `${prefix}${nanoid22(16)}`;
+  const actionId2 = `${prefix}${nanoid20(16)}`;
   if (prefix === "setg_") rememberSettingsDispatch(actionId2, edits);
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (!sent) {
@@ -16164,7 +16336,7 @@ function dispatchSetProjectSetting(db, projectId, edits, log, opts) {
 }
 function dispatchSetBudgetSource(db, projectId, source, log) {
   const action = { type: "set_budget_source", projectId, source };
-  const actionId2 = `bsrc_${nanoid22(16)}`;
+  const actionId2 = `bsrc_${nanoid20(16)}`;
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (!sent) log.warn({ projectId, actionId: actionId2 }, "dispatchSetBudgetSource: CLI not connected");
   else log.info({ projectId, actionId: actionId2, kind: source.kind }, "dispatchSetBudgetSource: sent to CLI");
@@ -16186,7 +16358,7 @@ function dispatchEditTrackerIssue(db, projectId, fields, log) {
     ...fields.title !== void 0 ? { title: fields.title } : {},
     ...fields.body !== void 0 ? { body: fields.body } : {}
   };
-  const actionId2 = `tedit_${nanoid22(16)}`;
+  const actionId2 = `tedit_${nanoid20(16)}`;
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (!sent) {
     log.warn({ projectId, actionId: actionId2, issueKey: fields.issueKey }, "dispatchEditTrackerIssue: CLI not connected");
@@ -16206,21 +16378,21 @@ var init_regimen_write = __esm({
 });
 
 // src/tasks/context-outbox.ts
-import { nanoid as nanoid23 } from "nanoid";
+import { nanoid as nanoid21 } from "nanoid";
 async function nextOrdinal(db, projectId) {
   const row = await db.get(`SELECT COALESCE(MAX(ordinal), 0) AS max FROM context_outbox WHERE project_id = ?`, projectId);
   return row.max + 1;
 }
 async function enqueueContextWrite(db, projectId, files, message, log) {
   if (files.length === 0) return;
-  const id = `ctx_${nanoid23(16)}`;
+  const id = `ctx_${nanoid21(16)}`;
   await db.run(`INSERT INTO context_outbox (id, project_id, ordinal, files_json, message, state, created_at)
      VALUES (?, ?, ?, ?, ?, 'pending', ?)`, id, projectId, await nextOrdinal(db, projectId), JSON.stringify(files), message, Date.now());
   await dispatchNextContextWrite(db, projectId, log);
 }
 async function enqueueAdrPromote(db, projectId, taskKey, slugs, log, source = "task") {
   if (slugs.length === 0) return;
-  const id = `ctx_${nanoid23(16)}`;
+  const id = `ctx_${nanoid21(16)}`;
   await db.run(`INSERT INTO context_outbox (id, project_id, ordinal, files_json, message, state, kind, meta_json, created_at)
      VALUES (?, ?, ?, ?, ?, 'pending', 'adr_promote', ?, ?)`, id, projectId, await nextOrdinal(db, projectId), JSON.stringify(slugs), `adr(${taskKey}): promote ${slugs.join(", ")}`, JSON.stringify({ taskKey, source }), Date.now());
   await dispatchNextContextWrite(db, projectId, log);
@@ -16625,10 +16797,10 @@ __export(cluster_journal_exports, {
   clusterJournal: () => clusterJournal,
   recordClusterEvent: () => recordClusterEvent
 });
-import { nanoid as nanoid24 } from "nanoid";
+import { nanoid as nanoid22 } from "nanoid";
 async function recordClusterEvent(db, projectId, anchorKey, kind, detail) {
   await engineStore(db).clusters.appendEvent(
-    `ce_${nanoid24(12)}`,
+    `ce_${nanoid22(12)}`,
     projectId,
     anchorKey,
     kind,
@@ -16696,7 +16868,7 @@ __export(cluster_recovery_exports, {
   reconcileClusterRecoveries: () => reconcileClusterRecoveries,
   startClusterRecovery: () => startClusterRecovery
 });
-import { nanoid as nanoid25 } from "nanoid";
+import { nanoid as nanoid23 } from "nanoid";
 async function startClusterRecovery(db, task, instruction, log, opts = {}) {
   const anchorKey = await clusterAnchorFor(db, task);
   const cluster = await getCluster(db, task.projectId, anchorKey);
@@ -17054,7 +17226,7 @@ async function dropCluster(db, task, cluster, reason, log, opts = {}) {
     if (carrier) {
       const now = Date.now();
       for (const t of await loadCreatePRTargets(db, carrier)) {
-        const id = `wa_${nanoid25(12)}`;
+        const id = `wa_${nanoid23(12)}`;
         const action = {
           type: "close_pr",
           taskId: carrier,
@@ -17173,7 +17345,7 @@ __export(tasks_exports, {
   queueTrackerStatusMove: () => queueTrackerStatusMove,
   tasksRoutes: () => tasksRoutes
 });
-import { nanoid as nanoid26 } from "nanoid";
+import { nanoid as nanoid24 } from "nanoid";
 async function queueTrackerStatusMove(db, log, taskId2, projectId, newStatus, manual = false) {
   const projectRow = await db.get(`SELECT automation_level as automationLevel FROM projects WHERE id = ?`, projectId);
   const writes = await loadYouTrackWrites(
@@ -17188,7 +17360,7 @@ async function queueTrackerStatusMove(db, log, taskId2, projectId, newStatus, ma
     newStatus,
     ...manual ? { manual: true } : {}
   };
-  const statusActionId = `wa_${nanoid26(12)}`;
+  const statusActionId = `wa_${nanoid24(12)}`;
   await engineStore(db).actions.appendPlan(
     taskId2,
     [{ id: statusActionId, kind: "tracker_status", payloadJson: JSON.stringify(action) }],
@@ -18037,7 +18209,7 @@ async function tasksRoutes(app, deps) {
       }
       await ingestComment(db, {
         taskId: taskId2,
-        trackerCommentId: `${DASHBOARD_PLACEHOLDER_PREFIX}${nanoid26(8)}`,
+        trackerCommentId: `${DASHBOARD_PLACEHOLDER_PREFIX}${nanoid24(8)}`,
         author: session.email,
         body: req.body.comment,
         origin: "dashboard",
@@ -18195,7 +18367,7 @@ async function tasksRoutes(app, deps) {
       if (!task) return reply.status(404).send({ error: "task_not_found" });
       const ingest = await ingestComment(db, {
         taskId: taskId2,
-        trackerCommentId: `${DASHBOARD_PLACEHOLDER_PREFIX}${nanoid26(8)}`,
+        trackerCommentId: `${DASHBOARD_PLACEHOLDER_PREFIX}${nanoid24(8)}`,
         author: session.email,
         body: req.body.body,
         origin: "dashboard",
@@ -18264,7 +18436,7 @@ ${req.body.body}
           // comments.jsonl; YouTrack ignores it (the token owner authors).
           author: session.email
         };
-        mirrorActionId = `wa_${nanoid26(12)}`;
+        mirrorActionId = `wa_${nanoid24(12)}`;
         await engineStore(db).actions.appendPlan(
           taskId2,
           [{ id: mirrorActionId, kind: "tracker_comment", payloadJson: JSON.stringify(action) }],
@@ -18455,7 +18627,7 @@ __export(observer_exports, {
   stampTranche: () => stampTranche,
   startStagedBatch: () => startStagedBatch
 });
-import { nanoid as nanoid27 } from "nanoid";
+import { nanoid as nanoid25 } from "nanoid";
 async function loadContextRepo2(db, projectId) {
   const row = await db.get(
     `SELECT context_repo_json AS json FROM projects WHERE id = ?`,
@@ -18500,7 +18672,7 @@ async function enqueueObserverJob(db, batch, log, opts = {}) {
   return spec.jobId;
 }
 async function stampTranche(db, taskIds) {
-  const trancheId = `tr_${nanoid27(12)}`;
+  const trancheId = `tr_${nanoid25(12)}`;
   for (const id of taskIds) {
     await engineStore(db).tasks.stampTrancheMembership(id, trancheId);
   }
@@ -18926,7 +19098,7 @@ var init_queue_view = __esm({
 });
 
 // src/tasks/cluster-order.ts
-import { nanoid as nanoid28 } from "nanoid";
+import { nanoid as nanoid26 } from "nanoid";
 function chainLess2(a, b) {
   const aq = a.queuePosition ?? Number.MAX_SAFE_INTEGER;
   const bq = b.queuePosition ?? Number.MAX_SAFE_INTEGER;
@@ -19032,7 +19204,7 @@ function dispatchProposedLinks(db, log, projectId, anchorKey, addLinks, memberKe
     links.push({ sourceIssueKey: source, rel: "depends_on", targetIssueKey: target });
   }
   if (links.length === 0) return;
-  const actionId2 = `clnk_${nanoid28(16)}`;
+  const actionId2 = `clnk_${nanoid26(16)}`;
   const action = { type: "apply_tracker_links", draftId: actionId2, projectId, links };
   const sent = sendToProjectCli(projectId, { type: "dispatch_action", actionId: actionId2, action });
   if (sent) {
@@ -19058,9 +19230,9 @@ var init_cluster_order = __esm({
 });
 
 // src/prompts/prompt-cache.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function contentSha3(content) {
-  return createHash3("sha1").update(content, "utf-8").digest("hex");
+  return createHash4("sha1").update(content, "utf-8").digest("hex");
 }
 function getProjectPromptTemplate(projectId, role) {
   return cache4.get(projectId)?.get(role)?.content ?? null;
@@ -21020,7 +21192,7 @@ __export(cluster_finalize_exports, {
   maybeFinalizeCluster: () => maybeFinalizeCluster,
   recordClusterPrCreated: () => recordClusterPrCreated
 });
-import { nanoid as nanoid29 } from "nanoid";
+import { nanoid as nanoid27 } from "nanoid";
 async function isFullAutomation2(db, projectId) {
   const row = await db.get(`SELECT automation_level as automationLevel FROM projects WHERE id = ?`, projectId);
   return row?.automationLevel === "full";
@@ -21041,7 +21213,7 @@ async function loadMergePolicy2(db, projectId) {
   };
 }
 async function enqueueAndDispatch(db, taskId2, action, log) {
-  const id = `wa_${nanoid29(12)}`;
+  const id = `wa_${nanoid27(12)}`;
   await engineStore(db).actions.appendPlan(
     taskId2,
     [{ id, kind: action.type, payloadJson: JSON.stringify(action) }],
@@ -21771,7 +21943,7 @@ __export(tracking_commands_exports, {
   handleUpdatePr: () => handleUpdatePr,
   loadCreatePRTargets: () => loadCreatePRTargets
 });
-import { nanoid as nanoid30 } from "nanoid";
+import { nanoid as nanoid28 } from "nanoid";
 async function loadCreatePRTargets(db, taskId2) {
   const rows = await db.all(`SELECT payload_json AS payloadJson, result_json AS resultJson
          FROM write_actions
@@ -21871,7 +22043,7 @@ async function handleApprove(db, task, log) {
   const now = Date.now();
   const ids = [];
   for (const t of targets) {
-    const id = `wa_${nanoid30(12)}`;
+    const id = `wa_${nanoid28(12)}`;
     const action = {
       type: "merge_pr",
       taskId: chainTaskId,
@@ -22059,7 +22231,7 @@ async function handleClusterReject(db, task, comment, log) {
       if (carrier) {
         const now = Date.now();
         for (const t of await loadCreatePRTargets(db, carrier)) {
-          const id = `wa_${nanoid30(12)}`;
+          const id = `wa_${nanoid28(12)}`;
           const action = {
             type: "close_pr",
             taskId: carrier,
@@ -22084,7 +22256,7 @@ async function handleClusterReject(db, task, comment, log) {
   if (deliveredRepos.size > 0) {
     const now = Date.now();
     for (const repoName of deliveredRepos) {
-      const id = `wa_${nanoid30(12)}`;
+      const id = `wa_${nanoid28(12)}`;
       const action = {
         type: "rewrite_cluster_branch",
         taskId: owner.id,
@@ -22658,7 +22830,7 @@ __export(lifecycle_exports, {
   taskRunsDirectImplement: () => taskRunsDirectImplement,
   triggerRework: () => triggerRework
 });
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 async function reconcileStuckTasks(db, log) {
   let recovered = 0;
   for (const task of await listTasks(db)) {
@@ -23253,7 +23425,7 @@ async function maybeAwaitingAnswer(db, task, log, blockingQuestions = []) {
   if (blocking.length === 0) return false;
   const now = Date.now();
   for (let i = 0; i < blocking.length; i++) {
-    const digest2 = createHash4("sha256").update(blocking[i]).digest("hex").slice(0, 12);
+    const digest2 = createHash5("sha256").update(blocking[i]).digest("hex").slice(0, 12);
     await ingestComment(db, {
       taskId: task.id,
       trackerCommentId: `agent:${task.phase.toLowerCase()}:${i}:${digest2}`,
@@ -24645,25 +24817,25 @@ async function requestGrantsFrom(spec, recipient, bindingVersion, log, timeoutMs
   const requestId2 = msg.requestId;
   return await new Promise((resolve2) => {
     const timer = setTimeout(() => {
-      pending3.delete(requestId2);
+      pending2.delete(requestId2);
       log.warn({ projectId: spec.projectId, jobId: spec.jobId, sandboxId: recipient.sandboxId }, "credential grants: CLI did not answer in time");
       resolve2(null);
     }, timeoutMs);
-    pending3.set(requestId2, {
+    pending2.set(requestId2, {
       projectId: spec.projectId,
       jobId: spec.jobId,
       sandboxId: recipient.sandboxId,
       holder,
       resolve: (answer) => {
         clearTimeout(timer);
-        pending3.delete(requestId2);
+        pending2.delete(requestId2);
         resolve2(answer);
       }
     });
     const sent = holder.kind === "provider" ? sendToAgentLoginProvider(holder.ownerKey, holder.providerId, msg) : sendToProjectCli(spec.projectId, msg);
     if (!sent) {
       clearTimeout(timer);
-      pending3.delete(requestId2);
+      pending2.delete(requestId2);
       resolve2(null);
     }
   });
@@ -24775,7 +24947,7 @@ async function sweepExpiredGrants(db, now = Date.now()) {
   const { changes } = await db.run(`DELETE FROM credential_grants WHERE not_after <= ?`, now);
   return changes;
 }
-var GRANT_REQUEST_TIMEOUT_MS, pending3, LATE_ANSWER_TTL_MS, lateAnswers;
+var GRANT_REQUEST_TIMEOUT_MS, pending2, LATE_ANSWER_TTL_MS, lateAnswers;
 var init_credential_grants = __esm({
   "src/tracker/credential-grants.ts"() {
     "use strict";
@@ -24786,7 +24958,7 @@ var init_credential_grants = __esm({
     init_ws();
     init_sandbox_keys();
     GRANT_REQUEST_TIMEOUT_MS = 6e3;
-    pending3 = /* @__PURE__ */ new Map();
+    pending2 = /* @__PURE__ */ new Map();
     LATE_ANSWER_TTL_MS = 6e4;
     lateAnswers = /* @__PURE__ */ new Map();
   }
@@ -24840,7 +25012,7 @@ init_regimen_config();
 // src/projects/cred-updates.ts
 init_dist();
 init_ws();
-import { nanoid as nanoid31 } from "nanoid";
+import { nanoid as nanoid29 } from "nanoid";
 async function latestCredUpdates(db, projectId) {
   const rows = await db.all(
     `SELECT id, kind, state, detail, updated_at as updatedAt
@@ -24865,6 +25037,7 @@ async function latestCredUpdates(db, projectId) {
 
 // src/application/read-model.ts
 init_ws();
+init_farm2();
 init_queue_view();
 init_state_machine();
 init_delivery_decision();
@@ -25076,7 +25249,7 @@ function configProposalRow(stored) {
 }
 
 // src/config-proposals/state-machine.ts
-import { nanoid as nanoid32 } from "nanoid";
+import { nanoid as nanoid30 } from "nanoid";
 function rowToProposal(raw) {
   return {
     id: raw["id"],
@@ -25101,7 +25274,7 @@ var PROPOSAL_COLUMNS = `id, project_id as projectId, user_input as userInput, st
          created_at as createdAt, updated_at as updatedAt`;
 var PROPOSAL_SELECT = `SELECT ${PROPOSAL_COLUMNS} FROM config_proposals`;
 async function createProposal(db, projectId, userInput) {
-  const id = `cfp_${nanoid32(16)}`;
+  const id = `cfp_${nanoid30(16)}`;
   const now = Date.now();
   await db.run(
     `INSERT INTO config_proposals
@@ -25803,7 +25976,7 @@ async function projectDetailOf(db, projectId, raw) {
     actionErrors: getProjectActions(projectId)?.actionErrors ?? []
   };
 }
-function createReadModel(db) {
+function createReadModel(db, options = {}) {
   const SUBMISSION_COLUMNS = `${DRAFT_COLUMNS},
          (SELECT COUNT(*) FROM draft_tasks c WHERE c.parent_draft_id = draft_tasks.id) as childCount,
          EXISTS (SELECT 1 FROM tasks t
@@ -26495,6 +26668,35 @@ function createReadModel(db) {
       const p = await getPresence(db, { email: viewer.email ?? "", userId: viewer.subjectId });
       return presenceRowOf(p, new Set(viewer.projectIds));
     },
+    // --- the account's fleet (DEV-927) ---
+    async listFarms(viewer) {
+      const isOperator = viewer.email !== null && (options.isOperator?.(viewer.email) ?? false);
+      return await listFarms(db, { email: viewer.email ?? "", userId: viewer.subjectId, isSuperAdmin: isOperator });
+    },
+    async listProjectDeliverables(projectId) {
+      const rows = await db.all(
+        `SELECT id, tracker_issue_key AS "taskKey", title, phase, updated_at AS "updatedAt"
+           FROM tasks
+          WHERE project_id = ? AND (archived IS NULL OR archived = 0)
+            AND phase IN ('TRACKING', 'AWAITING_CLUSTER', 'DONE', 'NEEDS_MANUAL')
+          ORDER BY CASE WHEN phase IN ('TRACKING', 'AWAITING_CLUSTER') THEN 0 ELSE 1 END,
+                   updated_at DESC
+          LIMIT 50`,
+        projectId
+      );
+      const out = [];
+      for (const r of rows) {
+        const byRepo = await loadTaskBranchesByRepo(db, r.id);
+        const repos = Object.entries(byRepo).map(([repoName, b]) => ({
+          repoName,
+          branchName: b.branchName,
+          baseRef: b.baseRef
+        }));
+        if (repos.length === 0) continue;
+        out.push({ taskKey: r.taskKey, title: r.title, phase: r.phase, updatedAt: Number(r.updatedAt), repos });
+      }
+      return out;
+    },
     async readNotificationSettings(subjectId) {
       const user = await db.get(`SELECT 1 as hit FROM users WHERE id = ?`, subjectId);
       if (!user) return null;
@@ -26635,7 +26837,7 @@ function createAuthorizer(db, config) {
 // src/jobs/apply-result.ts
 init_apply_overrides();
 init_publish_delivery();
-import { nanoid as nanoid33 } from "nanoid";
+import { nanoid as nanoid31 } from "nanoid";
 
 // src/drafts/result-handler.ts
 init_dist();
@@ -27251,7 +27453,7 @@ async function applyJobResult(fx, job, result) {
            size_bytes = excluded.size_bytes,
            source_job_id = excluded.source_job_id,
            created_at = excluded.created_at`,
-        `art_${nanoid33(16)}`,
+        `art_${nanoid31(16)}`,
         job.taskId,
         a.path,
         encoding,
@@ -28018,7 +28220,7 @@ init_state_machine2();
 // src/drafts/publish.ts
 init_ws();
 init_state_machine2();
-import { nanoid as nanoid34 } from "nanoid";
+import { nanoid as nanoid32 } from "nanoid";
 function firstNonBlank(...vals) {
   for (const v of vals) {
     if (v != null && v.trim() !== "") return v;
@@ -28026,7 +28228,7 @@ function firstNonBlank(...vals) {
   return "";
 }
 async function dispatchPublish(db, draft, targetStatus, log) {
-  const publishActionId = `dpub_${nanoid34(16)}`;
+  const publishActionId = `dpub_${nanoid32(16)}`;
   const title = firstNonBlank(draft.editedTitle, draft.generatedTitle);
   const body = firstNonBlank(draft.editedBody, draft.generatedBody);
   const project = await db.get(`SELECT youtrack_project_key as youtrackProjectKey FROM projects WHERE id = ?`, draft.projectId);
@@ -28172,7 +28374,7 @@ async function maybeAdvancePackage(db, parentDraftId, log) {
     log.info({ draftId: parentDraftId }, "package published (no links) \u2192 DONE");
     return;
   }
-  const linkActionId = `dpkg_${nanoid34(16)}`;
+  const linkActionId = `dpkg_${nanoid32(16)}`;
   const action = {
     type: "apply_tracker_links",
     draftId: parentDraftId,
@@ -28252,7 +28454,85 @@ async function discardDraft(db, draft, log) {
 init_dist2();
 init_regimen_write();
 init_ws();
-init_provision();
+
+// src/farm/provision.ts
+init_ws();
+init_pool_spec();
+import { nanoid as nanoid33 } from "nanoid";
+var pending3 = /* @__PURE__ */ new Map();
+function awaitResult(requestId2, send, timeoutMs) {
+  if (!send()) return Promise.reject(new Error("farm_offline"));
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      pending3.delete(requestId2);
+      reject(new Error("farm_timeout"));
+    }, timeoutMs);
+    pending3.set(requestId2, { resolve: resolve2, reject, timer });
+  });
+}
+function requestProvision(farmId, projectId, sealedBundle, timeoutMs) {
+  const requestId2 = nanoid33(16);
+  return awaitResult(
+    requestId2,
+    () => sendToFarm(farmId, { type: "provision_project", requestId: requestId2, projectId, sealedBundle }),
+    timeoutMs
+  );
+}
+function requestDelete(farmId, projectId, timeoutMs) {
+  const requestId2 = nanoid33(16);
+  return awaitResult(
+    requestId2,
+    () => sendToFarm(farmId, { type: "delete_project", requestId: requestId2, projectId }),
+    timeoutMs
+  );
+}
+async function requestFarmPoolSync(db, farmId) {
+  const accounts = await computeFarmPoolSpec(db, farmId);
+  sendToFarm(farmId, buildSyncWorkerPoolMessage(accounts));
+}
+
+// src/runner/provision.ts
+init_ws();
+import { nanoid as nanoid34 } from "nanoid";
+var pending4 = /* @__PURE__ */ new Map();
+function awaitResult2(requestId2, send, timeoutMs) {
+  if (!send()) return Promise.reject(new Error("runner_offline"));
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      pending4.delete(requestId2);
+      reject(new Error("runner_timeout"));
+    }, timeoutMs);
+    pending4.set(requestId2, { resolve: resolve2, reject, timer });
+  });
+}
+function requestGhRunnersProvision(runnerId, projectId, sealedBundle, timeoutMs) {
+  const requestId2 = nanoid34(16);
+  return awaitResult2(
+    requestId2,
+    () => sendToRunner(runnerId, { type: "provision_gh_runners", requestId: requestId2, projectId, sealedBundle }),
+    timeoutMs
+  );
+}
+function requestGhRunnersDelete(runnerId, projectId, sealedBundle, timeoutMs) {
+  const requestId2 = nanoid34(16);
+  return awaitResult2(
+    requestId2,
+    () => sendToRunner(runnerId, {
+      type: "delete_gh_runners",
+      requestId: requestId2,
+      projectId,
+      ...sealedBundle ? { sealedBundle } : {}
+    }),
+    timeoutMs
+  );
+}
+
+// src/application/write-model.ts
+init_farm2();
+init_runner2();
+init_init_status();
+init_sandbox_reg_tokens();
+init_abuse_throttle();
 
 // src/projects/forget.ts
 init_legacy_cred_bundles();
@@ -28296,8 +28576,57 @@ async function deleteProjectData(db, projectId) {
   });
 }
 
+// src/runner/bindings.ts
+function parseGhRunnerBindings(json) {
+  if (!json) return [];
+  try {
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed.bindings) ? parsed.bindings : [];
+  } catch {
+    return [];
+  }
+}
+function serialize(bindings) {
+  return JSON.stringify({ bindings });
+}
+async function upsertGhRunnerBinding(db, projectId, binding) {
+  await db.tx(async (tx) => {
+    const row = await tx.get(
+      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
+      projectId
+    );
+    if (!row) return;
+    const bindings = parseGhRunnerBindings(row.bindingsJson).filter(
+      (b) => !(b.owner === binding.owner && b.repo === binding.repo)
+    );
+    bindings.push(binding);
+    await tx.run(
+      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
+      serialize(bindings),
+      projectId
+    );
+  });
+}
+async function removeGhRunnerBinding(db, projectId, owner, repo) {
+  return db.tx(async (tx) => {
+    const row = await tx.get(
+      `SELECT gh_runner_bindings_json as bindingsJson FROM projects WHERE id = ?`,
+      projectId
+    );
+    if (!row) return false;
+    const bindings = parseGhRunnerBindings(row.bindingsJson);
+    const kept = bindings.filter((b) => !(b.owner === owner && b.repo === repo));
+    if (kept.length === bindings.length) return false;
+    await tx.run(
+      `UPDATE projects SET gh_runner_bindings_json = ? WHERE id = ?`,
+      serialize(kept),
+      projectId
+    );
+    return true;
+  });
+}
+
 // src/application/write-model.ts
-init_bindings();
 init_tracking_commands();
 
 // src/config-proposals/apply.ts
@@ -28373,10 +28702,27 @@ function conflict(reason) {
 function stale() {
   return { ok: false, refusal: "stale_revision" };
 }
+function notFound() {
+  return { ok: false, refusal: "not_found" };
+}
+var FARM_PROVISION_TIMEOUT_MS = 6e4;
+var GH_RUNNER_RELAY_TIMEOUT_MS = 12e4;
+function nodeUnavailable(capability, err) {
+  const reason = err instanceof Error ? err.message : `${capability}_error`;
+  const what = capability === "farm" ? "The farm" : "The runner host";
+  return {
+    ok: false,
+    refusal: "capability_unavailable",
+    capability,
+    message: reason === `${capability}_timeout` ? `${what} did not answer in time. Try again once it is responsive.` : reason === `${capability}_offline` ? `${what} is offline. Start it and try again.` : `${what} could not be reached for this. Try again in a moment.`,
+    retryable: true
+  };
+}
 function taskState(row) {
   return { ...row, revision: String(row.updatedAt) };
 }
-function createWriteModel(db, log) {
+var WORKER_REG_TOKEN_MINTS = createAbuseThrottle({ windowMs: 60 * 6e4, max: 30 });
+function createWriteModel(db, log, hooks = {}) {
   async function readTaskRow(projectId, key) {
     const row = await db.get(
       `SELECT project_id as projectId, tracker_issue_key as key, phase,
@@ -28451,6 +28797,13 @@ function createWriteModel(db, log) {
     if (sandboxId !== null) sendToSandbox(sandboxId, { type: "pause_job", jobId: stored.sourceJobId });
     await cancelActiveJobs(db, `config::${stored.id}`);
   }
+  function isOperator(actor) {
+    return actor.email !== null && (hooks.isOperator?.(actor.email) ?? false);
+  }
+  async function ghRunnerHost(runnerId, actor) {
+    const owns = isOperator(actor) ? await db.get(`SELECT id FROM runners WHERE id = ?`, runnerId) !== void 0 : await viewerOwnsRunner(db, { email: actor.email ?? "", userId: actor.subjectId }, runnerId);
+    return owns ? ok(true) : notFound();
+  }
   return {
     async readTask(projectId, taskKey) {
       const row = await readTaskRow(projectId, taskKey);
@@ -28922,6 +29275,153 @@ function createWriteModel(db, log) {
      * daemon behind it. The Context Repo remote is not touched: what the
      * pipeline wrote about the work outlives the record of the project.
      */
+    // --- registration and the account's fleet (DEV-927) ---
+    async createProject({ project, owner }) {
+      const trackerProvider = project.trackerProvider;
+      const inserted = await db.tx(async (tx) => {
+        const existing = await tx.get(`SELECT id FROM projects WHERE id = ?`, project.projectId);
+        if (existing) return conflict("project_already_exists");
+        const now = Date.now();
+        await tx.run(
+          `INSERT INTO projects (id, name, automation_level, youtrack_project_key, tracker_provider,
+                                 repos_json, owner_email, owner_user_id, language_json,
+                                 provisioning_status, context_repo_json, provisioned_at, provisioning_error, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'provisioned', ?, ?, NULL, ?)`,
+          project.projectId,
+          project.name,
+          project.automationLevel,
+          project.trackerProjectKey,
+          trackerProvider,
+          JSON.stringify(
+            project.repos.map((r) => ({
+              name: r.name,
+              host: r.host,
+              owner: r.owner,
+              repoName: r.repoName,
+              ...r.defaultBranch ? { defaultBranch: r.defaultBranch } : {},
+              ...r.mountAs ? { mountAs: r.mountAs } : {},
+              ...r.mirror ? { mirror: { host: r.mirror.host, owner: r.mirror.owner, repoName: r.mirror.repoName } } : {}
+            }))
+          ),
+          owner.email,
+          owner.subjectId,
+          project.language === null ? null : JSON.stringify(project.language),
+          JSON.stringify(project.contextRepo),
+          now,
+          now
+        );
+        return ok({ projectId: project.projectId });
+      });
+      if (!inserted.ok) return inserted;
+      await beginInitTracking(db, project.projectId, "registered");
+      log.info({ projectId: project.projectId, contextRepo: project.contextRepo }, "project registered, Context Repo provisioned by the client");
+      hooks.projectRegistered?.({
+        projectId: project.projectId,
+        name: project.name,
+        automationLevel: project.automationLevel,
+        ownerEmail: owner.email,
+        repoCount: project.repos.length
+      });
+      return inserted;
+    },
+    async provisionOnFarm({ farmId, projectId, sealedBundle, actor }) {
+      const usable = isOperator(actor) ? await db.get(`SELECT id FROM farms WHERE id = ?`, farmId) !== void 0 : await viewerOwnsFarm(db, { email: actor.email ?? "", userId: actor.subjectId }, farmId);
+      if (!usable) return notFound();
+      await beginInitTracking(db, projectId, "farm_provisioning");
+      let result;
+      try {
+        result = await requestProvision(farmId, projectId, sealedBundle, FARM_PROVISION_TIMEOUT_MS);
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : "provision_failed";
+        await recordInitError(
+          db,
+          projectId,
+          reason === "farm_offline" ? "the hosting farm is offline" : reason === "farm_timeout" ? "the hosting farm did not respond in time" : `farm provisioning failed: ${reason}`
+        );
+        return nodeUnavailable("farm", err);
+      }
+      if (result.ok) {
+        await db.run(`UPDATE projects SET farm_id = ? WHERE id = ?`, farmId, projectId);
+        await advanceInitPhase(db, projectId, "daemon_starting");
+        requestFarmPoolSync(db, farmId).catch(
+          (err) => log.warn({ farmId, err }, "farm pool sync after provision failed")
+        );
+      } else {
+        await recordInitError(db, projectId, `farm provisioning failed: ${result.error ?? "unknown error"}`);
+      }
+      return ok({ ok: result.ok, daemonStatus: result.daemonStatus ?? null, error: result.error ?? null });
+    },
+    async provisionGhRunners({ runnerId, projectId, sealedBundle, actor }) {
+      const guard = await ghRunnerHost(runnerId, actor);
+      if (!guard.ok) return guard;
+      let result;
+      try {
+        result = await requestGhRunnersProvision(runnerId, projectId, sealedBundle, GH_RUNNER_RELAY_TIMEOUT_MS);
+      } catch (err) {
+        return nodeUnavailable("runner", err);
+      }
+      const runners = result.runners ?? [];
+      if (result.ok) {
+        const connectedAt = Date.now();
+        for (const r of runners) {
+          await upsertGhRunnerBinding(db, projectId, {
+            owner: r.owner,
+            repo: r.repo,
+            runnerId,
+            connectedAt,
+            status: r.status,
+            ...r.error ? { error: r.error } : {},
+            ...r.labels ? { labels: r.labels } : {}
+          });
+        }
+      }
+      return ok({
+        ok: result.ok,
+        runners: runners.map((r) => ({ owner: r.owner, repo: r.repo, status: r.status, error: r.error ?? null, labels: r.labels ?? [] })),
+        error: result.error ?? null
+      });
+    },
+    async teardownGhRunners({ runnerId, projectId, sealedBundle, repo, actor }) {
+      const guard = await ghRunnerHost(runnerId, actor);
+      if (!guard.ok) return guard;
+      let result;
+      try {
+        result = await requestGhRunnersDelete(runnerId, projectId, sealedBundle ?? void 0, GH_RUNNER_RELAY_TIMEOUT_MS);
+      } catch (err) {
+        return nodeUnavailable("runner", err);
+      }
+      if (result.ok && repo !== null) {
+        await removeGhRunnerBinding(db, projectId, repo.owner, repo.repo);
+      }
+      return ok({ ok: result.ok, error: result.error ?? null });
+    },
+    async enqueueProjectIndex({ projectId, kind }) {
+      const p = await db.get(`SELECT id, context_repo_json as contextRepoJson FROM projects WHERE id = ?`, projectId);
+      if (!p) return notFound();
+      if (!p.contextRepoJson) return conflict("context_repo_not_provisioned");
+      const jobId = kind === "backfill" ? await enqueueBackfillJob(db, projectId) : await enqueueIndexJob(db, projectId);
+      await advanceInitPhase(db, projectId, "indexing");
+      log.info({ projectId, jobId, kind }, kind === "backfill" ? "backfill job enqueued" : "index job enqueued");
+      return ok({ jobId });
+    },
+    async issueWorkerRegistrationToken({ owner }) {
+      if (owner.email === null) return { ok: false, refusal: "unprocessable", reason: "account_has_no_email" };
+      if (!WORKER_REG_TOKEN_MINTS.take(`email:${owner.email}`)) {
+        log.warn({ email: owner.email }, "ephemeral sandbox reg token mint throttled");
+        return { ok: false, refusal: "rate_limited" };
+      }
+      const issued = await issueEphemeralSandboxRegToken(db, owner.email);
+      log.info({ email: owner.email }, "ephemeral sandbox reg token issued for a client");
+      return ok(issued);
+    },
+    async reportInitStatus({ projectId, phase, error }) {
+      const recorded = await advanceInitPhase(db, projectId, phase);
+      if (error !== null) {
+        const cur = await getInitStatus(db, projectId);
+        if (cur && cur.phase === phase) await recordInitError(db, projectId, error);
+      }
+      return ok({ recorded });
+    },
     async deleteProject({ projectId }) {
       const row = await db.get(`SELECT farm_id as farmId FROM projects WHERE id = ?`, projectId);
       if (!row) return conflict("project_not_found");
@@ -29289,9 +29789,9 @@ function createDirectPipeline(deps) {
   const materialization = {
     async next(projectId) {
       for (; ; ) {
-        const pending4 = await nextPendingProjectAction(db, projectId);
-        if (!pending4) return null;
-        const prepared = await prepareDispatch(db, pending4.id, log);
+        const pending5 = await nextPendingProjectAction(db, projectId);
+        if (!pending5) return null;
+        const prepared = await prepareDispatch(db, pending5.id, log);
         if (prepared.kind === "settled") continue;
         if (prepared.kind !== "ready") return null;
         await markDispatched(db, prepared.actionId);
@@ -29498,7 +29998,7 @@ async function compose(db, config, log, issueGrants) {
   const notify2 = { db, config, channels: [new EmailChannel(mailer)], log };
   setNotifyDeps(notify2);
   const authorizer = createAuthorizer(db, config);
-  const reads = createReadOperations(createReadModel(db), authorizer);
+  const reads = createReadOperations(createReadModel(db, { isOperator: (email) => isSuperUser(config, email) }), authorizer);
   const pipeline = createDirectPipeline({
     db,
     log,