@drisp/cli 0.6.8 → 0.6.9

package/dist/cli.js

@@ -8,16 +8,23 @@ import {
   PORTABLE_PROVIDER_ENV_VARS,
   RUN_EXIT_CODE,
   attachRuntimeEventLoop,
+  behindMain,
   bootstrapRuntimeConfig,
   buildApiKeyHelperSettings,
   buildPhaseFeedEvent,
+  buildPlanSchema,
   buildPostByToolUseId,
   buildProbeConfigs,
   centerAnsi,
+  childWorktreePath,
   classifyFailure,
+  commandSchema,
+  commitBuildFiles,
   compactText,
   computeInputRows,
   connectAlreadyConnectedSchema,
+  connectCodeResponseSchema,
+  connectPendingResponseSchema,
   connectRedeemResponseSchema,
   connectStartResponseSchema,
   createFeedMapper,
@@ -26,10 +33,15 @@ import {
   createSessionStore,
   credentialHelperKey,
   cursorToVisualPosition,
+  defaultWorktreesRoot,
   detectClaudeVersion,
+  ensureBuildWorktree,
+  ensureChildWorktree,
   expandHome,
   extractFriendlyServerName,
   extractPermissionSnapshot,
+  fallbackBranch,
+  finalizePlan,
   fit,
   fitAnsi,
   forgetRunner,
@@ -46,12 +58,18 @@ import {
   getLatestRunForSession,
   getMostRecentAthenaSession,
   getSessionMeta,
+  git,
+  hasUncommittedWork,
   hintGlyphs,
+  historyRecordSchema,
   hubHttpUrl,
   identityHubOrigin,
   isBashToolResponse,
   isCommandPrefix,
+  isGitHubRepository,
   isScopedPermissionsRequest,
+  isStartAnswer,
+  lastCommitTouching,
   listAwaitingAttentionRuns,
   listHarnessAdapters,
   listHarnessCapabilities,
@@ -66,6 +84,8 @@ import {
   overriddenIdentityPath,
   parseFrontmatter,
   parseToolName,
+  planBuild,
+  planInputSchema,
   platformRunnerServices,
   probeSkipReason,
   processRegistry,
@@ -74,6 +94,8 @@ import {
   registerCleanupOnExit,
   releaseMcpAsset,
   renderInputLines,
+  repoLayoutAt,
+  repositoryBindingSchema,
   require_string_width,
   resolveClaudeBinary,
   resolveClaudeSettingsSurfacePaths,
@@ -88,12 +110,18 @@ import {
   runExec,
   runMachineRunners,
   runProbe,
+  runViewSchema,
+  runnerAdoptRequestSchema,
   runnerConfigDirectory,
   runnerConfigSchema,
+  runnerDisconnectPreviewSchema,
   runnerDisconnectResponseSchema,
   runnerIdentities,
+  runnerListEntrySchema,
+  runnerListSchema,
   runnerServiceUnit,
   runnerSoftwareVersion,
+  runnerUpdateRequestSchema,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
@@ -101,12 +129,14 @@ import {
   startDashboardDecisionDrain,
   startWorkflowExecution,
   supportsSessionApproval,
+  teamDefaultRequestSchema,
+  teamDefaultSchema,
   teamIdentityPath,
   todoGlyphSet,
   visualPositionToOffset,
   wrapText,
   writeIdentityOnce
-} from "./chunk-HN3WNQVY.js";
+} from "./chunk-2JL4QT55.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -120,9 +150,21 @@ import {
   useTheme
 } from "./chunk-KPDCVR6Q.js";
 import {
+  BUILD_STRINGS,
+  CANNOT_PASS_TEMPLATE,
+  DESCRIPTION_TEMPLATE,
+  GATES,
+  LAYOUT_MARKERS,
+  NO_GATE_TEXT_TEMPLATE,
+  ORCHESTRATOR_LIMITS,
+  QA_SECTIONS,
+  RENDERER_RULES,
+  STAGE_TEMPLATE,
+  WORKFLOW_MD_TEMPLATE,
   collectMcpServersWithOptions,
   createSteerQueue,
   deserializeRunMemory,
+  external_exports,
   findMarketplaceRepoDir,
   gatherMarketplaceWorkflowSources,
   hasProjectWorkflow,
@@ -133,6 +175,7 @@ import {
   listMarketplaceWorkflows,
   listMarketplaceWorkflowsFromRepo,
   listWorkflows,
+  parseWorkflowConfig,
   projectConfigPath,
   pullMarketplaceRepo,
   readConfig,
@@ -145,10 +188,12 @@ import {
   resolveWorkflowMarketplaceSource,
   updateWorkflow,
   updateWorkflows,
+  verifyRendered,
   wakesFreshAfterHandover,
+  workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-CIPO2P2Q.js";
+} from "./chunk-YUVMVYUF.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -156,10 +201,10 @@ import {
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs6 from "fs";
+import fs9 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path6 from "path";
+import path9 from "path";
 import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
@@ -5278,14 +5323,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path7 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path10 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path7}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path10}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path7),
+    language: detectLanguage(path10),
     maxLines: 10
   };
 }
@@ -5811,10 +5856,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path7 = str(input, "path");
+      const path10 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path7) parts.push(`in ${path7}`);
+      if (path10) parts.push(`in ${path10}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -5970,8 +6015,8 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
         event.data.tool_input
       );
       const header = buildCompactHeader(event, width, { subject, theme });
-      const json = JSON.stringify(event.data.tool_input, null, 2);
-      const requestLines = highlightCode(json, cw, "json");
+      const json2 = JSON.stringify(event.data.tool_input, null, 2);
+      const requestLines = highlightCode(json2, cw, "json");
       return buildResult(header, requestLines, true);
     }
     case "subagent.start": {
@@ -5994,8 +6039,8 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
       } else if (prompt) {
         content = renderMarkdownToLines(prompt, cw);
       } else {
-        const json = JSON.stringify(event.data, null, 2);
-        content = highlightCode(json, cw, "json");
+        const json2 = JSON.stringify(event.data, null, 2);
+        content = highlightCode(json2, cw, "json");
       }
       return buildResult(header, content, !prompt && !response);
     }
@@ -6104,8 +6149,8 @@ Named by Turn ${event.data.turn} of Workflow Run \`${event.data.runId}\`.`,
     case "elicitation.result":
     case "artifacts.manifest": {
       const header = buildCompactHeader(event, width, { theme });
-      const json = JSON.stringify(event.raw ?? event.data, null, 2);
-      const content = highlightCode(json, cw, "json");
+      const json2 = JSON.stringify(event.raw ?? event.data, null, 2);
+      const content = highlightCode(json2, cw, "json");
       return buildResult(header, content, true);
     }
     default: {
@@ -13038,7 +13083,7 @@ var thisMachine = (installationId) => ({
   os: `${platform()} ${release()}`.slice(0, 64),
   softwareVersion: runnerSoftwareVersion
 });
-var post = (origin, path7, body) => fetch(new URL(path7, origin), {
+var post = (origin, path10, body) => fetch(new URL(path10, origin), {
   method: "POST",
   headers: { "Content-Type": "application/json" },
   body: JSON.stringify(body)
@@ -13057,8 +13102,8 @@ async function alreadyConnected(existing, { forTeam, ownIdentity }) {
   const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
   const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
   if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
-  const path7 = (own ?? forTeam(existing.orgId)[0])?.path;
-  return { status: "identity_unusable", ...runner, problem, ...path7 ? { path: path7 } : {} };
+  const path10 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path10 ? { path: path10 } : {} };
 }
 async function connectWithCode({
   code,
@@ -13130,20 +13175,20 @@ async function saveIdentity(origin, credential, { single, forTeam }, directory)
     name: credential.name
   });
   const replaced = [];
-  for (const { path: path8 } of forTeam(credential.orgId)) {
-    const aside = `${path8}.replaced-${Date.now()}`;
-    await rename(path8, aside);
+  for (const { path: path11 } of forTeam(credential.orgId)) {
+    const aside = `${path11}.replaced-${Date.now()}`;
+    await rename(path11, aside);
     replaced.push(aside);
   }
-  const path7 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  const path10 = single ?? teamIdentityPath(origin, credential.orgId, directory);
   try {
-    await writeIdentityOnce(path7, JSON.stringify(config, null, 2) + "\n");
+    await writeIdentityOnce(path10, JSON.stringify(config, null, 2) + "\n");
   } catch (error) {
     if (error.code === "EEXIST")
-      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path7} meanwhile; it was left unchanged.`);
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path10} meanwhile; it was left unchanged.`);
     throw error;
   }
-  return { status: "connected", config, path: path7, replaced };
+  return { status: "connected", config, path: path10, replaced };
 }
 function pathSegment(value) {
   const segment = encodeURIComponent(value);
@@ -13183,7 +13228,7 @@ async function refuseExisting(target) {
   throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
 }
 async function disconnectRunner({
-  identity: { path: path7, config },
+  identity: { path: path10, config },
   serviceManager,
   othersRemain
 }) {
@@ -13216,7 +13261,7 @@ async function disconnectRunner({
     await restore();
     throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
   }
-  await forgetRunner(path7);
+  await forgetRunner(path10);
   if (othersRemain) await restore();
   else await serviceManager?.remove();
   return result;
@@ -13350,18 +13395,18 @@ async function runRunnerCommandV2(input, options = {}) {
             `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-        const { config, path: path7, replaced } = outcome;
+        const { config, path: path10, replaced } = outcome;
         for (const aside of replaced)
           process.stdout.write(
             `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
 `
           );
         process.stdout.write(
-          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path7}.
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path10}.
 `
         );
         if (services) {
-          const service = await ensureService(services, config, path7);
+          const service = await ensureService(services, config, path10);
           process.stdout.write(`${serviceStarted(service)}
 `);
           return 0;
@@ -13370,7 +13415,7 @@ async function runRunnerCommandV2(input, options = {}) {
           process.stdout.write(
             "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
           );
-        await runConfiguredRunner(path7, options.signal);
+        await runConfiguredRunner(path10, options.signal);
         return 0;
       }
       case "disconnect": {
@@ -13444,9 +13489,9 @@ async function runRunnerCommandV2(input, options = {}) {
               configured: true,
               // One entry per Team this machine serves; credentials are never printed.
               teams: identities.map(
-                ({ path: path7, config: { token: _token, ...config } }) => ({
+                ({ path: path10, config: { token: _token, ...config } }) => ({
                   ...config,
-                  path: path7
+                  path: path10
                 })
               ),
               service: service ? {
@@ -13513,14 +13558,1248 @@ async function recoveryIdentity(runId) {
   throw new Error(`No Runner on this machine holds Run ${runId}.`);
 }
 
+// src/app/entry/buildCommand.ts
+import { execFileSync } from "child_process";
+
+// src/core/build/planCommand.ts
+import fs6 from "fs";
+import path6 from "path";
+
+// src/core/build/io.ts
+import fs5 from "fs";
+import path5 from "path";
+var BuildUsageError = class extends Error {
+};
+var PlanFailure = class extends Error {
+};
+function requireEnv(env2, name) {
+  const value = env2[name];
+  if (!value)
+    throw new BuildUsageError(
+      `${name} is not set: drisp build runs inside an Orchestrator Run.`
+    );
+  return value;
+}
+function readJson(file) {
+  try {
+    return JSON.parse(fs5.readFileSync(file, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeFile(file, content) {
+  fs5.mkdirSync(path5.dirname(file), { recursive: true });
+  fs5.writeFileSync(file, content, "utf-8");
+}
+var json = (value) => `${JSON.stringify(value, null, 2)}
+`;
+function readInput(file) {
+  const raw = readJson(file);
+  if (raw === void 0)
+    throw new PlanFailure(`Could not read plan-input.json at ${file}.`);
+  const parsed = planInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new PlanFailure(
+      `plan-input.json is invalid at ${issue.path.join(".") || "(root)"}: ${issue.message}`
+    );
+  }
+  return parsed.data;
+}
+
+// src/core/workflows/builtins/build-child/version.ts
+import { createHash } from "crypto";
+function computeTemplateVersion() {
+  const parts = [
+    WORKFLOW_MD_TEMPLATE,
+    STAGE_TEMPLATE,
+    CANNOT_PASS_TEMPLATE,
+    NO_GATE_TEXT_TEMPLATE,
+    DESCRIPTION_TEMPLATE,
+    JSON.stringify(QA_SECTIONS),
+    JSON.stringify(GATES),
+    JSON.stringify(RENDERER_RULES),
+    JSON.stringify(LAYOUT_MARKERS)
+  ];
+  const hash = createHash("sha256");
+  for (const part of parts) hash.update(`${part.length}:${part}`);
+  return hash.digest("hex");
+}
+var templateVersion = computeTemplateVersion();
+
+// src/core/build/planCommand.ts
+function checkGenerated(directory, workflow, host, layout) {
+  const workflowJson = fs6.readFileSync(
+    path6.join(directory, "workflow.json"),
+    "utf-8"
+  );
+  const workflowMd = fs6.readFileSync(
+    path6.join(directory, "workflow.md"),
+    "utf-8"
+  );
+  try {
+    parseWorkflowConfig(JSON.parse(workflowJson), {
+      instructions: workflowMd,
+      host
+    });
+  } catch (error) {
+    throw new PlanFailure(
+      `${workflow.identifier}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const verified = verifyRendered({
+    fill: workflow.fill,
+    layout,
+    workflowName: workflow.workflowName,
+    workflowJson,
+    workflowMd
+  });
+  if (!verified.ok)
+    throw new PlanFailure(
+      `${workflow.identifier}: the written ${verified.file} does not match what its fill renders.`
+    );
+}
+function runBuildPlan(deps) {
+  const orchestratorRunId = requireEnv(deps.env, "DRISP_RUN_ID");
+  const runnerId = requireEnv(deps.env, "DRISP_RUNNER_ID");
+  const artifacts = requireEnv(deps.env, "DRISP_RUN_ARTIFACTS");
+  const fixtureInput = deps.env["DRISP_BUILD_PLAN_INPUT"];
+  const inputPath = fixtureInput ?? deps.inputPath;
+  if (!inputPath)
+    throw new BuildUsageError("Usage: drisp build plan --input <path>");
+  const fail = (reason) => {
+    writeFile(path6.join(artifacts, "build_plan_error.json"), json({ reason }));
+    return { status: "failed", reason };
+  };
+  try {
+    if (!isGitHubRepository(deps.folder))
+      throw new PlanFailure(BUILD_STRINGS.notAGitHubRepository);
+    const input = readInput(path6.resolve(deps.folder, inputPath));
+    const worktree = ensureBuildWorktree({
+      folder: deps.folder,
+      slugId: input.project.slugId,
+      worktreesRoot: deps.worktreesRoot
+    });
+    const designDir = path6.join(
+      worktree.path,
+      ".athena",
+      "workflows",
+      input.project.slugId
+    );
+    writeFile(path6.join(designDir, "plan-input.json"), json(input));
+    const fixtureDir = fixtureInput ? path6.dirname(path6.resolve(fixtureInput)) : void 0;
+    const fillPath = (identifier) => path6.join(designDir, identifier, "fill.json");
+    const fills = Object.fromEntries(
+      input.issues.map((issue) => {
+        const fixture = fixtureDir ? path6.join(fixtureDir, "fills", `${issue.identifier}.json`) : void 0;
+        const file = fixture && fs6.existsSync(fixture) ? fixture : fillPath(issue.identifier);
+        return [issue.identifier, readJson(file)];
+      })
+    );
+    const fixturePullRequests = fixtureDir ? readJson(path6.join(fixtureDir, "pull-requests.json")) : void 0;
+    const pullRequests = fixturePullRequests ?? Object.fromEntries(
+      input.issues.filter(
+        (issue) => issue.branchName && issue.state.type !== "canceled" && !issue.labels.includes("ready-for-human")
+      ).map((issue) => [
+        issue.branchName,
+        deps.pullRequests(deps.folder, issue.branchName)
+      ])
+    );
+    const layout = repoLayoutAt(worktree.path, "HEAD");
+    const result = planBuild({
+      input,
+      fills,
+      pullRequests,
+      orchestratorRunId,
+      folder: deps.folder,
+      runnerId,
+      templateVersion,
+      layout
+    });
+    if (result.status === "failed") return fail(result.reason);
+    if (result.status === "needs_fills")
+      return {
+        status: "needs_fills",
+        templateVersion,
+        fills: result.fills.map((fill) => ({
+          ...fill,
+          path: fillPath(fill.identifier)
+        }))
+      };
+    const host = deps.hostCapabilities();
+    for (const workflow of result.workflows) {
+      const directory = path6.join(designDir, workflow.identifier);
+      writeFile(path6.join(directory, "fill.json"), json(workflow.fill));
+      writeFile(path6.join(directory, "workflow.json"), workflow.workflowJson);
+      writeFile(path6.join(directory, "workflow.md"), workflow.workflowMd);
+      checkGenerated(directory, workflow, host, layout);
+    }
+    const relativeDesignDir = path6.relative(worktree.path, designDir);
+    commitBuildFiles(
+      worktree.path,
+      [relativeDesignDir],
+      `drisp build: Generated Workflows for ${input.project.slugId}`
+    );
+    const commit = lastCommitTouching(worktree.path, relativeDesignDir, [
+      path6.join(relativeDesignDir, "plan.json")
+    ]);
+    const plan = finalizePlan(result.plan, commit);
+    writeFile(path6.join(designDir, "plan.json"), json(plan));
+    commitBuildFiles(
+      worktree.path,
+      [path6.join(relativeDesignDir, "plan.json")],
+      `drisp build: Run plan for ${input.project.slugId}`
+    );
+    writeFile(path6.join(artifacts, "build_plan.json"), json(plan));
+    return {
+      status: "planned",
+      entries: plan.groups.reduce((sum, group) => sum + group.issues.length, 0),
+      skipped: plan.skipped.length
+    };
+  } catch (error) {
+    if (error instanceof BuildUsageError) throw error;
+    return fail(error instanceof Error ? error.message : String(error));
+  }
+}
+
+// src/core/build/tick.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import fs7 from "fs";
+import path7 from "path";
+
+// ../../packages/client/src/index.ts
+var runArtifactSchema = external_exports.object({ name: external_exports.string(), seq: external_exports.number().int(), json: external_exports.json() });
+var githubRepositorySchema = external_exports.object({
+  installationId: external_exports.number().int().positive(),
+  repositoryId: external_exports.number().int().positive(),
+  owner: external_exports.string(),
+  name: external_exports.string(),
+  defaultBranch: external_exports.string()
+});
+var ClientError = class extends Error {
+  constructor(code, status) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+  code;
+  status;
+};
+var DrispClient = class _DrispClient {
+  constructor(baseUrl, orgId, token) {
+    this.baseUrl = baseUrl;
+    this.orgId = orgId;
+    this.token = token;
+    const url = new URL(baseUrl);
+    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      throw new Error("TLS_required");
+  }
+  baseUrl;
+  orgId;
+  token;
+  /**
+   * A client that authenticates with a Run's delegation token (root ADR-0008), from the agent's environment:
+   * `hubUrl` is `DRISP_HUB_URL`, the Team-scoped base `https://<hub>/v2/orgs/<orgId>`, and `token` is
+   * `DRISP_RUN_TOKEN`. The token starts, cancels and reads only its own Run's children.
+   */
+  static delegated(hubUrl, token) {
+    const url = new URL(hubUrl);
+    const match = /^\/v2\/orgs\/([^/]+)\/?$/.exec(url.pathname);
+    if (!match) throw new Error("invalid_hub_url");
+    return new _DrispClient(url.origin, decodeURIComponent(match[1]), async () => token);
+  }
+  async request(path10, body) {
+    const response = await fetch(
+      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path10}`,
+      {
+        method: body === void 0 ? "GET" : "POST",
+        headers: {
+          Authorization: `Bearer ${await this.token()}`,
+          "Content-Type": "application/json"
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      }
+    );
+    const result = await response.json();
+    if (!response.ok)
+      throw new ClientError(result.error ?? `HTTP ${response.status}`, response.status);
+    return result;
+  }
+  submit(command) {
+    return this.request("/commands", commandSchema.parse(command));
+  }
+  /** The recent Runs; with a filter, every Run carrying that key or every child of that Run, newest first. */
+  async runs(filter) {
+    const query = !filter ? "" : "key" in filter ? `?key=${encodeURIComponent(filter.key)}` : `?parent=${encodeURIComponent(filter.parent)}`;
+    return external_exports.object({ hubEpoch: external_exports.string(), runs: external_exports.array(runViewSchema) }).parse(await this.request(`/runs${query}`));
+  }
+  /** The newest `run.artifact` named `name` that the Run reported; `not_found` when it reported none. */
+  async artifact(runId, name) {
+    return runArtifactSchema.parse(
+      await this.request(`/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(name)}`)
+    );
+  }
+  async run(runId) {
+    return runViewSchema.parse(await this.request(`/runs/${encodeURIComponent(runId)}`));
+  }
+  history(runId, after = 0) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/history?after=${after}`);
+  }
+  async runners() {
+    return runnerListSchema.parse(await this.request("/runners"));
+  }
+  /** A one-use Connect code bound to the signed-in member, for `drisp runner connect <code>` (root ADR-0005). */
+  async createConnectCode(hubEpoch) {
+    return connectCodeResponseSchema.parse(await this.request("/runners/connect-codes", { hubEpoch }));
+  }
+  /** Rename a Runner, set its capacity, or change its Audience (root ADR-0005). */
+  async updateRunner(hubEpoch, runnerId, update) {
+    const body = runnerUpdateRequestSchema.parse({ hubEpoch, ...update });
+    return runnerListEntrySchema.parse(await this.request(`/runners/${encodeURIComponent(runnerId)}`, body));
+  }
+  /** Admin only: where a member's Runs go when they have no ready Personal Runner; `null` clears it. */
+  async setTeamDefault(hubEpoch, teamDefault) {
+    const body = teamDefaultRequestSchema.parse({ hubEpoch, teamDefault });
+    return external_exports.object({ teamDefault: teamDefaultSchema.nullable() }).parse(await this.request("/team-default", body));
+  }
+  /** The Runs a Disconnect of `runnerId` would stop, for its confirmation. */
+  async disconnectPreview(runnerId) {
+    return runnerDisconnectPreviewSchema.parse(
+      await this.request(`/runners/${encodeURIComponent(runnerId)}/disconnect`)
+    );
+  }
+  /** Disconnect (root ADR-0005): the Runner leaves the Team and its open Runs are Stopped. */
+  async disconnectRunner(hubEpoch, runnerId) {
+    return runnerDisconnectResponseSchema.parse(
+      await this.request(`/runners/${encodeURIComponent(runnerId)}/disconnect`, { hubEpoch })
+    );
+  }
+  /** Admin only: take over a Runner paused as "Needs an owner" because its member left, so it serves again. */
+  async adoptRunner(hubEpoch, runnerId) {
+    const body = runnerAdoptRequestSchema.parse({ hubEpoch });
+    return runnerListEntrySchema.parse(await this.request(`/runners/${encodeURIComponent(runnerId)}/adopt`, body));
+  }
+  submitManaged(profileId, command, repository) {
+    return this.request("/managed-runs", {
+      profileId,
+      ...repository,
+      command: commandSchema.parse(command)
+    });
+  }
+  async repositories() {
+    const schema = external_exports.object({
+      configured: external_exports.boolean(),
+      installationUrl: external_exports.string().url().optional(),
+      repositories: external_exports.array(repositoryBindingSchema)
+    });
+    try {
+      return schema.parse(await this.request("/repositories"));
+    } catch (error) {
+      if (error instanceof ClientError && error.status === 404 && error.code === "not_found")
+        return schema.parse({ configured: false, repositories: [] });
+      throw error;
+    }
+  }
+  async connectGitHub(hubEpoch) {
+    return external_exports.object({
+      connectionId: external_exports.string(),
+      userCode: external_exports.string(),
+      verificationUri: external_exports.string().url(),
+      expiresAt: external_exports.number(),
+      interval: external_exports.number(),
+      installationUrl: external_exports.string().url()
+    }).parse(await this.request("/github/device", { hubEpoch }));
+  }
+  async pollGitHub(hubEpoch, connectionId) {
+    return external_exports.discriminatedUnion("state", [
+      external_exports.object({ state: external_exports.literal("pending"), interval: external_exports.number() }),
+      external_exports.object({
+        state: external_exports.literal("authorized"),
+        authorizationId: external_exports.string(),
+        expiresAt: external_exports.number(),
+        repositories: external_exports.array(githubRepositorySchema)
+      })
+    ]).parse(await this.request("/github/device/poll", { hubEpoch, connectionId }));
+  }
+  async bindRepository(hubEpoch, authorizationId, repository, settings) {
+    return repositoryBindingSchema.parse(
+      await this.request("/repositories", {
+        hubEpoch,
+        authorizationId,
+        installationId: repository.installationId,
+        repositoryId: repository.repositoryId,
+        ...settings
+      })
+    );
+  }
+  async updateRepository(hubEpoch, id, settings) {
+    return repositoryBindingSchema.parse(
+      await this.request(`/repositories/${encodeURIComponent(id)}`, {
+        hubEpoch,
+        ...settings
+      })
+    );
+  }
+  disconnectRepository(hubEpoch, id) {
+    return this.request(`/repositories/${encodeURIComponent(id)}/disconnect`, { hubEpoch });
+  }
+  receipt(commandId) {
+    return this.request(`/commands/${encodeURIComponent(commandId)}`);
+  }
+  deleteSession(hubEpoch, sessionId) {
+    return this.request("/sessions/delete", { hubEpoch, sessionId });
+  }
+  async pendingDevice(code) {
+    return external_exports.object({ name: external_exports.string() }).parse(await this.request(`/auth/device?code=${encodeURIComponent(code)}`));
+  }
+  /** Approves the macOS app's sign-in for this client's Team: the token is bound to it. */
+  approveDevice(userCode) {
+    return this.request("/auth/device/approve", { userCode });
+  }
+  /** The machine asking to Connect with a code it printed (`drisp runner connect` with no code; root ADR-0005). */
+  async pendingConnect(code) {
+    return connectPendingResponseSchema.parse(await this.request(`/runners/connect/pending?code=${encodeURIComponent(code)}`));
+  }
+  /** Connects the machine that printed `code` to this client's Team, as a Runner with `audience`. Team needs an admin. */
+  approveConnect(code, audience, hubEpoch) {
+    return this.request("/runners/connect/approve", { code, audience, ...hubEpoch === void 0 ? {} : { hubEpoch } });
+  }
+  /** Refuses the machine that printed `code`; its wait ends without a credential. */
+  denyConnect(code) {
+    return this.request("/runners/connect/deny", { code });
+  }
+  async historyPage(runId, after = 0) {
+    const page = external_exports.object({
+      through: external_exports.number(),
+      archives: external_exports.array(
+        external_exports.object({
+          id: external_exports.string(),
+          checksum: external_exports.string(),
+          first_seq: external_exports.number(),
+          last_seq: external_exports.number()
+        })
+      ),
+      batches: external_exports.array(external_exports.object({ firstSeq: external_exports.number(), records: external_exports.array(historyRecordSchema) }))
+    }).parse(await this.history(runId, after));
+    const records = [];
+    const archive = page.archives[0];
+    if (archive) {
+      const response = await fetch(
+        `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}/runs/${encodeURIComponent(runId)}/objects/${encodeURIComponent(archive.id)}`,
+        { headers: { Authorization: `Bearer ${await this.token()}` } }
+      );
+      if (!response.ok) throw new Error(`history_download_${response.status}`);
+      const bytes = await response.arrayBuffer();
+      const checksum = [...new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+      if (checksum !== archive.checksum) throw new Error("history_integrity_failure");
+      const text = await new Response(
+        new Blob([bytes]).stream().pipeThrough(new DecompressionStream("gzip"))
+      ).text();
+      for (const line of text.trim().split("\n"))
+        records.push(
+          external_exports.object({ seq: external_exports.number(), record: historyRecordSchema }).parse(JSON.parse(line))
+        );
+    }
+    for (const batch of page.batches)
+      batch.records.forEach(
+        (record, index) => records.push({ seq: batch.firstSeq + index, record })
+      );
+    records.sort((a, b) => a.seq - b.seq);
+    let through = after;
+    const contiguous = [];
+    for (const row of records) {
+      if (row.seq <= through) continue;
+      if (row.seq !== through + 1) break;
+      contiguous.push(row);
+      through = row.seq;
+    }
+    if (through === after && page.through > after) throw new Error("history_gap");
+    return { through, availableThrough: page.through, records: contiguous };
+  }
+  watch(hubEpoch, runIds, update, error) {
+    let stopped = false;
+    let socket;
+    let timer;
+    let delay = 250;
+    const runs = /* @__PURE__ */ new Map();
+    const connect = async () => {
+      try {
+        const { ticket } = external_exports.object({ ticket: external_exports.string() }).parse(await this.request("/connect-ticket", { hubEpoch }));
+        if (stopped) return;
+        const endpoint = new URL(
+          `/v2/orgs/${encodeURIComponent(this.orgId)}/connect`,
+          this.baseUrl
+        );
+        endpoint.protocol = endpoint.protocol === "https:" ? "wss:" : "ws:";
+        const ws = new WebSocket(endpoint, ["drisp-v2", `ticket.${ticket}`]);
+        socket = ws;
+        ws.onopen = () => ws.send(JSON.stringify({ type: "watch", hubEpoch, runIds }));
+        ws.onmessage = (event) => {
+          try {
+            if (typeof event.data !== "string" || new TextEncoder().encode(event.data).length > 8 * 1024 * 1024)
+              throw new Error("frame_too_large");
+            const message = JSON.parse(String(event.data));
+            if (message.type === "error") throw new Error(message.code);
+            if (message.hubEpoch !== hubEpoch) throw new Error("recovery_required");
+            const header = external_exports.object({ subscriptionId: external_exports.string(), type: external_exports.enum(["snapshot", "change"]) }).parse(message);
+            let through;
+            if (header.type === "snapshot") {
+              const snapshot = external_exports.object({
+                controlThrough: external_exports.number().int().nonnegative(),
+                runs: external_exports.array(runViewSchema)
+              }).parse(message);
+              runs.clear();
+              for (const run of snapshot.runs) runs.set(run.runId, run);
+              through = snapshot.controlThrough;
+            } else {
+              const change = external_exports.object({
+                through: external_exports.number().int().nonnegative(),
+                runs: external_exports.array(external_exports.object({ seq: external_exports.number(), run: runViewSchema }))
+              }).parse(message);
+              for (const { run } of change.runs)
+                if ((runs.get(run.runId)?.recordRevision ?? 0) < run.recordRevision)
+                  runs.set(run.runId, run);
+              through = change.through;
+            }
+            update([...runs.values()]);
+            delay = 250;
+            ws.send(
+              JSON.stringify({ type: "watch.ack", subscriptionId: header.subscriptionId, through })
+            );
+          } catch (cause) {
+            if (cause instanceof Error && cause.message === "reset_required") {
+              ws.close();
+              return;
+            }
+            stopped = true;
+            error(cause);
+            ws.close();
+          }
+        };
+        ws.onclose = () => {
+          if (!stopped) {
+            timer = setTimeout(() => {
+              void connect();
+            }, delay);
+            delay = Math.min(delay * 2, 3e4);
+          }
+        };
+      } catch (cause) {
+        if (stopped) return;
+        error(cause);
+        if (cause instanceof ClientError && cause.status < 500 && cause.status !== 429) return;
+        timer = setTimeout(() => {
+          void connect();
+        }, delay);
+        delay = Math.min(delay * 2, 3e4);
+      }
+    };
+    void connect();
+    return () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+      socket?.close();
+    };
+  }
+};
+
+// src/core/build/state.ts
+var ATTEMPT_OUTCOMES = [
+  "completed",
+  "failed",
+  "cancelled",
+  "template_mismatch"
+];
+var attemptSchema = external_exports.strictObject({
+  n: external_exports.number().int().min(1).max(2),
+  runId: external_exports.string().min(1),
+  tokenCap: external_exports.number().int().positive(),
+  startedAt: external_exports.string(),
+  /** Where the attempt worked (chosen while building slice 2): later ticks check its PR and remove its worktree. */
+  branch: external_exports.string().min(1),
+  worktree: external_exports.string().min(1),
+  outcome: external_exports.enum(ATTEMPT_OUTCOMES).optional()
+});
+var buildStateSchema = external_exports.strictObject({
+  version: external_exports.literal(1),
+  orchestratorRunId: external_exports.string().min(1),
+  projectId: external_exports.string().min(1),
+  slugId: external_exports.string().regex(/^[a-z0-9]+$/),
+  templateVersion: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  approvedAt: external_exports.string(),
+  approved: external_exports.strictObject({ groups: external_exports.array(external_exports.array(external_exports.string())) }),
+  attempts: external_exports.record(external_exports.string(), external_exports.array(attemptSchema)),
+  needsPerson: external_exports.record(external_exports.string(), external_exports.string()),
+  tickCount: external_exports.number().int().nonnegative(),
+  lastTickAt: external_exports.string(),
+  /**
+   * Additive (chosen while building slice 3): the entries a tick had seen done, for rebasing parked children's
+   * branches after a merge. No longer written since slice 4 (a parked child rebases itself), still read so a state
+   * written before parses.
+   */
+  done: external_exports.array(external_exports.string()).optional(),
+  /** The merged issues the Orchestrator was already asked to repair in Linear, so it is asked once. */
+  repaired: external_exports.array(external_exports.string()).optional()
+});
+
+// src/core/build/childStart.ts
+function childRunId(orchestratorRunId, identifier, attempt) {
+  return `${orchestratorRunId}:${identifier}:a${attempt}`;
+}
+function childPrompt(child) {
+  return [
+    `${child.identifier} ${child.title}`,
+    `Linear: ${child.url}`,
+    `Branch: ${child.branch}`,
+    `Worktree: ${child.worktree}`,
+    `Build: ${child.orchestratorRunId}`
+  ].join("\n");
+}
+function childStartIntent(child, parent) {
+  const runId = childRunId(
+    child.orchestratorRunId,
+    child.identifier,
+    child.attempt
+  );
+  return {
+    runId,
+    intent: {
+      kind: "start",
+      sessionId: runId,
+      runnerId: parent.runnerId,
+      scope: parent.scope,
+      key: `issue:${child.issueId}`,
+      parent: { runId: child.orchestratorRunId, tokenCap: child.tokenCap },
+      spec: {
+        prompt: childPrompt(child),
+        projectDir: child.worktree,
+        harness: "claude-code",
+        workflow: child.workflowName
+      }
+    }
+  };
+}
+
+// src/core/build/tickDecision.ts
+var MAX_ATTEMPTS = 2;
+function mayRetry(attempts) {
+  return attempts.length < MAX_ATTEMPTS && attempts.at(-1)?.outcome === "failed";
+}
+var STOPPED_CLOSE_REASONS = /* @__PURE__ */ new Set(["cancelled_before_start", "abandoned"]);
+function outcomeOf(view) {
+  if (view.closeReason === "workflow_template_mismatch")
+    return "template_mismatch";
+  const status = view.execution?.status;
+  if (status === "completed" || status === "failed" || status === "cancelled")
+    return status;
+  if (view.cancellation || STOPPED_CLOSE_REASONS.has(view.closeReason ?? ""))
+    return "cancelled";
+  return "failed";
+}
+function buildLimits(own, delegation) {
+  if (!delegation) return own;
+  return {
+    ...own,
+    maxChildren: Math.min(own.maxChildren, delegation.maxChildren),
+    tokenBudget: Math.min(own.tokenBudget, delegation.tokenBudget)
+  };
+}
+function occupies(view) {
+  return !view || !view.closed && view.execution?.status !== "awaiting_attention";
+}
+function assessTick(facts) {
+  const { entries, orchestratorRunId } = facts;
+  const state = structuredClone(facts.state);
+  const views = new Map(facts.children.map((view) => [view.runId, view]));
+  const issues = new Map(facts.issues.map((issue) => [issue.id, issue]));
+  const attemptsOf = (id) => state.attempts[id] ?? [];
+  for (const entry of entries) {
+    const prefix = `${orchestratorRunId}:${entry.identifier}:a`;
+    for (const view of facts.children) {
+      if (!view.runId.startsWith(prefix)) continue;
+      const n = Number(view.runId.slice(prefix.length));
+      if (!(n === 1 || n === 2)) continue;
+      if (attemptsOf(entry.id).some((a) => a.runId === view.runId)) continue;
+      state.attempts[entry.id] = [
+        ...attemptsOf(entry.id),
+        {
+          n,
+          runId: view.runId,
+          tokenCap: view.parent?.tokenCap ?? entry.tokenCap,
+          startedAt: facts.now,
+          ...facts.locate(entry)
+        }
+      ].sort((a, b) => a.n - b.n);
+    }
+  }
+  for (const attempts of Object.values(state.attempts))
+    for (const attempt of attempts) {
+      const view = views.get(attempt.runId);
+      if (view?.closed && !attempt.outcome) attempt.outcome = outcomeOf(view);
+    }
+  const branchOf = (entry) => attemptsOf(entry.id).at(-1)?.branch ?? facts.locate(entry).branch;
+  for (const identifier of facts.rebaseFailed) {
+    const entry = entries.find((each) => each.identifier === identifier);
+    if (entry)
+      state.needsPerson[entry.id] = BUILD_STRINGS.rebaseFailed(branchOf(entry));
+  }
+  const pullRequests = /* @__PURE__ */ new Map();
+  const prsOf = (entry) => {
+    const branch = attemptsOf(entry.id).at(-1)?.branch ?? issues.get(entry.id)?.branchName;
+    if (!branch) return void 0;
+    if (!pullRequests.has(branch))
+      pullRequests.set(branch, facts.pullRequests(branch));
+    return pullRequests.get(branch);
+  };
+  const status = /* @__PURE__ */ new Map();
+  const skippedBlocker = (id) => {
+    const linear = issues.get(id)?.state.type;
+    return linear === "completed" || linear === "canceled" ? "done" : "blocked";
+  };
+  const repair = [];
+  const repaired = new Set(state.repaired ?? []);
+  for (const entry of entries) {
+    const attempts = attemptsOf(entry.id);
+    const newest = attempts.at(-1);
+    const view = newest && views.get(newest.runId);
+    const linear = issues.get(entry.id)?.state.type;
+    const statusOf = () => {
+      if (linear === "completed" || linear === "canceled") return "done";
+      const prs = prsOf(entry);
+      if (prs?.merged) {
+        if (!repaired.has(entry.id) && !(newest && occupies(view))) {
+          const prUrl = prs.mergedUrl ?? branchOf(entry);
+          repair.push({
+            id: entry.id,
+            identifier: entry.identifier,
+            prUrl,
+            comment: BUILD_STRINGS.repairComment(prUrl, orchestratorRunId)
+          });
+          repaired.add(entry.id);
+        }
+        return "done";
+      }
+      if (newest && (!view || !view.closed)) return "live";
+      if (newest?.outcome === "template_mismatch") return "replan";
+      if (newest?.outcome === "completed")
+        state.needsPerson[entry.id] ??= BUILD_STRINGS.completedUnmerged;
+      if (state.needsPerson[entry.id] || newest && !mayRetry(attempts))
+        return "needs_person";
+      const blockers = entry.blockedBy.map(
+        (id) => status.get(id) ?? skippedBlocker(id)
+      );
+      if (blockers.some(
+        (b) => b === "needs_person" || b === "replan" || b === "blocked"
+      ))
+        return "blocked";
+      return blockers.every((b) => b === "done") ? "ready" : "pending";
+    };
+    status.set(entry.id, statusOf());
+    if (status.get(entry.id) === "done" && state.needsPerson[entry.id] === BUILD_STRINGS.completedUnmerged)
+      delete state.needsPerson[entry.id];
+  }
+  if (repaired.size > 0) state.repaired = [...repaired];
+  let parkReason = facts.templateVersion !== state.templateVersion ? "template" : state.tickCount >= facts.limits.tickAllowance ? "budget" : void 0;
+  const occupying = entries.filter((entry) => {
+    const newest = attemptsOf(entry.id).at(-1);
+    return newest !== void 0 && occupies(views.get(newest.runId));
+  }).length;
+  const queue = [];
+  if (!parkReason) {
+    let capped = Object.values(state.attempts).flat().reduce((sum, attempt) => sum + attempt.tokenCap, 0);
+    for (const entry of entries) {
+      if (status.get(entry.id) !== "ready") continue;
+      if (capped + entry.tokenCap > facts.limits.tokenBudget) {
+        parkReason = "budget";
+        break;
+      }
+      queue.push(entry);
+      capped += entry.tokenCap;
+    }
+  }
+  return {
+    state,
+    status,
+    repair,
+    queue,
+    slots: Math.max(0, facts.limits.maxChildren - occupying),
+    ...parkReason ? { parkReason } : {}
+  };
+}
+function tickAction(input) {
+  const live = input.children.filter((view) => !view.closed);
+  if (input.started > 0 || live.some((view) => occupies(view)))
+    return { action: "wait" };
+  const remaining = input.entries.some(
+    (entry) => ["ready", "pending"].includes(input.status.get(entry.id))
+  );
+  if (input.parkReason && remaining)
+    return {
+      action: "park",
+      reason: input.parkReason,
+      message: input.parkReason === "budget" ? BUILD_STRINGS.budgetPark : BUILD_STRINGS.templatePark
+    };
+  if (live.length > 0) return { action: "wait" };
+  const done = input.entries.filter(
+    (entry) => input.status.get(entry.id) === "done"
+  ).length;
+  return {
+    action: "complete",
+    message: `Built ${done} of ${input.entries.length}`
+  };
+}
+
+// src/core/build/tick.ts
+var UNAVAILABLE_RETRY_MS = 2e3;
+var UNAVAILABLE_RETRY_FOR_MS = 3e4;
+var NEVER = (/* @__PURE__ */ new Date(0)).toISOString();
+var notStarted = () => ({
+  action: "complete",
+  message: BUILD_STRINGS.notStarted
+});
+function pushBranch(worktree, branch) {
+  git(worktree, ["push", "--quiet", "origin", `${branch}:${branch}`]);
+}
+async function startChild(deps, hubEpoch, start) {
+  for (let waited = 0; ; waited += UNAVAILABLE_RETRY_MS) {
+    try {
+      await deps.hub.submit({
+        commandId: randomUUID2(),
+        hubEpoch,
+        runId: start.runId,
+        intent: start.intent
+      });
+      return { kind: "started" };
+    } catch (error) {
+      if (!(error instanceof ClientError) || error.status >= 500)
+        return { kind: "unreachable" };
+      if (error.code === "key_busy") return { kind: "key_busy" };
+      if (error.code === "delegation_budget_exhausted") return { kind: "budget" };
+      if (error.code !== "workflow_unavailable")
+        return { kind: "refused", code: error.code };
+      if (waited >= UNAVAILABLE_RETRY_FOR_MS) return { kind: "unavailable" };
+      await deps.sleep(UNAVAILABLE_RETRY_MS);
+    }
+  }
+}
+function currentPlan(plan, state) {
+  const { needsPerson: _previous, ...approved } = plan;
+  const entries = plan.groups.flatMap((group) => group.issues);
+  const needsPerson = entries.filter((entry) => state.needsPerson[entry.id]).map((entry) => ({ id: entry.id, reason: state.needsPerson[entry.id] }));
+  return needsPerson.length > 0 ? { ...approved, needsPerson } : approved;
+}
+async function runBuildTick(deps) {
+  const orchestratorRunId = requireEnv(deps.env, "DRISP_RUN_ID");
+  const runnerId = requireEnv(deps.env, "DRISP_RUNNER_ID");
+  const artifacts = requireEnv(deps.env, "DRISP_RUN_ARTIFACTS");
+  if (!deps.inputPath)
+    throw new BuildUsageError("Usage: drisp build tick --input <path>");
+  let input;
+  try {
+    input = readInput(path7.resolve(deps.folder, deps.inputPath));
+  } catch (error) {
+    if (error instanceof PlanFailure) throw new BuildUsageError(error.message);
+    throw error;
+  }
+  const worktree = ensureBuildWorktree({
+    folder: deps.folder,
+    slugId: input.project.slugId,
+    worktreesRoot: deps.worktreesRoot
+  });
+  const designDir = path7.join(
+    worktree.path,
+    ".athena",
+    "workflows",
+    input.project.slugId
+  );
+  const relativeDesignDir = path7.relative(worktree.path, designDir);
+  const statePath = path7.join(designDir, "build-state.json");
+  const planPath = path7.join(designDir, "plan.json");
+  const parsedPlan = buildPlanSchema.safeParse(readJson(planPath));
+  if (!parsedPlan.success || parsedPlan.data.orchestratorRunId !== orchestratorRunId)
+    return notStarted();
+  const plan = parsedPlan.data;
+  const push = deps.push ?? pushBranch;
+  let stored;
+  const parsedState = buildStateSchema.safeParse(readJson(statePath));
+  if (parsedState.success && parsedState.data.orchestratorRunId === orchestratorRunId) {
+    stored = parsedState.data;
+  } else {
+    if (!isStartAnswer(readJson(path7.join(artifacts, "answer.json"))))
+      return notStarted();
+    stored = {
+      version: 1,
+      orchestratorRunId,
+      projectId: plan.projectId,
+      slugId: input.project.slugId,
+      templateVersion: plan.templateVersion,
+      approvedAt: deps.now().toISOString(),
+      approved: {
+        groups: plan.groups.map((group) => group.issues.map((issue) => issue.id))
+      },
+      attempts: {},
+      needsPerson: {},
+      tickCount: 0,
+      lastTickAt: NEVER
+    };
+    push(worktree.path, worktree.branch);
+  }
+  if (!(Date.parse(input.readAt) > Date.parse(stored.lastTickAt)))
+    return { action: "refresh_input" };
+  stored.tickCount += 1;
+  stored.lastTickAt = deps.now().toISOString();
+  const parent = await deps.hub.run(orchestratorRunId);
+  const children = await deps.hub.runs({ parent: orchestratorRunId });
+  const approved = new Set(stored.approved.groups.flat());
+  const entries = plan.groups.flatMap((group) => group.issues).filter((entry) => approved.has(entry.id));
+  const issues = new Map(input.issues.map((issue) => [issue.id, issue]));
+  const assessment = assessTick({
+    orchestratorRunId,
+    entries,
+    issues: input.issues,
+    state: stored,
+    children: children.runs,
+    templateVersion,
+    limits: buildLimits(ORCHESTRATOR_LIMITS, parent.delegation),
+    pullRequests: (branch) => deps.pullRequests(deps.folder, branch),
+    locate: (entry) => locate(deps, entry, issues.get(entry.id)?.branchName),
+    rebaseFailed: deps.rebaseFailed ?? [],
+    now: deps.now().toISOString()
+  });
+  const { state, status } = assessment;
+  let parkReason = assessment.parkReason;
+  const record = () => {
+    writeFile(statePath, json(state));
+    const files = [path7.join(relativeDesignDir, "build-state.json")];
+    const emitted = json(currentPlan(plan, state));
+    if (emitted !== fs7.readFileSync(planPath, "utf-8")) {
+      writeFile(planPath, emitted);
+      writeFile(path7.join(artifacts, "build_plan.json"), emitted);
+      files.push(path7.join(relativeDesignDir, "plan.json"));
+    }
+    if (commitBuildFiles(
+      worktree.path,
+      files,
+      `drisp build: tick ${state.tickCount} for ${state.slugId}`
+    ))
+      push(worktree.path, worktree.branch);
+  };
+  if (assessment.repair.length > 0) {
+    record();
+    return { action: "repair", issues: assessment.repair };
+  }
+  const deferred = [];
+  const behind = [];
+  let started = 0;
+  if (assessment.queue.length > 0 && assessment.slots > 0) {
+    for (const entry of assessment.queue) {
+      if (started >= assessment.slots) break;
+      const issue = issues.get(entry.id);
+      if (!issue) continue;
+      const child = ensureChildWorktree({
+        folder: deps.folder,
+        worktreesRoot: deps.worktreesRoot,
+        issue
+      });
+      if (child.status === "needs_person") {
+        state.needsPerson[entry.id] = child.reason;
+        status.set(entry.id, "needs_person");
+        continue;
+      }
+      if (child.existed && !hasUncommittedWork(child.path) && behindMain(deps.folder, child.path)) {
+        behind.push({
+          identifier: entry.identifier,
+          worktree: child.path,
+          branch: child.branch
+        });
+        continue;
+      }
+      const entryDir = path7.join(relativeDesignDir, entry.identifier);
+      git(worktree.path, ["checkout", plan.commit, "--", entryDir]);
+      installWorkflowFromSource(
+        {
+          kind: "filesystem",
+          workflowPath: path7.join(worktree.path, entryDir, "workflow.json"),
+          version: plan.commit
+        },
+        entry.workflowName
+      );
+      const attempt = (state.attempts[entry.id]?.length ?? 0) + 1;
+      const start = childStartIntent(
+        {
+          orchestratorRunId,
+          identifier: entry.identifier,
+          issueId: entry.id,
+          title: issue.title,
+          url: issue.url,
+          branch: child.branch,
+          worktree: child.path,
+          workflowName: entry.workflowName,
+          tokenCap: entry.tokenCap,
+          attempt
+        },
+        { runnerId, scope: parent.scope }
+      );
+      const result = await startChild(deps, children.hubEpoch, start);
+      if (result.kind === "started") {
+        (state.attempts[entry.id] ??= []).push({
+          n: attempt,
+          runId: start.runId,
+          tokenCap: entry.tokenCap,
+          startedAt: deps.now().toISOString(),
+          branch: child.branch,
+          worktree: child.path
+        });
+        status.set(entry.id, "live");
+        started += 1;
+      } else if (result.kind === "key_busy")
+        deferred.push({ entry, reason: BUILD_STRINGS.keyBusy(entry.identifier) });
+      else if (result.kind === "unavailable")
+        deferred.push({
+          entry,
+          reason: BUILD_STRINGS.workflowUnavailable(entry.identifier)
+        });
+      else if (result.kind === "unreachable")
+        deferred.push({
+          entry,
+          reason: BUILD_STRINGS.hubUnreachable(entry.identifier)
+        });
+      else if (result.kind === "budget") {
+        parkReason = "budget";
+        break;
+      } else {
+        state.needsPerson[entry.id] = BUILD_STRINGS.startRefused(result.code);
+        status.set(entry.id, "needs_person");
+      }
+    }
+  }
+  const anyLive = started > 0 || children.runs.some((view) => !view.closed) || behind.length > 0;
+  if (!anyLive)
+    for (const { entry, reason } of deferred) {
+      state.needsPerson[entry.id] = reason;
+      status.set(entry.id, "needs_person");
+    }
+  const views = new Map(children.runs.map((view) => [view.runId, view]));
+  for (const entry of entries) {
+    const newest = state.attempts[entry.id]?.at(-1);
+    if (!newest || status.get(entry.id) !== "done") continue;
+    if (!views.get(newest.runId)?.closed) continue;
+    const installed = fs7.existsSync(
+      path7.join(workflowRegistryDir(), entry.workflowName)
+    );
+    if (!installed && !fs7.existsSync(newest.worktree)) continue;
+    if (!deps.pullRequests(deps.folder, newest.branch).merged) continue;
+    if (fs7.existsSync(newest.worktree)) {
+      try {
+        git(deps.folder, ["worktree", "remove", newest.worktree]);
+      } catch {
+      }
+    }
+    if (installed) removeWorkflow(entry.workflowName);
+  }
+  record();
+  if (behind.length > 0) return { action: "rebase", items: behind };
+  return tickAction({
+    entries,
+    status,
+    children: children.runs,
+    started,
+    ...parkReason ? { parkReason } : {}
+  });
+}
+function locate(deps, entry, branchName) {
+  const worktree = childWorktreePath(
+    deps.worktreesRoot,
+    deps.folder,
+    entry.identifier
+  );
+  if (fs7.existsSync(path7.join(worktree, ".git")))
+    return {
+      worktree,
+      branch: git(worktree, ["rev-parse", "--abbrev-ref", "HEAD"])
+    };
+  return {
+    worktree,
+    branch: branchName ?? fallbackBranch(entry.identifier, entry.title)
+  };
+}
+
+// src/core/build/mergeGate.ts
+var PASSED = /* @__PURE__ */ new Set([
+  "success",
+  "skipped",
+  "neutral"
+]);
+function zeroStepFailure(run) {
+  const failedJobs = run.jobs.filter((job) => !PASSED.has(job.conclusion));
+  return failedJobs.length > 0 && failedJobs.every((job) => Array.isArray(job.steps) && job.steps.length === 0);
+}
+function evaluateRemoteChecks(runs) {
+  const verdict = {
+    ok: true,
+    failed: [],
+    ignored: [],
+    pending: []
+  };
+  for (const run of runs) {
+    if (run.status !== "completed") verdict.pending.push(run.name);
+    else if (PASSED.has(run.conclusion)) continue;
+    else if (zeroStepFailure(run)) verdict.ignored.push(run.name);
+    else verdict.failed.push(run.name);
+  }
+  verdict.ok = verdict.failed.length === 0 && verdict.pending.length === 0;
+  return verdict;
+}
+
+// src/app/entry/buildCommand.ts
+var USAGE3 = `Usage: drisp build plan --input <path>
+       drisp build tick --input <path> [--rebase-failed <IDENTIFIER>]...
+       drisp build checks
+plan and tick run inside an Orchestrator Run (DRISP_RUN_ID, DRISP_RUNNER_ID and DRISP_RUN_ARTIFACTS set; tick also
+DRISP_RUN_TOKEN and DRISP_HUB_URL). DRISP_BUILD_PLAN_INPUT=<path> stands in for plan's --input, with
+fills/<IDENTIFIER>.json beside it. checks runs in a child's worktree: the merge gate's verdict on HEAD's GitHub runs.`;
+function githubPullRequests(folder, branch) {
+  const output = execFileSync(
+    "gh",
+    [
+      "pr",
+      "list",
+      "--head",
+      branch,
+      "--state",
+      "all",
+      "--json",
+      "state,url",
+      "--limit",
+      "50"
+    ],
+    { cwd: folder, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+  return parsePullRequests(output);
+}
+function parsePullRequests(output) {
+  const prs = JSON.parse(output);
+  const merged = prs.find((pr) => pr.state === "MERGED");
+  return {
+    open: prs.some((pr) => pr.state === "OPEN"),
+    merged: merged !== void 0,
+    ...merged ? { mergedUrl: merged.url } : {}
+  };
+}
+function hostCapabilities(folder) {
+  const effective = resolveEffectiveCapabilities({
+    globalConfig: readGlobalConfig(),
+    projectConfig: readConfig(folder)
+  });
+  return {
+    skills: effective.skills.map((skill) => skill.name),
+    mcpServers: effective.mcpServers.map((server) => server.name)
+  };
+}
+var defaultChecks = {
+  head: (cwd) => git(cwd, ["rev-parse", "HEAD"]),
+  gh: (args, cwd) => execFileSync("gh", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  })
+};
+function runBuildChecks(cwd, deps) {
+  const head = deps.head(cwd);
+  const runs = JSON.parse(
+    deps.gh(
+      [
+        "run",
+        "list",
+        "--commit",
+        head,
+        "--json",
+        "databaseId,name,status,conclusion",
+        "--limit",
+        "100"
+      ],
+      cwd
+    )
+  );
+  const withJobs = runs.map((run) => ({
+    name: run.name,
+    status: run.status,
+    conclusion: run.conclusion,
+    jobs: run.status === "completed" && !PASSED.has(run.conclusion) ? JSON.parse(
+      deps.gh(
+        ["run", "view", String(run.databaseId), "--json", "jobs"],
+        cwd
+      )
+    ).jobs : []
+  }));
+  return evaluateRemoteChecks(withJobs);
+}
+async function runBuildCommand(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const env2 = input.env ?? process.env;
+  try {
+    let output;
+    switch (input.subcommand) {
+      case "plan":
+        output = runBuildPlan({
+          env: env2,
+          folder: input.cwd,
+          ...input.flags.input ? { inputPath: input.flags.input } : {},
+          worktreesRoot: defaultWorktreesRoot(),
+          hostCapabilities: () => hostCapabilities(input.cwd),
+          pullRequests: githubPullRequests,
+          ...input.dependencies
+        });
+        break;
+      case "tick": {
+        requireEnv(env2, "DRISP_RUN_ID");
+        requireEnv(env2, "DRISP_RUNNER_ID");
+        requireEnv(env2, "DRISP_RUN_ARTIFACTS");
+        const token = requireEnv(env2, "DRISP_RUN_TOKEN");
+        const hubUrl = requireEnv(env2, "DRISP_HUB_URL");
+        output = await runBuildTick({
+          env: env2,
+          folder: input.cwd,
+          ...input.flags.input ? { inputPath: input.flags.input } : {},
+          ...input.flags.rebaseFailed?.length ? { rebaseFailed: input.flags.rebaseFailed } : {},
+          worktreesRoot: defaultWorktreesRoot(),
+          hub: DrispClient.delegated(hubUrl, token),
+          pullRequests: githubPullRequests,
+          now: () => /* @__PURE__ */ new Date(),
+          sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+          ...input.tick
+        });
+        break;
+      }
+      case "checks":
+        output = runBuildChecks(input.cwd, input.checks ?? defaultChecks);
+        break;
+      default:
+        stderr.write(`${USAGE3}
+`);
+        return 2;
+    }
+    stdout.write(`${JSON.stringify(output)}
+`);
+    return 0;
+  } catch (error) {
+    if (!(error instanceof BuildUsageError)) throw error;
+    stderr.write(`${error.message}
+${USAGE3}
+`);
+    return 2;
+  }
+}
+
 // src/app/entry/doctorCommand.ts
 import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync } from "child_process";
-import * as fs5 from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs8 from "fs";
 import * as os4 from "os";
-import * as path5 from "path";
+import * as path8 from "path";
 var MANAGED_POLICY_KEYS = [
   "forceLoginMethod",
   "forceLoginOrgUUID",
@@ -13595,7 +14874,7 @@ function readEnforcement(scopes) {
 }
 function tryRichAuth(claudeBinary) {
   try {
-    const output = execFileSync(claudeBinary, ["auth", "status"], {
+    const output = execFileSync2(claudeBinary, ["auth", "status"], {
       timeout: 1e4,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -13624,8 +14903,8 @@ function collectEnvironment(options = {}) {
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs5.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs5.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs8.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs8.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -13670,7 +14949,7 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path5.join(homeDir, ".claude.json"));
+    statFn(path8.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
@@ -14150,13 +15429,13 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path6.dirname(fileURLToPath(entryUrl));
+  let currentDir = path9.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path6.join(currentDir, "package.json");
-    if (fs6.existsSync(candidatePath)) {
+    const candidatePath = path9.join(currentDir, "package.json");
+    if (fs9.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path6.dirname(currentDir);
+    const parentDir = path9.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
@@ -14178,6 +15457,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "skill",
   "marketplace",
   "runner",
+  "build",
   // Deprecated alias of `runner` (#188); removed in 0.7.0.
   "dashboard",
   "telemetry",
@@ -14324,6 +15604,9 @@ var cli = meow(
 			marketplace <sub>     Manage marketplace sources (add, refresh, remove, list)
 			runner [sub]          Run the runner that connects this machine to a Team and executes its Runs
 			                      (no subcommand: foreground; connect [code] --hub <url> [--replace], disconnect [team], status, recover, help)
+			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
+			build tick --input <path>  Run one step of a started Build (prints the next action; [--rebase-failed <ID>]...)
+			build checks               The merge gate's verdict on HEAD's GitHub runs (in a child's worktree)
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -14448,6 +15731,13 @@ var cli = meow(
       hub: {
         type: "string"
       },
+      input: {
+        type: "string"
+      },
+      rebaseFailed: {
+        type: "string",
+        isMultiple: true
+      },
       foreground: {
         type: "boolean",
         default: false
@@ -14487,7 +15777,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path6.resolve(cli.flags.projectDir);
+  const projectDir = path9.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -14537,7 +15827,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-TQ4SF5KB.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-NZFBSBLY.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -14614,6 +15904,20 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     );
     return;
   }
+  if (command === "build") {
+    const [subcommand = ""] = commandArgs;
+    await exitWith(
+      await runBuildCommand({
+        subcommand,
+        flags: {
+          ...typeof cli.flags.input === "string" ? { input: cli.flags.input } : {},
+          ...cli.flags.rebaseFailed?.length ? { rebaseFailed: cli.flags.rebaseFailed } : {}
+        },
+        cwd: process.cwd()
+      })
+    );
+    return;
+  }
   if (command === "runs") {
     await exitWith(
       runRunsCommand({
@@ -14687,8 +15991,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs6.existsSync(
-      path6.join(os5.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs9.existsSync(
+      path9.join(os5.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;