@drisp/cli 0.5.23 → 0.5.26

package/dist/{chunk-EC67PEFT.js → chunk-YZ7RCBKO.js}

@@ -12,29 +12,33 @@ import {
   isToolEvent,
   isValidHookEventEnvelope,
   resolveHookSocketPath
-} from "./chunk-BTKQ67RE.js";
+} from "./chunk-QYB6N2OT.js";
 import {
   TransportUnreachableError,
   createUdsClientTransport,
+  createWsClientTransport,
   generateChannelRequestId,
+  openVersionedDb,
   readDashboardClientConfig,
   refreshDashboardAccessToken,
   resolveGatewayPaths,
-  traceGatewayFrame,
   trackGatewayTransportReconnect,
-  writeGatewayTrace
-} from "./chunk-BTY7MYYT.js";
+  writeGatewayTrace,
+  wsClientOptionsForEndpoint
+} from "./chunk-3U37HT4T.js";
 import {
   compileWorkflowPlan,
   createWorkflowRunner,
   installWorkflowFromSource,
+  isMarketplaceRef,
   readConfig,
   readGlobalConfig,
   resolveActiveWorkflow,
+  resolveMarketplacePlugin,
   resolveWorkflow,
   resolveWorkflowInstall,
   resolveWorkflowPlugins
-} from "./chunk-JHSADKDJ.js";
+} from "./chunk-73V7GXV6.js";
 
 // src/infra/daemon/stateDir.ts
 import fs from "fs";
@@ -237,6 +241,16 @@ var RULES = {
     defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
     canBlock: false
   },
+  // Observation-only: the batch fires after every call in it has already
+  // resolved, so nothing downstream produces a decision or block for it. The
+  // claim is not cosmetic — hook dispatch keeps every decision-capable event
+  // on Claude's critical path, so a false `canBlock` would make every
+  // parallel tool batch wait on the forwarder for a reply never sent.
+  "tool.batch": {
+    expectsDecision: false,
+    defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
+    canBlock: false
+  },
   "tool.delta": {
     expectsDecision: false,
     defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
@@ -287,6 +301,16 @@ var RULES = {
     defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
     canBlock: true
   },
+  // Observation-only: nothing in the pipeline produces a decision or a block
+  // for an expansion, so it must not claim `canBlock`. The claim is not
+  // cosmetic — hook dispatch keeps every decision-capable event on Claude's
+  // critical path, so a false `canBlock` would make every slash command wait
+  // on the forwarder for a reply that is never sent.
+  "prompt.expansion": {
+    expectsDecision: false,
+    defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
+    canBlock: false
+  },
   "turn.start": {
     expectsDecision: false,
     defaultTimeoutMs: DEFAULT_TIMEOUT_MS,
@@ -419,6 +443,15 @@ function asRecord(value) {
   }
   return {};
 }
+function readToolBatchCalls(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => typeof entry === "object" && entry !== null).map((entry) => asRecord(entry)).map((call) => ({
+    tool_name: call["tool_name"],
+    tool_input: call["tool_input"],
+    tool_use_id: call["tool_use_id"],
+    tool_response: call["tool_response"]
+  }));
+}
 function translateClaudeEnvelope(envelope) {
   const payload = asRecord(envelope.payload);
   let toolName;
@@ -443,7 +476,9 @@ function translateClaudeEnvelope(envelope) {
         kind: "session.start",
         data: {
           source: payload["source"],
-          agent_type: payload["agent_type"]
+          model: payload["model"],
+          agent_type: payload["agent_type"],
+          session_title: payload["session_title"]
         }
       };
     case "SessionEnd":
@@ -457,6 +492,22 @@ function translateClaudeEnvelope(envelope) {
       return {
         kind: "user.prompt",
         data: {
+          prompt: payload["prompt"],
+          cwd: payload["cwd"],
+          permission_mode: payload["permission_mode"]
+        }
+      };
+    // Fires immediately before UserPromptSubmit, sharing its prompt_id,
+    // when a typed command expands into a prompt. Field names are pinned
+    // to the payload captured in the #116 spike.
+    case "UserPromptExpansion":
+      return {
+        kind: "prompt.expansion",
+        data: {
+          expansion_type: payload["expansion_type"],
+          command_name: payload["command_name"],
+          command_args: payload["command_args"],
+          command_source: payload["command_source"],
           prompt: payload["prompt"],
           permission_mode: payload["permission_mode"]
         }
@@ -484,6 +535,18 @@ function translateClaudeEnvelope(envelope) {
           tool_response: payload["tool_response"]
         }
       };
+    // Fires once per assistant tool batch, after every PostToolUse in it.
+    // Field names are pinned to the payload captured in the #116 spike;
+    // note that `tool_calls[].tool_response` is a STRING there, unlike
+    // PostToolUse's structured `tool_response`.
+    case "PostToolBatch":
+      return {
+        kind: "tool.batch",
+        data: {
+          tool_calls: readToolBatchCalls(payload["tool_calls"]),
+          permission_mode: payload["permission_mode"]
+        }
+      };
     case "PostToolUseFailure":
       return {
         kind: "tool.failure",
@@ -494,7 +557,10 @@ function translateClaudeEnvelope(envelope) {
           tool_input: payload["tool_input"] ?? {},
           tool_use_id: toolUseId,
           error: payload["error"],
-          is_interrupt: payload["is_interrupt"]
+          is_interrupt: payload["is_interrupt"],
+          exit_code: payload["exit_code"],
+          output: payload["output"],
+          error_code: payload["error_code"]
         }
       };
     case "PermissionRequest":
@@ -720,6 +786,12 @@ function buildClaudeDisplay(kind, data) {
 }
 
 // src/harnesses/claude/runtime/mapper.ts
+function readEffortLevel(payload) {
+  const effort = payload["effort"];
+  if (typeof effort !== "object" || effort === null) return void 0;
+  const level = effort["level"];
+  return typeof level === "string" ? level : void 0;
+}
 function mapEnvelopeToRuntimeEvent(envelope) {
   const payload = envelope.payload;
   const safePayload = typeof payload === "object" && payload !== null ? payload : { value: payload };
@@ -737,6 +809,13 @@ function mapEnvelopeToRuntimeEvent(envelope) {
     data: translated.data,
     hookName: envelope.hook_event_name,
     sessionId: envelope.session_id,
+    // prompt_id is a Claude common input field (v2.1.196+) on every hook
+    // payload; carried harness-neutrally as the Prompt identity (ADR 0009).
+    promptId: safePayloadRecord["prompt_id"],
+    // `effort` is likewise a common input field ({level}), observed on
+    // PostToolUse-class payloads and never on SessionStart, so it is read here
+    // rather than in any one hook's translation.
+    effortLevel: readEffortLevel(safePayloadRecord),
     toolName: translated.toolName,
     toolUseId: translated.toolUseId,
     agentId: translated.agentId,
@@ -854,9 +933,23 @@ function extractResultText(content) {
   }
   return parts.join("\n");
 }
-function createStreamJsonToolParser(onToolResult, onToolUse) {
+function extractAssistantText(content) {
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const block of content) {
+    if (typeof block === "object" && block !== null) {
+      const rec = block;
+      if (rec["type"] === "text" && typeof rec["text"] === "string") {
+        parts.push(rec["text"]);
+      }
+    }
+  }
+  return parts.join("");
+}
+function createStreamJsonToolParser(onToolResult, onToolUse, onMessageDelta, onMessageComplete) {
   let buffer = "";
   const toolNameById = /* @__PURE__ */ new Map();
+  let currentMessageId;
   function processLine(line) {
     const trimmed = line.trim();
     if (!trimmed) return;
@@ -867,6 +960,19 @@ function createStreamJsonToolParser(onToolResult, onToolUse) {
       return;
     }
     const record = parsed.type === "stream_event" && parsed.event ? parsed.event : parsed;
+    if (record.type === "message_start") {
+      const id = record.message?.["id"];
+      if (typeof id === "string") currentMessageId = id;
+    }
+    if (record.type === "content_block_delta") {
+      const delta = record["delta"];
+      if (typeof delta === "object" && delta !== null) {
+        const d = delta;
+        if (d["type"] === "text_delta" && typeof d["text"] === "string") {
+          onMessageDelta?.({ item_id: currentMessageId, delta: d["text"] });
+        }
+      }
+    }
     const contentBlocks = (record.type === "assistant" ? record.message?.content : record.type === "message" && record.role === "assistant" ? record.content : void 0) ?? [];
     for (const block of contentBlocks) {
       if (typeof block !== "object" || block === null) continue;
@@ -876,6 +982,14 @@ function createStreamJsonToolParser(onToolResult, onToolUse) {
         onToolUse?.({ tool_use_id: rec["id"], tool_name: rec["name"] });
       }
     }
+    if (record.type === "assistant" || record.type === "message" && record.role === "assistant") {
+      const messageText = extractAssistantText(contentBlocks);
+      if (messageText) {
+        const idValue = record.type === "assistant" ? record.message?.["id"] : record["id"];
+        const itemId = typeof idValue === "string" ? idValue : currentMessageId;
+        onMessageComplete?.({ item_id: itemId, message: messageText });
+      }
+    }
     if (record.type === "tool_result") {
       const toolUseId = typeof record.tool_use_id === "string" ? record.tool_use_id : void 0;
       const text = extractResultText(record.content);
@@ -974,6 +1088,38 @@ function createServer2(opts) {
     },
     () => {
       transportStats.streamToolUses++;
+    },
+    (messageDelta) => {
+      emit({
+        id: `stream-msg-delta-${messageDelta.item_id ?? "unknown"}-${Date.now()}`,
+        timestamp: Date.now(),
+        kind: "message.delta",
+        data: {
+          item_id: messageDelta.item_id,
+          delta: messageDelta.delta
+        },
+        hookName: "stream-json",
+        sessionId,
+        context: { cwd: projectDir, transcriptPath: "" },
+        interaction: getInteractionHints("message.delta"),
+        payload: null
+      });
+    },
+    (messageComplete) => {
+      emit({
+        id: `stream-msg-complete-${messageComplete.item_id ?? "unknown"}-${Date.now()}`,
+        timestamp: Date.now(),
+        kind: "message.complete",
+        data: {
+          item_id: messageComplete.item_id,
+          message: messageComplete.message
+        },
+        hookName: "stream-json",
+        sessionId,
+        context: { cwd: projectDir, transcriptPath: "" },
+        interaction: getInteractionHints("message.complete"),
+        payload: null
+      });
     }
   );
   function emit(event) {
@@ -1374,6 +1520,10 @@ var TOOL_HOOK_EVENTS = [
   "PreToolUse",
   "PostToolUse",
   "PostToolUseFailure",
+  // Batch-level, not per-tool, but Claude accepts (and requires) a matcher
+  // here: the #116 capture registered it with `matcher: '*'` and it fired in
+  // every run. Matcher-less registration is unverified.
+  "PostToolBatch",
   "PermissionRequest",
   "PermissionDenied",
   "Elicitation",
@@ -1388,6 +1538,7 @@ var NON_TOOL_HOOK_EVENTS = [
   "SubagentStart",
   "SubagentStop",
   "UserPromptSubmit",
+  "UserPromptExpansion",
   "PreCompact",
   "PostCompact",
   "Setup",
@@ -1400,6 +1551,27 @@ var NON_TOOL_HOOK_EVENTS = [
   "WorktreeCreate",
   "WorktreeRemove"
 ];
+var SYNC_HOOK_EVENTS = [
+  // Decision/blocking — kept in step with `runtime/interactionRules.ts`.
+  "PreToolUse",
+  "PermissionRequest",
+  "UserPromptSubmit",
+  "Stop",
+  "StopFailure",
+  "SubagentStop",
+  "Elicitation",
+  "ElicitationResult",
+  "TeammateIdle",
+  "TaskCreated",
+  "TaskCompleted",
+  "ConfigChange",
+  // Teardown — see (2) above.
+  "SessionEnd"
+];
+var SYNC_HOOK_EVENT_SET = new Set(SYNC_HOOK_EVENTS);
+function isAsyncHookEvent(event) {
+  return !SYNC_HOOK_EVENT_SET.has(event);
+}
 function quoteShellArg(value) {
   return `'${value.replace(/'/g, `'"'"'`)}'`;
 }
@@ -1447,23 +1619,20 @@ function generateHookSettings(tempDir, authOverlay) {
   if (process.env["ATHENA_DEBUG"]) {
     console.error("[athena-debug] Hook forwarder path:", hookForwarder.command);
   }
-  const hookCommand = {
-    type: "command",
-    command: hookForwarder.command
-  };
+  const hookCommandFor = (event) => isAsyncHookEvent(event) ? { type: "command", command: hookForwarder.command, async: true } : { type: "command", command: hookForwarder.command };
   const hooks = {};
   for (const event of TOOL_HOOK_EVENTS) {
     hooks[event] = [
       {
         matcher: "*",
-        hooks: [hookCommand]
+        hooks: [hookCommandFor(event)]
       }
     ];
   }
   for (const event of NON_TOOL_HOOK_EVENTS) {
     hooks[event] = [
       {
-        hooks: [hookCommand]
+        hooks: [hookCommandFor(event)]
       }
     ];
   }
@@ -2823,6 +2992,17 @@ import os8 from "os";
 import path10 from "path";
 
 // src/harnesses/claude/config/isolation.ts
+var CLAUDE_EFFORT_LEVELS = [
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+function normalizeEffort(value) {
+  if (value === void 0) return void 0;
+  return CLAUDE_EFFORT_LEVELS.includes(value) ? value : void 0;
+}
 var DISALLOWED_FIRST_PARTY_MCPS = [
   "mcp__claude_ai_Gmail__*",
   "mcp__claude_ai_Google_Calendar__*",
@@ -2933,6 +3113,7 @@ var FLAG_REGISTRY = [
   { field: "additionalDirectories", flag: "--add-dir", kind: "array" },
   // === Model & Agent ===
   { field: "model", flag: "--model", kind: "value" },
+  { field: "effort", flag: "--effort", kind: "value" },
   { field: "fallbackModel", flag: "--fallback-model", kind: "value" },
   { field: "agent", flag: "--agent", kind: "value" },
   { field: "agents", flag: "--agents", kind: "json" },
@@ -3374,7 +3555,7 @@ function createAssistantMessageAccumulator() {
   };
 }
 
-// src/harnesses/claude/process/useProcess.ts
+// src/harnesses/claude/session/turnConfig.ts
 function mergeIsolation(base, pluginMcpConfig, perCommand) {
   if (!pluginMcpConfig && !perCommand) return base;
   return {
@@ -3383,6 +3564,17 @@ function mergeIsolation(base, pluginMcpConfig, perCommand) {
     ...pluginMcpConfig ? { mcpConfig: pluginMcpConfig } : {}
   };
 }
+function resolveClaudeSessionId(continuation) {
+  if (!continuation || continuation.mode === "fresh") {
+    return void 0;
+  }
+  if (continuation.mode === "resume") {
+    return continuation.handle;
+  }
+  throw new Error("Claude harness does not support reuse-current continuation");
+}
+
+// src/harnesses/claude/process/useProcess.ts
 var MAX_OUTPUT = 1e3;
 var KILL_TIMEOUT_MS = 3e3;
 var NULL_TOKENS = {
@@ -3433,17 +3625,6 @@ function tokenUsageEquals(a, b) {
   return a.input === b.input && a.output === b.output && a.cacheRead === b.cacheRead && a.cacheWrite === b.cacheWrite && a.total === b.total && a.contextSize === b.contextSize && a.contextWindowSize === b.contextWindowSize;
 }
 var JQ_ASSISTANT_TEXT_FILTER = 'select(.type == "message" and .role == "assistant") | .content[] | select(.type == "text") | .text';
-function resolveClaudeSessionId(continuation) {
-  if (!continuation || continuation.mode === "fresh") {
-    return void 0;
-  }
-  if (continuation.mode === "resume") {
-    return continuation.handle;
-  }
-  throw new Error(
-    "Claude process hook does not support reuse-current continuation"
-  );
-}
 function useClaudeProcess(projectDir, instanceId, isolation, pluginMcpConfig, verbose, workflow, options) {
   const processRef = useRef(null);
   const abortRef = useRef(new AbortController());
@@ -3728,25 +3909,6 @@ function useClaudeProcess(projectDir, instanceId, isolation, pluginMcpConfig, ve
 }
 
 // src/harnesses/claude/session/controller.ts
-function mergeIsolation2(base, pluginMcpConfig, overrides) {
-  if (!pluginMcpConfig && !overrides) return base;
-  return {
-    ...resolveIsolationConfig(base),
-    ...overrides ?? {},
-    ...pluginMcpConfig ? { mcpConfig: pluginMcpConfig } : {}
-  };
-}
-function resolveClaudeSessionId2(continuation) {
-  if (!continuation || continuation.mode === "fresh") {
-    return void 0;
-  }
-  if (continuation.mode === "resume") {
-    return continuation.handle;
-  }
-  throw new Error(
-    "Claude session controller does not support reuse-current continuation"
-  );
-}
 function createClaudeSessionController(input) {
   const spawnProcess = input.spawnProcess ?? spawnClaude;
   const processConfig = input.processConfig;
@@ -3791,8 +3953,8 @@ function createClaudeSessionController(input) {
             prompt,
             projectDir: input.projectDir,
             instanceId: input.instanceId,
-            sessionId: resolveClaudeSessionId2(continuation),
-            isolation: mergeIsolation2(
+            sessionId: resolveClaudeSessionId(continuation),
+            isolation: mergeIsolation(
               processConfig,
               input.pluginMcpConfig,
               configOverride
@@ -3849,20 +4011,49 @@ function buildClaudeCompatibleIsolationConfig({
   additionalDirectories,
   pluginDirs,
   verbose,
-  configuredModel
+  configuredModel,
+  configuredEffort
 }) {
   return {
     preset: isolationPreset,
     additionalDirectories,
     pluginDirs: pluginDirs.length > 0 ? pluginDirs : void 0,
     debug: verbose,
-    model: configuredModel
+    model: configuredModel,
+    effort: normalizeEffort(configuredEffort)
   };
 }
+var CLAUDE_MODEL_OPTIONS = [
+  {
+    value: "sonnet",
+    label: "Sonnet",
+    description: "Balanced default for day-to-day coding work."
+  },
+  {
+    value: "opus",
+    label: "Opus",
+    description: "Stronger reasoning for complex architecture and debugging."
+  },
+  {
+    value: "haiku",
+    label: "Haiku",
+    description: "Fastest option for lighter tasks."
+  },
+  {
+    value: "opusplan",
+    label: "OpusPlan",
+    description: "Uses Opus for planning and Sonnet for execution."
+  }
+];
 var CLAUDE_CONFIG_PROFILE = {
   harness: "claude-code",
   buildIsolationConfig: buildClaudeCompatibleIsolationConfig,
-  resolveModelName: ({ projectDir, configuredModel }) => resolveClaudeModel({ projectDir, configuredModel })
+  resolveModelName: ({ projectDir, configuredModel }) => resolveClaudeModel({ projectDir, configuredModel }),
+  pluginDelivery: {
+    mergeWorkflowPluginDirs: true,
+    registrationBuildsMcpConfig: true,
+    workflowPluginsVia: "registration"
+  }
 };
 var claudeHarnessAdapter = {
   id: "claude-code",
@@ -3872,7 +4063,9 @@ var claudeHarnessAdapter = {
     conversationModel: "fresh_per_turn",
     killWaitsForTurnSettlement: true,
     supportsEphemeralSessions: false,
-    supportsConfigurableIsolation: true
+    supportsConfigurableIsolation: true,
+    emitsStartupDiagnostics: true,
+    extraAllowedTools: []
   },
   verify: () => verifyClaudeHarness(),
   createRuntime: (input) => createClaudeHookRuntime({
@@ -3908,7 +4101,8 @@ var claudeHarnessAdapter = {
     };
     return controller;
   },
-  resolveConfigProfile: () => CLAUDE_CONFIG_PROFILE
+  resolveConfigProfile: () => CLAUDE_CONFIG_PROFILE,
+  listModels: async () => CLAUDE_MODEL_OPTIONS
 };
 
 // src/harnesses/codex/runtime/appServerManager.ts
@@ -6751,6 +6945,74 @@ function buildCodexPromptOptions(input) {
   };
 }
 
+// src/harnesses/codex/session/turnRunner.ts
+function createCodexTurnEventCollector() {
+  let message = "";
+  let tokenDelta = { ...NULL_TOKENS2 };
+  let turnStatus;
+  let turnErrorMessage;
+  return {
+    handle(event) {
+      const data = typeof event.data === "object" ? event.data : {};
+      if (event.kind === "message.delta") {
+        const delta = typeof data["delta"] === "string" ? data["delta"] : "";
+        message += delta;
+      }
+      if (event.kind === "usage.update") {
+        tokenDelta = readTokenUsage(data["delta"]);
+      }
+      if (event.kind === "turn.complete") {
+        turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
+      }
+      if (event.kind === "unknown" && event.hookName === "error") {
+        const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
+        const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
+        if (typeof errorValue?.["message"] === "string") {
+          turnErrorMessage = errorValue["message"];
+        }
+      }
+    },
+    result() {
+      if (turnStatus === "failed") {
+        return {
+          exitCode: 1,
+          error: new Error(turnErrorMessage ?? "Codex turn failed"),
+          tokens: tokenDelta,
+          streamMessage: message || null
+        };
+      }
+      return {
+        exitCode: 0,
+        error: null,
+        tokens: tokenDelta,
+        streamMessage: message || null
+      };
+    },
+    errorResult(error) {
+      return {
+        exitCode: null,
+        error,
+        tokens: tokenDelta,
+        streamMessage: message || null
+      };
+    }
+  };
+}
+async function runCodexTurn(runtime, prompt, optionsInput, hooks) {
+  const collector = createCodexTurnEventCollector();
+  const unsubscribe = runtime.onEvent(collector.handle);
+  try {
+    await runtime.sendPrompt(prompt, buildCodexPromptOptions(optionsInput));
+    return collector.result();
+  } catch (error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    hooks?.onError?.(normalized);
+    return collector.errorResult(normalized);
+  } finally {
+    unsubscribe();
+  }
+}
+
 // src/harnesses/codex/session/controller.ts
 function createCodexSessionController(input) {
   const runtime = input.runtime;
@@ -6770,73 +7032,19 @@ function createCodexSessionController(input) {
           streamMessage: null
         };
       }
-      let message = "";
-      let tokenDelta = { ...NULL_TOKENS2 };
-      let turnStatus;
-      let turnErrorMessage;
-      const unsubscribe = runtime.onEvent((event) => {
-        const data = typeof event.data === "object" ? event.data : {};
-        if (event.kind === "message.delta") {
-          const delta = typeof data["delta"] === "string" ? data["delta"] : "";
-          message += delta;
-        }
-        if (event.kind === "usage.update") {
-          tokenDelta = readTokenUsage(data["delta"]);
-        }
-        if (event.kind === "turn.complete") {
-          turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
-        }
-        if (event.kind === "unknown" && event.hookName === "error") {
-          const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
-          const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
-          if (typeof errorValue?.["message"] === "string") {
-            turnErrorMessage = errorValue["message"];
-          }
-        }
+      const turnPromise = runCodexTurn(runtime, prompt, {
+        processConfig,
+        continuation,
+        configOverride,
+        workflowPlan: input.workflowPlan,
+        pluginMcpConfig: input.pluginMcpConfig,
+        ephemeral: input.ephemeral
       });
-      const turnPromise = (async () => {
-        try {
-          await runtime.sendPrompt(
-            prompt,
-            buildCodexPromptOptions({
-              processConfig,
-              continuation,
-              configOverride,
-              workflowPlan: input.workflowPlan,
-              pluginMcpConfig: input.pluginMcpConfig,
-              ephemeral: input.ephemeral
-            })
-          );
-          if (turnStatus === "failed") {
-            return {
-              exitCode: 1,
-              error: new Error(turnErrorMessage ?? "Codex turn failed"),
-              tokens: tokenDelta,
-              streamMessage: message || null
-            };
-          }
-          return {
-            exitCode: 0,
-            error: null,
-            tokens: tokenDelta,
-            streamMessage: message || null
-          };
-        } catch (error) {
-          return {
-            exitCode: null,
-            error: error instanceof Error ? error : new Error(String(error)),
-            tokens: tokenDelta,
-            streamMessage: message || null
-          };
-        } finally {
-          activeTurnPromise = null;
-        }
-      })();
       activeTurnPromise = turnPromise;
       try {
         return await turnPromise;
       } finally {
-        unsubscribe();
+        activeTurnPromise = null;
       }
     },
     interrupt() {
@@ -6893,81 +7101,38 @@ function useCodexSessionController(runtime, processConfig, workflowPlan, ephemer
         };
       }
       setIsRunning(true);
-      let streamedMessage = "";
-      let turnTokens = { ...NULL_TOKENS2 };
-      let turnStatus;
-      let turnErrorMessage;
-      const unsubscribe = codexRuntime.onEvent((event) => {
-        const data = typeof event.data === "object" ? event.data : {};
-        if (event.kind === "message.delta") {
-          const delta = typeof data["delta"] === "string" ? data["delta"] : "";
-          streamedMessage += delta;
-        }
-        if (event.kind === "usage.update") {
-          turnTokens = readTokenUsage(data["delta"]);
-        }
-        if (event.kind === "turn.complete") {
-          turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
-        }
-        if (event.kind === "unknown" && event.hookName === "error") {
-          const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
-          const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
-          if (typeof errorValue?.["message"] === "string") {
-            turnErrorMessage = errorValue["message"];
-          }
-        }
-      });
-      const turnPromise = (async () => {
-        try {
-          await codexRuntime.sendPrompt(
-            prompt,
-            buildCodexPromptOptions({
-              processConfig,
-              continuation,
-              configOverride: _configOverride,
-              workflowPlan,
-              pluginMcpConfig,
-              ephemeral
-            })
-          );
-          if (turnStatus === "failed") {
-            return {
-              exitCode: 1,
-              error: new Error(turnErrorMessage ?? "Codex turn failed"),
-              tokens: turnTokens,
-              streamMessage: streamedMessage || null
-            };
-          }
-          return {
-            exitCode: 0,
-            error: null,
-            tokens: turnTokens,
-            streamMessage: streamedMessage || null
-          };
-        } catch (error) {
-          if (!abortRef.current.signal.aborted) {
-            onLifecycleEventRef.current?.({
-              type: "spawn_error",
-              message: error instanceof Error ? error.message : "Unknown Codex error",
-              failureCode: "spawn_error"
-            });
-          }
-          return {
-            exitCode: null,
-            error: error instanceof Error ? error : new Error("Unknown Codex error"),
-            tokens: turnTokens,
-            streamMessage: streamedMessage || null
-          };
-        } finally {
-          activeTurnPromiseRef.current = null;
-          unsubscribe();
-          if (!abortRef.current.signal.aborted) {
-            setIsRunning(false);
+      const turnPromise = runCodexTurn(
+        codexRuntime,
+        prompt,
+        {
+          processConfig,
+          continuation,
+          configOverride: _configOverride,
+          workflowPlan,
+          pluginMcpConfig,
+          ephemeral
+        },
+        {
+          onError: (error) => {
+            if (!abortRef.current.signal.aborted) {
+              onLifecycleEventRef.current?.({
+                type: "spawn_error",
+                message: error.message,
+                failureCode: "spawn_error"
+              });
+            }
           }
         }
-      })();
+      );
       activeTurnPromiseRef.current = turnPromise;
-      return await turnPromise;
+      try {
+        return await turnPromise;
+      } finally {
+        activeTurnPromiseRef.current = null;
+        if (!abortRef.current.signal.aborted) {
+          setIsRunning(false);
+        }
+      }
     },
     [codexRuntime, processConfig, workflowPlan, pluginMcpConfig, ephemeral]
   );
@@ -7076,7 +7241,12 @@ var CODEX_CONFIG_PROFILE = {
     preset: isolationPreset,
     model: configuredModel
   }),
-  resolveModelName: ({ configuredModel }) => configuredModel ?? null
+  resolveModelName: ({ configuredModel }) => configuredModel ?? null,
+  pluginDelivery: {
+    mergeWorkflowPluginDirs: false,
+    registrationBuildsMcpConfig: false,
+    workflowPluginsVia: "generated-mcp"
+  }
 };
 var codexHarnessAdapter = {
   id: "openai-codex",
@@ -7086,7 +7256,12 @@ var codexHarnessAdapter = {
     conversationModel: "persistent_thread",
     killWaitsForTurnSettlement: true,
     supportsEphemeralSessions: true,
-    supportsConfigurableIsolation: true
+    supportsConfigurableIsolation: true,
+    emitsStartupDiagnostics: false,
+    // Codex auto-approves Bash/Edit (outside-sandbox commandExecution /
+    // fileChange) and the scoped 'Permissions' capability, on top of the
+    // shared 'mcp__*' baseline seeded via allowedTools (see buildInitialRules).
+    extraAllowedTools: ["Permissions", "Bash", "Edit"]
   },
   verify: () => verifyCodexHarness(),
   createRuntime: (input) => createCodexRuntime({
@@ -7113,8 +7288,23 @@ var codexHarnessAdapter = {
     };
     return controller;
   },
-  resolveConfigProfile: () => CODEX_CONFIG_PROFILE
+  resolveConfigProfile: () => CODEX_CONFIG_PROFILE,
+  listModels: async (runtime) => {
+    if (!isCodexRuntimeWithModels(runtime)) {
+      throw new Error("Codex runtime is not available");
+    }
+    const models = await runtime.listModels();
+    return models.map((model) => ({
+      value: model.model,
+      label: model.displayName,
+      description: model.description,
+      isDefault: model.isDefault
+    }));
+  }
 };
+function isCodexRuntimeWithModels(runtime) {
+  return Boolean(runtime && "listModels" in runtime);
+}
 
 // src/harnesses/registry.ts
 function buildClaudeCompatibleIsolationConfig2({
@@ -7140,7 +7330,9 @@ var opencodeHarnessAdapter = {
     conversationModel: "fresh_per_turn",
     killWaitsForTurnSettlement: true,
     supportsEphemeralSessions: false,
-    supportsConfigurableIsolation: false
+    supportsConfigurableIsolation: false,
+    emitsStartupDiagnostics: false,
+    extraAllowedTools: []
   },
   createRuntime: (input) => claudeHarnessAdapter.createRuntime(input),
   createSessionController: (input) => claudeHarnessAdapter.createSessionController(input),
@@ -7148,8 +7340,14 @@ var opencodeHarnessAdapter = {
   resolveConfigProfile: () => ({
     harness: "opencode",
     buildIsolationConfig: (input) => buildClaudeCompatibleIsolationConfig2(input),
-    resolveModelName: ({ configuredModel }) => configuredModel ?? null
-  })
+    resolveModelName: ({ configuredModel }) => configuredModel ?? null,
+    pluginDelivery: {
+      mergeWorkflowPluginDirs: true,
+      registrationBuildsMcpConfig: true,
+      workflowPluginsVia: "registration"
+    }
+  }),
+  listModels: async () => []
 };
 var HARNESS_ADAPTERS = [
   claudeHarnessAdapter,
@@ -7265,6 +7463,28 @@ function loadPlugin(pluginDir) {
   }
   return commands2;
 }
+function loadPersonalSkills(skills) {
+  const commands2 = [];
+  for (const skill of skills) {
+    const skillPath = path12.join(skill.path, "SKILL.md");
+    if (!fs14.existsSync(skillPath)) {
+      console.warn(
+        `Skipping personal skill '${skill.name}' [${skill.sourceLayer}]: SKILL.md not found at ${skill.path}`
+      );
+      continue;
+    }
+    try {
+      const parsed = parseFrontmatter(fs14.readFileSync(skillPath, "utf-8"));
+      commands2.push(skillToCommand(parsed.frontmatter, parsed.body));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(
+        `Skipping personal skill '${skill.name}' [${skill.sourceLayer}]: ${message}`
+      );
+    }
+  }
+  return commands2;
+}
 function skillToCommand(frontmatter, body, mcpConfigPath) {
   const args = frontmatter["argument-hint"] ? [
     {
@@ -7288,8 +7508,9 @@ function skillToCommand(frontmatter, body, mcpConfigPath) {
 }
 
 // src/infra/plugins/register.ts
-function buildPluginMcpConfig(pluginDirs, mcpServerOptions) {
+function buildPluginMcpConfig(pluginDirs, mcpServerOptions, personalMcpServers = []) {
   const mergedServers = {};
+  const conflicts = [];
   for (const dir of pluginDirs) {
     const mcpPath = path13.join(dir, ".mcp.json");
     if (!fs15.existsSync(mcpPath)) {
@@ -7315,22 +7536,99 @@ function buildPluginMcpConfig(pluginDirs, mcpServerOptions) {
       mergedServers[serverName] = rest;
     }
   }
+  for (const personal of personalMcpServers) {
+    const { name, sourceLayer: _sourceLayer, ...server } = personal;
+    if (name in mergedServers) {
+      conflicts.push(personal);
+      continue;
+    }
+    mergedServers[name] = server;
+  }
   if (Object.keys(mergedServers).length === 0) {
-    return void 0;
+    return { mcpConfig: void 0, conflicts };
   }
   const mcpConfig = path13.join(os10.tmpdir(), `athena-mcp-${process.pid}.json`);
   fs15.writeFileSync(mcpConfig, JSON.stringify({ mcpServers: mergedServers }));
-  return mcpConfig;
+  return { mcpConfig, conflicts };
 }
-function registerPlugins(pluginDirs, mcpServerOptions, includeMcpConfig = true) {
+function registerPlugins(pluginDirs, mcpServerOptions, includeMcpConfig = true, personalMcpServers = [], personalSkills = []) {
   for (const dir of pluginDirs) {
     const commands2 = loadPlugin(dir);
     for (const command of commands2) {
       register(command);
     }
   }
-  const mcpConfig = includeMcpConfig ? buildPluginMcpConfig(pluginDirs, mcpServerOptions) : void 0;
-  return { mcpConfig };
+  const skillByName = new Map(personalSkills.map((skill) => [skill.name, skill]));
+  const skillConflicts = [];
+  for (const command of loadPersonalSkills(personalSkills)) {
+    if (get(command.name)) {
+      const shadowed = skillByName.get(command.name);
+      if (shadowed) {
+        skillConflicts.push(shadowed);
+      }
+      continue;
+    }
+    register(command);
+  }
+  const mcpResult = includeMcpConfig ? buildPluginMcpConfig(pluginDirs, mcpServerOptions, personalMcpServers) : { mcpConfig: void 0, conflicts: [] };
+  return {
+    mcpConfig: mcpResult.mcpConfig,
+    conflicts: { mcpServers: mcpResult.conflicts, skills: skillConflicts }
+  };
+}
+
+// src/infra/plugins/pluginRefResolution.ts
+function resolvePluginDirs(entries) {
+  const dirs = [];
+  const warnings = [];
+  for (const entry of entries) {
+    if (!isMarketplaceRef(entry)) {
+      dirs.push(entry);
+      continue;
+    }
+    try {
+      dirs.push(resolveMarketplacePlugin(entry));
+    } catch (error) {
+      warnings.push(`Skipping plugin "${entry}": ${error.message}`);
+    }
+  }
+  return { dirs, warnings };
+}
+
+// src/infra/capabilities/effective.ts
+function resolveEffectiveCapabilities(input) {
+  const { globalConfig, projectConfig } = input;
+  return {
+    mcpServers: mergeMcpServers(
+      globalConfig.mcpServers,
+      projectConfig.mcpServers
+    ),
+    skills: mergeSkills(globalConfig.skills, projectConfig.skills)
+  };
+}
+function mergeMcpServers(global, project) {
+  const projectNames = new Set(Object.keys(project ?? {}));
+  const result = [];
+  for (const [name, server] of Object.entries(global ?? {})) {
+    if (projectNames.has(name)) continue;
+    result.push({ name, ...server, sourceLayer: "global" });
+  }
+  for (const [name, server] of Object.entries(project ?? {})) {
+    result.push({ name, ...server, sourceLayer: "project" });
+  }
+  return result;
+}
+function mergeSkills(global, project) {
+  const projectNames = new Set((project ?? []).map((s) => s.name));
+  const result = [];
+  for (const skill of global ?? []) {
+    if (projectNames.has(skill.name)) continue;
+    result.push({ ...skill, sourceLayer: "global" });
+  }
+  for (const skill of project ?? []) {
+    result.push({ ...skill, sourceLayer: "project" });
+  }
+  return result;
 }
 
 // src/setup/shouldResolveWorkflow.ts
@@ -7386,6 +7684,9 @@ function bootstrapRuntimeConfig({
   const projectConfig = providedProjectConfig ?? readConfig(projectDir);
   const warnings = [];
   const harness = harnessOverride ?? projectConfig.harness ?? globalConfig.harness ?? DEFAULT_HARNESS;
+  const harnessConfigProfile = resolveHarnessConfigProfile(harness);
+  const pluginDelivery = harnessConfigProfile.pluginDelivery;
+  const workflowPluginsAsGeneratedMcp = pluginDelivery.workflowPluginsVia === "generated-mcp";
   const activeWorkflowSelection = resolveActiveWorkflow({
     globalConfig,
     projectConfig,
@@ -7408,34 +7709,45 @@ function bootstrapRuntimeConfig({
       (plugin) => plugin.claudeArtifactDir
     );
   }
+  const globalPluginResolution = resolvePluginDirs(globalConfig.plugins);
+  const projectPluginResolution = resolvePluginDirs(projectConfig.plugins);
+  warnings.push(
+    ...globalPluginResolution.warnings,
+    ...projectPluginResolution.warnings
+  );
   const pluginDirs = mergePluginDirs({
-    workflowPluginDirs: harness === "openai-codex" ? [] : workflowPluginDirs,
-    globalPlugins: globalConfig.plugins,
-    projectPlugins: projectConfig.plugins,
+    workflowPluginDirs: pluginDelivery.mergeWorkflowPluginDirs ? workflowPluginDirs : [],
+    globalPlugins: globalPluginResolution.dirs,
+    projectPlugins: projectPluginResolution.dirs,
     pluginFlags
   });
-  const pluginResult = pluginDirs.length > 0 ? registerPlugins(
+  const effectiveCapabilities = harness === "openai-codex" ? { mcpServers: [], skills: [] } : resolveEffectiveCapabilities({ globalConfig, projectConfig });
+  const personalMcpServers = effectiveCapabilities.mcpServers;
+  const personalSkills = effectiveCapabilities.skills;
+  const pluginResult = pluginDirs.length > 0 || personalMcpServers.length > 0 || personalSkills.length > 0 ? registerPlugins(
     pluginDirs,
     workflowToResolve ? activeWorkflowConfig.workflowSelections?.[workflowToResolve]?.mcpServerOptions : void 0,
-    harness !== "openai-codex"
-  ) : { mcpConfig: void 0 };
-  const workflowPluginMcpConfig = harness === "openai-codex" ? buildPluginMcpConfig(
+    pluginDelivery.registrationBuildsMcpConfig,
+    personalMcpServers,
+    personalSkills
+  ) : { mcpConfig: void 0, conflicts: { mcpServers: [], skills: [] } };
+  const workflowPluginMcpConfig = workflowPluginsAsGeneratedMcp ? buildPluginMcpConfig(
     workflowPluginDirs,
     workflowToResolve ? activeWorkflowConfig.workflowSelections?.[workflowToResolve]?.mcpServerOptions : void 0
-  ) : void 0;
-  const pluginMcpConfig = harness === "openai-codex" ? void 0 : pluginResult.mcpConfig;
+  ).mcpConfig : void 0;
+  const pluginMcpConfig = workflowPluginsAsGeneratedMcp ? void 0 : pluginResult.mcpConfig;
   const activeWorkflow = resolvedWorkflow;
   const additionalDirectories = [
     ...globalConfig.additionalDirectories,
     ...projectConfig.additionalDirectories
   ];
-  const harnessConfigProfile = resolveHarnessConfigProfile(harness);
   const workflowPlan = compileWorkflowPlan({
     workflow: activeWorkflow,
     resolvedPlugins: activeWorkflow && resolvedWorkflow?.name === activeWorkflow.name ? workflowResolvedPlugins : void 0,
-    pluginMcpConfig: harness === "openai-codex" && activeWorkflow && resolvedWorkflow?.name === activeWorkflow.name ? workflowPluginMcpConfig : pluginResult.mcpConfig
+    pluginMcpConfig: workflowPluginsAsGeneratedMcp && activeWorkflow && resolvedWorkflow?.name === activeWorkflow.name ? workflowPluginMcpConfig : pluginResult.mcpConfig
   });
   const configModel = projectConfig.model || globalConfig.model || activeWorkflow?.model;
+  const configEffort = activeWorkflow?.effort;
   let isolationPreset = initialIsolationPreset;
   if (activeWorkflow?.isolation) {
     const presetOrder = ["strict", "minimal", "permissive"];
@@ -7454,7 +7766,8 @@ function bootstrapRuntimeConfig({
     additionalDirectories,
     pluginDirs,
     verbose,
-    configuredModel: configModel
+    configuredModel: configModel,
+    configuredEffort: configEffort
   });
   const modelName = harnessConfigProfile.resolveModelName({
     projectDir,
@@ -7470,6 +7783,9 @@ function bootstrapRuntimeConfig({
     workflow: activeWorkflow,
     workflowPlan,
     modelName,
+    personalMcpServers,
+    personalSkills,
+    capabilityConflicts: pluginResult.conflicts,
     warnings
   };
 }
@@ -7491,7 +7807,7 @@ var EXEC_EXIT_CODE = {
 
 // src/app/exec/runner.ts
 import crypto2 from "crypto";
-import path18 from "path";
+import path17 from "path";
 
 // src/core/feed/entities.ts
 var ActorRegistry = class {
@@ -7682,8 +7998,10 @@ function generateTitle(event, ascii = false) {
 }
 function generateNeutralTitle(event, g) {
   switch (event.kind) {
-    case "session.start":
-      return `Session started (${event.data.source})`;
+    case "session.start": {
+      const sessionTitle = event.data.session_title?.trim();
+      return sessionTitle ? truncate(sessionTitle) : `Session started (${event.data.source})`;
+    }
     case "session.end":
       return `Session ended (${event.data.reason})`;
     case "run.start":
@@ -7692,6 +8010,8 @@ function generateNeutralTitle(event, g) {
       return `Run ${event.data.status}`;
     case "user.prompt":
       return truncate(event.data.prompt);
+    case "prompt.expansion":
+      return event.data.command_name ? truncate(`Expanded /${event.data.command_name}`) : "Prompt expanded";
     case "plan.update":
       return truncate(
         event.data.explanation || event.data.delta || "Plan updated"
@@ -7706,6 +8026,10 @@ function generateNeutralTitle(event, g) {
       return `${g["tool.bullet"]} ${event.data.tool_name}`;
     case "tool.post":
       return `${g["tool.gutter"]} ${event.data.tool_name} result`;
+    case "tool.batch": {
+      const n = event.data.tool_calls.length;
+      return `Batch of ${n} tool call${n === 1 ? "" : "s"}`;
+    }
     case "tool.failure":
       return truncate(
         `${g["status.blocked"]} ${event.data.tool_name} failed: ${event.data.error}`
@@ -7936,6 +8260,7 @@ function createRunLifecycle(boundary) {
   let currentRun = null;
   let seq = 0;
   let runSeq = 0;
+  let currentPromptId;
   function getRunId() {
     const sessId = currentSession?.session_id ?? "unknown";
     return `${sessId}:R${runSeq}`;
@@ -7984,7 +8309,13 @@ function createRunLifecycle(boundary) {
     );
   }
   function beginRun(runtimeEvent, triggerType = "other", promptPreview) {
-    if (currentRun && triggerType === "other") return [];
+    const promptId = runtimeEvent.promptId;
+    const isExplicitContextTrigger = triggerType === "resume" || triggerType === "clear" || triggerType === "compact";
+    if (promptId !== void 0 && !isExplicitContextTrigger) {
+      if (currentRun && promptId === currentPromptId) return [];
+    } else if (promptId === void 0 && currentRun && triggerType === "other") {
+      return [];
+    }
     const results = [];
     const closeEvt = closeRunIntoEvent(runtimeEvent, "completed");
     if (closeEvt) results.push(closeEvt);
@@ -7995,6 +8326,7 @@ function createRunLifecycle(boundary) {
       triggerType,
       promptPreview
     );
+    currentPromptId = promptId;
     results.push(
       makeEvent(
         "run.start",
@@ -8074,6 +8406,7 @@ function createRunLifecycle(boundary) {
           if (e.kind === "tool.failure") currentRun.counters.tool_failures++;
           if (e.kind === "permission.request")
             currentRun.counters.permission_requests++;
+          if (e.prompt_id !== void 0) currentPromptId = e.prompt_id;
         }
       }
     }
@@ -8336,28 +8669,11 @@ function createAgentMessageStream(eventBuilder, transcriptReader) {
   };
 }
 
-// src/core/feed/internals/rootPlanTracker.ts
-function createRootPlanTracker() {
-  let items = [];
-  return {
-    set(next) {
-      items = next;
-    },
-    current() {
-      return items;
-    },
-    differs(next) {
-      if (next.length !== items.length) return true;
-      for (let i = 0; i < next.length; i++) {
-        if (next[i]?.content !== items[i]?.content) return true;
-        if (next[i]?.status !== items[i]?.status) return true;
-      }
-      return false;
-    }
-  };
+// src/core/feed/internals/taskStateTracker.ts
+function extractTodoItems(toolInput) {
+  const input = toolInput;
+  return Array.isArray(input?.todos) ? input.todos : [];
 }
-
-// src/core/feed/internals/taskLifecycleTracker.ts
 function coerceTaskStatus(status) {
   switch (status) {
     case "pending":
@@ -8369,57 +8685,6 @@ function coerceTaskStatus(status) {
       return null;
   }
 }
-function createTaskLifecycleTracker() {
-  let items = [];
-  return {
-    current() {
-      return items;
-    },
-    upsertCreated({ taskId, subject, description, activeForm }) {
-      const task = {
-        taskId,
-        content: subject,
-        status: "pending",
-        activeForm: activeForm ?? description
-      };
-      const existingIndex = items.findIndex((item) => item.taskId === taskId);
-      if (existingIndex === -1) {
-        items = [...items, task];
-        return;
-      }
-      items = items.map(
-        (item, index) => index === existingIndex ? {
-          ...item,
-          taskId,
-          content: subject,
-          activeForm: task.activeForm ?? item.activeForm
-        } : item
-      );
-    },
-    markCompleted({ taskId, subject }) {
-      const existingIndex = items.findIndex((item) => item.taskId === taskId);
-      if (existingIndex === -1) {
-        if (!subject) return;
-        items = [...items, { taskId, content: subject, status: "completed" }];
-        return;
-      }
-      items = items.map(
-        (item, index) => index === existingIndex ? { ...item, status: "completed" } : item
-      );
-    },
-    updateStatus({ taskId, status }) {
-      items = items.map(
-        (item) => item.taskId === taskId ? { ...item, status } : item
-      );
-    }
-  };
-}
-
-// src/core/feed/internals/taskStateTracker.ts
-function extractTodoItems(toolInput) {
-  const input = toolInput;
-  return Array.isArray(input?.todos) ? input.todos : [];
-}
 function mapPlanStepStatus(status) {
   switch (status) {
     case "inProgress":
@@ -8432,18 +8697,69 @@ function mapPlanStepStatus(status) {
   }
 }
 function createTaskStateTracker() {
-  const rootPlan = createRootPlanTracker();
-  const taskLifecycle = createTaskLifecycleTracker();
+  let rootPlanItems = [];
+  let taskItems = [];
+  function rootPlanDiffers(next) {
+    if (next.length !== rootPlanItems.length) return true;
+    for (let i = 0; i < next.length; i++) {
+      if (next[i]?.content !== rootPlanItems[i]?.content) return true;
+      if (next[i]?.status !== rootPlanItems[i]?.status) return true;
+    }
+    return false;
+  }
+  function upsertCreatedTask(input) {
+    const { taskId, subject, description, activeForm } = input;
+    const task = {
+      taskId,
+      content: subject,
+      status: "pending",
+      activeForm: activeForm ?? description
+    };
+    const existingIndex = taskItems.findIndex((item) => item.taskId === taskId);
+    if (existingIndex === -1) {
+      taskItems = [...taskItems, task];
+      return;
+    }
+    taskItems = taskItems.map(
+      (item, index) => index === existingIndex ? {
+        ...item,
+        taskId,
+        content: subject,
+        activeForm: task.activeForm ?? item.activeForm
+      } : item
+    );
+  }
+  function markTaskCompleted(input) {
+    const { taskId, subject } = input;
+    const existingIndex = taskItems.findIndex((item) => item.taskId === taskId);
+    if (existingIndex === -1) {
+      if (!subject) return;
+      taskItems = [
+        ...taskItems,
+        { taskId, content: subject, status: "completed" }
+      ];
+      return;
+    }
+    taskItems = taskItems.map(
+      (item, index) => index === existingIndex ? { ...item, status: "completed" } : item
+    );
+  }
+  function updateTaskStatus(input) {
+    const { taskId, status } = input;
+    taskItems = taskItems.map(
+      (item) => item.taskId === taskId ? { ...item, status } : item
+    );
+  }
   function applyToolPre(input) {
     const { toolName, toolInput, actorId } = input;
     if (toolName === "TodoWrite" && actorId === "agent:root") {
-      rootPlan.set(extractTodoItems(toolInput));
+      rootPlanItems = extractTodoItems(toolInput);
     }
     if (toolName === "TaskUpdate") {
       const taskId = readString(toolInput["taskId"], toolInput["task_id"]);
       const status = coerceTaskStatus(toolInput["status"]);
       if (taskId && status) {
-        taskLifecycle.updateStatus({ taskId, status });
+        updateTaskStatus({ taskId, status });
       }
     }
   }
@@ -8455,7 +8771,7 @@ function createTaskStateTracker() {
       const taskId = readString(task["id"], task["task_id"]);
       const subject = readString(task["subject"], toolInput["subject"]);
       if (taskId && subject) {
-        taskLifecycle.upsertCreated({
+        upsertCreatedTask({
           taskId,
           subject,
           description: readString(toolInput["description"]),
@@ -8475,7 +8791,7 @@ function createTaskStateTracker() {
         readObject(response["statusChange"])["to"] ?? toolInput["status"]
       );
       if (taskId && status) {
-        taskLifecycle.updateStatus({ taskId, status });
+        updateTaskStatus({ taskId, status });
       }
     }
   }
@@ -8484,19 +8800,19 @@ function createTaskStateTracker() {
     const subject = readString(data["task_subject"]);
     const description = readString(data["task_description"]);
     if (taskId && subject) {
-      taskLifecycle.upsertCreated({ taskId, subject, description });
+      upsertCreatedTask({ taskId, subject, description });
     }
   }
   function applyTaskCompletedEvent(data) {
     const taskId = readString(data["task_id"]);
     const subject = readString(data["task_subject"]);
     if (taskId) {
-      taskLifecycle.markCompleted({ taskId, subject });
+      markTaskCompleted({ taskId, subject });
     }
   }
   return {
     current() {
-      return [...rootPlan.current(), ...taskLifecycle.current()];
+      return [...rootPlanItems, ...taskItems];
     },
     applyToolPre,
     applyToolPost,
@@ -8506,8 +8822,8 @@ function createTaskStateTracker() {
         content: typeof step.step === "string" ? step.step : "",
         status: mapPlanStepStatus(step.status)
       }));
-      if (!rootPlan.differs(next)) return false;
-      rootPlan.set(next);
+      if (!rootPlanDiffers(next)) return false;
+      rootPlanItems = next;
       return true;
     },
     applyTaskCreatedEvent,
@@ -8538,48 +8854,6 @@ function createTaskStateTracker() {
   };
 }
 
-// src/core/feed/internals/subagentTracker.ts
-function createSubagentTracker() {
-  const stack = [];
-  const descriptions = /* @__PURE__ */ new Map();
-  let pendingDescription;
-  return {
-    pushActor(actorId) {
-      stack.push(actorId);
-    },
-    popActor(actorId) {
-      const idx = stack.lastIndexOf(actorId);
-      if (idx !== -1) stack.splice(idx, 1);
-    },
-    peek() {
-      return stack.length > 0 ? stack[stack.length - 1] : void 0;
-    },
-    clear() {
-      stack.length = 0;
-    },
-    currentScope() {
-      return stack.length > 0 ? "subagent" : "root";
-    },
-    recordPendingDescription(description) {
-      pendingDescription = description;
-    },
-    clearPendingDescription() {
-      pendingDescription = void 0;
-    },
-    consumePendingDescription() {
-      const value = pendingDescription;
-      pendingDescription = void 0;
-      return value;
-    },
-    setDescription(agentId, description) {
-      descriptions.set(agentId, description);
-    },
-    description(agentId) {
-      return descriptions.get(agentId);
-    }
-  };
-}
-
 // src/core/feed/todo.ts
 function isSubagentTool(toolName) {
   return toolName === "Task" || toolName === "Agent";
@@ -8588,44 +8862,48 @@ function isSubagentTool(toolName) {
 // src/core/feed/internals/subagentLifecycle.ts
 function createSubagentLifecycle(args) {
   const { actors, runLifecycle } = args;
-  const tracker = createSubagentTracker();
+  const stack = [];
+  const descriptions = /* @__PURE__ */ new Map();
+  let pendingDescription;
   const actorIdFor = (agentId) => `subagent:${agentId}`;
   return {
     observeToolInput(toolName, toolInput) {
       if (!isSubagentTool(toolName)) return;
-      if (typeof toolInput["description"] === "string") {
-        tracker.recordPendingDescription(toolInput["description"]);
-      } else {
-        tracker.clearPendingDescription();
-      }
+      pendingDescription = typeof toolInput["description"] === "string" ? toolInput["description"] : void 0;
     },
     startSubagent({ agentId, agentType, fallbackDescription }) {
-      const description = tracker.consumePendingDescription() ?? fallbackDescription;
+      const consumed = pendingDescription;
+      pendingDescription = void 0;
+      const description = consumed ?? fallbackDescription;
       if (agentId) {
         actors.ensureSubagent(agentId, agentType ?? "unknown");
         const currentRun = runLifecycle.getCurrentRun();
         if (currentRun) currentRun.actors.subagent_ids.push(agentId);
-        tracker.pushActor(actorIdFor(agentId));
-        if (description) tracker.setDescription(agentId, description);
+        stack.push(actorIdFor(agentId));
+        if (description) descriptions.set(agentId, description);
       }
       return { actorId: "agent:root", description: description ?? void 0 };
     },
     stopSubagent(agentId) {
-      if (agentId) tracker.popActor(actorIdFor(agentId));
+      if (agentId) {
+        const actorId = actorIdFor(agentId);
+        const idx = stack.lastIndexOf(actorId);
+        if (idx !== -1) stack.splice(idx, 1);
+      }
       return {
         actorId: actorIdFor(agentId ?? "unknown"),
-        description: tracker.description(agentId ?? "")
+        description: descriptions.get(agentId ?? "")
       };
     },
     currentActor() {
-      return tracker.peek() ?? "agent:root";
+      return stack.at(-1) ?? "agent:root";
     },
     currentScope() {
-      return tracker.currentScope();
+      return stack.length > 0 ? "subagent" : "root";
     },
     actorIdFor,
     clear() {
-      tracker.clear();
+      stack.length = 0;
     }
   };
 }
@@ -8640,6 +8918,15 @@ function toolUseCause(toolUseId, parentId) {
     ...parentId ? { parent_event_id: parentId } : {}
   };
 }
+function readToolBatchCalls2(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => typeof entry === "object" && entry !== null).map((entry) => readObject(entry)).map((call) => ({
+    tool_name: readString(call["tool_name"]),
+    tool_input: readObject(call["tool_input"]),
+    tool_use_id: readString(call["tool_use_id"]),
+    tool_response: readString(call["tool_response"])
+  }));
+}
 function createToolProjection(args) {
   const {
     ensureRunArray,
@@ -8696,6 +8983,21 @@ function createToolProjection(args) {
   return {
     mapToolEvent(event, data) {
       const results = ensureRunArray(event);
+      if (event.kind === "tool.batch") {
+        results.push(
+          makeEvent(
+            "tool.batch",
+            "info",
+            resolveToolActor(),
+            {
+              tool_calls: readToolBatchCalls2(data["tool_calls"]),
+              permission_mode: readString(data["permission_mode"])
+            },
+            event
+          )
+        );
+        return results;
+      }
       const toolUseId = resolveToolUseId(event, data);
       const toolName = event.toolName ?? readString(data["tool_name"]) ?? "Unknown";
       const toolInput = readObject(data["tool_input"]);
@@ -9474,7 +9776,8 @@ function createRunSessionProjection(args) {
             {
               source,
               agent_type: readString(data["agent_type"]),
-              model: readString(data["model"])
+              model: readString(data["model"]),
+              session_title: readString(data["session_title"])
             },
             event
           )
@@ -9519,6 +9822,34 @@ function createRunSessionProjection(args) {
         );
         return results;
       }
+      if (event.kind === "prompt.expansion") {
+        if (event.promptId !== void 0) {
+          results.push(
+            ...ensureRunArray(
+              event,
+              "user_prompt_submit",
+              readString(data["prompt"])?.slice(0, 80)
+            )
+          );
+        }
+        results.push(
+          makeEvent(
+            "prompt.expansion",
+            "info",
+            "user",
+            {
+              expansion_type: readString(data["expansion_type"]),
+              command_name: readString(data["command_name"]),
+              command_args: readString(data["command_args"]),
+              command_source: readString(data["command_source"]),
+              prompt: readString(data["prompt"]),
+              permission_mode: event.context.permissionMode ?? readString(data["permission_mode"])
+            },
+            event
+          )
+        );
+        return results;
+      }
       if (event.kind === "turn.start") {
         agentMessageStream.clearPending();
         const prompt = readString(data["prompt"]);
@@ -9751,6 +10082,7 @@ var RUN_SESSION_EVENT_KINDS = /* @__PURE__ */ new Set([
   "session.start",
   "session.end",
   "user.prompt",
+  "prompt.expansion",
   "turn.start",
   "message.delta",
   "message.complete",
@@ -9763,6 +10095,7 @@ var TOOL_EVENT_KINDS = /* @__PURE__ */ new Set([
   "tool.delta",
   "tool.pre",
   "tool.post",
+  "tool.batch",
   "tool.failure"
 ]);
 var DECISION_EVENT_KINDS = /* @__PURE__ */ new Set([
@@ -9824,6 +10157,8 @@ function createFeedMapper(bootstrap) {
       ts: runtimeEvent.timestamp,
       session_id: runtimeEvent.sessionId,
       run_id: runId,
+      prompt_id: runtimeEvent.promptId,
+      effort_level: runtimeEvent.effortLevel,
       kind,
       level,
       actor_id: actorId,
@@ -9978,185 +10313,10 @@ function createFeedMapper(bootstrap) {
   };
 }
 
-// src/core/controller/rules.ts
-function ruleMatches(ruleToolName, toolName) {
-  if (ruleToolName === "*") return true;
-  if (ruleToolName === toolName) return true;
-  if (ruleToolName.endsWith("__*")) {
-    const prefix = ruleToolName.slice(0, -1);
-    return toolName.startsWith(prefix);
-  }
-  return false;
-}
-function matchRule(rules, toolName) {
-  const denyMatch = rules.find(
-    (r) => r.action === "deny" && ruleMatches(r.toolName, toolName)
-  );
-  if (denyMatch) return denyMatch;
-  return rules.find(
-    (r) => r.action === "approve" && ruleMatches(r.toolName, toolName)
-  );
-}
-
-// src/core/controller/permission.ts
-var SESSION_APPROVAL_REQUEST_HOOKS = /* @__PURE__ */ new Set([
-  "item/commandExecution/requestApproval",
-  "item/fileChange/requestApproval",
-  "item/permissions/requestApproval"
-]);
-function isScopedPermissionsRequest(hookName) {
-  return hookName === "item/permissions/requestApproval";
-}
-function supportsSessionApproval(hookName) {
-  return hookName !== void 0 && SESSION_APPROVAL_REQUEST_HOOKS.has(hookName);
-}
-function extractPermissionSnapshot(event) {
-  const data = event.data;
-  const toolNameFromData = typeof data["tool_name"] === "string" ? data["tool_name"] : void 0;
-  const toolInputFromData = typeof data["tool_input"] === "object" && data["tool_input"] !== null ? data["tool_input"] : void 0;
-  const toolUseIdFromData = typeof data["tool_use_id"] === "string" ? data["tool_use_id"] : void 0;
-  return {
-    request_id: event.id,
-    ts: event.timestamp,
-    kind: event.kind,
-    hookName: event.hookName,
-    tool_name: event.toolName ?? toolNameFromData ?? "Unknown",
-    tool_input: toolInputFromData ?? {},
-    tool_use_id: event.toolUseId ?? toolUseIdFromData,
-    suggestions: data.permission_suggestions
-  };
-}
-
-// src/core/controller/runtimeController.ts
-function handleEvent(event, cb) {
-  const eventKind2 = event.kind;
-  const isScoped = isScopedPermissionsRequest(event.hookName);
-  const eventData = event.data;
-  const toolName = event.toolName ?? (typeof eventData["tool_name"] === "string" ? eventData["tool_name"] : void 0);
-  if (eventKind2 === "permission.request" && toolName === "user_input") {
-    cb.enqueueQuestion(event.id);
-    cb.relayQuestion?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "permission.request" && toolName) {
-    const rule = matchRule(cb.getRules(), toolName);
-    if (rule?.action === "deny") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: {
-            kind: "permission_deny",
-            reason: `Blocked by rule: ${rule.addedBy}`
-          }
-        }
-      };
-    }
-    if (rule?.action === "approve") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: { kind: "permission_allow" },
-          // Scoped Codex permission grants are session-scoped under
-          // auto rules so the same capability isn't re-prompted.
-          ...isScoped ? { data: { scope: "session" } } : {}
-        }
-      };
-    }
-    cb.enqueuePermission(event);
-    cb.relayPermission?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "tool.pre" && toolName === "AskUserQuestion") {
-    cb.enqueueQuestion(event.id);
-    cb.relayQuestion?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "tool.pre" && toolName) {
-    const rule = matchRule(cb.getRules(), toolName);
-    if (rule?.action === "deny") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: {
-            kind: "pre_tool_deny",
-            reason: `Blocked by rule: ${rule.addedBy}`
-          }
-        }
-      };
-    }
-    return {
-      handled: true,
-      decision: {
-        type: "json",
-        source: "rule",
-        intent: { kind: "pre_tool_allow" }
-      }
-    };
-  }
-  return { handled: false };
-}
-
-// src/core/feed/ingest.ts
-function ingestRuntimeEvent(event, ctx) {
-  const controllerResult = handleEvent(event, ctx.controllerCallbacks);
-  const feedEvents = ctx.mapper.mapEvent(event);
-  if (ctx.store) {
-    persistOrDegrade(
-      ctx.store,
-      () => ctx.store.recordEvent(event, feedEvents),
-      "recordEvent failed",
-      ctx.onPersistFailure
-    );
-  }
-  return {
-    feedEvents,
-    decision: controllerResult.handled && controllerResult.decision ? controllerResult.decision : null
-  };
-}
-function ingestRuntimeDecision(eventId, decision, ctx) {
-  const feedEvent = ctx.mapper.mapDecision(eventId, decision);
-  if (feedEvent && ctx.store) {
-    persistOrDegrade(
-      ctx.store,
-      () => ctx.store.recordFeedEvents([feedEvent]),
-      "recordFeedEvents failed",
-      ctx.onPersistFailure
-    );
-  }
-  return feedEvent;
-}
-function persistOrDegrade(store, action, label, onFailure) {
-  try {
-    action();
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    const message = `${label}: ${reason}`;
-    store.markDegraded(message);
-    onFailure?.(message);
-  }
-}
-
-// src/infra/sessions/store.ts
-import fs17 from "fs";
-import path14 from "path";
-import Database from "better-sqlite3";
-
 // src/infra/sessions/schema.ts
-var SCHEMA_VERSION = 6;
-function initSchema(db) {
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
+var SCHEMA_VERSION = 7;
+var applySessionSchema = (db, fromVersion) => {
   db.exec(`
-		CREATE TABLE IF NOT EXISTS schema_version (
-			version INTEGER NOT NULL
-		);
-
 		CREATE TABLE IF NOT EXISTS session (
 			id TEXT PRIMARY KEY,
 			project_dir TEXT NOT NULL,
@@ -10184,6 +10344,10 @@ function initSchema(db) {
 			actor_id TEXT NOT NULL,
 			timestamp INTEGER NOT NULL,
 			data JSON NOT NULL,
+			-- Harness-native Prompt identity (Claude prompt_id): a nullable
+			-- correlation key, NOT the Run identity (that stays run_id). Unset for
+			-- pre-prompt bootstrap + harnesses/versions without it (ADR 0009).
+			prompt_id TEXT,
 			FOREIGN KEY (runtime_event_id) REFERENCES runtime_events(id)
 		);
 
@@ -10216,45 +10380,6 @@ function initSchema(db) {
 			FOREIGN KEY (session_id) REFERENCES session(id)
 		);
 
-		-- Channel I/O ledger: every inbound chat normalized by an adapter and every
-		-- outbound chat dispatched back to a provider gets one row. Idempotency
-		-- key prevents double-delivery on retry/restart; session_id ties chat to a
-		-- particular Athena interactive runtime when known.
-		CREATE TABLE IF NOT EXISTS channel_messages (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			channel_id TEXT NOT NULL,
-			account_id TEXT NOT NULL,
-			peer_id TEXT,
-			room_id TEXT,
-			thread_id TEXT,
-			provider_message_id TEXT NOT NULL,
-			direction TEXT NOT NULL CHECK(direction IN ('in','out')),
-			session_id TEXT REFERENCES adapter_sessions(session_id),
-			agent_id TEXT,
-			idempotency_key TEXT,
-			feed_event_id TEXT,
-			created_at INTEGER NOT NULL
-		);
-
-		-- Audit log for cloud function invocations brokered by the gateway. One
-		-- row per invocation across all callers (agent tool, /run channel cmd,
-		-- hook helper). Idempotency cache is in-memory + write-through here.
-		CREATE TABLE IF NOT EXISTS gateway_function_invocations (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name TEXT NOT NULL,
-			caller_kind TEXT NOT NULL CHECK(caller_kind IN ('agent','channel','hook')),
-			session_id TEXT REFERENCES adapter_sessions(session_id),
-			agent_id TEXT,
-			idempotency_key TEXT,
-			request_hash TEXT NOT NULL,
-			status TEXT NOT NULL CHECK(status IN ('pending','ok','error','timeout')),
-			http_status INTEGER,
-			duration_ms INTEGER,
-			error TEXT,
-			started_at INTEGER NOT NULL,
-			completed_at INTEGER
-		);
-
 		-- Durable retry queue for outbound channel sends. Drained by the gateway
 		-- daemon on startup and after transient send failures.
 		CREATE TABLE IF NOT EXISTS channel_outbox (
@@ -10274,127 +10399,91 @@ function initSchema(db) {
 		CREATE UNIQUE INDEX IF NOT EXISTS idx_feed_seq ON feed_events(seq);
 		CREATE INDEX IF NOT EXISTS idx_runtime_seq ON runtime_events(seq);
 		CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
-		CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_messages_idem
-			ON channel_messages(channel_id, account_id, idempotency_key)
-			WHERE idempotency_key IS NOT NULL;
-		CREATE INDEX IF NOT EXISTS idx_channel_messages_session_key
-			ON channel_messages(channel_id, account_id, peer_id, room_id, thread_id, created_at);
-		CREATE UNIQUE INDEX IF NOT EXISTS idx_fn_idem
-			ON gateway_function_invocations(name, idempotency_key)
-			WHERE idempotency_key IS NOT NULL;
 		CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
 	`);
-  const existing = db.prepare("SELECT version FROM schema_version").get();
-  if (existing && existing.version > SCHEMA_VERSION) {
-    throw new Error(
-      `Database has newer schema version ${existing.version} (expected <= ${SCHEMA_VERSION}). Update athena-cli to open this session.`
+  if (fromVersion === void 0 || fromVersion >= 7) {
+    db.exec(
+      "CREATE INDEX IF NOT EXISTS idx_feed_prompt ON feed_events(prompt_id);"
     );
   }
-  if (!existing) {
-    db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(
-      SCHEMA_VERSION
+  if (fromVersion === void 0) return;
+  if (fromVersion >= SCHEMA_VERSION) return;
+  if (fromVersion < 2) {
+    throw new Error(
+      `Session database is at schema version ${fromVersion} which predates the first release. Delete the session database and start fresh.`
     );
-  } else if (existing.version < SCHEMA_VERSION) {
-    if (existing.version < 2) {
-      throw new Error(
-        `Session database is at schema version ${existing.version} which predates the first release. Delete the session database and start fresh.`
-      );
-    }
-    if (existing.version === 2) {
-      db.exec(`
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_input INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_output INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_read INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_write INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_size INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
-				UPDATE schema_version SET version = 4;
-			`);
-    }
-    if (existing.version === 3) {
-      db.exec(`
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
-				UPDATE schema_version SET version = 4;
-			`);
-    }
-    const currentVersion = db.prepare("SELECT version FROM schema_version").get().version;
-    if (currentVersion === 4) {
-      db.exec(`
-				CREATE TABLE IF NOT EXISTS workflow_runs (
-					id TEXT PRIMARY KEY,
-					session_id TEXT NOT NULL,
-					workflow_name TEXT,
-					started_at INTEGER NOT NULL,
-					ended_at INTEGER,
-					iteration INTEGER NOT NULL DEFAULT 0,
-					max_iterations INTEGER NOT NULL DEFAULT 1,
-					status TEXT NOT NULL DEFAULT 'running',
-					stop_reason TEXT,
-					tracker_path TEXT,
-					FOREIGN KEY (session_id) REFERENCES session(id)
-				);
-				CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
-				ALTER TABLE adapter_sessions ADD COLUMN run_id TEXT REFERENCES workflow_runs(id);
-				UPDATE schema_version SET version = 5;
-			`);
-    }
-    const versionAfterV5 = db.prepare("SELECT version FROM schema_version").get().version;
-    if (versionAfterV5 === 5) {
-      db.exec(`
-				CREATE TABLE IF NOT EXISTS channel_messages (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					channel_id TEXT NOT NULL,
-					account_id TEXT NOT NULL,
-					peer_id TEXT,
-					room_id TEXT,
-					thread_id TEXT,
-					provider_message_id TEXT NOT NULL,
-					direction TEXT NOT NULL CHECK(direction IN ('in','out')),
-					session_id TEXT REFERENCES adapter_sessions(session_id),
-					agent_id TEXT,
-					idempotency_key TEXT,
-					feed_event_id TEXT,
-					created_at INTEGER NOT NULL
-				);
-				CREATE TABLE IF NOT EXISTS gateway_function_invocations (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					name TEXT NOT NULL,
-					caller_kind TEXT NOT NULL CHECK(caller_kind IN ('agent','channel','hook')),
-					session_id TEXT REFERENCES adapter_sessions(session_id),
-					agent_id TEXT,
-					idempotency_key TEXT,
-					request_hash TEXT NOT NULL,
-					status TEXT NOT NULL CHECK(status IN ('pending','ok','error','timeout')),
-					http_status INTEGER,
-					duration_ms INTEGER,
-					error TEXT,
-					started_at INTEGER NOT NULL,
-					completed_at INTEGER
-				);
-				CREATE TABLE IF NOT EXISTS channel_outbox (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					channel_id TEXT NOT NULL,
-					account_id TEXT NOT NULL,
-					payload_json TEXT NOT NULL,
-					attempt INTEGER NOT NULL DEFAULT 0,
-					next_attempt_at INTEGER NOT NULL,
-					last_error TEXT,
-					created_at INTEGER NOT NULL
-				);
-				CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_messages_idem
-					ON channel_messages(channel_id, account_id, idempotency_key)
-					WHERE idempotency_key IS NOT NULL;
-				CREATE INDEX IF NOT EXISTS idx_channel_messages_session_key
-					ON channel_messages(channel_id, account_id, peer_id, room_id, thread_id, created_at);
-				CREATE UNIQUE INDEX IF NOT EXISTS idx_fn_idem
-					ON gateway_function_invocations(name, idempotency_key)
-					WHERE idempotency_key IS NOT NULL;
-				CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
-				UPDATE schema_version SET version = 6;
-			`);
-    }
   }
-}
+  if (fromVersion === 2) {
+    db.exec(`
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_input INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_output INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_read INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_write INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_size INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
+			UPDATE schema_version SET version = 4;
+		`);
+  }
+  if (fromVersion === 3) {
+    db.exec(`
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
+			UPDATE schema_version SET version = 4;
+		`);
+  }
+  const currentVersion = db.prepare("SELECT version FROM schema_version").get().version;
+  if (currentVersion === 4) {
+    db.exec(`
+			CREATE TABLE IF NOT EXISTS workflow_runs (
+				id TEXT PRIMARY KEY,
+				session_id TEXT NOT NULL,
+				workflow_name TEXT,
+				started_at INTEGER NOT NULL,
+				ended_at INTEGER,
+				iteration INTEGER NOT NULL DEFAULT 0,
+				max_iterations INTEGER NOT NULL DEFAULT 1,
+				status TEXT NOT NULL DEFAULT 'running',
+				stop_reason TEXT,
+				tracker_path TEXT,
+				FOREIGN KEY (session_id) REFERENCES session(id)
+			);
+			CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
+			ALTER TABLE adapter_sessions ADD COLUMN run_id TEXT REFERENCES workflow_runs(id);
+			UPDATE schema_version SET version = 5;
+		`);
+  }
+  const versionAfterV5 = db.prepare("SELECT version FROM schema_version").get().version;
+  if (versionAfterV5 === 5) {
+    db.exec(`
+			CREATE TABLE IF NOT EXISTS channel_outbox (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				channel_id TEXT NOT NULL,
+				account_id TEXT NOT NULL,
+				payload_json TEXT NOT NULL,
+				attempt INTEGER NOT NULL DEFAULT 0,
+				next_attempt_at INTEGER NOT NULL,
+				last_error TEXT,
+				created_at INTEGER NOT NULL
+			);
+			CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
+			UPDATE schema_version SET version = 6;
+		`);
+  }
+  const versionAfterV6 = db.prepare("SELECT version FROM schema_version").get().version;
+  if (versionAfterV6 === 6) {
+    db.exec(`
+			ALTER TABLE feed_events ADD COLUMN prompt_id TEXT;
+			CREATE INDEX IF NOT EXISTS idx_feed_prompt ON feed_events(prompt_id);
+			UPDATE schema_version SET version = 7;
+		`);
+  }
+};
+var SESSION_SCHEMA = {
+  version: SCHEMA_VERSION,
+  migrate: applySessionSchema,
+  onNewerVersion: (found, expected) => new Error(
+    `Database has newer schema version ${found} (expected <= ${expected}). Update athena-cli to open this session.`
+  )
+};
 
 // src/infra/sessions/types.ts
 function rowToAthenaSession(row, adapterSessionIds, firstPrompt) {
@@ -10412,11 +10501,11 @@ function rowToAthenaSession(row, adapterSessionIds, firstPrompt) {
 
 // src/infra/sessions/store.ts
 function createSessionStore(opts) {
-  if (opts.dbPath !== ":memory:") {
-    fs17.mkdirSync(path14.dirname(opts.dbPath), { recursive: true });
-  }
-  const db = new Database(opts.dbPath);
-  initSchema(db);
+  const db = openVersionedDb(opts.dbPath, {
+    ...SESSION_SCHEMA,
+    foreignKeys: true,
+    ensureDir: true
+  });
   if (opts.dbPath !== ":memory:") {
     db.pragma("locking_mode = EXCLUSIVE");
     db.exec("BEGIN IMMEDIATE; COMMIT");
@@ -10443,8 +10532,8 @@ function createSessionStore(opts) {
 		 VALUES (?, ?, ?, ?, ?, ?)`
   );
   const insertFeedEvent = db.prepare(
-    `INSERT OR IGNORE INTO feed_events (event_id, runtime_event_id, seq, kind, run_id, actor_id, timestamp, data)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    `INSERT OR IGNORE INTO feed_events (event_id, runtime_event_id, seq, kind, run_id, actor_id, timestamp, data, prompt_id)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
   );
   const insertAdapterSession = db.prepare(
     `INSERT OR IGNORE INTO adapter_sessions (session_id, started_at)
@@ -10499,7 +10588,8 @@ function createSessionStore(opts) {
           fe.run_id,
           fe.actor_id,
           fe.ts,
-          JSON.stringify(fe)
+          JSON.stringify(fe),
+          fe.prompt_id ?? null
         );
       }
       updateEventCount.run(feedEvents.length, opts.sessionId);
@@ -10515,7 +10605,8 @@ function createSessionStore(opts) {
         fe.run_id,
         fe.actor_id,
         fe.ts,
-        JSON.stringify(fe)
+        JSON.stringify(fe),
+        fe.prompt_id ?? null
       );
     }
     updateEventCount.run(feedEvents.length, opts.sessionId);
@@ -10687,9 +10778,6 @@ function createSessionStore(opts) {
   };
 }
 
-// src/infra/sessions/hookAudit.ts
-import Database2 from "better-sqlite3";
-
 // src/core/feed/filter.ts
 var TASK_TOOL_NAMES = /* @__PURE__ */ new Set([
   "TodoWrite",
@@ -11365,8 +11453,8 @@ var PRIMARY_INPUT_EXTRACTORS = {
     return compactText(colonIdx >= 0 ? name.slice(colonIdx + 1) : name, 80);
   },
   NotebookEdit: (input) => {
-    const path22 = String(input.notebook_path ?? "");
-    return path22 ? shortenPath(path22) : "";
+    const path21 = String(input.notebook_path ?? "");
+    return path21 ? shortenPath(path21) : "";
   },
   AskUserQuestion: (input) => {
     const questions = input.questions;
@@ -12352,6 +12440,13 @@ var stopFailure = defaultRenderer(
 var permissionDenied = defaultRenderer(
   (event) => `${event.data.tool_name}${event.data.reason ? `: ${event.data.reason}` : ""}`
 );
+var promptExpansion = defaultRenderer(
+  (event) => event.data.command_name ? `/${event.data.command_name}${event.data.command_args ? ` ${event.data.command_args}` : ""}` : event.data.expansion_type ?? ""
+);
+var toolBatch = defaultRenderer((event) => {
+  const names = event.data.tool_calls.map((call) => call.tool_name).filter((name) => Boolean(name));
+  return names.length > 0 ? names.join(", ") : "";
+});
 var elicitationRequest = defaultRenderer((event) => `elicitation from ${event.data.mcp_server}`);
 var elicitationResult = defaultRenderer(
   (event) => `${event.data.mcp_server} \u2192 ${event.data.action}`
@@ -12400,6 +12495,7 @@ var RENDERERS = {
   "tool.delta": toolDelta,
   "tool.pre": toolPre,
   "tool.post": toolPost,
+  "tool.batch": toolBatch,
   "tool.failure": toolFailure,
   "permission.request": permissionRequest,
   "permission.decision": permissionDecision,
@@ -12439,6 +12535,7 @@ var RENDERERS = {
   "worktree.remove": worktreeRemove,
   "stop.failure": stopFailure,
   "permission.denied": permissionDenied,
+  "prompt.expansion": promptExpansion,
   "elicitation.request": elicitationRequest,
   "elicitation.result": elicitationResult,
   "channel.permission.relayed": channelPermissionRelayed,
@@ -12637,16 +12734,16 @@ function extractDomain(url) {
   }
 }
 function filePathSegments(input) {
-  const path22 = prop2(input, "file_path") ?? prop2(input, "notebook_path") ?? "";
-  if (typeof path22 !== "string" || !path22) return [];
-  const { prefix, filename } = shortenPathStructured(path22);
+  const path21 = prop2(input, "file_path") ?? prop2(input, "notebook_path") ?? "";
+  if (typeof path21 !== "string" || !path21) return [];
+  const { prefix, filename } = shortenPathStructured(path21);
   if (prefix && filename) {
     return [
       { text: prefix, role: "target" },
       { text: filename, role: "filename" }
     ];
   }
-  return [{ text: filename || path22, role: "filename" }];
+  return [{ text: filename || path21, role: "filename" }];
 }
 function grepSegments(input) {
   const pattern = String(prop2(input, "pattern") ?? "");
@@ -13280,6 +13377,7 @@ function resolveEventToolColumn(event) {
     case "tool.delta":
     case "tool.pre":
     case "tool.post":
+    case "tool.batch":
     case "tool.failure":
     case "permission.decision":
     case "permission.denied":
@@ -13307,6 +13405,7 @@ function resolveEventToolColumn(event) {
     case "todo.done":
     case "agent.message":
     case "teammate.idle":
+    case "prompt.expansion":
     case "task.created":
     case "task.completed":
     case "config.change":
@@ -13779,57 +13878,93 @@ ${details}` : entry.summary;
   }
 };
 
+// src/infra/sessions/sessionDbReader.ts
+import Database from "better-sqlite3";
+function openSessionDbReadonly(dbPath, options = {}) {
+  const db = new Database(dbPath, {
+    readonly: true,
+    ...options.fileMustExist ? { fileMustExist: true } : {}
+  });
+  return {
+    schemaVersion() {
+      const row = db.prepare("SELECT version FROM schema_version").get();
+      return row?.version;
+    },
+    sessionRow() {
+      return db.prepare("SELECT * FROM session LIMIT 1").get();
+    },
+    adapterSessionIds() {
+      const rows = db.prepare("SELECT session_id FROM adapter_sessions ORDER BY started_at").all();
+      return rows.map((r) => r.session_id);
+    },
+    firstUserPrompt() {
+      const row = db.prepare(
+        `SELECT json_extract(payload, '$.data.prompt') as prompt FROM runtime_events WHERE hook_name = 'UserPromptSubmit' ORDER BY seq ASC LIMIT 1`
+      ).get();
+      return row?.prompt ?? void 0;
+    },
+    runtimeHookCounts() {
+      const rows = db.prepare(
+        "SELECT hook_name, COUNT(*) AS count FROM runtime_events GROUP BY hook_name"
+      ).all();
+      const counts = {};
+      for (const row of rows) counts[row.hook_name] = row.count;
+      return counts;
+    },
+    feedEvents() {
+      const rows = db.prepare("SELECT data FROM feed_events ORDER BY seq").all();
+      return rows.map((r) => JSON.parse(r.data));
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+
 // src/infra/sessions/registry.ts
-import fs18 from "fs";
+import fs17 from "fs";
 import os11 from "os";
-import path15 from "path";
-import Database3 from "better-sqlite3";
+import path14 from "path";
 function sessionsDir() {
-  return path15.join(os11.homedir(), ".config", "athena", "sessions");
+  return path14.join(os11.homedir(), ".config", "athena", "sessions");
 }
 function sessionDbPath(sessionId) {
-  return path15.join(sessionsDir(), sessionId, "session.db");
+  return path14.join(sessionsDir(), sessionId, "session.db");
 }
 function readSessionFromDb(dbPath) {
-  if (!fs18.existsSync(dbPath)) return null;
-  let db;
+  if (!fs17.existsSync(dbPath)) return null;
+  let reader;
   try {
-    db = new Database3(dbPath, { readonly: true });
-    const versionRow = db.prepare("SELECT version FROM schema_version").get();
-    if (versionRow && versionRow.version > SCHEMA_VERSION) {
+    reader = openSessionDbReadonly(dbPath);
+    const version = reader.schemaVersion();
+    if (version !== void 0 && version > SCHEMA_VERSION) {
       return null;
     }
-    const row = db.prepare("SELECT * FROM session LIMIT 1").get();
+    const row = reader.sessionRow();
     if (!row) return null;
-    const adapters = db.prepare("SELECT session_id FROM adapter_sessions ORDER BY started_at").all();
+    const adapterSessionIds = reader.adapterSessionIds();
     let firstPrompt;
     if (!row.label && (row.event_count ?? 0) > 0) {
-      const promptRow = db.prepare(
-        `SELECT json_extract(payload, '$.data.prompt') as prompt FROM runtime_events WHERE hook_name = 'UserPromptSubmit' ORDER BY seq ASC LIMIT 1`
-      ).get();
-      if (promptRow?.prompt) {
-        firstPrompt = promptRow.prompt;
+      const prompt = reader.firstUserPrompt();
+      if (prompt) {
+        firstPrompt = prompt;
       }
     }
-    return rowToAthenaSession(
-      row,
-      adapters.map((a) => a.session_id),
-      firstPrompt
-    );
+    return rowToAthenaSession(row, adapterSessionIds, firstPrompt);
   } catch {
     return null;
   } finally {
-    db?.close();
+    reader?.close();
   }
 }
 function listSessions(projectDir) {
   const dir = sessionsDir();
-  if (!fs18.existsSync(dir)) return [];
-  const entries = fs18.readdirSync(dir, { withFileTypes: true });
+  if (!fs17.existsSync(dir)) return [];
+  const entries = fs17.readdirSync(dir, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dbPath = path15.join(dir, entry.name, "session.db");
+    const dbPath = path14.join(dir, entry.name, "session.db");
     const session = readSessionFromDb(dbPath);
     if (session && (session.eventCount ?? 0) > 0) {
       if (!projectDir || session.projectDir === projectDir) {
@@ -13974,7 +14109,7 @@ function extractRelayQuestions(event) {
 }
 
 // src/app/channels/gatewayControlClient.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 
 // src/gateway/control/client.ts
 import crypto from "crypto";
@@ -14082,6 +14217,7 @@ async function connect(opts) {
     preHelloResolve = (frame) => {
       clearTimeout(timer);
       preHelloAbort = null;
+      helloAcked = true;
       resolve(frame);
     };
     preHelloAbort = (err) => {
@@ -14104,7 +14240,6 @@ async function connect(opts) {
     }
     throw new GatewayProtocolError(String(msg));
   }
-  helloAcked = true;
   const request = async (kind, payload, reqOpts) => {
     const requestId = crypto.randomUUID();
     const envelope = {
@@ -14125,9 +14260,6 @@ async function connect(opts) {
     );
     connection.send(envelope);
     const res = await responsePromise;
-    if (res.request_id !== requestId) {
-      throw new GatewayProtocolError("response request_id mismatch");
-    }
     if (!res.ok) {
       throw new GatewayProtocolError(
         `${res.error.code}: ${res.error.message}`,
@@ -14164,93 +14296,6 @@ function isStringRecord(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 
-// src/gateway/transport/wsClient.ts
-import { WebSocket } from "ws";
-import { readFileSync as readFileSync2 } from "fs";
-function createWsClientTransport(opts) {
-  return {
-    kind: "ws",
-    connect: () => connectWs(opts)
-  };
-}
-function wsClientOptionsForEndpoint(input) {
-  return {
-    url: input.url,
-    ...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {},
-    ...input.tlsCaPath !== void 0 ? { tlsCaPath: input.tlsCaPath } : {}
-  };
-}
-async function connectWs(opts) {
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const wsOpts = opts.tlsCaPath ? { ca: readFileSync2(opts.tlsCaPath) } : {};
-  const ws = new WebSocket(opts.url, wsOpts);
-  await new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      ws.close();
-      reject(
-        new TransportUnreachableError(`connect timed out after ${timeoutMs}ms`)
-      );
-    }, timeoutMs);
-    ws.once("open", () => {
-      clearTimeout(timer);
-      resolve();
-    });
-    ws.once("error", (err) => {
-      clearTimeout(timer);
-      reject(
-        new TransportUnreachableError(
-          `gateway not reachable at ${opts.url}: ${err.message}`
-        )
-      );
-    });
-  });
-  return createWsConnection(ws, opts.url);
-}
-function createWsConnection(ws, peer) {
-  const frameHandlers = /* @__PURE__ */ new Set();
-  const closeHandlers = /* @__PURE__ */ new Set();
-  const errorHandlers = /* @__PURE__ */ new Set();
-  ws.on("message", (data) => {
-    let parsed;
-    try {
-      parsed = JSON.parse(data.toString());
-    } catch {
-      ws.close();
-      return;
-    }
-    traceGatewayFrame("ws-client", peer, "in", parsed);
-    for (const handler of frameHandlers) handler(parsed);
-  });
-  ws.on("error", (err) => {
-    for (const handler of errorHandlers) handler(err);
-  });
-  ws.on("close", () => {
-    for (const handler of closeHandlers) handler();
-  });
-  return {
-    kind: "ws",
-    peer,
-    send: (frame) => {
-      if (ws.readyState !== ws.OPEN) return;
-      traceGatewayFrame("ws-client", peer, "out", frame);
-      ws.send(JSON.stringify(frame));
-    },
-    close: () => ws.close(),
-    onFrame: (cb) => {
-      frameHandlers.add(cb);
-      return () => frameHandlers.delete(cb);
-    },
-    onClose: (cb) => {
-      closeHandlers.add(cb);
-      return () => closeHandlers.delete(cb);
-    },
-    onError: (cb) => {
-      errorHandlers.add(cb);
-      return () => errorHandlers.delete(cb);
-    }
-  };
-}
-
 // src/app/channels/gatewayControlClient.ts
 async function connectGatewayControlClient(opts) {
   const loadToken = opts.loadToken ?? defaultLoadToken;
@@ -14272,13 +14317,13 @@ async function connectGatewayControlClient(opts) {
   });
 }
 function defaultLoadToken(tokenPath) {
-  return readFileSync3(tokenPath, "utf8").trim();
+  return readFileSync2(tokenPath, "utf8").trim();
 }
 
 // src/infra/config/gatewayClient.ts
-import fs19 from "fs";
+import fs18 from "fs";
 import os12 from "os";
-import path16 from "path";
+import path15 from "path";
 
 // src/shared/gateway-protocol/endpoint.ts
 function parseRuntimeEndpoint(value) {
@@ -14334,16 +14379,16 @@ function isRecord2(value) {
 // src/infra/config/gatewayClient.ts
 function resolveGatewayClientConfigPath(env = process.env) {
   const home = env["HOME"] ?? os12.homedir();
-  return path16.join(home, ".config", "athena", "gateway.json");
+  return path15.join(home, ".config", "athena", "gateway.json");
 }
 function readGatewayClientConfig(env = process.env) {
   const configPath = resolveGatewayClientConfigPath(env);
-  if (!fs19.existsSync(configPath)) {
+  if (!fs18.existsSync(configPath)) {
     return { mode: "local" };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs19.readFileSync(configPath, "utf-8"));
+    parsed = JSON.parse(fs18.readFileSync(configPath, "utf-8"));
   } catch (err) {
     throw new Error(
       `gateway client config ${configPath} is invalid JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -14360,16 +14405,16 @@ function readGatewayClientConfig(env = process.env) {
 function writeGatewayClientConfig(config, env = process.env) {
   const parsed = parseRuntimeEndpoint(config);
   const configPath = resolveGatewayClientConfigPath(env);
-  const dir = path16.dirname(configPath);
-  fs19.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs19.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
+  const dir = path15.dirname(configPath);
+  fs18.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs18.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
   if (process.platform !== "win32") {
     try {
-      fs19.chmodSync(dir, 448);
-      fs19.chmodSync(configPath, 384);
+      fs18.chmodSync(dir, 448);
+      fs18.chmodSync(configPath, 384);
     } catch {
     }
   }
@@ -14797,14 +14842,11 @@ function sleepOrAbort(ms, signal) {
 }
 
 // src/app/dashboard/dashboardFeedPublisher.ts
-import Database4 from "better-sqlite3";
 function dashboardFeedOutboxPath() {
   return `${ensureDaemonStateDir().dir}/dashboard-feed-outbox.db`;
 }
 function initOutboxSchema(db) {
   db.exec(`
-		PRAGMA journal_mode = WAL;
-
 		CREATE TABLE IF NOT EXISTS dashboard_feed_outbox (
 			delivery_seq INTEGER PRIMARY KEY AUTOINCREMENT,
 			instance_id TEXT NOT NULL,
@@ -14838,8 +14880,9 @@ function makeEnvelope(input) {
   };
 }
 function createDashboardFeedOutbox(options = {}) {
-  const db = new Database4(options.dbPath ?? dashboardFeedOutboxPath());
-  initOutboxSchema(db);
+  const db = openVersionedDb(options.dbPath ?? dashboardFeedOutboxPath(), {
+    migrate: initOutboxSchema
+  });
   const insert = db.prepare(`
 		INSERT OR IGNORE INTO dashboard_feed_outbox (
 			instance_id,
@@ -14949,91 +14992,342 @@ function createDashboardFeedOutbox(options = {}) {
     close() {
       db.close();
     }
-  };
-}
-
-// src/app/dashboard/pairedFeedPublisher.ts
-var DEFAULT_DRAIN_INTERVAL_MS = 1e3;
-function createPairedFeedPublisher(options = {}) {
-  const readConfig2 = options.readConfig ?? (() => readDashboardClientConfig());
-  const now = options.now ?? (() => Date.now());
-  const onError = options.onError ?? (() => {
-  });
-  const drainIntervalMs = options.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS;
-  let ownedOutbox = null;
-  let transport = null;
-  let drainTimer = null;
-  function getOutbox() {
-    if (options.outbox) return options.outbox;
-    ownedOutbox ??= createDashboardFeedOutbox();
-    return ownedOutbox;
+  };
+}
+
+// src/app/dashboard/pairedFeedPublisher.ts
+var DEFAULT_DRAIN_INTERVAL_MS = 1e3;
+function createPairedFeedPublisher(options = {}) {
+  const readConfig2 = options.readConfig ?? (() => readDashboardClientConfig());
+  const now = options.now ?? (() => Date.now());
+  const onError = options.onError ?? (() => {
+  });
+  const drainIntervalMs = options.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS;
+  let ownedOutbox = null;
+  let transport = null;
+  let drainTimer = null;
+  function getOutbox() {
+    if (options.outbox) return options.outbox;
+    ownedOutbox ??= createDashboardFeedOutbox();
+    return ownedOutbox;
+  }
+  function clearDrainTimer() {
+    if (!drainTimer) return;
+    clearInterval(drainTimer);
+    drainTimer = null;
+  }
+  function drain(force = false) {
+    if (!transport) return;
+    const rows = getOutbox().pendingBatch({
+      limit: 100,
+      now: force ? Number.POSITIVE_INFINITY : now()
+    });
+    for (const row of rows) {
+      transport.sendFeedEvent({
+        deliverySeq: row.deliverySeq,
+        envelope: row.envelope
+      });
+      getOutbox().markAttempted({
+        deliverySeq: row.deliverySeq,
+        nextAttemptAt: now() + Math.min(3e4, (row.attempt + 1) * 1e3)
+      });
+    }
+  }
+  function startDrainTimer() {
+    clearDrainTimer();
+    const timer = setInterval(drain, drainIntervalMs);
+    timer.unref();
+    drainTimer = timer;
+    drain(true);
+  }
+  return {
+    publish(input) {
+      if (input.feedEvents.length === 0) return;
+      try {
+        const config = readConfig2();
+        if (!config) return;
+        getOutbox().enqueue({
+          instanceId: config.instanceId,
+          athenaSessionId: input.athenaSessionId,
+          origin: input.origin,
+          feedEvents: input.feedEvents,
+          emittedAt: now()
+        });
+        drain();
+      } catch (err) {
+        onError(
+          `paired feed publish failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    },
+    attachTransport(nextTransport) {
+      transport = nextTransport;
+      startDrainTimer();
+    },
+    detachTransport() {
+      transport = null;
+      clearDrainTimer();
+    },
+    handleAck(frame) {
+      getOutbox().markAcked({
+        ...typeof frame.deliverySeq === "number" ? { deliverySeq: frame.deliverySeq } : {},
+        ...typeof frame.eventId === "string" ? { eventId: frame.eventId } : {}
+      });
+    },
+    close() {
+      this.detachTransport();
+      ownedOutbox?.close();
+    }
+  };
+}
+
+// src/core/controller/rules.ts
+function ruleMatches(ruleToolName, toolName) {
+  if (ruleToolName === "*") return true;
+  if (ruleToolName === toolName) return true;
+  if (ruleToolName.endsWith("__*")) {
+    const prefix = ruleToolName.slice(0, -1);
+    return toolName.startsWith(prefix);
+  }
+  return false;
+}
+function matchRule(rules, toolName) {
+  const denyMatch = rules.find(
+    (r) => r.action === "deny" && ruleMatches(r.toolName, toolName)
+  );
+  if (denyMatch) return denyMatch;
+  return rules.find(
+    (r) => r.action === "approve" && ruleMatches(r.toolName, toolName)
+  );
+}
+
+// src/core/controller/permission.ts
+var SESSION_APPROVAL_REQUEST_HOOKS = /* @__PURE__ */ new Set([
+  "item/commandExecution/requestApproval",
+  "item/fileChange/requestApproval",
+  "item/permissions/requestApproval"
+]);
+function isScopedPermissionsRequest(hookName) {
+  return hookName === "item/permissions/requestApproval";
+}
+function supportsSessionApproval(hookName) {
+  return hookName !== void 0 && SESSION_APPROVAL_REQUEST_HOOKS.has(hookName);
+}
+function extractPermissionSnapshot(event) {
+  const data = event.data;
+  const toolNameFromData = typeof data["tool_name"] === "string" ? data["tool_name"] : void 0;
+  const toolInputFromData = typeof data["tool_input"] === "object" && data["tool_input"] !== null ? data["tool_input"] : void 0;
+  const toolUseIdFromData = typeof data["tool_use_id"] === "string" ? data["tool_use_id"] : void 0;
+  return {
+    request_id: event.id,
+    ts: event.timestamp,
+    kind: event.kind,
+    hookName: event.hookName,
+    tool_name: event.toolName ?? toolNameFromData ?? "Unknown",
+    tool_input: toolInputFromData ?? {},
+    tool_use_id: event.toolUseId ?? toolUseIdFromData,
+    suggestions: data.permission_suggestions
+  };
+}
+
+// src/core/controller/runtimeController.ts
+function handleEvent(event, cb) {
+  const eventKind2 = event.kind;
+  const isScoped = isScopedPermissionsRequest(event.hookName);
+  const eventData = event.data;
+  const toolName = event.toolName ?? (typeof eventData["tool_name"] === "string" ? eventData["tool_name"] : void 0);
+  if (eventKind2 === "permission.request" && toolName === "user_input") {
+    cb.enqueueQuestion(event.id);
+    cb.relayQuestion?.(event);
+    return { handled: true };
+  }
+  if (eventKind2 === "permission.request" && toolName) {
+    const rule = matchRule(cb.getRules(), toolName);
+    if (rule?.action === "deny") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: {
+            kind: "permission_deny",
+            reason: `Blocked by rule: ${rule.addedBy}`
+          }
+        }
+      };
+    }
+    if (rule?.action === "approve") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: { kind: "permission_allow" },
+          // Scoped Codex permission grants are session-scoped under
+          // auto rules so the same capability isn't re-prompted.
+          ...isScoped ? { data: { scope: "session" } } : {}
+        }
+      };
+    }
+    cb.enqueuePermission(event);
+    cb.relayPermission?.(event);
+    return { handled: true };
   }
-  function clearDrainTimer() {
-    if (!drainTimer) return;
-    clearInterval(drainTimer);
-    drainTimer = null;
+  if (eventKind2 === "tool.pre" && toolName === "AskUserQuestion") {
+    cb.enqueueQuestion(event.id);
+    cb.relayQuestion?.(event);
+    return { handled: true };
   }
-  function drain(force = false) {
-    if (!transport) return;
-    const rows = getOutbox().pendingBatch({
-      limit: 100,
-      now: force ? Number.POSITIVE_INFINITY : now()
-    });
-    for (const row of rows) {
-      transport.sendFeedEvent({
-        deliverySeq: row.deliverySeq,
-        envelope: row.envelope
-      });
-      getOutbox().markAttempted({
-        deliverySeq: row.deliverySeq,
-        nextAttemptAt: now() + Math.min(3e4, (row.attempt + 1) * 1e3)
-      });
+  if (eventKind2 === "tool.pre" && toolName) {
+    const rule = matchRule(cb.getRules(), toolName);
+    if (rule?.action === "deny") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: {
+            kind: "pre_tool_deny",
+            reason: `Blocked by rule: ${rule.addedBy}`
+          }
+        }
+      };
     }
+    return {
+      handled: true,
+      decision: {
+        type: "json",
+        source: "rule",
+        intent: { kind: "pre_tool_allow" }
+      }
+    };
   }
-  function startDrainTimer() {
-    clearDrainTimer();
-    const timer = setInterval(drain, drainIntervalMs);
-    timer.unref();
-    drainTimer = timer;
-    drain(true);
+  return { handled: false };
+}
+
+// src/core/feed/ingest.ts
+function ingestRuntimeEvent(event, ctx) {
+  const controllerResult = handleEvent(event, ctx.controllerCallbacks);
+  const feedEvents = ctx.mapper.mapEvent(event);
+  if (ctx.store) {
+    persistOrDegrade(
+      ctx.store,
+      () => ctx.store.recordEvent(event, feedEvents),
+      "recordEvent failed",
+      ctx.onPersistFailure
+    );
   }
   return {
-    publish(input) {
-      if (input.feedEvents.length === 0) return;
+    feedEvents,
+    decision: controllerResult.handled && controllerResult.decision ? controllerResult.decision : null
+  };
+}
+function ingestRuntimeDecision(eventId, decision, ctx) {
+  const feedEvent = ctx.mapper.mapDecision(eventId, decision);
+  if (feedEvent && ctx.store) {
+    persistOrDegrade(
+      ctx.store,
+      () => ctx.store.recordFeedEvents([feedEvent]),
+      "recordFeedEvents failed",
+      ctx.onPersistFailure
+    );
+  }
+  return feedEvent;
+}
+function persistOrDegrade(store, action, label, onFailure) {
+  try {
+    action();
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    const message = `${label}: ${reason}`;
+    store.markDegraded(message);
+    onFailure?.(message);
+  }
+}
+
+// src/app/runtime/runtimeEventLoop.ts
+var DASHBOARD_DECISION_POLL_LIMIT = 25;
+var DASHBOARD_DECISION_POLL_INTERVAL_MS = 1e3;
+function resolveIngest(source) {
+  return typeof source === "function" ? source() : source;
+}
+function attachRuntimeEventLoop(options) {
+  const { runtime } = options;
+  const runEvent = (event) => {
+    options.onEventReceived?.(event);
+    if (options.skipEvent?.(event)) return;
+    const { feedEvents, decision } = ingestRuntimeEvent(
+      event,
+      resolveIngest(options.ingest)
+    );
+    if (decision) {
+      runtime.sendDecision(event.id, decision);
+    }
+    options.emitEventFeed(feedEvents, event);
+  };
+  const runDecision = (eventId, decision) => {
+    options.onDecisionReceived?.(eventId, decision);
+    if (options.skipDecision?.(eventId, decision)) return;
+    options.beforeDecisionIngest?.(eventId, decision);
+    const feedEvent = ingestRuntimeDecision(
+      eventId,
+      decision,
+      resolveIngest(options.ingest)
+    );
+    options.emitDecisionFeed(feedEvent, eventId, decision);
+  };
+  const unsubscribeEvent = runtime.onEvent((event) => {
+    if (options.wrapEvent) {
+      options.wrapEvent(event, () => runEvent(event));
+    } else {
+      runEvent(event);
+    }
+  });
+  const unsubscribeDecision = runtime.onDecision((eventId, decision) => {
+    if (options.wrapDecision) {
+      options.wrapDecision(
+        eventId,
+        decision,
+        () => runDecision(eventId, decision)
+      );
+    } else {
+      runDecision(eventId, decision);
+    }
+  });
+  return {
+    stop() {
+      unsubscribeEvent();
+      unsubscribeDecision();
+    }
+  };
+}
+function startDashboardDecisionDrain(options) {
+  const { runtime, inbox, athenaSessionId } = options;
+  const drainOnce = () => {
+    const rows = inbox.pendingForSession({
+      athenaSessionId,
+      limit: DASHBOARD_DECISION_POLL_LIMIT
+    });
+    for (const row of rows) {
       try {
-        const config = readConfig2();
-        if (!config) return;
-        getOutbox().enqueue({
-          instanceId: config.instanceId,
-          athenaSessionId: input.athenaSessionId,
-          origin: input.origin,
-          feedEvents: input.feedEvents,
-          emittedAt: now()
-        });
-        drain();
-      } catch (err) {
-        onError(
-          `paired feed publish failed: ${err instanceof Error ? err.message : String(err)}`
-        );
+        runtime.sendDecision(row.requestId, row.decision);
+        inbox.markConsumed({ id: row.id });
+      } catch (error) {
+        if (!options.onError) throw error;
+        options.onError(error);
       }
-    },
-    attachTransport(nextTransport) {
-      transport = nextTransport;
-      startDrainTimer();
-    },
-    detachTransport() {
-      transport = null;
-      clearDrainTimer();
-    },
-    handleAck(frame) {
-      getOutbox().markAcked({
-        ...typeof frame.deliverySeq === "number" ? { deliverySeq: frame.deliverySeq } : {},
-        ...typeof frame.eventId === "string" ? { eventId: frame.eventId } : {}
-      });
-    },
-    close() {
-      this.detachTransport();
-      ownedOutbox?.close();
+    }
+  };
+  drainOnce();
+  const timer = setInterval(
+    drainOnce,
+    options.pollIntervalMs ?? DASHBOARD_DECISION_POLL_INTERVAL_MS
+  );
+  options.configureTimer?.(timer);
+  return {
+    drainOnce,
+    stop() {
+      clearInterval(timer);
     }
   };
 }
@@ -15088,8 +15382,8 @@ function exitCodeFromFailure(failure) {
 }
 
 // src/app/exec/output.ts
-import fs20 from "fs/promises";
-import path17 from "path";
+import fs19 from "fs/promises";
+import path16 from "path";
 
 // src/app/exec/jsonl.ts
 function createExecJsonlEvent(type, data, ts = Date.now()) {
@@ -15117,6 +15411,10 @@ function createExecOutputWriter(options) {
       if (!options.verbose) return;
       writeLine(options.stderr, `[athena exec] ${message}`);
     },
+    notice(message) {
+      if (options.json) return;
+      writeLine(options.stderr, `[athena exec] ${message}`);
+    },
     warn(message) {
       writeLine(options.stderr, `[athena exec] warning: ${message}`);
     },
@@ -15128,9 +15426,9 @@ function createExecOutputWriter(options) {
       writeLine(options.stdout, message);
     },
     async writeLastMessage(filePath, message) {
-      const absPath = path17.resolve(filePath);
-      await fs20.mkdir(path17.dirname(absPath), { recursive: true });
-      await fs20.writeFile(absPath, message, "utf-8");
+      const absPath = path16.resolve(filePath);
+      await fs19.mkdir(path16.dirname(absPath), { recursive: true });
+      await fs19.writeFile(absPath, message, "utf-8");
     }
   };
 }
@@ -15145,6 +15443,34 @@ var NULL_TOKENS3 = {
   contextSize: null,
   contextWindowSize: null
 };
+function formatPersonalCapabilityNotice(summary) {
+  const parts = [];
+  if (summary.mcpServers.length > 0) {
+    const list = summary.mcpServers.map((server) => `${server.name} [${server.sourceLayer}]`).join(", ");
+    parts.push(`mcp servers: ${list}`);
+  }
+  if (summary.skills.length > 0) {
+    const list = summary.skills.map((skill) => `${skill.name} [${skill.sourceLayer}]`).join(", ");
+    parts.push(`skills: ${list}`);
+  }
+  if (parts.length === 0) return null;
+  return `personal capabilities active \u2014 ${parts.join("; ")}`;
+}
+function formatCapabilityConflictNotice(summary) {
+  const parts = [];
+  if (summary.mcpServers.length > 0) {
+    const list = summary.mcpServers.map((server) => `${server.name} [${server.sourceLayer}]`).join(", ");
+    parts.push(`mcp servers: ${list}`);
+  }
+  if (summary.skills.length > 0) {
+    const list = summary.skills.map((skill) => `${skill.name} [${skill.sourceLayer}]`).join(", ");
+    parts.push(`skills: ${list}`);
+  }
+  if (parts.length === 0) return null;
+  return `personal capability conflicts \u2014 workflow plugin wins; shadowed: ${parts.join(
+    "; "
+  )}`;
+}
 function workflowFailure(state, message) {
   return {
     kind: "workflow",
@@ -15209,7 +15535,7 @@ async function runExec(options) {
     store = sessionStoreFactory({
       sessionId: athenaSessionId,
       projectDir: options.projectDir,
-      dbPath: options.ephemeral ? ":memory:" : path18.join(sessionsDir(), athenaSessionId, "session.db")
+      dbPath: options.ephemeral ? ":memory:" : path17.join(sessionsDir(), athenaSessionId, "session.db")
     });
   } catch (error) {
     const message = `Failed to initialize session store: ${error instanceof Error ? error.message : String(error)}`;
@@ -15300,23 +15626,6 @@ async function runExec(options) {
     ...options.signal ? { signal: options.signal } : {}
   };
   const dashboardDecisionInbox = options.dashboardDecisionInbox;
-  const applyPendingDashboardDecisions = () => {
-    if (!dashboardDecisionInbox) return;
-    const rows = dashboardDecisionInbox.pendingForSession({
-      athenaSessionId,
-      limit: 25
-    });
-    for (const row of rows) {
-      try {
-        runtime.sendDecision(row.requestId, row.decision);
-        dashboardDecisionInbox.markConsumed({ id: row.id });
-      } catch (error) {
-        output.warn(
-          `dashboard decision failed: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  };
   const linkedAdapterSessions = /* @__PURE__ */ new Set();
   function publishFeedEvents(feedEvents) {
     if (feedEvents.length === 0) return;
@@ -15377,60 +15686,57 @@ async function runExec(options) {
       });
     }
   };
-  const unsubscribeEvent = runtime.onEvent((runtimeEvent) => {
-    adapterSessionId = runtimeEvent.sessionId;
-    if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
-      linkedAdapterSessions.add(runtimeEvent.sessionId);
-      safePersist(
-        store,
-        () => store.linkAdapterSession(runtimeEvent.sessionId, activeRunId),
-        (message) => output.warn(message),
-        "linkAdapterSession failed"
-      );
-    }
-    output.emitJsonEvent("runtime.event", {
-      id: runtimeEvent.id,
-      kind: runtimeEvent.kind,
-      hookName: runtimeEvent.hookName,
-      sessionId: runtimeEvent.sessionId,
-      toolName: runtimeEvent.toolName ?? null,
-      data: runtimeEvent.data
-    });
-    if (latch.hasFailure()) return;
-    const { feedEvents, decision } = ingestRuntimeEvent(runtimeEvent, {
+  const runtimeEventLoop = attachRuntimeEventLoop({
+    runtime,
+    ingest: {
       mapper,
       store,
       controllerCallbacks,
       onPersistFailure: (message) => output.warn(message)
-    });
-    if (decision) {
-      runtime.sendDecision(runtimeEvent.id, decision);
-    }
-    for (const event of feedEvents) {
-      if (event.kind === "agent.message") {
-        mappedFinalMessage = event.data.message;
+    },
+    onEventReceived: (runtimeEvent) => {
+      adapterSessionId = runtimeEvent.sessionId;
+      if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
+        linkedAdapterSessions.add(runtimeEvent.sessionId);
+        safePersist(
+          store,
+          () => store.linkAdapterSession(runtimeEvent.sessionId, activeRunId),
+          (message) => output.warn(message),
+          "linkAdapterSession failed"
+        );
       }
-    }
-    publishFeedEvents(feedEvents);
-  });
-  const unsubscribeDecision = runtime.onDecision(
-    (eventId, decision) => {
+      output.emitJsonEvent("runtime.event", {
+        id: runtimeEvent.id,
+        kind: runtimeEvent.kind,
+        hookName: runtimeEvent.hookName,
+        sessionId: runtimeEvent.sessionId,
+        toolName: runtimeEvent.toolName ?? null,
+        data: runtimeEvent.data
+      });
+    },
+    skipEvent: () => latch.hasFailure(),
+    emitEventFeed: (feedEvents) => {
+      for (const event of feedEvents) {
+        if (event.kind === "agent.message") {
+          mappedFinalMessage = event.data.message;
+        }
+      }
+      publishFeedEvents(feedEvents);
+    },
+    onDecisionReceived: (eventId, decision) => {
       output.emitJsonEvent("runtime.decision", {
         eventId,
         decision
       });
-      const feedEvent = ingestRuntimeDecision(eventId, decision, {
-        mapper,
-        store,
-        onPersistFailure: (message) => output.warn(message)
-      });
+    },
+    emitDecisionFeed: (feedEvent) => {
       if (feedEvent) {
         publishFeedEvents([feedEvent]);
       }
     }
-  );
+  });
   let timeoutTimer;
-  let dashboardDecisionTimer;
+  let dashboardDecisionDrain;
   if (typeof options.timeoutMs === "number" && options.timeoutMs > 0) {
     timeoutTimer = setTimeout(() => {
       latch.register({
@@ -15439,11 +15745,29 @@ async function runExec(options) {
       });
     }, options.timeoutMs);
   }
+  const personalCapabilities = options.personalCapabilities ?? {
+    mcpServers: [],
+    skills: []
+  };
+  const capabilityConflicts = options.capabilityConflicts ?? {
+    mcpServers: [],
+    skills: []
+  };
   output.emitJsonEvent("exec.started", {
     projectDir: options.projectDir,
     harness: options.harness,
-    athenaSessionId: options.ephemeral ? null : athenaSessionId
+    athenaSessionId: options.ephemeral ? null : athenaSessionId,
+    personalCapabilities,
+    capabilityConflicts
   });
+  const personalCapabilityNotice = formatPersonalCapabilityNotice(personalCapabilities);
+  if (personalCapabilityNotice) {
+    output.notice(personalCapabilityNotice);
+  }
+  const capabilityConflictNotice = formatCapabilityConflictNotice(capabilityConflicts);
+  if (capabilityConflictNotice) {
+    output.notice(capabilityConflictNotice);
+  }
   try {
     await runtime.start();
     runtimeStarted = true;
@@ -15451,12 +15775,16 @@ async function runExec(options) {
       status: runtime.getStatus()
     });
     if (dashboardDecisionInbox) {
-      applyPendingDashboardDecisions();
-      dashboardDecisionTimer = setInterval(
-        applyPendingDashboardDecisions,
-        options.dashboardDecisionPollIntervalMs ?? 1e3
-      );
-      dashboardDecisionTimer.unref();
+      dashboardDecisionDrain = startDashboardDecisionDrain({
+        runtime,
+        inbox: dashboardDecisionInbox,
+        athenaSessionId,
+        ...options.dashboardDecisionPollIntervalMs !== void 0 ? { pollIntervalMs: options.dashboardDecisionPollIntervalMs } : {},
+        onError: (error) => output.warn(
+          `dashboard decision failed: ${error instanceof Error ? error.message : String(error)}`
+        ),
+        configureTimer: (timer) => timer.unref()
+      });
     }
     const workflow = options.workflow;
     output.emitJsonEvent("run.started", {
@@ -15543,14 +15871,11 @@ async function runExec(options) {
     if (timeoutTimer) {
       clearTimeout(timeoutTimer);
     }
-    if (dashboardDecisionTimer) {
-      clearInterval(dashboardDecisionTimer);
-    }
+    dashboardDecisionDrain?.stop();
     await writeLastMessageBeforeTerminalCompletion();
     await runBeforeTerminalCompletion();
     await sessionController.kill();
-    unsubscribeEvent();
-    unsubscribeDecision();
+    runtimeEventLoop.stop();
     if (runtimeStarted) {
       runtime.stop();
     }
@@ -15599,7 +15924,7 @@ async function runExec(options) {
 }
 
 // src/app/dashboard/instanceSocketClient.ts
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket } from "ws";
 var DEFAULT_HEARTBEAT_MS = 3e4;
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
 function instanceSocketUrl(dashboardUrl, instanceId) {
@@ -15616,7 +15941,7 @@ function createInstanceSocketClient(opts) {
   const log = opts.log ?? (() => {
   });
   const now = opts.now ?? (() => Date.now());
-  const makeWebSocket = opts.makeWebSocket ?? ((url, accessToken) => new WebSocket2(url, [accessToken]));
+  const makeWebSocket = opts.makeWebSocket ?? ((url, accessToken) => new WebSocket(url, [accessToken]));
   const frameHandlers = /* @__PURE__ */ new Set();
   const closeHandlers = /* @__PURE__ */ new Set();
   let ws = null;
@@ -15816,7 +16141,7 @@ function normalizeHarnessOverride(value) {
 }
 
 // src/app/dashboard/runStreamClient.ts
-import { WebSocket as WebSocket3 } from "ws";
+import { WebSocket as WebSocket2 } from "ws";
 var DEFAULT_RECONNECT_DELAYS_MS = [250, 1e3, 2e3, 5e3, 15e3];
 var DEFAULT_HEARTBEAT_MS2 = 3e4;
 var DEFAULT_WATCHDOG_MS = 9e4;
@@ -15829,7 +16154,7 @@ function createRunStreamClient(opts) {
   const heartbeatMs = opts.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_MS2;
   const watchdogMs = opts.watchdogTimeoutMs ?? DEFAULT_WATCHDOG_MS;
   const maxQueueSize = opts.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
-  const makeWebSocket = opts.makeWebSocket ?? ((url) => new WebSocket3(url));
+  const makeWebSocket = opts.makeWebSocket ?? ((url) => new WebSocket2(url));
   const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
   const clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
   let nextSeq = 1;
@@ -16169,8 +16494,8 @@ async function createRemoteRunEventPublisher({
 // src/app/dashboard/artifactCapture.ts
 import { execFile } from "child_process";
 import crypto3 from "crypto";
-import fs21 from "fs/promises";
-import path19 from "path";
+import fs20 from "fs/promises";
+import path18 from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 function parseArtifactUploadSpec(value) {
@@ -16353,21 +16678,21 @@ async function collectArtifactPayloads(input) {
   return payloads;
 }
 async function readWorkspaceFile(projectDir, rel) {
-  const absolute = path19.resolve(projectDir, rel);
-  const workspaceRoot = await fs21.realpath(projectDir);
+  const absolute = path18.resolve(projectDir, rel);
+  const workspaceRoot = await fs20.realpath(projectDir);
   let stat;
   try {
-    stat = await fs21.lstat(absolute);
+    stat = await fs20.lstat(absolute);
   } catch {
     return null;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return null;
-  const real = await fs21.realpath(absolute);
-  const relativeToRoot = path19.relative(workspaceRoot, real);
-  if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path19.sep}`) || path19.isAbsolute(relativeToRoot)) {
+  const real = await fs20.realpath(absolute);
+  const relativeToRoot = path18.relative(workspaceRoot, real);
+  if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path18.sep}`) || path18.isAbsolute(relativeToRoot)) {
     return null;
   }
-  return fs21.readFile(absolute);
+  return fs20.readFile(absolute);
 }
 async function gitDiffForAllowedPaths(input) {
   const paths = splitNul(await git(input.projectDir, input.nameArgs)).filter(
@@ -16458,13 +16783,13 @@ var DEFAULT_HARD_DENY = [
   ".ssh/**"
 ];
 function isAllowedRelativePath(rel, hardDeny) {
-  if (path19.isAbsolute(rel) || rel.includes("\0")) return false;
-  const normalized = path19.posix.normalize(rel.replaceAll(path19.sep, "/"));
+  if (path18.isAbsolute(rel) || rel.includes("\0")) return false;
+  const normalized = path18.posix.normalize(rel.replaceAll(path18.sep, "/"));
   if (normalized === ".." || normalized.startsWith("../")) return false;
   return !hardDeny.some((pattern) => matchesDenyPattern(normalized, pattern));
 }
 function matchesDenyPattern(rel, pattern) {
-  const normalized = pattern.replaceAll(path19.sep, "/");
+  const normalized = pattern.replaceAll(path18.sep, "/");
   if (normalized.includes("*") || normalized.includes("?")) {
     return globToRegExp(normalized).test(rel);
   }
@@ -16861,18 +17186,18 @@ async function executeRemoteAssignment({
 
 // src/infra/config/attachmentMirror.ts
 import crypto4 from "crypto";
-import fs22 from "fs";
+import fs21 from "fs";
 import os13 from "os";
-import path20 from "path";
+import path19 from "path";
 function attachmentMirrorPath(env = process.env) {
   const home = env["HOME"] ?? os13.homedir();
-  return path20.join(home, ".config", "athena", "attachments.json");
+  return path19.join(home, ".config", "athena", "attachments.json");
 }
 function readAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   let raw;
   try {
-    raw = fs22.readFileSync(file, "utf-8");
+    raw = fs21.readFileSync(file, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -16896,29 +17221,29 @@ function readAttachmentMirror(env = process.env) {
 function writeAttachmentMirror(mirror, env = process.env) {
   const validated = parseAttachmentMirror(mirror);
   const file = attachmentMirrorPath(env);
-  const dir = path20.dirname(file);
-  fs22.mkdirSync(dir, { recursive: true, mode: 448 });
+  const dir = path19.dirname(file);
+  fs21.mkdirSync(dir, { recursive: true, mode: 448 });
   const tmp = `${file}.${process.pid}.${crypto4.randomBytes(4).toString("hex")}.tmp`;
-  const fd = fs22.openSync(tmp, "w", 384);
+  const fd = fs21.openSync(tmp, "w", 384);
   try {
-    fs22.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
-    fs22.fsyncSync(fd);
+    fs21.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
+    fs21.fsyncSync(fd);
   } finally {
-    fs22.closeSync(fd);
+    fs21.closeSync(fd);
   }
   try {
-    fs22.renameSync(tmp, file);
+    fs21.renameSync(tmp, file);
   } catch (err) {
     try {
-      fs22.unlinkSync(tmp);
+      fs21.unlinkSync(tmp);
     } catch {
     }
     throw err;
   }
   if (process.platform !== "win32") {
     try {
-      fs22.chmodSync(dir, 448);
-      fs22.chmodSync(file, 384);
+      fs21.chmodSync(dir, 448);
+      fs21.chmodSync(file, 384);
     } catch {
     }
   }
@@ -16926,7 +17251,7 @@ function writeAttachmentMirror(mirror, env = process.env) {
 function removeAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   try {
-    fs22.unlinkSync(file);
+    fs21.unlinkSync(file);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -17054,7 +17379,6 @@ function createAttachmentReconciler(options) {
 }
 
 // src/app/dashboard/dashboardDecisionInbox.ts
-import Database5 from "better-sqlite3";
 function dashboardDecisionInboxPath() {
   return `${ensureDaemonStateDir().dir}/dashboard-decision-inbox.db`;
 }
@@ -17099,8 +17423,6 @@ function migrateLegacyUniqueConstraint(db) {
 }
 function initInboxSchema(db) {
   db.exec(`
-		PRAGMA journal_mode = WAL;
-
 		CREATE TABLE IF NOT EXISTS dashboard_decision_inbox (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			athena_session_id TEXT NOT NULL,
@@ -17122,8 +17444,9 @@ function initInboxSchema(db) {
 	`);
 }
 function createDashboardDecisionInbox(options = {}) {
-  const db = new Database5(options.dbPath ?? dashboardDecisionInboxPath());
-  initInboxSchema(db);
+  const db = openVersionedDb(options.dbPath ?? dashboardDecisionInboxPath(), {
+    migrate: initInboxSchema
+  });
   const upsertUnconsumed = db.prepare(`
 		INSERT INTO dashboard_decision_inbox (
 			athena_session_id,
@@ -17332,9 +17655,9 @@ function createDashboardPairedExecution(options) {
 }
 
 // src/app/dashboard/remoteWorkspaceResolver.ts
-import fs23 from "fs";
+import fs22 from "fs";
 import os14 from "os";
-import path21 from "path";
+import path20 from "path";
 function resolveRemoteWorkspace(assignment, options = {}) {
   const { spec, runId, runnerId } = assignment;
   if (spec.projectDir) {
@@ -17343,14 +17666,14 @@ function resolveRemoteWorkspace(assignment, options = {}) {
   const sessionId = spec.athenaSessionId ?? spec.sessionId;
   const deploymentSlug = deploymentSlugFromUrl(options.dashboardUrl);
   const stateDir = daemonStatePaths(options.env).dir;
-  const projectDir = sessionId ? path21.join(
+  const projectDir = sessionId ? path20.join(
     stateDir,
     "remote-workspaces",
     deploymentSlug,
     sanitizePathSegment(runnerId),
     "sessions",
     sanitizePathSegment(sessionId)
-  ) : path21.join(
+  ) : path20.join(
     stateDir,
     "remote-workspaces",
     deploymentSlug,
@@ -17359,10 +17682,10 @@ function resolveRemoteWorkspace(assignment, options = {}) {
     sanitizePathSegment(runId)
   );
   try {
-    fs23.mkdirSync(projectDir, { recursive: true, mode: 448 });
+    fs22.mkdirSync(projectDir, { recursive: true, mode: 448 });
     if (process.platform !== "win32") {
       try {
-        fs23.chmodSync(projectDir, 448);
+        fs22.chmodSync(projectDir, 448);
       } catch {
       }
     }
@@ -17378,8 +17701,8 @@ function resolveRemoteWorkspace(assignment, options = {}) {
   return validateProjectDir(projectDir, options.env);
 }
 function validateProjectDir(projectDir, env = process.env) {
-  const resolved = path21.resolve(projectDir);
-  if (!path21.isAbsolute(projectDir)) {
+  const resolved = path20.resolve(projectDir);
+  if (!path20.isAbsolute(projectDir)) {
     return {
       kind: "rejected",
       rejection: {
@@ -17388,7 +17711,7 @@ function validateProjectDir(projectDir, env = process.env) {
       }
     };
   }
-  const home = path21.resolve(env["HOME"] ?? os14.homedir());
+  const home = path20.resolve(env["HOME"] ?? os14.homedir());
   if (resolved === home) {
     return {
       kind: "rejected",
@@ -17400,7 +17723,7 @@ function validateProjectDir(projectDir, env = process.env) {
   }
   let stat;
   try {
-    stat = fs23.statSync(resolved);
+    stat = fs22.statSync(resolved);
   } catch {
     return {
       kind: "rejected",
@@ -17845,18 +18168,18 @@ async function runDashboardRuntimeDaemon(options = {}) {
 }
 
 // src/infra/daemon/pidLock.ts
-import fs24 from "fs";
+import fs23 from "fs";
 function acquirePidLock(pidPath) {
   const ownPid = process.pid;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const fd = fs24.openSync(pidPath, "wx", 384);
+      const fd = fs23.openSync(pidPath, "wx", 384);
       try {
-        fs24.writeSync(fd, `${ownPid}
+        fs23.writeSync(fd, `${ownPid}
 `);
-        fs24.fsyncSync(fd);
+        fs23.fsyncSync(fd);
       } finally {
-        fs24.closeSync(fd);
+        fs23.closeSync(fd);
       }
       return makeHandle(pidPath, ownPid);
     } catch (err) {
@@ -17870,7 +18193,7 @@ function acquirePidLock(pidPath) {
     }
     if (existing.state === "stale") {
       try {
-        fs24.unlinkSync(pidPath);
+        fs23.unlinkSync(pidPath);
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
       }
@@ -17884,7 +18207,7 @@ function acquirePidLock(pidPath) {
 function readPidLock(pidPath) {
   let raw;
   try {
-    raw = fs24.readFileSync(pidPath, "utf-8");
+    raw = fs23.readFileSync(pidPath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { state: "absent" };
@@ -17908,9 +18231,9 @@ function makeHandle(pidPath, pid) {
       if (released) return;
       released = true;
       try {
-        const raw = fs24.readFileSync(pidPath, "utf-8").trim();
+        const raw = fs23.readFileSync(pidPath, "utf-8").trim();
         if (raw === String(pid)) {
-          fs24.unlinkSync(pidPath);
+          fs23.unlinkSync(pidPath);
         }
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -17936,7 +18259,7 @@ function isProcessAlive(pid) {
 }
 
 // src/infra/daemon/udsIpc.ts
-import fs25 from "fs";
+import fs24 from "fs";
 import net2 from "net";
 
 // src/infra/daemon/udsFrameCodec.ts
@@ -17981,7 +18304,7 @@ async function startUdsServer(socketPath, handler, log) {
   });
   if (process.platform !== "win32") {
     try {
-      fs25.chmodSync(socketPath, 384);
+      fs24.chmodSync(socketPath, 384);
     } catch {
     }
   }
@@ -17991,7 +18314,7 @@ async function startUdsServer(socketPath, handler, log) {
         server.close(() => resolve());
       });
       try {
-        fs25.unlinkSync(socketPath);
+        fs24.unlinkSync(socketPath);
       } catch (err) {
         if (err.code !== "ENOENT") {
         }
@@ -18109,7 +18432,7 @@ async function sendUdsRequest(socketPath, request, options = {}) {
 async function unlinkStaleSocket(socketPath) {
   let stat;
   try {
-    stat = fs25.statSync(socketPath);
+    stat = fs24.statSync(socketPath);
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -18136,7 +18459,7 @@ async function unlinkStaleSocket(socketPath) {
       `uds path ${socketPath} is in use by another process; aborting`
     );
   }
-  fs25.unlinkSync(socketPath);
+  fs24.unlinkSync(socketPath);
 }
 
 export {
@@ -18154,8 +18477,8 @@ export {
   mergeFeedItems,
   buildPostByToolUseId,
   createFeedMapper,
-  ingestRuntimeEvent,
-  ingestRuntimeDecision,
+  attachRuntimeEventLoop,
+  startDashboardDecisionDrain,
   generateId,
   daemonStatePaths,
   ensureDaemonStateDir,
@@ -18196,8 +18519,6 @@ export {
   GatewayUnreachableError,
   GatewayUnauthorizedError,
   connect,
-  createWsClientTransport,
-  wsClientOptionsForEndpoint,
   isSupportedGatewayUrl,
   readGatewayClientConfig,
   writeGatewayClientConfig,
@@ -18225,6 +18546,8 @@ export {
   isBashToolResponse,
   resolveToolColumn,
   IndexedTimeline,
+  parseFrontmatter,
+  resolveEffectiveCapabilities,
   bootstrapRuntimeConfig,
   EXEC_EXIT_CODE,
   runExec,
@@ -18237,4 +18560,4 @@ export {
   startUdsServer,
   sendUdsRequest
 };
-//# sourceMappingURL=chunk-EC67PEFT.js.map
+//# sourceMappingURL=chunk-YZ7RCBKO.js.map