@drisp/cli 0.6.8 → 0.6.10

package/dist/cli.js

@@ -7,17 +7,25 @@ import {
   IndexedTimeline,
   PORTABLE_PROVIDER_ENV_VARS,
   RUN_EXIT_CODE,
+  ServiceNotEnabledError,
   attachRuntimeEventLoop,
+  behindMain,
   bootstrapRuntimeConfig,
   buildApiKeyHelperSettings,
   buildPhaseFeedEvent,
+  buildPlanSchema,
   buildPostByToolUseId,
   buildProbeConfigs,
   centerAnsi,
+  childWorktreePath,
   classifyFailure,
+  commandSchema,
+  commitBuildFiles,
   compactText,
   computeInputRows,
   connectAlreadyConnectedSchema,
+  connectCodeResponseSchema,
+  connectPendingResponseSchema,
   connectRedeemResponseSchema,
   connectStartResponseSchema,
   createFeedMapper,
@@ -26,10 +34,15 @@ import {
   createSessionStore,
   credentialHelperKey,
   cursorToVisualPosition,
+  defaultWorktreesRoot,
   detectClaudeVersion,
+  ensureBuildWorktree,
+  ensureChildWorktree,
   expandHome,
   extractFriendlyServerName,
   extractPermissionSnapshot,
+  fallbackBranch,
+  finalizePlan,
   fit,
   fitAnsi,
   forgetRunner,
@@ -46,12 +59,18 @@ import {
   getLatestRunForSession,
   getMostRecentAthenaSession,
   getSessionMeta,
+  git,
+  hasUncommittedWork,
   hintGlyphs,
+  historyRecordSchema,
   hubHttpUrl,
   identityHubOrigin,
   isBashToolResponse,
   isCommandPrefix,
+  isGitHubRepository,
   isScopedPermissionsRequest,
+  isStartAnswer,
+  lastCommitTouching,
   listAwaitingAttentionRuns,
   listHarnessAdapters,
   listHarnessCapabilities,
@@ -66,6 +85,8 @@ import {
   overriddenIdentityPath,
   parseFrontmatter,
   parseToolName,
+  planBuild,
+  planInputSchema,
   platformRunnerServices,
   probeSkipReason,
   processRegistry,
@@ -74,6 +95,8 @@ import {
   registerCleanupOnExit,
   releaseMcpAsset,
   renderInputLines,
+  repoLayoutAt,
+  repositoryBindingSchema,
   require_string_width,
   resolveClaudeBinary,
   resolveClaudeSettingsSurfacePaths,
@@ -88,12 +111,18 @@ import {
   runExec,
   runMachineRunners,
   runProbe,
+  runViewSchema,
+  runnerAdoptRequestSchema,
   runnerConfigDirectory,
   runnerConfigSchema,
+  runnerDisconnectPreviewSchema,
   runnerDisconnectResponseSchema,
   runnerIdentities,
+  runnerListEntrySchema,
+  runnerListSchema,
   runnerServiceUnit,
   runnerSoftwareVersion,
+  runnerUpdateRequestSchema,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
@@ -101,12 +130,14 @@ import {
   startDashboardDecisionDrain,
   startWorkflowExecution,
   supportsSessionApproval,
+  teamDefaultRequestSchema,
+  teamDefaultSchema,
   teamIdentityPath,
   todoGlyphSet,
   visualPositionToOffset,
   wrapText,
   writeIdentityOnce
-} from "./chunk-HN3WNQVY.js";
+} from "./chunk-BTHLAJV7.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -120,9 +151,21 @@ import {
   useTheme
 } from "./chunk-KPDCVR6Q.js";
 import {
+  BUILD_STRINGS,
+  CANNOT_PASS_TEMPLATE,
+  DESCRIPTION_TEMPLATE,
+  GATES,
+  LAYOUT_MARKERS,
+  NO_GATE_TEXT_TEMPLATE,
+  ORCHESTRATOR_LIMITS,
+  QA_SECTIONS,
+  RENDERER_RULES,
+  STAGE_TEMPLATE,
+  WORKFLOW_MD_TEMPLATE,
   collectMcpServersWithOptions,
   createSteerQueue,
   deserializeRunMemory,
+  external_exports,
   findMarketplaceRepoDir,
   gatherMarketplaceWorkflowSources,
   hasProjectWorkflow,
@@ -133,6 +176,7 @@ import {
   listMarketplaceWorkflows,
   listMarketplaceWorkflowsFromRepo,
   listWorkflows,
+  parseWorkflowConfig,
   projectConfigPath,
   pullMarketplaceRepo,
   readConfig,
@@ -145,10 +189,12 @@ import {
   resolveWorkflowMarketplaceSource,
   updateWorkflow,
   updateWorkflows,
+  verifyRendered,
   wakesFreshAfterHandover,
+  workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-CIPO2P2Q.js";
+} from "./chunk-YUVMVYUF.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -156,10 +202,10 @@ import {
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs6 from "fs";
+import fs9 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path6 from "path";
+import path9 from "path";
 import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
@@ -5278,14 +5324,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path7 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path10 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path7}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path10}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path7),
+    language: detectLanguage(path10),
     maxLines: 10
   };
 }
@@ -5811,10 +5857,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path7 = str(input, "path");
+      const path10 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path7) parts.push(`in ${path7}`);
+      if (path10) parts.push(`in ${path10}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -5916,6 +5962,14 @@ function eventLabel(event) {
       return event.data.task_subject || "Task Completed";
     case "config.change":
       return "Config Change";
+    case "instructions.loaded":
+      return "Instructions Loaded";
+    case "worktree.create":
+      return "Worktree Created";
+    case "worktree.remove":
+      return "Worktree Removed";
+    case "artifacts.manifest":
+      return "Artifacts Manifest";
     default:
       return "Event";
   }
@@ -5970,8 +6024,8 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
         event.data.tool_input
       );
       const header = buildCompactHeader(event, width, { subject, theme });
-      const json = JSON.stringify(event.data.tool_input, null, 2);
-      const requestLines = highlightCode(json, cw, "json");
+      const json2 = JSON.stringify(event.data.tool_input, null, 2);
+      const requestLines = highlightCode(json2, cw, "json");
       return buildResult(header, requestLines, true);
     }
     case "subagent.start": {
@@ -5994,8 +6048,8 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
       } else if (prompt) {
         content = renderMarkdownToLines(prompt, cw);
       } else {
-        const json = JSON.stringify(event.data, null, 2);
-        content = highlightCode(json, cw, "json");
+        const json2 = JSON.stringify(event.data, null, 2);
+        content = highlightCode(json2, cw, "json");
       }
       return buildResult(header, content, !prompt && !response);
     }
@@ -6104,8 +6158,8 @@ Named by Turn ${event.data.turn} of Workflow Run \`${event.data.runId}\`.`,
     case "elicitation.result":
     case "artifacts.manifest": {
       const header = buildCompactHeader(event, width, { theme });
-      const json = JSON.stringify(event.raw ?? event.data, null, 2);
-      const content = highlightCode(json, cw, "json");
+      const json2 = JSON.stringify(event.raw ?? event.data, null, 2);
+      const content = highlightCode(json2, cw, "json");
       return buildResult(header, content, true);
     }
     default: {
@@ -8411,8 +8465,8 @@ function renderHeaderLines(model, width, hasColor, theme) {
   const harnessText = `${style("Harness: ", palette.label)}${style(model.harness, palette.value)}`;
   const effortSuffix = model.effort_level ? style(` with ${model.effort_level} effort`, palette.label) : "";
   const modelText = `${style("Model: ", palette.label)}${style(formatModelName(model.model_name), palette.value)}${effortSuffix}`;
-  const tokenLabel = model.token_label ?? "Tokens";
-  const runLabel = model.run_label ?? "Runs";
+  const tokenLabel = model.token_label;
+  const runLabel = model.run_label;
   const leftTokens = [
     { text: athena, priority: 100 },
     { text: divider, priority: 5 },
@@ -12561,11 +12615,10 @@ function parseArgs(args, context) {
     } else if (arg === "--global") {
       global = true;
     } else if (arg === "--env") {
-      const value = args[i + 1];
-      if (value === void 0) {
+      if (i + 1 >= args.length) {
         return { error: `mcp ${context}: --env requires a KEY=VALUE argument` };
       }
-      env2.push(value);
+      env2.push(args[i + 1]);
       i++;
     } else if (arg.startsWith("--")) {
       return { error: `Unknown flag for mcp ${context}: ${arg}` };
@@ -13038,7 +13091,7 @@ var thisMachine = (installationId) => ({
   os: `${platform()} ${release()}`.slice(0, 64),
   softwareVersion: runnerSoftwareVersion
 });
-var post = (origin, path7, body) => fetch(new URL(path7, origin), {
+var post = (origin, path10, body) => fetch(new URL(path10, origin), {
   method: "POST",
   headers: { "Content-Type": "application/json" },
   body: JSON.stringify(body)
@@ -13057,8 +13110,8 @@ async function alreadyConnected(existing, { forTeam, ownIdentity }) {
   const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
   const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
   if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
-  const path7 = (own ?? forTeam(existing.orgId)[0])?.path;
-  return { status: "identity_unusable", ...runner, problem, ...path7 ? { path: path7 } : {} };
+  const path10 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path10 ? { path: path10 } : {} };
 }
 async function connectWithCode({
   code,
@@ -13130,20 +13183,20 @@ async function saveIdentity(origin, credential, { single, forTeam }, directory)
     name: credential.name
   });
   const replaced = [];
-  for (const { path: path8 } of forTeam(credential.orgId)) {
-    const aside = `${path8}.replaced-${Date.now()}`;
-    await rename(path8, aside);
+  for (const { path: path11 } of forTeam(credential.orgId)) {
+    const aside = `${path11}.replaced-${Date.now()}`;
+    await rename(path11, aside);
     replaced.push(aside);
   }
-  const path7 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  const path10 = single ?? teamIdentityPath(origin, credential.orgId, directory);
   try {
-    await writeIdentityOnce(path7, JSON.stringify(config, null, 2) + "\n");
+    await writeIdentityOnce(path10, JSON.stringify(config, null, 2) + "\n");
   } catch (error) {
     if (error.code === "EEXIST")
-      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path7} meanwhile; it was left unchanged.`);
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path10} meanwhile; it was left unchanged.`);
     throw error;
   }
-  return { status: "connected", config, path: path7, replaced };
+  return { status: "connected", config, path: path10, replaced };
 }
 function pathSegment(value) {
   const segment = encodeURIComponent(value);
@@ -13183,7 +13236,7 @@ async function refuseExisting(target) {
   throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
 }
 async function disconnectRunner({
-  identity: { path: path7, config },
+  identity: { path: path10, config },
   serviceManager,
   othersRemain
 }) {
@@ -13216,14 +13269,14 @@ async function disconnectRunner({
     await restore();
     throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
   }
-  await forgetRunner(path7);
+  await forgetRunner(path10);
   if (othersRemain) await restore();
   else await serviceManager?.remove();
   return result;
 }
 
 // src/app/entry/runnerCommandV2.ts
-var usage = `Usage: drisp runner [connect [<code>] --hub <url> [--foreground] [--replace] | disconnect [<team>] | status | recover | help]
+var usage = `Usage: drisp runner [connect [<code>] --hub <url> [--foreground] [--replace] | disconnect [<team>] | status | restart | recover | help]
 
 Connect this machine from Settings \u2192 Runners in the web console, which shows the
 command to paste here:
@@ -13239,8 +13292,11 @@ that runs this machine's Runner for every Team it serves, at login. Connecting a
 the same Team reports the Runner the machine already is and changes nothing. When this
 machine can no longer serve that Runner (its credential is gone or has lapsed), Connect
 says so without using the code, and --replace connects a new Runner in its place.
-drisp runner status lists the Teams and the service's state. --foreground skips the
-service and runs the Runner in this terminal, for containers and CI; drisp runner runs
+drisp runner status lists the Teams and the service's state. drisp runner restart
+rewrites the service definition for the CLI installed now and restarts the service
+(on Linux it also turns start-at-login back on), so run it after
+npm install -g @drisp/cli@latest; it never installs one, and it fails any Run in
+progress, so restart when no Run is executing. --foreground skips the service and runs the Runner in this terminal, for containers and CI; drisp runner runs
 every Team's Runner there again later. DRISP_HUB_URL may stand in for --hub, and
 DRISP_RUNNER_CONFIG selects one identity file of a separate installation instead, which
 gets its own service.
@@ -13267,6 +13323,7 @@ The code works once and expires in ${minutes} minutes. Waiting for approval\u202
   );
 }
 var serviceStarted = (service) => `The Runner runs as a background service (${service.kind} ${service.name}) and starts again at login.`;
+var notConnected = "This machine is not connected to a Team. Settings \u2192 Runners shows the command to connect it.";
 var servicesFor = (options) => options.services === void 0 ? platformRunnerServices() : options.services;
 async function serviceInstallation(config) {
   const single = overriddenIdentityPath();
@@ -13275,25 +13332,35 @@ async function serviceInstallation(config) {
     ...single ? { configPath: single } : {}
   };
 }
+async function installAndRestart(service, configPath, onInstalled = () => {
+}) {
+  await service.install(runnerServiceUnit(configPath));
+  onInstalled();
+  await service.restart();
+}
 async function ensureService(services, config, identityPath) {
   let service;
-  let installed = false;
+  const progress = { installed: false };
   try {
     const { installationId, configPath } = await serviceInstallation(config);
     service = services(installationId);
-    await service.install(runnerServiceUnit(configPath));
-    installed = true;
-    if ((await service.status()).running) await service.stop();
-    await service.start();
+    await installAndRestart(service, configPath, () => {
+      progress.installed = true;
+    });
     return service;
   } catch (error) {
+    if (error instanceof ServiceNotEnabledError && service)
+      throw new Error(
+        `Connected, and the Runner runs as a background service (${service.kind} ${service.name}). ${error.message}
+Run drisp runner restart to enable it again.`
+      );
     throw new Error(
       [
         `Connected, but the background service did not start: ${error instanceof Error ? error.message : String(error)}`,
         `The identity is saved to ${identityPath}: run drisp runner to run the Runner in the foreground.`,
         // launchd loads an installed LaunchAgent at the next login and RunAtLoad starts it. A systemd unit
-        // is enabled only by the start that just failed, so it has no such fallback.
-        ...installed && service?.kind === "launchd" ? [
+        // is enabled only by the restart that just failed, so it has no such fallback.
+        ...progress.installed && service?.kind === "launchd" ? [
           `The LaunchAgent ${service.name} is installed, so launchd starts the Runner at your next login.`
         ] : []
       ].join("\n")
@@ -13301,6 +13368,10 @@ async function ensureService(services, config, identityPath) {
   }
 }
 async function runRunnerCommandV2(input, options = {}) {
+  if (input.flags.help || input.subcommand === "help") {
+    process.stdout.write(usage);
+    return 0;
+  }
   try {
     if (input.flags.detach)
       throw new Error(
@@ -13308,7 +13379,8 @@ async function runRunnerCommandV2(input, options = {}) {
       );
     switch (input.subcommand) {
       case "connect": {
-        const [code, extra] = input.subcommandArgs;
+        const code = input.subcommandArgs.at(0);
+        const extra = input.subcommandArgs.at(1);
         if (extra) throw new Error(`Unexpected argument ${extra}.`);
         const hub = input.flags.hub ?? process.env["DRISP_HUB_URL"];
         if (!hub)
@@ -13350,18 +13422,18 @@ async function runRunnerCommandV2(input, options = {}) {
             `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-        const { config, path: path7, replaced } = outcome;
+        const { config, path: path10, replaced } = outcome;
         for (const aside of replaced)
           process.stdout.write(
             `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
 `
           );
         process.stdout.write(
-          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path7}.
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path10}.
 `
         );
         if (services) {
-          const service = await ensureService(services, config, path7);
+          const service = await ensureService(services, config, path10);
           process.stdout.write(`${serviceStarted(service)}
 `);
           return 0;
@@ -13370,7 +13442,7 @@ async function runRunnerCommandV2(input, options = {}) {
           process.stdout.write(
             "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
           );
-        await runConfiguredRunner(path7, options.signal);
+        await runConfiguredRunner(path10, options.signal);
         return 0;
       }
       case "disconnect": {
@@ -13430,10 +13502,7 @@ async function runRunnerCommandV2(input, options = {}) {
       }
       case "status": {
         const identities = await runnerIdentities();
-        if (!identities.length)
-          throw new Error(
-            "This machine is not connected to a Team. Settings \u2192 Runners shows the command to connect it."
-          );
+        if (!identities.length) throw new Error(notConnected);
         const services = servicesFor(options);
         const service = services ? services(
           (await serviceInstallation(identities[0].config)).installationId
@@ -13444,9 +13513,9 @@ async function runRunnerCommandV2(input, options = {}) {
               configured: true,
               // One entry per Team this machine serves; credentials are never printed.
               teams: identities.map(
-                ({ path: path7, config: { token: _token, ...config } }) => ({
+                ({ path: path10, config: { token: _token, ...config } }) => ({
                   ...config,
-                  path: path7
+                  path: path10
                 })
               ),
               service: service ? {
@@ -13462,15 +13531,24 @@ async function runRunnerCommandV2(input, options = {}) {
         );
         return 0;
       }
+      case "restart": {
+        const [extra] = input.subcommandArgs;
+        if (extra) throw new Error(`Unexpected argument ${extra}.`);
+        const { service, configPath } = await installedService(
+          servicesFor(options)
+        );
+        await installAndRestart(service, configPath);
+        process.stdout.write(
+          `Restarted the background service ${service.kind} ${service.name}.
+`
+        );
+        return 0;
+      }
       case "":
         await runMachineRunners(options.signal, {
           services: servicesFor(options)
         });
         return 0;
-      case "help":
-      case "--help":
-        process.stdout.write(usage);
-        return 0;
       default:
         throw new Error(
           `Unsupported v2 runner command: ${input.subcommand}.
@@ -13485,6 +13563,25 @@ ${usage}`
     return 1;
   }
 }
+async function installedService(services) {
+  const identities = await runnerIdentities();
+  if (!identities.length) throw new Error(notConnected);
+  const whose = overriddenIdentityPath() ? "the Runner installation DRISP_RUNNER_CONFIG selects" : "this machine's Runner";
+  const foreground = "drisp runner runs it in the foreground meanwhile.";
+  if (!services)
+    throw new Error(
+      `No background service is installed for ${whose}: there is no launchd or systemd --user here. ${foreground}`
+    );
+  const { installationId, configPath } = await serviceInstallation(
+    identities[0].config
+  );
+  const service = services(installationId);
+  if (!(await service.status()).installed)
+    throw new Error(
+      `No background service is installed for ${whose} (${service.kind} ${service.name}). drisp runner connect installs one when it connects to a Team (Settings \u2192 Runners shows the command); restart never installs one. ${foreground}`
+    );
+  return { service, ...configPath ? { configPath } : {} };
+}
 async function recoveryIdentity(runId) {
   const identities = await runnerIdentities();
   if (!identities.length)
@@ -13513,14 +13610,1248 @@ async function recoveryIdentity(runId) {
   throw new Error(`No Runner on this machine holds Run ${runId}.`);
 }
 
+// src/app/entry/buildCommand.ts
+import { execFileSync } from "child_process";
+
+// src/core/build/planCommand.ts
+import fs6 from "fs";
+import path6 from "path";
+
+// src/core/build/io.ts
+import fs5 from "fs";
+import path5 from "path";
+var BuildUsageError = class extends Error {
+};
+var PlanFailure = class extends Error {
+};
+function requireEnv(env2, name) {
+  const value = env2[name];
+  if (!value)
+    throw new BuildUsageError(
+      `${name} is not set: drisp build runs inside an Orchestrator Run.`
+    );
+  return value;
+}
+function readJson(file) {
+  try {
+    return JSON.parse(fs5.readFileSync(file, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeFile(file, content) {
+  fs5.mkdirSync(path5.dirname(file), { recursive: true });
+  fs5.writeFileSync(file, content, "utf-8");
+}
+var json = (value) => `${JSON.stringify(value, null, 2)}
+`;
+function readInput(file) {
+  const raw = readJson(file);
+  if (raw === void 0)
+    throw new PlanFailure(`Could not read plan-input.json at ${file}.`);
+  const parsed = planInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new PlanFailure(
+      `plan-input.json is invalid at ${issue.path.join(".") || "(root)"}: ${issue.message}`
+    );
+  }
+  return parsed.data;
+}
+
+// src/core/workflows/builtins/build-child/version.ts
+import { createHash } from "crypto";
+function computeTemplateVersion() {
+  const parts = [
+    WORKFLOW_MD_TEMPLATE,
+    STAGE_TEMPLATE,
+    CANNOT_PASS_TEMPLATE,
+    NO_GATE_TEXT_TEMPLATE,
+    DESCRIPTION_TEMPLATE,
+    JSON.stringify(QA_SECTIONS),
+    JSON.stringify(GATES),
+    JSON.stringify(RENDERER_RULES),
+    JSON.stringify(LAYOUT_MARKERS)
+  ];
+  const hash = createHash("sha256");
+  for (const part of parts) hash.update(`${part.length}:${part}`);
+  return hash.digest("hex");
+}
+var templateVersion = computeTemplateVersion();
+
+// src/core/build/planCommand.ts
+function checkGenerated(directory, workflow, host, layout) {
+  const workflowJson = fs6.readFileSync(
+    path6.join(directory, "workflow.json"),
+    "utf-8"
+  );
+  const workflowMd = fs6.readFileSync(
+    path6.join(directory, "workflow.md"),
+    "utf-8"
+  );
+  try {
+    parseWorkflowConfig(JSON.parse(workflowJson), {
+      instructions: workflowMd,
+      host
+    });
+  } catch (error) {
+    throw new PlanFailure(
+      `${workflow.identifier}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const verified = verifyRendered({
+    fill: workflow.fill,
+    layout,
+    workflowName: workflow.workflowName,
+    workflowJson,
+    workflowMd
+  });
+  if (!verified.ok)
+    throw new PlanFailure(
+      `${workflow.identifier}: the written ${verified.file} does not match what its fill renders.`
+    );
+}
+function runBuildPlan(deps) {
+  const orchestratorRunId = requireEnv(deps.env, "DRISP_RUN_ID");
+  const runnerId = requireEnv(deps.env, "DRISP_RUNNER_ID");
+  const artifacts = requireEnv(deps.env, "DRISP_RUN_ARTIFACTS");
+  const fixtureInput = deps.env["DRISP_BUILD_PLAN_INPUT"];
+  const inputPath = fixtureInput ?? deps.inputPath;
+  if (!inputPath)
+    throw new BuildUsageError("Usage: drisp build plan --input <path>");
+  const fail = (reason) => {
+    writeFile(path6.join(artifacts, "build_plan_error.json"), json({ reason }));
+    return { status: "failed", reason };
+  };
+  try {
+    if (!isGitHubRepository(deps.folder))
+      throw new PlanFailure(BUILD_STRINGS.notAGitHubRepository);
+    const input = readInput(path6.resolve(deps.folder, inputPath));
+    const worktree = ensureBuildWorktree({
+      folder: deps.folder,
+      slugId: input.project.slugId,
+      worktreesRoot: deps.worktreesRoot
+    });
+    const designDir = path6.join(
+      worktree.path,
+      ".athena",
+      "workflows",
+      input.project.slugId
+    );
+    writeFile(path6.join(designDir, "plan-input.json"), json(input));
+    const fixtureDir = fixtureInput ? path6.dirname(path6.resolve(fixtureInput)) : void 0;
+    const fillPath = (identifier) => path6.join(designDir, identifier, "fill.json");
+    const fills = Object.fromEntries(
+      input.issues.map((issue) => {
+        const fixture = fixtureDir ? path6.join(fixtureDir, "fills", `${issue.identifier}.json`) : void 0;
+        const file = fixture && fs6.existsSync(fixture) ? fixture : fillPath(issue.identifier);
+        return [issue.identifier, readJson(file)];
+      })
+    );
+    const fixturePullRequests = fixtureDir ? readJson(path6.join(fixtureDir, "pull-requests.json")) : void 0;
+    const pullRequests = fixturePullRequests ?? Object.fromEntries(
+      input.issues.filter(
+        (issue) => issue.branchName && issue.state.type !== "canceled" && !issue.labels.includes("ready-for-human")
+      ).map((issue) => [
+        issue.branchName,
+        deps.pullRequests(deps.folder, issue.branchName)
+      ])
+    );
+    const layout = repoLayoutAt(worktree.path, "HEAD");
+    const result = planBuild({
+      input,
+      fills,
+      pullRequests,
+      orchestratorRunId,
+      folder: deps.folder,
+      runnerId,
+      templateVersion,
+      layout
+    });
+    if (result.status === "failed") return fail(result.reason);
+    if (result.status === "needs_fills")
+      return {
+        status: "needs_fills",
+        templateVersion,
+        fills: result.fills.map((fill) => ({
+          ...fill,
+          path: fillPath(fill.identifier)
+        }))
+      };
+    const host = deps.hostCapabilities();
+    for (const workflow of result.workflows) {
+      const directory = path6.join(designDir, workflow.identifier);
+      writeFile(path6.join(directory, "fill.json"), json(workflow.fill));
+      writeFile(path6.join(directory, "workflow.json"), workflow.workflowJson);
+      writeFile(path6.join(directory, "workflow.md"), workflow.workflowMd);
+      checkGenerated(directory, workflow, host, layout);
+    }
+    const relativeDesignDir = path6.relative(worktree.path, designDir);
+    commitBuildFiles(
+      worktree.path,
+      [relativeDesignDir],
+      `drisp build: Generated Workflows for ${input.project.slugId}`
+    );
+    const commit = lastCommitTouching(worktree.path, relativeDesignDir, [
+      path6.join(relativeDesignDir, "plan.json")
+    ]);
+    const plan = finalizePlan(result.plan, commit);
+    writeFile(path6.join(designDir, "plan.json"), json(plan));
+    commitBuildFiles(
+      worktree.path,
+      [path6.join(relativeDesignDir, "plan.json")],
+      `drisp build: Run plan for ${input.project.slugId}`
+    );
+    writeFile(path6.join(artifacts, "build_plan.json"), json(plan));
+    return {
+      status: "planned",
+      entries: plan.groups.reduce((sum, group) => sum + group.issues.length, 0),
+      skipped: plan.skipped.length
+    };
+  } catch (error) {
+    if (error instanceof BuildUsageError) throw error;
+    return fail(error instanceof Error ? error.message : String(error));
+  }
+}
+
+// src/core/build/tick.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import fs7 from "fs";
+import path7 from "path";
+
+// ../../packages/client/src/index.ts
+var runArtifactSchema = external_exports.object({ name: external_exports.string(), seq: external_exports.number().int(), json: external_exports.json() });
+var githubRepositorySchema = external_exports.object({
+  installationId: external_exports.number().int().positive(),
+  repositoryId: external_exports.number().int().positive(),
+  owner: external_exports.string(),
+  name: external_exports.string(),
+  defaultBranch: external_exports.string()
+});
+var ClientError = class extends Error {
+  constructor(code, status) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+  code;
+  status;
+};
+var DrispClient = class _DrispClient {
+  constructor(baseUrl, orgId, token) {
+    this.baseUrl = baseUrl;
+    this.orgId = orgId;
+    this.token = token;
+    const url = new URL(baseUrl);
+    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      throw new Error("TLS_required");
+  }
+  baseUrl;
+  orgId;
+  token;
+  /**
+   * A client that authenticates with a Run's delegation token (root ADR-0008), from the agent's environment:
+   * `hubUrl` is `DRISP_HUB_URL`, the Team-scoped base `https://<hub>/v2/orgs/<orgId>`, and `token` is
+   * `DRISP_RUN_TOKEN`. The token starts, cancels and reads only its own Run's children.
+   */
+  static delegated(hubUrl, token) {
+    const url = new URL(hubUrl);
+    const match = /^\/v2\/orgs\/([^/]+)\/?$/.exec(url.pathname);
+    if (!match) throw new Error("invalid_hub_url");
+    return new _DrispClient(url.origin, decodeURIComponent(match[1]), async () => token);
+  }
+  async request(path10, body) {
+    const response = await fetch(
+      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path10}`,
+      {
+        method: body === void 0 ? "GET" : "POST",
+        headers: {
+          Authorization: `Bearer ${await this.token()}`,
+          "Content-Type": "application/json"
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      }
+    );
+    const result = await response.json();
+    if (!response.ok)
+      throw new ClientError(result.error ?? `HTTP ${response.status}`, response.status);
+    return result;
+  }
+  submit(command) {
+    return this.request("/commands", commandSchema.parse(command));
+  }
+  /** The recent Runs; with a filter, every Run carrying that key or every child of that Run, newest first. */
+  async runs(filter) {
+    const query = !filter ? "" : "key" in filter ? `?key=${encodeURIComponent(filter.key)}` : `?parent=${encodeURIComponent(filter.parent)}`;
+    return external_exports.object({ hubEpoch: external_exports.string(), runs: external_exports.array(runViewSchema) }).parse(await this.request(`/runs${query}`));
+  }
+  /** The newest `run.artifact` named `name` that the Run reported; `not_found` when it reported none. */
+  async artifact(runId, name) {
+    return runArtifactSchema.parse(
+      await this.request(`/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(name)}`)
+    );
+  }
+  async run(runId) {
+    return runViewSchema.parse(await this.request(`/runs/${encodeURIComponent(runId)}`));
+  }
+  history(runId, after = 0) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/history?after=${after}`);
+  }
+  async runners() {
+    return runnerListSchema.parse(await this.request("/runners"));
+  }
+  /** A one-use Connect code bound to the signed-in member, for `drisp runner connect <code>` (root ADR-0005). */
+  async createConnectCode(hubEpoch) {
+    return connectCodeResponseSchema.parse(await this.request("/runners/connect-codes", { hubEpoch }));
+  }
+  /** Rename a Runner, set its capacity, or change its Audience (root ADR-0005). */
+  async updateRunner(hubEpoch, runnerId, update) {
+    const body = runnerUpdateRequestSchema.parse({ hubEpoch, ...update });
+    return runnerListEntrySchema.parse(await this.request(`/runners/${encodeURIComponent(runnerId)}`, body));
+  }
+  /** Admin only: where a member's Runs go when they have no ready Personal Runner; `null` clears it. */
+  async setTeamDefault(hubEpoch, teamDefault) {
+    const body = teamDefaultRequestSchema.parse({ hubEpoch, teamDefault });
+    return external_exports.object({ teamDefault: teamDefaultSchema.nullable() }).parse(await this.request("/team-default", body));
+  }
+  /** The Runs a Disconnect of `runnerId` would stop, for its confirmation. */
+  async disconnectPreview(runnerId) {
+    return runnerDisconnectPreviewSchema.parse(
+      await this.request(`/runners/${encodeURIComponent(runnerId)}/disconnect`)
+    );
+  }
+  /** Disconnect (root ADR-0005): the Runner leaves the Team and its open Runs are Stopped. */
+  async disconnectRunner(hubEpoch, runnerId) {
+    return runnerDisconnectResponseSchema.parse(
+      await this.request(`/runners/${encodeURIComponent(runnerId)}/disconnect`, { hubEpoch })
+    );
+  }
+  /** Admin only: take over a Runner paused as "Needs an owner" because its member left, so it serves again. */
+  async adoptRunner(hubEpoch, runnerId) {
+    const body = runnerAdoptRequestSchema.parse({ hubEpoch });
+    return runnerListEntrySchema.parse(await this.request(`/runners/${encodeURIComponent(runnerId)}/adopt`, body));
+  }
+  submitManaged(profileId, command, repository) {
+    return this.request("/managed-runs", {
+      profileId,
+      ...repository,
+      command: commandSchema.parse(command)
+    });
+  }
+  async repositories() {
+    const schema = external_exports.object({
+      configured: external_exports.boolean(),
+      installationUrl: external_exports.string().url().optional(),
+      repositories: external_exports.array(repositoryBindingSchema)
+    });
+    try {
+      return schema.parse(await this.request("/repositories"));
+    } catch (error) {
+      if (error instanceof ClientError && error.status === 404 && error.code === "not_found")
+        return schema.parse({ configured: false, repositories: [] });
+      throw error;
+    }
+  }
+  async connectGitHub(hubEpoch) {
+    return external_exports.object({
+      connectionId: external_exports.string(),
+      userCode: external_exports.string(),
+      verificationUri: external_exports.string().url(),
+      expiresAt: external_exports.number(),
+      interval: external_exports.number(),
+      installationUrl: external_exports.string().url()
+    }).parse(await this.request("/github/device", { hubEpoch }));
+  }
+  async pollGitHub(hubEpoch, connectionId) {
+    return external_exports.discriminatedUnion("state", [
+      external_exports.object({ state: external_exports.literal("pending"), interval: external_exports.number() }),
+      external_exports.object({
+        state: external_exports.literal("authorized"),
+        authorizationId: external_exports.string(),
+        expiresAt: external_exports.number(),
+        repositories: external_exports.array(githubRepositorySchema)
+      })
+    ]).parse(await this.request("/github/device/poll", { hubEpoch, connectionId }));
+  }
+  async bindRepository(hubEpoch, authorizationId, repository, settings) {
+    return repositoryBindingSchema.parse(
+      await this.request("/repositories", {
+        hubEpoch,
+        authorizationId,
+        installationId: repository.installationId,
+        repositoryId: repository.repositoryId,
+        ...settings
+      })
+    );
+  }
+  async updateRepository(hubEpoch, id, settings) {
+    return repositoryBindingSchema.parse(
+      await this.request(`/repositories/${encodeURIComponent(id)}`, {
+        hubEpoch,
+        ...settings
+      })
+    );
+  }
+  disconnectRepository(hubEpoch, id) {
+    return this.request(`/repositories/${encodeURIComponent(id)}/disconnect`, { hubEpoch });
+  }
+  receipt(commandId) {
+    return this.request(`/commands/${encodeURIComponent(commandId)}`);
+  }
+  deleteSession(hubEpoch, sessionId) {
+    return this.request("/sessions/delete", { hubEpoch, sessionId });
+  }
+  async pendingDevice(code) {
+    return external_exports.object({ name: external_exports.string() }).parse(await this.request(`/auth/device?code=${encodeURIComponent(code)}`));
+  }
+  /** Approves the macOS app's sign-in for this client's Team: the token is bound to it. */
+  approveDevice(userCode) {
+    return this.request("/auth/device/approve", { userCode });
+  }
+  /** The machine asking to Connect with a code it printed (`drisp runner connect` with no code; root ADR-0005). */
+  async pendingConnect(code) {
+    return connectPendingResponseSchema.parse(await this.request(`/runners/connect/pending?code=${encodeURIComponent(code)}`));
+  }
+  /** Connects the machine that printed `code` to this client's Team, as a Runner with `audience`. Team needs an admin. */
+  approveConnect(code, audience, hubEpoch) {
+    return this.request("/runners/connect/approve", { code, audience, ...hubEpoch === void 0 ? {} : { hubEpoch } });
+  }
+  /** Refuses the machine that printed `code`; its wait ends without a credential. */
+  denyConnect(code) {
+    return this.request("/runners/connect/deny", { code });
+  }
+  async historyPage(runId, after = 0) {
+    const page = external_exports.object({
+      through: external_exports.number(),
+      archives: external_exports.array(
+        external_exports.object({
+          id: external_exports.string(),
+          checksum: external_exports.string(),
+          first_seq: external_exports.number(),
+          last_seq: external_exports.number()
+        })
+      ),
+      batches: external_exports.array(external_exports.object({ firstSeq: external_exports.number(), records: external_exports.array(historyRecordSchema) }))
+    }).parse(await this.history(runId, after));
+    const records = [];
+    const archive = page.archives[0];
+    if (archive) {
+      const response = await fetch(
+        `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}/runs/${encodeURIComponent(runId)}/objects/${encodeURIComponent(archive.id)}`,
+        { headers: { Authorization: `Bearer ${await this.token()}` } }
+      );
+      if (!response.ok) throw new Error(`history_download_${response.status}`);
+      const bytes = await response.arrayBuffer();
+      const checksum = [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+      if (checksum !== archive.checksum) throw new Error("history_integrity_failure");
+      const text = await new Response(
+        new Blob([bytes]).stream().pipeThrough(new DecompressionStream("gzip"))
+      ).text();
+      for (const line of text.trim().split("\n"))
+        records.push(
+          external_exports.object({ seq: external_exports.number(), record: historyRecordSchema }).parse(JSON.parse(line))
+        );
+    }
+    for (const batch of page.batches)
+      batch.records.forEach(
+        (record, index) => records.push({ seq: batch.firstSeq + index, record })
+      );
+    records.sort((a, b) => a.seq - b.seq);
+    let through = after;
+    const contiguous = [];
+    for (const row of records) {
+      if (row.seq <= through) continue;
+      if (row.seq !== through + 1) break;
+      contiguous.push(row);
+      through = row.seq;
+    }
+    if (through === after && page.through > after) throw new Error("history_gap");
+    return { through, availableThrough: page.through, records: contiguous };
+  }
+  watch(hubEpoch, runIds, update, error) {
+    let stopped = false;
+    let socket;
+    let timer;
+    let delay = 250;
+    const runs = /* @__PURE__ */ new Map();
+    const connect = async () => {
+      try {
+        const { ticket } = external_exports.object({ ticket: external_exports.string() }).parse(await this.request("/connect-ticket", { hubEpoch }));
+        if (stopped) return;
+        const endpoint = new URL(
+          `/v2/orgs/${encodeURIComponent(this.orgId)}/connect`,
+          this.baseUrl
+        );
+        endpoint.protocol = endpoint.protocol === "https:" ? "wss:" : "ws:";
+        const ws = new WebSocket(endpoint, ["drisp-v2", `ticket.${ticket}`]);
+        socket = ws;
+        ws.onopen = () => ws.send(JSON.stringify({ type: "watch", hubEpoch, runIds }));
+        ws.onmessage = (event) => {
+          try {
+            if (typeof event.data !== "string" || new TextEncoder().encode(event.data).length > 8 * 1024 * 1024)
+              throw new Error("frame_too_large");
+            const message = JSON.parse(String(event.data));
+            if (message.type === "error") throw new Error(message.code);
+            if (message.hubEpoch !== hubEpoch) throw new Error("recovery_required");
+            const header = external_exports.object({ subscriptionId: external_exports.string(), type: external_exports.enum(["snapshot", "change"]) }).parse(message);
+            let through;
+            if (header.type === "snapshot") {
+              const snapshot = external_exports.object({
+                controlThrough: external_exports.number().int().nonnegative(),
+                runs: external_exports.array(runViewSchema)
+              }).parse(message);
+              runs.clear();
+              for (const run of snapshot.runs) runs.set(run.runId, run);
+              through = snapshot.controlThrough;
+            } else {
+              const change = external_exports.object({
+                through: external_exports.number().int().nonnegative(),
+                runs: external_exports.array(external_exports.object({ seq: external_exports.number(), run: runViewSchema }))
+              }).parse(message);
+              for (const { run } of change.runs)
+                if ((runs.get(run.runId)?.recordRevision ?? 0) < run.recordRevision)
+                  runs.set(run.runId, run);
+              through = change.through;
+            }
+            update([...runs.values()]);
+            delay = 250;
+            ws.send(
+              JSON.stringify({ type: "watch.ack", subscriptionId: header.subscriptionId, through })
+            );
+          } catch (cause) {
+            if (cause instanceof Error && cause.message === "reset_required") {
+              ws.close();
+              return;
+            }
+            stopped = true;
+            error(cause);
+            ws.close();
+          }
+        };
+        ws.onclose = () => {
+          if (!stopped) {
+            timer = setTimeout(() => {
+              void connect();
+            }, delay);
+            delay = Math.min(delay * 2, 3e4);
+          }
+        };
+      } catch (cause) {
+        if (stopped) return;
+        error(cause);
+        if (cause instanceof ClientError && cause.status < 500 && cause.status !== 429) return;
+        timer = setTimeout(() => {
+          void connect();
+        }, delay);
+        delay = Math.min(delay * 2, 3e4);
+      }
+    };
+    void connect();
+    return () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+      socket?.close();
+    };
+  }
+};
+
+// src/core/build/state.ts
+var ATTEMPT_OUTCOMES = [
+  "completed",
+  "failed",
+  "cancelled",
+  "template_mismatch"
+];
+var attemptSchema = external_exports.strictObject({
+  n: external_exports.number().int().min(1).max(2),
+  runId: external_exports.string().min(1),
+  tokenCap: external_exports.number().int().positive(),
+  startedAt: external_exports.string(),
+  /** Where the attempt worked (chosen while building slice 2): later ticks check its PR and remove its worktree. */
+  branch: external_exports.string().min(1),
+  worktree: external_exports.string().min(1),
+  outcome: external_exports.enum(ATTEMPT_OUTCOMES).optional()
+});
+var buildStateSchema = external_exports.strictObject({
+  version: external_exports.literal(1),
+  orchestratorRunId: external_exports.string().min(1),
+  projectId: external_exports.string().min(1),
+  slugId: external_exports.string().regex(/^[a-z0-9]+$/),
+  templateVersion: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  approvedAt: external_exports.string(),
+  approved: external_exports.strictObject({ groups: external_exports.array(external_exports.array(external_exports.string())) }),
+  attempts: external_exports.record(external_exports.string(), external_exports.array(attemptSchema)),
+  needsPerson: external_exports.record(external_exports.string(), external_exports.string()),
+  tickCount: external_exports.number().int().nonnegative(),
+  lastTickAt: external_exports.string(),
+  /**
+   * Additive (chosen while building slice 3): the entries a tick had seen done, for rebasing parked children's
+   * branches after a merge. No longer written since slice 4 (a parked child rebases itself), still read so a state
+   * written before parses.
+   */
+  done: external_exports.array(external_exports.string()).optional(),
+  /** The merged issues the Orchestrator was already asked to repair in Linear, so it is asked once. */
+  repaired: external_exports.array(external_exports.string()).optional()
+});
+
+// src/core/build/childStart.ts
+function childRunId(orchestratorRunId, identifier, attempt) {
+  return `${orchestratorRunId}:${identifier}:a${attempt}`;
+}
+function childPrompt(child) {
+  return [
+    `${child.identifier} ${child.title}`,
+    `Linear: ${child.url}`,
+    `Branch: ${child.branch}`,
+    `Worktree: ${child.worktree}`,
+    `Build: ${child.orchestratorRunId}`
+  ].join("\n");
+}
+function childStartIntent(child, parent) {
+  const runId = childRunId(
+    child.orchestratorRunId,
+    child.identifier,
+    child.attempt
+  );
+  return {
+    runId,
+    intent: {
+      kind: "start",
+      sessionId: runId,
+      runnerId: parent.runnerId,
+      scope: parent.scope,
+      key: `issue:${child.issueId}`,
+      parent: { runId: child.orchestratorRunId, tokenCap: child.tokenCap },
+      spec: {
+        prompt: childPrompt(child),
+        projectDir: child.worktree,
+        harness: "claude-code",
+        workflow: child.workflowName
+      }
+    }
+  };
+}
+
+// src/core/build/tickDecision.ts
+var MAX_ATTEMPTS = 2;
+function mayRetry(attempts) {
+  return attempts.length < MAX_ATTEMPTS && attempts.at(-1)?.outcome === "failed";
+}
+var STOPPED_CLOSE_REASONS = /* @__PURE__ */ new Set(["cancelled_before_start", "abandoned"]);
+function outcomeOf(view) {
+  if (view.closeReason === "workflow_template_mismatch")
+    return "template_mismatch";
+  const status = view.execution?.status;
+  if (status === "completed" || status === "failed" || status === "cancelled")
+    return status;
+  if (view.cancellation || STOPPED_CLOSE_REASONS.has(view.closeReason ?? ""))
+    return "cancelled";
+  return "failed";
+}
+function buildLimits(own, delegation) {
+  if (!delegation) return own;
+  return {
+    ...own,
+    maxChildren: Math.min(own.maxChildren, delegation.maxChildren),
+    tokenBudget: Math.min(own.tokenBudget, delegation.tokenBudget)
+  };
+}
+function occupies(view) {
+  return !view || !view.closed && view.execution?.status !== "awaiting_attention";
+}
+function assessTick(facts) {
+  const { entries, orchestratorRunId } = facts;
+  const state = structuredClone(facts.state);
+  const views = new Map(facts.children.map((view) => [view.runId, view]));
+  const issues = new Map(facts.issues.map((issue) => [issue.id, issue]));
+  const attemptsOf = (id) => state.attempts[id] ?? [];
+  for (const entry of entries) {
+    const prefix = `${orchestratorRunId}:${entry.identifier}:a`;
+    for (const view of facts.children) {
+      if (!view.runId.startsWith(prefix)) continue;
+      const n = Number(view.runId.slice(prefix.length));
+      if (!(n === 1 || n === 2)) continue;
+      if (attemptsOf(entry.id).some((a) => a.runId === view.runId)) continue;
+      state.attempts[entry.id] = [
+        ...attemptsOf(entry.id),
+        {
+          n,
+          runId: view.runId,
+          tokenCap: view.parent?.tokenCap ?? entry.tokenCap,
+          startedAt: facts.now,
+          ...facts.locate(entry)
+        }
+      ].sort((a, b) => a.n - b.n);
+    }
+  }
+  for (const attempts of Object.values(state.attempts))
+    for (const attempt of attempts) {
+      const view = views.get(attempt.runId);
+      if (view?.closed && !attempt.outcome) attempt.outcome = outcomeOf(view);
+    }
+  const branchOf = (entry) => attemptsOf(entry.id).at(-1)?.branch ?? facts.locate(entry).branch;
+  for (const identifier of facts.rebaseFailed) {
+    const entry = entries.find((each) => each.identifier === identifier);
+    if (entry)
+      state.needsPerson[entry.id] = BUILD_STRINGS.rebaseFailed(branchOf(entry));
+  }
+  const pullRequests = /* @__PURE__ */ new Map();
+  const prsOf = (entry) => {
+    const branch = attemptsOf(entry.id).at(-1)?.branch ?? issues.get(entry.id)?.branchName;
+    if (!branch) return void 0;
+    if (!pullRequests.has(branch))
+      pullRequests.set(branch, facts.pullRequests(branch));
+    return pullRequests.get(branch);
+  };
+  const status = /* @__PURE__ */ new Map();
+  const skippedBlocker = (id) => {
+    const linear = issues.get(id)?.state.type;
+    return linear === "completed" || linear === "canceled" ? "done" : "blocked";
+  };
+  const repair = [];
+  const repaired = new Set(state.repaired ?? []);
+  for (const entry of entries) {
+    const attempts = attemptsOf(entry.id);
+    const newest = attempts.at(-1);
+    const view = newest && views.get(newest.runId);
+    const linear = issues.get(entry.id)?.state.type;
+    const statusOf = () => {
+      if (linear === "completed" || linear === "canceled") return "done";
+      const prs = prsOf(entry);
+      if (prs?.merged) {
+        if (!repaired.has(entry.id) && !(newest && occupies(view))) {
+          const prUrl = prs.mergedUrl ?? branchOf(entry);
+          repair.push({
+            id: entry.id,
+            identifier: entry.identifier,
+            prUrl,
+            comment: BUILD_STRINGS.repairComment(prUrl, orchestratorRunId)
+          });
+          repaired.add(entry.id);
+        }
+        return "done";
+      }
+      if (newest && (!view || !view.closed)) return "live";
+      if (newest?.outcome === "template_mismatch") return "replan";
+      if (newest?.outcome === "completed")
+        state.needsPerson[entry.id] ??= BUILD_STRINGS.completedUnmerged;
+      if (state.needsPerson[entry.id] || newest && !mayRetry(attempts))
+        return "needs_person";
+      const blockers = entry.blockedBy.map(
+        (id) => status.get(id) ?? skippedBlocker(id)
+      );
+      if (blockers.some(
+        (b) => b === "needs_person" || b === "replan" || b === "blocked"
+      ))
+        return "blocked";
+      return blockers.every((b) => b === "done") ? "ready" : "pending";
+    };
+    status.set(entry.id, statusOf());
+    if (status.get(entry.id) === "done" && state.needsPerson[entry.id] === BUILD_STRINGS.completedUnmerged)
+      delete state.needsPerson[entry.id];
+  }
+  if (repaired.size > 0) state.repaired = [...repaired];
+  let parkReason = facts.templateVersion !== state.templateVersion ? "template" : state.tickCount >= facts.limits.tickAllowance ? "budget" : void 0;
+  const occupying = entries.filter((entry) => {
+    const newest = attemptsOf(entry.id).at(-1);
+    return newest !== void 0 && occupies(views.get(newest.runId));
+  }).length;
+  const queue = [];
+  if (!parkReason) {
+    let capped = Object.values(state.attempts).flat().reduce((sum, attempt) => sum + attempt.tokenCap, 0);
+    for (const entry of entries) {
+      if (status.get(entry.id) !== "ready") continue;
+      if (capped + entry.tokenCap > facts.limits.tokenBudget) {
+        parkReason = "budget";
+        break;
+      }
+      queue.push(entry);
+      capped += entry.tokenCap;
+    }
+  }
+  return {
+    state,
+    status,
+    repair,
+    queue,
+    slots: Math.max(0, facts.limits.maxChildren - occupying),
+    ...parkReason ? { parkReason } : {}
+  };
+}
+function tickAction(input) {
+  const live = input.children.filter((view) => !view.closed);
+  if (input.started > 0 || live.some((view) => occupies(view)))
+    return { action: "wait" };
+  const remaining = input.entries.some(
+    (entry) => ["ready", "pending"].includes(input.status.get(entry.id))
+  );
+  if (input.parkReason && remaining)
+    return {
+      action: "park",
+      reason: input.parkReason,
+      message: input.parkReason === "budget" ? BUILD_STRINGS.budgetPark : BUILD_STRINGS.templatePark
+    };
+  if (live.length > 0) return { action: "wait" };
+  const done = input.entries.filter(
+    (entry) => input.status.get(entry.id) === "done"
+  ).length;
+  return {
+    action: "complete",
+    message: `Built ${done} of ${input.entries.length}`
+  };
+}
+
+// src/core/build/tick.ts
+var UNAVAILABLE_RETRY_MS = 2e3;
+var UNAVAILABLE_RETRY_FOR_MS = 3e4;
+var NEVER = (/* @__PURE__ */ new Date(0)).toISOString();
+var notStarted = () => ({
+  action: "complete",
+  message: BUILD_STRINGS.notStarted
+});
+function pushBranch(worktree, branch) {
+  git(worktree, ["push", "--quiet", "origin", `${branch}:${branch}`]);
+}
+async function startChild(deps, hubEpoch, start) {
+  for (let waited = 0; ; waited += UNAVAILABLE_RETRY_MS) {
+    try {
+      await deps.hub.submit({
+        commandId: randomUUID2(),
+        hubEpoch,
+        runId: start.runId,
+        intent: start.intent
+      });
+      return { kind: "started" };
+    } catch (error) {
+      if (!(error instanceof ClientError) || error.status >= 500)
+        return { kind: "unreachable" };
+      if (error.code === "key_busy") return { kind: "key_busy" };
+      if (error.code === "delegation_budget_exhausted") return { kind: "budget" };
+      if (error.code !== "workflow_unavailable")
+        return { kind: "refused", code: error.code };
+      if (waited >= UNAVAILABLE_RETRY_FOR_MS) return { kind: "unavailable" };
+      await deps.sleep(UNAVAILABLE_RETRY_MS);
+    }
+  }
+}
+function currentPlan(plan, state) {
+  const { needsPerson: _previous, ...approved } = plan;
+  const entries = plan.groups.flatMap((group) => group.issues);
+  const needsPerson = entries.filter((entry) => state.needsPerson[entry.id]).map((entry) => ({ id: entry.id, reason: state.needsPerson[entry.id] }));
+  return needsPerson.length > 0 ? { ...approved, needsPerson } : approved;
+}
+async function runBuildTick(deps) {
+  const orchestratorRunId = requireEnv(deps.env, "DRISP_RUN_ID");
+  const runnerId = requireEnv(deps.env, "DRISP_RUNNER_ID");
+  const artifacts = requireEnv(deps.env, "DRISP_RUN_ARTIFACTS");
+  if (!deps.inputPath)
+    throw new BuildUsageError("Usage: drisp build tick --input <path>");
+  let input;
+  try {
+    input = readInput(path7.resolve(deps.folder, deps.inputPath));
+  } catch (error) {
+    if (error instanceof PlanFailure) throw new BuildUsageError(error.message);
+    throw error;
+  }
+  const worktree = ensureBuildWorktree({
+    folder: deps.folder,
+    slugId: input.project.slugId,
+    worktreesRoot: deps.worktreesRoot
+  });
+  const designDir = path7.join(
+    worktree.path,
+    ".athena",
+    "workflows",
+    input.project.slugId
+  );
+  const relativeDesignDir = path7.relative(worktree.path, designDir);
+  const statePath = path7.join(designDir, "build-state.json");
+  const planPath = path7.join(designDir, "plan.json");
+  const parsedPlan = buildPlanSchema.safeParse(readJson(planPath));
+  if (!parsedPlan.success || parsedPlan.data.orchestratorRunId !== orchestratorRunId)
+    return notStarted();
+  const plan = parsedPlan.data;
+  const push = deps.push ?? pushBranch;
+  let stored;
+  const parsedState = buildStateSchema.safeParse(readJson(statePath));
+  if (parsedState.success && parsedState.data.orchestratorRunId === orchestratorRunId) {
+    stored = parsedState.data;
+  } else {
+    if (!isStartAnswer(readJson(path7.join(artifacts, "answer.json"))))
+      return notStarted();
+    stored = {
+      version: 1,
+      orchestratorRunId,
+      projectId: plan.projectId,
+      slugId: input.project.slugId,
+      templateVersion: plan.templateVersion,
+      approvedAt: deps.now().toISOString(),
+      approved: {
+        groups: plan.groups.map((group) => group.issues.map((issue) => issue.id))
+      },
+      attempts: {},
+      needsPerson: {},
+      tickCount: 0,
+      lastTickAt: NEVER
+    };
+    push(worktree.path, worktree.branch);
+  }
+  if (!(Date.parse(input.readAt) > Date.parse(stored.lastTickAt)))
+    return { action: "refresh_input" };
+  stored.tickCount += 1;
+  stored.lastTickAt = deps.now().toISOString();
+  const parent = await deps.hub.run(orchestratorRunId);
+  const children = await deps.hub.runs({ parent: orchestratorRunId });
+  const approved = new Set(stored.approved.groups.flat());
+  const entries = plan.groups.flatMap((group) => group.issues).filter((entry) => approved.has(entry.id));
+  const issues = new Map(input.issues.map((issue) => [issue.id, issue]));
+  const assessment = assessTick({
+    orchestratorRunId,
+    entries,
+    issues: input.issues,
+    state: stored,
+    children: children.runs,
+    templateVersion,
+    limits: buildLimits(ORCHESTRATOR_LIMITS, parent.delegation),
+    pullRequests: (branch) => deps.pullRequests(deps.folder, branch),
+    locate: (entry) => locate(deps, entry, issues.get(entry.id)?.branchName),
+    rebaseFailed: deps.rebaseFailed ?? [],
+    now: deps.now().toISOString()
+  });
+  const { state, status } = assessment;
+  let parkReason = assessment.parkReason;
+  const record = () => {
+    writeFile(statePath, json(state));
+    const files = [path7.join(relativeDesignDir, "build-state.json")];
+    const emitted = json(currentPlan(plan, state));
+    if (emitted !== fs7.readFileSync(planPath, "utf-8")) {
+      writeFile(planPath, emitted);
+      writeFile(path7.join(artifacts, "build_plan.json"), emitted);
+      files.push(path7.join(relativeDesignDir, "plan.json"));
+    }
+    if (commitBuildFiles(
+      worktree.path,
+      files,
+      `drisp build: tick ${state.tickCount} for ${state.slugId}`
+    ))
+      push(worktree.path, worktree.branch);
+  };
+  if (assessment.repair.length > 0) {
+    record();
+    return { action: "repair", issues: assessment.repair };
+  }
+  const deferred = [];
+  const behind = [];
+  let started = 0;
+  if (assessment.queue.length > 0 && assessment.slots > 0) {
+    for (const entry of assessment.queue) {
+      if (started >= assessment.slots) break;
+      const issue = issues.get(entry.id);
+      if (!issue) continue;
+      const child = ensureChildWorktree({
+        folder: deps.folder,
+        worktreesRoot: deps.worktreesRoot,
+        issue
+      });
+      if (child.status === "needs_person") {
+        state.needsPerson[entry.id] = child.reason;
+        status.set(entry.id, "needs_person");
+        continue;
+      }
+      if (child.existed && !hasUncommittedWork(child.path) && behindMain(deps.folder, child.path)) {
+        behind.push({
+          identifier: entry.identifier,
+          worktree: child.path,
+          branch: child.branch
+        });
+        continue;
+      }
+      const entryDir = path7.join(relativeDesignDir, entry.identifier);
+      git(worktree.path, ["checkout", plan.commit, "--", entryDir]);
+      installWorkflowFromSource(
+        {
+          kind: "filesystem",
+          workflowPath: path7.join(worktree.path, entryDir, "workflow.json"),
+          version: plan.commit
+        },
+        entry.workflowName
+      );
+      const attempt = (state.attempts[entry.id]?.length ?? 0) + 1;
+      const start = childStartIntent(
+        {
+          orchestratorRunId,
+          identifier: entry.identifier,
+          issueId: entry.id,
+          title: issue.title,
+          url: issue.url,
+          branch: child.branch,
+          worktree: child.path,
+          workflowName: entry.workflowName,
+          tokenCap: entry.tokenCap,
+          attempt
+        },
+        { runnerId, scope: parent.scope }
+      );
+      const result = await startChild(deps, children.hubEpoch, start);
+      if (result.kind === "started") {
+        (state.attempts[entry.id] ??= []).push({
+          n: attempt,
+          runId: start.runId,
+          tokenCap: entry.tokenCap,
+          startedAt: deps.now().toISOString(),
+          branch: child.branch,
+          worktree: child.path
+        });
+        status.set(entry.id, "live");
+        started += 1;
+      } else if (result.kind === "key_busy")
+        deferred.push({ entry, reason: BUILD_STRINGS.keyBusy(entry.identifier) });
+      else if (result.kind === "unavailable")
+        deferred.push({
+          entry,
+          reason: BUILD_STRINGS.workflowUnavailable(entry.identifier)
+        });
+      else if (result.kind === "unreachable")
+        deferred.push({
+          entry,
+          reason: BUILD_STRINGS.hubUnreachable(entry.identifier)
+        });
+      else if (result.kind === "budget") {
+        parkReason = "budget";
+        break;
+      } else {
+        state.needsPerson[entry.id] = BUILD_STRINGS.startRefused(result.code);
+        status.set(entry.id, "needs_person");
+      }
+    }
+  }
+  const anyLive = started > 0 || children.runs.some((view) => !view.closed) || behind.length > 0;
+  if (!anyLive)
+    for (const { entry, reason } of deferred) {
+      state.needsPerson[entry.id] = reason;
+      status.set(entry.id, "needs_person");
+    }
+  const views = new Map(children.runs.map((view) => [view.runId, view]));
+  for (const entry of entries) {
+    const newest = state.attempts[entry.id]?.at(-1);
+    if (!newest || status.get(entry.id) !== "done") continue;
+    if (!views.get(newest.runId)?.closed) continue;
+    const installed = fs7.existsSync(
+      path7.join(workflowRegistryDir(), entry.workflowName)
+    );
+    if (!installed && !fs7.existsSync(newest.worktree)) continue;
+    if (!deps.pullRequests(deps.folder, newest.branch).merged) continue;
+    if (fs7.existsSync(newest.worktree)) {
+      try {
+        git(deps.folder, ["worktree", "remove", newest.worktree]);
+      } catch {
+      }
+    }
+    if (installed) removeWorkflow(entry.workflowName);
+  }
+  record();
+  if (behind.length > 0) return { action: "rebase", items: behind };
+  return tickAction({
+    entries,
+    status,
+    children: children.runs,
+    started,
+    ...parkReason ? { parkReason } : {}
+  });
+}
+function locate(deps, entry, branchName) {
+  const worktree = childWorktreePath(
+    deps.worktreesRoot,
+    deps.folder,
+    entry.identifier
+  );
+  if (fs7.existsSync(path7.join(worktree, ".git")))
+    return {
+      worktree,
+      branch: git(worktree, ["rev-parse", "--abbrev-ref", "HEAD"])
+    };
+  return {
+    worktree,
+    branch: branchName ?? fallbackBranch(entry.identifier, entry.title)
+  };
+}
+
+// src/core/build/mergeGate.ts
+var PASSED = /* @__PURE__ */ new Set([
+  "success",
+  "skipped",
+  "neutral"
+]);
+function zeroStepFailure(run) {
+  const failedJobs = run.jobs.filter((job) => !PASSED.has(job.conclusion));
+  return failedJobs.length > 0 && failedJobs.every((job) => Array.isArray(job.steps) && job.steps.length === 0);
+}
+function evaluateRemoteChecks(runs) {
+  const verdict = {
+    ok: true,
+    failed: [],
+    ignored: [],
+    pending: []
+  };
+  for (const run of runs) {
+    if (run.status !== "completed") verdict.pending.push(run.name);
+    else if (PASSED.has(run.conclusion)) continue;
+    else if (zeroStepFailure(run)) verdict.ignored.push(run.name);
+    else verdict.failed.push(run.name);
+  }
+  verdict.ok = verdict.failed.length === 0 && verdict.pending.length === 0;
+  return verdict;
+}
+
+// src/app/entry/buildCommand.ts
+var USAGE3 = `Usage: drisp build plan --input <path>
+       drisp build tick --input <path> [--rebase-failed <IDENTIFIER>]...
+       drisp build checks
+plan and tick run inside an Orchestrator Run (DRISP_RUN_ID, DRISP_RUNNER_ID and DRISP_RUN_ARTIFACTS set; tick also
+DRISP_RUN_TOKEN and DRISP_HUB_URL). DRISP_BUILD_PLAN_INPUT=<path> stands in for plan's --input, with
+fills/<IDENTIFIER>.json beside it. checks runs in a child's worktree: the merge gate's verdict on HEAD's GitHub runs.`;
+function githubPullRequests(folder, branch) {
+  const output = execFileSync(
+    "gh",
+    [
+      "pr",
+      "list",
+      "--head",
+      branch,
+      "--state",
+      "all",
+      "--json",
+      "state,url",
+      "--limit",
+      "50"
+    ],
+    { cwd: folder, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+  return parsePullRequests(output);
+}
+function parsePullRequests(output) {
+  const prs = JSON.parse(output);
+  const merged = prs.find((pr) => pr.state === "MERGED");
+  return {
+    open: prs.some((pr) => pr.state === "OPEN"),
+    merged: merged !== void 0,
+    ...merged ? { mergedUrl: merged.url } : {}
+  };
+}
+function hostCapabilities(folder) {
+  const effective = resolveEffectiveCapabilities({
+    globalConfig: readGlobalConfig(),
+    projectConfig: readConfig(folder)
+  });
+  return {
+    skills: effective.skills.map((skill) => skill.name),
+    mcpServers: effective.mcpServers.map((server) => server.name)
+  };
+}
+var defaultChecks = {
+  head: (cwd) => git(cwd, ["rev-parse", "HEAD"]),
+  gh: (args, cwd) => execFileSync("gh", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  })
+};
+function runBuildChecks(cwd, deps) {
+  const head = deps.head(cwd);
+  const runs = JSON.parse(
+    deps.gh(
+      [
+        "run",
+        "list",
+        "--commit",
+        head,
+        "--json",
+        "databaseId,name,status,conclusion",
+        "--limit",
+        "100"
+      ],
+      cwd
+    )
+  );
+  const withJobs = runs.map((run) => ({
+    name: run.name,
+    status: run.status,
+    conclusion: run.conclusion,
+    jobs: run.status === "completed" && !PASSED.has(run.conclusion) ? JSON.parse(
+      deps.gh(
+        ["run", "view", String(run.databaseId), "--json", "jobs"],
+        cwd
+      )
+    ).jobs : []
+  }));
+  return evaluateRemoteChecks(withJobs);
+}
+async function runBuildCommand(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const env2 = input.env ?? process.env;
+  try {
+    let output;
+    switch (input.subcommand) {
+      case "plan":
+        output = runBuildPlan({
+          env: env2,
+          folder: input.cwd,
+          ...input.flags.input ? { inputPath: input.flags.input } : {},
+          worktreesRoot: defaultWorktreesRoot(),
+          hostCapabilities: () => hostCapabilities(input.cwd),
+          pullRequests: githubPullRequests,
+          ...input.dependencies
+        });
+        break;
+      case "tick": {
+        requireEnv(env2, "DRISP_RUN_ID");
+        requireEnv(env2, "DRISP_RUNNER_ID");
+        requireEnv(env2, "DRISP_RUN_ARTIFACTS");
+        const token = requireEnv(env2, "DRISP_RUN_TOKEN");
+        const hubUrl = requireEnv(env2, "DRISP_HUB_URL");
+        output = await runBuildTick({
+          env: env2,
+          folder: input.cwd,
+          ...input.flags.input ? { inputPath: input.flags.input } : {},
+          ...input.flags.rebaseFailed?.length ? { rebaseFailed: input.flags.rebaseFailed } : {},
+          worktreesRoot: defaultWorktreesRoot(),
+          hub: DrispClient.delegated(hubUrl, token),
+          pullRequests: githubPullRequests,
+          now: () => /* @__PURE__ */ new Date(),
+          sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+          ...input.tick
+        });
+        break;
+      }
+      case "checks":
+        output = runBuildChecks(input.cwd, input.checks ?? defaultChecks);
+        break;
+      default:
+        stderr.write(`${USAGE3}
+`);
+        return 2;
+    }
+    stdout.write(`${JSON.stringify(output)}
+`);
+    return 0;
+  } catch (error) {
+    if (!(error instanceof BuildUsageError)) throw error;
+    stderr.write(`${error.message}
+${USAGE3}
+`);
+    return 2;
+  }
+}
+
 // src/app/entry/doctorCommand.ts
 import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync } from "child_process";
-import * as fs5 from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs8 from "fs";
 import * as os4 from "os";
-import * as path5 from "path";
+import * as path8 from "path";
 var MANAGED_POLICY_KEYS = [
   "forceLoginMethod",
   "forceLoginOrgUUID",
@@ -13595,7 +14926,7 @@ function readEnforcement(scopes) {
 }
 function tryRichAuth(claudeBinary) {
   try {
-    const output = execFileSync(claudeBinary, ["auth", "status"], {
+    const output = execFileSync2(claudeBinary, ["auth", "status"], {
       timeout: 1e4,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -13624,8 +14955,8 @@ function collectEnvironment(options = {}) {
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs5.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs5.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs8.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs8.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -13670,7 +15001,7 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path5.join(homeDir, ".claude.json"));
+    statFn(path8.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
@@ -14150,13 +15481,13 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path6.dirname(fileURLToPath(entryUrl));
+  let currentDir = path9.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path6.join(currentDir, "package.json");
-    if (fs6.existsSync(candidatePath)) {
+    const candidatePath = path9.join(currentDir, "package.json");
+    if (fs9.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path6.dirname(currentDir);
+    const parentDir = path9.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
@@ -14178,6 +15509,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "skill",
   "marketplace",
   "runner",
+  "build",
   // Deprecated alias of `runner` (#188); removed in 0.7.0.
   "dashboard",
   "telemetry",
@@ -14323,7 +15655,10 @@ var cli = meow(
 			skill <sub>           Manage personal skills (install, remove, list)
 			marketplace <sub>     Manage marketplace sources (add, refresh, remove, list)
 			runner [sub]          Run the runner that connects this machine to a Team and executes its Runs
-			                      (no subcommand: foreground; connect [code] --hub <url> [--replace], disconnect [team], status, recover, help)
+			                      (no subcommand: foreground; connect [code] --hub <url> [--replace], disconnect [team], status, restart, recover, help)
+			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
+			build tick --input <path>  Run one step of a started Build (prints the next action; [--rebase-failed <ID>]...)
+			build checks               The merge gate's verdict on HEAD's GitHub runs (in a child's worktree)
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -14354,7 +15689,7 @@ var cli = meow(
 			--dry-run       Print resolved bootstrap (workflow, isolation, plugins, harness) and exit (run mode)
 			--project       Scope workflow command to project config (workflow use)
 			--global        Scope workflow command to global config (workflow use, default)
-			--help          Show command help
+			--help, -h      Show command help (runner shows its own)
 			--version       Show CLI version
 
 		Note: All isolation modes use --setting-sources "" to completely isolate
@@ -14389,6 +15724,12 @@ var cli = meow(
     importMeta: import.meta,
     allowUnknownFlags: false,
     flags: {
+      // Declared so -h works too; meow alone handles only a bare --help (DRI-193).
+      help: {
+        type: "boolean",
+        shortFlag: "h",
+        default: false
+      },
       projectDir: {
         type: "string",
         default: process.cwd()
@@ -14448,6 +15789,13 @@ var cli = meow(
       hub: {
         type: "string"
       },
+      input: {
+        type: "string"
+      },
+      rebaseFailed: {
+        type: "string",
+        isMultiple: true
+      },
       foreground: {
         type: "boolean",
         default: false
@@ -14487,7 +15835,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path6.resolve(cli.flags.projectDir);
+  const projectDir = path9.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -14498,6 +15846,10 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     await exitWith(1);
     return;
   }
+  if (cli.flags.help && command !== "runner" && command !== "dashboard") {
+    cli.showHelp(0);
+    return;
+  }
   if (command === "exec") {
     console.error(
       "drisp exec is deprecated and is removed in 0.7.0; use drisp run instead."
@@ -14537,7 +15889,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-TQ4SF5KB.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-NZFBSBLY.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -14608,12 +15960,27 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
           ...cli.flags.detach ? { detach: true } : {},
           ...typeof cli.flags.hub === "string" ? { hub: cli.flags.hub } : {},
           ...cli.flags.foreground ? { foreground: true } : {},
-          ...cli.flags.replace ? { replace: true } : {}
+          ...cli.flags.replace ? { replace: true } : {},
+          ...cli.flags.help ? { help: true } : {}
         }
       })
     );
     return;
   }
+  if (command === "build") {
+    const [subcommand = ""] = commandArgs;
+    await exitWith(
+      await runBuildCommand({
+        subcommand,
+        flags: {
+          ...typeof cli.flags.input === "string" ? { input: cli.flags.input } : {},
+          ...cli.flags.rebaseFailed?.length ? { rebaseFailed: cli.flags.rebaseFailed } : {}
+        },
+        cwd: process.cwd()
+      })
+    );
+    return;
+  }
   if (command === "runs") {
     await exitWith(
       runRunsCommand({
@@ -14687,8 +16054,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs6.existsSync(
-      path6.join(os5.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs9.existsSync(
+      path9.join(os5.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;