@coreplane/switchboard 1.236.0 → 1.238.0

package/dist/cli.js

@@ -697,7 +697,7 @@ function validatePolicy(rules) {
     }
   }
 }
-var grant, MEMBER_OF, IS_SELF, OWNER_OF, ALL_CHANNELS, POLICY, ACTOR_KINDS, CONDITION_KINDS, REQUIRED_ATTRIBUTE, PLACEHOLDER, PolicyError;
+var grant, MEMBER_OF, IS_SELF, ACTS_AS_PERSON, OWNER_OF, ALL_CHANNELS, POLICY, ACTOR_KINDS, CONDITION_KINDS, REQUIRED_ATTRIBUTE, PLACEHOLDER, PolicyError;
 var init_policy = __esm({
   "../../src/core/authz/policy.ts"() {
     "use strict";
@@ -705,6 +705,7 @@ var init_policy = __esm({
     grant = (g) => ({ kind: "has-grant", grant: g });
     MEMBER_OF = { kind: "member-of" };
     IS_SELF = { kind: "is-self" };
+    ACTS_AS_PERSON = { kind: "acts-as-person" };
     OWNER_OF = { kind: "owner-of" };
     ALL_CHANNELS = { kind: "all-channels" };
     POLICY = [
@@ -799,6 +800,13 @@ var init_policy = __esm({
       // ── mcp (external MCP servers live in the three config tiers) ────────────
       { action: "mcp:read", resource: "command", when: [grant("mcp:read")] },
       { action: "mcp:write", resource: "command", when: [grant("mcp:write")] },
+      // A person always has their own tier to write (`mcp add|connect|remove`
+      // for themselves), as `config set me` already is theirs: the row admits an
+      // actor whose `self` names a chat identity — every chat user (who holds
+      // `mcp:write` by baseline anyway) and a dashboard session linked to its
+      // person (record 0042) — never an unlinked browser session or a credential.
+      // Which tier the write reaches stays the handler's question below.
+      { action: "mcp:write", resource: "command", actorKinds: ["user"], when: [ACTS_AS_PERSON] },
       // A CHANNEL's servers: the channel-config right for a person; a credential
       // an admin minted with `mcp:write` manages any tier it can name.
       { action: "mcp:write", resource: "config-scope", resourceKind: "channel", when: [grant("config:write")] },
@@ -864,6 +872,7 @@ var init_policy = __esm({
       "has-grant",
       "member-of",
       "is-self",
+      "acts-as-person",
       "owner-of",
       "all-channels"
     ];
@@ -918,13 +927,20 @@ function principalOf(actor) {
   while (current.onBehalfOf) current = current.onBehalfOf;
   return current;
 }
+function selfIdsOf(actor) {
+  const principal = principalOf(actor);
+  return principal.self && principal.self.length > 0 ? principal.self : [principal.id];
+}
+function actsAsPerson(selfIds) {
+  return selfIds.some((id) => id.startsWith("slack:"));
+}
 function deny(reason2) {
   return { allow: false, reason: reason2 };
 }
 function isKnownActorKind(kind) {
   return ACTOR_KINDS.includes(kind);
 }
-function evaluateCondition(condition, grants, selfId, attributes) {
+function evaluateCondition(condition, grants, selfIds, attributes) {
   switch (condition.kind) {
     case "has-grant": {
       const grant2 = resolveGrant(condition.grant, attributes);
@@ -933,7 +949,9 @@ function evaluateCondition(condition, grants, selfId, attributes) {
     case "member-of":
       return attributes.channelId !== void 0 && holds(grants.channels, attributes.channelId) || attributes.channelVisibility === "public";
     case "is-self":
-      return attributes.userId !== void 0 && attributes.userId === selfId;
+      return attributes.userId !== void 0 && selfIds.includes(attributes.userId);
+    case "acts-as-person":
+      return actsAsPerson(selfIds);
     case "owner-of":
       return attributes.repo !== void 0 && holds(grants.repos, attributes.repo);
     case "all-channels":
@@ -954,10 +972,10 @@ function authorizeWith(rules, actor, action, resource) {
   );
   if (forOrigin.length === 0) return deny("origin-visibility");
   const grants = effectiveGrants(actor);
-  const selfId = principalOf(actor).id;
+  const selfIds = selfIdsOf(actor);
   let reason2;
   for (const rule of forOrigin) {
-    const failed = rule.when.find((condition) => !evaluateCondition(condition, grants, selfId, attributes));
+    const failed = rule.when.find((condition) => !evaluateCondition(condition, grants, selfIds, attributes));
     if (!failed) return ALLOW;
     reason2 ??= FAILURE_REASON[failed.kind];
   }
@@ -975,6 +993,7 @@ var init_authorize = __esm({
     ALLOW = Object.freeze({ allow: true });
     FAILURE_REASON = {
       "has-grant": "missing-grant",
+      "acts-as-person": "not-person",
       "member-of": "not-member",
       "is-self": "not-self",
       "owner-of": "not-owner",
@@ -2540,6 +2559,9 @@ function unitSlug(unit) {
 function unitBranch(planId, slug) {
   return `plan/${planId}/${slug}`;
 }
+function isUnitBranch(ref) {
+  return /^plan\/[^/]+\/[^/]+$/.test(ref);
+}
 function parsePlanBranch(branch2) {
   const m = PLAN_BRANCH.exec(branch2);
   return m ? { planId: m[1], unitSlug: m[2] } : void 0;
@@ -3247,7 +3269,7 @@ function isOutcome(v) {
 function isMcpServerEntry(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return false;
   const e = v;
-  return isStr(e.url, MCP_URL_MAX) && (e.agents === void 0 || Array.isArray(e.agents) && e.agents.length > 0 && e.agents.length <= MCP_AGENTS_MAX && e.agents.every((a) => isStr(a, 32))) && (e.auth === "none" || e.auth === "bearer" || e.auth === "oauth") && (e.tokenEnv === void 0 || isStr(e.tokenEnv, 128)) && (e.headersEnv === void 0 || isHeadersEnv(e.headersEnv)) && (e.addedBy === void 0 || isStr(e.addedBy, 260)) && (e.addedAt === void 0 || isNum(e.addedAt));
+  return isStr(e.url, MCP_URL_MAX) && (e.agents === void 0 || Array.isArray(e.agents) && e.agents.length > 0 && e.agents.length <= MCP_AGENTS_MAX && e.agents.every((a) => isStr(a, 32))) && (e.auth === "none" || e.auth === "bearer" || e.auth === "oauth") && (e.tokenEnv === void 0 || isStr(e.tokenEnv, 128)) && (e.headersEnv === void 0 || isHeadersEnv(e.headersEnv)) && (e.addedBy === void 0 || isStr(e.addedBy, 260)) && (e.addedAt === void 0 || isNum(e.addedAt)) && (e.promotedFrom === void 0 || isStr(e.promotedFrom, 260));
 }
 function isSealedCredential(v) {
   if (!v || typeof v !== "object") return false;
@@ -3273,7 +3295,8 @@ function serverView(scopeKey, name, entry, opts) {
     state,
     source: opts.source,
     ...entry.addedBy ? { addedBy: entry.addedBy } : {},
-    ...entry.addedAt !== void 0 ? { addedAt: entry.addedAt } : {}
+    ...entry.addedAt !== void 0 ? { addedAt: entry.addedAt } : {},
+    ...entry.promotedFrom ? { promotedFrom: entry.promotedFrom } : {}
   };
 }
 function safeUrl(raw) {
@@ -4134,6 +4157,15 @@ var init_config2 = __esm({
        * caller's right to read each channel is decided; `config show --channel`
        * is the read that carries the values.
        */
+      /** Every channel and every user with a tier of its own — a static block or a
+       *  runtime override — sorted: what `mcp list --all` walks (record 0042). */
+      mcpTierIds() {
+        const ids = (stat, runtime) => [.../* @__PURE__ */ new Set([...Object.keys(stat ?? {}), ...Object.keys(runtime)])].sort();
+        return {
+          channels: ids(this.config.channels, this.overrides.channels),
+          users: ids(this.config.users, this.overrides.users)
+        };
+      }
       channelsWithScope() {
         const ids = /* @__PURE__ */ new Set([...Object.keys(this.config.channels ?? {}), ...Object.keys(this.overrides.channels)]);
         const rows = [];
@@ -10044,10 +10076,15 @@ function wakePause(ms, signal2) {
   });
 }
 function reboundOf(value) {
+  const move = returnedOf(value);
+  return move !== void 0 && move.pr !== void 0 ? { from: move.from, to: move.to, pr: move.pr } : void 0;
+}
+function returnedOf(value) {
   if (typeof value !== "object" || value === null) return void 0;
   const v = value;
-  if (typeof v.from !== "string" || typeof v.to !== "string" || typeof v.pr !== "number") return void 0;
-  if (!v.from || !v.to || !Number.isSafeInteger(v.pr) || v.pr <= 0) return void 0;
+  if (typeof v.from !== "string" || typeof v.to !== "string" || !v.from || !v.to) return void 0;
+  if (v.pr === void 0) return { from: v.from, to: v.to };
+  if (typeof v.pr !== "number" || !Number.isSafeInteger(v.pr) || v.pr <= 0) return void 0;
   return { from: v.from, to: v.to, pr: v.pr };
 }
 function rebindRefusedOf(value) {
@@ -10288,7 +10325,7 @@ var init_resident = __esm({
         const trace = sanitizeGraftedSteps(data.trace);
         const rebound = reboundOf(data.rebound);
         const rebindRefused = rebindRefusedOf(data.rebindRefused);
-        const returned = reboundOf(data.returned);
+        const returned = returnedOf(data.returned);
         this.lastBinding = {
           ref: data.ref,
           sha: data.sha,
@@ -10858,7 +10895,7 @@ function rebindLabel(binding) {
   if (binding.rebound) return ` \xB7 rebound to ${binding.rebound.to} (this thread's PR #${binding.rebound.pr})`;
   if (binding.returned) {
     const r = binding.returned;
-    return ` \xB7 returned to ${r.to} (the branch of this thread's PR #${r.pr} is gone)`;
+    return r.pr !== void 0 ? ` \xB7 returned to ${r.to} (the branch of this thread's PR #${r.pr} is gone)` : ` \xB7 returned to ${r.to} (this thread's branch ${r.from} is gone)`;
   }
   if (binding.rebindRefused) {
     const r = binding.rebindRefused;
@@ -15232,6 +15269,7 @@ var init_commandRegistry = __esm({
             commandId: cmd.id,
             callerKind: caller.kind,
             callerId: caller.id,
+            ...caller.actor.asUser ? { asUser: caller.actor.asUser.id } : {},
             effect: cmd.effect,
             outcome: res.ok ? "ok" : res.error,
             ...reason2 === void 0 ? {} : { reason: reason2 },
@@ -15416,8 +15454,14 @@ function assertMayEditChannel(caller, channel) {
   if (!mayEditChannel(caller, channel))
     throw new CommandError("unauthorized", "Channel config changes are restricted.");
 }
-function assertMeWritable(caller) {
-  if (caller.kind === "access") throw new CommandError("unauthorized", ME_ON_ACCESS_MESSAGE);
+function meIdOf(caller) {
+  if (caller.kind !== "access") return caller.id;
+  return caller.actor.self?.find((id) => id.startsWith("slack:"));
+}
+function meIdOrRefuse(caller) {
+  const id = meIdOf(caller);
+  if (id === void 0) throw new CommandError("unauthorized", ME_ON_ACCESS_MESSAGE);
+  return id;
 }
 async function mayReadChannel(caller, channel, deps) {
   const origin = caller.origin?.channelId;
@@ -15477,7 +15521,7 @@ var init_config4 = __esm({
         const channel = targetChannel(caller, options.channel);
         await assertMayReadChannel(caller, channel, deps);
         const description = {
-          ...await deps.config.describeConfig(channel, caller.id),
+          ...await deps.config.describeConfig(channel, meIdOf(caller) ?? caller.id),
           channelConfigRestricted: !mayEditChannel(caller, channel)
         };
         return description;
@@ -15570,8 +15614,7 @@ var init_config4 = __esm({
           assertMayEditChannel(caller, channel);
           effective = await deps.config.setChannelOverride(channel, patch);
         } else {
-          assertMeWritable(caller);
-          effective = await deps.config.setUserOverride(caller.id, patch);
+          effective = await deps.config.setUserOverride(meIdOrRefuse(caller), patch);
         }
         return { scope: args.scope, effective: summarizeScope(effective) };
       }
@@ -15590,8 +15633,7 @@ var init_config4 = __esm({
           assertMayEditChannel(caller, channel);
           await deps.config.clearChannelOverride(channel);
         } else {
-          assertMeWritable(caller);
-          await deps.config.clearUserOverride(caller.id);
+          await deps.config.clearUserOverride(meIdOrRefuse(caller));
         }
         return { scope: args.scope, cleared: true };
       }
@@ -15633,7 +15675,7 @@ ${quote(current ?? "")}`;
       handler: async ({ args, options, caller, deps }) => {
         const channel = args.scope === "channel" ? targetChannel(caller, options.channel) : void 0;
         if (args.text === void 0 && channel !== void 0) await assertMayReadChannel(caller, channel, deps);
-        const scopes = await deps.config.scopes(channel ?? caller.origin?.channelId ?? "", caller.id);
+        const scopes = await deps.config.scopes(channel ?? caller.origin?.channelId ?? "", meIdOf(caller) ?? caller.id);
         const current = (args.scope === "channel" ? scopes.channel : scopes.user).instructions?.trim();
         if (args.text === void 0)
           return { scope: args.scope, action: "show", ...current ? { instructions: current } : {} };
@@ -15650,8 +15692,7 @@ ${quote(current ?? "")}`;
           assertMayEditChannel(caller, channel);
           effective = await deps.config.setChannelOverride(channel, patch);
         } else {
-          assertMeWritable(caller);
-          effective = await deps.config.setUserOverride(caller.id, patch);
+          effective = await deps.config.setUserOverride(meIdOrRefuse(caller), patch);
         }
         if (text.length === 0) {
           const fromStatic = effective.instructions?.trim();
@@ -15782,7 +15823,25 @@ function anyOf(alternatives) {
   if (flat.length === 1) return flat[0];
   return { kind: "or", of: flat };
 }
-function compileCondition(condition, grants, selfId) {
+function allOf(parts) {
+  const flat = [];
+  for (const p of parts) {
+    if (p.kind === "none") return NONE;
+    if (p.kind === "all") continue;
+    if (p.kind === "and") flat.push(...p.of);
+    else flat.push(p);
+  }
+  if (flat.length === 0) return ALL;
+  if (flat.length === 1) return flat[0];
+  return { kind: "and", of: flat };
+}
+function selfPredicate(selfIds) {
+  return anyOf(selfIds.map((userId) => ({ kind: "user-is", userId })));
+}
+function ownedBy(actor) {
+  return selfPredicate(selfIdsOf(actor));
+}
+function compileCondition(condition, grants, selfIds) {
   switch (condition.kind) {
     case "has-grant": {
       if (grants.actions === "all") return ALL;
@@ -15793,7 +15852,9 @@ function compileCondition(condition, grants, selfId) {
       if (grants.channels === "all") return ALL;
       return anyOf([grants.channels.size === 0 ? NONE : { kind: "channels-in", channelIds: grants.channels }, PUBLIC]);
     case "is-self":
-      return { kind: "user-is", userId: selfId };
+      return selfPredicate(selfIds);
+    case "acts-as-person":
+      return actsAsPerson(selfIds) ? ALL : NONE;
     case "owner-of":
       if (grants.repos === "all") return ALL;
       return grants.repos.size === 0 ? NONE : { kind: "repos-in", repos: grants.repos };
@@ -15802,17 +15863,9 @@ function compileCondition(condition, grants, selfId) {
   }
   return NONE;
 }
-function compileRule(rule, grants, selfId) {
+function compileRule(rule, grants, selfIds) {
   if (rule.originVisibility) return NONE;
-  const parts = [];
-  for (const condition of rule.when) {
-    const part = compileCondition(condition, grants, selfId);
-    if (part.kind === "none") return NONE;
-    if (part.kind !== "all") parts.push(part);
-  }
-  if (parts.length === 0) return ALL;
-  if (parts.length === 1) return parts[0];
-  return { kind: "and", of: parts };
+  return allOf(rule.when.map((condition) => compileCondition(condition, grants, selfIds)));
 }
 function predicateWith(rules, actor, action, resourceType, kind) {
   if (RESOURCE_KINDS[resourceType] && kind === void 0) {
@@ -15822,12 +15875,12 @@ function predicateWith(rules, actor, action, resourceType, kind) {
   if (!target) throw new TypeError(`authz predicate: no target for ${resourceType}${kind ? `/${kind}` : ""}`);
   if (!isKnownActorKind(actor.kind)) return NONE;
   const grants = effectiveGrants(actor);
-  const selfId = principalOf(actor).id;
+  const selfIds = selfIdsOf(actor);
   const alternatives = [];
   for (const rule of rules) {
     if (rule.action !== action || ruleTarget(rule) !== target) continue;
     if (rule.actorKinds && !rule.actorKinds.includes(actor.kind)) continue;
-    alternatives.push(compileRule(rule, grants, selfId));
+    alternatives.push(compileRule(rule, grants, selfIds));
   }
   return anyOf(alternatives);
 }
@@ -18938,6 +18991,25 @@ var init_service = __esm({
         for (const r of resolved) out.push(await this.view(r));
         return out;
       }
+      /** Every tier there is — the org, every channel, every user (static and runtime) — for an
+       *  actor with org rights; anyone else is refused (record 0042: a non-admin never sees another
+       *  person's tier). Each row carries `addedByName` when the lookup answers. */
+      async listAll(actor) {
+        if (!actor.orgAdmin)
+          throw new McpServiceError(
+            "unauthorized",
+            "listing every tier's MCP servers takes admin rights (repo-management rights). `mcp list` shows the org's, this channel's and your own."
+          );
+        const { channels, users } = this.opts.config.mcpTierIds();
+        const targets = [
+          { kind: "org" },
+          ...channels.map((id) => ({ kind: "channel", id })),
+          ...users.map((id) => ({ kind: "user", id }))
+        ];
+        const out = [];
+        for (const target of targets) for (const r of this.tierEntries(target)) out.push(await this.view(r));
+        return out;
+      }
       async add(actor, target, input) {
         const scopeKey = mcpScopeKey(target.kind, target.id);
         try {
@@ -19052,6 +19124,55 @@ var init_service = __esm({
           return { ...view, probe: { ok: false, error: (err2 instanceof Error ? err2.message : String(err2)).slice(0, 300) } };
         }
       }
+      /** `mcp promote <name> --from <user>` (record 0042): copy a person's runtime entry — `url`,
+       *  `auth`, `agents` (widened only when the admin passes some) — into the org tier under the
+       *  same name, `addedBy` the admin and `promotedFrom` the person, and for bearer/oauth mint a
+       *  fresh ORG connect ticket exactly as `mcp add --scope org` would. The person's sealed
+       *  credential is never read, unsealed or written: it is theirs, and the org's calls must not
+       *  run as them. The personal entry stays (shadowed by the org tier at run time). */
+      async promote(actor, name, from, opts = {}) {
+        const org = this.target(actor, "org", void 0);
+        const source2 = this.tierEntries({ kind: "user", id: from }).find((r) => r.name === name);
+        if (!source2)
+          throw new McpServiceError(
+            "not_found",
+            `no MCP server named "${name}" in the user scope of ${from} (see \`mcp list --all\`)`
+          );
+        if (source2.source === "config")
+          throw new McpServiceError(
+            "conflict",
+            `"${name}" is pinned in config.yaml under users.${from} \u2014 move it to defaults.mcpServers there`
+          );
+        const runtime = this.opts.config.runtimeScope("org");
+        if (runtime.mcpServers?.[name] || this.opts.config.isStaticMcpServer("org", void 0, name))
+          throw new McpServiceError(
+            "conflict",
+            `an org MCP server named "${name}" already exists \u2014 remove it first or pick another name`
+          );
+        if (Object.keys(runtime.mcpServers ?? {}).length >= MCP_SERVERS_PER_SCOPE_MAX)
+          throw new McpServiceError("invalid_input", `the org scope already has ${MCP_SERVERS_PER_SCOPE_MAX} servers`);
+        const agents = this.checkAgents("org", opts.agents ?? source2.entry.agents);
+        if (source2.entry.auth !== "none") this.requireCredentialSupport(source2.entry.auth);
+        const entry = {
+          url: source2.entry.url,
+          agents,
+          auth: source2.entry.auth,
+          addedBy: actor.id,
+          addedAt: this.now(),
+          promotedFrom: from
+        };
+        await this.writeServers(org, { ...runtime.mcpServers, [name]: entry });
+        const view = serverView("org", name, entry, { hasCredential: false, source: "runtime" });
+        if (entry.auth === "none") return { server: view, promotedFrom: from };
+        const ticket = await this.mintTicket(mcpCredentialKey("org", name), actor);
+        return {
+          server: view,
+          promotedFrom: from,
+          connectUrl: this.connectUrl(ticket),
+          expiresAt: ticket.expiresAt,
+          expiresInMinutes: TICKET_MINUTES
+        };
+      }
       // ---- the connect page ----------------------------------------------------------
       /** GET: binding an unbound ticket is a compare-and-swap on its state; when
        *  another opener won the race the decision is re-planned against the
@@ -19421,7 +19542,7 @@ var init_service = __esm({
         return `${(this.opts.publicBaseUrl ?? "").replace(/\/+$/, "")}/mcp/connect/${ticket.nonce}`;
       }
       async mintTicket(serverId, actor) {
-        const email = this.opts.resolveEmail ? await this.opts.resolveEmail(actor.id).catch(() => void 0) : void 0;
+        const email = actor.email ?? (this.opts.resolveEmail ? await this.opts.resolveEmail(actor.id).catch(() => void 0) : void 0);
         const ticket = newTicket({
           nonce: this.nonce(),
           serverId,
@@ -19478,7 +19599,9 @@ var init_service = __esm({
       }
       async view(r) {
         const hasCredential = r.entry.auth !== "none" && !r.entry.tokenEnv ? await this.viaSecrets(() => this.opts.secrets.getCredential(mcpCredentialKey(r.scopeKey, r.name))) !== null : false;
-        return serverView(r.scopeKey, r.name, r.entry, { hasCredential, source: r.source });
+        const view = serverView(r.scopeKey, r.name, r.entry, { hasCredential, source: r.source });
+        const name = view.addedBy && this.opts.resolveName ? await this.opts.resolveName(view.addedBy).catch(() => void 0) : void 0;
+        return name ? { ...view, addedByName: name } : view;
       }
       async specFor(r) {
         const id = mcpCredentialKey(r.scopeKey, r.name);
@@ -19576,7 +19699,11 @@ async function serviceOf(deps) {
 }
 function actorOf(caller, channel) {
   return {
-    id: caller.id,
+    // The person, for a dashboard session linked to one (record 0042): its
+    // own tier, `addedBy` and the connect ticket's email are the person's.
+    id: meIdOf(caller) ?? caller.id,
+    // A dashboard session's own email binds the tickets it mints, linked or not.
+    ...caller.email ? { email: caller.email } : {},
     orgAdmin: authorize(caller.actor, "mcp:write", { type: "config-scope", kind: "org" }).allow,
     channelAdmin: authorize(caller.actor, "mcp:write", { type: "config-scope", kind: "channel", id: channel ?? "" }).allow
   };
@@ -19585,7 +19712,7 @@ function channelOf2(caller, option) {
   return option ?? caller.origin?.channelId;
 }
 async function writeTarget(svc, caller, actor, word, channel) {
-  if ((word ?? "me") === "me" && caller.kind === "access")
+  if ((word ?? "me") === "me" && meIdOf(caller) === void 0)
     throw new CommandError("unauthorized", MCP_ME_ON_ACCESS_MESSAGE);
   return via(() => svc.target(actor, word ?? "me", channel));
 }
@@ -19627,7 +19754,10 @@ function renderServerLine(r) {
   const state = r.state === "connected" ? "\u2705 connected" : r.state === "static" ? "\u2705 static (bot env)" : "\u23F3 awaiting credential";
   const agents = Array.isArray(r.agents) ? r.agents.join(", ") : "";
   const pinned = r.source === "config" ? " \xB7 pinned in config.yaml" : "";
-  return `\u2022 \`${String(r.name)}\` (${String(r.scope)}) ${state} \u2014 ${String(r.url)} \xB7 agents: ${agents} \xB7 auth: ${String(r.auth)}${pinned}`;
+  const by = typeof r.addedBy === "string" ? ` \xB7 added by ${typeof r.addedByName === "string" ? r.addedByName : r.addedBy}` : "";
+  const from = typeof r.promotedFrom === "string" ? ` \xB7 promoted from ${r.promotedFrom}` : "";
+  const owner = r.scope === "user" && typeof r.scopeKey === "string" ? ` \xB7 tier of ${r.scopeKey.slice("user:".length)}` : "";
+  return `\u2022 \`${String(r.name)}\` (${String(r.scope)}) ${state} \u2014 ${String(r.url)} \xB7 agents: ${agents} \xB7 auth: ${String(r.auth)}${pinned}${by}${from}${owner}`;
 }
 function renderList(output) {
   const o = output;
@@ -19667,13 +19797,14 @@ function renderShow(output) {
 function registerMcpCommands(registry) {
   for (const cmd of MCP_COMMANDS) registry.register(cmd);
 }
-var defineCommand10, serverName, serverUrl, scopeOption, channelOption2, nameArg, MCP_ME_ON_ACCESS_MESSAGE, mcpList, mcpAdd, mcpConnect, mcpShow, mcpRemove, MCP_COMMANDS;
+var defineCommand10, serverName, serverUrl, scopeOption, channelOption2, nameArg, USER_ID_PATTERN, MCP_ME_ON_ACCESS_MESSAGE, mcpList, mcpPromote, mcpAdd, mcpConnect, mcpShow, mcpRemove, MCP_COMMANDS;
 var init_mcp = __esm({
   "../../src/core/commands/mcp.ts"() {
     "use strict";
     init_config3();
     init_service();
     init_authorize();
+    init_config4();
     init_commandRegistry();
     defineCommand10 = commandDefiner();
     serverName = z13.string().refine((s) => MCP_SERVER_NAME_PATTERN.test(s), "expected a slug: lowercase letters, digits, dashes (\u2264 32 chars)");
@@ -19683,22 +19814,53 @@ var init_mcp = __esm({
     );
     channelOption2 = z13.string().optional().describe("target channel for `--scope channel` and for `list` (default: the channel you are speaking in)");
     nameArg = { name: "name", schema: serverName, describe: "the server's name (see `mcp list`)" };
+    USER_ID_PATTERN = /^[a-z]+:[A-Za-z0-9_.@-]{1,200}$/;
     MCP_ME_ON_ACCESS_MESSAGE = "Personal MCP servers are added in chat (`mcp add <name> --url \u2026`): your runs are requested as your chat user, not as this browser session, so a server added here for yourself would reach no run. Pass --scope org or --scope channel.";
     mcpList = defineCommand10({
       id: "mcp.list",
       enabledWhen: (caps) => caps.mcp,
-      options: z13.object({ channel: channelOption2 }),
+      options: z13.object({
+        channel: channelOption2,
+        all: flag.optional().describe("every tier there is \u2014 the org's, every channel's, every user's (admins)")
+      }),
       action: "mcp:read",
       effect: "read",
-      describe: "External MCP servers your runs in this channel can use \u2014 org-wide, this channel's, and your own \u2014 with state and agents; never a credential.",
+      describe: "External MCP servers your runs in this channel can use \u2014 org-wide, this channel's, and your own \u2014 with state and agents; never a credential. `--all` (admins): every tier.",
       render: renderList,
       handler: async ({ options, caller, deps }) => {
         const svc = await serviceOf(deps);
         const channel = channelOf2(caller, options.channel);
-        const servers = await via(() => svc.list(actorOf(caller, channel), channel));
+        const actor = actorOf(caller, channel);
+        const servers = await via(() => options.all ? svc.listAll(actor) : svc.list(actor, channel));
         return { servers };
       }
     });
+    mcpPromote = defineCommand10({
+      id: "mcp.promote",
+      enabledWhen: (caps) => caps.mcp,
+      args: [nameArg],
+      options: z13.object({
+        from: z13.string().refine((s) => USER_ID_PATTERN.test(s), "expected a platform-namespaced user id (slack:U\u2026)").describe("whose personal server to promote (`slack:U\u2026`, as `mcp list --all` shows it)"),
+        agents: z13.string().transform(
+          (s) => s.split(",").map((a) => a.trim()).filter(Boolean)
+        ).optional().describe("widen the agents (default: the personal entry's); an org server may name coding/review/ship")
+      }),
+      action: "mcp:write",
+      // Org-only by definition (there is no `me` alternative to point at), so the gate is the
+      // table's, at the door: the same `mcp:write` on `config-scope { org }` that `mcp add --scope org` asks.
+      resource: () => ({ type: "config-scope", kind: "org" }),
+      effect: "write",
+      describe: "Re-issue a person's MCP server in the org tier (admins): the same name, URL and auth, added by you; a bearer/oauth server gets a fresh org connect link for you to complete \u2014 the person's credential is never copied.",
+      render: renderAdd,
+      settle: (output, { deps }) => settleConnect(deps, output),
+      handler: async ({ args, options, caller, deps }) => {
+        const svc = await serviceOf(deps);
+        const actor = actorOf(caller, channelOf2(caller, void 0));
+        return await via(
+          () => svc.promote(actor, args.name, options.from, options.agents ? { agents: options.agents } : {})
+        );
+      }
+    });
     mcpAdd = defineCommand10({
       id: "mcp.add",
       enabledWhen: (caps) => caps.mcp,
@@ -19796,7 +19958,7 @@ var init_mcp = __esm({
         return await via(() => svc.remove(actor, target, args.name));
       }
     });
-    MCP_COMMANDS = [mcpList, mcpAdd, mcpConnect, mcpShow, mcpRemove];
+    MCP_COMMANDS = [mcpList, mcpAdd, mcpConnect, mcpShow, mcpRemove, mcpPromote];
   }
 });
 
@@ -22669,14 +22831,16 @@ var init_runs = __esm({
         sinceMs: z18.coerce.number().int().nonnegative().optional().describe("only runs started at or after this epoch ms"),
         limit: positiveInt3.max(RUN_LIST_MAX_LIMIT).optional().describe(`page size (max ${RUN_LIST_MAX_LIMIT})`),
         before: z18.coerce.number().int().nonnegative().optional().describe("page cursor: runs finished before this epoch ms"),
-        beforeId: runId2.optional().describe("page cursor tie-breaker: the last id of the previous page")
+        beforeId: runId2.optional().describe("page cursor tie-breaker: the last id of the previous page"),
+        mine: flag.optional().describe("only the runs you requested \u2014 for a dashboard session, the Slack user its email names (record 0042)")
       }),
       action: "runs:read",
       effect: "read",
       describe: "List runs (live and persisted, newest first) \u2014 metadata only, never message text.",
       handler: async ({ options, caller, deps }) => {
-        const visibleTo = predicateFor(caller.actor, "runs:read", "run");
-        const { thread, parent, ...rest } = options;
+        const { thread, parent, mine, ...rest } = options;
+        const readable = predicateFor(caller.actor, "runs:read", "run");
+        const visibleTo = mine ? allOf([readable, ownedBy(caller.actor)]) : readable;
         return asJson3(
           await (await deps.runs()).listRuns({
             ...rest,
@@ -25768,7 +25932,13 @@ async function fetchPullRequestFacts(pr) {
     ...typeof data.title === "string" && data.title ? { title: data.title } : {},
     ..."auto_merge" in data ? { autoMergeEnabled: data.auto_merge !== null } : {},
     ..."mergeable" in data ? { mergeable: data.mergeable === null ? null : data.mergeable === true } : {},
-    ...typeof data.mergeable_state === "string" && data.mergeable_state ? { mergeableState: data.mergeable_state } : {}
+    ...typeof data.mergeable_state === "string" && data.mergeable_state ? { mergeableState: data.mergeable_state } : {},
+    // The merge commit rides only a merged row: on an open pull request GitHub
+    // reports a test-merge sha under `merge_commit_sha`.
+    ...typeof data.merged_at === "string" && data.merged_at ? {
+      mergedAt: data.merged_at,
+      ...typeof data.merge_commit_sha === "string" && /^[0-9a-f]{40}$/.test(data.merge_commit_sha) ? { mergeCommitSha: data.merge_commit_sha } : {}
+    } : {}
   };
 }
 async function mergePullRequest(pr, opts) {
@@ -26121,7 +26291,12 @@ async function resolveRepoContext(msg, history = [], probe, residentSlugs, recor
       } else {
         out.prUnpostable = { number: inherited.number, reason: head.reason };
         if (inherited.source === "record" && head.reason === "closed" && head.sha !== void 0) {
-          out.closedRecordPr = { number: inherited.number, headSha: head.sha, merged: head.merged };
+          out.closedRecordPr = {
+            number: inherited.number,
+            headSha: head.sha,
+            ...head.ref !== void 0 ? { headRef: head.ref } : {},
+            merged: head.merged
+          };
         }
       }
     }
@@ -26134,11 +26309,21 @@ function ownPrOf(ctx) {
 }
 function recordPrOf(ctx) {
   if (ctx.prFromRecord && ctx.pr !== void 0 && ctx.headSha !== void 0) {
-    return { number: ctx.pr, headSha: ctx.headSha, state: "open" };
+    return {
+      number: ctx.pr,
+      headSha: ctx.headSha,
+      ...ctx.refFromPr && ctx.ref !== void 0 ? { headBranch: ctx.ref } : {},
+      state: "open"
+    };
   }
   if (ctx.closedRecordPr !== void 0) {
-    const { number, headSha, merged } = ctx.closedRecordPr;
-    return { number, headSha, state: merged ? "merged" : "closed" };
+    const { number, headSha, headRef, merged } = ctx.closedRecordPr;
+    return {
+      number,
+      headSha,
+      ...headRef !== void 0 ? { headBranch: headRef } : {},
+      state: merged ? "merged" : "closed"
+    };
   }
   return void 0;
 }
@@ -26150,8 +26335,14 @@ function inheritedPr(thread, records, repo) {
 }
 async function openPrHeadSha(pr) {
   const head = await prHead(pr).catch(() => void 0);
-  if (head?.state === "closed")
-    return { reason: "closed", ...head.sha ? { sha: head.sha } : {}, merged: head.merged };
+  if (head?.state === "closed") {
+    return {
+      reason: "closed",
+      ...head.sha ? { sha: head.sha } : {},
+      ...head.ref ? { ref: head.ref } : {},
+      merged: head.merged
+    };
+  }
   if (head?.state === "open" && head.sha) {
     return {
       sha: head.sha,
@@ -26999,7 +27190,7 @@ var init_types5 = __esm({
 
 // ../../src/core/dispatch/commandRun.ts
 function isInlineRunCommand(id) {
-  return id.startsWith("friction.") || id === "memory.forget" || /^repo\.(onboard|offboard|rebuild|reconfigure|test|build)$/.test(id) || /^mcp\.(add|connect|remove)$/.test(id);
+  return id.startsWith("friction.") || id === "memory.forget" || /^repo\.(onboard|offboard|rebuild|reconfigure|test|build)$/.test(id) || /^mcp\.(add|connect|remove|promote)$/.test(id);
 }
 async function runChatCommand(deps, msg, io, parsed, ending, trace, opts = {}) {
   const commands = deps.commands;
@@ -32512,6 +32703,14 @@ async function attachRound(deps, ctx) {
     return attached;
   });
 }
+async function reattachWorkspace2(deps, ctx) {
+  try {
+    return { kind: "attached", round: await attachRound(deps, ctx) };
+  } catch (err2) {
+    if (err2 instanceof WorkspaceReattachRefusedError) return { kind: "reattach_refused", why: err2.why };
+    throw err2;
+  }
+}
 async function attachWorkspace(deps, ctx) {
   const { msg, io, refuse: refuse3, card, shell, closeLines, clock: clock4, agent, profile, repoCtx, root, reattach } = ctx;
   let round2;
@@ -32908,7 +33107,7 @@ function openThroughSeam(harness, deps, run2) {
   }
   return harness.open(deps, run2);
 }
-var isRecord3, relaunchesOf, isPiFacts, HarnessInterruptedError, HarnessMismatchError;
+var isRecord3, relaunchesOf, isPiFacts, HarnessInterruptedError, HarnessMismatchError, RELAUNCH_CEILING, HarnessContainerReplacedError;
 var init_contract4 = __esm({
   "../../src/core/harness/contract.ts"() {
     "use strict";
@@ -32939,6 +33138,114 @@ var init_contract4 = __esm({
       expected;
       found;
     };
+    RELAUNCH_CEILING = 2;
+    HarnessContainerReplacedError = class extends HarnessInterruptedError {
+      constructor(message3, said2, was, now, record2) {
+        super(message3, "container replaced under the run", "container_replaced");
+        this.said = said2;
+        this.was = was;
+        this.now = now;
+        this.record = record2;
+        this.name = "HarnessContainerReplacedError";
+      }
+      said;
+      was;
+      now;
+      record;
+    };
+  }
+});
+
+// ../../src/core/dispatch/relaunch.ts
+async function prepareRelaunch(deps, ctx) {
+  const { replaced, facts: facts2, harness } = ctx;
+  const refuse3 = (why, reason2, refusal = "container_replaced") => ({
+    kind: "refused",
+    interruption: new RelaunchRefusedError(why, reason2, refusal)
+  });
+  if (harness.history !== "authored-session")
+    return refuse3(
+      `the ${harness.name} harness keeps its own store, which went with the container, so nothing here can rebuild its process; the run restarts from its request`,
+      "container replaced under the run; the harness keeps its own store; restarting from the request"
+    );
+  if (facts2 === void 0)
+    return refuse3(
+      "the row carries no harness facts to count a relaunch on; the run restarts from its request",
+      "container replaced under the run before its process left facts; restarting from the request"
+    );
+  const relaunches = facts2.relaunches;
+  if (relaunches >= RELAUNCH_CEILING)
+    return refuse3(
+      `the container was replaced under the run again and the relaunch ceiling is ${RELAUNCH_CEILING} (${relaunches} relaunches already), so pi is not started a ${ordinal(relaunches + 2)} time; the run restarts from its request`,
+      `relaunch ceiling: ${relaunches} relaunches already; restarting from the request`
+    );
+  let round2;
+  if (ctx.binding !== void 0) {
+    const reattached = await reattachWorkspace2(deps, {
+      threadKey: ctx.threadKey,
+      agent: ctx.agent,
+      profile: ctx.profile,
+      repoCtx: ctx.repoCtx,
+      root: ctx.root,
+      clock: ctx.clock,
+      reattach: ctx.binding
+    });
+    if (reattached.kind === "reattach_refused")
+      return refuse3(
+        `the run's workspace could not be re-attached in the replacement container (${reattached.why}); the run restarts from its request as a new run in this thread`,
+        "workspace lost with the replaced container; restarting from the request",
+        "workspace_lost"
+      );
+    round2 = reattached.round;
+  }
+  const counted = { ...facts2, relaunches: relaunches + 1 };
+  let written = counted;
+  let bearer;
+  if (deps.runBearers) {
+    const rotated = deps.runBearers.rotate(ctx.runId, (secretHash) => {
+      written = { ...counted, bearerHash: secretHash };
+      ctx.saveFacts(written);
+    });
+    if (!rotated.ok)
+      return refuse3(
+        `the run's bearer could not be rotated for the relaunch (${rotated.reason}); the run restarts from its request`,
+        `the run's bearer could not be rotated (${rotated.reason}); restarting from the request`
+      );
+    bearer = rotated.token;
+  } else {
+    ctx.saveFacts(written);
+  }
+  const { deadline, ...record2 } = replaced.record;
+  return {
+    kind: "relaunch",
+    resume: {
+      ...record2,
+      remainingMs: Math.max(0, deadline - ctx.clock()),
+      facts: written,
+      relaunch: {
+        ...replaced.was !== void 0 ? { from: replaced.was } : {},
+        ...replaced.now !== void 0 ? { to: replaced.now } : {}
+      }
+    },
+    ...bearer !== void 0 ? { bearer } : {},
+    ...round2 !== void 0 ? { round: round2 } : {}
+  };
+}
+function ordinal(n2) {
+  return n2 === 2 ? "second" : n2 === 3 ? "third" : n2 === 4 ? "fourth" : `${n2}th`;
+}
+var RelaunchRefusedError;
+var init_relaunch = __esm({
+  "../../src/core/dispatch/relaunch.ts"() {
+    "use strict";
+    init_contract4();
+    init_provision();
+    RelaunchRefusedError = class extends HarnessInterruptedError {
+      constructor(message3, reason2, refusal) {
+        super(message3, reason2, refusal);
+        this.name = "RelaunchRefusedError";
+      }
+    };
   }
 });
 
@@ -32980,7 +33287,7 @@ function startScript(start3) {
     `mkfifo -m 600 ${shellQuote(paths.fifo)}`,
     keepLog ? `: >> ${shellQuote(paths.log)}` : `: > ${shellQuote(paths.log)}`,
     keepLog ? `: >> ${shellQuote(paths.errLog)}` : `: > ${shellQuote(paths.errLog)}`,
-    `setsid -f sh -c ${shellQuote(inner)}`,
+    `setsid -f sh -c ${shellQuote(inner)} ${DETACHED_STDIO}`,
     `sleep 0.3`,
     `cat ${shellQuote(paths.pidFile)}`
   ].join(" && ");
@@ -33087,7 +33394,7 @@ function stdoutOf(operation, out) {
   const stdout = cut >= 0 ? out.slice(0, cut) : out;
   return stdout === "(no output)" ? "" : stdout;
 }
-var PORT_ARG, HARNESS_PORT_ENV, HarnessContainerError, WRITE_CHUNK_CHARS, INLINE_LINE_CHARS, LOG_READ_BYTES, COMMAND_WORD, FREE_PORT_JS, IDENTITY_WORD, METHOD_WORD, PATH_WORD, HEADER_NAME, OP_TIMEOUT_MS, CURL_MAX_TIME_S, secretHeaderEnv, STDERR_MARK, RUNTIME_WORD, HarnessContainerRuntimeReplacedError, ExecHarnessContainer;
+var PORT_ARG, HARNESS_PORT_ENV, HarnessContainerError, WRITE_CHUNK_CHARS, INLINE_LINE_CHARS, LOG_READ_BYTES, COMMAND_WORD, FREE_PORT_JS, DETACHED_STDIO, IDENTITY_WORD, METHOD_WORD, PATH_WORD, HEADER_NAME, OP_TIMEOUT_MS, CURL_MAX_TIME_S, secretHeaderEnv, STDERR_MARK, RUNTIME_WORD, HarnessContainerRuntimeReplacedError, ExecHarnessContainer;
 var init_container = __esm({
   "../../src/core/harness/container.ts"() {
     "use strict";
@@ -33109,6 +33416,7 @@ var init_container = __esm({
     LOG_READ_BYTES = 48 * 1024;
     COMMAND_WORD = /^[A-Za-z0-9_./-]+$/;
     FREE_PORT_JS = 'const s=require("net").createServer();s.listen(0,"127.0.0.1",()=>{console.log(s.address().port);s.close()})';
+    DETACHED_STDIO = "</dev/null >/dev/null 2>&1";
     IDENTITY_WORD = /^[A-Za-z0-9-]{1,64}$/;
     METHOD_WORD = /^[A-Z]+$/;
     PATH_WORD = /^\/\S*$/;
@@ -34251,12 +34559,32 @@ var init_mirror = __esm({
       seedEchoPending = false;
       mirroredTail;
       iteration = 0;
+      /** The rows written since the mirror started, and the compaction entries
+       *  among them by position — kept whether or not the ledger is wired, so
+       *  the harness holds this generation's copy of the record it wrote
+       *  (`written`), what a relaunch under a living bot rebuilds from. Bounded
+       *  by the run as the ledger's transcript and pi's own session file are — one
+       *  row per turn under the run's turn guard, the same bytes both already
+       *  hold — and never trimmed: a rebuilt session renders every row, with each
+       *  compaction where it sat, so a row dropped here would be a row the record
+       *  clause lost. */
+      rows = [];
+      compactionRows = [];
       /** The highest ledger inbox seq folded in so far (run-history item 40). */
       inboxConsumedSeq = 0;
       /** Whether a report is owed: the mirror is wired and something happened. */
       get wired() {
         return this.deps.onStep !== void 0;
       }
+      /** The transcript rows this mirror has written since it started (the rows
+       *  after the seed or the resumed transcript it was constructed on), and the
+       *  compaction entries among them, each `before` counted from the first of
+       *  these rows: what a relaunch under a living bot rebuilds from
+       *  (harness-pi item 8), this generation's copy of the ledger's rows. A row
+       *  met again on a re-attach (`alreadyHeld`) was the caller's and is not here. */
+      get written() {
+        return { messages: [...this.rows], compactions: [...this.compactionRows] };
+      }
       /** The row (the run's own index) the calls under way ride in — the last
        *  assistant turn the ledger holds — for the `tool_call` stamp (run-history
        *  item 53); undefined before any assistant turn, or when the transcript's
@@ -34277,6 +34605,19 @@ var init_mirror = __esm({
       expectSeedEcho() {
         this.seedEchoPending = true;
       }
+      /** The settlement turn a rebuilt process's session starts on (harness-pi
+       *  item 8) — one tool result per call in flight at the death: the relay's
+       *  answer, the still-running note or the restart note — primed as the user
+       *  content pending for the next step, the write-through's own convention
+       *  (the results since the last assistant turn are the one user turn the next
+       *  step carries). The ledger's next rows are then the session's,
+       *  `[user(settlements + the continue echo), assistant]` from the seed index,
+       *  so a rebuild from the ledger at the next death hands the model a
+       *  `tool_result` for every `tool_use` and the two records agree on what the
+       *  model saw. Never on a re-attach, where pi's own log carries the results. */
+      prime(parts) {
+        this.pendingUser.push(...parts);
+      }
       /** The row about to be written, against the transcript's tail — compared
        *  once, with the first row the mirror meets: equal means the ledger holds
        *  it already (read again, harness-pi item 8), together with the results
@@ -34295,7 +34636,6 @@ var init_mirror = __esm({
        *  there — so the harness can move the row's offset past it. A result or a
        *  steer's text waits in memory for the next step, and the answer is no. */
       async onMessage(message3, turn) {
-        if (!this.deps.onStep) return false;
         const chat = chatMessageOf(message3);
         if (!chat) return false;
         if (chat.content.length === 0) return false;
@@ -34307,7 +34647,7 @@ var init_mirror = __esm({
           this.pendingUser.push(...chat.content);
           return false;
         }
-        if (this.alreadyHeld({ turn: chat })) return true;
+        if (this.alreadyHeld({ turn: chat })) return this.wired;
         const turns = [];
         if (this.pendingUser.length > 0) turns.push({ role: "user", content: this.pendingUser });
         this.pendingUser = [];
@@ -34324,6 +34664,8 @@ var init_mirror = __esm({
         };
         this.idx += turns.length;
         this.lastAssistantIdx = this.idx - 1;
+        this.rows.push(...turns);
+        if (!this.deps.onStep) return false;
         await this.deps.onStep(report2);
         return true;
       }
@@ -34333,8 +34675,7 @@ var init_mirror = __esm({
        *  the summary where pi wrote it and the index moves past it. Answers as
        *  `onMessage` does: the ledger holds everything up to the entry. */
       async onCompaction(entry, turn) {
-        if (!this.deps.onStep) return false;
-        if (this.alreadyHeld({ compaction: entry })) return true;
+        if (this.alreadyHeld({ compaction: entry })) return this.wired;
         const turns = [];
         if (this.pendingUser.length > 0) turns.push({ role: "user", content: this.pendingUser });
         this.pendingUser = [];
@@ -34349,6 +34690,9 @@ var init_mirror = __esm({
           inboxConsumedSeq: this.inboxConsumedSeq
         };
         this.idx += turns.length + 1;
+        this.rows.push(...turns);
+        this.compactionRows.push({ before: this.rows.length, entry });
+        if (!this.deps.onStep) return false;
         await this.deps.onStep(report2);
         return true;
       }
@@ -34507,6 +34851,426 @@ var init_process = __esm({
   }
 });
 
+// ../../src/execution/tracingExecutor.ts
+var TracingExecutor;
+var init_tracingExecutor = __esm({
+  "../../src/execution/tracingExecutor.ts"() {
+    "use strict";
+    TracingExecutor = class {
+      constructor(inner, span, backend) {
+        this.inner = inner;
+        this.span = span;
+        this.backend = backend;
+        const innerRelease = inner.release?.bind(inner);
+        if (innerRelease) this.release = (mode) => this.timed("exec.release", (s) => innerRelease(mode, { span: s }));
+        const innerMoveTo = inner.moveTo?.bind(inner);
+        if (innerMoveTo) this.moveTo = (sha) => this.timed("exec.move_to", (s) => innerMoveTo(sha, { span: s }));
+        const innerReadBytes = inner.readBytes?.bind(inner);
+        if (innerReadBytes)
+          this.readBytes = (path) => this.timed("exec.read_bytes", (s) => innerReadBytes(path, { span: s }));
+      }
+      inner;
+      span;
+      backend;
+      release;
+      moveTo;
+      readBytes;
+      /** Each op under its own `exec.*` span, handed to the inner executor as
+       *  `opts.span` so its HTTP calls become `http.client` children (item 21). */
+      timed(name, fn, extra = {}) {
+        return this.span.span(name, (s) => fn(s), {
+          attrs: {
+            ...this.backend !== void 0 ? { backend: this.backend } : {},
+            ...extra.timeoutMs !== void 0 ? { timeoutMs: extra.timeoutMs } : {}
+          }
+        });
+      }
+      exec(command2, opts) {
+        return this.timed("exec.exec", (s) => this.inner.exec(command2, { ...opts, span: s }), {
+          timeoutMs: opts?.timeoutMs
+        });
+      }
+      readFile(path) {
+        return this.timed("exec.read_file", (s) => this.inner.readFile(path, { span: s }));
+      }
+      writeFile(path, content) {
+        return this.timed("exec.write_file", (s) => this.inner.writeFile(path, content, { span: s }));
+      }
+    };
+  }
+});
+
+// ../../src/core/chatMessage.ts
+function capToolResultContent(content, cap = MAX_TOOL_RESULT_CHARS) {
+  const capText = (text) => text.length > cap ? `${text.slice(0, cap)}
+\u2026[tool result truncated: ${text.length - cap} of ${text.length} characters cut \u2014 ask for a narrower slice]` : text;
+  if (typeof content === "string") return capText(content);
+  return content.map((p) => p.type === "text" ? { ...p, text: capText(p.text) } : p);
+}
+var MAX_TOOL_RESULT_CHARS;
+var init_chatMessage = __esm({
+  "../../src/core/chatMessage.ts"() {
+    "use strict";
+    MAX_TOOL_RESULT_CHARS = 12e4;
+  }
+});
+
+// ../../src/core/harness/pi/toolRules.ts
+import { isAbsolute as isAbsolute5, relative, resolve as resolve10 } from "node:path";
+function reachFor(identity2) {
+  if (identity2 === "write") return CODING_REACH;
+  if (identity2 === "read") return READ_REACH;
+  return NONE_REACH;
+}
+function judgeToolCall(tool, input, ctx) {
+  const bundle = PI_TOOL_BUNDLES[tool];
+  if (bundle === void 0) return outside(`${tool} is not in any bundle the ${ctx.identity} identity reaches`);
+  if (!reachFor(ctx.identity).has(bundle)) {
+    return outside(
+      ctx.identity === "none" ? `${tool} is the \`${bundle}\` bundle: a run without a workspace (identity none) has none of pi's own tools` : `${tool} is the \`${bundle}\` bundle, outside the ${ctx.identity} identity's reach`
+    );
+  }
+  const args = isRecord6(input) ? input : {};
+  if (tool === "bash") return judgeBash(args.command, ctx);
+  if (bundle === "files" || bundle === "write-files") return judgePath(args.path, ctx);
+  return allowed;
+}
+function judgeBash(command2, ctx) {
+  if (typeof command2 !== "string") return refused3("malformed \u2014 bash without a string command");
+  if (CREDENTIAL_FILE.test(command2)) return refused3("credential \u2014 reads the executor's credential store");
+  if (ENV_DUMP.test(command2)) return refused3("credential \u2014 dumps the process environment");
+  if (CREDENTIAL_VAR.test(command2)) return refused3("credential \u2014 expands a credential variable");
+  if (MERGE_OR_APPROVE.test(command2)) {
+    return refused3("merge/approve \u2014 a coding run never merges or approves a pull request");
+  }
+  if (ctx.identity !== "write") {
+    if (ANY_PUSH.test(command2)) return refused3("read-only \u2014 a read-identity run never pushes");
+    if (GH_WRITE_VERB.test(command2) || GH_API_WRITE.test(command2) || CURL_GITHUB_WRITE.test(command2)) {
+      return refused3("read-only \u2014 a read-identity run never writes to GitHub");
+    }
+    return allowed;
+  }
+  for (const match of command2.matchAll(GIT_PUSH)) {
+    const verdict = judgePush(match[1], ctx);
+    if (verdict.verdict !== "allowed") return verdict;
+  }
+  return allowed;
+}
+function judgePush(tail, ctx) {
+  const words = tail.split(/\s+/).filter((w) => w.length > 0 && !w.startsWith("-"));
+  const [remote, refspec] = words;
+  if (remote !== void 0 && remote !== "origin") {
+    return refused3(`repo:use \u2014 push to remote \`${remote}\`, not the run's repository (origin)`);
+  }
+  if (refspec === void 0) return allowed;
+  const destination = refspec.replace(/^\+/, "").split(":").pop() ?? refspec;
+  if (ctx.branch !== void 0) {
+    const branch3 = destination === "HEAD" ? ctx.branch : destination.replace(/^refs\/heads\//, "");
+    if (branch3 !== ctx.branch) return refused3(`repo:use \u2014 push to \`${branch3}\`, not the run's branch ${ctx.branch}`);
+    return allowed;
+  }
+  const branch2 = destination.replace(/^refs\/heads\//, "");
+  if (branch2 !== "HEAD" && (ctx.protectedBranches ?? []).includes(branch2)) {
+    return refused3(
+      `repo:use \u2014 push to \`${branch2}\`, the branch this run's pull request targets; push your own branch`
+    );
+  }
+  return allowed;
+}
+function judgePath(path, ctx) {
+  if (path === void 0) return allowed;
+  if (typeof path !== "string") return refused3("malformed \u2014 a path tool without a string path");
+  if (CREDENTIAL_FILE.test(path)) return refused3("credential \u2014 reads the executor's credential store");
+  const rel = relative(ctx.checkout, resolve10(ctx.checkout, path));
+  if (rel.startsWith("..") || isAbsolute5(rel)) return refused3(`path \u2014 \`${path}\` resolves outside the checkout`);
+  return allowed;
+}
+var PI_TOOL_BUNDLES, CODING_REACH, READ_REACH, NONE_REACH, allowed, refused3, outside, isRecord6, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_THEN_PUSH, GIT_PUSH, ANY_PUSH, GH_WRITE_VERB, WRITE_METHOD, GH_API_WRITE, CURL_GITHUB_WRITE;
+var init_toolRules = __esm({
+  "../../src/core/harness/pi/toolRules.ts"() {
+    "use strict";
+    PI_TOOL_BUNDLES = {
+      bash: "shell",
+      read: "files",
+      grep: "files",
+      find: "files",
+      ls: "files",
+      write: "write-files",
+      edit: "write-files",
+      submit_pr_description: "pr",
+      submit_verdict: "verdict"
+    };
+    CODING_REACH = /* @__PURE__ */ new Set([
+      "shell",
+      "files",
+      "write-files",
+      "web",
+      "github-read",
+      "github-write",
+      "pr"
+    ]);
+    READ_REACH = /* @__PURE__ */ new Set(["shell", "files", "web", "search", "github-read", "verdict"]);
+    NONE_REACH = /* @__PURE__ */ new Set();
+    allowed = { verdict: "allowed" };
+    refused3 = (reason2) => ({ verdict: "refused", reason: reason2 });
+    outside = (reason2) => ({ verdict: "outside-profile", reason: reason2 });
+    isRecord6 = (v) => typeof v === "object" && v !== null;
+    CREDENTIAL_FILE = /(^|[\s/'"`])(\.git\/)?(github-credentials|\.git-credentials)($|[\s'"`|;&])/;
+    ENV_DUMP = /(^|[;&|(]\s*)((printenv|env)(\s+-[A-Za-z0-9-]+)*|export\s+-p|declare\s+-[a-zA-Z]*[px][a-zA-Z]*|set)\s*($|[|;&>)])|\/proc\/(self|\d+)\/environ|process\.env(?![.[\w])/;
+    CREDENTIAL_VAR = /\$\{?[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b|printenv\s+[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b/;
+    MERGE_OR_APPROVE = /\bgh\s+pr\s+(merge|review)\b|\/pulls\/\d+\/(merge|reviews)\b/;
+    GIT_THEN_PUSH = String.raw`\bgit(?:\s+(?:-C\s+\S+|--git-dir=\S+|--work-tree=\S+|-c\s+\S+|--no-pager))*\s+push\b`;
+    GIT_PUSH = new RegExp(`${GIT_THEN_PUSH}([^;&|]*)`, "g");
+    ANY_PUSH = new RegExp(GIT_THEN_PUSH);
+    GH_WRITE_VERB = /\bgh\s+(pr|issue)\s+(comment|create|edit|close|reopen|ready|lock|unlock|review|merge|delete|transfer|pin|unpin)\b/;
+    WRITE_METHOD = "(POST|post|PATCH|patch|PUT|put|DELETE|delete)";
+    GH_API_WRITE = new RegExp(
+      `\\bgh\\s+api\\b(?=[^;&|]*(?:\\s(?:-X|--method)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-f|-F|--field|--raw-field|--input)[\\s=]))`
+    );
+    CURL_GITHUB_WRITE = new RegExp(
+      `\\bcurl\\b(?=[^;&|]*api\\.github\\.com)(?=[^;&|]*(?:\\s(?:-X|--request)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-d|--data(?:-\\w+)?|--json|-T|--upload-file)[\\s=]))`
+    );
+  }
+});
+
+// ../../src/core/harness/pi/relay.ts
+function stillRunningNote(tool) {
+  return `This ${tool} call is still running in the bot: the process that made it was relaunched while the call was in flight, and the call keeps running there rather than being re-run \u2014 do not run it again; its result is kept on the relay under the same call id.`;
+}
+async function relayToolCall(harness, calls, ask, opts = {}) {
+  const answer = calls.join(ask.toolCallId, () => runRelayedTool(harness, ask, { signal: calls.signal }));
+  const window = new AbortController();
+  const sleep2 = opts.sleep ?? sleepUnlessAborted;
+  const progress = await Promise.race([
+    answer.then((a) => ({ done: true, answer: a })),
+    sleep2(opts.windowMs ?? RELAY_POLL_WINDOW_MS, window.signal).then(() => ({ done: false }))
+  ]);
+  window.abort();
+  return progress;
+}
+function relayedToolDefinitions(harness) {
+  return harness.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema }));
+}
+function authorizeToolCall(harness, ask) {
+  harness.gateSaw(ask.toolCallId);
+  const blocked = harness.toolsBlocked();
+  const refuse3 = (reason2) => {
+    harness.emit({
+      type: "run_note",
+      kind: "tool_refused",
+      summary: redactAndCap(`${ask.tool} refused: ${reason2}`, 300)
+    });
+    return { allow: false, reason: reason2 };
+  };
+  if (blocked !== void 0) return refuse3(blocked);
+  if (harness.tools.some((t) => t.name === ask.tool)) return { allow: true };
+  const verdict = judgeToolCall(ask.tool, ask.input, harness.rules);
+  if (verdict.verdict === "allowed") return { allow: true };
+  return refuse3(verdict.reason);
+}
+async function runRelayedTool(harness, ask, opts = {}) {
+  const tool = harness.tools.find((t) => t.name === ask.tool);
+  if (!tool) return { content: [{ type: "text", text: `Unknown tool: ${ask.tool}` }], isError: true };
+  const span = harness.toolSpan(ask.toolCallId);
+  const base = harness.toolContext;
+  const readConversation = base.conversation;
+  const ctx = {
+    ...span ? {
+      ...base,
+      span,
+      executor: new TracingExecutor(base.executor, span, harness.backend),
+      publish: (e) => harness.emit(withSpanId(e, span.id)),
+      ...base.github?.api.withSpan ? { github: { ...base.github, api: base.github.api.withSpan(span) } } : {}
+    } : { ...base, publish: (e) => harness.emit(e) },
+    ...opts.signal && !base.signal ? { signal: opts.signal } : {},
+    ...readConversation && harness.callSeen ? { conversation: () => harness.callSeen(ask.toolCallId).then(() => readConversation()) } : {},
+    // After the spreads, so the call's own id can never be shadowed by one on the base context.
+    callId: ask.toolCallId
+  };
+  try {
+    const input = typeof ask.input === "object" && ask.input !== null ? ask.input : {};
+    const output = await tool.run(input, ctx);
+    return { content: piContentOf(capToolResultContent(output)), isError: false };
+  } catch (err2) {
+    return errorAnswerOf(err2);
+  }
+}
+function errorAnswerOf(err2) {
+  const message3 = err2 instanceof Error ? err2.message : String(err2);
+  return { content: piContentOf(capToolResultContent(`Error: ${message3}`)), isError: true };
+}
+function piContentOf(content) {
+  if (typeof content === "string") return [{ type: "text", text: content }];
+  return content.map(
+    (p) => p.type === "text" ? { type: "text", text: p.text } : p.type === "image" ? { type: "image", data: p.data, mimeType: p.mediaType } : { type: "text", text: `[document ${p.name ?? "document"} (${p.mediaType})]` }
+  );
+}
+function withSpanId(e, spanId) {
+  switch (e.type) {
+    case "tool_call":
+    case "tool_result":
+    case "run_note":
+    case "assistant":
+    case "skill_use":
+      return { ...e, spanId };
+    default:
+      return e;
+  }
+}
+var HarnessRegistry, RELAY_POLL_WINDOW_MS, RelayedCalls;
+var init_relay = __esm({
+  "../../src/core/harness/pi/relay.ts"() {
+    "use strict";
+    init_tracingExecutor();
+    init_chatMessage();
+    init_awaitChildren();
+    init_runEvents();
+    init_toolRules();
+    HarnessRegistry = class {
+      live = /* @__PURE__ */ new Map();
+      /** The run drives a pi from here, its relayed calls kept beside it; the
+       *  returned function forgets it and ends whatever call still runs. */
+      register(harness) {
+        return this.hold({ harness, calls: new RelayedCalls() });
+      }
+      /** A process relaunched under the same run — in a replacement container,
+       *  with a rotated bearer (harness-pi item 8) — takes the run's registration
+       *  over, and the run's relayed calls stay: a call in flight keeps running
+       *  under the same end signal, and an ask by its id through the new
+       *  registration joins it and reads its answer. The earlier registration's
+       *  forget is a no-op from here; the returned one forgets the run and ends
+       *  the calls. Refuses by name a run that is not registered. */
+      replace(harness) {
+        const previous = this.live.get(harness.runId);
+        if (!previous) throw new Error(`run ${harness.runId} is not registered on the relay: nothing to replace`);
+        return this.hold({ harness, calls: previous.calls });
+      }
+      /** The run forgotten whichever registration holds it, its calls ended: the
+       *  run loop's, for a run whose process was found gone with its container
+       *  and is not relaunched — the harness left the registration standing so a
+       *  relaunch could take it over (`replace`) with the calls kept, and a
+       *  refusal has to end them. A run not registered is nothing to forget. */
+      forget(runId3) {
+        const entry = this.live.get(runId3);
+        if (!entry) return;
+        this.live.delete(runId3);
+        entry.calls.end();
+      }
+      hold(entry) {
+        this.live.set(entry.harness.runId, entry);
+        return () => {
+          if (this.live.get(entry.harness.runId) !== entry) return;
+          this.live.delete(entry.harness.runId);
+          entry.calls.end();
+        };
+      }
+      get(runId3) {
+        return this.live.get(runId3)?.harness;
+      }
+      /** The run's relayed calls, for as long as it is registered. */
+      calls(runId3) {
+        return this.live.get(runId3)?.calls;
+      }
+      size() {
+        return this.live.size;
+      }
+    };
+    RELAY_POLL_WINDOW_MS = 3e4;
+    RelayedCalls = class {
+      calls = /* @__PURE__ */ new Map();
+      /** The ids whose call is still running: joined by `join`, forgotten as each answers. */
+      running = /* @__PURE__ */ new Set();
+      /** The ids answered from the record (`settle`), never run here. */
+      settledIds = /* @__PURE__ */ new Set();
+      ending = new AbortController();
+      get size() {
+        return this.calls.size;
+      }
+      /** Aborted when the run ends: the signal every call here runs under. */
+      get signal() {
+        return this.ending.signal;
+      }
+      /** The call's answer as a promise: started by `start` on the first ask, the same promise after. */
+      join(callId, start3) {
+        let answer = this.calls.get(callId);
+        if (!answer) {
+          answer = start3();
+          this.calls.set(callId, answer);
+          this.running.add(callId);
+          const done = () => void this.running.delete(callId);
+          answer.then(done, done);
+        }
+        return answer;
+      }
+      /** The ids of the calls still running, in the order they were started. */
+      inFlight() {
+        return [...this.running];
+      }
+      /** A call asked here whose answer already landed: the answer, or nothing
+       *  for a call never asked, one still running (`awaitInFlight` reads those)
+       *  or one settled from the record (`settle`: the record's answer, not the
+       *  bot's). What a relaunch reads for a call the record names beside the
+       *  calls it awaits (harness-pi item 8): an answer that landed after the
+       *  process died and before it could ask again is carried into the rebuilt
+       *  session too, never lost to a restart note. A `start` that rejected is
+       *  the error answer `runRelayedTool` would have given. */
+      async answered(callId) {
+        const answer = this.calls.get(callId);
+        if (!answer || this.running.has(callId) || this.settledIds.has(callId)) return void 0;
+        return answer.then(
+          (a) => a,
+          (err2) => errorAnswerOf(err2)
+        );
+      }
+      /** Every call still running, awaited together up to one window — the relay
+       *  window a request waits, by default — for a relaunch that rebuilds the
+       *  process's session (harness-pi item 8): a call that answers inside it is
+       *  `done` with its answer, the result the rebuilt session carries; one still
+       *  running after it is not, keeps running here for an ask by the same id,
+       *  and the rebuilt session carries the still-running note in its place
+       *  (`stillRunningNote`). A call whose `start` rejected is `done` with an
+       *  error answer, as `runRelayedTool` answers its own throws, so one
+       *  straggler's exception never loses the others' answers. Nothing is ended
+       *  or re-run. Answers at once with nothing in flight. */
+      async awaitInFlight(opts = {}) {
+        const ids = this.inFlight();
+        if (ids.length === 0) return [];
+        const window = new AbortController();
+        const sleep2 = opts.sleep ?? sleepUnlessAborted;
+        const closed = sleep2(opts.windowMs ?? RELAY_POLL_WINDOW_MS, window.signal).then(() => ({
+          done: false
+        }));
+        const progress = await Promise.all(
+          ids.map(async (callId) => {
+            const answered = this.calls.get(callId).then(
+              (answer) => ({ done: true, answer }),
+              (err2) => ({ done: true, answer: errorAnswerOf(err2) })
+            );
+            return { callId, ...await Promise.race([answered, closed]) };
+          })
+        );
+        window.abort();
+        return progress;
+      }
+      /** The call's answer is known before it is asked (harness-pi item 8): the
+       *  record's settlement for a call in flight when the previous generation
+       *  died, whose extension asks again with the same id. Every ask reads it and
+       *  the tool never runs; a call already joined keeps the answer it has. */
+      settle(callId, answer) {
+        if (this.calls.has(callId)) return;
+        this.calls.set(callId, Promise.resolve(answer));
+        this.settledIds.add(callId);
+      }
+      end() {
+        this.ending.abort();
+        this.calls.clear();
+        this.running.clear();
+        this.settledIds.clear();
+      }
+    };
+  }
+});
+
 // ../../src/core/harness/pi/transport.ts
 var NEWLINE, PiRpcTransport;
 var init_transport = __esm({
@@ -34642,16 +35406,25 @@ function promptOf(seed) {
 function settlementText(s) {
   return s.action === "synthetic" ? s.text : `The bot restarted while this ${s.toolUse.name} call was in flight; its result was lost \u2014 re-check its effects before re-running it.`;
 }
-function settlementResults(settlements) {
+function settlementResults(settlements, settled = /* @__PURE__ */ new Map()) {
   if (settlements.length === 0) return void 0;
   return {
     role: "user",
-    content: settlements.map((s) => ({
-      type: "tool_result",
-      toolUseId: s.toolUse.id,
-      content: settlementText(s),
-      isError: true
-    }))
+    content: settlements.map((s) => {
+      const relay = settled.get(s.toolUse.id);
+      return {
+        type: "tool_result",
+        toolUseId: s.toolUse.id,
+        content: relay?.text ?? settlementText(s),
+        ...relay?.isError ?? true ? { isError: true } : {}
+      };
+    })
+  };
+}
+function relaySettlementOf(answer) {
+  return {
+    text: answer.content.map((c) => c.type === "text" ? c.text : "[image]").join("\n"),
+    isError: answer.isError
   };
 }
 function ledgerTailOf(resume) {
@@ -34782,12 +35555,36 @@ async function runPiHarnessOpen(deps, run2) {
         await deps.sleep(seenTick);
     }
   };
-  const forget = deps.registry.register(live);
+  const relaunch = run2.resume?.relaunch;
+  const forget = relaunch !== void 0 && deps.registry.get(run2.runId) !== void 0 ? deps.registry.replace(live) : deps.registry.register(live);
   const calls = deps.registry.calls(run2.runId);
   for (const s of run2.resume?.settlements ?? []) calls?.settle(s.toolUse.id, settlementAnswer(s));
   let pid;
   let transport;
   let facts2;
+  const recordBase = {
+    messages: run2.resume?.messages ?? run2.messages,
+    compactions: run2.resume?.compactions ?? []
+  };
+  const relaySettled = /* @__PURE__ */ new Map();
+  let stillRunning = 0;
+  const recordNow = () => {
+    const written = mirror.written;
+    const messages = [...recordBase.messages, ...written.messages];
+    const last = messages.at(-1);
+    const calls2 = last?.role === "assistant" ? last.content.filter((p) => p.type === "tool_use") : [];
+    return {
+      messages,
+      compactions: [
+        ...recordBase.compactions,
+        ...written.compactions.map((c) => ({ ...c, before: recordBase.messages.length + c.before }))
+      ],
+      settlements: calls2.map((toolUse) => ({ toolUse, action: "synthetic", text: replacedCallNote(toolUse.name) })),
+      turn: bridge.turns,
+      inboxConsumedSeq: mirror.inboxConsumedSeq,
+      deadline
+    };
+  };
   let mirrored = 0;
   const save = () => {
     if (facts2) {
@@ -34814,8 +35611,8 @@ async function runPiHarnessOpen(deps, run2) {
       hardStopped ? "the run was hard-stopped" : bypass ? "the run was stopped: a tool call bypassed the gate" : "the run ended"
     );
     save();
-    forget();
     if (replaced !== void 0) return;
+    forget();
     if (pid !== void 0) await container.kill(pid).catch(() => {
     });
     if (paths !== void 0) await container.remove(paths).catch(() => {
@@ -34827,7 +35624,7 @@ async function runPiHarnessOpen(deps, run2) {
     let elsewhere;
     const here = await container.identity();
     const honoured = (hash) => hash !== void 0 && (deps.bearers === void 0 || deps.bearers.adopt(run2.runId, hash));
-    if (recorded !== void 0) {
+    if (recorded !== void 0 && relaunch === void 0) {
       const located2 = await locatePi(recorded, container, here);
       if (located2 === "another-container") {
         elsewhere = `pi is elsewhere: the row's pi (pid ${recorded.pid}) ran in container ${recorded.container}, not the one this run was handed (${here}), so it was neither probed nor ended here`;
@@ -34862,7 +35659,7 @@ async function runPiHarnessOpen(deps, run2) {
       );
     } else {
       paths = piRunPathsAt(await container.makeRoot(piRunPaths(run2.runId).dir));
-      if (recorded?.root !== void 0 && recorded.root !== paths.dir && elsewhere === void 0)
+      if (recorded?.root !== void 0 && recorded.root !== paths.dir && elsewhere === void 0 && relaunch === void 0)
         await container.remove(piRunPathsAt(recorded.root)).catch(() => {
         });
       const spec = {
@@ -34878,12 +35675,33 @@ async function runPiHarnessOpen(deps, run2) {
       };
       let session;
       if (run2.resume) {
-        const settled2 = settlementResults(run2.resume.settlements);
+        const wanted = new Map(run2.resume.settlements.map((s) => [s.toolUse.id, s.toolUse.name]));
+        const running = calls?.inFlight().filter((id) => wanted.has(id)) ?? [];
+        if (running.length > 0)
+          run2.onProgress?.(
+            `waiting up to ${Math.round(RELAY_POLL_WINDOW_MS / 1e3)} s for ${running.length} relayed call(s) still running in the bot before pi restarts`
+          );
+        for (const p of await calls?.awaitInFlight({ sleep: (ms) => deps.sleep(ms) }) ?? []) {
+          const tool = wanted.get(p.callId);
+          if (tool === void 0) continue;
+          relaySettled.set(
+            p.callId,
+            p.done ? relaySettlementOf(p.answer) : { text: stillRunningNote(tool), isError: false }
+          );
+          if (!p.done) stillRunning++;
+        }
+        for (const [callId] of wanted) {
+          if (relaySettled.has(callId)) continue;
+          const answer2 = await calls?.answered(callId);
+          if (answer2 !== void 0) relaySettled.set(callId, relaySettlementOf(answer2));
+        }
+        const settled2 = settlementResults(run2.resume.settlements, relaySettled);
         session = {
           stem: "resumed",
           messages: settled2 ? [...run2.resume.messages, settled2] : run2.resume.messages,
           compactions: run2.resume.compactions ?? []
         };
+        if (settled2) mirror.prime(settled2.content);
       } else {
         const earlier2 = splitSeed(run2.messages).session;
         if (earlier2.length > 0) session = { stem: "seed", messages: earlier2, compactions: [] };
@@ -34908,7 +35726,20 @@ async function runPiHarnessOpen(deps, run2) {
           )
         );
       }
-      if (run2.resume) {
+      if (run2.resume && relaunch !== void 0) {
+        const inFlight = run2.resume.settlements.length;
+        const answered = relaySettled.size - stillRunning;
+        const lost = inFlight - relaySettled.size;
+        const settledHow = inFlight === 0 ? "nothing was in flight" : `${inFlight} call(s) were in flight: ` + [
+          ...answered > 0 ? [`${answered} answered on the relay`] : [],
+          ...stillRunning > 0 ? [`${stillRunning} still running there`] : [],
+          ...lost > 0 ? [`${lost} lost with the container, each answered with a restart note`] : []
+        ].join(", ");
+        note(
+          "resumed",
+          `relaunched after the container was replaced (${relaunch.from ?? "unknown"} \u2192 ${relaunch.to ?? "unknown"}): the row's pi (pid ${recorded?.pid ?? "unknown"}) went with the old container and was neither probed nor ended here; pi restarted in the container the run holds on the mirrored transcript \u2014 ${settledHow}; ${Math.round(remainingMs / 6e4)} min of budget left`
+        );
+      } else if (run2.resume) {
         const lost = run2.resume.settlements.length;
         const how = elsewhere !== void 0 ? `${elsewhere}, and pi restarted` : ended !== void 0 && recorded !== void 0 ? `the row ${ended} (pid ${recorded.pid}), so it was ended and pi restarted` : "pi restarted";
         note(
@@ -35066,7 +35897,8 @@ ${stagedLine}` : prompt;
       return new PiContainerReplacedError(
         said2.message,
         facts2?.container,
-        await container.identity().catch(() => void 0)
+        await container.identity().catch(() => void 0),
+        recordNow()
       );
     };
     check();
@@ -35336,6 +36168,7 @@ var init_harness = __esm({
     init_mirror();
     init_process();
     init_protocol();
+    init_relay();
     init_transport();
     FINALE_TIMEOUT_MS = 3 * 6e4;
     CALL_SEEN_WAIT_MS = 3e3;
@@ -35355,21 +36188,17 @@ var init_harness = __esm({
         this.name = "GateBypassed";
       }
     };
-    PiContainerReplacedError = class extends HarnessInterruptedError {
-      constructor(said2, was, now) {
+    PiContainerReplacedError = class extends HarnessContainerReplacedError {
+      constructor(said2, was, now, record2) {
         super(
-          `the container running pi was replaced (${was ?? "unknown"} \u2192 ${now ?? "unknown"}; the executor said: ${redactAndCap(said2.replace(/\s+/g, " ").trim(), 240)}); the run restarts from its request`,
-          "container replaced under the run; restarting from the request",
-          "container_replaced"
+          `the container running pi was replaced (${was ?? "unknown"} \u2192 ${now ?? "unknown"}; the executor said: ${redactAndCap(said2.replace(/\s+/g, " ").trim(), 240)})`,
+          said2,
+          was,
+          now,
+          record2
         );
-        this.said = said2;
-        this.was = was;
-        this.now = now;
         this.name = "PiContainerReplacedError";
       }
-      said;
-      was;
-      now;
     };
     POLICY_REFUSAL_REPLY = "the model refused this request under its usage policy \u2014 rephrase it and the thread continues";
     ModelPolicyRefusedError = class extends Error {
@@ -35834,7 +36663,8 @@ async function runCodingPrPostStep(input) {
   const base = prDescription ? await resolveBaseRefLazy(candidates, repo, input.fetchRepoInfo) : resolveBaseRef(candidates, void 0);
   const pushedBranch = branch2 !== void 0 && branch2 !== base && pushed;
   const ownPr = target.ownPr;
-  const pushedPastOwnPr = ownPr !== void 0 && pushed && headSha !== void 0 && !sameCommit(headSha, ownPr.headSha) ? headSha : void 0;
+  const onOwnPrBranch = ownPr?.headBranch !== void 0 && branch2 === ownPr.headBranch;
+  const pushedPastOwnPr = ownPr !== void 0 && onOwnPrBranch && pushed && headSha !== void 0 && !sameCommit(headSha, ownPr.headSha) ? headSha : void 0;
   if (prDescription && ownPr !== void 0 && ownPr.state !== "open" && pushedPastOwnPr !== void 0 && branch2 !== void 0) {
     const url = `https://github.com/${repo}/pull/${ownPr.number}`;
     console.log(
@@ -35848,7 +36678,7 @@ async function runCodingPrPostStep(input) {
     });
     return `\u26A0\uFE0F A PR description was submitted and \`${branch2}\`${branchNote} was pushed to \`${pushedPastOwnPr.slice(0, 7)}\`, but this thread's pull request ${url} is ${ownPr.state} and that branch is its head \u2014 the new commits need a new pull request, so nothing was edited: compare & open manually: ${compareUrl}`;
   }
-  if (prDescription && ownPr !== void 0 && (branch2 === base || ownPr.state !== "open")) {
+  if (prDescription && ownPr !== void 0 && (branch2 === base || ownPr.state !== "open" && onOwnPrBranch)) {
     const { number, headSha: prHead2, state } = ownPr;
     const url = `https://github.com/${repo}/pull/${number}`;
     const standing = state === "open" ? "" : ` (${state})`;
@@ -36199,7 +37029,6 @@ async function runLoop(deps, ctx) {
     mcpForRun,
     run: run2,
     registry,
-    round: round2,
     admitted,
     ledgerRun,
     resume,
@@ -36226,7 +37055,9 @@ async function runLoop(deps, ctx) {
     seed
   } = ctx;
   const agent = budgetedAgent(ctx.agent, profile);
-  const { executor, binding } = round2.selection;
+  const { round: round2 } = ctx;
+  let { executor } = round2.selection;
+  const { binding } = round2.selection;
   const coordinatorBase = (async () => {
     if (coordinator === void 0) return void 0;
     if (coordinator.base !== void 0 || repoCtx.baseRef !== void 0) return coordinator.base;
@@ -36420,6 +37251,12 @@ async function runLoop(deps, ctx) {
   const postedBefore = resume ? reviewPostedBefore(resume.events) : void 0;
   if (postedBefore) reviewHead = postedBefore.head;
   const facts2 = resume ? harnessFactsOf(resume.row.state.harness) : void 0;
+  let lastFacts = facts2;
+  const saveFacts = (h) => {
+    lastFacts = h;
+    ledgerRun?.setState({ harness: h });
+  };
+  let workspaceBinding = workspaceBindingFor(round2.selection, profile.machine);
   try {
     if (finish2) {
       onEvent({
@@ -36490,11 +37327,21 @@ async function runLoop(deps, ctx) {
           )
         )
       ];
-      harnessSession = await openThroughSeam(
+      let bearer = ctx.bearer;
+      let harnessResume = reentry ? {
+        messages: reentry.messages,
+        compactions: reentry.compactions,
+        settlements: reentry.settlements,
+        remainingMs: reentry.remainingMs,
+        turn: reentry.turn,
+        inboxConsumedSeq: reentry.inboxConsumedSeq,
+        ...facts2 ? { facts: facts2 } : {}
+      } : void 0;
+      const openRun = () => openThroughSeam(
         harnessDeps.harness,
         {
           container: harnessDeps.containerFor?.(executor, profile.machine) ?? harnessContainerFor(executor, profile.machine),
-          bearer: ctx.bearer,
+          bearer,
           harnessUrl,
           registry: harnessDeps.registry,
           ...deps.runBearers ? { bearers: deps.runBearers } : {},
@@ -36525,24 +37372,55 @@ async function runLoop(deps, ctx) {
           ...stageFollowUps ? { stageFollowUps } : {},
           onEvent,
           onProgress,
-          ...ledgerRun ? {
-            onStep: ledgerRun.step.bind(ledgerRun),
-            logIndexOf: ledgerRun.logIndexOf.bind(ledgerRun),
-            saveFacts: (h) => ledgerRun.setState({ harness: h })
-          } : {},
-          ...reentry ? {
-            resume: {
-              messages: reentry.messages,
-              compactions: reentry.compactions,
-              settlements: reentry.settlements,
-              remainingMs: reentry.remainingMs,
-              turn: reentry.turn,
-              inboxConsumedSeq: reentry.inboxConsumedSeq,
-              ...facts2 ? { facts: facts2 } : {}
-            }
-          } : {}
+          ...ledgerRun ? { onStep: ledgerRun.step.bind(ledgerRun), logIndexOf: ledgerRun.logIndexOf.bind(ledgerRun) } : {},
+          saveFacts,
+          ...harnessResume ? { resume: harnessResume } : {}
         }
       );
+      for (; ; ) {
+        try {
+          harnessSession = await openRun();
+          break;
+        } catch (err2) {
+          if (!(err2 instanceof HarnessContainerReplacedError)) throw err2;
+          let decision;
+          try {
+            decision = await prepareRelaunch(deps, {
+              runId: run2.id,
+              threadKey: msg.threadKey,
+              agent: ctx.agent,
+              profile,
+              repoCtx,
+              root,
+              clock: clock4,
+              harness: harnessDeps.harness,
+              replaced: err2,
+              facts: lastFacts,
+              binding: workspaceBinding,
+              saveFacts
+            });
+          } catch (failed) {
+            harnessDeps.registry.forget(run2.id);
+            throw failed;
+          }
+          if (decision.kind === "refused") {
+            harnessDeps.registry.forget(run2.id);
+            onEvent({ type: "run_note", kind: "sandbox_restarted", summary: decision.interruption.message });
+            throw decision.interruption;
+          }
+          if (decision.round !== void 0) {
+            executor = decision.round.selection.executor;
+            toolContext.executor = executor;
+            const rebound = workspaceBindingFor(decision.round.selection, profile.machine);
+            if (rebound !== void 0) {
+              workspaceBinding = rebound;
+              ledgerRun?.setState({ binding: rebound });
+            }
+          }
+          if (decision.bearer !== void 0) bearer = decision.bearer;
+          harnessResume = decision.resume;
+        }
+      }
       answer = harnessSession.answer;
     }
     if (isPrReview && repoCtx.repo && repoCtx.pr !== void 0 && run2.control.requested !== "hard" && postedBefore === void 0) {
@@ -36851,7 +37729,9 @@ var init_runLoop = __esm({
     init_provider();
     init_toolsets();
     init_contract4();
+    init_relaunch();
     init_botHostContainer();
+    init_factory();
     init_container();
     init_harness();
     init_windDown();
@@ -37004,7 +37884,7 @@ async function shipPreflight(input) {
       `\u{1F6AB} Nothing to ship: give ship a task (\`agent:ship in ${repo}: <task>\`), or name an open ship PR by URL to resume its review loop.`
     );
   }
-  const ref = repoCtx.ref && !repoCtx.refFromPr && repoCtx.ref.toLowerCase() !== repo.toLowerCase() ? repoCtx.ref : void 0;
+  const ref = repoCtx.ref && !repoCtx.refFromPr && !isUnitBranch(repoCtx.ref) && repoCtx.ref.toLowerCase() !== repo.toLowerCase() ? repoCtx.ref : void 0;
   return {
     ok: true,
     entry: { repo, base: resolveBaseRef([ref], info?.defaultBranch) }
@@ -37137,7 +38017,7 @@ function planWhere(p, units, mergedBefore) {
 async function handOffToCoordinator(deps, input) {
   const log = deps.log ?? console.log;
   const planned = await plan(deps, input);
-  if (!planned.ok) return refused3(planned.reply);
+  if (!planned.ok) return refused4(planned.reply);
   const p = planned.planned;
   const planOf = () => ({
     id: p.planId,
@@ -37167,15 +38047,15 @@ async function handOffToCoordinator(deps, input) {
   const status3 = await deps.status(latest.id);
   const where = `plan \`${p.planId}\``;
   if (status3.kind === "unanswered")
-    return refused3(
+    return refused4(
       `\u26A0\uFE0F The plan runner could not tell whether \`${latest.id}\` still runs: ${status3.reason}. Nothing ran; re-issue the request to try again.`
     );
   if (status3.kind === "status" && RUNNING.has(status3.status))
-    return refused3(
+    return refused4(
       `\u{1F6AB} A runner for ${where} is still running (\`${latest.id}\`, status: ${status3.status}): wait for it to end \u2014 or terminate it in the Workflows dashboard \u2014 before re-issuing.`
     );
   if (status3.kind === "status" && !ENDED.has(status3.status))
-    return refused3(
+    return refused4(
       `\u{1F6AB} A runner for ${where} (\`${latest.id}\`) is in a state the bot does not read as ended (${status3.status}) \u2014 a person decides.`
     );
   const merged = /* @__PURE__ */ new Set();
@@ -37187,7 +38067,7 @@ async function handOffToCoordinator(deps, input) {
     }
   const remaining = p.selected.filter((u) => !merged.has(u));
   if (remaining.length === 0)
-    return refused3(
+    return refused4(
       `\u{1F6AB} Every unit of ${where} this request names is merged already (${p.selected.join(", ")}) \u2014 nothing left to run.`
     );
   const mergedBefore = p.selected.filter((u) => merged.has(u));
@@ -37222,16 +38102,16 @@ async function start(deps, input, instance, units, where, write) {
   const put = write === "replace" ? await deps.instances.replace(instance) : await deps.instances.put(instance);
   if (!put.ok) {
     if (put.reason === "unavailable")
-      return refused3(
+      return refused4(
         "\u26A0\uFE0F The plan runner needs run history on the state Worker (`runHistory.worker`): the instance record could not be written, so nothing ran."
       );
-    return refused3(
+    return refused4(
       `\u{1F6AB} A runner for \`${instance.id}\` was just recorded by another request \u2014 re-issue in a minute if it did not start.`
     );
   }
   const rows = await deps.instances.putUnits(units);
   if (!rows.ok)
-    return refused3(
+    return refused4(
       "\u26A0\uFE0F The plan runner needs run history on the state Worker: the unit rows could not be written, so nothing ran."
     );
   let answer;
@@ -37248,26 +38128,26 @@ async function start(deps, input, instance, units, where, write) {
     }
     case "duplicate": {
       const status3 = answer.status !== void 0 ? `, status: ${answer.status}` : "";
-      return refused3(
+      return refused4(
         `\u{1F6AB} A Workflow instance \`${instance.id}\` already exists on the platform${status3} but the state Worker knew nothing of it \u2014 a person decides; re-issuing will not resume it.`
       );
     }
     case "failed":
     case "unanswered":
       log(`[ship] ${input.msg.threadKey}: the plan runner ${instance.id} could not be started \u2014 ${answer.reason}`);
-      return refused3(
+      return refused4(
         `\u26A0\uFE0F The plan runner could not be started: ${answer.reason}. Nothing ran; re-issue the request to try again.`
       );
   }
 }
-var refused3, describe6, RUNNING, ENDED;
+var refused4, describe6, RUNNING, ENDED;
 var init_handOff = __esm({
   "../../src/core/coordinator/handOff.ts"() {
     "use strict";
     init_contract();
     init_preflight();
     init_coordinator();
-    refused3 = (reply) => ({ status: "aborted", reply });
+    refused4 = (reply) => ({ status: "aborted", reply });
     describe6 = (err2) => err2 instanceof Error ? err2.message : String(err2);
     RUNNING = /* @__PURE__ */ new Set(["queued", "running", "paused", "waiting", "waitingForPause"]);
     ENDED = /* @__PURE__ */ new Set(["complete", "errored", "terminated"]);
@@ -37867,12 +38747,12 @@ function continuable(run2) {
   return run2.finished && run2.session !== void 0 && run2.agent !== void 0;
 }
 function stickyAgentOf(runs) {
-  const newest = runs[0];
+  const newest = runs.find(addressed);
   if (newest === void 0 || !continuable(newest)) return void 0;
   return newest.agent;
 }
 function threadRouteOf(runs, agent) {
-  const newest = runs[0];
+  const newest = runs.find(addressed);
   if (newest === void 0 || !continuable(newest) || newest.agent !== agent || newest.route === void 0)
     return void 0;
   const { preset, reason: reason2, model } = newest.route;
@@ -37896,11 +38776,12 @@ function threadPrOf(runs) {
   if (run2 === void 0) return void 0;
   return { repo: run2.repo, number: run2.pr.number, at: run2.finishedAt ?? run2.startedAt };
 }
-var THREAD_READ_LIMIT;
+var THREAD_READ_LIMIT, addressed;
 var init_thread = __esm({
   "../../src/core/dispatch/thread.ts"() {
     "use strict";
     THREAD_READ_LIMIT = 8;
+    addressed = (run2) => run2.parentInstanceId === void 0;
   }
 });
 
@@ -39988,391 +40869,6 @@ var init_piHarness = __esm({
   }
 });
 
-// ../../src/execution/tracingExecutor.ts
-var TracingExecutor;
-var init_tracingExecutor = __esm({
-  "../../src/execution/tracingExecutor.ts"() {
-    "use strict";
-    TracingExecutor = class {
-      constructor(inner, span, backend) {
-        this.inner = inner;
-        this.span = span;
-        this.backend = backend;
-        const innerRelease = inner.release?.bind(inner);
-        if (innerRelease) this.release = (mode) => this.timed("exec.release", (s) => innerRelease(mode, { span: s }));
-        const innerMoveTo = inner.moveTo?.bind(inner);
-        if (innerMoveTo) this.moveTo = (sha) => this.timed("exec.move_to", (s) => innerMoveTo(sha, { span: s }));
-        const innerReadBytes = inner.readBytes?.bind(inner);
-        if (innerReadBytes)
-          this.readBytes = (path) => this.timed("exec.read_bytes", (s) => innerReadBytes(path, { span: s }));
-      }
-      inner;
-      span;
-      backend;
-      release;
-      moveTo;
-      readBytes;
-      /** Each op under its own `exec.*` span, handed to the inner executor as
-       *  `opts.span` so its HTTP calls become `http.client` children (item 21). */
-      timed(name, fn, extra = {}) {
-        return this.span.span(name, (s) => fn(s), {
-          attrs: {
-            ...this.backend !== void 0 ? { backend: this.backend } : {},
-            ...extra.timeoutMs !== void 0 ? { timeoutMs: extra.timeoutMs } : {}
-          }
-        });
-      }
-      exec(command2, opts) {
-        return this.timed("exec.exec", (s) => this.inner.exec(command2, { ...opts, span: s }), {
-          timeoutMs: opts?.timeoutMs
-        });
-      }
-      readFile(path) {
-        return this.timed("exec.read_file", (s) => this.inner.readFile(path, { span: s }));
-      }
-      writeFile(path, content) {
-        return this.timed("exec.write_file", (s) => this.inner.writeFile(path, content, { span: s }));
-      }
-    };
-  }
-});
-
-// ../../src/core/chatMessage.ts
-function capToolResultContent(content, cap = MAX_TOOL_RESULT_CHARS) {
-  const capText = (text) => text.length > cap ? `${text.slice(0, cap)}
-\u2026[tool result truncated: ${text.length - cap} of ${text.length} characters cut \u2014 ask for a narrower slice]` : text;
-  if (typeof content === "string") return capText(content);
-  return content.map((p) => p.type === "text" ? { ...p, text: capText(p.text) } : p);
-}
-var MAX_TOOL_RESULT_CHARS;
-var init_chatMessage = __esm({
-  "../../src/core/chatMessage.ts"() {
-    "use strict";
-    MAX_TOOL_RESULT_CHARS = 12e4;
-  }
-});
-
-// ../../src/core/harness/pi/toolRules.ts
-import { isAbsolute as isAbsolute5, relative, resolve as resolve10 } from "node:path";
-function reachFor(identity2) {
-  if (identity2 === "write") return CODING_REACH;
-  if (identity2 === "read") return READ_REACH;
-  return NONE_REACH;
-}
-function judgeToolCall(tool, input, ctx) {
-  const bundle = PI_TOOL_BUNDLES[tool];
-  if (bundle === void 0) return outside(`${tool} is not in any bundle the ${ctx.identity} identity reaches`);
-  if (!reachFor(ctx.identity).has(bundle)) {
-    return outside(
-      ctx.identity === "none" ? `${tool} is the \`${bundle}\` bundle: a run without a workspace (identity none) has none of pi's own tools` : `${tool} is the \`${bundle}\` bundle, outside the ${ctx.identity} identity's reach`
-    );
-  }
-  const args = isRecord6(input) ? input : {};
-  if (tool === "bash") return judgeBash(args.command, ctx);
-  if (bundle === "files" || bundle === "write-files") return judgePath(args.path, ctx);
-  return allowed;
-}
-function judgeBash(command2, ctx) {
-  if (typeof command2 !== "string") return refused4("malformed \u2014 bash without a string command");
-  if (CREDENTIAL_FILE.test(command2)) return refused4("credential \u2014 reads the executor's credential store");
-  if (ENV_DUMP.test(command2)) return refused4("credential \u2014 dumps the process environment");
-  if (CREDENTIAL_VAR.test(command2)) return refused4("credential \u2014 expands a credential variable");
-  if (MERGE_OR_APPROVE.test(command2)) {
-    return refused4("merge/approve \u2014 a coding run never merges or approves a pull request");
-  }
-  if (ctx.identity !== "write") {
-    if (ANY_PUSH.test(command2)) return refused4("read-only \u2014 a read-identity run never pushes");
-    if (GH_WRITE_VERB.test(command2) || GH_API_WRITE.test(command2) || CURL_GITHUB_WRITE.test(command2)) {
-      return refused4("read-only \u2014 a read-identity run never writes to GitHub");
-    }
-    return allowed;
-  }
-  for (const match of command2.matchAll(GIT_PUSH)) {
-    const verdict = judgePush(match[1], ctx);
-    if (verdict.verdict !== "allowed") return verdict;
-  }
-  return allowed;
-}
-function judgePush(tail, ctx) {
-  const words = tail.split(/\s+/).filter((w) => w.length > 0 && !w.startsWith("-"));
-  const [remote, refspec] = words;
-  if (remote !== void 0 && remote !== "origin") {
-    return refused4(`repo:use \u2014 push to remote \`${remote}\`, not the run's repository (origin)`);
-  }
-  if (refspec === void 0) return allowed;
-  const destination = refspec.replace(/^\+/, "").split(":").pop() ?? refspec;
-  if (ctx.branch !== void 0) {
-    const branch3 = destination === "HEAD" ? ctx.branch : destination.replace(/^refs\/heads\//, "");
-    if (branch3 !== ctx.branch) return refused4(`repo:use \u2014 push to \`${branch3}\`, not the run's branch ${ctx.branch}`);
-    return allowed;
-  }
-  const branch2 = destination.replace(/^refs\/heads\//, "");
-  if (branch2 !== "HEAD" && (ctx.protectedBranches ?? []).includes(branch2)) {
-    return refused4(
-      `repo:use \u2014 push to \`${branch2}\`, the branch this run's pull request targets; push your own branch`
-    );
-  }
-  return allowed;
-}
-function judgePath(path, ctx) {
-  if (path === void 0) return allowed;
-  if (typeof path !== "string") return refused4("malformed \u2014 a path tool without a string path");
-  if (CREDENTIAL_FILE.test(path)) return refused4("credential \u2014 reads the executor's credential store");
-  const rel = relative(ctx.checkout, resolve10(ctx.checkout, path));
-  if (rel.startsWith("..") || isAbsolute5(rel)) return refused4(`path \u2014 \`${path}\` resolves outside the checkout`);
-  return allowed;
-}
-var PI_TOOL_BUNDLES, CODING_REACH, READ_REACH, NONE_REACH, allowed, refused4, outside, isRecord6, CREDENTIAL_FILE, ENV_DUMP, CREDENTIAL_VAR, MERGE_OR_APPROVE, GIT_THEN_PUSH, GIT_PUSH, ANY_PUSH, GH_WRITE_VERB, WRITE_METHOD, GH_API_WRITE, CURL_GITHUB_WRITE;
-var init_toolRules = __esm({
-  "../../src/core/harness/pi/toolRules.ts"() {
-    "use strict";
-    PI_TOOL_BUNDLES = {
-      bash: "shell",
-      read: "files",
-      grep: "files",
-      find: "files",
-      ls: "files",
-      write: "write-files",
-      edit: "write-files",
-      submit_pr_description: "pr",
-      submit_verdict: "verdict"
-    };
-    CODING_REACH = /* @__PURE__ */ new Set([
-      "shell",
-      "files",
-      "write-files",
-      "web",
-      "github-read",
-      "github-write",
-      "pr"
-    ]);
-    READ_REACH = /* @__PURE__ */ new Set(["shell", "files", "web", "search", "github-read", "verdict"]);
-    NONE_REACH = /* @__PURE__ */ new Set();
-    allowed = { verdict: "allowed" };
-    refused4 = (reason2) => ({ verdict: "refused", reason: reason2 });
-    outside = (reason2) => ({ verdict: "outside-profile", reason: reason2 });
-    isRecord6 = (v) => typeof v === "object" && v !== null;
-    CREDENTIAL_FILE = /(^|[\s/'"`])(\.git\/)?(github-credentials|\.git-credentials)($|[\s'"`|;&])/;
-    ENV_DUMP = /(^|[;&|(]\s*)((printenv|env)(\s+-[A-Za-z0-9-]+)*|export\s+-p|declare\s+-[a-zA-Z]*[px][a-zA-Z]*|set)\s*($|[|;&>)])|\/proc\/(self|\d+)\/environ|process\.env(?![.[\w])/;
-    CREDENTIAL_VAR = /\$\{?[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b|printenv\s+[A-Z][A-Z0-9_]*(_API_KEY|_TOKEN|_SECRET|_BEARER|_PASSWORD)\b/;
-    MERGE_OR_APPROVE = /\bgh\s+pr\s+(merge|review)\b|\/pulls\/\d+\/(merge|reviews)\b/;
-    GIT_THEN_PUSH = String.raw`\bgit(?:\s+(?:-C\s+\S+|--git-dir=\S+|--work-tree=\S+|-c\s+\S+|--no-pager))*\s+push\b`;
-    GIT_PUSH = new RegExp(`${GIT_THEN_PUSH}([^;&|]*)`, "g");
-    ANY_PUSH = new RegExp(GIT_THEN_PUSH);
-    GH_WRITE_VERB = /\bgh\s+(pr|issue)\s+(comment|create|edit|close|reopen|ready|lock|unlock|review|merge|delete|transfer|pin|unpin)\b/;
-    WRITE_METHOD = "(POST|post|PATCH|patch|PUT|put|DELETE|delete)";
-    GH_API_WRITE = new RegExp(
-      `\\bgh\\s+api\\b(?=[^;&|]*(?:\\s(?:-X|--method)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-f|-F|--field|--raw-field|--input)[\\s=]))`
-    );
-    CURL_GITHUB_WRITE = new RegExp(
-      `\\bcurl\\b(?=[^;&|]*api\\.github\\.com)(?=[^;&|]*(?:\\s(?:-X|--request)[\\s=]*${WRITE_METHOD}\\b|\\s(?:-d|--data(?:-\\w+)?|--json|-T|--upload-file)[\\s=]))`
-    );
-  }
-});
-
-// ../../src/core/harness/pi/relay.ts
-async function relayToolCall(harness, calls, ask, opts = {}) {
-  const answer = calls.join(ask.toolCallId, () => runRelayedTool(harness, ask, { signal: calls.signal }));
-  const window = new AbortController();
-  const sleep2 = opts.sleep ?? sleepUnlessAborted;
-  const progress = await Promise.race([
-    answer.then((a) => ({ done: true, answer: a })),
-    sleep2(opts.windowMs ?? RELAY_POLL_WINDOW_MS, window.signal).then(() => ({ done: false }))
-  ]);
-  window.abort();
-  return progress;
-}
-function relayedToolDefinitions(harness) {
-  return harness.tools.map(({ name, description, inputSchema }) => ({ name, description, inputSchema }));
-}
-function authorizeToolCall(harness, ask) {
-  harness.gateSaw(ask.toolCallId);
-  const blocked = harness.toolsBlocked();
-  const refuse3 = (reason2) => {
-    harness.emit({
-      type: "run_note",
-      kind: "tool_refused",
-      summary: redactAndCap(`${ask.tool} refused: ${reason2}`, 300)
-    });
-    return { allow: false, reason: reason2 };
-  };
-  if (blocked !== void 0) return refuse3(blocked);
-  if (harness.tools.some((t) => t.name === ask.tool)) return { allow: true };
-  const verdict = judgeToolCall(ask.tool, ask.input, harness.rules);
-  if (verdict.verdict === "allowed") return { allow: true };
-  return refuse3(verdict.reason);
-}
-async function runRelayedTool(harness, ask, opts = {}) {
-  const tool = harness.tools.find((t) => t.name === ask.tool);
-  if (!tool) return { content: [{ type: "text", text: `Unknown tool: ${ask.tool}` }], isError: true };
-  const span = harness.toolSpan(ask.toolCallId);
-  const base = harness.toolContext;
-  const readConversation = base.conversation;
-  const ctx = {
-    ...span ? {
-      ...base,
-      span,
-      executor: new TracingExecutor(base.executor, span, harness.backend),
-      publish: (e) => harness.emit(withSpanId(e, span.id)),
-      ...base.github?.api.withSpan ? { github: { ...base.github, api: base.github.api.withSpan(span) } } : {}
-    } : { ...base, publish: (e) => harness.emit(e) },
-    ...opts.signal && !base.signal ? { signal: opts.signal } : {},
-    ...readConversation && harness.callSeen ? { conversation: () => harness.callSeen(ask.toolCallId).then(() => readConversation()) } : {},
-    // After the spreads, so the call's own id can never be shadowed by one on the base context.
-    callId: ask.toolCallId
-  };
-  try {
-    const input = typeof ask.input === "object" && ask.input !== null ? ask.input : {};
-    const output = await tool.run(input, ctx);
-    return { content: piContentOf(capToolResultContent(output)), isError: false };
-  } catch (err2) {
-    return errorAnswerOf(err2);
-  }
-}
-function errorAnswerOf(err2) {
-  const message3 = err2 instanceof Error ? err2.message : String(err2);
-  return { content: piContentOf(capToolResultContent(`Error: ${message3}`)), isError: true };
-}
-function piContentOf(content) {
-  if (typeof content === "string") return [{ type: "text", text: content }];
-  return content.map(
-    (p) => p.type === "text" ? { type: "text", text: p.text } : p.type === "image" ? { type: "image", data: p.data, mimeType: p.mediaType } : { type: "text", text: `[document ${p.name ?? "document"} (${p.mediaType})]` }
-  );
-}
-function withSpanId(e, spanId) {
-  switch (e.type) {
-    case "tool_call":
-    case "tool_result":
-    case "run_note":
-    case "assistant":
-    case "skill_use":
-      return { ...e, spanId };
-    default:
-      return e;
-  }
-}
-var HarnessRegistry, RELAY_POLL_WINDOW_MS, RelayedCalls;
-var init_relay = __esm({
-  "../../src/core/harness/pi/relay.ts"() {
-    "use strict";
-    init_tracingExecutor();
-    init_chatMessage();
-    init_awaitChildren();
-    init_runEvents();
-    init_toolRules();
-    HarnessRegistry = class {
-      live = /* @__PURE__ */ new Map();
-      /** The run drives a pi from here, its relayed calls kept beside it; the
-       *  returned function forgets it and ends whatever call still runs. */
-      register(harness) {
-        return this.hold({ harness, calls: new RelayedCalls() });
-      }
-      /** A process relaunched under the same run — in a replacement container,
-       *  with a rotated bearer (harness-pi item 8) — takes the run's registration
-       *  over, and the run's relayed calls stay: a call in flight keeps running
-       *  under the same end signal, and an ask by its id through the new
-       *  registration joins it and reads its answer. The earlier registration's
-       *  forget is a no-op from here; the returned one forgets the run and ends
-       *  the calls. Refuses by name a run that is not registered. */
-      replace(harness) {
-        const previous = this.live.get(harness.runId);
-        if (!previous) throw new Error(`run ${harness.runId} is not registered on the relay: nothing to replace`);
-        return this.hold({ harness, calls: previous.calls });
-      }
-      hold(entry) {
-        this.live.set(entry.harness.runId, entry);
-        return () => {
-          if (this.live.get(entry.harness.runId) !== entry) return;
-          this.live.delete(entry.harness.runId);
-          entry.calls.end();
-        };
-      }
-      get(runId3) {
-        return this.live.get(runId3)?.harness;
-      }
-      /** The run's relayed calls, for as long as it is registered. */
-      calls(runId3) {
-        return this.live.get(runId3)?.calls;
-      }
-      size() {
-        return this.live.size;
-      }
-    };
-    RELAY_POLL_WINDOW_MS = 3e4;
-    RelayedCalls = class {
-      calls = /* @__PURE__ */ new Map();
-      /** The ids whose call is still running: joined by `join`, forgotten as each answers. */
-      running = /* @__PURE__ */ new Set();
-      ending = new AbortController();
-      get size() {
-        return this.calls.size;
-      }
-      /** Aborted when the run ends: the signal every call here runs under. */
-      get signal() {
-        return this.ending.signal;
-      }
-      /** The call's answer as a promise: started by `start` on the first ask, the same promise after. */
-      join(callId, start3) {
-        let answer = this.calls.get(callId);
-        if (!answer) {
-          answer = start3();
-          this.calls.set(callId, answer);
-          this.running.add(callId);
-          const done = () => void this.running.delete(callId);
-          answer.then(done, done);
-        }
-        return answer;
-      }
-      /** The ids of the calls still running, in the order they were started. */
-      inFlight() {
-        return [...this.running];
-      }
-      /** Every call still running, awaited together up to one window — the relay
-       *  window a request waits, by default — for a relaunch that rebuilds the
-       *  process's session (harness-pi item 8): a call that answers inside it is
-       *  `done` with its answer, the result the rebuilt session carries; one still
-       *  running after it is not, keeps running here for an ask by the same id,
-       *  and the rebuilt session carries the still-running note in its place
-       *  (`stillRunningNote`). A call whose `start` rejected is `done` with an
-       *  error answer, as `runRelayedTool` answers its own throws, so one
-       *  straggler's exception never loses the others' answers. Nothing is ended
-       *  or re-run. Answers at once with nothing in flight. */
-      async awaitInFlight(opts = {}) {
-        const ids = this.inFlight();
-        if (ids.length === 0) return [];
-        const window = new AbortController();
-        const sleep2 = opts.sleep ?? sleepUnlessAborted;
-        const closed = sleep2(opts.windowMs ?? RELAY_POLL_WINDOW_MS, window.signal).then(() => ({
-          done: false
-        }));
-        const progress = await Promise.all(
-          ids.map(async (callId) => {
-            const answered = this.calls.get(callId).then(
-              (answer) => ({ done: true, answer }),
-              (err2) => ({ done: true, answer: errorAnswerOf(err2) })
-            );
-            return { callId, ...await Promise.race([answered, closed]) };
-          })
-        );
-        window.abort();
-        return progress;
-      }
-      /** The call's answer is known before it is asked (harness-pi item 8): the
-       *  record's settlement for a call in flight when the previous generation
-       *  died, whose extension asks again with the same id. Every ask reads it and
-       *  the tool never runs; a call already joined keeps the answer it has. */
-      settle(callId, answer) {
-        if (!this.calls.has(callId)) this.calls.set(callId, Promise.resolve(answer));
-      }
-      end() {
-        this.ending.abort();
-        this.calls.clear();
-        this.running.clear();
-      }
-    };
-  }
-});
-
 // ../../src/core/runLedger/takeover.ts
 var LedgerTakeover;
 var init_takeover = __esm({
@@ -41479,7 +41975,8 @@ function buildMcp(config, secrets, opts = {}) {
     fetch: webFetch,
     publicBaseUrl: opts.publicBaseUrl,
     bearers: secrets,
-    resolveEmail: opts.resolveEmail
+    resolveEmail: opts.resolveEmail,
+    resolveName: opts.resolveName
   });
   return { source: service.source, service };
 }
@@ -42285,6 +42782,45 @@ var init_dedupe = __esm({
 });
 
 // ../../src/channels/slack/lookups.ts
+function resolvePersonByEmail(client, email, opts = {}) {
+  const key = email.trim().toLowerCase();
+  if (!key.includes("@") || typeof client.users.lookupByEmail !== "function") return Promise.resolve(void 0);
+  const now = opts.now ?? Date.now;
+  const cached = personByEmailCache.get(key);
+  if (cached && cached.expiresAt > now()) return Promise.resolve(cached.person);
+  const inFlight = personByEmailInFlight.get(key);
+  if (inFlight) return inFlight;
+  const lookup2 = (async () => {
+    let timer;
+    try {
+      const call2 = client.users.lookupByEmail({ email: key }).then(
+        (r) => r.user,
+        () => void 0
+      );
+      const timedOut = /* @__PURE__ */ Symbol("person lookup timed out");
+      const answer = await Promise.race([
+        call2,
+        new Promise((resolve12) => {
+          timer = setTimeout(() => resolve12(timedOut), opts.timeoutMs ?? PERSON_LINK_TIMEOUT_MS);
+        })
+      ]);
+      if (answer === timedOut) return void 0;
+      const u = answer;
+      const person = u?.id && !u.deleted && !u.is_bot && !u.is_app_user ? { id: `slack:${u.id}`, ...displayNameOf2(u) ? { name: displayNameOf2(u) } : {} } : void 0;
+      personByEmailCache.set(key, { person, expiresAt: now() + PERSON_LINK_TTL_MS });
+      if (personByEmailCache.size > NAME_CACHE_MAX) {
+        const oldest = personByEmailCache.keys().next().value;
+        if (oldest !== void 0) personByEmailCache.delete(oldest);
+      }
+      return person;
+    } finally {
+      if (timer) clearTimeout(timer);
+      personByEmailInFlight.delete(key);
+    }
+  })();
+  personByEmailInFlight.set(key, lookup2);
+  return lookup2;
+}
 function cachePut(cache2, key, value) {
   cache2.set(key, value);
   if (cache2.size > NAME_CACHE_MAX) {
@@ -42338,10 +42874,15 @@ async function resolveTeamUrl(client) {
   }
   return teamUrl;
 }
-var NAME_CACHE_MAX, channelNameCache, userNameCache, teamUrl;
+var PERSON_LINK_TTL_MS, PERSON_LINK_TIMEOUT_MS, personByEmailCache, personByEmailInFlight, displayNameOf2, NAME_CACHE_MAX, channelNameCache, userNameCache, teamUrl;
 var init_lookups = __esm({
   "../../src/channels/slack/lookups.ts"() {
     "use strict";
+    PERSON_LINK_TTL_MS = 10 * 6e4;
+    PERSON_LINK_TIMEOUT_MS = 1500;
+    personByEmailCache = /* @__PURE__ */ new Map();
+    personByEmailInFlight = /* @__PURE__ */ new Map();
+    displayNameOf2 = (u) => u?.profile?.display_name || u?.profile?.real_name || u?.real_name || u?.name || void 0;
     NAME_CACHE_MAX = 1e3;
     channelNameCache = /* @__PURE__ */ new Map();
     userNameCache = /* @__PURE__ */ new Map();
@@ -44000,8 +44541,8 @@ function parseIndexCursor(params) {
   if (!params.has("before") || !Number.isFinite(before) || before <= 0 || beforeId === "") return void 0;
   return { before, beforeId };
 }
-function olderRunsHref(cursor) {
-  return `/runs?all=1&before=${cursor.finishedAt}&beforeId=${encodeURIComponent(cursor.id)}`;
+function olderRunsHref(cursor, opts = {}) {
+  return `/runs?all=1${opts.mine ? "&mine=1" : ""}&before=${cursor.finishedAt}&beforeId=${encodeURIComponent(cursor.id)}`;
 }
 function readDecision(actor, view) {
   const admitted = authorize(actor, "runs:read", RUNS_GET);
@@ -44099,7 +44640,7 @@ function createLiveViewHandler(deps) {
       })
     );
   };
-  const mergedRows = async (live, visibleTo, cursor) => {
+  const mergedRows = async (live, visibleTo, cursor, view = {}) => {
     const tokens = new Map(live.map((s) => [s.id, s.token]));
     const { runs, nextBefore, storeUnavailable } = await service.listRuns({
       status: "all",
@@ -44111,7 +44652,7 @@ function createLiveViewHandler(deps) {
     return {
       rows,
       ...storeUnavailable ? { storeUnavailable: true } : {},
-      ...nextBefore ? { olderHref: olderRunsHref(nextBefore) } : {},
+      ...nextBefore ? { olderHref: olderRunsHref(nextBefore, view) } : {},
       ...cursor ? { olderThan: cursor.before } : {}
     };
   };
@@ -44128,7 +44669,9 @@ function createLiveViewHandler(deps) {
     }
     if (route3.kind === "index") {
       const all = url.searchParams.get("all") === "1";
-      const visibleTo = readableRuns(ctx.actor);
+      const mine = url.searchParams.get("mine") === "1";
+      const readable2 = readableRuns(ctx.actor);
+      const visibleTo = mine ? allOf([readable2, ownedBy(ctx.actor)]) : readable2;
       if (url.searchParams.get("stream") === "1") {
         serveIndexEvents(
           visibleIndexFeed((onEvent) => index.subscribeIndex(onEvent), visibleTo),
@@ -44144,6 +44687,8 @@ function createLiveViewHandler(deps) {
         const seed = {
           page: "runs",
           all,
+          mine,
+          ...ctx.actor.asUser ? { asUser: ctx.actor.asUser } : {},
           retentionDays: deps.retention ? deps.retention.retentionDays : null,
           now: now(),
           rows: [...page2.rows],
@@ -44161,7 +44706,7 @@ function createLiveViewHandler(deps) {
         );
         return true;
       }
-      run2(res, async () => render3(await mergedRows(live, visibleTo, parseIndexCursor(url.searchParams))));
+      run2(res, async () => render3(await mergedRows(live, visibleTo, parseIndexCursor(url.searchParams), { mine })));
       return true;
     }
     if (route3.kind === "scheduled") {
@@ -44945,15 +45490,28 @@ function createSettingsViewHandler(deps, shell) {
     action,
     kind === "org" ? { type: "config-scope", kind: "org" } : { type: "config-scope", kind: "channel", id: id ?? "" }
   ).allow;
+  const serversOf = (answer) => answer.ok ? answer.value.servers ?? [] : [];
   async function mcpsSeed(caller, channel) {
-    const listed = await deps.commands.invoke("mcp.list", channel ? { options: { channel } } : {}, caller);
     const write = {
       org: canWrite(caller, "mcp:write", "org"),
       channel: channel !== void 0 && canWrite(caller, "mcp:write", "channel", channel)
     };
+    const listed = await deps.commands.invoke(
+      "mcp.list",
+      write.org ? { options: { all: true } } : channel ? { options: { channel } } : {},
+      caller
+    );
     if (!listed.ok)
       return { ...channel ? { channel } : {}, servers: [], unavailable: failureText(listed), canWrite: write };
-    const servers = listed.value.servers ?? [];
+    if (write.org)
+      return { ...channel ? { channel } : {}, allTiers: true, servers: serversOf(listed), canWrite: write };
+    const servers = serversOf(listed);
+    const readable = await deps.commands.invoke("config.overrides", {}, caller);
+    const others = (readable.ok ? readable.value.channels ?? [] : []).filter((r) => r.channelId !== channel && r.settings.includes("mcpServers")).map((r) => r.channelId);
+    const tiers = await Promise.all(
+      others.map((id) => deps.commands.invoke("mcp.list", { options: { channel: id } }, caller))
+    );
+    for (const answer of tiers) for (const s of serversOf(answer)) if (s.scope === "channel") servers.push(s);
     return { ...channel ? { channel } : {}, servers, canWrite: write };
   }
   async function channelsSeed(caller, channel) {
@@ -44976,9 +45534,7 @@ function createSettingsViewHandler(deps, shell) {
       plain4(res, 405, "method not allowed", { allow: "GET" });
       return true;
     }
-    const caller = deps.callerFor(ctx.identity);
     const tab = route3.tab === "home" ? homeTab(deps.capabilities) : route3.tab;
-    const base = { page: "settings", tab, viewer: caller.id, vocabulary: deps.vocabulary };
     const failed = (err2) => {
       const reason2 = (err2 instanceof Error ? err2.message : String(err2)).slice(0, UPSTREAM_REASON_MAX4);
       if (res.headersSent) {
@@ -44993,20 +45549,27 @@ function createSettingsViewHandler(deps, shell) {
       res.end(shell("Settings", seed));
     };
     const channel = "channel" in route3 ? route3.channel : void 0;
-    if (tab === "installation") {
-      if (!authorize(caller.actor, "config:read", { type: "command", id: "config.show" }).allow) {
-        plain4(res, 403, "forbidden");
-        return true;
+    deps.callerFor(ctx.identity).then(async (caller) => {
+      const base = {
+        page: "settings",
+        tab,
+        viewer: caller.id,
+        ...caller.actor.asUser ? { asUser: caller.actor.asUser } : {},
+        vocabulary: deps.vocabulary
+      };
+      if (tab === "installation") {
+        if (!authorize(caller.actor, "config:read", { type: "command", id: "config.show" }).allow) {
+          plain4(res, 403, "forbidden");
+          return;
+        }
+        render3({ ...base, installation: deps.installation() });
+        return;
       }
-      render3({ ...base, installation: deps.installation() });
-      return true;
-    }
-    const build = tab === "mcps" ? mcpsSeed(caller, channel) : channelsSeed(caller, channel);
-    build.then(
-      (part) => render3(
+      const part = tab === "mcps" ? await mcpsSeed(caller, channel) : await channelsSeed(caller, channel);
+      render3(
         tab === "mcps" ? { ...base, mcps: part } : { ...base, channels: part }
-      )
-    ).catch(failed);
+      );
+    }).catch(failed);
     return true;
   };
 }
@@ -47459,7 +48022,18 @@ async function merge(body, deps, subject2) {
     return json(502, { ok: false, error: "github_unavailable", message: `${where} could not be read`, at });
   if (isReleasePullRequest(facts2))
     return refused6(`${where} is the release pull request \u2014 always a person's merge, never the runner's`);
-  if (facts2.state !== "open") return refused6(`${where} is ${facts2.state}`);
+  if (facts2.state !== "open") {
+    if (facts2.mergedAt !== void 0 && facts2.mergeCommitSha !== void 0)
+      return json(200, {
+        ok: true,
+        outcome: "merged",
+        by: "other",
+        sha: facts2.mergeCommitSha,
+        mergedAt: facts2.mergedAt,
+        at
+      });
+    return refused6(`${where} is ${facts2.state}`);
+  }
   if (facts2.headRef !== row2.branch)
     return refused6(`${where} heads \`${facts2.headRef ?? "?"}\`, not the unit's branch \`${row2.branch}\``);
   if (facts2.headSha === void 0 || !sameCommit(facts2.headSha, headSha))
@@ -47857,8 +48431,24 @@ function accessActor(identity2, grantsFor) {
 function serviceTokenAllowed(pathname, identity2) {
   return !isServiceToken(identity2) || isCommandPath(pathname);
 }
-function callerFor(identity2, opts) {
-  return { kind: "access", id: callerIdFor(identity2), actor: accessActor(identity2, opts.grantsFor) };
+async function resolveAccessActor(identity2, opts) {
+  const actor = accessActor(identity2, opts.grantsFor);
+  if (isServiceToken(identity2) || !identity2.email || !opts.personByEmail) return actor;
+  const person = await opts.personByEmail(identity2.email).catch(() => void 0);
+  if (!person || !person.id.startsWith("slack:")) return actor;
+  return {
+    ...actor,
+    self: [actor.id, person.id],
+    asUser: { id: person.id, ...person.name ? { name: person.name } : {} }
+  };
+}
+async function callerFor(identity2, opts) {
+  return {
+    kind: "access",
+    id: callerIdFor(identity2),
+    actor: await resolveAccessActor(identity2, opts),
+    ...identity2.email && !isServiceToken(identity2) ? { email: identity2.email } : {}
+  };
 }
 function hostOf2(url) {
   if (!url) return void 0;
@@ -47925,7 +48515,7 @@ function createCommandHttpHandler(commands, opts) {
       refuse3(res, 403, "forbidden_origin", "cross-origin writes are refused");
       return;
     }
-    const caller = callerFor(identity2, opts);
+    const caller = await callerFor(identity2, opts);
     if (CommandRegistry.refuses(cmd, caller)) {
       refuse3(res, ERROR_STATUS.unauthorized, "unauthorized", `${caller.id} is not allowed to run ${cmd.id}`);
       return;
@@ -48013,9 +48603,14 @@ async function runBot() {
   const completions = new PiAiProviders(config.config.providers);
   const skills = new BundledSkillStore(DEFAULT_SKILLS_DIR);
   let slackEmailLookup;
+  let slackNameLookup;
+  let slackPersonByEmail;
+  const personByEmail = (email) => slackPersonByEmail ? slackPersonByEmail(email) : Promise.resolve(void 0);
   const mcpWiring = buildMcp(config, processSecrets, {
     publicBaseUrl: process.env.PUBLIC_BASE_URL,
     resolveEmail: (userId) => slackEmailLookup ? slackEmailLookup(userId) : Promise.resolve(void 0),
+    // `addedBy` as a name on the MCP lists (record 0042): the cached lookup the runs index uses.
+    resolveName: (userId) => slackNameLookup ? slackNameLookup(userId) : Promise.resolve(void 0),
     warn: (m) => console.warn(`[mcp] ${m}`)
   });
   const mcp = mcpWiring.source ?? new NullMcpToolSource();
@@ -48211,6 +48806,8 @@ async function runBot() {
   const conversationReader = new SlackConversationReader(app.client);
   deps.conversationReaders = [conversationReader];
   slackEmailLookup = (userId) => userId.startsWith("slack:") ? resolveUserEmail(app.client, userId.slice("slack:".length)) : Promise.resolve(void 0);
+  slackNameLookup = (userId) => userId.startsWith("slack:") ? resolveUserName(app.client, userId.slice("slack:".length)) : Promise.resolve(void 0);
+  slackPersonByEmail = (email) => resolvePersonByEmail(app.client, email);
   const pendingHistoryWrites = () => runHistoryWriter.pending();
   const inFlight = () => activeRunCount() + pendingReflectionCount() + pendingHistoryWrites();
   let draining = false;
@@ -48287,7 +48884,7 @@ async function runBot() {
     const settingsView = createSettingsViewHandler(
       {
         commands,
-        callerFor: (identity2) => callerFor(identity2, { grantsFor: (id) => config.grantsFor(id) }),
+        callerFor: (identity2) => callerFor(identity2, { grantsFor: (id) => config.grantsFor(id), personByEmail }),
         installation: () => installationSettings(config.config, capabilities),
         vocabulary: {
           agents: Object.keys(AGENTS),
@@ -48338,6 +48935,7 @@ async function runBot() {
     const accessState = `dashboard auth: ${dashboardAuth.describe()}`;
     const commandHttp = createCommandHttpHandler(commands, {
       grantsFor: (id) => config.grantsFor(id),
+      personByEmail,
       publicBaseUrl
     });
     const commandHttpState = `GET|POST /api/<group>.<verb> (${commands.list().length} commands)`;
@@ -48401,7 +48999,7 @@ async function runBot() {
       }
       if (webAssets.serve(req, res)) return;
       if (isCommandPath(path) || isConnectPath(path) || path === "/runs" || path.startsWith("/runs/") || path === "/residents" || path.startsWith("/residents/") || path === "/costs" || path === "/costs.json" || path.startsWith("/costs/") || path === "/delivery" || path === "/delivery.json" || path.startsWith("/delivery/") || path === "/settings" || path.startsWith("/settings/")) {
-        dashboardAuth.verify(req).then((gate) => {
+        dashboardAuth.verify(req).then(async (gate) => {
           if (!gate.ok) {
             res.writeHead(gate.status, { "content-type": "text/plain; charset=utf-8" });
             res.end(gate.body);
@@ -48417,7 +49015,10 @@ async function runBot() {
             return;
           }
           if (isCommandPath(path)) return commandHttp(req, res, gate.identity);
-          const actor = accessActor(gate.identity, (id) => config.grantsFor(id));
+          const actor = await resolveAccessActor(gate.identity, {
+            grantsFor: (id) => config.grantsFor(id),
+            personByEmail
+          });
           if (liveView2(req, res, { actor })) return;
           if (mcpConnectView(req, res, gate.identity)) return;
           if (residentsView(req, res, { actor })) return;