@coopcli/specsketch 5.5.6 → 2026.817.1

package/dist/cli/index.js

@@ -1,18 +1,347 @@
 #!/usr/bin/env node
 
 // server/cli.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname3, extname, join as join5, normalize as normalize2, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync9, readdirSync as readdirSync8 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname6, extname, join as join11, normalize as normalize2, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs as parseArgs2 } from "node:util";
 import { serve } from "@hono/node-server";
 import Anthropic from "@anthropic-ai/sdk";
-import { WebSocketServer } from "ws";
+
+// ../agent-harness/src/model-auth.ts
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var ModelAuthError = class extends Error {
+};
+var API_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+function hasAntAuthProfile(home) {
+  try {
+    return readdirSync(join(home, ".config", "anthropic", "credentials")).some(
+      (f) => f.endsWith(".json")
+    );
+  } catch {
+    return false;
+  }
+}
+function resolveModelCredential(opts = {}) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir();
+  const useApi = Boolean(opts.useApi) || Boolean(env.COOP_USE_API);
+  const hasApiKey = Boolean(env.ANTHROPIC_API_KEY);
+  const hasAntAuth = Boolean(env.ANTHROPIC_AUTH_TOKEN) || hasAntAuthProfile(home);
+  const hasSubscription = existsSync(join(home, ".claude", ".credentials.json"));
+  if (useApi) {
+    if (hasApiKey || hasAntAuth) return apiResult(env, hasApiKey ? "api-key" : "ant-auth");
+    throw new ModelAuthError(
+      "--api / COOP_USE_API is set but no API credential was found. Set ANTHROPIC_API_KEY=sk-ant-\u2026 or run `ant auth login`."
+    );
+  }
+  if (hasSubscription) {
+    const subprocessEnv = { ...env };
+    for (const k of API_ENV_KEYS) delete subprocessEnv[k];
+    return {
+      path: "subscription",
+      billsApiCredits: false,
+      notice: "Model auth: Max/Pro subscription login \u2014 billing your subscription.",
+      subprocessEnv
+    };
+  }
+  if (hasApiKey) return apiResult(env, "api-key");
+  if (hasAntAuth) return apiResult(env, "ant-auth");
+  throw new ModelAuthError(
+    "No Anthropic model credential found. Either:\n  \u2022 log in your own Claude Code for subscription billing:  claude login\n  \u2022 or use API credits:  export ANTHROPIC_API_KEY=sk-ant-\u2026   (or: ant auth login)"
+  );
+}
+function apiResult(env, path) {
+  return {
+    path,
+    billsApiCredits: true,
+    notice: `Model auth: ${path === "api-key" ? "ANTHROPIC_API_KEY" : "ant auth OAuth token"} \u2014 billing API credits, NOT your Max subscription.`,
+    subprocessEnv: { ...env }
+  };
+}
+
+// ../agent-harness/src/claude.ts
+function makeGate(profile) {
+  return async (toolName, input) => {
+    if (!profile.allowedTools.includes(toolName)) {
+      return {
+        behavior: "deny",
+        message: `Tool "${toolName}" is not in the headless allowlist for agent "${profile.identity}".`
+      };
+    }
+    if (toolName === "Bash") {
+      const command = typeof input["command"] === "string" ? input["command"] : "";
+      for (const pattern of profile.blockedBashPatterns) {
+        if (pattern.test(command)) {
+          return {
+            behavior: "deny",
+            message: `Bash command blocked by headless profile pattern ${String(pattern)} for agent "${profile.identity}".`
+          };
+        }
+      }
+    }
+    if (profile.gatedTools.includes(toolName) && !profile.allowGated) {
+      return {
+        behavior: "deny",
+        message: `Tool "${toolName}" is a gated side-effect tool and this profile does not allow gated tools (allowGated: false).`
+      };
+    }
+    return { behavior: "allow", updatedInput: input };
+  };
+}
+function destructiveBashHook(profile) {
+  return {
+    matcher: "Bash",
+    hooks: [
+      async (input) => {
+        if (input.hook_event_name !== "PreToolUse") return { continue: true };
+        const ti = input.tool_input;
+        const command = typeof ti === "object" && ti !== null ? String(ti.command ?? "") : "";
+        for (const pattern of profile.blockedBashPatterns) {
+          if (pattern.test(command)) {
+            return {
+              continue: true,
+              hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: `Destructive command blocked by headless profile (${String(pattern)}) for agent "${profile.identity}".`
+              }
+            };
+          }
+        }
+        return { continue: true };
+      }
+    ]
+  };
+}
+function* mapMessage(message, expectStructuredOutput) {
+  switch (message.type) {
+    case "system": {
+      if (message.subtype === "init") {
+        yield {
+          type: "start",
+          sessionId: message.session_id,
+          ...message.apiKeySource !== void 0 ? { apiKeySource: message.apiKeySource } : {}
+        };
+      }
+      return;
+    }
+    case "assistant": {
+      const assistant = message;
+      for (const block of assistant.message.content) {
+        if (block.type === "text") {
+          yield { type: "text", text: block.text };
+        } else if (block.type === "thinking") {
+          yield { type: "thinking", text: block.thinking };
+        } else if (block.type === "tool_use") {
+          yield { type: "tool_use", id: block.id, name: block.name, input: block.input };
+        }
+      }
+      return;
+    }
+    case "user": {
+      const user = message;
+      const content = user.message.content;
+      if (typeof content === "string") return;
+      for (const block of content) {
+        if (block.type === "tool_result") {
+          yield {
+            type: "tool_result",
+            id: block.tool_use_id,
+            isError: block.is_error ?? false,
+            content: block.content
+          };
+        }
+      }
+      return;
+    }
+    case "result": {
+      if (message.subtype === "success") {
+        const missingStructured = expectStructuredOutput && message.structured_output === void 0;
+        yield {
+          type: "result",
+          text: message.result,
+          costUsd: message.total_cost_usd,
+          isError: message.is_error || missingStructured,
+          ...message.structured_output !== void 0 ? { structuredOutput: message.structured_output } : {}
+        };
+      } else {
+        yield {
+          type: "result",
+          text: message.errors.join("\n"),
+          costUsd: message.total_cost_usd,
+          isError: true
+        };
+      }
+      return;
+    }
+    default:
+      return;
+  }
+}
+function buildOptions(input, resolved) {
+  const profile = input.profile;
+  const options = {
+    cwd: input.cwd,
+    // CRITICAL: an EXPLICIT settingSources: [] loads NOTHING. (The SDK's own
+    // default — when the option is omitted — loads ALL sources; we always
+    // pass the profile's list so inheritance is an explicit choice, and the
+    // profile's sources are what yield LifeOS inheritance.)
+    settingSources: profile.settingSources,
+    // Never 'bypassPermissions' / 'acceptEdits' — PermissionProfile's type
+    // only admits 'default' | 'plan' | 'dontAsk'.
+    permissionMode: profile.permissionMode,
+    allowedTools: profile.allowedTools,
+    canUseTool: makeGate(profile),
+    // Containment: destructive-Bash denial must survive a bare allowlisted
+    // `Bash` (allow rules short-circuit canUseTool), so it is enforced by a
+    // PreToolUse hook, which the SDK evaluates before allow rules.
+    hooks: { PreToolUse: [destructiveBashHook(profile)] },
+    // Options.env REPLACES the subprocess environment (no merge). The
+    // resolver hands back the FULL inherited env (HOME/PATH preserved) with
+    // ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN stripped on the subscription
+    // path, so the subprocess cannot prefer an API key over the login.
+    env: resolved.subprocessEnv
+  };
+  if (profile.disallowedTools) {
+    options.disallowedTools = profile.disallowedTools;
+  }
+  if (profile.mcpServers) {
+    options.mcpServers = profile.mcpServers;
+  }
+  if (profile.strictMcp !== void 0) {
+    options.strictMcpConfig = profile.strictMcp;
+  }
+  if (input.outputSchema) {
+    options.outputFormat = { type: "json_schema", schema: input.outputSchema };
+  }
+  return options;
+}
+function verifyBilling(resolved, apiKeySource, notify) {
+  if (apiKeySource === void 0) return;
+  const billedViaApiKey = apiKeySource !== "none";
+  if (resolved.path === "subscription" && billedViaApiKey) {
+    notify(
+      `Warning: the subscription path was selected but the run authenticated from an API-key source ('${apiKeySource}') \u2014 this run bills API credits, not your subscription.`
+    );
+  } else if (resolved.path !== "subscription" && !billedViaApiKey) {
+    notify(
+      `Warning: the ${resolved.path} (API credits) path was selected but the run authenticated as first-party (no API key) \u2014 this run bills the subscription.`
+    );
+  }
+}
+var SDK_UNAVAILABLE_MESSAGE = "Claude Agent SDK not available \u2014 reinstall the CLI (do not use --omit=optional). Global install is required for the agent path; pnpm dlx/npx re-download the ~268 MB native binary.";
+function isSdkAbsence(error) {
+  const code = error?.code;
+  if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return true;
+  const message = error instanceof Error ? error.message : String(error);
+  return /Native CLI binary.*not found/i.test(message);
+}
+async function loadSdkQuery(loader) {
+  try {
+    const mod = await (loader ?? (() => import("@anthropic-ai/claude-agent-sdk")))();
+    return mod.query;
+  } catch (error) {
+    if (isSdkAbsence(error)) throw new Error(SDK_UNAVAILABLE_MESSAGE, { cause: error });
+    throw error;
+  }
+}
+function createClaudeHarness(deps) {
+  return {
+    id: "claude",
+    async *run(input) {
+      const resolved = resolveModelCredential({
+        env: deps?.env,
+        home: deps?.home,
+        useApi: input.useApi
+      });
+      const notify = input.onNotice ?? ((message) => console.error(message));
+      notify(resolved.notice);
+      const queryFn = deps?.queryFn ?? await loadSdkQuery(deps?.sdkLoader);
+      const expectStructuredOutput = input.outputSchema !== void 0;
+      try {
+        const stream = queryFn({ prompt: input.prompt, options: buildOptions(input, resolved) });
+        for await (const message of stream) {
+          if (message.type === "system" && message.subtype === "init") {
+            verifyBilling(resolved, message.apiKeySource, notify);
+          }
+          yield* mapMessage(message, expectStructuredOutput);
+        }
+      } catch (error) {
+        if (isSdkAbsence(error)) throw new Error(SDK_UNAVAILABLE_MESSAGE, { cause: error });
+        throw error;
+      }
+    }
+  };
+}
+
+// ../agent-harness/src/profiles.ts
+var SIDE_EFFECT_GATED_TOOLS = ["SendMessage", "Send", "Deploy", "Publish"];
+var BLOCKED_BASH_PATTERNS = [
+  /\bgit\s+push\b/,
+  /\bwrangler\s+deploy\b/,
+  /\brm\s+-rf\b/,
+  /\bnpm\s+publish\b/
+];
+function blockedBashPatterns() {
+  return [...BLOCKED_BASH_PATTERNS];
+}
+function defaultHeadlessProfile(identity) {
+  return {
+    allowedTools: ["Read", "Grep", "Glob", "WebFetch"],
+    gatedTools: [...SIDE_EFFECT_GATED_TOOLS],
+    allowGated: false,
+    blockedBashPatterns: blockedBashPatterns(),
+    permissionMode: "default",
+    settingSources: [],
+    identity
+  };
+}
+function lifeOSProfile(identity, mcpServers) {
+  const profile = {
+    allowedTools: [
+      "Read",
+      "Grep",
+      "Glob",
+      "WebFetch",
+      "WebSearch",
+      "Write",
+      "Edit",
+      "NotebookEdit",
+      // NOTE: a bare 'Bash' allow rule auto-approves the tool and
+      // short-circuits canUseTool — blockedBashPatterns stay enforced only
+      // because the harness installs them as a PreToolUse hook (claude.ts
+      // destructiveBashHook), which the SDK evaluates before allow rules.
+      "Bash",
+      "Agent",
+      "Task",
+      "Skill",
+      "TodoWrite"
+    ],
+    gatedTools: [...SIDE_EFFECT_GATED_TOOLS],
+    allowGated: false,
+    blockedBashPatterns: blockedBashPatterns(),
+    permissionMode: "default",
+    settingSources: ["user", "project", "local"],
+    identity
+  };
+  if (mcpServers) {
+    profile.mcpServers = mcpServers;
+    profile.strictMcp = true;
+  }
+  return profile;
+}
+
+// server/cli.ts
+import "ws";
 
 // server/app.ts
 import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";
 import { Hono } from "hono";
+import { z as z2 } from "zod";
 
 // src/lib/schema.ts
 import { z } from "zod";
@@ -137,8 +466,8 @@ var SessionSnapshot = z.object({
 });
 
 // server/references.ts
-import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { readFileSync, readdirSync as readdirSync2, realpathSync, statSync } from "node:fs";
+import { basename, isAbsolute, join as join2, normalize, relative, resolve, sep } from "node:path";
 var REF_FILE_BYTE_LIMIT = 64 * 1024;
 var REF_TOTAL_BYTE_LIMIT = 256 * 1024;
 var REF_DIR_FILE_LIMIT = 50;
@@ -164,14 +493,14 @@ function collectEntries(root) {
     if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readdirSync2(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
       if (SEARCH_IGNORE.has(entry.name) || entry.isSymbolicLink()) continue;
-      const full = join(dir, entry.name);
+      const full = join2(dir, entry.name);
       if (entry.isDirectory()) {
         dirs.push(relative(root, full));
         walk(full);
@@ -258,7 +587,7 @@ function expandReferences(text, root) {
         if (included >= REF_DIR_FILE_LIMIT || totalBytes >= REF_TOTAL_BYTE_LIMIT) break;
         let body;
         try {
-          body = readClamped(join(rootReal, relPath));
+          body = readClamped(join2(rootReal, relPath));
         } catch {
           continue;
         }
@@ -305,7 +634,7 @@ function resolveOne(rootReal, ref) {
     if (real !== rootReal && !insideRoot(rootReal, real)) {
       return { reason: "resolves outside the working directory" };
     }
-    const dirFiles = collectFiles(direct).map((p) => relative(rootReal, join(direct, p))).sort((a, b) => {
+    const dirFiles = collectFiles(direct).map((p) => relative(rootReal, join2(direct, p))).sort((a, b) => {
       const depth = a.split(sep).length - b.split(sep).length;
       return depth !== 0 ? depth : a.localeCompare(b);
     });
@@ -331,7 +660,7 @@ function resolveOne(rootReal, ref) {
   if (matches.length === 0) return { reason: "not found" };
   const best = matches[0];
   try {
-    const body = readClamped(join(rootReal, best));
+    const body = readClamped(join2(rootReal, best));
     return {
       path: best,
       ...body,
@@ -513,6 +842,7 @@ function bundleFilePaths(b) {
     ...b.specs.map((s) => `specs/${s.capability}/spec.md`)
   ];
 }
+var SPEC_BUNDLE_JSON_SCHEMA = z2.toJSONSchema(SpecBundle, { target: "draft-7" });
 var FABLE_BETAS = ["server-side-fallback-2026-06-01"];
 var FABLE_FALLBACKS = [{ model: "claude-opus-4-8" }];
 function parseWithModelGate(anthropic, request) {
@@ -546,6 +876,9 @@ function anthropicErrorResponse(c, err, kind) {
 }
 function createApp(anthropic, workspace, getShare, options) {
   const refRoot = options === void 0 ? process.cwd() : options.refRoot;
+  const harness = options?.harness;
+  const reviewProfile = lifeOSProfile("specsketch-review");
+  const generateProfile = defaultHeadlessProfile("specsketch-generate");
   const app = new Hono();
   app.get("/api/health", (c) => c.json({ ok: true }));
   app.get(
@@ -624,25 +957,65 @@ Produce the OpenSpec change proposal for this architecture as structured output.
 Referenced files (resolved from @-references in the input):
 
 ${refContext}` : "");
-    let msg;
-    try {
-      msg = await parseWithModelGate(anthropic, {
-        model,
-        max_tokens: 16e3,
-        // non-streaming stays under the SDK HTTP timeout
-        system,
-        messages: [{ role: "user", content: prompt }],
-        output_config: { format: zodOutputFormat(SpecBundle) }
-        // No temperature/top_p or thinking config — both 400 on modern models.
-      });
-    } catch (err) {
-      return anthropicErrorResponse(c, err, "generation-failed");
-    }
-    if (msg.stop_reason === "refusal") {
-      return c.json({ error: "refusal", detail: msg.stop_details }, 422);
+    let output;
+    if (harness) {
+      let structured;
+      let resultText = "";
+      let resultError = false;
+      try {
+        for await (const ev of harness.run({
+          prompt: `${system}
+
+${prompt}`,
+          cwd: refRoot ?? process.cwd(),
+          session: workspace?.changeName ?? "specsketch-generate",
+          profile: generateProfile,
+          outputSchema: SPEC_BUNDLE_JSON_SCHEMA
+        })) {
+          if (ev.type === "result") {
+            structured = ev.structuredOutput;
+            resultText = ev.text;
+            resultError = ev.isError;
+          }
+        }
+      } catch (err) {
+        return anthropicErrorResponse(c, err, "generation-failed");
+      }
+      if (structured === void 0) {
+        return resultError ? c.json(
+          { error: "generation-failed", detail: resultText || "the agent run failed" },
+          502
+        ) : c.json({ error: "model returned no structured output" }, 502);
+      }
+      const checked = SpecBundle.safeParse(structured);
+      if (!checked.success) {
+        return c.json(
+          { error: "model returned invalid structured output", detail: checked.error.issues },
+          502
+        );
+      }
+      output = checked.data;
+    } else {
+      let msg;
+      try {
+        msg = await parseWithModelGate(anthropic, {
+          model,
+          max_tokens: 16e3,
+          // non-streaming stays under the SDK HTTP timeout
+          system,
+          messages: [{ role: "user", content: prompt }],
+          output_config: { format: zodOutputFormat(SpecBundle) }
+          // No temperature/top_p or thinking config — both 400 on modern models.
+        });
+      } catch (err) {
+        return anthropicErrorResponse(c, err, "generation-failed");
+      }
+      if (msg.stop_reason === "refusal") {
+        return c.json({ error: "refusal", detail: msg.stop_details }, 422);
+      }
+      if (!msg.parsed_output) return c.json({ error: "model returned no structured output" }, 502);
+      output = SpecBundle.parse(msg.parsed_output);
     }
-    if (!msg.parsed_output) return c.json({ error: "model returned no structured output" }, 502);
-    const output = SpecBundle.parse(msg.parsed_output);
     const bundle = workspace ? { ...output, changeName: workspace.changeName } : output;
     const changedFiles = workspace ? workspace.writeBundle(bundle) : bundleFilePaths(bundle);
     const seed = await makeSeed(anthropic, model, conversation, changedFiles, bundle);
@@ -654,43 +1027,56 @@ ${refContext}` : "");
     if (!parsed.success) {
       return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
     }
-    const { message, conversation, model = DEFAULT_MODEL } = parsed.data;
+    const { message, conversation } = parsed.data;
     const bundle = parsed.data.bundle ?? workspace?.toBundle() ?? null;
     if (!bundle) return c.json({ error: "no spec to chat about \u2014 generate one first" }, 400);
+    if (!harness) {
+      return c.json(
+        { error: "chat-unavailable", detail: "no agent harness configured for this server" },
+        500
+      );
+    }
     const refs = expandReferences(message, refRoot);
     const refContext = renderReferenceContext(refs);
-    const history = conversation.map((m) => ({
-      role: m.role === "user" ? "user" : "assistant",
-      content: m.text
-    }));
-    let msg;
-    try {
-      msg = await createWithModelGate(anthropic, {
-        model,
-        max_tokens: 2e3,
-        system: `${CHAT_SYSTEM}
-
-${renderBundleContext(bundle)}`,
-        messages: [
-          ...history,
-          {
-            role: "user",
-            content: message + (refContext ? `
+    const history = conversation.map((m) => `[${m.role === "user" ? "user" : "assistant"}]
+${m.text}`).join("\n\n");
+    const prompt = `${CHAT_SYSTEM}
+
+${renderBundleContext(bundle)}` + (history ? `
+
+Conversation so far:
+
+${history}` : "") + `
+
+[user]
+${message}` + (refContext ? `
 
 Referenced files (resolved from @-references in the message):
 
-${refContext}` : "")
-          }
-        ]
-      });
+${refContext}` : "");
+    let answer = "";
+    let resultText = "";
+    let resultError = false;
+    try {
+      for await (const ev of harness.run({
+        prompt,
+        cwd: refRoot ?? process.cwd(),
+        session: workspace?.changeName ?? bundle.changeName ?? "specsketch-review",
+        profile: reviewProfile
+      })) {
+        if (ev.type === "text") answer += ev.text;
+        else if (ev.type === "result") {
+          resultText = ev.text;
+          resultError = ev.isError;
+        }
+      }
     } catch (err) {
       return anthropicErrorResponse(c, err, "chat-failed");
     }
-    if (msg.stop_reason === "refusal") {
-      return c.json({ error: "refusal", detail: msg.stop_details }, 422);
+    const text = answer.trim() || resultText.trim();
+    if (!text) {
+      return resultError ? c.json({ error: "chat-failed", detail: resultText || "the agent run failed" }, 502) : c.json({ error: "model returned no text" }, 502);
     }
-    const text = textOf(msg);
-    if (!text) return c.json({ error: "model returned no text" }, 502);
     const reply = { role: "assistant", text, at: (/* @__PURE__ */ new Date()).toISOString() };
     workspace?.writeChat([
       ...conversation,
@@ -710,28 +1096,23 @@ ${refContext}` : "")
   return app;
 }
 
-// server/coop-auth.ts
-import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
-
 // ../shared/src/cli-auth.ts
 import { exec } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
 import { createServer } from "node:http";
 import { hostname as hostname2 } from "node:os";
 import { URL as URL2 } from "node:url";
 
 // ../shared/src/cli-config.ts
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { homedir, hostname } from "node:os";
-import { join as join2, dirname } from "node:path";
+import { homedir as homedir2, hostname } from "node:os";
+import { join as join3, dirname } from "node:path";
 
 // ../shared/src/schemas.ts
-import { z as z2 } from "zod";
-var planTierSchema = z2.enum(["hobby", "squad", "org"]);
-var jurisdictionSchema = z2.enum(["eu", "fedramp"]);
-var locationHintSchema = z2.enum([
+import { z as z3 } from "zod";
+var planTierSchema = z3.enum(["hobby", "squad", "org"]);
+var jurisdictionSchema = z3.enum(["eu", "fedramp"]);
+var locationHintSchema = z3.enum([
   "wnam",
   "enam",
   "weur",
@@ -742,135 +1123,135 @@ var locationHintSchema = z2.enum([
   "me",
   "sam"
 ]);
-var sessionNameSchema = z2.string().min(1).max(63).regex(
+var sessionNameSchema = z3.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Session name must be lowercase alphanumeric with hyphens, starting with a letter or digit"
 );
-var teamNameSchema = z2.string().min(1).max(63).regex(
+var teamNameSchema = z3.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Team name must be lowercase alphanumeric with hyphens"
 );
-var messageKindSchema = z2.enum(["text", "context", "request", "system"]);
-var messageContentSchema = z2.object({
+var messageKindSchema = z3.enum(["text", "context", "request", "system"]);
+var messageContentSchema = z3.object({
   kind: messageKindSchema,
   // No .max() here: the 10 000-char body limit is business logic owned by the
   // SessionActor (MAX_BODY_BYTES), which rejects with 413 MESSAGE_TOO_LARGE on
   // both REST and WS. A schema cap would pre-empt it as a generic 400.
-  body: z2.string().min(1),
+  body: z3.string().min(1),
   // Two-arg z.record: identical semantics in zod 3, required form in zod 4
   // (specsketch bundles this file against zod 4 — keep every construct dual-safe).
-  metadata: z2.record(z2.string(), z2.unknown()).optional()
+  metadata: z3.record(z3.string(), z3.unknown()).optional()
 });
-var createTeamInputSchema = z2.object({
+var createTeamInputSchema = z3.object({
   name: teamNameSchema
 });
-var createSessionInputSchema = z2.object({
+var createSessionInputSchema = z3.object({
   name: sessionNameSchema,
-  teamId: z2.string().optional(),
+  teamId: z3.string().optional(),
   jurisdiction: jurisdictionSchema.optional(),
   locationHint: locationHintSchema.optional()
 });
-var sendMessageInputSchema = z2.object({
+var sendMessageInputSchema = z3.object({
   content: messageContentSchema
 });
-var inviteInputSchema = z2.object({
-  email: z2.string().email(),
-  role: z2.enum(["admin", "member"]).default("member")
+var inviteInputSchema = z3.object({
+  email: z3.string().email(),
+  role: z3.enum(["admin", "member"]).default("member")
 });
-var joinTeamInputSchema = z2.object({
-  inviteCode: z2.string().min(1)
+var joinTeamInputSchema = z3.object({
+  inviteCode: z3.string().min(1)
 });
-var markReadInputSchema = z2.object({
-  notificationIds: z2.array(z2.string().min(1))
+var markReadInputSchema = z3.object({
+  notificationIds: z3.array(z3.string().min(1))
 });
-var pollQuerySchema = z2.object({
-  since: z2.string().optional(),
-  limit: z2.coerce.number().int().min(1).max(100).default(50),
-  session: z2.string().optional()
+var pollQuerySchema = z3.object({
+  since: z3.string().optional(),
+  limit: z3.coerce.number().int().min(1).max(100).default(50),
+  session: z3.string().optional()
 });
-var messagesQuerySchema = z2.object({
-  cursor: z2.string().optional(),
-  limit: z2.coerce.number().int().min(1).max(100).default(50)
+var messagesQuerySchema = z3.object({
+  cursor: z3.string().optional(),
+  limit: z3.coerce.number().int().min(1).max(100).default(50)
 });
-var teamTypeSchema = z2.enum(["personal", "shared"]);
-var teamRoleSchema = z2.enum(["owner", "admin", "member"]);
-var accessPermissionSchema = z2.enum(["read", "write", "admin"]);
-var accessGrantInputSchema = z2.object({
-  userId: z2.string().min(1),
+var teamTypeSchema = z3.enum(["personal", "shared"]);
+var teamRoleSchema = z3.enum(["owner", "admin", "member"]);
+var accessPermissionSchema = z3.enum(["read", "write", "admin"]);
+var accessGrantInputSchema = z3.object({
+  userId: z3.string().min(1),
   sessionName: sessionNameSchema.nullable().default(null),
   // null = general
   permission: accessPermissionSchema
 });
-var machineIdSchema = z2.string().min(1).max(63).regex(
+var machineIdSchema = z3.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Machine ID must be lowercase alphanumeric with hyphens, starting with a letter or digit"
 );
-var clerkProfileInputSchema = z2.object({
-  email: z2.string().email().nullable(),
-  displayName: z2.string().min(1).max(100),
-  avatarUrl: z2.string().url().nullable(),
-  provider: z2.string().min(1).max(50),
-  providerUserId: z2.string().min(1).max(100)
+var clerkProfileInputSchema = z3.object({
+  email: z3.string().email().nullable(),
+  displayName: z3.string().min(1).max(100),
+  avatarUrl: z3.string().url().nullable(),
+  provider: z3.string().min(1).max(50),
+  providerUserId: z3.string().min(1).max(100)
 });
-var sessionEnrollmentSchema = z2.object({
-  sessionId: z2.string(),
-  team: z2.string(),
-  teamName: z2.string().optional(),
-  key: z2.string().startsWith("api_"),
-  enrolledAt: z2.string().datetime(),
-  apiUrl: z2.string().url().optional(),
-  machineId: z2.string().optional()
+var sessionEnrollmentSchema = z3.object({
+  sessionId: z3.string(),
+  team: z3.string(),
+  teamName: z3.string().optional(),
+  key: z3.string().startsWith("api_"),
+  enrolledAt: z3.string().datetime(),
+  apiUrl: z3.string().url().optional(),
+  machineId: z3.string().optional()
 });
-var authConfigSchema = z2.object({
-  key: z2.string().startsWith("api_"),
-  userId: z2.string().min(1),
-  displayName: z2.string().nullable().optional().default(null),
-  email: z2.string().email().nullable(),
-  machineId: z2.string().nullable(),
-  authenticatedAt: z2.string().datetime()
+var authConfigSchema = z3.object({
+  key: z3.string().startsWith("api_"),
+  userId: z3.string().min(1),
+  displayName: z3.string().nullable().optional().default(null),
+  email: z3.string().email().nullable(),
+  machineId: z3.string().nullable(),
+  authenticatedAt: z3.string().datetime()
 });
 var configBaseFields = {
-  apiUrl: z2.string().url(),
-  machineId: z2.string().nullable(),
-  sessions: z2.record(z2.string(), sessionEnrollmentSchema),
-  defaults: z2.object({
-    team: z2.string().nullable(),
-    session: z2.string().nullable()
+  apiUrl: z3.string().url(),
+  machineId: z3.string().nullable(),
+  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
+  defaults: z3.object({
+    team: z3.string().nullable(),
+    session: z3.string().nullable()
   }),
-  poll: z2.object({
-    lastPollAt: z2.string().datetime().nullable()
+  poll: z3.object({
+    lastPollAt: z3.string().datetime().nullable()
   })
 };
-var coopConfigV1Schema = z2.object({
-  version: z2.literal(1),
+var coopConfigV1Schema = z3.object({
+  version: z3.literal(1),
   ...configBaseFields
 });
-var coopConfigV2Schema = z2.object({
-  version: z2.literal(2),
+var coopConfigV2Schema = z3.object({
+  version: z3.literal(2),
   ...configBaseFields,
   auth: authConfigSchema.optional()
 });
-var profileNameSchema = z2.string().regex(
+var profileNameSchema = z3.string().regex(
   /^[a-z0-9][a-z0-9_-]{0,63}$/,
   "Profile name must be lowercase alphanumeric with dashes/underscores, max 64 chars"
 );
-var coopProfileSchema = z2.object({
-  apiUrl: z2.string().url(),
+var coopProfileSchema = z3.object({
+  apiUrl: z3.string().url(),
   auth: authConfigSchema.optional(),
-  sessions: z2.record(z2.string(), sessionEnrollmentSchema),
-  defaults: z2.object({
-    team: z2.string().nullable(),
-    session: z2.string().nullable()
+  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
+  defaults: z3.object({
+    team: z3.string().nullable(),
+    session: z3.string().nullable()
   }),
-  poll: z2.object({
-    lastPollAt: z2.string().datetime().nullable()
+  poll: z3.object({
+    lastPollAt: z3.string().datetime().nullable()
   })
 });
-var coopConfigV3ObjectSchema = z2.object({
-  version: z2.literal(3),
-  machineId: z2.string().nullable(),
-  defaultProfile: z2.string(),
-  profiles: z2.record(profileNameSchema, coopProfileSchema)
+var coopConfigV3ObjectSchema = z3.object({
+  version: z3.literal(3),
+  machineId: z3.string().nullable(),
+  defaultProfile: z3.string(),
+  profiles: z3.record(profileNameSchema, coopProfileSchema)
 });
 function requireDefaultProfilePointer(config, ctx) {
   if (!(config.defaultProfile in config.profiles)) {
@@ -884,7 +1265,7 @@ function requireDefaultProfilePointer(config, ctx) {
 var coopConfigV3Schema = coopConfigV3ObjectSchema.superRefine(
   requireDefaultProfilePointer
 );
-var coopConfigSchema = z2.discriminatedUnion("version", [
+var coopConfigSchema = z3.discriminatedUnion("version", [
   coopConfigV1Schema,
   coopConfigV2Schema,
   coopConfigV3ObjectSchema
@@ -893,20 +1274,39 @@ var coopConfigSchema = z2.discriminatedUnion("version", [
     requireDefaultProfilePointer(config, ctx);
   }
 });
-var hookStdinSchema = z2.object({
-  session_id: z2.string().optional(),
-  cwd: z2.string().optional(),
-  hook_event_name: z2.string().optional()
+var hookStdinSchema = z3.object({
+  session_id: z3.string().optional(),
+  cwd: z3.string().optional(),
+  hook_event_name: z3.string().optional()
 }).passthrough();
-var wsClientMessageSchema = z2.discriminatedUnion("type", [
-  z2.object({ type: z2.literal("message"), content: messageContentSchema }),
-  z2.object({ type: z2.literal("presence_request") }),
-  z2.object({ type: z2.literal("ping") })
+var wsClientMessageSchema = z3.discriminatedUnion("type", [
+  z3.object({ type: z3.literal("message"), content: messageContentSchema }),
+  z3.object({ type: z3.literal("ack"), data: z3.object({ messageId: z3.string() }) }),
+  z3.object({ type: z3.literal("presence_request") }),
+  z3.object({ type: z3.literal("ping") })
 ]);
+var workKindSchema = z3.enum(["implement", "generate"]);
+var workCompletionStatusSchema = z3.enum(["succeeded", "failed"]);
+var poolJoinInputSchema = z3.object({}).passthrough();
+var poolCheckInInputSchema = z3.object({}).passthrough();
+var poolCompleteInputSchema = z3.object({
+  workId: z3.string().min(1),
+  status: workCompletionStatusSchema,
+  resultRef: z3.string().max(512),
+  assignmentSeq: z3.number().int().nonnegative()
+});
+var poolEnqueueInputSchema = z3.object({
+  kind: workKindSchema,
+  source: z3.string().min(1),
+  dedupKey: z3.string().min(1).max(512).optional()
+});
+var poolCancelInputSchema = z3.object({
+  workId: z3.string().min(1)
+});
 
 // ../shared/src/cli-config.ts
-var DEFAULT_CONFIG_DIR = join2(homedir(), ".coopcli");
-var DEFAULT_CONFIG_PATH = join2(DEFAULT_CONFIG_DIR, "config.json");
+var DEFAULT_CONFIG_DIR = join3(homedir2(), ".coopcli");
+var DEFAULT_CONFIG_PATH = join3(DEFAULT_CONFIG_DIR, "config.json");
 var PROD_API_URL = "https://api.coopcli.com";
 function emptyProfile(apiUrl) {
   return {
@@ -1238,8 +1638,8 @@ function resolveDisplayName(name, email, userId) {
 async function openBrowser(url) {
   const escaped = url.replace(/"/g, '\\"');
   const cmd = process.platform === "darwin" ? `open "${escaped}"` : process.platform === "win32" ? `start "" "${escaped}"` : `xdg-open "${escaped}"`;
-  return new Promise((resolve4) => {
-    exec(cmd, () => resolve4());
+  return new Promise((resolve5) => {
+    exec(cmd, () => resolve5());
   });
 }
 var PAGE_STYLE = "body{background:#0f0f0f;color:#e8e8e8;font-family:system-ui;display:flex;justify-content:center;padding-top:4rem}";
@@ -1324,14 +1724,15 @@ function deriveApiUrl(webUrl) {
 async function login(input, deps) {
   const state = randomBytes(16).toString("hex");
   const machineId = input.machine ?? hostname2();
+  const log = deps.log ?? ((message) => void process.stderr.write(message));
   const server = await startLocalhostServer({ expectedState: state, loginCommand: input.loginCommand });
   try {
     const webUrl = input.webUrl ?? "https://coopcli.com";
     const authUrl = `${webUrl}/cli-auth?port=${server.port}&state=${state}&machine=${encodeURIComponent(machineId)}`;
-    process.stderr.write(`Opening browser for authentication...
+    log(`Opening browser for authentication...
 `);
     await deps.openBrowser(authUrl);
-    process.stderr.write(`Waiting for callback on port ${server.port}...
+    log(`Waiting for callback on port ${server.port}...
 `);
     const params = await server.waitForCallback();
     const displayName = resolveDisplayName(params.displayName, params.email, params.userId);
@@ -1348,7 +1749,7 @@ async function login(input, deps) {
     });
     const config = await deps.config.load();
     if (params.apiUrl && config.apiUrl && params.apiUrl !== config.apiUrl) {
-      process.stderr.write(
+      log(
         `
 Backend mismatch: you authenticated against ${params.apiUrl}
   but your config points to ${config.apiUrl}
@@ -1372,73 +1773,6 @@ Backend mismatch: you authenticated against ${params.apiUrl}
     server.close();
   }
 }
-var CliAuthError = class extends Error {
-  constructor(message, kind) {
-    super(message);
-    this.kind = kind;
-    this.name = "CliAuthError";
-  }
-  kind;
-};
-async function resolveCoopCredentials(opts) {
-  const env = opts.env ?? process.env;
-  const { configPath, loginHint } = opts;
-  if (!existsSync(configPath)) {
-    throw new CliAuthError(`No CoopCLI config found at ${configPath}.
-${loginHint}`, "missing-config");
-  }
-  const store = new ConfigStore(configPath);
-  let raw;
-  try {
-    raw = await store.loadRaw();
-  } catch {
-    throw new CliAuthError(
-      `Could not read CoopCLI credentials from ${configPath}.
-${loginHint}`,
-      "unreadable-config"
-    );
-  }
-  const profileName = profileFromEnv(env, opts.profileEnvVars ?? ["COOP_PROFILE"]) ?? raw.defaultProfile;
-  const profile = raw.profiles[profileName];
-  if (!profile) {
-    const available = Object.keys(raw.profiles).join(", ");
-    throw new CliAuthError(
-      `CoopCLI config at ${configPath} has no profile "${profileName}" (available: ${available}).
-${loginHint}`,
-      "unknown-profile"
-    );
-  }
-  if (!profile.auth) {
-    throw new CliAuthError(`CoopCLI config at ${configPath} has no login.
-${loginHint}`, "no-login");
-  }
-  const apiUrl = (opts.apiUrlEnvVar && env[opts.apiUrlEnvVar] || profile.apiUrl).replace(/\/+$/, "");
-  return {
-    apiUrl,
-    key: profile.auth.key,
-    userId: profile.auth.userId,
-    displayName: profile.auth.displayName ?? null
-  };
-}
-
-// server/coop-auth.ts
-var CoopAuthError = class extends Error {
-};
-var LOGIN_HINT = "--share needs a CoopCLI account. Run `specsketch login` (it opens your browser and saves credentials to ~/.coopcli/config.json), then rerun with --share.";
-async function readCoopAuth(configPath = join3(homedir2(), ".coopcli", "config.json"), env = process.env) {
-  try {
-    return await resolveCoopCredentials({
-      configPath,
-      env,
-      profileEnvVars: ["SPECSKETCH_COOP_PROFILE", "COOP_PROFILE"],
-      apiUrlEnvVar: "SPECSKETCH_COOP_API_URL",
-      loginHint: LOGIN_HINT
-    });
-  } catch (err) {
-    if (err instanceof CliAuthError) throw new CoopAuthError(err.message);
-    throw err;
-  }
-}
 
 // server/login.ts
 import { parseArgs } from "node:util";
@@ -1479,886 +1813,2229 @@ async function runLogin(args, deps = {}) {
   if (profile) config.selectProfile(profile);
   const result = await login(
     { webUrl: args.webUrl, loginCommand: "specsketch login" },
-    { config, openBrowser: deps.openBrowser ?? openBrowser }
+    // Forward the writer too, so a caller supplying one gets ALL of login's output
+    // rather than just this command's closing line (issue #1).
+    { config, openBrowser: deps.openBrowser ?? openBrowser, log: deps.log }
   );
   (deps.log ?? console.log)(`Authenticated as ${result.email ?? result.userId}. Credentials saved.`);
 }
 
-// server/remote-session.ts
-import { WebSocket } from "ws";
+// server/workspace.ts
+import { createHash as createHash2 } from "node:crypto";
+import {
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  readdirSync as readdirSync4,
+  renameSync as renameSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+
+// ../shared/src/openspec-change-meta.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync3, readdirSync as readdirSync3, realpathSync as realpathSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+import { Document, parseDocument } from "yaml";
+import { z as z4 } from "zod";
 
-// ../shared/src/errors.ts
-function isApiErrorBody(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return typeof v.category === "string" && typeof v.code === "string" && typeof v.message === "string";
+// ../shared/src/fs-atomic.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+function writeAtomicFile(target, content) {
+  mkdirSync(dirname2(target), { recursive: true });
+  const tmp = `${target}.tmp`;
+  writeFileSync(tmp, content, "utf8");
+  renameSync(tmp, target);
+}
+function readIfExists(target) {
+  return existsSync2(target) ? readFileSync2(target, "utf8") : void 0;
 }
 
-// ../shared/src/api-client.ts
-var CoopApiError = class extends Error {
-  category;
-  code;
-  status;
-  details;
-  constructor(status, body) {
-    super(body.message);
-    this.name = "CoopApiError";
-    this.category = body.category;
-    this.code = body.code;
-    this.status = status;
-    this.details = body.details;
+// ../shared/src/openspec-change-meta.ts
+var CHANGE_META_FILE = "specplan.yaml";
+var nodeChangeMetaFs = {
+  readIfExists(path) {
+    return readIfExists(path);
+  },
+  writeAtomicFile(path, content) {
+    writeAtomicFile(path, content);
+  },
+  exists(path) {
+    return existsSync3(path);
+  },
+  readdir(path) {
+    if (!existsSync3(path)) return [];
+    return readdirSync3(path, { withFileTypes: true }).map((entry) => ({
+      name: entry.name,
+      directory: entry.isDirectory()
+    }));
+  },
+  realpath(path) {
+    return realpathSync2(path);
   }
 };
-function isCoopApiError(err) {
-  return err instanceof CoopApiError;
-}
-async function streamToBuffer(stream) {
-  const reader = stream.getReader();
-  const chunks = [];
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
-  }
-  const total = chunks.reduce((sum, c) => sum + c.length, 0);
-  const result = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    result.set(chunk, offset);
-    offset += chunk.length;
-  }
-  return result;
-}
-var verbose = false;
-var ApiClient = class _ApiClient {
-  constructor(apiUrl, token, userId) {
-    this.apiUrl = apiUrl;
-    this.token = token;
-    this.userId = userId;
-  }
-  apiUrl;
-  token;
-  userId;
-  /** Build a user-scoped path. Only callable when userId is set. */
-  userPath(sub) {
-    return `/api/u/${this.userId}${sub}`;
-  }
-  async request(method, path, body, params) {
-    const url = new URL(path, this.apiUrl);
-    if (params) {
-      for (const [key, val] of Object.entries(params)) {
-        if (val !== void 0) {
-          url.searchParams.set(key, String(val));
-        }
-      }
-    }
-    if (verbose) {
-      process.stderr.write(`[verbose] ${method} ${url.toString()}
-`);
-      if (body) process.stderr.write(`[verbose] body: ${JSON.stringify(body)}
-`);
-    }
-    const res = await fetch(url.toString(), {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.token}`,
-        "Content-Type": "application/json"
-      },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-    if (verbose) {
-      process.stderr.write(`[verbose] ${res.status} ${res.statusText}
-`);
-    }
-    if (!res.ok) {
-      let parsed = null;
-      try {
-        const json = await res.json();
-        if (isApiErrorBody(json)) {
-          parsed = json;
-        } else {
-          const legacy = json;
-          parsed = {
-            category: res.status >= 500 ? "server_error" : "user_action",
-            code: "UNKNOWN",
-            message: legacy.error ?? legacy.message ?? res.statusText
-          };
-        }
-      } catch {
-        parsed = {
-          category: res.status >= 500 ? "server_error" : "user_action",
-          code: "UNKNOWN",
-          message: res.statusText
-        };
-      }
-      if (verbose) {
-        process.stderr.write(`[verbose] error: [${parsed.category}/${parsed.code}] ${parsed.message}
-`);
-      }
-      throw new CoopApiError(res.status, parsed);
-    }
-    return res.json();
-  }
-  async getMe() {
-    const path = this.userId ? this.userPath("/me") : "/api/me";
-    return this.request("GET", path);
-  }
-  async createTeam(input) {
-    if (this.userId) {
-    }
-    return this.request("POST", "/api/teams", input);
-  }
-  async listTeams() {
-    if (this.userId) {
-      const me = await this.request("GET", this.userPath("/me"));
-      return (me.teams ?? []).map((m) => ({
-        id: m.teamId,
-        name: m.teamName,
-        type: m.teamId.startsWith("team:personal:") ? "personal" : "shared",
-        plan: "hobby",
-        createdBy: "",
-        createdAt: m.joinedAt
-      }));
-    }
-    return this.request("GET", "/api/teams");
-  }
-  async inviteToTeam(team, input) {
-    return this.request("POST", `/api/teams/${encodeURIComponent(team)}/invite`, input);
-  }
-  async joinTeam(team, inviteCode) {
-    await this.request("POST", `/api/teams/${encodeURIComponent(team)}/join`, { inviteCode });
-  }
-  async listTeamMembers(team) {
-    return this.request("GET", `/api/teams/${encodeURIComponent(team)}/members`);
-  }
-  async createSession(input) {
-    const path = this.userId ? this.userPath("/sessions") : "/api/sessions";
-    return this.request("POST", path, input);
-  }
-  async listSessions() {
-    const path = this.userId ? this.userPath("/sessions") : "/api/sessions";
-    const result = await this.request("GET", path);
-    return result.sessions;
-  }
-  async joinSession(name) {
-    await this.request("POST", `/api/sessions/${encodeURIComponent(name)}/join`);
-  }
-  async leaveSession(name) {
-    await this.request("POST", `/api/sessions/${encodeURIComponent(name)}/leave`);
-  }
-  async deleteSession(name) {
-    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(name)}`) : `/api/sessions/${encodeURIComponent(name)}`;
-    return this.request("DELETE", path);
-  }
-  async sendMessage(teamId, session, input) {
-    if (this.userId) {
-      return this.request(
-        "POST",
-        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
-        input,
-        { team: teamId }
-      );
-    }
-    return this.request("POST", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, input);
-  }
-  async getMessages(teamId, session, cursor, limit) {
-    if (this.userId) {
-      return this.request(
-        "GET",
-        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
-        void 0,
-        { team: teamId, cursor, limit }
-      );
-    }
-    return this.request("GET", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, void 0, {
-      cursor,
-      limit
-    });
-  }
-  async getLatestMessages(teamId, session, count = 5) {
-    if (this.userId) {
-      return this.request(
-        "GET",
-        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
-        void 0,
-        { team: teamId, latest: count }
-      );
-    }
-    return this.request("GET", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, void 0, {
-      latest: count
-    });
-  }
-  async queryAIContext(teamId, sessionName, input) {
-    return this.request(
-      "POST",
-      this.userPath(`/sessions/${encodeURIComponent(sessionName)}/ai-context`),
-      input,
-      { team: teamId }
-    );
-  }
-  async listSessionFiles(teamId, sessionName) {
-    const result = await this.request(
-      "GET",
-      this.userPath(`/sessions/${encodeURIComponent(sessionName)}/files`),
-      void 0,
-      { team: teamId }
-    );
-    return result.files;
-  }
-  async getNotifications(params) {
-    const path = this.userId ? this.userPath("/notifications") : "/api/notifications";
-    return this.request("GET", path, void 0, params);
-  }
-  async markRead(ids) {
-    const path = this.userId ? this.userPath("/notifications/read") : "/api/notifications/read";
-    await this.request("POST", path, { notificationIds: ids });
-  }
-  /** List the caller's user-scoped API keys. Requires user-level auth. */
-  async listUserApiKeys() {
-    const body = await this.request("GET", this.userPath("/keys"));
-    return body.keys;
+var sha256 = (s) => createHash("sha256").update(s).digest("hex");
+function listBodyFiles(changeDir, fsx = nodeChangeMetaFs) {
+  const files = [];
+  for (const name of ["proposal.md", "design.md", "tasks.md"]) {
+    if (fsx.exists(join4(changeDir, name))) files.push(name);
   }
-  /** Revoke a user-scoped API key by id. Requires user-level auth. */
-  async revokeUserApiKey(id) {
-    await this.request("DELETE", this.userPath(`/keys/${encodeURIComponent(id)}`));
+  const specsDir = join4(changeDir, "specs");
+  for (const entry of fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
+    const rel = join4("specs", entry.name, "spec.md");
+    if (entry.directory && fsx.exists(join4(changeDir, rel))) files.push(rel);
   }
+  return files;
+}
+function bodyHash(changeDir, fsx = nodeChangeMetaFs) {
+  const files = listBodyFiles(changeDir, fsx);
+  if (files.length === 0) return null;
+  const parts = files.map(
+    (rel) => `${rel}
+${sha256(fsx.readIfExists(join4(changeDir, rel)) ?? "")}`
+  );
+  return `sha256:${sha256(parts.join("\n"))}`;
+}
+var SPEC_STATUSES = ["draft", "in-progress"];
+var SpecStatus = z4.enum(SPEC_STATUSES);
+var LEGACY_STATUS_COERCION = {
+  active: "in-progress",
+  done: "in-progress",
+  deferred: "draft"
+};
+var StoredSpecStatus = z4.enum([...SPEC_STATUSES, "active", "done", "deferred"]).transform(
+  (s) => s in LEGACY_STATUS_COERCION ? LEGACY_STATUS_COERCION[s] : s
+);
+var SpecMetaSchema = z4.object({
+  specId: z4.string(),
+  userStories: z4.array(z4.string()),
+  dependencies: z4.array(z4.string()),
+  /** Working state (retired values coerce on read); absent = draft. */
+  status: StoredSpecStatus.optional(),
   /**
-   * Create a live canvas session (specsketch --share host). User-scoped
-   * route; the caller validates the response shape against
-   * canvasSessionCreatedSchema.
+   * Approved axis (formerly `applied`) — fold-driven, SEPARATE from the
+   * working status above. True when the proposal's delta has been folded
+   * into specs/ and archived (apply-first: the fold happens at approval).
+   * Absent = not-approved.
    */
-  async createCanvasSession(input) {
-    return this.request("POST", this.userPath("/canvas/sessions"), input);
-  }
-  /** End a canvas session server-side (invalidates the share link). */
-  async endCanvasSession(sessionId) {
-    await this.request("DELETE", this.userPath(`/canvas/sessions/${encodeURIComponent(sessionId)}`));
-  }
-  async uploadFile(teamId, session, filename, body, size) {
-    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(session)}/upload`) : `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/upload`;
-    const url = new URL(path, this.apiUrl);
-    if (this.userId) url.searchParams.set("team", teamId);
-    const form = new FormData();
-    const bytes = new Uint8Array(
-      body instanceof Buffer || body instanceof Uint8Array ? body : await streamToBuffer(body)
-    );
-    form.append("file", new Blob([bytes]), filename);
-    form.append("filename", filename);
-    const res = await fetch(url.toString(), {
-      method: "POST",
-      headers: { Authorization: `Bearer ${this.token}` },
-      body: form
-    });
-    if (!res.ok) {
-      const text = await res.text();
-      let msg = res.statusText;
-      try {
-        msg = JSON.parse(text).message ?? msg;
-      } catch {
-      }
-      throw new CoopApiError(res.status, { category: "user_action", code: "UPLOAD_FAILED", message: msg });
-    }
-    return res.json();
+  approved: z4.boolean().optional(),
+  /**
+   * Legacy spelling of the fold axis (pre-rename metadata files). Read-only
+   * compatibility: readers treat `applied: true` as `approved: true`; no
+   * writer ever sets this field again.
+   */
+  applied: z4.boolean().optional(),
+  /**
+   * Build flag — user-set, independent of the fold: true once the code has
+   * been built to match the approved diff. Absent = not-implemented.
+   */
+  implemented: z4.boolean().optional(),
+  /**
+   * Minimal implementation-task record written on fold (specplan-timeline-apply
+   * "Implementation task record on fold"): the creation time and a reference to
+   * the archived change's own id/path (from which the delta artifact is
+   * materialized on demand). Deliberately carries NO status and NO dispatch
+   * state — task execution/dispatch is a separate, not-yet-defined concern. A
+   * field addition to this sidecar, not a redefinition of its format.
+   */
+  task: z4.object({
+    createdAt: z4.string(),
+    source: z4.string()
+  }).optional(),
+  generation: z4.object({
+    /** sha256 of the last generated body files — detects hand edits. */
+    lastGeneratedBodyHash: z4.string(),
+    lastGeneratedAt: z4.string()
+  }).optional()
+});
+function writeChangeMeta(fsx, changeDir, meta) {
+  const path = join4(changeDir, CHANGE_META_FILE);
+  const raw = fsx.readIfExists(path);
+  const doc = raw === void 0 ? new Document({
+    specId: meta.specId,
+    userStories: meta.userStories ?? [],
+    dependencies: meta.dependencies ?? [],
+    status: meta.status ?? "draft"
+  }) : parseDocument(raw);
+  if (meta.approved !== void 0) doc.setIn(["approved"], meta.approved);
+  if (meta.implemented !== void 0) doc.setIn(["implemented"], meta.implemented);
+  if (meta.task !== void 0) {
+    doc.setIn(["task", "createdAt"], meta.task.createdAt);
+    doc.setIn(["task", "source"], meta.task.source);
+  }
+  if (meta.generation !== void 0) {
+    doc.setIn(["generation", "lastGeneratedBodyHash"], meta.generation.lastGeneratedBodyHash);
+    doc.setIn(["generation", "lastGeneratedAt"], meta.generation.lastGeneratedAt);
+  }
+  fsx.writeAtomicFile(path, doc.toString());
+}
+
+// server/workspace.ts
+var DIAGRAM_FILE = "diagram.excalidraw";
+var SIDECAR_FILE = "specsketch.json";
+var sha2562 = (s) => createHash2("sha256").update(s).digest("hex");
+var ChangeWorkspace = class {
+  dir;
+  changeName;
+  /**
+   * `create` defaults to true, which is the canvas-era contract: constructing a
+   * workspace makes its directory. The workbench passes `false`, because opening a
+   * change id that does not exist must not put an empty directory in the repository —
+   * the next run would report `resuming` for a change nobody started, and
+   * `openspec:check` WARNs about a change carrying no delta specs. `writeAtomic`
+   * creates the directory when something is actually written, which is the first
+   * moment the change is real.
+   */
+  constructor(dir, options = {}) {
+    this.dir = resolve2(dir);
+    this.changeName = basename2(this.dir);
+    if (options.create !== false) mkdirSync2(this.dir, { recursive: true });
   }
-  async downloadFile(teamId, session, fileId) {
-    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(session)}/files/${encodeURIComponent(fileId)}`) : `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/files/${encodeURIComponent(fileId)}`;
-    const url = new URL(path, this.apiUrl);
-    if (this.userId) url.searchParams.set("team", teamId);
-    const res = await fetch(url.toString(), {
-      method: "GET",
-      headers: { Authorization: `Bearer ${this.token}` }
-    });
-    if (!res.ok) {
-      const text = await res.text();
-      let msg = res.statusText;
-      try {
-        msg = JSON.parse(text).message ?? msg;
-      } catch {
-      }
-      throw new CoopApiError(res.status, { category: "user_action", code: "DOWNLOAD_FAILED", message: msg });
-    }
-    const disposition = res.headers.get("Content-Disposition") ?? "";
-    const filenameMatch = disposition.match(/filename="?([^"]+)"?/);
-    const filename = filenameMatch ? decodeURIComponent(filenameMatch[1]) : fileId;
-    const size = parseInt(res.headers.get("Content-Length") ?? "0", 10);
-    return { filename, body: res.body, size };
-  }
-  getWebSocketUrl(session) {
-    const wsBase = this.apiUrl.replace(
-      /^https?:\/\//,
-      (match) => match === "https://" ? "wss://" : "ws://"
-    );
-    return `${wsBase}/api/sessions/${encodeURIComponent(session)}/ws?token=${encodeURIComponent(this.token)}`;
+  writeAtomic(relPath, content) {
+    const target = join5(this.dir, relPath);
+    mkdirSync2(dirname3(target), { recursive: true });
+    const tmp = `${target}.tmp`;
+    writeFileSync2(tmp, content, "utf8");
+    renameSync2(tmp, target);
   }
-  withToken(token) {
-    return new _ApiClient(this.apiUrl, token, this.userId);
+  readIfExists(relPath) {
+    const target = join5(this.dir, relPath);
+    return existsSync4(target) ? readFileSync3(target, "utf8") : void 0;
   }
-};
-
-// ../shared/src/canvas-protocol.ts
-import { z as z3 } from "zod";
-var CANVAS_PROTOCOL_VERSION = 1;
-var canvasElementSchema = z3.object({
-  id: z3.string().min(1),
-  version: z3.number().int().nonnegative(),
-  versionNonce: z3.number().int(),
-  isDeleted: z3.boolean().optional()
-}).passthrough();
-var canvasFilesSchema = z3.record(z3.string(), z3.unknown());
-var canvasSceneSchema = z3.object({
-  elements: z3.array(canvasElementSchema),
-  files: canvasFilesSchema.optional()
-});
-var canvasParticipantSchema = z3.object({
-  id: z3.string().min(1),
-  role: z3.enum(["host", "guest"]),
-  name: z3.string().optional(),
-  color: z3.string().optional()
-});
-var canvasHelloSchema = z3.object({
-  type: z3.literal("hello"),
-  protocolVersion: z3.number().int().positive(),
-  role: z3.enum(["host", "guest"]),
-  /** Stable id across reconnects, if the client has one. */
-  participantId: z3.string().min(1).max(64).optional(),
-  name: z3.string().max(120).optional()
-});
-var canvasClientOpSchema = z3.object({
-  type: z3.literal("op"),
-  /** Changed or soft-deleted elements only — never the full scene. */
-  elements: z3.array(canvasElementSchema).min(1),
-  /** New binary files referenced by the changed elements, if any. */
-  files: canvasFilesSchema.optional(),
-  /** Client-local monotonic sequence, used by the sender for echo dedupe. */
-  clientSeq: z3.number().int().nonnegative()
-});
-var canvasClientMessageSchema = z3.discriminatedUnion("type", [
-  canvasHelloSchema,
-  canvasClientOpSchema
-]);
-var canvasSnapshotSchema = z3.object({
-  type: z3.literal("snapshot"),
-  scene: canvasSceneSchema,
-  revision: z3.number().int().nonnegative(),
-  participants: z3.array(canvasParticipantSchema),
-  /** Echoes the server's protocol version so clients can detect skew. */
-  protocolVersion: z3.number().int().positive(),
-  /** The participant id the server assigned to (or kept for) this client. */
-  participantId: z3.string()
-});
-var canvasServerOpSchema = z3.object({
-  type: z3.literal("op"),
-  /** The elements that won reconciliation (never echoed to the sender). */
-  elements: z3.array(canvasElementSchema),
-  files: canvasFilesSchema.optional(),
-  revision: z3.number().int().positive(),
-  /** Participant id of the sender. */
-  from: z3.string()
-});
-var canvasPresenceSchema = z3.object({
-  type: z3.literal("presence"),
-  participants: z3.array(canvasParticipantSchema)
-});
-var canvasEndSchema = z3.object({
-  type: z3.literal("end"),
-  reason: z3.string()
-});
-var canvasErrorSchema = z3.object({
-  type: z3.literal("error"),
-  code: z3.string(),
-  message: z3.string()
-});
-var canvasServerMessageSchema = z3.discriminatedUnion("type", [
-  canvasSnapshotSchema,
-  canvasServerOpSchema,
-  canvasPresenceSchema,
-  canvasEndSchema,
-  canvasErrorSchema
+  // ── Scene ────────────────────────────────────────────────────────────────
+  loadScene() {
+    const raw = this.readIfExists(DIAGRAM_FILE);
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        elements: Array.isArray(parsed.elements) ? parsed.elements : [],
+        appState: parsed.appState ?? void 0,
+        files: parsed.files ?? void 0
+      };
+    } catch {
+      return null;
+    }
+  }
+  saveScene(scene, title, model) {
+    this.writeAtomic(
+      DIAGRAM_FILE,
+      JSON.stringify(
+        {
+          type: "excalidraw",
+          version: 2,
+          source: "coopcli-specsketch",
+          elements: scene.elements,
+          appState: scene.appState ?? {},
+          files: scene.files ?? {}
+        },
+        null,
+        2
+      )
+    );
+    this.updateSidecar((s) => ({
+      ...s,
+      ...title !== void 0 ? { title } : {},
+      ...model !== void 0 ? { model } : {}
+    }));
+  }
+  // ── Sidecar ──────────────────────────────────────────────────────────────
+  readSidecar() {
+    const raw = this.readIfExists(SIDECAR_FILE);
+    if (!raw) return {};
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  updateSidecar(update) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const current = this.readSidecar();
+    const next = update(current);
+    next.createdAt ??= now;
+    next.updatedAt = now;
+    this.writeAtomic(SIDECAR_FILE, JSON.stringify(next, null, 2));
+  }
+  // ── Artifacts ────────────────────────────────────────────────────────────
+  /** Current artifact files, however they were authored. */
+  readArtifacts() {
+    const specs = [];
+    const specsDir = join5(this.dir, "specs");
+    if (existsSync4(specsDir)) {
+      for (const entry of readdirSync4(specsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        const spec = this.readIfExists(join5("specs", entry.name, "spec.md"));
+        if (spec !== void 0) specs.push({ capability: entry.name, spec });
+      }
+    }
+    return {
+      proposal: this.readIfExists("proposal.md"),
+      design: this.readIfExists("design.md"),
+      tasks: this.readIfExists("tasks.md"),
+      specs
+    };
+  }
+  /** Reconstruct a SpecBundle view from the files on disk, or null if none. */
+  toBundle() {
+    const a = this.readArtifacts();
+    if (!a.proposal && !a.design && !a.tasks && a.specs.length === 0) return null;
+    return {
+      changeName: this.changeName,
+      summary: this.readSidecar().summary ?? "",
+      proposal: a.proposal ?? "",
+      design: a.design ?? "",
+      tasks: a.tasks ?? "",
+      specs: a.specs
+    };
+  }
+  /**
+   * Materialize a generated bundle in OpenSpec layout, writing only files
+   * whose content actually changed. Returns the relative paths written.
+   */
+  writeBundle(bundle) {
+    const files = {
+      "proposal.md": bundle.proposal,
+      "design.md": bundle.design,
+      "tasks.md": bundle.tasks
+    };
+    for (const s of bundle.specs) files[join5("specs", s.capability, "spec.md")] = s.spec;
+    const written = [];
+    const manifest = {};
+    for (const [relPath, content] of Object.entries(files)) {
+      manifest[relPath] = sha2562(content);
+      if (this.readIfExists(relPath) === content) continue;
+      this.writeAtomic(relPath, content);
+      written.push(relPath);
+    }
+    this.updateSidecar((s) => ({
+      ...s,
+      summary: bundle.summary,
+      generated: manifest,
+      // The diff-before-write result IS the changed-file signal for the
+      // post-generation chat seed (generation-chat-reset-summary).
+      lastGeneration: { at: (/* @__PURE__ */ new Date()).toISOString(), changedFiles: written }
+    }));
+    const lastGeneratedBodyHash = bodyHash(this.dir, nodeChangeMetaFs);
+    if (lastGeneratedBodyHash) {
+      writeChangeMeta(nodeChangeMetaFs, this.dir, {
+        specId: this.changeName,
+        userStories: [],
+        dependencies: [],
+        status: "draft",
+        generation: { lastGeneratedBodyHash, lastGeneratedAt: (/* @__PURE__ */ new Date()).toISOString() }
+      });
+    }
+    return written;
+  }
+  // ── Spec review chat ─────────────────────────────────────────────────────
+  readChat() {
+    return this.readSidecar().chat ?? [];
+  }
+  writeChat(chat) {
+    this.updateSidecar((s) => ({ ...s, chat }));
+  }
+  // ── Generation system prompt override ────────────────────────────────────
+  readSystemPrompt() {
+    return this.readSidecar().systemPrompt;
+  }
+  /** `undefined` clears the override (reset to the built-in default). */
+  writeSystemPrompt(systemPrompt) {
+    this.updateSidecar(({ systemPrompt: _prev, ...s }) => ({
+      ...s,
+      ...systemPrompt !== void 0 ? { systemPrompt } : {}
+    }));
+  }
+};
+
+// server/workbench-host.ts
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname5, join as join10, resolve as resolve3 } from "node:path";
+
+// src/workbench/core/capability-store.ts
+import { readFileSync as readFileSync4, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+
+// src/workbench/core/spec-parse.ts
+var REQUIREMENT_HEADING = /^###[ \t]+Requirement:[ \t]*(.*)$/;
+var TERMINATING_HEADING = /^#{1,3}(?!#)(?:[ \t]|$)/;
+var HIGHER_LEVEL_HEADING = /^#{1,2}(?!#)(?:[ \t]|$)/;
+var FENCE_DELIMITER = /^[ \t]{0,3}(`{3,}|~{3,})[ \t]*(.*)$/;
+function probe(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+function isBlank(line) {
+  return probe(line).trim() === "";
+}
+function advanceFence(open, probed, lineNumber, rawLine) {
+  const delimiter2 = FENCE_DELIMITER.exec(probed);
+  if (!delimiter2) return open;
+  const marker = delimiter2[1];
+  const info = delimiter2[2] ?? "";
+  const char = marker[0];
+  if (open === null) {
+    if (char === "`" && info.includes("`")) return null;
+    return { char, length: marker.length, openLine: lineNumber, openText: rawLine };
+  }
+  if (char === open.char && marker.length >= open.length && info.trim() === "") return null;
+  return open;
+}
+function closeBlock(open) {
+  const lines = open.lines.slice();
+  while (lines.length > 1 && isBlank(lines[lines.length - 1])) lines.pop();
+  const bodyLines = lines.slice(1);
+  return {
+    index: open.index,
+    name: open.name,
+    headingLine: open.headingLine,
+    lines,
+    text: lines.join("\n"),
+    bodyLines,
+    bodyText: bodyLines.join("\n"),
+    startLine: open.startLine,
+    endLine: open.startLine + lines.length,
+    higherLevelHeadings: open.higherLevelHeadings.filter(
+      (h) => h.line < open.startLine + lines.length
+    )
+  };
+}
+function parseSpecFile(src) {
+  const lines = src.split("\n");
+  const head = [];
+  const requirements = [];
+  const outside = [];
+  let open = null;
+  let outsideStart = -1;
+  let outsideLines = [];
+  const fence = { open: null };
+  const flushOutside = () => {
+    if (outsideStart >= 0) {
+      outside.push({ startLine: outsideStart, lines: outsideLines });
+      outsideStart = -1;
+      outsideLines = [];
+    }
+  };
+  lines.forEach((line, i) => {
+    const p = probe(line);
+    const wasFenced = fence.open !== null;
+    fence.open = advanceFence(fence.open, p, i, line);
+    const fenced = wasFenced || fence.open !== null;
+    if (!fenced) {
+      const requirementHeading = REQUIREMENT_HEADING.exec(p);
+      if (requirementHeading) {
+        if (open) requirements.push(closeBlock(open));
+        flushOutside();
+        open = {
+          index: requirements.length,
+          name: (requirementHeading[1] ?? "").trim(),
+          headingLine: line,
+          startLine: i,
+          lines: [line],
+          higherLevelHeadings: []
+        };
+        return;
+      }
+      if (TERMINATING_HEADING.test(p)) {
+        if (open) {
+          requirements.push(closeBlock(open));
+          open = null;
+        }
+        if (requirements.length === 0) {
+          head.push(line);
+          return;
+        }
+        if (outsideStart < 0) outsideStart = i;
+        outsideLines.push(line);
+        return;
+      }
+    }
+    if (open) {
+      const block = open;
+      if (HIGHER_LEVEL_HEADING.test(p)) block.higherLevelHeadings.push({ line: i, text: line });
+      block.lines.push(line);
+      return;
+    }
+    if (requirements.length === 0) {
+      head.push(line);
+      return;
+    }
+    if (outsideStart < 0) outsideStart = i;
+    outsideLines.push(line);
+  });
+  if (open) requirements.push(closeBlock(open));
+  flushOutside();
+  const unterminatedFence = fence.open === null ? null : { openLine: fence.open.openLine, openText: fence.open.openText };
+  return {
+    head,
+    headText: head.join("\n"),
+    requirements,
+    outside,
+    unterminatedFence
+  };
+}
+function countRequirements(src) {
+  return parseSpecFile(src).requirements.length;
+}
+
+// src/workbench/core/capability-store.ts
+var CAPABILITY_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SPEC_FILE = "spec.md";
+function validateCapabilityName(name) {
+  if (name.length === 0) return "a capability name cannot be empty";
+  if (!CAPABILITY_NAME.test(name)) {
+    return `\`${name}\` is not a capability name: expected lowercase kebab-case, e.g. \`specsketch-delta-derivation\``;
+  }
+  return null;
+}
+function readIfPresent(path) {
+  try {
+    if (!statSync2(path).isFile()) return null;
+  } catch {
+    return null;
+  }
+  return readFileSync4(path, "utf8");
+}
+function createFoldedSpecReader(repoRoot) {
+  const specsDir = join6(repoRoot, "openspec", "specs");
+  const specPath = (name) => join6(specsDir, name, SPEC_FILE);
+  const readCapability = (name) => {
+    const invalid = validateCapabilityName(name);
+    if (invalid) throw new RangeError(invalid);
+    return readIfPresent(specPath(name));
+  };
+  const listCapabilities = (openCapabilities = []) => {
+    const open = new Set(openCapabilities);
+    const listings = [];
+    for (const entry of readdirSync5(specsDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const folded = readIfPresent(specPath(entry.name));
+      if (folded === null) continue;
+      listings.push({
+        name: entry.name,
+        requirementCount: countRequirements(folded),
+        alreadyOpen: open.has(entry.name)
+      });
+    }
+    listings.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    return listings;
+  };
+  const openCapability = (name, openCapabilities = []) => {
+    const invalid = validateCapabilityName(name);
+    if (invalid) return { outcome: "invalid-name", capability: name, reason: invalid };
+    if (new Set(openCapabilities).has(name)) return { outcome: "already-open", capability: name };
+    const folded = readIfPresent(specPath(name));
+    if (folded === null) return { outcome: "no-folded-counterpart", capability: name };
+    return { outcome: "opened", capability: name, draft: folded, folded };
+  };
+  return Object.freeze({ specsDir, listCapabilities, readCapability, openCapability });
+}
+
+// src/workbench/approve/approve.ts
+import { execFileSync } from "node:child_process";
+import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync5, rmSync, statSync as statSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join7 } from "node:path";
+
+// src/workbench/core/emit.ts
+var PROPOSAL_SECTIONS = Object.freeze([
+  { id: "why", title: "Why", level: 2, required: true, skippable: false },
+  { id: "what-changes", title: "What Changes", level: 2, required: true, skippable: false },
+  { id: "system-context", title: "System context", level: 3, required: true, skippable: true },
+  { id: "containers", title: "Containers", level: 3, required: true, skippable: true },
+  { id: "components", title: "Components", level: 3, required: true, skippable: true },
+  { id: "code", title: "Code", level: 3, required: false, skippable: true },
+  { id: "impact", title: "Impact", level: 2, required: true, skippable: false }
 ]);
-var canvasSessionCreatedSchema = z3.object({
-  sessionId: z3.string().min(1),
-  /** Capability token — shown once; the server stores only its hash. */
-  token: z3.string().min(1),
-  shareUrl: z3.string().min(1),
-  wsUrl: z3.string().min(1)
-});
-var canvasSessionSummarySchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().nullable(),
-  status: z3.enum(["active", "ended"]),
-  createdAt: z3.number(),
-  endedAt: z3.number().nullable()
+function emptyProposal() {
+  return {
+    why: { state: "empty" },
+    "what-changes": { state: "empty" },
+    "system-context": { state: "empty" },
+    containers: { state: "empty" },
+    components: { state: "empty" },
+    code: { state: "empty" },
+    impact: { state: "empty" }
+  };
+}
+var DESIGN_FENCES = Object.freeze({
+  mermaid: "mermaid",
+  sketch: "specsketch-sketch"
 });
-function elementWins(local, incoming) {
-  if (incoming.version !== local.version) return incoming.version > local.version;
-  return incoming.versionNonce < local.versionNonce;
-}
-function reconcileCanvasElements(local, incoming) {
-  const byId = new Map(local.map((el) => [el.id, el]));
-  const accepted = [];
-  for (const el of incoming) {
-    const existing = byId.get(el.id);
-    if (!existing || elementWins(existing, el)) {
-      byId.set(el.id, el);
-      accepted.push(el);
-    }
-  }
-  return { elements: [...byId.values()], accepted };
-}
-
-// server/remote-session.ts
-var HEARTBEAT_INTERVAL_MS = 3e4;
-var HEARTBEAT_TIMEOUT_MS = 75e3;
-var BACKOFF_MIN_MS = 1e3;
-var BACKOFF_MAX_MS = 3e4;
-var PENDING_OP_LIMIT = 200;
-function asCanvasElements(elements) {
-  if (!elements) return [];
-  return elements.filter(
-    (el) => typeof el === "object" && el !== null && typeof el.id === "string" && typeof el.version === "number" && typeof el.versionNonce === "number"
-  );
+function numberTasks(groups) {
+  return groups.map((group, g) => ({
+    ...group,
+    number: `${g + 1}`,
+    title: group.title,
+    tasks: group.tasks.map((task, t) => ({ ...task, number: `${g + 1}.${t + 1}` }))
+  }));
+}
+var SCENARIO_HEADING = /^####[ \t]+Scenario:[ \t]*(.*)$/;
+var ANY_HEADING = /^#{1,6}[ \t]/;
+function probe2(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+function parseScenarios(block) {
+  const scenarios = [];
+  let open = null;
+  for (const line of block.bodyLines) {
+    const p = probe2(line);
+    const heading = SCENARIO_HEADING.exec(p);
+    if (heading) {
+      if (open) scenarios.push(open);
+      open = { name: (heading[1] ?? "").trim(), steps: [] };
+      continue;
+    }
+    if (ANY_HEADING.test(p)) {
+      if (open) scenarios.push(open);
+      open = null;
+      continue;
+    }
+    if (open && p.trim() !== "") open.steps.push(p);
+  }
+  if (open) scenarios.push(open);
+  return scenarios;
+}
+function requirementProse(block) {
+  const prose = [];
+  for (const line of block.bodyLines) {
+    const p = probe2(line);
+    if (SCENARIO_HEADING.test(p) || ANY_HEADING.test(p)) break;
+    prose.push(p);
+  }
+  return prose.join("\n").trim();
+}
+function draftBlockOf(delta) {
+  return delta.operation === "REMOVED" ? null : delta.block;
+}
+function deltasOf(entry) {
+  return entry.derivation.outcome === "derived" ? entry.derivation.deltas : [];
+}
+function emitsDeltaSpec(entry) {
+  return deltasOf(entry).length > 0;
+}
+function testingRows(capabilities) {
+  const rows = [];
+  for (const entry of capabilities) {
+    for (const delta of deltasOf(entry)) {
+      const block = draftBlockOf(delta);
+      if (!block) continue;
+      for (const scenario of parseScenarios(block)) {
+        rows.push({
+          index: rows.length + 1,
+          capability: entry.capability,
+          requirement: block.name,
+          scenario: scenario.name
+        });
+      }
+    }
+  }
+  return rows;
+}
+function citableRequirements(capabilities) {
+  const citable = [];
+  for (const entry of capabilities) {
+    for (const delta of deltasOf(entry)) {
+      citable.push({ capability: entry.capability, key: delta.key });
+    }
+  }
+  return citable;
+}
+function purposeOf(entry) {
+  if (entry.derivation.outcome !== "derived") return null;
+  if (entry.derivation.foldedComparison.kind !== "no-folded-counterpart") return null;
+  return readPurposeBody(entry);
+}
+var PURPOSE_HEADING = /^##[ \t]+Purpose[ \t]*$/;
+function readPurposeBody(entry) {
+  const body = [];
+  let inPurpose = false;
+  for (const line of entry.draft.split("\n")) {
+    const p = probe2(line);
+    if (PURPOSE_HEADING.test(p)) {
+      inPurpose = true;
+      continue;
+    }
+    if (inPurpose && ANY_HEADING.test(p)) break;
+    if (inPurpose) body.push(p);
+  }
+  const text = body.join("\n").trim();
+  return text === "" ? null : text;
+}
+function deltaSpecDocument(entry) {
+  const deltas = deltasOf(entry);
+  return {
+    capability: entry.capability,
+    purpose: purposeOf(entry),
+    added: deltas.filter((d) => d.operation === "ADDED").map((d) => blockText(d)),
+    // A declared rename whose body also changed emits RENAMED *and* MODIFIED: the
+    // rename names the heading change, the modification carries the body change
+    // with the folded block as its base. Emitting only the rename would discard a
+    // body edit the author made; refusing would make a legitimate edit and a
+    // legitimate rename mutually exclusive. See `docs/specsketch-workbench-issues.md` #8.
+    modified: deltas.filter((d) => d.operation === "MODIFIED" || d.operation === "RENAMED" && d.bodyChanged).map((d) => blockText(d)),
+    removed: deltas.filter((d) => d.operation === "REMOVED").map((d) => d.base.name),
+    renamed: deltas.filter((d) => d.operation === "RENAMED").map((d) => ({ from: d.base.name, to: d.block.name }))
+  };
+}
+function blockText(delta) {
+  const block = draftBlockOf(delta);
+  if (!block) throw new RangeError(`no draft block for ${delta.operation} delta \`${delta.key}\``);
+  return block.text;
+}
+function changeDocument(change) {
+  return {
+    id: change.id,
+    proposal: change.proposal,
+    design: change.design,
+    groups: numberTasks(change.tasks),
+    testing: testingRows(change.capabilities),
+    deltaSpecs: change.capabilities.filter(emitsDeltaSpec).map(deltaSpecDocument).sort((a, b) => a.capability < b.capability ? -1 : a.capability > b.capability ? 1 : 0)
+  };
+}
+var SKIPPED_MARKER = "_Skipped._";
+var UNSATISFIED_MARKER = "_Unsatisfied \u2014 this section has no body and no recorded skip._";
+function renderProposalSection(spec, section2) {
+  const heading = `${"#".repeat(spec.level)} ${spec.title}`;
+  switch (section2.state) {
+    case "authored":
+      return `${heading}
+
+${section2.body}
+`;
+    case "skipped":
+      return `${heading}
+
+${SKIPPED_MARKER} ${section2.reason.trim()}
+`;
+    case "empty":
+      return `${heading}
+
+${UNSATISFIED_MARKER}
+`;
+  }
+}
+function renderProposal(doc) {
+  const parts = [`# ${doc.id}
+`];
+  for (const spec of PROPOSAL_SECTIONS) {
+    parts.push(renderProposalSection(spec, doc.proposal[spec.id]));
+  }
+  return `${parts.join("\n")}`;
+}
+function renderDesign(doc) {
+  const parts = [`# Design \u2014 ${doc.id}
+`];
+  for (const block of doc.design) {
+    const title = (block.title ?? "").trim();
+    const heading = title === "" ? "" : `## ${title}
+
+`;
+    if (block.kind === "markdown") {
+      parts.push(`${heading}${block.text.trim()}
+`);
+      continue;
+    }
+    const info = block.kind === "mermaid" ? DESIGN_FENCES.mermaid : DESIGN_FENCES.sketch;
+    parts.push(`${heading}\`\`\`${info}
+${block.text.trim()}
+\`\`\`
+`);
+  }
+  return parts.join("\n");
+}
+function cell(text) {
+  return text.replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
+}
+function uncell(text) {
+  return text.replace(/\\\|/g, "|").replace(/\\\\/g, "\\");
+}
+function renderTasks(doc) {
+  const parts = [`# Tasks \u2014 ${doc.id}
+`];
+  for (const group of doc.groups) {
+    const citation = group.cites ? ` \u2014 implements \`${group.cites.capability}\`: \`${group.cites.key}\`` : "";
+    const lines = [`## ${group.number}. ${group.title}${citation}
+`];
+    for (const task of group.tasks) {
+      const box = task.done ? "x" : " ";
+      lines.push(`- [${box}] ${task.number} ${task.title}`);
+    }
+    parts.push(`${lines.join("\n")}
+`);
+  }
+  parts.push(renderTestingTable(doc.testing));
+  return parts.join("\n");
+}
+function renderTestingTable(rows) {
+  const lines = [
+    "## Testing",
+    "",
+    "One test per scenario. This table is derived from the change's deltas \u2014 it is not",
+    "editable text, and its row count is the change's scenario count.",
+    "",
+    "| # | Capability | Requirement | Scenario |",
+    "|---:|---|---|---|"
+  ];
+  for (const row of rows) {
+    lines.push(
+      `| ${row.index} | \`${cell(row.capability)}\` | ${cell(row.requirement)} | ${cell(row.scenario)} |`
+    );
+  }
+  if (rows.length === 0) lines.push("| \u2014 | \u2014 | \u2014 | \u2014 |");
+  return `${lines.join("\n")}
+`;
+}
+function renderDeltaSpec(doc, changeId) {
+  const parts = [`# ${doc.capability} (delta) \u2014 ${changeId}
+`];
+  if (doc.purpose !== null) parts.push(`## Purpose
+
+${doc.purpose}
+`);
+  if (doc.added.length > 0) parts.push(section("## ADDED Requirements", doc.added));
+  if (doc.modified.length > 0) parts.push(section("## MODIFIED Requirements", doc.modified));
+  if (doc.removed.length > 0) {
+    parts.push(
+      section(
+        "## REMOVED Requirements",
+        doc.removed.map((name) => `### Requirement: ${name}`)
+      )
+    );
+  }
+  if (doc.renamed.length > 0) {
+    const pairs = doc.renamed.map(
+      (pair) => `- FROM: \`### Requirement: ${pair.from}\`
+- TO: \`### Requirement: ${pair.to}\``
+    );
+    parts.push(`## RENAMED Requirements
+
+${pairs.join("\n\n")}
+`);
+  }
+  return parts.join("\n");
+}
+function section(heading, blocks) {
+  return `${heading}
+
+${blocks.map((b) => b.trimEnd()).join("\n\n")}
+`;
+}
+function renderChangeDocument(doc) {
+  const files = [
+    { path: "proposal.md", content: renderProposal(doc) },
+    { path: "design.md", content: renderDesign(doc) },
+    { path: "tasks.md", content: renderTasks(doc) }
+  ];
+  for (const spec of doc.deltaSpecs) {
+    files.push({
+      path: `specs/${spec.capability}/spec.md`,
+      content: renderDeltaSpec(spec, doc.id)
+    });
+  }
+  return { id: doc.id, files };
+}
+function emitChange(change) {
+  return renderChangeDocument(changeDocument(change));
+}
+var TASK_LINE = /^- \[([ xX])\] (\d+\.\d+) (.*)$/;
+var GROUP_CITATION = /^(.*) — implements `([^`]+)`: `([^`]+)`$/;
+var GROUP_HEADING = /^## (\d+)\. (.*)$/;
+var FENCE = /^```(\S*)\s*$/;
+function parseChangeDocument(emitted) {
+  const byPath = new Map(emitted.files.map((f) => [f.path, f.content]));
+  const proposalSrc = byPath.get("proposal.md") ?? "";
+  const designSrc = byPath.get("design.md") ?? "";
+  const tasksSrc = byPath.get("tasks.md") ?? "";
+  const groups = parseTasksFile(tasksSrc);
+  const deltaSpecs = emitted.files.filter((f) => f.path.startsWith("specs/") && f.path.endsWith("/spec.md")).map((f) => parseDeltaSpecFile(capabilityOfPath(f.path), f.content));
+  return {
+    id: emitted.id,
+    proposal: parseProposalFile(proposalSrc),
+    design: parseDesignFile(designSrc),
+    groups: numberTasks(groups),
+    testing: parseTestingTable(tasksSrc),
+    deltaSpecs
+  };
+}
+function capabilityOfPath(path) {
+  const parts = path.split("/");
+  return parts[1] ?? "";
+}
+function parseProposalFile(src) {
+  const lines = src.split("\n");
+  const bodies = /* @__PURE__ */ new Map();
+  let current = null;
+  for (const line of lines) {
+    const p = probe2(line);
+    const spec = PROPOSAL_SECTIONS.find(
+      (s) => p === `${"#".repeat(s.level)} ${s.title}`
+    );
+    if (spec) {
+      current = spec.id;
+      bodies.set(spec.id, []);
+      continue;
+    }
+    if (ANY_HEADING.test(p)) {
+      current = null;
+      continue;
+    }
+    if (current) bodies.get(current).push(p);
+  }
+  const draft = emptyProposal();
+  for (const spec of PROPOSAL_SECTIONS) {
+    const body = (bodies.get(spec.id) ?? []).join("\n").trim();
+    if (body === "" || body === UNSATISFIED_MARKER) {
+      draft[spec.id] = { state: "empty" };
+      continue;
+    }
+    if (body.startsWith(SKIPPED_MARKER)) {
+      draft[spec.id] = { state: "skipped", reason: body.slice(SKIPPED_MARKER.length).trim() };
+      continue;
+    }
+    draft[spec.id] = { state: "authored", body };
+  }
+  return draft;
 }
-var RemoteSession = class _RemoteSession {
-  sessionId;
-  shareUrl;
-  token;
-  wsUrl;
-  opts;
-  status = "connecting";
-  revision = 0;
-  participants = [];
-  ws = null;
-  closed = false;
-  clientSeq = 0;
-  backoffMs;
-  lastTrafficAt = 0;
-  heartbeatTimer = null;
-  reconnectTimer = null;
-  pendingOps = [];
-  api;
-  constructor(opts, api, created) {
-    this.opts = opts;
-    this.api = api;
-    this.sessionId = created.sessionId;
-    this.token = created.token;
-    this.shareUrl = created.shareUrl;
-    this.wsUrl = created.wsUrl;
-    this.backoffMs = opts.backoffMinMs ?? BACKOFF_MIN_MS;
-  }
-  /** Create the session server-side and open the host connection. */
-  static async start(opts) {
-    const api = opts.api ?? new ApiClient(opts.apiUrl, opts.key, opts.userId);
-    let response;
-    try {
-      response = await api.createCanvasSession({ title: opts.title });
-    } catch (err) {
-      if (isCoopApiError(err)) {
-        if (err.status === 401 || err.status === 403) {
-          throw new Error(
-            "CoopCLI rejected the saved credentials (revoked or expired key). Run `specsketch login` and retry."
-          );
-        }
-        throw new Error(`Could not create the shared session: HTTP ${err.status} ${err.message}`);
+var DESIGN_HEADING = /^##[ \t]+(.*)$/;
+function parseDesignFile(src) {
+  const lines = src.split("\n");
+  const blocks = [];
+  let markdown = [];
+  let title = null;
+  let fence = null;
+  const withTitle = (block) => {
+    if (title === null) return block;
+    const titled = { ...block, title };
+    title = null;
+    return titled;
+  };
+  const flushMarkdown = () => {
+    const text = markdown.join("\n").trim();
+    if (text !== "" || title !== null) blocks.push(withTitle({ kind: "markdown", text }));
+    markdown = [];
+  };
+  for (const [i, line] of lines.entries()) {
+    const p = probe2(line);
+    const fenceMatch = FENCE.exec(p);
+    if (fence) {
+      if (p === "```") {
+        const kind = fence.info === DESIGN_FENCES.mermaid ? "mermaid" : "sketch";
+        blocks.push(withTitle({ kind, text: fence.lines.join("\n").trim() }));
+        fence = null;
+        continue;
       }
-      throw err;
+      fence.lines.push(p);
+      continue;
     }
-    const created = canvasSessionCreatedSchema.parse(response);
-    const session = new _RemoteSession(opts, api, created);
-    session.connect();
-    return session;
-  }
-  // ── Upstream connection ──
-  connect() {
-    if (this.closed) return;
-    const factory = this.opts.wsFactory ?? ((url, headers) => new WebSocket(url, { headers }));
-    const ws = factory(this.wsUrl, { Authorization: `Bearer ${this.opts.key}` });
-    this.ws = ws;
-    this.lastTrafficAt = Date.now();
-    ws.on("open", () => {
-      this.backoffMs = this.opts.backoffMinMs ?? BACKOFF_MIN_MS;
-      this.status = "connected";
-      ws.send(
-        JSON.stringify({
-          type: "hello",
-          protocolVersion: CANVAS_PROTOCOL_VERSION,
-          role: "host",
-          name: this.opts.hostName ?? void 0
-        })
-      );
-      for (const frame of this.pendingOps.splice(0)) ws.send(frame);
-    });
-    ws.on("message", (data) => this.handleUpstreamFrame(String(data)));
-    ws.on("close", (code) => {
-      if (ws !== this.ws) return;
-      this.stopHeartbeat();
-      if (this.closed) return;
-      this.status = "reconnecting";
-      this.opts.log?.(`share: connection lost (code ${code}) \u2014 reconnecting`);
-      this.scheduleReconnect();
-    });
-    ws.on("error", () => {
+    if (fenceMatch && isDesignFence(fenceMatch[1] ?? "")) {
+      if (markdown.join("\n").trim() !== "") flushMarkdown();
+      markdown = [];
+      fence = { info: fenceMatch[1], lines: [] };
+      continue;
+    }
+    const heading = DESIGN_HEADING.exec(p);
+    if (heading) {
+      flushMarkdown();
+      title = (heading[1] ?? "").trim();
+      continue;
+    }
+    if (i === 0 && p.startsWith("# Design \u2014 ")) continue;
+    markdown.push(p);
+  }
+  flushMarkdown();
+  return blocks;
+}
+function isDesignFence(info) {
+  return info === DESIGN_FENCES.mermaid || info === DESIGN_FENCES.sketch;
+}
+function parseTasksFile(src) {
+  const groups = [];
+  let open = null;
+  for (const line of src.split("\n")) {
+    const p = probe2(line);
+    const heading = GROUP_HEADING.exec(p);
+    if (heading) {
+      if (open) groups.push(open);
+      const text = (heading[2] ?? "").trim();
+      const cited = GROUP_CITATION.exec(text);
+      open = cited ? {
+        title: (cited[1] ?? "").trim(),
+        tasks: [],
+        cites: { capability: cited[2], key: cited[3] }
+      } : { title: text, tasks: [] };
+      continue;
+    }
+    if (/^##[ \t]/.test(p)) {
+      if (open) groups.push(open);
+      open = null;
+      continue;
+    }
+    const task = TASK_LINE.exec(p);
+    if (task && open) {
+      const done = (task[1] ?? " ").toLowerCase() === "x";
+      open.tasks.push({ title: (task[3] ?? "").trim(), done });
+    }
+  }
+  if (open) groups.push(open);
+  return groups;
+}
+function parseTestingTable(src) {
+  const rows = [];
+  let inTable = false;
+  for (const line of src.split("\n")) {
+    const p = probe2(line);
+    if (p.startsWith("| # | Capability |")) {
+      inTable = true;
+      continue;
+    }
+    if (!inTable) continue;
+    if (!p.startsWith("|")) break;
+    if (/^\|[-: |]+\|$/.test(p)) continue;
+    const cells = splitRow(p);
+    if (cells.length !== 4) continue;
+    const index = Number.parseInt(cells[0], 10);
+    if (!Number.isFinite(index)) continue;
+    rows.push({
+      index,
+      capability: cells[1].replace(/^`|`$/g, ""),
+      requirement: cells[2],
+      scenario: cells[3]
     });
-    this.startHeartbeat();
-  }
-  scheduleReconnect() {
-    if (this.closed || this.reconnectTimer) return;
-    const jitter = Math.random() * 0.3 + 0.85;
-    const delay = Math.round(this.backoffMs * jitter);
-    this.backoffMs = Math.min(this.backoffMs * 2, BACKOFF_MAX_MS);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = null;
-      this.connect();
-    }, delay);
-  }
-  startHeartbeat() {
-    this.stopHeartbeat();
-    this.heartbeatTimer = setInterval(() => {
-      const ws = this.ws;
-      if (!ws || ws.readyState !== WebSocket.OPEN) return;
-      if (Date.now() - this.lastTrafficAt > HEARTBEAT_TIMEOUT_MS) {
-        ws.terminate();
-        return;
+  }
+  return rows;
+}
+function splitRow(line) {
+  const cells = [];
+  let buffer = "";
+  let escaped = false;
+  for (const char of line.slice(1, line.lastIndexOf("|"))) {
+    if (escaped) {
+      buffer += `\\${char}`;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === "|") {
+      cells.push(uncell(buffer.trim()));
+      buffer = "";
+      continue;
+    }
+    buffer += char;
+  }
+  cells.push(uncell(buffer.trim()));
+  return cells;
+}
+var DELTA_SECTION = /^## (ADDED|MODIFIED|REMOVED|RENAMED) Requirements[ \t]*$/;
+var REQUIREMENT_HEADING2 = /^###[ \t]+Requirement:[ \t]*(.*)$/;
+var RENAME_FROM = /^-[ \t]+FROM:[ \t]*`###[ \t]*Requirement:[ \t]*(.+?)`[ \t]*$/;
+var RENAME_TO = /^-[ \t]+TO:[ \t]*`###[ \t]*Requirement:[ \t]*(.+?)`[ \t]*$/;
+function parseDeltaSpecFile(capability, src) {
+  const added = [];
+  const modified = [];
+  const removed = [];
+  const renamed = [];
+  const purposeLines = [];
+  let operation = null;
+  let block = null;
+  let pendingFrom = null;
+  const flushBlock = () => {
+    if (!block) return;
+    const text = block.join("\n").trimEnd();
+    if (operation === "ADDED") added.push(text);
+    if (operation === "MODIFIED") modified.push(text);
+    block = null;
+  };
+  for (const line of src.split("\n")) {
+    const p = probe2(line);
+    const sectionHeading = DELTA_SECTION.exec(p);
+    if (sectionHeading) {
+      flushBlock();
+      operation = sectionHeading[1];
+      continue;
+    }
+    if (PURPOSE_HEADING.test(p)) {
+      flushBlock();
+      operation = "PURPOSE";
+      continue;
+    }
+    if (/^##(?!#)[ \t]/.test(p)) {
+      flushBlock();
+      operation = null;
+      continue;
+    }
+    if (operation === "PURPOSE") {
+      purposeLines.push(p);
+      continue;
+    }
+    const requirementHeading = REQUIREMENT_HEADING2.exec(p);
+    if (requirementHeading) {
+      flushBlock();
+      if (operation === "REMOVED") {
+        removed.push((requirementHeading[1] ?? "").trim());
+        continue;
       }
-      ws.send("ping");
-    }, HEARTBEAT_INTERVAL_MS);
-    this.heartbeatTimer.unref?.();
-  }
-  stopHeartbeat() {
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    this.heartbeatTimer = null;
-  }
-  // ── Frames from the DO ──
-  handleUpstreamFrame(text) {
-    this.lastTrafficAt = Date.now();
-    if (text === "pong") return;
-    const parsed = canvasServerMessageSchema.safeParse(
-      (() => {
-        try {
-          return JSON.parse(text);
-        } catch {
-          return null;
-        }
-      })()
-    );
-    if (!parsed.success) return;
-    const frame = parsed.data;
-    switch (frame.type) {
-      case "snapshot": {
-        const local = this.opts.workspace.loadScene();
-        const { elements, accepted } = reconcileCanvasElements(
-          asCanvasElements(frame.scene.elements),
-          asCanvasElements(local?.elements)
-        );
-        this.revision = frame.revision;
-        this.participants = frame.participants;
-        this.opts.workspace.saveScene({
-          elements,
-          appState: local?.appState,
-          files: { ...frame.scene.files ?? {}, ...local?.files ?? {} }
-        });
-        if (accepted.length > 0) {
-          this.sendUpstream(
-            JSON.stringify({ type: "op", elements: accepted, clientSeq: ++this.clientSeq })
-          );
-        }
-        this.opts.onLocalBroadcast?.(text);
-        return;
+      if (operation === "ADDED" || operation === "MODIFIED") block = [p];
+      continue;
+    }
+    if (operation === "RENAMED") {
+      const from = RENAME_FROM.exec(p);
+      if (from) {
+        pendingFrom = (from[1] ?? "").trim();
+        continue;
       }
-      case "op": {
-        if (frame.revision > this.revision + 1) {
-          this.ws?.terminate();
-          return;
-        }
-        this.revision = frame.revision;
-        this.applyRemoteElements(frame.elements, frame.files);
-        this.opts.onLocalBroadcast?.(text);
-        return;
+      const to = RENAME_TO.exec(p);
+      if (to && pendingFrom !== null) {
+        renamed.push({ from: pendingFrom, to: (to[1] ?? "").trim() });
+        pendingFrom = null;
       }
-      case "presence": {
-        this.participants = frame.participants;
-        this.opts.onLocalBroadcast?.(text);
-        return;
+      continue;
+    }
+    if (block) block.push(p);
+  }
+  flushBlock();
+  const purpose = purposeLines.join("\n").trim();
+  return {
+    capability,
+    purpose: purpose === "" ? null : purpose,
+    added,
+    modified,
+    removed,
+    renamed
+  };
+}
+
+// src/workbench/core/validate.ts
+var SHALL_OR_MUST = /\b(SHALL|MUST)\b/;
+function validateChange(change) {
+  const findings = [
+    ...validateProposal(change),
+    ...validateDesign(change),
+    ...validateCapabilities(change),
+    ...validateTasks(change)
+  ];
+  return report(findings);
+}
+function report(findings) {
+  const errors = findings.filter((f) => f.severity === "error");
+  const warnings = findings.filter((f) => f.severity === "warning");
+  return { findings, errors, warnings, valid: errors.length === 0 };
+}
+function validateProposal(change) {
+  const findings = [];
+  for (const spec of PROPOSAL_SECTIONS) {
+    const section2 = change.proposal[spec.id];
+    const subject = {
+      kind: "proposal-section",
+      section: spec.id,
+      title: spec.title
+    };
+    if (section2.state === "skipped") {
+      findings.push(...validateSkip(spec, section2.reason, subject));
+      continue;
+    }
+    if (section2.state === "empty" && spec.required) {
+      findings.push({
+        severity: "error",
+        kind: "proposal-section-unsatisfied",
+        subject,
+        message: `\`${spec.title}\` has no body and no recorded skip, and is required.`
+      });
+    }
+  }
+  return findings;
+}
+function validateSkip(spec, reason, subject) {
+  if (!spec.skippable) {
+    return [
+      {
+        severity: "error",
+        kind: "proposal-section-not-skippable",
+        subject,
+        message: `\`${spec.title}\` is not skippable \u2014 only the C4 levels are.`
       }
-      case "end": {
-        this.opts.log?.(`share: session ended (${frame.reason})`);
-        this.opts.onLocalBroadcast?.(text);
-        this.closed = true;
-        this.status = "ended";
-        this.teardown();
-        return;
+    ];
+  }
+  if (reason.trim() === "") {
+    return [
+      {
+        severity: "error",
+        kind: "proposal-skip-without-reason",
+        subject,
+        message: `\`${spec.title}\` is skipped with no recorded reason; a skip requires one.`
       }
-      case "error": {
-        this.opts.log?.(`share: server error ${frame.code}: ${frame.message}`);
-        return;
+    ];
+  }
+  return [];
+}
+function validateDesign(change) {
+  if (change.design.length === 0) {
+    return [
+      {
+        severity: "warning",
+        kind: "design-empty",
+        subject: { kind: "change", change: change.id },
+        message: "`design.md` carries no blocks; the change will emit a title and nothing else."
       }
-    }
+    ];
   }
-  /** Persist remote edits into the change directory — the durable copy. */
-  applyRemoteElements(incoming, files) {
-    const local = this.opts.workspace.loadScene();
-    const { elements } = reconcileCanvasElements(asCanvasElements(local?.elements), incoming);
-    this.opts.workspace.saveScene({
-      elements,
-      appState: local?.appState,
-      files: { ...local?.files ?? {}, ...files ?? {} }
+  const findings = [];
+  change.design.forEach((block, index) => {
+    if ((block.title ?? "").trim() !== "") return;
+    findings.push({
+      severity: "error",
+      kind: "design-block-untitled",
+      // An untitled block has no name to be reported under, so it is named by where
+      // it is and what it is — the two things the author can find it by.
+      subject: { kind: "design-block", index, blockKind: block.kind },
+      message: `Design block ${index + 1} (\`${block.kind}\`) carries no title, and a block's title is emitted as its \`##\` heading.`
+    });
+  });
+  return findings;
+}
+function validateCapabilities(change) {
+  const findings = [];
+  let derivedDeltas = 0;
+  for (const entry of change.capabilities) {
+    if (entry.derivation.outcome === "refused") {
+      findings.push(...refusalFindings(entry));
+      continue;
+    }
+    const deltas = deltasOf(entry);
+    derivedDeltas += deltas.length;
+    findings.push(...emptyDerivationFindings(entry));
+    findings.push(...conditionFindings(entry));
+    findings.push(...requirementFindings(entry));
+    findings.push(...duplicateIdentityFindings(entry));
+  }
+  if (derivedDeltas === 0) {
+    findings.push({
+      severity: "error",
+      kind: "no-delta-derived",
+      subject: { kind: "change", change: change.id },
+      message: "the change derives no delta at all, so it alters nothing \u2014 there is no operation to fold."
     });
   }
-  // ── Frames from the host browser (via /ws/local) ──
-  /**
-   * Handle one message from a local browser socket. Ops are relayed upstream
-   * verbatim (the browser already persists via its autosave PUT). A `hello`
-   * is answered locally with a synthetic snapshot so the browser can seed
-   * its revision/participant state without a round-trip to the DO.
-   */
-  handleLocalFrame(text, reply) {
-    const parsed = canvasClientMessageSchema.safeParse(
-      (() => {
-        try {
-          return JSON.parse(text);
-        } catch {
-          return null;
+  return findings;
+}
+function refusalFindings(entry) {
+  if (entry.derivation.outcome !== "refused") return [];
+  return entry.derivation.refusals.map((refusal) => {
+    if (refusal.kind === "duplicate-identity") {
+      const keys = refusal.collisions.map((c) => `\`${c.key}\``).join(", ");
+      return {
+        severity: "error",
+        kind: "duplicate-requirement-identity",
+        subject: { kind: "capability", capability: entry.capability },
+        message: `two requirements in the ${refusal.side} \`${entry.capability}\` claim one identity: ${keys}. One of them would derive nothing.`
+      };
+    }
+    if (refusal.kind === "unterminated-fence") {
+      return {
+        severity: "error",
+        kind: "capability-derivation-refused",
+        subject: { kind: "capability", capability: entry.capability },
+        message: `the ${refusal.side} \`${entry.capability}\` opens a fence on line ${refusal.openLine + 1} (\`${refusal.openText.trim()}\`) and never closes it, so everything after it sits inside the requirement above.`
+      };
+    }
+    return {
+      severity: "error",
+      kind: "capability-derivation-refused",
+      subject: { kind: "capability", capability: entry.capability },
+      message: `\`${entry.capability}\` derives nothing: ${refusal.kind}.`
+    };
+  });
+}
+function emptyDerivationFindings(entry) {
+  if (entry.derivation.outcome !== "derived") return [];
+  if (entry.derivation.deltas.length > 0) return [];
+  const subject = { kind: "capability", capability: entry.capability };
+  switch (entry.derivation.foldedComparison.kind) {
+    case "identical":
+      return [
+        {
+          severity: "warning",
+          kind: "capability-unchanged",
+          subject,
+          message: `\`${entry.capability}\` is open but byte-identical to its folded file; no delta spec is emitted for it.`
         }
-      })()
-    );
-    if (!parsed.success) return;
-    if (parsed.data.type === "hello") {
-      const scene = this.opts.workspace.loadScene();
-      reply(
-        JSON.stringify({
-          type: "snapshot",
-          scene: { elements: scene?.elements ?? [], files: scene?.files ?? void 0 },
-          revision: this.revision,
-          participants: this.participants,
-          protocolVersion: CANVAS_PROTOCOL_VERSION,
-          participantId: "host"
-        })
-      );
-      return;
+      ];
+    case "differs-outside-requirements":
+      return [
+        {
+          severity: "error",
+          kind: "capability-changed-outside-requirements",
+          subject,
+          message: `\`${entry.capability}\` differs from its folded file only outside its requirements (its \`## Purpose\` or head). OpenSpec has no operation for that edit \u2014 a delta file carrying no operation cannot fold. Edit \`openspec/specs/${entry.capability}/spec.md\` directly, or revert the edit.`
+        }
+      ];
+    case "differs-in-requirement-order":
+      return [
+        {
+          severity: "error",
+          kind: "capability-requirements-reordered",
+          subject,
+          message: `\`${entry.capability}\`'s requirements are reordered and otherwise unchanged. OpenSpec has no move operation, so the reordering cannot be folded and would be lost.`
+        }
+      ];
+    case "no-folded-counterpart":
+      return [
+        {
+          severity: "error",
+          kind: "new-capability-declares-no-requirement",
+          subject,
+          message: `\`${entry.capability}\` is a new capability that declares no requirement; there is nothing to add.`
+        }
+      ];
+    case "differs":
+      return [
+        {
+          severity: "error",
+          kind: "capability-differs-without-delta",
+          subject,
+          message: `\`${entry.capability}\` differs from its folded file but derives no delta; the derivation and the comparison disagree about the same two documents.`
+        }
+      ];
+  }
+}
+function conditionFindings(entry) {
+  if (entry.derivation.outcome !== "derived") return [];
+  const findings = [];
+  const isNew = entry.derivation.foldedComparison.kind === "no-folded-counterpart";
+  const subject = { kind: "capability", capability: entry.capability };
+  for (const condition of entry.derivation.conditions) {
+    if (isNew && (condition.kind === "purpose-empty" || condition.kind === "purpose-missing")) {
+      findings.push({
+        severity: "error",
+        kind: "new-capability-purpose-empty",
+        subject,
+        message: `new capability \`${entry.capability}\` has ${condition.kind === "purpose-missing" ? "no `## Purpose` heading" : "an empty `## Purpose`"}; it seeds the folded spec's Purpose, which cannot be left blank.`
+      });
+    }
+    if (condition.kind === "identity-scheme-changed") {
+      findings.push({
+        severity: "warning",
+        kind: "identity-scheme-changed",
+        subject,
+        message: `\`${entry.capability}\`'s folded file resolves on ${condition.foldedScheme} identity and its draft on ${condition.draftScheme}, so no key matches across them: every requirement derives as a removal plus an addition. Declare the renames if that is not what you meant.`
+      });
     }
-    this.sendUpstream(text);
   }
-  sendUpstream(frameText) {
-    const ws = this.ws;
-    if (ws && ws.readyState === WebSocket.OPEN) {
-      ws.send(frameText);
-      return;
+  return findings;
+}
+function requirementFindings(entry) {
+  const findings = [];
+  for (const delta of deltasOf(entry)) {
+    const block = draftBlockOf(delta);
+    if (!block) continue;
+    const subject = {
+      kind: "requirement",
+      capability: entry.capability,
+      requirement: block.name
+    };
+    if (!SHALL_OR_MUST.test(requirementProse(block))) {
+      findings.push({
+        severity: "error",
+        kind: "requirement-without-shall",
+        subject,
+        message: `\`${block.name}\` in \`${entry.capability}\` states no obligation: its text carries neither SHALL nor MUST.`
+      });
+    }
+    const scenarios = parseScenarios(block);
+    if (scenarios.length === 0) {
+      findings.push({
+        severity: "error",
+        kind: "requirement-without-scenario",
+        subject,
+        message: `\`${block.name}\` in \`${entry.capability}\` has no \`#### Scenario:\`; a requirement is not testable without one.`
+      });
+    }
+    for (const scenario of scenarios) {
+      if (scenario.steps.length > 0) continue;
+      findings.push({
+        severity: "error",
+        kind: "scenario-without-steps",
+        subject: {
+          kind: "scenario",
+          capability: entry.capability,
+          requirement: block.name,
+          scenario: scenario.name
+        },
+        message: `scenario \`${scenario.name}\` of \`${block.name}\` in \`${entry.capability}\` has no steps.`
+      });
     }
-    this.pendingOps.push(frameText);
-    if (this.pendingOps.length > PENDING_OP_LIMIT) this.pendingOps.shift();
   }
-  // ── Teardown ──
-  /** End the session server-side (invalidates the share link) and close. */
-  async end() {
-    if (this.status === "ended") return;
-    this.closed = true;
-    this.status = "ended";
-    this.teardown();
-    try {
-      await this.api.endCanvasSession(this.sessionId);
-    } catch {
+  return findings;
+}
+function duplicateIdentityFindings(entry) {
+  const findings = [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const delta of deltasOf(entry)) {
+    const block = draftBlockOf(delta);
+    const name = block ? block.name : delta.operation === "REMOVED" ? delta.base.name : delta.key;
+    const section2 = delta.operation === "RENAMED" ? "MODIFIED" : delta.operation;
+    const slot = `${section2} ${name}`;
+    seen.set(slot, { name, count: (seen.get(slot)?.count ?? 0) + 1 });
+  }
+  for (const { name, count } of seen.values()) {
+    if (count < 2) continue;
+    findings.push({
+      severity: "error",
+      kind: "duplicate-requirement-identity",
+      subject: { kind: "requirement", capability: entry.capability, requirement: name },
+      message: `\`${name}\` appears ${count} times in \`${entry.capability}\`'s deltas; one of them would be invisible after the fold.`
+    });
+  }
+  return findings;
+}
+function validateTasks(change) {
+  const findings = [];
+  const citable = new Set(
+    citableRequirements(change.capabilities).map((c) => `${c.capability} ${c.key}`)
+  );
+  for (const group of numberTasks(change.tasks)) {
+    if (group.tasks.length === 0) {
+      findings.push({
+        severity: "error",
+        kind: "task-group-empty",
+        subject: { kind: "task-group", number: group.number, title: group.title },
+        message: `Task group ${group.number} (\`${group.title}\`) carries no tasks.`
+      });
+    }
+    const cites = group.cites;
+    if (cites) {
+      const subject = {
+        kind: "task-group",
+        number: group.number,
+        title: group.title
+      };
+      if (cites.capability.includes("`") || cites.key.includes("`") || group.title.includes("`")) {
+        findings.push({
+          severity: "error",
+          kind: "task-citation-unrepresentable",
+          subject,
+          message: `task group ${group.number} carries a backtick in its title or citation; the emitted citation could not be read back unambiguously.`
+        });
+      } else if (!citable.has(`${cites.capability} ${cites.key}`)) {
+        findings.push({
+          severity: "error",
+          kind: "task-cites-absent-requirement",
+          subject,
+          message: `task group ${group.number} cites \`${cites.key}\` in \`${cites.capability}\`, which this change no longer declares.`
+        });
+      }
     }
   }
-  teardown() {
-    this.stopHeartbeat();
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.reconnectTimer = null;
+  return findings;
+}
+
+// src/workbench/shell/provenance.ts
+var NO_ISSUE = Object.freeze({ kind: "none" });
+function provenanceValue(provenance) {
+  return provenance.kind === "issue" ? String(provenance.issue) : "none";
+}
+function provenanceFrontmatter(provenance) {
+  return `---
+issue: ${provenanceValue(provenance)}
+---
+`;
+}
+function emitChangeWithProvenance(change, provenance) {
+  const emitted = emitChange(change);
+  return {
+    id: emitted.id,
+    files: emitted.files.map(
+      (file) => file.path === "proposal.md" ? { path: file.path, content: `${provenanceFrontmatter(provenance)}
+${file.content}` } : file
+    )
+  };
+}
+
+// src/workbench/approve/approve.ts
+var ARCHIVE_FLAGS = Object.freeze(["--json", "--yes"]);
+var FLAGS_APPROVAL_NEVER_PASSES = Object.freeze([
+  "--skip-specs",
+  "--no-validate"
+]);
+function archiveArgv(changeId) {
+  return ["archive", changeId, ...ARCHIVE_FLAGS];
+}
+function changeDirectoryOf(repoRoot, changeId) {
+  return join7(repoRoot, "openspec", "changes", changeId);
+}
+function approveChange(repoRoot, change, provenance, options = {}) {
+  const directory = changeDirectoryOf(repoRoot, change.id);
+  const report2 = validateChange(change);
+  if (!report2.valid) {
+    return { outcome: "refused-validation", errors: report2.errors, warnings: report2.warnings };
+  }
+  const emitted = emitChangeWithProvenance(change, provenance);
+  if (!existsSync5(directory)) return { outcome: "refused-not-emitted", directory };
+  const differing = emittedDifferences(directory, emitted);
+  if (differing.length > 0) return { outcome: "refused-emission-stale", directory, differing };
+  const foldedCapabilities = emitted.files.filter((f) => f.path.startsWith("specs/") && f.path.endsWith("/spec.md")).map((f) => f.path.split("/")[1]);
+  const snapshot = takeSnapshot(repoRoot);
+  try {
+    const archive = runArchive(repoRoot, change.id, options);
+    if (archive.kind === "failed") {
+      return {
+        outcome: "refused-fold-failed",
+        code: archive.code,
+        message: archive.message,
+        rollback: restore(repoRoot, snapshot)
+      };
+    }
+    const incomplete = incompleteness(repoRoot, change.id, archive, foldedCapabilities);
+    if (incomplete) {
+      return {
+        outcome: "refused-fold-incomplete",
+        reason: incomplete,
+        rollback: restore(repoRoot, snapshot)
+      };
+    }
+    return {
+      outcome: "approved",
+      archivedAs: archive.archivedAs,
+      archivePath: archive.path,
+      foldedCapabilities,
+      totals: archive.totals,
+      warnings: report2.warnings
+    };
+  } finally {
+    discardSnapshot(snapshot);
+  }
+}
+function emittedDifferences(directory, emitted) {
+  const differing = [];
+  for (const file of emitted.files) {
+    const target = join7(directory, file.path);
+    let onDisk;
     try {
-      this.ws?.close(1e3, "host shutting down");
+      onDisk = readFileSync5(target, "utf8");
     } catch {
+      differing.push(file.path);
+      continue;
+    }
+    if (onDisk !== file.content) differing.push(file.path);
+  }
+  return differing;
+}
+var SNAPSHOT_TREES = Object.freeze(["specs", "changes"]);
+function takeSnapshot(repoRoot) {
+  const directory = mkdtempSync(join7(tmpdir(), "specsketch-approve-"));
+  const present = [];
+  for (const tree of SNAPSHOT_TREES) {
+    const source = join7(repoRoot, "openspec", tree);
+    if (!existsSync5(source)) continue;
+    cpSync(source, join7(directory, tree), { recursive: true });
+    present.push(tree);
+  }
+  return { root: repoRoot, present, directory };
+}
+function restore(repoRoot, snapshot) {
+  try {
+    for (const tree of SNAPSHOT_TREES) {
+      const target = join7(repoRoot, "openspec", tree);
+      rmSync(target, { recursive: true, force: true });
+      if (!snapshot.present.includes(tree)) continue;
+      mkdirSync3(join7(repoRoot, "openspec"), { recursive: true });
+      cpSync(join7(snapshot.directory, tree), target, { recursive: true });
+    }
+    return { kind: "restored" };
+  } catch (error) {
+    return { kind: "restore-failed", error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function discardSnapshot(snapshot) {
+  rmSync(snapshot.directory, { recursive: true, force: true });
+}
+function resolveOpenspecBinary(repoRoot) {
+  const local = join7(repoRoot, "node_modules", ".bin", "openspec");
+  return existsSync5(local) ? local : "openspec";
+}
+var NO_TOTALS = Object.freeze({ added: 0, modified: 0, removed: 0, renamed: 0 });
+function runArchive(repoRoot, changeId, options) {
+  const bin = options.openspecBin ?? resolveOpenspecBinary(repoRoot);
+  let stdout;
+  try {
+    stdout = execFileSync(bin, [...archiveArgv(changeId)], {
+      cwd: repoRoot,
+      encoding: "utf8"
+    });
+  } catch (error) {
+    const captured = error.stdout;
+    if (typeof captured === "string" && captured.trim() !== "") stdout = captured;
+    else {
+      return {
+        kind: "failed",
+        code: "archive_not_run",
+        message: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  return readArchiveJson(stdout);
+}
+function readArchiveJson(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return { kind: "failed", code: "archive_output_unreadable", message: stdout.trim() };
+  }
+  if (!parsed.archive) {
+    const diagnostic = parsed.status?.[0];
+    return {
+      kind: "failed",
+      code: diagnostic?.code ?? "archive_failed",
+      message: diagnostic?.message ?? "openspec archive reported no result and no diagnostic."
+    };
+  }
+  const totals = parsed.archive.totals;
+  return {
+    kind: "archived",
+    archivedAs: parsed.archive.archivedAs ?? "",
+    path: parsed.archive.path ?? "",
+    specsUpdated: parsed.archive.specsUpdated === true,
+    totals: totals ? {
+      added: totals.added ?? 0,
+      modified: totals.modified ?? 0,
+      removed: totals.removed ?? 0,
+      renamed: totals.renamed ?? 0
+    } : NO_TOTALS
+  };
+}
+function incompleteness(repoRoot, changeId, archive, foldedCapabilities) {
+  if (!archive.specsUpdated) return { kind: "no-spec-updated" };
+  const folded = archive.totals.added + archive.totals.modified + archive.totals.removed + archive.totals.renamed;
+  if (folded === 0) return { kind: "nothing-folded" };
+  for (const capability of foldedCapabilities) {
+    if (!existsSync5(join7(repoRoot, "openspec", "specs", capability, "spec.md"))) {
+      return { kind: "capability-not-folded", capability };
+    }
+  }
+  if (existsSync5(changeDirectoryOf(repoRoot, changeId))) return { kind: "change-still-in-changes" };
+  const archived = join7(repoRoot, "openspec", "changes", "archive", archive.archivedAs);
+  if (archive.archivedAs === "" || !isDirectory(archived)) {
+    return { kind: "archive-directory-missing", expected: archived };
+  }
+  return null;
+}
+function isDirectory(path) {
+  try {
+    return statSync3(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// src/workbench/write/write-change.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync6, statSync as statSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join8 } from "node:path";
+function changeDirectory(repoRoot, changeId) {
+  return join8(repoRoot, "openspec", "changes", changeId);
+}
+function writeChange(repoRoot, change, provenance, options = {}) {
+  const directory = changeDirectory(repoRoot, change.id);
+  const report2 = validateChange(change);
+  if (!report2.valid) {
+    return {
+      outcome: "validation-failed",
+      directory,
+      errors: report2.errors,
+      warnings: report2.warnings
+    };
+  }
+  if (!options.overwrite && isNonEmptyDirectory(directory)) {
+    return { outcome: "directory-exists", directory };
+  }
+  const emitted = emitChangeWithProvenance(change, provenance);
+  writeEmitted(directory, emitted);
+  return {
+    outcome: "written",
+    directory,
+    files: emitted.files.map((f) => f.path),
+    warnings: report2.warnings
+  };
+}
+function isNonEmptyDirectory(directory) {
+  try {
+    if (!statSync4(directory).isDirectory()) return true;
+    return readdirSync6(directory).length > 0;
+  } catch {
+    return false;
+  }
+}
+function readEmittedChange(directory, id) {
+  const files = [];
+  for (const name of ["proposal.md", "design.md", "tasks.md"]) {
+    files.push({ path: name, content: readFileSync6(join8(directory, name), "utf8") });
+  }
+  const specsDir = join8(directory, "specs");
+  let capabilities = [];
+  try {
+    capabilities = readdirSync6(specsDir).filter((name) => statSync4(join8(specsDir, name)).isDirectory()).sort();
+  } catch {
+    capabilities = [];
+  }
+  for (const capability of capabilities) {
+    files.push({
+      path: `specs/${capability}/spec.md`,
+      content: readFileSync6(join8(specsDir, capability, "spec.md"), "utf8")
+    });
+  }
+  return { id, files };
+}
+function writeEmitted(directory, emitted) {
+  mkdirSync4(directory, { recursive: true });
+  for (const file of emitted.files) {
+    const target = join8(directory, file.path);
+    mkdirSync4(dirname4(target), { recursive: true });
+    writeFileSync3(target, file.content, "utf8");
+  }
+}
+
+// src/workbench/core/reconstruct.ts
+function headingName(block) {
+  const match = /^###[ \t]+Requirement:[ \t]*(.*)$/m.exec(block);
+  return match?.[1]?.trim() ?? null;
+}
+function reconstructDraft(folded, delta) {
+  const capability = delta.capability;
+  if (folded.trim() === "") {
+    const purpose = delta.purpose === null ? "" : `
+## Purpose
+${delta.purpose}
+`;
+    const head = `# ${capability} Specification
+${purpose}
+## Requirements
+
+`;
+    return {
+      outcome: "reconstructed",
+      capability,
+      draft: `${head}${delta.added.map((b) => b.trimEnd()).join("\n\n")}
+`
+    };
+  }
+  const parsed = parseSpecFile(folded);
+  if (parsed.outside.length > 0) {
+    return {
+      outcome: "unreconstructable",
+      capability,
+      reason: "the folded spec carries content outside its requirement blocks, which a rebuild would drop",
+      draft: folded
+    };
+  }
+  const blocks = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const requirement of parsed.requirements) {
+    blocks.set(requirement.name, requirement.text);
+    order.push(requirement.name);
+  }
+  for (const pair of delta.renamed) {
+    const existing = blocks.get(pair.from);
+    if (existing === void 0) {
+      return {
+        outcome: "unreconstructable",
+        capability,
+        reason: `the delta renames \`${pair.from}\`, which the folded spec does not declare`,
+        draft: folded
+      };
     }
-    this.ws = null;
+    blocks.delete(pair.from);
+    blocks.set(pair.to, existing.replace(pair.from, pair.to));
+    order[order.indexOf(pair.from)] = pair.to;
   }
-};
-
-// server/workspace.ts
-import { createHash } from "node:crypto";
-import {
-  existsSync as existsSync2,
-  mkdirSync,
-  readFileSync as readFileSync2,
-  readdirSync as readdirSync2,
-  renameSync,
-  writeFileSync
-} from "node:fs";
-import { basename as basename2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
-var DIAGRAM_FILE = "diagram.excalidraw";
-var SIDECAR_FILE = "specsketch.json";
-var sha256 = (s) => createHash("sha256").update(s).digest("hex");
-var ChangeWorkspace = class {
-  dir;
-  changeName;
-  constructor(dir) {
-    this.dir = resolve2(dir);
-    this.changeName = basename2(this.dir);
-    mkdirSync(this.dir, { recursive: true });
-  }
-  writeAtomic(relPath, content) {
-    const target = join4(this.dir, relPath);
-    mkdirSync(dirname2(target), { recursive: true });
-    const tmp = `${target}.tmp`;
-    writeFileSync(tmp, content, "utf8");
-    renameSync(tmp, target);
+  for (const name of delta.removed) {
+    if (!blocks.delete(name)) {
+      return {
+        outcome: "unreconstructable",
+        capability,
+        reason: `the delta removes \`${name}\`, which the folded spec does not declare`,
+        draft: folded
+      };
+    }
+    order.splice(order.indexOf(name), 1);
   }
-  readIfExists(relPath) {
-    const target = join4(this.dir, relPath);
-    return existsSync2(target) ? readFileSync2(target, "utf8") : void 0;
+  for (const block of delta.modified) {
+    const name = headingName(block);
+    if (name === null || !blocks.has(name)) {
+      return {
+        outcome: "unreconstructable",
+        capability,
+        reason: name === null ? "the delta modifies a block with no readable heading" : `the delta modifies \`${name}\`, which is not in the folded spec after renames and removals`,
+        draft: folded
+      };
+    }
+    blocks.set(name, block.trimEnd());
   }
-  // ── Scene ────────────────────────────────────────────────────────────────
-  loadScene() {
-    const raw = this.readIfExists(DIAGRAM_FILE);
-    if (!raw) return null;
-    try {
-      const parsed = JSON.parse(raw);
+  for (const block of delta.added) {
+    const name = headingName(block);
+    if (name === null) {
       return {
-        elements: Array.isArray(parsed.elements) ? parsed.elements : [],
-        appState: parsed.appState ?? void 0,
-        files: parsed.files ?? void 0
+        outcome: "unreconstructable",
+        capability,
+        reason: "the delta adds a block with no readable heading",
+        draft: folded
       };
-    } catch {
-      return null;
     }
+    if (!blocks.has(name)) order.push(name);
+    blocks.set(name, block.trimEnd());
   }
-  saveScene(scene, title, model) {
-    this.writeAtomic(
-      DIAGRAM_FILE,
-      JSON.stringify(
-        {
-          type: "excalidraw",
-          version: 2,
-          source: "coopcli-specsketch",
-          elements: scene.elements,
-          appState: scene.appState ?? {},
-          files: scene.files ?? {}
-        },
-        null,
-        2
-      )
-    );
-    this.updateSidecar((s) => ({
-      ...s,
-      ...title !== void 0 ? { title } : {},
-      ...model !== void 0 ? { model } : {}
-    }));
+  const body = order.map((name) => blocks.get(name).trimEnd()).join("\n\n");
+  return {
+    outcome: "reconstructed",
+    capability,
+    draft: `${parsed.headText.trimEnd()}
+
+${body}
+`
+  };
+}
+
+// src/workbench/agent/credential-probe.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
+import { delimiter, join as join9 } from "node:path";
+function readSubscriptionToken(home) {
+  const path = join9(home, ".claude", ".credentials.json");
+  if (!existsSync6(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    const token = parsed.claudeAiOauth?.accessToken;
+    if (typeof token !== "string" || token === "") return null;
+    const expiresAt = parsed.claudeAiOauth?.expiresAt;
+    if (typeof expiresAt === "number" && expiresAt <= Date.now()) return null;
+    return token;
+  } catch {
+    return null;
   }
-  // ── Sidecar ──────────────────────────────────────────────────────────────
-  readSidecar() {
-    const raw = this.readIfExists(SIDECAR_FILE);
-    if (!raw) return {};
+}
+
+// src/workbench/agent/model-boundary.ts
+import { builtinModels } from "@earendil-works/pi-ai/providers/all";
+var MAX_TOOL_ROUNDS = 6;
+var DEFAULT_PROVIDER = "anthropic";
+var DEFAULT_MODEL2 = "claude-opus-4-5";
+async function runTurn(input, deps = {}) {
+  const provider = deps.provider ?? DEFAULT_PROVIDER;
+  const modelId = deps.modelId ?? DEFAULT_MODEL2;
+  const maxRounds = deps.maxRounds ?? MAX_TOOL_ROUNDS;
+  if (deps.oauthToken) process.env.ANTHROPIC_OAUTH_TOKEN = deps.oauthToken;
+  else if (deps.apiKey) process.env.ANTHROPIC_API_KEY = deps.apiKey;
+  const models = deps.models ?? builtinModels();
+  const model = models.getModel(provider, modelId);
+  if (!model) return { kind: "failed", reason: `no such model: ${provider}/${modelId}` };
+  const messages = [
+    { role: "user", content: input.prompt, timestamp: Date.now() }
+  ];
+  const context = {
+    systemPrompt: input.systemPrompt,
+    messages,
+    tools: [...input.tools]
+  };
+  const calls = [];
+  const served = `${provider}/${modelId}`;
+  let answer = "";
+  for (let round = 0; round < maxRounds; round += 1) {
+    const stream = models.stream(model, context);
+    const pending = [];
+    let message;
     try {
-      return JSON.parse(raw);
-    } catch {
-      return {};
+      for await (const event of stream) {
+        if (event.type === "toolcall_end") pending.push(event.toolCall);
+      }
+      message = await stream.result();
+    } catch (err) {
+      return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
+    }
+    if (message.stopReason === "error") {
+      return { kind: "failed", reason: message.errorMessage ?? "the model returned an error" };
+    }
+    answer = textOf2(message);
+    context.messages.push(message);
+    if (pending.length === 0) return { kind: "answered", answer, calls, served };
+    for (const call of pending) {
+      const result = await input.execute(call.name, call.arguments);
+      calls.push({ name: call.name, arguments: call.arguments, result });
+      context.messages.push({
+        role: "toolResult",
+        toolCallId: call.id,
+        toolName: call.name,
+        content: [{ type: "text", text: result }],
+        // The executor reports a refusal as ordinary text — a refused proposal is a
+        // normal outcome the model should reason about, not a transport error.
+        isError: false,
+        timestamp: Date.now()
+      });
     }
   }
-  updateSidecar(update) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const current = this.readSidecar();
-    const next = update(current);
-    next.createdAt ??= now;
-    next.updatedAt = now;
-    this.writeAtomic(SIDECAR_FILE, JSON.stringify(next, null, 2));
+  return { kind: "cut-short", answer, calls, served, rounds: maxRounds };
+}
+function textOf2(message) {
+  return message.content.filter((block) => block.type === "text").map((block) => block.text).join("").trim();
+}
+
+// src/workbench/agent/tools.ts
+import { Type } from "@earendil-works/pi-ai";
+var AGENT_TOOLS = [
+  {
+    name: "add_task_group",
+    description: "Propose a group of implementation tasks for this change. Use for planning the work; one group per coherent area, each task a single concrete action.",
+    parameters: Type.Object({
+      title: Type.String({ description: 'Short group title, e.g. "Search" or "Byte-safe writes"' }),
+      tasks: Type.Array(Type.String(), {
+        description: "Task titles, one per task. Each states one concrete action."
+      }),
+      capability: Type.Optional(
+        Type.String({
+          description: "Optional. The capability of the requirement this group implements \u2014 omit for a chore group that implements none."
+        })
+      ),
+      requirement: Type.Optional(
+        Type.String({
+          description: "Optional. The exact requirement name this group implements, as it appears after `### Requirement:`."
+        })
+      )
+    })
+  },
+  {
+    name: "add_requirement",
+    description: "Propose a requirement to draft into an open capability. The block must be full markdown: a `### Requirement:` heading, RFC-2119 SHALL text, and at least one `#### Scenario:` with WHEN/THEN steps.",
+    parameters: Type.Object({
+      capability: Type.String({ description: "A capability already open in this change" }),
+      block: Type.String({ description: "The complete requirement block, in markdown" })
+    })
+  },
+  {
+    name: "set_proposal_section",
+    description: "Propose the body of one proposal section.",
+    parameters: Type.Object({
+      section: Type.String({
+        description: `One of: ${PROPOSAL_SECTIONS.map((s) => s.id).join(", ")}`
+      }),
+      body: Type.String({ description: "The section body, in markdown" })
+    })
+  },
+  {
+    name: "add_design_block",
+    description: "Propose a design block. Use `mermaid` for a diagram (C4Context / C4Container / C4Component / C4Dynamic render as diagrams), `markdown` for prose.",
+    parameters: Type.Object({
+      kind: Type.String({ description: "markdown | mermaid | sketch" }),
+      title: Type.String({ description: "The block's heading" }),
+      text: Type.String({ description: "The block body" })
+    })
   }
-  // ── Artifacts ────────────────────────────────────────────────────────────
-  /** Current artifact files, however they were authored. */
-  readArtifacts() {
-    const specs = [];
-    const specsDir = join4(this.dir, "specs");
-    if (existsSync2(specsDir)) {
-      for (const entry of readdirSync2(specsDir, { withFileTypes: true })) {
-        if (!entry.isDirectory()) continue;
-        const spec = this.readIfExists(join4("specs", entry.name, "spec.md"));
-        if (spec !== void 0) specs.push({ capability: entry.name, spec });
+];
+var DESIGN_KINDS = /* @__PURE__ */ new Set(["markdown", "mermaid", "sketch"]);
+function stripLeadingNumber(text) {
+  return text.replace(/^\s*\d+(?:\.\d+)*[.)]?\s+/, "").trim();
+}
+function proposalFromToolCall(name, args, shape) {
+  switch (name) {
+    case "add_task_group": {
+      const title = stripLeadingNumber(String(args["title"] ?? ""));
+      const tasks = Array.isArray(args["tasks"]) ? args["tasks"].map((t) => stripLeadingNumber(String(t))).filter((t) => t !== "") : [];
+      if (title === "" || tasks.length === 0) {
+        return { kind: "refused", tool: name, missing: "a title and at least one task" };
+      }
+      const capability = String(args["capability"] ?? "").trim();
+      const key = String(args["requirement"] ?? "").trim();
+      if (capability === "" && key === "") return { kind: "task-group", title, tasks };
+      if (capability === "" || key === "") {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: "both a capability and a requirement name, or neither"
+        };
       }
+      if (shape.citable !== void 0 && !shape.citable.some((c) => c.capability === capability && c.key === key)) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `\`${key}\` in \`${capability}\` is not a requirement this change declares`
+        };
+      }
+      return { kind: "task-group", title, tasks, cites: { capability, key } };
     }
-    return {
-      proposal: this.readIfExists("proposal.md"),
-      design: this.readIfExists("design.md"),
-      tasks: this.readIfExists("tasks.md"),
-      specs
-    };
+    case "add_requirement": {
+      const capability = String(args["capability"] ?? "").trim();
+      const block = String(args["block"] ?? "").trim();
+      if (!shape.openCapabilities.includes(capability)) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `capability \`${capability}\` is not open in this change`
+        };
+      }
+      if (!/^###[ \t]+Requirement:/m.test(block)) {
+        return { kind: "refused", tool: name, missing: "a `### Requirement:` heading" };
+      }
+      return { kind: "requirement", capability, block };
+    }
+    case "set_proposal_section": {
+      const section2 = String(args["section"] ?? "").trim();
+      const known = PROPOSAL_SECTIONS.find((s) => s.id === section2);
+      if (!known) {
+        return { kind: "refused", tool: name, missing: `no proposal section \`${section2}\`` };
+      }
+      return {
+        kind: "proposal-section",
+        section: known.id,
+        body: String(args["body"] ?? "")
+      };
+    }
+    case "add_design_block": {
+      const blockKind = String(args["kind"] ?? "").trim();
+      if (!DESIGN_KINDS.has(blockKind)) {
+        return { kind: "refused", tool: name, missing: `no design block kind \`${blockKind}\`` };
+      }
+      const title = String(args["title"] ?? "").trim();
+      if (title === "") return { kind: "refused", tool: name, missing: "a block title" };
+      return {
+        kind: "design-block",
+        blockKind,
+        title,
+        text: String(args["text"] ?? "")
+      };
+    }
+    default:
+      return { kind: "refused", tool: name, missing: `no such tool \`${name}\`` };
   }
-  /** Reconstruct a SpecBundle view from the files on disk, or null if none. */
-  toBundle() {
-    const a = this.readArtifacts();
-    if (!a.proposal && !a.design && !a.tasks && a.specs.length === 0) return null;
-    return {
-      changeName: this.changeName,
-      summary: this.readSidecar().summary ?? "",
-      proposal: a.proposal ?? "",
-      design: a.design ?? "",
-      tasks: a.tasks ?? "",
-      specs: a.specs
-    };
+}
+function toolResultFor(proposal) {
+  switch (proposal.kind) {
+    case "task-group":
+      return `Proposed task group "${proposal.title}" with ${proposal.tasks.length} task(s)${proposal.cites ? `, implementing \`${proposal.cites.key}\`` : ", implementing no requirement"}. Awaiting the author's apply; nothing is written yet.`;
+    case "requirement":
+      return `Proposed a requirement for \`${proposal.capability}\`. Awaiting the author's apply; nothing is written yet.`;
+    case "proposal-section":
+      return `Proposed a body for the \`${proposal.section}\` section. Awaiting the author's apply; nothing is written yet.`;
+    case "design-block":
+      return `Proposed a ${proposal.blockKind} design block "${proposal.title}". Awaiting the author's apply; nothing is written yet.`;
+    case "refused":
+      return `Refused: ${proposal.tool} needs ${proposal.missing}. Nothing was proposed.`;
   }
-  /**
-   * Materialize a generated bundle in OpenSpec layout, writing only files
-   * whose content actually changed. Returns the relative paths written.
-   */
-  writeBundle(bundle) {
-    const files = {
-      "proposal.md": bundle.proposal,
-      "design.md": bundle.design,
-      "tasks.md": bundle.tasks
-    };
-    for (const s of bundle.specs) files[join4("specs", s.capability, "spec.md")] = s.spec;
-    const written = [];
-    const manifest = {};
-    for (const [relPath, content] of Object.entries(files)) {
-      manifest[relPath] = sha256(content);
-      if (this.readIfExists(relPath) === content) continue;
-      this.writeAtomic(relPath, content);
-      written.push(relPath);
+}
+
+// server/workbench-host.ts
+var CHANGE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function changeContextFor(target, source) {
+  const read = [];
+  let changeText = "";
+  if (source.change) {
+    for (const file of emitChange({ ...source.change, id: target.changeId }).files) {
+      if (file.content.replace(/^#[ \t].*$/m, "").trim() === "") continue;
+      changeText += `
+
+===== ${file.path} (unsaved draft \u2014 what the author is looking at) =====
+${file.content}`;
+      read.push(`${file.path} (draft)`);
     }
-    this.updateSidecar((s) => ({
-      ...s,
-      summary: bundle.summary,
-      generated: manifest,
-      // The diff-before-write result IS the changed-file signal for the
-      // post-generation chat seed (generation-chat-reset-summary).
-      lastGeneration: { at: (/* @__PURE__ */ new Date()).toISOString(), changedFiles: written }
-    }));
-    return written;
+    return { read, changeText };
   }
-  // ── Spec review chat ─────────────────────────────────────────────────────
-  readChat() {
-    return this.readSidecar().chat ?? [];
+  if (!target.resuming) return { read, changeText };
+  for (const name of ["proposal.md", "tasks.md"]) {
+    const file = join10(target.changeDir, name);
+    if (!existsSync7(file)) continue;
+    changeText += `
+
+===== ${name} =====
+${readFileSync8(file, "utf8")}`;
+    read.push(name);
+  }
+  for (const capability of source.openCapabilities ?? []) {
+    const file = join10(target.changeDir, "specs", capability, "spec.md");
+    if (!existsSync7(file)) continue;
+    changeText += `
+
+===== specs/${capability}/spec.md (the change's deltas) =====
+${readFileSync8(file, "utf8")}`;
+    read.push(`specs/${capability}/spec.md`);
   }
-  writeChat(chat) {
-    this.updateSidecar((s) => ({ ...s, chat }));
+  return { read, changeText };
+}
+var WorkbenchHostError = class extends Error {
+};
+function findRepoRoot(start) {
+  let dir = resolve3(start);
+  for (; ; ) {
+    if (existsSync7(join10(dir, "openspec"))) return dir;
+    const parent = dirname5(dir);
+    if (parent === dir) return null;
+    dir = parent;
   }
-  // ── Generation system prompt override ────────────────────────────────────
-  readSystemPrompt() {
-    return this.readSidecar().systemPrompt;
+}
+function resolveTarget(cwd, changeId) {
+  if (changeId === void 0 || changeId === "") {
+    throw new WorkbenchHostError("a change id is required: specsketch <change-id>");
   }
-  /** `undefined` clears the override (reset to the built-in default). */
-  writeSystemPrompt(systemPrompt) {
-    this.updateSidecar(({ systemPrompt: _prev, ...s }) => ({
-      ...s,
-      ...systemPrompt !== void 0 ? { systemPrompt } : {}
-    }));
+  if (!CHANGE_ID.test(changeId)) {
+    throw new WorkbenchHostError(
+      `\`${changeId}\` is not a change id. Pass the id (\`my-change\`), not a path \u2014 the workbench resolves it under \`openspec/changes/\`.`
+    );
   }
-};
+  const repoRoot = findRepoRoot(cwd);
+  if (repoRoot === null) {
+    throw new WorkbenchHostError(
+      `no \`openspec/\` directory found in \`${resolve3(cwd)}\` or any parent. The workbench authors changes in an OpenSpec repository; run it inside one.`
+    );
+  }
+  const changeDir = changeDirectory(repoRoot, changeId);
+  return { repoRoot, changeId, changeDir, resuming: existsSync7(changeDir) };
+}
+function mountWorkbenchHost(app, options) {
+  const { target } = options;
+  const reader = createFoldedSpecReader(target.repoRoot);
+  app.get("/api/workbench/context", (c) => {
+    let document = null;
+    let deltaCapabilities = [];
+    const capabilities = [];
+    if (target.resuming) {
+      try {
+        const emitted = readEmittedChange(target.changeDir, target.changeId);
+        document = parseChangeDocument(emitted);
+        deltaCapabilities = emitted.files.map((f) => /^specs\/([^/]+)\/spec\.md$/.exec(f.path)?.[1]).filter((n) => n !== void 0);
+        for (const spec of document.deltaSpecs) {
+          const folded = reader.readCapability(spec.capability);
+          const rebuilt = reconstructDraft(folded ?? "", spec);
+          capabilities.push({
+            capability: spec.capability,
+            folded,
+            draft: rebuilt.draft,
+            reconstructed: rebuilt.outcome === "reconstructed",
+            ...rebuilt.outcome === "unreconstructable" ? { reason: rebuilt.reason } : {}
+          });
+        }
+      } catch {
+        document = null;
+      }
+    }
+    return c.json({
+      repoRoot: target.repoRoot,
+      changeId: target.changeId,
+      changeDir: target.changeDir,
+      resuming: target.resuming,
+      fixture: options.fixture === true,
+      specsDir: reader.specsDir,
+      document,
+      deltaCapabilities,
+      capabilities,
+      // True when every delta this change carries was rebuilt. A capability that
+      // failed is listed with its reason rather than appearing to carry no edits.
+      draftsRestorable: capabilities.every((c2) => c2.reconstructed)
+    });
+  });
+  app.get("/api/workbench/capabilities", (c) => {
+    const open = c.req.queries("open") ?? [];
+    return c.json({ capabilities: reader.listCapabilities(open) });
+  });
+  app.get("/api/workbench/capabilities/:name", (c) => {
+    const name = c.req.param("name");
+    const open = c.req.queries("open") ?? [];
+    try {
+      return c.json({ result: reader.openCapability(name, open) });
+    } catch (err) {
+      if (err instanceof RangeError) {
+        return c.json({ error: "invalid-capability-name", message: err.message }, 400);
+      }
+      throw err;
+    }
+  });
+  app.post("/api/workbench/emit", async (c) => {
+    const body = await c.req.json();
+    if (!body.change) return c.json({ error: "missing-change" }, 400);
+    const result = writeChange(
+      target.repoRoot,
+      { ...body.change, id: target.changeId },
+      options.provenance ?? NO_ISSUE,
+      body.overwrite === true ? { overwrite: true } : {}
+    );
+    return c.json({ result }, result.outcome === "written" ? 200 : 409);
+  });
+  app.post("/api/workbench/archive", async (c) => {
+    const body = await c.req.json();
+    if (!body.change) return c.json({ error: "missing-change" }, 400);
+    const result = approveChange(
+      target.repoRoot,
+      { ...body.change, id: target.changeId },
+      options.provenance ?? NO_ISSUE
+    );
+    return c.json({ result }, result.outcome === "approved" ? 200 : 409);
+  });
+  app.post("/api/workbench/agent/turn", async (c) => {
+    const body = await c.req.json();
+    const prompt = (body.prompt ?? "").trim();
+    if (prompt === "") return c.json({ error: "missing-prompt" }, 400);
+    const token = readSubscriptionToken(options.home ?? homedir3());
+    if (!token && !process.env["ANTHROPIC_API_KEY"]) {
+      return c.json({ outcome: { kind: "no-credential" } }, 200);
+    }
+    const shape = {
+      openCapabilities: body.openCapabilities ?? [],
+      ...body.change ? { citable: citableRequirements(body.change.capabilities) } : {}
+    };
+    const { read, changeText } = changeContextFor(target, body);
+    const proposals = [];
+    const outcome = await runTurn(
+      {
+        systemPrompt: [
+          "You are helping author an OpenSpec change in the SpecSketch workbench.",
+          `The change is \`${target.changeId}\`, in the repository at ${target.repoRoot}.`,
+          shape.openCapabilities.length > 0 ? `Capabilities open in this change: ${shape.openCapabilities.join(", ")}.` : "No capability is open in this change yet.",
+          body.scope ? `The author is looking at ${body.scope}.` : "",
+          "",
+          "Use the tools to propose concrete items. Everything you propose is reviewed and",
+          "applied by the author \u2014 you never write to the change yourself, so propose freely",
+          "and say briefly what you proposed and why.",
+          "",
+          "Ground every proposal in the change below. Use its own vocabulary: if it says",
+          '"changes", do not write "plans". Do not invent states, sections or files it does',
+          "not define. Where it is silent on something you need, say so rather than",
+          "inventing it.",
+          changeText === "" ? "(This change has nothing written yet.)" : changeText
+        ].filter((line) => line !== "").join("\n"),
+        prompt,
+        tools: AGENT_TOOLS,
+        execute: (name, args) => {
+          const proposal = proposalFromToolCall(name, args, shape);
+          proposals.push(proposal);
+          return toolResultFor(proposal);
+        }
+      },
+      { oauthToken: token ?? void 0 }
+    );
+    return c.json({ outcome, proposals, read });
+  });
+}
 
 // server/cli.ts
-var USAGE = `Usage: specsketch <path-to-openspec-change-dir> [--port <n>] [--share]
+var CLI_VERSION = true ? "2026.08.17.1" : "dev";
+var USAGE = `Usage: specsketch <change-id> [--port <n>] [--fixture]
        specsketch login [--profile <name>] [--web-url <url>]
+       specsketch --version
+
+  specsketch add-user-search
 
-  specsketch ./openspec/changes/new-feature-change
+The workbench authors exactly ONE change per run, named by <change-id>. The id
+is resolved under openspec/changes/<change-id> in the repository you run it in.
+An existing change is resumed; an unknown id starts a new draft \u2014 authoring a
+change that does not exist yet is the ordinary case.
 
-The directory is created if it doesn't exist. Diagrams autosave to
-diagram.excalidraw inside it; Generate Spec writes proposal.md, design.md,
-tasks.md and specs/<capability>/spec.md alongside.
+The id is required and never inferred. Guessing it (newest directory, only open
+change, last used) is right until two changes are in flight, which is exactly
+when being wrong costs the most.
 
 --port sets the preferred port (default 8787); if it's already in use the
 server moves to the next available port and prints the actual URL.
 
---share hosts the canvas as a live multiplayer session on your CoopCLI
-account and prints a link coworkers can open in a browser \u2014 no account
-needed on their side. Requires \`specsketch login\` first. The local server
-still binds to 127.0.0.1 only; sharing runs over an outbound connection.
-
-login authenticates this machine against your CoopCLI account (opens a
-browser, saves credentials to ~/.coopcli/config.json).`;
+--fixture opens the demo change instead of the repository, for trying the
+surface out. The workbench says on screen when it is showing fixture data.
+`;
 var UsageError = class extends Error {
 };
 function parseCliArgs(argv) {
@@ -2366,19 +4043,24 @@ function parseCliArgs(argv) {
   try {
     parsed = parseArgs2({
       args: argv,
-      options: { port: { type: "string" }, share: { type: "boolean" } },
+      options: { port: { type: "string" }, fixture: { type: "boolean" } },
       allowPositionals: true
     });
   } catch (err) {
     throw new UsageError(err instanceof Error ? err.message : String(err));
   }
-  const [dir, ...rest] = parsed.positionals;
-  if (!dir || rest.length > 0) throw new UsageError("expected exactly one change directory");
+  const [changeId, ...rest] = parsed.positionals;
+  if (!changeId) throw new UsageError("a change id is required");
+  if (rest.length > 0) {
+    throw new UsageError(
+      "expected exactly one change id \u2014 the workbench authors one change per run"
+    );
+  }
   const port = parsed.values.port === void 0 ? 8787 : Number(parsed.values.port);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new UsageError(`invalid --port: ${String(parsed.values.port)}`);
   }
-  return { dir, port, share: parsed.values.share === true };
+  return { changeId, port, fixture: parsed.values.fixture === true };
 }
 var PORT_SCAN_LIMIT = 100;
 async function bindAvailablePort(start, tryBind) {
@@ -2405,25 +4087,25 @@ var MIME = {
   ".woff": "font/woff"
 };
 function resolveClientDir(moduleUrl) {
-  const here = dirname3(fileURLToPath(moduleUrl));
+  const here = dirname6(fileURLToPath(moduleUrl));
   const candidates = [
-    join5(here, "..", "client"),
+    join11(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join5(here, "..", "dist", "client")
+    join11(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync3(join5(dir, "index.html"))) return dir;
+    if (existsSync8(join11(dir, "index.html"))) return dir;
   }
   return null;
 }
 function staticResponse(clientDir, pathname) {
   const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
-  const target = resolve3(clientDir, rel === "" ? "index.html" : rel);
-  if (!target.startsWith(resolve3(clientDir))) return null;
-  const file = existsSync3(target) && extname(target) ? target : join5(clientDir, "index.html");
-  if (!existsSync3(file)) return null;
-  return new Response(readFileSync3(file), {
+  const target = resolve4(clientDir, rel === "" ? "index.html" : rel);
+  if (!target.startsWith(resolve4(clientDir))) return null;
+  const file = existsSync8(target) && extname(target) ? target : join11(clientDir, "index.html");
+  if (!existsSync8(file)) return null;
+  return new Response(readFileSync9(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
   });
 }
@@ -2435,12 +4117,12 @@ but "Generate Spec" needs one of:
   \u2022 or the Anthropic CLI's login profile (no key handling needed):
       brew install anthropics/tap/ant   # macOS
       ant auth login`;
-function detectCredentialSource(env = process.env, home = homedir3()) {
+function detectCredentialSource(env = process.env, home = homedir4()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join5(home, ".config", "anthropic", "credentials");
-    if (readdirSync3(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
+    const dir = join11(home, ".config", "anthropic", "credentials");
+    if (readdirSync8(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }
   return null;
@@ -2454,6 +4136,10 @@ function preflight(log = console.log) {
   }
 }
 async function main(argv) {
+  if (argv[0] === "--version") {
+    console.log(CLI_VERSION);
+    return;
+  }
   preflight();
   if (argv[0] === "login") {
     let loginArgs;
@@ -2489,26 +4175,25 @@ ${USAGE}` : err);
     console.error("specsketch: built UI assets not found (dist/client missing).");
     process.exit(1);
   }
-  if (args.share) {
-    try {
-      await readCoopAuth();
-    } catch (err) {
-      console.error(`specsketch: ${err instanceof CoopAuthError ? err.message : String(err)}`);
-      process.exit(1);
-    }
+  let target;
+  try {
+    target = resolveTarget(process.cwd(), args.changeId);
+  } catch (err) {
+    console.error(
+      err instanceof WorkbenchHostError ? `specsketch: ${err.message}
+
+${USAGE}` : `specsketch: ${err instanceof Error ? err.message : String(err)}`
+    );
+    process.exit(1);
   }
-  const workspace = new ChangeWorkspace(args.dir);
-  let remote = null;
+  const workspace = new ChangeWorkspace(target.changeDir, { create: false });
   const app = createApp(
     new Anthropic(),
     workspace,
-    () => remote ? {
-      active: true,
-      shareUrl: remote.shareUrl,
-      status: remote.status,
-      participants: remote.participants.length
-    } : { active: false }
+    () => ({ active: false }),
+    { refRoot: target.repoRoot, harness: createClaudeHarness() }
   );
+  mountWorkbenchHost(app, { target, fixture: args.fixture });
   app.get("*", (c) => {
     const res = staticResponse(clientDir, new URL(c.req.url).pathname);
     return res ?? c.notFound();
@@ -2535,17 +4220,11 @@ ${USAGE}` : err);
     console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  if (args.share) {
-    try {
-      remote = await startShare(workspace, httpServer);
-    } catch (err) {
-      console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    }
-  }
   const source = detectCredentialSource();
   console.log(`coopcli specsketch`);
-  console.log(`  workspace: ${workspace.dir}`);
+  console.log(`  repo:      ${target.repoRoot}`);
+  console.log(`  change:    ${target.changeId} (${target.resuming ? "resuming" : "new draft"})`);
+  if (args.fixture) console.log(`  data:      demo fixture \u2014 NOT this repository`);
   console.log(`  open:      http://127.0.0.1:${port}`);
   if (moved) {
     console.log(`  port:      ${args.port} was in use \u2014 moved to ${port}`);
@@ -2557,56 +4236,6 @@ ${USAGE}` : err);
 \u26A0 ${CREDENTIALS_HINT}
 `);
   }
-  if (remote) {
-    console.log(`
-  \u2500\u2500 shared session \u2500\u2500`);
-    console.log(`  anyone with this link can view AND edit the canvas (no account needed):`);
-    console.log(`
-    ${remote.shareUrl}
-`);
-    console.log(`  Ctrl-C ends the session and invalidates the link.`);
-  }
-}
-async function startShare(workspace, server) {
-  const auth = await readCoopAuth();
-  const localClients = /* @__PURE__ */ new Set();
-  const remote = await RemoteSession.start({
-    ...auth,
-    workspace,
-    title: workspace.changeName,
-    hostName: auth.displayName,
-    log: (msg) => console.log(`  ${msg}`),
-    onLocalBroadcast: (frame) => {
-      for (const client of localClients) client.send(frame);
-    }
-  });
-  const wss = new WebSocketServer({ noServer: true });
-  server.on("upgrade", (req, socket, head) => {
-    const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
-    if (pathname !== "/ws/local") {
-      socket.destroy();
-      return;
-    }
-    wss.handleUpgrade(req, socket, head, (ws) => {
-      localClients.add(ws);
-      ws.on("close", () => localClients.delete(ws));
-      ws.on(
-        "message",
-        (data) => remote.handleLocalFrame(String(data), (reply) => ws.send(reply))
-      );
-    });
-  });
-  let ending = false;
-  const endAndExit = async () => {
-    if (ending) return;
-    ending = true;
-    console.log("\nspecsketch: ending shared session\u2026");
-    await remote.end();
-    process.exit(0);
-  };
-  process.on("SIGINT", () => void endAndExit());
-  process.on("SIGTERM", () => void endAndExit());
-  return remote;
 }
 
 // server/cli-entry.ts